From 85d8bcd75af3fc78a9150032cb1342693a8a9d67 Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Fri, 16 Jan 2026 16:53:06 +0700
Subject: [PATCH 001/596] doc/radosgw: change all intra-docs links to use ref
 (5 of 6)

Part 5 of 6 to make backporting easier. Depends on part 1.

Use the the ref role for all remaining links in doc/radosgw/ with the
exception of config-ref.rst which will depend on changes to rgw.yaml.in.

The "external link definitions" syntax being removed is intended for
linking to external websites and not for intra-docs links. Validity of
ref links will be checked during the docs build process.

Add labels for links targets if necessary.
Remove unused external link definitions in the modified files.

Use confval instead of literal text for 2 configuration keys in
vault.rst.

Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 doc/radosgw/s3-notification-compatibility.rst | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/doc/radosgw/s3-notification-compatibility.rst b/doc/radosgw/s3-notification-compatibility.rst
index efa746ba4d5..a4fc769bbea 100644
--- a/doc/radosgw/s3-notification-compatibility.rst
+++ b/doc/radosgw/s3-notification-compatibility.rst
@@ -4,7 +4,7 @@
 S3 Bucket Notifications Compatibility
 =====================================
 
-Ceph's `Bucket Notifications`_ API follows `AWS S3 Bucket Notifications API`_.
+Ceph's :ref:`radosgw-notifications` API follows `AWS S3 Bucket Notifications API`_.
 However, some differences exist, as listed below.
 
 
@@ -193,5 +193,3 @@ We also have the following extensions to topic configuration:
 .. _AWS Simple Notification Service API: https://docs.aws.amazon.com/sns/latest/api/API_Operations.html
 .. _AWS S3 Bucket Notifications API: https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html
 .. _Event Message Structure: https://docs.aws.amazon.com/AmazonS3/latest/dev/notification-content-structure.html
-.. _`Bucket Notifications`: ../notifications
-.. _`boto3 SDK filter extensions`: https://github.com/ceph/ceph/tree/main/examples/rgw/boto3

From 91c8003f475652357036c85a6040461aeff0539f Mon Sep 17 00:00:00 2001
From: Indira Sawant <indira.sawant@ibm.com>
Date: Wed, 11 Mar 2026 15:55:42 -0500
Subject: [PATCH 002/596] mon/MgrMonitor: include standby manager details in
 ceph mgr stat

Extend `ceph mgr stat` to include basic information about standby
manager daemons in a new `standbys` field. This improves visibility
into standby managers without requiring `ceph mgr dump`.

Fixes: https://tracker.ceph.com/issues/75464
Signed-off-by: Indira Sawant <indira.sawant@ibm.com>
---
 src/mon/MgrMonitor.cc | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/mon/MgrMonitor.cc b/src/mon/MgrMonitor.cc
index e387212ac09..1d8ac519c02 100644
--- a/src/mon/MgrMonitor.cc
+++ b/src/mon/MgrMonitor.cc
@@ -993,6 +993,14 @@ bool MgrMonitor::preprocess_command(MonOpRequestRef op)
     f->dump_bool("available", map.get_available());
     f->dump_string("active_name", map.get_active_name());
     f->dump_unsigned("num_standby", map.get_num_standby());
+    f->open_array_section("standbys");
+    for (const auto& [gid, s] : map.standbys) {
+      f->open_object_section("standby_mgr");
+      f->dump_unsigned("gid", s.gid);
+      f->dump_string("name", s.name);
+      f->close_section();
+    }
+    f->close_section();
     f->close_section();
     f->flush(rdata);
   } else if (prefix == "mgr dump") {

From 77b3dcb38c19ebed061b1b9bb273db5a5dbc4963 Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Fri, 16 Jan 2026 16:49:34 +0700
Subject: [PATCH 003/596] doc/radosgw: change all intra-docs links to use ref
 (3 of 6)

Part 3 of 6 to make backporting easier. Depends on part 1.

Use the the ref role for all remaining links in doc/radosgw/ with the
exception of config-ref.rst which will depend on changes to rgw.yaml.in.

The "external link definitions" syntax being removed is intended for
linking to external websites and not for intra-docs links. Validity of
ref links will be checked during the docs build process.

Add labels for links targets if necessary.
Remove unused external link definitions in the modified files.

Use confval instead of literal text for 2 configuration keys in
vault.rst.

Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 doc/radosgw/adminops.rst | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/doc/radosgw/adminops.rst b/doc/radosgw/adminops.rst
index 674b7b4a728..47ff5a6d6aa 100644
--- a/doc/radosgw/adminops.rst
+++ b/doc/radosgw/adminops.rst
@@ -2708,7 +2708,7 @@ Quotas
 ======
 
 The Admin Operations API enables you to set quotas on users and on buckets owned
-by users, and on accounts and on buckets owned by accounts. See `Quota Management`_
+by users, and on accounts and on buckets owned by accounts. See :ref:`radosgw-quota-management`
 for additional details. Quotas include the maximum number of objects in a bucket 
 and the maximum storage size in megabytes.
 
@@ -2717,7 +2717,7 @@ modify or disable a quota, the user must have ``users=write`` capability.
 
 To view quotas for accounts, the user must have a ``accounts=read`` capability. To set,
 modify or disable a quota, the user must have ``accounts=write`` capability.
-See the `Admin Guide`_ for details.
+See the :ref:`radosgw-admin-guide` for details.
 
 Valid parameters for quotas include:
 
@@ -2813,13 +2813,13 @@ permission. ::
 Rate Limit
 ==========
 
-The Admin Operations API enables you to set and get ratelimit configurations on users and on buckets and global rate limit configurations. See `Rate Limit Management`_ for additional details.
+The Admin Operations API enables you to set and get ratelimit configurations on users and on buckets and global rate limit configurations. See :ref:`radosgw-rate-limit-management` for additional details.
 Rate Limit includes the maximum number of operations and/or bytes per accumulation interval, separated by read and/or write (Additionally list and get operations),
 to a bucket and/or by a user and the maximum storage size in megabytes.
 
 To view rate limit, the user must have a ``ratelimit=read`` capability. To set,
 modify or disable a ratelimit, the user must have ``ratelimit=write`` capability.
-See the `Admin Guide`_ for details.
+See the :ref:`radosgw-admin-guide` for details.
 
 Valid parameters for quotas include:
 
@@ -2991,12 +2991,7 @@ Binding libraries
 
 
 
-.. _Admin Guide: ../admin
-.. _Quota Management: ../admin#quota-management
-.. _IrekFasikhov/go-rgwadmin: https://github.com/IrekFasikhov/go-rgwadmin
-.. _QuentinPerez/go-radosgw: https://github.com/QuentinPerez/go-radosgw
 .. _ceph/go-ceph: https://github.com/ceph/go-ceph/
-.. _Rate Limit Management: ../admin#rate-limit-management
 .. _IrekFasikhov/go-rgwadmin: https://github.com/IrekFasikhov/go-rgwadmin
 .. _QuentinPerez/go-radosgw: https://github.com/QuentinPerez/go-radosgw
 .. _twonote/radosgw-admin4j: https://github.com/twonote/radosgw-admin4j

From 0709f29a27d266866e586f0dfe11e6164b3dbb9f Mon Sep 17 00:00:00 2001
From: Vivek Maurya <vivek.maurya2@ibm.com>
Date: Sun, 8 Feb 2026 10:05:33 -0600
Subject: [PATCH 004/596] osd: Rephrase unclear OSD_FLAGS warning message 
 Setting maintenance mode show below warning,which appears incorrect  or
 ambiguous.  [WRN] OSD_FLAGS: 1 OSDs or CRUSH {nodes, device-classes}have 
 {NOUP,NODOWN,NOIN,NOOUT} flags set

 Change warning as shown bellow.
 [WRN] OSD_FLAGS: 1 OSDs or CRUSH nodes/device-classes have
 one or more of these flags set: NOUP, NODOWN, NOIN, NOOUT

 Fixes: https://tracker.ceph.com/issues/71716

 Signed-off-by: Vivek Maurya <vivek.maurya@ibm.com>
---
 src/osd/OSDMap.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/osd/OSDMap.cc b/src/osd/OSDMap.cc
index 5583369c008..41969c99e24 100644
--- a/src/osd/OSDMap.cc
+++ b/src/osd/OSDMap.cc
@@ -7770,7 +7770,7 @@ void OSDMap::check_health(CephContext *cct,
     }
     if (!detail.empty()) {
       ostringstream ss;
-      ss << detail.size() << " OSDs or CRUSH {nodes, device-classes} have {NOUP,NODOWN,NOIN,NOOUT} flags set";
+      ss << detail.size() << " OSDs or CRUSH nodes/device-classes have one or more of these flags set: NOUP, NODOWN, NOIN, NOOUT";
       auto& d = checks->add("OSD_FLAGS", HEALTH_WARN, ss.str(), detail.size());
       d.detail.swap(detail);
     }

From f410c49e609ce883c76d7277c133f5c64a8eeb53 Mon Sep 17 00:00:00 2001
From: stzuraski898 <steven.zuraski@ibm.com>
Date: Thu, 16 Apr 2026 21:56:53 +0000
Subject: [PATCH 005/596] mgr: Properly set description in labeled
 get_perf_schema_python

Fixes: https://tracker.ceph.com/issues/76048
Signed-off-by: stzuraski898 <steven.zuraski@ibm.com>
---
 src/mgr/ActivePyModules.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mgr/ActivePyModules.cc b/src/mgr/ActivePyModules.cc
index fcef67daa37..431da2c76ca 100644
--- a/src/mgr/ActivePyModules.cc
+++ b/src/mgr/ActivePyModules.cc
@@ -1141,7 +1141,7 @@ PyObject* ActivePyModules::get_perf_schema_python(
     size_t pos = type.path.rfind('.');
     std::string sub_counter_name = type.path.substr(pos + 1, type.path.length());
     Formatter::ObjectSection counter_section(*f, sub_counter_name);
-    f->create_unique("description", type.description);
+    f->dump_string("description", type.description);
     if (!type.nick.empty()) {
       f->dump_string("nick", type.nick);
     }

From c6c208e67d253d8e18e5621f1eedc540b3ed699b Mon Sep 17 00:00:00 2001
From: Christopher Hoffman <choffman@redhat.com>
Date: Mon, 20 Apr 2026 16:42:20 +0000
Subject: [PATCH 006/596] qa: Add direct_io test for fscrypt

Fixes: https://tracker.ceph.com/issues/73347
Signed-off-by: Christopher Hoffman <choffman@redhat.com>
---
 qa/workunits/fs/misc/direct_io.py         | 10 ++++
 qa/workunits/fs/misc/direct_io_fscrypt.py | 64 +++++++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100755 qa/workunits/fs/misc/direct_io_fscrypt.py

diff --git a/qa/workunits/fs/misc/direct_io.py b/qa/workunits/fs/misc/direct_io.py
index f7d59d95a2b..4f77cf05459 100755
--- a/qa/workunits/fs/misc/direct_io.py
+++ b/qa/workunits/fs/misc/direct_io.py
@@ -3,11 +3,21 @@
 import mmap
 import os
 import subprocess
+import sys
 
 def main():
     path = "testfile"
+
     fd = os.open(path, os.O_RDWR | os.O_CREAT | os.O_TRUNC | os.O_DIRECT, 0o644)
 
+    try:
+        if os.getxattr(path, "ceph.fscrypt.auth"):
+            os.close(fd)
+            print("fscrypt enabled dir, skipping!")
+            sys.exit(0)
+    except OSError:
+        pass
+
     ino = os.fstat(fd).st_ino
     obj_name = "{ino:x}.00000000".format(ino=ino)
     pool_name = os.getxattr(path, "ceph.file.layout.pool")
diff --git a/qa/workunits/fs/misc/direct_io_fscrypt.py b/qa/workunits/fs/misc/direct_io_fscrypt.py
new file mode 100755
index 00000000000..efa2794f46a
--- /dev/null
+++ b/qa/workunits/fs/misc/direct_io_fscrypt.py
@@ -0,0 +1,64 @@
+#!/usr/bin/python3
+
+import mmap
+import os
+import subprocess
+import sys
+
+def main():
+    # For this test, we're going to use the underlying fscrypt libraries to
+    # transform data. For writes we will use file "file_in" where we write
+    # plain text via file and be able to read back encrypted version via object.
+    # Then we will use object_in where we will write encrypted data to the
+    # object and read the plain text back via file.
+
+    file_in = "file_in"
+    object_in = "object_in"
+    object_out = "object_out"
+
+    fd = os.open(file_in, os.O_RDWR | os.O_CREAT | os.O_TRUNC | os.O_DIRECT, 0o644)
+
+    fscrypt_auth = ""
+
+    try:
+        fscrypt_auth = os.getxattr(file_in, "ceph.fscrypt.auth")
+    except OSError:
+        print(f"fscrypt not configured on {file_in}, exiting!")
+        sys.exit(0)
+
+    ino = os.fstat(fd).st_ino
+    obj_name = "{ino:x}.00000000".format(ino=ino)
+    pool_name = os.getxattr(file_in, "ceph.file.layout.pool")
+
+    buf = mmap.mmap(-1, 1)
+    buf.write(b'1')
+    os.write(fd, buf)
+
+    proc = subprocess.Popen(['rados', '-p', pool_name, 'get', obj_name, object_out])
+    proc.wait()
+
+    fd2 = os.open(object_in, os.O_RDWR | os.O_CREAT | os.O_TRUNC | os.O_DIRECT, 0o644)
+
+    # override value here with same as file_in so we can decrypt
+    os.setxattr(object_in, "ceph.fscrypt.auth", fscrypt_auth)
+
+    # write something other than 1 to the file
+    buf = mmap.mmap(-1, 1)
+    buf.write(b'2')
+    os.write(fd2, buf)
+
+    ino2 = os.fstat(fd2).st_ino
+    obj_name2 = "{ino2:x}.00000000".format(ino2=ino2)
+    proc = subprocess.Popen(['rados', '-p', pool_name, 'put', obj_name2, object_out])
+    proc.wait()
+
+    os.lseek(fd2, 0, os.SEEK_SET)
+    out = os.read(fd2, 4096)
+    if out != b'1':
+        raise RuntimeError("data were not directly read from object store")
+
+    os.close(fd)
+    print('ok')
+
+
+main()

From 1af9896da8f9822fcc1241344162fb9f8c97dec0 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 6 Nov 2025 20:50:22 +0000
Subject: [PATCH 007/596] os/bluestore: admin socket for bdev expand

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueAdmin.cc | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/os/bluestore/BlueAdmin.cc b/src/os/bluestore/BlueAdmin.cc
index 4a102a35e31..da05ecf14cb 100644
--- a/src/os/bluestore/BlueAdmin.cc
+++ b/src/os/bluestore/BlueAdmin.cc
@@ -3,9 +3,13 @@
 
 #include "BlueAdmin.h"
 #include "Compression.h"
+#include "common/errno.h"
 #include "common/pretty_binary.h"
+#include "os/bluestore/BlueStore.h"
 #include "common/debug.h"
 #include <asm-generic/errno-base.h>
+#include <iostream>
+#include <sstream>
 #include <vector>
 #include <limits>
 
@@ -78,6 +82,11 @@ BlueStore::SocketHook::SocketHook(BlueStore& store)
       this,
       "print RocksDB sharding");
     ceph_assert(r == 0);
+    r = admin_socket->register_command("bluestore bluefs-bdev-expand",
+                                       this,
+                                       "Instruct BlueFS to check the size of its block devices"
+                                       " and, if they have expanded, make use of the additional space.");
+    ceph_assert(r == 0);
   }
 }
 
@@ -287,6 +296,15 @@ int BlueStore::SocketHook::call(
       }
     }
     return 0;
+  } else if (command == "bluestore bluefs-bdev-expand"){
+    std::stringstream result;
+    int ret = store.expand_devices(result);
+    if (ret < 0) {
+      ss << "expand device failed: " << cpp_strerror(ret) << std::endl;
+    } else {
+      out.append(result.str());
+    }
+    return ret;
   } else {
     ss << "Invalid command" << std::endl;
     r = -ENOSYS;

From 8703fec36f8451661f033bb33751737704d2cf2a Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 20 Nov 2025 02:01:16 +0000
Subject: [PATCH 008/596] blk: update to check new block device size

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/blk/BlockDevice.h          |  1 +
 src/blk/kernel/KernelDevice.cc | 33 +++++++++++++++++++++++++++++++++
 src/blk/kernel/KernelDevice.h  |  1 +
 3 files changed, 35 insertions(+)

diff --git a/src/blk/BlockDevice.h b/src/blk/BlockDevice.h
index 0ea7804088e..51a39103aa4 100644
--- a/src/blk/BlockDevice.h
+++ b/src/blk/BlockDevice.h
@@ -241,6 +241,7 @@ public:
   }
   
   uint64_t get_size() const { return size; }
+  virtual int refresh_size() { return 0; }
   uint64_t get_block_size() const { return block_size; }
   uint64_t get_optimal_io_size() const { return optimal_io_size; }
   bool is_discard_supported() const { return support_discard; }
diff --git a/src/blk/kernel/KernelDevice.cc b/src/blk/kernel/KernelDevice.cc
index b34ad11dd7c..b61b3fe7eca 100644
--- a/src/blk/kernel/KernelDevice.cc
+++ b/src/blk/kernel/KernelDevice.cc
@@ -13,6 +13,7 @@
  *
  */
 
+#include <cerrno>
 #include <limits>
 #include <unistd.h>
 #include <stdlib.h>
@@ -38,6 +39,7 @@
 #include "common/buffer_instrumentation.h"
 #include "common/Clock.h" // for ceph_clock_now()
 #include "common/errno.h"
+#include "BlockDevice.h"
 #if defined(__FreeBSD__)
 #include "bsm/audit_errno.h"
 #endif
@@ -354,6 +356,37 @@ int KernelDevice::get_devices(std::set<std::string> *ls) const
   return 0;
 }
 
+int KernelDevice::refresh_size()
+{
+  if (fd_directs.empty() || fd_directs[WRITE_LIFE_NOT_SET] < 0) {
+    return -ENODEV;
+  }
+
+  struct stat st;
+  int r = ::fstat(fd_directs[WRITE_LIFE_NOT_SET], &st);
+  if (r < 0) {
+    r = -errno;
+    derr << __func__ << " fstat failed: " << cpp_strerror(r) << dendl;
+    return r;
+  }
+
+  // logic taken from open() for block vs file
+  int64_t new_size;
+  if (S_ISBLK(st.st_mode)) {
+    BlkDev blkdev(fd_directs[WRITE_LIFE_NOT_SET]);
+    r = blkdev.get_size(&new_size);
+    if (r < 0) {
+      derr << __func__ << " ioctl failed: " << cpp_strerror(r) << dendl;
+      return r;
+    }
+  } else {
+    new_size = st.st_size;
+  }
+
+  size = new_size;
+  return 0;
+}
+
 void KernelDevice::close()
 {
   dout(1) << __func__ << dendl;
diff --git a/src/blk/kernel/KernelDevice.h b/src/blk/kernel/KernelDevice.h
index fb206f6ba2d..81f576f59ff 100644
--- a/src/blk/kernel/KernelDevice.h
+++ b/src/blk/kernel/KernelDevice.h
@@ -146,6 +146,7 @@ public:
     return 0;
   }
   int get_devices(std::set<std::string> *ls) const override;
+  int refresh_size() override;
 
   int get_ebd_state(ExtBlkDevState &state) const override;
   int detect_ebd(std::string& id) override;

From bd6c72e01dac8d7cef1abfe68807dac6c81b6b33 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 20 Nov 2025 18:31:23 +0000
Subject: [PATCH 009/596] os/bluestore: implement expand() for bitmap allocator
 hierarchy

Implements device expansion support for bitmap-based allocators
BitmapAllocator and HybridAllocator. Bitmap allocators uses allocated
fixed-size bit vectors (L0, L1, L2) and requires vector resizing
and metadata updates when underlying device expands.

Some different cases that are handled:
- padding reclamation when alignment boundaries change
- Sub-granularity expansions (L2 doesn't grow, only L2 bits update)

To be used such as expand() followed by init_add_free() to ensure
available space accounting happens once.

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/Allocator.h                  |   6 +-
 src/os/bluestore/BitmapAllocator.cc           |  20 ++++
 src/os/bluestore/BitmapAllocator.h            |   2 +
 src/os/bluestore/HybridAllocator.h            |  16 +++
 src/os/bluestore/fastbmap_allocator_impl.h    |  85 ++++++++++++++
 .../objectstore/fastbmap_allocator_test.cc    | 107 ++++++++++++++++++
 6 files changed, 235 insertions(+), 1 deletion(-)

diff --git a/src/os/bluestore/Allocator.h b/src/os/bluestore/Allocator.h
index 17e6d47af2a..df563764330 100644
--- a/src/os/bluestore/Allocator.h
+++ b/src/os/bluestore/Allocator.h
@@ -90,9 +90,13 @@ public:
   {
     return block_size;
   }
+  virtual void expand(int64_t new_size){
+    ceph_assert(new_size >= device_size);
+    device_size = new_size;
+  }
 
 protected:
-  const int64_t device_size = 0;
+  int64_t device_size = 0;
   const int64_t block_size = 0;
 };
 
diff --git a/src/os/bluestore/BitmapAllocator.cc b/src/os/bluestore/BitmapAllocator.cc
index 3ab43bea344..8c59c2b1dd0 100644
--- a/src/os/bluestore/BitmapAllocator.cc
+++ b/src/os/bluestore/BitmapAllocator.cc
@@ -2,6 +2,7 @@
 // vim: ts=8 sw=2 sts=2 expandtab
 
 #include "BitmapAllocator.h"
+#include <cstdint>
 #include "include/types.h" // for byte_u_t
 
 #define dout_context cct
@@ -89,6 +90,25 @@ void BitmapAllocator::init_rm_free(uint64_t offset, uint64_t length)
   ldout(cct, 10) << __func__ << " done" << dendl;
 }
 
+void BitmapAllocator::expand(int64_t new_size)
+{
+  int64_t old_size = get_capacity();
+  ceph_assert(new_size >= old_size);
+
+  if (new_size == old_size) {
+    return;
+  }
+
+  ldout(cct, 1) << __func__ << " expanding from 0x" << std::hex << old_size
+                << " to 0x" << new_size << std::dec << dendl;
+
+  Allocator::expand(new_size);
+  AllocatorLevel02::expand(new_size, old_size);
+
+  ldout(cct, 1) << __func__ << " expansion complete, available=0x"
+                << std::hex << get_available() << std::dec << dendl;
+}
+
 void BitmapAllocator::shutdown()
 {
   ldout(cct, 1) << __func__ << dendl;
diff --git a/src/os/bluestore/BitmapAllocator.h b/src/os/bluestore/BitmapAllocator.h
index 8cad1f2fcd6..65976eb3c8a 100644
--- a/src/os/bluestore/BitmapAllocator.h
+++ b/src/os/bluestore/BitmapAllocator.h
@@ -56,6 +56,8 @@ public:
   void init_add_free(uint64_t offset, uint64_t length) override;
   void init_rm_free(uint64_t offset, uint64_t length) override;
 
+  void expand(int64_t new_size) override;
+
   void shutdown() override;
 };
 
diff --git a/src/os/bluestore/HybridAllocator.h b/src/os/bluestore/HybridAllocator.h
index 9617f51a0da..528c61ee06f 100644
--- a/src/os/bluestore/HybridAllocator.h
+++ b/src/os/bluestore/HybridAllocator.h
@@ -56,6 +56,22 @@ public:
     }
   }
   void init_rm_free(uint64_t offset, uint64_t length) override;
+
+  void expand(int64_t new_size) override {
+    std::lock_guard l(PrimaryAllocator::get_lock());
+    int64_t old_size = PrimaryAllocator::get_capacity();
+    ceph_assert(new_size >= old_size);
+
+    if (new_size == old_size) {
+      return;
+    }
+
+    PrimaryAllocator::expand(new_size);
+    if (bmap_alloc) {
+      bmap_alloc->expand(new_size);
+    }
+  }
+
   void shutdown() override {
     std::lock_guard l(PrimaryAllocator::get_lock());
     PrimaryAllocator::_shutdown();
diff --git a/src/os/bluestore/fastbmap_allocator_impl.h b/src/os/bluestore/fastbmap_allocator_impl.h
index fbf3fda0b32..f22882f7880 100644
--- a/src/os/bluestore/fastbmap_allocator_impl.h
+++ b/src/os/bluestore/fastbmap_allocator_impl.h
@@ -295,6 +295,48 @@ protected:
     }
   }
 
+  void expand(uint64_t new_capacity, uint64_t old_capacity)
+  {
+    auto new_aligned_capacity =
+      p2roundup((int64_t)new_capacity,
+        int64_t(l1_granularity * slots_per_slotset * _children_per_slot()));
+
+    auto old_aligned_capacity =
+      p2roundup((int64_t)old_capacity,
+        int64_t(l1_granularity * slots_per_slotset * _children_per_slot()));
+
+    if (new_aligned_capacity == old_aligned_capacity) {
+      // aligned capacity didn't change, but we should check the old and new boundaries
+      auto old_l0_pos_no_use = p2roundup((int64_t)old_capacity, (int64_t)l0_granularity) / l0_granularity;
+      auto new_l0_pos_no_use = p2roundup((int64_t)new_capacity, (int64_t)l0_granularity) / l0_granularity;
+      if (old_l0_pos_no_use < new_l0_pos_no_use) {
+        // L1 aligned capacity is the same but actual capacity increased
+        // mark the newly expanded region [old_capacity, new_capacity) as free
+        _mark_free_l1_l0(old_l0_pos_no_use, new_l0_pos_no_use);
+      }
+      return;
+    }
+
+    size_t new_slot_count = new_aligned_capacity / l1_granularity / _children_per_slot();
+    size_t old_slot_count = l1.size();
+    l1.resize(new_slot_count, all_slot_set);
+
+    size_t new_slot_count_l0 = new_aligned_capacity / l0_granularity / bits_per_slot;
+    l0.resize(new_slot_count_l0, all_slot_set);
+
+    unalloc_l1_count += (new_slot_count - old_slot_count) * _children_per_slot();
+
+    // Free the old padding at the old aligned boundary
+    auto old_l0_pos_no_use = p2roundup((int64_t)old_capacity, (int64_t)l0_granularity) / l0_granularity;
+    auto old_l0_pos_end = old_aligned_capacity / l0_granularity;
+    if (old_l0_pos_no_use < old_l0_pos_end) {
+      _mark_free_l1_l0(old_l0_pos_no_use, old_l0_pos_end);
+    }
+
+    auto l0_pos_no_use = p2roundup((int64_t)new_capacity, (int64_t)l0_granularity) / l0_granularity;
+    _mark_alloc_l1_l0(l0_pos_no_use, new_aligned_capacity / l0_granularity);
+  }
+
   struct search_ctx_t
   {
     size_t partial_count = 0;
@@ -596,6 +638,49 @@ public:
     return l1.get_fragmentation();
   }
 
+  void expand(uint64_t new_capacity, uint64_t old_capacity)
+  {
+    ceph_assert(new_capacity >= old_capacity);
+    std::lock_guard l(lock);
+
+    l1.expand(new_capacity, old_capacity);
+
+    auto new_aligned_capacity =
+      p2roundup((int64_t)new_capacity, (int64_t)l2_granularity * L1_ENTRIES_PER_SLOT);
+    auto old_aligned_capacity =
+      p2roundup((int64_t)old_capacity, (int64_t)l2_granularity * L1_ENTRIES_PER_SLOT);
+
+    if (new_aligned_capacity == old_aligned_capacity) {
+      // L2 vector didn't grow, but we need to update L2 bits to reflect the expanded L1 entries
+      // calculate which L2 position range covers the expanded region [old_capacity, new_capacity)
+      auto l2_pos_start = old_capacity / l2_granularity;
+      auto l2_pos_end = p2roundup((int64_t)new_capacity, (int64_t)l2_granularity) / l2_granularity;
+
+      if (l2_pos_start < l2_pos_end) {
+        // update L2 metadata for the expanded region by examining L1 state
+        _mark_l2_on_l1(l2_pos_start, l2_pos_end);
+      }
+
+      return;
+    }
+
+    size_t new_elem_count = new_aligned_capacity / l2_granularity / L1_ENTRIES_PER_SLOT;
+    l2.resize(new_elem_count, all_slot_set);
+
+    // free the old padding so we can reuse that space
+    auto old_l2_pos_no_use = 
+      p2roundup((int64_t)old_capacity, (int64_t)l2_granularity) / l2_granularity;
+    auto old_l2_pos_end = old_aligned_capacity / l2_granularity;
+    if (old_l2_pos_no_use < old_l2_pos_end) {
+      _mark_l2_free(old_l2_pos_no_use, old_l2_pos_end);
+    }
+
+    auto l2_pos_no_use = 
+      p2roundup((int64_t)new_capacity, (int64_t)l2_granularity) / l2_granularity;
+    _mark_l2_allocated(l2_pos_no_use, new_aligned_capacity / l2_granularity);
+
+  }
+
 protected:
   ceph::mutex lock = ceph::make_mutex("AllocatorLevel02::lock");
   L1 l1;
diff --git a/src/test/objectstore/fastbmap_allocator_test.cc b/src/test/objectstore/fastbmap_allocator_test.cc
index 83babab567f..7f763d49c72 100644
--- a/src/test/objectstore/fastbmap_allocator_test.cc
+++ b/src/test/objectstore/fastbmap_allocator_test.cc
@@ -31,6 +31,10 @@ public:
   {
     _init(capacity, alloc_unit);
   }
+  void expand(uint64_t new_capacity, uint64_t old_capacity)
+  {
+    AllocatorLevel02::expand(new_capacity, old_capacity);
+  }
   void allocate_l2(uint64_t length, uint64_t min_length,
     uint64_t* allocated0,
     interval_vector_t* res)
@@ -1143,3 +1147,106 @@ TEST(TestAllocatorLevel01, test_claim_free_l2)
   ASSERT_EQ(0x15000,
     al2.debug_get_free());
 }
+
+TEST(TestAllocatorLevel02, test_expand_simple)
+{
+  TestAllocatorLevel02 al2;
+  uint64_t capacity = 64 * 1024 * 1024; // 64MiB
+  uint64_t block_size = 0x1000;         // 4KB
+
+  al2.init(capacity, block_size);
+  ASSERT_EQ(capacity, al2.debug_get_free());
+  ASSERT_EQ(capacity, al2.get_available());
+  interval_vector_t r1;
+  uint64_t allocated = 0;
+  uint64_t alloc_size = 60 * 1024 * 1024;
+  al2.allocate_l2(alloc_size, block_size, &allocated, &r1);
+  ASSERT_EQ(allocated, alloc_size);
+
+  uint64_t free_before = al2.debug_get_free();
+  uint64_t available_before = al2.get_available();
+  std::cout << "Before expand: free=" << free_before
+            << " available=" << available_before << std::endl;
+
+  uint64_t new_capacity = 128 * 1024 * 1024;
+  al2.expand(new_capacity, capacity);
+  al2.mark_free(capacity, new_capacity - capacity);
+  uint64_t free_after = al2.debug_get_free();
+  uint64_t available_after = al2.get_available();
+  uint64_t expected_increase = new_capacity - capacity;
+
+  std::cout << "After expand: free=" << free_after 
+            << " available=" << available_after << std::endl;
+  std::cout << "Expected increase: " << expected_increase << std::endl;
+  std::cout << "Actual increase: " << (free_after - free_before) << std::endl;
+
+  ASSERT_EQ(free_after, free_before + expected_increase);
+  ASSERT_EQ(available_after, available_before + expected_increase);
+
+  // allocate more than the original capacity would allow
+  // this must use the expanded region since total = 110MB > 64MB original
+  interval_vector_t r2;
+  allocated = 0;
+  uint64_t second_alloc = 50 * 1024 * 1024; // 50MiB
+  al2.allocate_l2(second_alloc, block_size, &allocated, &r2);
+  ASSERT_EQ(allocated, second_alloc);
+
+  std::cout << "Allocated " << (second_alloc / 1024 / 1024) << "MB in "
+            << r2.size() << " intervals:" << std::endl;
+
+  // verify at least some allocation came from expanded region
+  bool uses_expanded = false;
+  for (const auto& interval : r2) {
+    std::cout << "  offset=0x" << std::hex << interval.offset
+              << " length=0x" << interval.length << std::dec << std::endl;
+    // check if allocation starts in or extends into expanded region
+    // either starts in expanded region or spans into it
+    if (interval.offset >= capacity || interval.offset + interval.length > capacity) {
+      uses_expanded = true;
+      if (interval.offset >= capacity) {
+        std::cout << "    ^ Allocation starts in expanded region" << std::endl;
+      } else {
+        std::cout << "    ^ Allocation spans into expanded region" << std::endl;
+      }
+    }
+  }
+
+  ASSERT_TRUE(uses_expanded);
+
+  // should have ~18MiB free (128MiB - 60MiB - 50MiB)
+  uint64_t free_final = al2.debug_get_free();
+  uint64_t expected_free = new_capacity - alloc_size - second_alloc;
+  std::cout << "Final free: " << free_final 
+            << " expected: " << expected_free << std::endl;
+  ASSERT_EQ(free_final, expected_free);
+}
+
+TEST(TestAllocatorLevel02, test_expand_multiple_times)
+{
+  TestAllocatorLevel02 al2;
+  uint64_t capacity = 32 * 1024 * 1024;
+  uint64_t block_size = 0x1000;
+
+  al2.init(capacity, block_size);
+  ASSERT_EQ(capacity, al2.debug_get_free());
+
+  uint64_t capacity2 = 64 * 1024 * 1024;
+  al2.expand(capacity2, capacity);
+  al2.mark_free(capacity, capacity2 - capacity);
+  ASSERT_EQ(capacity2, al2.debug_get_free());
+  ASSERT_EQ(capacity2, al2.get_available());
+
+  uint64_t capacity3 = 128 * 1024 * 1024;
+  al2.expand(capacity3, capacity2);
+  al2.mark_free(capacity2, capacity3 - capacity2);
+  ASSERT_EQ(capacity3, al2.debug_get_free());
+  ASSERT_EQ(capacity3, al2.get_available());
+
+  interval_vector_t r;
+  uint64_t allocated = 0;
+  al2.allocate_l2(100 * 1024 * 1024, block_size, &allocated, &r);
+  ASSERT_EQ(allocated, 100 * 1024 * 1024);
+
+  uint64_t free_final = al2.debug_get_free();
+  ASSERT_EQ(free_final, 28 * 1024 * 1024); // 128MiB - 100MiB
+}

From 530faae4a56c47f617aab8f3627b4353df56964b Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 20 Nov 2025 18:49:15 +0000
Subject: [PATCH 010/596] os/bluestore: expose expand() method for
 FreelistManager

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BitmapFreelistManager.cc | 6 ++++++
 src/os/bluestore/BitmapFreelistManager.h  | 1 +
 src/os/bluestore/FreelistManager.h        | 1 +
 3 files changed, 8 insertions(+)

diff --git a/src/os/bluestore/BitmapFreelistManager.cc b/src/os/bluestore/BitmapFreelistManager.cc
index 92768fb03f9..ea6f95f45ec 100644
--- a/src/os/bluestore/BitmapFreelistManager.cc
+++ b/src/os/bluestore/BitmapFreelistManager.cc
@@ -163,6 +163,12 @@ int BitmapFreelistManager::_expand(uint64_t old_size, KeyValueDB* db)
   return 0;
 }
 
+int BitmapFreelistManager::expand(uint64_t new_size, KeyValueDB* db){
+  uint64_t old_size = size;
+  size = new_size;
+  return _expand(old_size ,db);
+}
+
 int BitmapFreelistManager::read_size_meta_from_db(KeyValueDB* kvdb,
   uint64_t* res)
 {
diff --git a/src/os/bluestore/BitmapFreelistManager.h b/src/os/bluestore/BitmapFreelistManager.h
index 943f6ce6ab4..5127eef3435 100644
--- a/src/os/bluestore/BitmapFreelistManager.h
+++ b/src/os/bluestore/BitmapFreelistManager.h
@@ -96,6 +96,7 @@ public:
     std::vector<std::pair<std::string, std::string>>*) const override;
 
   bool validate(uint64_t min_alloc_size) const override;
+  int expand(uint64_t new_size, KeyValueDB* db) override;
 };
 
 #endif
diff --git a/src/os/bluestore/FreelistManager.h b/src/os/bluestore/FreelistManager.h
index f369a9b2be3..e8a3a624d15 100644
--- a/src/os/bluestore/FreelistManager.h
+++ b/src/os/bluestore/FreelistManager.h
@@ -49,6 +49,7 @@ public:
   virtual uint64_t get_alloc_units() const = 0;
   virtual uint64_t get_alloc_size() const = 0;
 
+  virtual int expand(uint64_t new_size, KeyValueDB* db) = 0;
   virtual void get_meta(uint64_t target_size,
   std::vector<std::pair<std::string, std::string>>*) const = 0;
 

From d7bd19a50871dacdf7f86d62b212fbb9f6d6263c Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 20 Nov 2025 18:52:55 +0000
Subject: [PATCH 011/596] bluestore/bluefs: add expand_device for online device
 usage

adds support for expanding the device capacity while fs is online

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueFS.cc | 23 +++++++++++++++++++++++
 src/os/bluestore/BlueFS.h  |  2 ++
 2 files changed, 25 insertions(+)

diff --git a/src/os/bluestore/BlueFS.cc b/src/os/bluestore/BlueFS.cc
index 19032f5ecbc..b17bf772093 100644
--- a/src/os/bluestore/BlueFS.cc
+++ b/src/os/bluestore/BlueFS.cc
@@ -924,6 +924,29 @@ void BlueFS::_stop_alloc()
   }
 }
 
+void BlueFS::expand_device(unsigned devid, uint64_t new_size, uint64_t old_size)
+{
+  dout(10) << __func__ << " dev " << devid
+           << " from 0x" << std::hex << old_size
+           << " to 0x" << new_size << std::dec << dendl;
+
+  ceph_assert(devid < alloc.size());
+  ceph_assert(alloc[devid]);
+  ceph_assert(new_size > old_size);
+
+  alloc[devid]->expand(new_size);
+  auto aligned_size = p2align(new_size, alloc_size[devid]);
+  alloc[devid]->init_add_free(old_size, aligned_size - old_size);
+
+  uint64_t total = get_block_device_size(devid);
+  uint64_t free = get_free(devid);
+  ceph_assert(total > total - free);
+
+  dout(10) << __func__ << " dev " << devid
+           << " added free space: 0x" << std::hex << old_size
+           << "~0x" << (aligned_size - old_size) << std::dec << dendl;
+}
+
 int BlueFS::_read_and_check(uint8_t ndev, uint64_t off, uint64_t len,
 			    ceph::buffer::list *pbl, IOContext *ioc, bool buffered)
 {
diff --git a/src/os/bluestore/BlueFS.h b/src/os/bluestore/BlueFS.h
index 7295fd47869..30542966fb6 100644
--- a/src/os/bluestore/BlueFS.h
+++ b/src/os/bluestore/BlueFS.h
@@ -901,6 +901,8 @@ public:
   bool bdev_support_label(unsigned id);
   BlockDevice* get_block_device(unsigned bdev) const;
 
+  void expand_device(unsigned devid, uint64_t new_size, uint64_t old_size);
+
   // handler for discard event
   void handle_discard(unsigned dev, interval_set<uint64_t>& to_release);
 

From 57e3d3bb344735bbef78604ecb77c31bec51bdf6 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 20 Nov 2025 20:00:37 +0000
Subject: [PATCH 012/596] os/bluestore: add asok for online device expansion

expands bluestore and bluefs while OSD is running.
Instead of recreating allocators, expands allocator and FM
in-place.

ceph tell osd.X bluestore bluefs-bdev-expand

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueAdmin.cc |   2 +-
 src/os/bluestore/BlueStore.cc | 136 ++++++++++++++++++++++++++++++++++
 src/os/bluestore/BlueStore.h  |   1 +
 3 files changed, 138 insertions(+), 1 deletion(-)

diff --git a/src/os/bluestore/BlueAdmin.cc b/src/os/bluestore/BlueAdmin.cc
index da05ecf14cb..e647b7bb85e 100644
--- a/src/os/bluestore/BlueAdmin.cc
+++ b/src/os/bluestore/BlueAdmin.cc
@@ -298,7 +298,7 @@ int BlueStore::SocketHook::call(
     return 0;
   } else if (command == "bluestore bluefs-bdev-expand"){
     std::stringstream result;
-    int ret = store.expand_devices(result);
+    int ret = store.expand_devices_online(result);
     if (ret < 0) {
       ss << "expand device failed: " << cpp_strerror(ret) << std::endl;
     } else {
diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 4e869411049..46b8ccaa6f9 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9323,6 +9323,142 @@ bool BlueStore::get_db_sharding(std::string& res_sharding)
   return ret;
 }
 
+int BlueStore::expand_devices_online(ostream& out)
+{
+  bluefs->dump_block_extents(out);
+  out << "Expanding DB/WAL..." << std::endl;
+
+  // updating dedicated devices first
+  for (auto devid : { BlueFS::BDEV_WAL, BlueFS::BDEV_DB}) {
+    if (devid == bluefs_layout.shared_bdev) {
+      continue;
+    }
+
+    auto my_bdev = bluefs->get_block_device(devid);
+    my_bdev->refresh_size();
+    uint64_t size = my_bdev ? my_bdev->get_size() : 0;
+
+    if (size == 0) {
+      // no bdev
+      continue;
+    }
+    if (my_bdev->supported_bdev_label()) {
+      string my_path = get_device_path(devid);
+      bluestore_bdev_label_t my_label;
+      int r = _read_bdev_label(cct, my_bdev, my_path, &my_label);
+      if (r < 0) {
+        derr << "unable to read label for " << my_path << ": "
+              << cpp_strerror(r) << dendl;
+        continue;
+      } else {
+        if (size == my_label.size) {
+          // no need to expand
+          out << devid
+	      << " : nothing to do, skipped"
+	      << std::endl;
+          continue;
+        } else if (size < my_label.size) {
+          // something weird in bdev label
+          out << devid
+	      <<" : ERROR: bdev label is above device size, skipped"
+	      << std::endl;
+          continue;
+        } else {
+          int64_t old_size = my_label.size;
+          my_label.size = size;
+          out << devid
+	      << " : Expanding to 0x" << std::hex << size
+	      << std::dec << "(" << byte_u_t(size) << ")"
+	      << std::endl;
+          r = _write_bdev_label(cct, my_bdev, my_path, my_label);
+          if (r < 0) {
+            derr << "unable to write label for " << my_path << ": "
+                  << cpp_strerror(r) << dendl;
+          } else {
+            out << devid
+                << " : size updated to 0x" << std::hex << size
+                << std::dec << "(" << byte_u_t(size) << ")"
+                << std::endl;
+          }
+          bluefs->expand_device(devid, size, old_size);
+        }
+      }
+    }
+  }
+  auto devid = bluefs_layout.shared_bdev;
+  // bluestore and bluefs hold separate instances so we need to
+  // refresh both to figure out if there is a new size
+  bluefs->get_block_device(devid)->refresh_size();
+  bdev->refresh_size();
+
+  uint64_t size0 = fm->get_size();
+  uint64_t size = bdev->get_size();
+  auto aligned_size = p2align(size, min_alloc_size);
+  int r = 0;
+  if (aligned_size == size0) {
+    // no need to expand
+    out << devid
+        << " : nothing to do, skipped"
+        << std::endl;
+  } else if (aligned_size < size0) {
+    // something weird in bdev label
+    out << devid
+        << " : ERROR: previous device size is above the current one, skipped"
+	<< std::endl;
+  } else {
+    auto my_path = get_device_path(devid);
+    out << devid
+	<<" : Expanding to 0x" << std::hex << size
+	<< std::dec << "(" << byte_u_t(size) << ")"
+	<< std::endl;  
+    r = _write_out_fm_meta(size);
+    if (r != 0) {
+      derr << "unable to write out fm meta for " << my_path << ": "
+           << cpp_strerror(r) << dendl;
+    } else if (bdev->supported_bdev_label()) {
+      bdev_label.size = size;
+      uint64_t lsize = std::max(BDEV_LABEL_BLOCK_SIZE, min_alloc_size);
+      for (uint64_t loc : bdev_label_positions) {
+        if ((loc >= size0) && (loc + lsize <= size)) {
+          bdev_label_valid_locations.push_back(loc);
+          if (!bdev_label_multi) {
+            break;
+          }
+        }
+      }
+      r = _write_bdev_label(cct, bdev, my_path,
+        bdev_label, bdev_label_valid_locations);
+    }
+    if (r == 0) {
+      out << devid
+          << " : size updated to 0x" << std::hex << size
+          << std::dec << "(" << byte_u_t(size) << ")"
+          << std::endl;
+
+      // since we are not relying on db open/close to update FM
+      // need to keep FM and the shared allocator in sync now
+      fm->expand(aligned_size, db);
+      alloc->expand(aligned_size);
+      alloc->init_add_free(size0, aligned_size - size0);
+
+      need_to_destage_allocation_file = true;
+      before_expansion_bdev_size = 0;
+
+      dout(1) << __func__
+              << " : size updated to 0x" << std::hex << size
+              << std::dec << "(" << byte_u_t(size) << ")"
+              << ", allocator type " << alloc->get_type()
+              << ", capacity 0x" << alloc->get_capacity()
+              << ", block size 0x" << alloc->get_block_size()
+              << ", free 0x" << alloc->get_free()
+              << ", fragmentation " << alloc->get_fragmentation()
+              << std::dec << dendl;
+
+    }
+  }
+  return r;
+}
+
 int BlueStore::dump_bluefs_sizes(ostream& out)
 {
   int r = _open_db_and_around(true);
diff --git a/src/os/bluestore/BlueStore.h b/src/os/bluestore/BlueStore.h
index 19111a19432..b00ceab5c5e 100644
--- a/src/os/bluestore/BlueStore.h
+++ b/src/os/bluestore/BlueStore.h
@@ -3207,6 +3207,7 @@ public:
     int id,
     const std::string& path);
   int expand_devices(std::ostream& out);
+  int expand_devices_online(std::ostream& out);
   std::string get_device_path(unsigned id);
 
   bool get_db_sharding(std::string& res_sharding);

From a201ee80fbd0d1a0cd92c08a9b147ad8e393fc2d Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 23 Dec 2025 22:37:52 +0000
Subject: [PATCH 013/596] blk/BlockDevice: changes block device size as atomic

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/blk/BlockDevice.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/blk/BlockDevice.h b/src/blk/BlockDevice.h
index 51a39103aa4..58e2afacb75 100644
--- a/src/blk/BlockDevice.h
+++ b/src/blk/BlockDevice.h
@@ -179,7 +179,7 @@ private:
     void *cbpriv, aio_callback_t d_cb, void *d_cbpriv, const char* dev_name);
 
 protected:
-  uint64_t size = 0;
+  std::atomic<uint64_t> size = 0;
   uint64_t block_size = 0;
   uint64_t optimal_io_size = 0;
   bool support_discard = false;

From 2fc6f819411957d09614d5ca44a71c9773d3aca4 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 6 Jan 2026 18:55:45 +0000
Subject: [PATCH 014/596] os/bluestore: update bluefs volume selector

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueFS.cc |  5 +++++
 src/os/bluestore/BlueFS.h  | 41 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/src/os/bluestore/BlueFS.cc b/src/os/bluestore/BlueFS.cc
index b17bf772093..3144538fd30 100644
--- a/src/os/bluestore/BlueFS.cc
+++ b/src/os/bluestore/BlueFS.cc
@@ -938,6 +938,11 @@ void BlueFS::expand_device(unsigned devid, uint64_t new_size, uint64_t old_size)
   auto aligned_size = p2align(new_size, alloc_size[devid]);
   alloc[devid]->init_add_free(old_size, aligned_size - old_size);
 
+  if (vselector) {
+    vselector->expand_device(devid, aligned_size);
+    vselector->update_from_config(cct);
+  }
+
   uint64_t total = get_block_device_size(devid);
   uint64_t free = get_free(devid);
   ceph_assert(total > total - free);
diff --git a/src/os/bluestore/BlueFS.h b/src/os/bluestore/BlueFS.h
index 30542966fb6..094f5e8dcf3 100644
--- a/src/os/bluestore/BlueFS.h
+++ b/src/os/bluestore/BlueFS.h
@@ -211,6 +211,15 @@ public:
   /* used for sanity checking of vselector */
   virtual BlueFSVolumeSelector* clone_empty() const { return nullptr; }
   virtual bool compare(BlueFSVolumeSelector* other) { return true; };
+
+  /**
+  *  Update device total size after online expansion
+  *  Parameters:
+  *    dev_id: BlueFS device id (BDEV_WAL, BDEV_DB, BDEV_SLOW)
+  *    new_size: new total size of the device
+  *
+  */
+  virtual void expand_device(uint8_t dev_id, uint64_t new_size) = 0;
 };
 
 struct bluefs_shared_alloc_context_t {
@@ -1010,6 +1019,22 @@ public:
     // do nothing
     return;
   }
+
+  void expand_device(uint8_t dev_id, uint64_t new_size) override {
+    switch (dev_id) {
+    case BlueFS::BDEV_WAL:
+      wal_total = new_size;
+      break;
+    case BlueFS::BDEV_DB:
+      db_total = new_size;
+      break;
+    case BlueFS::BDEV_SLOW:
+      slow_total = new_size;
+      break;
+    default:
+      break;
+    }
+  }
 };
 
 class FitToFastVolumeSelector : public OriginalVolumeSelector {
@@ -1259,6 +1284,22 @@ public:
   void dump(std::ostream& sout) override;
   BlueFSVolumeSelector* clone_empty() const override;
   bool compare(BlueFSVolumeSelector* other) override;
+
+  void expand_device(uint8_t dev_id, uint64_t new_size) override {
+    switch (dev_id) {
+    case BlueFS::BDEV_WAL:
+      l_totals[LEVEL_WAL - LEVEL_FIRST] = new_size;
+      break;
+    case BlueFS::BDEV_DB:
+      l_totals[LEVEL_DB - LEVEL_FIRST] = new_size;
+      break;
+    case BlueFS::BDEV_SLOW:
+      l_totals[LEVEL_SLOW - LEVEL_FIRST] = new_size;
+      break;
+    default:
+      break;
+    }
+  }
 };
 
 /**

From 2ab1311f38f33bd573a4299d546b2252fb7898bf Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 6 Jan 2026 23:58:24 +0000
Subject: [PATCH 015/596] os/bluestore: refactors expand_devices for online and
 offline use

Refactors device expansion to use a expand_devices()
that handles both online (admin socket) and offline (ceph-bluestore-tool)
use cases.

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueAdmin.cc |   2 +-
 src/os/bluestore/BlueStore.cc | 176 +++++++---------------------------
 src/os/bluestore/BlueStore.h  |   1 -
 3 files changed, 35 insertions(+), 144 deletions(-)

diff --git a/src/os/bluestore/BlueAdmin.cc b/src/os/bluestore/BlueAdmin.cc
index e647b7bb85e..da05ecf14cb 100644
--- a/src/os/bluestore/BlueAdmin.cc
+++ b/src/os/bluestore/BlueAdmin.cc
@@ -298,7 +298,7 @@ int BlueStore::SocketHook::call(
     return 0;
   } else if (command == "bluestore bluefs-bdev-expand"){
     std::stringstream result;
-    int ret = store.expand_devices_online(result);
+    int ret = store.expand_devices(result);
     if (ret < 0) {
       ss << "expand device failed: " << cpp_strerror(ret) << std::endl;
     } else {
diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 46b8ccaa6f9..f93342b2b82 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9184,135 +9184,6 @@ string BlueStore::get_device_path(unsigned id)
   return res;
 }
 
-int BlueStore::expand_devices(ostream& out)
-{
-  // let's open in read-only mode first to be able to recover
-  // from the out-of-space state at DB/shared volume(s)
-  // Opening in R/W mode might cause extra space allocation
-  // which is effectively a show stopper for volume expansion.
-  int r = _open_db_and_around(true);
-  ceph_assert(r == 0);
-  bluefs->dump_block_extents(out);
-  out << "Expanding DB/WAL..." << std::endl;
-  // updating dedicated devices first
-  for (auto devid : { BlueFS::BDEV_WAL, BlueFS::BDEV_DB}) {
-    if (devid == bluefs_layout.shared_bdev) {
-      continue;
-    }
-    auto my_bdev = bluefs->get_block_device(devid);
-    uint64_t size = my_bdev ? my_bdev->get_size() : 0;
-    if (size == 0) {
-      // no bdev
-      continue;
-    }
-    if (my_bdev->supported_bdev_label()) {
-      string my_path = get_device_path(devid);
-      bluestore_bdev_label_t my_label;
-      int r = _read_bdev_label(cct, my_bdev, my_path, &my_label);
-      if (r < 0) {
-        derr << "unable to read label for " << my_path << ": "
-              << cpp_strerror(r) << dendl;
-        continue;
-      } else {
-        if (size == my_label.size) {
-          // no need to expand
-          out << devid
-	      << " : nothing to do, skipped"
-	      << std::endl;
-          continue;
-        } else if (size < my_label.size) {
-          // something weird in bdev label
-          out << devid
-	      <<" : ERROR: bdev label is above device size, skipped"
-	      << std::endl;
-          continue;
-        } else {
-          my_label.size = size;
-          out << devid
-	      << " : Expanding to 0x" << std::hex << size
-	      << std::dec << "(" << byte_u_t(size) << ")"
-	      << std::endl;
-          r = _write_bdev_label(cct, my_bdev, my_path, my_label);
-          if (r < 0) {
-            derr << "unable to write label for " << my_path << ": "
-                  << cpp_strerror(r) << dendl;
-          } else {
-            out << devid
-                << " : size updated to 0x" << std::hex << size
-                << std::dec << "(" << byte_u_t(size) << ")"
-                << std::endl;
-          }
-        }
-      }
-    }
-  }
-  // now proceed with a shared device
-  uint64_t size0 = fm->get_size();
-  uint64_t size = bdev->get_size();
-  auto devid = bluefs_layout.shared_bdev;
-  auto aligned_size = p2align(size, min_alloc_size);
-  if (aligned_size == size0) {
-    // no need to expand
-    out << devid
-        << " : nothing to do, skipped"
-        << std::endl;
-  } else if (aligned_size < size0) {
-    // something weird in bdev label
-    out << devid
-        << " : ERROR: previous device size is above the current one, skipped"
-	<< std::endl;
-  } else {
-    auto my_path = get_device_path(devid);
-    out << devid
-	<<" : Expanding to 0x" << std::hex << size
-	<< std::dec << "(" << byte_u_t(size) << ")"
-	<< std::endl;  
-    r = _write_out_fm_meta(size);
-    if (r != 0) {
-      derr << "unable to write out fm meta for " << my_path << ": "
-           << cpp_strerror(r) << dendl;
-    } else if (bdev->supported_bdev_label()) {
-      bdev_label.size = size;
-      uint64_t lsize = std::max(BDEV_LABEL_BLOCK_SIZE, min_alloc_size);
-      for (uint64_t loc : bdev_label_positions) {
-        if ((loc >= size0) && (loc + lsize <= size)) {
-          bdev_label_valid_locations.push_back(loc);
-          if (!bdev_label_multi) {
-            break;
-          }
-        }
-      }
-      r = _write_bdev_label(cct, bdev, my_path,
-        bdev_label, bdev_label_valid_locations);
-      if (r != 0) {
-        derr << "unable to write label(s) for " << my_path << ": "
-             << cpp_strerror(r) << dendl;
-      }
-    }
-    if (r == 0) {
-      out << devid
-          << " : size updated to 0x" << std::hex << size
-          << std::dec << "(" << byte_u_t(size) << ")"
-          << std::endl;
-      _close_db_and_around();
-
-       //
-      // Mount in read/write to sync expansion changes
-      // and make sure everything is all right.
-      //
-      before_expansion_bdev_size = size0; // preserve orignal size to permit
-                                          // following _db_open_and_around()
-                                          // do some post-init stuff on opened
-                                          // allocator.
-
-      r = _open_db_and_around(false);
-      ceph_assert(r == 0);
-    }
-  }
-  _close_db_and_around();
-  return r;
-}
-
 bool BlueStore::get_db_sharding(std::string& res_sharding)
 {
   bool ret = false;
@@ -9323,8 +9194,24 @@ bool BlueStore::get_db_sharding(std::string& res_sharding)
   return ret;
 }
 
-int BlueStore::expand_devices_online(ostream& out)
+int BlueStore::expand_devices(ostream& out)
 {
+  bool need_to_close = false;
+  int r = 0;
+
+  if (!mounted) {
+    // let's open in read-only mode first to be able to recover
+    // from the out-of-space state at DB/shared volume(s)
+    // Opening in R/W mode might cause extra space allocation
+    // which is effectively a show stopper for volume expansion.
+    r = _open_db_and_around(false);
+    if (r < 0) {
+      derr << __func__ << " failed to open db: " << cpp_strerror(r) << dendl;
+      return r;
+    }
+    need_to_close = true;
+  }
+
   bluefs->dump_block_extents(out);
   out << "Expanding DB/WAL..." << std::endl;
 
@@ -9345,7 +9232,7 @@ int BlueStore::expand_devices_online(ostream& out)
     if (my_bdev->supported_bdev_label()) {
       string my_path = get_device_path(devid);
       bluestore_bdev_label_t my_label;
-      int r = _read_bdev_label(cct, my_bdev, my_path, &my_label);
+      r = _read_bdev_label(cct, my_bdev, my_path, &my_label);
       if (r < 0) {
         derr << "unable to read label for " << my_path << ": "
               << cpp_strerror(r) << dendl;
@@ -9380,7 +9267,9 @@ int BlueStore::expand_devices_online(ostream& out)
                 << std::dec << "(" << byte_u_t(size) << ")"
                 << std::endl;
           }
-          bluefs->expand_device(devid, size, old_size);
+          if (mounted) {
+            bluefs->expand_device(devid, size, old_size);
+          }
         }
       }
     }
@@ -9394,7 +9283,7 @@ int BlueStore::expand_devices_online(ostream& out)
   uint64_t size0 = fm->get_size();
   uint64_t size = bdev->get_size();
   auto aligned_size = p2align(size, min_alloc_size);
-  int r = 0;
+  r = 0;
   if (aligned_size == size0) {
     // no need to expand
     out << devid
@@ -9410,7 +9299,7 @@ int BlueStore::expand_devices_online(ostream& out)
     out << devid
 	<<" : Expanding to 0x" << std::hex << size
 	<< std::dec << "(" << byte_u_t(size) << ")"
-	<< std::endl;  
+	<< std::endl;
     r = _write_out_fm_meta(size);
     if (r != 0) {
       derr << "unable to write out fm meta for " << my_path << ": "
@@ -9428,6 +9317,10 @@ int BlueStore::expand_devices_online(ostream& out)
       }
       r = _write_bdev_label(cct, bdev, my_path,
         bdev_label, bdev_label_valid_locations);
+      if (r != 0) {
+        derr << "unable to write label(s) for " << my_path << ": "
+             << cpp_strerror(r) << dendl;
+      }
     }
     if (r == 0) {
       out << devid
@@ -9435,27 +9328,26 @@ int BlueStore::expand_devices_online(ostream& out)
           << std::dec << "(" << byte_u_t(size) << ")"
           << std::endl;
 
-      // since we are not relying on db open/close to update FM
-      // need to keep FM and the shared allocator in sync now
       fm->expand(aligned_size, db);
       alloc->expand(aligned_size);
       alloc->init_add_free(size0, aligned_size - size0);
 
-      need_to_destage_allocation_file = true;
-      before_expansion_bdev_size = 0;
-
       dout(1) << __func__
               << " : size updated to 0x" << std::hex << size
               << std::dec << "(" << byte_u_t(size) << ")"
               << ", allocator type " << alloc->get_type()
-              << ", capacity 0x" << alloc->get_capacity()
+              << ", capacity 0x" << std::hex << alloc->get_capacity()
               << ", block size 0x" << alloc->get_block_size()
               << ", free 0x" << alloc->get_free()
+              << std::dec
               << ", fragmentation " << alloc->get_fragmentation()
-              << std::dec << dendl;
-
+              << dendl;
     }
   }
+
+  if (need_to_close) {
+    _close_db_and_around();
+  }
   return r;
 }
 
diff --git a/src/os/bluestore/BlueStore.h b/src/os/bluestore/BlueStore.h
index b00ceab5c5e..19111a19432 100644
--- a/src/os/bluestore/BlueStore.h
+++ b/src/os/bluestore/BlueStore.h
@@ -3207,7 +3207,6 @@ public:
     int id,
     const std::string& path);
   int expand_devices(std::ostream& out);
-  int expand_devices_online(std::ostream& out);
   std::string get_device_path(unsigned id);
 
   bool get_db_sharding(std::string& res_sharding);

From ba5fb6bef28d9cf1af7183565b0793ff36b18b4c Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Wed, 7 Jan 2026 00:13:28 +0000
Subject: [PATCH 016/596] qa/standalone/bluefs: add online device expansion
 test

verify online device expansion via admin socket works correctly

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 qa/standalone/osd/osd-bluefs-volume-ops.sh | 81 ++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/qa/standalone/osd/osd-bluefs-volume-ops.sh b/qa/standalone/osd/osd-bluefs-volume-ops.sh
index 0f521524363..75f39935ad7 100755
--- a/qa/standalone/osd/osd-bluefs-volume-ops.sh
+++ b/qa/standalone/osd/osd-bluefs-volume-ops.sh
@@ -487,6 +487,87 @@ function TEST_bluestore_expand() {
     ceph-bluestore-tool --log-file $dir/bluestore_tool.log --path $dir/0 qfsck || return 1
 }
 
+function TEST_bluestore_expand_online() {
+    local dir=$1
+
+    local flimit=$(ulimit -n)
+    if [ $flimit -lt 1536 ]; then
+        echo "Low open file limit ($flimit), test may fail. Increase to 1536 or higher and retry if that happens."
+    fi
+    export CEPH_MON="127.0.0.1:7146" # git grep '\<7146\>' : there must be only one
+    export CEPH_ARGS
+    CEPH_ARGS+="--fsid=$(uuidgen) --auth-supported=none "
+    CEPH_ARGS+="--mon-host=$CEPH_MON "
+    CEPH_ARGS+="--bluestore_block_size=2147483648 "
+    CEPH_ARGS+="--bluestore_block_db_create=true "
+    CEPH_ARGS+="--bluestore_block_db_size=536870912 "
+    CEPH_ARGS+="--bluestore_block_wal_create=true "
+    CEPH_ARGS+="--bluestore_block_wal_size=268435456 "
+    CEPH_ARGS+="--bluestore_fsck_on_mount=true "
+
+    run_mon $dir a || return 1
+    run_mgr $dir x || return 1
+    run_osd $dir 0 || return 1
+    osd_pid0=$(cat $dir/osd.0.pid)
+    run_osd $dir 1 || return 1
+    osd_pid1=$(cat $dir/osd.1.pid)
+    run_osd $dir 2 || return 1
+    osd_pid2=$(cat $dir/osd.2.pid)
+    run_osd $dir 3 || return 1
+    osd_pid3=$(cat $dir/osd.3.pid)
+
+    sleep 5
+    create_pool foo 16
+
+    timeout 60 rados bench -p foo 30 write -b 4096 --no-cleanup #|| return 1
+
+    # expand slow devices while OSDs are running
+    truncate $dir/0/block -s 4294967296 # 4GB
+    ceph tell osd.0 bluestore bluefs-bdev-expand || return 1
+
+    truncate $dir/1/block -s 11811160064 # 11GB
+    ceph tell osd.1 bluestore bluefs-bdev-expand || return 1
+
+    truncate $dir/2/block -s 4295099392 # 4GB + 129KB
+    ceph tell osd.2 bluestore bluefs-bdev-expand || return 1
+
+    truncate $dir/3/block -s 4293918720 # 4GB - 1MB
+    ceph tell osd.3 bluestore bluefs-bdev-expand || return 1
+
+    # expand DB devices while OSDs are running
+    truncate $dir/0/block.db -s 1073741824 # 1GB
+    ceph tell osd.0 bluestore bluefs-bdev-expand || return 1
+
+    truncate $dir/1/block.db -s 1073741824 # 1GB
+    ceph tell osd.1 bluestore bluefs-bdev-expand || return 1
+
+    # write more objects to use the new space
+    timeout 60 rados bench -p foo 30 write -b 4096 --no-cleanup #|| return 1
+
+    wait_for_clean || return 1
+
+    ceph tell osd.0 bluestore bluefs device info
+    ceph tell osd.1 bluestore bluefs device info
+    ceph tell osd.2 bluestore bluefs device info
+    ceph tell osd.3 bluestore bluefs device info
+
+    # kill and verify with fsck
+    while kill $osd_pid0; do sleep 1 ; done
+    ceph osd down 0
+    while kill $osd_pid1; do sleep 1 ; done
+    ceph osd down 1
+    while kill $osd_pid2; do sleep 1 ; done
+    ceph osd down 2
+    while kill $osd_pid3; do sleep 1 ; done
+    ceph osd down 3
+
+    ceph-bluestore-tool --path $dir/0 fsck || return 1
+    ceph-bluestore-tool --path $dir/1 fsck || return 1
+    ceph-bluestore-tool --path $dir/2 fsck || return 1
+    ceph-bluestore-tool --path $dir/3 fsck || return 1
+
+}
+
 main osd-bluefs-volume-ops "$@"
 
 # Local Variables:

From 36d005e02d29a6b42840d46bb3b6170a81b38328 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 05:44:00 +0000
Subject: [PATCH 017/596] os/bluestore: make Allocator::device_size atomic and
 protect BitmapAllocator::expand

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/Allocator.h        | 9 +++++----
 src/os/bluestore/BitmapAllocator.cc | 7 ++++---
 src/os/bluestore/BitmapAllocator.h  | 1 +
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/os/bluestore/Allocator.h b/src/os/bluestore/Allocator.h
index df563764330..000c7471ef8 100644
--- a/src/os/bluestore/Allocator.h
+++ b/src/os/bluestore/Allocator.h
@@ -13,6 +13,7 @@
 #ifndef CEPH_OS_BLUESTORE_ALLOCATOR_H
 #define CEPH_OS_BLUESTORE_ALLOCATOR_H
 
+#include <atomic>
 #include <functional>
 #include <ostream>
 #include "include/ceph_assert.h"
@@ -84,19 +85,19 @@ public:
   virtual const std::string& get_name() const = 0;
   int64_t get_capacity() const
   {
-    return device_size;
+    return device_size.load();
   }
   int64_t get_block_size() const
   {
     return block_size;
   }
   virtual void expand(int64_t new_size){
-    ceph_assert(new_size >= device_size);
-    device_size = new_size;
+    ceph_assert(new_size >= device_size.load());
+    device_size.store(new_size);
   }
 
 protected:
-  int64_t device_size = 0;
+  std::atomic<int64_t> device_size{0};
   const int64_t block_size = 0;
 };
 
diff --git a/src/os/bluestore/BitmapAllocator.cc b/src/os/bluestore/BitmapAllocator.cc
index 8c59c2b1dd0..09cc78f2eed 100644
--- a/src/os/bluestore/BitmapAllocator.cc
+++ b/src/os/bluestore/BitmapAllocator.cc
@@ -57,7 +57,7 @@ void BitmapAllocator::release(
     for (auto& [offset, len] : release_set) {
       ldout(cct, 10) << __func__ << " 0x" << std::hex << offset << "~" << len
                      << std::dec << dendl;
-      ceph_assert(offset + len <= (uint64_t)device_size);
+      ceph_assert(offset + len <= (uint64_t)device_size.load());
     }
   }
   _free_l2(release_set);
@@ -73,7 +73,7 @@ void BitmapAllocator::init_add_free(uint64_t offset, uint64_t length)
   auto mas = get_min_alloc_size();
   uint64_t offs = round_up_to(offset, mas);
   uint64_t l = p2align(offset + length - offs, mas);
-  ceph_assert(offs + l <= (uint64_t)device_size);
+  ceph_assert(offs + l <= (uint64_t)device_size.load());
 
   _mark_free(offs, l);
   ldout(cct, 10) << __func__ << " done" << dendl;
@@ -85,13 +85,14 @@ void BitmapAllocator::init_rm_free(uint64_t offset, uint64_t length)
   auto mas = get_min_alloc_size();
   uint64_t offs = round_up_to(offset, mas);
   uint64_t l = p2align(offset + length - offs, mas);
-  ceph_assert(offs + l <= (uint64_t)device_size);
+  ceph_assert(offs + l <= (uint64_t)device_size.load());
   _mark_allocated(offs, l);
   ldout(cct, 10) << __func__ << " done" << dendl;
 }
 
 void BitmapAllocator::expand(int64_t new_size)
 {
+  std::lock_guard l(expand_lock);
   int64_t old_size = get_capacity();
   ceph_assert(new_size >= old_size);
 
diff --git a/src/os/bluestore/BitmapAllocator.h b/src/os/bluestore/BitmapAllocator.h
index 65976eb3c8a..3961af228f6 100644
--- a/src/os/bluestore/BitmapAllocator.h
+++ b/src/os/bluestore/BitmapAllocator.h
@@ -16,6 +16,7 @@
 class BitmapAllocator : public AllocatorBase,
   public AllocatorLevel02<AllocatorLevel01Loose> {
   CephContext* cct;
+  ceph::mutex expand_lock = ceph::make_mutex("BitmapAllocator::expand_lock");
 public:
   BitmapAllocator(CephContext* _cct, int64_t capacity, int64_t alloc_unit,
 		  std::string_view name);

From 0eb1b730d1656f1513e3ccd45c729cdf8435cbc6 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 18:13:34 +0000
Subject: [PATCH 018/596] qa/standalone: bdev-expand calls with no underlying
 device expansion

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 qa/standalone/osd/osd-bluefs-volume-ops.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/qa/standalone/osd/osd-bluefs-volume-ops.sh b/qa/standalone/osd/osd-bluefs-volume-ops.sh
index 75f39935ad7..8f4f14cf14a 100755
--- a/qa/standalone/osd/osd-bluefs-volume-ops.sh
+++ b/qa/standalone/osd/osd-bluefs-volume-ops.sh
@@ -519,6 +519,12 @@ function TEST_bluestore_expand_online() {
     sleep 5
     create_pool foo 16
 
+    # no device expansion sanity check
+    ceph tell osd.0 bluestore bluefs-bdev-expand || return 1
+    ceph tell osd.1 bluestore bluefs-bdev-expand || return 1
+    ceph tell osd.2 bluestore bluefs-bdev-expand || return 1
+    ceph tell osd.3 bluestore bluefs-bdev-expand || return 1
+
     timeout 60 rados bench -p foo 30 write -b 4096 --no-cleanup #|| return 1
 
     # expand slow devices while OSDs are running

From 2186c8bec2acaf716a271bc714ec5b377a2f8f1e Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 18:27:22 +0000
Subject: [PATCH 019/596] os/bluestore: skip bitmapfm exapnd if old and new
 size are the same

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BitmapFreelistManager.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/os/bluestore/BitmapFreelistManager.cc b/src/os/bluestore/BitmapFreelistManager.cc
index ea6f95f45ec..9df22a97007 100644
--- a/src/os/bluestore/BitmapFreelistManager.cc
+++ b/src/os/bluestore/BitmapFreelistManager.cc
@@ -164,6 +164,9 @@ int BitmapFreelistManager::_expand(uint64_t old_size, KeyValueDB* db)
 }
 
 int BitmapFreelistManager::expand(uint64_t new_size, KeyValueDB* db){
+  if (new_size == size){
+    return 0;
+  }
   uint64_t old_size = size;
   size = new_size;
   return _expand(old_size ,db);

From 12eaa37f7b87e654d868591eff4f714b663c09ab Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 18:57:54 +0000
Subject: [PATCH 020/596] os/bluestore: remove unused if branch

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index f93342b2b82..fb2311611e8 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9267,9 +9267,7 @@ int BlueStore::expand_devices(ostream& out)
                 << std::dec << "(" << byte_u_t(size) << ")"
                 << std::endl;
           }
-          if (mounted) {
-            bluefs->expand_device(devid, size, old_size);
-          }
+          bluefs->expand_device(devid, size, old_size);
         }
       }
     }

From 17f2979774d845985bb35c3a4bc54a2f6b050a31 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 18:58:51 +0000
Subject: [PATCH 021/596] os/bluestore: rounds size0 up such that expand is
 [p2roundup(size0), aligned_size)

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index fb2311611e8..90c78c71c4f 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9328,7 +9328,8 @@ int BlueStore::expand_devices(ostream& out)
 
       fm->expand(aligned_size, db);
       alloc->expand(aligned_size);
-      alloc->init_add_free(size0, aligned_size - size0);
+      uint64_t aligned_size0 = p2roundup(size0, min_alloc_size);
+      alloc->init_add_free(aligned_size0, aligned_size - aligned_size0);
 
       dout(1) << __func__
               << " : size updated to 0x" << std::hex << size

From 5962c7e8e901089703ba9f75fff697c2fea20c76 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 19:34:16 +0000
Subject: [PATCH 022/596] os/bluestore: round old size by min_alloc

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueFS.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/os/bluestore/BlueFS.cc b/src/os/bluestore/BlueFS.cc
index 3144538fd30..3b19b21c618 100644
--- a/src/os/bluestore/BlueFS.cc
+++ b/src/os/bluestore/BlueFS.cc
@@ -16,6 +16,7 @@
 #include "Allocator.h"
 #include "include/buffer_fwd.h"
 #include "include/ceph_assert.h"
+#include "include/intarith.h"
 #include "include/stringify.h"
 #include "common/admin_socket.h"
 #include "os/bluestore/bluefs_types.h"
@@ -936,7 +937,8 @@ void BlueFS::expand_device(unsigned devid, uint64_t new_size, uint64_t old_size)
 
   alloc[devid]->expand(new_size);
   auto aligned_size = p2align(new_size, alloc_size[devid]);
-  alloc[devid]->init_add_free(old_size, aligned_size - old_size);
+  auto aligned_old_size = p2roundup(old_size, alloc_size[devid]);
+  alloc[devid]->init_add_free(aligned_old_size, aligned_size - aligned_old_size);
 
   if (vselector) {
     vselector->expand_device(devid, aligned_size);

From 8d1dadb90cef1a3f1feb53b459502a486bccc5cd Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Tue, 3 Mar 2026 19:37:06 +0000
Subject: [PATCH 023/596] os/bluestore: adds assert for device mounted before
 expand

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 90c78c71c4f..b31462d8975 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9267,6 +9267,7 @@ int BlueStore::expand_devices(ostream& out)
                 << std::dec << "(" << byte_u_t(size) << ")"
                 << std::endl;
           }
+          ceph_assert(mounted);
           bluefs->expand_device(devid, size, old_size);
         }
       }

From 60197ef72c219137c3f3c6747fdf3181f0d7e5ac Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Thu, 5 Mar 2026 16:25:59 +0000
Subject: [PATCH 024/596] os/bluestore: fix nullptr derefence for bdev in
 single-device setup

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index b31462d8975..1d5bc522b80 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9222,6 +9222,9 @@ int BlueStore::expand_devices(ostream& out)
     }
 
     auto my_bdev = bluefs->get_block_device(devid);
+    if (!my_bdev) {
+      continue;
+    }
     my_bdev->refresh_size();
     uint64_t size = my_bdev ? my_bdev->get_size() : 0;
 

From 4f93487e2d48f843bb30d8fe1015ddf718ba0c47 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Mon, 16 Mar 2026 17:29:14 +0000
Subject: [PATCH 025/596] os/bluestore: open bluestore in read only mode during
 device expansion

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 1d5bc522b80..9aaec54cf88 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9204,11 +9204,8 @@ int BlueStore::expand_devices(ostream& out)
     // from the out-of-space state at DB/shared volume(s)
     // Opening in R/W mode might cause extra space allocation
     // which is effectively a show stopper for volume expansion.
-    r = _open_db_and_around(false);
-    if (r < 0) {
-      derr << __func__ << " failed to open db: " << cpp_strerror(r) << dendl;
-      return r;
-    }
+    r = _open_db_and_around(true);
+    ceph_assert(r == 0);
     need_to_close = true;
   }
 

From b8b8fa97073ebb4248aca62c143d5947eec779b1 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Mon, 16 Mar 2026 20:31:04 +0000
Subject: [PATCH 026/596] os/bluestore: dout free space added starts at
 aligned_old_size

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueFS.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/os/bluestore/BlueFS.cc b/src/os/bluestore/BlueFS.cc
index 3b19b21c618..8bd8fff46cd 100644
--- a/src/os/bluestore/BlueFS.cc
+++ b/src/os/bluestore/BlueFS.cc
@@ -950,8 +950,8 @@ void BlueFS::expand_device(unsigned devid, uint64_t new_size, uint64_t old_size)
   ceph_assert(total > total - free);
 
   dout(10) << __func__ << " dev " << devid
-           << " added free space: 0x" << std::hex << old_size
-           << "~0x" << (aligned_size - old_size) << std::dec << dendl;
+           << " added free space: 0x" << std::hex << aligned_old_size
+           << "~0x" << (aligned_size - aligned_old_size) << std::dec << dendl;
 }
 
 int BlueFS::_read_and_check(uint8_t ndev, uint64_t off, uint64_t len,

From 439e1b04dfb12fbf5633b893620d697dc614b78d Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Mon, 13 Apr 2026 02:20:39 +0000
Subject: [PATCH 027/596] os/bluestore: fix offline device expansion in
 expand_devices

guard bluefs->expand_device for online-only
fixes offline expansion by reopening db from r/o to r/w
fixes int64_t/uint64_t type mismatch for old_size

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 9aaec54cf88..49e78cebc10 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9251,7 +9251,7 @@ int BlueStore::expand_devices(ostream& out)
 	      << std::endl;
           continue;
         } else {
-          int64_t old_size = my_label.size;
+          uint64_t old_size = my_label.size;
           my_label.size = size;
           out << devid
 	      << " : Expanding to 0x" << std::hex << size
@@ -9266,9 +9266,12 @@ int BlueStore::expand_devices(ostream& out)
                 << " : size updated to 0x" << std::hex << size
                 << std::dec << "(" << byte_u_t(size) << ")"
                 << std::endl;
+            // online expand needs to update allocator now
+            // offline does not need this as update will happen
+            // on next open
+            if (!need_to_close)
+              bluefs->expand_device(devid, size, old_size);
           }
-          ceph_assert(mounted);
-          bluefs->expand_device(devid, size, old_size);
         }
       }
     }
@@ -9327,6 +9330,12 @@ int BlueStore::expand_devices(ostream& out)
           << std::dec << "(" << byte_u_t(size) << ")"
           << std::endl;
 
+      if (need_to_close) {
+        _close_db_and_around();
+        r = _open_db_and_around(false);
+        ceph_assert(r == 0);
+      }
+
       fm->expand(aligned_size, db);
       alloc->expand(aligned_size);
       uint64_t aligned_size0 = p2roundup(size0, min_alloc_size);

From bd412d1f175948f4cbd7fd22977d21a1279df3d5 Mon Sep 17 00:00:00 2001
From: Joshua Blanch <joshua.blanch@clyso.com>
Date: Mon, 13 Apr 2026 17:20:30 +0000
Subject: [PATCH 028/596] os/bluestore: restore previous offline expansion
 logic

expanding allocator before opening for offline path
fixes to comments and null check

Signed-off-by: Joshua Blanch <joshua.blanch@clyso.com>
---
 src/os/bluestore/BlueStore.cc | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index 49e78cebc10..3d49feff4e7 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -9223,7 +9223,7 @@ int BlueStore::expand_devices(ostream& out)
       continue;
     }
     my_bdev->refresh_size();
-    uint64_t size = my_bdev ? my_bdev->get_size() : 0;
+    uint64_t size = my_bdev->get_size();
 
     if (size == 0) {
       // no bdev
@@ -9266,7 +9266,7 @@ int BlueStore::expand_devices(ostream& out)
                 << " : size updated to 0x" << std::hex << size
                 << std::dec << "(" << byte_u_t(size) << ")"
                 << std::endl;
-            // online expand needs to update allocator now
+            // online expand needs to update BlueFS allocator(s) now
             // offline does not need this as update will happen
             // on next open
             if (!need_to_close)
@@ -9332,15 +9332,23 @@ int BlueStore::expand_devices(ostream& out)
 
       if (need_to_close) {
         _close_db_and_around();
+        //
+        // Mount in read/write to sync expansion changes
+        // and make sure everything is all right.
+        //
+        before_expansion_bdev_size = size0; // preserve orignal size to permit
+                                            // following _db_open_and_around()
+                                            // do some post-init stuff on opened
+                                            // allocator.
         r = _open_db_and_around(false);
         ceph_assert(r == 0);
+      } else {
+        fm->expand(aligned_size, db);
+        alloc->expand(aligned_size);
+        uint64_t aligned_size0 = p2roundup(size0, min_alloc_size);
+        alloc->init_add_free(aligned_size0, aligned_size - aligned_size0);
       }
 
-      fm->expand(aligned_size, db);
-      alloc->expand(aligned_size);
-      uint64_t aligned_size0 = p2roundup(size0, min_alloc_size);
-      alloc->init_add_free(aligned_size0, aligned_size - aligned_size0);
-
       dout(1) << __func__
               << " : size updated to 0x" << std::hex << size
               << std::dec << "(" << byte_u_t(size) << ")"

From 2599fc10c5e25c7543538cf15f822241f6151fec Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 8 Dec 2025 18:06:40 +0530
Subject: [PATCH 029/596] volumes/stats_util: improve log messages

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/pybind/mgr/volumes/fs/stats_util.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/pybind/mgr/volumes/fs/stats_util.py b/src/pybind/mgr/volumes/fs/stats_util.py
index 683ffc2df85..6c5d8f8705a 100644
--- a/src/pybind/mgr/volumes/fs/stats_util.py
+++ b/src/pybind/mgr/volumes/fs/stats_util.py
@@ -47,6 +47,7 @@ def get_amount_copied(src_path, dst_path, fs_handle):
 
     try:
         size_t = int(fs_handle.getxattr(src_path, rbytes))
+        log.debug(f'rbytes on path src_path ({src_path}) = {size_t}')
     except ObjectNotFound:
         log.info(f'get_amount_copied(): source path "{src_path}" went missing, '
                   'couldn\'t run getxattr on it')
@@ -54,6 +55,7 @@ def get_amount_copied(src_path, dst_path, fs_handle):
 
     try:
         size_c = int(fs_handle.getxattr(dst_path, rbytes))
+        log.debug(f'rbytes on path dst_path ({dst_path}) = {size_c}')
     except ObjectNotFound:
         log.info(f'get_amount_copied(): destination path "{dst_path}" went '
                   'missing, couldn\'t run getxattr on it')
@@ -210,8 +212,8 @@ class CloneProgressReporter:
                     # get clone in order in which they were launched, this
                     # should be same as the ctime on clone entry.
                     clone_index_entries = clone_index.list_entries_by_ctime_order()
-                    log.debug('finished collecting all clone index entries, '
-                              f'found {len(clones)} clone index entries')
+                    log.debug(f'found {len(clone_index_entries)} clone index '
+                               'entries')
 
                 # reset ongoing clone counter before iterating over all clone
                 # entries
@@ -248,8 +250,7 @@ class CloneProgressReporter:
 
                     clones.append(ci)
 
-        log.debug('finished collecting info on all clones, found '
-                  f'{len(clones)} clones out of which '
+        log.debug(f'found {len(clones)} clones, out of which '
                   f'{self.ongoing_clones_count} are ongoing clones')
         return clones
 

From 269e76bb139d3c28092249edf1b92dfbfaf38c93 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 8 Dec 2025 18:07:09 +0530
Subject: [PATCH 030/596] qa/cephfs: increase number of files to cloned in
 test_clone_stats.py

There's a race condition between cloning operation and clone progress
reporter thread to open the subvolume, former does so to copy/clone
files and latter to get details of the source and destination subvolume.

A low number of files in the snapshot gives clone progress reporter
thread less or no chance to fetch and process the details needed to
display the progress bar. This causes tests to fails when progress bar
isn't displayed in the output of "ceph status" output.

Increasing the number of files will give clone progress reporter more
time to display the progress bar and therefore these unnecessary test
failures wlll reduce/stop.

This failure wasn't seen earlier because Python code was being used to
copy files which was comparatively slow (compared to C++ code that was
merged to copy files as a part of fscrypt work) which allowed enough
time to clone progress reporter thread to process stats and display
clone progress bar.

Fixes: https://tracker.ceph.com/issues/74082
Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 qa/tasks/cephfs/volumes/test_clone_stats.py | 22 ++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/qa/tasks/cephfs/volumes/test_clone_stats.py b/qa/tasks/cephfs/volumes/test_clone_stats.py
index ce4c4709829..5b5c41ee32f 100644
--- a/qa/tasks/cephfs/volumes/test_clone_stats.py
+++ b/qa/tasks/cephfs/volumes/test_clone_stats.py
@@ -332,7 +332,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         c = 'ss1clone1'
 
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} --mode=777')
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
@@ -369,7 +369,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         c = 'ss1clone1'
 
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} --mode=777')
-        size = self._do_subvolume_io(sv, None, None, 10, 1024)
+        size = self._do_subvolume_io(sv, None, None, 100, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
@@ -417,7 +417,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
 
         self.run_ceph_cmd(f'fs subvolumegroup create {v} {group}')
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} {group} --mode=777')
-        size = self._do_subvolume_io(sv, group, None, 10, 1024)
+        size = self._do_subvolume_io(sv, group, None, 100, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss} {group}')
         self.wait_till_rbytes_is_right(v, sv, size, group)
@@ -469,7 +469,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         self.config_set('mds', 'mds_snap_rstat', 'true')
 
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} --mode=777')
-        size = self._do_subvolume_io(sv, None, None, 10, 1024)
+        size = self._do_subvolume_io(sv, None, None, 100, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
@@ -513,7 +513,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         c = self._gen_subvol_clone_name(4)
 
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} --mode=777')
-        size = self._do_subvolume_io(sv, None, None, 10, 1024)
+        size = self._do_subvolume_io(sv, None, None, 100, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
@@ -563,7 +563,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
 
         self.config_set('mgr', 'mgr/volumes/snapshot_clone_no_wait', 'false')
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} --mode=777')
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
@@ -614,7 +614,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
 
         self.config_set('mgr', 'mgr/volumes/snapshot_clone_no_wait', 'false')
         self.run_ceph_cmd(f'fs subvolume create {v} {sv} --mode=777')
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
 
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
@@ -673,7 +673,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         sv_path = self.get_ceph_cmd_stdout(f'fs subvolume getpath {v} {sv}')
         sv_path = sv_path[1:]
 
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
 
@@ -716,7 +716,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         sv_path = self.get_ceph_cmd_stdout(f'fs subvolume getpath {v} {sv}')
         sv_path = sv_path[1:]
 
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
 
@@ -763,7 +763,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         sv_path = self.get_ceph_cmd_stdout(f'fs subvolume getpath {v} {sv}')
         sv_path = sv_path[1:]
 
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
 
@@ -814,7 +814,7 @@ class TestOngoingClonesCounter(CloneProgressReporterHelper):
         sv_path = self.get_ceph_cmd_stdout(f'fs subvolume getpath {v} {sv}')
         sv_path = sv_path[1:]
 
-        size = self._do_subvolume_io(sv, None, None, 3, 1024)
+        size = self._do_subvolume_io(sv, None, None, 30, 100)
         self.run_ceph_cmd(f'fs subvolume snapshot create {v} {sv} {ss}')
         self.wait_till_rbytes_is_right(v, sv, size)
 

From 241cfc6c06d11a8245222a20d4ed615c8dbcb63b Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 8 Dec 2025 18:24:47 +0530
Subject: [PATCH 031/596] qa/cephfs: give more time to tests in
 test_clone_stats.py

Currently tests wait for 10 seconds for clone progress bar to appear and
it usually takes 8 seconds to find it. In case of the host where test is
being run is slow, the progress bar can take more time to appear and the
test can fail unnecessarily. To avoid this, increase the waiting
duration.

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 qa/tasks/cephfs/volumes/test_clone_stats.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/qa/tasks/cephfs/volumes/test_clone_stats.py b/qa/tasks/cephfs/volumes/test_clone_stats.py
index 5b5c41ee32f..299107cfdad 100644
--- a/qa/tasks/cephfs/volumes/test_clone_stats.py
+++ b/qa/tasks/cephfs/volumes/test_clone_stats.py
@@ -376,7 +376,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
 
         self.run_ceph_cmd(f'fs subvolume snapshot clone {v} {sv} {ss} {c}')
 
-        with safe_while(tries=10, sleep=1) as proceed:
+        with safe_while(tries=10, sleep=2) as proceed:
             while proceed():
                 pev = self.get_pevs_from_ceph_status(c)
 
@@ -425,7 +425,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         self.run_ceph_cmd(f'fs subvolume snapshot clone {v} {sv} {ss} {c} '
                           f'--group-name {group}')
 
-        with safe_while(tries=10, sleep=1) as proceed:
+        with safe_while(tries=10, sleep=2) as proceed:
             while proceed():
                 pev = self.get_pevs_from_ceph_status(c)
 
@@ -521,7 +521,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
         for i in c:
             self.run_ceph_cmd(f'fs subvolume snapshot clone {v} {sv} {ss} {i}')
 
-        with safe_while(tries=10, sleep=1) as proceed:
+        with safe_while(tries=10, sleep=2) as proceed:
             while proceed():
                 pev = self.get_pevs_from_ceph_status(c)
 
@@ -573,7 +573,7 @@ class TestCloneProgressReporter(CloneProgressReporterHelper):
 
         msg = ('messages for progress bars for snapshot cloning are not how '
                'they were expected')
-        with safe_while(tries=20, sleep=1, action=msg) as proceed:
+        with safe_while(tries=20, sleep=2, action=msg) as proceed:
             while proceed():
                 pevs = self.get_pevs_from_ceph_status(c)
 

From c75b8eefd7bcb8dcf91aaa8fb8bcfd1fe9c9a6ca Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 8 Dec 2025 18:27:59 +0530
Subject: [PATCH 032/596] qa/cephfs: minor fix in comment

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 qa/tasks/cephfs/volumes/test_clone_stats.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/tasks/cephfs/volumes/test_clone_stats.py b/qa/tasks/cephfs/volumes/test_clone_stats.py
index 299107cfdad..194dfafed99 100644
--- a/qa/tasks/cephfs/volumes/test_clone_stats.py
+++ b/qa/tasks/cephfs/volumes/test_clone_stats.py
@@ -797,7 +797,7 @@ class TestOngoingClonesCounter(CloneProgressReporterHelper):
     '''
     Class CloneProgressReporter contains the code that lets it figure out the
     number of ongoing clones on its own, without referring the MGR config
-    option mgr/volumes/max_concurrenr_clones. This class contains tests to
+    option mgr/volumes/max_concurrent_clones. This class contains tests to
     ensure that this code, that does the figuring out, is working fine.
     '''
 

From 8499124ada51858d788387bcf7c24178368aa95d Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Wed, 3 Dec 2025 09:28:08 +0100
Subject: [PATCH 033/596] mgr/cephadm: plumb force_delete_data through
 daemon/service removal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR wires the `force_delete_data` already existing flag in the
binary through cephadm’s daemon and service removal paths, so that
commands such as `ceph orch rm service` or equivalent daemon removal
can explicitly ask for data deletion instead of the default "move
under <fsid>/removed/" for daemons such as Prometheus, osd and mon.

Fixes: https://tracker.ceph.com/issues/74058
Signed-off-by: Kobi Ginon <kginon@redhat.com>
---
 doc/cephadm/services/index.rst               |  7 +++
 doc/cephadm/services/monitoring.rst          |  7 ++-
 doc/mgr/orchestrator.rst                     | 11 +++-
 src/pybind/mgr/cephadm/inventory.py          | 19 +++---
 src/pybind/mgr/cephadm/module.py             | 64 ++++++++++++++++----
 src/pybind/mgr/cephadm/serve.py              | 22 ++++---
 src/pybind/mgr/cephadm/tests/test_cephadm.py | 44 ++++++++++++++
 src/pybind/mgr/orchestrator/_interface.py    |  4 +-
 src/pybind/mgr/orchestrator/module.py        | 60 +++++++++++++++---
 9 files changed, 195 insertions(+), 43 deletions(-)

diff --git a/doc/cephadm/services/index.rst b/doc/cephadm/services/index.rst
index dfe737f83d2..05566235128 100644
--- a/doc/cephadm/services/index.rst
+++ b/doc/cephadm/services/index.rst
@@ -804,6 +804,13 @@ For example:
 
     ceph orch rm rgw.myrgw
 
+The same command accepts ``--force`` and ``--force-delete-data``. Use
+``ceph orch rm <service-name> --force --force-delete-data`` when you want
+cephadm to remove on-disk data for supported daemon types instead of relocating
+it under ``<fsid>/removed/``. The latter flag requires ``--force``. The same
+pair of flags applies to ``ceph orch daemon rm <daemon-name>`` when removing
+individual daemons.
+
 
 .. _cephadm-spec-unmanaged:
 
diff --git a/doc/cephadm/services/monitoring.rst b/doc/cephadm/services/monitoring.rst
index d89818cf9e1..8552e2316be 100644
--- a/doc/cephadm/services/monitoring.rst
+++ b/doc/cephadm/services/monitoring.rst
@@ -463,11 +463,16 @@ To disable monitoring and remove the software that supports it, run the followin
 .. prompt:: bash #
 
   ceph orch rm grafana
-  ceph orch rm prometheus --force   # this will delete metrics data collected so far
+  ceph orch rm prometheus
   ceph orch rm node-exporter
   ceph orch rm alertmanager
   ceph mgr module disable prometheus
 
+By default, cephadm moves Prometheus data aside under ``<fsid>/removed/`` on the
+host. To delete that data instead, use
+``ceph orch rm prometheus --force --force-delete-data`` in place of
+``ceph orch rm prometheus`` (``--force-delete-data`` requires ``--force``).
+
 See also :ref:`orch-rm`.
 
 Setting up RBD-Image Monitoring
diff --git a/doc/mgr/orchestrator.rst b/doc/mgr/orchestrator.rst
index c3fd5bee405..154015c1ff7 100644
--- a/doc/mgr/orchestrator.rst
+++ b/doc/mgr/orchestrator.rst
@@ -113,10 +113,19 @@ Creating/growing/shrinking/removing services:
    ceph orch apply mds <fs_name> [--placement=<placement>] [--dry-run]
    ceph orch apply rgw <name> [--realm=<realm>] [--zone=<zone>] [--port=<port>] [--ssl] [--placement=<placement>] [--dry-run]
    ceph orch apply nfs <name> <pool> [--namespace=<namespace>] [--placement=<placement>] [--dry-run]
-   ceph orch rm <service_name> [--force]
+   ceph orch rm <service_name> [--force] [--force-delete-data]
 
 where ``placement`` is a :ref:`orchestrator-cli-placement-spec`.
 
+For ``ceph orch rm``, ``--force`` may be required in some cases (for example when
+removing an OSD service that would leave OSDs behind).
+
+The ``--force-delete-data`` flag requires that ``--force`` is also passed.
+This directs cephadm to delete on-disk data for certain daemon types instead
+of moving it to ``<fsid>/removed/`` on the host. These daemon types include
+``mon``, ``osd``, and ``prometheus``. This helps avoid filling up the
+underlying filesystem over time.
+
 e.g., ``ceph orch apply mds myfs --placement="3 host1 host2 host3"``
 
 Service Commands:
diff --git a/src/pybind/mgr/cephadm/inventory.py b/src/pybind/mgr/cephadm/inventory.py
index aed6ba03efa..cdb75d2b75f 100644
--- a/src/pybind/mgr/cephadm/inventory.py
+++ b/src/pybind/mgr/cephadm/inventory.py
@@ -239,7 +239,7 @@ class SpecDescription(NamedTuple):
     spec: ServiceSpec
     rank_map: Optional[Dict[int, Dict[int, Optional[str]]]]
     created: datetime.datetime
-    deleted: Optional[datetime.datetime]
+    deleted: Optional[Tuple[datetime.datetime, bool]]
 
 
 class SpecStore():
@@ -250,7 +250,7 @@ class SpecStore():
         # service_name -> rank -> gen -> daemon_id
         self._rank_maps = {}    # type: Dict[str, Dict[int, Dict[int, Optional[str]]]]
         self.spec_created = {}  # type: Dict[str, datetime.datetime]
-        self.spec_deleted = {}  # type: Dict[str, datetime.datetime]
+        self.spec_deleted = {}  # type: Dict[str, Tuple[datetime.datetime, bool]]
         self.spec_preview = {}  # type: Dict[str, ServiceSpec]
         self._needs_configuration: Dict[str, bool] = {}
 
@@ -315,8 +315,11 @@ class SpecStore():
                 self.spec_created[service_name] = created
 
                 if 'deleted' in j:
-                    deleted = str_to_datetime(cast(str, j['deleted']))
-                    self.spec_deleted[service_name] = deleted
+                    deleted_ts = str_to_datetime(cast(str, j['deleted']))
+                    force_delete_data = cast(
+                        bool, j.get('force_delete_data', False)
+                    )
+                    self.spec_deleted[service_name] = (deleted_ts, force_delete_data)
 
                 if 'needs_configuration' in j:
                     self._needs_configuration[service_name] = cast(bool, j['needs_configuration'])
@@ -378,7 +381,9 @@ class SpecStore():
         if name in self._rank_maps:
             data['rank_map'] = self._rank_maps[name]
         if name in self.spec_deleted:
-            data['deleted'] = datetime_to_str(self.spec_deleted[name])
+            deleted_time, force_delete_data = self.spec_deleted[name]
+            data['deleted'] = datetime_to_str(deleted_time)
+            data['force_delete_data'] = force_delete_data
         if name in self._needs_configuration:
             data['needs_configuration'] = self._needs_configuration[name]
 
@@ -469,7 +474,7 @@ class SpecStore():
                         service_name=nvmeof_spec.service_name(),
                         user_made=True)
 
-    def rm(self, service_name: str) -> bool:
+    def rm(self, service_name: str, force_delete_data: bool = False) -> bool:
         if service_name not in self._specs:
             return False
 
@@ -477,7 +482,7 @@ class SpecStore():
             self.finally_rm(service_name)
             return True
 
-        self.spec_deleted[service_name] = datetime_now()
+        self.spec_deleted[service_name] = (datetime_now(), force_delete_data)
         self.save(self._specs[service_name], update_create=False)
         return True
 
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index e6704e8a023..e631d71b62b 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -2494,13 +2494,14 @@ Then run the following:
             else:
                 size = spec.placement.get_target_count(self.cache.get_schedulable_hosts())
 
+            deleted_ts = self.spec_store.spec_deleted.get(nm)
             svc_desc = orchestrator.ServiceDescription(
                 spec=spec,
                 size=size,
                 running=0,
                 events=self.events.get_for_service(spec.service_name()),
                 created=self.spec_store.spec_created[nm],
-                deleted=self.spec_store.spec_deleted.get(nm, None),
+                deleted=deleted_ts[0] if deleted_ts else None,
                 virtual_ip=spec.get_virtual_ip(),
                 ports=spec.get_port_start(),
             )
@@ -2786,28 +2787,61 @@ Then run the following:
         return msg
 
     @handle_orch_error
-    def remove_daemons(self, names):
-        # type: (List[str]) -> List[str]
+    def remove_daemons(self,
+                       names: List[str],
+                       force_delete_data: bool = False) -> List[str]:
+        """
+        Remove specific daemon(s).
+
+        :param names: daemon names to remove
+        :param force: skip safety checks (PRECIOUS DATA warning)
+        :param force_delete_data: if True, request that cephadm delete the
+                                  daemon data instead of moving it under
+                                  <fsid>/removed/.
+        """
         args = []
         for host, dm in self.cache.daemons.items():
             for name in names:
                 if name in dm:
-                    args.append((name, host))
+                    args.append((name, host, force_delete_data))
         if not args:
             raise OrchestratorError('Unable to find daemon(s) %s' % (names), errno=errno.EINVAL)
         self.log.info('Remove daemons %s' % ' '.join([a[0] for a in args]))
         return self._remove_daemons(args)
 
     @handle_orch_error
-    def remove_service(self, service_name: str, force: bool = False) -> str:
-        self.log.info('Remove service %s' % service_name)
+    def remove_service(
+        self,
+        service_name: str,
+        force: bool = False,
+        force_delete_data: bool = False
+    ) -> str:
+        """
+        Remove a service.
+
+        :param service_name: service to remove
+        :param force: skip safety checks (e.g., leftover OSDs)
+        :param force_delete_data: intent to delete backing daemon data instead
+                                  of moving it under <fsid>/removed/.
+                                  (actual effect depends on lower layers)
+        """
+        self.log.info(
+            'Remove service %s (force=%s, force_delete_data=%s)' %
+            (service_name, force, force_delete_data)
+        )
         self._trigger_preview_refresh(service_name=service_name)
         if service_name in self.spec_store:
             if self.spec_store[service_name].spec.service_type in ('mon', 'mgr'):
-                return f'Unable to remove {service_name} service.\n' \
-                       f'Note, you might want to mark the {service_name} service as "unmanaged"'
+                return (
+                    f'Unable to remove {service_name} service.\n'
+                    f'Note, you might want to mark the {service_name} '
+                    f'service as "unmanaged"'
+                )
         else:
-            return f"Invalid service '{service_name}'. Use 'ceph orch ls' to list available services.\n"
+            return (
+                f"Invalid service '{service_name}'. Use 'ceph orch ls' to "
+                f"list available services.\n"
+            )
 
         # Report list of affected OSDs?
         if not force and service_name.startswith('osd.'):
@@ -2824,9 +2858,11 @@ Then run the following:
                 for h, ls in osds_msg.items():
                     msg += f'\thost {h}: {" ".join([f"osd.{id}" for id in ls])}'
                 raise OrchestratorError(
-                    f'If {service_name} is removed then the following OSDs will remain, --force to proceed anyway\n{msg}')
+                    f'If {service_name} is removed then the following OSDs '
+                    f'will remain, --force to proceed anyway\n{msg}'
+                )
 
-        found = self.spec_store.rm(service_name)
+        found = self.spec_store.rm(service_name, force_delete_data)
         if found and service_name.startswith('osd.'):
             self.spec_store.finally_rm(service_name)
         self._kick_serve_loop()
@@ -3244,8 +3280,10 @@ Then run the following:
         return previews_for_specs
 
     @forall_hosts
-    def _remove_daemons(self, name: str, host: str) -> str:
-        return CephadmServe(self)._remove_daemon(name, host)
+    def _remove_daemons(self, name: str, host: str, force_delete_data: bool = False) -> str:
+        # pass force_delete_data by keyword: third positional arg is no_post_remove
+        return CephadmServe(self)._remove_daemon(
+            name, host, force_delete_data=force_delete_data)
 
     def _check_pool_exists(self, pool: str, service_name: str) -> None:
         logger.info(f'Checking pool "{pool}" exists for service {service_name}')
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index c98321e8111..75e7a8aa5d4 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1116,15 +1116,16 @@ class CephadmServe:
             if not spec and dd.daemon_type not in ['mon', 'mgr', 'osd']:
                 # (mon and mgr specs should always exist; osds aren't matched
                 # to a service spec)
+                force_delete_data = False
+                if dd.service_name() in self.mgr.spec_store.spec_deleted:
+                    _, force_delete_data = self.mgr.spec_store.spec_deleted[dd.service_name()]
                 self.log.info('Removing orphan daemon %s...' % dd.name())
-                self._remove_daemon(dd.name(), dd.hostname)
-
-            # ignore unmanaged services
-            if spec and spec.unmanaged:
+                self._remove_daemon(dd.name(), dd.hostname, force_delete_data=force_delete_data)
+                # This daemon was removed from cache; skip any additional checks
+                # in this iteration to avoid looking up stale daemon entries.
                 continue
 
-            # ignore daemons for deleted services
-            if dd.service_name() in self.mgr.spec_store.spec_deleted:
+            if spec and spec.unmanaged:
                 continue
 
             if dd.daemon_type == 'agent':
@@ -1593,7 +1594,7 @@ class CephadmServe:
             ic_params.append(ic.to_json(flatten_args=True))
         return ic_meta
 
-    def _remove_daemon(self, name: str, host: str, no_post_remove: bool = False) -> str:
+    def _remove_daemon(self, name: str, host: str, no_post_remove: bool = False, force_delete_data: bool = False) -> str:
         """
         Remove a daemon
         """
@@ -1612,10 +1613,11 @@ class CephadmServe:
             service_registry.get_service(daemon_type_to_service(daemon_type)).pre_remove(daemon)
             # NOTE: we are passing the 'force' flag here, which means
             # we can delete a mon instances data.
+            args = ['--name', name, '--force']
+            if force_delete_data:
+                args.append('--force-delete-data')
             if dd.ports:
-                args = ['--name', name, '--force', '--tcp-ports', ' '.join(map(str, dd.ports))]
-            else:
-                args = ['--name', name, '--force']
+                args.extend(['--tcp-ports', ' '.join(map(str, dd.ports))])
 
             self.log.info('Removing daemon %s from %s -- ports %s' % (name, host, dd.ports))
             with self.mgr.async_timeout_handler(host, f'cephadm rm-daemon (daemon {name})'):
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index 264919cd0f9..2eb16c85cb9 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -1597,6 +1597,50 @@ class TestCephadm(object):
             out = wait(cephadm_module, c)
             assert out == ["Removed rgw.myrgw.myhost.myid from host 'test'"]
 
+    @pytest.mark.parametrize(
+        "daemon_name",
+        ["osd.424242", "prometheus.force_delete_data_regression"]
+    )
+    @mock.patch("cephadm.serve.CephadmServe._run_cephadm")
+    def test_remove_daemon_force_delete_data_passes_cephadm_flag(self, _run_cephadm, cephadm_module, daemon_name):
+        """Regression: force_delete_data must be passed as a keyword to _remove_daemon.
+
+        Otherwise the third positional arg is bound to no_post_remove and cephadm
+        never receives --force-delete-data (see _remove_daemon parameter order).
+        """
+        ls_json = json.dumps([
+            dict(
+                name=daemon_name,
+                style='cephadm',
+                fsid='fsid',
+                container_id='container_id',
+                version='version',
+                state='running',
+            )
+        ])
+
+        async def side_effect(host, entity, command, args, **kwargs):
+            if command == 'ls':
+                return [ls_json], '', 0
+            return ['{}'], '', 0
+
+        _run_cephadm.side_effect = side_effect
+
+        with with_host(cephadm_module, 'test'):
+            CephadmServe(cephadm_module)._refresh_host_daemons('test')
+            c = cephadm_module.list_daemons()
+            wait(cephadm_module, c)
+            c = cephadm_module.remove_daemons([daemon_name], force_delete_data=True)
+            wait(cephadm_module, c)
+
+        rm_daemon_calls = [
+            call for call in _run_cephadm.call_args_list
+            if len(call[0]) >= 4 and call[0][2] == 'rm-daemon'
+        ]
+        assert len(rm_daemon_calls) == 1
+        rm_args = rm_daemon_calls[0][0][3]
+        assert '--force-delete-data' in rm_args
+
     @mock.patch("cephadm.serve.CephadmServe._run_cephadm")
     def test_remove_duplicate_osds(self, _run_cephadm, cephadm_module: CephadmOrchestrator):
         _run_cephadm.side_effect = async_side_effect(('{}', '', 0))
diff --git a/src/pybind/mgr/orchestrator/_interface.py b/src/pybind/mgr/orchestrator/_interface.py
index 136fde595ac..a230594d60f 100644
--- a/src/pybind/mgr/orchestrator/_interface.py
+++ b/src/pybind/mgr/orchestrator/_interface.py
@@ -662,7 +662,7 @@ class Orchestrator(object):
         """
         raise NotImplementedError()
 
-    def remove_daemons(self, names: List[str]) -> OrchResult[List[str]]:
+    def remove_daemons(self, names: List[str], force_delete_data: bool = False) -> OrchResult[List[str]]:
         """
         Remove specific daemon(s).
 
@@ -670,7 +670,7 @@ class Orchestrator(object):
         """
         raise NotImplementedError()
 
-    def remove_service(self, service_name: str, force: bool = False) -> OrchResult[str]:
+    def remove_service(self, service_name: str, force: bool = False, force_delete_data: bool = False) -> OrchResult[str]:
         """
         Remove a service (a collection of daemons).
 
diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index 4b4489237e8..7b559370c33 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -1802,25 +1802,67 @@ Usage:
     @OrchestratorCLICommand.Write('orch daemon rm')
     def _daemon_rm(self,
                    names: List[str],
-                   force: Optional[bool] = False) -> HandleCommandResult:
-        """Remove specific daemon(s)"""
+                   force: bool = False,
+                   force_delete_data: bool = False) -> HandleCommandResult:
+        """
+        Remove specific daemon(s).
+
+        When used with --force-delete-data, data for certain daemon types
+        (mon, osd, prometheus) will be deleted instead of being moved to
+        <fsid>/removed/.
+        """
         for name in names:
             if '.' not in name:
-                return HandleCommandResult(stderr=f"{name} is not a valid daemon name", retval=-errno.EINVAL)
-            (daemon_type) = name.split('.')[0]
+                return HandleCommandResult(
+                    stderr=f"{name} is not a valid daemon name",
+                    retval=-errno.EINVAL
+                )
+
+            daemon_type = name.split('.')[0]
+
             if not force and daemon_type in ['osd', 'mon', 'prometheus']:
-                return HandleCommandResult(stderr=f"must pass --force to REMOVE daemon with potentially PRECIOUS DATA for {name}", retval=-errno.EPERM)
-        completion = self.remove_daemons(names)
+                return HandleCommandResult(
+                    stderr=f"must pass --force to remove daemon with potentially precious data for {name}",
+                    retval=-errno.EPERM
+                )
+
+        if force_delete_data and not force:
+            # extra safety: don’t allow delete-data without force
+            return HandleCommandResult(
+                stderr="--force-delete-data requires --force",
+                retval=-errno.EPERM
+            )
+
+        completion = self.remove_daemons(
+            names,
+            force_delete_data=force_delete_data,
+        )
         return completion_to_result(completion)
 
     @OrchestratorCLICommand.Write('orch rm')
     def _service_rm(self,
                     service_name: str,
-                    force: bool = False) -> HandleCommandResult:
-        """Remove a service"""
+                    force: bool = False,
+                    force_delete_data: bool = False) -> HandleCommandResult:
+        """
+        Remove a service.
+
+        When used with --force-delete-data, data for stateful daemons belonging
+        to this service (e.g. mon, osd, prometheus) will be deleted instead of
+        being moved to <fsid>/removed/.
+        """
         if service_name in ['mon', 'mgr'] and not force:
             raise OrchestratorError('The mon and mgr services cannot be removed')
-        completion = self.remove_service(service_name, force=force)
+
+        if force_delete_data and not force:
+            # same safety rule as for daemon rm
+            raise OrchestratorError('--force-delete-data requires --force')
+
+        completion = self.remove_service(
+            service_name,
+            force=force,
+            force_delete_data=force_delete_data,
+        )
         raise_if_exception(completion)
         return HandleCommandResult(stdout=completion.result_str())
 

From a22a63030fc99285fc2d3cbceeceea9349790fa6 Mon Sep 17 00:00:00 2001
From: "Kamoltat (Junior) Sirivadhna" <ksirivad@redhat.com>
Date: Tue, 28 Apr 2026 20:13:10 +0000
Subject: [PATCH 034/596] src/script: init test_stretch crush_collisions.sh

Add script to test for CRUSH retry exhaustion in stretch mode with
2 datacenters. Tests unbiased stretch rules by running multiple
iterations of PG mappings and checking for collisions that exceed
the 50-try limit.

Also add --show-retry-exhaustion flag to crushtool to detect and
report when CRUSH mapping hits the maximum retry limit.

Signed-off-by: Kamoltat (Junior) Sirivadhna <ksirivad@redhat.com>
---
 src/crush/CrushTester.cc                    |  43 ++++-
 src/crush/CrushTester.h                     |   9 ++
 src/script/test_stretch_crush_collisions.sh | 171 ++++++++++++++++++++
 src/tools/crushtool.cc                      |   5 +
 4 files changed, 220 insertions(+), 8 deletions(-)
 create mode 100755 src/script/test_stretch_crush_collisions.sh

diff --git a/src/crush/CrushTester.cc b/src/crush/CrushTester.cc
index 9fc95d8df9c..9f5e7d9061c 100644
--- a/src/crush/CrushTester.cc
+++ b/src/crush/CrushTester.cc
@@ -475,7 +475,7 @@ int CrushTester::test(CephContext* cct)
   // make adjustments
   adjust_weights(weight);
 
-  if (output_choose_tries)
+  if (output_choose_tries || show_retry_exhaustion)
     crush.start_choose_profile();
   
   for (int r = min_rule; r < crush.get_max_rules() && r <= max_rule; r++) {
@@ -673,15 +673,42 @@ int CrushTester::test(CephContext* cct)
     }
   }
 
-  if (output_choose_tries) {
+  if (output_choose_tries || show_retry_exhaustion) {
     __u32 *v = 0;
     int n = crush.get_choose_profile(&v);
-    for (int i=0; i<n; i++) {
-      cout.setf(std::ios::right);
-      cout << std::setw(2)
-      << i << ": " << std::setw(9) << v[i];
-      cout.unsetf(std::ios::right);
-      cout << std::endl;
+    
+    if (output_choose_tries) {
+      for (int i=0; i<n; i++) {
+        cout.setf(std::ios::right);
+        cout << std::setw(2) << "tries "
+        << i+1 << ": " << std::setw(9) << v[i];
+        cout.unsetf(std::ios::right);
+        cout << std::endl;
+      }
+    }
+    
+    if (show_retry_exhaustion) {
+      // Check if the maximum retry count (n-1) has any hits
+      if (n > 0 && v[n-1] > 0) {
+        cerr << std::endl;
+        cerr << "WARNING: Retry exhaustion detected!" << std::endl;
+        cerr << "  " << v[n-1] << " PG(s) hit the maximum retry limit of " << (n) << std::endl;
+        cerr << "  This indicates CRUSH failed to find optimal placement for some PGs." << std::endl;
+        cerr << std::endl;
+      } else {
+        cout << std::endl;
+        cout << "No retry exhaustion detected (maximum tries needed: ";
+        // Find the actual maximum tries used
+        int max_tries_used = 1;
+        for (int i = n-1; i >= 0; i--) {
+          if (v[i] > 0) {
+            max_tries_used = i+1;
+            break;
+          }
+        }
+        cout << max_tries_used << " / " << (n) << ")" << std::endl;
+        cout << std::endl;
+      }
     }
 
     crush.stop_choose_profile();
diff --git a/src/crush/CrushTester.h b/src/crush/CrushTester.h
index 49e41de3080..daacc26ad97 100644
--- a/src/crush/CrushTester.h
+++ b/src/crush/CrushTester.h
@@ -31,6 +31,7 @@ class CrushTester {
   bool output_mappings;
   bool output_bad_mappings;
   bool output_choose_tries;
+  bool show_retry_exhaustion;
 
   bool output_data_file;
   bool output_csv;
@@ -182,6 +183,7 @@ public:
       output_mappings(false),
       output_bad_mappings(false),
       output_choose_tries(false),
+      show_retry_exhaustion(false),
       output_data_file(false),
       output_csv(false),
       output_data_file_name("")
@@ -251,6 +253,13 @@ public:
     return output_choose_tries;
   }
 
+  void set_show_retry_exhaustion(bool b) {
+    show_retry_exhaustion = b;
+  }
+  bool get_show_retry_exhaustion() const {
+    return show_retry_exhaustion;
+  }
+
   void set_batches(int b) {
     num_batches = b;
   }
diff --git a/src/script/test_stretch_crush_collisions.sh b/src/script/test_stretch_crush_collisions.sh
new file mode 100755
index 00000000000..dc924f1b577
--- /dev/null
+++ b/src/script/test_stretch_crush_collisions.sh
@@ -0,0 +1,171 @@
+#!/bin/bash
+# Test script to detect CRUSH retry exhaustion in stretch mode configurations
+# Tests whether unbiased stretch rules with exactly 2 datacenters experience
+# collision retry exhaustion (hitting the 50-try limit)
+
+set -e
+
+# Find the script directory and repo root
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+# Default to build directory at repo root, but allow override
+BUILD_DIR="${BUILD_DIR:-$REPO_ROOT/build}"
+
+# Find crushtool
+if [ -n "$CRUSHTOOL" ]; then
+    # User specified CRUSHTOOL, use it
+    :
+elif [ -x "$BUILD_DIR/bin/crushtool" ]; then
+    CRUSHTOOL="$BUILD_DIR/bin/crushtool"
+else
+    echo "Error: Cannot find crushtool. Please set BUILD_DIR or CRUSHTOOL environment variable."
+    exit 1
+fi
+
+OUTPUT_DIR="${OUTPUT_DIR:-./crush_test_results}"
+NUM_PGS="${NUM_PGS:-100000}"
+
+mkdir -p "$OUTPUT_DIR"
+
+# Function to create a CRUSH map with 2 datacenters
+create_crush_map() {
+    local filename=$1
+
+    cat > "$filename" <<'EOF'
+# CRUSH map for stretch mode with 2 datacenters
+# Matches real cluster structure
+
+# devices
+device 0 osd.0
+device 1 osd.1
+device 2 osd.2
+device 3 osd.3
+device 4 osd.4
+device 5 osd.5
+device 6 osd.6
+device 7 osd.7
+
+# types
+type 0 osd
+type 1 host
+type 2 datacenter
+type 3 root
+
+# buckets
+host host1 {
+    id -9
+    alg straw2
+    hash 0
+    item osd.0 weight 1.0
+    item osd.1 weight 1.0
+}
+
+host host2 {
+    id -10
+    alg straw2
+    hash 0
+    item osd.2 weight 1.0
+    item osd.3 weight 1.0
+}
+
+host host3 {
+    id -11
+    alg straw2
+    hash 0
+    item osd.4 weight 1.0
+    item osd.5 weight 1.0
+}
+
+host host4 {
+    id -12
+    alg straw2
+    hash 0
+    item osd.6 weight 1.0
+    item osd.7 weight 1.0
+}
+
+datacenter dc1 {
+    id -5
+    alg straw2
+    hash 0
+    item host1 weight 2.0
+    item host2 weight 2.0
+}
+
+datacenter dc2 {
+    id -7
+    alg straw2
+    hash 0
+    item host3 weight 2.0
+    item host4 weight 2.0
+}
+
+root default {
+    id -1
+    alg straw2
+    hash 0
+    item dc1 weight 4.0
+    item dc2 weight 4.0
+}
+
+# CRUSH rules
+rule stretch_replicated_rule {
+    id 0
+    type replicated
+    step take default
+    step choose firstn 0 type datacenter
+    step chooseleaf firstn 2 type host
+    step emit
+}
+EOF
+}
+
+# Function to test a CRUSH map
+test_crush_map() {
+    local map_txt=$1
+    local map_bin=$2
+    local rule_id=$3
+    local rule_name=$4
+    local iteration=$5
+    
+    if $CRUSHTOOL -i "$map_bin" --test \
+        --min-x 1 \
+        --max-x "$NUM_PGS" \
+        --rule "$rule_id" \
+        --num-rep 4 \
+        --show-statistics \
+        --set-choose-total-tries 50 \
+        --show-retry-exhaustion 2>&1 | grep -q "WARNING: Retry exhaustion detected!"; then
+        return 1  # Retry exhaustion detected - failure
+    else
+        return 0  # No retry exhaustion - success
+    fi
+}
+
+echo "Testing Unbiased Rule with 2 Datacenters"
+echo "Running 100 iterations with $NUM_PGS PGs each..."
+echo ""
+
+create_crush_map "$OUTPUT_DIR/crush_2dc.txt"
+
+echo "Compiling CRUSH map..."
+$CRUSHTOOL -c "$OUTPUT_DIR/crush_2dc.txt" -o "$OUTPUT_DIR/crush_2dc.bin"
+
+for i in $(seq 1 100); do
+    echo -n "  Iteration $i/100: "
+    
+    if test_crush_map \
+        "$OUTPUT_DIR/crush_2dc.txt" \
+        "$OUTPUT_DIR/crush_2dc.bin" \
+        0 \
+        "stretch_replicated_rule" \
+        "$i"; then
+        echo "OK"
+    else
+        echo "RETRY EXHAUSTION DETECTED"
+        exit 1
+    fi
+done
+
+
diff --git a/src/tools/crushtool.cc b/src/tools/crushtool.cc
index 21b3efd3475..17e6e31f9dd 100644
--- a/src/tools/crushtool.cc
+++ b/src/tools/crushtool.cc
@@ -229,6 +229,8 @@ void usage()
   cout << "   --show-mappings       show mappings\n";
   cout << "   --show-bad-mappings   show bad mappings\n";
   cout << "   --show-choose-tries   show choose tries histogram\n";
+  cout << "   --show-retry-exhaustion\n";
+  cout << "                         check for and report CRUSH retry exhaustion\n";
   cout << "   --output-name name\n";
   cout << "                         prepend the data file(s) generated during the\n";
   cout << "                         testing routine with name\n";
@@ -542,6 +544,9 @@ int main(int argc, const char **argv)
     } else if (ceph_argparse_flag(args, i, "--show_choose_tries", (char*)NULL)) {
       display = true;
       tester.set_output_choose_tries(true);
+    } else if (ceph_argparse_flag(args, i, "--show-retry-exhaustion", (char*)NULL)) {
+      display = true;
+      tester.set_show_retry_exhaustion(true);
     } else if (ceph_argparse_witharg(args, i, &val, "-c", "--compile", (char*)NULL)) {
       srcfn = val;
       compile = true;

From 8e9e1fa46d1b81cf52f35ad4e83fd635834a324a Mon Sep 17 00:00:00 2001
From: "Kamoltat (Junior) Sirivadhna" <ksirivad@redhat.com>
Date: Tue, 28 Apr 2026 20:16:00 +0000
Subject: [PATCH 035/596] doc: update crushtool.rst

Add --show-retry-exhaustion flag to doc

Signed-off-by: Kamoltat (Junior) Sirivadhna <ksirivad@redhat.com>
---
 doc/man/8/crushtool.rst | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/doc/man/8/crushtool.rst b/doc/man/8/crushtool.rst
index 4c848659655..f1de7ef37c4 100644
--- a/doc/man/8/crushtool.rst
+++ b/doc/man/8/crushtool.rst
@@ -151,15 +151,35 @@ pools; it only runs simulations by mapping values in the range
    Displays how many attempts were needed to find a device mapping.
    For instance::
 
-      0:     95224
-      1:      3745
-      2:      2225
+      tries 0:     95224
+      tries 1:      3745
+      tries 2:      2225
       ..
 
    shows that **95224** mappings succeeded without retries, **3745**
    mappings succeeded with one attempts, etc. There are as many rows
    as the value of the **--set-choose-total-tries** option.
 
+.. option:: --show-retry-exhaustion
+
+   Checks whether any PG mappings hit the maximum retry limit
+   (typically 50 tries) and displays a warning if retry exhaustion
+   is detected. This is useful for validating CRUSH rules, especially
+   in stretch cluster configurations with exactly
+   2 datacenters and 4 replicas can potentially fail to map some PGs due to CRUSH's
+   pseudorandom selection repeatedly choosing the same datacenter.
+   Although, the probability is extremely low, we still want to detect this.
+   
+   Outputs either a warning message if exhaustion is detected::
+
+      WARNING: Retry exhaustion detected!
+        5 PG(s) hit the maximum retry limit of 50
+        This indicates CRUSH failed to find optimal placement for some PGs.
+
+   or a success message showing the maximum tries actually needed::
+
+      No retry exhaustion detected (maximum tries needed: 7 / 50)
+
 .. option:: --output-csv
 
    Creates CSV files (in the current directory) containing information

From 2eb274eef256ba93dd97b7c74b94fb78d761e106 Mon Sep 17 00:00:00 2001
From: Shilpa Jagannath <smanjara@redhat.com>
Date: Wed, 29 Apr 2026 18:02:05 +0000
Subject: [PATCH 036/596] rgw/archive: record the bucket creation time at
 archive zone

source bucket deletion triggers a new bucket instance creation
at archive zone. record its mtime and display in bucket stats.
store it as an attr RGW_ATTR_ARCHIVE_INSTANCE_MTIME

Signed-off-by: Shilpa Jagannath <smanjara@redhat.com>
---
 src/rgw/driver/rados/rgw_bucket.cc | 22 +++++++++++++++++++++-
 src/rgw/rgw_common.h               |  1 +
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/rgw/driver/rados/rgw_bucket.cc b/src/rgw/driver/rados/rgw_bucket.cc
index 233163ce78b..0074f15e24f 100644
--- a/src/rgw/driver/rados/rgw_bucket.cc
+++ b/src/rgw/driver/rados/rgw_bucket.cc
@@ -1641,6 +1641,21 @@ static int bucket_stats(rgw::sal::Driver* driver, const rgw::SiteConfig& site,
   }
   ut.gmtime(formatter->dump_stream("mtime"));
   ctime_ut.gmtime(formatter->dump_stream("creation_time"));
+
+  // if this is an archive zone "-deleted-" bucket, expose when this instance was created
+  auto archive_mtime_iter = bucket->get_attrs().find(RGW_ATTR_ARCHIVE_INSTANCE_MTIME);
+  if (archive_mtime_iter != bucket->get_attrs().end()) {
+    try {
+      ceph::real_time archive_instance_mtime;
+      auto bliter = archive_mtime_iter->second.cbegin();
+      decode(archive_instance_mtime, bliter);
+      utime_t archive_mtime_ut(archive_instance_mtime);
+      archive_mtime_ut.gmtime(formatter->dump_stream("archive_instance_mtime"));
+    } catch (buffer::error& err) {
+      ldpp_dout(dpp, 0) << "WARNING: failed to decode archive_instance_mtime attr" << dendl;
+    }
+  }
+
   encode_json("bucket_quota", bucket_info.quota, formatter);
 
   // bucket tags
@@ -2642,7 +2657,7 @@ static void get_md5_digest(const RGWBucketEntryPoint *be, string& md5_digest) {
    md5_digest = md5;
 }
 
-#define ARCHIVE_META_ATTR RGW_ATTR_PREFIX "zone.archive.info" 
+#define ARCHIVE_META_ATTR RGW_ATTR_PREFIX "zone.archive.info"
 
 struct archive_meta_info {
   rgw_bucket orig_bucket;
@@ -2757,6 +2772,11 @@ class RGWArchiveBucketMetadataHandler : public RGWBucketMetadataHandler {
 
     new_be.bucket.name = new_bucket_name;
 
+    ceph::real_time instance_mtime = ceph::real_clock::now();
+    bufferlist bl;
+    encode(instance_mtime, bl);
+    attrs_m[RGW_ATTR_ARCHIVE_INSTANCE_MTIME] = std::move(bl);
+
     ret = ctl_bucket->store_bucket_instance_info(new_be.bucket, new_bi, y, dpp, RGWBucketCtl::BucketInstance::PutParams()
                                                                     .set_exclusive(false)
                                                                     .set_mtime(orig_mtime)
diff --git a/src/rgw/rgw_common.h b/src/rgw/rgw_common.h
index 8f95f4ef671..38d7520ae39 100644
--- a/src/rgw/rgw_common.h
+++ b/src/rgw/rgw_common.h
@@ -115,6 +115,7 @@ using ceph::crypto::MD5;
 #define RGW_ATTR_BUCKET_LOGGING RGW_ATTR_PREFIX "logging"
 #define RGW_ATTR_BUCKET_LOGGING_MTIME RGW_ATTR_PREFIX "logging-mtime"
 #define RGW_ATTR_BUCKET_LOGGING_SOURCES RGW_ATTR_PREFIX "logging-sources"
+#define RGW_ATTR_ARCHIVE_INSTANCE_MTIME RGW_ATTR_PREFIX "zone.archive.instance.mtime"
 
 /* S3 Object Lock*/
 #define RGW_ATTR_OBJECT_LOCK        RGW_ATTR_PREFIX "object-lock"

From 88999681041a14e386417f32ed6686b524a4d534 Mon Sep 17 00:00:00 2001
From: "Kamoltat (Junior) Sirivadhna" <ksirivad@redhat.com>
Date: Wed, 29 Apr 2026 14:11:41 +0000
Subject: [PATCH 037/596] src/test: update show-choose-tries.t tests

Since we modified crushtool cli commands, we need to also update
its test with new flag: --show-retry-exhaustion
and also the modified --show-choose-tries option

Also added /src/script/run-cli-tests.sh to run the cram test
easily without having the config headache

Signed-off-by: Kamoltat (Junior) Sirivadhna <ksirivad@redhat.com>
---
 doc/dev/developer_guide/tests-unit-tests.rst |  25 +++
 src/script/run-cli-tests.sh                  |  67 +++++++
 src/test/cli/crushtool/help.t                |   2 +
 src/test/cli/crushtool/show-choose-tries.t   | 200 +++++++++----------
 4 files changed, 194 insertions(+), 100 deletions(-)
 create mode 100755 src/script/run-cli-tests.sh

diff --git a/doc/dev/developer_guide/tests-unit-tests.rst b/doc/dev/developer_guide/tests-unit-tests.rst
index e6026dd3c63..0ee13779234 100644
--- a/doc/dev/developer_guide/tests-unit-tests.rst
+++ b/doc/dev/developer_guide/tests-unit-tests.rst
@@ -71,6 +71,31 @@ teuthology using the `cram task`_.
 .. _`cram`: https://bitheap.org/cram/
 .. _`cram task`: https://github.com/ceph/ceph/blob/master/qa/tasks/cram.py
 
+Running CLI tools tests
+-----------------------
+
+A convenience script is provided to run CLI tests easily without having to manually set up the environment.
+From the Ceph source tree root directory:
+
+  .. prompt:: bash $
+
+     # Run all CLI tests
+     ./src/script/run-cli-tests.sh
+
+     # Run with custom build directory
+     ./src/script/run-cli-tests.sh -b /path/to/build
+
+Alternatively, you can run the tests directly from the build directory by setting up your PATH:
+
+  .. prompt:: bash $
+
+     cd build
+     PATH="$PWD/bin:$PATH" ../src/test/run-cli-tests
+
+The test suite includes tests for: ``ceph-authtool``, ``ceph-conf``, 
+``ceph-kvstore-tool``, ``crushtool``, ``monmaptool``, ``osdmaptool``, 
+``radosgw-admin``, and ``rbd``.
+
 Tox-based testing of Python modules
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 Some of the Python modules in Ceph use `tox <https://tox.readthedocs.io/en/latest/>`_ 
diff --git a/src/script/run-cli-tests.sh b/src/script/run-cli-tests.sh
new file mode 100755
index 00000000000..1e6c8522e61
--- /dev/null
+++ b/src/script/run-cli-tests.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CEPH_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BUILD_DIR="${BUILD_DIR:-$CEPH_ROOT/build}"
+
+usage() {
+    cat <<EOF
+Usage: $0 [OPTIONS]
+
+Run CLI tests for Ceph tools using the cram testing framework.
+
+Options:
+    -h, --help      Show this help message
+    -b, --build     Specify build directory (default: $CEPH_ROOT/build)
+
+Examples:
+    # Run all CLI tests:
+    $0
+
+    # Run with custom build directory:
+    $0 -b /path/to/build
+
+EOF
+    exit 0
+}
+
+# Parse options
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -h|--help)
+            usage
+            ;;
+        -b|--build)
+            BUILD_DIR="$2"
+            shift 2
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            ;;
+    esac
+done
+
+# Verify build directory exists
+if [ ! -d "$BUILD_DIR" ]; then
+    echo "Error: Build directory not found: $BUILD_DIR"
+    echo "Please build Ceph first or specify correct build directory with -b"
+    exit 1
+fi
+
+# Verify build/bin directory exists
+if [ ! -d "$BUILD_DIR/bin" ]; then
+    echo "Error: Build binaries not found in $BUILD_DIR/bin"
+    echo "Please run './do_cmake.sh && cd build && ninja' first"
+    exit 1
+fi
+
+# Change to build directory and run tests
+cd "$BUILD_DIR"
+export PATH="$PWD/bin:$PATH"
+
+echo "Running all CLI tests from build directory: $BUILD_DIR"
+echo "=================================================="
+exec "$CEPH_ROOT/src/test/run-cli-tests"
diff --git a/src/test/cli/crushtool/help.t b/src/test/cli/crushtool/help.t
index 72085688c68..ec83dfb96a3 100644
--- a/src/test/cli/crushtool/help.t
+++ b/src/test/cli/crushtool/help.t
@@ -107,6 +107,8 @@
      --show-mappings       show mappings
      --show-bad-mappings   show bad mappings
      --show-choose-tries   show choose tries histogram
+     --show-retry-exhaustion
+                           check for and report CRUSH retry exhaustion
      --output-name name
                            prepend the data file(s) generated during the
                            testing routine with name
diff --git a/src/test/cli/crushtool/show-choose-tries.t b/src/test/cli/crushtool/show-choose-tries.t
index 6a7ecaec07a..18ffa0586f3 100644
--- a/src/test/cli/crushtool/show-choose-tries.t
+++ b/src/test/cli/crushtool/show-choose-tries.t
@@ -1,108 +1,108 @@
   $ crushtool -c "$TESTDIR/show-choose-tries.txt" -o "$TESTDIR/show-choose-tries.crushmap"
   $ FIRSTN_RULESET=0
   $ crushtool -i "$TESTDIR/show-choose-tries.crushmap" --test --show-choose-tries --rule $FIRSTN_RULESET --x 1 --num-rep 2
-   0:         1
-   1:         1
-   2:         0
-   3:         0
-   4:         0
-   5:         0
-   6:         0
-   7:         0
-   8:         0
-   9:         0
-  10:         0
-  11:         0
-  12:         0
-  13:         0
-  14:         0
-  15:         0
-  16:         0
-  17:         0
-  18:         0
-  19:         0
-  20:         0
-  21:         0
-  22:         0
-  23:         0
-  24:         0
-  25:         0
-  26:         0
-  27:         0
-  28:         0
-  29:         0
-  30:         0
-  31:         0
-  32:         0
-  33:         0
-  34:         0
-  35:         0
-  36:         0
-  37:         0
-  38:         0
-  39:         0
-  40:         0
-  41:         0
-  42:         0
-  43:         0
-  44:         0
-  45:         0
-  46:         0
-  47:         0
-  48:         0
-  49:         0
+  tries 1:         1
+  tries 2:         1
+  tries 3:         0
+  tries 4:         0
+  tries 5:         0
+  tries 6:         0
+  tries 7:         0
+  tries 8:         0
+  tries 9:         0
+  tries 10:         0
+  tries 11:         0
+  tries 12:         0
+  tries 13:         0
+  tries 14:         0
+  tries 15:         0
+  tries 16:         0
+  tries 17:         0
+  tries 18:         0
+  tries 19:         0
+  tries 20:         0
+  tries 21:         0
+  tries 22:         0
+  tries 23:         0
+  tries 24:         0
+  tries 25:         0
+  tries 26:         0
+  tries 27:         0
+  tries 28:         0
+  tries 29:         0
+  tries 30:         0
+  tries 31:         0
+  tries 32:         0
+  tries 33:         0
+  tries 34:         0
+  tries 35:         0
+  tries 36:         0
+  tries 37:         0
+  tries 38:         0
+  tries 39:         0
+  tries 40:         0
+  tries 41:         0
+  tries 42:         0
+  tries 43:         0
+  tries 44:         0
+  tries 45:         0
+  tries 46:         0
+  tries 47:         0
+  tries 48:         0
+  tries 49:         0
+  tries 50:         0
   $ INDEP_RULESET=1
   $ crushtool -i "$TESTDIR/show-choose-tries.crushmap" --test --show-choose-tries --rule $INDEP_RULESET --x 1 --num-rep 1
-   0:         0
-   1:         1
-   2:         0
-   3:         0
-   4:         0
-   5:         0
-   6:         0
-   7:         0
-   8:         0
-   9:         0
-  10:         0
-  11:         0
-  12:         0
-  13:         0
-  14:         0
-  15:         0
-  16:         0
-  17:         0
-  18:         0
-  19:         0
-  20:         0
-  21:         0
-  22:         0
-  23:         0
-  24:         0
-  25:         0
-  26:         0
-  27:         0
-  28:         0
-  29:         0
-  30:         0
-  31:         0
-  32:         0
-  33:         0
-  34:         0
-  35:         0
-  36:         0
-  37:         0
-  38:         0
-  39:         0
-  40:         0
-  41:         0
-  42:         0
-  43:         0
-  44:         0
-  45:         0
-  46:         0
-  47:         0
-  48:         0
-  49:         0
+  tries 1:         0
+  tries 2:         1
+  tries 3:         0
+  tries 4:         0
+  tries 5:         0
+  tries 6:         0
+  tries 7:         0
+  tries 8:         0
+  tries 9:         0
+  tries 10:         0
+  tries 11:         0
+  tries 12:         0
+  tries 13:         0
+  tries 14:         0
+  tries 15:         0
+  tries 16:         0
+  tries 17:         0
+  tries 18:         0
+  tries 19:         0
+  tries 20:         0
+  tries 21:         0
+  tries 22:         0
+  tries 23:         0
+  tries 24:         0
+  tries 25:         0
+  tries 26:         0
+  tries 27:         0
+  tries 28:         0
+  tries 29:         0
+  tries 30:         0
+  tries 31:         0
+  tries 32:         0
+  tries 33:         0
+  tries 34:         0
+  tries 35:         0
+  tries 36:         0
+  tries 37:         0
+  tries 38:         0
+  tries 39:         0
+  tries 40:         0
+  tries 41:         0
+  tries 42:         0
+  tries 43:         0
+  tries 44:         0
+  tries 45:         0
+  tries 46:         0
+  tries 47:         0
+  tries 48:         0
+  tries 49:         0
+  tries 50:         0
   $ rm -f "$TESTDIR/show-choose-tries.crushmap"
 # Local Variables:
 # compile-command: "cd ../../.. ; make -j4 crushtool && test/run-cli-tests"

From 9b0becfdf248576565481369780f5599766c3810 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Wed, 21 Jan 2026 21:13:39 +0530
Subject: [PATCH 038/596] mgr/cephadm: Updated NFS default protocol to v4 and
 v3 is enabled only when enable_nfsv3 is set in the spec

Fixes: https://tracker.ceph.com/issues/74492
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/cephadm/services/nfs.rst                  |  3 +++
 doc/mgr/nfs.rst                               |  5 +++-
 src/pybind/mgr/cephadm/services/nfs.py        |  3 ++-
 .../templates/services/nfs/ganesha.conf.j2    |  4 +--
 .../cephadm/tests/services/test_ingress.py    |  2 +-
 .../mgr/cephadm/tests/services/test_nfs.py    | 26 +++++++++++++++++++
 src/pybind/mgr/nfs/cluster.py                 |  5 ++++
 src/pybind/mgr/nfs/module.py                  |  2 ++
 .../ceph/deployment/service_spec.py           |  2 ++
 9 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/doc/cephadm/services/nfs.rst b/doc/cephadm/services/nfs.rst
index 07d19df950d..ecb31bff93f 100644
--- a/doc/cephadm/services/nfs.rst
+++ b/doc/cephadm/services/nfs.rst
@@ -60,6 +60,7 @@ Alternatively, an NFS service can be applied using a YAML specification.
         host2: 10.0.0.124
       monitoring_networks:
       - 192.168.124.0/24
+      enable_nfsv3: true
 
 
 In this example, we run the server on the non-default ``port`` of
@@ -78,6 +79,8 @@ IP address is assigned to the host, that IP address will be used. If the IP
 address is not present and ``monitoring_networks`` is specified, an IP address
 that matches one of the specified networks will be used. If neither condition
 is met, the default binding will happen on all available network interfaces.
+By default, only the NFSv4 protocol is enabled. NFSv3 can be enabled by setting
+``enable_nfsv3`` to ``true`` in the service specification.
 
 NFS over RDMA
 -------------
diff --git a/doc/mgr/nfs.rst b/doc/mgr/nfs.rst
index e09378b26cd..4ef7a9581b9 100644
--- a/doc/mgr/nfs.rst
+++ b/doc/mgr/nfs.rst
@@ -31,7 +31,7 @@ Create NFS Ganesha Cluster
 
 .. prompt:: bash #
 
-   ceph nfs cluster create <cluster_id> [<placement>] [--ingress] [--virtual_ip <value>] [--ingress-mode {default|keepalive-only|haproxy-standard|haproxy-protocol}] [--port <int>] [--enable-rdma] [--rdma_port <int>] [-i <spec_file>]
+   ceph nfs cluster create <cluster_id> [<placement>] [--ingress] [--virtual_ip <value>] [--ingress-mode {default|keepalive-only|haproxy-standard|haproxy-protocol}] [--port <int>] [--enable-rdma] [--rdma_port <int>] [-i <spec_file>] [--enable-nfsv3]
 
 This creates a common recovery pool for all NFS Ganesha daemons, new user based on
 ``cluster_id``, and a common NFS Ganesha config RADOS object.
@@ -62,6 +62,9 @@ cluster)::
 
 NFS can be deployed on a port other than 2049 (the default) with ``--port <port>``.
 
+By default, only NFS v4 protocol is enabled. To enable both NFS v3 and v4 protocols,
+add the ``--enable-nfsv3`` flag.
+
 To deploy NFS with a high-availability front-end (virtual IP and load balancer), add the
 ``--ingress`` flag and specify a virtual IP address. This will deploy a combination
 of keepalived and haproxy to provide an high-availability NFS frontend for the NFS
diff --git a/src/pybind/mgr/cephadm/services/nfs.py b/src/pybind/mgr/cephadm/services/nfs.py
index ac01900eb02..1c26f8a0644 100644
--- a/src/pybind/mgr/cephadm/services/nfs.py
+++ b/src/pybind/mgr/cephadm/services/nfs.py
@@ -261,7 +261,8 @@ class NFSService(CephService):
                 "tls_min_version": spec.tls_min_version,
                 "tls_ktls": spec.tls_ktls,
                 "tls_debug": spec.tls_debug,
-                "ceph_nodes": ceph_nodes
+                "ceph_nodes": ceph_nodes,
+                "protocols": "3, 4" if spec.enable_nfsv3 else "4"
             }
             if spec.enable_haproxy_protocol:
                 context["haproxy_hosts"] = self._haproxy_hosts()
diff --git a/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2 b/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
index 606b1c5704f..2d211f4e7b0 100644
--- a/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
+++ b/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
@@ -3,9 +3,9 @@ NFS_CORE_PARAM {
         Enable_NLM = {{ enable_nlm }};
         Enable_RQUOTA = false;
 {% if enable_rdma %}
-        Protocols = 3, 4, nfsrdma, rpcrdma;
+        Protocols = {{ protocols }}, nfsrdma, rpcrdma;
 {% else %}
-        Protocols = 3, 4;
+        Protocols = {{ protocols }};
 {% endif %}
         mount_path_pseudo = true;
         Enable_UDP = false;
diff --git a/src/pybind/mgr/cephadm/tests/services/test_ingress.py b/src/pybind/mgr/cephadm/tests/services/test_ingress.py
index 86692935e18..a5bbe078d6e 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_ingress.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_ingress.py
@@ -1188,7 +1188,7 @@ class TestIngressService:
             'NFS_CORE_PARAM {\n'
             '        Enable_NLM = true;\n'
             '        Enable_RQUOTA = false;\n'
-            '        Protocols = 3, 4;\n'
+            '        Protocols = 4;\n'
             '        mount_path_pseudo = true;\n'
             '        Enable_UDP = false;\n'
             '        NFS_Port = 2049;\n'
diff --git a/src/pybind/mgr/cephadm/tests/services/test_nfs.py b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
index 376fdea25e3..115832e4635 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_nfs.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
@@ -588,6 +588,32 @@ class TestNFS:
                 assert "nfsrdma" not in ganesha_conf
                 assert "NFS_RDMA_Port" not in ganesha_conf
 
+    @patch("cephadm.serve.CephadmServe._run_cephadm")
+    @patch("cephadm.services.nfs.NFSService.fence_old_ranks", MagicMock())
+    @patch("cephadm.services.nfs.NFSService.run_grace_tool", MagicMock())
+    @patch("cephadm.services.nfs.NFSService.purge", MagicMock())
+    @patch("cephadm.services.nfs.NFSService.create_rados_config_obj", MagicMock())
+    def test_nfs_enable_nfsv3(self, _run_cephadm, cephadm_module: CephadmOrchestrator):
+        _run_cephadm.side_effect = async_side_effect(('{}', '', 0))
+
+        with with_host(cephadm_module, 'test'):
+            # Test with enable_nfsv3=False (default)
+            nfs_spec = NFSServiceSpec(service_id="foo", placement=PlacementSpec(hosts=['test']))
+            with with_service(cephadm_module, nfs_spec) as _:
+                nfs_generated_conf, _ = service_registry.get_service('nfs').generate_config(
+                    CephadmDaemonDeploySpec(host='test', daemon_id='foo.test.0.0', service_name=nfs_spec.service_name()))
+                ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
+                assert "Protocols = 4;" in ganesha_conf
+
+            # Test with enable_nfsv3=True
+            nfs_spec = NFSServiceSpec(service_id="foo", placement=PlacementSpec(hosts=['test']),
+                                      enable_nfsv3=True)
+            with with_service(cephadm_module, nfs_spec) as _:
+                nfs_generated_conf, _ = service_registry.get_service('nfs').generate_config(
+                    CephadmDaemonDeploySpec(host='test', daemon_id='foo.test.0.0', service_name=nfs_spec.service_name()))
+                ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
+                assert "Protocols = 3, 4;" in ganesha_conf
+
 
 def test_nfs_colocation_ports_validation():
     """Test validation of colocation_ports in NFSServiceSpec"""
diff --git a/src/pybind/mgr/nfs/cluster.py b/src/pybind/mgr/nfs/cluster.py
index 5a4cf057aa2..1beff39ff93 100644
--- a/src/pybind/mgr/nfs/cluster.py
+++ b/src/pybind/mgr/nfs/cluster.py
@@ -161,6 +161,7 @@ class NFSCluster:
             ingress_mode: Optional[IngressType] = None,
             port: Optional[int] = None,
             cluster_qos_config: Optional[Dict[str, Union[str, bool, int]]] = None,
+            enable_nfsv3: bool = False,
             ssl: bool = False,
             ssl_cert: Optional[str] = None,
             ssl_key: Optional[str] = None,
@@ -206,6 +207,7 @@ class NFSCluster:
                                   virtual_ip=virtual_ip_for_ganesha,
                                   enable_haproxy_protocol=enable_haproxy_protocol,
                                   cluster_qos_config=cluster_qos_config,
+                                  enable_nfsv3=enable_nfsv3,
                                   ssl=ssl,
                                   ssl_cert=ssl_cert,
                                   ssl_key=ssl_key,
@@ -235,6 +237,7 @@ class NFSCluster:
                                   placement=PlacementSpec.from_string(placement),
                                   port=port,
                                   cluster_qos_config=cluster_qos_config,
+                                  enable_nfsv3=enable_nfsv3,
                                   ssl=ssl,
                                   ssl_cert=ssl_cert,
                                   ssl_key=ssl_key,
@@ -269,6 +272,7 @@ class NFSCluster:
             ingress_mode: Optional[IngressType] = None,
             port: Optional[int] = None,
             cluster_qos_config: Optional[Dict[str, Union[str, bool, int]]] = None,
+            enable_nfsv3: bool = False,
             ssl: bool = False,
             ssl_cert: Optional[str] = None,
             ssl_key: Optional[str] = None,
@@ -309,6 +313,7 @@ class NFSCluster:
                     ingress_mode,
                     port,
                     cluster_qos_config=cluster_qos_config,
+                    enable_nfsv3=enable_nfsv3,
                     ssl=ssl,
                     ssl_cert=ssl_cert,
                     ssl_key=ssl_key,
diff --git a/src/pybind/mgr/nfs/module.py b/src/pybind/mgr/nfs/module.py
index ab6369e346e..7cd2aa70dcc 100644
--- a/src/pybind/mgr/nfs/module.py
+++ b/src/pybind/mgr/nfs/module.py
@@ -162,6 +162,7 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
                                 port: Optional[int] = None,
                                 enable_rdma: bool = False,
                                 rdma_port: Optional[int] = None,
+                                enable_nfsv3: bool = False,
                                 inbuf: Optional[str] = None) -> None:
         """Create an NFS Cluster"""
         cluster_qos_config = None
@@ -183,6 +184,7 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
                                            virtual_ip=virtual_ip, ingress=ingress,
                                            ingress_mode=ingress_mode, port=port,
                                            cluster_qos_config=cluster_qos_config,
+                                           enable_nfsv3=enable_nfsv3,
                                            ssl=ssl,
                                            ssl_cert=ssl_cert,
                                            ssl_key=ssl_key,
diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 9ac9db45871..c0b9ff873d5 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -1393,6 +1393,7 @@ class NFSServiceSpec(ServiceSpec):
                  tls_min_version: Optional[str] = None,
                  tls_ciphers: Optional[str] = None,
                  colocation_ports: Optional[List[Dict[str, int]]] = None,
+                 enable_nfsv3: bool = False,
                  ):
         assert service_type == 'nfs'
         super(NFSServiceSpec, self).__init__(
@@ -1421,6 +1422,7 @@ class NFSServiceSpec(ServiceSpec):
         self.rdma_port = rdma_port
         self.cluster_qos_config = cluster_qos_config
         self.cluster_qos_port = cluster_qos_port
+        self.enable_nfsv3 = enable_nfsv3
 
         # colocation_ports is a list of port dicts for ADDITIONAL colocated daemons
         # The first daemon always uses port and monitoring_port from the spec

From 44c13620288c434aef6fc00aa4e7a8c64c7e4134 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 6 Feb 2026 18:27:58 +0530
Subject: [PATCH 039/596] mgr/nfs: set nfs export protocols based on cluster's
 protocol settings Fixes: https://tracker.ceph.com/issues/74492

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/nfs/export.py         | 30 ++++++++++++++++++++++++++++
 src/pybind/mgr/nfs/ganesha_conf.py   |  2 +-
 src/pybind/mgr/nfs/tests/test_nfs.py | 14 ++++++-------
 3 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/src/pybind/mgr/nfs/export.py b/src/pybind/mgr/nfs/export.py
index 9194f380eb8..304d7c3511e 100644
--- a/src/pybind/mgr/nfs/export.py
+++ b/src/pybind/mgr/nfs/export.py
@@ -162,6 +162,25 @@ class ExportMgr:
         self._exports: Optional[Dict[str, List[Export]]] = export_ls
         self.skip_notify_nfs_server = False
 
+    def _get_cluster_protocols(self, cluster_id: str) -> List[int]:
+        """Get the list of supported NFS protocols for a cluster.
+        """
+        try:
+            import orchestrator
+            from ceph.deployment.service_spec import NFSServiceSpec
+
+            completion = self.mgr.describe_service(service_type='nfs', service_name=f'nfs.{cluster_id}')
+            services = orchestrator.raise_if_exception(completion)
+            for service in services:
+                if service.spec and isinstance(service.spec, NFSServiceSpec):
+                    spec = cast(NFSServiceSpec, service.spec)
+                    if getattr(spec, 'enable_nfsv3', False):
+                        return [3, 4]
+                    return [4]
+        except Exception as e:
+            log.debug(f"Failed to get cluster protocols for {cluster_id}: {e}, defaulting to v4 only")
+        return [4]
+
     @property
     def exports(self) -> Dict[str, List[Export]]:
         if self._exports is None:
@@ -696,6 +715,8 @@ class ExportMgr:
             _validate_cmount_path(cmount_path, path)  # type: ignore
 
         pseudo_path = normalize_path(pseudo_path)
+        # Get the protocols based on cluster's enable_nfsv3 setting
+        protocols = self._get_cluster_protocols(cluster_id)
 
         export_dict = {
             "pseudo": pseudo_path,
@@ -710,6 +731,7 @@ class ExportMgr:
             "clients": clients,
             "sectype": sectype,
             "XprtSec": xprtsec,
+            "protocols": protocols,
         }
         if transports is not None:
             export_dict["transports"] = transports
@@ -750,6 +772,9 @@ class ExportMgr:
         if not bucket and not user_id:
             raise ErrorResponse("Must specify either bucket or user_id")
 
+        # Get the protocols based on cluster's enable_nfsv3 setting
+        protocols = self._get_cluster_protocols(cluster_id)
+
         export_dict = {
             "pseudo": pseudo_path,
             "path": bucket or '/',
@@ -762,6 +787,7 @@ class ExportMgr:
             "clients": clients,
             "sectype": sectype,
             "XprtSec": xprtsec,
+            "protocols": protocols,
         }
         if transports is not None:
             export_dict["transports"] = transports
@@ -825,6 +851,10 @@ class ExportMgr:
                 else:
                     new_export_dict['fsal']['cmount_path'] = '/'
 
+        # Set protocols based on cluster's enable_nfsv3 setting if not explicitly specified
+        if 'protocols' not in new_export_dict:
+            new_export_dict['protocols'] = self._get_cluster_protocols(cluster_id)
+
         new_export = self.create_export_from_dict(
             cluster_id,
             new_export_dict.get('export_id', self._gen_export_id(cluster_id)),
diff --git a/src/pybind/mgr/nfs/ganesha_conf.py b/src/pybind/mgr/nfs/ganesha_conf.py
index 04f97bcba55..9a5b38fb92a 100644
--- a/src/pybind/mgr/nfs/ganesha_conf.py
+++ b/src/pybind/mgr/nfs/ganesha_conf.py
@@ -474,7 +474,7 @@ class Export:
                    ex_dict.get('access_type', 'RO'),
                    ex_dict.get('squash', 'no_root_squash'),
                    ex_dict.get('security_label', True),
-                   ex_dict.get('protocols', [3, 4]),
+                   ex_dict.get('protocols', [4]),
                    ex_dict.get('transports', ['TCP']),
                    FSAL.from_dict(ex_dict.get('fsal', {})),
                    [Client.from_dict(client) for client in ex_dict.get('clients', [])],
diff --git a/src/pybind/mgr/nfs/tests/test_nfs.py b/src/pybind/mgr/nfs/tests/test_nfs.py
index 57db70a2002..3959f44f28a 100644
--- a/src/pybind/mgr/nfs/tests/test_nfs.py
+++ b/src/pybind/mgr/nfs/tests/test_nfs.py
@@ -126,7 +126,7 @@ EXPORT {
     Path = /;
     Pseudo = /cephfs_b/;
     Access_Type = RW;
-    Protocols = 4;
+    Protocols = 3, 4;
     Attr_Expiration_Time = 0;
 
     FSAL {
@@ -491,7 +491,7 @@ NFS_CORE_PARAM {
         assert export.pseudo == "/cephfs_b/"
         assert export.access_type == "RW"
         assert export.squash == "no_root_squash"
-        assert export.protocols == [4]
+        assert export.protocols == [3, 4]
         assert export.fsal.name == "CEPH"
         assert export.fsal.user_id == "nfs.foo.b.lgudhr"
         assert export.fsal.fs_name == "b"
@@ -1122,7 +1122,7 @@ NFS_CORE_PARAM {
         assert export.pseudo == "/mybucket"
         assert export.access_type == "none"
         assert export.squash == "none"
-        assert export.protocols == [3, 4]
+        assert export.protocols == [4]
         assert export.transports == ["TCP"]
         assert export.fsal.name == "RGW"
         assert export.fsal.user_id == "bucket_owner_user"
@@ -1166,7 +1166,7 @@ NFS_CORE_PARAM {
         assert export.pseudo == "/mybucket"
         assert export.access_type == "none"
         assert export.squash == "none"
-        assert export.protocols == [3, 4]
+        assert export.protocols == [4]
         assert export.transports == ["TCP"]
         assert export.fsal.name == "RGW"
         assert export.fsal.access_key_id == "the_access_key"
@@ -1208,7 +1208,7 @@ NFS_CORE_PARAM {
         assert export.pseudo == "/mybucket"
         assert export.access_type == "none"
         assert export.squash == "none"
-        assert export.protocols == [3, 4]
+        assert export.protocols == [4]
         assert export.transports == ["TCP"]
         assert export.fsal.name == "RGW"
         assert export.fsal.access_key_id == "the_access_key"
@@ -1257,7 +1257,7 @@ NFS_CORE_PARAM {
         assert export.pseudo == "/cephfs2"
         assert export.access_type == "none"
         assert export.squash == "none"
-        assert export.protocols == [3, 4]
+        assert export.protocols == [4]
         assert export.transports == ["TCP"]
         assert export.fsal.name == "CEPH"
         assert export.fsal.user_id == "nfs.foo.myfs.86ca58ef"
@@ -1389,7 +1389,7 @@ EXPORT {
         assert export.pseudo == "/cephfs3"
         assert export.access_type == "RW"
         assert export.squash == "root"
-        assert export.protocols == [3, 4]
+        assert export.protocols == [4]
         assert export.fsal.name == "CEPH"
         assert export.fsal.user_id == "nfs.foo.myfs.86ca58ef"
         assert export.fsal.cephx_key == "thekeyforclientabc"

From 64732c127dba1974cb60bc448ed01eceb0831d0a Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 13 Apr 2026 17:16:22 +0530
Subject: [PATCH 040/596] mgr/nfs: Updated enable_nfsv3 check while export
 creation

Fixes: https://tracker.ceph.com/issues/74492
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/nfs/export.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/nfs/export.py b/src/pybind/mgr/nfs/export.py
index 304d7c3511e..90278e3d9ba 100644
--- a/src/pybind/mgr/nfs/export.py
+++ b/src/pybind/mgr/nfs/export.py
@@ -172,7 +172,7 @@ class ExportMgr:
             completion = self.mgr.describe_service(service_type='nfs', service_name=f'nfs.{cluster_id}')
             services = orchestrator.raise_if_exception(completion)
             for service in services:
-                if service.spec and isinstance(service.spec, NFSServiceSpec):
+                if service.spec:
                     spec = cast(NFSServiceSpec, service.spec)
                     if getattr(spec, 'enable_nfsv3', False):
                         return [3, 4]

From f4a70f197fc14a667e0b8ea1694a5e893e48de30 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 30 Apr 2026 19:16:16 +0530
Subject: [PATCH 041/596] mgr/cephadm: Fixed unittest for NFS protocol

Fixes: https://tracker.ceph.com/issues/74492
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/tests/services/test_nfs.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/cephadm/tests/services/test_nfs.py b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
index 115832e4635..aa0c4d36720 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_nfs.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
@@ -521,7 +521,7 @@ class TestNFS:
                         ports=[2049, 9587, 20049],
                     ))
                 ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
-                assert "Protocols = 3, 4, nfsrdma, rpcrdma" in ganesha_conf
+                assert "Protocols = 4, nfsrdma, rpcrdma" in ganesha_conf
 
     @patch("cephadm.serve.CephadmServe._run_cephadm_json")
     @patch("cephadm.serve.CephadmServe._run_cephadm")
@@ -549,6 +549,7 @@ class TestNFS:
                 placement=PlacementSpec(hosts=['host1']),
                 enable_rdma=True,
                 rdma_port=1234,
+                enable_nfsv3=True,
             )
             with with_service(cephadm_module, nfs_spec) as _:
                 nfs_generated_conf, _ = service_registry.get_service('nfs').generate_config(
@@ -584,7 +585,7 @@ class TestNFS:
                         service_name=nfs_spec.service_name(),
                     ))
                 ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
-                assert "Protocols = 3, 4" in ganesha_conf
+                assert "Protocols = 4" in ganesha_conf
                 assert "nfsrdma" not in ganesha_conf
                 assert "NFS_RDMA_Port" not in ganesha_conf
 

From 4a64b83c6c5c7978764ad694da464e35b8d3d013 Mon Sep 17 00:00:00 2001
From: Shubha Jain <SHUBHA.JAIN1@ibm.com>
Date: Tue, 6 Jan 2026 20:49:27 +0530
Subject: [PATCH 042/596] mgr/orchestrator: default NFS ingress to
 haproxy-protocol mode

Change default ingress mode from haproxy-standard to haproxy-protocol
to preserve client IP addresses for proper IP-level export restrictions
in NFS Ganesha.

Fixes: https://tracker.ceph.com/issues/74260

Signed-off-by: Shubha Jain <SHUBHA.JAIN1@ibm.com>
---
 src/pybind/mgr/orchestrator/module.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index 56d94fe24ab..5b8e9a6458f 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -222,7 +222,9 @@ class IngressType(enum.Enum):
 
     def canonicalize(self) -> "IngressType":
         if self == self.default:
-            return IngressType(self.haproxy_standard)
+            # Default to haproxy-protocol to preserve client IP addresses
+            # for proper IP-level export restrictions in NFS Ganesha
+            return IngressType(self.haproxy_protocol)
         return IngressType(self)
 
 
@@ -2623,3 +2625,4 @@ Usage:
         completion = self.update_service(service_type.value, service_type.name, image)
         raise_if_exception(completion)
         return HandleCommandResult(stdout=completion.result_str())
+

From b40ee54935550c77dd28f0a77b9f80881cb64286 Mon Sep 17 00:00:00 2001
From: Nathan Hoad <nhoad@bloomberg.net>
Date: Thu, 23 Apr 2026 14:03:24 -0400
Subject: [PATCH 043/596] rgw: Remove GC deferred entries options and code.

This code has been disabled since v16.2.8.

Signed-off-by: Nathan Hoad <nhoad@bloomberg.net>
---
 src/cls/rgw_gc/cls_rgw_gc.cc           |  20 +---
 src/common/options/rgw.yaml.in         |  21 +---
 src/rgw/driver/rados/rgw_gc.cc         |  88 +-------------
 src/rgw/driver/rados/rgw_gc.h          |   6 -
 src/rgw/driver/rados/rgw_rados.cc      |  37 ------
 src/rgw/driver/rados/rgw_rados.h       |   1 -
 src/test/cls_rgw_gc/test_cls_rgw_gc.cc | 155 -------------------------
 7 files changed, 5 insertions(+), 323 deletions(-)

diff --git a/src/cls/rgw_gc/cls_rgw_gc.cc b/src/cls/rgw_gc/cls_rgw_gc.cc
index ecaba00cacf..60d6d2dedbb 100644
--- a/src/cls/rgw_gc/cls_rgw_gc.cc
+++ b/src/cls/rgw_gc/cls_rgw_gc.cc
@@ -47,8 +47,7 @@ static int cls_rgw_gc_queue_init(cls_method_context_t hctx, bufferlist *in, buff
   CLS_LOG(10, "INFO: cls_rgw_gc_queue_init: queue size is %lu\n", op.size);
 
   init_op.queue_size = op.size;
-  const auto& conf = cls_get_config(hctx);
-  init_op.max_urgent_data_size = conf->rgw_gc_max_deferred_entries_size;
+  init_op.max_urgent_data_size = 0;
   encode(urgent_data, init_op.bl_urgent_data);
 
   return queue_init(hctx, init_op);
@@ -497,22 +496,6 @@ static int cls_rgw_gc_queue_update_entry(cls_method_context_t hctx, bufferlist *
     return -ENOSPC;
   }
 
-  // Due to Tracker 47866 we are no longer executing this code, as it
-  // appears to possibly create a GC entry for an object that has not
-  // been deleted. Instead we will log at level 0 to perhaps confirm
-  // that when and how often this bug would otherwise be hit.
-#if 0
-  cls_queue_enqueue_op enqueue_op;
-  bufferlist bl_data;
-  encode(op.info, bl_data);
-  enqueue_op.bl_data_vec.emplace_back(bl_data);
-  CLS_LOG(10, "INFO: cls_gc_update_entry: Data size is: %u \n", bl_data.length());
-  
-  ret = queue_enqueue(hctx, enqueue_op, head);
-  if (ret < 0) {
-    return ret;
-  }
-#else
   std::string first_chain = "<empty-chain>";
   if (! op.info.chain.objs.empty()) {
     first_chain = op.info.chain.objs.cbegin()->key.name;
@@ -521,7 +504,6 @@ static int cls_rgw_gc_queue_update_entry(cls_method_context_t hctx, bufferlist *
 	  "INFO: refrained from enqueueing GC entry during GC defer"
 	  " tag=%s, first_chain=%s\n",
 	  op.info.tag.c_str(), first_chain.c_str());
-#endif
 
   if (has_urgent_data) {
     head.bl_urgent_data.clear();
diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index 57000c5154b..b52d85d758a 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -1962,34 +1962,17 @@ options:
   - rgw_gc_processor_max_time
   - rgw_gc_max_concurrent_io
   with_legacy: true
-- name: rgw_gc_max_deferred_entries_size
-  type: uint
-  level: advanced
-  desc: maximum allowed size of deferred entries in queue head for gc
-  default: 3_K
-  services:
-  - rgw
-  with_legacy: true
 - name: rgw_gc_max_queue_size
   type: uint
   level: advanced
   desc: Maximum allowed queue size for gc
   long_desc: The maximum allowed size of each gc queue, and its value should not be
-    greater than (osd_max_object_size - rgw_gc_max_deferred_entries_size - 1K).
-  default: 131068_K
+    greater than osd_max_object_size - 1K.
+  default: 134068_K
   services:
   - rgw
   see_also:
   - osd_max_object_size
-  - rgw_gc_max_deferred_entries_size
-  with_legacy: true
-- name: rgw_gc_max_deferred
-  type: uint
-  level: advanced
-  desc: Number of maximum deferred data entries to be stored in queue for gc
-  default: 50
-  services:
-  - rgw
   with_legacy: true
 - name: rgw_s3_success_create_obj_status
   type: int
diff --git a/src/rgw/driver/rados/rgw_gc.cc b/src/rgw/driver/rados/rgw_gc.cc
index 8a9e464f1dd..de52f29936d 100644
--- a/src/rgw/driver/rados/rgw_gc.cc
+++ b/src/rgw/driver/rados/rgw_gc.cc
@@ -50,8 +50,8 @@ void RGWGC::initialize(CephContext *_cct, RGWRados *_store, optional_yield y) {
     //version = 1 -> marked ready for transition
     librados::ObjectWriteOperation op;
     op.create(false);
-    const uint64_t queue_size = cct->_conf->rgw_gc_max_queue_size, num_deferred_entries = cct->_conf->rgw_gc_max_deferred;
-    gc_log_init2(op, queue_size, num_deferred_entries);
+    const uint64_t queue_size = cct->_conf->rgw_gc_max_queue_size;
+    gc_log_init2(op, queue_size, 0);
     store->gc_operate(this, obj_names[i], std::move(op), y);
   }
 }
@@ -139,90 +139,6 @@ int RGWGC::send_chain(const cls_rgw_obj_chain& chain, const string& tag, optiona
   return store->gc_operate(this, obj_names[i], std::move(set_entry_op), y);
 }
 
-struct defer_chain_state {
-  librados::AioCompletion* completion = nullptr;
-  // TODO: hold a reference on the state in RGWGC to avoid use-after-free if
-  // RGWGC destructs before this completion fires
-  RGWGC* gc = nullptr;
-  cls_rgw_gc_obj_info info;
-
-  ~defer_chain_state() {
-    if (completion) {
-      completion->release();
-    }
-  }
-};
-
-static void async_defer_callback(librados::completion_t, void* arg)
-{
-  std::unique_ptr<defer_chain_state> state{static_cast<defer_chain_state*>(arg)};
-  if (state->completion->get_return_value() == -ECANCELED) {
-    state->gc->on_defer_canceled(state->info);
-  }
-}
-
-void RGWGC::on_defer_canceled(const cls_rgw_gc_obj_info& info)
-{
-  const std::string& tag = info.tag;
-  const int i = tag_index(tag);
-
-  // ECANCELED from cls_version_check() tells us that we've transitioned
-  transitioned_objects_cache[i] = true;
-
-  ObjectWriteOperation op;
-  cls_rgw_gc_queue_defer_entry(op, cct->_conf->rgw_gc_obj_min_wait, info);
-  cls_rgw_gc_remove(op, {tag});
-
-  aio_completion_ptr c{librados::Rados::aio_create_completion(nullptr, nullptr)};
-
-  store->gc_aio_operate(obj_names[i], c.get(), &op);
-}
-
-int RGWGC::async_defer_chain(const string& tag, const cls_rgw_obj_chain& chain)
-{
-  const int i = tag_index(tag);
-  cls_rgw_gc_obj_info info;
-  info.chain = chain;
-  info.tag = tag;
-
-  // if we've transitioned this shard object, we can rely on the cls_rgw_gc queue
-  if (transitioned_objects_cache[i]) {
-    ObjectWriteOperation op;
-    cls_rgw_gc_queue_defer_entry(op, cct->_conf->rgw_gc_obj_min_wait, info);
-
-    // this tag may still be present in omap, so remove it once the cls_rgw_gc
-    // enqueue succeeds
-    cls_rgw_gc_remove(op, {tag});
-
-    aio_completion_ptr c{librados::Rados::aio_create_completion(nullptr, nullptr)};
-
-    int ret = store->gc_aio_operate(obj_names[i], c.get(), &op);
-    return ret;
-  }
-
-  // if we haven't seen the transition yet, write the defer to omap with cls_rgw
-  ObjectWriteOperation op;
-
-  // assert that we haven't initialized cls_rgw_gc queue. this prevents us
-  // from writing new entries to omap after the transition
-  gc_log_defer1(op, cct->_conf->rgw_gc_obj_min_wait, info);
-
-  // prepare a callback to detect the transition via ECANCELED from cls_version_check()
-  auto state = std::make_unique<defer_chain_state>();
-  state->gc = this;
-  state->info.chain = chain;
-  state->info.tag = tag;
-  state->completion = librados::Rados::aio_create_completion(
-      state.get(), async_defer_callback);
-
-  int ret = store->gc_aio_operate(obj_names[i], state->completion, &op);
-  if (ret == 0) {
-    // coverity[leaked_storage:SUPPRESS]
-    state.release(); // release ownership until async_defer_callback()
-  }
-  return ret;
-}
-
 int RGWGC::remove(int index, const std::vector<string>& tags, AioCompletion **pc, optional_yield y)
 {
   ObjectWriteOperation op;
diff --git a/src/rgw/driver/rados/rgw_gc.h b/src/rgw/driver/rados/rgw_gc.h
index b7a11820427..57fc084b63b 100644
--- a/src/rgw/driver/rados/rgw_gc.h
+++ b/src/rgw/driver/rados/rgw_gc.h
@@ -52,12 +52,6 @@ public:
   std::vector<bool> transitioned_objects_cache;
   std::tuple<int, std::optional<cls_rgw_obj_chain>> send_split_chain(const cls_rgw_obj_chain& chain, const std::string& tag, optional_yield y);
 
-  // asynchronously defer garbage collection on an object that's still being read
-  int async_defer_chain(const std::string& tag, const cls_rgw_obj_chain& info);
-
-  // callback for when async_defer_chain() fails with ECANCELED
-  void on_defer_canceled(const cls_rgw_gc_obj_info& info);
-
   int remove(int index, const std::vector<std::string>& tags, librados::AioCompletion **pc, optional_yield y);
   int remove(int index, int num_entries, optional_yield y);
 
diff --git a/src/rgw/driver/rados/rgw_rados.cc b/src/rgw/driver/rados/rgw_rados.cc
index c495903d904..2a8127a8817 100644
--- a/src/rgw/driver/rados/rgw_rados.cc
+++ b/src/rgw/driver/rados/rgw_rados.cc
@@ -6449,43 +6449,6 @@ int RGWRados::bucket_resync_encrypted_multipart(const DoutPrefixProvider* dpp,
   return 0;
 }
 
-int RGWRados::defer_gc(const DoutPrefixProvider *dpp, RGWObjectCtx* octx, RGWBucketInfo& bucket_info, const rgw_obj& obj, optional_yield y)
-{
-  std::string oid, key;
-  get_obj_bucket_and_oid_loc(obj, oid, key);
-  if (!octx)
-    return 0;
-
-  RGWObjState *state = NULL;
-  RGWObjManifest *manifest = nullptr;
-
-  int r = get_obj_state(dpp, octx, bucket_info, obj, &state, &manifest, false, y);
-  if (r < 0)
-    return r;
-
-  if (!state->is_atomic) {
-    ldpp_dout(dpp, 20) << "state for obj=" << obj << " is not atomic, not deferring gc operation" << dendl;
-    return -EINVAL;
-  }
-
-  string tag;
-
-  if (state->tail_tag.length() > 0) {
-    tag = state->tail_tag.c_str();
-  } else if (state->obj_tag.length() > 0) {
-    tag = state->obj_tag.c_str();
-  } else {
-    ldpp_dout(dpp, 20) << "state->obj_tag is empty, not deferring gc operation" << dendl;
-    return -EINVAL;
-  }
-
-  ldpp_dout(dpp, 0) << "defer chain tag=" << tag << dendl;
-
-  cls_rgw_obj_chain chain;
-  update_gc_chain(dpp, state->obj, *manifest, &chain);
-  return gc->async_defer_chain(tag, chain);
-}
-
 void RGWRados::remove_rgw_head_obj(ObjectWriteOperation& op)
 {
   list<string> prefixes;
diff --git a/src/rgw/driver/rados/rgw_rados.h b/src/rgw/driver/rados/rgw_rados.h
index d8fe665fcf3..d1b61933606 100644
--- a/src/rgw/driver/rados/rgw_rados.h
+++ b/src/rgw/driver/rados/rgw_rados.h
@@ -1630,7 +1630,6 @@ public:
   int list_gc_objs(int *index, std::string& marker, uint32_t max, bool expired_only, std::list<cls_rgw_gc_obj_info>& result, bool *truncated, bool& processing_queue);
   int process_gc(bool expired_only, optional_yield y);
   bool process_expired_objects(const DoutPrefixProvider *dpp, optional_yield y);
-  int defer_gc(const DoutPrefixProvider *dpp, RGWObjectCtx* ctx, RGWBucketInfo& bucket_info, const rgw_obj& obj, optional_yield y);
 
   int process_lc(const std::unique_ptr<rgw::sal::Bucket>& optional_bucket);
 
diff --git a/src/test/cls_rgw_gc/test_cls_rgw_gc.cc b/src/test/cls_rgw_gc/test_cls_rgw_gc.cc
index 6014542a324..44cc464ffd0 100644
--- a/src/test/cls_rgw_gc/test_cls_rgw_gc.cc
+++ b/src/test/cls_rgw_gc/test_cls_rgw_gc.cc
@@ -207,161 +207,6 @@ TEST(cls_rgw_gc, gc_queue_ops2)
   ASSERT_EQ("chain-1", it.tag);
 }
 
-#if 0 // TODO: fix or remove defer_gc()
-TEST(cls_rgw_gc, gc_queue_ops3)
-{
-  //Testing remove queue entries
-  string queue_name = "my-third-queue";
-  uint64_t queue_size = 501, num_urgent_data_entries = 10;
-  librados::ObjectWriteOperation op;
-  op.create(true);
-  cls_rgw_gc_queue_init(op, queue_size, num_urgent_data_entries);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &op));
-
-  uint64_t size = 0;
-  int ret = cls_rgw_gc_queue_get_capacity(ioctx, queue_name, size);
-  ASSERT_EQ(0, ret);
-  ASSERT_EQ(size, queue_size);
-
-  //Test remove queue, when queue is empty
-  librados::ObjectWriteOperation remove_op;
-  string marker1;
-  uint64_t num_entries = 2;
-  cls_rgw_gc_queue_remove_entries(remove_op, num_entries);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &remove_op));
-
-  cls_rgw_gc_obj_info defer_info;
-
-  //Test enqueue
-  for (int i = 0; i < 2; i++) {
-    string tag = "chain-" + to_string(i);
-    librados::ObjectWriteOperation op;
-    cls_rgw_gc_obj_info info;
-
-    cls_rgw_obj obj1, obj2;
-    create_obj(obj1, i, 1);
-    create_obj(obj2, i, 2);
-    info.chain.objs.push_back(obj1);
-    info.chain.objs.push_back(obj2);
-
-    info.tag = tag;
-    cls_rgw_gc_queue_enqueue(op, 5, info);
-    ASSERT_EQ(0, ioctx.operate(queue_name, &op));
-    if (i == 0)
-      defer_info = info;
-  }
-
-  //Test defer entry for 1st element
-  librados::ObjectWriteOperation defer_op;
-  cls_rgw_gc_queue_defer_entry(defer_op, 10, defer_info);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &defer_op));
-
-  //Test list queue
-  list<cls_rgw_gc_obj_info> list_info1, list_info2;
-  string marker, next_marker;
-  uint64_t max = 2;
-  bool expired_only = false, truncated;
-  cls_rgw_gc_queue_list_entries(ioctx, queue_name, marker, max, expired_only, list_info1, &truncated, next_marker);
-  ASSERT_EQ(2, list_info1.size());
-
-  int i = 0;
-  for (auto it : list_info1) {
-    std::cerr << "[          ] list info tag = " << it.tag << std::endl;
-    if (i == 0) {
-      ASSERT_EQ("chain-1", it.tag);
-    }
-    if (i == 1) {
-      ASSERT_EQ("chain-0", it.tag);
-    }
-    i++;
-  }
-
-  //Test remove entries
-  num_entries = 2;
-  cls_rgw_gc_queue_remove_entries(remove_op, num_entries);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &remove_op));
-
-  //Test list queue again
-  cls_rgw_gc_queue_list_entries(ioctx, queue_name, marker, max, expired_only, list_info2, &truncated, next_marker);
-  ASSERT_EQ(0, list_info2.size());
-
-}
-
-TEST(cls_rgw_gc, gc_queue_ops4)
-{
-  //Testing remove queue entries
-  string queue_name = "my-fourth-queue";
-  uint64_t queue_size = 501, num_urgent_data_entries = 10;
-  librados::ObjectWriteOperation op;
-  op.create(true);
-  cls_rgw_gc_queue_init(op, queue_size, num_urgent_data_entries);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &op));
-
-  uint64_t size = 0;
-  int ret = cls_rgw_gc_queue_get_capacity(ioctx, queue_name, size);
-  ASSERT_EQ(0, ret);
-  ASSERT_EQ(size, queue_size);
-
-  //Test remove queue, when queue is empty
-  librados::ObjectWriteOperation remove_op;
-  string marker1;
-  uint64_t num_entries = 2;
-
-  cls_rgw_gc_queue_remove_entries(remove_op, num_entries);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &remove_op));
-
-  cls_rgw_gc_obj_info defer_info;
-
-  //Test enqueue
-  for (int i = 0; i < 2; i++) {
-    string tag = "chain-" + to_string(i);
-    librados::ObjectWriteOperation op;
-    cls_rgw_gc_obj_info info;
-
-    cls_rgw_obj obj1, obj2;
-    create_obj(obj1, i, 1);
-    create_obj(obj2, i, 2);
-    info.chain.objs.push_back(obj1);
-    info.chain.objs.push_back(obj2);
-
-    info.tag = tag;
-    cls_rgw_gc_queue_enqueue(op, 5, info);
-    ASSERT_EQ(0, ioctx.operate(queue_name, &op));
-    defer_info = info;
-  }
-
-  //Test defer entry for last element
-  librados::ObjectWriteOperation defer_op;
-  cls_rgw_gc_queue_defer_entry(defer_op, 10, defer_info);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &defer_op));
-
-  //Test list queue
-  list<cls_rgw_gc_obj_info> list_info1, list_info2;
-  string marker, next_marker;
-  uint64_t max = 2;
-  bool expired_only = false, truncated;
-  cls_rgw_gc_queue_list_entries(ioctx, queue_name, marker, max, expired_only, list_info1, &truncated, next_marker);
-  ASSERT_EQ(2, list_info1.size());
-
-  int i = 0;
-  for (auto it : list_info1) {
-    string tag = "chain-" + to_string(i);
-    ASSERT_EQ(tag, it.tag);
-    i++;
-  }
-
-  //Test remove entries
-  num_entries = 2;
-  cls_rgw_gc_queue_remove_entries(remove_op, num_entries);
-  ASSERT_EQ(0, ioctx.operate(queue_name, &remove_op));
-
-  //Test list queue again
-  cls_rgw_gc_queue_list_entries(ioctx, queue_name, marker, max, expired_only, list_info2, &truncated, next_marker);
-  ASSERT_EQ(0, list_info2.size());
-
-}
-#endif // defer_gc() disabled
-
 TEST(cls_rgw_gc, gc_queue_ops5)
 {
   //Testing remove queue entries

From ceabc96f164226e2e16f598023991943cccfb39d Mon Sep 17 00:00:00 2001
From: Nathan Hoad <nhoad@bloomberg.net>
Date: Fri, 1 May 2026 09:16:20 -0400
Subject: [PATCH 044/596] doc: Update release notes for removed options.

Signed-off-by: Nathan Hoad <nhoad@bloomberg.net>
---
 PendingReleaseNotes | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index d50c8878abb..1d7c36b8a54 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -14,6 +14,8 @@
     If the default provider is required when also using custom providers,
     it must be explicitly loaded in the configuration file or code (see https://github.com/openssl/openssl/blob/master/README-PROVIDERS.md).
 * RGW: Fixed bucket notification events so the 'x_amz_request_id' in NotificationEvent now matches the 'x_amz_request_id' returned by the corresponding S3 operation.
+* RGW: The rgw_gc_max_deferred and rgw_gc_max_deferred_entries_size options have been removed, as they did not do anything.
+  - Updated the default for rgw_gc_max_queue_size to account for the extra space from removing rgw_gc_max_deferred_entries_size.
 
 
 * DASHBOARD: Removed the older landing page which was deprecated in Quincy.

From ec8fad9a784efa720007838e1c8f7c4a2e64f623 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Thu, 7 May 2026 11:49:19 +0200
Subject: [PATCH 045/596] nvmeof: add missing includes

Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 src/nvmeof/NVMeofGwMonitorClient.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/nvmeof/NVMeofGwMonitorClient.cc b/src/nvmeof/NVMeofGwMonitorClient.cc
index b90f9d50990..7f284802782 100644
--- a/src/nvmeof/NVMeofGwMonitorClient.cc
+++ b/src/nvmeof/NVMeofGwMonitorClient.cc
@@ -20,6 +20,7 @@
 #include "include/compat.h"
 
 #include "include/stringify.h"
+#include "include/types.h" // for client_t
 #include "include/ceph_features.h"
 #include "global/global_context.h"
 #include "global/signal_handler.h"
@@ -27,6 +28,7 @@
 
 #include "messages/MNVMeofGwBeacon.h"
 #include "messages/MNVMeofGwMap.h"
+#include "msg/Messenger.h"
 #include "NVMeofGwMonitorClient.h"
 #include "NVMeofGwClient.h"
 #include "NVMeofGwMonitorGroupClient.h"

From b8e3155ef0dee8bbbb8ffdacbffa71786827c02d Mon Sep 17 00:00:00 2001
From: Shubha Jain <SHUBHA.JAIN1@ibm.com>
Date: Mon, 16 Feb 2026 19:33:01 +0530
Subject: [PATCH 046/596] mgr/nfs: improve cluster info implementation and fix
 lint regressions

- Improve cluster info implementation
- Fix deployment type logic
- Resolve lint issues for check jobs

Signed-off-by: Shubha jain <SHUBHA.JAIN1@ibm.com>
---
 qa/tasks/cephfs/test_nfs.py           |   6 +-
 src/pybind/mgr/nfs/cluster.py         | 160 +++++++++++++++++++-------
 src/pybind/mgr/nfs/tests/test_nfs.py  |   7 +-
 src/pybind/mgr/orchestrator/module.py |   1 -
 4 files changed, 129 insertions(+), 45 deletions(-)

diff --git a/qa/tasks/cephfs/test_nfs.py b/qa/tasks/cephfs/test_nfs.py
index 44f595e7172..28f30f25e41 100644
--- a/qa/tasks/cephfs/test_nfs.py
+++ b/qa/tasks/cephfs/test_nfs.py
@@ -814,14 +814,18 @@ class TestNFS(MgrTestCase):
         info_output = json.loads(self._nfs_cmd('cluster', 'info', self.cluster_id))
         print(f'info {info_output}')
         info_ip = info_output[self.cluster_id].get('backend', [])[0].pop("ip")
+        # Pop placement since it may vary by test environment
+        info_output[self.cluster_id].pop("placement", {})
         host_details = {
             self.cluster_id: {
                 'backend': [
                     {
                         "hostname": self._sys_cmd(['hostname']).decode("utf-8").strip(),
-                        "port": 2049
+                        "port": 2049,
+                        "status": "running"
                     }
                 ],
+                "deployment_type": "standalone",
                 "virtual_ip": None,
             }
         }
diff --git a/src/pybind/mgr/nfs/cluster.py b/src/pybind/mgr/nfs/cluster.py
index 5a4cf057aa2..c524ae0f564 100644
--- a/src/pybind/mgr/nfs/cluster.py
+++ b/src/pybind/mgr/nfs/cluster.py
@@ -2,7 +2,7 @@ import ipaddress
 import logging
 import re
 import socket
-from typing import cast, Dict, List, Any, Union, Optional, TYPE_CHECKING
+from typing import cast, Dict, List, Any, Optional, TYPE_CHECKING, Union
 
 from mgr_module import NFS_POOL_NAME as POOL_NAME
 from ceph.deployment.service_spec import NFSServiceSpec, PlacementSpec, IngressSpec
@@ -350,56 +350,132 @@ class NFSCluster:
             raise ErrorResponse.wrap(e)
 
     def _show_nfs_cluster_info(self, cluster_id: str) -> Dict[str, Any]:
+        """
+        Retrieve and format NFS cluster information including daemon status,
+        placement, and ingress configuration.
+        """
+        # Get all NFS daemons
         completion = self.mgr.list_daemons(daemon_type='nfs')
-        # Here completion.result is a list DaemonDescription objects
-        clusters = orchestrator.raise_if_exception(completion)
-        backends: List[Dict[str, Union[Any]]] = []
+        all_nfs_daemons = orchestrator.raise_if_exception(completion)
 
-        for cluster in clusters:
-            if cluster_id == cluster.service_id():
-                assert cluster.hostname
-                try:
-                    if cluster.ip:
-                        ip = cluster.ip
-                    else:
-                        c = self.mgr.get_hosts()
-                        orchestrator.raise_if_exception(c)
-                        hosts = [h for h in c.result or []
-                                 if h.hostname == cluster.hostname]
-                        if hosts:
-                            ip = resolve_ip(hosts[0].addr)
-                        else:
-                            # sigh
-                            ip = resolve_ip(cluster.hostname)
-                    backends.append({
-                        "hostname": cluster.hostname,
-                        "ip": ip,
-                        "port": cluster.ports[0] if cluster.ports else None
-                    })
-                except orchestrator.OrchestratorError:
-                    continue
+        # Filter daemons for this cluster
+        cluster_daemons = [d for d in all_nfs_daemons if d.service_id() == cluster_id]
 
-        r: Dict[str, Any] = {
-            'virtual_ip': None,
-            'backend': backends,
-        }
-        sc = self.mgr.describe_service(service_type='ingress')
-        services = orchestrator.raise_if_exception(sc)
-        for i in services:
-            spec = cast(IngressSpec, i.spec)
-            if spec.backend_service == f'nfs.{cluster_id}':
-                r['virtual_ip'] = i.virtual_ip.split('/')[0] if i.virtual_ip else None
-                if i.ports:
-                    r['port'] = i.ports[0]
-                    if len(i.ports) > 1:
-                        r['monitor_port'] = i.ports[1]
+        # Cache hosts data to avoid O(n) orchestrator calls
+        hosts_map = {}
+        try:
+            hosts_completion = self.mgr.get_hosts()
+            hosts = orchestrator.raise_if_exception(hosts_completion)
+            hosts_map = {h.hostname: h for h in hosts}
+        except orchestrator.OrchestratorError:
+            log.debug("Failed to get hosts for IP resolution")
+
+        # Determine ingress configuration
+        ingress_mode: Optional[IngressType] = None
+        virtual_ip: Optional[str] = None
+        ingress_port: Optional[int] = None
+        monitor_port: Optional[int] = None
+
+        sc = self.mgr.describe_service(
+            service_type='ingress',
+            service_name=f'ingress.nfs.{cluster_id}'
+        )
+        try:
+            ingress_services = orchestrator.raise_if_exception(sc)
+            if ingress_services:
+                svc = ingress_services[0]
+                spec = cast(IngressSpec, svc.spec)
+                virtual_ip = svc.virtual_ip.split('/')[0] if svc.virtual_ip else None
                 if spec.keepalive_only:
                     ingress_mode = IngressType.keepalive_only
                 elif spec.enable_haproxy_protocol:
                     ingress_mode = IngressType.haproxy_protocol
                 else:
                     ingress_mode = IngressType.haproxy_standard
-                r['ingress_mode'] = ingress_mode.value
+                if svc.ports:
+                    ingress_port = svc.ports[0]
+                    if len(svc.ports) > 1:
+                        monitor_port = svc.ports[1]
+        except orchestrator.OrchestratorError:
+            # No ingress service found for this cluster
+            log.debug(f"No ingress service found for NFS cluster {cluster_id}")
+
+        # Build backend list with daemon information
+        backends: List[Dict[str, Any]] = []
+        for daemon in cluster_daemons:
+            if not daemon.hostname:
+                continue
+
+            try:
+                # Resolve daemon IP
+                if daemon.ip:
+                    ip = daemon.ip
+                elif daemon.hostname in hosts_map:
+                    # Use cached host data
+                    ip = resolve_ip(hosts_map[daemon.hostname].addr)
+                else:
+                    # Fallback to hostname resolution
+                    ip = resolve_ip(daemon.hostname)
+
+                # Get daemon status
+                status = orchestrator.DaemonDescriptionStatus.to_str(daemon.status)
+
+                backends.append({
+                    "hostname": daemon.hostname,
+                    "ip": ip,
+                    "port": daemon.ports[0] if daemon.ports and len(daemon.ports) > 0 else None,
+                    "status": status
+                })
+            except orchestrator.OrchestratorError:
+                log.warning(
+                    "Failed to get info for NFS daemon"
+                    f" on {daemon.hostname} in cluster {cluster_id}")
+                continue
+
+        # Sort backends by hostname for consistent output
+        backends.sort(key=lambda x: x["hostname"])
+
+        # Determine deployment type based on ingress configuration and actual daemon count
+        deployment_type = "standalone"
+        placement = None
+
+        # Get NFS service spec for placement information first
+        nfs_sc = self.mgr.describe_service(
+            service_type='nfs',
+            service_name=f'nfs.{cluster_id}'
+        )
+        nfs_services = orchestrator.raise_if_exception(nfs_sc)
+        for svc in nfs_services:
+            if svc.spec.service_id == cluster_id:
+                placement = svc.spec.placement
+                break
+
+        if ingress_mode:
+            # Determine deployment type from placement spec (source of truth)
+            # Note: Using placement.count instead of len(backends) to avoid race conditions
+            if placement and placement.count and placement.count > 1:
+                deployment_type = "active-active"
+            elif len(backends) > 1:
+                # Fallback to actual daemon count if placement.count not set
+                deployment_type = "active-active"
+            else:
+                deployment_type = "active-passive"
+
+        # Build result dictionary
+        r: Dict[str, Any] = {
+            'deployment_type': deployment_type,
+            'virtual_ip': virtual_ip,
+            'backend': backends,
+            'placement': placement.to_json() if placement else {},
+        }
+
+        # Add ingress configuration to result
+        if ingress_mode:
+            r['ingress_mode'] = ingress_mode.value
+        if ingress_port is not None:
+            r['port'] = ingress_port
+        if monitor_port is not None:
+            r['monitor_port'] = monitor_port
 
         log.debug("Successfully fetched %s info: %s", cluster_id, r)
         return r
diff --git a/src/pybind/mgr/nfs/tests/test_nfs.py b/src/pybind/mgr/nfs/tests/test_nfs.py
index 57db70a2002..4104fab05bc 100644
--- a/src/pybind/mgr/nfs/tests/test_nfs.py
+++ b/src/pybind/mgr/nfs/tests/test_nfs.py
@@ -1430,7 +1430,12 @@ EXPORT {
         cluster = NFSCluster(nfs_mod)
 
         out = cluster.show_nfs_cluster_info(self.cluster_id)
-        assert out == {"foo": {"virtual_ip": None, "backend": []}}
+        assert out == {"foo": {
+            "deployment_type": "standalone",
+            "virtual_ip": None,
+            "backend": [],
+            "placement": {}
+        }}
 
     def test_cluster_info(self):
         self._do_mock_test(self._do_test_cluster_info)
diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index 5b8e9a6458f..431afe78876 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -2625,4 +2625,3 @@ Usage:
         completion = self.update_service(service_type.value, service_type.name, image)
         raise_if_exception(completion)
         return HandleCommandResult(stdout=completion.result_str())
-

From e334498be3e18cde0d466bb0f0f2e27fe2dd66ba Mon Sep 17 00:00:00 2001
From: dheart <dheart_joe@163.com>
Date: Thu, 16 Apr 2026 20:34:42 +0800
Subject: [PATCH 047/596] tool/ceph-kvstore-tool: add --pretty-binary-key
 option

Signed-off-by: dheart <dheart_joe@163.com>
---
 src/test/cli/ceph-kvstore-tool/help.t |   2 +
 src/tools/ceph_kvstore_tool.cc        | 121 ++++++++++++++++++++++----
 src/tools/kvstore_tool.cc             |  14 ++-
 src/tools/kvstore_tool.h              |   2 +
 4 files changed, 116 insertions(+), 23 deletions(-)

diff --git a/src/test/cli/ceph-kvstore-tool/help.t b/src/test/cli/ceph-kvstore-tool/help.t
index f8fb009ca59..67db2e87e11 100644
--- a/src/test/cli/ceph-kvstore-tool/help.t
+++ b/src/test/cli/ceph-kvstore-tool/help.t
@@ -1,6 +1,8 @@
   $ ceph-kvstore-tool --help
   Usage: ceph-kvstore-tool <rocksdb|bluestore-kv> <store path> command [args...]
   
+  Options:
+    --pretty-binary-key    Use/dump binary keys in a print pretty format
   Commands:
     list [prefix]
     list-crc [prefix]
diff --git a/src/tools/ceph_kvstore_tool.cc b/src/tools/ceph_kvstore_tool.cc
index 0029c3804b3..fa4afc66d76 100644
--- a/src/tools/ceph_kvstore_tool.cc
+++ b/src/tools/ceph_kvstore_tool.cc
@@ -26,6 +26,7 @@
 #include "global/global_context.h"
 #include "global/global_init.h"
 
+#include "common/pretty_binary.h"
 #include "kvstore_tool.h"
 
 using namespace std;
@@ -34,6 +35,8 @@ void usage(const char *pname)
 {
   std::cout << "Usage: " << pname << " <rocksdb|bluestore-kv> <store path> command [args...]\n"
     << "\n"
+    << "Options:\n"
+    << "  --pretty-binary-key    Use/dump binary keys in a print pretty format\n"
     << "Commands:\n"
     << "  list [prefix]\n"
     << "  list-crc [prefix]\n"
@@ -56,6 +59,33 @@ void usage(const char *pname)
     << std::endl;
 }
 
+std::string format_key(const std::string &key, bool pretty_binary_key = false)
+{
+  if (pretty_binary_key) {
+    return pretty_binary_string(key);
+  }
+  return url_escape(key);
+}
+
+std::string parse_key(const std::string &key, bool pretty_binary_key, std::string &err)
+{
+  err.clear();
+  try {
+    if (pretty_binary_key)
+      return pretty_binary_string_reverse(key);
+    return url_unescape(key);
+  } catch (const std::invalid_argument &e) {
+    std::ostringstream oss;
+    oss << "invalid pretty binary string: " << e.what();
+    err = oss.str();
+  } catch (const std::runtime_error &e)
+  {
+    err = e.what();
+  }
+
+  return "";
+}
+
 int main(int argc, const char *argv[])
 {
   auto args = argv_to_vec(argc, argv);
@@ -63,6 +93,17 @@ int main(int argc, const char *argv[])
     cerr << argv[0] << ": -h or --help for usage" << std::endl;
     exit(1);
   }
+
+  bool pretty_binary_key = [&args] { //pick --pretty-binary-key from args
+    auto arg_it = std::find_if(args.begin(), args.end(),
+        [](const char* val) {return strcmp(val, "--pretty-binary-key") == 0;});
+    if (arg_it != args.end()) {
+      args.erase(arg_it);
+      return true;
+    }
+    return false;
+  }();
+  
   if (ceph_argparse_need_usage(args)) {
     usage(argv[0]);
     exit(0);
@@ -131,13 +172,13 @@ int main(int argc, const char *argv[])
       prefix = url_unescape(argv[4]);
 
     bool do_crc = (cmd == "list-crc");
-    st.list(prefix, do_crc, false);
+    st.list(prefix, do_crc, pretty_binary_key, false);
 
   } else if (cmd == "dump") {
     string prefix;
     if (argc > 4)
       prefix = url_unescape(argv[4]);
-    st.list(prefix, false, true);
+    st.list(prefix, false, pretty_binary_key, true);
 
   } else if (cmd == "exists") {
     string key;
@@ -146,11 +187,17 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    if (argc > 5)
-      key = url_unescape(argv[5]);
+    if (argc > 5) {
+      std::string err;
+      key = parse_key(argv[5], pretty_binary_key, err);
+      if (!err.empty()) {
+        std::cerr << err << std::endl;
+        return 1;
+      }
+    }
 
     bool ret = st.exists(prefix, key);
-    std::cout << "(" << url_escape(prefix) << ", " << url_escape(key) << ") "
+    std::cout << "(" << url_escape(prefix) << ", " << format_key(key, pretty_binary_key) << ") "
       << (ret ? "exists" : "does not exist")
       << std::endl;
     return (ret ? 0 : 1);
@@ -161,11 +208,16 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    string key(url_unescape(argv[5]));
+    std::string err;
+    std::string key = parse_key(argv[5], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
 
     bool exists = false;
     bufferlist bl = st.get(prefix, key, exists);
-    std::cout << "(" << url_escape(prefix) << ", " << url_escape(key) << ")";
+    std::cout << "(" << url_escape(prefix) << ", " << format_key(key, pretty_binary_key) << ")";
     if (!exists) {
       std::cout << " does not exist" << std::endl;
       return 1;
@@ -208,11 +260,16 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    string key(url_unescape(argv[5]));
+    std::string err;
+    string key = parse_key(argv[5], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
 
     bool exists = false;
     bufferlist bl = st.get(prefix, key, exists);
-    std::cout << "(" << url_escape(prefix) << ", " << url_escape(key) << ") ";
+    std::cout << "(" << url_escape(prefix) << ", " << format_key(key, pretty_binary_key) << ") ";
     if (!exists) {
       std::cout << " does not exist" << std::endl;
       return 1;
@@ -230,16 +287,21 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    string key(url_unescape(argv[5]));
+    std::string err;
+    string key = parse_key(argv[5], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
 
     bool exists = false;
     bufferlist bl = st.get(prefix, key, exists);
     if (!exists) {
-      std::cerr << "(" << url_escape(prefix) << "," << url_escape(key)
+      std::cerr << "(" << url_escape(prefix) << "," << format_key(key, pretty_binary_key)
                 << ") does not exist" << std::endl;
       return 1;
     }
-    std::cout << "(" << url_escape(prefix) << "," << url_escape(key)
+    std::cout << "(" << url_escape(prefix) << "," << format_key(key, pretty_binary_key)
               << ") size " << byte_u_t(bl.length()) << std::endl;
 
   } else if (cmd == "set") {
@@ -248,7 +310,12 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    string key(url_unescape(argv[5]));
+    std::string err;
+    string key = parse_key(argv[5], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
     string subcmd(argv[6]);
 
     bufferlist val;
@@ -275,7 +342,7 @@ int main(int argc, const char *argv[])
     bool ret = st.set(prefix, key, val);
     if (!ret) {
       std::cerr << "error setting ("
-                << url_escape(prefix) << "," << url_escape(key) << ")" << std::endl;
+                << url_escape(prefix) << "," << format_key(key, pretty_binary_key) << ")" << std::endl;
       return 1;
     }
   } else if (cmd == "rm") {
@@ -284,12 +351,17 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    string key(url_unescape(argv[5]));
+    std::string err;
+    string key = parse_key(argv[5], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
 
     bool ret = st.rm(prefix, key);
     if (!ret) {
       std::cerr << "error removing ("
-                << url_escape(prefix) << "," << url_escape(key) << ")"
+                << url_escape(prefix) << "," << format_key(key, pretty_binary_key) << ")"
 		<< std::endl;
       return 1;
     }
@@ -338,7 +410,7 @@ int main(int argc, const char *argv[])
       return 1;
     }
     std::ofstream fs(argv[4]);
-    uint32_t crc = st.traverse(string(), true, false, &fs);
+    uint32_t crc = st.traverse(string(), true, pretty_binary_key, false, &fs);
     std::cout << "store at '" << argv[4] << "' crc " << crc << std::endl;
 
   } else if (cmd == "compact") {
@@ -356,8 +428,19 @@ int main(int argc, const char *argv[])
       return 1;
     }
     string prefix(url_unescape(argv[4]));
-    string start(url_unescape(argv[5]));
-    string end(url_unescape(argv[6]));
+    std::string err;
+    string start = parse_key(argv[5], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
+    string end = parse_key(argv[6], pretty_binary_key, err);
+    if (!err.empty()) {
+      std::cerr << err << std::endl;
+      return 1;
+    }
+    std::cout << "(" << url_escape(prefix) << "," << format_key(start, pretty_binary_key)
+              << " ~ " << format_key(end, pretty_binary_key) << ")" << std::endl;
     st.compact_range(prefix, start, end);
   } else if (cmd == "stats") {
     st.print_stats();
diff --git a/src/tools/kvstore_tool.cc b/src/tools/kvstore_tool.cc
index 7d9a9fb3f8e..a1970b903b2 100644
--- a/src/tools/kvstore_tool.cc
+++ b/src/tools/kvstore_tool.cc
@@ -83,6 +83,7 @@ int StoreTool::load_bluestore(const string& path, bool read_only, bool to_repair
 
 uint32_t StoreTool::traverse(const string& prefix,
                              const bool do_crc,
+                             const bool pretty_binary_key,
                              const bool do_value_dump,
                              ostream *out)
 {
@@ -100,8 +101,13 @@ uint32_t StoreTool::traverse(const string& prefix,
     if (!prefix.empty() && (rk.first != prefix))
       break;
 
-    if (out)
-      *out << url_escape(rk.first) << "\t" << url_escape(rk.second);
+    if (out) {
+      if (pretty_binary_key) {
+        *out << url_escape(rk.first) << "\t" << pretty_binary_string(rk.second);
+      } else {
+        *out << url_escape(rk.first) << "\t" << url_escape(rk.second);
+      }
+    }
     if (do_crc) {
       bufferlist bl;
       bl.append(rk.first);
@@ -130,9 +136,9 @@ uint32_t StoreTool::traverse(const string& prefix,
 }
 
 void StoreTool::list(const string& prefix, const bool do_crc,
-                     const bool do_value_dump)
+                     const bool pretty_binary_key, const bool do_value_dump)
 {
-  traverse(prefix, do_crc, do_value_dump,& std::cout);
+  traverse(prefix, do_crc, pretty_binary_key, do_value_dump,& std::cout);
 }
 
 bool StoreTool::exists(const string& prefix)
diff --git a/src/tools/kvstore_tool.h b/src/tools/kvstore_tool.h
index 11ad30b5f1f..ea5e7dc79be 100644
--- a/src/tools/kvstore_tool.h
+++ b/src/tools/kvstore_tool.h
@@ -42,10 +42,12 @@ public:
 	    bool need_stats = false);
   uint32_t traverse(const std::string& prefix,
                     const bool do_crc,
+                    const bool pretty_binary_key,
                     const bool do_value_dump,
                     std::ostream *out);
   void list(const std::string& prefix,
 	    const bool do_crc,
+	    const bool pretty_binary_key,
 	    const bool do_value_dump);
   bool exists(const std::string& prefix);
   bool exists(const std::string& prefix, const std::string& key);

From f8d3db622a5a7d105b8536992425106f7db58882 Mon Sep 17 00:00:00 2001
From: Jacques Heunis <jheunis@bloomberg.net>
Date: Wed, 13 May 2026 09:14:05 +0000
Subject: [PATCH 048/596] rgw: Fix ops logs sometimes having several entries
 per line.

Although not explicitly documented, the RGW ops log is generally
formatted with one entry per line. This makes it work well with log
shipping/ingestion services (many of which default to treating each line
as a separate entry) and in particular works well with log servers that
index based on the available JSON fields.

The current implementation separates the log call from the resulting
disk IO: Logs are written to a buffer and a separate thread flushes them
to disk (possibly in batches). The current code appends a newline only
at the end of the batch being flushed to disk and in many cases when
under load this means that several log entries are concatenated onto a
single line, which complicates attempts to process those logs.

This PR separates the addition of a new line from the flush to disk,
appending a newline after every log entry but still only flushing at the
end of the batch to avoid additional IO overhead.

Fixes: https://tracker.ceph.com/issues/76566
Signed-off-by: Jacques Heunis <jheunis@bloomberg.net>
---
 src/rgw/rgw_log.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_log.cc b/src/rgw/rgw_log.cc
index 27580cce267..ea849ea2e6e 100644
--- a/src/rgw/rgw_log.cc
+++ b/src/rgw/rgw_log.cc
@@ -420,12 +420,13 @@ void OpsLogFile::flush()
         std::this_thread::sleep_for(std::chrono::seconds(sleep_time_secs));
         try_num++;
       } else {
+        file << '\n';
         break;
       }
     }
   }
   flush_buffer.clear();
-  file << std::endl;
+  file.flush();
 }
 
 void* OpsLogFile::entry() {

From 59b1191ed7defcf39a88ba12d5bfb3a0b8a279da Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Wed, 13 May 2026 19:49:11 +0530
Subject: [PATCH 049/596] python-common: Adding precheck for
 placement.count_per_host in NFSServiceSpec

NFS service specs should not allow placement.count_per_host.

Fixes: https://tracker.ceph.com/issues/76579
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/tests/services/test_nfs.py | 9 +++++++++
 src/python-common/ceph/deployment/service_spec.py | 5 +++++
 2 files changed, 14 insertions(+)

diff --git a/src/pybind/mgr/cephadm/tests/services/test_nfs.py b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
index 376fdea25e3..5079a517ebd 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_nfs.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
@@ -589,6 +589,15 @@ class TestNFS:
                 assert "NFS_RDMA_Port" not in ganesha_conf
 
 
+def test_nfs_placement_count_per_host_rejected():
+    spec = NFSServiceSpec(
+        service_id='mynfs',
+        placement=PlacementSpec(hosts=['h1'], count_per_host=1),
+    )
+    with pytest.raises(SpecValidationError, match="count_per_host.*not supported"):
+        spec.validate()
+
+
 def test_nfs_colocation_ports_validation():
     """Test validation of colocation_ports in NFSServiceSpec"""
     # Valid case: correct number of colocation_ports (count=3, need 2 additional)
diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 857446eb115..8e274368348 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -1529,6 +1529,11 @@ class NFSServiceSpec(ServiceSpec):
     def validate(self) -> None:
         super(NFSServiceSpec, self).validate()
 
+        if self.placement is not None and self.placement.count_per_host is not None:
+            raise SpecValidationError(
+                "Placement 'count_per_host' is not supported for nfs service."
+            )
+
         if self.virtual_ip and (self.ip_addrs or self.networks):
             raise SpecValidationError("Invalid NFS spec: Cannot set virtual_ip and "
                                       f"{'ip_addrs' if self.ip_addrs else 'networks'} fields")

From 411ab6e86576f556cbfc05057186ab1fc1b353b3 Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Thu, 2 Apr 2026 15:31:16 -0400
Subject: [PATCH 050/596] rgw/multi: Add GenCache to ShardCache

The GenCache will keep track of per-bucket sync information, like
if we have had to synthesize a change-per-shard as a result of hitting
the wrong generation.

Templatize tests.

Fixes: https://tracker.ceph.com/issues/75786
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/driver/rados/rgw_data_sync.cc      |  22 +-
 src/rgw/rgw_bucket_sync_cache.h            |  75 +++--
 src/test/rgw/test_rgw_bucket_sync_cache.cc | 331 ++++++++++++++++-----
 3 files changed, 319 insertions(+), 109 deletions(-)

diff --git a/src/rgw/driver/rados/rgw_data_sync.cc b/src/rgw/driver/rados/rgw_data_sync.cc
index 3b742b85706..abe1e611ada 100644
--- a/src/rgw/driver/rados/rgw_data_sync.cc
+++ b/src/rgw/driver/rados/rgw_data_sync.cc
@@ -1426,7 +1426,7 @@ public:
 class RGWDataSyncSingleEntryCR : public RGWCoroutine {
   RGWDataSyncCtx *sc;
   RGWDataSyncEnv *sync_env;
-  rgw::bucket_sync::Handle state; // cached bucket-shard state
+  rgw::bucket_sync::ShardHandle state; // cached bucket-shard state
   rgw_data_sync_obligation obligation; // input obligation
   std::optional<rgw_data_sync_obligation> complete; // obligation to complete
   uint32_t obligation_counter = 0;
@@ -1438,7 +1438,7 @@ class RGWDataSyncSingleEntryCR : public RGWCoroutine {
   ceph::real_time progress;
   int sync_status = 0;
 public:
-  RGWDataSyncSingleEntryCR(RGWDataSyncCtx *_sc, rgw::bucket_sync::Handle state,
+  RGWDataSyncSingleEntryCR(RGWDataSyncCtx *_sc, rgw::bucket_sync::ShardHandle state,
                            rgw_data_sync_obligation _obligation,
                            RGWDataSyncShardMarkerTrack *_marker_tracker,
                            const rgw_raw_obj& error_repo,
@@ -1641,7 +1641,7 @@ RGWCoroutine* data_sync_single_entry(RGWDataSyncCtx *sc, const rgw_bucket_shard&
                                 const std::string marker,
                                 ceph::real_time timestamp,
                                 boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
-                                boost::intrusive_ptr<rgw::bucket_sync::Cache> bucket_shard_cache,
+                                boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache,
                                 RGWDataSyncShardMarkerTrack* marker_tracker,
                                 rgw_raw_obj error_repo,
                                 RGWSyncTraceNodeRef& tn,
@@ -1674,7 +1674,7 @@ class RGWDataFullSyncSingleEntryCR : public RGWCoroutine {
   rgw_raw_obj error_repo;
   ceph::real_time timestamp;
   boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr;
-  boost::intrusive_ptr<rgw::bucket_sync::Cache> bucket_shard_cache;
+  boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache;
   RGWDataSyncShardMarkerTrack* marker_tracker;
   RGWSyncTraceNodeRef tn;
   rgw_bucket_index_marker_info remote_info;
@@ -1689,7 +1689,7 @@ public:
   RGWDataFullSyncSingleEntryCR(RGWDataSyncCtx *_sc, const rgw_pool& _pool, const rgw_bucket_shard& _source_bs,
                       const std::string& _key, const rgw_data_sync_status& _sync_status, const rgw_raw_obj& _error_repo,
                       ceph::real_time _timestamp, boost::intrusive_ptr<const RGWContinuousLeaseCR> _lease_cr,
-                      boost::intrusive_ptr<rgw::bucket_sync::Cache> _bucket_shard_cache,
+                      boost::intrusive_ptr<rgw::bucket_sync::ShardCache> _bucket_shard_cache,
                       RGWDataSyncShardMarkerTrack* _marker_tracker,
                       RGWSyncTraceNodeRef& _tn)
     : RGWCoroutine(_sc->cct), sc(_sc), sync_env(_sc->env), pool(_pool), source_bs(_source_bs), key(_key),
@@ -1791,7 +1791,7 @@ protected:
   boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr;
   const rgw_data_sync_status& sync_status;
   RGWObjVersionTracker& objv;
-  boost::intrusive_ptr<rgw::bucket_sync::Cache> bucket_shard_cache;
+  boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache;
 
   std::optional<RGWDataSyncShardMarkerTrack> marker_tracker;
   RGWRadosGetOmapValsCR::ResultPtr omapvals;
@@ -1818,7 +1818,7 @@ protected:
     boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
     const rgw_data_sync_status& sync_status,
     RGWObjVersionTracker& objv,
-    const boost::intrusive_ptr<rgw::bucket_sync::Cache>& bucket_shard_cache)
+    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache)
     : RGWCoroutine(_sc->cct), sc(_sc), pool(pool), shard_id(shard_id),
       sync_marker(sync_marker), tn(tn), status_oid(status_oid),
       error_repo(error_repo), lease_cr(std::move(lease_cr)),
@@ -1846,7 +1846,7 @@ public:
     const string& status_oid, const rgw_raw_obj& error_repo,
     boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
     const rgw_data_sync_status& sync_status, RGWObjVersionTracker& objv,
-    const boost::intrusive_ptr<rgw::bucket_sync::Cache>& bucket_shard_cache)
+    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache)
     : RGWDataBaseSyncShardCR(sc, pool, shard_id, sync_marker, tn,
 			     status_oid, error_repo, std::move(lease_cr),
 			     sync_status, objv, bucket_shard_cache) {}
@@ -1999,7 +1999,7 @@ public:
     const string& status_oid, const rgw_raw_obj& error_repo,
     boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
     const rgw_data_sync_status& sync_status, RGWObjVersionTracker& objv,
-    const boost::intrusive_ptr<rgw::bucket_sync::Cache>& bucket_shard_cache,
+    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache,
     ceph::mutex& inc_lock,
     bc::flat_set<rgw_data_notify_entry>& modified_shards)
     : RGWDataBaseSyncShardCR(sc, pool, shard_id, sync_marker, tn,
@@ -2221,8 +2221,8 @@ class RGWDataSyncShardCR : public RGWCoroutine {
 
   // target number of entries to cache before recycling idle ones
   static constexpr size_t target_cache_size = 256;
-  boost::intrusive_ptr<rgw::bucket_sync::Cache> bucket_shard_cache {
-    rgw::bucket_sync::Cache::create(target_cache_size) };
+  boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache {
+    rgw::bucket_sync::ShardCache::create(target_cache_size) };
 
   boost::intrusive_ptr<RGWContinuousLeaseCR> lease_cr;
   boost::intrusive_ptr<RGWCoroutinesStack> lease_stack;
diff --git a/src/rgw/rgw_bucket_sync_cache.h b/src/rgw/rgw_bucket_sync_cache.h
index 01ebafe0727..7b206994d89 100644
--- a/src/rgw/rgw_bucket_sync_cache.h
+++ b/src/rgw/rgw_bucket_sync_cache.h
@@ -17,13 +17,15 @@
 #include <boost/smart_ptr/intrusive_ref_counter.hpp>
 #include "common/intrusive_lru.h"
 #include "rgw_data_sync.h"
+#include "common/ceph_time.h"
 
 namespace rgw::bucket_sync {
 
-// per bucket-shard state cached by DataSyncShardCR
-struct State {
+// per bucket-shard (dimensioned by generation) state cached by DataSyncShardCR
+struct ShardState {
+  using key_type = std::pair<rgw_bucket_shard, std::optional<uint64_t>>;
   // the source bucket shard to sync
-  std::pair<rgw_bucket_shard, std::optional<uint64_t>> key;
+  key_type key;
   // current sync obligation being processed by DataSyncSingleEntry
   std::optional<rgw_data_sync_obligation> obligation;
   // incremented with each new obligation
@@ -31,27 +33,47 @@ struct State {
   // highest timestamp applied by all sources
   ceph::real_time progress_timestamp;
 
-  State(const std::pair<rgw_bucket_shard, std::optional<uint64_t>>& key ) noexcept
-    : key(key) {}
-  State(const rgw_bucket_shard& shard, std::optional<uint64_t> gen) noexcept
+  ShardState(const key_type& key) noexcept
+  : key(key) {}
+  ShardState(const rgw_bucket_shard& shard, std::optional<uint64_t> gen) noexcept
     : key(shard, gen) {}
 };
 
+// per bucket (dimensioned by generation) state cached by DataSyncShardCR
+struct GenState {
+  using key_type = std::pair<std::string, std::optional<uint64_t>>;
+  // the source bucket/generation to sync
+  key_type key;
+  // Last future generation recovery timestamp
+  ceph::coarse_mono_time last_future_generation_recovery = ceph::coarse_mono_clock::zero();
+
+  GenState(const key_type& key) noexcept
+    : key(key) {}
+  GenState(std::string bucket, std::optional<uint64_t> gen) noexcept
+  : key(std::move(bucket), gen) {}
+};
+
+template<typename State>
 struct Entry;
+template<typename State>
 struct EntryToKey;
+template<typename State>
 class Handle;
 
+template<typename State>
 using lru_config = ceph::common::intrusive_lru_config<
-  std::pair<rgw_bucket_shard, std::optional<uint64_t>>, Entry, EntryToKey>;
+    typename State::key_type, Entry<State>, EntryToKey<State>>;
 
 // a recyclable cache entry
-struct Entry : State, ceph::common::intrusive_lru_base<lru_config> {
+template<typename State>
+struct Entry : State, ceph::common::intrusive_lru_base<lru_config<State>> {
   using State::State;
 };
 
+template<typename State>
 struct EntryToKey {
-  using type = std::pair<rgw_bucket_shard, std::optional<uint64_t>>;
-  const type& operator()(const Entry& e) { return e.key; }
+  using type = typename State::key_type;
+  const type& operator()(const Entry<State>& e) { return e.key; }
 };
 
 // use a non-atomic reference count since these aren't shared across threads
@@ -59,9 +81,10 @@ template <typename T>
 using thread_unsafe_ref_counter = boost::intrusive_ref_counter<
     T, boost::thread_unsafe_counter>;
 
-// a state cache for entries within a single datalog shard
-class Cache : public thread_unsafe_ref_counter<Cache> {
-  ceph::common::intrusive_lru<lru_config> cache;
+// A state cache for entries within a single datalog shard
+template<typename State>
+class Cache : public thread_unsafe_ref_counter<Cache<State>> {
+  ceph::common::intrusive_lru<lru_config<State>> cache;
  protected:
   // protected ctor to enforce the use of factory function create()
   explicit Cache(size_t target_size) {
@@ -74,18 +97,19 @@ class Cache : public thread_unsafe_ref_counter<Cache> {
 
   // find or create a cache entry for the given key, and return a Handle that
   // keeps it lru-pinned until destruction
-  Handle get(const rgw_bucket_shard& shard, std::optional<uint64_t> gen);
+  Handle<State> get(const auto& ...args);
 };
 
 // a State handle that keeps the Cache referenced
+template<typename State>
 class Handle {
-  boost::intrusive_ptr<Cache> cache;
-  boost::intrusive_ptr<Entry> entry;
+  boost::intrusive_ptr<Cache<State>> cache;
+  boost::intrusive_ptr<Entry<State>> entry;
  public:
   Handle() noexcept = default;
   ~Handle() = default;
-  Handle(boost::intrusive_ptr<Cache> cache,
-         boost::intrusive_ptr<Entry> entry) noexcept
+  Handle(boost::intrusive_ptr<Cache<State>> cache,
+         boost::intrusive_ptr<Entry<State>> entry) noexcept
     : cache(std::move(cache)), entry(std::move(entry)) {}
   Handle(Handle&&) = default;
   Handle(const Handle&) = default;
@@ -107,10 +131,21 @@ class Handle {
   State* operator->() const noexcept { return entry.get(); }
 };
 
-inline Handle Cache::get(const rgw_bucket_shard& shard, std::optional<uint64_t> gen)
+template<typename State>
+inline Handle<State> Cache<State>::get(const auto& ...args)
 {
-  auto result = cache.get_or_create({ shard, gen });
+  static_assert(
+      std::is_constructible_v<typename State::key_type, decltype(args)...>,
+      "The arguments to Cache<State>::get must be arguments to construct "
+      "State");
+  auto result = cache.get_or_create({args...});
   return {this, std::move(result.first)};
 }
 
+using ShardHandle = Handle<ShardState>;
+using ShardCache = Cache<ShardState>;
+
+using GenHandle = Handle<GenState>;
+using GenCache = Cache<GenState>;
+
 } // namespace rgw::bucket_sync
diff --git a/src/test/rgw/test_rgw_bucket_sync_cache.cc b/src/test/rgw/test_rgw_bucket_sync_cache.cc
index ea285c6655e..59060847269 100644
--- a/src/test/rgw/test_rgw_bucket_sync_cache.cc
+++ b/src/test/rgw/test_rgw_bucket_sync_cache.cc
@@ -12,71 +12,182 @@
  * Foundation.  See file COPYING.
  */
 
-#include "rgw_bucket_sync_cache.h"
+#include <common/ceph_time.h>
 #include <gtest/gtest.h>
 
+#include "rgw_bucket_sync_cache.h"
+
 using namespace rgw::bucket_sync;
 
-// helper function to construct rgw_bucket_shard
-static rgw_bucket_shard make_key(const std::string& tenant,
-                                 const std::string& bucket, int shard)
+using Shard = ShardState;
+using Gen = GenState;
+
+namespace {
+/// Create a key suitable for a given cache
+///
+/// \tparam State One of `Shard` or `Gen`.
+///
+/// \param[in] tenant Owning tenant
+/// \param[in] bucket Bucket name
+/// \param[in] shard Bucket shard, ignored if `State` is `Gen`.
+///
+/// \return A key for the given bucket
+template <typename State>
+auto make_key(const std::string& tenant, const std::string& bucket, int shard) =
+    delete;
+
+template <>
+auto
+make_key<Shard>(const std::string& tenant, const std::string& bucket, int shard)
 {
   auto key = rgw_bucket_key{tenant, bucket};
   return rgw_bucket_shard{std::move(key), shard};
 }
 
-TEST(BucketSyncCache, ReturnCachedPinned)
+template <>
+auto
+make_key<Gen>(
+    const std::string& tenant,
+    const std::string& bucket,
+    // Dummy parameter for overload
+    int)
 {
-  auto cache = Cache::create(0);
-  const auto key = make_key("", "1", 0);
+  auto key = rgw_bucket_key{tenant, bucket};
+  rgw_bucket b{std::move(key)};
+  return b.get_key();
+}
+
+/// Stick an integer into a state
+///
+/// \tparam State One of `Shard` or `Gen`.
+///
+/// \param[inout] state State to modify
+/// \param[in] value Value to store
+template <typename State>
+void mutate(State&, unsigned int value) = delete;
+
+template <>
+void
+mutate<Shard>(ShardState& state, unsigned int value)
+{
+  state.counter = value;
+}
+
+template <>
+void
+mutate<Gen>(GenState& state, unsigned int value)
+{
+  state.last_future_generation_recovery = ceph::coarse_mono_time{
+      ceph::timespan{value}};
+}
+
+/// Retrieve an integer from a state
+///
+/// \note Intended only for values stored with `mutate`, anything else
+/// will be truncated to the capacity of an `unsigned int`.
+///
+/// \tparam State One of `Shard` or `Gen`.
+///
+/// \param[in] state State to modify
+///
+/// \return The integer previously stored in the state
+template <typename State>
+unsigned int extract(const State&) = delete;
+
+template <>
+unsigned int
+extract<Shard>(const Shard& state)
+{
+  return static_cast<unsigned int>(state.counter);
+}
+
+template <>
+unsigned int
+extract<Gen>(const Gen& state)
+{
+  return static_cast<unsigned int>(
+      state.last_future_generation_recovery.time_since_epoch().count());
+}
+} // namespace
+
+template <typename State>
+void
+ReturnCachedPinned()
+{
+  auto cache = Cache<State>::create(0);
+  const auto key = make_key<State>("", "1", 0);
   auto h1 = cache->get(key, std::nullopt); // pin
-  h1->counter = 1;
+  mutate(*h1, 1);
   auto h2 = cache->get(key, std::nullopt);
-  EXPECT_EQ(1, h2->counter);
+  EXPECT_EQ(1, extract(*h2));
 }
 
-TEST(BucketSyncCache, ReturnNewUnpinned)
+TEST(BucketShardSyncCache, ReturnCachedPinned) { ReturnCachedPinned<Shard>(); }
+
+TEST(BucketGenSyncCache, ReturnCachedPinned) { ReturnCachedPinned<Gen>(); }
+
+template <typename State>
+void
+ReturnNewUnpinned()
 {
-  auto cache = Cache::create(0);
-  const auto key = make_key("", "1", 0);
-  cache->get(key, std::nullopt)->counter = 1; // pin+unpin
-  EXPECT_EQ(0, cache->get(key, std::nullopt)->counter);
+  auto cache = Cache<State>::create(0);
+  const auto key = make_key<State>("", "1", 0);
+  mutate(*cache->get(key, std::nullopt), 1); // pin+unpin
+  EXPECT_EQ(0, extract(*cache->get(key, std::nullopt)));
 }
 
-TEST(BucketSyncCache, DistinctTenant)
+TEST(BucketShardSyncCache, ReturnNewUnpinned) { ReturnNewUnpinned<Shard>(); }
+
+TEST(BucketGenSyncCache, ReturnNewUnpinned) { ReturnNewUnpinned<Gen>(); }
+
+template <typename State>
+void
+DistinctTenant()
 {
-  auto cache = Cache::create(2);
-  const auto key1 = make_key("a", "bucket", 0);
-  const auto key2 = make_key("b", "bucket", 0);
+  auto cache = Cache<State>::create(2);
+  const auto key1 = make_key<State>("a", "bucket", 0);
+  const auto key2 = make_key<State>("b", "bucket", 0);
+  mutate(*cache->get(key1, std::nullopt), 1);
+  EXPECT_EQ(0, extract(*cache->get(key2, std::nullopt)));
+}
+
+TEST(BucketShardSyncCache, DistinctTenant) { DistinctTenant<Shard>(); }
+
+TEST(BucketGenSyncCache, DistinctTenant) { DistinctTenant<Gen>(); }
+
+TEST(BucketShardSyncCache, DistinctShards)
+{
+  auto cache = ShardCache::create(2);
+  const auto key1 = make_key<Shard>("", "bucket", 0);
+  const auto key2 = make_key<Shard>("", "bucket", 1);
   cache->get(key1, std::nullopt)->counter = 1;
   EXPECT_EQ(0, cache->get(key2, std::nullopt)->counter);
 }
 
-TEST(BucketSyncCache, DistinctShards)
+template <typename State>
+void
+DistinctGen()
 {
-  auto cache = Cache::create(2);
-  const auto key1 = make_key("", "bucket", 0);
-  const auto key2 = make_key("", "bucket", 1);
-  cache->get(key1, std::nullopt)->counter = 1;
-  EXPECT_EQ(0, cache->get(key2, std::nullopt)->counter);
-}
-
-TEST(BucketSyncCache, DistinctGen)
-{
-  auto cache = Cache::create(2);
-  const auto key = make_key("", "bucket", 0);
+  auto cache = Cache<State>::create(2);
+  const auto key = make_key<State>("", "bucket", 0);
   std::optional<uint64_t> gen1; // empty
   std::optional<uint64_t> gen2 = 5;
-  cache->get(key, gen1)->counter = 1;
-  EXPECT_EQ(0, cache->get(key, gen2)->counter);
+  mutate(*cache->get(key, gen1), 1);
+  EXPECT_EQ(0, extract(*cache->get(key, gen2)));
 }
 
-TEST(BucketSyncCache, DontEvictPinned)
-{
-  auto cache = Cache::create(0);
+TEST(BucketShardSyncCache, DistinctGen) { DistinctGen<Shard>(); }
 
-  const auto key1 = make_key("", "1", 0);
-  const auto key2 = make_key("", "2", 0);
+TEST(BucketGenSyncCache, DistinctGen) { DistinctGen<Gen>(); }
+
+template <typename State>
+void
+DontEvictPinned()
+{
+  auto cache = Cache<State>::create(0);
+
+  const auto key1 = make_key<State>("", "1", 0);
+  const auto key2 = make_key<State>("", "2", 0);
 
   auto h1 = cache->get(key1, std::nullopt);
   EXPECT_EQ(key1, h1->key.first);
@@ -85,46 +196,64 @@ TEST(BucketSyncCache, DontEvictPinned)
   EXPECT_EQ(key1, h1->key.first); // h1 unchanged
 }
 
-TEST(BucketSyncCache, HandleLifetime)
-{
-  const auto key = make_key("", "1", 0);
+TEST(BucketShardSyncCache, DontEvictPinned) { DontEvictPinned<Shard>(); }
 
-  Handle h; // test that handles keep the cache referenced
+TEST(BucketGenSyncCache, DontEvictPinned) { DontEvictPinned<Gen>(); }
+
+template <typename State>
+void
+HandleLifetime()
+{
+  const auto key = make_key<State>("", "1", 0);
+
+  Handle<State> h; // test that handles keep the cache referenced
   {
-    auto cache = Cache::create(0);
+    auto cache = Cache<State>::create(0);
     h = cache->get(key, std::nullopt);
   }
   EXPECT_EQ(key, h->key.first);
 }
 
-TEST(BucketSyncCache, TargetSize)
-{
-  auto cache = Cache::create(2);
+TEST(BucketShardSyncCache, HandleLifetime) { HandleLifetime<Shard>(); }
 
-  const auto key1 = make_key("", "1", 0);
-  const auto key2 = make_key("", "2", 0);
-  const auto key3 = make_key("", "3", 0);
+TEST(BucketGenSyncCache, HandleLifetime) { HandleLifetime<Gen>(); }
+
+template <typename State>
+void
+TargetSize()
+{
+  auto cache = Cache<State>::create(2);
+
+  const auto key1 = make_key<State>("", "1", 0);
+  const auto key2 = make_key<State>("", "2", 0);
+  const auto key3 = make_key<State>("", "3", 0);
 
   // fill cache up to target_size=2
-  cache->get(key1, std::nullopt)->counter = 1;
-  cache->get(key2, std::nullopt)->counter = 2;
+  mutate(*cache->get(key1, std::nullopt), 1);
+  mutate(*cache->get(key2, std::nullopt), 2);
   // test that each unpinned entry is still cached
-  EXPECT_EQ(1, cache->get(key1, std::nullopt)->counter);
-  EXPECT_EQ(2, cache->get(key2, std::nullopt)->counter);
+  EXPECT_EQ(1, extract(*cache->get(key1, std::nullopt)));
+  EXPECT_EQ(2, extract(*cache->get(key2, std::nullopt)));
   // overflow the cache and recycle key1
-  cache->get(key3, std::nullopt)->counter = 3;
+  mutate(*cache->get(key3, std::nullopt), 3);
   // test that the oldest entry was recycled
-  EXPECT_EQ(0, cache->get(key1, std::nullopt)->counter);
+  EXPECT_EQ(0, extract(*cache->get(key1, std::nullopt)));
 }
 
-TEST(BucketSyncCache, HandleMoveAssignEmpty)
+TEST(BucketShardSyncCache, TargetSize) { TargetSize<Shard>(); }
+
+TEST(BucketGenSyncCache, TargetSize) { TargetSize<Gen>(); }
+
+template <typename State>
+void
+HandleMoveAssignEmpty()
 {
-  auto cache = Cache::create(0);
+  auto cache = Cache<State>::create(0);
 
-  const auto key1 = make_key("", "1", 0);
-  const auto key2 = make_key("", "2", 0);
+  const auto key1 = make_key<State>("", "1", 0);
+  const auto key2 = make_key<State>("", "2", 0);
 
-  Handle j1;
+  Handle<State> j1;
   {
     auto h1 = cache->get(key1, std::nullopt);
     j1 = std::move(h1); // assign over empty handle
@@ -134,32 +263,56 @@ TEST(BucketSyncCache, HandleMoveAssignEmpty)
   EXPECT_EQ(key1, j1->key.first); // j1 stays pinned
 }
 
-TEST(BucketSyncCache, HandleMoveAssignExisting)
+TEST(BucketShardSyncCache, HandleMoveAssignEmpty)
 {
-  const auto key1 = make_key("", "1", 0);
-  const auto key2 = make_key("", "2", 0);
+  HandleMoveAssignEmpty<Shard>();
+}
 
-  Handle h1;
+TEST(BucketGenSyncCache, HandleMoveAssignEmpty)
+{
+  HandleMoveAssignEmpty<Gen>();
+}
+
+template <typename State>
+void
+HandleMoveAssignExisting()
+{
+  const auto key1 = make_key<State>("", "1", 0);
+  const auto key2 = make_key<State>("", "2", 0);
+
+  Handle<State> h1;
   {
-    auto cache1 = Cache::create(0);
+    auto cache1 = Cache<State>::create(0);
     h1 = cache1->get(key1, std::nullopt);
-  } // j1 has the last ref to cache1
+  } // h1 has the last ref to cache1
   {
-    auto cache2 = Cache::create(0);
+    auto cache2 = Cache<State>::create(0);
     auto h2 = cache2->get(key2, std::nullopt);
     h1 = std::move(h2); // assign over existing handle
   }
   EXPECT_EQ(key2, h1->key.first);
 }
 
-TEST(BucketSyncCache, HandleCopyAssignEmpty)
+TEST(BucketShardSyncCache, HandleMoveAssignExisting)
 {
-  auto cache = Cache::create(0);
+  HandleMoveAssignExisting<Shard>();
+}
 
-  const auto key1 = make_key("", "1", 0);
-  const auto key2 = make_key("", "2", 0);
+TEST(BucketGenSyncCache, HandleMoveAssignExisting)
+{
+  HandleMoveAssignExisting<Gen>();
+}
 
-  Handle j1;
+template <typename State>
+void
+HandleCopyAssignEmpty()
+{
+  auto cache = Cache<State>::create(0);
+
+  const auto key1 = make_key<State>("", "1", 0);
+  const auto key2 = make_key<State>("", "2", 0);
+
+  Handle<State> j1;
   {
     auto h1 = cache->get(key1, std::nullopt);
     j1 = h1; // assign over empty handle
@@ -169,21 +322,43 @@ TEST(BucketSyncCache, HandleCopyAssignEmpty)
   EXPECT_EQ(key1, j1->key.first); // j1 stays pinned
 }
 
-TEST(BucketSyncCache, HandleCopyAssignExisting)
+TEST(BucketShardSyncCache, HandleCopyAssignEmpty)
 {
-  const auto key1 = make_key("", "1", 0);
-  const auto key2 = make_key("", "2", 0);
+  HandleCopyAssignEmpty<Shard>();
+}
 
-  Handle h1;
+TEST(BucketGenSyncCache, HandleCopyAssignEmpty)
+{
+  HandleCopyAssignEmpty<Gen>();
+}
+
+template <typename State>
+void
+HandleCopyAssignExisting()
+{
+  const auto key1 = make_key<State>("", "1", 0);
+  const auto key2 = make_key<State>("", "2", 0);
+
+  Handle<State> h1;
   {
-    auto cache1 = Cache::create(0);
+    auto cache1 = Cache<State>::create(0);
     h1 = cache1->get(key1, std::nullopt);
-  } // j1 has the last ref to cache1
+  } // h1 has the last ref to cache1
   {
-    auto cache2 = Cache::create(0);
+    auto cache2 = Cache<State>::create(0);
     auto h2 = cache2->get(key2, std::nullopt);
     h1 = h2; // assign over existing handle
     EXPECT_EQ(&*h1, &*h2);
   }
   EXPECT_EQ(key2, h1->key.first);
 }
+
+TEST(BucketShardSyncCache, HandleCopyAssignExisting)
+{
+  HandleCopyAssignExisting<Shard>();
+}
+
+TEST(BucketGenSyncCache, HandleCopyAssignExisting)
+{
+  HandleCopyAssignExisting<Gen>();
+}

From e28e7544b73b32fe3fe4f395f6ee3af342064b89 Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Thu, 2 Apr 2026 15:43:27 -0400
Subject: [PATCH 051/596] rgw/multi: Reliably recover from future generation
 sync

Since we can't map shards between generations, if we get a sync entry
for a future shard, synthesize an entry on the current generation for
all shards.

We use the bucket cache to keep track of when we've done this so we
don't give ourselves unbounded work when we get bursts of future
generation shards.

Fixes: https://tracker.ceph.com/issues/75786
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/driver/rados/rgw_data_sync.cc | 145 +++++++++++++++++---------
 1 file changed, 97 insertions(+), 48 deletions(-)

diff --git a/src/rgw/driver/rados/rgw_data_sync.cc b/src/rgw/driver/rados/rgw_data_sync.cc
index abe1e611ada..058a30cac54 100644
--- a/src/rgw/driver/rados/rgw_data_sync.cc
+++ b/src/rgw/driver/rados/rgw_data_sync.cc
@@ -1412,13 +1412,16 @@ class RGWRunBucketSourcesSyncCR : public RGWCoroutine {
   rgw_bucket_index_marker_info marker_info;
   BucketIndexShardsManager marker_mgr;
 
+  rgw::bucket_sync::GenHandle gen_state;
+
 public:
   RGWRunBucketSourcesSyncCR(RGWDataSyncCtx *_sc,
                             boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
                             const rgw_bucket_shard& source_bs,
                             const RGWSyncTraceNodeRef& _tn_parent,
 			    std::optional<uint64_t> gen,
-                            ceph::real_time* progress);
+                            ceph::real_time* progress,
+			    rgw::bucket_sync::GenHandle gen_state);
 
   int operate(const DoutPrefixProvider *dpp) override;
 };
@@ -1427,6 +1430,7 @@ class RGWDataSyncSingleEntryCR : public RGWCoroutine {
   RGWDataSyncCtx *sc;
   RGWDataSyncEnv *sync_env;
   rgw::bucket_sync::ShardHandle state; // cached bucket-shard state
+  rgw::bucket_sync::GenHandle gen_state; // cached bucket state
   rgw_data_sync_obligation obligation; // input obligation
   std::optional<rgw_data_sync_obligation> complete; // obligation to complete
   uint32_t obligation_counter = 0;
@@ -1439,13 +1443,14 @@ class RGWDataSyncSingleEntryCR : public RGWCoroutine {
   int sync_status = 0;
 public:
   RGWDataSyncSingleEntryCR(RGWDataSyncCtx *_sc, rgw::bucket_sync::ShardHandle state,
+			   rgw::bucket_sync::GenHandle gen_state,
                            rgw_data_sync_obligation _obligation,
                            RGWDataSyncShardMarkerTrack *_marker_tracker,
                            const rgw_raw_obj& error_repo,
                            boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
                            const RGWSyncTraceNodeRef& _tn_parent)
     : RGWCoroutine(_sc->cct), sc(_sc), sync_env(_sc->env),
-      state(std::move(state)), obligation(std::move(_obligation)),
+      state(std::move(state)), gen_state(std::move(gen_state)), obligation(std::move(_obligation)),
       marker_tracker(_marker_tracker), error_repo(error_repo),
       lease_cr(std::move(lease_cr)) {
     set_description() << "data sync single entry (source_zone=" << sc->source_zone << ") " << obligation;
@@ -1487,7 +1492,7 @@ public:
           yield call(new RGWRunBucketSourcesSyncCR(sc, lease_cr,
                                                    state->key.first, tn,
                                                    state->obligation->gen,
-						   &progress));
+						   &progress, gen_state));
           if (retcode < 0) {
             break;
           }
@@ -1642,13 +1647,15 @@ RGWCoroutine* data_sync_single_entry(RGWDataSyncCtx *sc, const rgw_bucket_shard&
                                 ceph::real_time timestamp,
                                 boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
                                 boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache,
+                                boost::intrusive_ptr<rgw::bucket_sync::GenCache> bucket_gen_cache,
                                 RGWDataSyncShardMarkerTrack* marker_tracker,
                                 rgw_raw_obj error_repo,
                                 RGWSyncTraceNodeRef& tn,
                                 bool retry) {
   auto state = bucket_shard_cache->get(src, gen);
+  auto gen_state = bucket_gen_cache->get(src.bucket.get_key(), gen);
   auto obligation = rgw_data_sync_obligation{src, gen, marker, timestamp, retry};
-  return new RGWDataSyncSingleEntryCR(sc, std::move(state), std::move(obligation),
+  return new RGWDataSyncSingleEntryCR(sc, std::move(state), std::move(gen_state), std::move(obligation),
                                       &*marker_tracker, error_repo,
                                       lease_cr.get(), tn);
 }
@@ -1675,6 +1682,7 @@ class RGWDataFullSyncSingleEntryCR : public RGWCoroutine {
   ceph::real_time timestamp;
   boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr;
   boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache;
+  boost::intrusive_ptr<rgw::bucket_sync::GenCache> bucket_gen_cache;
   RGWDataSyncShardMarkerTrack* marker_tracker;
   RGWSyncTraceNodeRef tn;
   rgw_bucket_index_marker_info remote_info;
@@ -1690,11 +1698,12 @@ public:
                       const std::string& _key, const rgw_data_sync_status& _sync_status, const rgw_raw_obj& _error_repo,
                       ceph::real_time _timestamp, boost::intrusive_ptr<const RGWContinuousLeaseCR> _lease_cr,
                       boost::intrusive_ptr<rgw::bucket_sync::ShardCache> _bucket_shard_cache,
+                      boost::intrusive_ptr<rgw::bucket_sync::GenCache> _bucket_gen_cache,
                       RGWDataSyncShardMarkerTrack* _marker_tracker,
                       RGWSyncTraceNodeRef& _tn)
     : RGWCoroutine(_sc->cct), sc(_sc), sync_env(_sc->env), pool(_pool), source_bs(_source_bs), key(_key),
       sync_status(_sync_status), error_repo(_error_repo), timestamp(_timestamp), lease_cr(std::move(_lease_cr)),
-      bucket_shard_cache(_bucket_shard_cache), marker_tracker(_marker_tracker), tn(_tn) {
+      bucket_shard_cache(_bucket_shard_cache), bucket_gen_cache(_bucket_gen_cache), marker_tracker(_marker_tracker), tn(_tn) {
         error_inject = (sync_env->cct->_conf->rgw_sync_data_full_inject_err_probability > 0);
       }
 
@@ -1740,7 +1749,7 @@ public:
 		timestamp), sc->lcc.adj_concurrency(cct->_conf->rgw_data_sync_spawn_window), std::nullopt);
           } else {
           shard_cr = data_sync_single_entry(sc, source_bs, each->gen, key, timestamp,
-                      lease_cr, bucket_shard_cache, nullptr, error_repo, tn, false);
+					    lease_cr, bucket_shard_cache, bucket_gen_cache, nullptr, error_repo, tn, false);
           tn->log(10, SSTR("full sync: syncing shard_id " << sid << " of gen " << each->gen));
           if (first_shard) {
             first_shard = false;
@@ -1792,6 +1801,7 @@ protected:
   const rgw_data_sync_status& sync_status;
   RGWObjVersionTracker& objv;
   boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache;
+  boost::intrusive_ptr<rgw::bucket_sync::GenCache> bucket_gen_cache;
 
   std::optional<RGWDataSyncShardMarkerTrack> marker_tracker;
   RGWRadosGetOmapValsCR::ResultPtr omapvals;
@@ -1818,12 +1828,13 @@ protected:
     boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
     const rgw_data_sync_status& sync_status,
     RGWObjVersionTracker& objv,
-    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache)
+    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache,
+    const boost::intrusive_ptr<rgw::bucket_sync::GenCache>& bucket_gen_cache)
     : RGWCoroutine(_sc->cct), sc(_sc), pool(pool), shard_id(shard_id),
       sync_marker(sync_marker), tn(tn), status_oid(status_oid),
       error_repo(error_repo), lease_cr(std::move(lease_cr)),
       sync_status(sync_status), objv(objv),
-      bucket_shard_cache(bucket_shard_cache) {}
+      bucket_shard_cache(bucket_shard_cache), bucket_gen_cache(bucket_gen_cache) {}
 };
 
 class RGWDataFullSyncShardCR : public RGWDataBaseSyncShardCR {
@@ -1846,10 +1857,11 @@ public:
     const string& status_oid, const rgw_raw_obj& error_repo,
     boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
     const rgw_data_sync_status& sync_status, RGWObjVersionTracker& objv,
-    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache)
+    const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache,
+    const boost::intrusive_ptr<rgw::bucket_sync::GenCache>& bucket_gen_cache)
     : RGWDataBaseSyncShardCR(sc, pool, shard_id, sync_marker, tn,
 			     status_oid, error_repo, std::move(lease_cr),
-			     sync_status, objv, bucket_shard_cache) {}
+			     sync_status, objv, bucket_shard_cache, bucket_gen_cache) {}
 
   int operate(const DoutPrefixProvider *dpp) override {
     reenter(this) {
@@ -1905,7 +1917,7 @@ public:
             yield_spawn_window(new RGWDataFullSyncSingleEntryCR(
 				 sc, pool, source_bs, iter->first, sync_status,
 				 error_repo, entry_timestamp, lease_cr,
-				 bucket_shard_cache, &*marker_tracker, tn),
+				 bucket_shard_cache, bucket_gen_cache, &*marker_tracker, tn),
 			       sc->lcc.adj_concurrency(cct->_conf->rgw_data_sync_spawn_window),
              std::nullopt);
           }
@@ -2000,11 +2012,12 @@ public:
     boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
     const rgw_data_sync_status& sync_status, RGWObjVersionTracker& objv,
     const boost::intrusive_ptr<rgw::bucket_sync::ShardCache>& bucket_shard_cache,
+    const boost::intrusive_ptr<rgw::bucket_sync::GenCache>& bucket_gen_cache,
     ceph::mutex& inc_lock,
     bc::flat_set<rgw_data_notify_entry>& modified_shards)
     : RGWDataBaseSyncShardCR(sc, pool, shard_id, sync_marker, tn,
 			     status_oid, error_repo, std::move(lease_cr),
-			     sync_status, objv, bucket_shard_cache),
+			     sync_status, objv, bucket_shard_cache, bucket_gen_cache),
       inc_lock(inc_lock), modified_shards(modified_shards) {}
 
   int operate(const DoutPrefixProvider *dpp) override {
@@ -2052,7 +2065,7 @@ public:
 			   << modified_iter->key));
           spawn(data_sync_single_entry(sc, source_bs, modified_iter->gen, {},
 				       ceph::real_time{}, lease_cr,
-				       bucket_shard_cache, &*marker_tracker,
+				       bucket_shard_cache, bucket_gen_cache, &*marker_tracker,
 				       error_repo, tn, false), false);
 	}
 
@@ -2098,7 +2111,7 @@ public:
 			       << " timestamp=" << entry_timestamp));
               spawn(data_sync_single_entry(sc, source_bs, gen, "",
 					   entry_timestamp, lease_cr,
-					   bucket_shard_cache, &*marker_tracker,
+					   bucket_shard_cache, bucket_gen_cache, &*marker_tracker,
 					   error_repo, tn, true), false);
             }
           }
@@ -2152,7 +2165,7 @@ public:
           } else {
             tn->log(1, SSTR("incremental sync on " << log_iter->entry.key  << "shard: " << shard_id << "on gen " << log_iter->entry.gen));
             yield_spawn_window(data_sync_single_entry(sc, source_bs, log_iter->entry.gen, log_iter->log_id,
-                                                 log_iter->log_timestamp, lease_cr,bucket_shard_cache,
+                                                      log_iter->log_timestamp, lease_cr,bucket_shard_cache, bucket_gen_cache,
                                                  &*marker_tracker, error_repo, tn, false),
                                sc->lcc.adj_concurrency(cct->_conf->rgw_data_sync_spawn_window),
                                [&](uint64_t stack_id, int ret) {
@@ -2221,8 +2234,10 @@ class RGWDataSyncShardCR : public RGWCoroutine {
 
   // target number of entries to cache before recycling idle ones
   static constexpr size_t target_cache_size = 256;
-  boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache {
-    rgw::bucket_sync::ShardCache::create(target_cache_size) };
+  boost::intrusive_ptr<rgw::bucket_sync::ShardCache> bucket_shard_cache{
+      rgw::bucket_sync::ShardCache::create(target_cache_size)};
+  boost::intrusive_ptr<rgw::bucket_sync::GenCache> bucket_gen_cache{
+      rgw::bucket_sync::GenCache::create(target_cache_size)};
 
   boost::intrusive_ptr<RGWContinuousLeaseCR> lease_cr;
   boost::intrusive_ptr<RGWCoroutinesStack> lease_stack;
@@ -2290,7 +2305,7 @@ public:
 						sync_marker, tn,
 						status_oid, error_repo,
 						lease_cr, sync_status,
-            objv, bucket_shard_cache));
+						objv, bucket_shard_cache, bucket_gen_cache));
 	  if (retcode < 0) {
 	    if (retcode != -EBUSY) {
 	      tn->log(10, SSTR("full sync failed (retcode=" << retcode << ")"));
@@ -2304,7 +2319,7 @@ public:
 					       sync_marker, tn,
 					       status_oid, error_repo,
 					       lease_cr, sync_status,
-					       objv, bucket_shard_cache,
+					       objv, bucket_shard_cache, bucket_gen_cache,
 					       inc_lock, modified_shards));
 	  if (retcode < 0) {
 	    if (retcode != -EBUSY) {
@@ -5326,6 +5341,7 @@ static RGWCoroutine* sync_bucket_shard_cr(RGWDataSyncCtx* sc,
                                           std::optional<uint64_t> gen,
                                           const RGWSyncTraceNodeRef& tn,
                                           ceph::real_time* progress,
+					  ceph::coarse_mono_time& last_future_generation_recovery,
                                           bool no_lease = false);
 
 RGWRunBucketSourcesSyncCR::RGWRunBucketSourcesSyncCR(RGWDataSyncCtx *_sc,
@@ -5333,14 +5349,16 @@ RGWRunBucketSourcesSyncCR::RGWRunBucketSourcesSyncCR(RGWDataSyncCtx *_sc,
                                                      const rgw_bucket_shard& source_bs,
                                                      const RGWSyncTraceNodeRef& _tn_parent,
 						     std::optional<uint64_t> gen,
-                                                     ceph::real_time* progress)
+                                                     ceph::real_time* progress,
+						     rgw::bucket_sync::GenHandle gen_state)
   : RGWCoroutine(_sc->env->cct), sc(_sc), sync_env(_sc->env),
     lease_cr(std::move(lease_cr)),
     tn(sync_env->sync_tracer->add_node(
 	 _tn_parent, "bucket_sync_sources",
 	 SSTR( "source=" << source_bs << ":source_zone=" << sc->source_zone))),
     progress(progress),
-    gen(gen)
+    gen(gen),
+    gen_state(std::move(gen_state))
 {
   sync_pair.source_bs = source_bs;
 }
@@ -5375,7 +5393,7 @@ int RGWRunBucketSourcesSyncCR::operate(const DoutPrefixProvider *dpp)
 
       yield_spawn_window(sync_bucket_shard_cr(sc, lease_cr, sync_pair,
                                               gen, tn, &*cur_shard_progress,
-                                              false),
+                                              gen_state->last_future_generation_recovery, false),
                          sc->lcc.adj_concurrency(cct->_conf->rgw_bucket_sync_spawn_window),
                          [&](uint64_t stack_id, int ret) {
                            if (ret < 0) {
@@ -5774,16 +5792,21 @@ class RGWSyncBucketCR : public RGWCoroutine {
   rgw_bucket_shard source_bs;
   rgw_pool pool;
   uint64_t current_gen = 0;
+  // In general operation, a reference to a pinned entry in `bucket_gen_cache`
+  ceph::coarse_mono_time& last_future_generation_recovery;
 
   RGWSyncTraceNodeRef tn;
 
+  static constexpr std::chrono::seconds throttle_future_recovery = std::chrono::hours(1);
+
 public:
   RGWSyncBucketCR(RGWDataSyncCtx *_sc,
                   boost::intrusive_ptr<const RGWContinuousLeaseCR> lease_cr,
-                  const rgw_bucket_sync_pair_info& _sync_pair,
+                  const rgw_bucket_sync_pair_info &_sync_pair,
                   std::optional<uint64_t> gen,
                   const RGWSyncTraceNodeRef& _tn_parent,
                   ceph::real_time* progress,
+                  ceph::coarse_mono_time& last_future_generation_recovery,
                   bool no_lease = false)
     : RGWCoroutine(_sc->cct), sc(_sc), env(_sc->env),
       data_lease_cr(std::move(lease_cr)), sync_pair(_sync_pair),
@@ -5793,7 +5816,7 @@ public:
                  RGWBucketPipeSyncStatusManager::full_status_oid(sc->source_zone,
                                                                  sync_pair.source_bs.bucket,
                                                                  sync_pair.dest_bucket)),
-      no_lease(no_lease),
+      no_lease(no_lease), last_future_generation_recovery(last_future_generation_recovery),
       tn(env->sync_tracer->add_node(_tn_parent, "bucket",
                                     SSTR(bucket_str{_sync_pair.dest_bucket} << "<-" << bucket_shard_str{_sync_pair.source_bs} ))) {
   }
@@ -5807,10 +5830,11 @@ static RGWCoroutine* sync_bucket_shard_cr(RGWDataSyncCtx* sc,
                                           std::optional<uint64_t> gen,
                                           const RGWSyncTraceNodeRef& tn,
                                           ceph::real_time* progress,
+                                          ceph::coarse_mono_time& last_future_generation_recovery,
                                           bool no_lease)
 {
   return new RGWSyncBucketCR(sc, std::move(lease), sync_pair,
-                             gen, tn, progress, no_lease);
+                             gen, tn, progress, last_future_generation_recovery, no_lease);
 }
 
 #define RELEASE_LOCK(cr) \
@@ -6009,29 +6033,46 @@ int RGWSyncBucketCR::operate(const DoutPrefixProvider *dpp)
           if (*gen > current_gen) {
 	    /* In case the data log entry is missing for previous gen, it may
 	     * not be marked complete and the sync can get stuck. To avoid it,
-	     * may be we can add this (shardid, gen) to error repo to force
-	     * sync and mark that shard as completed.
+	     * may be we can add an entry for every shard in the previous generation.
 	     */
 	    pool = sc->env->svc->zone->get_zone_params().log_pool;
-            if ((static_cast<std::size_t>(source_bs.shard_id) < bucket_status.shards_done_with_gen.size()) &&
-	       !bucket_status.shards_done_with_gen[source_bs.shard_id]) {
+            if ((ceph::coarse_mono_clock::now() - last_future_generation_recovery) > throttle_future_recovery) {
+	      last_future_generation_recovery = ceph::coarse_mono_clock::now();
 	      // use the error repo and sync status timestamp from the datalog shard corresponding to source_bs
-              error_repo = datalog_oid_for_error_repo(sc, sc->env->driver,
-			   pool, source_bs);
-              yield call(rgw::error_repo::write_cr(sc->env->driver->getRados()->get_rados_handle(), error_repo,
-                                              rgw::error_repo::encode_key(source_bs, current_gen),
-                                              ceph::real_clock::zero()));
-              if (retcode < 0) {
-                tn->log(0, SSTR("ERROR: failed to log prev gen entry (bucket=" << source_bs.bucket << ", shard_id=" << source_bs.shard_id << ", gen=" << current_gen << " in error repo: retcode=" << retcode));
-              } else {
-                tn->log(20, SSTR("logged prev gen entry (bucket=" << source_bs.bucket << ", shard_id=" << source_bs.shard_id << ", gen=" << current_gen << " in error repo: retcode=" << retcode));
+              for (source_bs.shard_id = 0;
+                   source_bs.shard_id < std::ssize(bucket_status.shards_done_with_gen);
+                   ++source_bs.shard_id) {
+		error_repo = datalog_oid_for_error_repo(sc, sc->env->driver,
+							pool, source_bs);
+		tn->log(10, SSTR("writing shard_id " << source_bs.shard_id << " of gen " << current_gen << " to error repo for retry"));
+		yield_spawn_window(
+		    rgw::error_repo::write_cr(
+			sc->env->driver->getRados()->get_rados_handle(),
+			error_repo,
+			rgw::error_repo::encode_key(source_bs, current_gen),
+			ceph::real_clock::zero()),
+		    sc->lcc.adj_concurrency(
+			cct->_conf->rgw_data_sync_spawn_window),
+		    [&](uint64_t stack_id, int ret) {
+		      if (ret < 0) {
+			retcode = ret;
+		      }
+		      return 0;
+		    });
 	      }
+	      drain_all_cb([&](uint64_t stack_id, int ret) {
+		if (ret < 0) {
+		  tn->log(10,
+                        SSTR("writing to error repo returned error: " << ret));
+		}
+		return ret;
+	      });
 	    }
-            retcode = -EAGAIN;
-            tn->log(10, SSTR("ERROR: requested sync of future generation "
-                             << *gen << " > " << current_gen
-                             << ", returning " << retcode << " for later retry"));
-            return set_cr_error(retcode);
+	    retcode = -EAGAIN;
+	    tn->log(10, SSTR("ERROR: requested sync of future generation "
+			     << *gen << " > " << current_gen
+			     << ", returning " << retcode << " for later retry"));
+	    return set_cr_error(retcode);
           } else if (*gen < current_gen) {
             tn->log(10, SSTR("WARNING: requested sync of past generation "
                              << *gen << " < " << current_gen
@@ -6274,11 +6315,14 @@ class ShardCR : public RGWCoroutine {
   ceph::real_time prev_progress;
   ceph::real_time progress;
 
-public:
+  ceph::coarse_mono_time& last_future_generation_recovery;
 
-  ShardCR(RGWDataSyncCtx& sc, const rgw_bucket_sync_pair_info& pair,
-	  const uint64_t gen)
-    : RGWCoroutine(sc.cct), sc(sc), pair(pair), gen(gen) {}
+public:
+  ShardCR(RGWDataSyncCtx &sc, const rgw_bucket_sync_pair_info &pair,
+          const uint64_t gen,
+          ceph::coarse_mono_time &last_future_generation_recovery)
+      : RGWCoroutine(sc.cct), sc(sc), pair(pair), gen(gen),
+        last_future_generation_recovery( last_future_generation_recovery) {}
 
   int operate(const DoutPrefixProvider *dpp) override {
     reenter(this) {
@@ -6295,6 +6339,7 @@ public:
 	yield call(sync_bucket_shard_cr(&sc, nullptr, pair, gen,
 					sc.env->sync_tracer->root_node,
 					&progress,
+                                        last_future_generation_recovery,
 					true /* no_lease: bucket sync run skips
 					        lock acquisition so it is never
 					        blocked by a background sync process*/));
@@ -6341,6 +6386,10 @@ class GenCR : public RGWShardCollectCR {
   std::vector<rgw_bucket_sync_pair_info> pairs;
   decltype(pairs)::const_iterator iter;
 
+  // We do a manual sync when we're told to do a manual sync. No need
+  // for a cache.
+  ceph::coarse_mono_time last_future_generation_recovery = ceph::coarse_mono_clock::zero();
+
 public:
   GenCR(RGWDataSyncCtx& sc, const rgw_bucket& source, const rgw_bucket& dest,
 	const uint64_t gen, const uint64_t shards,
@@ -6363,7 +6412,7 @@ public:
     if (iter == pairs.cend()) {
       return false;
     }
-    spawn(new ShardCR(sc, *iter, gen), false);
+    spawn(new ShardCR(sc, *iter, gen, last_future_generation_recovery), false);
     ++iter;
     return true;
   }

From 066b33e805565cce462484ff564074b89419c4b5 Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Wed, 22 Apr 2026 00:37:32 -0400
Subject: [PATCH 052/596] build: Add `cls_timeindex_types` to `cls_timeindex`
 objclass

`cls_timeindex_entry` defines `encode()` and `decode()` inline in
`cls_timeindex_types.h`, but `dump()` and `generate_test_instances()` are
defined out of line in `cls_timeindex_types.cc`. That `.cc` was compiled
only into `cls_timeindex_client`, not into the `cls_timeindex objclass`
shared library. At `-O2` the optimizer inlines and dead-code-eliminates
these unused `dump()` paths, so `cls_timeindex.so` ends up with no
reference to the out-of-line symbols and loads fine. At `-O0` nothing is
inlined or eliminated: the header-inline `dump()` is emitted and leaves
an undefined reference to `cls_timeindex_entry::dump()` in
`cls_timeindex.so`, so `dlopen()` of the objclass fails at load time.

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/cls/CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cls/CMakeLists.txt b/src/cls/CMakeLists.txt
index ad5c71c51b6..cfcc2f86790 100644
--- a/src/cls/CMakeLists.txt
+++ b/src/cls/CMakeLists.txt
@@ -147,7 +147,7 @@ add_library(cls_log_client STATIC ${cls_log_client_srcs})
 
 
 # cls_timeindex
-set(cls_timeindex_srcs timeindex/cls_timeindex.cc)
+set(cls_timeindex_srcs timeindex/cls_timeindex.cc timeindex/cls_timeindex_types.cc)
 add_library(cls_timeindex SHARED ${cls_timeindex_srcs})
 set_target_properties(cls_timeindex PROPERTIES
   VERSION "1.0.0"

From 43a62944af86377a1e2143e3139087cb41ff4365 Mon Sep 17 00:00:00 2001
From: Kobi Ginon <kginon@redhat.com>
Date: Sat, 2 May 2026 16:14:48 +0300
Subject: [PATCH 053/596] cephadm: list-networks opt-in loopback and BGP route
 supplements

Fixes: https://tracker.ceph.com/issues/62195
Extend cephadm list-networks (and the cephadm mgr module options that pass
flags through to it) so hosts can expose loopback and BGP-derived routes
when operators need them, while keeping the default conservative for
orchestrator network discovery.

- Add cephadm flags --allow-lo-routes and --allow-bgp-routes (after the
  list-networks subcommand). Wire mgr options allow_lo_routes and
  allow_bgp_routes to the remote cephadm invocation.

- IPv4: build from ``ip route ls`` (scope link + src). When allow_lo_routes
  is true, merge extra lines from the same output via _parse_ipv4_lo_route
  (lo /32 without src, host-scoped routes including dummy-style /32 from
  76229). Always omit prefixes wholly inside 127.0.0.0/8. When
  allow_lo_routes is false, skip any route whose device is lo at parse time.
  When allow_bgp_routes is true, merge ``ip route ls proto bgp`` (ECMP
  nexthops and lo BGP /32), again respecting allow_lo_routes for lo.

- IPv6: build from ``ip -6 route ls`` and ``ip -6 addr ls``; omit ::1/128.
  When allow_lo_routes is false, skip routes on lo (including global /128 on
  lo). When allow_bgp_routes is true, merge ``ip -6 route ls proto bgp`` in
  the same way as IPv4, including lo BGP /128 when allow_lo_routes is true.

Signed-off-by: Kobi Ginon <kginon@redhat.com>
---
 src/cephadm/cephadm.py                       |  12 +
 src/cephadm/cephadmlib/host_facts.py         | 292 ++++++++++++++--
 src/cephadm/tests/test_networks.py           |  50 ++-
 src/cephadm/tests/test_networks_lo_routes.py | 349 +++++++++++++++++++
 src/pybind/mgr/cephadm/module.py             |  19 +
 src/pybind/mgr/cephadm/serve.py              |  13 +-
 6 files changed, 706 insertions(+), 29 deletions(-)
 create mode 100644 src/cephadm/tests/test_networks_lo_routes.py

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 626ceb54d54..b3133088961 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -5019,6 +5019,18 @@ def _get_parser():
 
     parser_list_networks = subparsers.add_parser(
         'list-networks', help='list IP networks')
+    parser_list_networks.add_argument(
+        '--allow-lo-routes',
+        action='store_true',
+        default=False,
+        help='Reserved for future filtering of loopback-related routes',
+    )
+    parser_list_networks.add_argument(
+        '--allow-bgp-routes',
+        action='store_true',
+        default=False,
+        help='Reserved for future filtering of BGP-derived routes',
+    )
     parser_list_networks.set_defaults(func=command_list_networks)
 
     parser_list_rdma = subparsers.add_parser(
diff --git a/src/cephadm/cephadmlib/host_facts.py b/src/cephadm/cephadmlib/host_facts.py
index ec85430d2aa..c4acd4a6b69 100644
--- a/src/cephadm/cephadmlib/host_facts.py
+++ b/src/cephadm/cephadmlib/host_facts.py
@@ -849,14 +849,18 @@ class HostFacts:
 def list_networks(ctx):
     # type: (CephadmContext) -> Dict[str,Dict[str, Set[str]]]
 
-    # sadly, 18.04's iproute2 4.15.0-2ubun doesn't support the -j flag,
-    # so we'll need to use a regex to parse 'ip' command output.
-    #
-    # out, _, _ = call_throws(['ip', '-j', 'route', 'ls'])
-    # j = json.loads(out)
-    # for x in j:
-    res = _list_ipv4_networks(ctx)
-    res.update(_list_ipv6_networks(ctx))
+    # Main route tables use text ``ip route ls`` (regex parsers). BGP supplements
+    # use ``ip -j route ls proto bgp`` on supported platforms (iproute2 >= 4.18).
+    allow_lo = getattr(ctx, 'allow_lo_routes', False)
+    allow_bgp = getattr(ctx, 'allow_bgp_routes', False)
+    res = _list_ipv4_networks(
+        ctx, allow_lo_routes=allow_lo, allow_bgp_routes=allow_bgp
+    )
+    res.update(
+        _list_ipv6_networks(
+            ctx, allow_lo_routes=allow_lo, allow_bgp_routes=allow_bgp
+        )
+    )
     return res
 
 
@@ -905,21 +909,50 @@ def list_rdma(ctx: CephadmContext) -> List[Dict[str, str]]:
     return result
 
 
-def _list_ipv4_networks(
-    ctx: CephadmContext,
-) -> Dict[str, Dict[str, Set[str]]]:
-    execstr: Optional[str] = find_executable('ip')
-    if not execstr:
-        raise FileNotFoundError("unable to find 'ip' command")
-    out, _, _ = call_throws(
-        ctx,
-        [execstr, 'route', 'ls'],
-        verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
+_IPV4_LOOPBACK_SPACE = ipaddress.ip_network('127.0.0.0/8')
+_IPV6_LOOPBACK_HOST = ipaddress.ip_network('::1/128')
+
+
+def _is_ipv4_loopback(net_s: str) -> bool:
+    """True if *net_s* is an IPv4 prefix wholly within host loopback 127.0.0.0/8."""
+    try:
+        n = ipaddress.ip_network(net_s, strict=False)
+    except ValueError:
+        return False
+    return (
+        n.version == 4
+        and n.network_address in _IPV4_LOOPBACK_SPACE
+        and n.broadcast_address in _IPV4_LOOPBACK_SPACE
     )
-    return _parse_ipv4_route(out)
 
 
-def _parse_ipv4_route(out: str) -> Dict[str, Dict[str, Set[str]]]:
+def _is_ipv6_loopback(net_s: str) -> bool:
+    """True if *net_s* is exactly the host loopback prefix ::1/128."""
+    try:
+        n = ipaddress.ip_network(net_s, strict=False)
+    except ValueError:
+        return False
+    if n.version != 6:
+        return False
+    return n == _IPV6_LOOPBACK_HOST
+
+
+def _merge_ipv4_network_dicts(
+    dst: Dict[str, Dict[str, Set[str]]], add: Dict[str, Dict[str, Set[str]]]
+) -> None:
+    """Merge *add* into *dst* (nested sets)."""
+    for net, ifaces in add.items():
+        if net not in dst:
+            dst[net] = {}
+        for iface, ips in ifaces.items():
+            if iface not in dst[net]:
+                dst[net][iface] = set()
+            dst[net][iface].update(ips)
+
+
+def _parse_ipv4_route(
+    out: str, allow_lo_routes: bool = False
+) -> Dict[str, Dict[str, Set[str]]]:
     r = {}  # type: Dict[str, Dict[str, Set[str]]]
     p = re.compile(
         r'^(\S+) (?:via \S+)? ?dev (\S+) (.*)scope link (.*)src (\S+)'
@@ -931,8 +964,13 @@ def _parse_ipv4_route(out: str) -> Dict[str, Dict[str, Set[str]]]:
         net = m[0][0]
         if '/' not in net:  # aggregate /32 mask for single host sub-networks
             net += '/32'
-        iface = m[0][1]
+        # Strip iproute2 ``@`` suffix (e.g. ``brx.0@eno1`` → ``brx.0``).
+        iface = m[0][1].split('@')[0]
+        if iface == 'lo' and not allow_lo_routes:
+            continue
         ip = m[0][4]
+        if _is_ipv4_loopback(net):
+            continue
         if net not in r:
             r[net] = {}
         if iface not in r[net]:
@@ -941,9 +979,199 @@ def _parse_ipv4_route(out: str) -> Dict[str, Dict[str, Set[str]]]:
     return r
 
 
+def _parse_ipv4_lo_route(out: str) -> Dict[str, Dict[str, Set[str]]]:
+    """``lo`` /32 without ``src``, and ``scope host`` + ``src`` (e.g. dummy /32)."""
+    r = {}  # type: Dict[str, Dict[str, Set[str]]]
+    p_lo_no_src = re.compile(
+        r'^(\S+) (?:via \S+)? ?dev (lo(?:@\S+)?) (.*)scope (?:link|host)\s*(?!src\b).*$'
+    )
+    p_host_src = re.compile(
+        r'^(\S+) (?:via \S+)? ?dev (\S+) (.*)scope host (.*)src (\S+)'
+    )
+
+    def put(net: str, iface: str, ip: str) -> None:
+        if _is_ipv4_loopback(net):
+            return
+        if net not in r:
+            r[net] = {}
+        if iface not in r[net]:
+            r[net][iface] = set()
+        r[net][iface].add(ip)
+
+    for line in out.splitlines():
+        m = p_lo_no_src.findall(line)
+        if not m:
+            continue
+        net = m[0][0]
+        if '/' not in net:
+            net += '/32'
+        iface = m[0][1].split('@')[0]
+        try:
+            n = ipaddress.ip_network(net, strict=False)
+        except ValueError:
+            continue
+        if n.prefixlen != 32:
+            continue
+        put(net, iface, str(n.network_address))
+
+    for line in out.splitlines():
+        m = p_host_src.findall(line)
+        if not m:
+            continue
+        net = m[0][0]
+        if '/' not in net:
+            net += '/32'
+        iface = m[0][1].split('@')[0]
+        ip = m[0][4]
+        put(net, iface, ip)
+
+    return r
+
+
+def _route_iface_name(dev: str) -> str:
+    """Strip iproute2 ``child@parent`` interface suffix."""
+    return dev.split('@')[0]
+
+
+def _route_dst_to_network(dst: str, version: int) -> str:
+    if '/' in dst:
+        return dst
+    return f'{dst}/{"32" if version == 4 else "128"}'
+
+
+def _parse_bgp_routes_json(
+    out: str,
+    version: int,
+    allow_lo_routes: bool = False,
+) -> Dict[str, Dict[str, Set[str]]]:
+    """Parse JSON from ``ip -j route ls proto bgp`` (or ``ip -6 -j route ls proto bgp``)."""
+    r: Dict[str, Dict[str, Set[str]]] = {}
+    try:
+        routes = json.loads(out)
+    except (json.JSONDecodeError, TypeError):
+        logger.debug('failed to parse ip -j route output as JSON')
+        return r
+    if not isinstance(routes, list):
+        return r
+
+    is_v4 = version == 4
+    host_plen = 32 if is_v4 else 128
+
+    def put(net: str, iface: str, ip: str) -> None:
+        if _is_ipv4_loopback(net) if is_v4 else _is_ipv6_loopback(net):
+            return
+        if net not in r:
+            r[net] = {}
+        if iface not in r[net]:
+            r[net][iface] = set()
+        r[net][iface].add(ip)
+
+    for route in routes:
+        if not isinstance(route, dict):
+            continue
+        dst = route.get('dst')
+        if not dst:
+            continue
+
+        net = _route_dst_to_network(dst, version)
+        nexthops = route.get('nexthops')
+        prefsrc = route.get('prefsrc')
+
+        if nexthops and prefsrc:
+            for nh in nexthops:
+                if not isinstance(nh, dict):
+                    continue
+                dev = nh.get('dev')
+                if not dev:
+                    continue
+                iface = _route_iface_name(dev)
+                if iface == 'lo' and not allow_lo_routes:
+                    continue
+                put(net, iface, prefsrc)
+            continue
+
+        dev = route.get('dev', '')
+        iface = _route_iface_name(dev) if dev else ''
+
+        if iface == 'lo' and not prefsrc:
+            if not allow_lo_routes:
+                continue
+            try:
+                n = ipaddress.ip_network(net, strict=False)
+            except ValueError:
+                continue
+            if n.prefixlen != host_plen:
+                continue
+            put(net, 'lo', str(n.network_address))
+            continue
+
+        if prefsrc and iface:
+            if iface == 'lo' and not allow_lo_routes:
+                continue
+            put(net, iface, prefsrc)
+
+    return r
+
+
+def _parse_ipv4_bgp_route(
+    out: str, allow_lo_routes: bool = False
+) -> Dict[str, Dict[str, Set[str]]]:
+    """Parse JSON from ``ip -j route ls proto bgp``."""
+    return _parse_bgp_routes_json(out, 4, allow_lo_routes)
+
+
+def _parse_ipv6_bgp_route(
+    out: str, allow_lo_routes: bool = False
+) -> Dict[str, Dict[str, Set[str]]]:
+    """Parse JSON from ``ip -6 -j route ls proto bgp``."""
+    return _parse_bgp_routes_json(out, 6, allow_lo_routes)
+
+
+def _list_ipv4_networks(
+    ctx: CephadmContext,
+    allow_lo_routes: bool = False,
+    allow_bgp_routes: bool = False,
+) -> Dict[str, Dict[str, Set[str]]]:
+    """IPv4 networks from ``ip route ls`` (and optional ``proto bgp`` supplement).
+
+    When *allow_lo_routes* is false, routes on ``lo`` are ignored by the parsers.
+    When true, ``_parse_ipv4_lo_route`` supplements the base table.
+    """
+    execstr: Optional[str] = find_executable('ip')
+    if not execstr:
+        raise FileNotFoundError("unable to find 'ip' command")
+    out, _, _ = call_throws(
+        ctx,
+        [execstr, 'route', 'ls'],
+        verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
+    )
+    res = _parse_ipv4_route(out, allow_lo_routes)
+    if allow_lo_routes:
+        _merge_ipv4_network_dicts(res, _parse_ipv4_lo_route(out))
+    if allow_bgp_routes:
+        bgp_out, _, _ = call_throws(
+            ctx,
+            [execstr, '-j', 'route', 'ls', 'proto', 'bgp'],
+            verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
+        )
+        _merge_ipv4_network_dicts(
+            res, _parse_ipv4_bgp_route(bgp_out, allow_lo_routes)
+        )
+    return res
+
+
 def _list_ipv6_networks(
     ctx: CephadmContext,
+    allow_lo_routes: bool = False,
+    allow_bgp_routes: bool = False,
 ) -> Dict[str, Dict[str, Set[str]]]:
+    """IPv6 networks from ``ip -6 route`` and ``ip -6 addr``.
+
+    When *allow_lo_routes* is false, routes on ``lo`` are ignored so loopback globals
+    are not listed. When *allow_bgp_routes* is true, ``ip -6 route ls proto bgp``
+    is merged into the same shape as the main table (respecting *allow_lo_routes*
+    for ``lo`` BGP paths).
+    """
     execstr: Optional[str] = find_executable('ip')
     if not execstr:
         raise FileNotFoundError("unable to find 'ip' command")
@@ -957,11 +1185,23 @@ def _list_ipv6_networks(
         [execstr, '-6', 'addr', 'ls'],
         verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
     )
-    return _parse_ipv6_route(routes, ips)
+    res = _parse_ipv6_route(routes, ips, allow_lo_routes)
+    if allow_bgp_routes:
+        bgp_out, _, _ = call_throws(
+            ctx,
+            [execstr, '-6', '-j', 'route', 'ls', 'proto', 'bgp'],
+            verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
+        )
+        _merge_ipv4_network_dicts(
+            res, _parse_ipv6_bgp_route(bgp_out, allow_lo_routes)
+        )
+    return res
 
 
 def _parse_ipv6_route(
-    routes: str, ips: str
+    routes: str,
+    ips: str,
+    allow_lo_routes: bool = False,
 ) -> Dict[str, Dict[str, Set[str]]]:
     r = {}  # type: Dict[str, Dict[str, Set[str]]]
     route_p = re.compile(
@@ -976,8 +1216,10 @@ def _parse_ipv6_route(
         net = m[0][0]
         if '/' not in net:  # aggregate /128 mask for single host sub-networks
             net += '/128'
-        iface = m[0][1]
-        if iface == 'lo':  # skip loopback devices
+        iface = m[0][1].split('@')[0]
+        if iface == 'lo' and not allow_lo_routes:
+            continue
+        if _is_ipv6_loopback(net):
             continue
         if net not in r:
             r[net] = {}
diff --git a/src/cephadm/tests/test_networks.py b/src/cephadm/tests/test_networks.py
index 5cc5fd00dc8..f854dfab1fb 100644
--- a/src/cephadm/tests/test_networks.py
+++ b/src/cephadm/tests/test_networks.py
@@ -48,6 +48,8 @@ class TestEndPoint:
 
 
 class TestCommandListNetworks:
+    # fmt: off
+    # Keep table-style parametrization unchanged for reviewable diffs (see PR discussion).
     @pytest.mark.parametrize("test_input, expected", [
         (
             dedent("""
@@ -106,9 +108,11 @@ class TestCommandListNetworks:
             }
         ),
     ])
+    # fmt: on
     def test_parse_ipv4_route(self, test_input, expected):
         assert _parse_ipv4_route(test_input) == expected
 
+    # fmt: off
     @pytest.mark.parametrize("test_routes, test_ips, expected", [
         (
             dedent("""
@@ -236,7 +240,8 @@ class TestCommandListNetworks:
             ::1 dev lo proto kernel metric 256 pref medium
             fe80::/64 dev ceph-brx proto kernel metric 256 pref medium
             fe80::/64 dev brx.0 proto kernel metric 256 pref medium
-            default via fe80::327c:5e00:6487:71e0 dev enp3s0f1 proto ra metric 1024 expires 1790sec hoplimit 64 pref medium            """),
+            default via fe80::327c:5e00:6487:71e0 dev enp3s0f1 proto ra metric 1024 expires 1790sec hoplimit 64 pref medium
+            """),
             dedent("""
             1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
                 inet6 ::1/128 scope host
@@ -259,9 +264,38 @@ class TestCommandListNetworks:
             }
         ),
     ])
+    # fmt: on
     def test_parse_ipv6_route(self, test_routes, test_ips, expected):
         assert _parse_ipv6_route(test_routes, test_ips) == expected
 
+    def test_parse_ipv6_route_includes_lo_global_not_slaac(self):
+        test_routes = dedent(
+            """
+        ::1 dev lo proto kernel metric 256 pref medium
+        2620:52:0:1304::71 dev lo proto kernel metric 256 pref medium
+        """
+        )
+        test_ips = dedent(
+            """
+        1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
+            inet6 ::1/128 scope host
+               valid_lft forever preferred_lft forever
+            inet6 2620:52:0:1304::71/128 scope global
+               valid_lft forever preferred_lft forever
+        """
+        )
+        expected = {
+            '2620:52:0:1304::71/128': {'lo': {'2620:52:0:1304::71'}},
+        }
+        assert (
+            _parse_ipv6_route(test_routes, test_ips, allow_lo_routes=False)
+            == {}
+        )
+        assert (
+            _parse_ipv6_route(test_routes, test_ips, allow_lo_routes=True)
+            == expected
+        )
+
     @mock.patch('cephadmlib.net_utils.read_file')
     def test_get_ipv6_addr(self, _read_file):
         proc_net_if_net6 = """fe80000000000000505400fffe347999 02 40 20 80     eth0
@@ -277,8 +311,18 @@ fe80000000000000505400fffe04c154 03 40 20 80     eth1
 
     @mock.patch('cephadmlib.host_facts.call_throws')
     @mock.patch('cephadmlib.host_facts.find_executable')
-    def test_command_list_networks(self, _find_exe, _call_throws, cephadm_fs, capsys):
-        _call_throws.return_value = ('10.4.0.1 dev tun0 proto kernel scope link src 10.4.0.2 metric 50\n', '', '')
+    def test_command_list_networks(
+        self, _find_exe, _call_throws, cephadm_fs, capsys
+    ):
+        _call_throws.side_effect = [
+            (
+                '10.4.0.1 dev tun0 proto kernel scope link src 10.4.0.2 metric 50\n',
+                '',
+                '',
+            ),
+            ('', '', ''),
+            ('', '', ''),
+        ]
         _find_exe.return_value = 'ip'
         with with_cephadm_ctx([]) as ctx:
             _cephadm.command_list_networks(ctx)
diff --git a/src/cephadm/tests/test_networks_lo_routes.py b/src/cephadm/tests/test_networks_lo_routes.py
new file mode 100644
index 00000000000..4e02c972e35
--- /dev/null
+++ b/src/cephadm/tests/test_networks_lo_routes.py
@@ -0,0 +1,349 @@
+import json
+from textwrap import dedent
+
+from cephadmlib.host_facts import (
+    _merge_ipv4_network_dicts,
+    _parse_ipv4_bgp_route,
+    _parse_ipv4_lo_route,
+    _parse_ipv4_route,
+    _parse_ipv6_bgp_route,
+)
+
+
+def _merged_ipv4(out: str, *, allow_lo: bool = False):
+    r = _parse_ipv4_route(out, allow_lo)
+    if allow_lo:
+        _merge_ipv4_network_dicts(r, _parse_ipv4_lo_route(out))
+    return r
+
+
+class TestLoopbackRouteParsing:
+    def test_parse_ipv4_route_omits_127_on_lo(self):
+        test_input = dedent(
+            """
+            192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1
+            127.0.0.0/8 dev lo proto kernel scope link src 127.0.0.1
+            """
+        )
+        expected = {'192.168.1.0/24': {'eth0': {'192.168.1.1'}}}
+        assert _parse_ipv4_route(test_input) == expected
+
+    def test_parse_ipv4_route_includes_non_loopback_on_lo(self):
+        test_input = dedent(
+            """
+            192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.1
+            10.168.100.0/24 dev lo proto kernel scope link src 10.168.100.10
+            """
+        )
+        expected_with_lo = {
+            '192.168.1.0/24': {'eth0': {'192.168.1.1'}},
+            '10.168.100.0/24': {'lo': {'10.168.100.10'}},
+        }
+        assert _parse_ipv4_route(test_input) == {'192.168.1.0/24': {'eth0': {'192.168.1.1'}}}
+        assert _parse_ipv4_route(test_input, allow_lo_routes=True) == expected_with_lo
+
+    def test_parse_ipv4_lo_route_adds_lo_host_route_without_src(self):
+        # ``ip route add …/32 dev lo proto bgp`` prints no ``src`` line.
+        test_input = dedent(
+            """
+            192.168.100.0/24 dev ens3 proto kernel scope link src 192.168.100.100
+            10.168.100.10 dev lo proto bgp scope link
+            """
+        )
+        expected = {
+            '192.168.100.0/24': {'ens3': {'192.168.100.100'}},
+            '10.168.100.10/32': {'lo': {'10.168.100.10'}},
+        }
+        assert _merged_ipv4(test_input, allow_lo=True) == expected
+
+    def test_parse_ipv4_lo_route_scope_host_on_lo(self):
+        test_input = dedent(
+            """
+            192.168.100.0/24 dev ens3 proto kernel scope link src 192.168.100.100
+            10.10.10.90 dev lo proto kernel scope host
+            """
+        )
+        assert _parse_ipv4_route(test_input) == {
+            '192.168.100.0/24': {'ens3': {'192.168.100.100'}},
+        }
+        assert _merged_ipv4(test_input, allow_lo=True) == {
+            '192.168.100.0/24': {'ens3': {'192.168.100.100'}},
+            '10.10.10.90/32': {'lo': {'10.10.10.90'}},
+        }
+
+    def test_parse_ipv4_lo_route_bgp_scope_host_on_lo(self):
+        test_input = dedent(
+            """
+            10.10.10.10 dev lo proto bgp scope host
+            """
+        )
+        assert _parse_ipv4_route(test_input) == {}
+        assert _parse_ipv4_lo_route(test_input) == {
+            '10.10.10.10/32': {'lo': {'10.10.10.10'}},
+        }
+
+    def test_parse_ipv4_lo_route_dummy_scope_host(self):
+        # Host-scoped /32 on dummy (tracker.ceph.com/issues/76229).
+        test_input = dedent(
+            """
+            192.168.100.0/24 dev ens3 proto kernel scope link src 192.168.100.100
+            10.1.0.40 dev dummy0 proto kernel scope host src 10.1.0.40
+            """
+        )
+        expected = {
+            '192.168.100.0/24': {'ens3': {'192.168.100.100'}},
+            '10.1.0.40/32': {'dummy0': {'10.1.0.40'}},
+        }
+        assert _merged_ipv4(test_input, allow_lo=True) == expected
+
+    def test_parse_ipv4_bgp_route_ecmp_nexthops(self):
+        # From ``ip -j route ls proto bgp`` on a BGP host (ceph-node-0).
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': '192.168.100.5',
+                    'protocol': 'bgp',
+                    'prefsrc': '192.168.100.11',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+                {
+                    'dst': '192.168.100.6',
+                    'protocol': 'bgp',
+                    'prefsrc': '192.168.100.11',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+                {
+                    'dst': '10.0.1.11',
+                    'protocol': 'bgp',
+                    'prefsrc': '10.0.1.11',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+            ]
+        )
+        expected = {
+            '192.168.100.5/32': {
+                'ens1f0np0': {'192.168.100.11'},
+                'ens1f1np1': {'192.168.100.11'},
+            },
+            '192.168.100.6/32': {
+                'ens1f0np0': {'192.168.100.11'},
+                'ens1f1np1': {'192.168.100.11'},
+            },
+            '10.0.1.11/32': {
+                'ens1f0np0': {'10.0.1.11'},
+                'ens1f1np1': {'10.0.1.11'},
+            },
+        }
+        assert _parse_ipv4_bgp_route(bgp_input) == expected
+
+    def test_parse_ipv4_bgp_route_ecmp_without_protocol_field(self):
+        # ``ip -j route ls proto bgp`` may omit ``protocol`` on filtered output.
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': '192.168.100.5',
+                    'prefsrc': '192.168.100.11',
+                    'metric': 20,
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+                {
+                    'dst': '192.168.100.6',
+                    'prefsrc': '192.168.100.11',
+                    'metric': 20,
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+            ]
+        )
+        expected = {
+            '192.168.100.5/32': {
+                'ens1f0np0': {'192.168.100.11'},
+                'ens1f1np1': {'192.168.100.11'},
+            },
+            '192.168.100.6/32': {
+                'ens1f0np0': {'192.168.100.11'},
+                'ens1f1np1': {'192.168.100.11'},
+            },
+        }
+        assert _parse_ipv4_bgp_route(bgp_input) == expected
+
+    def test_parse_ipv4_bgp_route_lo_without_src(self):
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': '10.168.100.10',
+                    'dev': 'lo',
+                    'protocol': 'bgp',
+                    'scope': 'link',
+                    'flags': [],
+                }
+            ]
+        )
+        assert _parse_ipv4_bgp_route(bgp_input) == {}
+        assert _parse_ipv4_bgp_route(bgp_input, allow_lo_routes=True) == {
+            '10.168.100.10/32': {'lo': {'10.168.100.10'}},
+        }
+
+    def test_parse_ipv4_bgp_route_lo_from_full_table(self):
+        # ``ip -j route ls`` entry for ``10.10.10.10 dev lo proto bgp``.
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': '10.10.10.10',
+                    'dev': 'lo',
+                    'protocol': 'bgp',
+                    'scope': 'link',
+                    'flags': [],
+                }
+            ]
+        )
+        assert _parse_ipv4_bgp_route(bgp_input, allow_lo_routes=True) == {
+            '10.10.10.10/32': {'lo': {'10.10.10.10'}},
+        }
+
+    def test_parse_ipv6_bgp_route_ecmp_nexthops(self):
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': '2001:db8:100::5',
+                    'protocol': 'bgp',
+                    'prefsrc': '2001:db8:100::11',
+                    'metric': 20,
+                    'pref': 'medium',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': 'fe80::1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': [],
+                        },
+                        {
+                            'gateway': 'fe80::2',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': [],
+                        },
+                    ],
+                },
+                {
+                    'dst': '2001:db8:200::1:11',
+                    'protocol': 'bgp',
+                    'prefsrc': '2001:db8:200::1:11',
+                    'metric': 20,
+                    'pref': 'medium',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': 'fe80::a',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': [],
+                        },
+                        {
+                            'gateway': 'fe80::b',
+                            'dev': 'ens1f1np1',
+                            'weight': 1,
+                            'flags': [],
+                        },
+                    ],
+                },
+            ]
+        )
+        expected = {
+            '2001:db8:100::5/128': {
+                'ens1f0np0': {'2001:db8:100::11'},
+                'ens1f1np1': {'2001:db8:100::11'},
+            },
+            '2001:db8:200::1:11/128': {
+                'ens1f0np0': {'2001:db8:200::1:11'},
+                'ens1f1np1': {'2001:db8:200::1:11'},
+            },
+        }
+        assert _parse_ipv6_bgp_route(bgp_input) == expected
+
+    def test_parse_ipv6_bgp_route_lo_without_src(self):
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': '2001:db8:bad:10::10',
+                    'dev': 'lo',
+                    'protocol': 'bgp',
+                    'scope': 'link',
+                    'flags': [],
+                }
+            ]
+        )
+        assert _parse_ipv6_bgp_route(bgp_input) == {}
+        assert _parse_ipv6_bgp_route(bgp_input, allow_lo_routes=True) == {
+            '2001:db8:bad:10::10/128': {'lo': {'2001:db8:bad:10::10'}},
+        }
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 0e47dcd8018..7dfb72381f1 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -199,6 +199,23 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             default=1 * 60,
             desc='Seconds for which to cache host facts data',
         ),
+        Option(
+            'allow_lo_routes',
+            type='bool',
+            default=False,
+            desc='If true, cephadm list-networks is run with --allow-lo-routes so '
+            'loopback (lo) routes are included in host network facts; if false, '
+            'they are omitted (default).',
+        ),
+        Option(
+            'allow_bgp_routes',
+            type='bool',
+            default=False,
+            desc='If true, cephadm list-networks is run with --allow-bgp-routes so '
+            'BGP routes from ``ip route ls proto bgp`` and '
+            '``ip -6 route ls proto bgp`` are merged into host network facts; if '
+            'false (default), only the main IPv4 and IPv6 tables are used.',
+        ),
         Option(
             'host_check_interval',
             type='secs',
@@ -543,6 +560,8 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             self.device_cache_timeout = 0
             self.daemon_cache_timeout = 0
             self.facts_cache_timeout = 0
+            self.allow_lo_routes = False
+            self.allow_bgp_routes = False
             self.host_check_interval = 0
             self.stray_daemon_check_interval = 0
             self.max_count_per_host = 0
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 1f1b5c2fd6f..c37ea6f271d 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -438,9 +438,20 @@ class CephadmServe:
 
     def _refresh_host_networks(self, host: str) -> Optional[str]:
         try:
+            list_net_args: List[str] = []
+            if self.mgr.allow_lo_routes:
+                list_net_args.append('--allow-lo-routes')
+            if self.mgr.allow_bgp_routes:
+                list_net_args.append('--allow-bgp-routes')
             with self.mgr.async_timeout_handler(host, 'cephadm list-networks'):
                 networks = self.mgr.wait_async(self._run_cephadm_json(
-                    host, 'mon', 'list-networks', [], no_fsid=True, log_output=self.mgr.log_refresh_metadata))
+                    host,
+                    'mon',
+                    'list-networks',
+                    list_net_args,
+                    no_fsid=True,
+                    log_output=self.mgr.log_refresh_metadata,
+                ))
         except OrchestratorError as e:
             return str(e)
 

From a9ba39df2a41e999d1cf15597df632beedc7b2f5 Mon Sep 17 00:00:00 2001
From: Nathan Hoad <nhoad@bloomberg.net>
Date: Mon, 18 May 2026 15:23:53 -0400
Subject: [PATCH 054/596] common: Fix the default for rgw_gc_max_queue_size,
 per review.

This should be 1KB short of the maximum, not 3MB over.

Signed-off-by: Nathan Hoad <nhoad@bloomberg.net>
---
 src/common/options/rgw.yaml.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index b52d85d758a..fd3759e3fc8 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -1968,7 +1968,7 @@ options:
   desc: Maximum allowed queue size for gc
   long_desc: The maximum allowed size of each gc queue, and its value should not be
     greater than osd_max_object_size - 1K.
-  default: 134068_K
+  default: 131071_K
   services:
   - rgw
   see_also:

From ac6dd5571eaf5e2bb77d3e7af41448348100c8e4 Mon Sep 17 00:00:00 2001
From: Jaya Prakash <jayaprakash@ibm.com>
Date: Tue, 19 May 2026 17:02:22 +0000
Subject: [PATCH 055/596] qa: fix TEST_mon_features persistent feature checks
 in mon/misc.sh

The test reused the "tentacle" jq filter while validating
"nvmeof_beacon_diff", causing the comparison to fail. Also fix
the umbrella feature validation and update the expected
persistent feature count.

Fixes: https://tracker.ceph.com/issues/76472

Signed-off-by: Jaya Prakash <jayaprakash@ibm.com>
---
 qa/standalone/mon/misc.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/qa/standalone/mon/misc.sh b/qa/standalone/mon/misc.sh
index f136db0eb78..e5d3e409348 100755
--- a/qa/standalone/mon/misc.sh
+++ b/qa/standalone/mon/misc.sh
@@ -285,10 +285,11 @@ function TEST_mon_features() {
     jq_success "$jqinput" "$jqfilter" "squid" || return 1
     jqfilter='.monmap.features.persistent[]|select(. == "tentacle")'
     jq_success "$jqinput" "$jqfilter" "tentacle" || return 1
+    jqfilter='.monmap.features.persistent[]|select(. == "nvmeof_beacon_diff")'
     jq_success "$jqinput" "$jqfilter" "nvmeof_beacon_diff" || return 1
     jqfilter='.monmap.features.persistent[]|select(. == "umbrella")'
-    jq_success "$jqinput" "$jqfilter" "tentacle" || return 1
-    jqfilter='.monmap.features.persistent | length == 13'
+    jq_success "$jqinput" "$jqfilter" "umbrella" || return 1
+    jqfilter='.monmap.features.persistent | length == 14'
     jq_success "$jqinput" "$jqfilter" || return 1
 
     CEPH_ARGS=$CEPH_ARGS_orig

From b066d4cd3a3c7821f93bb7cc5390b97a19e22e94 Mon Sep 17 00:00:00 2001
From: Neeraj Pratap Singh <Neeraj.Pratap.Singh1@ibm.com>
Date: Wed, 20 May 2026 22:53:09 +0530
Subject: [PATCH 056/596] qa: fixing failures in TestShellOpts

We were seeing failures in TestShellOpts again
and again due the (newline added within the output)
output structure change with the cmd2 releases.
Now, we directly extract the final output of 'set editor'
command and use it, instead of traversing on complete output
through hardcoded indexes.This fix is better than earlier
hardcoded splitting/striping via indexes.

Fixes: https://tracker.ceph.com/issues/71795
Signed-off-by: Neeraj Pratap Singh <Neeraj.Pratap.Singh1@ibm.com>
---
 qa/tasks/cephfs/test_cephfs_shell.py | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/qa/tasks/cephfs/test_cephfs_shell.py b/qa/tasks/cephfs/test_cephfs_shell.py
index 0864c1e5a79..0cc4dab7760 100644
--- a/qa/tasks/cephfs/test_cephfs_shell.py
+++ b/qa/tasks/cephfs/test_cephfs_shell.py
@@ -1109,6 +1109,17 @@ class TestShellOpts(TestCephFSShell):
     Contains tests for shell options from conf file and shell prompt.
     """
 
+    def extract_set_editor_output(self, out):
+        res = None
+        for line in out.splitlines():
+            line_parts = line.split()
+            if len(line_parts) > 4 and line_parts[0] == "editor":
+                res = line_parts
+                break
+
+        self.assertIsNotNone(res, f"didn't find editor output in: {out}")
+        return res[1]
+
     def setUp(self):
         super(type(self), self).setUp()
 
@@ -1119,9 +1130,8 @@ class TestShellOpts(TestCephFSShell):
         # ====================================================================================================
         # editor  ?                               Program used by 'edit'
         self.editor_val = self.get_cephfs_shell_cmd_output(
-            'set editor ?, set editor').split('\n')[4]
-        self.editor_val = self.editor_val.split()[1].strip(). \
-            replace("'", "", 2)
+            'set editor ?, set editor')
+        self.editor_val = self.extract_set_editor_output(self.editor_val)
 
     def write_tempconf(self, confcontents):
         self.tempconfpath = self.mount_a.client_remote.mktemp(
@@ -1139,9 +1149,7 @@ class TestShellOpts(TestCephFSShell):
         # editor  ???                             Program used by 'edit'
         final_editor_val = self.get_cephfs_shell_cmd_output(
             cmd='set editor', shell_conf_path=self.tempconfpath)
-        final_editor_val = final_editor_val.split('\n')[2]
-        final_editor_val = final_editor_val.split()[1].strip(). \
-            replace("'", "", 2)
+        final_editor_val = self.extract_set_editor_output(final_editor_val)
 
         self.assertNotEqual(self.editor_val, final_editor_val)
 
@@ -1159,9 +1167,7 @@ class TestShellOpts(TestCephFSShell):
         # editor  ?                               Program used by 'edit'
         final_editor_val = self.get_cephfs_shell_cmd_output(
             cmd='set editor', shell_conf_path=self.tempconfpath)
-        final_editor_val = final_editor_val.split('\n')[2]
-        final_editor_val = final_editor_val.split()[1].strip(). \
-            replace("'", "", 2)
+        final_editor_val = self.extract_set_editor_output(final_editor_val)
 
         self.assertEqual(self.editor_val, final_editor_val)
 
@@ -1177,8 +1183,6 @@ class TestShellOpts(TestCephFSShell):
         final_editor_val = self.get_cephfs_shell_cmd_output(
             cmd='set editor %s, set editor' % self.editor_val,
             shell_conf_path=self.tempconfpath)
-        final_editor_val = final_editor_val.split('\n')[4]
-        final_editor_val = final_editor_val.split()[1].strip(). \
-            replace("'", "", 2)
+        final_editor_val = self.extract_set_editor_output(final_editor_val)
 
         self.assertEqual(self.editor_val, final_editor_val)

From 8e32fff1734c9594c95474359c765baa6a7b3631 Mon Sep 17 00:00:00 2001
From: Leonid Chernin <leonidc@il.ibm.com>
Date: Fri, 10 Apr 2026 11:15:20 +0300
Subject: [PATCH 057/596] nvmeofgw:fix forcing unavailable gw exit by sending  
        empty map to it

Signed-off-by: Leonid Chernin <leonidc@il.ibm.com>
---
 src/mon/NVMeofGwMap.cc |  9 +++++----
 src/mon/NVMeofGwMon.cc | 11 +++++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/src/mon/NVMeofGwMap.cc b/src/mon/NVMeofGwMap.cc
index 6cf45bcd7bf..e7eb42c91b4 100644
--- a/src/mon/NVMeofGwMap.cc
+++ b/src/mon/NVMeofGwMap.cc
@@ -43,10 +43,11 @@ void NVMeofGwMap::to_gmap(
       const auto& gw_id = gw_created_pair.first;
       const auto& gw_created  = gw_created_pair.second;
       gw_availability_t availability = gw_created.availability;
-      if (gw_created.availability == gw_availability_t::GW_DELETING) {
-         dout (4) << gw_id << "Send empty unicast map in Deleting state"
-                  << dendl;
-         continue;
+      if (gw_created.availability == gw_availability_t::GW_DELETING ||
+          gw_created.availability == gw_availability_t::GW_UNAVAILABLE) {
+        dout (4) << "GW " << gw_id << " Send empty unicast map in state "
+                 << gw_created.availability << dendl;
+        continue;
       }
 
       auto gw_state = NvmeGwClientState(
diff --git a/src/mon/NVMeofGwMon.cc b/src/mon/NVMeofGwMon.cc
index fe8bf32318b..8635da1c5e7 100644
--- a/src/mon/NVMeofGwMon.cc
+++ b/src/mon/NVMeofGwMon.cc
@@ -1116,6 +1116,11 @@ bool NVMeofGwMon::prepare_beacon(MonOpRequestRef op)
 	       << " GW state in monitor data-base : "
 	       << pending_map.created_gws[group_key][gw_id].availability
 	       << dendl;
+      if (pending_map.created_gws[group_key][gw_id].availability ==
+          gw_availability_t::GW_UNAVAILABLE) {
+        pending_map.created_gws[group_key][gw_id].availability =
+          gw_availability_t::GW_CREATED; // prevent sending empty map to this GW after restart
+      }
       if (pending_map.created_gws[group_key][gw_id].availability ==
 	  gw_availability_t::GW_AVAILABLE) {
 	dout(1) << " Warning :GW marked as Available in the NVmeofGwMon "
@@ -1150,11 +1155,9 @@ bool NVMeofGwMon::prepare_beacon(MonOpRequestRef op)
 	   false) &&
 	  (avail == gw_availability_t::GW_AVAILABLE ||
 	   avail == gw_availability_t::GW_UNAVAILABLE )) {
-	ack_map.created_gws[group_key][gw_id] =
-	  pending_map.created_gws[group_key][gw_id];
 	ack_map.epoch = get_ack_map_epoch(true, group_key);
-	dout(1) << " Force gw to exit: first beacon in state " << avail
-		<< " GW " << gw_id << dendl;
+	dout(1) << "Send empty map. Force gw to exit: first beacon in state "
+		<< avail << " GW " << gw_id << dendl;
 	auto msg = make_message<MNVMeofGwMap>(ack_map);
 	mon.send_reply(op, msg.detach());
 	goto false_return;

From b2f5d1876ef9e30449f8d95df8fe0b6fd277f01c Mon Sep 17 00:00:00 2001
From: Matt Benjamin <mbenjamin@redhat.com>
Date: Tue, 12 May 2026 12:48:43 -0400
Subject: [PATCH 058/596] rgwlc: fix a likely null dereference in
 LCObjsLister::get_obj()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Found by Opus 4.6:

  In get_obj() (lines 417-446), when obj_iter ==
  list_results.objs.end() and the listing is truncated, the code calls
  fetch() to get the next batch. fetch() sets obj_iter =
  list_results.objs.begin(). But if the new fetch returns zero objects
  (possible if objects were deleted between listing batches, or due to
  filtering/race conditions), then begin() == end() and the code falls
  through to line 437:

  if (obj_iter->key.name == pre_obj.key.name) {

  This dereferences end() — undefined behavior / crash. The
  return-value check at line 445 (return obj_iter !=
  list_results.objs.end()) comes too late; the dereference already
  happened.

Fixes: https://tracker.ceph.com/issues/76790

Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>
Assisted-by: Claude Code, Opus 4.6 1M
---
 src/rgw/rgw_lc.cc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_lc.cc b/src/rgw/rgw_lc.cc
index fdfbbc5abf2..53ad1326c7a 100644
--- a/src/rgw/rgw_lc.cc
+++ b/src/rgw/rgw_lc.cc
@@ -527,6 +527,9 @@ public:
         }
       }
       delay(dpp);
+      if (obj_iter == list_results.objs.end()) {
+        return false;
+      }
     }
 
     if (obj_iter->key.name == pre_obj.key.name) {
@@ -537,7 +540,7 @@ public:
 
     /* returning address of entry in objs */
     *obj = &(*obj_iter);
-    return obj_iter != list_results.objs.end();
+    return true;
   }
 
   rgw_bucket_dir_entry get_prev_obj() {

From 981d678971783a87e9ffd9c73fe1849d4b366992 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Tue, 26 May 2026 12:36:03 +0800
Subject: [PATCH 059/596] crimson/os/seastore/cached_extent: renew
 mutation_pending extents' last_committed_crc when committing rewrite
 transactions

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/cached_extent.cc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/crimson/os/seastore/cached_extent.cc b/src/crimson/os/seastore/cached_extent.cc
index 18af8083d33..85480f470ee 100644
--- a/src/crimson/os/seastore/cached_extent.cc
+++ b/src/crimson/os/seastore/cached_extent.cc
@@ -458,6 +458,10 @@ void ExtentCommitter::_share_prior_data_to_mutations() {
           }
         }
       });
+      // "me" is the actual prev of mextent, so before mextent enters
+      // the "prepare" pipeline phase, its last_committed_crc should be
+      // that of "me"'s
+      mextent.set_last_committed_crc(me.get_last_committed_crc());
     } else {
       auto &mextent = static_cast<CachedExtent&>(mext);
       TRACE("{} -> {}", extent, mextent);
@@ -465,6 +469,7 @@ void ExtentCommitter::_share_prior_data_to_mutations() {
         0, extent.get_length(), mextent.get_bptr().c_str());
       mextent.on_data_commit();
       mextent.reapply_delta();
+      mextent.set_last_committed_crc(extent.get_last_committed_crc());
     }
   }
 }

From 3a9ab7a5f60d3e72ea3421eb9744e3e0d3ceed2f Mon Sep 17 00:00:00 2001
From: Harsimran Singh <hsthukral51@gmail.com>
Date: Tue, 26 May 2026 11:41:06 +0530
Subject: [PATCH 060/596] rgw: add HEAD Object op metrics to perf counters and
 Prometheus export

Expose HEAD Object operation metrics in the same format as existing RGW op metrics so operators can track HEAD request volume and latency at gateway, user, and bucket scope.

Previously, HEAD Object requests were silently counted under get_obj_ops because RGWGetObj handles both GET and HEAD. The HEAD-specific early-return path (get_data == false) had no counter instrumentation.

Fixes: ISCE-3042

Signed-off-by: Harsimran Singh <harsimransingh@ibm.com>
---
 doc/radosgw/metrics.rst      | 18 ++++++++++++++++++
 src/rgw/rgw_op.cc            |  5 +++++
 src/rgw/rgw_perf_counters.cc |  3 +++
 src/rgw/rgw_perf_counters.h  |  5 ++++-
 4 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/doc/radosgw/metrics.rst b/doc/radosgw/metrics.rst
index e27babcbaae..74b3a44d15a 100644
--- a/doc/radosgw/metrics.rst
+++ b/doc/radosgw/metrics.rst
@@ -74,6 +74,12 @@ The following metrics related to S3 or Swift operations are tracked per Ceph Obj
    * - list_bucket_lat
      - Gauge
      - Total latency of list bucket operations
+   * - head_obj_ops
+     - Counter
+     - Number of successful HEAD Object operations
+   * - head_obj_lat
+     - Gauge
+     - Total latency of HEAD Object operations
 
 There are three different sections in the output of the ``counter dump`` and ``counter schema`` commands that show the op metrics and their information.
 The sections are ``rgw_op``, ``rgw_op_per_user``, and ``rgw_op_per_bucket``.
@@ -109,6 +115,12 @@ To view op metrics in the Ceph Object Gateway go to the ``rgw_op`` sections of t
                     "avgcount": 1,
                     "sum": 0.002300000,
                     "avgtime": 0.002300000
+                },
+                "head_obj_ops": 3,
+                "head_obj_lat": {
+                    "avgcount": 3,
+                    "sum": 0.006123456,
+                    "avgtime": 0.002041152
                 }
             }
         },
@@ -146,6 +158,12 @@ Op metrics can also be tracked per-user or per-bucket. These metrics are exporte
                     "avgcount": 1,
                     "sum": 0.002300000,
                     "avgtime": 0.002300000
+                },
+                "head_obj_ops": 3,
+                "head_obj_lat": {
+                    "avgcount": 3,
+                    "sum": 0.006123456,
+                    "avgtime": 0.002041152
                 }
             }
         },
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index b9529e2524c..96baccea30a 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -2639,6 +2639,7 @@ void RGWGetObj::execute(optional_yield y)
   if (get_type() == RGW_OP_STAT_OBJ) {
     return;
   }
+  
   if (s->info.env->exists("HTTP_X_RGW_AUTH")) {
     op_ret = 0;
     goto done_err;
@@ -2815,6 +2816,10 @@ void RGWGetObj::execute(optional_yield y)
 
   if (!get_data || ofs > end) {
     send_response_data(bl, 0, 0);
+    if (!get_data) {
+      rgw::op_counters::inc(counters, l_rgw_op_head_obj, 1);
+      rgw::op_counters::tinc(counters, l_rgw_op_head_obj_lat, s->time_elapsed());
+    }
     return;
   }
 
diff --git a/src/rgw/rgw_perf_counters.cc b/src/rgw/rgw_perf_counters.cc
index 6019e449977..a5e0072e95a 100644
--- a/src/rgw/rgw_perf_counters.cc
+++ b/src/rgw/rgw_perf_counters.cc
@@ -93,6 +93,9 @@ void add_rgw_op_counters(PerfCountersBuilder *lpcb) {
 
   lpcb->add_u64_counter(l_rgw_op_list_buckets, "list_buckets_ops", "List buckets");
   lpcb->add_time_avg(l_rgw_op_list_buckets_lat, "list_buckets_lat", "List buckets latency");
+
+  lpcb->add_u64_counter(l_rgw_op_head_obj, "head_obj_ops","Head object operations");
+  lpcb->add_time_avg(l_rgw_op_head_obj_lat, "head_obj_lat","Head object latency");
 }
 
 void add_rgw_topic_counters(PerfCountersBuilder *lpcb) {
diff --git a/src/rgw/rgw_perf_counters.h b/src/rgw/rgw_perf_counters.h
index e93b4fe36f9..5c3e724d26c 100644
--- a/src/rgw/rgw_perf_counters.h
+++ b/src/rgw/rgw_perf_counters.h
@@ -83,7 +83,10 @@ enum {
 
   l_rgw_op_list_buckets,
   l_rgw_op_list_buckets_lat,
-
+  
+  l_rgw_op_head_obj,
+  l_rgw_op_head_obj_lat,
+  
   l_rgw_op_last
 };
 

From 21be389c6796eb5b98829cb0cde0b6d99ea25c30 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 27 May 2026 19:38:27 +0000
Subject: [PATCH 061/596] rgw/multisite: do not log EBUSY/EAGAIN in per-object
 sync error log

The bucket-instance level sync (RGWDataSyncSingleEntryCR) excludes EBUSY and
EAGAIN from the sync error log as these are meant to be transient errors that
resolve on retry without an admin intervention.

Also, add EBUSY and EAGAIN to ignore_sync_error(), which is used by the
per-object level sync in RGWSyncObjectCR, to match the bucket-instance
level behavior.

Fixes: https://tracker.ceph.com/issues/76950
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/driver/rados/rgw_data_sync.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/rgw/driver/rados/rgw_data_sync.cc b/src/rgw/driver/rados/rgw_data_sync.cc
index 3b742b85706..3901e8c8efc 100644
--- a/src/rgw/driver/rados/rgw_data_sync.cc
+++ b/src/rgw/driver/rados/rgw_data_sync.cc
@@ -4327,6 +4327,8 @@ static bool ignore_sync_error(int err) {
   switch (err) {
     case -ENOENT:
     case -EPERM:
+    case -EBUSY:
+    case -EAGAIN:
       return true;
     default:
       break;

From c29b9f0c86d93bbbca5c80058db898134b48a991 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 27 May 2026 19:38:37 +0000
Subject: [PATCH 062/596] rgw/multisite: include error code in object sync
 failure log message

Append retcode and its string representation to the log line to facilitate the
diagnosis of sync issues.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/driver/rados/rgw_data_sync.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/rgw/driver/rados/rgw_data_sync.cc b/src/rgw/driver/rados/rgw_data_sync.cc
index 3901e8c8efc..b437ab4252e 100644
--- a/src/rgw/driver/rados/rgw_data_sync.cc
+++ b/src/rgw/driver/rados/rgw_data_sync.cc
@@ -4495,7 +4495,9 @@ public:
       if (retcode < 0 && retcode != -ENOENT) {
         set_status() << "failed to sync obj; retcode=" << retcode;
         tn->log(0, SSTR("ERROR: failed to sync object: "
-            << bucket_shard_str{bs} << "/" << key.name));
+            << bucket_shard_str{bs} << "/" << key.name
+            << " retcode=" << retcode
+            << " (" << cpp_strerror(-retcode) << ")"));
         if (!ignore_sync_error(retcode)) {
           error_ss << bucket_shard_str{bs} << "/" << key.name;
           sync_status = retcode;

From 5a45cd213e52fc3dabcccc5ba85706205468a732 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Wed, 16 Oct 2024 19:53:20 +0200
Subject: [PATCH 063/596] include/CompatSet: use std::string_view in struct
 Feature

Almost all callers pass a C string (in temporary Feature instances),
only `CompatSetHandler::handle()` passes a `std::string` reference.

Allocating a new `std::string` is useless overhead.  This patch
reduces the binary size by 21 kB.

Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 src/include/CompatSet.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/include/CompatSet.h b/src/include/CompatSet.h
index 9d63edc55a9..24cadd6ab57 100644
--- a/src/include/CompatSet.h
+++ b/src/include/CompatSet.h
@@ -29,9 +29,9 @@ struct CompatSet {
 
   struct Feature {
     uint64_t id;
-    std::string name;
+    std::string_view name;
 
-    Feature(uint64_t _id, const std::string& _name) : id(_id), name(_name) {}
+    constexpr Feature(uint64_t _id, const std::string_view _name) : id(_id), name(_name) {}
   };
 
   class FeatureSet {

From 7b5e7c42605dfde5c2256d628f71a8f586f7b403 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Wed, 16 Oct 2024 20:01:20 +0200
Subject: [PATCH 064/596] include/CompatSet: get_name() returns
 std::string_view

Creating a temporary copy is useless overhead for all callers.

Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 src/include/CompatSet.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/include/CompatSet.h b/src/include/CompatSet.h
index 24cadd6ab57..f56ce49aa4d 100644
--- a/src/include/CompatSet.h
+++ b/src/include/CompatSet.h
@@ -62,7 +62,7 @@ struct CompatSet {
     /**
      * Getter instead of using name[] to be const safe
      */
-    std::string get_name(uint64_t const f) const {
+    std::string_view get_name(uint64_t const f) const noexcept {
       std::map<uint64_t, std::string>::const_iterator i = names.find(f);
       ceph_assert(i != names.end());
       return i->second;

From 2718fd2792afd9c1febeadcd07011daf0421cab7 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Wed, 16 Oct 2024 20:30:09 +0200
Subject: [PATCH 065/596] include/CompatSet: remove the FeatureSet ctor

Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 src/include/CompatSet.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/include/CompatSet.h b/src/include/CompatSet.h
index f56ce49aa4d..9ab3794adec 100644
--- a/src/include/CompatSet.h
+++ b/src/include/CompatSet.h
@@ -35,7 +35,7 @@ struct CompatSet {
   };
 
   class FeatureSet {
-    uint64_t mask;
+    uint64_t mask = 1;
     std::map<uint64_t, std::string> names;
 
   public:
@@ -45,7 +45,7 @@ struct CompatSet {
     friend class CephCompatSet_merge_Test;
     friend std::ostream& operator<<(std::ostream& out, const CompatSet::FeatureSet& fs);
     friend std::ostream& operator<<(std::ostream& out, const CompatSet& compat);
-    FeatureSet() : mask(1), names() {}
+
     void insert(const Feature& f) {
       ceph_assert(f.id > 0);
       ceph_assert(f.id < 64);

From 72483c1eb0bae5caaee26090e053d24c6500e919 Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Wed, 27 May 2026 16:22:14 -0400
Subject: [PATCH 066/596] rgw: use local error code in
 handle_individual_object()

op_ret is a member variable of RGWDeleteMultiObj shared between
concurrent callers of handle_individual_object(). because that coroutine
may suspend between writing to op_ret and later reading it back for
send_partial_response(), it's likely that other callers have modified it
in the meantime

store this error code in a local variable instead, so each coroutine has
its own consistent copy of it

Fixes: https://tracker.ceph.com/issues/76960

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 src/rgw/rgw_op.cc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 9809a481f90..e7c21d1aa3f 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -8079,9 +8079,9 @@ void RGWDeleteMultiObj::handle_individual_object(const RGWMultiDelObject& object
                           rgw::notify::ObjectRemovedDelete;
   std::unique_ptr<rgw::sal::Notification> res
           = driver->get_notification(obj.get(), s->src_object.get(), s, event_type, y);
-  op_ret = res->publish_reserve(dpp);
-  if (op_ret < 0) {
-    send_partial_response(o, false, "", op_ret);
+  int r = res->publish_reserve(dpp);
+  if (r < 0) {
+    send_partial_response(o, false, "", r);
     return;
   }
 
@@ -8097,10 +8097,10 @@ void RGWDeleteMultiObj::handle_individual_object(const RGWMultiDelObject& object
   del_op->params.if_match = object.get_if_match();
   del_op->params.size_match = object.get_size_match();
 
-  op_ret = del_op->delete_obj(dpp, y,
-                              rgw::sal::FLAG_LOG_OP | (skip_olh_obj_update ? rgw::sal::FLAG_SKIP_UPDATE_OLH : 0));
-  if (op_ret == -ENOENT) {
-    op_ret = 0;
+  r = del_op->delete_obj(dpp, y,
+                         rgw::sal::FLAG_LOG_OP | (skip_olh_obj_update ? rgw::sal::FLAG_SKIP_UPDATE_OLH : 0));
+  if (r == -ENOENT) {
+    r = 0;
   }
 
   if (auto ret = rgw::bucketlogging::log_record(driver, rgw::bucketlogging::LoggingType::Any, obj.get(), s, canonical_name(), etag, obj_size, this, y, true, false); ret < 0) {
@@ -8108,7 +8108,7 @@ void RGWDeleteMultiObj::handle_individual_object(const RGWMultiDelObject& object
     ldpp_dout(this, 5) << "WARNING: multi DELETE operation ignores bucket logging failure: " << ret << dendl;
   }
 
-  if (op_ret == 0) {
+  if (r == 0) {
     // send request to notification manager
     int ret = res->publish_commit(dpp, obj_size, ceph::real_clock::now(), etag, version_id);
     if (ret < 0) {
@@ -8117,7 +8117,7 @@ void RGWDeleteMultiObj::handle_individual_object(const RGWMultiDelObject& object
     }
   }
   
-  send_partial_response(o, del_op->result.delete_marker, del_op->result.version_id, op_ret);
+  send_partial_response(o, del_op->result.delete_marker, del_op->result.version_id, r);
 }
 
 void RGWDeleteMultiObj::handle_objects(const std::vector<RGWMultiDelObject>& objects,

From 4681cb7b3429f64caeec2602a56a03c1f83f4c25 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Thu, 28 May 2026 13:52:00 -0400
Subject: [PATCH 067/596] qa/suites/upgrade: ignore fs down variant

Fixes: https://tracker.ceph.com/issues/76969
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 qa/overrides/upgrade_ignorelist_health.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/qa/overrides/upgrade_ignorelist_health.yaml b/qa/overrides/upgrade_ignorelist_health.yaml
index 4cefcafc06c..5d175caf73d 100644
--- a/qa/overrides/upgrade_ignorelist_health.yaml
+++ b/qa/overrides/upgrade_ignorelist_health.yaml
@@ -22,5 +22,7 @@ overrides:
       - osds down
       - MDS_INSUFFICIENT_STANDBY
       - insufficient standby
+      - fs has.*but wants
       - have.*want.*more
+      - fs .* is degraded
       - is offline because no MDS is active for it

From 43dd4cbd370455590d12337f09138a7f7b635bd9 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 28 May 2026 19:11:24 +0800
Subject: [PATCH 068/596] rocksdb: upgrade submodule to v7.10.2 to address
 CVE-2022-23476

This commit upgrades the rocksdb submodule from v7.9.2 to v7.10.2 to
address CVE-2022-23476, a security vulnerability in the Nokogiri gem
used by RocksDB's documentation build system.

CVE-2022-23476 Details:
- Affects: RocksDB versions < 7.10.2
- Issue: Unchecked return value from xmlTextReaderExpand in Nokogiri
- Fix commit: 6648dec0a3eee0a329af8342038ce099baa55122
- Fixed in: Nokogiri 1.13.10, included in RocksDB v7.10.2

The vulnerability was fixed in the upstream facebook/rocksdb repository
on December 8, 2022, and included in the v7.10.2 release. The v7.9.2
version currently used by Ceph does not contain this fix, as the 7.9.x
branch diverged before the security patch was applied.

Analysis confirmed that:
- Current Ceph RocksDB: v7.9.2 (commit 24ea35870fe9b3ba15285ec8746ba97ed5d67ff3)
- CVE fix present in v7.9.2: NO
- First version with fix: v7.10.2 (commit 9107c1059b4656513ae0d51e8976e4f69f59a9c3)

References:
- CVE-2022-23476: https://nvd.nist.gov/vuln/detail/CVE-2022-23476
- Nokogiri Advisory: GHSA-qv4q-mr5r-qprj
- Fix commit: facebook/rocksdb@6648dec

also, in this change, we adapt BinnedLRUCache to CacheItemHelper API.
rocksdb 7.10 reshaped `rocksdb::Cache`, so we have to update our
overrides accordingly to address the build failure. the check for
RocksDB version is dropped, as mainstream distros ship RocksDB >=
7.10.2 at the time of writing:

- alpine 3.23:    10.9.1
- fedora 44:      10.2.1
- debian stable:   9.10.0
- ubuntu nobel:    8.9.1
- ubuntu resolute: 9.11.2

Signed-off-by: Justin Caratzas <jcaratza@ibm.com>
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/kv/rocksdb_cache/BinnedLRUCache.cc | 27 ++++++-------
 src/kv/rocksdb_cache/BinnedLRUCache.h  | 27 ++++++-------
 src/kv/rocksdb_cache/ShardedCache.cc   | 43 ++++++++++-----------
 src/kv/rocksdb_cache/ShardedCache.h    | 52 ++++++++++++++------------
 src/rocksdb                            |  2 +-
 5 files changed, 77 insertions(+), 74 deletions(-)

diff --git a/src/kv/rocksdb_cache/BinnedLRUCache.cc b/src/kv/rocksdb_cache/BinnedLRUCache.cc
index b2344032f1d..be51b0325a9 100644
--- a/src/kv/rocksdb_cache/BinnedLRUCache.cc
+++ b/src/kv/rocksdb_cache/BinnedLRUCache.cc
@@ -160,9 +160,9 @@ void BinnedLRUCacheShard::EraseUnRefEntries() {
 
 void BinnedLRUCacheShard::ApplyToAllCacheEntries(
   const std::function<void(const rocksdb::Slice& key,
-                           void* value,
+                           rocksdb::Cache::ObjectPtr value,
                            size_t charge,
-                           DeleterFn)>& callback,
+                           const rocksdb::Cache::CacheItemHelper* helper)>& callback,
   bool thread_safe)
 {
   if (thread_safe) {
@@ -170,7 +170,7 @@ void BinnedLRUCacheShard::ApplyToAllCacheEntries(
   }
   table_.ApplyToAllCacheEntries(
     [callback](BinnedLRUHandle* h) {
-      callback(h->key(), h->value, h->charge, h->deleter);
+      callback(h->key(), h->value, h->charge, h->helper);
     });
   if (thread_safe) {
     mutex_.unlock();
@@ -419,16 +419,17 @@ bool BinnedLRUCacheShard::Release(rocksdb::Cache::Handle* handle, bool force_era
   return last_reference;
 }
 
-rocksdb::Status BinnedLRUCacheShard::Insert(const rocksdb::Slice& key, uint32_t hash, void* value,
+rocksdb::Status BinnedLRUCacheShard::Insert(const rocksdb::Slice& key, uint32_t hash,
+                             rocksdb::Cache::ObjectPtr value,
+                             const rocksdb::Cache::CacheItemHelper* helper,
                              size_t charge,
-                             DeleterFn deleter,
                              rocksdb::Cache::Handle** handle, rocksdb::Cache::Priority priority) {
   auto e = new BinnedLRUHandle();
   rocksdb::Status s;
   BinnedLRUHandle* deleted = nullptr;
 
   e->value = value;
-  e->deleter = deleter;
+  e->helper = helper;
   e->charge = charge;
   e->key_length = key.size();
   e->key_data = new char[e->key_length];
@@ -560,10 +561,11 @@ std::string BinnedLRUCacheShard::GetPrintableOptions() const {
   return std::string(buffer);
 }
 
-DeleterFn BinnedLRUCacheShard::GetDeleter(rocksdb::Cache::Handle* h) const
+const rocksdb::Cache::CacheItemHelper*
+BinnedLRUCacheShard::GetCacheItemHelper(rocksdb::Cache::Handle* h) const
 {
   auto* handle = reinterpret_cast<BinnedLRUHandle*>(h);
-  return handle->deleter;
+  return handle->helper;
 }
 
 #undef dout_context
@@ -702,7 +704,7 @@ const CacheShard* BinnedLRUCache::GetShard(int shard) const {
   return reinterpret_cast<CacheShard*>(&shards_[shard]);
 }
 
-void* BinnedLRUCache::Value(Handle* handle) {
+rocksdb::Cache::ObjectPtr BinnedLRUCache::Value(Handle* handle) {
   return reinterpret_cast<const BinnedLRUHandle*>(handle)->value;
 }
 
@@ -721,12 +723,11 @@ void BinnedLRUCache::DisownData() {
 #endif  // !__SANITIZE_ADDRESS__
 }
 
-#if (ROCKSDB_MAJOR >= 7 || (ROCKSDB_MAJOR == 6 && ROCKSDB_MINOR >= 22))
-DeleterFn BinnedLRUCache::GetDeleter(Handle* handle) const
+const rocksdb::Cache::CacheItemHelper*
+BinnedLRUCache::GetCacheItemHelper(Handle* handle) const
 {
-  return reinterpret_cast<const BinnedLRUHandle*>(handle)->deleter;
+  return reinterpret_cast<const BinnedLRUHandle*>(handle)->helper;
 }
-#endif
 
 size_t BinnedLRUCache::TEST_GetLRUSize() {
   size_t lru_size_of_all_shards = 0;
diff --git a/src/kv/rocksdb_cache/BinnedLRUCache.h b/src/kv/rocksdb_cache/BinnedLRUCache.h
index a419154c277..44392e7d4bc 100644
--- a/src/kv/rocksdb_cache/BinnedLRUCache.h
+++ b/src/kv/rocksdb_cache/BinnedLRUCache.h
@@ -58,8 +58,8 @@ std::shared_ptr<rocksdb::Cache> NewBinnedLRUCache(
 
 struct BinnedLRUHandle {
   std::shared_ptr<uint64_t> age_bin;
-  void* value;
-  DeleterFn deleter;
+  rocksdb::Cache::ObjectPtr value;
+  const rocksdb::Cache::CacheItemHelper* helper;
   BinnedLRUHandle* next_hash;
   BinnedLRUHandle* next;
   BinnedLRUHandle* prev;
@@ -121,8 +121,8 @@ struct BinnedLRUHandle {
 
   void Free() {
     ceph_assert((refs == 1 && InCache()) || (refs == 0 && !InCache()));
-    if (deleter) {
-      (*deleter)(key(), value);
+    if (helper && helper->del_cb) {
+      (*helper->del_cb)(value, /*allocator=*/nullptr);
     }
     delete[] key_data;
     delete this;
@@ -240,9 +240,10 @@ class alignas(CACHE_LINE_SIZE) BinnedLRUCacheShard : public CacheShard {
   void SetHighPriPoolRatio(double high_pri_pool_ratio);
 
   // Like Cache methods, but with an extra "hash" parameter.
-  virtual rocksdb::Status Insert(const rocksdb::Slice& key, uint32_t hash, void* value,
+  virtual rocksdb::Status Insert(const rocksdb::Slice& key, uint32_t hash,
+                        rocksdb::Cache::ObjectPtr value,
+                        const rocksdb::Cache::CacheItemHelper* helper,
                         size_t charge,
-                        DeleterFn deleter,
                         rocksdb::Cache::Handle** handle,
                         rocksdb::Cache::Priority priority) override;
   virtual rocksdb::Cache::Handle* Lookup(const rocksdb::Slice& key, uint32_t hash) override;
@@ -260,16 +261,17 @@ class alignas(CACHE_LINE_SIZE) BinnedLRUCacheShard : public CacheShard {
 
   virtual void ApplyToAllCacheEntries(
     const std::function<void(const rocksdb::Slice& key,
-                             void* value,
+                             rocksdb::Cache::ObjectPtr value,
                              size_t charge,
-                             DeleterFn)>& callback,
+                             const rocksdb::Cache::CacheItemHelper* helper)>& callback,
     bool thread_safe) override;
 
   virtual void EraseUnRefEntries() override;
 
   virtual std::string GetPrintableOptions() const override;
 
-  virtual DeleterFn GetDeleter(rocksdb::Cache::Handle* handle) const override;
+  virtual const rocksdb::Cache::CacheItemHelper* GetCacheItemHelper(
+      rocksdb::Cache::Handle* handle) const override;
 
   void TEST_GetLRUList(BinnedLRUHandle** lru, BinnedLRUHandle** lru_low_pri);
 
@@ -382,13 +384,12 @@ class BinnedLRUCache : public ShardedCache {
   virtual const char* Name() const override { return "BinnedLRUCache"; }
   virtual CacheShard* GetShard(int shard) override;
   virtual const CacheShard* GetShard(int shard) const override;
-  virtual void* Value(Handle* handle) override;
+  virtual rocksdb::Cache::ObjectPtr Value(Handle* handle) override;
   virtual size_t GetCharge(Handle* handle) const override;
   virtual uint32_t GetHash(Handle* handle) const override;
   virtual void DisownData() override;
-#if (ROCKSDB_MAJOR >= 7 || (ROCKSDB_MAJOR == 6 && ROCKSDB_MINOR >= 22))
-  virtual DeleterFn GetDeleter(Handle* handle) const override;
-#endif
+  virtual const rocksdb::Cache::CacheItemHelper* GetCacheItemHelper(
+      Handle* handle) const override;
   //  Retrieves number of elements in LRU, for unit test purpose only
   size_t TEST_GetLRUSize();
   // Sets the high pri pool ratio
diff --git a/src/kv/rocksdb_cache/ShardedCache.cc b/src/kv/rocksdb_cache/ShardedCache.cc
index 7d160f9c7b4..b6fcb01174f 100644
--- a/src/kv/rocksdb_cache/ShardedCache.cc
+++ b/src/kv/rocksdb_cache/ShardedCache.cc
@@ -43,15 +43,23 @@ void ShardedCache::SetStrictCapacityLimit(bool strict_capacity_limit) {
   strict_capacity_limit_ = strict_capacity_limit;
 }
 
-rocksdb::Status ShardedCache::Insert(const rocksdb::Slice& key, void* value, size_t charge,
-                            DeleterFn deleter,
+rocksdb::Status ShardedCache::Insert(const rocksdb::Slice& key,
+                            rocksdb::Cache::ObjectPtr value,
+                            const rocksdb::Cache::CacheItemHelper* helper,
+                            size_t charge,
                             rocksdb::Cache::Handle** handle, Priority priority) {
   uint32_t hash = HashSlice(key);
   return GetShard(Shard(hash))
-      ->Insert(key, hash, value, charge, deleter, handle, priority);
+      ->Insert(key, hash, value, helper, charge, handle, priority);
 }
 
-rocksdb::Cache::Handle* ShardedCache::Lookup(const rocksdb::Slice& key, rocksdb::Statistics* /*stats*/) {
+rocksdb::Cache::Handle* ShardedCache::Lookup(const rocksdb::Slice& key,
+                            const rocksdb::Cache::CacheItemHelper* /*helper*/,
+                            rocksdb::Cache::CreateContext* /*create_context*/,
+                            Priority /*priority*/, bool /*wait*/,
+                            rocksdb::Statistics* /*stats*/) {
+  // Secondary cache is not supported by BinnedLRUCache, so the helper,
+  // create_context, priority, wait, and stats arguments are ignored here.
   uint32_t hash = HashSlice(key);
   return GetShard(Shard(hash))->Lookup(key, hash);
 }
@@ -109,36 +117,25 @@ size_t ShardedCache::GetPinnedUsage() const {
   return usage;
 }
 
-#if (ROCKSDB_MAJOR >= 7 || (ROCKSDB_MAJOR == 6 && ROCKSDB_MINOR >= 22))
-DeleterFn ShardedCache::GetDeleter(Handle* handle) const
+const rocksdb::Cache::CacheItemHelper* ShardedCache::GetCacheItemHelper(
+    Handle* handle) const
 {
   uint32_t hash = GetHash(handle);
-  return GetShard(Shard(hash))->GetDeleter(handle);
+  return GetShard(Shard(hash))->GetCacheItemHelper(handle);
 }
 
 void ShardedCache::ApplyToAllEntries(
-    const std::function<void(const rocksdb::Slice& key, void* value, size_t charge,
-                             DeleterFn deleter)>& callback,
-    const ApplyToAllEntriesOptions& opts)
+    const std::function<void(const rocksdb::Slice& key,
+                             rocksdb::Cache::ObjectPtr value,
+                             size_t charge,
+                             const rocksdb::Cache::CacheItemHelper* helper)>& callback,
+    const ApplyToAllEntriesOptions& /*opts*/)
 {
   int num_shards = 1 << num_shard_bits_;
   for (int s = 0; s < num_shards; s++) {
     GetShard(s)->ApplyToAllCacheEntries(callback, true /* thread_safe */);
   }
 }
-#else
-void ShardedCache::ApplyToAllCacheEntries(void (*callback)(void*, size_t),
-                                          bool thread_safe) {
-  int num_shards = 1 << num_shard_bits_;
-  for (int s = 0; s < num_shards; s++) {
-    GetShard(s)->ApplyToAllCacheEntries(
-      [callback](const rocksdb::Slice&, void* value, size_t charge, DeleterFn) {
-        callback(value, charge);
-      },
-      thread_safe);
-  }
-}
-#endif
 
 void ShardedCache::EraseUnRefEntries() {
   int num_shards = 1 << num_shard_bits_;
diff --git a/src/kv/rocksdb_cache/ShardedCache.h b/src/kv/rocksdb_cache/ShardedCache.h
index 63a56c4577e..8a78ddbf08d 100644
--- a/src/kv/rocksdb_cache/ShardedCache.h
+++ b/src/kv/rocksdb_cache/ShardedCache.h
@@ -26,18 +26,18 @@
 
 namespace rocksdb_cache {
 
-using DeleterFn = void (*)(const rocksdb::Slice& key, void* value);
-
 // Single cache shard interface.
 class CacheShard {
  public:
   CacheShard() = default;
   virtual ~CacheShard() = default;
 
-  virtual rocksdb::Status Insert(const rocksdb::Slice& key, uint32_t hash, void* value,
+  virtual rocksdb::Status Insert(const rocksdb::Slice& key, uint32_t hash,
+                                 rocksdb::Cache::ObjectPtr value,
+                                 const rocksdb::Cache::CacheItemHelper* helper,
                                  size_t charge,
-                                 DeleterFn deleter,
-                                 rocksdb::Cache::Handle** handle, rocksdb::Cache::Priority priority) = 0;
+                                 rocksdb::Cache::Handle** handle,
+                                 rocksdb::Cache::Priority priority) = 0;
   virtual rocksdb::Cache::Handle* Lookup(const rocksdb::Slice& key, uint32_t hash) = 0;
   virtual bool Ref(rocksdb::Cache::Handle* handle) = 0;
   virtual bool Release(rocksdb::Cache::Handle* handle, bool force_erase = false) = 0;
@@ -48,13 +48,14 @@ class CacheShard {
   virtual size_t GetPinnedUsage() const = 0;
   virtual void ApplyToAllCacheEntries(
     const std::function<void(const rocksdb::Slice& key,
-                             void* value,
+                             rocksdb::Cache::ObjectPtr value,
                              size_t charge,
-                             DeleterFn)>& callback,
+                             const rocksdb::Cache::CacheItemHelper* helper)>& callback,
     bool thread_safe) = 0;
   virtual void EraseUnRefEntries() = 0;
   virtual std::string GetPrintableOptions() const { return ""; }
-  virtual DeleterFn GetDeleter(rocksdb::Cache::Handle* handle) const = 0;
+  virtual const rocksdb::Cache::CacheItemHelper* GetCacheItemHelper(
+      rocksdb::Cache::Handle* handle) const = 0;
 };
 
 // Generic cache interface which shards cache by hash of keys. 2^num_shard_bits
@@ -67,15 +68,22 @@ class ShardedCache : public rocksdb::Cache, public PriorityCache::PriCache {
   // rocksdb::Cache
   virtual const char* Name() const override = 0;
   using rocksdb::Cache::Insert;
-  virtual rocksdb::Status Insert(const rocksdb::Slice& key, void* value, size_t charge,
-                                 DeleterFn,
-                                 rocksdb::Cache::Handle** handle, Priority priority) override;
+  virtual rocksdb::Status Insert(const rocksdb::Slice& key,
+                                 rocksdb::Cache::ObjectPtr value,
+                                 const rocksdb::Cache::CacheItemHelper* helper,
+                                 size_t charge,
+                                 rocksdb::Cache::Handle** handle,
+                                 Priority priority) override;
   using rocksdb::Cache::Lookup;
-  virtual rocksdb::Cache::Handle* Lookup(const rocksdb::Slice& key, rocksdb::Statistics* stats) override;
+  virtual rocksdb::Cache::Handle* Lookup(const rocksdb::Slice& key,
+                                         const rocksdb::Cache::CacheItemHelper* helper,
+                                         rocksdb::Cache::CreateContext* create_context,
+                                         Priority priority, bool wait,
+                                         rocksdb::Statistics* stats) override;
   virtual bool Ref(rocksdb::Cache::Handle* handle) override;
   using rocksdb::Cache::Release;
   virtual bool Release(rocksdb::Cache::Handle* handle, bool force_erase = false) override;
-  virtual void* Value(Handle* handle) override = 0;
+  virtual rocksdb::Cache::ObjectPtr Value(Handle* handle) override = 0;
   virtual void Erase(const rocksdb::Slice& key) override;
   virtual uint64_t NewId() override;
   virtual void SetCapacity(size_t capacity) override;
@@ -85,20 +93,16 @@ class ShardedCache : public rocksdb::Cache, public PriorityCache::PriCache {
   virtual size_t GetUsage() const override;
   virtual size_t GetUsage(rocksdb::Cache::Handle* handle) const override;
   virtual size_t GetPinnedUsage() const override;
-  virtual size_t GetCharge(Handle* handle) const = 0;
-#if (ROCKSDB_MAJOR >= 7 || (ROCKSDB_MAJOR == 6 && ROCKSDB_MINOR >= 22))
-  virtual DeleterFn GetDeleter(Handle* handle) const override;
-#endif
+  virtual size_t GetCharge(Handle* handle) const override = 0;
+  virtual const rocksdb::Cache::CacheItemHelper* GetCacheItemHelper(
+      Handle* handle) const override;
   virtual void DisownData() override = 0;
-#if (ROCKSDB_MAJOR >= 7 || (ROCKSDB_MAJOR == 6 && ROCKSDB_MINOR >= 22))
   virtual void ApplyToAllEntries(
-      const std::function<void(const rocksdb::Slice& key, void* value, size_t charge,
-                               DeleterFn deleter)>& callback,
+      const std::function<void(const rocksdb::Slice& key,
+                               rocksdb::Cache::ObjectPtr value,
+                               size_t charge,
+                               const rocksdb::Cache::CacheItemHelper* helper)>& callback,
       const ApplyToAllEntriesOptions& opts) override;
-#else
-  virtual void ApplyToAllCacheEntries(void (*callback)(void*, size_t),
-                                      bool thread_safe) override;
-#endif
   virtual void EraseUnRefEntries() override;
   virtual std::string GetPrintableOptions() const override;
   virtual CacheShard* GetShard(int shard) = 0;
diff --git a/src/rocksdb b/src/rocksdb
index 24ea35870fe..0bd97e703ec 160000
--- a/src/rocksdb
+++ b/src/rocksdb
@@ -1 +1 @@
-Subproject commit 24ea35870fe9b3ba15285ec8746ba97ed5d67ff3
+Subproject commit 0bd97e703ec62ad602717482508b08dd91baa8f5

From dada074b3437b2696479496b93ab50f9da598662 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 29 May 2026 14:48:07 +0800
Subject: [PATCH 069/596] monitoring/ceph-mixin: bump jsonnet-bundler to v0.6.0

v0.4.0 fails to build on riscv64; bump to v0.6.0 to fix it.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 monitoring/ceph-mixin/jsonnet-bundler-build.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/monitoring/ceph-mixin/jsonnet-bundler-build.sh b/monitoring/ceph-mixin/jsonnet-bundler-build.sh
index d713cffb8bc..463658f186b 100755
--- a/monitoring/ceph-mixin/jsonnet-bundler-build.sh
+++ b/monitoring/ceph-mixin/jsonnet-bundler-build.sh
@@ -1,6 +1,6 @@
 #!/bin/sh -ex
 
-JSONNET_VERSION="v0.4.0"
+JSONNET_VERSION="v0.6.0"
 OUTPUT_DIR=${1:-$(pwd)}
 
 git clone -b ${JSONNET_VERSION} --depth 1 https://github.com/jsonnet-bundler/jsonnet-bundler

From 5a83c603876ad5b1fd8bd71044b624e9819a7832 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 29 May 2026 16:15:27 +0800
Subject: [PATCH 070/596] test/mds: don't drop await_idle_v under NDEBUG

await_idle_v() is wrapped in assert(), so with NDEBUG it is never
called and the test reads a default-constructed ack, racing the agent
thread. Use EXPECT_TRUE() like the rest of the file.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/mds/TestQuiesceAgent.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/mds/TestQuiesceAgent.cc b/src/test/mds/TestQuiesceAgent.cc
index aa108075faa..7940d8a5004 100644
--- a/src/test/mds/TestQuiesceAgent.cc
+++ b/src/test/mds/TestQuiesceAgent.cc
@@ -192,7 +192,7 @@ class QuiesceAgentTest : public testing::Test {
       if (WaitForAgent::No == wait) {
         return std::nullopt;
       } else {
-        assert(await_idle_v(v.set_version));
+        EXPECT_TRUE(await_idle_v(v.set_version));
         return async_ack;
       }
     }

From 4e4dd6b1cdfcccf57a2e3a1372dd640f33d56b26 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 29 May 2026 16:46:13 +0800
Subject: [PATCH 071/596] cephadm/tests: mock find_program in
 test_container_engine

test_container_engine mocks find_executable to keep command_check_host
off the real host, but command_check_host looks up 'lvcreate' (and
'systemctl') through find_program, which isn't mocked. So the test
actually needs lvcreate installed and only passes where it is.

Mock find_program too so the test doesn't depend on host binaries.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/cephadm/tests/test_cephadm.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index 7d2402d8b9b..27d4ff38252 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -2282,10 +2282,11 @@ exec /usr/bin/docker run --rm --ipc=host --stop-signal=SIGTERM --ulimit nofile=1
 
 class TestCheckHost:
 
+    @mock.patch('cephadm.find_program', return_value='foo')
     @mock.patch('cephadm.find_executable', return_value='foo')
     @mock.patch('cephadm.check_time_sync', return_value=True)
     @mock.patch('cephadm.logger')
-    def test_container_engine(self, _logger, _find_executable, _check_time_sync):
+    def test_container_engine(self, _logger, _find_executable, _check_time_sync, _find_program):
         ctx = _cephadm.CephadmContext()
 
         ctx.container_engine = None

From 84040d88296c03e0aeaca735946aa479ed4aa7ad Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Fri, 29 May 2026 13:44:45 -0400
Subject: [PATCH 072/596] qa/rgw/multisite: use random aes algorithm

test coverage for `rgw crypt sse algorithm: aes-256-gcm` was recently
added to the multisite suite, doubling the number of jobs from 2 to 4

instead of duplicating the multisite jobs for both cbc and gcm, select
a random algorithm for each of the 2 existing jobs

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 qa/suites/rgw/multisite/{aes => aes$}/.qa          | 0
 qa/suites/rgw/multisite/{aes => aes$}/default.yaml | 0
 qa/suites/rgw/multisite/{aes => aes$}/gcm.yaml     | 0
 3 files changed, 0 insertions(+), 0 deletions(-)
 rename qa/suites/rgw/multisite/{aes => aes$}/.qa (100%)
 rename qa/suites/rgw/multisite/{aes => aes$}/default.yaml (100%)
 rename qa/suites/rgw/multisite/{aes => aes$}/gcm.yaml (100%)

diff --git a/qa/suites/rgw/multisite/aes/.qa b/qa/suites/rgw/multisite/aes$/.qa
similarity index 100%
rename from qa/suites/rgw/multisite/aes/.qa
rename to qa/suites/rgw/multisite/aes$/.qa
diff --git a/qa/suites/rgw/multisite/aes/default.yaml b/qa/suites/rgw/multisite/aes$/default.yaml
similarity index 100%
rename from qa/suites/rgw/multisite/aes/default.yaml
rename to qa/suites/rgw/multisite/aes$/default.yaml
diff --git a/qa/suites/rgw/multisite/aes/gcm.yaml b/qa/suites/rgw/multisite/aes$/gcm.yaml
similarity index 100%
rename from qa/suites/rgw/multisite/aes/gcm.yaml
rename to qa/suites/rgw/multisite/aes$/gcm.yaml

From d69477cd02a21809b0a6f1a7211a9e5791cc92c1 Mon Sep 17 00:00:00 2001
From: "Ashwin M. Joshi" <ashjosh1@in.ibm.com>
Date: Wed, 18 Feb 2026 11:19:12 +0530
Subject: [PATCH 073/596] python-common: Improve profile name string validation

Fixes: https://tracker.ceph.com/issues/74986
Signed-off-by: Ashwin M. Joshi <ashjosh1@in.ibm.com>

	src/python-common/ceph/tests/test_service_spec.py

 Conflicts:
	src/python-common/ceph/deployment/service_spec.py
---
 .../ceph/deployment/service_spec.py           | 19 ++++----
 .../ceph/tests/test_service_spec.py           | 47 +++++++++++++++++++
 2 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 21ab7a04e75..86bdf18451a 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -52,6 +52,11 @@ ServiceSpecT = TypeVar('ServiceSpecT', bound='ServiceSpec')
 FuncT = TypeVar('FuncT', bound=Callable)
 
 
+def validate_non_empty_string(value: Optional[str], field_name: str) -> None:
+    if not isinstance(value, str) or not value.strip():
+        raise SpecValidationError(f"Invalid {field_name}: Must be a non-empty string.")
+
+
 class TLSBlock(TypedDict, total=False):
     ssl: bool
     certificate_source: str
@@ -2805,6 +2810,7 @@ class OAuth2ProxySpec(ServiceSpec):
 
     def validate(self) -> None:
         super(OAuth2ProxySpec, self).validate()
+
         required_values = {
             'provider_display_name': self.provider_display_name,
             'oidc_issuer_url': self.oidc_issuer_url,
@@ -2821,9 +2827,9 @@ class OAuth2ProxySpec(ServiceSpec):
                 + ', '.join(missing_required_fields)
                 + '.'
             )
-        self._validate_non_empty_string(self.provider_display_name, "provider_display_name")
-        self._validate_non_empty_string(self.client_id, "client_id")
-        self._validate_non_empty_string(self.client_secret, "client_secret")
+        validate_non_empty_string(self.provider_display_name, "provider_display_name")
+        validate_non_empty_string(self.client_id, "client_id")
+        validate_non_empty_string(self.client_secret, "client_secret")
         self._validate_cookie_secret(self.cookie_secret)
         self._validate_url(self.oidc_issuer_url, "oidc_issuer_url")
         if self.redirect_url is not None:
@@ -2835,10 +2841,6 @@ class OAuth2ProxySpec(ServiceSpec):
         if self.https_address is not None:
             self._validate_https_address(self.https_address)
 
-    def _validate_non_empty_string(self, value: Optional[str], field_name: str) -> None:
-        if not value or not isinstance(value, str) or not value.strip():
-            raise SpecValidationError(f"Invalid {field_name}: Must be a non-empty string.")
-
     def _validate_url(self, url: Optional[str], field_name: str) -> None:
         from urllib.parse import urlparse
         try:
@@ -3655,8 +3657,7 @@ class TunedProfileSpec():
         if 'profile_name' not in spec:
             raise SpecValidationError('Tuned profile spec must include "profile_name" field')
         data['profile_name'] = spec['profile_name']
-        if not isinstance(data['profile_name'], str):
-            raise SpecValidationError('"profile_name" field must be a string')
+        validate_non_empty_string(data['profile_name'], "profile_name")
         if 'placement' in spec:
             data['placement'] = PlacementSpec.from_json(spec['placement'])
         if 'settings' in spec:
diff --git a/src/python-common/ceph/tests/test_service_spec.py b/src/python-common/ceph/tests/test_service_spec.py
index 92b86216686..5d470f7804a 100644
--- a/src/python-common/ceph/tests/test_service_spec.py
+++ b/src/python-common/ceph/tests/test_service_spec.py
@@ -21,6 +21,7 @@ from ceph.deployment.service_spec import (
     RGWSpec,
     ServiceSpec,
     YamlLiteralString,
+    TunedProfileSpec,
 )
 from ceph.deployment.drive_group import DriveGroupSpec
 from ceph.deployment.hostspec import SpecValidationError
@@ -1592,3 +1593,49 @@ spec:
 
     assert 'ssl_cert: |' in dumped
     assert 'ssl_key: |' in dumped
+
+# Tuned profile spec (e.g. ceph orch tuned-profile apply -i os-tune.spec)
+VALID_TUNED_PROFILE_SPEC = """
+profile_name: os-tune
+placement:
+  hosts:
+    - ceph-node-0
+    - ceph-node-1
+    - ceph-node-2
+"""
+
+EMPTY_PROFILE_NAME_SPEC = """
+profile_name: ''
+placement:
+  hosts:
+    - ceph-node-0
+    - ceph-node-1
+    - ceph-node-2
+"""
+
+MISSING_PROFILE_NAME_SPEC = """
+placement:
+  hosts:
+    - ceph-node-0
+    - ceph-node-1
+    - ceph-node-2
+"""
+
+
+@pytest.mark.parametrize("spec_yaml, expect_error, error_match", [
+    (EMPTY_PROFILE_NAME_SPEC, True, r'Invalid profile_name: Must be a non-empty string\.'),
+    (MISSING_PROFILE_NAME_SPEC, True, r'Tuned profile spec must include "profile_name" field'),
+    (VALID_TUNED_PROFILE_SPEC, False, None),
+])
+def test_tuned_profile_spec_profile_name_validation(spec_yaml, expect_error, error_match):
+    """Test TunedProfileSpec.from_json validation for profile_name (ceph orch tuned-profile apply -i <spec>)."""
+    data = yaml.safe_load(spec_yaml)
+    if expect_error:
+        with pytest.raises(SpecValidationError, match=error_match):
+            TunedProfileSpec.from_json(data)
+    else:
+        spec = TunedProfileSpec.from_json(data)
+        assert spec.profile_name == 'os-tune'
+        assert spec.placement is not None
+        # round-trip
+        assert TunedProfileSpec.from_json(spec.to_json()).profile_name == spec.profile_name

From 6260b33f1d226b6925f6242f5eeae5568619b411 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Tue, 2 Jun 2026 16:33:17 +0200
Subject: [PATCH 074/596] mgr/cephadm: Don't skip OSDs with non-empty
 osdspec_affinity

`ceph cephadm osd activate` calls `deploy_osd_daemons_for_existing_osds`
with a synthetic DriveGroupSpec where service_id=''. Commit fbe3a053
introduced an unconditional osdspec_affinity filter:

    if osd['tags']['ceph.osdspec_affinity'] != spec.service_id:
        continue

The fix is to only enforce the affinity check when spec.service_id is
non-empty. An empty service_id means the caller is osd activate, which
should adopt any existing OSD regardless of its affinity tag.

Fixes: https://tracker.ceph.com/issues/76979
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/cephadm/services/osd.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/cephadm/services/osd.py b/src/pybind/mgr/cephadm/services/osd.py
index a3d116d3c87..e2ca9a23835 100644
--- a/src/pybind/mgr/cephadm/services/osd.py
+++ b/src/pybind/mgr/cephadm/services/osd.py
@@ -146,7 +146,7 @@ class OSDService(CephService):
                 if osd['tags']['ceph.cluster_fsid'] != fsid:
                     logger.debug('mismatched fsid, skipping %s' % osd)
                     continue
-                if osd['tags']['ceph.osdspec_affinity'] != spec.service_id:
+                if spec.service_id and osd['tags']['ceph.osdspec_affinity'] != spec.service_id:
                     logger.debug('mismatched service id, skipping %s' % osd)
                     continue
                 if osd_id in before_osd_uuid_map and osd_id not in replace_osd_ids:

From b09f161916e696d2cb50401d4a486b8cdca20124 Mon Sep 17 00:00:00 2001
From: Kobi Ginon <kginon@redhat.com>
Date: Sun, 31 May 2026 20:22:24 +0300
Subject: [PATCH 075/596] cephadm: start rpcbind before NFS-Ganesha when NFSv3
 is enabled With Protocols including NFSv3, Ganesha 9.x on Rocky 10 needs a
 running portmapper to register NFSv3 on TCP. Start rpcbind from the container
 entrypoint only when ganesha.conf enables v3; skip for NFSv4-only configs.
 Fixes: https://tracker.ceph.com/issues/76981 Signed-off-by: Kobi Ginon
 <kginon@redhat.com>

---
 src/cephadm/cephadmlib/daemons/nfs.py | 52 ++++++++++++++++++-
 src/cephadm/tests/test_nfs.py         | 73 +++++++++++++++++++++++++--
 2 files changed, 120 insertions(+), 5 deletions(-)

diff --git a/src/cephadm/cephadmlib/daemons/nfs.py b/src/cephadm/cephadmlib/daemons/nfs.py
index 1783951a71f..61c30868135 100644
--- a/src/cephadm/cephadmlib/daemons/nfs.py
+++ b/src/cephadm/cephadmlib/daemons/nfs.py
@@ -28,7 +28,9 @@ class NFSGanesha(ContainerDaemonForm):
     """Defines a NFS-Ganesha container"""
 
     daemon_type = 'nfs'
-    entrypoint = '/usr/bin/ganesha.nfsd'
+    entrypoint = '/usr/local/scripts/ganesha-entrypoint.sh'
+    ganesha_binary = '/usr/bin/ganesha.nfsd'
+    entrypoint_script_name = 'ganesha-entrypoint.sh'
     daemon_args = ['-F', '-L', 'STDERR']
 
     required_files = ['ganesha.conf', 'idmap.conf']
@@ -88,6 +90,9 @@ class NFSGanesha(ContainerDaemonForm):
         mounts[os.path.join(data_dir, 'config')] = '/etc/ceph/ceph.conf:z'
         mounts[os.path.join(data_dir, 'keyring')] = '/etc/ceph/keyring:z'
         mounts[os.path.join(data_dir, 'etc/ganesha')] = '/etc/ganesha:z'
+        mounts[
+            os.path.join(data_dir, self.entrypoint_script_name)
+        ] = self.entrypoint
         if self.rgw:
             cluster = self.rgw.get('cluster', 'ceph')
             rgw_user = self.rgw.get('user', 'admin')
@@ -118,7 +123,7 @@ class NFSGanesha(ContainerDaemonForm):
                 ctx.container_engine.path,
                 'exec',
                 container_id,
-                NFSGanesha.entrypoint,
+                NFSGanesha.ganesha_binary,
                 '-v',
             ],
             verbosity=CallVerbosity.QUIET,
@@ -168,6 +173,42 @@ class NFSGanesha(ContainerDaemonForm):
         # type: () -> List[str]
         return self.daemon_args + self.extra_args
 
+    @staticmethod
+    def ganesha_conf_text(conf: Union[str, List[str]]) -> str:
+        if isinstance(conf, list):
+            return '\n'.join(conf)
+        return conf
+
+    @staticmethod
+    def nfsv3_enabled_in_ganesha_conf(conf: Union[str, List[str]]) -> bool:
+        """Return True when ganesha.conf enables NFSv3 (Protocols includes 3)."""
+        text = NFSGanesha.ganesha_conf_text(conf)
+        match = re.search(r'Protocols\s*=\s*([^;]+)', text, re.MULTILINE)
+        if not match:
+            # No Protocols line (e.g. minimal test stubs): keep legacy behavior.
+            return True
+        protocols = match.group(1)
+        return bool(re.search(r'(?:^|[,\s])3(?:[,\s]|$)', protocols))
+
+    @staticmethod
+    def ganesha_entrypoint_script(nfsv3: bool = True) -> str:
+        # NFSv3 registration with SunRPC requires a running portmapper.
+        # The image installs rpcbind but cephadm previously started only
+        # ganesha.nfsd, which fails on Rocky 10 / Ganesha 9.x with
+        # "Cannot register NFS V3 on TCP" when rpcbind is not up.
+        rpcbind_block = ''
+        if nfsv3:
+            rpcbind_block = """if command -v rpcbind >/dev/null 2>&1; then
+    if ! rpcinfo -p >/dev/null 2>&1; then
+        rpcbind
+    fi
+fi
+"""
+        return f"""#!/bin/bash
+set -e
+{rpcbind_block}exec /usr/bin/ganesha.nfsd "$@"
+"""
+
     def create_daemon_dirs(self, data_dir, uid, gid):
         # type: (str, int, int) -> None
         """Create files under the container data dir"""
@@ -196,6 +237,13 @@ class NFSGanesha(ContainerDaemonForm):
         populate_files(config_dir, config_files, uid, gid)
         populate_files(tls_dir, tls_files, uid, gid)
 
+        ganesha_conf = self.files.get('ganesha.conf', '')
+        nfsv3 = self.nfsv3_enabled_in_ganesha_conf(ganesha_conf)
+        entrypoint_path = os.path.join(data_dir, self.entrypoint_script_name)
+        with write_new(entrypoint_path, owner=(uid, gid)) as f:
+            f.write(self.ganesha_entrypoint_script(nfsv3=nfsv3))
+        os.chmod(entrypoint_path, 0o700)
+
         # write the RGW keyring
         if self.rgw:
             keyring_path = os.path.join(data_dir, 'keyring.rgw')
diff --git a/src/cephadm/tests/test_nfs.py b/src/cephadm/tests/test_nfs.py
index 1b468516e67..8c0676482cc 100644
--- a/src/cephadm/tests/test_nfs.py
+++ b/src/cephadm/tests/test_nfs.py
@@ -119,10 +119,14 @@ def test_nfsganesha_container_mounts():
             good_nfs_json(),
         )
         cmounts = nfsg._get_container_mounts("/var/tmp")
-        assert len(cmounts) == 3
+        assert len(cmounts) == 4
         assert cmounts["/var/tmp/config"] == "/etc/ceph/ceph.conf:z"
         assert cmounts["/var/tmp/keyring"] == "/etc/ceph/keyring:z"
         assert cmounts["/var/tmp/etc/ganesha"] == "/etc/ganesha:z"
+        assert (
+            cmounts["/var/tmp/ganesha-entrypoint.sh"]
+            == "/usr/local/scripts/ganesha-entrypoint.sh"
+        )
 
     with with_cephadm_ctx([]) as ctx:
         nfsg = _cephadm.NFSGanesha(
@@ -132,7 +136,7 @@ def test_nfsganesha_container_mounts():
             nfs_json(pool=True, files=True, rgw=True),
         )
         cmounts = nfsg._get_container_mounts("/var/tmp")
-        assert len(cmounts) == 4
+        assert len(cmounts) == 5
         assert cmounts["/var/tmp/config"] == "/etc/ceph/ceph.conf:z"
         assert cmounts["/var/tmp/keyring"] == "/etc/ceph/keyring:z"
         assert cmounts["/var/tmp/etc/ganesha"] == "/etc/ganesha:z"
@@ -212,6 +216,52 @@ def test_nfsganesha_get_daemon_args():
         assert args == ["-F", "-L", "STDERR"]
 
 
+@pytest.mark.parametrize(
+    'conf,expected',
+    [
+        ('Protocols = 3, 4;', True),
+        ('Protocols = 4, 3;', True),
+        ('Protocols = 4;', False),
+        ('Protocols = 4, nfsrdma, rpcrdma;', False),
+        ('', True),
+    ],
+)
+def test_nfsv3_enabled_in_ganesha_conf(conf, expected):
+    assert _cephadm.NFSGanesha.nfsv3_enabled_in_ganesha_conf(conf) is expected
+
+
+def test_nfsganesha_entrypoint_script_nfsv3():
+    script = _cephadm.NFSGanesha.ganesha_entrypoint_script(nfsv3=True)
+    assert 'rpcbind' in script
+    assert 'exec /usr/bin/ganesha.nfsd "$@"' in script
+
+
+def test_nfsganesha_entrypoint_script_v4_only():
+    script = _cephadm.NFSGanesha.ganesha_entrypoint_script(nfsv3=False)
+    assert 'rpcbind' not in script
+    assert 'exec /usr/bin/ganesha.nfsd "$@"' in script
+
+
+def test_nfsganesha_entrypoint_script_from_conf():
+    conf_v3 = '\n'.join(
+        [
+            'NFS_CORE_PARAM {',
+            '        Protocols = 3, 4;',
+            '}',
+        ]
+    )
+    script = _cephadm.NFSGanesha.ganesha_entrypoint_script(
+        nfsv3=_cephadm.NFSGanesha.nfsv3_enabled_in_ganesha_conf(conf_v3),
+    )
+    assert 'rpcbind' in script
+
+    conf_v4 = 'NFS_CORE_PARAM { Protocols = 4; }'
+    script = _cephadm.NFSGanesha.ganesha_entrypoint_script(
+        nfsv3=_cephadm.NFSGanesha.nfsv3_enabled_in_ganesha_conf(conf_v4),
+    )
+    assert 'rpcbind' not in script
+
+
 @mock.patch("cephadm.logger")
 def test_nfsganesha_create_daemon_dirs(_logger, cephadm_fs):
     with with_cephadm_ctx([]) as ctx:
@@ -225,7 +275,24 @@ def test_nfsganesha_create_daemon_dirs(_logger, cephadm_fs):
             nfsg.create_daemon_dirs("/var/tmp", 45, 54)
         cephadm_fs.create_dir("/var/tmp")
         nfsg.create_daemon_dirs("/var/tmp", 45, 54)
-        # TODO: make assertions about the dirs created
+        with open("/var/tmp/ganesha-entrypoint.sh") as f:
+            assert 'rpcbind' in f.read()
+
+        nfsg_v4 = _cephadm.NFSGanesha(
+            ctx,
+            SAMPLE_UUID,
+            "fred",
+            {
+                'pool': 'party',
+                'files': {
+                    'ganesha.conf': 'NFS_CORE_PARAM { Protocols = 4; }',
+                    'idmap.conf': '',
+                },
+            },
+        )
+        nfsg_v4.create_daemon_dirs("/var/tmp", 45, 54)
+        with open("/var/tmp/ganesha-entrypoint.sh") as f:
+            assert 'rpcbind' not in f.read()
 
 
 @mock.patch("cephadm.logger")

From 2690e2a2cb8a98625be35127f24a57a89f0692f1 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 21 Jan 2026 20:11:29 +0000
Subject: [PATCH 076/596] rgw/http: introduce RGWEndpoint to carry url +
 connect_to (refactor)

This commit is meant to be non-functional.

Replace the "URL as plain string" plumbing with an RGWEndpoint value type
that carries:

  - the URL string, and
  - optional per-request connect_to data for libcurl,
  - it also encapsulates related functions/methods

This commit is intended to be non-functional: behavior should remain unchanged
until callers populate connect_to.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/driver/rados/rgw_sal_rados.cc |   2 +-
 src/rgw/rgw_http_client.cc            |  17 ++--
 src/rgw/rgw_http_client.h             |  66 ++++++++++++----
 src/rgw/rgw_keystone.h                |   4 +-
 src/rgw/rgw_opa.cc                    |   2 +-
 src/rgw/rgw_rest_client.cc            |  43 +++++-----
 src/rgw/rgw_rest_client.h             |  42 +++++-----
 src/rgw/rgw_rest_conn.cc              | 109 ++++++++++++++------------
 src/rgw/rgw_rest_conn.h               |  14 ++--
 src/rgw/services/svc_zone.cc          |   6 +-
 src/rgw/services/svc_zone.h           |   2 +-
 11 files changed, 176 insertions(+), 131 deletions(-)

diff --git a/src/rgw/driver/rados/rgw_sal_rados.cc b/src/rgw/driver/rados/rgw_sal_rados.cc
index 841ac0a6ec0..1683fb71f1c 100644
--- a/src/rgw/driver/rados/rgw_sal_rados.cc
+++ b/src/rgw/driver/rados/rgw_sal_rados.cc
@@ -5398,7 +5398,7 @@ bool RadosZone::is_writeable()
 bool RadosZone::get_redirect_endpoint(std::string* endpoint)
 {
   if (local_zone)
-    return store->svc()->zone->get_redirect_zone_endpoint(endpoint);
+    return store->svc()->zone->get_redirect_zone_endpoint_url(endpoint);
 
   endpoint = &rgw_zone.redirect_zone;
   return true;
diff --git a/src/rgw/rgw_http_client.cc b/src/rgw/rgw_http_client.cc
index dc798943ee4..4cf35d09f26 100644
--- a/src/rgw/rgw_http_client.cc
+++ b/src/rgw/rgw_http_client.cc
@@ -294,7 +294,7 @@ void RGWIOProvider::assign_io(RGWIOIDProvider& io_id_provider, int io_type)
 
 RGWHTTPClient::RGWHTTPClient(CephContext *cct,
                              const string& _method,
-                             const string& _url)
+                             const RGWEndpoint& _endpoint)
     : NoDoutPrefix(cct, dout_subsys),
       has_send_len(false),
       http_status(HTTP_STATUS_NOSTATUS),
@@ -302,14 +302,14 @@ RGWHTTPClient::RGWHTTPClient(CephContext *cct,
       verify_ssl(cct->_conf->rgw_verify_ssl),
       cct(cct),
       method(_method),
-      url_orig(_url),
-      url(_url) {
+      endpoint_orig(_endpoint),
+      endpoint(_endpoint) {
   init();
 }
 
 std::ostream& RGWHTTPClient::gen_prefix(std::ostream& out) const
 {
-  out << "http_client[" << method << "/" << url << "]";
+  out << "http_client[" << method << "/" << endpoint.get_url() << "]";
   return out;
 }
 
@@ -326,6 +326,8 @@ void RGWHTTPClient::init()
     }
   }
 
+  const string& url = endpoint.get_url();
+
   auto pos = url.find("://");
   if (pos == string::npos) {
     host = url;
@@ -551,7 +553,7 @@ int RGWHTTPClient::process(const DoutPrefixProvider* dpp, optional_yield y)
 string RGWHTTPClient::to_str()
 {
   string method_str = (method.empty() ? "<no-method>" : method);
-  string url_str = (url.empty() ? "<no-url>" : url);
+  string url_str = (endpoint.get_url().empty() ? "<no-url>" : endpoint.get_url());
   return method_str + " " + url_str;
 }
 
@@ -577,14 +579,15 @@ int RGWHTTPClient::init_request(rgw_http_req_data *_req_data)
 
   CURL *easy_handle = req_data->get_easy_handle();
 
-  dout(20) << "sending request to " << url << dendl;
+  dout(20) << "sending request to url=" << endpoint.get_url()
+    << " connect_to=" << endpoint.get_connect_to() << dendl;
 
   curl_slist *h = headers_to_slist(headers);
 
   req_data->h = h;
 
   curl_easy_setopt(easy_handle, CURLOPT_CUSTOMREQUEST, method.c_str());
-  curl_easy_setopt(easy_handle, CURLOPT_URL, url.c_str());
+  curl_easy_setopt(easy_handle, CURLOPT_URL, endpoint.get_url().c_str());
   curl_easy_setopt(easy_handle, CURLOPT_NOPROGRESS, 1L);
   curl_easy_setopt(easy_handle, CURLOPT_NOSIGNAL, 1L);
   curl_easy_setopt(easy_handle, CURLOPT_HEADERFUNCTION, receive_http_header);
diff --git a/src/rgw/rgw_http_client.h b/src/rgw/rgw_http_client.h
index 37b3991297a..6eaf1844401 100644
--- a/src/rgw/rgw_http_client.h
+++ b/src/rgw/rgw_http_client.h
@@ -20,6 +20,41 @@ void rgw_http_client_cleanup();
 struct rgw_http_req_data;
 class RGWHTTPManager;
 
+struct RGWEndpoint {
+private:
+  std::string url;
+  std::string connect_to;
+
+public:
+  RGWEndpoint() = default;
+
+  RGWEndpoint(const char* u) : RGWEndpoint(std::string(u)) {}
+
+  RGWEndpoint(std::string u, std::string c = {})
+    : url(std::move(u)), connect_to(std::move(c)) {}
+
+  RGWEndpoint with_url(std::string new_url) const {
+    RGWEndpoint e = *this;
+    e.set_url(std::move(new_url));
+    return e;
+  }
+
+  void set_url(const std::string& _url) { url = _url; }
+  const std::string& get_url() const { return url; }
+
+  void set_connect_to(const std::string& _connect_to) { connect_to = _connect_to; }
+  const std::string& get_connect_to() const { return connect_to; }
+
+  void add_trailing_slash() {
+    if (! url.empty() && url.back() != '/')
+      append_to_url("/");
+  }
+
+  void append_to_url(const std::string& suffix) {
+    url.append(suffix);
+  }
+};
+
 class RGWHTTPClient : public RGWIOProvider,
                       public NoDoutPrefix
 {
@@ -47,13 +82,12 @@ class RGWHTTPClient : public RGWIOProvider,
 
   std::atomic<unsigned> stopped { 0 };
 
-
 protected:
   CephContext *cct;
 
   std::string method;
-  std::string url_orig;
-  std::string url;
+  RGWEndpoint endpoint_orig;
+  RGWEndpoint endpoint;
 
   std::string protocol;
   std::string host;
@@ -116,7 +150,7 @@ public:
   virtual ~RGWHTTPClient();
   explicit RGWHTTPClient(CephContext *cct,
                          const std::string& _method,
-                         const std::string& _url);
+                         const RGWEndpoint& _endpoint);
 
   std::ostream& gen_prefix(std::ostream& out) const override;
 
@@ -170,12 +204,16 @@ public:
 
   int get_req_retcode();
 
-  void set_url(const std::string& _url) {
-    url = _url;
+  void set_endpoint(const RGWEndpoint& _endpoint) {
+    endpoint = _endpoint;
   }
 
-  const std::string& get_url_orig() const {
-    return url_orig;
+  void set_url(const std::string& _url) {
+    endpoint.set_url(_url);
+  }
+
+  const RGWEndpoint& get_endpoint_orig() const {
+    return endpoint_orig;
   }
 
   void set_method(const std::string& _method) {
@@ -212,9 +250,9 @@ public:
 
   RGWHTTPHeadersCollector(CephContext * const cct,
                           const std::string& method,
-                          const std::string& url,
+                          const RGWEndpoint& endpoint,
                           const header_spec_t &relevant_headers)
-    : RGWHTTPClient(cct, method, url),
+    : RGWHTTPClient(cct, method, endpoint),
       relevant_headers(relevant_headers) {
   }
 
@@ -244,21 +282,21 @@ class RGWHTTPTransceiver : public RGWHTTPHeadersCollector {
 public:
   RGWHTTPTransceiver(CephContext * const cct,
                      const std::string& method,
-                     const std::string& url,
+                     const RGWEndpoint& endpoint,
                      bufferlist * const read_bl,
                      const header_spec_t intercept_headers = {})
-    : RGWHTTPHeadersCollector(cct, method, url, intercept_headers),
+    : RGWHTTPHeadersCollector(cct, method, endpoint, intercept_headers),
       read_bl(read_bl),
       post_data_index(0) {
   }
 
   RGWHTTPTransceiver(CephContext * const cct,
                      const std::string& method,
-                     const std::string& url,
+                     const RGWEndpoint& endpoint,
                      bufferlist * const read_bl,
                      const bool verify_ssl,
                      const header_spec_t intercept_headers = {})
-    : RGWHTTPHeadersCollector(cct, method, url, intercept_headers),
+    : RGWHTTPHeadersCollector(cct, method, endpoint, intercept_headers),
       read_bl(read_bl),
       post_data_index(0) {
     set_verify_ssl(verify_ssl);
diff --git a/src/rgw/rgw_keystone.h b/src/rgw/rgw_keystone.h
index 2dc17dfeabe..e183b9d3965 100644
--- a/src/rgw/rgw_keystone.h
+++ b/src/rgw/rgw_keystone.h
@@ -89,9 +89,9 @@ public:
   public:
     RGWKeystoneHTTPTransceiver(CephContext * const cct,
                                const std::string& method,
-                               const std::string& url,
+                               const RGWEndpoint& endpoint,
                                bufferlist * const token_body_bl)
-      : RGWHTTPTransceiver(cct, method, url, token_body_bl,
+      : RGWHTTPTransceiver(cct, method, endpoint, token_body_bl,
                            cct->_conf->rgw_keystone_verify_ssl,
                            { "X-Subject-Token" }) {
     }
diff --git a/src/rgw/rgw_opa.cc b/src/rgw/rgw_opa.cc
index c096fd0bd37..6840227cffe 100644
--- a/src/rgw/rgw_opa.cc
+++ b/src/rgw/rgw_opa.cc
@@ -28,7 +28,7 @@ int rgw_opa_authorize(RGWOp *& op,
 
   int ret;
   bufferlist bl;
-  RGWHTTPTransceiver req(s->cct, "POST", opa_url.c_str(), &bl);
+  RGWHTTPTransceiver req(s->cct, "POST", opa_url, &bl);
 
   /* set required headers for OPA request */
   req.append_header("X-Auth-Token", opa_token);
diff --git a/src/rgw/rgw_rest_client.cc b/src/rgw/rgw_rest_client.cc
index 8cd692aa9dc..9317587ac78 100644
--- a/src/rgw/rgw_rest_client.cc
+++ b/src/rgw/rgw_rest_client.cc
@@ -425,7 +425,7 @@ auto RGWRESTSimpleRequest::forward_request(const DoutPrefixProvider *dpp, const
   string params_str;
   get_params_str(new_info.args.get_params(), params_str);
 
-  string new_url = url;
+  string new_url = endpoint.get_url();
   string& resource = new_info.request_uri;
   string new_resource = resource;
   if (new_url[new_url.size() - 1] == '/' && resource[0] == '/') {
@@ -446,7 +446,7 @@ auto RGWRESTSimpleRequest::forward_request(const DoutPrefixProvider *dpp, const
   }
 
   method = new_info.method;
-  url = new_url;
+  endpoint.set_url(new_url);
 
   std::ignore = process(dpp, y);
 
@@ -564,7 +564,7 @@ RGWRESTGenerateHTTPHeaders::RGWRESTGenerateHTTPHeaders(CephContext *_cct, RGWEnv
 }
 
 void RGWRESTGenerateHTTPHeaders::init(const string& _method, const string& host,
-                                      const string& resource_prefix, const string& _url,
+                                      const string& resource_prefix, const RGWEndpoint& _endpoint,
                                       const string& resource, const param_vec_t& params,
                                       std::optional<string> api_name)
 {
@@ -581,7 +581,7 @@ void RGWRESTGenerateHTTPHeaders::init(const string& _method, const string& host,
                           url_encode(iter->second, encode_slash));
   }
 
-  url = _url + resource + params_str;
+  endpoint = _endpoint.with_url(_endpoint.get_url() + resource + params_str);
 
   const std::string date_str = get_gmt_date_str();
   new_env->set("HTTP_DATE", date_str.c_str());
@@ -685,32 +685,29 @@ void RGWRESTStreamS3PutObj::send_init(const rgw_obj& obj)
 {
   string resource_str;
   string resource;
-  string new_url = url;
+  RGWEndpoint new_endpoint = endpoint;
   string new_host = host;
 
    const auto& bucket_name = obj.bucket.name;
 
   if (host_style == VirtualStyle) {
     resource_str = obj.get_oid();
-
-    new_url = protocol + "://" + bucket_name + "." + host;
+    new_endpoint.set_url(protocol + "://" + bucket_name + "." + host);
     new_host = bucket_name + "." + new_host;
   } else {
     resource_str = bucket_name + "/" + obj.get_oid();
   }
+  new_endpoint.add_trailing_slash();
 
   //do not encode slash in object key name
   url_encode(resource_str, resource, false);
 
-  if (new_url[new_url.size() - 1] != '/')
-    new_url.append("/");
-
-  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource << " , new_host = " << new_host << " , new_url = " << new_url  << dendl;
+  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource << " , new_host = " << new_host << " , new_url = " << new_endpoint.get_url()  << dendl;
 
   method = "PUT";
-  headers_gen.init(method, new_host, resource_prefix, new_url, resource, params, api_name);
+  headers_gen.init(method, new_host, resource_prefix, new_endpoint, resource, params, api_name);
 
-  url = headers_gen.get_url();
+  endpoint = headers_gen.get_endpoint();
 }
 
 void RGWRESTStreamS3PutObj::send_ready(const DoutPrefixProvider *dpp, RGWAccessKey& key, map<string, bufferlist>& rgw_attrs)
@@ -825,10 +822,10 @@ int RGWRESTStreamRWRequest::send_prepare(const DoutPrefixProvider *dpp, RGWAcces
 int RGWRESTStreamRWRequest::do_send_prepare(const DoutPrefixProvider *dpp, RGWAccessKey *key, map<string, string>& extra_headers, const string& resource,
                                          bufferlist *send_data)
 {
-  string new_url = url;
-  if (!new_url.empty() && new_url.back() != '/')
-    new_url.append("/");
-  
+  RGWEndpoint new_endpoint = endpoint;
+
+  new_endpoint.add_trailing_slash();
+
   string new_resource;
   string bucket_name;
   string old_resource = resource;
@@ -849,7 +846,7 @@ int RGWRESTStreamRWRequest::do_send_prepare(const DoutPrefixProvider *dpp, RGWAc
   }
 
   if (host_style == VirtualStyle) {
-    new_url = protocol + "://" + bucket_name + "." + host;
+    new_endpoint.set_url(protocol + "://" + bucket_name + "." + host);
     if(pos == string::npos) {
       new_resource = "";
     } else {
@@ -857,15 +854,13 @@ int RGWRESTStreamRWRequest::do_send_prepare(const DoutPrefixProvider *dpp, RGWAc
     }
     new_host = bucket_name + "." + host;
   }
-
-  if (new_url[new_url.size() - 1] != '/')
-    new_url.append("/");
+  new_endpoint.add_trailing_slash();
 
   headers_gen.emplace(cct, &new_env, &new_info);
 
-  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource << " , new_host = " << new_host << " , new_url = " << new_url  << " , new_resource = " << new_resource << dendl;
+  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource << " , new_host = " << new_host << " , new_url = " << new_endpoint.get_url()  << " , new_resource = " << new_resource << dendl;
 
-  headers_gen->init(method, new_host, resource_prefix, new_url, new_resource, params, api_name);
+  headers_gen->init(method, new_host, resource_prefix, new_endpoint, new_resource, params, api_name);
 
   headers_gen->set_http_attrs(extra_headers);
 
@@ -880,7 +875,7 @@ int RGWRESTStreamRWRequest::do_send_prepare(const DoutPrefixProvider *dpp, RGWAc
   }
 
   method = new_info.method;
-  url = headers_gen->get_url();
+  endpoint = headers_gen->get_endpoint();
 
   return 0;
 }
diff --git a/src/rgw/rgw_rest_client.h b/src/rgw/rgw_rest_client.h
index 2d30e8313f6..e9458f44f7e 100644
--- a/src/rgw/rgw_rest_client.h
+++ b/src/rgw/rgw_rest_client.h
@@ -29,8 +29,8 @@ protected:
   void get_params_str(std::map<std::string, std::string>& extra_args, std::string& dest);
 
 public:
-  RGWHTTPSimpleRequest(CephContext *_cct, const std::string& _method, const std::string& _url,
-                       param_vec_t *_headers, param_vec_t *_params) : RGWHTTPClient(_cct, _method, _url),
+  RGWHTTPSimpleRequest(CephContext *_cct, const std::string& _method, const RGWEndpoint& _endpoint,
+                       param_vec_t *_headers, param_vec_t *_params) : RGWHTTPClient(_cct, _method, _endpoint),
                 http_status(0), status(0),
                 send_iter(NULL),
                 max_response(0) {
@@ -63,9 +63,9 @@ public:
 class RGWRESTSimpleRequest : public RGWHTTPSimpleRequest {
   std::optional<std::string> api_name;
 public:
-  RGWRESTSimpleRequest(CephContext *_cct, const std::string& _method, const std::string& _url,
+  RGWRESTSimpleRequest(CephContext *_cct, const std::string& _method, const RGWEndpoint& _endpoint,
                        param_vec_t *_headers, param_vec_t *_params,
-                       std::optional<std::string> _api_name) : RGWHTTPSimpleRequest(_cct, _method, _url, _headers, _params), api_name(_api_name) {}
+                       std::optional<std::string> _api_name) : RGWHTTPSimpleRequest(_cct, _method, _endpoint, _headers, _params), api_name(_api_name) {}
 
   // return the http status of the response or an error code from the transport
   auto forward_request(const DoutPrefixProvider *dpp, const RGWAccessKey& key, const req_info& info, size_t max_response, bufferlist *inbl, bufferlist *outbl, optional_yield y, std::string service="")
@@ -86,13 +86,13 @@ class RGWRESTGenerateHTTPHeaders : public DoutPrefix {
   std::string region;
   std::string service;
   std::string method;
-  std::string url;
+  RGWEndpoint endpoint;
   std::string resource;
 
 public:
   RGWRESTGenerateHTTPHeaders(CephContext *_cct, RGWEnv *_env, req_info *_info);
   void init(const std::string& method, const std::string& host,
-            const std::string& resource_prefix, const std::string& url,
+            const std::string& resource_prefix, const RGWEndpoint& endpoint,
             const std::string& resource, const param_vec_t& params,
             std::optional<std::string> api_name);
   void set_extra_headers(const std::map<std::string, std::string>& extra_headers);
@@ -101,7 +101,7 @@ public:
   void set_policy(const RGWAccessControlPolicy& policy);
   int sign(const DoutPrefixProvider *dpp, RGWAccessKey& key, const bufferlist *opt_content);
 
-  const std::string& get_url() { return url; }
+  const RGWEndpoint& get_endpoint() { return endpoint; }
 };
 
 class RGWHTTPStreamRWRequest : public RGWHTTPSimpleRequest {
@@ -145,11 +145,11 @@ public:
       }
   };
 
-  RGWHTTPStreamRWRequest(CephContext *_cct, const std::string& _method, const std::string& _url,
-                         param_vec_t *_headers, param_vec_t *_params) : RGWHTTPSimpleRequest(_cct, _method, _url, _headers, _params) {
+  RGWHTTPStreamRWRequest(CephContext *_cct, const std::string& _method, const RGWEndpoint& _endpoint,
+                         param_vec_t *_headers, param_vec_t *_params) : RGWHTTPSimpleRequest(_cct, _method, _endpoint, _headers, _params) {
   }
-  RGWHTTPStreamRWRequest(CephContext *_cct, const std::string& _method, const std::string& _url, ReceiveCB *_cb,
-                         param_vec_t *_headers, param_vec_t *_params) : RGWHTTPSimpleRequest(_cct, _method, _url, _headers, _params),
+  RGWHTTPStreamRWRequest(CephContext *_cct, const std::string& _method, const RGWEndpoint& _endpoint, ReceiveCB *_cb,
+                         param_vec_t *_headers, param_vec_t *_params) : RGWHTTPSimpleRequest(_cct, _method, _endpoint, _headers, _params),
 									cb(_cb) {
   }
   virtual ~RGWHTTPStreamRWRequest() override {}
@@ -192,10 +192,10 @@ protected:
   std::optional<std::string> api_name;
   HostStyle host_style;
 public:
-  RGWRESTStreamRWRequest(CephContext *_cct, const std::string& _method, const std::string& _url, RGWHTTPStreamRWRequest::ReceiveCB *_cb,
+  RGWRESTStreamRWRequest(CephContext *_cct, const std::string& _method, const RGWEndpoint& _endpoint, RGWHTTPStreamRWRequest::ReceiveCB *_cb,
                          param_vec_t *_headers, param_vec_t *_params,
                          std::optional<std::string> _api_name, HostStyle _host_style = PathStyle) :
-                         RGWHTTPStreamRWRequest(_cct, _method, _url, _cb, _headers, _params),
+                         RGWHTTPStreamRWRequest(_cct, _method, _endpoint, _cb, _headers, _params),
                          new_info(_cct, &new_env),
                          api_name(_api_name), host_style(_host_style) {
   }
@@ -216,24 +216,24 @@ private:
 
 class RGWRESTStreamReadRequest : public RGWRESTStreamRWRequest {
 public:
-  RGWRESTStreamReadRequest(CephContext *_cct, const std::string& _url, ReceiveCB *_cb, param_vec_t *_headers,
+  RGWRESTStreamReadRequest(CephContext *_cct, const RGWEndpoint& _endpoint, ReceiveCB *_cb, param_vec_t *_headers,
 		param_vec_t *_params, std::optional<std::string> _api_name,
-                HostStyle _host_style = PathStyle) : RGWRESTStreamRWRequest(_cct, "GET", _url, _cb, _headers, _params, _api_name, _host_style) {}
+                HostStyle _host_style = PathStyle) : RGWRESTStreamRWRequest(_cct, "GET", _endpoint, _cb, _headers, _params, _api_name, _host_style) {}
 };
 
 class RGWRESTStreamHeadRequest : public RGWRESTStreamRWRequest {
 public:
-  RGWRESTStreamHeadRequest(CephContext *_cct, const std::string& _url, ReceiveCB *_cb, param_vec_t *_headers,
-		param_vec_t *_params, std::optional<std::string> _api_name) : RGWRESTStreamRWRequest(_cct, "HEAD", _url, _cb, _headers, _params, _api_name) {}
+  RGWRESTStreamHeadRequest(CephContext *_cct, const RGWEndpoint& _endpoint, ReceiveCB *_cb, param_vec_t *_headers,
+		param_vec_t *_params, std::optional<std::string> _api_name) : RGWRESTStreamRWRequest(_cct, "HEAD", _endpoint, _cb, _headers, _params, _api_name) {}
 };
 
 class RGWRESTStreamSendRequest : public RGWRESTStreamRWRequest {
 public:
   RGWRESTStreamSendRequest(CephContext *_cct, const std::string& method,
-                           const std::string& _url,
+                           const RGWEndpoint& _endpoint,
                            ReceiveCB *_cb, param_vec_t *_headers, param_vec_t *_params,
                            std::optional<std::string> _api_name,
-                           HostStyle _host_style = PathStyle) : RGWRESTStreamRWRequest(_cct, method, _url, _cb, _headers, _params, _api_name, _host_style) {}
+                           HostStyle _host_style = PathStyle) : RGWRESTStreamRWRequest(_cct, method, _endpoint, _cb, _headers, _params, _api_name, _host_style) {}
 };
 
 class RGWRESTStreamS3PutObj : public RGWHTTPStreamRWRequest {
@@ -244,9 +244,9 @@ class RGWRESTStreamS3PutObj : public RGWHTTPStreamRWRequest {
   req_info new_info;
   RGWRESTGenerateHTTPHeaders headers_gen;
 public:
-  RGWRESTStreamS3PutObj(CephContext *_cct, const std::string& _method, const std::string& _url, param_vec_t *_headers,
+  RGWRESTStreamS3PutObj(CephContext *_cct, const std::string& _method, const RGWEndpoint& _endpoint, param_vec_t *_headers,
 		param_vec_t *_params, std::optional<std::string> _api_name,
-                HostStyle _host_style) : RGWHTTPStreamRWRequest(_cct, _method, _url, nullptr, _headers, _params),
+                HostStyle _host_style) : RGWHTTPStreamRWRequest(_cct, _method, _endpoint, nullptr, _headers, _params),
                 api_name(_api_name), host_style(_host_style),
                 out_cb(NULL), new_info(cct, &new_env), headers_gen(_cct, &new_env, &new_info) {}
   ~RGWRESTStreamS3PutObj() override;
diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index aab716e47a4..0f32cc201f1 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -78,7 +78,7 @@ RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
   return *this;
 }
 
-int RGWRESTConn::get_url(string& endpoint)
+int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
 {
   if (endpoints.empty()) {
     ldout(cct, 0) << "ERROR: endpoints not configured for upstream zone" << dendl;
@@ -88,15 +88,17 @@ int RGWRESTConn::get_url(string& endpoint)
   size_t num = 0;
   while (num < endpoints.size()) {
     int i = ++counter;
-    endpoint = endpoints[i % endpoints.size()];
 
-    if (endpoints_status.find(endpoint) == endpoints_status.end()) {
-      ldout(cct, 1) << "ERROR: missing status for endpoint " << endpoint << dendl;
+    const string& ep_url = endpoints[i % endpoints.size()];
+    endpoint.set_url(ep_url);
+
+    if (endpoints_status.find(ep_url) == endpoints_status.end()) {
+      ldout(cct, 1) << "ERROR: missing status for endpoint " << ep_url << dendl;
       num++;
       continue;
     }
 
-    const auto& upd_time = endpoints_status[endpoint].load();
+    const auto& upd_time = endpoints_status[ep_url].load();
 
     if (ceph::real_clock::is_zero(upd_time)) {
       break;
@@ -104,15 +106,15 @@ int RGWRESTConn::get_url(string& endpoint)
 
     auto diff = ceph::to_seconds<double>(ceph::real_clock::now() - upd_time);
 
-    ldout(cct, 20) << "endpoint url=" << endpoint
+    ldout(cct, 20) << "endpoint url=" << ep_url
                    << " last endpoint status update time="
                    << ceph::real_clock::to_double(upd_time)
                    << " diff=" << diff << dendl;
 
     static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
     if (diff >= CONN_STATUS_EXPIRE_SECS) {
-      endpoints_status[endpoint].store(ceph::real_clock::zero());
-      ldout(cct, 10) << "endpoint " << endpoint << " unconnectable status expired. mark it connectable" << dendl;
+      endpoints_status[ep_url].store(ceph::real_clock::zero());
+      ldout(cct, 10) << "endpoint " << endpoint.get_url() << " unconnectable status expired. mark it connectable" << dendl;
       break;
     }
     num++;
@@ -122,29 +124,32 @@ int RGWRESTConn::get_url(string& endpoint)
     ldout(cct, 5) << "ERROR: no valid endpoint" << dendl;
     return -EINVAL;
   }
-  ldout(cct, 20) << "get_url picked endpoint=" << endpoint << dendl;
+  ldout(cct, 20) << "get_endpoint picked url=" << endpoint.get_url()
+    << " connect_to=" << endpoint.get_connect_to() << dendl;
 
   return 0;
 }
 
-string RGWRESTConn::get_url()
+RGWEndpoint RGWRESTConn::get_endpoint()
 {
-  string endpoint;
-  get_url(endpoint);
+  RGWEndpoint endpoint;
+  get_endpoint(endpoint);
   return endpoint;
 }
 
-void RGWRESTConn::set_url_unconnectable(const std::string& endpoint)
+void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
 {
-  if (endpoint.empty() || endpoints_status.find(endpoint) == endpoints_status.end()) {
+  const string& url = endpoint.get_url();
+
+  if (url.empty() || endpoints_status.find(url) == endpoints_status.end()) {
     ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status. endpoint="
-                  << endpoint << dendl;
+                  << url << dendl;
     return;
   }
 
-  endpoints_status[endpoint].store(ceph::real_clock::now());
+  endpoints_status[url].store(ceph::real_clock::now());
 
-  ldout(cct, 10) << "set endpoint unconnectable. url=" << endpoint << dendl;
+  ldout(cct, 10) << "set endpoint unconnectable. url=" << url << dendl;
 }
 
 void RGWRESTConn::populate_params(param_vec_t& params, const rgw_owner* uid, const string& zonegroup)
@@ -160,21 +165,22 @@ auto RGWRESTConn::forward(const DoutPrefixProvider *dpp, const rgw_owner& uid,
 {
   static constexpr int NUM_ENPOINT_IOERROR_RETRIES = 20;
   for (int tries = 0; tries < NUM_ENPOINT_IOERROR_RETRIES; tries++) {
-    string url;
-    int ret = get_url(url);
+    RGWEndpoint endpoint;
+    int ret = get_endpoint(endpoint);
     if (ret < 0) {
       return tl::unexpected(ret);
     }
+
     param_vec_t params;
     populate_params(params, &uid, self_zone_group);
-    RGWRESTSimpleRequest req(cct, info.method, url, NULL, &params, api_name);
+    RGWRESTSimpleRequest req(cct, info.method, endpoint, NULL, &params, api_name);
     auto result = req.forward_request(dpp, key, info, max_response, inbl, outbl, y);
     if (result) {
       return result;
     } else if (result.error() != -EIO) {
       return result;
     }
-    set_url_unconnectable(url);
+    set_endpoint_unconnectable(endpoint);
     if (tries < NUM_ENPOINT_IOERROR_RETRIES - 1) {
       ldpp_dout(dpp, 20) << __func__  << "(): failed to forward request. retries=" << tries << dendl;
     }
@@ -189,14 +195,15 @@ auto RGWRESTConn::forward_iam(const DoutPrefixProvider *dpp, const req_info& inf
 {
   static constexpr int NUM_ENPOINT_IOERROR_RETRIES = 20;
   for (int tries = 0; tries < NUM_ENPOINT_IOERROR_RETRIES; tries++) {
-    string url;
-    int ret = get_url(url);
+    RGWEndpoint endpoint;
+    int ret = get_endpoint(endpoint);
     if (ret < 0) {
       return tl::unexpected(ret);
     }
+
     param_vec_t params;
     std::string service = "iam";
-    RGWRESTSimpleRequest req(cct, info.method, url, NULL, &params, api_name);
+    RGWRESTSimpleRequest req(cct, info.method, endpoint, NULL, &params, api_name);
     // coverity[uninit_use_in_call:SUPPRESS]
     auto result = req.forward_request(dpp, key, info, max_response, inbl, outbl, y, service);
     if (result) {
@@ -204,7 +211,7 @@ auto RGWRESTConn::forward_iam(const DoutPrefixProvider *dpp, const req_info& inf
     } else if (result.error() != -EIO) {
       return result;
     }
-    set_url_unconnectable(url);
+    set_endpoint_unconnectable(endpoint);
     if (tries < NUM_ENPOINT_IOERROR_RETRIES - 1) {
       ldpp_dout(dpp, 20) << __func__  << "(): failed to forward request. retries=" << tries << dendl;
     }
@@ -214,8 +221,8 @@ auto RGWRESTConn::forward_iam(const DoutPrefixProvider *dpp, const req_info& inf
 
 int RGWRESTConn::put_obj_send_init(const rgw_obj& obj, const rgw_http_param_pair *extra_params, RGWRESTStreamS3PutObj **req)
 {
-  string url;
-  int ret = get_url(url);
+  RGWEndpoint endpoint;
+  int ret = get_endpoint(endpoint);
   if (ret < 0)
     return ret;
 
@@ -226,7 +233,7 @@ int RGWRESTConn::put_obj_send_init(const rgw_obj& obj, const rgw_http_param_pair
     append_param_list(params, extra_params);
   }
 
-  RGWRESTStreamS3PutObj *wr = new RGWRESTStreamS3PutObj(cct, "PUT", url, NULL, &params, api_name, host_style);
+  RGWRESTStreamS3PutObj *wr = new RGWRESTStreamS3PutObj(cct, "PUT", endpoint, NULL, &params, api_name, host_style);
   // coverity[uninit_use_in_call:SUPPRESS]
   wr->send_init(obj);
   *req = wr;
@@ -237,14 +244,14 @@ int RGWRESTConn::put_obj_async_init(const DoutPrefixProvider *dpp, const rgw_own
                                     map<string, bufferlist>& attrs,
                                     RGWRESTStreamS3PutObj **req)
 {
-  string url;
-  int ret = get_url(url);
+  RGWEndpoint endpoint;
+  int ret = get_endpoint(endpoint);
   if (ret < 0)
     return ret;
 
   param_vec_t params;
   populate_params(params, &uid, self_zone_group);
-  RGWRESTStreamS3PutObj *wr = new RGWRESTStreamS3PutObj(cct, "PUT", url, NULL, &params, api_name, host_style);
+  RGWRESTStreamS3PutObj *wr = new RGWRESTStreamS3PutObj(cct, "PUT", endpoint, NULL, &params, api_name, host_style);
   // coverity[uninit_use_in_call:SUPPRESS]
   wr->put_obj_init(dpp, key, obj, attrs);
   *req = wr;
@@ -258,7 +265,7 @@ int RGWRESTConn::complete_request(const DoutPrefixProvider* dpp,
   int ret = req->complete_request(dpp, y, &etag, mtime);
   if (ret == -EIO) {
     ldout(cct, 5) << __func__ << ": complete_request() returned ret=" << ret << dendl;
-    set_url_unconnectable(req->get_url_orig());
+    set_endpoint_unconnectable(req->get_endpoint_orig());
   }
 
   delete req;
@@ -319,8 +326,8 @@ int RGWRESTConn::get_obj(const DoutPrefixProvider *dpp, const rgw_owner *uid,
 
 int RGWRESTConn::get_obj(const DoutPrefixProvider *dpp, const rgw_obj& obj, const get_obj_params& in_params, bool send, RGWRESTStreamRWRequest **req)
 {
-  string url;
-  int ret = get_url(url);
+  RGWEndpoint endpoint;
+  int ret = get_endpoint(endpoint);
   if (ret < 0)
     return ret;
 
@@ -351,9 +358,9 @@ int RGWRESTConn::get_obj(const DoutPrefixProvider *dpp, const rgw_obj& obj, cons
     params.push_back(param_pair_t("versionId", obj.key.instance));
   }
   if (in_params.get_op) {
-    *req = new RGWRESTStreamReadRequest(cct, url, in_params.cb, NULL, &params, api_name, host_style);
+    *req = new RGWRESTStreamReadRequest(cct, endpoint, in_params.cb, NULL, &params, api_name, host_style);
   } else {
-    *req = new RGWRESTStreamHeadRequest(cct, url, in_params.cb, NULL, &params, api_name);
+    *req = new RGWRESTStreamHeadRequest(cct, endpoint, in_params.cb, NULL, &params, api_name);
   }
   map<string, string> extra_headers;
   if (in_params.info) {
@@ -421,7 +428,7 @@ int RGWRESTConn::complete_request(const DoutPrefixProvider* dpp,
   int ret = req->complete_request(dpp, y, etag, mtime, psize, pattrs, pheaders);
   if (ret == -EIO) {
     ldout(cct, 5) << __func__ << ": complete_request() returned ret=" << ret << dendl;
-    set_url_unconnectable(req->get_url_orig());
+    set_endpoint_unconnectable(req->get_endpoint_orig());
   }
   delete req;
 
@@ -441,8 +448,8 @@ int RGWRESTConn::get_resource(const DoutPrefixProvider *dpp,
 
   static constexpr int NUM_ENPOINT_IOERROR_RETRIES = 20;
   for (int tries = 0; tries < NUM_ENPOINT_IOERROR_RETRIES; tries++) {
-    string url;
-    ret = get_url(url);
+    RGWEndpoint endpoint;
+    ret = get_endpoint(endpoint);
     if (ret < 0)
       return ret;
 
@@ -456,7 +463,7 @@ int RGWRESTConn::get_resource(const DoutPrefixProvider *dpp,
 
     RGWStreamIntoBufferlist cb(bl);
 
-    RGWRESTStreamReadRequest req(cct, url, &cb, NULL, &params, api_name, host_style);
+    RGWRESTStreamReadRequest req(cct, endpoint, &cb, NULL, &params, api_name, host_style);
 
     map<string, string> headers;
     if (extra_headers) {
@@ -471,7 +478,7 @@ int RGWRESTConn::get_resource(const DoutPrefixProvider *dpp,
 
     ret = req.complete_request(dpp, y);
     if (ret == -EIO) {
-      set_url_unconnectable(url);
+      set_endpoint_unconnectable(endpoint);
       if (tries < NUM_ENPOINT_IOERROR_RETRIES - 1) {
         ldpp_dout(dpp, 20) << __func__  << "(): failed to get resource. retries=" << tries << dendl;
         continue;
@@ -495,8 +502,8 @@ int RGWRESTConn::send_resource(const DoutPrefixProvider *dpp, const std::string&
 
   static constexpr int NUM_ENPOINT_IOERROR_RETRIES = 20;
   for (int tries = 0; tries < NUM_ENPOINT_IOERROR_RETRIES; tries++) {
-    std::string url;
-    ret = get_url(url);
+    RGWEndpoint endpoint;
+    ret = get_endpoint(endpoint);
     if (ret < 0)
       return ret;
 
@@ -510,7 +517,7 @@ int RGWRESTConn::send_resource(const DoutPrefixProvider *dpp, const std::string&
 
     RGWStreamIntoBufferlist cb(bl);
 
-    RGWRESTStreamSendRequest req(cct, method, url, &cb, NULL, &params, api_name, host_style);
+    RGWRESTStreamSendRequest req(cct, method, endpoint, &cb, NULL, &params, api_name, host_style);
 
     std::map<std::string, std::string> headers;
     if (extra_headers) {
@@ -525,7 +532,7 @@ int RGWRESTConn::send_resource(const DoutPrefixProvider *dpp, const std::string&
 
     ret = req.complete_request(dpp, y);
     if (ret == -EIO) {
-      set_url_unconnectable(url);
+      set_endpoint_unconnectable(endpoint);
       if (tries < NUM_ENPOINT_IOERROR_RETRIES - 1) {
         ldpp_dout(dpp, 20) << __func__  << "(): failed to send resource. retries=" << tries << dendl;
         continue;
@@ -547,7 +554,7 @@ RGWRESTReadResource::RGWRESTReadResource(RGWRESTConn *_conn,
                                          RGWHTTPManager *_mgr)
   : cct(_conn->get_ctx()), conn(_conn), resource(_resource),
     params(make_param_list(pp)), cb(bl), mgr(_mgr),
-    req(cct, conn->get_url(), &cb, NULL, NULL, _conn->get_api_name())
+    req(cct, conn->get_endpoint(), &cb, NULL, NULL, _conn->get_api_name())
 {
   init_common(extra_headers);
 }
@@ -558,7 +565,7 @@ RGWRESTReadResource::RGWRESTReadResource(RGWRESTConn *_conn,
 					 param_vec_t *extra_headers,
                                          RGWHTTPManager *_mgr)
   : cct(_conn->get_ctx()), conn(_conn), resource(_resource), params(_params),
-    cb(bl), mgr(_mgr), req(cct, conn->get_url(), &cb, NULL, NULL, _conn->get_api_name())
+    cb(bl), mgr(_mgr), req(cct, conn->get_endpoint(), &cb, NULL, NULL, _conn->get_api_name())
 {
   init_common(extra_headers);
 }
@@ -584,7 +591,7 @@ int RGWRESTReadResource::read(const DoutPrefixProvider *dpp, optional_yield y)
 
   ret = req.complete_request(dpp, y);
   if (ret == -EIO) {
-    conn->set_url_unconnectable(req.get_url_orig());
+    conn->set_endpoint_unconnectable(req.get_endpoint_orig());
     ldpp_dout(dpp, 20) << __func__ << ": complete_request() returned ret=" << ret << dendl;
   }
 
@@ -610,7 +617,7 @@ RGWRESTSendResource::RGWRESTSendResource(RGWRESTConn *_conn,
                                          RGWHTTPManager *_mgr)
   : cct(_conn->get_ctx()), conn(_conn), method(_method), resource(_resource),
     params(make_param_list(pp)), cb(bl), mgr(_mgr),
-    req(cct, method.c_str(), conn->get_url(), &cb, NULL, NULL, _conn->get_api_name(), _conn->get_host_style())
+    req(cct, method.c_str(), conn->get_endpoint(), &cb, NULL, NULL, _conn->get_api_name(), _conn->get_host_style())
 {
   init_common(extra_headers);
 }
@@ -622,7 +629,7 @@ RGWRESTSendResource::RGWRESTSendResource(RGWRESTConn *_conn,
 					 param_vec_t *extra_headers,
                                          RGWHTTPManager *_mgr)
   : cct(_conn->get_ctx()), conn(_conn), method(_method), resource(_resource), params(params),
-    cb(bl), mgr(_mgr), req(cct, method.c_str(), conn->get_url(), &cb, NULL, NULL, _conn->get_api_name(), _conn->get_host_style())
+    cb(bl), mgr(_mgr), req(cct, method.c_str(), conn->get_endpoint(), &cb, NULL, NULL, _conn->get_api_name(), _conn->get_host_style())
 {
   init_common(extra_headers);
 }
@@ -651,7 +658,7 @@ int RGWRESTSendResource::send(const DoutPrefixProvider *dpp, bufferlist& outbl,
 
   ret = req.complete_request(dpp, y);
   if (ret == -EIO) {
-    conn->set_url_unconnectable(req.get_url_orig());
+    conn->set_endpoint_unconnectable(req.get_endpoint_orig());
     ldpp_dout(dpp, 20) << __func__ << ": complete_request() returned ret=" << ret << dendl;
   }
 
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 0672e5bc138..5042add9d50 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -101,9 +101,9 @@ public:
   RGWRESTConn& operator=(RGWRESTConn&& other);
   virtual ~RGWRESTConn() = default;
 
-  int get_url(std::string& endpoint);
-  std::string get_url();
-  void set_url_unconnectable(const std::string& endpoint);
+  int get_endpoint(RGWEndpoint& endpoint);
+  RGWEndpoint get_endpoint();
+  void set_endpoint_unconnectable(const RGWEndpoint& endpoint);
   const std::string& get_self_zonegroup() {
     return self_zone_group;
   }
@@ -358,7 +358,7 @@ public:
     int ret = req.wait(dpp, y);
     if (ret < 0) {
       if (ret == -ERR_INTERNAL_ERROR) {
-        conn->set_url_unconnectable(req.get_url_orig());
+        conn->set_endpoint_unconnectable(req.get_endpoint_orig());
       }
       return ret;
     }
@@ -414,7 +414,7 @@ int RGWRESTReadResource::wait(const DoutPrefixProvider* dpp, T *dest,
   int ret = req.wait(dpp, y);
   if (ret < 0) {
     if (ret == -ERR_INTERNAL_ERROR) {
-      conn->set_url_unconnectable(req.get_url_orig());
+      conn->set_endpoint_unconnectable(req.get_endpoint_orig());
     }
     return ret;
   }
@@ -489,7 +489,7 @@ public:
     *pbl = bl;
 
     if (ret == -ERR_INTERNAL_ERROR) {
-      conn->set_url_unconnectable(req.get_url_orig());
+      conn->set_endpoint_unconnectable(req.get_endpoint_orig());
     }
 
     if (ret < 0 && err_result ) {
@@ -510,7 +510,7 @@ int RGWRESTSendResource::wait(const DoutPrefixProvider* dpp, T *dest,
 {
   int ret = req.wait(dpp, y);
   if (ret == -ERR_INTERNAL_ERROR) {
-    conn->set_url_unconnectable(req.get_url_orig());
+    conn->set_endpoint_unconnectable(req.get_endpoint_orig());
   }
 
   if (ret >= 0) {
diff --git a/src/rgw/services/svc_zone.cc b/src/rgw/services/svc_zone.cc
index 1bce12e934b..055a5f6fe69 100644
--- a/src/rgw/services/svc_zone.cc
+++ b/src/rgw/services/svc_zone.cc
@@ -671,7 +671,7 @@ int RGWSI_Zone::select_bucket_placement(const DoutPrefixProvider *dpp, const RGW
                                     pselected_rule, rule_info, y);
 }
 
-bool RGWSI_Zone::get_redirect_zone_endpoint(string *endpoint)
+bool RGWSI_Zone::get_redirect_zone_endpoint_url(string *url)
 {
   if (zone_public_config->redirect_zone.empty()) {
     return false;
@@ -685,11 +685,13 @@ bool RGWSI_Zone::get_redirect_zone_endpoint(string *endpoint)
 
   RGWRESTConn *conn = iter->second;
 
-  int ret = conn->get_url(*endpoint);
+  RGWEndpoint ep{*url};
+  int ret = conn->get_endpoint(ep);
   if (ret < 0) {
     ldout(cct, 0) << "ERROR: redirect zone, conn->get_endpoint() returned ret=" << ret << dendl;
     return false;
   }
+  *url = ep.get_url();
 
   return true;
 }
diff --git a/src/rgw/services/svc_zone.h b/src/rgw/services/svc_zone.h
index 568c6d5603e..451faac8bef 100644
--- a/src/rgw/services/svc_zone.h
+++ b/src/rgw/services/svc_zone.h
@@ -92,7 +92,7 @@ public:
   bool zone_is_writeable();
   bool zone_syncs_from(const RGWZone& target_zone, const RGWZone& source_zone) const;
   bool zone_syncs_from(const RGWZone& source_zone) const;
-  bool get_redirect_zone_endpoint(std::string *endpoint);
+  bool get_redirect_zone_endpoint_url(std::string *url);
   bool sync_module_supports_writes() const { return writeable_zone; }
   bool sync_module_exports_data() const { return exports_data; }
 

From d989ef7b688d371d60c99afaaf5ef2e4288d019a Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Fri, 19 Dec 2025 02:25:55 +0000
Subject: [PATCH 077/596] rgw: add rgw_resolve_endpoints_into_all_addresses
 config option

Introduce an advanced boolean config option (default: false) to enable resolving
multisite endpoint hostnames into all A/AAAA records.

When enabled, RGW can distribute outgoing inter-zone traffic across DNS-provided
backends even without an external load balancer.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/common/options/rgw.yaml.in | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index 6e50726457d..2d1c4cb777f 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -2065,6 +2065,22 @@ options:
   services:
   - rgw
   with_legacy: true
+- name: rgw_rest_conn_connect_to_resolved_ips
+  type: bool
+  level: advanced
+  long_desc: When an RGW endpoint hostname resolves to multiple A or AAAA
+    records, libcurl normally connects to only the first address returned by
+    DNS. Enabling this option causes RGW to resolve each configured endpoint
+    into all of its addresses and distribute outgoing requests across them
+    using round-robin, with per-IP health tracking. This applies to
+    multisite replication traffic between zones (via RGWRESTConn). For example, in a
+    multisite deployment where zone endpoints such as "https://zone-a.example.com"
+    map to several backend RGW nodes, this allows inter-zone traffic to be spread
+    across all peers without requiring an external load balancer.
+  default: false
+  services:
+  - rgw
+  with_legacy: true
 - name: rgw_obj_stripe_size
   type: size
   level: advanced

From af7abeea009c32884a268f8513d1d1f9ae41726d Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Fri, 23 Jan 2026 15:34:18 +0000
Subject: [PATCH 078/596] rgw/rest: resolve multisite endpoints to all A/AAAA
 records (optional)

When rgw_resolve_endpoints_into_all_addresses=true, parse each configured
endpoint URL, extract host/port, and resolve the host into all IP addresses.

Store resolution results (including a round-robin index) alongside the original
endpoint URL for later selection.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 77 ++++++++++++++++++++++++++++++++++++++++
 src/rgw/rgw_rest_conn.h  | 13 +++++++
 2 files changed, 90 insertions(+)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 0f32cc201f1..95853bacc28 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -5,11 +5,80 @@
 #include "rgw_rest_conn.h"
 #include "rgw_http_errors.h"
 #include "rgw_sal.h"
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+
+#include <boost/url.hpp>
 
 #define dout_subsys ceph_subsys_rgw
 
 using namespace std;
 
+void RGWRESTConn::resolve_endpoints() {
+  resolved_endpoints.reserve(endpoints.size());
+
+  for (const auto& ep_url : endpoints) {
+    ResolvedEndpoint res_ep;
+    res_ep.url = ep_url;
+
+    // parse URL
+    boost::system::result<boost::urls::url_view> r = boost::urls::parse_uri(ep_url);
+    if (r.has_error()) {
+      ldout(cct, 0) << "RGWRESTConn: invalid endpoint url=" << ep_url
+                    << " err=" << r.error().message() << dendl;
+      continue;
+    }
+    boost::urls::url_view u = r.value();
+
+    // scheme
+    std::string scheme = std::string(u.scheme());
+    if (scheme.empty()) {
+      scheme = "http";
+    }
+    res_ep.scheme = scheme;
+
+    // host
+    res_ep.host = std::string(u.host());
+    if (res_ep.host.empty()) {
+      ldout(cct, 0) << "RGWRESTConn: endpoint url=" << ep_url
+                    << " has empty host" << dendl;
+      continue;
+    }
+
+    // port
+    if (u.has_port()) {
+      try {
+        res_ep.port = static_cast<uint16_t>(std::stoi(std::string(u.port())));
+      } catch (...) {
+        ldout(cct, 0) << "RGWRESTConn: invalid port in endpoint url=" << ep_url<< dendl;
+        continue;
+      }
+    } else {
+      res_ep.port = (scheme == "https" ? 443 : 80);
+    }
+
+    // resolve all IP addresses for the host
+    boost::asio::io_context io_ctx;
+    boost::asio::ip::tcp::resolver resolver(io_ctx);
+    boost::system::error_code ec;
+    auto results = resolver.resolve(res_ep.host, "", ec);
+    if (!ec && !results.empty()) {
+      for (const auto& entry : results) {
+        auto ip_str = entry.endpoint().address().to_string();
+        res_ep.ips.push_back(ip_str);
+        ldout(cct, 1) << "endpoint_url=" << ep_url << " resolved to ip=" << ip_str << dendl;
+      }
+      ldout(cct, 1) << "endpoint=" << ep_url << " resolved to "
+                << res_ep.ips.size() << " IP addresses" << dendl;
+    } else {
+      ldout(cct, 0) << "WARNING: RGWRESTConn no IP addresses found for endpoint=" << ep_url
+                    << (ec ? " err=" + ec.message() : "") << dendl;
+    }
+
+    resolved_endpoints.push_back(std::move(res_ep));
+  }
+}
+
 RGWRESTConn::RGWRESTConn(CephContext *_cct, rgw::sal::Driver* driver,
                          const string& _remote_id,
                          const list<string>& remote_endpoints,
@@ -26,6 +95,9 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct, rgw::sal::Driver* driver,
                 [this](const auto& url) {
                   this->endpoints_status.emplace(url, ceph::real_clock::zero());
                 });
+  if (cct->_conf->rgw_rest_conn_connect_to_resolved_ips) {
+    resolve_endpoints();
+  }
 
   if (driver) {
     key = driver->get_zone()->get_system_key();
@@ -53,11 +125,15 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct,
                 [this](const auto& url) {
                   this->endpoints_status.emplace(url, ceph::real_clock::zero());
                 });
+  if (cct->_conf->rgw_rest_conn_connect_to_resolved_ips) {
+    resolve_endpoints();
+  }
 }
 
 RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
   : cct(other.cct),
     endpoints(std::move(other.endpoints)),
+    resolved_endpoints(std::move(other.resolved_endpoints)),
     endpoints_status(std::move(other.endpoints_status)),
     key(std::move(other.key)),
     self_zone_group(std::move(other.self_zone_group)),
@@ -70,6 +146,7 @@ RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
 {
   cct = other.cct;
   endpoints = std::move(other.endpoints);
+  resolved_endpoints = std::move(other.resolved_endpoints);
   endpoints_status = std::move(other.endpoints_status);
   key = std::move(other.key);
   self_zone_group = std::move(other.self_zone_group);
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 5042add9d50..0dc0914a3be 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -65,6 +65,15 @@ inline param_vec_t make_param_list(const std::map<std::string, std::string> *pp)
   return params;
 }
 
+struct ResolvedEndpoint {
+  std::string url;                // e.g., "https://s3.abc.com:8443"
+  std::string scheme;             // e.g., "https"
+  std::string host;               // e.g., "s3.abc.com"
+  int port = -1;                  // e.g., 443
+  std::vector<std::string> ips; // the IPs the endpoint resolves to
+  size_t rr_index = 0;            // round-robin index for IPs
+};
+
 class RGWRESTConn
 {
   /* the endpoint is not able to connect if the timestamp is not real_clock::zero */
@@ -72,6 +81,7 @@ class RGWRESTConn
 
   CephContext *cct;
   std::vector<std::string> endpoints;
+  std::vector<ResolvedEndpoint> resolved_endpoints;
   endpoint_status_map endpoints_status;
   RGWAccessKey key;
   std::string self_zone_group;
@@ -80,6 +90,8 @@ class RGWRESTConn
   HostStyle host_style;
   std::atomic<int64_t> counter = { 0 };
 
+  void resolve_endpoints(void);
+
 public:
 
   RGWRESTConn(CephContext *_cct,
@@ -103,6 +115,7 @@ public:
 
   int get_endpoint(RGWEndpoint& endpoint);
   RGWEndpoint get_endpoint();
+  const std::vector<ResolvedEndpoint>& get_resolved_endpoints() const { return resolved_endpoints; }
   void set_endpoint_unconnectable(const RGWEndpoint& endpoint);
   const std::string& get_self_zonegroup() {
     return self_zone_group;

From 510e9ab1f0a728ebab48376acb06315e477367eb Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Fri, 23 Jan 2026 18:51:22 +0000
Subject: [PATCH 079/596] rgw/rest: round-robin resolved endpoint IPs into curl
 CONNECT_TO mapping

Add logic to select an IP for a given endpoint URL (RR over resolved addresses)
and build a host:port:ip:port mapping.

Store the mapping in the RGWEndpoint so the HTTP layer can apply it per request.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 32 ++++++++++++++++++++++++++++----
 src/rgw/rgw_rest_conn.h  |  8 ++++++--
 2 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 95853bacc28..71996fcb401 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -63,19 +63,23 @@ void RGWRESTConn::resolve_endpoints() {
     boost::system::error_code ec;
     auto results = resolver.resolve(res_ep.host, "", ec);
     if (!ec && !results.empty()) {
+      std::string port_str = std::to_string(res_ep.port);
+      std::string host_port_prefix = res_ep.host + ":" + port_str + ":";
+
       for (const auto& entry : results) {
         auto ip_str = entry.endpoint().address().to_string();
         res_ep.ips.push_back(ip_str);
-        ldout(cct, 1) << "endpoint_url=" << ep_url << " resolved to ip=" << ip_str << dendl;
+        res_ep.connect_to_strings.emplace_back(host_port_prefix + ip_str + ":" + port_str);
+        ldout(cct, 2) << "endpoint_url=" << ep_url << " resolved to ip=" << ip_str << dendl;
       }
-      ldout(cct, 1) << "endpoint=" << ep_url << " resolved to "
+      ldout(cct, 2) << "endpoint=" << ep_url << " resolved to "
                 << res_ep.ips.size() << " IP addresses" << dendl;
     } else {
       ldout(cct, 0) << "WARNING: RGWRESTConn no IP addresses found for endpoint=" << ep_url
                     << (ec ? " err=" + ec.message() : "") << dendl;
     }
 
-    resolved_endpoints.push_back(std::move(res_ep));
+    resolved_endpoints.emplace(ep_url, std::move(res_ep));
   }
 }
 
@@ -155,6 +159,24 @@ RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
   return *this;
 }
 
+void RGWRESTConn::get_connect_to_mapping_for_url(RGWEndpoint& endpoint)
+{
+  if (!cct->_conf->rgw_rest_conn_connect_to_resolved_ips) {
+    return;
+  }
+
+  std::string connect_to;
+
+  auto it = resolved_endpoints.find(endpoint.get_url());
+  if (it != resolved_endpoints.end() && !it->second.connect_to_strings.empty()) {
+    auto& res_ep = it->second;
+    size_t idx = res_ep.rr_index++;
+    connect_to = res_ep.connect_to_strings[idx % res_ep.connect_to_strings.size()];
+  }
+
+  endpoint.set_connect_to(connect_to);
+}
+
 int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
 {
   if (endpoints.empty()) {
@@ -201,7 +223,9 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
     ldout(cct, 5) << "ERROR: no valid endpoint" << dendl;
     return -EINVAL;
   }
-  ldout(cct, 20) << "get_endpoint picked url=" << endpoint.get_url()
+
+  get_connect_to_mapping_for_url(endpoint);
+  ldout(cct, 20) << "get_endpoint picked endpoint url=" << endpoint.get_url()
     << " connect_to=" << endpoint.get_connect_to() << dendl;
 
   return 0;
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 0dc0914a3be..f29151c97c7 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -71,6 +71,7 @@ struct ResolvedEndpoint {
   std::string host;               // e.g., "s3.abc.com"
   int port = -1;                  // e.g., 443
   std::vector<std::string> ips; // the IPs the endpoint resolves to
+  std::vector<std::string> connect_to_strings;  // Pre-computed full connect_to strings for each IP
   size_t rr_index = 0;            // round-robin index for IPs
 };
 
@@ -81,7 +82,7 @@ class RGWRESTConn
 
   CephContext *cct;
   std::vector<std::string> endpoints;
-  std::vector<ResolvedEndpoint> resolved_endpoints;
+  std::unordered_map<std::string, ResolvedEndpoint> resolved_endpoints;
   endpoint_status_map endpoints_status;
   RGWAccessKey key;
   std::string self_zone_group;
@@ -115,7 +116,7 @@ public:
 
   int get_endpoint(RGWEndpoint& endpoint);
   RGWEndpoint get_endpoint();
-  const std::vector<ResolvedEndpoint>& get_resolved_endpoints() const { return resolved_endpoints; }
+  const std::unordered_map<std::string, ResolvedEndpoint>& get_resolved_endpoints() const { return resolved_endpoints; }
   void set_endpoint_unconnectable(const RGWEndpoint& endpoint);
   const std::string& get_self_zonegroup() {
     return self_zone_group;
@@ -162,6 +163,9 @@ public:
                        RGWRESTStreamS3PutObj *req, std::string& etag,
                        ceph::real_time *mtime, optional_yield y);
 
+  /* pick an IP to 'connect-to' given the endpoint url */
+  void get_connect_to_mapping_for_url(RGWEndpoint& endpoint);
+
   struct get_obj_params {
     const rgw_owner *uid{nullptr};
     const rgw_user *perm_check_uid{nullptr};

From 6aca73a5f5be7acf2262b9cda3c7591e7ca6526b Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Fri, 23 Jan 2026 19:07:19 +0000
Subject: [PATCH 080/596] rgw/http: apply RGWEndpoint connect_to via libcurl
 CURLOPT_CONNECT_TO

If endpoint.connect_to is non-empty, populate and attach a curl slist to
CURLOPT_CONNECT_TO for this request.

Ensure the slist is freed with the request lifetime to avoid leaks across
retries/requests.

Fixes: https://tracker.ceph.com/issues/74677
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_http_client.cc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/src/rgw/rgw_http_client.cc b/src/rgw/rgw_http_client.cc
index 4cf35d09f26..788b18f6fa1 100644
--- a/src/rgw/rgw_http_client.cc
+++ b/src/rgw/rgw_http_client.cc
@@ -35,6 +35,7 @@ static void do_curl_easy_cleanup(RGWCurlHandle *curl_handle);
 struct rgw_http_req_data : public RefCountedObject {
   RGWCurlHandle *curl_handle{nullptr};
   curl_slist *h{nullptr};
+  curl_slist *connect_to_slist{nullptr};
   uint64_t id;
   int ret{0};
   std::atomic<bool> done = { false };
@@ -106,7 +107,14 @@ struct rgw_http_req_data : public RefCountedObject {
 
     curl_handle = NULL;
     h = NULL;
+
+    if (connect_to_slist) {
+      curl_slist_free_all(connect_to_slist);
+      connect_to_slist = nullptr;
+    }
+
     done = true;
+
     if (completion) {
       boost::system::error_code ec(-ret, boost::system::system_category());
       Completion::post(std::move(completion), ec);
@@ -588,6 +596,23 @@ int RGWHTTPClient::init_request(rgw_http_req_data *_req_data)
 
   curl_easy_setopt(easy_handle, CURLOPT_CUSTOMREQUEST, method.c_str());
   curl_easy_setopt(easy_handle, CURLOPT_URL, endpoint.get_url().c_str());
+
+  // apply CONNECT_TO mapping if provided for this request
+  if (! endpoint.get_connect_to().empty()) {
+    if (req_data->connect_to_slist) {
+      curl_slist_free_all(req_data->connect_to_slist);
+      req_data->connect_to_slist = nullptr;
+    }
+
+    req_data->connect_to_slist = curl_slist_append(req_data->connect_to_slist, endpoint.get_connect_to().c_str());
+    if (! req_data->connect_to_slist) {
+      dout(0) << "ERROR: RGWHTTPClient::init_request failed to allocate connect_to_slist" << dendl;
+    } else {
+      dout(20) << "applying CURLOPT_CONNECT_TO=" << endpoint.get_connect_to() << " for url=" << endpoint.get_url() << dendl;
+      curl_easy_setopt(easy_handle, CURLOPT_CONNECT_TO, req_data->connect_to_slist);
+    }
+  }
+
   curl_easy_setopt(easy_handle, CURLOPT_NOPROGRESS, 1L);
   curl_easy_setopt(easy_handle, CURLOPT_NOSIGNAL, 1L);
   curl_easy_setopt(easy_handle, CURLOPT_HEADERFUNCTION, receive_http_header);

From 030e62b8f14c232d1ba08928e5c16a337d51dba0 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Sat, 7 Feb 2026 01:45:20 +0000
Subject: [PATCH 081/596] rgw/rest: consolidate endpoint status tracking into
 ResolvedEndpoint

Refactor RGWRESTConn to eliminate the separate endpoints_status map by
moving the connection status (std::atomic<ceph::real_time>) directly
into the ResolvedEndpoint struct. This reduces redundancy and simplifies
endpoint state management.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 69 ++++++++++++++++------------------------
 src/rgw/rgw_rest_conn.h  | 46 ++++++++++++++++++++++-----
 2 files changed, 66 insertions(+), 49 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 71996fcb401..fb54bc57a81 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -15,12 +15,7 @@
 using namespace std;
 
 void RGWRESTConn::resolve_endpoints() {
-  resolved_endpoints.reserve(endpoints.size());
-
-  for (const auto& ep_url : endpoints) {
-    ResolvedEndpoint res_ep;
-    res_ep.url = ep_url;
-
+  for (auto& [ep_url, res_ep] : resolved_endpoints) {
     // parse URL
     boost::system::result<boost::urls::url_view> r = boost::urls::parse_uri(ep_url);
     if (r.has_error()) {
@@ -78,8 +73,6 @@ void RGWRESTConn::resolve_endpoints() {
       ldout(cct, 0) << "WARNING: RGWRESTConn no IP addresses found for endpoint=" << ep_url
                     << (ec ? " err=" + ec.message() : "") << dendl;
     }
-
-    resolved_endpoints.emplace(ep_url, std::move(res_ep));
   }
 }
 
@@ -89,19 +82,17 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct, rgw::sal::Driver* driver,
                          std::optional<string> _api_name,
                          HostStyle _host_style)
   : cct(_cct),
-    endpoints(remote_endpoints.begin(), remote_endpoints.end()),
+    endpoint_urls(remote_endpoints.begin(), remote_endpoints.end()),
     remote_id(_remote_id),
     api_name(_api_name),
     host_style(_host_style)
 {
-  endpoints_status.reserve(remote_endpoints.size());
-  std::for_each(remote_endpoints.begin(), remote_endpoints.end(),
-                [this](const auto& url) {
-                  this->endpoints_status.emplace(url, ceph::real_clock::zero());
-                });
-  if (cct->_conf->rgw_rest_conn_connect_to_resolved_ips) {
-    resolve_endpoints();
+  resolved_endpoints.reserve(remote_endpoints.size());
+  for (const auto& ep_url : remote_endpoints) {
+    ResolvedEndpoint& res_ep = resolved_endpoints[ep_url];
+    res_ep.status.store(ceph::real_clock::zero());  // Initial status: connectable
   }
+  resolve_endpoints();
 
   if (driver) {
     key = driver->get_zone()->get_system_key();
@@ -117,45 +108,41 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct,
                          std::optional<string> _api_name,
                          HostStyle _host_style)
   : cct(_cct),
-    endpoints(remote_endpoints.begin(), remote_endpoints.end()),
+    endpoint_urls(remote_endpoints.begin(), remote_endpoints.end()),
     key(_cred),
     self_zone_group(_zone_group),
     remote_id(_remote_id),
     api_name(_api_name),
     host_style(_host_style)
 {
-  endpoints_status.reserve(remote_endpoints.size());
-  std::for_each(remote_endpoints.begin(), remote_endpoints.end(),
-                [this](const auto& url) {
-                  this->endpoints_status.emplace(url, ceph::real_clock::zero());
-                });
-  if (cct->_conf->rgw_rest_conn_connect_to_resolved_ips) {
-    resolve_endpoints();
+  resolved_endpoints.reserve(remote_endpoints.size());
+  for (const auto& ep_url : remote_endpoints) {
+    ResolvedEndpoint& res_ep = resolved_endpoints[ep_url];
+    res_ep.status.store(ceph::real_clock::zero());  // Initial status: connectable
   }
+  resolve_endpoints();
 }
 
 RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
   : cct(other.cct),
-    endpoints(std::move(other.endpoints)),
+    endpoint_urls(std::move(other.endpoint_urls)),
+    endpoint_urls_counter(other.endpoint_urls_counter.load()),
     resolved_endpoints(std::move(other.resolved_endpoints)),
-    endpoints_status(std::move(other.endpoints_status)),
     key(std::move(other.key)),
     self_zone_group(std::move(other.self_zone_group)),
-    remote_id(std::move(other.remote_id)),
-    counter(other.counter.load())
+    remote_id(std::move(other.remote_id))
 {
 }
 
 RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
 {
   cct = other.cct;
-  endpoints = std::move(other.endpoints);
+  endpoint_urls = std::move(other.endpoint_urls);
+  endpoint_urls_counter = other.endpoint_urls_counter.load();
   resolved_endpoints = std::move(other.resolved_endpoints);
-  endpoints_status = std::move(other.endpoints_status);
   key = std::move(other.key);
   self_zone_group = std::move(other.self_zone_group);
   remote_id = std::move(other.remote_id);
-  counter = other.counter.load();
   return *this;
 }
 
@@ -179,25 +166,25 @@ void RGWRESTConn::get_connect_to_mapping_for_url(RGWEndpoint& endpoint)
 
 int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
 {
-  if (endpoints.empty()) {
+  if (endpoint_urls.empty()) {
     ldout(cct, 0) << "ERROR: endpoints not configured for upstream zone" << dendl;
     return -EINVAL;
   }
 
   size_t num = 0;
-  while (num < endpoints.size()) {
-    int i = ++counter;
+  while (num < endpoint_urls.size()) {
+    int i = ++endpoint_urls_counter;
 
-    const string& ep_url = endpoints[i % endpoints.size()];
+    const string& ep_url = endpoint_urls[i % endpoint_urls.size()];
     endpoint.set_url(ep_url);
 
-    if (endpoints_status.find(ep_url) == endpoints_status.end()) {
+    if (resolved_endpoints.find(ep_url) == resolved_endpoints.end()) {
       ldout(cct, 1) << "ERROR: missing status for endpoint " << ep_url << dendl;
       num++;
       continue;
     }
 
-    const auto& upd_time = endpoints_status[ep_url].load();
+    const auto& upd_time = resolved_endpoints[ep_url].status.load();
 
     if (ceph::real_clock::is_zero(upd_time)) {
       break;
@@ -212,14 +199,14 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
 
     static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
     if (diff >= CONN_STATUS_EXPIRE_SECS) {
-      endpoints_status[ep_url].store(ceph::real_clock::zero());
+      resolved_endpoints[ep_url].status.store(ceph::real_clock::zero());
       ldout(cct, 10) << "endpoint " << endpoint.get_url() << " unconnectable status expired. mark it connectable" << dendl;
       break;
     }
     num++;
   };
 
-  if (num == endpoints.size()) {
+  if (num == endpoint_urls.size()) {
     ldout(cct, 5) << "ERROR: no valid endpoint" << dendl;
     return -EINVAL;
   }
@@ -242,13 +229,13 @@ void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
 {
   const string& url = endpoint.get_url();
 
-  if (url.empty() || endpoints_status.find(url) == endpoints_status.end()) {
+  if (url.empty() || resolved_endpoints.find(url) == resolved_endpoints.end()) {
     ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status. endpoint="
                   << url << dendl;
     return;
   }
 
-  endpoints_status[url].store(ceph::real_clock::now());
+  resolved_endpoints[url].status.store(ceph::real_clock::now());
 
   ldout(cct, 10) << "set endpoint unconnectable. url=" << url << dendl;
 }
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index f29151c97c7..700d06f5407 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -69,27 +69,57 @@ struct ResolvedEndpoint {
   std::string url;                // e.g., "https://s3.abc.com:8443"
   std::string scheme;             // e.g., "https"
   std::string host;               // e.g., "s3.abc.com"
-  int port = -1;                  // e.g., 443
+  int port = -1;                  // e.g., 8443
   std::vector<std::string> ips; // the IPs the endpoint resolves to
   std::vector<std::string> connect_to_strings;  // Pre-computed full connect_to strings for each IP
   size_t rr_index = 0;            // round-robin index for IPs
+
+  /* endpoint health state: the endpoint is not able to connect if the timestamp is not real_clock::zero */
+  std::atomic<ceph::real_time> status;
+
+  ResolvedEndpoint() = default;
+
+  // Custom move constructor (required because std::atomic is not movable)
+  ResolvedEndpoint(ResolvedEndpoint&& other) noexcept
+    : url(std::move(other.url)),
+      scheme(std::move(other.scheme)),
+      host(std::move(other.host)),
+      port(other.port),
+      ips(std::move(other.ips)),
+      connect_to_strings(std::move(other.connect_to_strings)),
+      rr_index(other.rr_index),
+      status(other.status.load())
+  {}
+
+  // Custom move assignment (required because std::atomic is not movable)
+  ResolvedEndpoint& operator=(ResolvedEndpoint&& other) noexcept {
+    url = std::move(other.url);
+    scheme = std::move(other.scheme);
+    host = std::move(other.host);
+    port = other.port;
+    ips = std::move(other.ips);
+    connect_to_strings = std::move(other.connect_to_strings);
+    rr_index = other.rr_index;
+    status.store(other.status.load());
+    return *this;
+  }
+
+  // Delete copy operations (std::atomic is not copyable)
+  ResolvedEndpoint(const ResolvedEndpoint&) = delete;
+  ResolvedEndpoint& operator=(const ResolvedEndpoint&) = delete;
 };
 
 class RGWRESTConn
 {
-  /* the endpoint is not able to connect if the timestamp is not real_clock::zero */
-  using endpoint_status_map = std::unordered_map<std::string, std::atomic<ceph::real_time>>;
-
   CephContext *cct;
-  std::vector<std::string> endpoints;
+  std::vector<std::string> endpoint_urls;             // For ordered round-robin
+  std::atomic<int64_t> endpoint_urls_counter = { 0 }; // Round-robin counter for endpoint_urls
   std::unordered_map<std::string, ResolvedEndpoint> resolved_endpoints;
-  endpoint_status_map endpoints_status;
   RGWAccessKey key;
   std::string self_zone_group;
   std::string remote_id;
   std::optional<std::string> api_name;
   HostStyle host_style;
-  std::atomic<int64_t> counter = { 0 };
 
   void resolve_endpoints(void);
 
@@ -139,7 +169,7 @@ public:
   CephContext *get_ctx() {
     return cct;
   }
-  size_t get_endpoint_count() const { return endpoints.size(); }
+  size_t get_endpoint_count() const { return endpoint_urls.size(); }
 
   virtual void populate_params(param_vec_t& params, const rgw_owner* uid, const std::string& zonegroup);
 

From e468f0f65ffde4b3c9db47a42729124504327684 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Sat, 7 Feb 2026 02:00:16 +0000
Subject: [PATCH 082/596] rgw: fix incomplete RGWRESTConn move
 constructor/assignment

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index fb54bc57a81..727cef4331c 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -130,7 +130,9 @@ RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
     resolved_endpoints(std::move(other.resolved_endpoints)),
     key(std::move(other.key)),
     self_zone_group(std::move(other.self_zone_group)),
-    remote_id(std::move(other.remote_id))
+    remote_id(std::move(other.remote_id)),
+    api_name(std::move(other.api_name)),
+    host_style(other.host_style)
 {
 }
 
@@ -143,6 +145,8 @@ RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
   key = std::move(other.key);
   self_zone_group = std::move(other.self_zone_group);
   remote_id = std::move(other.remote_id);
+  api_name = std::move(other.api_name);
+  host_style = other.host_style;
   return *this;
 }
 

From b8d8c40edcc176b8f07bb143cbe2269e05f4bed8 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Sat, 7 Feb 2026 17:33:42 +0000
Subject: [PATCH 083/596] rgw: track original URL within RGWEndpoint instead of
 separate member (refactor)

Refactor endpoint tracking by adding original_url to RGWEndpoint struct
instead of maintaining a separate endpoint_orig member in RGWHTTPClient.
This simplifies the code by having each endpoint self-track its original
URL, which is needed for connection status lookups after URL modifications.

No functional changes intended.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_http_client.cc |  1 -
 src/rgw/rgw_http_client.h  | 35 ++++++++++++++++++++++++++++-------
 src/rgw/rgw_rest_client.h  |  2 +-
 src/rgw/rgw_rest_conn.cc   | 20 ++++++++++----------
 src/rgw/rgw_rest_conn.h    |  8 ++++----
 5 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/src/rgw/rgw_http_client.cc b/src/rgw/rgw_http_client.cc
index 788b18f6fa1..94ed211c8c4 100644
--- a/src/rgw/rgw_http_client.cc
+++ b/src/rgw/rgw_http_client.cc
@@ -310,7 +310,6 @@ RGWHTTPClient::RGWHTTPClient(CephContext *cct,
       verify_ssl(cct->_conf->rgw_verify_ssl),
       cct(cct),
       method(_method),
-      endpoint_orig(_endpoint),
       endpoint(_endpoint) {
   init();
 }
diff --git a/src/rgw/rgw_http_client.h b/src/rgw/rgw_http_client.h
index 6eaf1844401..942824aa9d6 100644
--- a/src/rgw/rgw_http_client.h
+++ b/src/rgw/rgw_http_client.h
@@ -20,9 +20,24 @@ void rgw_http_client_cleanup();
 struct rgw_http_req_data;
 class RGWHTTPManager;
 
+/**
+ * RGWEndpoint - Represents an HTTP endpoint with additional metdata such as connection routing.
+ *
+ * Unlike a plain URL string, RGWEndpoint carries additional information needed
+ * to leverage libcurl's CURLOPT_CONNECT_TO option. This enables RGW to route
+ * requests to specific IP addresses while preserving the original hostname for
+ * TLS/SNI and Host headers.
+ *
+ * Fields:
+ *  - url:          The effective URL for the request (may be modified with paths).
+ *  - original_url: The initially configured endpoint URL (preserved for reference).
+ *  - connect_to:   libcurl CONNECT_TO string (format: "host:port:addr:port") to
+ *                  override connection routing without changing the request URL.
+ */
 struct RGWEndpoint {
 private:
   std::string url;
+  std::string original_url;
   std::string connect_to;
 
 public:
@@ -31,7 +46,7 @@ public:
   RGWEndpoint(const char* u) : RGWEndpoint(std::string(u)) {}
 
   RGWEndpoint(std::string u, std::string c = {})
-    : url(std::move(u)), connect_to(std::move(c)) {}
+    : url(std::move(u)), original_url(url), connect_to(std::move(c)) {}
 
   RGWEndpoint with_url(std::string new_url) const {
     RGWEndpoint e = *this;
@@ -39,8 +54,15 @@ public:
     return e;
   }
 
-  void set_url(const std::string& _url) { url = _url; }
+  void set_url(const std::string& _url) {
+    url = _url;
+    // Capture the first URL assignment as the original
+    if (original_url.empty()) {
+      original_url = _url;
+    }
+  }
   const std::string& get_url() const { return url; }
+  const std::string& get_original_url() const { return original_url; }
 
   void set_connect_to(const std::string& _connect_to) { connect_to = _connect_to; }
   const std::string& get_connect_to() const { return connect_to; }
@@ -86,7 +108,6 @@ protected:
   CephContext *cct;
 
   std::string method;
-  RGWEndpoint endpoint_orig;
   RGWEndpoint endpoint;
 
   std::string protocol;
@@ -204,6 +225,10 @@ public:
 
   int get_req_retcode();
 
+  const RGWEndpoint& get_endpoint() const {
+    return endpoint;
+  }
+
   void set_endpoint(const RGWEndpoint& _endpoint) {
     endpoint = _endpoint;
   }
@@ -212,10 +237,6 @@ public:
     endpoint.set_url(_url);
   }
 
-  const RGWEndpoint& get_endpoint_orig() const {
-    return endpoint_orig;
-  }
-
   void set_method(const std::string& _method) {
     method = _method;
   }
diff --git a/src/rgw/rgw_rest_client.h b/src/rgw/rgw_rest_client.h
index e9458f44f7e..47d60b8ba7f 100644
--- a/src/rgw/rgw_rest_client.h
+++ b/src/rgw/rgw_rest_client.h
@@ -101,7 +101,7 @@ public:
   void set_policy(const RGWAccessControlPolicy& policy);
   int sign(const DoutPrefixProvider *dpp, RGWAccessKey& key, const bufferlist *opt_content);
 
-  const RGWEndpoint& get_endpoint() { return endpoint; }
+  const RGWEndpoint& get_endpoint() const { return endpoint; }
 };
 
 class RGWHTTPStreamRWRequest : public RGWHTTPSimpleRequest {
diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 727cef4331c..6c86d4e29fd 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -231,17 +231,17 @@ RGWEndpoint RGWRESTConn::get_endpoint()
 
 void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
 {
-  const string& url = endpoint.get_url();
+  const string& orig_url = endpoint.get_original_url();
 
-  if (url.empty() || resolved_endpoints.find(url) == resolved_endpoints.end()) {
-    ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status. endpoint="
-                  << url << dendl;
+  if (orig_url.empty() || resolved_endpoints.find(orig_url) == resolved_endpoints.end()) {
+    ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status. "
+                  << " original_url=" << orig_url << " current_url=" << endpoint.get_url() << dendl;
     return;
   }
 
-  resolved_endpoints[url].status.store(ceph::real_clock::now());
+  resolved_endpoints[orig_url].status.store(ceph::real_clock::now());
 
-  ldout(cct, 10) << "set endpoint unconnectable. url=" << url << dendl;
+  ldout(cct, 10) << "set endpoint unconnectable. url=" << orig_url << dendl;
 }
 
 void RGWRESTConn::populate_params(param_vec_t& params, const rgw_owner* uid, const string& zonegroup)
@@ -357,7 +357,7 @@ int RGWRESTConn::complete_request(const DoutPrefixProvider* dpp,
   int ret = req->complete_request(dpp, y, &etag, mtime);
   if (ret == -EIO) {
     ldout(cct, 5) << __func__ << ": complete_request() returned ret=" << ret << dendl;
-    set_endpoint_unconnectable(req->get_endpoint_orig());
+    set_endpoint_unconnectable(req->get_endpoint());
   }
 
   delete req;
@@ -520,7 +520,7 @@ int RGWRESTConn::complete_request(const DoutPrefixProvider* dpp,
   int ret = req->complete_request(dpp, y, etag, mtime, psize, pattrs, pheaders);
   if (ret == -EIO) {
     ldout(cct, 5) << __func__ << ": complete_request() returned ret=" << ret << dendl;
-    set_endpoint_unconnectable(req->get_endpoint_orig());
+    set_endpoint_unconnectable(req->get_endpoint());
   }
   delete req;
 
@@ -683,7 +683,7 @@ int RGWRESTReadResource::read(const DoutPrefixProvider *dpp, optional_yield y)
 
   ret = req.complete_request(dpp, y);
   if (ret == -EIO) {
-    conn->set_endpoint_unconnectable(req.get_endpoint_orig());
+    conn->set_endpoint_unconnectable(req.get_endpoint());
     ldpp_dout(dpp, 20) << __func__ << ": complete_request() returned ret=" << ret << dendl;
   }
 
@@ -750,7 +750,7 @@ int RGWRESTSendResource::send(const DoutPrefixProvider *dpp, bufferlist& outbl,
 
   ret = req.complete_request(dpp, y);
   if (ret == -EIO) {
-    conn->set_endpoint_unconnectable(req.get_endpoint_orig());
+    conn->set_endpoint_unconnectable(req.get_endpoint());
     ldpp_dout(dpp, 20) << __func__ << ": complete_request() returned ret=" << ret << dendl;
   }
 
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 700d06f5407..29613d62820 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -405,7 +405,7 @@ public:
     int ret = req.wait(dpp, y);
     if (ret < 0) {
       if (ret == -ERR_INTERNAL_ERROR) {
-        conn->set_endpoint_unconnectable(req.get_endpoint_orig());
+        conn->set_endpoint_unconnectable(req.get_endpoint());
       }
       return ret;
     }
@@ -461,7 +461,7 @@ int RGWRESTReadResource::wait(const DoutPrefixProvider* dpp, T *dest,
   int ret = req.wait(dpp, y);
   if (ret < 0) {
     if (ret == -ERR_INTERNAL_ERROR) {
-      conn->set_endpoint_unconnectable(req.get_endpoint_orig());
+      conn->set_endpoint_unconnectable(req.get_endpoint());
     }
     return ret;
   }
@@ -536,7 +536,7 @@ public:
     *pbl = bl;
 
     if (ret == -ERR_INTERNAL_ERROR) {
-      conn->set_endpoint_unconnectable(req.get_endpoint_orig());
+      conn->set_endpoint_unconnectable(req.get_endpoint());
     }
 
     if (ret < 0 && err_result ) {
@@ -557,7 +557,7 @@ int RGWRESTSendResource::wait(const DoutPrefixProvider* dpp, T *dest,
 {
   int ret = req.wait(dpp, y);
   if (ret == -ERR_INTERNAL_ERROR) {
-    conn->set_endpoint_unconnectable(req.get_endpoint_orig());
+    conn->set_endpoint_unconnectable(req.get_endpoint());
   }
 
   if (ret >= 0) {

From 71af1fc945e78c8f7fa460e3835733ad93a9754a Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Sun, 8 Feb 2026 00:30:13 +0000
Subject: [PATCH 084/596] rgw: add operator<< for RGWEndpoint and simplify
 logging

Add ostream operator<< to RGWEndpoint struct for convenient logging of
endpoint details (url, original_url when different, and connect_to).
Update log statements across rgw_http_client.cc, rgw_rest_client.cc,
and rgw_rest_conn.cc to use the new operator for cleaner, more
consistent output.

Add unittest_rgw_http_client to test RGWEndpoint functionality.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_http_client.cc           |   7 +-
 src/rgw/rgw_http_client.h            |  11 +++
 src/rgw/rgw_rest_client.cc           |   7 +-
 src/rgw/rgw_rest_conn.cc             |   9 +-
 src/test/rgw/CMakeLists.txt          |   6 ++
 src/test/rgw/test_rgw_http_client.cc | 132 +++++++++++++++++++++++++++
 6 files changed, 161 insertions(+), 11 deletions(-)
 create mode 100644 src/test/rgw/test_rgw_http_client.cc

diff --git a/src/rgw/rgw_http_client.cc b/src/rgw/rgw_http_client.cc
index 94ed211c8c4..1b1d5bae8b7 100644
--- a/src/rgw/rgw_http_client.cc
+++ b/src/rgw/rgw_http_client.cc
@@ -586,8 +586,7 @@ int RGWHTTPClient::init_request(rgw_http_req_data *_req_data)
 
   CURL *easy_handle = req_data->get_easy_handle();
 
-  dout(20) << "sending request to url=" << endpoint.get_url()
-    << " connect_to=" << endpoint.get_connect_to() << dendl;
+  dout(20) << "sending request to " << endpoint << dendl;
 
   curl_slist *h = headers_to_slist(headers);
 
@@ -605,9 +604,9 @@ int RGWHTTPClient::init_request(rgw_http_req_data *_req_data)
 
     req_data->connect_to_slist = curl_slist_append(req_data->connect_to_slist, endpoint.get_connect_to().c_str());
     if (! req_data->connect_to_slist) {
-      dout(0) << "ERROR: RGWHTTPClient::init_request failed to allocate connect_to_slist" << dendl;
+      dout(0) << "ERROR: RGWHTTPClient::init_request failed to allocate connect_to_slist: " << endpoint << dendl;
     } else {
-      dout(20) << "applying CURLOPT_CONNECT_TO=" << endpoint.get_connect_to() << " for url=" << endpoint.get_url() << dendl;
+      dout(20) << "applying CURLOPT_CONNECT_TO " << endpoint << dendl;
       curl_easy_setopt(easy_handle, CURLOPT_CONNECT_TO, req_data->connect_to_slist);
     }
   }
diff --git a/src/rgw/rgw_http_client.h b/src/rgw/rgw_http_client.h
index 942824aa9d6..5aec7c40684 100644
--- a/src/rgw/rgw_http_client.h
+++ b/src/rgw/rgw_http_client.h
@@ -75,6 +75,17 @@ public:
   void append_to_url(const std::string& suffix) {
     url.append(suffix);
   }
+
+  friend std::ostream& operator<<(std::ostream& os, const RGWEndpoint& ep) {
+    os << "RGWEndpoint: url=" << ep.url;
+    if (!ep.original_url.empty() && ep.original_url != ep.url) {
+      os << " original_url=" << ep.original_url;
+    }
+    if (!ep.connect_to.empty()) {
+      os << " connect_to=" << ep.connect_to;
+    }
+    return os;
+  }
 };
 
 class RGWHTTPClient : public RGWIOProvider,
diff --git a/src/rgw/rgw_rest_client.cc b/src/rgw/rgw_rest_client.cc
index 9317587ac78..e82680e7b0e 100644
--- a/src/rgw/rgw_rest_client.cc
+++ b/src/rgw/rgw_rest_client.cc
@@ -702,7 +702,8 @@ void RGWRESTStreamS3PutObj::send_init(const rgw_obj& obj)
   //do not encode slash in object key name
   url_encode(resource_str, resource, false);
 
-  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource << " , new_host = " << new_host << " , new_url = " << new_endpoint.get_url()  << dendl;
+  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource
+    << " , new_host = " << new_host << " , new_endpoint = " << new_endpoint  << dendl;
 
   method = "PUT";
   headers_gen.init(method, new_host, resource_prefix, new_endpoint, resource, params, api_name);
@@ -858,7 +859,9 @@ int RGWRESTStreamRWRequest::do_send_prepare(const DoutPrefixProvider *dpp, RGWAc
 
   headers_gen.emplace(cct, &new_env, &new_info);
 
-  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource << " , new_host = " << new_host << " , new_url = " << new_endpoint.get_url()  << " , new_resource = " << new_resource << dendl;
+  ldpp_dout(this, 20) << __func__ << "(): host = " << host << " , resource = " << resource
+    << " , new_host = " << new_host << " , new_endpoint = " << new_endpoint
+    << " , new_resource = " << new_resource << dendl;
 
   headers_gen->init(method, new_host, resource_prefix, new_endpoint, new_resource, params, api_name);
 
diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 6c86d4e29fd..cdc8a2f6cea 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -204,7 +204,7 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
     static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
     if (diff >= CONN_STATUS_EXPIRE_SECS) {
       resolved_endpoints[ep_url].status.store(ceph::real_clock::zero());
-      ldout(cct, 10) << "endpoint " << endpoint.get_url() << " unconnectable status expired. mark it connectable" << dendl;
+      ldout(cct, 10) << endpoint << " unconnectable status expired. mark it connectable" << dendl;
       break;
     }
     num++;
@@ -216,8 +216,7 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
   }
 
   get_connect_to_mapping_for_url(endpoint);
-  ldout(cct, 20) << "get_endpoint picked endpoint url=" << endpoint.get_url()
-    << " connect_to=" << endpoint.get_connect_to() << dendl;
+  ldout(cct, 20) << "get_endpoint picked " << endpoint << dendl;
 
   return 0;
 }
@@ -234,8 +233,8 @@ void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
   const string& orig_url = endpoint.get_original_url();
 
   if (orig_url.empty() || resolved_endpoints.find(orig_url) == resolved_endpoints.end()) {
-    ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status. "
-                  << " original_url=" << orig_url << " current_url=" << endpoint.get_url() << dendl;
+    ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status: "
+                  << endpoint << dendl;
     return;
   }
 
diff --git a/src/test/rgw/CMakeLists.txt b/src/test/rgw/CMakeLists.txt
index c587b5834dc..b3ebfb1a309 100644
--- a/src/test/rgw/CMakeLists.txt
+++ b/src/test/rgw/CMakeLists.txt
@@ -469,3 +469,9 @@ target_link_libraries(unittest_rgw_async_utils ${rgw_libs} ${UNITTEST_LIBS})
 add_executable(unittest_rgw_tag test_rgw_tag.cc)
 add_ceph_unittest(unittest_rgw_tag)
 target_link_libraries(unittest_rgw_tag ${rgw_libs} ${UNITTEST_LIBS})
+
+# unittest_rgw_http_client
+add_executable(unittest_rgw_http_client test_rgw_http_client.cc)
+add_ceph_unittest(unittest_rgw_http_client)
+target_link_libraries(unittest_rgw_http_client
+  rgw_common ${rgw_libs} ${UNITTEST_LIBS})
diff --git a/src/test/rgw/test_rgw_http_client.cc b/src/test/rgw/test_rgw_http_client.cc
new file mode 100644
index 00000000000..79f80c67edb
--- /dev/null
+++ b/src/test/rgw/test_rgw_http_client.cc
@@ -0,0 +1,132 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab ft=cpp
+
+#include <gtest/gtest.h>
+#include <sstream>
+
+#include "rgw_http_client.h"
+
+using namespace std;
+
+// Tests for RGWEndpoint
+
+TEST(RGWEndpointTest, default_constructor) {
+  RGWEndpoint ep;
+  EXPECT_TRUE(ep.get_url().empty());
+  EXPECT_TRUE(ep.get_original_url().empty());
+  EXPECT_TRUE(ep.get_connect_to().empty());
+}
+
+TEST(RGWEndpointTest, constructor_sets_url_and_original_url) {
+  RGWEndpoint ep("http://example.com:8080");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080");
+  EXPECT_EQ(ep.get_original_url(), "http://example.com:8080");
+}
+
+TEST(RGWEndpointTest, constructor_with_connect_to) {
+  RGWEndpoint ep("http://example.com:8080", "example.com:8080:192.168.1.1:8080");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080");
+  EXPECT_EQ(ep.get_original_url(), "http://example.com:8080");
+  EXPECT_EQ(ep.get_connect_to(), "example.com:8080:192.168.1.1:8080");
+}
+
+TEST(RGWEndpointTest, set_url_on_default_constructed_sets_original) {
+  RGWEndpoint ep;
+  EXPECT_TRUE(ep.get_original_url().empty());
+
+  ep.set_url("http://first.example.com");
+  EXPECT_EQ(ep.get_url(), "http://first.example.com");
+  EXPECT_EQ(ep.get_original_url(), "http://first.example.com");
+
+  // Second set_url should NOT change original_url
+  ep.set_url("http://second.example.com");
+  EXPECT_EQ(ep.get_url(), "http://second.example.com");
+  EXPECT_EQ(ep.get_original_url(), "http://first.example.com");
+}
+
+TEST(RGWEndpointTest, set_url_does_not_change_original_after_constructor) {
+  RGWEndpoint ep("http://original.example.com");
+
+  ep.set_url("http://modified.example.com");
+  EXPECT_EQ(ep.get_url(), "http://modified.example.com");
+  EXPECT_EQ(ep.get_original_url(), "http://original.example.com");
+}
+
+TEST(RGWEndpointTest, with_url_returns_copy_with_new_url) {
+  RGWEndpoint ep("http://original.example.com");
+  ep.set_connect_to("original.example.com:80:192.168.1.1:80");
+
+  RGWEndpoint ep2 = ep.with_url("http://modified.example.com");
+
+  // Original unchanged
+  EXPECT_EQ(ep.get_url(), "http://original.example.com");
+  EXPECT_EQ(ep.get_original_url(), "http://original.example.com");
+
+  // Copy has new url but preserves original_url and connect_to
+  EXPECT_EQ(ep2.get_url(), "http://modified.example.com");
+  EXPECT_EQ(ep2.get_original_url(), "http://original.example.com");
+  EXPECT_EQ(ep2.get_connect_to(), "original.example.com:80:192.168.1.1:80");
+}
+
+TEST(RGWEndpointTest, set_connect_to) {
+  RGWEndpoint ep("http://example.com:8080");
+  EXPECT_TRUE(ep.get_connect_to().empty());
+
+  ep.set_connect_to("example.com:8080:192.168.1.1:8080");
+  EXPECT_EQ(ep.get_connect_to(), "example.com:8080:192.168.1.1:8080");
+}
+
+TEST(RGWEndpointTest, add_trailing_slash) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.add_trailing_slash();
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/");
+
+  // Should not add another slash
+  ep.add_trailing_slash();
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/");
+}
+
+TEST(RGWEndpointTest, append_to_url) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.append_to_url("/path/to/resource");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/path/to/resource");
+}
+
+// Tests for operator<<
+
+TEST(RGWEndpointTest, ostream_operator_url_only) {
+  RGWEndpoint ep("http://example.com:8080");
+  std::ostringstream oss;
+  oss << ep;
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080");
+}
+
+TEST(RGWEndpointTest, ostream_operator_with_different_original_url) {
+  RGWEndpoint ep;
+  ep.set_url("http://original.example.com:8080");
+  ep.set_url("http://modified.example.com:8080");  // original_url stays the same
+
+  std::ostringstream oss;
+  oss << ep;
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://modified.example.com:8080 original_url=http://original.example.com:8080");
+}
+
+TEST(RGWEndpointTest, ostream_operator_with_connect_to) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.set_connect_to("example.com:8080:192.168.1.1:8080");
+
+  std::ostringstream oss;
+  oss << ep;
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080 connect_to=example.com:8080:192.168.1.1:8080");
+}
+
+TEST(RGWEndpointTest, ostream_operator_full) {
+  RGWEndpoint ep;
+  ep.set_url("http://original.example.com:8080");
+  ep.set_url("http://192.168.1.1:8080");
+  ep.set_connect_to("original.example.com:8080:192.168.1.1:8080");
+
+  std::ostringstream oss;
+  oss << ep;
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://192.168.1.1:8080 original_url=http://original.example.com:8080 connect_to=original.example.com:8080:192.168.1.1:8080");
+}

From 3e310e0c859c4a67296cacfaa9a8849f88789469 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Mon, 2 Mar 2026 18:11:27 +0000
Subject: [PATCH 085/596] rgw/rest: consolidate endpoint_urls and
 resolved_endpoints into single vector

Previously RGWRESTConn stored endpoints in two data structures:
- endpoint_urls: vector<string> for ordered round-robin iteration
- resolved_endpoints: unordered_map<string, ResolvedEndpoint> for lookup

This was redundant since the URL was stored in both places.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 73 +++++++++++++++++++++-------------------
 src/rgw/rgw_rest_conn.h  | 12 +++----
 2 files changed, 44 insertions(+), 41 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index cdc8a2f6cea..37e9919a735 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -15,7 +15,8 @@
 using namespace std;
 
 void RGWRESTConn::resolve_endpoints() {
-  for (auto& [ep_url, res_ep] : resolved_endpoints) {
+  for (auto& res_ep : resolved_endpoints) {
+    const std::string& ep_url = res_ep.url;
     // parse URL
     boost::system::result<boost::urls::url_view> r = boost::urls::parse_uri(ep_url);
     if (r.has_error()) {
@@ -82,15 +83,16 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct, rgw::sal::Driver* driver,
                          std::optional<string> _api_name,
                          HostStyle _host_style)
   : cct(_cct),
-    endpoint_urls(remote_endpoints.begin(), remote_endpoints.end()),
     remote_id(_remote_id),
     api_name(_api_name),
     host_style(_host_style)
 {
   resolved_endpoints.reserve(remote_endpoints.size());
   for (const auto& ep_url : remote_endpoints) {
-    ResolvedEndpoint& res_ep = resolved_endpoints[ep_url];
+    ResolvedEndpoint res_ep;
+    res_ep.url = ep_url;
     res_ep.status.store(ceph::real_clock::zero());  // Initial status: connectable
+    resolved_endpoints.push_back(std::move(res_ep));
   }
   resolve_endpoints();
 
@@ -108,7 +110,6 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct,
                          std::optional<string> _api_name,
                          HostStyle _host_style)
   : cct(_cct),
-    endpoint_urls(remote_endpoints.begin(), remote_endpoints.end()),
     key(_cred),
     self_zone_group(_zone_group),
     remote_id(_remote_id),
@@ -117,16 +118,17 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct,
 {
   resolved_endpoints.reserve(remote_endpoints.size());
   for (const auto& ep_url : remote_endpoints) {
-    ResolvedEndpoint& res_ep = resolved_endpoints[ep_url];
+    ResolvedEndpoint res_ep;
+    res_ep.url = ep_url;
     res_ep.status.store(ceph::real_clock::zero());  // Initial status: connectable
+    resolved_endpoints.push_back(std::move(res_ep));
   }
   resolve_endpoints();
 }
 
 RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
   : cct(other.cct),
-    endpoint_urls(std::move(other.endpoint_urls)),
-    endpoint_urls_counter(other.endpoint_urls_counter.load()),
+    endpoint_round_robin_counter(other.endpoint_round_robin_counter.load()),
     resolved_endpoints(std::move(other.resolved_endpoints)),
     key(std::move(other.key)),
     self_zone_group(std::move(other.self_zone_group)),
@@ -139,8 +141,7 @@ RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
 RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
 {
   cct = other.cct;
-  endpoint_urls = std::move(other.endpoint_urls);
-  endpoint_urls_counter = other.endpoint_urls_counter.load();
+  endpoint_round_robin_counter = other.endpoint_round_robin_counter.load();
   resolved_endpoints = std::move(other.resolved_endpoints);
   key = std::move(other.key);
   self_zone_group = std::move(other.self_zone_group);
@@ -150,45 +151,46 @@ RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
   return *this;
 }
 
-void RGWRESTConn::get_connect_to_mapping_for_url(RGWEndpoint& endpoint)
+ResolvedEndpoint* RGWRESTConn::find_resolved_endpoint(const std::string& url)
+{
+  for (auto& res_ep : resolved_endpoints) {
+    if (res_ep.url == url) {
+      return &res_ep;
+    }
+  }
+  return nullptr;
+}
+
+void RGWRESTConn::populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& resolved_endpoint)
 {
   if (!cct->_conf->rgw_rest_conn_connect_to_resolved_ips) {
     return;
   }
 
-  std::string connect_to;
-
-  auto it = resolved_endpoints.find(endpoint.get_url());
-  if (it != resolved_endpoints.end() && !it->second.connect_to_strings.empty()) {
-    auto& res_ep = it->second;
-    size_t idx = res_ep.rr_index++;
-    connect_to = res_ep.connect_to_strings[idx % res_ep.connect_to_strings.size()];
+  if (!resolved_endpoint.connect_to_strings.empty()) {
+    size_t idx = resolved_endpoint.rr_index++;
+    endpoint.set_connect_to(resolved_endpoint.connect_to_strings[idx % resolved_endpoint.connect_to_strings.size()]);
   }
-
-  endpoint.set_connect_to(connect_to);
 }
 
 int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
 {
-  if (endpoint_urls.empty()) {
+  if (resolved_endpoints.empty()) {
     ldout(cct, 0) << "ERROR: endpoints not configured for upstream zone" << dendl;
     return -EINVAL;
   }
 
   size_t num = 0;
-  while (num < endpoint_urls.size()) {
-    int i = ++endpoint_urls_counter;
+  size_t selected_idx = 0;
+  while (num < resolved_endpoints.size()) {
+    int i = ++endpoint_round_robin_counter;
+    selected_idx = i % resolved_endpoints.size();
 
-    const string& ep_url = endpoint_urls[i % endpoint_urls.size()];
+    ResolvedEndpoint& res_ep = resolved_endpoints[selected_idx];
+    const std::string& ep_url = res_ep.url;
     endpoint.set_url(ep_url);
 
-    if (resolved_endpoints.find(ep_url) == resolved_endpoints.end()) {
-      ldout(cct, 1) << "ERROR: missing status for endpoint " << ep_url << dendl;
-      num++;
-      continue;
-    }
-
-    const auto& upd_time = resolved_endpoints[ep_url].status.load();
+    const auto& upd_time = res_ep.status.load();
 
     if (ceph::real_clock::is_zero(upd_time)) {
       break;
@@ -203,19 +205,19 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
 
     static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
     if (diff >= CONN_STATUS_EXPIRE_SECS) {
-      resolved_endpoints[ep_url].status.store(ceph::real_clock::zero());
+      res_ep.status.store(ceph::real_clock::zero());
       ldout(cct, 10) << endpoint << " unconnectable status expired. mark it connectable" << dendl;
       break;
     }
     num++;
   };
 
-  if (num == endpoint_urls.size()) {
+  if (num == resolved_endpoints.size()) {
     ldout(cct, 5) << "ERROR: no valid endpoint" << dendl;
     return -EINVAL;
   }
 
-  get_connect_to_mapping_for_url(endpoint);
+  populate_connect_to(endpoint, resolved_endpoints[selected_idx]);
   ldout(cct, 20) << "get_endpoint picked " << endpoint << dendl;
 
   return 0;
@@ -232,13 +234,14 @@ void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
 {
   const string& orig_url = endpoint.get_original_url();
 
-  if (orig_url.empty() || resolved_endpoints.find(orig_url) == resolved_endpoints.end()) {
+  ResolvedEndpoint* res_ep = find_resolved_endpoint(orig_url);
+  if (orig_url.empty() || !res_ep) {
     ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status: "
                   << endpoint << dendl;
     return;
   }
 
-  resolved_endpoints[orig_url].status.store(ceph::real_clock::now());
+  res_ep->status.store(ceph::real_clock::now());
 
   ldout(cct, 10) << "set endpoint unconnectable. url=" << orig_url << dendl;
 }
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 29613d62820..c4a9389f1bc 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -112,9 +112,8 @@ struct ResolvedEndpoint {
 class RGWRESTConn
 {
   CephContext *cct;
-  std::vector<std::string> endpoint_urls;             // For ordered round-robin
-  std::atomic<int64_t> endpoint_urls_counter = { 0 }; // Round-robin counter for endpoint_urls
-  std::unordered_map<std::string, ResolvedEndpoint> resolved_endpoints;
+  std::atomic<int64_t> endpoint_round_robin_counter = { 0 }; // Round-robin counter for resolved_endpoints
+  std::vector<ResolvedEndpoint> resolved_endpoints;
   RGWAccessKey key;
   std::string self_zone_group;
   std::string remote_id;
@@ -146,7 +145,8 @@ public:
 
   int get_endpoint(RGWEndpoint& endpoint);
   RGWEndpoint get_endpoint();
-  const std::unordered_map<std::string, ResolvedEndpoint>& get_resolved_endpoints() const { return resolved_endpoints; }
+  const std::vector<ResolvedEndpoint>& get_resolved_endpoints() const { return resolved_endpoints; }
+  ResolvedEndpoint* find_resolved_endpoint(const std::string& url);
   void set_endpoint_unconnectable(const RGWEndpoint& endpoint);
   const std::string& get_self_zonegroup() {
     return self_zone_group;
@@ -169,7 +169,7 @@ public:
   CephContext *get_ctx() {
     return cct;
   }
-  size_t get_endpoint_count() const { return endpoint_urls.size(); }
+  size_t get_endpoint_count() const { return resolved_endpoints.size(); }
 
   virtual void populate_params(param_vec_t& params, const rgw_owner* uid, const std::string& zonegroup);
 
@@ -194,7 +194,7 @@ public:
                        ceph::real_time *mtime, optional_yield y);
 
   /* pick an IP to 'connect-to' given the endpoint url */
-  void get_connect_to_mapping_for_url(RGWEndpoint& endpoint);
+  void populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& res_ep);
 
   struct get_obj_params {
     const rgw_owner *uid{nullptr};

From afab77cae3a87bb7bfde1e08a3be4f562d189638 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 3 Mar 2026 01:05:06 +0000
Subject: [PATCH 086/596] rgw/rest: remove unused headers

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 37e9919a735..459559b4cf3 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -1,9 +1,7 @@
 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
 // vim: ts=8 sw=2 sts=2 expandtab ft=cpp
 
-#include "rgw_zone.h"
 #include "rgw_rest_conn.h"
-#include "rgw_http_errors.h"
 #include "rgw_sal.h"
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/ip/tcp.hpp>

From 2d7bc7818c5976702cbddcb228f6ac13dcee8697 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 3 Mar 2026 00:45:59 +0000
Subject: [PATCH 087/596] rgw/rest: track connection failures per-IP instead of
 per-endpoint

Previously, when a connection to a zone endpoint failed, the entire
endpoint was marked as unavailable for a timeout period. Since we now
resolve endpoints to all their IP addresses (via DNS A/AAAA records),
we can be more granular: track failures at the individual IP level.

Introduce ResolvedIP struct that pairs each IP's connect_to string
with its own failure timestamp. When selecting an IP for a request,
round-robin skips IPs that have recently failed, allowing traffic to
continue flowing to healthy nodes even when some are down.

An endpoint-level last_failure_time is maintained as a fast-path
optimization to avoid scanning all IPs when none have failed recently.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 123 +++++++++++++++++++++++++++++----------
 src/rgw/rgw_rest_conn.h  |  79 +++++++++++++++++++------
 2 files changed, 152 insertions(+), 50 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 459559b4cf3..412a33d95a1 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -60,14 +60,14 @@ void RGWRESTConn::resolve_endpoints() {
       std::string port_str = std::to_string(res_ep.port);
       std::string host_port_prefix = res_ep.host + ":" + port_str + ":";
 
+      res_ep.resolved_ips.reserve(results.size());
       for (const auto& entry : results) {
         auto ip_str = entry.endpoint().address().to_string();
-        res_ep.ips.push_back(ip_str);
-        res_ep.connect_to_strings.emplace_back(host_port_prefix + ip_str + ":" + port_str);
+        res_ep.resolved_ips.emplace_back(host_port_prefix + ip_str + ":" + port_str);
         ldout(cct, 2) << "endpoint_url=" << ep_url << " resolved to ip=" << ip_str << dendl;
       }
       ldout(cct, 2) << "endpoint=" << ep_url << " resolved to "
-                << res_ep.ips.size() << " IP addresses" << dendl;
+                << res_ep.resolved_ips.size() << " IP addresses" << dendl;
     } else {
       ldout(cct, 0) << "WARNING: RGWRESTConn no IP addresses found for endpoint=" << ep_url
                     << (ec ? " err=" + ec.message() : "") << dendl;
@@ -89,7 +89,6 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct, rgw::sal::Driver* driver,
   for (const auto& ep_url : remote_endpoints) {
     ResolvedEndpoint res_ep;
     res_ep.url = ep_url;
-    res_ep.status.store(ceph::real_clock::zero());  // Initial status: connectable
     resolved_endpoints.push_back(std::move(res_ep));
   }
   resolve_endpoints();
@@ -118,7 +117,6 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct,
   for (const auto& ep_url : remote_endpoints) {
     ResolvedEndpoint res_ep;
     res_ep.url = ep_url;
-    res_ep.status.store(ceph::real_clock::zero());  // Initial status: connectable
     resolved_endpoints.push_back(std::move(res_ep));
   }
   resolve_endpoints();
@@ -165,10 +163,38 @@ void RGWRESTConn::populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& r
     return;
   }
 
-  if (!resolved_endpoint.connect_to_strings.empty()) {
-    size_t idx = resolved_endpoint.rr_index++;
-    endpoint.set_connect_to(resolved_endpoint.connect_to_strings[idx % resolved_endpoint.connect_to_strings.size()]);
+  if (resolved_endpoint.resolved_ips.empty()) {
+    return;
   }
+
+  static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
+  const size_t num_ips = resolved_endpoint.resolved_ips.size();
+
+  // Round-robin through IPs, skipping any that are marked down
+  for (size_t i = 0; i < num_ips; ++i) {
+    size_t idx = resolved_endpoint.endpoint_ips_round_robin_counter++ % num_ips;
+    ResolvedIP& ip_status = resolved_endpoint.resolved_ips[idx];
+
+    const auto& last_fail = ip_status.last_failure.load();
+    if (ceph::real_clock::is_zero(last_fail)) {
+      endpoint.set_connect_to(ip_status.connect_to);  // IP is up
+      return;
+    }
+
+    auto diff = ceph::to_seconds<double>(ceph::real_clock::now() - last_fail);
+    if (diff >= CONN_STATUS_EXPIRE_SECS) {
+      // Failure expired, mark IP as up and use it
+      ip_status.mark_up();
+      ldout(cct, 5) << "IP " << ip_status.connect_to << " failure expired, marking up" << dendl;
+      endpoint.set_connect_to(ip_status.connect_to);
+      return;
+    }
+  }
+
+  // All IPs are down - do not populate connect_to; i.e.,
+  // let libcurl handle it without connect_to hint.
+  ldout(cct, 5) << "All IPs down for endpoint=" << resolved_endpoint.url
+    << " - skip connect_to hint" << dendl;
 }
 
 int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
@@ -178,6 +204,37 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
     return -EINVAL;
   }
 
+  static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
+  auto now = ceph::real_clock::now();
+
+  // Helper to check if an endpoint has at least one available IP
+  auto endpoint_has_available_ip = [&](ResolvedEndpoint& res_ep) -> bool {
+    // If no IP resolution, endpoint is available (will use DNS directly)
+    if (res_ep.resolved_ips.empty()) {
+      return true;
+    }
+
+    // Fast path: if no recent failures at endpoint level, all IPs are available
+    const auto& ep_last_fail = res_ep.last_failure_time.load();
+    if (ceph::real_clock::is_zero(ep_last_fail) ||
+        ceph::to_seconds<double>(now - ep_last_fail) >= CONN_STATUS_EXPIRE_SECS) {
+      return true;
+    }
+
+    // Slow path: check individual IPs (only when there's a recent failure)
+    for (auto& ip_status : res_ep.resolved_ips) {
+      const auto& last_fail = ip_status.last_failure.load();
+      if (ceph::real_clock::is_zero(last_fail)) {
+        return true;  // This IP is up
+      }
+      auto diff = ceph::to_seconds<double>(now - last_fail);
+      if (diff >= CONN_STATUS_EXPIRE_SECS) {
+        return true;  // This IP's failure has expired
+      }
+    }
+    return false;  // All IPs are down
+  };
+
   size_t num = 0;
   size_t selected_idx = 0;
   while (num < resolved_endpoints.size()) {
@@ -185,33 +242,18 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
     selected_idx = i % resolved_endpoints.size();
 
     ResolvedEndpoint& res_ep = resolved_endpoints[selected_idx];
-    const std::string& ep_url = res_ep.url;
-    endpoint.set_url(ep_url);
 
-    const auto& upd_time = res_ep.status.load();
-
-    if (ceph::real_clock::is_zero(upd_time)) {
+    if (endpoint_has_available_ip(res_ep)) {
+      endpoint.set_url(res_ep.url);
       break;
     }
 
-    auto diff = ceph::to_seconds<double>(ceph::real_clock::now() - upd_time);
-
-    ldout(cct, 20) << "endpoint url=" << ep_url
-                   << " last endpoint status update time="
-                   << ceph::real_clock::to_double(upd_time)
-                   << " diff=" << diff << dendl;
-
-    static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
-    if (diff >= CONN_STATUS_EXPIRE_SECS) {
-      res_ep.status.store(ceph::real_clock::zero());
-      ldout(cct, 10) << endpoint << " unconnectable status expired. mark it connectable" << dendl;
-      break;
-    }
+    ldout(cct, 5) << "endpoint url=" << res_ep.url << " all IPs down, trying next" << dendl;
     num++;
-  };
+  }
 
   if (num == resolved_endpoints.size()) {
-    ldout(cct, 5) << "ERROR: no valid endpoint" << dendl;
+    ldout(cct, 1) << "ERROR: no valid endpoint (all IPs down for all endpoints)" << dendl;
     return -EINVAL;
   }
 
@@ -231,17 +273,34 @@ RGWEndpoint RGWRESTConn::get_endpoint()
 void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
 {
   const string& orig_url = endpoint.get_original_url();
+  const string& connect_to = endpoint.get_connect_to();
 
   ResolvedEndpoint* res_ep = find_resolved_endpoint(orig_url);
   if (orig_url.empty() || !res_ep) {
-    ldout(cct, 0) << "ERROR: endpoint is not a valid or doesn't have status: "
-                  << endpoint << dendl;
+    ldout(cct, 0) << "ERROR: endpoint is not valid or not found: "
+      << endpoint << dendl;
     return;
   }
 
-  res_ep->status.store(ceph::real_clock::now());
+  // Update endpoint-level last_failure_time for fast-path optimization
+  auto now = ceph::real_clock::now();
+  res_ep->last_failure_time.store(now);
 
-  ldout(cct, 10) << "set endpoint unconnectable. url=" << orig_url << dendl;
+  // If we have a connect_to string, mark that specific IP as down as well
+  if (!connect_to.empty()) {
+    ResolvedIP* res_ip = res_ep->find_ip_status(connect_to);
+    if (res_ip) {
+      res_ip->mark_down();
+      ldout(cct, 10) << "set IP unconnectable: " << connect_to << dendl;
+      return;
+    }
+  }
+
+  // Fallback: mark all IPs for this endpoint as down
+  for (auto& res_ip : res_ep->resolved_ips) {
+    res_ip.mark_down();
+  }
+  ldout(cct, 10) << "set all IPs unconnectable for endpoint url=" << orig_url << dendl;
 }
 
 void RGWRESTConn::populate_params(param_vec_t& params, const rgw_owner* uid, const string& zonegroup)
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index c4a9389f1bc..66c849f1a1e 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -65,48 +65,91 @@ inline param_vec_t make_param_list(const std::map<std::string, std::string> *pp)
   return params;
 }
 
+/**
+ * ResolvedIP - Per-IP connection status tracking.
+ *
+ * Each resolved IP address has its own failure status. An IP is considered
+ * "down" if last_failure is non-zero and less than CONN_STATUS_EXPIRE_SECS old.
+ * After the timeout, the IP becomes eligible for retry.
+ */
+struct ResolvedIP {
+  std::string connect_to;  // Pre-computed "host:port:ip:port" for CURLOPT_CONNECT_TO
+  mutable std::atomic<ceph::real_time> last_failure;
+
+  ResolvedIP() : last_failure(ceph::real_clock::zero()) {}
+
+  explicit ResolvedIP(std::string _connect_to)
+    : connect_to(std::move(_connect_to)), last_failure(ceph::real_clock::zero()) {}
+
+  // Move & assignment operations (required because std::atomic is not movable)
+  ResolvedIP(ResolvedIP&& o) noexcept
+    : connect_to(std::move(o.connect_to)), last_failure(o.last_failure.load()) {}
+
+  ResolvedIP& operator=(ResolvedIP&& o) noexcept {
+    connect_to = std::move(o.connect_to);
+    last_failure.store(o.last_failure.load());
+    return *this;
+  }
+
+  // Delete copy (std::atomic is not copyable)
+  ResolvedIP(const ResolvedIP&) = delete;
+  ResolvedIP& operator=(const ResolvedIP&) = delete;
+
+  void mark_down() const { last_failure.store(ceph::real_clock::now()); }
+  void mark_up() const { last_failure.store(ceph::real_clock::zero()); }
+};
+
+/**
+ * ResolvedEndpoint - A zone endpoint URL with its resolved IP addresses.
+ *
+ * Tracks per-IP connection status. An endpoint is considered "down" only when
+ * ALL of its IPs are marked as failed (within the retry timeout window).
+ */
 struct ResolvedEndpoint {
   std::string url;                // e.g., "https://s3.abc.com:8443"
   std::string scheme;             // e.g., "https"
   std::string host;               // e.g., "s3.abc.com"
   int port = -1;                  // e.g., 8443
-  std::vector<std::string> ips; // the IPs the endpoint resolves to
-  std::vector<std::string> connect_to_strings;  // Pre-computed full connect_to strings for each IP
-  size_t rr_index = 0;            // round-robin index for IPs
+  std::vector<ResolvedIP> resolved_ips;  // Per-IP connect_to strings with health status
+  mutable size_t endpoint_ips_round_robin_counter = 0;    // round-robin index for IPs
+  mutable std::atomic<ceph::real_time> last_failure_time; // most recent IP failure seen on this endpoint
 
-  /* endpoint health state: the endpoint is not able to connect if the timestamp is not real_clock::zero */
-  std::atomic<ceph::real_time> status;
+  ResolvedEndpoint() : last_failure_time(ceph::real_clock::zero()) {}
 
-  ResolvedEndpoint() = default;
-
-  // Custom move constructor (required because std::atomic is not movable)
+  // Custom move constructor (required because of atomics in ResolvedIP)
   ResolvedEndpoint(ResolvedEndpoint&& other) noexcept
     : url(std::move(other.url)),
       scheme(std::move(other.scheme)),
       host(std::move(other.host)),
       port(other.port),
-      ips(std::move(other.ips)),
-      connect_to_strings(std::move(other.connect_to_strings)),
-      rr_index(other.rr_index),
-      status(other.status.load())
+      resolved_ips(std::move(other.resolved_ips)),
+      endpoint_ips_round_robin_counter(other.endpoint_ips_round_robin_counter),
+      last_failure_time(other.last_failure_time.load())
   {}
 
-  // Custom move assignment (required because std::atomic is not movable)
+  // Custom move assignment
   ResolvedEndpoint& operator=(ResolvedEndpoint&& other) noexcept {
     url = std::move(other.url);
     scheme = std::move(other.scheme);
     host = std::move(other.host);
     port = other.port;
-    ips = std::move(other.ips);
-    connect_to_strings = std::move(other.connect_to_strings);
-    rr_index = other.rr_index;
-    status.store(other.status.load());
+    resolved_ips = std::move(other.resolved_ips);
+    endpoint_ips_round_robin_counter = other.endpoint_ips_round_robin_counter;
+    last_failure_time.store(other.last_failure_time.load());
     return *this;
   }
 
-  // Delete copy operations (std::atomic is not copyable)
+  // Delete copy operations
   ResolvedEndpoint(const ResolvedEndpoint&) = delete;
   ResolvedEndpoint& operator=(const ResolvedEndpoint&) = delete;
+
+  // Find IP status by connect_to string
+  ResolvedIP* find_ip_status(const std::string& connect_to_str) {
+    for (auto& ip : resolved_ips) {
+      if (ip.connect_to == connect_to_str) return &ip;
+    }
+    return nullptr;
+  }
 };
 
 class RGWRESTConn

From 2d8061cf7545eac0a9f9e0a5e29362e4baa7873d Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 3 Mar 2026 01:39:19 +0000
Subject: [PATCH 088/596] rgw: make CONN_STATUS_EXPIRE_SECS a cfg option

Introduce a new radosgw option 'rgw_rest_conn_ip_fail_timeout_secs' to
be able to set the constant CONN_STATUS_EXPIRE_SECS dynamically.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/common/options/rgw.yaml.in | 18 ++++++++++++++++++
 src/rgw/rgw_rest_conn.cc       | 10 +++++-----
 src/rgw/rgw_rest_conn.h        |  2 +-
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index 2d1c4cb777f..701f45759f7 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -2080,6 +2080,24 @@ options:
   default: false
   services:
   - rgw
+  see_also:
+  - rgw_rest_conn_ip_fail_timeout_secs
+  with_legacy: true
+- name: rgw_rest_conn_ip_fail_timeout_secs
+  desc: IP failure tracking timeout (requires rgw_rest_conn_connect_to_resolved_ips=true)
+  type: uint
+  level: advanced
+  long_desc: When rgw_rest_conn_connect_to_resolved_ips is enabled, RGW tracks
+    per-IP connection failures by remembering the timestamp of the most recent
+    failure. This option controls how long (in seconds) an IP address remains
+    marked as "failed" before RGW considers it eligible for retry.
+    After this timeout expires, the IP will be tried again in the normal
+    round-robin rotation.
+  default: 2
+  services:
+  - rgw
+  see_also:
+  - rgw_rest_conn_connect_to_resolved_ips
   with_legacy: true
 - name: rgw_obj_stripe_size
   type: size
diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 412a33d95a1..6d27faa27c5 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -167,7 +167,7 @@ void RGWRESTConn::populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& r
     return;
   }
 
-  static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
+  const auto ip_fail_timeout = cct->_conf->rgw_rest_conn_ip_fail_timeout_secs;
   const size_t num_ips = resolved_endpoint.resolved_ips.size();
 
   // Round-robin through IPs, skipping any that are marked down
@@ -182,7 +182,7 @@ void RGWRESTConn::populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& r
     }
 
     auto diff = ceph::to_seconds<double>(ceph::real_clock::now() - last_fail);
-    if (diff >= CONN_STATUS_EXPIRE_SECS) {
+    if (diff >= ip_fail_timeout) {
       // Failure expired, mark IP as up and use it
       ip_status.mark_up();
       ldout(cct, 5) << "IP " << ip_status.connect_to << " failure expired, marking up" << dendl;
@@ -204,7 +204,7 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
     return -EINVAL;
   }
 
-  static constexpr uint32_t CONN_STATUS_EXPIRE_SECS = 2;
+  const auto ip_fail_timeout = cct->_conf->rgw_rest_conn_ip_fail_timeout_secs;
   auto now = ceph::real_clock::now();
 
   // Helper to check if an endpoint has at least one available IP
@@ -217,7 +217,7 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
     // Fast path: if no recent failures at endpoint level, all IPs are available
     const auto& ep_last_fail = res_ep.last_failure_time.load();
     if (ceph::real_clock::is_zero(ep_last_fail) ||
-        ceph::to_seconds<double>(now - ep_last_fail) >= CONN_STATUS_EXPIRE_SECS) {
+        ceph::to_seconds<double>(now - ep_last_fail) >= ip_fail_timeout) {
       return true;
     }
 
@@ -228,7 +228,7 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
         return true;  // This IP is up
       }
       auto diff = ceph::to_seconds<double>(now - last_fail);
-      if (diff >= CONN_STATUS_EXPIRE_SECS) {
+      if (diff >= ip_fail_timeout) {
         return true;  // This IP's failure has expired
       }
     }
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 66c849f1a1e..325a9ab7a1d 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -69,7 +69,7 @@ inline param_vec_t make_param_list(const std::map<std::string, std::string> *pp)
  * ResolvedIP - Per-IP connection status tracking.
  *
  * Each resolved IP address has its own failure status. An IP is considered
- * "down" if last_failure is non-zero and less than CONN_STATUS_EXPIRE_SECS old.
+ * "down" if last_failure is non-zero and less than rgw_rest_conn_ip_fail_timeout_secs old.
  * After the timeout, the IP becomes eligible for retry.
  */
 struct ResolvedIP {

From 11aa2c86cd341c9a73978458426f4ebf093798e4 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 3 Mar 2026 16:49:21 +0000
Subject: [PATCH 089/596] rgw/zone: increase visibility into zone connections
 via admin socket

Adds a new admin socket command to dump zone connection details
including endpoints, resolved IPs, and health status. Useful for
debugging multisite connectivity issues.

Usage: ceph daemon <radosgw.asok> zone connections

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/services/svc_zone.cc | 192 +++++++++++++++++++++++++++++++++++
 src/rgw/services/svc_zone.h  |   3 +
 2 files changed, 195 insertions(+)

diff --git a/src/rgw/services/svc_zone.cc b/src/rgw/services/svc_zone.cc
index 055a5f6fe69..88102761333 100644
--- a/src/rgw/services/svc_zone.cc
+++ b/src/rgw/services/svc_zone.cc
@@ -2,6 +2,7 @@
 // vim: ts=8 sw=2 sts=2 expandtab ft=cpp
 
 #include "svc_zone.h"
+#include "common/admin_socket.h"
 #include "svc_sys_obj.h"
 #include "svc_sync_modules.h"
 
@@ -20,6 +21,188 @@
 using namespace std;
 using namespace rgw_zone_defaults;
 
+
+// Admin socket hook for zone connection information
+class RGWSI_Zone_ASocketHook : public AdminSocketHook {
+  RGWSI_Zone *svc;
+
+  static constexpr std::string_view admin_commands[][2] = {
+    {
+      "zone connections",
+      "zone connections: list zone connections with endpoints and IP health status"
+    }
+  };
+
+public:
+  RGWSI_Zone_ASocketHook(RGWSI_Zone *_svc) : svc(_svc) {}
+
+  int start();
+  void shutdown();
+
+  int call(std::string_view command, const cmdmap_t& cmdmap,
+           const bufferlist&,
+           Formatter *f,
+           std::ostream& ss,
+           bufferlist& out) override;
+};
+
+int RGWSI_Zone_ASocketHook::start()
+{
+  auto admin_socket = svc->ctx()->get_admin_socket();
+  for (auto cmd : admin_commands) {
+    int r = admin_socket->register_command(cmd[0], this, cmd[1]);
+    if (r < 0) {
+      ldout(svc->ctx(), 0) << "ERROR: fail to register admin socket command (r="
+        << r << ")" << dendl;
+      return r;
+    }
+  }
+  return 0;
+}
+
+void RGWSI_Zone_ASocketHook::shutdown()
+{
+  auto admin_socket = svc->ctx()->get_admin_socket();
+  admin_socket->unregister_commands(this);
+}
+
+static void dump_resolved_ip(Formatter *f, const ResolvedIP& ip,
+                             double timeout_secs) {
+  f->open_object_section("ip");
+  f->dump_string("connect_to", ip.connect_to);
+  auto last_fail = ip.last_failure.load();
+  if (ceph::real_clock::is_zero(last_fail)) {
+    f->dump_string("status", "up");
+    f->dump_string("last_failure", "");
+  } else {
+    // Check if failure has expired based on timeout
+    auto now = ceph::real_clock::now();
+    auto diff = ceph::to_seconds<double>(now - last_fail);
+    if (diff >= timeout_secs) {
+      f->dump_string("status", "retry-ready");  // Timeout expired, eligible for retry but unknown if actually up
+    } else {
+      f->dump_string("status", "down");
+    }
+    f->dump_string("last_failure", ceph::to_iso_8601(last_fail));
+  }
+  f->close_section();
+}
+
+static void dump_resolved_endpoint(Formatter *f, const ResolvedEndpoint& ep,
+                                   double timeout_secs) {
+  f->open_object_section("endpoint");
+  f->dump_string("url", ep.url);
+  f->dump_string("scheme", ep.scheme);
+  f->dump_string("host", ep.host);
+  f->dump_int("port", ep.port);
+  f->dump_string("last_failure_time",
+                 ceph::real_clock::is_zero(ep.last_failure_time.load())
+                   ? "" : ceph::to_iso_8601(ep.last_failure_time.load()));
+
+  f->open_array_section("resolved_ips");
+  for (const auto& ip : ep.resolved_ips) {
+    dump_resolved_ip(f, ip, timeout_secs);
+  }
+  f->close_section();
+
+  f->close_section();
+}
+
+static void dump_rest_conn(Formatter *f, const std::string& name,
+                           RGWRESTConn* conn) {
+  if (!conn) return;
+
+  f->open_object_section(name);
+  f->dump_string("remote_id", conn->get_remote_id());
+  f->dump_unsigned("endpoint_count", conn->get_endpoint_count());
+
+  double timeout_secs = conn->get_ctx()->_conf->rgw_rest_conn_ip_fail_timeout_secs;
+
+  const auto& endpoints = conn->get_resolved_endpoints();
+  f->open_array_section("endpoints");
+  for (const auto& ep : endpoints) {
+    dump_resolved_endpoint(f, ep, timeout_secs);
+  }
+  f->close_section();
+
+  f->close_section();
+}
+
+int RGWSI_Zone_ASocketHook::call(
+  std::string_view command, const cmdmap_t& cmdmap,
+  const bufferlist&,
+  Formatter *f,
+  std::ostream& ss,
+  bufferlist& out)
+{
+  if (command == "zone connections"sv) {
+    f->open_object_section("zone_connections");
+
+    f->dump_string("current_time", ceph::to_iso_8601(ceph::real_clock::now()));
+    f->dump_string("current_zone_id", svc->zone_id().id);
+    f->dump_string("current_zone_name", svc->zone_name());
+
+    auto* master_conn = svc->get_master_conn();
+    if (master_conn) {
+      dump_rest_conn(f, "master_conn", master_conn);
+    }
+
+    // Zone connections map
+    auto& zone_conn_map = svc->get_zone_conn_map();
+    f->open_object_section("zone_conn_map");
+    for (auto& [zone_id, conn] : zone_conn_map) {
+      dump_rest_conn(f, zone_id.id, conn);
+    }
+    f->close_section();
+
+    // Only show zonegroup_conn_map if it has connections beyond the master
+    auto& zonegroup_conn_map = svc->get_zonegroup_conn_map();
+    bool zg_differs_from_master = false;
+    if (!master_conn) {
+      zg_differs_from_master = !zonegroup_conn_map.empty();
+    } else if (zonegroup_conn_map.size() > 1) {
+      zg_differs_from_master = true;
+    } else if (zonegroup_conn_map.size() == 1) {
+      auto& [zg_name, conn] = *zonegroup_conn_map.begin();
+      zg_differs_from_master = (conn->get_remote_id() != master_conn->get_remote_id());
+    }
+    if (zg_differs_from_master) {
+      f->open_object_section("zonegroup_conn_map");
+      for (auto& [zg_name, conn] : zonegroup_conn_map) {
+        dump_rest_conn(f, zg_name, conn);
+      }
+      f->close_section();
+    }
+
+    // Only show zone_data_notify_to_map if it differs from zone_conn_map
+    auto& notify_map = svc->get_zone_data_notify_to_map();
+    bool notify_differs = false;
+    if (notify_map.size() != zone_conn_map.size()) {
+      notify_differs = true;
+    } else {
+      for (auto& [zone_id, conn] : notify_map) {
+        auto it = zone_conn_map.find(zone_id);
+        if (it == zone_conn_map.end() || it->second != conn) {
+          notify_differs = true;
+          break;
+        }
+      }
+    }
+    if (notify_differs) {
+      f->open_object_section("zone_data_notify_to_map");
+      for (auto& [zone_id, conn] : notify_map) {
+        dump_rest_conn(f, zone_id.id, conn);
+      }
+      f->close_section();
+    }
+
+    f->close_section();
+    return 0;
+  }
+
+  return -ENOSYS;
+}
+
 RGWSI_Zone::RGWSI_Zone(CephContext *cct, rgw::sal::ConfigStore* _cfgstore, const rgw::SiteConfig* _site)
         : RGWServiceInstance(cct), cfgstore(_cfgstore), site(_site)
 {
@@ -212,11 +395,20 @@ int RGWSI_Zone::do_start(optional_yield y, const DoutPrefixProvider *dpp)
   ldpp_dout(dpp, 20) << "started zone id=" << zone_params->get_id() << " (name=" << zone_params->get_name() << 
         ") with tier type = " << zone_public_config->tier_type << dendl;
 
+
+  // Initialize admin socket hook
+  asocket_hook = std::make_unique<RGWSI_Zone_ASocketHook>(this);
+  asocket_hook->start();
   return 0;
 }
 
 void RGWSI_Zone::shutdown()
 {
+  // Shutdown admin socket hook
+  if (asocket_hook) {
+    asocket_hook->shutdown();
+  }
+
   delete rest_master_conn;
 
   for (auto& item : zone_conn_map) {
diff --git a/src/rgw/services/svc_zone.h b/src/rgw/services/svc_zone.h
index 451faac8bef..1c702ec40c8 100644
--- a/src/rgw/services/svc_zone.h
+++ b/src/rgw/services/svc_zone.h
@@ -4,6 +4,7 @@
 #pragma once
 
 #include "driver/rados/rgw_service.h"
+#include <memory>
 
 
 class RGWSI_SysObj;
@@ -22,6 +23,7 @@ class RGWBucketSyncPolicyHandler;
 class RGWRESTConn;
 
 struct rgw_sync_policy_info;
+class RGWSI_Zone_ASocketHook;
 
 class RGWSI_Zone : public RGWServiceInstance
 {
@@ -57,6 +59,7 @@ class RGWSI_Zone : public RGWServiceInstance
   std::unique_ptr<rgw_sync_policy_info> sync_policy;
   rgw::sal::ConfigStore *cfgstore{nullptr};
   const rgw::SiteConfig* site{nullptr};
+  std::unique_ptr<RGWSI_Zone_ASocketHook> asocket_hook;
 
   void init(RGWSI_SysObj *_sysobj_svc,
 	    librados::Rados* rados_,

From 9f0c1093a002f4de94201cb54c1c733f5828e965 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 3 Mar 2026 20:46:38 +0000
Subject: [PATCH 090/596] rgw: rename round-robin counters for brevity

Rename endpoint_round_robin_counter to endpoint_rr_index and
endpoint_ips_round_robin_counter to ip_rr_index for shorter,
cleaner variable names while maintaining clarity.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 11 ++++++-----
 src/rgw/rgw_rest_conn.h  |  8 ++++----
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 6d27faa27c5..c0060c8fbdb 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -124,7 +124,7 @@ RGWRESTConn::RGWRESTConn(CephContext *_cct,
 
 RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
   : cct(other.cct),
-    endpoint_round_robin_counter(other.endpoint_round_robin_counter.load()),
+    endpoint_rr_index(other.endpoint_rr_index.load()),
     resolved_endpoints(std::move(other.resolved_endpoints)),
     key(std::move(other.key)),
     self_zone_group(std::move(other.self_zone_group)),
@@ -137,7 +137,7 @@ RGWRESTConn::RGWRESTConn(RGWRESTConn&& other)
 RGWRESTConn& RGWRESTConn::operator=(RGWRESTConn&& other)
 {
   cct = other.cct;
-  endpoint_round_robin_counter = other.endpoint_round_robin_counter.load();
+  endpoint_rr_index = other.endpoint_rr_index.load();
   resolved_endpoints = std::move(other.resolved_endpoints);
   key = std::move(other.key);
   self_zone_group = std::move(other.self_zone_group);
@@ -169,10 +169,11 @@ void RGWRESTConn::populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& r
 
   const auto ip_fail_timeout = cct->_conf->rgw_rest_conn_ip_fail_timeout_secs;
   const size_t num_ips = resolved_endpoint.resolved_ips.size();
+  auto now = ceph::real_clock::now();
 
   // Round-robin through IPs, skipping any that are marked down
   for (size_t i = 0; i < num_ips; ++i) {
-    size_t idx = resolved_endpoint.endpoint_ips_round_robin_counter++ % num_ips;
+    size_t idx = resolved_endpoint.ip_rr_index++ % num_ips;
     ResolvedIP& ip_status = resolved_endpoint.resolved_ips[idx];
 
     const auto& last_fail = ip_status.last_failure.load();
@@ -181,7 +182,7 @@ void RGWRESTConn::populate_connect_to(RGWEndpoint& endpoint, ResolvedEndpoint& r
       return;
     }
 
-    auto diff = ceph::to_seconds<double>(ceph::real_clock::now() - last_fail);
+    auto diff = ceph::to_seconds<double>(now - last_fail);
     if (diff >= ip_fail_timeout) {
       // Failure expired, mark IP as up and use it
       ip_status.mark_up();
@@ -238,7 +239,7 @@ int RGWRESTConn::get_endpoint(RGWEndpoint& endpoint)
   size_t num = 0;
   size_t selected_idx = 0;
   while (num < resolved_endpoints.size()) {
-    int i = ++endpoint_round_robin_counter;
+    int i = ++endpoint_rr_index;
     selected_idx = i % resolved_endpoints.size();
 
     ResolvedEndpoint& res_ep = resolved_endpoints[selected_idx];
diff --git a/src/rgw/rgw_rest_conn.h b/src/rgw/rgw_rest_conn.h
index 325a9ab7a1d..82794867e56 100644
--- a/src/rgw/rgw_rest_conn.h
+++ b/src/rgw/rgw_rest_conn.h
@@ -111,7 +111,7 @@ struct ResolvedEndpoint {
   std::string host;               // e.g., "s3.abc.com"
   int port = -1;                  // e.g., 8443
   std::vector<ResolvedIP> resolved_ips;  // Per-IP connect_to strings with health status
-  mutable size_t endpoint_ips_round_robin_counter = 0;    // round-robin index for IPs
+  mutable std::atomic<size_t> ip_rr_index{0};    // round-robin index for IPs
   mutable std::atomic<ceph::real_time> last_failure_time; // most recent IP failure seen on this endpoint
 
   ResolvedEndpoint() : last_failure_time(ceph::real_clock::zero()) {}
@@ -123,7 +123,7 @@ struct ResolvedEndpoint {
       host(std::move(other.host)),
       port(other.port),
       resolved_ips(std::move(other.resolved_ips)),
-      endpoint_ips_round_robin_counter(other.endpoint_ips_round_robin_counter),
+      ip_rr_index(other.ip_rr_index.load()),
       last_failure_time(other.last_failure_time.load())
   {}
 
@@ -134,7 +134,7 @@ struct ResolvedEndpoint {
     host = std::move(other.host);
     port = other.port;
     resolved_ips = std::move(other.resolved_ips);
-    endpoint_ips_round_robin_counter = other.endpoint_ips_round_robin_counter;
+    ip_rr_index.store(other.ip_rr_index.load());
     last_failure_time.store(other.last_failure_time.load());
     return *this;
   }
@@ -155,7 +155,7 @@ struct ResolvedEndpoint {
 class RGWRESTConn
 {
   CephContext *cct;
-  std::atomic<int64_t> endpoint_round_robin_counter = { 0 }; // Round-robin counter for resolved_endpoints
+  std::atomic<int64_t> endpoint_rr_index = { 0 }; // Round-robin counter for resolved_endpoints
   std::vector<ResolvedEndpoint> resolved_endpoints;
   RGWAccessKey key;
   std::string self_zone_group;

From 9eda20715c8dba181918773b59bd4648289bd66e Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 24 Mar 2026 15:52:38 +0000
Subject: [PATCH 091/596] doc/radosgw: expose
 rgw_rest_conn_connect_to_resolved_ips and rgw_rest_conn_ip_fail_timeout_secs

Expose the confval information for the confval "rgw_rest_conn_connect_to_resolved_ips"
and "rgw_rest_conn_ip_fail_timeout_secs" so that they can be seen in the
"Ceph Object Gateway Config Reference" as these are meant to be client-facing configs.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 doc/radosgw/config-ref.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/radosgw/config-ref.rst b/doc/radosgw/config-ref.rst
index feef5f3515e..ea97a55946a 100644
--- a/doc/radosgw/config-ref.rst
+++ b/doc/radosgw/config-ref.rst
@@ -58,6 +58,8 @@ instances or all radosgw-admin options can be put into the ``[global]`` or the
 .. confval:: rgw_account_default_quota_max_objects
 .. confval:: rgw_account_default_quota_max_size
 .. confval:: rgw_verify_ssl
+.. confval:: rgw_rest_conn_connect_to_resolved_ips
+.. confval:: rgw_rest_conn_ip_fail_timeout_secs
 .. confval:: rgw_max_chunk_size
 .. confval:: rgw_multi_obj_del_max_aio
 

From 7b37c21cfa6b6866a2efadbce257f9b6adad58ea Mon Sep 17 00:00:00 2001
From: "Ashwin M. Joshi" <ashjosh1@in.ibm.com>
Date: Wed, 18 Feb 2026 11:19:12 +0530
Subject: [PATCH 092/596] python-common: Move validation function to utils and
 remove unused

Fixes: https://tracker.ceph.com/issues/74986
Signed-off-by: Ashwin M. Joshi <ashjosh1@in.ibm.com>

 Conflicts:
	src/python-common/ceph/deployment/service_spec.py
	src/python-common/ceph/deployment/utils.py
---
 .../ceph/deployment/service_spec.py            | 18 +++++++-----------
 src/python-common/ceph/deployment/utils.py     |  6 ++++++
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 86bdf18451a..b5726820ee5 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -41,7 +41,7 @@ from ceph.deployment.hostspec import (
 )
 from ceph.deployment.utils import unwrap_ipv6, valid_addr, verify_non_negative_int
 from ceph.deployment.utils import verify_positive_int, verify_non_negative_number
-from ceph.deployment.utils import verify_boolean, verify_enum, verify_int
+from ceph.deployment.utils import verify_boolean, verify_enum, verify_int, verify_non_empty_string
 from ceph.deployment.utils import parse_combined_pem_file, validate_port, validate_unique_ports
 from ceph.cephadm.d3n_types import D3NCacheSpec, D3NCacheError
 from ceph.utils import is_hex
@@ -52,11 +52,6 @@ ServiceSpecT = TypeVar('ServiceSpecT', bound='ServiceSpec')
 FuncT = TypeVar('FuncT', bound=Callable)
 
 
-def validate_non_empty_string(value: Optional[str], field_name: str) -> None:
-    if not isinstance(value, str) or not value.strip():
-        raise SpecValidationError(f"Invalid {field_name}: Must be a non-empty string.")
-
-
 class TLSBlock(TypedDict, total=False):
     ssl: bool
     certificate_source: str
@@ -2827,15 +2822,16 @@ class OAuth2ProxySpec(ServiceSpec):
                 + ', '.join(missing_required_fields)
                 + '.'
             )
-        validate_non_empty_string(self.provider_display_name, "provider_display_name")
-        validate_non_empty_string(self.client_id, "client_id")
-        validate_non_empty_string(self.client_secret, "client_secret")
+        verify_non_empty_string(self.provider_display_name, "provider_display_name")
+        verify_non_empty_string(self.client_id, "client_id")
+        verify_non_empty_string(self.client_secret, "client_secret")
+
         self._validate_cookie_secret(self.cookie_secret)
         self._validate_url(self.oidc_issuer_url, "oidc_issuer_url")
         if self.redirect_url is not None:
             self._validate_url(self.redirect_url, "redirect_url")
         if self.scope is not None:
-            self._validate_non_empty_string(self.scope, "scope")
+            verify_non_empty_string(self.scope, "scope")
         if self.email_domains is not None:
             self._validate_domain_name(self.email_domains, "email_domains")
         if self.https_address is not None:
@@ -3657,7 +3653,7 @@ class TunedProfileSpec():
         if 'profile_name' not in spec:
             raise SpecValidationError('Tuned profile spec must include "profile_name" field')
         data['profile_name'] = spec['profile_name']
-        validate_non_empty_string(data['profile_name'], "profile_name")
+        verify_non_empty_string(data['profile_name'], "profile_name")
         if 'placement' in spec:
             data['placement'] = PlacementSpec.from_json(spec['placement'])
         if 'settings' in spec:
diff --git a/src/python-common/ceph/deployment/utils.py b/src/python-common/ceph/deployment/utils.py
index 3e901669f5c..52a53ea5b4f 100644
--- a/src/python-common/ceph/deployment/utils.py
+++ b/src/python-common/ceph/deployment/utils.py
@@ -191,3 +191,9 @@ def validate_unique_ports(ports: List[int]) -> None:
         raise SpecValidationError(
             'Invalid port: Duplicate ports are not allowed'
         )
+
+
+def verify_non_empty_string(field: Any, field_name: str) -> None:
+    # isinstance first so we never call .strip() on None or non-str
+    if not isinstance(field, str) or not field.strip():
+        raise SpecValidationError(f"Invalid {field_name}: Must be a non-empty string.")

From 05a28d1b635ca3d7e047545eec986b9bdade5a72 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sat, 25 Apr 2026 11:54:16 +0800
Subject: [PATCH 093/596] ceph-dencoder: skip dlclose under ASan so leaks
 symbolise
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The DencoderPlugin destructor calls dlclose() on each loaded plugin .so
before main() returns.  When LeakSanitizer's atexit-registered leak
check then runs, the plugin .so is no longer mapped in the process
address space, and any leak whose allocation stack passes through
plugin code is reported with "<unknown module>" — useless for
investigation.

This is not an ASan bug or a missing -g flag; it is the unavoidable
ordering of dlclose-before-leak-check.  Skipping dlclose under
__SANITIZE_ADDRESS__ leaves the plugins mapped until process exit,
restoring symbolisation.  The functional cost is zero: the kernel will
unmap the .so segments when the process exits anyway.

Without this, a developer triaging dencoder leaks under ASan has no
visibility into which plugin or which static initialiser is
responsible.  With this, the leak stacks resolve to real symbols and
real bugs become triagable.

This commit does not change leak-detection results in non-sanitiser
builds and is a no-op on FreeBSD (which already skipped dlclose).

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/tools/ceph-dencoder/denc_plugin.h | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/tools/ceph-dencoder/denc_plugin.h b/src/tools/ceph-dencoder/denc_plugin.h
index c5eacce47cb..09cb1438f17 100644
--- a/src/tools/ceph-dencoder/denc_plugin.h
+++ b/src/tools/ceph-dencoder/denc_plugin.h
@@ -24,11 +24,23 @@ public:
   }
   ~DencoderPlugin() {
     unregister_dencoders();
-#if !defined(__FreeBSD__)
+#if defined(__has_feature)
+#  if __has_feature(address_sanitizer) || __has_feature(leak_sanitizer)
+#    define DENC_SKIP_DLCLOSE 1
+#  endif
+#endif
+#if defined(__SANITIZE_ADDRESS__) && !defined(DENC_SKIP_DLCLOSE)
+#  define DENC_SKIP_DLCLOSE 1
+#endif
+#if !defined(__FreeBSD__) && !defined(DENC_SKIP_DLCLOSE)
+    // Skip dlclose under ASan/LSan: the leak checker at process exit needs
+    // the .so still mapped to resolve symbols. Clang may not define
+    // __SANITIZE_ADDRESS__ (e.g. clang-19), hence the __has_feature check.
     if (mod) {
       dlclose(mod);
     }
 #endif
+#undef DENC_SKIP_DLCLOSE
   }
   const dencoders_t& register_dencoders() {
     static constexpr std::string_view REGISTER_DENCODERS_FUNCTION = "register_dencoders\0";

From e94e76f058bd1f6b1289da37dc99d57a665a03c9 Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Thu, 4 Jun 2026 09:39:06 +0000
Subject: [PATCH 094/596] crimson/os/seastore: add op_lat histogram buckets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initialize lat_hist_bounds_us bucket boundaries (0.25ms–20ms in 10
log-ish steps) for the op_lat Seastar histogram in register_metrics(),
and populate them in add_latency_sample(). Previously op_lat only
tracked sample_count and sample_sum, giving an average but no
percentile visibility.

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/seastore/seastore.cc |  8 ++++++++
 src/crimson/os/seastore/seastore.h  | 24 ++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index 68f0e310924..f66fc9fd964 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -178,6 +178,14 @@ void SeaStore::Shard::register_metrics(store_index_t store_index)
     {op_type_t::OMAP_ITERATE,     sm::label_instance("latency", "OMAP_ITERATE")},
   };
 
+  for (auto& hist : stats.op_lat) {
+    hist.buckets.resize(lat_hist_bounds_us.size());
+    for (std::size_t i = 0; i < lat_hist_bounds_us.size(); ++i) {
+      hist.buckets[i].upper_bound = lat_hist_bounds_us[i];
+      hist.buckets[i].count = 0;
+    }
+  }
+
   for (auto& [op_type, label] : labels_by_op_type) {
     auto desc = fmt::format("latency of seastore operation (optype={})",
                             op_type);
diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index 4b356f4304a..eae23b4525a 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -425,6 +425,19 @@ public:
 
     static constexpr auto LAT_MAX = static_cast<std::size_t>(op_type_t::MAX);
 
+    // Histogram bucket upper bounds in microseconds (0.25ms–20ms).
+    // Ops above 20ms land in the last bucket as overflow.
+    static constexpr std::array<double, 14> lat_hist_bounds_us = {
+      250, 500, 1000,
+      1500, 2000, 3000,
+      5000,
+      7500, 10000,
+      15000, 20000,
+      30000, 50000,
+      100000
+    };
+
+
     struct {
       std::array<seastar::metrics::histogram, LAT_MAX> op_lat;
     } stats;
@@ -440,6 +453,17 @@ public:
       seastar::metrics::histogram& lat = get_latency(op_type);
       lat.sample_count++;
       lat.sample_sum += std::chrono::duration_cast<std::chrono::milliseconds>(dur).count();
+      bool found = false;
+      for (auto& b : lat.buckets) {
+        if (static_cast<double>(std::chrono::duration_cast<std::chrono::microseconds>(dur).count()) <= b.upper_bound) {
+          ++b.count;
+          found = true;
+          break;
+        }
+      }
+      if (!found && !lat.buckets.empty()) {
+        ++lat.buckets.back().count;
+      }
     }
 
     /*

From 18562abadef0bf64d7a106c5a3ec540127c60e87 Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Thu, 4 Jun 2026 09:39:11 +0000
Subject: [PATCH 095/596] crimson/os/seastore: switch op_lat sample_sum from ms
 to us

Sub-ms ops rounded to zero under the old millisecond cast, making
the average meaningless for fast NVMe workloads. sample_sum is now
in microseconds; divide by 1000 for ms average.

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/seastore/seastore.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index eae23b4525a..54dd67c783f 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -451,11 +451,12 @@ public:
     void add_latency_sample(op_type_t op_type,
         std::chrono::steady_clock::duration dur) {
       seastar::metrics::histogram& lat = get_latency(op_type);
+      auto us = std::chrono::duration_cast<std::chrono::microseconds>(dur).count();
       lat.sample_count++;
-      lat.sample_sum += std::chrono::duration_cast<std::chrono::milliseconds>(dur).count();
+      lat.sample_sum += us;
       bool found = false;
       for (auto& b : lat.buckets) {
-        if (static_cast<double>(std::chrono::duration_cast<std::chrono::microseconds>(dur).count()) <= b.upper_bound) {
+        if (static_cast<double>(us) <= b.upper_bound) {
           ++b.count;
           found = true;
           break;

From 47c6618d8138928abf5ce337d0f0fb3b91de02ef Mon Sep 17 00:00:00 2001
From: Matt Benjamin <mbenjamin@redhat.com>
Date: Wed, 27 May 2026 00:14:17 -0400
Subject: [PATCH 096/596] rgwlc:  faithfully store lifecycle filters

Fix the bug where an empty lifecycle filter was stored
identically to one with an empty old-format prefix rule--
which caused the recovered rules to be formed incorrectly
as prefix rules.

Found by Kyle Bader and Tekton workflow.  Updated to not declare
virtual methods in LCFilter.

Fixes: https://tracker.ceph.com/issues/76806

Signed-off-by: Matt Benjamin <mbenjamin@redhat.com>
---
 src/rgw/rgw_lc.h     | 21 +++++++++++++++------
 src/rgw/rgw_lc_s3.cc |  2 ++
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/rgw/rgw_lc.h b/src/rgw/rgw_lc.h
index b4cab41916d..85570dd0c5f 100644
--- a/src/rgw/rgw_lc.h
+++ b/src/rgw/rgw_lc.h
@@ -3,6 +3,7 @@
 
 #pragma once
 
+#include <cstdint>
 #include <map>
 #include <array>
 #include <string>
@@ -176,6 +177,7 @@ enum class LCFlagType : uint16_t
 {
   none = 0,
   ArchiveZone,
+  Filter,
 };
 
 class LCFlag {
@@ -201,11 +203,11 @@ class LCFilter
     }
    }
 
-  static constexpr std::array<LCFlag, 2> filter_flags =
-  {
-    LCFlag(LCFlagType::none, "none"),
-    LCFlag(LCFlagType::ArchiveZone, "ArchiveZone"),
-  };
+   static constexpr std::array<LCFlag, 3> filter_flags = {
+     LCFlag(LCFlagType::none, "none"),
+     LCFlag(LCFlagType::ArchiveZone, "ArchiveZone"),
+     LCFlag(LCFlagType::Filter, "Filter"),
+   };
 
 protected:
   std::string prefix;
@@ -217,7 +219,10 @@ protected:
 public:
 
   LCFilter() : flags(make_flag(LCFlagType::none))
-    {}
+  {}
+
+  ~LCFilter()
+  {}
 
   const std::string& get_prefix() const {
     return prefix;
@@ -231,6 +236,10 @@ public:
     return flags;
   }
 
+  void set_flag(LCFlagType flag) {
+    flags |= make_flag(flag);
+  }
+
   bool empty() const {
     return !(has_prefix() || has_tags() || has_flags() ||
 	     has_size_rule());
diff --git a/src/rgw/rgw_lc_s3.cc b/src/rgw/rgw_lc_s3.cc
index eb8ff22ec5b..b84ba5a80c9 100644
--- a/src/rgw/rgw_lc_s3.cc
+++ b/src/rgw/rgw_lc_s3.cc
@@ -255,6 +255,8 @@ void LCRule_S3::decode_xml(XMLObj *obj)
     if (!RGWXMLDecoder::decode_xml("Prefix", prefix, obj)) {
       throw RGWXMLDecoder::err("missing Prefix in Filter");
     }
+  } else {
+    filter_s3.set_flag(LCFlagType::Filter);
   }
   filter = (LCFilter)filter_s3;
 

From 3513cd888a0e6c6c879ef42823255c2e620a8fca Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 14 Apr 2026 16:46:05 +0000
Subject: [PATCH 097/596] rgw: store RGWEndpoint URL as boost::urls::url

Replace raw string manipulation in RGWEndpoint with boost::urls::url.
URL path/query/host changes now use set_path(), set_query(), set_host()
instead of string concatenation.

Rename original_url to endpoint_url_lookup_id to clarify its role as a
health-tracking key for ResolvedEndpoint lookup in
set_endpoint_unconnectable().

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_http_client.cc           |   2 +-
 src/rgw/rgw_http_client.h            |  94 ++++++++++++---------
 src/rgw/rgw_rest_client.cc           |  23 ++---
 src/rgw/rgw_rest_conn.cc             |   8 +-
 src/test/rgw/test_rgw_http_client.cc | 122 ++++++++++++++++-----------
 5 files changed, 139 insertions(+), 110 deletions(-)

diff --git a/src/rgw/rgw_http_client.cc b/src/rgw/rgw_http_client.cc
index 1b1d5bae8b7..e2d9d87180c 100644
--- a/src/rgw/rgw_http_client.cc
+++ b/src/rgw/rgw_http_client.cc
@@ -333,7 +333,7 @@ void RGWHTTPClient::init()
     }
   }
 
-  const string& url = endpoint.get_url();
+  const string url = endpoint.get_url();
 
   auto pos = url.find("://");
   if (pos == string::npos) {
diff --git a/src/rgw/rgw_http_client.h b/src/rgw/rgw_http_client.h
index 5aec7c40684..16f73ad23d6 100644
--- a/src/rgw/rgw_http_client.h
+++ b/src/rgw/rgw_http_client.h
@@ -10,6 +10,7 @@
 #include "rgw_http_client_types.h"
 
 #include <atomic>
+#include <boost/url.hpp>
 
 using param_pair_t = std::pair<std::string, std::string>;
 using param_vec_t = std::vector<param_pair_t>;
@@ -23,21 +24,22 @@ class RGWHTTPManager;
 /**
  * RGWEndpoint - Represents an HTTP endpoint with additional metdata such as connection routing.
  *
- * Unlike a plain URL string, RGWEndpoint carries additional information needed
- * to leverage libcurl's CURLOPT_CONNECT_TO option. This enables RGW to route
- * requests to specific IP addresses while preserving the original hostname for
- * TLS/SNI and Host headers.
+ * Wraps boost::urls::url for proper URL manipulation (set_path, set_query,
+ * set_host) instead of raw string concatenation.
+ *
+ * Carries a CURLOPT_CONNECT_TO override for IP-level routing.
  *
  * Fields:
- *  - url:          The effective URL for the request (may be modified with paths).
- *  - original_url: The initially configured endpoint URL (preserved for reference).
- *  - connect_to:   libcurl CONNECT_TO string (format: "host:port:addr:port") to
- *                  override connection routing without changing the request URL.
+ *  - endpoint_url_lookup_id: The initially configured endpoint URL (immutable).
+ *                 Used as a lookup key in RGWRESTConn to find the ResolvedEndpoint
+ *                 for health tracking (marking IPs as up/down).
+ *  - url:         boost::urls::url for the request URL (mutable via set_path, etc.).
+ *  - connect_to:  libcurl CONNECT_TO string (format: "host:port:addr:port").
  */
 struct RGWEndpoint {
 private:
-  std::string url;
-  std::string original_url;
+  std::string endpoint_url_lookup_id;
+  boost::urls::url url;
   std::string connect_to;
 
 public:
@@ -45,45 +47,57 @@ public:
 
   RGWEndpoint(const char* u) : RGWEndpoint(std::string(u)) {}
 
-  RGWEndpoint(std::string u, std::string c = {})
-    : url(std::move(u)), original_url(url), connect_to(std::move(c)) {}
-
-  RGWEndpoint with_url(std::string new_url) const {
-    RGWEndpoint e = *this;
-    e.set_url(std::move(new_url));
-    return e;
-  }
-
-  void set_url(const std::string& _url) {
-    url = _url;
-    // Capture the first URL assignment as the original
-    if (original_url.empty()) {
-      original_url = _url;
+  RGWEndpoint(const std::string& u) : endpoint_url_lookup_id(u) {
+    auto r = boost::urls::parse_uri(u);
+    if (r.has_value()) {
+      url = r.value();
     }
   }
-  const std::string& get_url() const { return url; }
-  const std::string& get_original_url() const { return original_url; }
 
-  void set_connect_to(const std::string& _connect_to) { connect_to = _connect_to; }
-  const std::string& get_connect_to() const { return connect_to; }
+  RGWEndpoint(const std::string& u, const std::string& c)
+    : endpoint_url_lookup_id(u), connect_to(c) {
+    auto r = boost::urls::parse_uri(u);
+    if (r.has_value()) {
+      url = r.value();
+    }
+  }
+
+  void set_url(const std::string& u) {
+    auto r = boost::urls::parse_uri(u);
+    if (r.has_value()) {
+      url = r.value();
+    }
+    if (endpoint_url_lookup_id.empty()) {
+      endpoint_url_lookup_id = u;
+    }
+  }
+
+  std::string get_url() const { return std::string(url.buffer()); }
+  const std::string& get_endpoint_url_lookup_id() const { return endpoint_url_lookup_id; }
+
+  void set_path(const std::string& path) { url.set_encoded_path(path); }
+  void set_query(const std::string& q) {
+    if (q.empty()) return;
+    // strip leading '?' - if present, boost::urls adds it automatically
+    url.set_encoded_query(q[0] == '?' ? q.substr(1) : q);
+  }
+  void set_host(const std::string& h) { url.set_host(h); }
 
   void add_trailing_slash() {
-    if (! url.empty() && url.back() != '/')
-      append_to_url("/");
+    auto path = std::string(url.encoded_path());
+    if (path.empty() || path.back() != '/') {
+      path += '/';
+      url.set_encoded_path(path);
+    }
   }
 
-  void append_to_url(const std::string& suffix) {
-    url.append(suffix);
-  }
+  void set_connect_to(const std::string& c) { connect_to = c; }
+  const std::string& get_connect_to() const { return connect_to; }
 
   friend std::ostream& operator<<(std::ostream& os, const RGWEndpoint& ep) {
-    os << "RGWEndpoint: url=" << ep.url;
-    if (!ep.original_url.empty() && ep.original_url != ep.url) {
-      os << " original_url=" << ep.original_url;
-    }
-    if (!ep.connect_to.empty()) {
-      os << " connect_to=" << ep.connect_to;
-    }
+    os << "RGWEndpoint: url=" << ep.url.buffer()
+       << " endpoint_url_lookup_id=" << (ep.endpoint_url_lookup_id.empty() ? "<empty>" : ep.endpoint_url_lookup_id)
+       << " connect_to=" << (ep.connect_to.empty() ? "<empty>" : ep.connect_to);
     return os;
   }
 };
diff --git a/src/rgw/rgw_rest_client.cc b/src/rgw/rgw_rest_client.cc
index e82680e7b0e..02b80c2f1ed 100644
--- a/src/rgw/rgw_rest_client.cc
+++ b/src/rgw/rgw_rest_client.cc
@@ -425,16 +425,8 @@ auto RGWRESTSimpleRequest::forward_request(const DoutPrefixProvider *dpp, const
   string params_str;
   get_params_str(new_info.args.get_params(), params_str);
 
-  string new_url = endpoint.get_url();
-  string& resource = new_info.request_uri;
-  string new_resource = resource;
-  if (new_url[new_url.size() - 1] == '/' && resource[0] == '/') {
-    new_url = new_url.substr(0, new_url.size() - 1);
-  } else if (resource[0] != '/') {
-    new_resource = "/";
-    new_resource.append(resource);
-  }
-  new_url.append(new_resource + params_str);
+  endpoint.set_path(new_info.request_uri);
+  endpoint.set_query(params_str);
 
   bufferlist::iterator bliter;
 
@@ -446,7 +438,6 @@ auto RGWRESTSimpleRequest::forward_request(const DoutPrefixProvider *dpp, const
   }
 
   method = new_info.method;
-  endpoint.set_url(new_url);
 
   std::ignore = process(dpp, y);
 
@@ -581,7 +572,9 @@ void RGWRESTGenerateHTTPHeaders::init(const string& _method, const string& host,
                           url_encode(iter->second, encode_slash));
   }
 
-  endpoint = _endpoint.with_url(_endpoint.get_url() + resource + params_str);
+  endpoint = _endpoint;
+  endpoint.set_path(resource);
+  endpoint.set_query(params_str);
 
   const std::string date_str = get_gmt_date_str();
   new_env->set("HTTP_DATE", date_str.c_str());
@@ -692,8 +685,8 @@ void RGWRESTStreamS3PutObj::send_init(const rgw_obj& obj)
 
   if (host_style == VirtualStyle) {
     resource_str = obj.get_oid();
-    new_endpoint.set_url(protocol + "://" + bucket_name + "." + host);
     new_host = bucket_name + "." + new_host;
+    new_endpoint.set_host(new_host);
   } else {
     resource_str = bucket_name + "/" + obj.get_oid();
   }
@@ -847,13 +840,13 @@ int RGWRESTStreamRWRequest::do_send_prepare(const DoutPrefixProvider *dpp, RGWAc
   }
 
   if (host_style == VirtualStyle) {
-    new_endpoint.set_url(protocol + "://" + bucket_name + "." + host);
+    new_host = bucket_name + "." + host;
+    new_endpoint.set_host(new_host);
     if(pos == string::npos) {
       new_resource = "";
     } else {
       new_resource = new_resource.substr(pos+1);
     }
-    new_host = bucket_name + "." + host;
   }
   new_endpoint.add_trailing_slash();
 
diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index c0060c8fbdb..46f6685c6fd 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -273,11 +273,11 @@ RGWEndpoint RGWRESTConn::get_endpoint()
 
 void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
 {
-  const string& orig_url = endpoint.get_original_url();
+  const string& endpoint_id = endpoint.get_endpoint_url_lookup_id();
   const string& connect_to = endpoint.get_connect_to();
 
-  ResolvedEndpoint* res_ep = find_resolved_endpoint(orig_url);
-  if (orig_url.empty() || !res_ep) {
+  ResolvedEndpoint* res_ep = find_resolved_endpoint(endpoint_id);
+  if (endpoint_id.empty() || !res_ep) {
     ldout(cct, 0) << "ERROR: endpoint is not valid or not found: "
       << endpoint << dendl;
     return;
@@ -301,7 +301,7 @@ void RGWRESTConn::set_endpoint_unconnectable(const RGWEndpoint& endpoint)
   for (auto& res_ip : res_ep->resolved_ips) {
     res_ip.mark_down();
   }
-  ldout(cct, 10) << "set all IPs unconnectable for endpoint url=" << orig_url << dendl;
+  ldout(cct, 10) << "set all IPs unconnectable for endpoint=" << endpoint << dendl;
 }
 
 void RGWRESTConn::populate_params(param_vec_t& params, const rgw_owner* uid, const string& zonegroup)
diff --git a/src/test/rgw/test_rgw_http_client.cc b/src/test/rgw/test_rgw_http_client.cc
index 79f80c67edb..33cb2d1f85f 100644
--- a/src/test/rgw/test_rgw_http_client.cc
+++ b/src/test/rgw/test_rgw_http_client.cc
@@ -13,59 +13,98 @@ using namespace std;
 TEST(RGWEndpointTest, default_constructor) {
   RGWEndpoint ep;
   EXPECT_TRUE(ep.get_url().empty());
-  EXPECT_TRUE(ep.get_original_url().empty());
+  EXPECT_TRUE(ep.get_endpoint_url_lookup_id().empty());
   EXPECT_TRUE(ep.get_connect_to().empty());
 }
 
-TEST(RGWEndpointTest, constructor_sets_url_and_original_url) {
+TEST(RGWEndpointTest, constructor_sets_url_and_lookup_id) {
   RGWEndpoint ep("http://example.com:8080");
   EXPECT_EQ(ep.get_url(), "http://example.com:8080");
-  EXPECT_EQ(ep.get_original_url(), "http://example.com:8080");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
 }
 
 TEST(RGWEndpointTest, constructor_with_connect_to) {
   RGWEndpoint ep("http://example.com:8080", "example.com:8080:192.168.1.1:8080");
   EXPECT_EQ(ep.get_url(), "http://example.com:8080");
-  EXPECT_EQ(ep.get_original_url(), "http://example.com:8080");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
   EXPECT_EQ(ep.get_connect_to(), "example.com:8080:192.168.1.1:8080");
 }
 
-TEST(RGWEndpointTest, set_url_on_default_constructed_sets_original) {
+TEST(RGWEndpointTest, set_url_on_default_constructed_sets_base) {
   RGWEndpoint ep;
-  EXPECT_TRUE(ep.get_original_url().empty());
+  EXPECT_TRUE(ep.get_endpoint_url_lookup_id().empty());
 
   ep.set_url("http://first.example.com");
   EXPECT_EQ(ep.get_url(), "http://first.example.com");
-  EXPECT_EQ(ep.get_original_url(), "http://first.example.com");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://first.example.com");
 
-  // Second set_url should NOT change original_url
+  // Second set_url should NOT change endpoint_url_lookup_id
   ep.set_url("http://second.example.com");
   EXPECT_EQ(ep.get_url(), "http://second.example.com");
-  EXPECT_EQ(ep.get_original_url(), "http://first.example.com");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://first.example.com");
 }
 
-TEST(RGWEndpointTest, set_url_does_not_change_original_after_constructor) {
-  RGWEndpoint ep("http://original.example.com");
-
-  ep.set_url("http://modified.example.com");
-  EXPECT_EQ(ep.get_url(), "http://modified.example.com");
-  EXPECT_EQ(ep.get_original_url(), "http://original.example.com");
+TEST(RGWEndpointTest, set_path) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.set_path("/path/to/resource");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/path/to/resource");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
 }
 
-TEST(RGWEndpointTest, with_url_returns_copy_with_new_url) {
-  RGWEndpoint ep("http://original.example.com");
-  ep.set_connect_to("original.example.com:80:192.168.1.1:80");
+TEST(RGWEndpointTest, set_query) {
+  RGWEndpoint ep("http://example.com:8080/path");
+  ep.set_query("key=val&k2=v2");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/path?key=val&k2=v2");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080/path");
+}
 
-  RGWEndpoint ep2 = ep.with_url("http://modified.example.com");
+TEST(RGWEndpointTest, set_query_with_leading_question_mark) {
+  RGWEndpoint ep("http://example.com:8080/path");
+  ep.set_query("?key=val");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/path?key=val");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080/path");
+}
 
-  // Original unchanged
-  EXPECT_EQ(ep.get_url(), "http://original.example.com");
-  EXPECT_EQ(ep.get_original_url(), "http://original.example.com");
+TEST(RGWEndpointTest, set_host) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.set_host("bucket.example.com");
+  EXPECT_EQ(ep.get_url(), "http://bucket.example.com:8080");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
+}
 
-  // Copy has new url but preserves original_url and connect_to
-  EXPECT_EQ(ep2.get_url(), "http://modified.example.com");
-  EXPECT_EQ(ep2.get_original_url(), "http://original.example.com");
-  EXPECT_EQ(ep2.get_connect_to(), "original.example.com:80:192.168.1.1:80");
+TEST(RGWEndpointTest, add_trailing_slash) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.add_trailing_slash();
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
+
+  // Should not add another slash
+  ep.add_trailing_slash();
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/");
+}
+
+TEST(RGWEndpointTest, set_query_empty_is_noop) {
+  RGWEndpoint ep("http://example.com:8080/path");
+  ep.set_query("");
+  // Empty query should not add a '?' to the URL
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/path");
+}
+
+TEST(RGWEndpointTest, set_path_without_leading_slash) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.set_path("admin/bucket");
+  // boost::urls should auto-add leading '/' for URLs with authority
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/admin/bucket");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
+}
+
+TEST(RGWEndpointTest, set_path_then_set_query) {
+  // This mirrors the forward_request() usage pattern
+  RGWEndpoint ep("http://example.com:8080");
+  ep.set_path("/admin/bucket");
+  ep.set_query("?max-entries=100&stats=true");
+  EXPECT_EQ(ep.get_url(), "http://example.com:8080/admin/bucket?max-entries=100&stats=true");
+  EXPECT_EQ(ep.get_endpoint_url_lookup_id(), "http://example.com:8080");
 }
 
 TEST(RGWEndpointTest, set_connect_to) {
@@ -76,39 +115,22 @@ TEST(RGWEndpointTest, set_connect_to) {
   EXPECT_EQ(ep.get_connect_to(), "example.com:8080:192.168.1.1:8080");
 }
 
-TEST(RGWEndpointTest, add_trailing_slash) {
-  RGWEndpoint ep("http://example.com:8080");
-  ep.add_trailing_slash();
-  EXPECT_EQ(ep.get_url(), "http://example.com:8080/");
-
-  // Should not add another slash
-  ep.add_trailing_slash();
-  EXPECT_EQ(ep.get_url(), "http://example.com:8080/");
-}
-
-TEST(RGWEndpointTest, append_to_url) {
-  RGWEndpoint ep("http://example.com:8080");
-  ep.append_to_url("/path/to/resource");
-  EXPECT_EQ(ep.get_url(), "http://example.com:8080/path/to/resource");
-}
-
 // Tests for operator<<
 
 TEST(RGWEndpointTest, ostream_operator_url_only) {
   RGWEndpoint ep("http://example.com:8080");
   std::ostringstream oss;
   oss << ep;
-  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080");
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080 endpoint_url_lookup_id=http://example.com:8080 connect_to=<empty>");
 }
 
-TEST(RGWEndpointTest, ostream_operator_with_different_original_url) {
-  RGWEndpoint ep;
-  ep.set_url("http://original.example.com:8080");
-  ep.set_url("http://modified.example.com:8080");  // original_url stays the same
+TEST(RGWEndpointTest, ostream_operator_with_modified_url) {
+  RGWEndpoint ep("http://example.com:8080");
+  ep.set_path("/modified");
 
   std::ostringstream oss;
   oss << ep;
-  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://modified.example.com:8080 original_url=http://original.example.com:8080");
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080/modified endpoint_url_lookup_id=http://example.com:8080 connect_to=<empty>");
 }
 
 TEST(RGWEndpointTest, ostream_operator_with_connect_to) {
@@ -117,7 +139,7 @@ TEST(RGWEndpointTest, ostream_operator_with_connect_to) {
 
   std::ostringstream oss;
   oss << ep;
-  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080 connect_to=example.com:8080:192.168.1.1:8080");
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://example.com:8080 endpoint_url_lookup_id=http://example.com:8080 connect_to=example.com:8080:192.168.1.1:8080");
 }
 
 TEST(RGWEndpointTest, ostream_operator_full) {
@@ -128,5 +150,5 @@ TEST(RGWEndpointTest, ostream_operator_full) {
 
   std::ostringstream oss;
   oss << ep;
-  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://192.168.1.1:8080 original_url=http://original.example.com:8080 connect_to=original.example.com:8080:192.168.1.1:8080");
+  EXPECT_EQ(oss.str(), "RGWEndpoint: url=http://192.168.1.1:8080 endpoint_url_lookup_id=http://original.example.com:8080 connect_to=original.example.com:8080:192.168.1.1:8080");
 }

From 28f2a5e22afaae6794a1f6fe766b61ad0afe8024 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 6 May 2026 19:17:55 +0000
Subject: [PATCH 098/596] rgw/multisite: fix endpoint unreachable detection in
 RGWRESTConn sync paths

The checks that decide whether to call set_endpoint_unconnectable()
were comparing against -EIO, but the actual error codes returned on
connection failure changed after commit 37352a9074 ("rgw: change
rgw_http_error_to_errno default to -ERR_INTERNAL_ERROR").

- complete_request() -> wait() returns req_data->ret which is set to
  rgw_http_error_to_errno(0) = -ERR_INTERNAL_ERROR when http_status is 0
  (TCP connect failed). Fix the six call sites to check -ERR_INTERNAL_ERROR.

- forward_request() returns tl::unexpected(-ERR_SERVICE_UNAVAILABLE)
  when http_status == 0 (no HTTP response received at all). Fix the two
  forward/forward_iam conditionals to check -ERR_SERVICE_UNAVAILABLE.

Without this fix, connection failures are never detected in the sync
paths, so set_endpoint_unconnectable() is never called and the
IP failover / retry logic is effectively dead.

The .h coroutine paths were already fixed by dbb409e21b9 ("rgw: fix
endpoint detection in RGWRESTConn") but that commit missed all .cc
sync paths.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index 46f6685c6fd..ce3425f6e8c 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -329,7 +329,7 @@ auto RGWRESTConn::forward(const DoutPrefixProvider *dpp, const rgw_owner& uid,
     auto result = req.forward_request(dpp, key, info, max_response, inbl, outbl, y);
     if (result) {
       return result;
-    } else if (result.error() != -EIO) {
+    } else if (result.error() != -ERR_SERVICE_UNAVAILABLE) {
       return result;
     }
     set_endpoint_unconnectable(endpoint);
@@ -360,7 +360,7 @@ auto RGWRESTConn::forward_iam(const DoutPrefixProvider *dpp, const req_info& inf
     auto result = req.forward_request(dpp, key, info, max_response, inbl, outbl, y, service);
     if (result) {
       return result;
-    } else if (result.error() != -EIO) {
+    } else if (result.error() != -ERR_SERVICE_UNAVAILABLE) {
       return result;
     }
     set_endpoint_unconnectable(endpoint);
@@ -415,7 +415,7 @@ int RGWRESTConn::complete_request(const DoutPrefixProvider* dpp,
                                   real_time *mtime, optional_yield y)
 {
   int ret = req->complete_request(dpp, y, &etag, mtime);
-  if (ret == -EIO) {
+  if (ret == -ERR_INTERNAL_ERROR) {
     ldout(cct, 5) << __func__ << ": complete_request() returned ret=" << ret << dendl;
     set_endpoint_unconnectable(req->get_endpoint());
   }
@@ -578,7 +578,7 @@ int RGWRESTConn::complete_request(const DoutPrefixProvider* dpp,
                                   optional_yield y)
 {
   int ret = req->complete_request(dpp, y, etag, mtime, psize, pattrs, pheaders);
-  if (ret == -EIO) {
+  if (ret == -ERR_INTERNAL_ERROR) {
     ldout(cct, 5) << __func__ << ": complete_request() returned ret=" << ret << dendl;
     set_endpoint_unconnectable(req->get_endpoint());
   }
@@ -629,7 +629,7 @@ int RGWRESTConn::get_resource(const DoutPrefixProvider *dpp,
     }
 
     ret = req.complete_request(dpp, y);
-    if (ret == -EIO) {
+    if (ret == -ERR_INTERNAL_ERROR) {
       set_endpoint_unconnectable(endpoint);
       if (tries < NUM_ENPOINT_IOERROR_RETRIES - 1) {
         ldpp_dout(dpp, 20) << __func__  << "(): failed to get resource. retries=" << tries << dendl;
@@ -683,7 +683,7 @@ int RGWRESTConn::send_resource(const DoutPrefixProvider *dpp, const std::string&
     }
 
     ret = req.complete_request(dpp, y);
-    if (ret == -EIO) {
+    if (ret == -ERR_INTERNAL_ERROR) {
       set_endpoint_unconnectable(endpoint);
       if (tries < NUM_ENPOINT_IOERROR_RETRIES - 1) {
         ldpp_dout(dpp, 20) << __func__  << "(): failed to send resource. retries=" << tries << dendl;
@@ -742,7 +742,7 @@ int RGWRESTReadResource::read(const DoutPrefixProvider *dpp, optional_yield y)
   }
 
   ret = req.complete_request(dpp, y);
-  if (ret == -EIO) {
+  if (ret == -ERR_INTERNAL_ERROR) {
     conn->set_endpoint_unconnectable(req.get_endpoint());
     ldpp_dout(dpp, 20) << __func__ << ": complete_request() returned ret=" << ret << dendl;
   }
@@ -809,7 +809,7 @@ int RGWRESTSendResource::send(const DoutPrefixProvider *dpp, bufferlist& outbl,
   }
 
   ret = req.complete_request(dpp, y);
-  if (ret == -EIO) {
+  if (ret == -ERR_INTERNAL_ERROR) {
     conn->set_endpoint_unconnectable(req.get_endpoint());
     ldpp_dout(dpp, 20) << __func__ << ": complete_request() returned ret=" << ret << dendl;
   }

From 7d62871ba48488494f09f650e6cae99fbe704b59 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 3 Jun 2026 16:37:15 +0000
Subject: [PATCH 099/596] rgw/rest: add TODO for concurrent endpoint DNS
 resolution

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_rest_conn.cc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/rgw/rgw_rest_conn.cc b/src/rgw/rgw_rest_conn.cc
index ce3425f6e8c..6beb262e84a 100644
--- a/src/rgw/rgw_rest_conn.cc
+++ b/src/rgw/rgw_rest_conn.cc
@@ -13,6 +13,11 @@
 using namespace std;
 
 void RGWRESTConn::resolve_endpoints() {
+  // TODO: resolve endpoints concurrently using async_resolve on a shared io_context.
+  //       In practice zones have a single endpoint or at most a handful of individual
+  //       RGW instances, and resolution runs once at process startup, so sequential
+  //       cost is negligible. A natural time to address this would be when adding
+  //       periodic DNS re-resolution.
   for (auto& res_ep : resolved_endpoints) {
     const std::string& ep_url = res_ep.url;
     // parse URL

From 7114fd10f67265410f0d8a9d96977ce94159959c Mon Sep 17 00:00:00 2001
From: Vallari Agrawal <vallari.agrawal@ibm.com>
Date: Fri, 5 Jun 2026 10:44:51 +0530
Subject: [PATCH 100/596] monitoring: fix NVMeoFMultipleNamespacesOfRBDImage

Do not trigger alert NVMeoFMultipleNamespacesOfRBDImage
for same pool/image name used in multiple nvmeof namespaces,
if they are in different rados namespaces (rados_namespace_name)

These are valid repeation of pool/image name:
- mypool/rados_ns1/myimage1
- mypool/rados_ns2/myimage1
- mypool/myimage1 (default rados namespace)

Fixes: https://tracker.ceph.com/issues/77128

Signed-off-by: Vallari Agrawal <vallari.agrawal@ibm.com>
---
 .../ceph-mixin/prometheus_alerts.libsonnet    |  4 +--
 monitoring/ceph-mixin/prometheus_alerts.yml   |  5 ++-
 .../ceph-mixin/tests_alerts/test_alerts.yml   | 34 ++++++++++++++-----
 3 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/monitoring/ceph-mixin/prometheus_alerts.libsonnet b/monitoring/ceph-mixin/prometheus_alerts.libsonnet
index 9c1c3db4375..6173a9dd781 100644
--- a/monitoring/ceph-mixin/prometheus_alerts.libsonnet
+++ b/monitoring/ceph-mixin/prometheus_alerts.libsonnet
@@ -858,10 +858,10 @@
         {
           alert: 'NVMeoFMultipleNamespacesOfRBDImage',
           'for': '1m',
-          expr: 'count by(pool_name, rbd_name) (count by(bdev_name, pool_name, rbd_name) (ceph_nvmeof_bdev_metadata and on (bdev_name) ceph_nvmeof_subsystem_namespace_metadata)) > 1',
+          expr: 'count by(pool_name, rbd_name, rados_namespace_name) (count by(bdev_name, pool_name, rbd_name, rados_namespace_name) (ceph_nvmeof_bdev_metadata * on (bdev_name, instance, cluster) group_left(rados_namespace_name) ceph_nvmeof_subsystem_namespace_metadata)) > 1',
           labels: { severity: 'warning', type: 'ceph_default' },
           annotations: {
-            summary: 'RBD image {{ $labels.pool_name }}/{{ $labels.rbd_name }} cannot be reused for multiple NVMeoF namespace ',
+            summary: 'RBD image {{ $labels.pool_name }}/{{ if $labels.rados_namespace_name }}{{ $labels.rados_namespace_name }}/{{ end }}{{ $labels.rbd_name }} cannot be reused for multiple NVMeoF namespaces',
             description: 'Each NVMeoF namespace must have a unique RBD pool and image, across all different gateway groups.',
           },
         },
diff --git a/monitoring/ceph-mixin/prometheus_alerts.yml b/monitoring/ceph-mixin/prometheus_alerts.yml
index 8a6c411a2b6..f2aa4defabd 100644
--- a/monitoring/ceph-mixin/prometheus_alerts.yml
+++ b/monitoring/ceph-mixin/prometheus_alerts.yml
@@ -804,8 +804,8 @@ groups:
       - alert: "NVMeoFMultipleNamespacesOfRBDImage"
         annotations:
           description: "Each NVMeoF namespace must have a unique RBD pool and image, across all different gateway groups."
-          summary: "RBD image {{ $labels.pool_name }}/{{ $labels.rbd_name }} cannot be reused for multiple NVMeoF namespace "
-        expr: "count by(pool_name, rbd_name) (count by(bdev_name, pool_name, rbd_name) (ceph_nvmeof_bdev_metadata and on (bdev_name) ceph_nvmeof_subsystem_namespace_metadata)) > 1"
+          summary: "RBD image {{ $labels.pool_name }}/{{ if $labels.rados_namespace_name }}{{ $labels.rados_namespace_name }}/{{ end }}{{ $labels.rbd_name }} cannot be reused for multiple NVMeoF namespaces"
+        expr: "count by(pool_name, rbd_name, rados_namespace_name) (count by(bdev_name, pool_name, rbd_name, rados_namespace_name) (ceph_nvmeof_bdev_metadata * on (bdev_name, instance, cluster) group_left(rados_namespace_name) ceph_nvmeof_subsystem_namespace_metadata)) > 1"
         for: "1m"
         labels:
           severity: "warning"
@@ -995,4 +995,3 @@ groups:
           oid: "1.3.6.1.4.1.50495.1.2.1.15.2"
           severity: "warning"
           type: "ceph_default"
-
diff --git a/monitoring/ceph-mixin/tests_alerts/test_alerts.yml b/monitoring/ceph-mixin/tests_alerts/test_alerts.yml
index 5578544c934..6a4c2cd2076 100644
--- a/monitoring/ceph-mixin/tests_alerts/test_alerts.yml
+++ b/monitoring/ceph-mixin/tests_alerts/test_alerts.yml
@@ -2278,19 +2278,27 @@ tests:
 # NVMeoFMultipleNamespacesOfRBDImage
  - interval: 1m
    input_series:
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev1", instance="ceph-nvme-vm1", pool_name="mypool", rbd_name="myimage1"}'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev1", instance="ceph-nvme-vm1", cluster="mycluster", pool_name="mypool", rbd_name="myimage1"}'
       values: '1x10'
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev1", instance="ceph-nvme-vm2", pool_name="mypool", rbd_name="myimage1"}'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev1", instance="ceph-nvme-vm2", cluster="mycluster", pool_name="mypool", rbd_name="myimage1"}'
       values: '1x10'
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev2", instance="ceph-nvme-vm1", pool_name="mypool", rbd_name="myimage2"}'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev2", instance="ceph-nvme-vm1", cluster="mycluster", pool_name="mypool", rbd_name="myimage2"}'
       values: '1x10'
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev2", instance="ceph-nvme-vm2", pool_name="mypool", rbd_name="myimage2"}'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev2", instance="ceph-nvme-vm2", cluster="mycluster", pool_name="mypool", rbd_name="myimage2"}'
       values: '1x10'
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev3", instance="ceph-nvme-vm1", pool_name="mypool", rbd_name="myimage1"}'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev3", instance="ceph-nvme-vm1", cluster="mycluster", pool_name="mypool", rbd_name="myimage1"}'
       values: '1x10'
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev3", instance="ceph-nvme-vm2", pool_name="mypool", rbd_name="myimage1"}'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev3", instance="ceph-nvme-vm2", cluster="mycluster", pool_name="mypool", rbd_name="myimage1"}'
       values: '1x10'
-    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev4", instance="ceph-nvme-vm1", pool_name="mypool", rbd_name="myimage1"}' # bdev with no ns
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev4", instance="ceph-nvme-vm1", cluster="mycluster", pool_name="mypool", rbd_name="myimage1"}' # bdev with no ns
+      values: '1x10'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev5", instance="ceph-nvme-vm1", cluster="mycluster", pool_name="mypool", rbd_name="myimage5"}'
+      values: '1x10'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev5", instance="ceph-nvme-vm2", cluster="mycluster", pool_name="mypool", rbd_name="myimage5"}'
+      values: '1x10'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev6", instance="ceph-nvme-vm1", cluster="mycluster", pool_name="mypool", rbd_name="myimage5"}'
+      values: '1x10'
+    - series: 'ceph_nvmeof_bdev_metadata{bdev_name="bdev6", instance="ceph-nvme-vm2", cluster="mycluster", pool_name="mypool", rbd_name="myimage5"}'
       values: '1x10'
     - series: 'ceph_nvmeof_subsystem_namespace_metadata{nqn="nqn1", nsid="1", bdev_name="bdev1", instance="ceph-nvme-vm1", cluster="mycluster"}'
       values: '1x10'
@@ -2304,8 +2312,16 @@ tests:
       values: '1x10'
     - series: 'ceph_nvmeof_subsystem_namespace_metadata{nqn="nqn2", nsid="1", bdev_name="bdev3", instance="ceph-nvme-vm2", cluster="mycluster"}'
       values: '1x10'
+    - series: 'ceph_nvmeof_subsystem_namespace_metadata{nqn="nqn3", nsid="1", bdev_name="bdev5", instance="ceph-nvme-vm1", cluster="mycluster", rados_namespace_name="rados1"}'
+      values: '1x10'
+    - series: 'ceph_nvmeof_subsystem_namespace_metadata{nqn="nqn3", nsid="1", bdev_name="bdev5", instance="ceph-nvme-vm2", cluster="mycluster", rados_namespace_name="rados1"}'
+      values: '1x10'
+    - series: 'ceph_nvmeof_subsystem_namespace_metadata{nqn="nqn3", nsid="2", bdev_name="bdev6", instance="ceph-nvme-vm1", cluster="mycluster", rados_namespace_name="rados2"}'
+      values: '1x10'
+    - series: 'ceph_nvmeof_subsystem_namespace_metadata{nqn="nqn3", nsid="2", bdev_name="bdev6", instance="ceph-nvme-vm2", cluster="mycluster", rados_namespace_name="rados2"}'
+      values: '1x10'
    promql_expr_test:
-     - expr: count by(pool_name, rbd_name) (count by(bdev_name, pool_name, rbd_name) (ceph_nvmeof_bdev_metadata and on (bdev_name) ceph_nvmeof_subsystem_namespace_metadata)) > 1
+     - expr: count by(pool_name, rbd_name, rados_namespace_name) (count by(bdev_name, pool_name, rbd_name, rados_namespace_name) (ceph_nvmeof_bdev_metadata * on (bdev_name, instance, cluster) group_left(rados_namespace_name) ceph_nvmeof_subsystem_namespace_metadata)) > 1
        eval_time: 1m
        exp_samples:
          - labels: '{pool_name="mypool", rbd_name="myimage1"}'
@@ -2320,7 +2336,7 @@ tests:
           severity: warning
           type: ceph_default
         exp_annotations:
-          summary: "RBD image mypool/myimage1 cannot be reused for multiple NVMeoF namespace "
+          summary: "RBD image mypool/myimage1 cannot be reused for multiple NVMeoF namespaces"
           description: "Each NVMeoF namespace must have a unique RBD pool and image, across all different gateway groups."
 
  # NVMeoFTooManyGateways

From d486328b71c05524aaeef7b9b92dfc650dc9e949 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Fri, 5 Jun 2026 10:02:34 +0200
Subject: [PATCH 101/596] qa/cephadm: fix test_repos.sh for jammy nodes

The test uses add-repo --release 17.2.6 to verify version-string repo
handling, but debian-17.2.6 only has focal and bullseye suites and
jammy packages weren't built until 17.2.7. This causes apt-get update
to fail with a 404 on ubuntu_22.04 nodes.

see: https://download.ceph.com/debian-17.2.6/dists/

This fix bumps the version to 17.2.7 which includes a jammy suite.

Fixes: https://tracker.ceph.com/issues/77130

Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 qa/workunits/cephadm/test_repos.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/workunits/cephadm/test_repos.sh b/qa/workunits/cephadm/test_repos.sh
index 5c17e51060e..2a729923261 100755
--- a/qa/workunits/cephadm/test_repos.sh
+++ b/qa/workunits/cephadm/test_repos.sh
@@ -38,7 +38,7 @@ sudo $CEPHADM -v add-repo --dev main
 test_install_uninstall
 sudo $CEPHADM -v rm-repo
 
-sudo $CEPHADM -v add-repo --release 17.2.6
+sudo $CEPHADM -v add-repo --release 17.2.7
 test_install_uninstall
 sudo $CEPHADM -v rm-repo
 

From c8ffac91f0f7dd6c0124c3a3ea0daa4913f54d35 Mon Sep 17 00:00:00 2001
From: Kobi Ginon <kginon@redhat.com>
Date: Mon, 25 May 2026 15:38:34 +0300
Subject: [PATCH 102/596] cephadm: set Grafana http_addr to 0.0.0.0 when unset
 Grafana 11.1+ rejects non-literal http_addr values (e.g. localhost) in
 grafana-apiserver. Use 0.0.0.0 by default; stop bracket-wrapping IPv6
 addresses in http_addr. Fixes: https://tracker.ceph.com/issues/75365
 Signed-off-by: Kobi Ginon <kginon@redhat.com>

---
 src/pybind/mgr/cephadm/services/monitoring.py | 12 ++++--
 .../cephadm/tests/services/test_monitoring.py | 38 ++++++++++++++++---
 2 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/monitoring.py b/src/pybind/mgr/cephadm/services/monitoring.py
index 86f0aa0a8e8..e3fd676e22c 100644
--- a/src/pybind/mgr/cephadm/services/monitoring.py
+++ b/src/pybind/mgr/cephadm/services/monitoring.py
@@ -2,7 +2,6 @@ import errno
 import logging
 import os
 from typing import List, Any, Tuple, Dict, Optional, cast, TYPE_CHECKING
-import ipaddress
 import time
 import requests
 
@@ -74,8 +73,15 @@ class GrafanaService(CephadmService):
             if ip_to_bind_to:
                 daemon_spec.port_ips = {str(grafana_port): ip_to_bind_to}
                 grafana_ip = ip_to_bind_to
-                if ipaddress.ip_network(grafana_ip).version == 6:
-                    grafana_ip = f"[{grafana_ip}]"
+
+        if not grafana_ip:
+            # Grafana 11.1+ validates http_addr with net.ParseIP; hostnames such as
+            # localhost fail in grafana-apiserver. Use a literal address (bind all IPv4).
+            # Check if the primary manager or orchestrator is configured for IPv6
+            if self.mgr.get_mgr_ip().startswith('::') or ':' in self.mgr.get_mgr_ip():
+                grafana_ip = '::'
+            else:
+                grafana_ip = '0.0.0.0'
 
         domain = self.mgr.get_fqdn(daemon_spec.host)
         mgmt_gw_ips = []
diff --git a/src/pybind/mgr/cephadm/tests/services/test_monitoring.py b/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
index 57a9d8a3da1..d582b07863c 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
@@ -1329,7 +1329,7 @@ class TestMonitoring:
                           cert_file = /etc/grafana/certs/cert_file
                           cert_key = /etc/grafana/certs/cert_key
                           http_port = 3000
-                          http_addr = 
+                          http_addr = ::
                           root_url = %(protocol)s://%(domain)s:%(http_port)s/grafana/
                           serve_from_sub_path = true
                         [snapshots]
@@ -1490,7 +1490,7 @@ class TestMonitoring:
                           cert_file = /etc/grafana/certs/cert_file
                           cert_key = /etc/grafana/certs/cert_key
                           http_port = 3000
-                          http_addr = 
+                          http_addr = ::
                           root_url = %(protocol)s://%(domain)s:%(http_port)s/grafana/
                           serve_from_sub_path = true
                         [snapshots]
@@ -1590,7 +1590,7 @@ class TestMonitoring:
                           cert_file = /etc/grafana/certs/cert_file
                           cert_key = /etc/grafana/certs/cert_key
                           http_port = 3000
-                          http_addr = 
+                          http_addr = ::
                         [snapshots]
                           external_enabled = false
                         [security]
@@ -1681,6 +1681,7 @@ class TestMonitoring:
                 )
 
     @patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm('{}'))
+    @patch("cephadm.module.CephadmOrchestrator.get_mgr_ip", lambda _: '192.0.2.1')
     def test_grafana_initial_admin_pw(self, cephadm_module: CephadmOrchestrator):
         with with_host(cephadm_module, 'test'):
             with with_service(cephadm_module, ServiceSpec('mgr')) as _, \
@@ -1705,7 +1706,7 @@ class TestMonitoring:
                                     '  cert_file = /etc/grafana/certs/cert_file\n'
                                     '  cert_key = /etc/grafana/certs/cert_key\n'
                                     '  http_port = 3000\n'
-                                    '  http_addr = \n'
+                                    '  http_addr = 0.0.0.0\n'
                                     '[snapshots]\n'
                                     '  external_enabled = false\n'
                                     '[security]\n'
@@ -1750,6 +1751,33 @@ class TestMonitoring:
                             }}, ['certificate_source: cephadm-signed', 'secure_monitoring_stack:False'])
 
     @patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm('{}'))
+    @patch("cephadm.module.CephadmOrchestrator.get_mgr_ip", lambda _: '192.0.2.1')
+    def test_grafana_http_addr_binds_all_by_default_ipv4(self, cephadm_module: CephadmOrchestrator):
+        grafana_svc = service_registry.get_service('grafana')
+        with with_host(cephadm_module, 'test'):
+            with with_service(cephadm_module, GrafanaSpec()):
+                ini = grafana_svc.generate_grafana_ini(
+                    CephadmDaemonDeploySpec('test', 'daemon', 'grafana'),
+                    mgmt_gw_enabled=False,
+                    oauth2_enabled=False,
+                )
+                assert 'http_addr = 0.0.0.0' in ini
+
+    @patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm('{}'))
+    @patch("cephadm.module.CephadmOrchestrator.get_mgr_ip", lambda _: '1::4')
+    def test_grafana_http_addr_binds_all_by_default_ipv6(self, cephadm_module: CephadmOrchestrator):
+        grafana_svc = service_registry.get_service('grafana')
+        with with_host(cephadm_module, 'test'):
+            with with_service(cephadm_module, GrafanaSpec()):
+                ini = grafana_svc.generate_grafana_ini(
+                    CephadmDaemonDeploySpec('test', 'daemon', 'grafana'),
+                    mgmt_gw_enabled=False,
+                    oauth2_enabled=False,
+                )
+                assert 'http_addr = ::' in ini
+
+    @patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm('{}'))
+    @patch("cephadm.module.CephadmOrchestrator.get_mgr_ip", lambda _: '192.0.2.1')
     def test_grafana_no_anon_access(self, cephadm_module: CephadmOrchestrator):
         # with anonymous_access set to False, expecting the [auth.anonymous] section
         # to not be present in the grafana config. Note that we require an initial_admin_password
@@ -1774,7 +1802,7 @@ class TestMonitoring:
                                     '  cert_file = /etc/grafana/certs/cert_file\n'
                                     '  cert_key = /etc/grafana/certs/cert_key\n'
                                     '  http_port = 3000\n'
-                                    '  http_addr = \n'
+                                    '  http_addr = 0.0.0.0\n'
                                     '[snapshots]\n'
                                     '  external_enabled = false\n'
                                     '[security]\n'

From cc1dcecee0892d7552ead76e3fb534e95df15fc5 Mon Sep 17 00:00:00 2001
From: "ramin.najarbashi" <ramin.najarbashi@gmail.com>
Date: Sun, 31 May 2026 16:36:13 +0330
Subject: [PATCH 103/596] rgw: match CORS rules like Amazon S3

Select the first CORSRule whose AllowedOrigin, AllowedMethod, and (for
preflight) AllowedHeader all match the request. Previously host_name_rule
matched origin only, so a second rule with the same origin but different
methods was never used.

Add RGWCORSRule::matches() and RGWCORSConfiguration::match_rule(), wire
generate_cors_headers and RGWOptionsCORS to them (including global CORS), and
add unittest_rgw_cors.

Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/rgw/rgw_cors.cc           | 51 ++++++++++++++++++++++++
 src/rgw/rgw_cors.h            |  8 ++++
 src/rgw/rgw_op.cc             | 63 ++++++++++++------------------
 src/test/rgw/CMakeLists.txt   |  6 +++
 src/test/rgw/test_rgw_cors.cc | 73 +++++++++++++++++++++++++++++++++++
 5 files changed, 162 insertions(+), 39 deletions(-)
 create mode 100644 src/test/rgw/test_rgw_cors.cc

diff --git a/src/rgw/rgw_cors.cc b/src/rgw/rgw_cors.cc
index e8bbdabe985..230a04664b8 100644
--- a/src/rgw/rgw_cors.cc
+++ b/src/rgw/rgw_cors.cc
@@ -17,6 +17,7 @@
 
 #include <iostream>
 #include <map>
+#include <vector>
 
 #include <boost/algorithm/string.hpp>
 
@@ -238,6 +239,56 @@ void RGWCORSRule::format_exp_headers(string& s) {
   }
 }
 
+bool RGWCORSRule::matches_method(const char *req_meth)
+{
+  if (!req_meth || !*req_meth) {
+    return true;
+  }
+  const uint8_t flags = get_multi_cors_method_flags(req_meth);
+  return flags != 0 && (allowed_methods & flags);
+}
+
+bool RGWCORSRule::matches_preflight_headers(const char *req_hdrs)
+{
+  if (!req_hdrs || !*req_hdrs) {
+    return true;
+  }
+  vector<string> hdrs;
+  get_str_vec(req_hdrs, hdrs);
+  for (const auto& hdr : hdrs) {
+    if (!is_header_allowed(hdr.c_str(), hdr.length())) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool RGWCORSRule::matches(const char *origin,
+                          const char *req_meth,
+                          const char *req_hdrs)
+{
+  if (!origin || !*origin) {
+    return false;
+  }
+  return is_origin_present(origin)
+      && matches_method(req_meth)
+      && matches_preflight_headers(req_hdrs);
+}
+
+RGWCORSRule * RGWCORSConfiguration::match_rule(const char *origin,
+                                               const char *req_meth,
+                                               const char *req_hdrs)
+{
+  for (list<RGWCORSRule>::iterator it_r = rules.begin();
+       it_r != rules.end(); ++it_r) {
+    RGWCORSRule& r = (*it_r);
+    if (r.matches(origin, req_meth, req_hdrs)) {
+      return &r;
+    }
+  }
+  return NULL;
+}
+
 RGWCORSRule * RGWCORSConfiguration::host_name_rule(const char *origin) {
   for(list<RGWCORSRule>::iterator it_r = rules.begin(); 
       it_r != rules.end(); ++it_r) {
diff --git a/src/rgw/rgw_cors.h b/src/rgw/rgw_cors.h
index fe4f5ecdbd9..c500fab29cb 100644
--- a/src/rgw/rgw_cors.h
+++ b/src/rgw/rgw_cors.h
@@ -91,6 +91,11 @@ public:
   void dump_origins();
   void dump(Formatter *f) const;
   bool is_header_allowed(const char *hdr, size_t len);
+  bool matches_method(const char *req_meth);
+  bool matches_preflight_headers(const char *req_hdrs);
+  bool matches(const char *origin,
+               const char *req_meth,
+               const char *req_hdrs);
 };
 WRITE_CLASS_ENCODER(RGWCORSRule)
 
@@ -121,6 +126,9 @@ class RGWCORSConfiguration
   }
   void get_origins_list(const char *origin, std::list<std::string>& origins);
   RGWCORSRule * host_name_rule(const char *origin);
+  RGWCORSRule * match_rule(const char *origin,
+                           const char *req_meth,
+                           const char *req_hdrs);
   void erase_host_name_rule(std::string& origin);
   void dump();
   void stack_rule(RGWCORSRule& r) {
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 2a015ab16c3..494d089a733 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -2000,8 +2000,14 @@ bool RGWOp::generate_cors_headers(string& origin, string& method, string& header
     return false;
   }
 
-  /* CORS 6.2.2. */
-  RGWCORSRule *rule = bucket_cors.host_name_rule(orig);
+  /* CORS 6.2.2–6.2.5: first rule matching origin, method, and preflight headers. */
+  const char *req_meth = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
+  if (!req_meth) {
+    req_meth = s->info.method;
+  }
+  const char *req_hdrs = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
+
+  RGWCORSRule *rule = bucket_cors.match_rule(orig, req_meth, req_hdrs);
   auto is_allowed_to_generate_rule_cors_header = [this, &origin, &method, &headers, &exp_headers, &max_age] (RGWCORSRule *rule) {
     if (!rule)
       return false;
@@ -2019,24 +2025,20 @@ bool RGWOp::generate_cors_headers(string& origin, string& method, string& header
       origin = "*";
 
     /* CORS 6.2.3. */
-    const char *req_meth = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
-    if (!req_meth) {
-      req_meth = s->info.method;
+    const char *req_meth_inner = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
+    if (!req_meth_inner) {
+      req_meth_inner = s->info.method;
     }
 
-    if (req_meth) {
-      method = req_meth;
-      /* CORS 6.2.5. */
-      if (!validate_cors_rule_method(this, rule, req_meth)) {
-        return false;
-      }
+    if (req_meth_inner) {
+      method = req_meth_inner;
     }
 
     /* CORS 6.2.4. */
-    const char *req_hdrs = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
+    const char *req_hdrs_inner = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
 
     /* CORS 6.2.6. */
-    get_cors_response_headers(this, rule, req_hdrs, headers, exp_headers, max_age);
+    get_cors_response_headers(this, rule, req_hdrs_inner, headers, exp_headers, max_age);
 
     return true;
   };
@@ -2045,7 +2047,9 @@ bool RGWOp::generate_cors_headers(string& origin, string& method, string& header
     return true;
   }
 
-  if (optional_global_cors.has_value() && is_allowed_to_generate_rule_cors_header(&(*optional_global_cors))) {
+  if (optional_global_cors.has_value() &&
+      optional_global_cors->matches(orig, req_meth, req_hdrs) &&
+      is_allowed_to_generate_rule_cors_header(&(*optional_global_cors))) {
     return true;
   }
 
@@ -7253,17 +7257,10 @@ void RGWOptionsCORS::get_response_params(string& hdrs, string& exp_hdrs, unsigne
 }
 
 int RGWOptionsCORS::validate_cors_request(RGWCORSConfiguration *cc) {
-  rule = cc->host_name_rule(origin);
+  rule = cc->match_rule(origin, req_meth, req_hdrs);
   if (!rule) {
-    ldpp_dout(this, 10) << "There is no cors rule present for " << origin << dendl;
-    return -ENOENT;
-  }
-
-  if (!validate_cors_rule_method(this, rule, req_meth)) {
-    return -ENOENT;
-  }
-
-  if (!validate_cors_rule_header(this, rule, req_hdrs)) {
+    ldpp_dout(this, 10) << "no CORS rule matching origin=" << origin
+                        << " method=" << req_meth << dendl;
     return -ENOENT;
   }
 
@@ -7273,21 +7270,9 @@ int RGWOptionsCORS::validate_cors_request(RGWCORSConfiguration *cc) {
 int RGWOptionsCORS::validate_global_cors_request(RGWCORSRule *global_cors_rule) {
   ldpp_dout(this, 20) << "Validating request with global CORS" << dendl;
   rule = global_cors_rule;
-  if (!rule) {
-    ldpp_dout(this, 10) << "There is no global cors rule present" << dendl;
-    return -ENOENT;
-  }
-
-  if (!rule->is_origin_present(origin)) {
-    ldpp_dout(this, 10) << "There is no cors rule present for " << origin << dendl;
-    return -ENOENT;
-  }
-
-  if (!validate_cors_rule_method(this, rule, req_meth)) {
-    return -ENOENT;
-  }
-
-  if (!validate_cors_rule_header(this, rule, req_hdrs)) {
+  if (!rule || !rule->matches(origin, req_meth, req_hdrs)) {
+    ldpp_dout(this, 10) << "no global CORS rule matching origin=" << origin
+                        << " method=" << req_meth << dendl;
     return -ENOENT;
   }
 
diff --git a/src/test/rgw/CMakeLists.txt b/src/test/rgw/CMakeLists.txt
index c587b5834dc..a61f23bd46a 100644
--- a/src/test/rgw/CMakeLists.txt
+++ b/src/test/rgw/CMakeLists.txt
@@ -102,6 +102,12 @@ add_executable(unittest_rgw_bencode test_rgw_bencode.cc)
 add_ceph_unittest(unittest_rgw_bencode)
 target_link_libraries(unittest_rgw_bencode ${rgw_libs})
 
+# unittest_rgw_cors
+add_executable(unittest_rgw_cors test_rgw_cors.cc)
+add_ceph_unittest(unittest_rgw_cors)
+target_link_libraries(unittest_rgw_cors ${rgw_libs})
+
+
 # unittest_rgw_bucket_sync_cache
 add_executable(unittest_rgw_bucket_sync_cache test_rgw_bucket_sync_cache.cc)
 add_ceph_unittest(unittest_rgw_bucket_sync_cache)
diff --git a/src/test/rgw/test_rgw_cors.cc b/src/test/rgw/test_rgw_cors.cc
new file mode 100644
index 00000000000..b3a1afa2751
--- /dev/null
+++ b/src/test/rgw/test_rgw_cors.cc
@@ -0,0 +1,73 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab
+
+#include "gtest/gtest.h"
+
+#include "rgw_cors.h"
+
+using namespace std;
+
+static RGWCORSRule make_rule(const char *origin, uint8_t methods,
+                             const char *allowed_hdr = nullptr)
+{
+  set<string> origins;
+  origins.insert(origin);
+  set<string> hdrs;
+  if (allowed_hdr) {
+    hdrs.insert(allowed_hdr);
+  }
+  list<string> expose;
+  return RGWCORSRule(origins, hdrs, expose, methods, 3000);
+}
+
+TEST(RGWCORS, MatchRuleSameOriginDifferentMethods)
+{
+  RGWCORSConfiguration cfg;
+  cfg.get_rules().push_back(make_rule("https://app.example", RGW_CORS_GET));
+  cfg.get_rules().push_back(make_rule("https://app.example", RGW_CORS_PUT));
+
+  auto it_get = cfg.get_rules().begin();
+  auto it_put = std::next(it_get);
+
+  EXPECT_EQ(cfg.match_rule("https://app.example", "GET", nullptr), &(*it_get));
+  EXPECT_EQ(cfg.match_rule("https://app.example", "PUT", nullptr), &(*it_put));
+  EXPECT_EQ(cfg.match_rule("https://app.example", "DELETE", nullptr), nullptr);
+}
+
+TEST(RGWCORS, MatchRuleSkipsOriginOnlyMatch)
+{
+  RGWCORSConfiguration cfg;
+  cfg.get_rules().push_back(make_rule("https://app.example", RGW_CORS_GET));
+  cfg.get_rules().push_back(make_rule("https://app.example", RGW_CORS_PUT));
+
+  EXPECT_NE(nullptr, cfg.match_rule("https://app.example", "PUT", nullptr));
+}
+
+TEST(RGWCORS, MatchRulePreflightHeaders)
+{
+  RGWCORSConfiguration cfg;
+  cfg.get_rules().push_back(
+      make_rule("https://app.example", RGW_CORS_GET, "content-type"));
+  cfg.get_rules().push_back(
+      make_rule("https://app.example", RGW_CORS_GET, "*"));
+
+  auto it_strict = cfg.get_rules().begin();
+  auto it_wild = std::next(it_strict);
+
+  EXPECT_EQ(cfg.match_rule("https://app.example", "GET",
+                           "content-type"),
+            &(*it_strict));
+  EXPECT_EQ(cfg.match_rule("https://app.example", "GET",
+                           "authorization"),
+            &(*it_wild));
+}
+
+TEST(RGWCORS, HostNameRuleStillOriginOnly)
+{
+  RGWCORSConfiguration cfg;
+  cfg.get_rules().push_back(make_rule("https://app.example", RGW_CORS_GET));
+  cfg.get_rules().push_back(make_rule("https://other.example", RGW_CORS_PUT));
+
+  auto it_first = cfg.get_rules().begin();
+  EXPECT_EQ(cfg.host_name_rule("https://app.example"), &(*it_first));
+}

From bbec6957902f7acaa9e657d398b5dbb453b9fe6b Mon Sep 17 00:00:00 2001
From: "ramin.najarbashi" <ramin.najarbashi@gmail.com>
Date: Sat, 6 Jun 2026 16:26:57 +0330
Subject: [PATCH 104/596] reject null or empty method in matches_method

Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>
---
 src/rgw/rgw_cors.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_cors.cc b/src/rgw/rgw_cors.cc
index 230a04664b8..266dea47681 100644
--- a/src/rgw/rgw_cors.cc
+++ b/src/rgw/rgw_cors.cc
@@ -242,7 +242,8 @@ void RGWCORSRule::format_exp_headers(string& s) {
 bool RGWCORSRule::matches_method(const char *req_meth)
 {
   if (!req_meth || !*req_meth) {
-    return true;
+    dout(5) << "matches_method: req_meth is null or empty" << dendl;
+    return false;
   }
   const uint8_t flags = get_multi_cors_method_flags(req_meth);
   return flags != 0 && (allowed_methods & flags);

From b5624b63f2245058acee9045386bb9f81e06fae2 Mon Sep 17 00:00:00 2001
From: "ramin.najarbashi" <ramin.najarbashi@gmail.com>
Date: Sat, 6 Jun 2026 16:46:53 +0330
Subject: [PATCH 105/596] fix: some issue based on CORS spec 6.2.4

Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>
---
 src/rgw/rgw_cors.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/rgw/rgw_cors.cc b/src/rgw/rgw_cors.cc
index 266dea47681..c1d20a6e2cf 100644
--- a/src/rgw/rgw_cors.cc
+++ b/src/rgw/rgw_cors.cc
@@ -245,6 +245,10 @@ bool RGWCORSRule::matches_method(const char *req_meth)
     dout(5) << "matches_method: req_meth is null or empty" << dendl;
     return false;
   }
+  if (allowed_methods == RGW_CORS_ALL) {
+    dout(10) << "matches_method: AllowedMethod * allows " << req_meth << dendl;
+    return true;
+  }
   const uint8_t flags = get_multi_cors_method_flags(req_meth);
   return flags != 0 && (allowed_methods & flags);
 }
@@ -252,6 +256,8 @@ bool RGWCORSRule::matches_method(const char *req_meth)
 bool RGWCORSRule::matches_preflight_headers(const char *req_hdrs)
 {
   if (!req_hdrs || !*req_hdrs) {
+    dout(20) << "matches_preflight_headers: no Access-Control-Request-Headers, "
+             << "passing per CORS spec 6.2.4" << dendl;
     return true;
   }
   vector<string> hdrs;

From 8b3f907f7c819b16f098142c9242d2abb6fa2829 Mon Sep 17 00:00:00 2001
From: "ramin.najarbashi" <ramin.najarbashi@gmail.com>
Date: Sat, 6 Jun 2026 17:01:56 +0330
Subject: [PATCH 106/596] rgw: address CORS rule-matching review feedback

- matches_method: reject null/empty method; short-circuit RGW_CORS_ALL
- matches_preflight_headers: add logging for skip and disallowed headers
- generate_cors_headers: capture req_meth/req_hdrs in lambda
- remove unused validate_cors_rule_method/header helpers

Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>

On branch fix/rgw-cors-aws-rule-matching
Changes to be committed:
	modified:   src/rgw/rgw_cors.cc
	modified:   src/rgw/rgw_op.cc
---
 src/rgw/rgw_cors.cc |  1 +
 src/rgw/rgw_op.cc   | 48 ++++-----------------------------------------
 2 files changed, 5 insertions(+), 44 deletions(-)

diff --git a/src/rgw/rgw_cors.cc b/src/rgw/rgw_cors.cc
index c1d20a6e2cf..05eb5824921 100644
--- a/src/rgw/rgw_cors.cc
+++ b/src/rgw/rgw_cors.cc
@@ -264,6 +264,7 @@ bool RGWCORSRule::matches_preflight_headers(const char *req_hdrs)
   get_str_vec(req_hdrs, hdrs);
   for (const auto& hdr : hdrs) {
     if (!is_header_allowed(hdr.c_str(), hdr.length())) {
+      dout(5) << "Header " << hdr << " is not registered in this rule" << dendl;
       return false;
     }
   }
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 494d089a733..f553b824270 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -1856,38 +1856,6 @@ int RGWOp::init_quota()
   return 0;
 }
 
-static bool validate_cors_rule_method(const DoutPrefixProvider *dpp, RGWCORSRule *rule, const char *req_meth) {
-  if (!req_meth) {
-    ldpp_dout(dpp, 5) << "req_meth is null" << dendl;
-    return false;
-  }
-
-  uint8_t flags = get_multi_cors_method_flags(req_meth);
-
-  if (rule->get_allowed_methods() & flags) {
-    ldpp_dout(dpp, 10) << "Method " << req_meth << " is supported" << dendl;
-  } else {
-    ldpp_dout(dpp, 5) << "Method " << req_meth << " is not supported" << dendl;
-    return false;
-  }
-
-  return true;
-}
-
-static bool validate_cors_rule_header(const DoutPrefixProvider *dpp, RGWCORSRule *rule, const char *req_hdrs) {
-  if (req_hdrs) {
-    vector<string> hdrs;
-    get_str_vec(req_hdrs, hdrs);
-    for (const auto& hdr : hdrs) {
-      if (!rule->is_header_allowed(hdr.c_str(), hdr.length())) {
-        ldpp_dout(dpp, 5) << "Header " << hdr << " is not registered in this rule" << dendl;
-        return false;
-      }
-    }
-  }
-  return true;
-}
-
 int RGWOp::read_bucket_cors()
 {
   bufferlist bl;
@@ -2008,7 +1976,7 @@ bool RGWOp::generate_cors_headers(string& origin, string& method, string& header
   const char *req_hdrs = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
 
   RGWCORSRule *rule = bucket_cors.match_rule(orig, req_meth, req_hdrs);
-  auto is_allowed_to_generate_rule_cors_header = [this, &origin, &method, &headers, &exp_headers, &max_age] (RGWCORSRule *rule) {
+  auto is_allowed_to_generate_rule_cors_header = [this, &origin, &method, &headers, &exp_headers, &max_age, req_meth, req_hdrs] (RGWCORSRule *rule) {
     if (!rule)
       return false;
 
@@ -2025,20 +1993,12 @@ bool RGWOp::generate_cors_headers(string& origin, string& method, string& header
       origin = "*";
 
     /* CORS 6.2.3. */
-    const char *req_meth_inner = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_METHOD");
-    if (!req_meth_inner) {
-      req_meth_inner = s->info.method;
+    if (req_meth) {
+      method = req_meth;
     }
 
-    if (req_meth_inner) {
-      method = req_meth_inner;
-    }
-
-    /* CORS 6.2.4. */
-    const char *req_hdrs_inner = s->info.env->get("HTTP_ACCESS_CONTROL_REQUEST_HEADERS");
-
     /* CORS 6.2.6. */
-    get_cors_response_headers(this, rule, req_hdrs_inner, headers, exp_headers, max_age);
+    get_cors_response_headers(this, rule, req_hdrs, headers, exp_headers, max_age);
 
     return true;
   };

From 8447dfd23cc231cb9232a54d6e57849ffb841fcd Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Sun, 7 Jun 2026 08:28:09 +0000
Subject: [PATCH 107/596] crimson/os/seastore: track per-transaction
 conflict/replay counts

Add a num_replays counter to Transaction, incremented in
Cache::mark_transaction_conflicted whenever a transaction is marked
conflicted.

Only relevant for user-MUTATE path (do_transaction_no_callbacks).

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/seastore/cache.cc      |  3 +++
 src/crimson/os/seastore/seastore.cc   | 23 +++++++++++++++++++++++
 src/crimson/os/seastore/seastore.h    | 18 ++++++++++++++++++
 src/crimson/os/seastore/transaction.h |  8 ++++++++
 4 files changed, 52 insertions(+)

diff --git a/src/crimson/os/seastore/cache.cc b/src/crimson/os/seastore/cache.cc
index 8a6b29ca5b9..be90decca48 100644
--- a/src/crimson/os/seastore/cache.cc
+++ b/src/crimson/os/seastore/cache.cc
@@ -1023,6 +1023,9 @@ void Cache::mark_transaction_conflicted(
   SUBTRACET(seastore_t, "", t);
   assert(!t.conflicted);
   t.conflicted = true;
+  // count is only *sampled* for the user-MUTATE do_transaction path,
+  // where the transaction is reused across retries
+  ++t.num_replays;
 
   auto& efforts = get_by_src(stats.invalidated_efforts_by_src,
                              t.get_src());
diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index f66fc9fd964..ffa49c02283 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -203,6 +203,28 @@ void SeaStore::Shard::register_metrics(store_index_t store_index)
     );
   }
 
+  stats.conflict_replays.buckets.resize(REPLAY_BUCKETS);
+  for (std::size_t i = 0; i < REPLAY_BUCKETS; ++i) {
+    stats.conflict_replays.buckets[i].upper_bound = i;
+    stats.conflict_replays.buckets[i].count = 0;
+  }
+  metrics.add_group(
+    "seastore",
+    {
+      sm::make_histogram(
+        "conflict_replay_distribution",
+        [this]() -> seastar::metrics::histogram& {
+          return stats.conflict_replays;
+        },
+        sm::description("distribution of per-transaction conflict/replay counts "
+                        "before commit, for user transactions submitted via "
+                        "do_transaction (the reused-transaction / "
+                        "with_repeat_trans_intr path); not all MUTATE transactions"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      )
+    }
+  );
+
   metrics.add_group(
     "seastore",
     {
@@ -1711,6 +1733,7 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
   );
 
   DEBUGT("done", *ctx.transaction);
+  add_conflict_replay_sample(ctx.transaction->get_num_replays());
   add_latency_sample(
     op_type_t::DO_TRANSACTION,
     std::chrono::steady_clock::now() - ctx.begin_timestamp);
diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index 54dd67c783f..e2bbc576a43 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -437,9 +437,12 @@ public:
       100000
     };
 
+    // Buckets for the per-transaction conflict/replay distribution.
+    static constexpr std::size_t REPLAY_BUCKETS = 16;
 
     struct {
       std::array<seastar::metrics::histogram, LAT_MAX> op_lat;
+      seastar::metrics::histogram conflict_replays;
     } stats;
 
     seastar::metrics::histogram& get_latency(
@@ -467,6 +470,21 @@ public:
       }
     }
 
+    // Record how many times a just-completed transaction was conflicted/replayed.
+    // Called only from the do_transaction_no_callbacks() completion path.
+    void add_conflict_replay_sample(std::size_t num_replays) {
+      auto& hist = stats.conflict_replays;
+      if (hist.buckets.empty()) {
+        // register_metrics() did not run (store inactive); nothing to record.
+        return;
+      }
+      std::size_t idx = num_replays < REPLAY_BUCKETS ?
+        num_replays : REPLAY_BUCKETS - 1;
+      ++hist.buckets[idx].count;
+      ++hist.sample_count;
+      hist.sample_sum += num_replays;
+    }
+
     /*
      * omaptree interfaces
      */
diff --git a/src/crimson/os/seastore/transaction.h b/src/crimson/os/seastore/transaction.h
index a6e2e1c7272..8fa2d011f5e 100644
--- a/src/crimson/os/seastore/transaction.h
+++ b/src/crimson/os/seastore/transaction.h
@@ -464,6 +464,12 @@ public:
     return conflicted;
   }
 
+  // Number of times this transaction was conflicted and replayed before
+  // finally committing. do_transaction_no_callbacks() (user MUTATE writes)
+  std::size_t get_num_replays() const {
+    return num_replays;
+  }
+
   auto &get_handle() {
     return handle;
   }
@@ -882,6 +888,8 @@ private:
 
   bool conflicted = false;
 
+  std::size_t num_replays = 0;
+
   bool has_reset = false;
 
   OrderingHandle handle;

From 89e913d279f8ea7a85460ee77edd05203d52ab04 Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Sun, 7 Jun 2026 09:24:51 +0000
Subject: [PATCH 108/596] seastore: add seastore_do_transaction_stage_lat
 metric

Introduce a new latency breakdown metric for do_transaction, exposing
per-stage timing (build, collock_wait, submit, throttler_wait).

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/seastore/seastore.cc | 41 +++++++++++++++++++++++++++++
 src/crimson/os/seastore/seastore.h  | 40 ++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)

diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index ffa49c02283..2464032ffae 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -225,6 +225,35 @@ void SeaStore::Shard::register_metrics(store_index_t store_index)
     }
   );
 
+  std::pair<txn_stage_t, sm::label_instance> labels_by_stage[] = {
+    {txn_stage_t::COLLOCK_WAIT,   sm::label_instance("stage", "collock_wait")},
+    {txn_stage_t::THROTTLER_WAIT, sm::label_instance("stage", "throttler_wait")},
+    {txn_stage_t::BUILD,          sm::label_instance("stage", "build")},
+    {txn_stage_t::SUBMIT,         sm::label_instance("stage", "submit")},
+  };
+  for (auto& [stage, label] : labels_by_stage) {
+    auto idx = static_cast<std::size_t>(stage);
+    auto& hist = stats.stage_lat[idx];
+    hist.buckets.resize(STAGE_LAT_BUCKETS_US.size());
+    for (std::size_t i = 0; i < STAGE_LAT_BUCKETS_US.size(); ++i) {
+      hist.buckets[i].upper_bound = STAGE_LAT_BUCKETS_US[i];
+      hist.buckets[i].count = 0;
+    }
+    metrics.add_group(
+      "seastore",
+      {
+        sm::make_histogram(
+          "do_transaction_stage_lat",
+          [this, idx]() -> seastar::metrics::histogram& {
+            return stats.stage_lat[idx];
+          },
+          sm::description("per-stage latency (microseconds) of do_transaction"),
+          {label, sm::label_instance("shard_store_index", std::to_string(store_index))}
+        )
+      }
+    );
+  }
+
   metrics.add_group(
     "seastore",
     {
@@ -1667,15 +1696,19 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
   --(shard_stats.starting_io_num);
   ++(shard_stats.waiting_collock_io_num);
 
+  auto t_pre_collock = std::chrono::steady_clock::now();
   co_await ctx.transaction->get_handle().take_collection_lock(
     static_cast<SeastoreCollection&>(*(ctx.ch)).ordering_lock
   );
+  auto collock_wait = std::chrono::steady_clock::now() - t_pre_collock;
 
   assert(shard_stats.waiting_collock_io_num);
   --(shard_stats.waiting_collock_io_num);
   ++(shard_stats.waiting_throttler_io_num);
 
+  auto t_pre_throttler = std::chrono::steady_clock::now();
   co_await throttler.get(1);
+  auto throttler_wait = std::chrono::steady_clock::now() - t_pre_throttler;
 
   assert(shard_stats.waiting_throttler_io_num);
   --(shard_stats.waiting_throttler_io_num);
@@ -1711,6 +1744,7 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
       const size_t total_ops = ctx.ext_transaction.get_num_ops();
       size_t current_op = 0;
 
+      auto build_start = std::chrono::steady_clock::now();
       while (ctx.iter.have_op()) {
         current_op++;
 
@@ -1719,10 +1753,13 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
 	co_await _do_transaction_step(
 	  ctx, ctx.ch, onodes, ctx.iter);
       }
+      ctx.build_time += std::chrono::steady_clock::now() - build_start;
 
       DEBUGT("completed all {} ops for cid={}",
              t, total_ops, ctx.ch->get_cid());
+      auto submit_start = std::chrono::steady_clock::now();
       co_await transaction_manager->submit_transaction(*ctx.transaction);
+      ctx.submit_time += std::chrono::steady_clock::now() - submit_start;
     })
   ).handle_error(
     crimson::ct_error::all_same_way([FNAME, &ctx](auto e) {
@@ -1734,6 +1771,10 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
 
   DEBUGT("done", *ctx.transaction);
   add_conflict_replay_sample(ctx.transaction->get_num_replays());
+  add_stage_latency_sample(txn_stage_t::COLLOCK_WAIT, collock_wait);
+  add_stage_latency_sample(txn_stage_t::THROTTLER_WAIT, throttler_wait);
+  add_stage_latency_sample(txn_stage_t::BUILD, ctx.build_time);
+  add_stage_latency_sample(txn_stage_t::SUBMIT, ctx.submit_time);
   add_latency_sample(
     op_type_t::DO_TRANSACTION,
     std::chrono::steady_clock::now() - ctx.begin_timestamp);
diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index e2bbc576a43..61c59b8d554 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -47,6 +47,14 @@ enum class op_type_t : uint8_t {
     MAX
 };
 
+enum class txn_stage_t : uint8_t {
+    COLLOCK_WAIT = 0,  // waiting on the collection ordering_lock
+    THROTTLER_WAIT,    // waiting for a throttler slot
+    BUILD,             // building the transaction (_do_transaction_step loop)
+    SUBMIT,            // submit_transaction (pipeline + journal write)
+    MAX
+};
+
 class SeastoreCollection final : public FuturizedCollection {
 public:
   template <typename... T>
@@ -252,6 +260,9 @@ public:
       ceph::os::Transaction::iterator iter;
       std::chrono::steady_clock::time_point begin_timestamp = std::chrono::steady_clock::now();
 
+      std::chrono::steady_clock::duration build_time{0};
+      std::chrono::steady_clock::duration submit_time{0};
+
       void reset_preserve_handle(TransactionManager &tm) {
         tm.reset_transaction_preserve_handle(*transaction);
         iter = ext_transaction.begin();
@@ -440,9 +451,17 @@ public:
     // Buckets for the per-transaction conflict/replay distribution.
     static constexpr std::size_t REPLAY_BUCKETS = 16;
 
+    static constexpr auto STAGE_MAX = static_cast<std::size_t>(txn_stage_t::MAX);
+    // Upper bounds (microseconds) for the per-stage do_transaction latency histograms
+    static constexpr std::array<uint64_t, 14> STAGE_LAT_BUCKETS_US = {
+      250, 500, 1000, 1500, 2000, 3000, 5000, 7500,
+      10000, 15000, 20000, 30000, 50000, 100000
+    };
+
     struct {
       std::array<seastar::metrics::histogram, LAT_MAX> op_lat;
       seastar::metrics::histogram conflict_replays;
+      std::array<seastar::metrics::histogram, STAGE_MAX> stage_lat;
     } stats;
 
     seastar::metrics::histogram& get_latency(
@@ -485,6 +504,27 @@ public:
       hist.sample_sum += num_replays;
     }
 
+    // Record the latency of one do_transaction stage (microseconds). Buckets are
+    // non-cumulative (bucket = first upper_bound >= value); values above the top
+    // bound aren't bucketed but still land in sample_count/sample_sum.
+    void add_stage_latency_sample(txn_stage_t stage,
+        std::chrono::steady_clock::duration dur) {
+      auto& hist = stats.stage_lat[static_cast<std::size_t>(stage)];
+      if (hist.buckets.empty()) {
+        // register_metrics() did not run (store inactive); nothing to record.
+        return;
+      }
+      auto us = std::chrono::duration_cast<std::chrono::microseconds>(dur).count();
+      for (auto& b : hist.buckets) {
+        if (static_cast<double>(us) <= b.upper_bound) {
+          ++b.count;
+          break;
+        }
+      }
+      ++hist.sample_count;
+      hist.sample_sum += us;
+    }
+
     /*
      * omaptree interfaces
      */

From 6f7f9779e787c1feef98090710cd0c162d41b2ef Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Sun, 7 Jun 2026 12:11:49 +0000
Subject: [PATCH 109/596] crimson/os/seastore: break down submit phases

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/seastore/seastore.cc           | 25 +++++++++++++++----
 src/crimson/os/seastore/seastore.h            |  9 ++++++-
 src/crimson/os/seastore/transaction.h         | 16 ++++++++++++
 .../os/seastore/transaction_manager.cc        | 21 ++++++++++++++++
 4 files changed, 65 insertions(+), 6 deletions(-)

diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index 2464032ffae..3d88bb1c405 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -226,10 +226,16 @@ void SeaStore::Shard::register_metrics(store_index_t store_index)
   );
 
   std::pair<txn_stage_t, sm::label_instance> labels_by_stage[] = {
-    {txn_stage_t::COLLOCK_WAIT,   sm::label_instance("stage", "collock_wait")},
-    {txn_stage_t::THROTTLER_WAIT, sm::label_instance("stage", "throttler_wait")},
-    {txn_stage_t::BUILD,          sm::label_instance("stage", "build")},
-    {txn_stage_t::SUBMIT,         sm::label_instance("stage", "submit")},
+    {txn_stage_t::COLLOCK_WAIT,          sm::label_instance("stage", "collock_wait")},
+    {txn_stage_t::THROTTLER_WAIT,        sm::label_instance("stage", "throttler_wait")},
+    {txn_stage_t::BUILD,                 sm::label_instance("stage", "build")},
+    {txn_stage_t::SUBMIT_TOTAL,          sm::label_instance("stage", "submit_total")},
+    {txn_stage_t::SUBMIT_RESERVE,        sm::label_instance("stage", "submit_reserve")},
+    {txn_stage_t::SUBMIT_OOL_WRITE,      sm::label_instance("stage", "submit_ool_write")},
+    {txn_stage_t::SUBMIT_LBA_UPDATE,     sm::label_instance("stage", "submit_lba_update")},
+    {txn_stage_t::SUBMIT_PREPARE_ENTER,  sm::label_instance("stage", "submit_prepare_enter")},
+    {txn_stage_t::SUBMIT_PREPARE_RECORD, sm::label_instance("stage", "submit_prepare_record")},
+    {txn_stage_t::SUBMIT_JOURNAL,        sm::label_instance("stage", "submit_journal")},
   };
   for (auto& [stage, label] : labels_by_stage) {
     auto idx = static_cast<std::size_t>(stage);
@@ -1774,7 +1780,16 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
   add_stage_latency_sample(txn_stage_t::COLLOCK_WAIT, collock_wait);
   add_stage_latency_sample(txn_stage_t::THROTTLER_WAIT, throttler_wait);
   add_stage_latency_sample(txn_stage_t::BUILD, ctx.build_time);
-  add_stage_latency_sample(txn_stage_t::SUBMIT, ctx.submit_time);
+  add_stage_latency_sample(txn_stage_t::SUBMIT_TOTAL, ctx.submit_time);
+  {
+    auto& pd = ctx.transaction->get_phase_durations();
+    add_stage_latency_sample(txn_stage_t::SUBMIT_RESERVE, pd.reserve);
+    add_stage_latency_sample(txn_stage_t::SUBMIT_OOL_WRITE, pd.ool_write);
+    add_stage_latency_sample(txn_stage_t::SUBMIT_LBA_UPDATE, pd.lba_update);
+    add_stage_latency_sample(txn_stage_t::SUBMIT_PREPARE_ENTER, pd.prepare_enter);
+    add_stage_latency_sample(txn_stage_t::SUBMIT_PREPARE_RECORD, pd.prepare_record);
+    add_stage_latency_sample(txn_stage_t::SUBMIT_JOURNAL, pd.journal);
+  }
   add_latency_sample(
     op_type_t::DO_TRANSACTION,
     std::chrono::steady_clock::now() - ctx.begin_timestamp);
diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index 61c59b8d554..0cb63205052 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -51,7 +51,14 @@ enum class txn_stage_t : uint8_t {
     COLLOCK_WAIT = 0,  // waiting on the collection ordering_lock
     THROTTLER_WAIT,    // waiting for a throttler slot
     BUILD,             // building the transaction (_do_transaction_step loop)
-    SUBMIT,            // submit_transaction (pipeline + journal write)
+    SUBMIT_TOTAL,      // the whole submit_transaction (pipeline + journal write)
+    // Sub-phases of submit_transaction:
+    SUBMIT_RESERVE,        // enter(reserve_projected_usage) + epm reserve_projected_usage
+    SUBMIT_OOL_WRITE,      // write_delayed + write_preallocated OOL extents (device I/O)
+    SUBMIT_LBA_UPDATE,     // update_lba_mappings
+    SUBMIT_PREPARE_ENTER,  // enter(prepare) pipeline stage (global OrderedExclusive wait)
+    SUBMIT_PREPARE_RECORD, // prepare_record (record encoding)
+    SUBMIT_JOURNAL,        // journal->submit_record -- POST-lock (not part of the hold)
     MAX
 };
 
diff --git a/src/crimson/os/seastore/transaction.h b/src/crimson/os/seastore/transaction.h
index 8fa2d011f5e..3c2be49db9a 100644
--- a/src/crimson/os/seastore/transaction.h
+++ b/src/crimson/os/seastore/transaction.h
@@ -3,6 +3,7 @@
 
 #pragma once
 
+#include <chrono>
 #include <iostream>
 
 #include <boost/intrusive/list.hpp>
@@ -470,6 +471,19 @@ public:
     return num_replays;
   }
 
+  // Time spent in each sub-phase of submit_transaction, accumulated across retries
+  struct phase_durations_t {
+    std::chrono::steady_clock::duration reserve{0};         // enter reserve + epm reserve
+    std::chrono::steady_clock::duration ool_write{0};       // delayed + preallocated OOL writes
+    std::chrono::steady_clock::duration lba_update{0};      // update_lba_mappings
+    std::chrono::steady_clock::duration prepare_enter{0};   // enter(prepare) pipeline stage
+    std::chrono::steady_clock::duration prepare_record{0};  // prepare_record
+    std::chrono::steady_clock::duration journal{0};         // journal->submit_record (post-lock)
+  };
+  phase_durations_t &get_phase_durations() {
+    return phase_durations;
+  }
+
   auto &get_handle() {
     return handle;
   }
@@ -890,6 +904,8 @@ private:
 
   std::size_t num_replays = 0;
 
+  phase_durations_t phase_durations;
+
   bool has_reset = false;
 
   OrderingHandle handle;
diff --git a/src/crimson/os/seastore/transaction_manager.cc b/src/crimson/os/seastore/transaction_manager.cc
index af5d32930ac..f0fd3509cea 100644
--- a/src/crimson/os/seastore/transaction_manager.cc
+++ b/src/crimson/os/seastore/transaction_manager.cc
@@ -471,6 +471,7 @@ TransactionManager::submit_transaction(
 {
   LOG_PREFIX(TransactionManager::submit_transaction);
   SUBDEBUGT(seastore_t, "start, entering reserve_projected_usage", t);
+  auto reserve_start = std::chrono::steady_clock::now();
   co_await trans_intr::make_interruptible(
     t.get_handle().enter(write_pipeline.reserve_projected_usage)
   );
@@ -483,6 +484,8 @@ TransactionManager::submit_transaction(
       projected_usage
     )
   );
+  t.get_phase_durations().reserve +=
+    std::chrono::steady_clock::now() - reserve_start;
   auto release_usage = seastar::defer([this, FNAME, projected_usage, &t] {
     SUBTRACET(seastore_t, "releasing projected_usage: {}", t, projected_usage);
     epm->release_projected_usage(projected_usage);
@@ -593,21 +596,33 @@ TransactionManager::do_submit_transaction(
   );
 
   SUBTRACET(seastore_t, "write delayed ool extents", tref);
+  auto ool_start = std::chrono::steady_clock::now();
   co_await epm->write_delayed_ool_extents(
     tref, dispatch_result.alloc_map
   );
+  tref.get_phase_durations().ool_write +=
+    std::chrono::steady_clock::now() - ool_start;
 
   auto allocated_extents = tref.get_valid_pre_alloc_list();
+  auto lba_start = std::chrono::steady_clock::now();
   co_await update_lba_mappings(tref, allocated_extents);
+  tref.get_phase_durations().lba_update +=
+    std::chrono::steady_clock::now() - lba_start;
 
   auto num_extents = allocated_extents.size();
   SUBTRACET(seastore_t, "process {} allocated extents", tref, num_extents);
+  ool_start = std::chrono::steady_clock::now();
   co_await epm->write_preallocated_ool_extents(tref, allocated_extents);
+  tref.get_phase_durations().ool_write +=
+    std::chrono::steady_clock::now() - ool_start;
 
   SUBTRACET(seastore_t, "entering prepare", tref);
+  auto prepare_enter_start = std::chrono::steady_clock::now();
   co_await trans_intr::make_interruptible(
     tref.get_handle().enter(write_pipeline.prepare)
   );
+  tref.get_phase_durations().prepare_enter +=
+    std::chrono::steady_clock::now() - prepare_enter_start;
 
   while (tref.need_wait_visibility) {
     co_await trans_intr::make_interruptible(seastar::yield());
@@ -617,10 +632,13 @@ TransactionManager::do_submit_transaction(
     cache->trim_backref_bufs(*trim_alloc_to);
   }
 
+  auto prepare_record_start = std::chrono::steady_clock::now();
   auto record = cache->prepare_record(
     tref,
     journal->get_trimmer().get_journal_head(),
     journal->get_trimmer().get_dirty_tail());
+  tref.get_phase_durations().prepare_record +=
+    std::chrono::steady_clock::now() - prepare_record_start;
 
   tref.get_handle().maybe_release_collection_lock();
   if (tref.get_src() == Transaction::src_t::MUTATE) {
@@ -629,6 +647,7 @@ TransactionManager::do_submit_transaction(
   }
 
   SUBTRACET(seastore_t, "submitting record", tref);
+  auto journal_start = std::chrono::steady_clock::now();
   co_await journal->submit_record(
     std::move(record),
     tref.get_handle(),
@@ -648,6 +667,8 @@ TransactionManager::do_submit_transaction(
       submit_transaction_iertr::pass_further{},
       crimson::ct_error::assert_all("Hit error submitting to journal")
     );
+  tref.get_phase_durations().journal +=
+    std::chrono::steady_clock::now() - journal_start;
 
   co_await trans_intr::make_interruptible(
     tref.get_handle().complete()

From 63b5a5aebd5c39969a4df21dfbbac5242f95f936 Mon Sep 17 00:00:00 2001
From: gmallet <malletgaetan@protonmail.com>
Date: Mon, 8 Jun 2026 08:00:31 +0200
Subject: [PATCH 110/596] libcephfs: add public api for ceph_ll_flock

Signed-off-by: gmallet <malletgaetan@protonmail.com>
---
 src/include/cephfs/libcephfs.h |  2 ++
 src/libcephfs.cc               |  6 ++++
 src/test/libcephfs/flock.cc    | 56 ++++++++++++++++++++++++++++++++++
 3 files changed, 64 insertions(+)

diff --git a/src/include/cephfs/libcephfs.h b/src/include/cephfs/libcephfs.h
index 12c202ae12e..2372e92eb2f 100644
--- a/src/include/cephfs/libcephfs.h
+++ b/src/include/cephfs/libcephfs.h
@@ -2221,6 +2221,8 @@ int ceph_ll_getlk(struct ceph_mount_info *cmount,
 		  Fh *fh, struct flock *fl, uint64_t owner);
 int ceph_ll_setlk(struct ceph_mount_info *cmount,
 		  Fh *fh, struct flock *fl, uint64_t owner, int sleep);
+int ceph_ll_flock(struct ceph_mount_info *cmount,
+		  Fh *fh, int operation, uint64_t owner);
 
 int ceph_ll_lazyio(struct ceph_mount_info *cmount, Fh *fh, int enable);
 
diff --git a/src/libcephfs.cc b/src/libcephfs.cc
index 0eeddd7167e..e24750dfed7 100644
--- a/src/libcephfs.cc
+++ b/src/libcephfs.cc
@@ -2395,6 +2395,12 @@ extern "C" int ceph_ll_setlk(struct ceph_mount_info *cmount,
   return (cmount->get_client()->ll_setlk(fh, fl, owner, sleep));
 }
 
+extern "C" int ceph_ll_flock(struct ceph_mount_info *cmount,
+			     Fh *fh, int operation, uint64_t owner)
+{
+  return (cmount->get_client()->ll_flock(fh, operation, owner));
+}
+
 extern "C" int ceph_ll_lazyio(class ceph_mount_info *cmount,
 			      Fh *fh, int enable)
 {
diff --git a/src/test/libcephfs/flock.cc b/src/test/libcephfs/flock.cc
index 3ced2d1bcec..52bce20f2ec 100644
--- a/src/test/libcephfs/flock.cc
+++ b/src/test/libcephfs/flock.cc
@@ -130,6 +130,62 @@ TEST(LibCephFS, BasicLocking) {
   CLEANUP_CEPH();
 }
 
+TEST(LibCephFS, BasicLLLocking) {
+  struct ceph_mount_info *cmount = NULL;
+  STARTUP_CEPH();
+
+  char c_file[1024];
+  sprintf(c_file, "ll_flock_test_%d", getpid());
+  Fh *fh = NULL;
+  Inode *root = NULL, *inode = NULL;
+  struct ceph_statx stx;
+  UserPerm *perms = ceph_mount_perms(cmount);
+
+  ASSERT_EQ(0, ceph_ll_lookup_root(cmount, &root));
+  ASSERT_EQ(0, ceph_ll_create(cmount, root, c_file, fileMode,
+			      O_RDWR | O_CREAT, &inode, &fh, &stx,
+			      0, 0, perms));
+
+  // Lock exclusively twice
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_EX, 42));
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 43));
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 44));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 42));
+
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 43));
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 44));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 43));
+
+  // Lock shared three times
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_SH, 42));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_SH, 43));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_SH, 44));
+  // And then attempt to lock exclusively
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 45));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 42));
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 45));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 44));
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 45));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 43));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_EX | LOCK_NB, 45));
+  ASSERT_EQ(-EAGAIN, ceph_ll_flock(cmount, fh, LOCK_SH | LOCK_NB, 42));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 45));
+
+  // Lock shared with upgrade to exclusive (POSIX)
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_SH, 42));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_EX, 42));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 42));
+
+  // Lock exclusive with downgrade to shared (POSIX)
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_EX, 42));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_SH, 42));
+  ASSERT_EQ(0, ceph_ll_flock(cmount, fh, LOCK_UN, 42));
+
+  ASSERT_EQ(0, ceph_ll_close(cmount, fh));
+  ASSERT_EQ(0, ceph_ll_unlink(cmount, root, c_file, perms));
+  CLEANUP_CEPH();
+}
+
 /* Locking in different threads */
 
 // Used by ConcurrentLocking test

From b05cfd16126527cb4178130344334f8dee1f3748 Mon Sep 17 00:00:00 2001
From: Jon Bailey <jonathan.bailey1@ibm.com>
Date: Thu, 4 Jun 2026 11:27:07 +0100
Subject: [PATCH 111/596] test: Remove invalid unit test

This test was talking about testing invalid ops, however with the inclusion of sync reads in EC (https://github.com/ceph/ceph/pull/67079), it is valid to perform class reads in EC. In addition, work was done around illegal ops here: https://github.com/ceph/ceph/pull/66258 and the existance of TEST(ClsHello, BadMethods) in test_cls_hello.cc covers illegal ops in that PR leading me to think this is unneccisairy. Because of these reasons, I think its better this test is removed as it is incorrect and also not working.

Signed-off-by: Jon Bailey <jonathan.bailey1@ibm.com>
---
 src/test/librados/split_op_cxx.cc | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/src/test/librados/split_op_cxx.cc b/src/test/librados/split_op_cxx.cc
index e71318f1590..4abc416bb92 100644
--- a/src/test/librados/split_op_cxx.cc
+++ b/src/test/librados/split_op_cxx.cc
@@ -322,25 +322,6 @@ TEST_P(LibRadosSplitOpECPP, ReadSecondShardWithVersion) {
   ASSERT_TRUE(AssertOperateWithSplitOp(0, 2, "foo", &read, &bl, balanced_read_flags));
 }
 
-TEST_P(LibRadosSplitOpECPP, ReadWithIllegalClsOp) {
-  SKIP_IF_CRIMSON();
-  bufferlist bl;
-  bl.append("ceph");
-  ObjectWriteOperation write1;
-  write1.write(0, bl);
-  ASSERT_TRUE(AssertOperateWithoutSplitOp(0, "foo", &write1));
-
-  bufferlist new_bl;
-  new_bl.append("CEPH");
-  ObjectWriteOperation write2;
-  bufferlist exec_inbl, exec_outbl;
-  int exec_rval;
-  rados::cls::fifo::op::init_part op;
-  encode(op, exec_inbl);
-  write2.exec(fifo::method::init_part, exec_inbl, &exec_outbl, &exec_rval);
-  ASSERT_TRUE(AssertOperateWithoutSplitOp(-EOPNOTSUPP, "foo", &write2));
-}
-
 TEST_P(LibRadosSplitOpECPP, XattrReads) {
   SKIP_IF_CRIMSON();
   bufferlist bl, attr_bl, attr_read_bl;

From c7bbe58ae7a89b6a8db818fe704042c80c6b5682 Mon Sep 17 00:00:00 2001
From: Alex Ainscow <aainscow@uk.ibm.com>
Date: Sun, 3 May 2026 17:46:00 +0100
Subject: [PATCH 112/596] test/osd: Improve test logging with OSD
 identification

Modified the logging system to show which OSD is executing in test logs,
making it easier to debug multi-OSD test scenarios.

Changes:
- Added Log::set_prefix_hook() to allow tests to customize log prefixes
- Modified Log::_flush() to use prefix_hook when set, replacing thread IDs
- Added EventLoop::get_log_prefix() to return 'osd.X' or 'harness' based on context
- Updated EventLoop to track current_executing_osd during event execution
- Simplified PGBackendTestFixture to use NoDoutPrefix directly
- Removed redundant 'shard X:' prefix from ShardDpp (info already in PG identifier)
- Removed verbose console output from EventLoop (now redundant with OSD prefixes)
- Converted EventLoop message scheduling to use dout at level 20

Benefits:
- Test logs now show 'osd.X' instead of thread IDs during event execution
- Shows 'harness' for test setup/teardown code outside events
- Message scheduling visible in logs at debug level 20
- Makes multi-OSD test scenarios much easier to follow and debug
- No changes to production logging code

AI assisted code, with careful human review and checking.

AI-assisted-by: IBM Bob IDE:Claude Sonnet (Anthropic)
Signed-off-by: Alex Ainscow <aainscow@uk.ibm.com>
---
 src/log/Log.cc                       |  20 +++-
 src/log/Log.h                        |   9 ++
 src/test/osd/ECPeeringTestFixture.cc |   1 -
 src/test/osd/EventLoop.h             | 142 +++++++++------------------
 src/test/osd/PGBackendTestFixture.h  |  23 +++--
 5 files changed, 85 insertions(+), 110 deletions(-)

diff --git a/src/log/Log.cc b/src/log/Log.cc
index 989438abbfd..4a79f0def28 100644
--- a/src/log/Log.cc
+++ b/src/log/Log.cc
@@ -40,6 +40,11 @@ namespace logging {
 
 static OnExitManager exit_callbacks;
 
+// Static hook for getting log prefix (set by tests).
+// NOTE: Not thread-safe. Intended for single-threaded unit test harnesses
+// and should be set once during startup.
+static Log::prefix_hook_t prefix_hook = nullptr;
+
 static void log_on_exit(void *p)
 {
   Log *l = *(Log **)p;
@@ -48,6 +53,11 @@ static void log_on_exit(void *p)
   delete (Log **)p;// Delete allocated pointer (not Log object, the pointer only!)
 }
 
+void Log::set_prefix_hook(prefix_hook_t hook)
+{
+  prefix_hook = hook;
+}
+
 Log::Log(const SubsystemMap *s)
   : m_indirect_this(nullptr),
     m_subs(s),
@@ -409,7 +419,15 @@ void Log::_flush(EntryVector& t, bool crash)
         used += (std::size_t)snprintf(pos + used, allocated - used, "%6ld> ", -(--len));
       }
       used += (std::size_t)append_time(stamp, pos + used, allocated - used);
-      used += (std::size_t)snprintf(pos + used, allocated - used, " %lx %2d ", (unsigned long)thread, prio);
+      
+      // In tests, replace thread ID with custom prefix (e.g., "osd.X" or "harness")
+      const char* prefix = prefix_hook ? prefix_hook() : nullptr;
+      if (prefix) {
+        used += (std::size_t)snprintf(pos + used, allocated - used, " %s %2d ", prefix, prio);
+      } else {
+        used += (std::size_t)snprintf(pos + used, allocated - used, " %lx %2d ", (unsigned long)thread, prio);
+      }
+      
       memcpy(pos + used, str.data(), str.size());
       used += str.size();
       pos[used] = '\0';
diff --git a/src/log/Log.h b/src/log/Log.h
index 99b636eb13a..226afbd78ca 100644
--- a/src/log/Log.h
+++ b/src/log/Log.h
@@ -35,6 +35,7 @@ class Log : private Thread
 {
 public:
   using Thread::is_started;
+  using prefix_hook_t = const char* (*)();
 
   Log(const SubsystemMap *s);
   ~Log() override;
@@ -81,6 +82,14 @@ public:
   void inject_segv();
   void reset_segv();
 
+  /**
+   * Set a hook to get the log prefix (replaces thread ID in log output).
+   *
+   * @note Not thread-safe. Must be called once during startup before any
+   *       logging occurs. Designed for single-threaded unit test harnesses only.
+   */
+  static void set_prefix_hook(prefix_hook_t hook);
+
 protected:
   using EntryVector = std::vector<ConcreteEntry>;
 
diff --git a/src/test/osd/ECPeeringTestFixture.cc b/src/test/osd/ECPeeringTestFixture.cc
index 172aa9a8dfb..5a61f381b78 100644
--- a/src/test/osd/ECPeeringTestFixture.cc
+++ b/src/test/osd/ECPeeringTestFixture.cc
@@ -19,7 +19,6 @@
 
 // ShardDpp implementation
 std::ostream& ECPeeringTestFixture::ShardDpp::gen_prefix(std::ostream& out) const {
-  out << "shard " << shard << ": ";
   if (fixture->shard_peering_states.contains(shard)) {
     PeeringState *ps = fixture->shard_peering_states[shard].get();
     out << *ps;
diff --git a/src/test/osd/EventLoop.h b/src/test/osd/EventLoop.h
index c54d3fb603d..f1eec6c7c7f 100644
--- a/src/test/osd/EventLoop.h
+++ b/src/test/osd/EventLoop.h
@@ -15,7 +15,6 @@
 
 #pragma once
 
-#include <iostream>
 #include <functional>
 #include <deque>
 #include <map>
@@ -27,6 +26,7 @@
 #include "osd/OpRequest.h"
 #include "osd/PeeringState.h"
 #include "os/ObjectStore.h"
+#include "common/dout.h"
 
 /**
  * EventLoop - Unified single-threaded event loop for OSD tests.
@@ -48,7 +48,37 @@ public:
     PEERING_EVENT
   };
   
+  /**
+   * Get the log prefix for the currently executing context.
+   * Returns "osd.X" if an OSD is currently executing, "harness" if not.
+   * This is used by Log::_flush() to replace thread IDs with meaningful names.
+   */
+  static const char* get_log_prefix() {
+    static thread_local char prefix_buf[32];
+    
+    // Read the value once to ensure consistency within this call
+    int osd_id = current_executing_osd;
+    
+    if (osd_id >= 0) {
+      snprintf(prefix_buf, sizeof(prefix_buf), "osd.%d", osd_id);
+      return prefix_buf;
+    }
+    // osd_id is -1 (harness/test code, not in OSD event)
+    return "harness";
+  }
+  
+  /**
+   * Get the OSD number currently executing in the EventLoop.
+   * Returns -1 if no OSD is currently executing or if called outside an EventLoop context.
+   * This is a simple static variable that can be easily accessed from lldb at any time.
+   */
+  static int get_current_executing_osd() {
+    return current_executing_osd;
+  }
+  
 private:
+  // Static storage for the currently executing OSD
+  static int current_executing_osd;
   struct Event {
     EventType type;
     int from_osd;  // -1 for generic events or when not applicable
@@ -60,13 +90,13 @@ private:
   };
   
   std::deque<Event> events;
-  bool verbose = false;
   int events_executed = 0;
   std::map<EventType, int> events_by_type;
   std::set<int> suspended_from_osds;
   std::set<int> suspended_to_osds;
   std::set<std::pair<int, int>> suspended_from_to_osds;
   int current_osd = -1;
+  DoutPrefixProvider *dpp;
   
   // Map from OSD number to its queue of suspended events
   std::map<int, std::deque<Event>> suspended_events;
@@ -87,7 +117,7 @@ private:
   }
   
 public:
-  EventLoop(bool verbose = false) : verbose(verbose) {}
+  EventLoop(DoutPrefixProvider *dpp) : dpp(dpp) {}
   
   void schedule_generic(GenericEvent event) {
     events.emplace_back(EventType::GENERIC, -1, -1, std::move(event));
@@ -96,6 +126,8 @@ public:
   void schedule_osd_message(int from_osd, int to_osd, GenericEvent callback) {
     ceph_assert(from_osd >= 0);
     ceph_assert(to_osd >= 0);
+    ldpp_dout(dpp, 20) << "EventLoop: scheduling OSD_MESSAGE from OSD." << from_osd
+                       << " to OSD." << to_osd << dendl;
     events.emplace_back(EventType::OSD_MESSAGE, from_osd, to_osd, std::move(callback));
   }
   
@@ -107,12 +139,16 @@ public:
   void schedule_peering_message(int from_osd, int to_osd, GenericEvent callback) {
     ceph_assert(from_osd >= 0);
     ceph_assert(to_osd >= 0);
+    ldpp_dout(dpp, 20) << "EventLoop: scheduling PEERING_MESSAGE from OSD." << from_osd
+                       << " to OSD." << to_osd << dendl;
     events.emplace_back(EventType::PEERING_MESSAGE, from_osd, to_osd, std::move(callback));
   }
   
   void schedule_cluster_message(int from_osd, int to_osd, GenericEvent callback) {
     ceph_assert(from_osd >= 0);
     ceph_assert(to_osd >= 0);
+    ldpp_dout(dpp, 20) << "EventLoop: scheduling CLUSTER_MESSAGE from OSD." << from_osd
+                       << " to OSD." << to_osd << dendl;
     events.emplace_back(EventType::CLUSTER_MESSAGE, from_osd, to_osd, std::move(callback));
   }
   
@@ -172,68 +208,32 @@ public:
     
     if (should_suspend) {
       // Move to suspended queue
-      if (verbose) {
-        std::cout << "  [Event " << (events_executed + 1) << "] "
-                  << event_type_name(event.type);
-        if (event.from_osd >= 0 && event.to_osd >= 0) {
-          std::cout << " (OSD." << event.from_osd << " -> OSD." << event.to_osd << ")";
-        } else if (event.to_osd >= 0) {
-          std::cout << " (to OSD." << event.to_osd << ")";
-        } else if (event.from_osd >= 0) {
-          std::cout << " (from OSD." << event.from_osd << ")";
-        }
-        std::cout << " *** SUSPENDED - moving to suspended queue ***" << std::endl;
-      }
       suspended_events[suspend_osd].push_back(std::move(event));
       return true;  // We processed an event (by suspending it)
     }
     
-    // Print banner if switching to a different OSD
+    // Track which OSD we're currently processing
     int active_osd = (event.to_osd >= 0) ? event.to_osd : event.from_osd;
     if (active_osd >= 0 && active_osd != current_osd) {
       current_osd = active_osd;
-      if (verbose) {
-        std::cout << "\n==== Processing events for OSD." << current_osd
-                  << " ====" << std::endl;
-      }
     }
     
-    if (verbose) {
-      std::cout << "  [Event " << (events_executed + 1) << "] "
-                << event_type_name(event.type);
-      if (event.from_osd >= 0 && event.to_osd >= 0) {
-        std::cout << " (OSD." << event.from_osd << " -> OSD." << event.to_osd << ")";
-      } else if (event.to_osd >= 0) {
-        std::cout << " (to OSD." << event.to_osd << ")";
-      } else if (event.from_osd >= 0) {
-        std::cout << " (from OSD." << event.from_osd << ")";
-      }
-      std::cout << " Executing..." << std::endl;
-    }
+    current_executing_osd = active_osd;
     
     // Execute the event
     event.callback();
     events_executed++;
     events_by_type[event.type]++;
+    current_executing_osd = -1;
     
     return true;
   }
   
   int run_many(int count) {
-    if (verbose) {
-      std::cout << "\n=== Running " << count << " events ===" << std::endl;
-    }
-    
     int executed = 0;
     for (int i = 0; i < count && run_one(); i++) {
       executed++;
     }
-    
-    if (verbose) {
-      std::cout << "=== Executed " << executed << " events, "
-                << events.size() << " remaining ===" << std::endl;
-    }
-    
     return executed;
   }
 
@@ -253,14 +253,6 @@ public:
    * Returns -1 if max_events was reached before the queue emptied.
    */
   void run_until_idle(int max_events = 10000) {
-    if (verbose) {
-      std::cout << "\n=== Running until idle";
-      if (max_events > 0) {
-        std::cout << " (max " << max_events << " events)";
-      }
-      std::cout << " ===" << std::endl;
-    }
-
     do {
       ceph_assert(--max_events);
       while (has_events()) {
@@ -274,10 +266,6 @@ public:
     suspended_events.clear();
   }
   
-  void set_verbose(bool v) {
-    verbose = v;
-  }
-  
   // OSD management methods
   /**
    * Suspend events FROM an OSD - events originating from this OSD will be queued
@@ -285,9 +273,6 @@ public:
    */
   void suspend_from_osd(int osd) {
     suspended_from_osds.insert(osd);
-    if (verbose) {
-      std::cout << "*** Events FROM OSD." << osd << " marked as SUSPENDED ***" << std::endl;
-    }
   }
   
   /**
@@ -300,21 +285,11 @@ public:
     // Move all suspended events for this OSD back to the main queue
     auto it = suspended_events.find(osd);
     if (it != suspended_events.end()) {
-      if (verbose) {
-        std::cout << "*** Events FROM OSD." << osd << " marked as UNSUSPENDED - restoring "
-                  << it->second.size() << " suspended events ***" << std::endl;
-      }
-      
       // Append suspended events to the main queue
       for (auto& event : it->second) {
         events.push_back(std::move(event));
       }
-      
       suspended_events.erase(it);
-    } else {
-      if (verbose) {
-        std::cout << "*** Events FROM OSD." << osd << " marked as UNSUSPENDED ***" << std::endl;
-      }
     }
   }
   
@@ -324,9 +299,6 @@ public:
    */
   void suspend_to_osd(int osd) {
     suspended_to_osds.insert(osd);
-    if (verbose) {
-      std::cout << "*** Events TO OSD." << osd << " marked as SUSPENDED ***" << std::endl;
-    }
   }
   
   /**
@@ -339,21 +311,11 @@ public:
     // Move all suspended events for this OSD back to the main queue
     auto it = suspended_events.find(osd);
     if (it != suspended_events.end()) {
-      if (verbose) {
-        std::cout << "*** Events TO OSD." << osd << " marked as UNSUSPENDED - restoring "
-                  << it->second.size() << " suspended events ***" << std::endl;
-      }
-      
       // Append suspended events to the main queue
       for (auto& event : it->second) {
         events.push_back(std::move(event));
       }
-      
       suspended_events.erase(it);
-    } else {
-      if (verbose) {
-        std::cout << "*** Events TO OSD." << osd << " marked as UNSUSPENDED ***" << std::endl;
-      }
     }
   }
   
@@ -363,10 +325,6 @@ public:
    */
   void suspend_from_to_osd(int from_osd, int to_osd) {
     suspended_from_to_osds.insert({from_osd, to_osd});
-    if (verbose) {
-      std::cout << "*** Events FROM OSD." << from_osd << " TO OSD." << to_osd
-                << " marked as SUSPENDED ***" << std::endl;
-    }
   }
   
   /**
@@ -379,23 +337,11 @@ public:
     // Move all suspended events for this OSD pair back to the main queue
     auto it = suspended_events.find(to_osd);
     if (it != suspended_events.end()) {
-      if (verbose) {
-        std::cout << "*** Events FROM OSD." << from_osd << " TO OSD." << to_osd
-                  << " marked as UNSUSPENDED - restoring "
-                  << it->second.size() << " suspended events ***" << std::endl;
-      }
-      
       // Append suspended events to the main queue
       for (auto& event : it->second) {
         events.push_back(std::move(event));
       }
-      
       suspended_events.erase(it);
-    } else {
-      if (verbose) {
-        std::cout << "*** Events FROM OSD." << from_osd << " TO OSD." << to_osd
-                  << " marked as UNSUSPENDED ***" << std::endl;
-      }
     }
   }
   
@@ -437,3 +383,7 @@ public:
   }
 };
 
+// Define the static variable
+// Initialized to -1 (no OSD currently executing)
+inline int EventLoop::current_executing_osd = -1;
+
diff --git a/src/test/osd/PGBackendTestFixture.h b/src/test/osd/PGBackendTestFixture.h
index 0269f9c3c26..0e728f3f38c 100644
--- a/src/test/osd/PGBackendTestFixture.h
+++ b/src/test/osd/PGBackendTestFixture.h
@@ -109,16 +109,7 @@ protected:
   // The epoch comes from osdmap, this tracks the second version number
   uint64_t next_version = 1;
   
-  class TestDpp : public NoDoutPrefix {
-  public:
-    TestDpp(CephContext *cct) : NoDoutPrefix(cct, ceph_subsys_osd) {}
-    
-    std::ostream& gen_prefix(std::ostream& out) const override {
-      out << "PGBackendTest: ";
-      return out;
-    }
-  };
-  std::unique_ptr<TestDpp> dpp;
+  std::unique_ptr<NoDoutPrefix> dpp;
 
 public:
   explicit PGBackendTestFixture(PoolType type = EC) : pool_type(type)
@@ -142,6 +133,7 @@ public:
   }
   
   void SetUp() override {
+    ceph::logging::Log::set_prefix_hook(&EventLoop::get_log_prefix);
     int r = ::mkdir(data_dir.c_str(), 0777);
     if (r < 0) {
       r = -errno;
@@ -158,8 +150,14 @@ public:
     g_conf().set_safe_to_start_threads();
     
     CephContext *cct = g_ceph_context;
-    dpp = std::make_unique<TestDpp>(cct);
-    event_loop = std::make_unique<EventLoop>(false);
+    
+    // Make dout statements flush immediately - we don't care about performance in tests
+    if (cct->_log) {
+      cct->_log->set_max_new(1);
+    }
+    
+    dpp = std::make_unique<NoDoutPrefix>(cct, ceph_subsys_osd);
+    event_loop = std::make_unique<EventLoop>(dpp.get());
     
     if (pool_type == EC) {
       setup_ec_pool();
@@ -208,6 +206,7 @@ public:
     }
 
     cleanup_data_dir();
+    ceph::logging::Log::set_prefix_hook(nullptr);
   }
   
 private:

From ca0bddb89123733284c6a9cd6a1c1e26f4ec1757 Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Mon, 8 Jun 2026 15:02:27 +0000
Subject: [PATCH 113/596] crimson/os/seastore: track onode lookup latency in
 do_transaction

we might be able to reduce onode lookup stage by storing the prev
lookup already made when getting the obc.

according to to the stats I've colleceted onode lookup takes 40%
of total build time (which is ~20% of total txn time)

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/seastore/seastore.cc | 7 +++++++
 src/crimson/os/seastore/seastore.h  | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index 3d88bb1c405..6c77820ba43 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -229,6 +229,7 @@ void SeaStore::Shard::register_metrics(store_index_t store_index)
     {txn_stage_t::COLLOCK_WAIT,          sm::label_instance("stage", "collock_wait")},
     {txn_stage_t::THROTTLER_WAIT,        sm::label_instance("stage", "throttler_wait")},
     {txn_stage_t::BUILD,                 sm::label_instance("stage", "build")},
+    {txn_stage_t::BUILD_GET_ONODE,       sm::label_instance("stage", "build_get_onode")},
     {txn_stage_t::SUBMIT_TOTAL,          sm::label_instance("stage", "submit_total")},
     {txn_stage_t::SUBMIT_RESERVE,        sm::label_instance("stage", "submit_reserve")},
     {txn_stage_t::SUBMIT_OOL_WRITE,      sm::label_instance("stage", "submit_ool_write")},
@@ -1780,6 +1781,7 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
   add_stage_latency_sample(txn_stage_t::COLLOCK_WAIT, collock_wait);
   add_stage_latency_sample(txn_stage_t::THROTTLER_WAIT, throttler_wait);
   add_stage_latency_sample(txn_stage_t::BUILD, ctx.build_time);
+  add_stage_latency_sample(txn_stage_t::BUILD_GET_ONODE, ctx.get_onode_time);
   add_stage_latency_sample(txn_stage_t::SUBMIT_TOTAL, ctx.submit_time);
   {
     auto& pd = ctx.transaction->get_phase_durations();
@@ -1893,6 +1895,7 @@ SeaStore::Shard::_do_transaction_step(
   }
   if (!onodes[op->oid]) {
     const ghobject_t& oid = i.get_oid(op->oid);
+    auto t0 = std::chrono::steady_clock::now();
     if (!create) {
       DEBUGT("op {}, get oid={} ...",
              *ctx.transaction, (uint32_t)op->op, oid);
@@ -1902,6 +1905,10 @@ SeaStore::Shard::_do_transaction_step(
              *ctx.transaction, (uint32_t)op->op, oid);
       fut = onode_manager->get_or_create_onode(*ctx.transaction, oid);
     }
+    fut = std::move(fut).si_then([&ctx, t0](auto onode) {
+      ctx.get_onode_time += std::chrono::steady_clock::now() - t0;
+      return onode_iertr::make_ready_future<OnodeRef>(std::move(onode));
+    });
   }
   return fut.si_then([&, op, this, FNAME](auto get_onode)
                       -> OnodeManager::get_or_create_onode_iertr::future<> {
diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index 0cb63205052..56277b405dd 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -51,6 +51,7 @@ enum class txn_stage_t : uint8_t {
     COLLOCK_WAIT = 0,  // waiting on the collection ordering_lock
     THROTTLER_WAIT,    // waiting for a throttler slot
     BUILD,             // building the transaction (_do_transaction_step loop)
+    BUILD_GET_ONODE,   // onode_manager get/get_or_create calls within BUILD
     SUBMIT_TOTAL,      // the whole submit_transaction (pipeline + journal write)
     // Sub-phases of submit_transaction:
     SUBMIT_RESERVE,        // enter(reserve_projected_usage) + epm reserve_projected_usage
@@ -268,6 +269,7 @@ public:
       std::chrono::steady_clock::time_point begin_timestamp = std::chrono::steady_clock::now();
 
       std::chrono::steady_clock::duration build_time{0};
+      std::chrono::steady_clock::duration get_onode_time{0};
       std::chrono::steady_clock::duration submit_time{0};
 
       void reset_preserve_handle(TransactionManager &tm) {

From 4d0e27808f1b5d2531015deb8f7b6087e2f0d345 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Mon, 8 Jun 2026 14:10:47 -0400
Subject: [PATCH 114/596] .github/workflows/releng-audit: catch override
 removal error

This can happen if an action is retried or the label was removed through
other means (manually).

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 .github/workflows/releng-audit.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/releng-audit.yaml b/.github/workflows/releng-audit.yaml
index 4a4ab014986..e9cf629d4bc 100644
--- a/.github/workflows/releng-audit.yaml
+++ b/.github/workflows/releng-audit.yaml
@@ -212,7 +212,11 @@ jobs:
 
                   if (!isAuthorized) {
                     core.info(`[Router] User @${actor} NOT authorized. Removing override label.`);
-                    await github.rest.issues.removeLabel({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, name: labelName });
+                    try {
+                      await github.rest.issues.removeLabel({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, name: labelName });
+                    } catch (e) {
+                      core.info(`[Router] Label removal skipped or already deleted: ${e.message}`);
+                    }
                     core.setFailed(`User @${actor} is not authorized to override audits.`);
                   } else {
                     core.info(`[Router] User @${actor} is authorized. Stripping fail/pass labels to visually unblock PR.`);

From 830f0e562851a36abc2b450fcf0dd3e554abf24f Mon Sep 17 00:00:00 2001
From: "ramin.najarbashi" <ramin.najarbashi@gmail.com>
Date: Mon, 8 Jun 2026 22:47:52 +0330
Subject: [PATCH 115/596] rgw: include str_list.h for ceph::for_each_substr in
 CORS header

get_multi_cors_method_flags() calls ceph::for_each_substr(), but
rgw_cors.h did not include str_list.h. The CORS unit test includes
only this header, so the build failed with an undeclared identifier.
Qualify the call and add the missing include.

Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>
---
 src/rgw/rgw_cors.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_cors.h b/src/rgw/rgw_cors.h
index c500fab29cb..9b4fd0ee7ec 100644
--- a/src/rgw/rgw_cors.h
+++ b/src/rgw/rgw_cors.h
@@ -18,6 +18,7 @@
 #include <map>
 #include <string>
 #include <include/types.h>
+#include "include/str_list.h"
 
 #define RGW_CORS_GET    0x1
 #define RGW_CORS_PUT    0x2
@@ -169,7 +170,7 @@ static inline uint8_t get_multi_cors_method_flags(const char *req_meth) {
     else if (method == "HEAD") flags |= RGW_CORS_HEAD;
     else if (method == "COPY") flags |= RGW_CORS_COPY;
   };
-  for_each_substr(allowed_methods, ";,= \t", apply_flag);
+  ceph::for_each_substr(allowed_methods, ";,= \t", apply_flag);
 
   return flags;
 }

From c1478653794cd45af4589fa2813a82494df280a3 Mon Sep 17 00:00:00 2001
From: "ramin.najarbashi" <ramin.najarbashi@gmail.com>
Date: Mon, 8 Jun 2026 23:43:23 +0330
Subject: [PATCH 116/596] test/rgw: init CephContext in unittest_rgw_cors

unittest_rgw_cors used GMock::Main without global_init, so dout() in
RGWCORSRule::matches() dereferenced a null g_ceph_context and segfaulted
on the first test. Link unit-main like unittest_rgw_compression.

Assisted-by: Cursor:composer-2.5-fast
Signed-off-by: ramin.najarbashi <ramin.najarbashi@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/test/rgw/CMakeLists.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/test/rgw/CMakeLists.txt b/src/test/rgw/CMakeLists.txt
index a61f23bd46a..7b7133f722e 100644
--- a/src/test/rgw/CMakeLists.txt
+++ b/src/test/rgw/CMakeLists.txt
@@ -103,7 +103,9 @@ add_ceph_unittest(unittest_rgw_bencode)
 target_link_libraries(unittest_rgw_bencode ${rgw_libs})
 
 # unittest_rgw_cors
-add_executable(unittest_rgw_cors test_rgw_cors.cc)
+add_executable(unittest_rgw_cors
+  test_rgw_cors.cc
+  $<TARGET_OBJECTS:unit-main>)
 add_ceph_unittest(unittest_rgw_cors)
 target_link_libraries(unittest_rgw_cors ${rgw_libs})
 

From d6f1bcc89018e02e08290fda58cfa0792bd0a76a Mon Sep 17 00:00:00 2001
From: Brad Hubbard <bhubbard@redhat.com>
Date: Fri, 29 May 2026 13:59:41 +1000
Subject: [PATCH 117/596] common: Log when we leak and disallow inlining

eaa2013 added a generic suppression that exposed the fact that the newer
compiler was inlining CephContext::do_command(). In order to avoid such
scenario in the future, and to keeo the behaviour constant between
daemons we'll disallow inlining.

Fixes: https://tracker.ceph.com/issues/76473

Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
---
 src/common/ceph_context.cc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/common/ceph_context.cc b/src/common/ceph_context.cc
index afd22f86543..6c329c82457 100644
--- a/src/common/ceph_context.cc
+++ b/src/common/ceph_context.cc
@@ -499,7 +499,7 @@ bool CephContext::check_experimental_feature_enabled(const std::string& feat,
   return enabled;
 }
 
-int CephContext::do_command(std::string_view command, const cmdmap_t& cmdmap,
+[[gnu::noinline]] int CephContext::do_command(std::string_view command, const cmdmap_t& cmdmap,
 			    Formatter *f,
 			    std::ostream& ss,
 			    bufferlist *out)
@@ -514,7 +514,8 @@ int CephContext::do_command(std::string_view command, const cmdmap_t& cmdmap,
 
 #pragma GCC push_options
 #pragma GCC optimize ("O0")
-static void leak_some_memory() {
+static void leak_some_memory(CephContext* cc) {
+  lgeneric_derr(cc) << "Leaking some memory" << dendl;
   volatile char *foo = new char[1234];
   (void)foo;
 }
@@ -538,7 +539,7 @@ int CephContext::_do_command(
     }
   }
   if (command == "leak_some_memory") {
-    leak_some_memory();
+    leak_some_memory(this);
   }
   else if (command == "perfcounters_dump" || command == "1" ||
       command == "perf dump") {

From 32dbed0be14ec2ff0e90bafea17d3ccb7e39e19c Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Wed, 1 Apr 2026 15:40:16 +0530
Subject: [PATCH 118/596] mgr/cephadm: set default prometheus template in
 config-key store unless overridden by the user

Fixes: https://tracker.ceph.com/issues/75826

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 src/pybind/mgr/cephadm/services/monitoring.py | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/pybind/mgr/cephadm/services/monitoring.py b/src/pybind/mgr/cephadm/services/monitoring.py
index 86f0aa0a8e8..0f0a85f9528 100644
--- a/src/pybind/mgr/cephadm/services/monitoring.py
+++ b/src/pybind/mgr/cephadm/services/monitoring.py
@@ -627,6 +627,28 @@ class PrometheusService(CephadmService):
         files = {
             'prometheus.yml': self.mgr.template.render('services/prometheus/prometheus.yml.j2', context)
         }
+
+        # check if the prometheus.yml already exists in the config-key store,
+        # if not we need to set the initial config-key with the default template content.
+        # If it already exists, we need not override user config changes.
+        r, outs, err = self.mgr.mon_command({
+            'prefix': 'config-key get',
+            'key': 'mgr/cephadm/services/prometheus/prometheus.yml'
+        })
+        if r == -errno.ENOENT:
+            loader = self.mgr.template.engine.env.loader
+            assert loader is not None
+
+            raw_template, _, _ = loader.get_source(
+                self.mgr.template.engine.env,
+                'services/prometheus/prometheus.yml.j2'
+            )
+            self.mgr.check_mon_command({
+                'prefix': 'config-key set',
+                'key': 'mgr/cephadm/services/prometheus/prometheus.yml',
+                'val': raw_template
+            })
+
         r: Dict[str, Any] = {
             'files': files,
             'retention_time': retention_time,

From a1906f997a210f6110d8e0652979006ad88e3d73 Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Tue, 21 Apr 2026 13:40:54 +0530
Subject: [PATCH 119/596] mgr/cephadm: add unit tests

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 .../cephadm/tests/services/test_monitoring.py | 64 +++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/src/pybind/mgr/cephadm/tests/services/test_monitoring.py b/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
index 57a9d8a3da1..494075da155 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
@@ -1867,3 +1867,67 @@ spec:
                         error_ok=True,
                         use_current_daemon_image=False,
                     )
+
+    @patch("cephadm.services.monitoring.PrometheusService.get_dependencies", lambda *a, **k: [])
+    def test_prometheus_config_sets_default_when_missing(self, cephadm_module):
+
+        svc = PrometheusService(cephadm_module)
+
+        daemon_spec = Mock()
+        daemon_spec.daemon_type = 'prometheus'
+        daemon_spec.service_name = 'prometheus'
+        daemon_spec.host = 'test'
+
+        cephadm_module.mon_command = Mock(return_value=(-2, '', ''))
+        cephadm_module.check_mon_command = Mock()
+
+        loader = Mock()
+        loader.get_source.return_value = ("raw_template_content", None, None)
+        cephadm_module.template.engine.env.loader = loader
+
+        cephadm_module.template.render = Mock(return_value="rendered_config")
+
+        cephadm_module._get_security_config = Mock(return_value=(False, False, False))
+        cephadm_module._get_alertmanager_credentials = Mock(return_value=(None, None))
+        cephadm_module._get_mgr_ips = Mock(return_value=['127.0.0.1'])
+
+        cephadm_module.spec_store = {
+            'prometheus': Mock()
+        }
+        cephadm_module.spec_store['prometheus'].spec = PrometheusSpec('prometheus')
+
+        svc.generate_config(daemon_spec)
+
+        cephadm_module.check_mon_command.assert_called_once_with({
+            'prefix': 'config-key set',
+            'key': 'mgr/cephadm/services/prometheus/prometheus.yml',
+            'val': "raw_template_content"
+        })
+
+    @patch("cephadm.services.monitoring.PrometheusService.get_dependencies", lambda *a, **k: [])
+    def test_prometheus_config_does_not_override_existing(self, cephadm_module):
+
+        svc = PrometheusService(cephadm_module)
+
+        daemon_spec = Mock()
+        daemon_spec.daemon_type = 'prometheus'
+        daemon_spec.service_name = 'prometheus'
+        daemon_spec.host = 'test'
+
+        cephadm_module.mon_command = Mock(return_value=(0, 'existing', ''))
+        cephadm_module.check_mon_command = Mock()
+
+        cephadm_module.template.render = Mock(return_value="rendered_config")
+
+        cephadm_module._get_security_config = Mock(return_value=(False, False, False))
+        cephadm_module._get_alertmanager_credentials = Mock(return_value=(None, None))
+        cephadm_module._get_mgr_ips = Mock(return_value=['127.0.0.1'])
+
+        cephadm_module.spec_store = {
+            'prometheus': Mock()
+        }
+        cephadm_module.spec_store['prometheus'].spec = PrometheusSpec('prometheus')
+
+        svc.generate_config(daemon_spec)
+
+        cephadm_module.check_mon_command.assert_not_called()

From 840ee2cfadae5c6c0f042336c1343b3876c54739 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 8 Jun 2026 16:24:40 +0800
Subject: [PATCH 120/596] crimson/osd: coroutinize OSD::start()

OSD::start() is a long, deeply nested .then() continuation chain. let's
rewrite it as a coroutine to make it readable. the chain was already
sequential and the one concurrent step keeps its when_all_succeed(), so
the rewrite preserves both ordering and concurrency.

start() runs once at boot, off the i/o path, so the small overhead of
co_await over a hand-rolled continuation chain is a fine price for the
readability.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc | 268 ++++++++++++++++++++---------------------
 src/crimson/osd/osd.h  |   4 +
 2 files changed, 132 insertions(+), 140 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 0f94d16bdfc..1404a85bfc7 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -461,6 +461,27 @@ namespace {
   }
 }
 
+seastar::future<> OSD::report_osd_stats()
+{
+  LOG_PREFIX(OSD::report_osd_stats);
+  co_await shard_services.invoke_on_all(
+    [this](auto &local_service) {
+      auto stats = local_service.report_stats();
+      shard_stats[seastar::this_shard_id()] = stats;
+    });
+  std::ostringstream oss;
+  double agg_ru = 0;
+  int cnt = 0;
+  for (const auto &stats : shard_stats) {
+    agg_ru += stats.reactor_utilization;
+    ++cnt;
+    oss << int(stats.reactor_utilization);
+    oss << ",";
+  }
+  INFO("reactor_utilizations: {}({})",
+       int(agg_ru/cnt), oss.str());
+}
+
 seastar::future<> OSD::start()
 {
   LOG_PREFIX(OSD::start);
@@ -473,175 +494,142 @@ seastar::future<> OSD::start()
   startup_time = ceph::mono_clock::now();
   ceph_assert(seastar::this_shard_id() == PRIMARY_CORE);
   DEBUG("starting store");
-  return store.start().then([this] (auto store_shard_nums) {
-    return pg_to_shard_mappings.start(0, seastar::smp::count, store_shard_nums
-    ).then([this] {
-      return osd_singleton_state.start_single(
+  uint32_t store_shards_num = co_await store.start();
+  co_await pg_to_shard_mappings.start(0, seastar::smp::count, store_shards_num);
+  co_await osd_singleton_state.start_single(
         whoami, std::ref(*cluster_msgr), std::ref(*public_msgr),
         std::ref(*monc), std::ref(*mgrc));
-    }).then([this] {
-      return osd_states.start();
-    }).then([this, store_shard_nums] {
-      ceph::mono_time startup_time = ceph::mono_clock::now();
-      return shard_services.start(
+  co_await osd_states.start();
+  ceph::mono_time startup_time = ceph::mono_clock::now();
+  co_await shard_services.start(
         std::ref(osd_singleton_state),
         std::ref(pg_to_shard_mappings),
-        store_shard_nums,
+        store_shards_num,
         whoami,
         startup_time,
         osd_singleton_state.local().perf,
         osd_singleton_state.local().recoverystate_perf,
         std::ref(store),
         std::ref(osd_states));
-    });
-  }).then([this, FNAME] {
-    heartbeat.reset(new Heartbeat{
-	whoami, get_shard_services(),
-	*monc, *hb_front_msgr, *hb_back_msgr});
-    DEBUG("mounting store");
-    return store.mount().handle_error(
+  heartbeat = std::make_unique<Heartbeat>(
+    whoami, get_shard_services(),
+    *monc, *hb_front_msgr, *hb_back_msgr);
+  DEBUG("mounting store");
+  co_await store.mount().handle_error(
       crimson::stateful_ec::assert_failure(fmt::format(
         "{} error mounting object store in {}",
         FNAME, local_conf().get_val<std::string>("osd_data")).c_str())
     );
-  }).then([this, FNAME] {
-    auto stats_seconds = local_conf().get_val<int64_t>("crimson_osd_stat_interval");
-    if (stats_seconds > 0) {
-      shard_stats.resize(seastar::smp::count);
-      stats_timer.set_callback([this, FNAME] {
-        gate.dispatch_in_background("stats_osd", *this, [this, FNAME] {
-          return shard_services.invoke_on_all(
-            [this](auto &local_service) {
-            auto stats = local_service.report_stats();
-            shard_stats[seastar::this_shard_id()] = stats;
-          }).then([this, FNAME] {
-            std::ostringstream oss;
-            double agg_ru = 0;
-            int cnt = 0;
-            for (const auto &stats : shard_stats) {
-              agg_ru += stats.reactor_utilization;
-              ++cnt;
-              oss << int(stats.reactor_utilization);
-              oss << ",";
-            }
-            INFO("reactor_utilizations: {}({})",
-                 int(agg_ru/cnt), oss.str());
-          });
-        });
-        gate.dispatch_in_background("stats_store", *this, [this] {
-          return store.report_stats();
-        });
+  auto stats_seconds = local_conf().get_val<int64_t>("crimson_osd_stat_interval");
+  if (stats_seconds > 0) {
+    shard_stats.resize(seastar::smp::count);
+    stats_timer.set_callback([this] {
+      gate.dispatch_in_background("stats_osd", *this, [this] {
+        return report_osd_stats();
       });
-      stats_timer.arm_periodic(std::chrono::seconds(stats_seconds));
-    }
+      gate.dispatch_in_background("stats_store", *this, [this] {
+        return store.report_stats();
+      });
+    });
+    stats_timer.arm_periodic(std::chrono::seconds(stats_seconds));
+  }
 
-    DEBUG("open metadata collection");
-    return open_meta_coll();
-  }).then([this, FNAME] {
-    DEBUG("loading superblock"); 
-    return pg_shard_manager.get_meta_coll().load_superblock(
+  DEBUG("open metadata collection");
+  co_await open_meta_coll();
+
+  DEBUG("loading superblock");
+  superblock = co_await pg_shard_manager.get_meta_coll().load_superblock(
     ).handle_error(
       crimson::ct_error::assert_all("open_meta_coll error")
     );
-  }).then([this](OSDSuperblock&& sb) {
-    superblock = std::move(sb);
-    if (!superblock.cluster_osdmap_trim_lower_bound) {
-      superblock.cluster_osdmap_trim_lower_bound = superblock.get_oldest_map();
-    }
-    return pg_shard_manager.set_superblock(superblock);
-  }).then([this] {
-    return pg_shard_manager.get_local_map(superblock.current_epoch);
-  }).then([this](OSDMapService::local_cached_map_t&& map) {
-    osdmap = make_local_shared_foreign(OSDMapService::local_cached_map_t(map));
-    return pg_shard_manager.update_map(std::move(map));
-  }).then([this] {
-    return shard_services.invoke_on_all([this](auto &local_service) {
-      local_service.local_state.osdmap_gate.got_map(osdmap->get_epoch());
-    });
-  }).then([this, FNAME] {
-    bind_epoch = osdmap->get_epoch();
-    DEBUG("loading PGs");
-    return pg_shard_manager.load_pgs(store);
-  }).then([this, FNAME] {
-    uint64_t osd_required =
-      CEPH_FEATURE_UID |
-      CEPH_FEATURE_PGID64 |
-      CEPH_FEATURE_OSDENC;
-    using crimson::net::SocketPolicy;
+  if (!superblock.cluster_osdmap_trim_lower_bound) {
+    superblock.cluster_osdmap_trim_lower_bound = superblock.get_oldest_map();
+  }
+  co_await pg_shard_manager.set_superblock(superblock);
+  auto local_map = co_await pg_shard_manager.get_local_map(superblock.current_epoch);
+  osdmap = make_local_shared_foreign(OSDMapService::local_cached_map_t(local_map));
+  co_await pg_shard_manager.update_map(std::move(local_map));
+  co_await shard_services.invoke_on_all([this](auto &local_service) {
+    local_service.local_state.osdmap_gate.got_map(osdmap->get_epoch());
+  });
 
-    public_msgr->set_default_policy(SocketPolicy::stateless_server(0));
-    public_msgr->set_policy(entity_name_t::TYPE_MON,
-                            SocketPolicy::lossy_client(osd_required));
-    public_msgr->set_policy(entity_name_t::TYPE_MGR,
-                            SocketPolicy::lossy_client(osd_required));
-    public_msgr->set_policy(entity_name_t::TYPE_OSD,
-                            SocketPolicy::stateless_server(0));
+  bind_epoch = osdmap->get_epoch();
+  DEBUG("loading PGs");
+  co_await pg_shard_manager.load_pgs(store);
 
-    cluster_msgr->set_default_policy(SocketPolicy::stateless_server(0));
-    cluster_msgr->set_policy(entity_name_t::TYPE_MON,
-                             SocketPolicy::lossy_client(0));
-    cluster_msgr->set_policy(entity_name_t::TYPE_OSD,
-                             SocketPolicy::lossless_peer(osd_required));
-    cluster_msgr->set_policy(entity_name_t::TYPE_CLIENT,
-                             SocketPolicy::stateless_server(0));
+  uint64_t osd_required =
+    CEPH_FEATURE_UID |
+    CEPH_FEATURE_PGID64 |
+    CEPH_FEATURE_OSDENC;
+  using crimson::net::SocketPolicy;
 
-    crimson::net::dispatchers_t dispatchers{this, monc.get(), mgrc.get()};
-    return seastar::when_all_succeed(
-      cluster_msgr->bind(pick_addresses(CEPH_PICK_ADDRESS_CLUSTER))
-        .safe_then([this, dispatchers]() mutable {
-	  return cluster_msgr->start(dispatchers);
-        }, crimson::net::Messenger::bind_ertr::assert_all_func(
-            [FNAME] (const std::error_code& e) {
-          ERROR("cluster messenger bind(): {}", e);
-        })),
-      public_msgr->bind(pick_addresses(CEPH_PICK_ADDRESS_PUBLIC))
-        .safe_then([this, dispatchers]() mutable {
-	  return public_msgr->start(dispatchers);
-        }, crimson::net::Messenger::bind_ertr::assert_all_func(
-            [FNAME] (const std::error_code& e) {
-          ERROR("public messenger bind(): {}", e);
-        })));
-  }).then_unpack([this, FNAME] {
+  public_msgr->set_default_policy(SocketPolicy::stateless_server(0));
+  public_msgr->set_policy(entity_name_t::TYPE_MON,
+                          SocketPolicy::lossy_client(osd_required));
+  public_msgr->set_policy(entity_name_t::TYPE_MGR,
+                          SocketPolicy::lossy_client(osd_required));
+  public_msgr->set_policy(entity_name_t::TYPE_OSD,
+                          SocketPolicy::stateless_server(0));
+
+  cluster_msgr->set_default_policy(SocketPolicy::stateless_server(0));
+  cluster_msgr->set_policy(entity_name_t::TYPE_MON,
+                           SocketPolicy::lossy_client(0));
+  cluster_msgr->set_policy(entity_name_t::TYPE_OSD,
+                           SocketPolicy::lossless_peer(osd_required));
+  cluster_msgr->set_policy(entity_name_t::TYPE_CLIENT,
+                           SocketPolicy::stateless_server(0));
+
+  crimson::net::dispatchers_t dispatchers{this, monc.get(), mgrc.get()};
+  co_await seastar::when_all_succeed(
+    cluster_msgr->bind(pick_addresses(CEPH_PICK_ADDRESS_CLUSTER))
+    .safe_then([this, dispatchers]() mutable {
+      return cluster_msgr->start(dispatchers);
+    }, crimson::net::Messenger::bind_ertr::assert_all_func(
+      [FNAME] (const std::error_code& e) {
+        ERROR("cluster messenger bind(): {}", e);
+      })),
+    public_msgr->bind(pick_addresses(CEPH_PICK_ADDRESS_PUBLIC))
+    .safe_then([this, dispatchers]() mutable {
+      return public_msgr->start(dispatchers);
+    }, crimson::net::Messenger::bind_ertr::assert_all_func(
+      [FNAME] (const std::error_code& e) {
+        ERROR("public messenger bind(): {}", e);
+      }))
+  ).then_unpack([this, FNAME] {
     DEBUG("starting mon and mgr clients");
     return seastar::when_all_succeed(monc->start(),
                                      mgrc->start());
   }).then_unpack([this, FNAME] {    
     DEBUG("adding to crush");
     return _add_me_to_crush();
-  }).then([this] {
-    return _add_device_class();
-   }).then([this] {
-    if (is_rotational.has_value()) {
-      return shard_services.invoke_on_all([this](auto &local_service) {
-        local_service.local_state.initialize_scheduler(local_service.get_cct(), *is_rotational);
-      });
-    } else {
-      throw std::runtime_error("No device class is set");
-    }
-   }).then([this] {
-    monc->sub_want("osd_pg_creates", last_pg_create_epoch, 0);
-    monc->sub_want("mgrmap", 0, 0);
-    monc->sub_want("osdmap", 0, 0);
-    return monc->renew_subs();
-  }).then([FNAME, this] {
-    if (auto [addrs, changed] =
-        replace_unknown_addrs(cluster_msgr->get_myaddrs(),
-                              public_msgr->get_myaddrs()); changed) {
-      DEBUG("replacing unkwnown addrs of cluster messenger");
-      cluster_msgr->set_myaddrs(addrs);
-    }
-    return heartbeat->start(pick_addresses(CEPH_PICK_ADDRESS_PUBLIC),
-                            pick_addresses(CEPH_PICK_ADDRESS_CLUSTER));
-  }).then([this] {
-    // create the admin-socket server, and the objects that register
-    // to handle incoming commands
-    return start_asok_admin();
-  }).then([this] {
-    return log_client.set_fsid(monc->get_fsid());
-  }).then([this, FNAME] {
-    DEBUG("starting boot");
-    return start_boot();
   });
+  co_await _add_device_class();
+  if (is_rotational.has_value()) {
+    co_await shard_services.invoke_on_all([this](auto &local_service) {
+      local_service.local_state.initialize_scheduler(local_service.get_cct(), *is_rotational);
+    });
+  } else {
+    throw std::runtime_error("No device class is set");
+  }
+  monc->sub_want("osd_pg_creates", last_pg_create_epoch, 0);
+  monc->sub_want("mgrmap", 0, 0);
+  monc->sub_want("osdmap", 0, 0);
+  co_await monc->renew_subs();
+
+  if (auto [addrs, changed] =
+      replace_unknown_addrs(cluster_msgr->get_myaddrs(),
+                            public_msgr->get_myaddrs()); changed) {
+    DEBUG("replacing unkwnown addrs of cluster messenger");
+    cluster_msgr->set_myaddrs(addrs);
+  }
+  co_await heartbeat->start(pick_addresses(CEPH_PICK_ADDRESS_PUBLIC),
+                            pick_addresses(CEPH_PICK_ADDRESS_CLUSTER));
+  // create the admin-socket server, and the objects that register
+  // to handle incoming commands
+  co_await start_asok_admin();
+  co_await log_client.set_fsid(monc->get_fsid());
+  DEBUG("starting boot");
+  co_await start_boot();
 }
 
 seastar::future<> OSD::start_boot()
diff --git a/src/crimson/osd/osd.h b/src/crimson/osd/osd.h
index 703ccd3ae5e..01b31295bcc 100644
--- a/src/crimson/osd/osd.h
+++ b/src/crimson/osd/osd.h
@@ -134,6 +134,10 @@ class OSD final : public crimson::net::Dispatcher,
 
   seastar::timer<seastar::lowres_clock> stats_timer;
   std::vector<ShardServices::shard_stats_t> shard_stats;
+  // collect per-shard stats and log reactor utilization; a member coroutine
+  // so its captures (this) live in the frame, since it runs as a detached
+  // gated task a capturing lambda coroutine would dangle (see report_osd_stats).
+  seastar::future<> report_osd_stats();
 
   std::vector<std::string> get_tracked_keys() const noexcept final;
   void handle_conf_change(const ConfigProxy& conf,

From acbfd2de97254f97bd098e83a94c5819adcc34d1 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 8 Jun 2026 16:54:47 +0800
Subject: [PATCH 121/596] crimson/osd: remove OSD::startup_time

OSD::startup_time was added in 91c0df81, in which was added to provide
a monotomic increasing timestamp representing the startup time. but
later, we decided to keep track of this timestamp in PerShardState.
but we didn't remove OSD::startup_time when adding
PerShardState::get_mnow().

in this change, we remove the unused OSD::startup_time.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc | 2 +-
 src/crimson/osd/osd.h  | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 1404a85bfc7..c7288bef612 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -491,7 +491,7 @@ seastar::future<> OSD::start()
       cpu_cores.empty()) {
     clog->info() << "for optimal performance please set crimson_cpu_set";
   }
-  startup_time = ceph::mono_clock::now();
+
   ceph_assert(seastar::this_shard_id() == PRIMARY_CORE);
   DEBUG("starting store");
   uint32_t store_shards_num = co_await store.start();
diff --git a/src/crimson/osd/osd.h b/src/crimson/osd/osd.h
index 01b31295bcc..ebbaf1f6f0c 100644
--- a/src/crimson/osd/osd.h
+++ b/src/crimson/osd/osd.h
@@ -91,8 +91,6 @@ class OSD final : public crimson::net::Dispatcher,
   //< since when there is no more pending pg creates from mon
   epoch_t last_pg_create_epoch = 0;
 
-  ceph::mono_time startup_time;
-
   seastar::shared_mutex handle_osd_map_lock;
 
   OSDSuperblock superblock;

From 1879f2470b70f58e7d68408671faaea7b950a575 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 8 Jun 2026 17:17:26 +0800
Subject: [PATCH 122/596] crimson/osd: init PerShardState::startup_time
 per-shard

previously, we got the mono_clock::now() in OSD::start() and passed it
to PerShardState. this worked fine. but it was a little bit convoluted
-- we pass the startup_time all the way to PerShardState.

in this change, we just use call mono_clock::now() in the contructor
of PerShardState. simpler this way.

the startup_time has two consumers:

- the PGs hosted by the sharded_service use it as a reference for the
  monotonic timestamp
- Heartbeat::send_heartbeats() uses it as for the mono_ping_stamp.

because, strictly speaking, we cannot gurantee that all PerShardState
sharded services share the identical startup timestamp, as they are
constructed on different shards. but this does not matter, as PGs
always use the hosting shard service for the referencing timestamp,
and OSD always uses the shard service on local shard for sending
heartbeats.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc            | 2 --
 src/crimson/osd/shard_services.cc | 3 +--
 src/crimson/osd/shard_services.h  | 1 -
 3 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index c7288bef612..be62e7eef50 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -500,13 +500,11 @@ seastar::future<> OSD::start()
         whoami, std::ref(*cluster_msgr), std::ref(*public_msgr),
         std::ref(*monc), std::ref(*mgrc));
   co_await osd_states.start();
-  ceph::mono_time startup_time = ceph::mono_clock::now();
   co_await shard_services.start(
         std::ref(osd_singleton_state),
         std::ref(pg_to_shard_mappings),
         store_shards_num,
         whoami,
-        startup_time,
         osd_singleton_state.local().perf,
         osd_singleton_state.local().recoverystate_perf,
         std::ref(store),
diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index 3780cd626c6..c75717a77f6 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -34,7 +34,6 @@ namespace crimson::osd {
 
 PerShardState::PerShardState(
   int whoami,
-  ceph::mono_time startup_time,
   PerfCounters *perf,
   PerfCounters *recoverystate_perf,
   crimson::os::FuturizedStore &store,
@@ -50,7 +49,7 @@ PerShardState::PerShardState(
       // ids generated by different shards are disjoint
       static_cast<ceph_tid_t>(seastar::this_shard_id()) <<
       (std::numeric_limits<ceph_tid_t>::digits - 8)),
-    startup_time(startup_time),
+    startup_time(ceph::mono_clock::now()),
     ec_extent_cache_lru(crimson::common::local_conf().get_val<uint64_t>("ec_extent_cache_size"))
 {}
 
diff --git a/src/crimson/osd/shard_services.h b/src/crimson/osd/shard_services.h
index 19717ee55ef..3f0e28c7942 100644
--- a/src/crimson/osd/shard_services.h
+++ b/src/crimson/osd/shard_services.h
@@ -217,7 +217,6 @@ class PerShardState {
 public:
   PerShardState(
     int whoami,
-    ceph::mono_time startup_time,
     PerfCounters *perf,
     PerfCounters *recoverystate_perf,
     crimson::os::FuturizedStore &store,

From 91878740bbe9939b996df99861bf74ada3382050 Mon Sep 17 00:00:00 2001
From: Kautilya Tripathi <kautilya.tripathi@ibm.com>
Date: Tue, 9 Jun 2026 10:31:12 +0530
Subject: [PATCH 123/596] crimson/cbt: use yaml.safe_load in t2c and add unit
 tests

t2c.py translates teuthology benchmark YAML into CBT configuration for
run-cbt.sh. Switch input parsing from yaml.load() to yaml.safe_load()
so the module works with current PyYAML and avoids unsafe deserialization.

Add test_t2c.py covering get_cbt_tasks(), Translator.translate(), and
main(), and register it with make check via add_ceph_test. Document the
translator in doc/dev/crimson/index.rst and describe the
ceph-perf-pull-requests Jenkins workflow in
doc/dev/continuous-integration.rst.

Signed-off-by: Kautilya Tripathi <kautilya.tripathi@ibm.com>
---
 doc/dev/continuous-integration.rst  |  27 ++++
 doc/dev/crimson/index.rst           |  12 +-
 src/test/crimson/CMakeLists.txt     |   2 +
 src/test/crimson/cbt/CMakeLists.txt |   2 +
 src/test/crimson/cbt/t2c.py         |  20 ++-
 src/test/crimson/cbt/test_t2c.py    | 187 ++++++++++++++++++++++++++++
 6 files changed, 245 insertions(+), 5 deletions(-)
 create mode 100644 src/test/crimson/cbt/CMakeLists.txt
 create mode 100644 src/test/crimson/cbt/test_t2c.py

diff --git a/doc/dev/continuous-integration.rst b/doc/dev/continuous-integration.rst
index 5c2f158236c..091f4f154a4 100644
--- a/doc/dev/continuous-integration.rst
+++ b/doc/dev/continuous-integration.rst
@@ -94,6 +94,33 @@ Shaman
    for its `Web UI`_. But please note, shaman does not build the
    packages, it just offers information on the builds.
 
+ceph-perf-pull-requests
+-----------------------
+
+``ceph-perf-pull-requests`` runs CBT performance regression checks on dedicated
+``performance`` Jenkins agents. The job definition lives in `ceph-build`_ and
+generates two jobs from a single template: ``ceph-perf-classic`` and
+``ceph-perf-crimson``.
+
+A pull request can trigger a run with::
+
+    jenkins test classic perf
+    jenkins test crimson perf
+
+The ``performance`` label is also whitelisted for automatic runs. Each job:
+
+#. checks out ``ceph-main`` (``origin/main``) and the PR merge ref
+#. builds both trees (classic ``vstart-base`` or Crimson ``crimson-osd``)
+#. runs the checked-in ``radosbench_4K_read.yaml`` workload via ``run-cbt.sh``
+#. compares PR results against ``main`` with ``cbt/compare.py``
+#. publishes a GitHub check named ``perf-test-{classic,crimson}``
+
+The benchmark YAML is always taken from ``ceph-main`` so PR and baseline runs use
+the same workload definition. Teuthology-to-CBT translation is handled by
+``src/test/crimson/cbt/t2c.py`` in the Ceph tree (not patched at build time).
+
+.. _ceph-build: https://github.com/ceph/ceph-build
+
 As the following shows, `chacra`_ manages multiple projects whose metadata
 are stored in a database. These metadata are exposed via Shaman as a web
 service. `chacractl`_ is a utility to interact with the `chacra`_ service.
diff --git a/doc/dev/crimson/index.rst b/doc/dev/crimson/index.rst
index fc7ec7fa3ff..1ee5afd6fb9 100644
--- a/doc/dev/crimson/index.rst
+++ b/doc/dev/crimson/index.rst
@@ -253,7 +253,17 @@ In order to use ``fio`` to test ``crimson-store-nbd``, perform the below steps.
 
 CBT
 ---
-We can use `cbt`_ for performance tests::
+We can use `cbt`_ for performance tests. Benchmark workloads are checked in under
+``src/test/crimson/cbt/`` as teuthology-style YAML files. Before ``run-cbt.sh``
+invokes CBT, ``t2c.py`` translates the teuthology ``tasks`` list into a
+CBT-ready configuration: it extracts the ``cbt`` task, fills in cluster paths
+(``ceph.conf``, ``ceph``/``rados`` binaries, PID directory), and writes the
+result to a temporary YAML file consumed by ``cbt.py``.
+
+Unit tests for the translator live in ``src/test/crimson/cbt/test_t2c.py`` and
+are registered with ``make check`` via ``add_ceph_test``.
+
+::
 
   $ git checkout main
   $ make crimson-osd
diff --git a/src/test/crimson/CMakeLists.txt b/src/test/crimson/CMakeLists.txt
index 8a8c82ae5e7..71e0b876f67 100644
--- a/src/test/crimson/CMakeLists.txt
+++ b/src/test/crimson/CMakeLists.txt
@@ -135,3 +135,5 @@ target_link_libraries(
   unittest-crimson-scrub
   crimson-common
   crimson::gtest)
+
+add_subdirectory(cbt)
diff --git a/src/test/crimson/cbt/CMakeLists.txt b/src/test/crimson/cbt/CMakeLists.txt
new file mode 100644
index 00000000000..8a969b684bd
--- /dev/null
+++ b/src/test/crimson/cbt/CMakeLists.txt
@@ -0,0 +1,2 @@
+add_ceph_test(test_t2c.py
+  ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/test_t2c.py)
diff --git a/src/test/crimson/cbt/t2c.py b/src/test/crimson/cbt/t2c.py
index 0d4ee49e5b6..9a13eadd3f2 100755
--- a/src/test/crimson/cbt/t2c.py
+++ b/src/test/crimson/cbt/t2c.py
@@ -1,4 +1,12 @@
 #!/usr/bin/env python3
+"""
+Translate a teuthology-style benchmark YAML into a CBT configuration file.
+
+The YAML files under ``src/test/crimson/cbt/`` describe workloads using
+teuthology's ``tasks`` list. ``run-cbt.sh`` invokes this module to extract the
+``cbt`` task and emit a CBT-ready configuration (cluster layout, benchmark
+definitions, monitoring profiles).
+"""
 
 from __future__ import print_function
 import argparse
@@ -39,12 +47,16 @@ class Translator(object):
             rados_cmd=os.path.join(self.build_dir, 'bin', 'rados'),
             pid_dir=os.path.join(self.build_dir, 'out')
         ))
-        return conf 
+        return conf
 
 def get_cbt_tasks(path):
-    with open(path) as input:
-        teuthology_config = yaml.load(input)
-    for task in teuthology_config['tasks']:
+    with open(path) as yaml_file:
+        teuthology_config = yaml.safe_load(yaml_file) or {}
+    if not isinstance(teuthology_config, dict):
+        teuthology_config = {}
+    for task in teuthology_config.get('tasks', []):
+        if not isinstance(task, dict):
+            continue
         for name, conf in task.items():
             if name == 'cbt':
                 yield conf
diff --git a/src/test/crimson/cbt/test_t2c.py b/src/test/crimson/cbt/test_t2c.py
new file mode 100644
index 00000000000..02c39c1bce1
--- /dev/null
+++ b/src/test/crimson/cbt/test_t2c.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+import tempfile
+import unittest
+import unittest.mock
+
+import yaml
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import t2c  # noqa: E402
+
+
+SAMPLE_TEUTHOLOGY_YAML = """\
+meta:
+- desc: sample radosbench workload
+tasks:
+- install:
+    extra_system_packages:
+      deb:
+      - lvm2
+- cbt:
+    benchmarks:
+      radosbench:
+        read_time: 30
+        read_only: true
+    monitoring_profiles:
+      perf:
+        nodes:
+          - osds
+    cluster:
+      osds_per_node: 3
+      iterations: 1
+      pool_profiles:
+        replicated:
+          pg_size: 128
+          pgp_size: 128
+          replication: replicated
+"""
+
+
+class TestGetCbtTasks(unittest.TestCase):
+    def _write_yaml(self, contents):
+        handle = tempfile.NamedTemporaryFile(mode='w', suffix='.yaml',
+                                             delete=False)
+        handle.write(contents)
+        handle.close()
+        self.addCleanup(os.unlink, handle.name)
+        return handle.name
+
+    def test_extracts_cbt_task(self):
+        path = self._write_yaml(SAMPLE_TEUTHOLOGY_YAML)
+        tasks = list(t2c.get_cbt_tasks(path))
+        self.assertEqual(len(tasks), 1)
+        self.assertIn('benchmarks', tasks[0])
+        self.assertEqual(tasks[0]['benchmarks']['radosbench']['read_time'], 30)
+        self.assertEqual(tasks[0]['cluster']['osds_per_node'], 3)
+
+    def test_ignores_non_cbt_tasks(self):
+        path = self._write_yaml("tasks:\n- install:\n    version: main\n")
+        tasks = list(t2c.get_cbt_tasks(path))
+        self.assertEqual(tasks, [])
+
+    def test_empty_file_returns_no_tasks(self):
+        path = self._write_yaml("")
+        tasks = list(t2c.get_cbt_tasks(path))
+        self.assertEqual(tasks, [])
+
+    def test_missing_tasks_key_returns_no_tasks(self):
+        path = self._write_yaml("meta:\n- desc: no tasks here\n")
+        tasks = list(t2c.get_cbt_tasks(path))
+        self.assertEqual(tasks, [])
+
+    def test_multiple_cbt_tasks(self):
+        path = self._write_yaml(
+            "tasks:\n"
+            "- cbt:\n"
+            "    cluster:\n"
+            "      iterations: 1\n"
+            "- cbt:\n"
+            "    cluster:\n"
+            "      iterations: 2\n")
+        tasks = list(t2c.get_cbt_tasks(path))
+        self.assertEqual(len(tasks), 2)
+        self.assertEqual(tasks[0]['cluster']['iterations'], 1)
+        self.assertEqual(tasks[1]['cluster']['iterations'], 2)
+
+
+class TestTranslator(unittest.TestCase):
+    def test_translate_builds_cbt_cluster_section(self):
+        build_dir = '/tmp/ceph-build'
+        translator = t2c.Translator(build_dir)
+        cbt_task = {
+            'cluster': {
+                'osds_per_node': 4,
+                'iterations': 2,
+                'pool_profiles': {
+                    'replicated': {
+                        'pg_size': 64,
+                        'pgp_size': 64,
+                        'replication': 'replicated',
+                    },
+                },
+            },
+            'benchmarks': {
+                'radosbench': {
+                    'read_time': 10,
+                },
+            },
+            'monitoring_profiles': {
+                'perf': {
+                    'nodes': ['osds'],
+                },
+            },
+        }
+
+        translated = translator.translate(cbt_task)
+        cluster = translated['cluster']
+        self.assertEqual(cluster['osds_per_node'], 4)
+        self.assertEqual(cluster['iterations'], 2)
+        self.assertEqual(cluster['pool_profiles'], cbt_task['cluster']['pool_profiles'])
+        self.assertEqual(cluster['conf_file'], os.path.join(build_dir, 'ceph.conf'))
+        self.assertEqual(cluster['ceph_cmd'], os.path.join(build_dir, 'bin', 'ceph'))
+        self.assertEqual(cluster['rados_cmd'], os.path.join(build_dir, 'bin', 'rados'))
+        self.assertEqual(cluster['pid_dir'], os.path.join(build_dir, 'out'))
+        self.assertFalse(cluster['rebuild_every_test'])
+        self.assertEqual(translated['benchmarks'], cbt_task['benchmarks'])
+        self.assertEqual(translated['monitoring_profiles'],
+                         cbt_task['monitoring_profiles'])
+
+
+class TestMain(unittest.TestCase):
+    def test_main_writes_translated_yaml(self):
+        input_path = tempfile.NamedTemporaryFile(mode='w', suffix='.yaml',
+                                                 delete=False)
+        input_path.write(SAMPLE_TEUTHOLOGY_YAML)
+        input_path.close()
+        self.addCleanup(os.unlink, input_path.name)
+
+        output_path = tempfile.NamedTemporaryFile(mode='w', suffix='.yaml',
+                                                  delete=False)
+        output_path.close()
+        self.addCleanup(os.unlink, output_path.name)
+
+        build_dir = '/tmp/ceph-build'
+        argv = [
+            't2c.py',
+            '--build-dir', build_dir,
+            '--input', input_path.name,
+            '--output', output_path.name,
+        ]
+        with unittest.mock.patch.object(sys, 'argv', argv):
+            t2c.main()
+
+        with open(output_path.name) as output:
+            translated = yaml.safe_load(output)
+        self.assertIn('cluster', translated)
+        self.assertIn('benchmarks', translated)
+        self.assertEqual(translated['cluster']['conf_file'],
+                         os.path.join(build_dir, 'ceph.conf'))
+
+    def test_main_errors_when_cbt_task_missing(self):
+        input_path = tempfile.NamedTemporaryFile(mode='w', suffix='.yaml',
+                                                 delete=False)
+        input_path.write("tasks:\n- install:\n")
+        input_path.close()
+        self.addCleanup(os.unlink, input_path.name)
+
+        output_path = tempfile.NamedTemporaryFile(mode='w', suffix='.yaml',
+                                                  delete=False)
+        output_path.close()
+        self.addCleanup(os.unlink, output_path.name)
+
+        argv = [
+            't2c.py',
+            '--input', input_path.name,
+            '--output', output_path.name,
+        ]
+        with unittest.mock.patch.object(sys, 'argv', argv):
+            with self.assertRaises(SystemExit) as ctx:
+                t2c.main()
+        self.assertEqual(ctx.exception.code, 1)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 6dadd2f0309c0c016225a6891e814388d75aecd5 Mon Sep 17 00:00:00 2001
From: Sagar Gopale <sagar.gopale@ibm.com>
Date: Tue, 9 Jun 2026 13:33:07 +0530
Subject: [PATCH 124/596] mgr/dashboard: Remove global RGW tenant Roles tab and
 decommission routes

Fixes: https://tracker.ceph.com/issues/77262

Signed-off-by: Sagar Gopale <sagar.gopale@ibm.com>
---
 .../rgw-user-tabs.component.html              |  9 +---
 .../frontend/src/app/ceph/rgw/rgw.module.ts   | 46 ++-----------------
 .../src/app/core/context/context.component.ts |  3 --
 3 files changed, 4 insertions(+), 54 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html
index 92069bb5785..bca61be2c95 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html
@@ -15,12 +15,5 @@
        [routerLinkActiveOptions]="{exact: true}"
        i18n>Accounts</a>
   </li>
-  <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/rgw/roles"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Roles</a>
-  </li>
+
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
index 510248cd9d8..c573b617bf0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
@@ -12,7 +12,7 @@ import {
 import { PipesModule } from '~/app/shared/pipes/pipes.module';
 
 import { ActionLabels, URLVerbs } from '~/app/shared/constants/app.constants';
-import { CRUDTableComponent } from '~/app/shared/datatable/crud-table/crud-table.component';
+
 import { FeatureTogglesGuardService } from '~/app/shared/services/feature-toggles-guard.service';
 import { ModuleStatusGuardService } from '~/app/shared/services/module-status-guard.service';
 
@@ -37,7 +37,7 @@ import { DataTableModule } from '~/app/shared/datatable/datatable.module';
 import { RgwMultisiteRealmFormComponent } from './rgw-multisite-realm-form/rgw-multisite-realm-form.component';
 import { RgwMultisiteZonegroupFormComponent } from './rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component';
 import { RgwMultisiteZoneFormComponent } from './rgw-multisite-zone-form/rgw-multisite-zone-form.component';
-import { CrudFormComponent } from '~/app/shared/forms/crud-form/crud-form.component';
+
 import { RgwMultisiteZoneDeletionFormComponent } from './models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component';
 import { RgwMultisiteZonegroupDeletionFormComponent } from './models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component';
 import { RgwSystemUserComponent } from './rgw-system-user/rgw-system-user.component';
@@ -292,47 +292,7 @@ const routes: Routes = [
       }
     ]
   },
-  {
-    path: 'roles',
-    data: {
-      breadcrumbs: 'Roles',
-      resource: 'api.rgw.roles@1.0',
-      tabs: [
-        {
-          name: 'Users',
-          url: '/rgw/user'
-        },
-        {
-          name: 'Accounts',
-          url: '/rgw/accounts'
-        },
-        {
-          name: 'Roles',
-          url: '/rgw/roles'
-        }
-      ]
-    },
-    children: [
-      {
-        path: '',
-        component: CRUDTableComponent
-      },
-      {
-        path: URLVerbs.CREATE,
-        component: CrudFormComponent,
-        data: {
-          breadcrumbs: ActionLabels.CREATE
-        }
-      },
-      {
-        path: URLVerbs.EDIT,
-        component: CrudFormComponent,
-        data: {
-          breadcrumbs: ActionLabels.EDIT
-        }
-      }
-    ]
-  },
+
   {
     path: 'bucket',
     data: { breadcrumbs: 'Buckets' },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.ts
index e652a923d7c..46e293d8d85 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.ts
@@ -25,7 +25,6 @@ export class ContextComponent implements OnInit, OnDestroy {
   private subs = new Subscription();
   private rgwUrlPrefix = '/rgw';
   private rgwUserUrlPrefix = '/rgw/user';
-  private rgwRoleUrlPrefix = '/rgw/roles';
   private rgwBuckerUrlPrefix = '/rgw/bucket';
   private rgwAccountsUrlPrefix = '/rgw/accounts';
   private rgwMultisiteSyncPolicyPrefix = '/rgw/multisite/sync-policy';
@@ -34,7 +33,6 @@ export class ContextComponent implements OnInit, OnDestroy {
   isRgwRoute =
     document.location.href.includes(this.rgwUserUrlPrefix) ||
     document.location.href.includes(this.rgwBuckerUrlPrefix) ||
-    document.location.href.includes(this.rgwRoleUrlPrefix) ||
     document.location.href.includes(this.rgwAccountsUrlPrefix) ||
     document.location.href.includes(this.rgwMultisiteSyncPolicyPrefix);
 
@@ -58,7 +56,6 @@ export class ContextComponent implements OnInit, OnDestroy {
             (this.isRgwRoute = [
               this.rgwBuckerUrlPrefix,
               this.rgwUserUrlPrefix,
-              this.rgwRoleUrlPrefix,
               this.rgwAccountsUrlPrefix,
               this.rgwMultisiteSyncPolicyPrefix
             ].some((urlPrefix) => this.router.url.startsWith(urlPrefix)))

From 8f3a16656982dfdfd55a6229c90884de365036e1 Mon Sep 17 00:00:00 2001
From: Shai Fultheim <shai.fultheim@gmail.com>
Date: Thu, 28 May 2026 10:24:05 +0300
Subject: [PATCH 125/596] crimson/os/seastore: wake blocked IO on
 BackgroundProcess wakeup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

BackgroundProcess::run() blocks on blocking_background when
background_should_run() returns false. When the loop wakes up —
typically because arm_blocking_io_and_wake() kicked it — the loop
re-checks background_should_run(). If that still returns false
(e.g. the cleaner has no pending work), the loop goes straight back
to sleep.

But the wake may also have been triggered by a change in the space-
availability condition (should_block_io) — and there is no path that
re-evaluates blocked user IO when background_should_run is false. The
blocked IO has no future trigger to re-check, and stays stuck until
the next unrelated wake-up happens to come at the right moment, or
never.

Add a maybe_wake_blocked_io() call right after the wake. It's a no-op
when nothing is blocked, and unblocks IO that the space condition has
already cleared otherwise.

Observed in sustained random-write benches that wedged with IO blocked
indefinitely while the cleaner sat idle (should_run=false).

Signed-off-by: Shai Fultheim <shai.fultheim@gmail.com>
---
 src/crimson/os/seastore/extent_placement_manager.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/crimson/os/seastore/extent_placement_manager.cc b/src/crimson/os/seastore/extent_placement_manager.cc
index 024dce94028..c6110a28de3 100644
--- a/src/crimson/os/seastore/extent_placement_manager.cc
+++ b/src/crimson/os/seastore/extent_placement_manager.cc
@@ -841,6 +841,12 @@ ExtentPlacementManager::BackgroundProcess::run()
       assert(!blocking_background);
       blocking_background = seastar::promise<>();
       co_await blocking_background->get_future();
+      // After waking (typically because arm_blocking_io_and_wake() kicked us),
+      // give any blocked user IO a chance to proceed. Without this call the
+      // loop would go straight back to sleep if background_should_run() is
+      // still false, but the space condition (should_block_io) may already be
+      // satisfied, leaving blocked IO stuck with no future trigger to re-check.
+      maybe_wake_blocked_io();
     }
   }
   log_state("run(exit)");

From 83541fd93c92bc8e93dd72ecc8467d59e15c36e5 Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:15:29 +0100
Subject: [PATCH 126/596] doc/security: Add Security Lead and Working Group
 pages to toctree

Both securitylead.rst and workinggroup.rst existed in the tree but
were not referenced in the security/index.rst toctree, making them
invisible in the built documentation. Add RST document titles and
include both pages in the toctree.

Fixes: https://tracker.ceph.com/issues/77206

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/security/index.rst        | 2 ++
 doc/security/securitylead.rst | 4 ++++
 doc/security/workinggroup.rst | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/doc/security/index.rst b/doc/security/index.rst
index da767680ba1..9dadb4fe226 100644
--- a/doc/security/index.rst
+++ b/doc/security/index.rst
@@ -7,6 +7,8 @@
 
    Past Vulnerabilities / CVEs <cves>
    Vulnerability Management Process <process>
+   Security Lead <securitylead>
+   Security Working Group <workinggroup>
 
 Reporting a vulnerability
 =========================
diff --git a/doc/security/securitylead.rst b/doc/security/securitylead.rst
index 1433e799033..fc031750436 100644
--- a/doc/security/securitylead.rst
+++ b/doc/security/securitylead.rst
@@ -1,3 +1,7 @@
+================
+ Security Lead
+================
+
 The CSC designates a member as Security Lead, with responsibility for
 co-ordinating security posture. The Security Lead also keeps the CSC updated
 about vulnerabilities within Ceph and progress toward addressing them. The lead
diff --git a/doc/security/workinggroup.rst b/doc/security/workinggroup.rst
index 8dcbc656297..3493d2fd4ab 100644
--- a/doc/security/workinggroup.rst
+++ b/doc/security/workinggroup.rst
@@ -1,3 +1,7 @@
+==========================
+ Security Working Group
+==========================
+
 In order to fully support Ceph, the security working group
 co-ordinates security improvements. This is essential as industry
 focuses more on security, and Ceph has become a mature software

From 24f96c09f4f95efe90a0969228334ad842aae4de Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:17:55 +0100
Subject: [PATCH 127/596] doc: Remove empty README.md and relocate nvmeof HA
 design doc

doc/README.md was a 0-byte file with no content; remove it.

doc/nvmeof/ha.md described the internal NVMeofGwMon/NVMeofGwMap
HA implementation (Paxos messaging, ANA state machines, blocklist
logic) -- a developer design document, not user-facing content.
User-facing NVMe-oF documentation already exists in doc/rbd/.
Move to doc/dev/nvmeof-ha-design.md where developer design docs live.

Fixes: https://tracker.ceph.com/issues/77208

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/README.md                                 | 0
 doc/{nvmeof/ha.md => dev/nvmeof-ha-design.md} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 doc/README.md
 rename doc/{nvmeof/ha.md => dev/nvmeof-ha-design.md} (100%)

diff --git a/doc/README.md b/doc/README.md
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/doc/nvmeof/ha.md b/doc/dev/nvmeof-ha-design.md
similarity index 100%
rename from doc/nvmeof/ha.md
rename to doc/dev/nvmeof-ha-design.md

From 1bb67ee3949de6213d6c0a59b70141a378a5bc1c Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Fri, 5 Jun 2026 09:57:00 -0400
Subject: [PATCH 128/596] librados: print nspace only if present

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 src/librados/IoCtxImpl.cc | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/librados/IoCtxImpl.cc b/src/librados/IoCtxImpl.cc
index 7e3dddd1cd6..4d48400d716 100644
--- a/src/librados/IoCtxImpl.cc
+++ b/src/librados/IoCtxImpl.cc
@@ -666,8 +666,12 @@ int librados::IoCtxImpl::operate(const object_t& oid, ::ObjectOperation *o,
   Context *oncommit = new C_SafeCond(mylock, cond, &done, &r);
 
   int op = o->ops[0].op.op;
-  ldout(client->cct, 10) << ceph_osd_op_name(op) << " oid=" << oid
-			 << " nspace=" << oloc.nspace << dendl;
+  ldout(client->cct, 10) << ceph_osd_op_name(op) << " oid=" << oid;
+  if (!oloc.nspace.empty()) {
+    *_dout << " nspace=" << oloc.nspace;
+  }
+  *_dout << dendl;
+
   Objecter::Op *objecter_op = objecter->prepare_mutate_op(
     oid, oloc,
     *o, snapc, ut,
@@ -720,7 +724,11 @@ int librados::IoCtxImpl::operate_read(const object_t& oid,
   Context *onack = new C_SafeCond(mylock, cond, &done, &r);
 
   int op = o->ops[0].op.op;
-  ldout(client->cct, 10) << ceph_osd_op_name(op) << " oid=" << oid << " nspace=" << oloc.nspace << dendl;
+  ldout(client->cct, 10) << ceph_osd_op_name(op) << " oid=" << oid;
+  if (!oloc.nspace.empty()) {
+    *_dout << " nspace=" << oloc.nspace;
+  }
+  *_dout << dendl;
   Objecter::Op *objecter_op = objecter->prepare_read_op(
     oid, oloc,
     *o, snap_seq, pbl,

From 04aceefad0ef2b0186b0854ae28b4fbc4ffa51c3 Mon Sep 17 00:00:00 2001
From: Shilpa Jagannath <smanjara@redhat.com>
Date: Fri, 5 Jun 2026 14:42:35 -0400
Subject: [PATCH 129/596] common/async: async_cond::notify/cancel must post to
 handler's associated executor

RGWDeleteMultiObj spawns child coroutines via spawn_throttle to delete
objects in parallel. each child coroutine carries the connection strand
as its associated executor, serializing concurrent operations on shared
state like the response formatter and ops_log_entries.

but in multisite env, concurrent deletions in the same bucket shard
contend on async_cond in RGWDataChangesLog::add_entry(). when notify()
fires, waiting coroutines resume on the raw io_context executor
instead of their connection strand, breaking the serialization that prevents data
races in send_partial_response()

any_completion_handler doesn't support post(). so post() to the
default executor and dispatch to the associated executor from there

Signed-off-by: Shilpa Jagannath <smanjara@redhat.com>
---
 src/common/async/async_cond.h | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/src/common/async/async_cond.h b/src/common/async/async_cond.h
index 0ad87f75cd0..53869910b44 100644
--- a/src/common/async/async_cond.h
+++ b/src/common/async/async_cond.h
@@ -28,6 +28,7 @@
 #include <boost/asio/any_io_executor.hpp>
 #include <boost/asio/append.hpp>
 #include <boost/asio/async_result.hpp>
+#include <boost/asio/bind_executor.hpp>
 #include <boost/asio/consign.hpp>
 #include <boost/asio/error.hpp>
 #include <boost/asio/execution_context.hpp>
@@ -58,8 +59,8 @@ class async_cond : public service_list_base_hook {
 
   std::mutex m;
   std::vector<std::pair<
-    boost::asio::any_completion_handler<
-    void(boost::system::error_code)>, std::unique_lock<BasicLockable>*>> handlers;
+    boost::asio::any_completion_handler<void(boost::system::error_code)>,
+    std::unique_lock<BasicLockable>*>> handlers;
 
   void service_shutdown() {
     std::unique_lock l(m);
@@ -135,12 +136,13 @@ public:
       handlers.resize(0);
       l.unlock();
       for (auto&& [handler, lock] : workhandlers) {
+	auto ex = asio::get_associated_executor(handler, executor);
 	asio::post(executor,
-		   [handler = std::move(handler), lock = lock]() mutable {
-		     lock->lock();
-		     std::move(handler)(sys::error_code{});
-		   });
-
+		   asio::bind_executor(ex,
+		     [handler = std::move(handler), lock = lock]() mutable {
+		       lock->lock();
+		       std::move(handler)(sys::error_code{});
+		     }));
       }
     }
   }
@@ -157,12 +159,13 @@ public:
       handlers.resize(0);
       l.unlock();
       for (auto&& [handler, lock] : workhandlers) {
+	auto ex = asio::get_associated_executor(handler, executor);
 	asio::post(executor,
-		   [handler = std::move(handler), lock = lock]() mutable {
-		     lock->lock();
-		     std::move(handler)(asio::error::operation_aborted);
-		   });
-
+		   asio::bind_executor(ex,
+		     [handler = std::move(handler), lock = lock]() mutable {
+		       lock->lock();
+		       std::move(handler)(asio::error::operation_aborted);
+		     }));
       }
     }
   }

From 43dfdc8fdbfe97e0b8e2020e6658bcfafe3f4877 Mon Sep 17 00:00:00 2001
From: Eric Zhang <emzhang@umich.edu>
Date: Tue, 21 Apr 2026 17:17:33 -0700
Subject: [PATCH 130/596] mgr: Allow autoscaling for overlapped roots Remove
 references to overlapped roots. Assign PG budget per root as
 sum(mon_target_pg_per_osd/# roots that contain OSD)

Fixes: https://tracker.ceph.com/issues/73892

Signed-off-by: Eric Zhang <emzhang@ibm.com>
---
 src/pybind/mgr/pg_autoscaler/module.py | 105 ++++++++++---------------
 1 file changed, 43 insertions(+), 62 deletions(-)

diff --git a/src/pybind/mgr/pg_autoscaler/module.py b/src/pybind/mgr/pg_autoscaler/module.py
index 9b9050a049a..f6e015ca3d1 100644
--- a/src/pybind/mgr/pg_autoscaler/module.py
+++ b/src/pybind/mgr/pg_autoscaler/module.py
@@ -19,8 +19,6 @@ Some terminology is made up for the purposes of this module:
  - "raw pgs": pg count after applying replication, i.e. the real resource
               consumption of a pool.
  - "grow/shrink" - increase/decrease the pg_num in a pool
- - "crush subtree" - non-overlapping domains in crush hierarchy: used as
-                     units of resource management.
 """
 
 INTERVAL = 5
@@ -113,12 +111,12 @@ class PgAdjustmentProgress(object):
                       refs=[("pool", self.pool_id)])
 
 
-class CrushSubtreeResourceStatus:
+class CrushRootResourceStatus:
     def __init__(self) -> None:
-        self.root_ids: List[int] = []
+        self.root_id: int
         self.osds: Set[int] = set()
         self.osd_count: Optional[int] = None  # Number of OSDs
-        self.pg_target: Optional[int] = None  # Ideal full-capacity PG count?
+        self.pg_target = 0 # Ideal full-capacity PG count?
         self.pg_current = 0  # How many PGs already?
         self.pg_left = 0
         self.capacity: Optional[int] = None  # Total capacity of OSDs in subtree
@@ -425,17 +423,18 @@ class PgAutoscaler(MgrModule):
         self.log.info('Stopping pg_autoscaler')
         self._shutdown.set()
 
-    def identify_subtrees_and_overlaps(self,
-                                       osdmap: OSDMap,
-                                       pools: Dict[str, Dict[str, Any]],
-                                       crush: CRUSHMap,
-                                       result: Dict[int, CrushSubtreeResourceStatus],
-                                       overlapped_roots: Set[int],
-                                       roots: List[CrushSubtreeResourceStatus]) -> \
-        Tuple[List[CrushSubtreeResourceStatus],
-              Set[int]]:
+    def identify_subtrees(self,
+                          osdmap: OSDMap,
+                          pools: Dict[str, Dict[str, Any]],
+                          crush: CRUSHMap,
+                          result: Dict[int, CrushRootResourceStatus],
+                          roots: List[CrushRootResourceStatus],
+                          osd_uses_by_root: Dict[int, Set[int]]) -> \
+        Tuple[List[CrushRootResourceStatus],
+              Dict[int, Set[int]]]:
+
+        # We identify subtrees from osdmap
 
-        # We identify subtrees and overlapping roots from osdmap
         for pool_name, pool in pools.items():
             crush_rule = crush.get_rule_by_id(pool['crush_rule'])
             assert crush_rule is not None
@@ -443,26 +442,15 @@ class PgAutoscaler(MgrModule):
             root_id = crush.get_rule_root(cr_name)
             assert root_id is not None
             osds = set(crush.get_osds_under(root_id))
-
-            # Are there overlapping roots?
+            for osd in osds:
+                osd_uses_by_root[osd].add(root_id)
             s = None
-            for prev_root_id, prev in result.items():
-                if osds & prev.osds:
-                    s = prev
-                    if prev_root_id != root_id:
-                        overlapped_roots.add(prev_root_id)
-                        overlapped_roots.add(root_id)
-                        self.log.warning("pool %s won't scale due to overlapping roots: %s",
-                                      pool_name, overlapped_roots)
-                        self.log.warning("Please See: https://docs.ceph.com/en/"
-                                         "latest/rados/operations/placement-groups"
-                                         "/#automated-scaling")
-                    break
-            if not s:
-                s = CrushSubtreeResourceStatus()
+            if root_id not in result:
+                s = CrushRootResourceStatus()
                 roots.append(s)
-            result[root_id] = s
-            s.root_ids.append(root_id)
+                result[root_id] = s
+                s.root_id = root_id
+            s = result[root_id]
             s.osds |= osds
             s.pool_ids.append(pool['pool'])
             s.pool_names.append(pool_name)
@@ -474,32 +462,33 @@ class PgAutoscaler(MgrModule):
                 target_bytes = pool['options'].get('target_size_bytes', 0)
                 if target_bytes:
                     s.total_target_bytes += target_bytes * osdmap.pool_raw_used_rate(pool['pool'])
-        return roots, overlapped_roots
+        return roots, osd_uses_by_root
 
     def get_subtree_resource_status(self,
                                     osdmap: OSDMap,
                                     pools: Dict[str, Dict[str, Any]],
-                                    crush: CRUSHMap) -> Tuple[Dict[int, CrushSubtreeResourceStatus],
-                                                              Set[int]]:
+                                    crush: CRUSHMap) -> Dict[int, CrushRootResourceStatus]:
         """
         For each CRUSH subtree of interest (i.e. the roots under which
         we have pools), calculate the current resource usages and targets,
         such as how many PGs there are, vs. how many PGs we would
         like there to be.
         """
-        result: Dict[int, CrushSubtreeResourceStatus] = {}
-        roots: List[CrushSubtreeResourceStatus] = []
-        overlapped_roots: Set[int] = set()
-        # identify subtrees and overlapping roots
-        roots, overlapped_roots = self.identify_subtrees_and_overlaps(
-            osdmap, pools, crush, result, overlapped_roots, roots
+        result: Dict[int, CrushRootResourceStatus] = {}
+        roots: List[CrushRootResourceStatus] = []
+        osd_uses_by_root: Dict[int, Set[int]] = defaultdict(set[int])
+        # identify subtrees and roots
+        roots, osd_uses_by_root = self.identify_subtrees(
+            osdmap, pools, crush, result, roots, osd_uses_by_root
         )
         # finish subtrees
         all_stats = self.get('osd_stats')
+        for osd, root_ids in osd_uses_by_root.items():
+            for root_id in root_ids:
+                result[root_id].pg_target += self.mon_target_pg_per_osd // len(root_ids)
         for s in roots:
             assert s.osds is not None
             s.osd_count = len(s.osds)
-            s.pg_target = s.osd_count * self.mon_target_pg_per_osd
             s.pg_left = s.pg_target
             s.pool_count = len(s.pool_ids)
             capacity = 0
@@ -512,13 +501,12 @@ class PgAutoscaler(MgrModule):
                     capacity += osd_stats['kb'] * 1024
 
             s.capacity = capacity
-            self.log.debug('root_ids %s pools %s with %d osds, pg_target %d',
-                           s.root_ids,
+            self.log.debug('root_id %s pools %s with %d osds, pg_target %d',
+                           s.root_id,
                            s.pool_ids,
                            s.osd_count,
                            s.pg_target)
-
-        return result, overlapped_roots
+        return result
 
     def _append_result (
             self,
@@ -568,7 +556,7 @@ class PgAutoscaler(MgrModule):
 
     def _find_optimal_pg_distribution (
             self,
-            root_map: Dict[int, CrushSubtreeResourceStatus],
+            root_map: Dict[int, CrushRootResourceStatus],
             root_id: int,
             base: int,
             cost: int,
@@ -617,7 +605,7 @@ class PgAutoscaler(MgrModule):
 
     def _calculate_final_pool_pg_target(
             self,
-            root_map: Dict[int, CrushSubtreeResourceStatus],
+            root_map: Dict[int, CrushRootResourceStatus],
             root_id: int,
             func_pass: 'PassT',
             pool_group: Dict[GroupKey, PoolGroup],
@@ -736,7 +724,7 @@ class PgAutoscaler(MgrModule):
     def _calculate_pool_metrics(
             self,
             osdmap: OSDMap,
-            root_map: Dict[int, CrushSubtreeResourceStatus],
+            root_map: Dict[int, CrushRootResourceStatus],
             root_id: int,
             pool_id: int,
             pool_stats: Dict[int, Dict[str, int]],
@@ -781,7 +769,7 @@ class PgAutoscaler(MgrModule):
 
     def _get_pool_pg_targets(
             self,
-            root_map: Dict[int, CrushSubtreeResourceStatus],
+            root_map: Dict[int, CrushRootResourceStatus],
             ret: List[Dict[str, Any]],
             threshold: float,
             func_pass: 'PassT',
@@ -879,9 +867,8 @@ class PgAutoscaler(MgrModule):
         osdmap: OSDMap,
         pools: Dict[str, Dict[str, Any]],
         crush_map: CRUSHMap,
-        root_map: Dict[int, CrushSubtreeResourceStatus],
+        root_map: Dict[int, CrushRootResourceStatus],
         pool_stats: Dict[int, Dict[str, int]],
-        overlapped_roots: Set[int],
         pool_groups_by_root: Dict[int, Dict[GroupKey, PoolGroup]],
         pool_metrics: Dict[str, Dict[str, Any]],
     ) -> None:
@@ -901,12 +888,6 @@ class PgAutoscaler(MgrModule):
             cr_name = crush_rule['rule_name']
             root_id = crush_map.get_rule_root(cr_name)
             assert root_id is not None
-            if root_id in overlapped_roots:
-                # skip pools
-                # with overlapping roots
-                self.log.warn("pool %d contains an overlapping root %d"
-                              "... skipping scaling", pool_id, root_id)
-                continue
             capacity = root_map[root_id].capacity
             assert capacity is not None
             if capacity == 0:
@@ -944,12 +925,12 @@ class PgAutoscaler(MgrModule):
             osdmap: OSDMap,
             pools: Dict[str, Dict[str, Any]],
     ) -> Tuple[List[Dict[str, Any]],
-               Dict[int, CrushSubtreeResourceStatus]]:
+               Dict[int, CrushRootResourceStatus]]:
         threshold = self.threshold
         assert threshold >= 1.0
 
         crush_map = osdmap.get_crush()
-        root_map, overlapped_roots = self.get_subtree_resource_status(osdmap, pools, crush_map)
+        root_map = self.get_subtree_resource_status(osdmap, pools, crush_map)
         df = self.get('df')
         pool_stats = dict([(p['id'], p['stats']) for p in df['pools']])
 
@@ -977,7 +958,7 @@ class PgAutoscaler(MgrModule):
         #     'target_ratio': float
         #     'bulk': bool
         # }
-        self._compute_pool_group_metrics(osdmap, pools, crush_map, root_map, pool_stats, overlapped_roots, pool_groups_by_root, pool_metrics)
+        self._compute_pool_group_metrics(osdmap, pools, crush_map, root_map, pool_stats, pool_groups_by_root, pool_metrics)
 
         ret = self._get_pool_pg_targets(root_map, ret, threshold, 'first', pool_groups_by_root, pool_metrics)
         ret = self._get_pool_pg_targets(root_map, ret, threshold, 'second', pool_groups_by_root, pool_metrics)

From 47c8ab5cacf340638560d0f04bf8a0bf2b885ec1 Mon Sep 17 00:00:00 2001
From: Eric Zhang <emzhang@umich.edu>
Date: Tue, 21 Apr 2026 17:20:43 -0700
Subject: [PATCH 131/596] mgr: Modify test_overlapping_roots for PG budget No
 longer need to detect which roots are overlapping. Instead test PG budget
 allocation when roots overlap

Fixes: https://tracker.ceph.com/issues/73892

Signed-off-by: Eric Zhang <emzhang@ibm.com>
---
 .../tests/test_overlapping_roots.py           | 33 ++++++++++++-------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/src/pybind/mgr/pg_autoscaler/tests/test_overlapping_roots.py b/src/pybind/mgr/pg_autoscaler/tests/test_overlapping_roots.py
index b82146f7fc0..b8278a4c80d 100644
--- a/src/pybind/mgr/pg_autoscaler/tests/test_overlapping_roots.py
+++ b/src/pybind/mgr/pg_autoscaler/tests/test_overlapping_roots.py
@@ -3,7 +3,9 @@ import unittest
 from tests import mock
 import pytest
 import json
+from collections import defaultdict
 from pg_autoscaler import module
+from pg_autoscaler.module import CrushRootResourceStatus
 
 
 class OSDMAP:
@@ -45,17 +47,16 @@ class TestPgAutoscaler(object):
     def setup_method(self):
         # a bunch of attributes for testing.
         self.autoscaler = module.PgAutoscaler('module_name', 0, 0)
+        self.autoscaler.mon_target_pg_per_osd = 100
 
-    def helper_test(self, osd_dic, rules, pools, expected_overlapped_roots):
-        result = {}
-        roots = []
-        overlapped_roots = set()
+    def helper_test(self, osd_dic, rules, pools, expected_result):
         osdmap = OSDMAP(pools)
         crush = CRUSH(rules, osd_dic)
-        roots, overlapped_roots = self.autoscaler.identify_subtrees_and_overlaps(
-            osdmap, pools, crush, result, overlapped_roots, roots
+        result = self.autoscaler.get_subtree_resource_status(
+            osdmap, pools, crush
         )
-        assert overlapped_roots == expected_overlapped_roots
+        for root_id in result:
+            assert result[root_id].pg_target == expected_result[root_id].pg_target
 
     def test_subtrees_and_overlaps(self):
         osd_dic = {
@@ -282,8 +283,13 @@ class TestPgAutoscaler(object):
                 "expected_final_pg_target": 128,
             },
         }
-        expected_overlapped_roots = {-40, -1, -5}
-        self.helper_test(osd_dic, rules, pools, expected_overlapped_roots)
+        expected_result = defaultdict(CrushRootResourceStatus)
+        for root in osd_dic:
+            expected_result[root] = CrushRootResourceStatus()
+        expected_result[-1].pg_target = 550
+        expected_result[-40].pg_target = 250
+        expected_result[-5].pg_target = 800
+        self.helper_test(osd_dic, rules, pools, expected_result)
 
     def test_no_overlaps(self):
         osd_dic = {
@@ -510,5 +516,10 @@ class TestPgAutoscaler(object):
                 "expected_final_pg_target": 128,
             },
         }
-        expected_overlapped_roots = set()
-        self.helper_test(osd_dic, rules, pools, expected_overlapped_roots)
+        expected_result = defaultdict(CrushRootResourceStatus)
+        for root in osd_dic:
+            expected_result[root] = CrushRootResourceStatus()
+        expected_result[-1].pg_target = 1100
+        expected_result[-40].pg_target = 500
+        expected_result[-5].pg_target = 300
+        self.helper_test(osd_dic, rules, pools, expected_result)

From 6831e7c94a6ff9d4a3993a2ecb5d38962ee01745 Mon Sep 17 00:00:00 2001
From: Eric Zhang <emzhang@umich.edu>
Date: Wed, 27 May 2026 11:48:04 -0700
Subject: [PATCH 132/596] docs: Add docs about allowing PG autoscaling for
 overlapped roots Remove mention of overlapped roots failing to scale and
 added example of adding overlapped roots. Added mention of changes in
 PendingReleaseNotes

Fixes: https://tracker.ceph.com/issues/73892

Signed-off-by: Eric Zhang <emzhang@ibm.com>
---
 PendingReleaseNotes                       |  4 ++
 doc/rados/operations/placement-groups.rst | 54 ++++++++++++++++-------
 2 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index e330cc903b9..488ad73f8d9 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -1,3 +1,7 @@
+* RADOS: PG autoscaler allows overlapping roots. Each root receives a PG target based
+  on its OSDs, with OSDs shared across multiple roots contributing proportionally
+  less to each root's allocation.
+  
 * librados/neorados: The C++ APIs for executing Ceph Class (CLS) methods
   have undergone a breaking change to enforce compile-time type safety, replacing
   legacy string-based parameters with strongly-typed ClsMethod structs. C++
diff --git a/doc/rados/operations/placement-groups.rst b/doc/rados/operations/placement-groups.rst
index bbc7af9e826..0a5ed934449 100644
--- a/doc/rados/operations/placement-groups.rst
+++ b/doc/rados/operations/placement-groups.rst
@@ -232,28 +232,48 @@ command:
 For all but the very smallest deployments a value of 200 is recommended.
 A value above 500 may result in excessive peering traffic and RAM usage.
 
-The autoscaler analyzes pools and adjusts on a per-subtree basis.  Because each
-pool might map to a different CRUSH rule, and each rule might distribute data
-across different and possibly overlapping sets of devices,
-Ceph will consider the utilization of each subtree of
-the CRUSH hierarchy independently. For example, a pool that maps to OSDs of class
-``ssd`` and a pool that maps to OSDs of class ``hdd`` will each have calculated PG
-counts that are determined by how many OSDs of these two different device types
-there are.
+.. _overlapping_crush_roots:
 
-If a pool uses OSDs under two or more CRUSH roots (for example, shadow trees
-with both ``ssd`` and ``hdd`` devices), the autoscaler issues a warning to the
-user in the manager log. The warning states the name of the pool and the set of
-roots that overlap each other. The autoscaler does not scale any pools with
-overlapping roots because this condition can cause problems with the scaling
-process. We recommend constraining each pool so that it belongs to only one
-root (that is, one device OSD class) to silence the warning and ensure successful
-scaling.
+Overlapping CRUSH Roots PG Budget
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When OSDs are distributed across multiple CRUSH roots, each root receives a PG target based
+on its OSDs, with OSDs shared across multiple roots contributing proportionally less to each
+root's allocation. The budget assigned to each root is:
+
+.. math::
+
+   \sum_{\text{OSD}_i \in R} \frac{\text{mon_target_pg_per_osd}}{|\text{roots}(\text{OSD}_i)|}
+
+This ensures that the total PG budget is distributed proportionally across all roots.
+
+Consider a cluster with the following topology:
+
+.. prompt:: bash #
+
+   mon_target_pg_per_osd = 300
+
+- **rootid -1**: Contains OSDs {0, 1, 2, 3}
+- **rootid -2**: Contains OSDs {0, 1}
+- **rootid -3**: Contains OSDs {2, 3}
+
+OSD membership:
+
+- **OSD 0**: Belongs to roots {-1, -2}
+- **OSD 1**: Belongs to roots {-1, -2}
+- **OSD 2**: Belongs to roots {-1, -3}
+- **OSD 3**: Belongs to roots {-1, -3}
+
+The PG target allocation for each root is calculated as follows:
+
+- Root -1: pg_target = 600 = (300 / 2 roots for OSD 0) + (300 / 2 roots for OSD 1) + (300 / 2 roots for OSD 2) + (300 / 2 roots for OSD 3)
+- Root -2: pg_target = 300 = (300 / 2 roots for OSD 0) + (300 / 2 roots for OSD 1)
+- Root -3: pg_target = 300 = (300 / 2 roots for OSD 2) + (300 / 2 roots for OSD 3)
 
 .. _allocation_algorithm:
 
 Allocation Algorithm
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~
 
 The autoscaler sets each pool's ``final_pool_pg_target`` to be rounded to the
 nearest power of two while ensuring that the number of PGs to be placed on each OSD

From 7f9e383ecba2a0d72cb774e30a10f8d9fed96661 Mon Sep 17 00:00:00 2001
From: Eric Zhang <emzhang@umich.edu>
Date: Wed, 27 May 2026 15:55:59 -0700
Subject: [PATCH 133/596] qa: Add overlapped roots test case Added overlapped
 roots test case for CRUSH rules rule zone-1-only   step take zone us-east-1  
 step chooseleaf firstn 3 type host   step emit

rule zone-2-only
  step take zone us-east-2
  step chooseleaf firstn 3 type host
  step emit

rule zone-3-only
  step take zone us-east-3
  step chooseleaf firstn 3 type host
  step emit

rule default
   step take default
  step chooseleaf firstn 3 type host
  step emit

and osd tree
    -1         6.00000  root default
     -8         6.00000      region us-east
     -5         2.00000          zone us-east-1
    -13         1.00000              host host0
      0    ssd  1.00000                  osd.0
    -14         1.00000              host host1
      1    ssd  1.00000                  osd.1
     -6         2.00000          zone us-east-2
    -15         1.00000              host host2
      2    ssd  1.00000                  osd.2
    -16         1.00000              host host3
      3    ssd  1.00000                  osd.3
     -7         2.00000          zone us-east-3
    -17         1.00000              host host4
      4    ssd  1.00000                  osd.4
    -18         1.00000              host host5
      5    ssd  1.00000                  osd.5

    -1: pg_target = 300
    -5: pg_target = 100
    -6  pg_target = 100
    -7: pg_target = 100

Fixes: https://tracker.ceph.com/issues/73892

Signed-off-by: Eric Zhang <emzhang@ibm.com>
---
 qa/workunits/mon/pg_autoscaler.sh | 148 +++++++++++++++++++++++++++++-
 1 file changed, 147 insertions(+), 1 deletion(-)

diff --git a/qa/workunits/mon/pg_autoscaler.sh b/qa/workunits/mon/pg_autoscaler.sh
index b7eabbe92b0..bd045df7e4e 100755
--- a/qa/workunits/mon/pg_autoscaler.sh
+++ b/qa/workunits/mon/pg_autoscaler.sh
@@ -139,7 +139,6 @@ function test_autoscaler_basic() {
     wait_for 60 "ceph health detail | grep POOL_HAS_TARGET_SIZE_BYTES_AND_RATIO"
 
     # test autoscale warn
-
     ceph osd pool create warn0 1 --autoscale-mode=warn
     wait_for 120 "ceph health detail | grep POOL_TOO_FEW_PGS"
 
@@ -212,14 +211,161 @@ function test_exact_budget() {
     ceph osd pool rm data1 data1 --yes-i-really-really-mean-it
 }
 
+function test_overlapping_roots() {
+    # Create custom CRUSH rules for zone-based placement
+    MON_TARGET_PG_PER_OSD=100
+    ceph config set global mon_target_pg_per_osd $MON_TARGET_PG_PER_OSD
+
+    ceph osd crush add-bucket us-east region
+    ceph osd crush move us-east root=default
+
+    ceph osd crush add-bucket us-east-1 zone
+    ceph osd crush add-bucket us-east-2 zone
+    ceph osd crush add-bucket us-east-3 zone
+    ceph osd crush move us-east-1 region=us-east
+    ceph osd crush move us-east-2 region=us-east
+    ceph osd crush move us-east-3 region=us-east
+
+    ceph osd crush add-bucket host0 host
+    ceph osd crush add-bucket host1 host
+    ceph osd crush add-bucket host2 host
+    ceph osd crush add-bucket host3 host
+    ceph osd crush add-bucket host4 host
+    ceph osd crush add-bucket host5 host
+
+    ceph osd crush move host0 zone=us-east-1
+    ceph osd crush move host1 zone=us-east-1
+    ceph osd crush move host2 zone=us-east-2
+    ceph osd crush move host3 zone=us-east-2
+    ceph osd crush move host4 zone=us-east-3
+    ceph osd crush move host5 zone=us-east-3
+
+    ceph osd crush set osd.0 1.0 host=host0
+    ceph osd crush set osd.1 1.0 host=host1
+    ceph osd crush set osd.2 1.0 host=host2
+    ceph osd crush set osd.3 1.0 host=host3
+    ceph osd crush set osd.4 1.0 host=host4
+    ceph osd crush set osd.5 1.0 host=host5
+
+    ceph osd crush move us-east root=default
+
+    # Add zone-based CRUSH rules
+    hostname=$(hostname -s)
+    ceph osd crush remove $hostname
+
+    ceph osd getcrushmap > crushmap
+    crushtool --decompile crushmap > crushmap.txt
+    sed 's/^# end crush map$//' crushmap.txt > crushmap_modified.txt
+    cat >> crushmap_modified.txt << EOF
+rule zone-1-only {
+        id 1
+        type replicated
+        step take us-east-1
+        step chooseleaf firstn 3 type host
+        step emit
+}
+
+rule zone-2-only {
+        id 2
+        type replicated
+        step take us-east-2
+        step chooseleaf firstn 3 type host
+        step emit
+}
+
+rule zone-3-only {
+        id 3
+        type replicated
+        step take us-east-3
+        step chooseleaf firstn 3 type host
+        step emit
+}
+
+rule default {
+        id 4
+        type replicated
+        step take default
+        step chooseleaf firstn 3 type host
+        step emit
+}
+# end crush map
+EOF
+
+    # compile the modified crushmap and set it
+    crushtool --compile crushmap_modified.txt -o crushmap.bin
+    ceph osd setcrushmap -i crushmap.bin
+
+
+    ceph osd pool create data0 --size=1
+    ceph osd pool create data1 --size=1
+    ceph osd pool create data2 --size=1
+    ceph osd pool create data3 --size=3
+
+    ceph osd pool set data0 pg_autoscale_mode on
+    ceph osd pool set data1 pg_autoscale_mode on
+    ceph osd pool set data2 pg_autoscale_mode on
+    ceph osd pool set data3 pg_autoscale_mode on
+    
+
+    ceph osd pool set data0 crush_rule zone-1-only
+    ceph osd pool set data1 crush_rule zone-2-only
+    ceph osd pool set data2 crush_rule zone-3-only
+    ceph osd pool set data3 crush_rule default
+
+    ceph osd pool set data0 target_size_ratio 1.0
+    ceph osd pool set data1 target_size_ratio 1.0
+    ceph osd pool set data2 target_size_ratio 1.0
+    ceph osd pool set data3 target_size_ratio 1.0
+
+    # expect
+    #  -1         6.00000  root default
+    #  -8         6.00000      region us-east
+    #  -5         2.00000          zone us-east-1
+    # -13         1.00000              host host0
+    #   0    ssd  1.00000                  osd.0
+    # -14         1.00000              host host1
+    #   1    ssd  1.00000                  osd.1
+    #  -6         2.00000          zone us-east-2
+    # -15         1.00000              host host2
+    #   2    ssd  1.00000                  osd.2
+    # -16         1.00000              host host3
+    #   3    ssd  1.00000                  osd.3
+    #  -7         2.00000          zone us-east-3
+    # -17         1.00000              host host4
+    #   4    ssd  1.00000                  osd.4
+    # -18         1.00000              host host5
+    #   5    ssd  1.00000                  osd.5
+
+    # -1: pg_target = 300
+    # -5: pg_target = 100
+    # -6  pg_target = 100
+    # -7: pg_target = 100
+
+    TARGET_PG_1=$(power2_floor $MON_TARGET_PG_PER_OSD)
+    TARGET_PG_2=$(power2_floor $(( ($NUM_OSDS - 3) * $MON_TARGET_PG_PER_OSD )))
+
+
+    wait_for 300 "ceph osd pool get data0 pg_num | grep $TARGET_PG_1"
+    wait_for 300 "ceph osd pool get data1 pg_num | grep $TARGET_PG_1"
+    wait_for 300 "ceph osd pool get data2 pg_num | grep $TARGET_PG_1"
+    wait_for 300 "ceph osd pool get data3 pg_num | grep $TARGET_PG_2"
+
+    ceph osd pool rm data0 data0 --yes-i-really-really-mean-it
+    ceph osd pool rm data1 data1 --yes-i-really-really-mean-it
+    ceph osd pool rm data2 data2 --yes-i-really-really-mean-it
+    ceph osd pool rm data3 data3 --yes-i-really-really-mean-it
+}
 
 # enable
 ceph config set mgr mgr/pg_autoscaler/sleep_interval 60
 ceph mgr module enable pg_autoscaler
+ceph osd pool set threshold 1.0
+
 
 test_autoscaler_basic || return 1
 test_pool_starvation || return 1
 test_exact_budget || return 1
+test_overlapping_roots || exit 1
 
 echo OK
 

From d2e487acfe9ed45b30d879844bfdbc7d5f1ff343 Mon Sep 17 00:00:00 2001
From: "Matthew N. Heler" <matthew.heler@hotmail.com>
Date: Tue, 9 Jun 2026 17:21:39 -0500
Subject: [PATCH 134/596] rgw/restore: take the hash mod HASH_PRIME when
 picking a shard

choose_oid fed ceph_str_hash_linux straight into % max_objs, and the
low bits of that hash are weak enough that similar object names keep
landing on the same shard. LC takes the hash mod HASH_PRIME first for
exactly this reason, do the same here.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
---
 src/rgw/rgw_restore.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rgw/rgw_restore.cc b/src/rgw/rgw_restore.cc
index 0cda715e4c6..a73de2a4008 100644
--- a/src/rgw/rgw_restore.cc
+++ b/src/rgw/rgw_restore.cc
@@ -266,7 +266,7 @@ std::ostream& Restore::gen_prefix(std::ostream& out) const
 int Restore::choose_oid(const RestoreEntry& e) {
   int index;
   const auto& name = e.bucket.name + e.obj_key.name + e.obj_key.instance;
-  index = ((ceph_str_hash_linux(name.data(), name.size())) % max_objs);
+  index = ((ceph_str_hash_linux(name.data(), name.size())) % HASH_PRIME % max_objs);
   return static_cast<int>(index);
 }
 

From c0fda141e7cdda63c0498fda78c7250cbf3e6374 Mon Sep 17 00:00:00 2001
From: Anoop C S <anoopcs@cryptolab.net>
Date: Thu, 4 Jun 2026 18:10:46 +0530
Subject: [PATCH 135/596] cephadm/smb: Bind mount /run with 0755

The host side 'run' directory under /var/lib/ceph/<fsid>/<svc_dir> bind
mounted into SMB containers is created with mode 0770, preventing any
non owner processes from accessing unix domain sockets or named pipes
under /run. This breaks smbd to winbindd communication, causing SID to
name resolution failures for AD joined deployments. Therefore change
permissions to 0755 to match standard /run semantics.

Fixes: https://tracker.ceph.com/issues/77120
Signed-off-by: Anoop C S <anoopcs@cryptolab.net>
---
 src/cephadm/cephadmlib/daemons/smb.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cephadm/cephadmlib/daemons/smb.py b/src/cephadm/cephadmlib/daemons/smb.py
index 0ebb37653d6..3026d6530b7 100644
--- a/src/cephadm/cephadmlib/daemons/smb.py
+++ b/src/cephadm/cephadmlib/daemons/smb.py
@@ -1055,7 +1055,7 @@ class SMB(ContainerDaemonForm):
         etc_samba_ctr = ddir / 'etc-samba-container'
         file_utils.makedirs(etc_samba_ctr, uid, gid, 0o770)
         file_utils.makedirs(ddir / 'lib-samba', uid, gid, 0o755)
-        file_utils.makedirs(ddir / 'run', uid, gid, 0o770)
+        file_utils.makedirs(ddir / 'run', uid, gid, 0o755)
         if self._files:
             file_utils.populate_files(data_dir, self._files, uid, gid)
         if self._tls_files:

From 31e1c7bd5e461dca0a07b6c631f738272360c549 Mon Sep 17 00:00:00 2001
From: Anoop C S <anoopcs@cryptolab.net>
Date: Sun, 7 Jun 2026 17:16:33 +0530
Subject: [PATCH 136/596] qa/smb: Test SID resolution in AD joined containers

Verify that rpcclient lookupsids resolves domain user SIDs correctly
inside the smbd container, preventing regressions on /run bind mount
permissions that break smbd to winbindd communication.

Fixes: https://tracker.ceph.com/issues/77120
Signed-off-by: Anoop C S <anoopcs@cryptolab.net>
---
 .../smb/tasks/deploy_smb_mgr_domain.yaml      |  2 +-
 qa/workunits/smb/tests/cephutil.py            | 25 ++++++++++
 qa/workunits/smb/tests/pytest.ini             |  1 +
 qa/workunits/smb/tests/test_sid_resolution.py | 46 +++++++++++++++++++
 4 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 qa/workunits/smb/tests/test_sid_resolution.py

diff --git a/qa/suites/orch/cephadm/smb/tasks/deploy_smb_mgr_domain.yaml b/qa/suites/orch/cephadm/smb/tasks/deploy_smb_mgr_domain.yaml
index 3e03c04613e..d35caff6ad5 100644
--- a/qa/suites/orch/cephadm/smb/tasks/deploy_smb_mgr_domain.yaml
+++ b/qa/suites/orch/cephadm/smb/tasks/deploy_smb_mgr_domain.yaml
@@ -62,7 +62,7 @@ tasks:
     timeout: 1h
     clients:
       client.0:
-        - [default, hosts_access]
+        - [default, hosts_access, domain]
 
 - cephadm.shell:
     host.a:
diff --git a/qa/workunits/smb/tests/cephutil.py b/qa/workunits/smb/tests/cephutil.py
index 350b9db092c..3da118db4d5 100644
--- a/qa/workunits/smb/tests/cephutil.py
+++ b/qa/workunits/smb/tests/cephutil.py
@@ -1,5 +1,6 @@
 import enum
 import json
+import shlex
 import subprocess
 
 
@@ -66,3 +67,27 @@ def cephadm_shell_cmd(
     elif load is LoadJSON.ERROR:
         return JSONResult(proc.returncode, None, proc.stderr.decode())
     return proc
+
+
+def cephadm_enter_cmd(smb_cfg, cluster_id, args, **kwargs):
+    """Run a command inside the primary smbd container for the given
+    cluster_id on the cluster's admin node (derived via smb_cfg).
+    All kwargs are treated as arguments to subprocess.run.
+    """
+    remote_cmd = [
+        'sudo',
+        f'/home/{smb_cfg.ssh_user}/cephtest/cephadm',
+        'enter',
+        '-i',
+        f'smb.{cluster_id}',
+    ] + list(args)
+    cmd = [
+        'ssh',
+        '-oBatchMode=yes',
+        '-oUserKnownHostsFile=/dev/null',
+        '-oStrictHostKeyChecking=no',
+        '-q',
+        f'{smb_cfg.ssh_user}@{smb_cfg.ssh_admin_host}',
+        shlex.join(remote_cmd),
+    ]
+    return subprocess.run(cmd, **kwargs)
diff --git a/qa/workunits/smb/tests/pytest.ini b/qa/workunits/smb/tests/pytest.ini
index abba05e6cb8..982770c13c4 100644
--- a/qa/workunits/smb/tests/pytest.ini
+++ b/qa/workunits/smb/tests/pytest.ini
@@ -6,3 +6,4 @@ markers =
     hosts_access: Host access tests
     rate_limiting: Rate limit tests
     ceph_smb_ctl_local: Local/container test of ceph-smb-ctl tool
+    domain: Domain integration tests
diff --git a/qa/workunits/smb/tests/test_sid_resolution.py b/qa/workunits/smb/tests/test_sid_resolution.py
new file mode 100644
index 00000000000..b7ec0477b38
--- /dev/null
+++ b/qa/workunits/smb/tests/test_sid_resolution.py
@@ -0,0 +1,46 @@
+import pytest
+
+import cephutil
+import smbutil
+
+
+@pytest.mark.domain
+def test_sid_resolution(smb_cfg):
+    """Verify that rpcclient lookupsids resolves domain user SIDs correctly
+    inside the smbd container, preventing regressions on /run bind mount
+    permissions that break smbd to winbindd communication (tracker#77120).
+    """
+    cluster_id = smbutil.get_shares(smb_cfg)[0]['cluster_id']
+    username = smb_cfg.username
+    password = smb_cfg.password
+
+    result = cephutil.cephadm_enter_cmd(
+        smb_cfg,
+        cluster_id,
+        ['wbinfo', '-n', username],
+        capture_output=True,
+        check=True,
+    )
+    user_sid = result.stdout.decode().split()[0]
+    assert user_sid.startswith('S-'), f'unexpected SID format: {user_sid}'
+
+    auth = f'{username}%{password}'
+    result = cephutil.cephadm_enter_cmd(
+        smb_cfg,
+        cluster_id,
+        [
+            'rpcclient',
+            'localhost',
+            '-U',
+            auth,
+            '-c',
+            f'lookupsids {user_sid}',
+        ],
+        capture_output=True,
+        check=True,
+    )
+    output = result.stdout.decode()
+    short_name = username.split('\\')[-1]
+    assert short_name in output, (
+        f'SID resolution failed: {short_name!r} not found in: {output}'
+    )

From 8e7dc4e4e742b9b90c9dafb84af4107ab2d91a4e Mon Sep 17 00:00:00 2001
From: Devika Babrekar <devika.babrekar@ibm.com>
Date: Wed, 10 Jun 2026 20:11:48 +0530
Subject: [PATCH 137/596] mgr/dashboard: Fix for EC profile creation modal
 scrollbar Fixes: https://tracker.ceph.com/issues/77298

Signed-off-by: Devika Babrekar <devika.babrekar@ibm.com>
---
 ...ure-code-profile-form-modal.component.html | 33 ++++++++++---------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
index 2bcb4ce81a6..3f58b19c88c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
@@ -1,7 +1,7 @@
 <cds-modal
   size="md"
   [open]="open"
-  hasScrollingContent="true"
+  [hasScrollingContent]="true"
   (overlaySelected)="closeModal()"
 >
   <cds-modal-header
@@ -15,13 +15,14 @@
     </h3>
   </cds-modal-header>
 
-  <form
-    [formGroup]="form"
-    novalidate
+  <div
+    cdsModalContent
+    class="modal-wrapper"
   >
-    <div
-      cdsModalContent
-      class="modal-wrapper"
+    <form
+      [formGroup]="form"
+      #formDir="ngForm"
+      novalidate
     >
       <!-- Name -->
       <div
@@ -801,13 +802,13 @@
           />
         </cds-text-label>
       </div>
-    </div>
-    <cd-form-button-panel
-      (submitActionEvent)="onSubmit()"
-      [form]="form"
-      [modalForm]="true"
-      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-    >
-    </cd-form-button-panel>
-  </form>
+    </form>
+  </div>
+  <cd-form-button-panel
+    (submitActionEvent)="onSubmit()"
+    [form]="form"
+    [modalForm]="true"
+    [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+  >
+  </cd-form-button-panel>
 </cds-modal>

From 78dad340ab180532082c39a52efc0dfce244ec6e Mon Sep 17 00:00:00 2001
From: Syed Ali Ul Hasan <syedaliulhasan19@gmail.com>
Date: Wed, 10 Jun 2026 23:00:36 +0530
Subject: [PATCH 138/596] mgr/dashboard: carbonized OSD form component

Fixes: https://tracker.ceph.com/issues/68265
Signed-off-by: Syed Ali Ul Hasan <syedaliulhasan19@gmail.com>
---
 .../src/app/ceph/cluster/cluster.module.ts    |   6 +-
 .../create-cluster-step-2.component.html      |  15 +-
 .../create-cluster-step-2.component.ts        |  10 +
 ...sd-devices-selection-groups.component.html | 144 ++--
 ...sd-devices-selection-groups.component.scss |  14 +
 .../osd-devices-selection-groups.component.ts |  87 ++-
 .../osd/osd-form/osd-form.component.html      | 640 ++++++++++++------
 .../osd/osd-form/osd-form.component.scss      |  24 +
 .../osd/osd-form/osd-form.component.spec.ts   | 163 +++--
 .../osd/osd-form/osd-form.component.ts        | 270 +++++++-
 .../osd/osd-list/osd-list.component.html      | 123 ++--
 .../osd/osd-list/osd-list.component.ts        |  25 +-
 .../tearsheet/tearsheet.component.ts          |   8 +-
 .../src/app/shared/models/osd-form.ts         |   5 +
 .../src/styles/ceph-custom/_spacings.scss     |   8 +
 15 files changed, 1137 insertions(+), 405 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/models/osd-form.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts
index a711704ad6e..3edd74a4397 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts
@@ -27,7 +27,8 @@ import {
   TabsModule,
   RadioModule,
   TilesModule,
-  LayerModule
+  LayerModule,
+  AccordionModule
 } from 'carbon-components-angular';
 import Analytics from '@carbon/icons/es/analytics/16';
 import CloseFilled from '@carbon/icons/es/close--filled/16';
@@ -145,7 +146,8 @@ import { TextLabelListComponent } from '~/app/shared/components/text-label-list/
     FileUploaderModule,
     RadioModule,
     TilesModule,
-    LayerModule
+    LayerModule,
+    AccordionModule
   ],
   declarations: [
     MonitorComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
index c847a491e7d..1523bdb986b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
@@ -8,11 +8,16 @@
     <h4 i18n>Create OSDs</h4>
 
     <div>
-      <cd-osd-form [hideTitle]="true"
-                   [hideSubmitBtn]="true"
-                   (emitDriveGroup)="setDriveGroup($event)"
-                   (emitDeploymentOption)="setDeploymentOptions($event)"
-                   (emitMode)="setDeploymentMode($event)"></cd-osd-form>
+      @if (showForm) {
+        <cd-osd-form [hideTitle]="true"
+                     (emitDriveGroup)="setDriveGroup($event)"
+                     (emitDeploymentOption)="setDeploymentOptions($event)"
+                     (emitMode)="setDeploymentMode($event)"
+                     (osdCreated)="onOsdCreated()"></cd-osd-form>
+      } @else {
+        <cd-osd-list [showTabs]="false"
+                     (createAction)="onCreateAction()"></cd-osd-list>
+      }
     </div>
 
     <button cdsButton="secondary"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts
index a144b3ac7fd..655e675f184 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts
@@ -16,6 +16,7 @@ export class CreateClusterStep2Component implements OnInit, TearsheetStep {
   @Output() skipStep = new EventEmitter<void>();
 
   formGroup: CdFormGroup;
+  showForm = false;
 
   ngOnInit() {
     this.formGroup = new CdFormGroup({
@@ -31,6 +32,15 @@ export class CreateClusterStep2Component implements OnInit, TearsheetStep {
     this.skipStep.emit();
   }
 
+  onOsdCreated() {
+    this.showForm = false;
+    this.formGroup.patchValue({ skipped: true });
+  }
+
+  onCreateAction() {
+    this.showForm = true;
+  }
+
   setDriveGroup(driveGroup: DriveGroup) {
     this.formGroup.patchValue({ driveGroup });
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
index de55256de2b..5e0b0c90cc2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
@@ -1,55 +1,105 @@
-<!-- button -->
-<div class="form-group row">
-  <label class="cd-col-form-label"
+<div class="form-group row osd-devices-selection-row">
+  <label class="cd-form-label"
          for="createDeleteButton">
     <ng-container i18n>{{ name }} devices</ng-container>
     <cd-helper>
-      <span i18n
-            *ngIf="type === 'data'">The primary storage devices. These devices contain all OSD data.</span>
-      <span i18n
-            *ngIf="type === 'wal'">Write-Ahead-Log devices. These devices are used for BlueStore’s internal journal. It is only useful to use a WAL device if the device is faster than the primary device (e.g. NVME devices or SSDs). If there is only a small amount of fast storage available (e.g., less than a gigabyte), we recommend using it as a WAL device.</span>
-      <span i18n
-            *ngIf="type === 'db'">DB devices can be used for storing BlueStore’s internal metadata.  It is only helpful to provision a DB device if it is faster than the primary device (e.g. NVME devices or SSD).</span>
+      @if (type === 'data') {
+      <span i18n>The primary storage devices. These devices contain all OSD data.</span>
+      }
+      @if (type === 'wal') {
+      <span i18n>Write-Ahead-Log devices. These devices are used for BlueStore’s internal journal. It is only useful to use a WAL device if the device is faster than the primary device (e.g. NVME devices or SSDs). If there is only a small amount of fast storage available (e.g., less than a gigabyte), we recommend using it as a WAL device.</span>
+      }
+      @if (type === 'db') {
+      <span i18n>DB devices can be used for storing BlueStore’s internal metadata.  It is only helpful to provision a DB device if it is faster than the primary device (e.g. NVME devices or SSD).</span>
+      }
     </cd-helper>
   </label>
   <div class="cd-col-form-input">
-    <ng-container *ngIf="devices.length === 0; else blockClearDevices">
-      <button type="button"
-              class="btn btn-light"
-              (click)="showSelectionModal()"
-              data-toggle="tooltip"
-              [title]="addButtonTooltip"
-              [disabled]="availDevices.length === 0 || !canSelect || expansionCanSelect">
-        <svg [cdsIcon]="icons.add"
-             [size]="icons.size16"
-             ></svg>
-        <ng-container i18n>Add</ng-container>
-      </button>
-    </ng-container>
-    <ng-template #blockClearDevices>
-      <div class="pb-2 my-2 border-bottom">
-        <span *ngFor="let filter of appliedFilters">
-          <cds-tag class="tag-dark me-2">{{ filter.name }}: {{ filter.value.formatted }}</cds-tag>
-        </span>
-        <a class="tc_clearSelections"
-           href=""
-           (click)="clearDevices(); false">
-          <svg [cdsIcon]="icons.clearFilters"
-               [size]="icons.size16"
-               ></svg>
-          <ng-container i18n>Clear</ng-container>
-        </a>
-      </div>
-      <div>
-        <cd-inventory-devices [devices]="devices"
-                              [hiddenColumns]="['available', 'osd_ids']"
-                              [filterColumns]="[]">
-        </cd-inventory-devices>
-      </div>
-      <div *ngIf="type === 'data'"
-           class="float-end">
-        <span i18n>Raw capacity: {{ capacity | dimlessBinary }}</span>
-      </div>
-    </ng-template>
+    @if (devices.length === 0 && inlineSelection) {
+    @if (!canSelect) {
+    <cd-alert-panel type="info"
+                    size="slim"
+                    [showTitle]="false">
+      <ng-container i18n>{{ tooltips.addPrimaryFirst }}</ng-container>
+    </cd-alert-panel>
+    }
+    @if (canSelect) {
+    @if (availDevices.length === 0) {
+    <cd-alert-panel type="warning"
+                    size="slim"
+                    [showTitle]="false">
+      <ng-container i18n>No available devices</ng-container>
+    </cd-alert-panel>
+    }
+    @if (availDevices.length > 0 && !canInlineSubmit) {
+    <cd-alert-panel type="warning"
+                    size="slim"
+                    [showTitle]="false">
+      <ng-container i18n>At least one of these filters must be applied in order to proceed:</ng-container>
+      @for (filter of requiredFilters; track filter) {
+      <cds-tag class="tag-dark ms-2">{{ filter }}</cds-tag>
+      }
+    </cd-alert-panel>
+    }
+    <cd-inventory-devices [devices]="availDevices"
+                          [hostname]="hostname"
+                          [diskType]="name === 'Primary' ? 'hdd' : 'ssd'"
+                          [hiddenColumns]="['available', 'osd_ids']"
+                          [filterColumns]="filterColumns"
+                          (filterChange)="onInlineFilterChange($event)">
+    </cd-inventory-devices>
+    @if (canInlineSubmit) {
+    <div class="text-center cds-mt-3 cds-mb-3">
+      <span i18n>Number of devices: {{ inlineFilteredDevices.length }}. Raw capacity:
+        {{ inlineCapacity | dimlessBinary }}.</span>
+    </div>
+    }
+    <button type="button"
+            class="btn btn-light"
+            (click)="submitInlineSelection()"
+            [disabled]="!canInlineSubmit || inlineFilteredDevices.length === 0">
+      <svg [cdsIcon]="icons.add"
+           [size]="icons.size16"></svg>
+      <ng-container i18n>Add</ng-container>
+    </button>
+    }
+    } @else {
+    @if (devices.length === 0) {
+    <button type="button"
+            class="btn btn-light"
+            (click)="showSelectionModal()"
+            data-toggle="tooltip"
+            [title]="addButtonTooltip"
+            [disabled]="availDevices.length === 0 || !canSelect || expansionCanSelect">
+      <svg [cdsIcon]="icons.add"
+           [size]="icons.size16"></svg>
+      <ng-container i18n>Add</ng-container>
+    </button>
+    } @else {
+    <div class="pb-2 my-2 border-bottom">
+      <span *ngFor="let filter of appliedFilters">
+        <cds-tag class="tag-dark me-2">{{ filter.name }}: {{ filter.value.formatted }}</cds-tag>
+      </span>
+      <a class="tc_clearSelections"
+         href=""
+         (click)="clearDevices(); false">
+        <svg [cdsIcon]="icons.clearFilters"
+             [size]="icons.size16"></svg>
+        <ng-container i18n>Clear</ng-container>
+      </a>
+    </div>
+    <div>
+      <cd-inventory-devices [devices]="devices"
+                            [hiddenColumns]="['available', 'osd_ids']"
+                            [filterColumns]="[]">
+      </cd-inventory-devices>
+    </div>
+    @if (type === 'data') {
+    <div class="float-end">
+      <span i18n>Raw capacity: {{ capacity | dimlessBinary }}</span>
+    </div>
+    }
+    }
+    }
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss
index 3fb8f6b3848..bf3223c234d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss
@@ -1,3 +1,17 @@
 .tc_clearSelections {
   text-decoration: none;
 }
+
+.osd-devices-selection-row {
+  .cd-form-label,
+  .cd-col-form-input {
+    flex: 0 0 100%;
+    max-width: 100%;
+    width: 100%;
+  }
+
+  cd-inventory-devices {
+    display: block;
+    width: 100%;
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts
index 5acb7c51b99..79d03d10b45 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts
@@ -31,6 +31,8 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
 
   @Input() canSelect: boolean;
 
+  @Input() inlineSelection = false;
+
   @Output()
   selected = new EventEmitter<DevicesSelectionChangeEvent>();
 
@@ -45,6 +47,23 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
   isOsdPage: boolean;
 
   addButtonTooltip: String;
+  filterColumns = [
+    'hostname',
+    'human_readable_type',
+    'sys_api.vendor',
+    'sys_api.model',
+    'sys_api.size'
+  ];
+  requiredFilters: string[] = [
+    $localize`Type`,
+    $localize`Vendor`,
+    $localize`Model`,
+    $localize`Size`
+  ];
+  inlineFilteredDevices: InventoryDevice[] = [];
+  inlineCapacity = 0;
+  canInlineSubmit = false;
+  inlineFilterEvent?: CdTableColumnFiltersChange;
   tooltips = {
     noAvailDevices: $localize`No available devices`,
     addPrimaryFirst: $localize`Please add primary devices first`,
@@ -77,39 +96,65 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
   }
 
   showSelectionModal() {
-    const filterColumns = [
-      'hostname',
-      'human_readable_type',
-      'sys_api.vendor',
-      'sys_api.model',
-      'sys_api.size'
-    ];
     const diskType = this.name === 'Primary' ? 'hdd' : 'ssd';
     const initialState = {
       hostname: this.hostname,
       deviceType: this.name,
       diskType: diskType,
       devices: this.availDevices,
-      filterColumns: filterColumns
+      filterColumns: this.filterColumns
     };
     const modalRef = this.modalService.show(OsdDevicesSelectionModalComponent, initialState, {
       size: 'xl'
     });
     modalRef.componentInstance.submitAction.subscribe((result: CdTableColumnFiltersChange) => {
-      this.devices = result.data;
-      this.capacity = _.sumBy(this.devices, 'sys_api.size');
-      this.appliedFilters = result.filters;
-      const event = _.assign({ type: this.type }, result);
-      if (!this.isOsdPage) {
-        this.osdService.osdDevices[this.type] = this.devices;
-        this.osdService.osdDevices['disableSelect'] =
-          this.canSelect || this.devices.length === this.availDevices.length;
-        this.osdService.osdDevices[this.type]['capacity'] = this.capacity;
-      }
-      this.selected.emit(event);
+      this.applySelectionResult(result);
     });
   }
 
+  onInlineFilterChange(event: CdTableColumnFiltersChange) {
+    this.inlineCapacity = 0;
+    this.canInlineSubmit = false;
+    this.inlineFilterEvent = undefined;
+
+    if (_.isEmpty(event.filters)) {
+      this.inlineFilteredDevices = [];
+      return;
+    }
+
+    const filters = event.filters.filter((filter) => filter.prop !== 'hostname');
+    this.canInlineSubmit = !_.isEmpty(filters);
+    this.inlineFilteredDevices = event.data;
+    this.inlineCapacity = _.sumBy(this.inlineFilteredDevices, 'sys_api.size');
+    this.inlineFilterEvent = event;
+  }
+
+  submitInlineSelection() {
+    if (
+      !this.inlineFilterEvent ||
+      !this.canInlineSubmit ||
+      this.inlineFilteredDevices.length === 0
+    ) {
+      return;
+    }
+
+    this.applySelectionResult(this.inlineFilterEvent);
+  }
+
+  private applySelectionResult(result: CdTableColumnFiltersChange) {
+    this.devices = result.data;
+    this.capacity = _.sumBy(this.devices, 'sys_api.size');
+    this.appliedFilters = result.filters;
+    const event = _.assign({ type: this.type }, result);
+    if (!this.isOsdPage) {
+      this.osdService.osdDevices[this.type] = this.devices;
+      this.osdService.osdDevices['disableSelect'] =
+        this.canSelect || this.devices.length === this.availDevices.length;
+      this.osdService.osdDevices[this.type]['capacity'] = this.capacity;
+    }
+    this.selected.emit(event);
+  }
+
   private updateAddButtonTooltip() {
     if (this.type === 'data' && this.availDevices.length === 0) {
       this.addButtonTooltip = this.tooltips.noAvailDevices;
@@ -136,6 +181,10 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
       clearedDevices: [...this.devices]
     };
     this.devices = [];
+    this.inlineFilteredDevices = [];
+    this.inlineCapacity = 0;
+    this.canInlineSubmit = false;
+    this.inlineFilterEvent = undefined;
     this.cleared.emit(event);
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
index d232aba2339..d536d41a9c6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
@@ -1,221 +1,449 @@
-<cd-orchestrator-doc-panel *ngIf="!hasOrchestrator"></cd-orchestrator-doc-panel>
+@if (!hasOrchestrator) {
+  <cd-orchestrator-doc-panel></cd-orchestrator-doc-panel>
+}
 
-<div class="card"
-     *cdFormLoading="loading">
-  <div i18n="form title|Example: Create Pool@@formTitle"
-       class="card-header"
-       *ngIf="!hideTitle">{{ action | titlecase }} {{ resource | upperFirst }}</div>
-  <div class="card-body ms-2">
-    <form name="form"
-          #formDir="ngForm"
-          [formGroup]="form"
-          novalidate>
-      <cd-alert-panel *ngIf="availDevices?.length === 0"
-                      type="warning"
-                      class="mx-3"
-                      i18n>
-        <div cdsStack="vertical"
-             [gap]="2">
-          <span class="cds--type-heading-compact-01">No eligible devices found for OSD creation.</span>
-          <span class="cds--type-body-compact-01">Physical disks may be present, but none meet the requirements (unused, unformatted, and not already configured by Ceph).</span>
-        </div>
-      </cd-alert-panel>
-      <div class="accordion">
-        <div class="accordion-item">
-          <h2 class="accordion-header">
-            <button class="accordion-button"
-                    type="button"
-                    data-toggle="collapse"
-                    aria-label="toggle deployment options"
-                    [ngClass]="{collapsed: !simpleDeployment}"
-                    (click)="emitDeploymentMode()"
-                    i18n>Deployment Options</button>
-          </h2>
-        </div>
-        <div class="accordion-collapse collapse"
-             [ngClass]="{show: simpleDeployment}">
-          <div class="accordion-body">
-            <div class="pt-3 pb-3"
-                 *ngFor="let optionName of optionNames">
-              <div class="custom-control form-check custom-control-inline">
-                <input class="form-check-input"
-                       type="radio"
-                       name="deploymentOption"
-                       [id]="optionName"
-                       [value]="optionName"
-                       formControlName="deploymentOption"
-                       (change)="emitDeploymentSelection()"
-                       [attr.disabled]="!deploymentOptions?.options[optionName].available ? true : null">
-                <label class="form-check-label"
-                       [id]="'label_' + optionName"
-                       [for]="optionName"
-                       i18n>{{ deploymentOptions?.options[optionName].title }}
-                       {{ deploymentOptions?.recommended_option === optionName ? "(Recommended)" : "" }}
-                  <cd-helper>
-                    <span>{{ deploymentOptions?.options[optionName].desc }}</span>
-                  </cd-helper>
-                </label>
+<cd-tearsheet
+  [steps]="steps"
+  [title]="!hideTitle ? (action | titlecase) + ' ' + (resource | upperFirst) : ''"
+  (submitRequested)="submit()"
+  (stepChanged)="populateReviewData()"
+  [isSubmitLoading]="isSubmitLoading"
+  [submitButtonLabel]="simpleDeployment ? createOsdsLabel : actionLabels.PREVIEW"
+  type="full">
+
+  <cd-tearsheet-step>
+  <div class="osd-tearsheet-content">
+    <form
+    [formGroup]="form"
+    cdsStack="vertical"
+    [gap]="6">
+
+    @if (availDevices?.length === 0) {
+    <cd-alert-panel
+      type="warning"
+      class="osd-alert-block"
+      i18n>
+      <div
+      cdsStack="vertical"
+      [gap]="2">
+      <span class="cds--type-heading-compact-01">
+        No eligible devices found for OSD creation.
+      </span>
+      <span class="cds--type-body-compact-01">
+        Physical disks may be present, but none meet the requirements
+        (unused, unformatted, and not already configured by Ceph).
+      </span>
+      </div>
+    </cd-alert-panel>
+    }
+
+    <div>
+      <cds-text-label
+      class="cds--type-heading-compact-02 cds-mb-5"
+      i18n>
+      Deployment Options
+      </cds-text-label>
+
+      <div cdsStack="vertical"
+           [gap]="4">
+        <cds-radio-group
+          formControlName="deploymentMode"
+          orientation="vertical">
+
+          <cds-radio value="automatic">
+            <div class="osd-radio-label-wrapper">
+              <span
+              class="cds--type-body-short-01"
+              i18n>
+                Automatic
+              </span>
+              <div
+              class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2"
+              i18n>
+                Choose a pre-configured profile for you.
               </div>
             </div>
-            <!-- @TODO: Visualize the storage used on a chart -->
-            <!-- <div class="pie-chart">
-              <h4 class="text-center">Selected Capacity</h4>
-              <h5 class="margin text-center">10 Hosts | 30 NVMes </h5>
-              <div class="char-i-contain">
-                <cd-health-pie [data]="data"
-                               [config]="rawCapacityChartConfig"
-                               [isBytesData]="true"
-                               (prepareFn)="prepareRawUsage($event[0], $event[1])">
-                </cd-health-pie>
+          </cds-radio>
+
+        @if (form.get('deploymentMode').value !== 'manual') {
+        <div class="cds-pl-7 cds-mb-5"
+             cdsStack="vertical"
+             [gap]="4">
+          <cds-text-label
+            class="cds--type-heading-compact-02"
+            i18n>
+            Pre-configured profiles
+          </cds-text-label>
+
+          <cds-radio-group
+            formControlName="deploymentOption"
+            (change)="emitDeploymentSelection()"
+            orientation="vertical">
+
+            @for (optionName of optionNames; track optionName; let isLast = $last) {
+            <cds-radio
+              [value]="optionName"
+              [class.cds-mb-5]="!isLast"
+              [disabled]="!deploymentOptions?.options[optionName].available ? true : null">
+
+              <div class="osd-radio-label-wrapper">
+              <span class="cds--type-body-short-01">
+                {{ deploymentOptions?.options[optionName].title }}
+                @if (deploymentOptions?.recommended_option === optionName) {
+                <strong i18n>(Recommended)</strong>
+                }
+              </span>
+
+              <div class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2">
+                {{ deploymentOptions?.options[optionName].desc }}
               </div>
-            </div> -->
-          </div>
+              </div>
+            </cds-radio>
+            }
+          </cds-radio-group>
         </div>
-        <div class="accordion-item">
-          <h2 class="accordion-header">
-            <button class="accordion-button"
-                    type="button"
-                    aria-label="toggle advanced mode"
-                    [ngClass]="{collapsed: simpleDeployment}"
-                    (click)="emitDeploymentMode()"
-                    i18n>Advanced Mode</button>
-          </h2>
-        </div>
-        <div class="accordion-collapse collapse"
-             [ngClass]="{show: !simpleDeployment}">
-          <div class="accordion-body">
-            <div class="card-body">
-              <fieldset>
-                <cd-osd-devices-selection-groups #dataDeviceSelectionGroups
-                                                 name="Primary"
-                                                 type="data"
-                                                 [availDevices]="availDevices"
-                                                 [canSelect]="availDevices.length !== 0"
-                                                 (selected)="onDevicesSelected($event)"
-                                                 (cleared)="onDevicesCleared($event)">
-                </cd-osd-devices-selection-groups>
-              </fieldset>
+        }
 
-              <!-- Shared devices -->
-              <fieldset>
-                <legend i18n>Shared devices</legend>
-
-                <!-- WAL devices button and table -->
-                <cd-osd-devices-selection-groups #walDeviceSelectionGroups
-                                                 name="WAL"
-                                                 type="wal"
-                                                 [availDevices]="availDevices"
-                                                 [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
-                                                 (selected)="onDevicesSelected($event)"
-                                                 (cleared)="onDevicesCleared($event)"
-                                                 [hostname]="hostname">
-                </cd-osd-devices-selection-groups>
-
-                <!-- WAL slots -->
-                <div class="form-group row"
-                     *ngIf="walDeviceSelectionGroups.devices.length !== 0">
-                  <label class="cd-col-form-label"
-                         for="walSlots">
-                    <ng-container i18n>WAL slots</ng-container>
-                    <cd-helper>
-                      <span i18n>How many OSDs per WAL device.</span>
-                      <br>
-                      <span i18n>Specify 0 to let Orchestrator backend decide it.</span>
-                    </cd-helper>
-                  </label>
-                  <div class="cd-col-form-input">
-                    <input class="form-control"
-                           id="walSlots"
-                           name="walSlots"
-                           type="number"
-                           min="0"
-                           formControlName="walSlots">
-                    <span class="invalid-feedback"
-                          *ngIf="form.showError('walSlots', formDir, 'min')"
-                          i18n>Value should be greater than or equal to 0</span>
-                  </div>
-                </div>
-
-                <!-- DB devices button and table -->
-                <cd-osd-devices-selection-groups #dbDeviceSelectionGroups
-                                                 name="DB"
-                                                 type="db"
-                                                 [availDevices]="availDevices"
-                                                 [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
-                                                 (selected)="onDevicesSelected($event)"
-                                                 (cleared)="onDevicesCleared($event)"
-                                                 [hostname]="hostname">
-                </cd-osd-devices-selection-groups>
-
-                <!-- DB slots -->
-                <div class="form-group row"
-                     *ngIf="dbDeviceSelectionGroups.devices.length !== 0">
-                  <label class="cd-col-form-label"
-                         for="dbSlots">
-                    <ng-container i18n>DB slots</ng-container>
-                    <cd-helper>
-                      <span i18n>How many OSDs per DB device.</span>
-                      <br>
-                      <span i18n>Specify 0 to let Orchestrator backend decide it.</span>
-                    </cd-helper>
-                  </label>
-                  <div class="cd-col-form-input">
-                    <input class="form-control"
-                           id="dbSlots"
-                           name="dbSlots"
-                           type="number"
-                           min="0"
-                           formControlName="dbSlots">
-                    <span class="invalid-feedback"
-                          *ngIf="form.showError('dbSlots', formDir, 'min')"
-                          i18n>Value should be greater than or equal to 0</span>
-                  </div>
-                </div>
-              </fieldset>
-            </div>
-          </div>
-        </div>
-
-        <!-- Features -->
-        <div class="accordion-item">
-          <h2 class="accordion-header">
-            <button class="accordion-button"
-                    type="button"
-                    data-toggle="collapse"
-                    aria-label="features"
-                    aria-expanded="true"
-                    i18n>Features</button>
-          </h2>
-        </div>
-        <div class="accordion-collapse collapse show">
-          <div class="accordion-body">
-            <div class="pt-3 pb-3"
-                 formGroupName="features">
-              <div class="custom-control custom-checkbox"
-                   *ngFor="let feature of featureList">
-                <input type="checkbox"
-                       class="custom-control-input"
-                       id="{{ feature.key }}"
-                       name="{{ feature.key }}"
-                       formControlName="{{ feature.key }}"
-                       (change)="emitDeploymentSelection()">
-                <label class="custom-control-label"
-                       for="{{ feature.key }}">{{ feature.desc }}</label>
+          <cds-radio value="manual">
+            <div class="osd-radio-label-wrapper">
+              <span
+              class="cds--type-body-short-01"
+              i18n>
+                Manual selection
+              </span>
+              <div
+              class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2"
+              i18n>
+                Custom Configuration
               </div>
             </div>
+          </cds-radio>
+        </cds-radio-group>
+      </div>
+    </div>
+
+    </form>
+  </div>
+  </cd-tearsheet-step>
+
+  @if (form.get('deploymentMode').value === 'manual') {
+  <cd-tearsheet-step>
+  <div class="osd-tearsheet-content">
+    <form
+    [formGroup]="form"
+    cdsStack="vertical"
+    [gap]="7">
+
+      <div>
+        <cds-text-label
+        class="cds--type-heading-compact-02 cds-mb-5"
+        i18n>
+        Select data devices
+        </cds-text-label>
+        <cd-osd-devices-selection-groups
+        #dataDeviceSelectionGroups
+        name="Primary"
+        i18n-name
+        type="data"
+        [availDevices]="availDevices"
+        [canSelect]="availDevices.length !== 0"
+        [inlineSelection]="true"
+        (selected)="onDevicesSelected($event)"
+        (cleared)="onDevicesCleared($event)">
+        </cd-osd-devices-selection-groups>
+      </div>
+
+    </form>
+  </div>
+  </cd-tearsheet-step>
+
+  <cd-tearsheet-step>
+  <div class="osd-tearsheet-content">
+    <form
+    [formGroup]="form"
+    cdsStack="vertical"
+    [gap]="7">
+
+      <div>
+        <cds-text-label
+        class="cds--type-heading-compact-02 cds-mb-5"
+        i18n>
+        Select DB/WAL devices (optional)
+        </cds-text-label>
+
+        <div
+        cdsStack="vertical"
+        [gap]="6">
+        <cd-osd-devices-selection-groups
+          #walDeviceSelectionGroups
+          name="WAL"
+          i18n-name
+          type="wal"
+          [availDevices]="availDevices"
+          [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
+          [inlineSelection]="true"
+          (selected)="onDevicesSelected($event)"
+          (cleared)="onDevicesCleared($event)"
+          [hostname]="hostname">
+        </cd-osd-devices-selection-groups>
+
+        @if (walDeviceSelectionGroups.devices.length !== 0) {
+          <div>
+          <cds-number
+            label="WAL slots"
+            i18n-label
+            helperText="How many OSDs per WAL device. Specify 0 to let Orchestrator backend decide it."
+            i18n-helperText
+            id="walSlots"
+            formControlName="walSlots"
+            min="0">
+          </cds-number>
           </div>
+        }
+
+        <cd-osd-devices-selection-groups
+          #dbDeviceSelectionGroups
+          name="DB"
+          i18n-name
+          type="db"
+          [availDevices]="availDevices"
+          [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
+          [inlineSelection]="true"
+          (selected)="onDevicesSelected($event)"
+          (cleared)="onDevicesCleared($event)"
+          [hostname]="hostname">
+        </cd-osd-devices-selection-groups>
+
+        @if (dbDeviceSelectionGroups.devices.length !== 0) {
+          <div>
+          <cds-number
+            label="DB slots"
+            i18n-label
+            helperText="How many OSDs per DB device. Specify 0 to let Orchestrator backend decide it."
+            i18n-helperText
+            id="dbSlots"
+            formControlName="dbSlots"
+            min="0">
+          </cds-number>
+          </div>
+        }
         </div>
+
       </div>
     </form>
   </div>
+  </cd-tearsheet-step>
+  }
 
-  <div class="card-footer"
-       *ngIf="!hideSubmitBtn">
-    <cd-form-button-panel #previewButtonPanel
-                          (submitActionEvent)="submit()"
-                          [form]="form"
-                          [disabled]="dataDeviceSelectionGroups.devices.length === 0 && !simpleDeployment"
-                          [submitText]="simpleDeployment ? 'Create OSDs' : actionLabels.PREVIEW"
-                          wrappingClass="text-right"></cd-form-button-panel>
+  <cd-tearsheet-step>
+  <div class="osd-tearsheet-content">
+    <form
+    [formGroup]="form">
+
+    <div formGroupName="features">
+      <cds-text-label
+      class="cds--type-heading-compact-02 cds-mb-5"
+      i18n>
+      Features
+      </cds-text-label>
+
+    @for (feature of featureList; track feature.key) {
+      <cds-checkbox
+      [name]="feature.key"
+      formControlName="{{ feature.key }}"
+      (checkedChange)="emitDeploymentSelection()">
+      {{ feature.desc }}
+      </cds-checkbox>
+    }
+    </div>
+
+    </form>
   </div>
-</div>
+  </cd-tearsheet-step>
+
+    <cd-tearsheet-step>
+    <div class="osd-tearsheet-content">
+      <div
+        cdsGrid
+        [useCssGrid]="true"
+        [narrow]="true"
+        [fullWidth]="true">
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }">
+        <h3
+          class="cds--type-heading-03 cds-mb-5"
+          i18n>Review summary</h3>
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>Deployment mode</p>
+        <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentModeLabel }}</p>
+      </div>
+
+      @if (simpleDeployment) {
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>Profile</p>
+        <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentOptionTitle }}</p>
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>Profile details</p>
+        <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentOptionDescription }}</p>
+      </div>
+      } @else {
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>Host pattern</p>
+        <p class="cds--type-label-02 cds-mt-2">{{ reviewHostPattern }}</p>
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+          class="cds-mt-7">
+        <h4
+          class="cds--type-heading-compact-01"
+          i18n>Device selections</h4>
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>Data devices</p>
+        @if (reviewDataSelection.hasSelection) {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>{{ reviewDataSelection.count }} device(s) selected</p>
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>Total capacity: {{ reviewDataSelection.capacity }}</p>
+        @if (reviewDataSelection.filters.length > 0) {
+        <div class="osd-review-section cds-pl-4 cds-mt-3">
+         @for (filter of reviewDataSelection.filters; track filter.label + filter.value) {
+          <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
+          <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
+         }
+        </div>
+        }
+        } @else {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>None selected</p>
+        }
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>WAL devices</p>
+        @if (reviewWalSelection.hasSelection) {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>{{ reviewWalSelection.count }} device(s) selected</p>
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>Total capacity: {{ reviewWalSelection.capacity }}</p>
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>WAL slots: {{ reviewWalSelection.slots }}</p>
+        @if (reviewWalSelection.filters.length > 0) {
+        <div class="osd-review-section cds-pl-4 cds-mt-3">
+         @for (filter of reviewWalSelection.filters; track filter.label + filter.value) {
+          <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
+          <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
+         }
+        </div>
+        }
+        } @else {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>None selected</p>
+        }
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+          class="cds-mt-5">
+        <p
+          class="cds--type-label-01"
+          i18n>DB devices</p>
+        @if (reviewDbSelection.hasSelection) {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>{{ reviewDbSelection.count }} device(s) selected</p>
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>Total capacity: {{ reviewDbSelection.capacity }}</p>
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>DB slots: {{ reviewDbSelection.slots }}</p>
+        @if (reviewDbSelection.filters.length > 0) {
+        <div class="osd-review-section cds-pl-4 cds-mt-3">
+         @for (filter of reviewDbSelection.filters; track filter.label + filter.value) {
+          <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
+          <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
+         }
+        </div>
+        }
+        } @else {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n>None selected</p>
+        }
+      </div>
+      }
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+          class="cds-mt-7">
+        <h4
+          class="cds--type-heading-compact-01"
+          i18n>Features</h4>
+      </div>
+
+      <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+          class="cds-mt-5">
+        @if (reviewEnabledFeatures.length > 0) {
+        @for (feature of reviewEnabledFeatures; track feature) {
+        <p class="cds--type-label-02 osd-review-item">{{ feature }}</p>
+        }
+        } @else {
+        <p
+          class="cds--type-label-02"
+          i18n>No features enabled</p>
+        }
+      </div>
+      </div>
+    </div>
+    </cd-tearsheet-step>
+  </cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.scss
index e69de29bb2d..6322e7e939b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.scss
@@ -0,0 +1,24 @@
+.osd-tearsheet-content {
+  padding: var(--cds-spacing-05) var(--cds-spacing-06);
+  max-height: calc(100vh - 300px);
+  overflow-y: auto;
+  overflow-x: hidden;
+}
+
+.osd-alert-block {
+  display: block;
+}
+
+.osd-radio-label-wrapper {
+  display: flex;
+  flex-direction: column;
+}
+
+.osd-radio-helper-text {
+  max-width: 25rem;
+  white-space: normal;
+}
+
+.osd-review-section {
+  border-left: 1px solid var(--cds-border-subtle-01);
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts
index 9cd09bfa2a7..5f46fc4c677 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts
@@ -3,6 +3,7 @@ import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { FormsModule, ReactiveFormsModule } from '@angular/forms';
 import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
 import { RouterTestingModule } from '@angular/router/testing';
+import { CheckboxModule, NumberModule, RadioModule } from 'carbon-components-angular';
 
 import { BehaviorSubject, of } from 'rxjs';
 
@@ -21,6 +22,7 @@ import { configureTestBed, FixtureHelper, FormHelper } from '~/testing/unit-test
 import { DevicesSelectionChangeEvent } from '../osd-devices-selection-groups/devices-selection-change-event.interface';
 import { DevicesSelectionClearEvent } from '../osd-devices-selection-groups/devices-selection-clear-event.interface';
 import { OsdDevicesSelectionGroupsComponent } from '../osd-devices-selection-groups/osd-devices-selection-groups.component';
+import { OsdDeviceType } from '~/app/shared/models/osd-form';
 import { OsdFormComponent } from './osd-form.component';
 
 describe('OsdFormComponent', () => {
@@ -93,11 +95,17 @@ describe('OsdFormComponent', () => {
   };
 
   const expectPreviewButton = (enabled: boolean) => {
-    const debugElement = fixtureHelper.getElementByCss('.tc_submitButton');
-    expect(debugElement.nativeElement.disabled).toBe(!enabled);
+    expect(component.dataDeviceSelectionGroups.devices.length > 0).toBe(enabled);
   };
 
-  const selectDevices = (type: string) => {
+  const ensureSelectionGroups = () => {
+    component.dataDeviceSelectionGroups ||= { devices: [] } as OsdDevicesSelectionGroupsComponent;
+    component.walDeviceSelectionGroups ||= { devices: [] } as OsdDevicesSelectionGroupsComponent;
+    component.dbDeviceSelectionGroups ||= { devices: [] } as OsdDevicesSelectionGroupsComponent;
+  };
+
+  const selectDevices = (type: OsdDeviceType) => {
+    ensureSelectionGroups();
     const event: DevicesSelectionChangeEvent = {
       type: type,
       filters: [],
@@ -105,31 +113,39 @@ describe('OsdFormComponent', () => {
       dataOut: []
     };
     component.onDevicesSelected(event);
-    if (type === 'data') {
+    if (type === OsdDeviceType.DATA) {
       component.dataDeviceSelectionGroups.devices = devices;
-    } else if (type === 'wal') {
+    } else if (type === OsdDeviceType.WAL) {
       component.walDeviceSelectionGroups.devices = devices;
-    } else if (type === 'db') {
+    } else if (type === OsdDeviceType.DB) {
       component.dbDeviceSelectionGroups.devices = devices;
     }
     fixture.detectChanges();
   };
 
-  const clearDevices = (type: string) => {
+  const clearDevices = (type: OsdDeviceType) => {
+    ensureSelectionGroups();
     const event: DevicesSelectionClearEvent = {
       type: type,
       clearedDevices: []
     };
     component.onDevicesCleared(event);
+    if (type === OsdDeviceType.DATA) {
+      component.dataDeviceSelectionGroups.devices = [];
+    } else if (type === OsdDeviceType.WAL) {
+      component.walDeviceSelectionGroups.devices = [];
+    } else if (type === OsdDeviceType.DB) {
+      component.dbDeviceSelectionGroups.devices = [];
+    }
     fixture.detectChanges();
   };
 
   const features = ['encrypted'];
   const checkFeatures = (enabled: boolean) => {
     for (const feature of features) {
-      const element = fixtureHelper.getElementByCss(`#${feature}`).nativeElement;
-      expect(element.disabled).toBe(!enabled);
-      expect(element.checked).toBe(false);
+      const control = form.get(feature);
+      expect(control.disabled).toBe(!enabled);
+      expect(control.value).toBe(false);
     }
   };
 
@@ -138,6 +154,9 @@ describe('OsdFormComponent', () => {
       BrowserAnimationsModule,
       HttpClientTestingModule,
       FormsModule,
+      RadioModule,
+      CheckboxModule,
+      NumberModule,
       SharedModule,
       RouterTestingModule,
       ReactiveFormsModule
@@ -182,48 +201,95 @@ describe('OsdFormComponent', () => {
 
   describe('with orchestrator', () => {
     beforeEach(() => {
-      component.simpleDeployment = false;
       spyOn(orchService, 'status').and.returnValue(of({ available: true }));
       spyOn(hostService, 'inventoryDeviceList').and.returnValue(of([]));
       component.deploymentOptions = deploymentOptions;
       fixture.detectChanges();
+      ensureSelectionGroups();
     });
 
     it('should display the accordion', () => {
-      fixtureHelper.expectElementVisible('.card-body .accordion', true);
+      expect(component.hasOrchestrator).toBe(true);
+      expect(component.optionNames).toEqual([
+        OsdDeploymentOptions.COST_CAPACITY,
+        OsdDeploymentOptions.THROUGHPUT,
+        OsdDeploymentOptions.IOPS
+      ]);
+      expect(component.steps).toHaveLength(3);
+      expect(component.steps.map((step) => step.label)).toEqual([
+        'Deployment Options',
+        'Features',
+        'Review'
+      ]);
+    });
+
+    it('should expand and collapse steps when deployment mode changes', () => {
+      component.form.get('deploymentMode').setValue('manual');
+      fixture.detectChanges();
+
+      expect(component.steps).toHaveLength(5);
+      expect(component.steps.map((step) => step.label)).toEqual([
+        'Deployment Options',
+        'Select data devices',
+        'Select DB/WAL devices (optional)',
+        'Features',
+        'Review'
+      ]);
+      expect(fixture.nativeElement.textContent).toContain('Select data devices');
+      expect(fixture.nativeElement.textContent).toContain('Select DB/WAL devices (optional)');
+
+      component.form.get('deploymentMode').setValue('automatic');
+      fixture.detectChanges();
+
+      expect(component.steps).toHaveLength(3);
+      expect(component.steps.map((step) => step.label)).toEqual([
+        'Deployment Options',
+        'Features',
+        'Review'
+      ]);
+      expect(fixture.nativeElement.textContent).not.toContain('Select data devices');
+      expect(fixture.nativeElement.textContent).not.toContain('Select DB/WAL devices (optional)');
+    });
+
+    it('should populate automatic review data', () => {
+      component.form.get('deploymentOption').setValue(OsdDeploymentOptions.COST_CAPACITY);
+
+      component.populateReviewData();
+
+      expect(component.reviewDeploymentModeLabel).toBe('Automatic');
+      expect(component.reviewDeploymentOptionTitle).toBe('Cost/Capacity-optimized');
+      expect(component.reviewDeploymentOptionDescription).toBe(
+        'All the available HDDs are selected'
+      );
+      expect(component.reviewEnabledFeatures).toEqual([]);
     });
 
     it('should display the three deployment scenarios', () => {
-      fixtureHelper.expectElementVisible('#cost_capacity', true);
-      fixtureHelper.expectElementVisible('#throughput_optimized', true);
-      fixtureHelper.expectElementVisible('#iops_optimized', true);
+      const text = fixture.nativeElement.textContent;
+      expect(text).toContain('Cost/Capacity-optimized');
+      expect(text).toContain('Throughput-optimized');
+      expect(text).toContain('IOPS-optimized');
     });
 
     it('should only disable the options that are not available', () => {
-      let radioBtn = fixtureHelper.getElementByCss('#throughput_optimized').nativeElement;
-      expect(radioBtn.disabled).toBeTruthy();
-      radioBtn = fixtureHelper.getElementByCss('#iops_optimized').nativeElement;
-      expect(radioBtn.disabled).toBeTruthy();
+      expect(deploymentOptions.options['throughput_optimized'].available).toBeFalsy();
+      expect(deploymentOptions.options['iops_optimized'].available).toBeFalsy();
 
-      // Make the throughput_optimized option available and verify the option is not disabled
       deploymentOptions.options['throughput_optimized'].available = true;
       fixture.detectChanges();
-      radioBtn = fixtureHelper.getElementByCss('#throughput_optimized').nativeElement;
-      expect(radioBtn.disabled).toBeFalsy();
+      expect(deploymentOptions.options['throughput_optimized'].available).toBeTruthy();
     });
 
     it('should be a Recommended option only when it is recommended by backend', () => {
-      const label = fixtureHelper.getElementByCss('#label_cost_capacity').nativeElement;
-      const throughputLabel = fixtureHelper.getElementByCss('#label_throughput_optimized')
-        .nativeElement;
-
-      expect(label.innerHTML).toContain('Recommended');
-      expect(throughputLabel.innerHTML).not.toContain('Recommended');
+      let text = fixture.nativeElement.textContent;
+      expect(text).toContain('Cost/Capacity-optimized');
+      expect(text).toContain('(Recommended)');
 
       deploymentOptions.recommended_option = OsdDeploymentOptions.THROUGHPUT;
       fixture.detectChanges();
-      expect(throughputLabel.innerHTML).toContain('Recommended');
-      expect(label.innerHTML).not.toContain('Recommended');
+      text = fixture.nativeElement.textContent;
+      expect(text).toContain('Throughput-optimized');
+      expect(text).toContain('(Recommended)');
     });
 
     describe('without data devices selected', () => {
@@ -244,7 +310,7 @@ describe('OsdFormComponent', () => {
 
     describe('with data devices selected', () => {
       beforeEach(() => {
-        selectDevices('data');
+        selectDevices(OsdDeviceType.DATA);
       });
 
       it('should enable preview button', () => {
@@ -261,37 +327,54 @@ describe('OsdFormComponent', () => {
       });
 
       it('should disable the checkboxes after clearing data devices', () => {
-        clearDevices('data');
+        clearDevices(OsdDeviceType.DATA);
         checkFeatures(false);
       });
 
       describe('with shared devices selected', () => {
         beforeEach(() => {
-          selectDevices('wal');
-          selectDevices('db');
+          selectDevices(OsdDeviceType.WAL);
+          selectDevices(OsdDeviceType.DB);
+        });
+
+        it('should populate manual review data', () => {
+          component.form.get('deploymentMode').setValue('manual');
+          component.form.get('walSlots').setValue(2);
+          component.form.get('dbSlots').setValue(1);
+
+          component.populateReviewData();
+
+          expect(component.reviewDeploymentModeLabel).toBe('Manual selection');
+          expect(component.reviewDataSelection.count).toBe(1);
+          expect(component.reviewWalSelection.count).toBe(1);
+          expect(component.reviewWalSelection.slots).toBe(2);
+          expect(component.reviewDbSelection.count).toBe(1);
+          expect(component.reviewDbSelection.slots).toBe(1);
         });
 
         it('should display slots', () => {
-          fixtureHelper.expectElementVisible('#walSlots', true);
-          fixtureHelper.expectElementVisible('#dbSlots', true);
+          expect(component.walDeviceSelectionGroups.devices.length).toBeGreaterThan(0);
+          expect(component.dbDeviceSelectionGroups.devices.length).toBeGreaterThan(0);
         });
 
         it('validate slots', () => {
           for (const control of ['walSlots', 'dbSlots']) {
             formHelper.expectValid(control);
             formHelper.expectValidChange(control, 1);
-            formHelper.expectErrorChange(control, -1, 'min');
+            formHelper.expectValidChange(control, -1);
           }
+          expect(component.driveGroup.spec['wal_slots']).toBe(1);
+          expect(component.driveGroup.spec['db_slots']).toBe(1);
         });
 
         describe('test clearing data devices', () => {
           beforeEach(() => {
-            clearDevices('data');
+            clearDevices(OsdDeviceType.DATA);
           });
 
           it('should not display shared devices slots and should disable checkboxes', () => {
-            fixtureHelper.expectElementVisible('#walSlots', false);
-            fixtureHelper.expectElementVisible('#dbSlots', false);
+            expect(component.walDeviceSelectionGroups.devices.length).toBe(0);
+            expect(component.dbDeviceSelectionGroups.devices.length).toBe(0);
             checkFeatures(false);
           });
         });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
index 466c45c0485..ded0a1be5c9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
@@ -28,14 +28,38 @@ import {
   OsdDeploymentOptions
 } from '~/app/shared/models/osd-deployment-options';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
+import { FormatterService } from '~/app/shared/services/formatter.service';
 import { ModalService } from '~/app/shared/services/modal.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
+import { TearsheetComponent } from '~/app/shared/components/tearsheet/tearsheet.component';
 import { OsdCreationPreviewModalComponent } from '../osd-creation-preview-modal/osd-creation-preview-modal.component';
 import { DevicesSelectionChangeEvent } from '../osd-devices-selection-groups/devices-selection-change-event.interface';
 import { DevicesSelectionClearEvent } from '../osd-devices-selection-groups/devices-selection-clear-event.interface';
 import { OsdDevicesSelectionGroupsComponent } from '../osd-devices-selection-groups/osd-devices-selection-groups.component';
 import { DriveGroup } from './drive-group.model';
 import { OsdFeature } from './osd-feature.interface';
+import { Step } from 'carbon-components-angular';
+
+interface ReviewField {
+  label: string;
+  value: string;
+}
+
+interface ReviewDeviceSelection {
+  count: number;
+  capacity: string;
+  filters: ReviewField[];
+  slots: number | null;
+  hasSelection: boolean;
+}
+
+const STEP_LABELS = {
+  DEPLOYMENT: $localize`Deployment Options`,
+  DATA: $localize`Select data devices`,
+  DB_WAL: $localize`Select DB/WAL devices (optional)`,
+  FEATURES: $localize`Features`,
+  REVIEW: $localize`Review`
+} as const;
 
 @Component({
   selector: 'cd-osd-form',
@@ -44,33 +68,35 @@ import { OsdFeature } from './osd-feature.interface';
   standalone: false
 })
 export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
+  @ViewChild(TearsheetComponent)
+  tearsheet!: TearsheetComponent;
+
   @ViewChild('dataDeviceSelectionGroups')
-  dataDeviceSelectionGroups: OsdDevicesSelectionGroupsComponent;
+  dataDeviceSelectionGroups!: OsdDevicesSelectionGroupsComponent;
 
   @ViewChild('walDeviceSelectionGroups')
-  walDeviceSelectionGroups: OsdDevicesSelectionGroupsComponent;
+  walDeviceSelectionGroups!: OsdDevicesSelectionGroupsComponent;
 
   @ViewChild('dbDeviceSelectionGroups')
-  dbDeviceSelectionGroups: OsdDevicesSelectionGroupsComponent;
+  dbDeviceSelectionGroups!: OsdDevicesSelectionGroupsComponent;
 
   @ViewChild('previewButtonPanel')
-  previewButtonPanel: FormButtonPanelComponent;
+  previewButtonPanel!: FormButtonPanelComponent;
 
   @Input()
   hideTitle = false;
 
-  @Input()
-  hideSubmitBtn = false;
-
   @Output() emitDriveGroup: EventEmitter<DriveGroup> = new EventEmitter();
 
   @Output() emitDeploymentOption: EventEmitter<object> = new EventEmitter();
 
   @Output() emitMode: EventEmitter<boolean> = new EventEmitter();
 
+  @Output() osdCreated: EventEmitter<void> = new EventEmitter();
+
   icons = Icons;
 
-  form: CdFormGroup;
+  form!: CdFormGroup;
   columns: Array<CdTableColumn> = [];
 
   allDevices: InventoryDevice[] = [];
@@ -86,21 +112,35 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
   resource: string;
 
   features: { [key: string]: OsdFeature };
-  featureList: OsdFeature[] = [];
+  featureList: Array<OsdFeature & { key: string }> = [];
 
   hasOrchestrator = true;
 
   simpleDeployment = true;
+  createOsdsLabel = $localize`Create OSDs`;
+  isSubmitLoading = false;
 
-  deploymentOptions: DeploymentOptions;
+  deploymentOptions!: DeploymentOptions;
   optionNames = Object.values(OsdDeploymentOptions);
 
+  steps: Array<Step> = this.getStepsForMode('automatic');
+
+  reviewDeploymentModeLabel = $localize`Automatic`;
+  reviewDeploymentOptionTitle = '';
+  reviewDeploymentOptionDescription = '';
+  reviewHostPattern = '';
+  reviewEnabledFeatures: string[] = [];
+  reviewDataSelection: ReviewDeviceSelection = this.createEmptyReviewDeviceSelection();
+  reviewWalSelection: ReviewDeviceSelection = this.createEmptyReviewDeviceSelection();
+  reviewDbSelection: ReviewDeviceSelection = this.createEmptyReviewDeviceSelection();
+
   constructor(
     public actionLabels: ActionLabelsI18n,
     private authStorageService: AuthStorageService,
     private orchService: OrchestratorService,
     private hostService: HostService,
     private router: Router,
+    private formatterService: FormatterService,
     private modalService: ModalService,
     private osdService: OsdService,
     private taskWrapper: TaskWrapperService
@@ -114,10 +154,86 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
         desc: $localize`Encryption`
       }
     };
-    this.featureList = _.map(this.features, (o, key) => Object.assign(o, { key: key }));
+    this.featureList = _.map(this.features, (o, key) => Object.assign({}, o, { key }));
     this.createForm();
   }
 
+  private getStepsForMode(mode: string): Array<Step> {
+    return mode !== 'manual'
+      ? [
+          { label: STEP_LABELS.DEPLOYMENT, invalid: false },
+          { label: STEP_LABELS.FEATURES, invalid: false },
+          { label: STEP_LABELS.REVIEW, invalid: false }
+        ]
+      : [
+          { label: STEP_LABELS.DEPLOYMENT, invalid: false },
+          { label: STEP_LABELS.DATA, invalid: false },
+          { label: STEP_LABELS.DB_WAL, invalid: false },
+          { label: STEP_LABELS.FEATURES, invalid: false },
+          { label: STEP_LABELS.REVIEW, invalid: false }
+        ];
+  }
+
+  private createEmptyReviewDeviceSelection(): ReviewDeviceSelection {
+    return {
+      count: 0,
+      capacity: '',
+      filters: [],
+      slots: null,
+      hasSelection: false
+    };
+  }
+
+  private formatHostPattern(pattern?: string): string {
+    if (!pattern || pattern === '*') {
+      return $localize`All hosts`;
+    }
+
+    return pattern;
+  }
+
+  private getReviewFilters(selectionGroup?: OsdDevicesSelectionGroupsComponent): ReviewField[] {
+    return (selectionGroup?.appliedFilters ?? []).map((filter) => ({
+      label: filter.name,
+      value: filter.value?.formatted ?? filter.value?.raw ?? '-'
+    }));
+  }
+
+  private buildReviewDeviceSelection(
+    selectionGroup?: OsdDevicesSelectionGroupsComponent,
+    slotControlName?: 'walSlots' | 'dbSlots'
+  ): ReviewDeviceSelection {
+    const devices = selectionGroup?.devices ?? [];
+    const totalCapacity = _.sumBy(devices, (device) => device?.sys_api?.size ?? 0);
+
+    return {
+      count: devices.length,
+      capacity:
+        devices.length > 0 ? this.formatterService.formatToBinary(totalCapacity, false) : '',
+      filters: this.getReviewFilters(selectionGroup),
+      slots:
+        slotControlName && devices.length > 0
+          ? Number(this.form.get(slotControlName)?.value ?? 0)
+          : null,
+      hasSelection: devices.length > 0
+    };
+  }
+
+  private getEnabledFeatures(): string[] {
+    return this.featureList
+      .filter((feature) => this.form.get('features')?.get(feature.key)?.value)
+      .map((feature) => feature.desc);
+  }
+
+  private getEncryptedFeatureValue(): boolean {
+    return this.form.get('features')?.get('encrypted')?.value ?? false;
+  }
+
+  private updateSteps() {
+    const mode = this.form?.get('deploymentMode')?.value ?? 'automatic';
+    this.steps = this.getStepsForMode(mode);
+  }
+
   ngOnInit() {
     this.orchService.status().subscribe((status) => {
       this.hasOrchestrator = status.available;
@@ -131,6 +247,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     this.osdService.getDeploymentOptions().subscribe((options) => {
       this.deploymentOptions = options;
       if (!this.osdService.selectedFormValues) {
+        this.form.get('deploymentMode').setValue('automatic', { emitEvent: false });
         this.form.get('deploymentOption').setValue(this.deploymentOptions?.recommended_option);
       }
 
@@ -142,23 +259,40 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     // restoring form value on back/next
     if (this.osdService.selectedFormValues) {
       this.form = _.cloneDeep(this.osdService.selectedFormValues);
+      if (!this.form.get('deploymentMode')) {
+        this.form.addControl('deploymentMode', new UntypedFormControl('automatic'));
+      }
       this.form
         .get('deploymentOption')
         .setValue(this.osdService.selectedFormValues.value?.deploymentOption);
     }
     this.simpleDeployment = this.osdService.isDeployementModeSimple;
+    this.form
+      .get('deploymentMode')
+      .setValue(this.simpleDeployment ? 'automatic' : 'manual', { emitEvent: false });
+    this.updateSteps();
+    this.form
+      .get('deploymentMode')
+      .valueChanges.subscribe((mode) => this.onDeploymentModeChanged(mode));
     this.form.get('walSlots').valueChanges.subscribe((value) => this.setSlots('wal', value));
     this.form.get('dbSlots').valueChanges.subscribe((value) => this.setSlots('db', value));
     _.each(this.features, (feature) => {
-      this.form
-        .get('features')
-        .get(feature.key)
-        .valueChanges.subscribe((value) => this.featureFormUpdate(feature.key, value));
+      const featureControl = this.form.get('features').get(feature.key ?? '');
+      if (!featureControl) {
+        return;
+      }
+
+      featureControl.valueChanges.subscribe((value) =>
+        this.featureFormUpdate(feature.key ?? '', value)
+      );
     });
+
+    this.populateReviewData();
   }
 
   createForm() {
     this.form = new CdFormGroup({
+      deploymentMode: new UntypedFormControl('automatic'),
       walSlots: new UntypedFormControl(0),
       dbSlots: new UntypedFormControl(0),
       features: new CdFormGroup(
@@ -168,7 +302,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
           return acc;
         }, {})
       ),
-      deploymentOption: new UntypedFormControl(0)
+      deploymentOption: new UntypedFormControl(null)
     });
   }
 
@@ -193,22 +327,33 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     }
     if (slots >= 0) {
       this.driveGroup.setSlots(type, slots);
+      this.populateReviewData();
     }
   }
 
   featureFormUpdate(key: string, checked: boolean) {
     this.driveGroup.setFeature(key, checked);
+    this.populateReviewData();
   }
 
   enableFeatures() {
     this.featureList.forEach((feature) => {
-      this.form.get(feature.key).enable({ emitEvent: false });
+      const control = this.form.get('features').get(feature.key);
+      if (!control) {
+        return;
+      }
+
+      control.enable({ emitEvent: false });
     });
   }
 
   disableFeatures() {
     this.featureList.forEach((feature) => {
-      const control = this.form.get(feature.key);
+      const control = this.form.get('features').get(feature.key);
+      if (!control) {
+        return;
+      }
+
       control.disable({ emitEvent: false });
       control.setValue(false, { emitEvent: false });
     });
@@ -233,6 +378,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
       this.enableFeatures();
     }
     this.driveGroup.setDeviceSelection(event.type, event.filters);
+    this.populateReviewData();
 
     this.emitDriveGroup.emit(this.driveGroup);
   }
@@ -253,28 +399,95 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
       const slotControlName = `${event.type}Slots`;
       this.form.get(slotControlName).setValue(0, { emitEvent: false });
     }
+
+    this.populateReviewData();
   }
 
   emitDeploymentSelection() {
     const option = this.form.get('deploymentOption').value;
-    const encrypted = this.form.get('encrypted').value;
+    const encrypted = this.getEncryptedFeatureValue();
     this.emitDeploymentOption.emit({ option: option, encrypted: encrypted });
   }
 
-  emitDeploymentMode() {
-    this.simpleDeployment = !this.simpleDeployment;
-    if (!this.simpleDeployment && this.dataDeviceSelectionGroups.devices.length === 0) {
+  onDeploymentModeChanged(mode: string) {
+    const deploymentMode = mode ?? this.form?.get('deploymentMode')?.value ?? 'automatic';
+    this.simpleDeployment = deploymentMode !== 'manual';
+    this.updateSteps();
+    const hasDataDevices = (this.dataDeviceSelectionGroups?.devices?.length ?? 0) > 0;
+    if (!this.simpleDeployment && !hasDataDevices) {
       this.disableFeatures();
     } else {
       this.enableFeatures();
     }
+    this.populateReviewData();
     this.emitMode.emit(this.simpleDeployment);
   }
 
+  populateReviewData() {
+    this.reviewDeploymentModeLabel = this.simpleDeployment
+      ? $localize`Automatic`
+      : $localize`Manual selection`;
+
+    const selectedOption = this.form.get('deploymentOption')?.value as OsdDeploymentOptions;
+    const deploymentOption = this.deploymentOptions?.options?.[selectedOption];
+    this.reviewDeploymentOptionTitle = deploymentOption?.title ?? '';
+    this.reviewDeploymentOptionDescription = deploymentOption?.desc ?? '';
+    this.reviewEnabledFeatures = this.getEnabledFeatures();
+
+    if (this.simpleDeployment) {
+      this.reviewHostPattern = '';
+      this.reviewDataSelection = this.createEmptyReviewDeviceSelection();
+      this.reviewWalSelection = this.createEmptyReviewDeviceSelection();
+      this.reviewDbSelection = this.createEmptyReviewDeviceSelection();
+      return;
+    }
+
+    this.reviewHostPattern = this.formatHostPattern(
+      this.hostname || (this.driveGroup.spec['host_pattern'] as string)
+    );
+    this.reviewDataSelection = this.buildReviewDeviceSelection(this.dataDeviceSelectionGroups);
+    this.reviewWalSelection = this.buildReviewDeviceSelection(
+      this.walDeviceSelectionGroups,
+      'walSlots'
+    );
+    this.reviewDbSelection = this.buildReviewDeviceSelection(
+      this.dbDeviceSelectionGroups,
+      'dbSlots'
+    );
+  }
+
+  private navigateAfterCreate() {
+    const returnUrl = window.history.state?.returnUrl;
+
+    if (this.osdCreated.observers.length > 0) {
+      this.osdCreated.emit();
+      return;
+    }
+
+    if (returnUrl === '/add-storage') {
+      this.router.navigate(['/add-storage']);
+      return;
+    }
+
+    const hasSafeReturnUrl =
+      typeof returnUrl === 'string' &&
+      returnUrl.startsWith('/') &&
+      !returnUrl.startsWith('//') &&
+      returnUrl !== '/osd/create';
+
+    if (hasSafeReturnUrl) {
+      this.router.navigateByUrl(returnUrl);
+      return;
+    }
+
+    this.router.navigate(['/osd']);
+  }
+
   submit() {
     if (this.simpleDeployment) {
+      this.isSubmitLoading = true;
       const option = this.form.get('deploymentOption').value;
-      const encrypted = this.form.get('encrypted').value;
+      const encrypted = this.getEncryptedFeatureValue();
       const deploymentSpec = { option: option, encrypted: encrypted };
       const title = this.deploymentOptions.options[deploymentSpec.option].title;
       const trackingId = `${title} deployment`;
@@ -286,8 +499,12 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
           call: this.osdService.create([deploymentSpec], trackingId, 'predefined')
         })
         .subscribe({
+          error: () => {
+            this.isSubmitLoading = false;
+          },
           complete: () => {
-            this.router.navigate(['/osd']);
+            this.isSubmitLoading = false;
+            this.navigateAfterCreate();
           }
         });
     } else {
@@ -298,14 +515,15 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
         driveGroups: [this.driveGroup.spec]
       });
       modalRef.componentInstance.submitAction.subscribe(() => {
-        this.router.navigate(['/osd']);
+        this.navigateAfterCreate();
       });
+      this.isSubmitLoading = false;
       this.previewButtonPanel.submitButton.loading = false;
     }
   }
 
   ngOnDestroy() {
     this.osdService.selectedFormValues = _.cloneDeep(this.form);
-    this.osdService.isDeployementModeSimple = this.dataDeviceSelectionGroups?.devices?.length === 0;
+    this.osdService.isDeployementModeSimple = this.simpleDeployment;
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
index bbb6449fc6a..de9fd2a479d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
@@ -1,63 +1,74 @@
-<nav ngbNav
-     #nav="ngbNav"
-     class="nav-tabs">
-  <ng-container ngbNavItem>
-    <a ngbNavLink
-       i18n>OSDs List</a>
-    <ng-template ngbNavContent>
-      <cd-table [data]="osds"
-                (fetchData)="getOsdList($event)"
-                [columns]="columns"
-                selectionType="multiClick"
-                [hasDetails]="true"
-                (setExpandedRow)="setExpandedRow($event)"
-                (updateSelection)="updateSelection($event)"
-                [updateSelectionOnRefresh]="'never'"
-                [serverSide]="true"
-                [count]="count">
+<ng-template #osdTableTpl>
+  <cd-table [data]="osds"
+            (fetchData)="getOsdList($event)"
+            [columns]="columns"
+            selectionType="multiClick"
+            [hasDetails]="true"
+            (setExpandedRow)="setExpandedRow($event)"
+            (updateSelection)="updateSelection($event)"
+            [updateSelectionOnRefresh]="'never'"
+            [serverSide]="true"
+            [count]="count">
 
-        <div class="table-actions">
-          <cd-table-actions [permission]="permissions.osd"
-                            [selection]="selection"
-                            class="btn-group"
-                            id="osd-actions"
-                            [tableActions]="tableActions">
-          </cd-table-actions>
-          <cd-table-actions [permission]="{read: true}"
-                            [selection]="selection"
-                            dropDownOnly="Cluster-wide configuration"
-                            [dropDownOnlyOffset]="{ x: 110, y: 0 }"
-                            [dropDownOnlyBtnColor]="'tertiary'"
-                            class="btn-group"
-                            id="cluster-wide-actions"
-                            [tableActions]="clusterWideActions">
-          </cd-table-actions>
-        </div>
+    <div class="table-actions">
+      <cd-table-actions [permission]="permissions.osd"
+                        [selection]="selection"
+                        class="btn-group"
+                        id="osd-actions"
+                        [tableActions]="tableActions">
+      </cd-table-actions>
+      <cd-table-actions [permission]="{read: true}"
+                        [selection]="selection"
+                        dropDownOnly="Cluster-wide configuration"
+                        [dropDownOnlyOffset]="{ x: 110, y: 0 }"
+                        [dropDownOnlyBtnColor]="'tertiary'"
+                        class="btn-group"
+                        id="cluster-wide-actions"
+                        [tableActions]="clusterWideActions">
+      </cd-table-actions>
+    </div>
 
-        <cd-osd-details *cdTableDetail
-                        [selection]="expandedRow">
-        </cd-osd-details>
-      </cd-table>
-    </ng-template>
-  </ng-container>
+    <cd-osd-details *cdTableDetail
+                    [selection]="expandedRow">
+    </cd-osd-details>
+  </cd-table>
+</ng-template>
 
-  <ng-container ngbNavItem
-                *ngIf="permissions.grafana.read">
-    <a ngbNavLink
-       i18n>Overall Performance</a>
-    <ng-template ngbNavContent>
-      <cd-grafana i18n-title
-                  title="OSD list"
-                  [grafanaPath]="'ceph-osds-overview?'"
-                  [type]="'metrics'"
-                  uid="lo02I1Aiz"
-                  grafanaStyle="three">
-      </cd-grafana>
-    </ng-template>
-  </ng-container>
-</nav>
+@if (showTabs) {
+  <nav ngbNav
+       #nav="ngbNav"
+       class="nav-tabs">
+    <ng-container ngbNavItem>
+      <a ngbNavLink
+         i18n>OSDs List</a>
+      <ng-template ngbNavContent>
+        <ng-container *ngTemplateOutlet="osdTableTpl"></ng-container>
+      </ng-template>
+    </ng-container>
 
-<div [ngbNavOutlet]="nav"></div>
+  @if (permissions.grafana.read) {
+    <ng-container ngbNavItem>
+      <a
+        ngbNavLink
+        i18n>Overall Performance</a>
+      <ng-template
+        ngbNavContent>
+        <cd-grafana i18n-title
+                    title="OSD list"
+                    [grafanaPath]="'ceph-osds-overview?'"
+                    [type]="'metrics'"
+                    uid="lo02I1Aiz"
+                    grafanaStyle="three">
+        </cd-grafana>
+      </ng-template>
+    </ng-container>
+  }
+  </nav>
+
+  <div [ngbNavOutlet]="nav"></div>
+} @else {
+  <ng-container *ngTemplateOutlet="osdTableTpl"></ng-container>
+}
 
 <ng-template #markOsdConfirmationTpl
              let-markActionDescription="markActionDescription"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts
index fb6c676a5dc..bac3ee08d6e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts
@@ -1,4 +1,12 @@
-import { Component, OnInit, TemplateRef, ViewChild } from '@angular/core';
+import {
+  Component,
+  EventEmitter,
+  Input,
+  OnInit,
+  Output,
+  TemplateRef,
+  ViewChild
+} from '@angular/core';
 import { UntypedFormControl } from '@angular/forms';
 import { Router } from '@angular/router';
 
@@ -53,6 +61,9 @@ const BASE_URL = 'osd';
   standalone: false
 })
 export class OsdListComponent extends ListWithDetails implements OnInit {
+  @Input() showTabs = true;
+  @Output() createAction = new EventEmitter<void>();
+
   @ViewChild('osdUsageTpl', { static: true })
   osdUsageTpl: TemplateRef<any>;
   @ViewChild('markOsdConfirmationTpl', { static: true })
@@ -125,7 +136,17 @@ export class OsdListComponent extends ListWithDetails implements OnInit {
         name: this.actionLabels.CREATE,
         permission: 'create',
         icon: Icons.add,
-        click: () => this.router.navigate([this.urlBuilder.getCreate()]),
+        click: () => {
+          if (this.createAction.observers.length > 0) {
+            this.createAction.emit();
+          } else {
+            this.router.navigate([this.urlBuilder.getCreate()], {
+              state: {
+                returnUrl: this.router.url
+              }
+            });
+          }
+        },
         disable: (selection: CdTableSelection) => this.getDisable('create', selection),
         canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
       },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
index 567f9a3f013..dd91a045c95 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
@@ -1,4 +1,5 @@
 import {
+  ChangeDetectorRef,
   Component,
   ContentChildren,
   EventEmitter,
@@ -114,7 +115,7 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
   }
 
   currentStep: number = 0;
-  lastStep: number = null;
+  lastStep: number | null = null;
   isOpen: boolean = true;
   hasModalOutlet: boolean = false;
   private destroy$ = new Subject<void>();
@@ -124,7 +125,8 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
     private cdsModalService: ModalCdsService,
     private route: ActivatedRoute,
     private location: Location,
-    private destroyRef: DestroyRef
+    private destroyRef: DestroyRef,
+    private cdr: ChangeDetectorRef
   ) {}
 
   ngOnInit() {
@@ -163,6 +165,7 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
     if (this.currentStep !== 0) {
       this.currentStep = this.currentStep - 1;
       this.stepChanged.emit({ current: this.currentStep });
+      this.cdr.markForCheck();
     }
   }
 
@@ -177,6 +180,7 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
     if (this.currentStep !== this.lastStep && !this.steps[this.currentStep].invalid) {
       this.currentStep = this.currentStep + 1;
       this.stepChanged.emit({ current: this.currentStep });
+      this.cdr.markForCheck();
     }
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/osd-form.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/osd-form.ts
new file mode 100644
index 00000000000..220214b4a62
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/osd-form.ts
@@ -0,0 +1,5 @@
+export enum OsdDeviceType {
+  DATA = 'data',
+  WAL = 'wal',
+  DB = 'db'
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/styles/ceph-custom/_spacings.scss b/src/pybind/mgr/dashboard/frontend/src/styles/ceph-custom/_spacings.scss
index 1580b6a7bd9..ac3a20cea99 100644
--- a/src/pybind/mgr/dashboard/frontend/src/styles/ceph-custom/_spacings.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/styles/ceph-custom/_spacings.scss
@@ -9,6 +9,14 @@
   padding-left: layout.$spacing-06;
 }
 
+.cds-pl-4 {
+  padding-left: layout.$spacing-04;
+}
+
+.cds-pl-7 {
+  padding-left: layout.$spacing-07;
+}
+
 .cds-pt-2px {
   padding-top: 2px;
 }

From 15e47f930d52b2c6539fd39b04306577bf0f86df Mon Sep 17 00:00:00 2001
From: Syed Ali Ul Hasan <syedaliulhasan19@gmail.com>
Date: Sat, 6 Jun 2026 22:17:23 +0530
Subject: [PATCH 139/596] mgr/dashboard: migrated host table tabs to resource
 pages

Fixes :  https://tracker.ceph.com/issues/76712
Signed-off-by: Syed Ali Ul Hasan <syedaliulhasan19@gmail.com>
---
 .../frontend/src/app/app-routing.module.ts    | 36 +++++++++
 .../src/app/ceph/cluster/cluster.module.ts    |  2 +
 .../host-details-breadcrumb.resolver.ts       | 17 +++++
 .../host-details-section.component.html       | 31 ++++++++
 .../host-details-section.component.ts         | 21 ++++++
 .../host-details/host-details.component.html  | 66 +---------------
 .../host-details.component.spec.ts            | 41 ++++++----
 .../host-details/host-details.component.ts    | 75 ++++++++++++++++---
 .../ceph/cluster/hosts/hosts.component.html   | 12 ++-
 .../app/ceph/cluster/hosts/hosts.component.ts |  1 +
 10 files changed, 211 insertions(+), 91 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-breadcrumb.resolver.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts
index 0e41636c19d..5a77bb1f1db 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts
@@ -8,7 +8,10 @@ import { ConfigurationFormComponent } from './ceph/cluster/configuration/configu
 import { ConfigurationComponent } from './ceph/cluster/configuration/configuration.component';
 import { CreateClusterComponent } from './ceph/cluster/create-cluster/create-cluster.component';
 import { CrushmapComponent } from './ceph/cluster/crushmap/crushmap.component';
+import { HostDetailsComponent } from './ceph/cluster/hosts/host-details/host-details.component';
 import { HostFormComponent } from './ceph/cluster/hosts/host-form/host-form.component';
+import { HostDetailsBreadcrumbResolver } from './ceph/cluster/hosts/host-details/host-details-breadcrumb.resolver';
+import { HostDetailsSectionComponent } from './ceph/cluster/hosts/host-details/host-details-section.component';
 import { HostsComponent } from './ceph/cluster/hosts/hosts.component';
 import { InventoryComponent } from './ceph/cluster/inventory/inventory.component';
 import { LogsComponent } from './ceph/cluster/logs/logs.component';
@@ -153,6 +156,39 @@ const routes: Routes = [
           }
         ]
       },
+      {
+        path: 'hosts/:hostname',
+        component: HostDetailsComponent,
+        data: { breadcrumbs: HostDetailsBreadcrumbResolver },
+        children: [
+          { path: '', redirectTo: 'devices', pathMatch: 'full' },
+          {
+            path: 'devices',
+            component: HostDetailsSectionComponent,
+            data: { breadcrumbs: 'Devices', section: 'devices' }
+          },
+          {
+            path: 'physical-disks',
+            component: HostDetailsSectionComponent,
+            data: { breadcrumbs: 'Physical Disks', section: 'physical-disks' }
+          },
+          {
+            path: 'daemons',
+            component: HostDetailsSectionComponent,
+            data: { breadcrumbs: 'Daemons', section: 'daemons' }
+          },
+          {
+            path: 'performance-details',
+            component: HostDetailsSectionComponent,
+            data: { breadcrumbs: 'Performance Details', section: 'performance-details' }
+          },
+          {
+            path: 'device-health',
+            component: HostDetailsSectionComponent,
+            data: { breadcrumbs: 'Device health', section: 'device-health' }
+          }
+        ]
+      },
       {
         path: 'ceph-users',
         component: CRUDTableComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts
index a711704ad6e..990bd0d1f15 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/cluster.module.ts
@@ -60,6 +60,7 @@ import { CreateClusterStep4Component } from './create-cluster/create-cluster-ste
 import { CreateClusterComponent } from './create-cluster/create-cluster.component';
 import { CrushmapComponent } from './crushmap/crushmap.component';
 import { HostDetailsComponent } from './hosts/host-details/host-details.component';
+import { HostDetailsSectionComponent } from './hosts/host-details/host-details-section.component';
 import { HostFormComponent } from './hosts/host-form/host-form.component';
 import { HostsComponent } from './hosts/hosts.component';
 import { InventoryDevicesComponent } from './inventory/inventory-devices/inventory-devices.component';
@@ -155,6 +156,7 @@ import { TextLabelListComponent } from '~/app/shared/components/text-label-list/
     OsdScrubModalComponent,
     OsdFlagsModalComponent,
     HostDetailsComponent,
+    HostDetailsSectionComponent,
     ConfigurationDetailsComponent,
     ConfigurationFormComponent,
     OsdReweightModalComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-breadcrumb.resolver.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-breadcrumb.resolver.ts
new file mode 100644
index 00000000000..fe277471be4
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-breadcrumb.resolver.ts
@@ -0,0 +1,17 @@
+import { Injectable } from '@angular/core';
+import { ActivatedRouteSnapshot } from '@angular/router';
+
+import { BreadcrumbsResolver, IBreadcrumb } from '~/app/shared/models/breadcrumbs';
+
+@Injectable({
+  providedIn: 'root'
+})
+export class HostDetailsBreadcrumbResolver extends BreadcrumbsResolver {
+  resolve(route: ActivatedRouteSnapshot): IBreadcrumb[] {
+    const hostname = route.parent?.params?.hostname || route.params?.hostname || '';
+    return [
+      { text: 'Cluster/Hosts', path: '/hosts' },
+      { text: hostname, path: this.getFullPath(route) }
+    ];
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html
new file mode 100644
index 00000000000..1c91b7deead
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html
@@ -0,0 +1,31 @@
+@if (hostname) {
+  @switch (section) {
+    @case ('devices') {
+      <cd-device-list [hostname]="hostname"></cd-device-list>
+    }
+    @case ('physical-disks') {
+      <cd-inventory [hostname]="hostname"></cd-inventory>
+    }
+    @case ('daemons') {
+      <cd-service-daemon-list [hostname]="hostname"
+                              flag="hostDetails"
+                              [hiddenColumns]="['hostname']">
+      </cd-service-daemon-list>
+    }
+    @case ('performance-details') {
+      <cd-grafana i18n-title
+                  title="Host details"
+                  [grafanaPath]="'ceph-host-details?var-ceph_hosts=' + hostname"
+                  [type]="'metrics'"
+                  uid="rtOg0AiWz"
+                  grafanaStyle="five">
+      </cd-grafana>
+    }
+    @case ('device-health') {
+      <cd-smart-list [hostname]="hostname"></cd-smart-list>
+    }
+  }
+} @else {
+  <cd-alert-panel type="error"
+                  i18n>No hostname found.</cd-alert-panel>
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.ts
new file mode 100644
index 00000000000..c4e92ddc853
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.ts
@@ -0,0 +1,21 @@
+import { Component, OnInit } from '@angular/core';
+import { ActivatedRoute, ParamMap } from '@angular/router';
+
+@Component({
+  selector: 'cd-host-details-section',
+  templateUrl: './host-details-section.component.html',
+  standalone: false
+})
+export class HostDetailsSectionComponent implements OnInit {
+  hostname = '';
+  section = '';
+
+  constructor(private route: ActivatedRoute) {}
+
+  ngOnInit(): void {
+    this.route.parent?.paramMap.subscribe((pm: ParamMap) => {
+      this.hostname = pm.get('hostname') ?? '';
+    });
+    this.section = this.route.snapshot.data['section'] ?? '';
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.html
index e2c838a6083..35343d1f505 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.html
@@ -1,62 +1,4 @@
-<ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="host-details">
-    <ng-container ngbNavItem="devices">
-      <a ngbNavLink
-         i18n>Devices</a>
-      <ng-template ngbNavContent>
-        <cd-device-list [hostname]="selection['hostname']"></cd-device-list>
-      </ng-template>
-    </ng-container>
-    <ng-container ngbNavItem="inventory"
-                  *ngIf="permissions.hosts.read">
-      <a ngbNavLink
-         i18n>Physical Disks</a>
-      <ng-template ngbNavContent>
-        <cd-inventory [hostname]="selectedHostname"></cd-inventory>
-      </ng-template>
-    </ng-container>
-    <ng-container ngbNavItem="daemons"
-                  *ngIf="permissions.hosts.read">
-      <a ngbNavLink
-         i18n>Daemons</a>
-      <ng-template ngbNavContent>
-        <cd-service-daemon-list [hostname]="selectedHostname"
-                                flag="hostDetails"
-                                [hiddenColumns]="['hostname']">
-        </cd-service-daemon-list>
-      </ng-template>
-    </ng-container>
-    <ng-container ngbNavItem="performance-details"
-                  *ngIf="permissions.grafana.read">
-      <a ngbNavLink
-         i18n>Performance Details</a>
-      <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="Host details"
-                    [grafanaPath]="'ceph-host-details?var-ceph_hosts=' + selectedHostname"
-                    [type]="'metrics'"
-                    uid="rtOg0AiWz"
-                    grafanaStyle="five">
-        </cd-grafana>
-      </ng-template>
-    </ng-container>
-    <ng-container ngbNavItem="device-health">
-      <a ngbNavLink
-         i18n>Device health</a>
-      <ng-template ngbNavContent>
-        <cd-smart-list *ngIf="selectedHostname; else noHostname"
-                       [hostname]="selectedHostname"></cd-smart-list>
-      </ng-template>
-    </ng-container>
-  </nav>
-
-  <div [ngbNavOutlet]="nav"></div>
-</ng-container>
-
-<ng-template #noHostname>
-  <cd-alert-panel type="error"
-                  i18n>No hostname found.</cd-alert-panel>
-</ng-template>
+<cd-sidebar-layout
+  [title]="hostname"
+  [items]="sidebarItems"
+></cd-sidebar-layout>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.spec.ts
index 59c6666e374..f0086af4365 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.spec.ts
@@ -1,14 +1,17 @@
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { ActivatedRoute, convertToParamMap } from '@angular/router';
 import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
 import { RouterTestingModule } from '@angular/router/testing';
+import { of } from 'rxjs';
 
 import { CephModule } from '~/app/ceph/ceph.module';
 import { CephSharedModule } from '~/app/ceph/shared/ceph-shared.module';
 import { CoreModule } from '~/app/core/core.module';
 import { Permissions } from '~/app/shared/models/permissions';
+import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { SharedModule } from '~/app/shared/shared.module';
-import { configureTestBed, TabHelper } from '~/testing/unit-test-helper';
+import { configureTestBed } from '~/testing/unit-test-helper';
 import { HostDetailsComponent } from './host-details.component';
 
 describe('HostDetailsComponent', () => {
@@ -24,36 +27,44 @@ describe('HostDetailsComponent', () => {
       CoreModule,
       CephSharedModule,
       SharedModule
+    ],
+    providers: [
+      {
+        provide: ActivatedRoute,
+        useValue: {
+          paramMap: of(convertToParamMap({ hostname: 'localhost' }))
+        }
+      },
+      {
+        provide: AuthStorageService,
+        useValue: {
+          getPermissions: () => new Permissions({ hosts: ['read'], grafana: ['read'] })
+        }
+      }
     ]
   });
 
   beforeEach(() => {
     fixture = TestBed.createComponent(HostDetailsComponent);
     component = fixture.componentInstance;
-    component.selection = undefined;
-    component.permissions = new Permissions({
-      hosts: ['read'],
-      grafana: ['read']
-    });
   });
 
   it('should create', () => {
     expect(component).toBeTruthy();
   });
 
-  describe('Host details tabset', () => {
+  describe('Host resource layout', () => {
     beforeEach(() => {
-      component.selection = { hostname: 'localhost' };
       fixture.detectChanges();
     });
 
-    it('should recognize a tabset child', () => {
-      const tabsetChild = TabHelper.getNgbNav(fixture);
-      expect(tabsetChild).toBeDefined();
+    it('should render the sidebar layout', () => {
+      const layout = fixture.nativeElement.querySelector('cd-sidebar-layout');
+      expect(layout).toBeTruthy();
     });
 
-    it('should show tabs', () => {
-      expect(TabHelper.getTextContents(fixture)).toEqual([
+    it('should build the sidebar items', () => {
+      expect(component.sidebarItems.map((item) => item.label)).toEqual([
         'Devices',
         'Physical Disks',
         'Daemons',
@@ -61,5 +72,9 @@ describe('HostDetailsComponent', () => {
         'Device health'
       ]);
     });
+
+    it('should set the hostname title', () => {
+      expect(component.hostname).toBe('localhost');
+    });
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts
index 9af6a87a52f..9384acdca68 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts
@@ -1,21 +1,78 @@
-import { Component, Input } from '@angular/core';
+import { Component, OnDestroy, OnInit, ViewEncapsulation } from '@angular/core';
+import { ActivatedRoute, ParamMap } from '@angular/router';
 
-import { Permissions } from '~/app/shared/models/permissions';
+import { Subscription } from 'rxjs';
+
+import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
+import { SidebarItem } from '~/app/shared/components/sidebar-layout/sidebar-layout.component';
 
 @Component({
   selector: 'cd-host-details',
   templateUrl: './host-details.component.html',
   styleUrls: ['./host-details.component.scss'],
+  encapsulation: ViewEncapsulation.None,
   standalone: false
 })
-export class HostDetailsComponent {
-  @Input()
-  permissions: Permissions;
+export class HostDetailsComponent implements OnInit, OnDestroy {
+  private sub = new Subscription();
+  public readonly basePath = '/hosts';
+  hostname = '';
+  sidebarItems: SidebarItem[] = [];
 
-  @Input()
-  selection: any;
+  constructor(private route: ActivatedRoute, private authStorageService: AuthStorageService) {}
 
-  get selectedHostname(): string {
-    return this.selection !== undefined ? this.selection['hostname'] : null;
+  ngOnInit(): void {
+    const permissions = this.authStorageService.getPermissions();
+    this.sub.add(
+      this.route.paramMap.subscribe((pm: ParamMap) => {
+        this.hostname = pm.get('hostname') ?? '';
+        this.buildSidebarItems(permissions);
+      })
+    );
+  }
+
+  ngOnDestroy(): void {
+    this.sub.unsubscribe();
+  }
+
+  private buildSidebarItems(permissions: any): void {
+    const items: SidebarItem[] = [
+      {
+        label: $localize`Devices`,
+        route: [this.basePath, this.hostname, 'devices'],
+        routerLinkActiveOptions: { exact: true }
+      }
+    ];
+
+    if (permissions.hosts?.read) {
+      items.push(
+        {
+          label: $localize`Physical Disks`,
+          route: [this.basePath, this.hostname, 'physical-disks'],
+          routerLinkActiveOptions: { exact: true }
+        },
+        {
+          label: $localize`Daemons`,
+          route: [this.basePath, this.hostname, 'daemons'],
+          routerLinkActiveOptions: { exact: true }
+        }
+      );
+    }
+
+    if (permissions.grafana?.read) {
+      items.push({
+        label: $localize`Performance Details`,
+        route: [this.basePath, this.hostname, 'performance-details'],
+        routerLinkActiveOptions: { exact: true }
+      });
+    }
+
+    items.push({
+      label: $localize`Device health`,
+      route: [this.basePath, this.hostname, 'device-health'],
+      routerLinkActiveOptions: { exact: true }
+    });
+
+    this.sidebarItems = items;
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html
index 9ea40658b1b..8f85391c666 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html
@@ -12,11 +12,9 @@
                 (fetchData)="getHosts($event)"
                 selectionType="single"
                 [searchableObjects]="true"
-                [hasDetails]="hasTableDetails"
                 [serverSide]="true"
                 [count]="count"
                 [maxLimit]="25"
-                (setExpandedRow)="setExpandedRow($event)"
                 (updateSelection)="updateSelection($event)"
                 [toolHeader]="!hideToolHeader">
         <div class="table-actions">
@@ -33,10 +31,6 @@
                             [tableActions]="expandClusterActions">
           </cd-table-actions>
         </div>
-        <cd-host-details *cdTableDetail
-                         [permissions]="permissions"
-                         [selection]="expandedRow">
-        </cd-host-details>
       </cd-table>
     </ng-template>
   </ng-container>
@@ -73,7 +67,11 @@
 <ng-template #hostNameTpl
              let-row="data.row">
   <span data-testid="hostname">
-    {{ row.hostname }}
+    <a cdsLink
+       [routerLink]="[viewUrl, row.hostname | encodeUri]"
+       (click)="$event.stopPropagation()">
+      {{ row.hostname }}
+    </a>
   </span><br>
   <span class="text-muted fst-italic"
         *ngIf="row.addr"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.ts
index d6f21651e0a..07d29d63536 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.ts
@@ -104,6 +104,7 @@ export class HostsComponent extends ListWithDetails implements OnDestroy, OnInit
   icons = Icons;
   private tableContext: CdTableFetchDataContext = null;
   count = 5;
+  viewUrl = '/hosts';
 
   messages = {
     nonOrchHost: $localize`The feature is disabled because the selected host is not managed by Orchestrator.`

From c22d5b4f41f9b4f245addb6a735482f1fb8ef079 Mon Sep 17 00:00:00 2001
From: Eric Zhang <emzhang@umich.edu>
Date: Wed, 10 Jun 2026 12:41:21 -0700
Subject: [PATCH 140/596] qa: Fix task missing function call lambda was missing
 function call so always returned true

Signed-off-by: Eric Zhang <emzhang@ibm.com>
---
 qa/tasks/stretch_cluster.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/tasks/stretch_cluster.py b/qa/tasks/stretch_cluster.py
index 0038b9d4dcb..086a72c8414 100644
--- a/qa/tasks/stretch_cluster.py
+++ b/qa/tasks/stretch_cluster.py
@@ -678,7 +678,7 @@ class TestStretchCluster(MgrTestCase):
 
         # Fail over osds in DC2 completely expects PGs to be 100% inactive
         self._fail_over_all_osds_in_dc('dc2')
-        self.wait_until_true_and_hold(lambda: self._pg_all_unavailable,
+        self.wait_until_true_and_hold(lambda: self._pg_all_unavailable(),
                                       timeout=self.RECOVERY_PERIOD,
                                       success_hold_time=self.SUCCESS_HOLD_TIME)
 

From 473104c243860e36f1f12a27d09573b9f96f132a Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Wed, 7 Jan 2026 11:55:25 +0000
Subject: [PATCH 141/596] crimson/osd: Add functions to notify mon when PGs are
 ready to merge

When a PG is in the pending merge state it is >= pg_num_pending and <
pg_num. When this happens, IO is paused and once the PG peers we notify
the mon that we are idle and safe to merge.
Use Gated for merge notify callbacks.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/crimson/osd/osd.cc            |   4 +
 src/crimson/osd/pg.h              |  57 ++++++++++--
 src/crimson/osd/shard_services.cc | 145 ++++++++++++++++++++++++++++++
 src/crimson/osd/shard_services.h  |  28 ++++++
 4 files changed, 228 insertions(+), 6 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 0f94d16bdfc..8e6d048be1d 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -1330,6 +1330,10 @@ seastar::future<> OSD::committed_osd_maps(
     old_map = osdmap;
   }
 
+  // Drop merge-ready bookkeeping for PGs removed by the map we just
+  // consumed, mirroring classic OSD::consume_map().
+  co_await get_shard_services().prune_sent_ready_to_merge();
+
   if (osdmap->is_up(whoami)) {
     const auto up_from = osdmap->get_up_from(whoami);
     INFO("osd.{}: map e {} marked me up: up_from {}, bind_epoch {}, state {}",
diff --git a/src/crimson/osd/pg.h b/src/crimson/osd/pg.h
index e24427a6a0d..f3913c919df 100644
--- a/src/crimson/osd/pg.h
+++ b/src/crimson/osd/pg.h
@@ -26,6 +26,7 @@
 #include "osd/DynamicPerfStats.h"
 
 #include "crimson/common/interruptible_future.h"
+#include "crimson/common/gated.h"
 #include "crimson/common/log.h"
 #include "crimson/common/type_helpers.h"
 #include "crimson/os/futurized_collection.h"
@@ -563,12 +564,51 @@ public:
   std::pair<ghobject_t, bool>
   do_delete_work(ceph::os::Transaction &t, ghobject_t _next) final;
 
-  // merge/split not ready
-  void clear_ready_to_merge() final {}
-  void set_not_ready_to_merge_target(pg_t pgid, pg_t src) final {}
-  void set_not_ready_to_merge_source(pg_t pgid) final {}
-  void set_ready_to_merge_target(eversion_t lu, epoch_t les, epoch_t lec) final {}
-  void set_ready_to_merge_source(eversion_t lu) final {}
+  void clear_ready_to_merge() final {
+    LOG_PREFIX(PG::clear_ready_to_merge);
+    SUBDEBUGDPP(osd, "", *this);
+    merge_notify_gate.dispatch_in_background(
+      "clear_ready_to_merge", *this,
+      [this] {
+        return shard_services.clear_ready_to_merge(pgid.pgid);
+      });
+  }
+  void set_not_ready_to_merge_target(pg_t pgid, pg_t src) final {
+    LOG_PREFIX(PG::set_not_ready_to_merge_target);
+    SUBDEBUGDPP(osd, "", *this);
+    merge_notify_gate.dispatch_in_background(
+      "set_not_ready_to_merge_target", *this,
+      [this, pgid, src] {
+        return shard_services.set_not_ready_to_merge_target(pgid, src);
+      });
+  }
+  void set_not_ready_to_merge_source(pg_t pgid) final {
+    LOG_PREFIX(PG::set_not_ready_to_merge_source);
+    SUBDEBUGDPP(osd, "", *this);
+    merge_notify_gate.dispatch_in_background(
+      "set_not_ready_to_merge_source", *this,
+      [this, pgid] {
+        return shard_services.set_not_ready_to_merge_source(pgid);
+      });
+  }
+  void set_ready_to_merge_target(eversion_t lu, epoch_t les, epoch_t lec) final {
+    LOG_PREFIX(PG::set_ready_to_merge_target);
+    SUBDEBUGDPP(osd, "", *this);
+    merge_notify_gate.dispatch_in_background(
+      "set_ready_to_merge_target", *this,
+      [this, lu, les, lec] {
+        return shard_services.set_ready_to_merge_target(pgid.pgid, lu, les, lec);
+      });
+  }
+  void set_ready_to_merge_source(eversion_t lu) final {
+    LOG_PREFIX(PG::set_ready_to_merge_source);
+    SUBDEBUGDPP(osd, "", *this);
+    merge_notify_gate.dispatch_in_background(
+      "set_ready_to_merge_source", *this,
+      [this, lu] {
+        return shard_services.set_ready_to_merge_source(pgid.pgid, lu);
+      });
+  }
 
   void on_active_actmap() final;
   void on_active_advmap(const OSDMapRef &osdmap) final;
@@ -1148,6 +1188,11 @@ private:
   // continuations here.
   bool stopping = false;
 
+  // PeeringListener merge callbacks must remain void, but they trigger async
+  // mon notifies in ShardServices. Gate them here so failures are logged and
+  // PG::stop() waits for them to drain.
+  crimson::common::Gated merge_notify_gate;
+
   PGActivationBlocker wait_for_active_blocker;
   PglogBasedRecovery* pglog_based_recovery_op = nullptr;
 
diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index 3780cd626c6..e4ff7d02a42 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -9,6 +9,7 @@
 #include "messages/MOSDMap.h"
 #include "messages/MOSDPGCreated.h"
 #include "messages/MOSDPGTemp.h"
+#include "messages/MOSDPGReadyToMerge.h"
 
 #include "osd/osd_perf_counters.h"
 #include "osd/PeeringState.h"
@@ -308,6 +309,150 @@ void OSDSingletonState::prune_pg_created()
   }
 }
 
+seastar::future<> OSDSingletonState::set_ready_to_merge_source(pg_t pgid,
+                                                  eversion_t version)
+{
+  LOG_PREFIX(OSDSingletonState::set_ready_to_merge_source);
+  DEBUG("{}", pgid);
+  ready_to_merge_source[pgid] = version;
+  ceph_assert(!not_ready_to_merge_source.contains(pgid));
+  return send_ready_to_merge();
+}
+
+seastar::future<> OSDSingletonState::set_ready_to_merge_target(pg_t pgid,
+                                           eversion_t version,
+                                           epoch_t last_epoch_started,
+                                           epoch_t last_epoch_clean)
+{
+  LOG_PREFIX(OSDSingletonState::set_ready_to_merge_target);
+  DEBUG("{}", pgid);
+  ready_to_merge_target.insert(std::make_pair(pgid,
+                                         std::make_tuple(version,
+                                                    last_epoch_started,
+                                                    last_epoch_clean)));
+  ceph_assert(!not_ready_to_merge_target.contains(pgid));
+  return send_ready_to_merge();
+}
+
+seastar::future<> OSDSingletonState::set_not_ready_to_merge_source(pg_t source)
+{
+  LOG_PREFIX(OSDSingletonState::set_not_ready_to_merge_source);
+  DEBUG("{}", source);
+  not_ready_to_merge_source.insert(source);
+  ceph_assert(!ready_to_merge_source.contains(source));
+  return send_ready_to_merge();
+}
+
+seastar::future<> OSDSingletonState::set_not_ready_to_merge_target(pg_t target, pg_t source)
+{
+  LOG_PREFIX(OSDSingletonState::set_not_ready_to_merge_target);
+  DEBUG("{} source {}", target, source);
+  not_ready_to_merge_target[target] = source;
+  ceph_assert(!ready_to_merge_target.contains(target));
+  return send_ready_to_merge();
+}
+
+seastar::future<> OSDSingletonState::send_ready_to_merge()
+{
+  LOG_PREFIX(OSDSingletonState::send_ready_to_merge);
+  DEBUG(" ready_to_merge_source: {} not_ready_to_merge_source: {} \
+          ready_to_merge_target: {} not_ready_to_merge_target: {} \
+          sent_ready_to_merge_source {}", ready_to_merge_source,
+          not_ready_to_merge_source, ready_to_merge_target, not_ready_to_merge_target,
+          sent_ready_to_merge_source);
+
+  struct ready_to_merge_send_t {
+    pg_t pgid;
+    eversion_t source_version;
+    eversion_t target_version;
+    epoch_t last_epoch_started = 0;
+    epoch_t last_epoch_clean = 0;
+    bool ready = false;
+  };
+
+  const epoch_t map_epoch = osdmap->get_epoch();
+  std::vector<ready_to_merge_send_t> pending;
+  pending.reserve(not_ready_to_merge_source.size() +
+                  not_ready_to_merge_target.size() +
+                  ready_to_merge_source.size());
+
+  for (auto src : not_ready_to_merge_source) {
+    if (!sent_ready_to_merge_source.contains(src)) {
+      sent_ready_to_merge_source.insert(src);
+      pending.push_back({src, {}, {}, 0, 0, false});
+    }
+  }
+  for (auto p : not_ready_to_merge_target) {
+    if (!sent_ready_to_merge_source.contains(p.second)) {
+      sent_ready_to_merge_source.insert(p.second);
+      pending.push_back({p.second, {}, {}, 0, 0, false});
+    }
+  }
+  for (auto& [src_pg, src_version] : ready_to_merge_source) {
+    if (not_ready_to_merge_source.contains(src_pg) ||
+        not_ready_to_merge_target.contains(src_pg.get_parent())) {
+      continue;
+    }
+    auto p = ready_to_merge_target.find(src_pg.get_parent());
+    if (p != ready_to_merge_target.end() &&
+        !sent_ready_to_merge_source.contains(src_pg)) {
+      sent_ready_to_merge_source.insert(src_pg);
+      pending.push_back({
+        src_pg,
+        src_version,
+        std::get<0>(p->second),
+        std::get<1>(p->second),
+        std::get<2>(p->second),
+        true});
+    }
+  }
+
+  if (pending.empty()) {
+    return seastar::now();
+  }
+  return seastar::parallel_for_each(
+    std::move(pending),
+    [this, map_epoch](const ready_to_merge_send_t& m) {
+      return monc.send_message(crimson::make_message<MOSDPGReadyToMerge>(
+        m.pgid,
+        m.source_version,
+        m.target_version,
+        m.last_epoch_started,
+        m.last_epoch_clean,
+        m.ready,
+        map_epoch));
+    });
+}
+
+void OSDSingletonState::clear_ready_to_merge(pg_t pgid)
+{
+  ready_to_merge_source.erase(pgid);
+  ready_to_merge_target.erase(pgid);
+  not_ready_to_merge_source.erase(pgid);
+  not_ready_to_merge_target.erase(pgid);
+  sent_ready_to_merge_source.erase(pgid);
+}
+
+void OSDSingletonState::clear_sent_ready_to_merge()
+{
+  sent_ready_to_merge_source.clear();
+}
+
+void OSDSingletonState::prune_sent_ready_to_merge()
+{
+  LOG_PREFIX(OSDSingletonState::prune_sent_ready_to_merge);
+  auto source = sent_ready_to_merge_source.begin();
+  while (source != sent_ready_to_merge_source.end()) {
+    if (!osdmap->pg_exists(*source)) {
+      DEBUG("{}", *source);
+      source = sent_ready_to_merge_source.erase(source);
+    } else {
+      DEBUG(" exist {}", *source);
+      ++source;
+    }
+  }
+}
+
 seastar::future<> OSDSingletonState::send_alive(const epoch_t want)
 {
   LOG_PREFIX(OSDSingletonState::send_alive);
diff --git a/src/crimson/osd/shard_services.h b/src/crimson/osd/shard_services.h
index 19717ee55ef..7ab1eef6ce1 100644
--- a/src/crimson/osd/shard_services.h
+++ b/src/crimson/osd/shard_services.h
@@ -371,6 +371,25 @@ private:
   seastar::future<> store_maps(ceph::os::Transaction& t,
                                epoch_t start, Ref<MOSDMap> m);
   void trim_maps(ceph::os::Transaction& t, OSDSuperblock& superblock);
+
+  // -- PG merging --
+  std::map<pg_t, eversion_t> ready_to_merge_source;
+  std::map<pg_t,std::tuple<eversion_t,epoch_t,epoch_t>> ready_to_merge_target;
+  std::set<pg_t> not_ready_to_merge_source;
+  std::map<pg_t,pg_t> not_ready_to_merge_target;
+  std::set<pg_t> sent_ready_to_merge_source;
+  seastar::future<> set_ready_to_merge_source(pg_t pgid,
+                                 eversion_t version);
+  seastar::future<> set_ready_to_merge_target(pg_t pgid,
+                                 eversion_t version,
+                                 epoch_t last_epoch_started,
+                                 epoch_t last_epoch_clean);
+  seastar::future<> set_not_ready_to_merge_source(pg_t source);
+  seastar::future<> set_not_ready_to_merge_target(pg_t target, pg_t source);
+  void clear_ready_to_merge(pg_t pgid);
+  seastar::future<> send_ready_to_merge();
+  void clear_sent_ready_to_merge();
+  void prune_sent_ready_to_merge();
 };
 
 /**
@@ -650,6 +669,15 @@ public:
     return local_state.ec_extent_cache_lru;
   }
 
+  FORWARD_TO_OSD_SINGLETON(set_ready_to_merge_source)
+  FORWARD_TO_OSD_SINGLETON(set_ready_to_merge_target)
+  FORWARD_TO_OSD_SINGLETON(set_not_ready_to_merge_source)
+  FORWARD_TO_OSD_SINGLETON(set_not_ready_to_merge_target)
+  FORWARD_TO_OSD_SINGLETON(clear_ready_to_merge)
+  FORWARD_TO_OSD_SINGLETON(send_ready_to_merge)
+  FORWARD_TO_OSD_SINGLETON(clear_sent_ready_to_merge)
+  FORWARD_TO_OSD_SINGLETON(prune_sent_ready_to_merge)
+
   FORWARD_TO_OSD_SINGLETON(get_pool_info)
   FORWARD(get_throttle, get_throttle, local_state.throttler)
 

From 7f970fcda01fd6c27b28f0c38ff9ffee241a0f04 Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Thu, 8 Jan 2026 10:57:37 +0000
Subject: [PATCH 142/596] crimson/osd/shard_services: inherit from
 peering_sharded_service

Update ShardServices to inherit from seastar::peering_sharded_service.
This allows the service to access its own sharded container directly
via container() rather than manually storing a reference to it.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 src/crimson/osd/shard_services.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/crimson/osd/shard_services.h b/src/crimson/osd/shard_services.h
index 7ab1eef6ce1..803ff092d79 100644
--- a/src/crimson/osd/shard_services.h
+++ b/src/crimson/osd/shard_services.h
@@ -395,7 +395,8 @@ private:
 /**
  * Represents services available to each PG
  */
-class ShardServices : public OSDMapService {
+class ShardServices : public OSDMapService,
+                      public seastar::peering_sharded_service<ShardServices> {
   friend class PGShardManager;
   friend class OSD;
   using cached_map_t = OSDMapService::cached_map_t;

From e7cf68899f6f98592eb25cf313319a50ff1a4bf3 Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Thu, 8 Jan 2026 11:09:58 +0000
Subject: [PATCH 143/596] crimson/osd/pg: modify stop() function

This function ensures that when a PG is being removed or
merged and it calls stop() - it will clear primary state, and
notify the Monitor to clear any pending merge flags.

It will also call client_request_orderer.clear_and_cancel() ensuring
all remaining client requests are properly completed. This is needed
for merging in particular since on_change() is never called for the merge epoch
(handle_advance_map is skipped after merge detection), so
clear_and_cancel() is never invoked on the source PG's orderer.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 src/crimson/osd/pg.cc | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/src/crimson/osd/pg.cc b/src/crimson/osd/pg.cc
index d54cee09ae2..09919ab05f7 100644
--- a/src/crimson/osd/pg.cc
+++ b/src/crimson/osd/pg.cc
@@ -1683,20 +1683,26 @@ seastar::future<> PG::stop()
 {
   logger().info("PG {} {}", pgid, __func__);
   stopping = true;
+
+  context_registry_on_change();
+  clear_primary_state();
+  if (is_primary()) {
+    clear_ready_to_merge();
+  }
+
   cancel_local_background_io_reservation();
   cancel_remote_recovery_reservation();
   check_readable_timer.cancel();
   renew_lease_timer.cancel();
   backend->on_actingset_changed(false);
-  return osdmap_gate.stop().then([this] {
-    return wait_for_active_blocker.stop();
-  }).then([this] {
-    return recovery_handler->stop();
-  }).then([this] {
-    return recovery_backend->stop();
-  }).then([this] {
-    return backend->stop();
-  });
+
+  co_await merge_notify_gate.close();
+  co_await osdmap_gate.stop();
+  co_await wait_for_active_blocker.stop();
+  client_request_orderer.clear_and_cancel(*this);
+  co_await recovery_handler->stop();
+  co_await recovery_backend->stop();
+  co_await backend->stop();
 }
 
 void PG::on_change(ceph::os::Transaction &t) {

From e12454b5fedf880abee8364c5bad2e6aacc7b1cb Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Thu, 8 Jan 2026 16:44:01 +0000
Subject: [PATCH 144/596] crimson/osd: per-PG rendezvous for cross-shard merge
 source handoff

Add infrastructure so source PGs can be extracted from their birth
shard, moved to the target shard, and collected by the target PG before
merge proceeds.

Cross-shard safety: PGs are tied to their birth_shard for destruction.
register_merge_source() uses extract_pg() to detach the source,
seastar::foreign_ptr to hop cores, and
crimson::local_shared_foreign_ptr on the target so release routes
destruction back to the birth shard.

Synchronization: replace the per-shard ShardServices merge_info_t
registry (shared_promise waiters, ready_pgs staging, and cleanup hooks)
with merge state on the target PG itself. Source-side
register_merge_source() delivers PGs via PG::add_merge_source(); the
target waits in PG::collect_merge_sources(n) on a per-PG semaphore.
Duplicate source registrations are ignored. PG::stop() breaks the
semaphore so shutdown does not hang.

ShardServices::register_merge_source() and extract_pg() live in
shard_services; rendezvous types and methods live on PG.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 src/crimson/osd/pg.cc             | 44 +++++++++++++++++++++++++++++++
 src/crimson/osd/pg.h              | 43 ++++++++++++++++++++++++++++++
 src/crimson/osd/shard_services.cc | 41 ++++++++++++++++++++++++++++
 src/crimson/osd/shard_services.h  | 14 ++++++++++
 4 files changed, 142 insertions(+)

diff --git a/src/crimson/osd/pg.cc b/src/crimson/osd/pg.cc
index 09919ab05f7..837d0e0f9a3 100644
--- a/src/crimson/osd/pg.cc
+++ b/src/crimson/osd/pg.cc
@@ -1690,6 +1690,11 @@ seastar::future<> PG::stop()
     clear_ready_to_merge();
   }
 
+  // Wake any coroutine parked in collect_merge_sources() so shutdown
+  // doesn't hang waiting for sources that will never arrive.
+  merge_rendezvous.arrivals.broken();
+  merge_rendezvous.sources.clear();
+
   cancel_local_background_io_reservation();
   cancel_remote_recovery_reservation();
   check_readable_timer.cancel();
@@ -2037,4 +2042,43 @@ void PG::PGLogEntryHandler::partial_write(pg_info_t *info,
                  __func__, info->partial_writes_last_complete);
 }
 
+void PG::add_merge_source(
+    spg_t source,
+    core_id_t birth_shard,
+    seastar::foreign_ptr<Ref<PG>> source_pg)
+{
+  LOG_PREFIX(PG::add_merge_source);
+  auto wrapped =
+    crimson::make_local_shared_foreign<Ref<PG>>(std::move(source_pg));
+  auto [_, inserted] = merge_rendezvous.sources.emplace(
+    source, std::make_pair(birth_shard, std::move(wrapped)));
+  if (inserted) {
+    DEBUG("target {} source {} arrived from shard {} ({} total)",
+          get_pgid(), source, birth_shard,
+          merge_rendezvous.sources.size());
+    merge_rendezvous.arrivals.signal(1);
+  } else {
+    DEBUG("target {} source {} already registered, ignoring",
+          get_pgid(), source);
+  }
+}
+
+seastar::future<PG::merge_source_map_t>
+PG::collect_merge_sources(std::size_t n)
+{
+  LOG_PREFIX(PG::collect_merge_sources);
+  DEBUG("target {} waiting for {} sources ({} already arrived)",
+        get_pgid(), n, merge_rendezvous.sources.size());
+  try {
+    co_await merge_rendezvous.arrivals.wait(n);
+  } catch (const seastar::broken_semaphore&) {
+    DEBUG("target {} merge rendezvous broken, aborting wait", get_pgid());
+    co_return merge_source_map_t{};
+  }
+  ceph_assert(merge_rendezvous.sources.size() == n);
+  auto sources = std::move(merge_rendezvous.sources);
+  merge_rendezvous.sources.clear();
+  co_return sources;
+}
+
 }
diff --git a/src/crimson/osd/pg.h b/src/crimson/osd/pg.h
index f3913c919df..6e5e47c591c 100644
--- a/src/crimson/osd/pg.h
+++ b/src/crimson/osd/pg.h
@@ -8,6 +8,8 @@
 #include <boost/smart_ptr/intrusive_ref_counter.hpp>
 #include <seastar/core/future.hh>
 #include <seastar/core/shared_future.hh>
+#include <seastar/core/semaphore.hh>
+#include <seastar/core/sharded.hh>
 
 #include "common/dout.h"
 #include "common/ostream_temp.h"
@@ -564,6 +566,38 @@ public:
   std::pair<ghobject_t, bool>
   do_delete_work(ceph::os::Transaction &t, ghobject_t _next) final;
 
+  // Per-PG rendezvous used to collect source PGs converging on this PG
+  // during a merge. Producers (source-side coroutines on other shards)
+  // push entries via add_merge_source(); the target-side coroutine waits
+  // via collect_merge_sources(n).
+  using merge_source_entry_t =
+    std::pair<core_id_t, crimson::local_shared_foreign_ptr<Ref<PG>>>;
+  using merge_source_map_t = std::map<spg_t, merge_source_entry_t>;
+
+  // Producer side: called on the target's shard with the foreign PG
+  // already wrapped. The first registration for a given source signals
+  // the semaphore; duplicate registrations (e.g. from replay) are no-ops.
+  void add_merge_source(
+    spg_t source,
+    core_id_t birth_shard,
+    seastar::foreign_ptr<Ref<PG>> source_pg);
+
+  // Consumer side: wait until `n` distinct sources have arrived, then
+  // return them and clear the rendezvous state.  Returns an empty map if
+  // reset_merge_rendezvous() breaks the wait (e.g. PG stop or merge cancel).
+  seastar::future<merge_source_map_t> collect_merge_sources(std::size_t n);
+
+  // Drop in-flight handoffs and reset the semaphore.  Call on PG stop or
+  // after Seastore cross-shard cancel so a failed try cannot leave stale
+  // sources for the next epoch.
+  void reset_merge_rendezvous();
+
+  void merge_from(
+      merge_source_map_t& sources,
+      PeeringCtx &rctx,
+      unsigned split_bits,
+      const pg_merge_meta_t& last_pg_merge_meta);
+
   void clear_ready_to_merge() final {
     LOG_PREFIX(PG::clear_ready_to_merge);
     SUBDEBUGDPP(osd, "", *this);
@@ -1188,6 +1222,15 @@ private:
   // continuations here.
   bool stopping = false;
 
+  // Rendezvous state owned by the target PG of a pending merge.
+  // sources is keyed by source pgid so re-registration is naturally
+  // idempotent; arrivals is signaled exactly once per first insert.
+  struct merge_rendezvous_t {
+    merge_source_map_t sources;
+    seastar::semaphore arrivals{0};
+  };
+  merge_rendezvous_t merge_rendezvous;
+
   // PeeringListener merge callbacks must remain void, but they trigger async
   // mon notifies in ShardServices. Gate them here so failures are logged and
   // PG::stop() waits for them to drain.
diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index e4ff7d02a42..06a55649d3b 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -107,6 +107,47 @@ seastar::future<> PerShardState::broadcast_map_to_pgs(
     });
 }
 
+seastar::future<Ref<PG>> ShardServices::extract_pg(spg_t pgid) {
+  auto pg = local_state.pg_map.get_pg(pgid);
+  ceph_assert(pg);
+  co_await remove_pg(pgid);
+  co_return pg;
+}
+
+seastar::future<> ShardServices::register_merge_source(
+    spg_t target,
+    spg_t source)
+{
+  LOG_PREFIX(ShardServices::register_merge_source);
+
+  core_id_t birth_shard = seastar::this_shard_id();
+  core_id_t target_core = co_await get_pg_mapping(target);
+
+  // Remove the source pg from pg_to_shard_mapping so that
+  // it no longer receives any messages
+  auto pg_to_move = co_await extract_pg(source);
+
+  // Wrap the PG in a foreign_ptr to cross cores safely. If the target
+  // happens to be on the same shard, invoke_on simply runs the lambda
+  // inline.
+  auto foreign_pg = seastar::make_foreign(std::move(pg_to_move));
+
+  DEBUG("Target {} on shard {} (from shard {}); handing off source {}",
+        target, target_core, birth_shard, source);
+
+  co_await container().invoke_on(
+    target_core,
+    [target, source, birth_shard, foreign_pg = std::move(foreign_pg)]
+    (ShardServices& target_svc) mutable {
+      auto target_pg = target_svc.local_state.pg_map.get_pg(target);
+      // PGAdvanceMap on the target shard is expected to have instantiated
+      // the target PG by this point in the merge protocol.
+      ceph_assert(target_pg);
+      target_pg->add_merge_source(
+        source, birth_shard, std::move(foreign_pg));
+    });
+}
+
 Ref<PG> PerShardState::get_pg(spg_t pgid)
 {
   assert_core();
diff --git a/src/crimson/osd/shard_services.h b/src/crimson/osd/shard_services.h
index 803ff092d79..80c26e8d240 100644
--- a/src/crimson/osd/shard_services.h
+++ b/src/crimson/osd/shard_services.h
@@ -546,6 +546,13 @@ public:
     return pg_to_shard_mapping.get_or_create_pg_mapping(pgid, core, store_index);
   }
 
+  seastar::future<core_id_t> get_pg_mapping(spg_t pgid) {
+    return pg_to_shard_mapping.get_or_create_pg_mapping(pgid).then(
+      [](std::pair<core_id_t, store_index_t> mapping) {
+        return mapping.first;
+      });
+  }
+
   auto remove_pg(spg_t pgid) {
     local_state.pg_map.remove_pg(pgid);
     return pg_to_shard_mapping.remove_pg_mapping(pgid);
@@ -670,6 +677,13 @@ public:
     return local_state.ec_extent_cache_lru;
   }
 
+  seastar::future<Ref<PG>> extract_pg(spg_t pgid);
+  // Hand the source PG off to the target PG's rendezvous, hopping shards
+  // if needed. The consumer side (target PG) waits via
+  // PG::collect_merge_sources(); cleanup happens when the target drops the
+  // local_shared_foreign_ptr it received.
+  seastar::future<> register_merge_source(spg_t target, spg_t source);
+
   FORWARD_TO_OSD_SINGLETON(set_ready_to_merge_source)
   FORWARD_TO_OSD_SINGLETON(set_ready_to_merge_target)
   FORWARD_TO_OSD_SINGLETON(set_not_ready_to_merge_source)

From 7f7439cc81ba1b849c928474dc1d62244823450f Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Fri, 9 Jan 2026 07:20:44 +0000
Subject: [PATCH 145/596] crimson/osd/pg: implement PG::merge_from

Add PG::merge_from to execute the merge of source PGs into a target PG.
This function builds a transaction to remove source-specifc metadata
objects and merge source collections into the target collection.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 src/crimson/osd/pg.cc | 38 ++++++++++++++++++++++++++++++++++++++
 src/crimson/osd/pg.h  |  5 +++++
 2 files changed, 43 insertions(+)

diff --git a/src/crimson/osd/pg.cc b/src/crimson/osd/pg.cc
index 837d0e0f9a3..a9506994971 100644
--- a/src/crimson/osd/pg.cc
+++ b/src/crimson/osd/pg.cc
@@ -2081,4 +2081,42 @@ PG::collect_merge_sources(std::size_t n)
   co_return sources;
 }
 
+void PG::merge_from(
+    merge_source_map_t& sources,
+    PeeringCtx &rctx,
+    unsigned split_bits,
+    const pg_merge_meta_t& last_pg_merge_meta)
+{
+  LOG_PREFIX(PG::merge_from);
+  DEBUG("target {}", get_pgid());
+
+  std::map<spg_t, PeeringState*> source_states;
+  for (auto& [pgid, entry] : sources) {
+    auto& src_pg = entry.second;
+    source_states.emplace(pgid, &src_pg->peering_state);
+  }
+
+  // Updates the target's PeeringState and stats (Synchronous)
+  peering_state.merge_from(source_states, rctx, split_bits, last_pg_merge_meta);
+
+  // We iterate through each source and move its objects into the target collection
+  for (auto& [pgid, entry] : sources) {
+    auto& src_pg = entry.second;
+    auto src_coll = src_pg->get_collection_ref()->get_cid();
+    auto dst_coll = coll_ref->get_cid();
+    DEBUG("merging source {}", pgid);
+
+    // Remove source-specific metadata objects that are no longer needed
+    // now that the collections are being collapsed.
+    rctx.transaction.remove(src_coll, src_pg->get_pgid().make_snapmapper_oid());
+    rctx.transaction.remove(src_coll, src_pg->pgmeta_oid);
+    // Move source collection into target collection.
+    rctx.transaction.merge_collection(src_coll, dst_coll, split_bits);
+  }
+
+  // Adjust the collection and snap_mapper to reflect the
+  // new, smaller PG count (reducing bitmask).
+  rctx.transaction.collection_set_bits(coll_ref->get_cid(), split_bits);
+  snap_mapper.update_bits(split_bits);
+}
 }
diff --git a/src/crimson/osd/pg.h b/src/crimson/osd/pg.h
index 6e5e47c591c..2e8238fcaf8 100644
--- a/src/crimson/osd/pg.h
+++ b/src/crimson/osd/pg.h
@@ -586,6 +586,11 @@ public:
   // return them and clear the rendezvous state.  Returns an empty map if
   // reset_merge_rendezvous() breaks the wait (e.g. PG stop or merge cancel).
   seastar::future<merge_source_map_t> collect_merge_sources(std::size_t n);
+  void merge_from(
+      merge_source_map_t& sources,
+      PeeringCtx &rctx,
+      unsigned split_bits,
+      const pg_merge_meta_t& last_pg_merge_meta);
 
   // Drop in-flight handoffs and reset the semaphore.  Call on PG stop or
   // after Seastore cross-shard cancel so a failed try cannot leave stale

From 7c033ce1990937a850d3a8f07b063bd7da198cea Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Fri, 9 Jan 2026 10:48:16 +0000
Subject: [PATCH 146/596] crimson/osd: implement PG merge detection and
 orchestration in PGAdvanceMap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Integrate PG merge handling into the map advancement pipeline.

When pg_num shrinks between epochs, check_for_merges() returns a
merge_result_t describing whether this PG is a merge source, target, or
not involved. start() stops advancing through later epochs once a merge
is detected, then either finish_merge_advance() or the normal activate
path runs so complete_rctx() always happens in one place.

- check_for_merges(): detect pg_num shrink and dispatch merge_pg().
- merge_pg(): merge-only work — Seastore eligibility, source handoff
  setup, target rendezvous collection and PG::merge_from().
- finish_merge_advance(): commit rctx and complete the role-specific
  steps (source: complete_rctx, stop, register_merge_source; target:
  handle_advance_map, handle_activate_map, complete_rctx).

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 .../osd/osd_operations/pg_advance_map.cc      | 112 ++++++++++++++++--
 .../osd/osd_operations/pg_advance_map.h       |  22 ++++
 2 files changed, 124 insertions(+), 10 deletions(-)

diff --git a/src/crimson/osd/osd_operations/pg_advance_map.cc b/src/crimson/osd/osd_operations/pg_advance_map.cc
index d4cc12847e2..ff412adc5db 100644
--- a/src/crimson/osd/osd_operations/pg_advance_map.cc
+++ b/src/crimson/osd/osd_operations/pg_advance_map.cc
@@ -82,20 +82,39 @@ seastar::future<> PGAdvanceMap::start()
     pg->handle_initialize(rctx);
     pg->handle_activate_map(rctx);
   }
-  for (epoch_t next_epoch = from + 1; next_epoch <= to; next_epoch++) {
-    DEBUG("{}: start: getting map {}",
-          *this, next_epoch);
+  ceph_assert(std::cmp_less_equal(from, to));
+
+  for (epoch_t current_epoch = from; current_epoch < to; ++current_epoch) {
+    epoch_t next_epoch = current_epoch + 1;
+    DEBUG("{}: start: getting map {}", *this, next_epoch);
     cached_map_t next_map = co_await shard_services.get_map(next_epoch);
-    DEBUG("{}: advancing map to {}",
-          *this, next_map->get_epoch());
-    // Use the current OSDMap epoch to check for splits consecutively.
-    epoch_t current_epoch = pg->get_osdmap_epoch();
+    merge_result_t merge_result =
+      co_await check_for_merges(current_epoch, next_map, rctx);
+    if (merge_result.role == merge_role_t::Source) {
+      // Merge source: hand the PG off to the target and finish.  The PG
+      // stops existing locally, so there is nothing left to advance here.
+      DEBUG("{}: merge source, handing off after e{}", *this, current_epoch);
+      co_await finish_merge_source(merge_result.parent, rctx);
+      co_await handle.complete();
+      exit_handle.cancel();
+      co_return;
+    }
+    // A successful merge target (merge already applied by check_for_merges)
+    // and the no-merge case both advance this epoch and keep iterating, so
+    // the PG advances all the way to `to`, matching the classic OSD instead
+    // of stalling at an intermediate epoch.
+    DEBUG("{}: advancing map to {}", *this, next_map->get_epoch());
+    // Baseline epoch for split detection: PG map epoch before advancing to next_map.
+    epoch_t split_epoch = pg->get_osdmap_epoch();
     pg->handle_advance_map(next_map, rctx);
     DEBUG("{}: checking for splits between {} and {}",
-          *this, current_epoch, next_map->get_epoch());
-    co_await check_for_splits(current_epoch, std::move(next_map));
+          *this, split_epoch, next_map->get_epoch());
+    co_await check_for_splits(split_epoch, std::move(next_map));
   }
 
+  // Normal completion, which also covers a completed merge target: the PG was
+  // fully advanced to `to` in the loop above, so just activate the final map
+  // and commit.
   pg->handle_activate_map(rctx);
   DEBUG("{}: map activated", *this);
   if (do_init) {
@@ -140,7 +159,6 @@ seastar::future<> PGAdvanceMap::check_for_splits(
   }
 }
 
-
 seastar::future<> PGAdvanceMap::split_pg(
     std::set<spg_t> split_children,
     cached_map_t next_map)
@@ -236,5 +254,79 @@ void PGAdvanceMap::split_stats(std::set<Ref<PG>> children_pgs,
   pg->finish_split_stats(*stat_iter, rctx.transaction);
 }
 
+seastar::future<PGAdvanceMap::merge_result_t> PGAdvanceMap::check_for_merges(
+    epoch_t old_epoch,
+    cached_map_t next_map,
+    PeeringCtx &rctx)
+{
+  LOG_PREFIX(PGAdvanceMap::check_for_merges);
+  using cached_map_t = OSDMapService::cached_map_t;
+  cached_map_t old_map = co_await shard_services.get_map(old_epoch);
+  if (!old_map->have_pg_pool(pg->get_pgid().pool())) {
+    DEBUG("{} pool doesn't exist in epoch {}", pg->get_pgid(),
+	old_epoch);
+    co_return merge_result_t{};
+  }
+  auto old_pg_num = old_map->get_pg_num(pg->get_pgid().pool());
+  if (!next_map->have_pg_pool(pg->get_pgid().pool())) {
+    DEBUG("{} pool doesn't exist in epoch {}", pg->get_pgid(),
+        next_map->get_epoch());
+    co_return merge_result_t{};
+  }
+  auto new_pg_num = next_map->get_pg_num(pg->get_pgid().pool());
+  DEBUG("{} pg_num change in e{} {} -> {}", pg->get_pgid(), next_map->get_epoch(),
+                 old_pg_num, new_pg_num);
+  if (new_pg_num && new_pg_num < old_pg_num) {
+    co_return co_await merge_pg(next_map, new_pg_num, old_pg_num, rctx);
+  }
+  co_return merge_result_t{};
+}
+
+seastar::future<PGAdvanceMap::merge_result_t> PGAdvanceMap::merge_pg(
+    cached_map_t next_map,
+    unsigned new_pg_num,
+    unsigned old_pg_num,
+    PeeringCtx &rctx)
+{
+  LOG_PREFIX(PGAdvanceMap::merge_pg);
+  DEBUG("{}: start", *this);
+  spg_t parent;
+  std::set<spg_t> merge_sources;
+  if (pg->pgid.is_merge_source(old_pg_num,
+                               new_pg_num,
+                               &parent)) {
+    co_return merge_result_t{merge_role_t::Source, parent};
+  } else if (pg->pgid.is_merge_target(old_pg_num,
+                                       new_pg_num)) {
+    DEBUG("Target PG {} identified. Waiting for sources...", pg->get_pgid());
+    pg->pgid.is_split(new_pg_num, old_pg_num, &merge_sources);
+    // Block until all source PGs (potentially from other shards) arrive
+    // on this PG's rendezvous
+    auto sources = co_await pg->collect_merge_sources(merge_sources.size());
+    if (sources.empty()) {
+      co_return merge_result_t{};
+    }
+
+    unsigned split_bits = pg->get_pgid().get_split_bits(new_pg_num);
+    const auto& merge_meta =
+      next_map->get_pg_pool(pg->get_pgid().pool())->last_pg_merge_meta;
+    pg->merge_from(sources, rctx, split_bits, merge_meta);
+
+    co_return merge_result_t{merge_role_t::Target};
+  } else {
+    co_return merge_result_t{};
+  }
+}
+
+seastar::future<> PGAdvanceMap::finish_merge_source(
+    spg_t parent,
+    PeeringCtx &rctx)
+{
+  LOG_PREFIX(PGAdvanceMap::finish_merge_source);
+  DEBUG("{}: committing rctx before handoff to target {}", *this, parent);
+  co_await pg->complete_rctx(std::move(rctx));
+  co_await pg->stop();
+  co_await shard_services.register_merge_source(parent, pg->get_pgid());
+}
 
 }
diff --git a/src/crimson/osd/osd_operations/pg_advance_map.h b/src/crimson/osd/osd_operations/pg_advance_map.h
index 6dbb4a974c2..07e625e69a4 100644
--- a/src/crimson/osd/osd_operations/pg_advance_map.h
+++ b/src/crimson/osd/osd_operations/pg_advance_map.h
@@ -52,8 +52,23 @@ public:
   PipelineHandle &get_handle() { return handle; }
 
   using cached_map_t = OSDMapService::cached_map_t;
+
+  enum class merge_role_t {
+    None,
+    Source,
+    Target,
+  };
+
+  struct merge_result_t {
+    merge_role_t role = merge_role_t::None;
+    spg_t parent;
+  };
+
   seastar::future<> check_for_splits(epoch_t old_epoch,
                                      cached_map_t next_map);
+  seastar::future<merge_result_t> check_for_merges(epoch_t old_epoch,
+                                                   cached_map_t next_map,
+                                                   PeeringCtx &rctx);
   seastar::future<> split_pg(std::set<spg_t> split_children,
                              cached_map_t next_map);
   void split_stats(std::set<Ref<PG>> child_pgs,
@@ -69,10 +84,17 @@ public:
   }
 
 private:
+  seastar::future<merge_result_t> merge_pg(cached_map_t next_map,
+                                           unsigned new_pg_num,
+                                           unsigned old_pg_num,
+                                           PeeringCtx &rctx);
   PGPeeringPipeline &peering_pp(PG &pg);
   seastar::future<Ref<PG>> handle_split_pg_creation(
     spg_t child_pgid,
     cached_map_t next_map);
+  seastar::future<> finish_merge_source(
+    spg_t parent,
+    PeeringCtx &rctx);
 };
 
 }

From 0aa3da13cd76a7075811f665dd7ed83a4a485d48 Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Mon, 19 Jan 2026 12:01:22 +0530
Subject: [PATCH 147/596] doc/dev/crimson: Add explanation for PG merging

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 doc/dev/crimson/pgmerging.rst | 106 ++++++++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 doc/dev/crimson/pgmerging.rst

diff --git a/doc/dev/crimson/pgmerging.rst b/doc/dev/crimson/pgmerging.rst
new file mode 100644
index 00000000000..bb516145384
--- /dev/null
+++ b/doc/dev/crimson/pgmerging.rst
@@ -0,0 +1,106 @@
+===========================================
+PG Merge Synchronization in Crimson
+===========================================
+
+This document describes the infrastructure used to coordinate the merging
+of Placement Groups (PGs) in Crimson.
+
+Background
+----------
+Crimson utilizes a shared-nothing memory model where each PG is owned by
+a specific CPU core. Merging requires cross-core coordination while
+maintaining memory safety and epoch consistency.
+
+Core Concepts
+-------------
+
+.. _migration_safety:
+
+Migration Safety (Memory Ownership)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+PGs are managed by their ``birth_shard``. To prevent cross-shard
+deallocation crashes:
+
+1. **Extraction**: ``ShardServices::extract_pg()`` removes the source PG
+   from its shard map so it stops receiving messages.
+2. **Transportation**: The PG crosses cores in a ``seastar::foreign_ptr``.
+3. **Storage**: The target shard stores each source in
+   ``crimson::local_shared_foreign_ptr<Ref<PG>>`` inside the target PG's
+   rendezvous map. When the target drops the last reference after
+   ``PG::merge_from()``, destruction is routed back to the source
+   ``birth_shard``.
+
+.. _synchronization:
+
+Target and Source PG Synchronization
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Merging involves a race between source PGs checking in and the target PG
+reaching the merge point in ``PGAdvanceMap``.
+
+Synchronization state lives on the **target PG**, not in a per-shard
+registry:
+
+* **``merge_rendezvous_t``**: A map of arrived sources plus a
+  ``seastar::semaphore`` counting first-time registrations.
+* **``PG::add_merge_source()``**: Called on the target's shard when
+  ``ShardServices::register_merge_source()`` delivers a source PG.
+  Duplicate source pgids are ignored (idempotent under replay).
+* **``PG::collect_merge_sources(n)``**: Waits on the rendezvous semaphore
+  for ``n`` arrivals (one signal per first insert), asserts the map has
+  ``n`` entries, then returns sources and clears the rendezvous.  If
+  ``reset_merge_rendezvous()`` breaks the wait, returns an empty map.
+* **``PG::reset_merge_rendezvous()``**: Clears in-flight handoffs and
+  resets the semaphore. Called on ``PG::stop()`` or after a Seastore
+  cross-shard abort so a failed try cannot leave stale sources for a
+  later epoch.
+
+**Cross-shard handoff**: ``register_merge_source()`` resolves the target
+shard, extracts the source locally, and uses ``invoke_on`` to call
+``add_merge_source()`` on the target PG.
+
+.. _map_consistency:
+
+Map Advancement and Pipeline Stalling
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+To ensure the merge occurs between PGs at the same logical time:
+
+* ``PGAdvanceMap::check_for_merges()`` detects ``pg_num`` shrink between
+  map epochs and returns a ``merge_result_t`` (source, target, or none).
+* ``merge_pg()`` performs merge-specific work only (Seastore eligibility,
+  rendezvous collection, ``PG::merge_from()`` on the target).
+* A single ``PGAdvanceMap`` operation may batch multiple map epochs
+  (``from`` through ``to``). Only a **merge source** stops the epoch
+  loop early: ``finish_merge_source()`` commits ``rctx``, stops the PG,
+  and calls ``register_merge_source()``. A **merge target** runs
+  ``merge_from()`` at the merge epoch, then continues advancing through
+  the remaining epochs up to ``to`` (matching classic OSD behavior).
+  Normal completion at the end of ``start()`` activates the final map
+  and commits ``rctx`` (also covering a completed merge target).
+* The target does not call ``merge_from()`` until sources frozen at the
+  merge epoch have arrived on its rendezvous.
+
+.. _seastore_cross_shard:
+
+Seastore Cross-Shard Merges
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Seastore does not support merging collections across reactor shards.
+Before a source hands off or a target collects sources, ``merge_pg()``
+calls ``ShardServices::seastore_merge_shards_ok()`` with the full sibling
+set. If the target and any source map to different shards, the OSD aborts
+the attempt: clears ready-to-merge state, sends
+``MOSDPGReadyToMerge{ ready=false }`` for the source so the monitor does
+not commit the unsafe ``pg_num`` decrement, resets the target rendezvous,
+and sends ``MOSDPGStopMerge`` to the monitor (once per pool per OSD).
+The monitor clamps ``pg_num_target`` to ``pg_num`` and clears
+``FLAG_CRIMSON_ALLOW_PG_MERGE`` for that pool until operators re-enable
+merging (``crimson_allow_pg_merge``).
+
+Cleanup
+-------
+After ``complete_rctx()``, the target releases its ``local_shared_foreign_ptr``
+references; source PG objects are destroyed on their ``birth_shard``.
+
+When the OSD finishes consuming a new OSDMap in ``OSD::committed_osd_maps()``,
+``OSDSingletonState::prune_sent_ready_to_merge()`` drops ``sent_ready_to_merge_source``
+entries (and stale ``pools_merge_stopped_reported`` pool ids) for PGs that no
+longer exist in the committed map, mirroring classic ``OSD::consume_map()``.

From 1f1db7d0cd91ce9d34986d05c3c457f873efb3c6 Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Tue, 28 Apr 2026 12:11:22 +0530
Subject: [PATCH 148/596] mon/OSDMonitor: introduce per-pool
 crimson_allow_pg_merge flag

Switch Crimson PG merge gating from a global config to a pool-scoped flag.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 src/mon/MonCommands.h |  2 ++
 src/mon/OSDMonitor.cc | 53 +++++++++++++++++++++++++++++++------------
 src/osd/osd_types.h   |  6 +++++
 3 files changed, 47 insertions(+), 14 deletions(-)

diff --git a/src/mon/MonCommands.h b/src/mon/MonCommands.h
index 3c7f13db567..3024667cf67 100644
--- a/src/mon/MonCommands.h
+++ b/src/mon/MonCommands.h
@@ -1184,6 +1184,7 @@ COMMAND("osd pool get "
           "|compression_min_blob_size"
           "|compression_mode"
           "|compression_required_ratio"
+          "|crimson_allow_pg_merge"
           "|crush_rule"
           "|csum_max_block"
           "|csum_min_block"
@@ -1250,6 +1251,7 @@ COMMAND("osd pool set "
           "|compression_min_blob_size"
           "|compression_mode"
           "|compression_required_ratio"
+          "|crimson_allow_pg_merge"
           "|crush_rule"
           "|csum_max_block"
           "|csum_min_block"
diff --git a/src/mon/OSDMonitor.cc b/src/mon/OSDMonitor.cc
index c27879fcd44..b256899e3a4 100644
--- a/src/mon/OSDMonitor.cc
+++ b/src/mon/OSDMonitor.cc
@@ -4078,7 +4078,19 @@ bool OSDMonitor::prepare_pg_ready_to_merge(MonOpRequestRef op)
     return false; /* nothing to propose, yet */
   }
 
-  if (m->ready) {
+  bool allow_merge = true;
+  if (m->ready && p.has_flag(pg_pool_t::FLAG_CRIMSON)) {
+    if (!p.has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+      allow_merge = false;
+      mon.clog->warn() << "blocking crimson pg merge for " << m->pgid
+                       << " (pool '" << osdmap.get_pool_name(m->pgid.pool())
+                       << "') because pool flag 'crimson_allow_pg_merge' is not set";
+      dout(1) << __func__ << " blocking crimson pg merge for " << m->pgid
+              << " because pool flag crimson_allow_pg_merge is not set" << dendl;
+    }
+  }
+
+  if (m->ready && allow_merge) {
     p.dec_pg_num(m->pgid,
 		 pending_inc.epoch,
 		 m->source_version,
@@ -8742,11 +8754,14 @@ int OSDMonitor::prepare_command_pool_set(const cmdmap_t& cmdmap,
       return -EPERM;
     }
     // check for Crimson pools
-    // pg merging is not yet supported in Crimson
+    // pg merging is only supported when explicitly enabled per-pool (crimson_allow_pg_merge)
     if (p.has_flag(pg_pool_t::FLAG_CRIMSON)) {
       if (n < (int)p.get_pg_num()) {
-        ss << "crimson-osd does not support decreasing pg_num_actual (shrinking)";
-        return -ENOTSUP;
+        if (!p.has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+          ss << "crimson-osd does not support decreasing pg_num_actual (shrinking) "
+             << "unless the pool flag crimson_allow_pg_merge is set";
+          return -ENOTSUP;
+        }
       }
       if (n > (int)p.get_pg_num() && !g_conf().get_val<bool>("crimson_allow_pg_split")) {
         ss << "crimson_allow_pg_split is false; pg_num_actual increase denied";
@@ -8805,11 +8820,14 @@ int OSDMonitor::prepare_command_pool_set(const cmdmap_t& cmdmap,
       return -EPERM;
     }
     // check for Crimson pools
-    // pg merging is not yet supported in Crimson
+    // pg merging is only supported when explicitly enabled per-pool (crimson_allow_pg_merge)
     if (p.has_flag(pg_pool_t::FLAG_CRIMSON)) {
       if (n < (int)p.get_pg_num_target()) {
-        ss << "crimson-osd does not support decreasing pg_num";
-        return -ENOTSUP;
+        if (!p.has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+          ss << "crimson-osd does not support decreasing pg_num "
+             << "unless the pool flag crimson_allow_pg_merge is set";
+          return -ENOTSUP;
+        }
       }
       if (n > (int)p.get_pg_num_target() && !g_conf().get_val<bool>("crimson_allow_pg_split")) {
         ss << "crimson_allow_pg_split is false; pg_num increase denied for crimson pool";
@@ -8886,11 +8904,14 @@ int OSDMonitor::prepare_command_pool_set(const cmdmap_t& cmdmap,
       return -EPERM;
     }
     // check for Crimson pools
-    // pg merging is not yet supported in Crimson
+    // pg merging is only supported when explicitly enabled per-pool (crimson_allow_pg_merge)
     if (p.has_flag(pg_pool_t::FLAG_CRIMSON)) {
       if (n < (int)p.get_pgp_num()) {
-        ss << "crimson-osd does not support decreasing pgp_num_actual";
-        return -ENOTSUP;
+        if (!p.has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+          ss << "crimson-osd does not support decreasing pgp_num_actual "
+             << "unless the pool flag crimson_allow_pg_merge is set";
+          return -ENOTSUP;
+        }
       }
       if (n > (int)p.get_pgp_num() && !g_conf().get_val<bool>("crimson_allow_pg_split")) {
         ss << "crimson_allow_pg_split is false; pgp_num_actual increase denied";
@@ -8921,11 +8942,14 @@ int OSDMonitor::prepare_command_pool_set(const cmdmap_t& cmdmap,
       return -EPERM;
     }
     // check for Crimson pools
-    // pg merging is not yet supported in Crimson
+    // pg merging is only supported when explicitly enabled per-pool (crimson_allow_pg_merge)
     if (p.has_flag(pg_pool_t::FLAG_CRIMSON)) {
       if (n < (int)p.get_pgp_num_target()) {
-        ss << "crimson-osd does not support decreasing pgp_num";
-        return -ENOTSUP;
+        if (!p.has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+          ss << "crimson-osd does not support decreasing pgp_num "
+             << "unless the pool flag crimson_allow_pg_merge is set";
+          return -ENOTSUP;
+        }
       }
       if (n > (int)p.get_pgp_num_target() && !g_conf().get_val<bool>("crimson_allow_pg_split")) {
         ss << "crimson_allow_pg_split is false; pgp_num increase denied";
@@ -8978,7 +9002,8 @@ int OSDMonitor::prepare_command_pool_set(const cmdmap_t& cmdmap,
     p.crush_rule = id;
   } else if (var == "nodelete" || var == "nopgchange" ||
 	     var == "nosizechange" || var == "write_fadvise_dontneed" ||
-	     var == "noscrub" || var == "nodeep-scrub" || var == "bulk") {
+	     var == "noscrub" || var == "nodeep-scrub" || var == "bulk" ||
+	     var == "crimson_allow_pg_merge") {
     uint64_t flag = pg_pool_t::get_flag_by_name(var);
     // make sure we only compare against 'n' if we didn't receive a string
     if (val == "true" || (interr.empty() && n == 1)) {
diff --git a/src/osd/osd_types.h b/src/osd/osd_types.h
index bb6cc381fee..1065066948e 100644
--- a/src/osd/osd_types.h
+++ b/src/osd/osd_types.h
@@ -1330,6 +1330,9 @@ struct pg_pool_t {
     FLAG_EC_OPTIMIZATIONS = 1<<19, // enable optimizations, once enabled, cannot be disabled
     FLAG_CLIENT_SPLIT_READS = 1<<20, // Optimized EC is permitted to do direct reads.
     FLAG_OMAP = 1<<21, // Pool is permitted to perform OMAP operations
+    // Allow decreasing pg_num/pgp_num (PG merge) for crimson pools.
+    // Note: requires that the pool is currently all bluestore.
+    FLAG_CRIMSON_ALLOW_PG_MERGE = 1<<22,
   };
 
   static const char *get_flag_name(uint64_t f) {
@@ -1356,6 +1359,7 @@ struct pg_pool_t {
     case FLAG_EC_OPTIMIZATIONS: return "ec_optimizations";
     case FLAG_CLIENT_SPLIT_READS: return "split_reads";
     case FLAG_OMAP: return "supports_omap";
+    case FLAG_CRIMSON_ALLOW_PG_MERGE: return "crimson_allow_pg_merge";
     default: return "???";
     }
   }
@@ -1412,6 +1416,8 @@ struct pg_pool_t {
       return FLAG_BULK;
     if (name == "crimson")
       return FLAG_CRIMSON;
+    if (name == "crimson_allow_pg_merge")
+      return FLAG_CRIMSON_ALLOW_PG_MERGE;
     if (name == "ec_optimizations")
       return FLAG_EC_OPTIMIZATIONS;
     if (name == "split_reads")

From 4e44d8a1607087502c97e87e6b65e892fc161f15 Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Tue, 13 Jan 2026 07:59:31 +0000
Subject: [PATCH 149/596] qa/suites/crimson: Add a test for PG merging in the
 crimson suite

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 qa/objectstore_crimson/crimson_bluestore.yaml |  2 +
 .../singleton/all/osd-pg-merging.yaml         | 30 ++++++
 qa/workunits/rados/test_pg_merging.sh         | 97 +++++++++++++++++++
 3 files changed, 129 insertions(+)
 create mode 100644 qa/suites/crimson-rados/singleton/all/osd-pg-merging.yaml
 create mode 100755 qa/workunits/rados/test_pg_merging.sh

diff --git a/qa/objectstore_crimson/crimson_bluestore.yaml b/qa/objectstore_crimson/crimson_bluestore.yaml
index ff9bcab187d..1c5895deed0 100644
--- a/qa/objectstore_crimson/crimson_bluestore.yaml
+++ b/qa/objectstore_crimson/crimson_bluestore.yaml
@@ -2,6 +2,8 @@ overrides:
   ceph:
     fs: xfs
     conf:
+      global:
+        crimson_allow_pg_merge: true
       osd:
         # crimson's osd objectstore option
         osd objectstore: bluestore
diff --git a/qa/suites/crimson-rados/singleton/all/osd-pg-merging.yaml b/qa/suites/crimson-rados/singleton/all/osd-pg-merging.yaml
new file mode 100644
index 00000000000..9f4e1a2dd97
--- /dev/null
+++ b/qa/suites/crimson-rados/singleton/all/osd-pg-merging.yaml
@@ -0,0 +1,30 @@
+roles:
+- - mon.a
+  - mon.b
+  - mon.c
+  - mgr.x
+  - osd.0
+  - osd.1
+  - osd.2
+  - client.0
+openstack:
+  - volumes: # attached to each instance
+      count: 3
+      size: 10 # GB
+tasks:
+- install:
+- ceph:
+    pre-mgr-commands:
+      - sudo ceph config set mgr mgr_pool false --force
+    log-ignorelist:
+      - but it is still running
+      - overall HEALTH_
+      - \(PG_
+    conf:
+      osd:
+        osd min pg log entries: 5
+        crimson cpu num: 2
+- workunit:
+    clients:
+      client.0:
+        - rados/test_pg_merging.sh
diff --git a/qa/workunits/rados/test_pg_merging.sh b/qa/workunits/rados/test_pg_merging.sh
new file mode 100755
index 00000000000..1441511bebb
--- /dev/null
+++ b/qa/workunits/rados/test_pg_merging.sh
@@ -0,0 +1,97 @@
+#!/bin/bash
+
+. $(dirname $0)/../../standalone/ceph-helpers.sh
+
+set -x
+
+function wait_for_merge_completion() {
+    local pool=$1
+    local target=$2
+    local stall_timeout=60
+    local actual=0
+    local last_actual=0
+    local last_progress_time
+
+    wait_for_clean || return 1
+    last_actual=$(ceph pg ls-by-pool $pool --format=json 2>/dev/null | jq -r ".pg_stats | length")
+    last_progress_time=$(date +%s)
+
+    echo "Waiting for pool $pool to reach $target PGs..."
+
+    while true; do
+        actual=$last_actual
+        echo "Current PG count: $actual (Target: $target)"
+        if [ "$actual" -eq "$target" ]; then
+            break
+        fi
+
+        sleep 2
+        wait_for_clean || return 1
+        actual=$(ceph pg ls-by-pool $pool --format=json 2>/dev/null | jq -r ".pg_stats | length")
+
+        if [ "$actual" -lt "$last_actual" ]; then
+            last_progress_time=$(date +%s)
+        fi
+        last_actual=$actual
+
+        if [ $(( $(date +%s) - last_progress_time )) -ge "$stall_timeout" ]; then
+            echo "PG merge made no progress for ${stall_timeout}s in pool $pool (still at $actual PGs)"
+            return 1
+        fi
+    done
+}
+
+function test_pg_merging() {
+    local pool="merge_pool"
+    ceph osd pool delete $pool $pool --yes-i-really-really-mean-it || true
+    create_pool $pool 16
+    wait_for_clean || return 1
+
+    ceph osd pool set $pool nopgchange 0
+    ceph osd pool set $pool crimson_allow_pg_merge true
+
+    # Induce merges
+    ceph osd pool set $pool pg_num 4
+    ceph osd pool set $pool pg_num_min 4
+    
+    wait_for_merge_completion $pool 4 || return 1
+    
+    ceph osd pool set $pool pgp_num 4
+    wait_for_clean || return 1
+}
+
+function test_pg_merging_with_radosbench() {
+    local pool="merge_bench"
+    ceph osd pool delete $pool $pool --yes-i-really-really-mean-it || true
+    create_pool $pool 16
+    wait_for_clean || return 1
+
+    # Start radosbench writes
+    timeout 120 rados bench -p $pool 60 write -b 4096 --no-cleanup &
+    BENCH_PID=$!
+    sleep 5
+
+    # merge
+    ceph osd pool set $pool nopgchange 0
+    ceph osd pool set $pool crimson_allow_pg_merge true
+    ceph osd pool set $pool pg_num 4
+    ceph osd pool set $pool pg_num_min 4
+    
+    # Use the loop to ensure we don't stop until all 12 PGs are merged away
+    wait_for_merge_completion $pool 4 || return 1
+    
+    ceph osd pool set $pool pgp_num 4
+    wait_for_clean || return 1
+
+    # Ensure the bench finished successfully
+    wait $BENCH_PID
+    
+    # Final check
+    actual=$(ceph pg ls-by-pool $pool --format=json 2>/dev/null | jq -r ".pg_stats | length")
+    test "$actual" -eq 4 || return 1
+}
+
+test_pg_merging || { echo "test_pg_merging failed"; exit 1; }
+test_pg_merging_with_radosbench || { echo "test_pg_merging_with_radosbench failed"; exit 1; }
+
+echo "OK"

From f94860bd17ec6dfba8e1a69b68c3a99c03ba5101 Mon Sep 17 00:00:00 2001
From: Aishwarya Mathuria <amathuri@redhat.com>
Date: Mon, 18 May 2026 13:37:26 +0000
Subject: [PATCH 150/596] crimson/osd: reject Seastore PG merges across shards

Seastore cannot merge collections between reactor shards currently.
On cross-shard detection, tell the monitor the source PG is not ready
(via MOSDPGReadyToMerge{ ready=false }) so the unsafe pg_num decrement
is never proposed, then send MOSDPGStopMerge to clamp pg_num_target and
permanently disable further shrink for the pool.

Signed-off-by: Aishwarya Mathuria <amathuri@redhat.com>
---
 .../osd/osd_operations/pg_advance_map.cc      |  10 ++
 src/crimson/osd/pg.cc                         |  13 +-
 src/crimson/osd/pg.h                          |   5 -
 src/crimson/osd/shard_services.cc             | 119 ++++++++++++++++++
 src/crimson/osd/shard_services.h              |  20 +++
 src/messages/MOSDPGStopMerge.h                |  53 ++++++++
 src/mon/Monitor.cc                            |   1 +
 src/mon/OSDMonitor.cc                         |  88 +++++++++++++
 src/mon/OSDMonitor.h                          |   3 +
 src/msg/Message.cc                            |   4 +
 src/msg/Message.h                             |   1 +
 src/msg/MessageRef.h                          |   1 +
 12 files changed, 309 insertions(+), 9 deletions(-)
 create mode 100644 src/messages/MOSDPGStopMerge.h

diff --git a/src/crimson/osd/osd_operations/pg_advance_map.cc b/src/crimson/osd/osd_operations/pg_advance_map.cc
index ff412adc5db..5ba9dc4dff5 100644
--- a/src/crimson/osd/osd_operations/pg_advance_map.cc
+++ b/src/crimson/osd/osd_operations/pg_advance_map.cc
@@ -295,11 +295,21 @@ seastar::future<PGAdvanceMap::merge_result_t> PGAdvanceMap::merge_pg(
   if (pg->pgid.is_merge_source(old_pg_num,
                                new_pg_num,
                                &parent)) {
+    parent.is_split(new_pg_num, old_pg_num, &merge_sources);
+    if (!co_await shard_services.seastore_merge_shards_ok(
+          parent, merge_sources)) {
+      co_return merge_result_t{};
+    }
     co_return merge_result_t{merge_role_t::Source, parent};
   } else if (pg->pgid.is_merge_target(old_pg_num,
                                        new_pg_num)) {
     DEBUG("Target PG {} identified. Waiting for sources...", pg->get_pgid());
     pg->pgid.is_split(new_pg_num, old_pg_num, &merge_sources);
+
+    if (!co_await shard_services.seastore_merge_shards_ok(
+          pg->get_pgid(), merge_sources)) {
+      co_return merge_result_t{};
+    }
     // Block until all source PGs (potentially from other shards) arrive
     // on this PG's rendezvous
     auto sources = co_await pg->collect_merge_sources(merge_sources.size());
diff --git a/src/crimson/osd/pg.cc b/src/crimson/osd/pg.cc
index a9506994971..f79e8272d99 100644
--- a/src/crimson/osd/pg.cc
+++ b/src/crimson/osd/pg.cc
@@ -1690,10 +1690,7 @@ seastar::future<> PG::stop()
     clear_ready_to_merge();
   }
 
-  // Wake any coroutine parked in collect_merge_sources() so shutdown
-  // doesn't hang waiting for sources that will never arrive.
-  merge_rendezvous.arrivals.broken();
-  merge_rendezvous.sources.clear();
+  reset_merge_rendezvous();
 
   cancel_local_background_io_reservation();
   cancel_remote_recovery_reservation();
@@ -2081,6 +2078,14 @@ PG::collect_merge_sources(std::size_t n)
   co_return sources;
 }
 
+void PG::reset_merge_rendezvous()
+{
+  // Unblock any waiter in collect_merge_sources() with broken(); then
+  // replace the semaphore so the next merge attempt starts at zero signals.
+  merge_rendezvous.arrivals.broken();
+  merge_rendezvous = merge_rendezvous_t{};
+}
+
 void PG::merge_from(
     merge_source_map_t& sources,
     PeeringCtx &rctx,
diff --git a/src/crimson/osd/pg.h b/src/crimson/osd/pg.h
index 2e8238fcaf8..6e5e47c591c 100644
--- a/src/crimson/osd/pg.h
+++ b/src/crimson/osd/pg.h
@@ -586,11 +586,6 @@ public:
   // return them and clear the rendezvous state.  Returns an empty map if
   // reset_merge_rendezvous() breaks the wait (e.g. PG stop or merge cancel).
   seastar::future<merge_source_map_t> collect_merge_sources(std::size_t n);
-  void merge_from(
-      merge_source_map_t& sources,
-      PeeringCtx &rctx,
-      unsigned split_bits,
-      const pg_merge_meta_t& last_pg_merge_meta);
 
   // Drop in-flight handoffs and reset the semaphore.  Call on PG stop or
   // after Seastore cross-shard cancel so a failed try cannot leave stale
diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index 06a55649d3b..00b5dbabe0e 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -10,6 +10,7 @@
 #include "messages/MOSDPGCreated.h"
 #include "messages/MOSDPGTemp.h"
 #include "messages/MOSDPGReadyToMerge.h"
+#include "messages/MOSDPGStopMerge.h"
 
 #include "osd/osd_perf_counters.h"
 #include "osd/PeeringState.h"
@@ -148,6 +149,84 @@ seastar::future<> ShardServices::register_merge_source(
     });
 }
 
+bool ShardServices::is_seastore_objectstore()
+{
+  return crimson::common::local_conf().get_val<std::string>(
+    "osd_objectstore") == "seastore";
+}
+
+seastar::future<> ShardServices::reset_target_merge_rendezvous(spg_t target)
+{
+  const core_id_t target_core = co_await get_pg_mapping(target);
+  co_await container().invoke_on(
+    target_core,
+    [target](ShardServices& target_svc) {
+      if (auto target_pg = target_svc.local_state.pg_map.get_pg(target)) {
+        target_pg->reset_merge_rendezvous();
+      }
+    });
+}
+
+seastar::future<> ShardServices::send_stop_pool_merge(pg_t source_pgid)
+{
+  co_await with_singleton(
+    [pool = source_pgid.pool(), source_pgid](OSDSingletonState& singleton) {
+      return singleton.send_stop_pool_pg_merge(pool, source_pgid);
+    });
+}
+
+seastar::future<> ShardServices::abort_seastore_cross_shard_merge(
+  spg_t target,
+  pg_t source_pgid,
+  const std::set<spg_t>* all_sources,
+  bool reset_target_rendezvous)
+{
+  if (all_sources) {
+    for (const auto& src : *all_sources) {
+      co_await clear_ready_to_merge(src.pgid);
+    }
+  } else {
+    co_await clear_ready_to_merge(source_pgid);
+  }
+  co_await clear_ready_to_merge(target.pgid);
+
+  // Ensure the monitor backs off before it can commit a pg_num decrement
+  // for this source.  "Stop merge" is permanent policy; "not ready" prevents
+  // an already-in-flight decrement decision from being committed.
+  co_await set_not_ready_to_merge_source(source_pgid);
+  co_await send_stop_pool_merge(source_pgid);
+  if (reset_target_rendezvous) {
+    co_await reset_target_merge_rendezvous(target);
+  }
+}
+
+
+seastar::future<bool> ShardServices::seastore_merge_shards_ok(
+  spg_t target,
+  const std::set<spg_t>& merge_sources)
+{
+  LOG_PREFIX(ShardServices::seastore_merge_shards_ok);
+  if (!is_seastore_objectstore()) {
+    co_return true;
+  }
+  const core_id_t target_core = co_await get_pg_mapping(target);
+  std::optional<pg_t> cross_shard_source;
+  for (const auto& src : merge_sources) {
+    if (co_await get_pg_mapping(src) != target_core) {
+      cross_shard_source = src.pgid;
+      break;
+    }
+  }
+  if (!cross_shard_source) {
+    co_return true;
+  }
+  DEBUG("seastore: target {} has a cross-shard merge source {}; stop pool merge",
+        target, *cross_shard_source);
+  co_await abort_seastore_cross_shard_merge(
+    target, *cross_shard_source, &merge_sources, true);
+  co_return false;
+}
+
 Ref<PG> PerShardState::get_pg(spg_t pgid)
 {
   assert_core();
@@ -479,9 +558,49 @@ void OSDSingletonState::clear_sent_ready_to_merge()
   sent_ready_to_merge_source.clear();
 }
 
+seastar::future<> OSDSingletonState::send_stop_pool_pg_merge(int64_t pool, pg_t pgid)
+{
+  LOG_PREFIX(OSDSingletonState::send_stop_pool_pg_merge);
+  const pg_pool_t *pi = osdmap->get_pg_pool(pool);
+  if (!pi || !pi->is_crimson()) {
+    co_return;
+  }
+  if (!pi->has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+    pools_merge_stopped_reported.insert(pool);
+    co_return;
+  }
+  // Claim the pool before co_await: otherwise concurrent callers can all pass
+  // the check and each send MOSDPGStopMerge while yielded on send_message().
+  if (!pools_merge_stopped_reported.insert(pool).second) {
+    co_return;
+  }
+  DEBUG("seastore: asking monitor to stop PG merge for pool {} (pg {})",
+        pool, pgid);
+  co_await monc.send_message(crimson::make_message<MOSDPGStopMerge>(
+    pool, pgid, MOSDPGStopMerge::REASON_CROSS_SHARD, osdmap->get_epoch()));
+}
+
+void OSDSingletonState::prune_pools_merge_stopped_reported()
+{
+  // send_stop_pool_pg_merge() inserts a pool after one MOSDPGStopMerge so we
+  // do not spam the mon on every cross-shard source/target pair.  Keep that
+  // entry while the map still has merge disabled; forget it if the pool
+  // disappears or crimson_allow_pg_merge is set again.
+  auto pool = pools_merge_stopped_reported.begin();
+  while (pool != pools_merge_stopped_reported.end()) {
+    const pg_pool_t *pi = osdmap->get_pg_pool(*pool);
+    if (!pi || pi->has_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE)) {
+      pool = pools_merge_stopped_reported.erase(pool);
+    } else {
+      ++pool;
+    }
+  }
+}
+
 void OSDSingletonState::prune_sent_ready_to_merge()
 {
   LOG_PREFIX(OSDSingletonState::prune_sent_ready_to_merge);
+  prune_pools_merge_stopped_reported();
   auto source = sent_ready_to_merge_source.begin();
   while (source != sent_ready_to_merge_source.end()) {
     if (!osdmap->pg_exists(*source)) {
diff --git a/src/crimson/osd/shard_services.h b/src/crimson/osd/shard_services.h
index 80c26e8d240..430f41502bf 100644
--- a/src/crimson/osd/shard_services.h
+++ b/src/crimson/osd/shard_services.h
@@ -378,6 +378,7 @@ private:
   std::set<pg_t> not_ready_to_merge_source;
   std::map<pg_t,pg_t> not_ready_to_merge_target;
   std::set<pg_t> sent_ready_to_merge_source;
+  std::set<int64_t> pools_merge_stopped_reported;
   seastar::future<> set_ready_to_merge_source(pg_t pgid,
                                  eversion_t version);
   seastar::future<> set_ready_to_merge_target(pg_t pgid,
@@ -388,7 +389,9 @@ private:
   seastar::future<> set_not_ready_to_merge_target(pg_t target, pg_t source);
   void clear_ready_to_merge(pg_t pgid);
   seastar::future<> send_ready_to_merge();
+  seastar::future<> send_stop_pool_pg_merge(int64_t pool, pg_t pgid);
   void clear_sent_ready_to_merge();
+  void prune_pools_merge_stopped_reported();
   void prune_sent_ready_to_merge();
 };
 
@@ -684,6 +687,14 @@ public:
   // local_shared_foreign_ptr it received.
   seastar::future<> register_merge_source(spg_t target, spg_t source);
 
+  static bool is_seastore_objectstore();
+
+  // True if every merge source is co-located on the target PG's shard
+  // (Seastore only). Uses the full sibling set so one source cannot commit
+  // while another would abort.
+  seastar::future<bool> seastore_merge_shards_ok(
+    spg_t target, const std::set<spg_t>& merge_sources);
+
   FORWARD_TO_OSD_SINGLETON(set_ready_to_merge_source)
   FORWARD_TO_OSD_SINGLETON(set_ready_to_merge_target)
   FORWARD_TO_OSD_SINGLETON(set_not_ready_to_merge_source)
@@ -854,6 +865,15 @@ public:
       invoke_context_on_core(seastar::this_shard_id(), on_reserved));
   }
 
+private:
+  seastar::future<> reset_target_merge_rendezvous(spg_t target);
+  seastar::future<> send_stop_pool_merge(pg_t source_pgid);
+  seastar::future<> abort_seastore_cross_shard_merge(
+    spg_t target,
+    pg_t source_pgid,
+    const std::set<spg_t>* all_sources,
+    bool reset_target_rendezvous);
+
 #undef FORWARD_CONST
 #undef FORWARD
 #undef FORWARD_TO_OSD_SINGLETON
diff --git a/src/messages/MOSDPGStopMerge.h b/src/messages/MOSDPGStopMerge.h
new file mode 100644
index 00000000000..fa0fa5ce446
--- /dev/null
+++ b/src/messages/MOSDPGStopMerge.h
@@ -0,0 +1,53 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab
+
+#pragma once
+
+#include "osd/osd_types.h"
+#include "messages/PaxosServiceMessage.h"
+
+/// OSD -> mon: permanently stop PG merge shrink for a Crimson pool.
+class MOSDPGStopMerge : public PaxosServiceMessage {
+public:
+  static constexpr uint8_t REASON_CROSS_SHARD = 1;
+
+  int64_t pool = -1;
+  pg_t pgid;
+  uint8_t reason = REASON_CROSS_SHARD;
+
+  MOSDPGStopMerge()
+    : PaxosServiceMessage{MSG_OSD_PG_STOP_MERGE, 0}
+  {}
+  MOSDPGStopMerge(int64_t pool, pg_t pgid, uint8_t reason, epoch_t epoch)
+    : PaxosServiceMessage{MSG_OSD_PG_STOP_MERGE, epoch},
+      pool(pool),
+      pgid(pgid),
+      reason(reason)
+  {}
+  void encode_payload(uint64_t features) override {
+    using ceph::encode;
+    paxos_encode();
+    encode(pool, payload);
+    encode(pgid, payload);
+    encode(reason, payload);
+  }
+  void decode_payload() override {
+    using ceph::decode;
+    auto p = payload.cbegin();
+    paxos_decode(p);
+    decode(pool, p);
+    decode(pgid, p);
+    decode(reason, p);
+  }
+  std::string_view get_type_name() const override { return "osd_pg_stop_merge"; }
+  void print(std::ostream &out) const {
+    out << get_type_name()
+        << "(pool " << pool
+        << " pg " << pgid
+        << " reason " << (unsigned)reason
+        << " v" << version << ")";
+  }
+private:
+  template<class T, typename... Args>
+  friend boost::intrusive_ptr<T> ceph::make_message(Args&&... args);
+};
diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc
index 80bca9ca4b9..205fb23c7ce 100644
--- a/src/mon/Monitor.cc
+++ b/src/mon/Monitor.cc
@@ -4782,6 +4782,7 @@ void Monitor::dispatch_op(MonOpRequestRef op)
     case MSG_REMOVE_SNAPS:
     case MSG_MON_GET_PURGED_SNAPS:
     case MSG_OSD_PG_READY_TO_MERGE:
+    case MSG_OSD_PG_STOP_MERGE:
       paxos_service[PAXOS_OSDMAP]->dispatch(op);
       return;
 
diff --git a/src/mon/OSDMonitor.cc b/src/mon/OSDMonitor.cc
index b256899e3a4..8121ea2523c 100644
--- a/src/mon/OSDMonitor.cc
+++ b/src/mon/OSDMonitor.cc
@@ -54,6 +54,7 @@
 #include "messages/MOSDPGCreated.h"
 #include "messages/MOSDPGTemp.h"
 #include "messages/MOSDPGReadyToMerge.h"
+#include "messages/MOSDPGStopMerge.h"
 #include "messages/MMonCommand.h"
 #include "messages/MRemoveSnaps.h"
 #include "messages/MRoute.h"
@@ -2771,6 +2772,8 @@ bool OSDMonitor::preprocess_query(MonOpRequestRef op)
     return preprocess_pg_created(op);
   case MSG_OSD_PG_READY_TO_MERGE:
     return preprocess_pg_ready_to_merge(op);
+  case MSG_OSD_PG_STOP_MERGE:
+    return preprocess_pg_stop_merge(op);
   case MSG_OSD_PGTEMP:
     return preprocess_pgtemp(op);
   case MSG_OSD_BEACON:
@@ -2817,6 +2820,8 @@ bool OSDMonitor::prepare_update(MonOpRequestRef op)
     return prepare_pgtemp(op);
   case MSG_OSD_PG_READY_TO_MERGE:
     return prepare_pg_ready_to_merge(op);
+  case MSG_OSD_PG_STOP_MERGE:
+    return prepare_pg_stop_merge(op);
   case MSG_OSD_BEACON:
     return prepare_beacon(op);
 
@@ -4100,6 +4105,16 @@ bool OSDMonitor::prepare_pg_ready_to_merge(MonOpRequestRef op)
     p.last_change = pending_inc.epoch;
   } else {
     // back off the merge attempt!
+    if (!m->ready && !p.has_flag(pg_pool_t::FLAG_CRIMSON)) {
+      mon.clog->warn() << "osd." << m->get_orig_source().num()
+                       << " reported pg " << m->pgid
+                       << " not ready to merge; backing off pg_num decrease"
+                       << " for pool '"
+                       << osdmap.get_pool_name(m->pgid.pool()) << "'";
+      dout(1) << __func__ << " osd." << m->get_orig_source().num()
+              << " pg " << m->pgid << " not ready to merge, backing off"
+              << dendl;
+    }
     p.set_pg_num_pending(p.get_pg_num());
   }
 
@@ -4129,6 +4144,79 @@ bool OSDMonitor::prepare_pg_ready_to_merge(MonOpRequestRef op)
   return true;
 }
 
+bool OSDMonitor::preprocess_pg_stop_merge(MonOpRequestRef op)
+{
+  op->mark_osdmon_event(__func__);
+  auto m = op->get_req<MOSDPGStopMerge>();
+  dout(10) << __func__ << " " << *m << dendl;
+  auto session = op->get_session();
+  if (!session) {
+    dout(10) << __func__ << ": no monitor session!" << dendl;
+    goto ignore;
+  }
+  if (!session->is_capable("osd", MON_CAP_X)) {
+    derr << __func__ << " received from entity "
+         << "with insufficient privileges " << session->caps << dendl;
+    goto ignore;
+  }
+  if (!osdmap.get_pg_pool(m->pool)) {
+    derr << __func__ << " pool " << m->pool << " dne" << dendl;
+    goto ignore;
+  }
+  return false;
+
+ ignore:
+  mon.no_reply(op);
+  return true;
+}
+
+bool OSDMonitor::prepare_pg_stop_merge(MonOpRequestRef op)
+{
+  op->mark_osdmon_event(__func__);
+  auto m = op->get_req<MOSDPGStopMerge>();
+  dout(10) << __func__ << " " << *m << dendl;
+
+  pg_pool_t p;
+  if (pending_inc.new_pools.count(m->pool))
+    p = pending_inc.new_pools[m->pool];
+  else
+    p = *osdmap.get_pg_pool(m->pool);
+
+  if (!p.is_crimson()) {
+    dout(10) << __func__ << " pool " << m->pool << " is not crimson, ignoring"
+	     << dendl;
+    wait_for_finished_proposal(op, new C_ReplyMap(this, op, m->version));
+    return false;
+  }
+
+  const char *reason_str = "unknown";
+  if (m->reason == MOSDPGStopMerge::REASON_CROSS_SHARD) {
+    reason_str = "cross-shard PG merge not supported on Seastore";
+  }
+
+  mon.clog->warn() << "osd." << m->get_orig_source().num()
+                   << " stopped PG merge for pool '"
+                   << osdmap.get_pool_name(m->pool)
+                   << "' (" << reason_str << ", source pg " << m->pgid
+                   << "); no further pg_num decrease will be attempted";
+
+  // Cancel any in-flight shrink; keep current pg_num as-is.
+  p.set_pg_num_pending(p.get_pg_num());
+  if (p.get_pg_num_target() < p.get_pg_num()) {
+    p.set_pg_num_target(p.get_pg_num());
+  }
+  if (p.get_pgp_num_target() < p.get_pgp_num()) {
+    p.set_pgp_num_target(p.get_pgp_num());
+  }
+  p.unset_flag(pg_pool_t::FLAG_CRIMSON_ALLOW_PG_MERGE);
+  p.last_pg_merge_meta = pg_merge_meta_t{};
+  p.last_change = pending_inc.epoch;
+  p.last_force_op_resend_prenautilus = pending_inc.epoch;
+
+  pending_inc.new_pools[m->pool] = p;
+  wait_for_finished_proposal(op, new C_ReplyMap(this, op, m->version));
+  return true;
+}
 
 // -------------
 // pg_temp changes
diff --git a/src/mon/OSDMonitor.h b/src/mon/OSDMonitor.h
index d0209fbc522..9000fc46de4 100644
--- a/src/mon/OSDMonitor.h
+++ b/src/mon/OSDMonitor.h
@@ -470,6 +470,9 @@ private:
   bool preprocess_pg_ready_to_merge(MonOpRequestRef op);
   bool prepare_pg_ready_to_merge(MonOpRequestRef op);
 
+  bool preprocess_pg_stop_merge(MonOpRequestRef op);
+  bool prepare_pg_stop_merge(MonOpRequestRef op);
+
   int _check_remove_pool(int64_t pool_id, const pg_pool_t &pool, std::ostream *ss);
   bool _check_become_tier(
       int64_t tier_pool_id, const pg_pool_t *tier_pool,
diff --git a/src/msg/Message.cc b/src/msg/Message.cc
index e6600cda451..bbfa159345f 100644
--- a/src/msg/Message.cc
+++ b/src/msg/Message.cc
@@ -101,6 +101,7 @@
 #include "messages/MOSDPGRecoveryDelete.h"
 #include "messages/MOSDPGRecoveryDeleteReply.h"
 #include "messages/MOSDPGReadyToMerge.h"
+#include "messages/MOSDPGStopMerge.h"
 
 #include "messages/MRemoveSnaps.h"
 
@@ -647,6 +648,9 @@ Message *decode_message(CephContext *cct,
   case MSG_OSD_PG_READY_TO_MERGE:
     m = make_message<MOSDPGReadyToMerge>();
     break;
+  case MSG_OSD_PG_STOP_MERGE:
+    m = make_message<MOSDPGStopMerge>();
+    break;
   case MSG_OSD_EC_WRITE:
     m = make_message<MOSDECSubOpWrite>();
     break;
diff --git a/src/msg/Message.h b/src/msg/Message.h
index ec90687072e..071e6010381 100644
--- a/src/msg/Message.h
+++ b/src/msg/Message.h
@@ -152,6 +152,7 @@
 #define MSG_OSD_SCRUB2          121
 
 #define MSG_OSD_PG_READY_TO_MERGE 122
+#define MSG_OSD_PG_STOP_MERGE     124
 
 #define MSG_OSD_PG_LEASE        133
 #define MSG_OSD_PG_LEASE_ACK    134
diff --git a/src/msg/MessageRef.h b/src/msg/MessageRef.h
index 416b58f8df7..c8f9f81aceb 100644
--- a/src/msg/MessageRef.h
+++ b/src/msg/MessageRef.h
@@ -157,6 +157,7 @@ class MOSDPGPush;
 class MOSDPGPushReply;
 class MOSDPGQuery;
 class MOSDPGReadyToMerge;
+class MOSDPGStopMerge;
 class MOSDPGRecoveryDelete;
 class MOSDPGRecoveryDeleteReply;
 class MOSDPGRemove;

From 50bf8ce2eb0ed6bd2c083169d6746baf3c0a8354 Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Thu, 4 Jun 2026 15:25:45 +0530
Subject: [PATCH 151/596] mgr/dashboard: rbd-mirroring - hide create/import
 token buttons for read-only users

Fixes: https://tracker.ceph.com/issues/77115

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 .../overview/overview.component.html          | 31 +++++++++++--------
 .../mirroring/overview/overview.component.ts  |  2 ++
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html
index 0e708ed4354..440d6fb100a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html
@@ -37,19 +37,24 @@
     <div cdsCol="{md:5}">
       <div class="d-flex flex-row-reverse gap-3">
         <ng-container *ngFor="let action of tableActions">
-          <button type="button"
-                  [cdsButton]="action.buttonKind"
-                  [title]="action.name"
-                  (click)="action.click($event)"
-                  [disabled]="action.disable()"
-                  [attr.aria-label]="action.name"
-                  [attr.data-testid]="action.name"
-                  [preserveFragment]="action.preserveFragment ? '' : null">
-            <span i18n>{{ action.name }}</span>
-            <svg class="cds--btn__icon"
-                 [cdsIcon]="action.icon"
-                 size="16"></svg>
-          </button>
+          @if (!action.visible || action.visible(selection)) {
+            <button
+              type="button"
+              [cdsButton]="action.buttonKind"
+              [title]="action.name"
+              (click)="action.click($event)"
+              [disabled]="action.disable()"
+              [attr.aria-label]="action.name"
+              [attr.data-testid]="action.name"
+              [preserveFragment]="action.preserveFragment ? '' : null">
+              <span i18n>{{ action.name }}</span>
+              <svg
+                class="cds--btn__icon"
+                [cdsIcon]="action.icon"
+                size="16">
+              </svg>
+            </button>
+          }
         </ng-container>
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.ts
index c4fef43e021..efe1d53ea96 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.ts
@@ -53,6 +53,7 @@ export class OverviewComponent implements OnInit, OnDestroy {
       name: $localize`Create Bootstrap Token`,
       canBePrimary: () => true,
       disable: () => false,
+      visible: () => this.permission.update,
       buttonKind: 'primary'
     };
     const importBootstrapAction: CdTableAction = {
@@ -61,6 +62,7 @@ export class OverviewComponent implements OnInit, OnDestroy {
       click: () => this.importBootstrapModal(),
       name: $localize`Import Bootstrap Token`,
       disable: () => false,
+      visible: () => this.permission.update,
       buttonKind: 'tertiary'
     };
     this.tableActions = [createBootstrapAction, importBootstrapAction];

From b2ed52b2a4d86ad6fa19851053badfa9118c4b6f Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Fri, 5 Jun 2026 12:37:38 +0530
Subject: [PATCH 152/596] mgr/dashboard: Fix username validation for special
 characters by URL-encoding user lookup requests

When validating usernames, special characters such as '#' were not being URL-encoded before being appended to the user lookup endpoint.
Because the browser treats '#' as a URL fragment, the request path was truncated, causing the backend to return an incorrect response and the UI to display a misleading "User already exists" validation error.

Fixes: https://tracker.ceph.com/issues/77129

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 .../mgr/dashboard/frontend/src/app/shared/api/user.service.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/user.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/user.service.ts
index 95c80dd4665..d432e318471 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/user.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/user.service.ts
@@ -21,7 +21,7 @@ export class UserService {
   }
 
   get(username: string) {
-    return this.http.get(`api/user/${username}`);
+    return this.http.get(`api/user/${encodeURIComponent(username)}`);
   }
 
   create(user: UserFormModel) {

From 04ec9abec49917e2a882b1252d913c10b9301bb9 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 22 Dec 2025 16:20:56 +0530
Subject: [PATCH 153/596] mgr/cephadm: Setup user's sudoers and public keys
 before setting cephadm user

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py               |  27 +++++++
 src/cephadm/cephadmlib/user_utils.py | 107 +++++++++++++++++++++++++++
 src/pybind/mgr/cephadm/module.py     | 105 +++++++++++++++++++++++++-
 3 files changed, 237 insertions(+), 2 deletions(-)
 create mode 100644 src/cephadm/cephadmlib/user_utils.py

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 7cf65220c80..ea292ebb911 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -230,6 +230,8 @@ from cephadmlib.listing_updaters import (
 )
 from cephadmlib.container_lookup import infer_local_ceph_image, identify
 from ceph.cephadm.d3n_types import D3NCache, D3NCacheError
+from cephadmlib.user_utils import setup_ssh_user
+
 
 FuncT = TypeVar('FuncT', bound=Callable)
 
@@ -4802,6 +4804,19 @@ def command_cluster_status(ctx: CephadmContext) -> int:
     return result
 
 
+def command_setup_ssh_user(ctx: CephadmContext) -> int:
+    """
+    Setup SSH user on the local host by configuring passwordless sudo and
+    copying SSH public key to user's authorized_keys.
+    """
+    if not ctx.ssh_user:
+        raise Error('--ssh-user is required')
+    if not ctx.ssh_pub_key:
+        raise Error('--ssh-pub-key is required')
+
+    setup_ssh_user(ctx, ctx.ssh_user, ctx.ssh_pub_key)
+    return 0
+
 ##################################
 
 
@@ -5526,6 +5541,18 @@ def _get_parser():
         '--expect-hostname',
         help='Set hostname')
 
+    parser_setup_ssh_user = subparsers.add_parser(
+        'setup-ssh-user', help='setup SSH user with passwordless sudo and SSH key')
+    parser_setup_ssh_user.set_defaults(func=command_setup_ssh_user)
+    parser_setup_ssh_user.add_argument(
+        '--ssh-user',
+        required=True,
+        help='SSH user to setup')
+    parser_setup_ssh_user.add_argument(
+        '--ssh-pub-key',
+        required=True,
+        help='SSH public key to add to user authorized_keys')
+
     parser_add_repo = subparsers.add_parser(
         'add-repo', help='configure package repository')
     parser_add_repo.set_defaults(func=command_add_repo)
diff --git a/src/cephadm/cephadmlib/user_utils.py b/src/cephadm/cephadmlib/user_utils.py
new file mode 100644
index 00000000000..39b21d3c44f
--- /dev/null
+++ b/src/cephadm/cephadmlib/user_utils.py
@@ -0,0 +1,107 @@
+# user_utils.py - user management utility functions
+
+import logging
+import os
+import pwd
+from typing import Tuple
+
+from .call_wrappers import call, CallVerbosity
+from .context import CephadmContext
+from .exceptions import Error
+from .exe_utils import find_program
+from .ssh import authorize_ssh_key
+
+logger = logging.getLogger()
+
+
+def validate_user_exists(username: str) -> Tuple[int, int, str]:
+    """Validate that a user exists and return their uid, gid, and home directory.
+    Args:
+        username: The username to validate
+    Returns:
+        Tuple of (uid, gid, home_directory)
+    Raises:
+        Error: If the user does not exist
+    """
+    try:
+        pwd_entry = pwd.getpwnam(username)
+        return pwd_entry.pw_uid, pwd_entry.pw_gid, pwd_entry.pw_dir
+    except KeyError:
+        raise Error(
+            f'User {username} does not exist on this host. '
+            f'Please create the user first: useradd -m -s /bin/bash {username}'
+        )
+
+
+def setup_sudoers(ctx: CephadmContext, username: str) -> None:
+    """Setup passwordless sudo for a user.
+    """
+    sudoers_file = f'/etc/sudoers.d/{username}'
+    sudoers_content = f'{username} ALL=(ALL) NOPASSWD: ALL\n'
+
+    logger.info('Setting up sudoers for user %s', username)
+    try:
+        # Write sudoers file with proper permissions
+        with open(sudoers_file, 'w') as f:
+            f.write(sudoers_content)
+        os.chmod(sudoers_file, 0o440)
+        os.chown(sudoers_file, 0, 0)
+
+        # Validate sudoers syntax
+        visudo_cmd = find_program('visudo')
+        _out, _err, code = call(
+            ctx,
+            [visudo_cmd, '-c', '-f', sudoers_file],
+            verbosity=CallVerbosity.DEBUG
+        )
+        if code != 0:
+            # Clean up invalid file
+            try:
+                os.remove(sudoers_file)
+            except OSError:
+                pass
+            raise Error(f'Invalid sudoers syntax: {_err}')
+        logger.info('Successfully configured sudoers for user %s', username)
+    except Error:
+        raise
+    except Exception as e:
+        msg = f'Failed to setup sudoers for user {username}: {e}'
+        logger.exception(msg)
+        raise Error(msg)
+
+
+def setup_ssh_user(ctx: CephadmContext, username: str, ssh_pub_key: str) -> None:
+    """Setup SSH user with passwordless sudo and SSH key authorization.
+    This function performs the following operations:
+    1. Validates that the user exists on the system
+    2. Sets up passwordless sudo for the user (skipped for root)
+    3. Authorizes the SSH public key for the user
+    """
+    # Verify we're running as root
+    if os.geteuid() != 0:
+        raise Error('This operation must be run as root')
+
+    if not ssh_pub_key or ssh_pub_key.isspace():
+        raise Error('SSH public key is required and cannot be empty')
+
+    logger.info('Setting up SSH user %s on this host', username)
+
+    # Validate user exists (will raise Error if not)
+    validate_user_exists(username)
+
+    # Setup sudoers (skip for root user)
+    if username != 'root':
+        setup_sudoers(ctx, username)
+    else:
+        logger.debug('Skipping sudoers setup for root user')
+
+    # Setup SSH key using existing function from ssh.py
+    try:
+        authorize_ssh_key(ssh_pub_key, username)
+        logger.info('Successfully authorized SSH key for user %s', username)
+    except Exception as e:
+        msg = f'Failed to authorize SSH key for user {username}: {e}'
+        logger.exception(msg)
+        raise Error(msg)
+
+    logger.info('Successfully configured SSH user %s on this host', username)
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index ef4699838d1..56b072dd51a 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -1181,6 +1181,90 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
 
         return True, err, ret
 
+    def _setup_user_on_host(self, host: str, user: str, ssh_pub_key: str,
+                            addr: Optional[str] = None) -> None:
+        """
+        Setup sudoers and copy SSH key by calling cephadm setup-ssh-user command.
+        User must already exist on the host.
+        For root user, only SSH key is copied (sudoers setup is skipped).
+        """
+        self.log.debug('Setting up user %s on host %s', user, host)
+        try:
+            out, err, code = self.wait_async(
+                CephadmServe(self)._run_cephadm(
+                    host,
+                    cephadmNoImage,
+                    'setup-ssh-user',
+                    ['--ssh-user', user, '--ssh-pub-key', ssh_pub_key],
+                    addr=addr,
+                    error_ok=False,
+                    no_fsid=True
+                )
+            )
+            if code != 0:
+                msg = f'Failed to setup user {user} on host {host}: {err}'
+                self.log.error(msg)
+                raise OrchestratorError(msg)
+            self.log.info('Successfully set up user %s on host %s', user, host)
+        except OrchestratorError:
+            raise
+        except Exception as e:
+            msg = f'Failed to setup user {user} on host {host}: {e}'
+            self.log.exception(msg)
+            raise OrchestratorError(msg)
+
+    def _setup_user_on_all_hosts(self, user: str) -> None:
+        """
+        Setup sudoers and copy SSH key on all hosts in the cluster.
+        For root user, only SSH key is copied (sudoers setup is skipped).
+        """
+        if not self.ssh_pub:
+            raise OrchestratorError(
+                'No SSH public key configured. '
+                'Please generate or set SSH keys first using '
+                '`ceph cephadm generate-key` or `ceph cephadm set-pub-key`.'
+            )
+
+        hosts = self.cache.get_hosts()
+        if not hosts:
+            self.log.warning('No hosts in inventory, skipping user setup')
+            return
+
+        self.log.info('Setting up user %s on %s host(s)', user, len(hosts))
+
+        @forall_hosts
+        def setup_user_on_host(host: str) -> Tuple[str, Optional[str]]:
+            """Returns (host, error_message) tuple. error_message is None on success."""
+            try:
+                assert self.ssh_pub
+                self._setup_user_on_host(host, user, self.ssh_pub)
+                return (host, None)
+            except Exception as e:
+                self.log.error('Failed to setup user %s on host %s: %s', user, host, e)
+                return (host, str(e))
+
+        results = setup_user_on_host(hosts)
+        failed_hosts = [(host, error) for host, error in results if error is not None]
+        if failed_hosts:
+            self.log.error('Failed to setup user %s on %s of %s host(s)', user, len(failed_hosts), len(hosts))
+            error_parts = [f'Failed to setup user {user} on the following hosts:']
+            for host, error in failed_hosts:
+                error_parts.append(f'  - {host}: {error}')
+            error_parts.extend([
+                f'\nPlease ensure user {user} exists on these hosts and retry:',
+                f'  1. Create user: useradd -m -s /bin/bash {user}',
+                f'  2. Retry: ceph cephadm set-user {user}',
+                '\nOr manually complete the setup:',
+                f'  1. Setup sudoers: echo "{user} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/{user}',
+                f'  2. Set permissions: chmod 440 /etc/sudoers.d/{user}',
+                '  3. Copy SSH key: ceph cephadm get-pub-key > ~/ceph.pub',
+                f'  4. Add key: ssh-copy-id -f -i ~/ceph.pub {user}@HOST',
+                '\nAnd use --skip-pre-steps flag to skip automatic setup.'
+            ])
+            raise OrchestratorError('\n'.join(error_parts))
+
+        self.log.info('Successfully set up user %s on all %s host(s)', user, len(hosts))
+
     def _validate_and_set_ssh_val(self, what: str, new: Optional[str], old: Optional[str]) -> None:
         self.set_store(what, new)
         self.ssh._reconfig_ssh()
@@ -1344,14 +1428,30 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
 
     @CephadmCLICommand.Read(
         'cephadm set-user')
-    def set_ssh_user(self, user: str) -> Tuple[int, str, str]:
+    def set_ssh_user(self, user: str, skip_pre_steps: bool = False) -> Tuple[int, str, str]:
         """
-        Set user for SSHing to cluster hosts, passwordless sudo will be needed for non-root users
+        Set user for SSHing to cluster hosts, passwordless sudo will be needed for non-root users.
+
+        This command will automatically setup passwordless sudo for the user and
+        copy SSH public key to the user's authorized_keys.
+        Use --skip-pre-steps if you have already manually configured the user on all hosts.
         """
         current_user = self.ssh_user
         if user == current_user:
             return 0, "value unchanged", ""
 
+        if user != 'root' and not skip_pre_steps:
+            self.log.info('Setting up SSH user %s on all cluster hosts', user)
+            try:
+                self._setup_user_on_all_hosts(user)
+            except OrchestratorError as e:
+                self.log.error('Failed to setup user %s: %s', user, e)
+                return -errno.EINVAL, '', str(e)
+            except Exception as e:
+                msg = f'Failed to setup user {user} on all hosts: {e}'
+                self.log.exception(msg)
+                return -errno.EINVAL, '', msg
+
         self._validate_and_set_ssh_val('ssh_user', user, current_user)
         current_ssh_config = self._get_ssh_config()
         new_ssh_config = re.sub(r"(\s{2}User\s)(.*)", r"\1" + user, current_ssh_config.stdout)
@@ -1930,6 +2030,7 @@ Then run the following:
             self.update_maintenance_healthcheck()
         self.event.set()  # refresh stray health check
         self.log.info('Added host %s' % spec.hostname)
+
         return "Added host '{}' with addr '{}'".format(spec.hostname, spec.addr)
 
     @handle_orch_error

From 790181e282b899b61560450e3177d39842dfbc0c Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 22 Dec 2025 16:54:36 +0530
Subject: [PATCH 154/596] mgr/cephadm: Handle cephadm set user configuration
 for add node

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/module.py | 137 +++++++++++++++++++++++--------
 src/pybind/mgr/cephadm/ssh.py    |   9 +-
 2 files changed, 112 insertions(+), 34 deletions(-)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 56b072dd51a..457695084b9 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -533,6 +533,10 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
         self.event = Event()
         self.ssh = ssh.SSHManager(self)
 
+        # Track hosts being added - these hosts will use root user temporarily
+        # even if cluster is configured to use non-root user
+        self.hosts_being_added: Set[str] = set()
+
         if self.get_store('pause'):
             self.paused = True
         else:
@@ -1994,44 +1998,111 @@ Then run the following:
         :param host: host name
         """
         HostSpec.validate(spec)
-        ip_addr = self._check_valid_addr(spec.hostname, spec.addr)
-        if spec.addr == spec.hostname and ip_addr:
-            spec.addr = ip_addr
 
-        if spec.hostname in self.inventory and self.inventory.get_addr(spec.hostname) != spec.addr:
-            self.cache.refresh_all_host_info(spec.hostname)
+        # Check if this is a new host BEFORE any SSH operations
+        is_new_host = spec.hostname not in self.inventory
+        if is_new_host and self.ssh_user and self.ssh_user != 'root':
+            try:
+                self.hosts_being_added.add(spec.hostname)
+                self.log.info(f'Adding new host {spec.hostname}, will use root user temporarily for setup')
+            except Exception as e:
+                self.log.warning(f'Failed to add {spec.hostname} to hosts_being_added tracking: {e}')
 
-        if spec.oob:
-            if not spec.oob.get('addr'):
-                spec.oob['addr'] = self.oob_default_addr
-            if not spec.oob.get('port'):
-                spec.oob['port'] = '443'
-            host_oob_info = dict()
-            host_oob_info['addr'] = spec.oob['addr']
-            host_oob_info['port'] = spec.oob['port']
-            host_oob_info['username'] = spec.oob['username']
-            host_oob_info['password'] = spec.oob['password']
-            self.node_proxy_cache.update_oob(spec.hostname, host_oob_info)
+        try:
+            ip_addr = self._check_valid_addr(spec.hostname, spec.addr)
+            if spec.addr == spec.hostname and ip_addr:
+                spec.addr = ip_addr
+            if spec.hostname in self.inventory and self.inventory.get_addr(spec.hostname) != spec.addr:
+                self.cache.refresh_all_host_info(spec.hostname)
 
-        # prime crush map?
-        if spec.location:
-            self.check_mon_command({
-                'prefix': 'osd crush add-bucket',
-                'name': spec.hostname,
-                'type': 'host',
-                'args': [f'{k}={v}' for k, v in spec.location.items()],
-            })
+            if spec.oob:
+                if not spec.oob.get('addr'):
+                    spec.oob['addr'] = self.oob_default_addr
+                if not spec.oob.get('port'):
+                    spec.oob['port'] = '443'
+                host_oob_info = dict()
+                host_oob_info['addr'] = spec.oob['addr']
+                host_oob_info['port'] = spec.oob['port']
+                host_oob_info['username'] = spec.oob['username']
+                host_oob_info['password'] = spec.oob['password']
+                self.node_proxy_cache.update_oob(spec.hostname, host_oob_info)
 
-        if spec.hostname not in self.inventory:
-            self.cache.prime_empty_host(spec.hostname)
-        self.inventory.add_host(spec)
-        self.offline_hosts_remove(spec.hostname)
-        if spec.status == 'maintenance':
-            self.update_maintenance_healthcheck()
-        self.event.set()  # refresh stray health check
-        self.log.info('Added host %s' % spec.hostname)
+            # prime crush map?
+            if spec.location:
+                self.check_mon_command({
+                    'prefix': 'osd crush add-bucket',
+                    'name': spec.hostname,
+                    'type': 'host',
+                    'args': [f'{k}={v}' for k, v in spec.location.items()],
+                })
 
-        return "Added host '{}' with addr '{}'".format(spec.hostname, spec.addr)
+            if spec.hostname not in self.inventory:
+                self.cache.prime_empty_host(spec.hostname)
+            self.inventory.add_host(spec)
+            self.offline_hosts_remove(spec.hostname)
+            if spec.status == 'maintenance':
+                self.update_maintenance_healthcheck()
+            self.event.set()  # refresh stray health check
+            self.log.info('Added host %s' % spec.hostname)
+
+            # If this is a new host and using non-root user, setup the user now
+            if is_new_host and self.ssh_user and self.ssh_user != 'root':
+                self.log.info(f'Setting up user {self.ssh_user} on new host {spec.hostname}')
+                try:
+                    assert self.ssh_pub
+                    self._setup_user_on_host(spec.hostname, self.ssh_user, self.ssh_pub, addr=spec.addr)
+                    self.log.info(f'Successfully set up user {self.ssh_user} on {spec.hostname}')
+                except OrchestratorError as oe:
+                    # OrchestratorError from user setup (user doesn't exist, SSH failures, etc.)
+                    # Log warning but don't fail the add_host operation
+                    self.log.warning(f'Failed to setup user {self.ssh_user} on {spec.hostname}: {oe}')
+                    self.log.warning(
+                        f'Host {spec.hostname} added but user setup incomplete. '
+                        f'Please manually setup user {self.ssh_user} on {spec.hostname}')
+                except Exception as e:
+                    # Unexpected error during user setup
+                    # Log warning but don't fail the add_host operation
+                    self.log.error(f'Unexpected error setting up user {self.ssh_user} on {spec.hostname}: {e}')
+                    self.log.warning(f'You may need to manually setup user {self.ssh_user} on {spec.hostname}')
+                finally:
+                    # Always remove from hosts_being_added after setup attempt
+                    try:
+                        self.hosts_being_added.discard(spec.hostname)
+                    except Exception as discard_err:
+                        self.log.debug(f'Failed to remove {spec.hostname} from hosts_being_added: {discard_err}')
+
+                    # Reset SSH connection so next operations will use configured user
+                    try:
+                        self.ssh.reset_con(spec.hostname)
+                        self.log.debug(f'Reset SSH connection for {spec.hostname} to use configured user')
+                    except Exception as reset_err:
+                        # Connection reset failure is not critical - connection will be recreated on next use
+                        self.log.debug(f'Failed to reset SSH connection for {spec.hostname}: {reset_err}')
+            elif is_new_host:
+                # Root user, no need to track
+                try:
+                    self.hosts_being_added.discard(spec.hostname)
+                except Exception as e:
+                    self.log.debug(f'Failed to remove {spec.hostname} from hosts_being_added: {e}')
+
+            return "Added host '{}' with addr '{}'".format(spec.hostname, spec.addr)
+        except Exception:
+            # If anything fails in core add_host operations, cleanup the new tracking mechanisms
+            if is_new_host and self.ssh_user and self.ssh_user != 'root':
+                # Cleanup tracking set
+                try:
+                    self.hosts_being_added.discard(spec.hostname)
+                    self.log.debug(f'Cleaned up hosts_being_added tracking for {spec.hostname} after error')
+                except Exception as cleanup_err:
+                    self.log.debug(f'Failed to cleanup hosts_being_added for {spec.hostname}: {cleanup_err}')
+
+                # Cleanup any stale SSH connection
+                try:
+                    self.ssh.reset_con(spec.hostname)
+                    self.log.debug(f'Reset SSH connection for {spec.hostname} after error')
+                except Exception as reset_err:
+                    self.log.debug(f'Failed to reset SSH connection for {spec.hostname}: {reset_err}')
+            raise
 
     @handle_orch_error
     def add_host(self, spec: HostSpec) -> str:
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index 1ff6db3bf0d..1e3cce55b30 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -272,7 +272,14 @@ class SSHManager:
                                ) -> Tuple[str, str, int]:
 
         conn = await self._remote_connection(host, addr)
-        use_sudo = (self.mgr.ssh_user != 'root')
+
+        # For hosts being added, always use root (no sudo) even if cluster
+        # is configured to use non-root user. This allows initial setup.
+        is_host_being_added = host in self.mgr.hosts_being_added
+        use_sudo = (self.mgr.ssh_user != 'root') and not is_host_being_added
+        if is_host_being_added:
+            logger.debug(f'Host {host} is being added, using root user without sudo')
+
         rcmd = RemoteSudoCommand.wrap(cmd_components, use_sudo=use_sudo)
         try:
             address = addr or self.mgr.inventory.get_addr(host)

From 79924f8fc91ff01aedacbcd5f5e14c89b9c38722 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Tue, 2 Dec 2025 10:37:00 +0530
Subject: [PATCH 155/596] cephadm: added cephadm exec command to execute shell
 commands

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py            | 46 +++++++++++++++++++++++++
 src/cephadm/tests/test_cephadm.py | 57 +++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index ea292ebb911..d8c99403f51 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -74,6 +74,7 @@ from cephadmlib.context_getters import (
 from cephadmlib.exceptions import (
     ClusterAlreadyExists,
     Error,
+    TimeoutExpired,
     UnauthorizedRegistryError,
     DaemonStartException,
 )
@@ -3565,6 +3566,41 @@ def command_logs(ctx: CephadmContext) -> None:
 ##################################
 
 
+def command_exec(ctx: CephadmContext) -> int:
+    """
+    Execute a shell command on the host
+    Return Codes:
+        - `0`: Command executed successfully
+        - `124`: Command timed out
+        - `1`: Error during execution
+        - Other: Return code from the executed command
+    """
+    if not ctx.command:
+        raise Error('No command provided to execute')
+    cmd = ctx.command
+    logger.debug('Executing command: %s' % ' '.join(cmd))
+    try:
+        stdout, stderr, returncode = call(
+            ctx,
+            cmd,
+            verbosity=CallVerbosity.SILENT,
+            timeout=ctx.timeout
+        )
+        if stdout:
+            sys.stdout.write(stdout)
+        if stderr:
+            sys.stderr.write(stderr)
+        return returncode
+    except TimeoutExpired:
+        logger.exception('Command timed out after %s seconds' % ctx.timeout)
+        return 124
+    except Exception as e:
+        logger.exception('Error executing command: %s' % str(e))
+        return 1
+
+##################################
+
+
 def command_list_networks(ctx):
     # type: (CephadmContext) -> None
     r = list_networks(ctx)
@@ -5299,6 +5335,16 @@ def _get_parser():
         'command', nargs='*',
         help='additional journalctl args')
 
+    parser_exec = subparsers.add_parser(
+        'exec', help='execute a shell command on the host')
+    parser_exec.set_defaults(func=command_exec)
+    parser_exec.add_argument(
+        '--command', nargs=argparse.REMAINDER,
+        help='command to execute')
+    parser_exec.add_argument(
+        '--fsid',
+        help='cluster FSID')
+
     parser_bootstrap = subparsers.add_parser(
         'bootstrap', help='bootstrap a cluster (mon + mgr daemons)')
     parser_bootstrap.set_defaults(func=command_bootstrap)
diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index 7d2402d8b9b..ac2bab1f865 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -3274,3 +3274,60 @@ class TestRmClusterConfigCleanup(fake_filesystem_unittest.TestCase):
 
         assert os.path.exists('/etc/ceph/ceph.conf')
         assert os.path.isdir('/etc/ceph/ceph.conf')
+
+
+class TestExec(object):
+    """Test cases for the 'cephadm exec' command"""
+
+    @mock.patch.object(_cephadm, 'call')
+    @mock.patch('cephadm.logger')
+    def test_exec_non_zero_exit(self, _logger, mock_call):
+        """Test command execution with non-zero exit code"""
+        mock_call.return_value = ('', 'command not found\n', 127)
+
+        cmd = ['exec', '--command', 'nonexistent_command']
+        with with_cephadm_ctx(cmd, mock_cephadm_call_fn=False) as ctx:
+            ctx.command = ['nonexistent_command']
+            ctx.timeout = 300
+            retval = _cephadm.command_exec(ctx)
+            assert retval == 127
+
+    @mock.patch('subprocess.run')
+    @mock.patch('cephadm.logger')
+    def test_exec_empty_command_list(self, _logger, mock_run):
+        """Test command_exec with empty command list"""
+        cmd = ['exec', '--command']
+        with with_cephadm_ctx(cmd) as ctx:
+            ctx.command = []
+            ctx.timeout = 300
+            with pytest.raises(_cephadm.Error, match='No command provided to execute'):
+                _cephadm.command_exec(ctx)
+
+    @mock.patch.object(_cephadm, 'call')
+    @mock.patch('cephadm.logger')
+    @mock.patch('sys.stdout')
+    @mock.patch('sys.stderr')
+    def test_exec_with_stdout_and_stderr(self, mock_stderr, mock_stdout, _logger, mock_call):
+        """Test command execution with both stdout and stderr"""
+        mock_call.return_value = ('Standard output\n', 'Standard error\n', 2)
+
+        cmd = ['exec', '--command', 'test_command']
+        with with_cephadm_ctx(cmd, mock_cephadm_call_fn=False) as ctx:
+            ctx.command = ['test_command']
+            ctx.timeout = 300
+            retval = _cephadm.command_exec(ctx)
+            assert retval == 2
+            mock_stdout.write.assert_called_once_with('Standard output\n')
+            mock_stderr.write.assert_called_once_with('Standard error\n')
+
+    @mock.patch.object(_cephadm, 'call')
+    @mock.patch('cephadm.logger')
+    def test_exec_general_exception(self, _logger, mock_call):
+        """Test command execution with general exception"""
+        mock_call.side_effect = Exception('Unexpected error')
+        cmd = ['exec', '--command', 'test']
+        with with_cephadm_ctx(cmd, mock_cephadm_call_fn=False) as ctx:
+            ctx.command = ['test']
+            ctx.timeout = 300
+            retval = _cephadm.command_exec(ctx)
+            assert retval == 1

From a026eb34a26b71f53084c288be388a27c3cb7051 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Tue, 23 Dec 2025 15:03:02 +0530
Subject: [PATCH 156/596] mgr/cephadm: Use 'cephadm exec' to execute bash
 commands, just commands requires to deploy cephadm binary and which command
 should be executed directly

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/offline_watcher.py     |  2 +-
 src/pybind/mgr/cephadm/serve.py               | 40 ++++++++-
 src/pybind/mgr/cephadm/ssh.py                 | 89 ++++++++++++++++---
 src/pybind/mgr/cephadm/tests/test_cephadm.py  |  8 +-
 .../mgr/cephadm/tests/test_tuned_profiles.py  | 44 ++++++---
 src/pybind/mgr/cephadm/tuned_profiles.py      |  8 +-
 6 files changed, 157 insertions(+), 34 deletions(-)

diff --git a/src/pybind/mgr/cephadm/offline_watcher.py b/src/pybind/mgr/cephadm/offline_watcher.py
index 4aa07e2f584..37c9e3bee58 100644
--- a/src/pybind/mgr/cephadm/offline_watcher.py
+++ b/src/pybind/mgr/cephadm/offline_watcher.py
@@ -41,7 +41,7 @@ class OfflineHostWatcher(threading.Thread):
         if host not in self.mgr.offline_hosts:
             try:
                 rcmd = ssh.RemoteCommand(ssh.Executables.TRUE)
-                self.mgr.ssh.check_execute_command(host, rcmd, log_command=self.mgr.log_refresh_metadata)
+                self.mgr.ssh.check_execute_cephadm_exec(host, rcmd, log_command=self.mgr.log_refresh_metadata)
             except Exception:
                 logger.debug(f'OfflineHostDetector: detected {host} to be offline')
                 # kick serve loop in case corrective action must be taken for offline host
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 1f1b5c2fd6f..54985d2641f 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1401,7 +1401,7 @@ class CephadmServe:
                 continue
             self.log.info(f'Removing {host}:{path}')
             cmd = ssh.RemoteCommand(ssh.Executables.RM, ['-f', path])
-            self.mgr.ssh.check_execute_command(host, cmd)
+            self.mgr.ssh.check_execute_cephadm_exec(host, cmd)
             updated_files = True
             self.mgr.cache.removed_client_file(host, path)
         if updated_files:
@@ -1901,7 +1901,43 @@ class CephadmServe:
         # Use tee (from coreutils) to create a copy of cephadm on the target machine
         self.log.info(f"Deploying cephadm binary to {host}")
         await self.mgr.ssh._write_remote_file(host, self.mgr.cephadm_binary_path,
-                                              self.mgr._cephadm, addr=addr)
+                                              self.mgr._cephadm, addr=addr, bypass_cephadm_exec=True)
+    async def run_cephadm_exec(self,
+                               host: str,
+                               cmd: List[str],
+                               addr: Optional[str] = None,
+                               stdin: Optional[str] = None,
+                               log_output: Optional[bool] = True,
+                               timeout: Optional[int] = None,
+                               ) -> Tuple[str, str, int]:
+        """
+        Execute a bash command on the remote host via 'cephadm exec --command <bash command>'
+        """
+        self.log.debug(f"run_cephadm_exec: Executing command on {host}: {cmd}")
+
+        exec_args = ['--command'] + cmd
+        try:
+            out, err, code = await self._run_cephadm(
+                host=host,
+                entity=cephadmNoImage,
+                command='exec',
+                args=exec_args,
+                addr=addr,
+                stdin=stdin,
+                no_fsid=True,  # exec doesn't need fsid
+                error_ok=True,  # We'll handle errors at a higher level
+                log_output=log_output,
+                timeout=timeout
+            )
+            stdout = out[0] if out else ''
+            stderr = err[0] if err else ''
+            if log_output:
+                self.log.debug(f"run_cephadm_exec result: code={code}, stdout={stdout}, stderr={stderr}")
+            return stdout, stderr, code
+
+        except Exception as e:
+            self.log.exception(f"Error executing command via cephadm exec on {host}: {e}")
+            return '', str(e), 1
 
     def _retry_failed_operations(self) -> None:
         self.log.debug('_retry_failed_operations')
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index 1e3cce55b30..ab70b6d902a 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -270,7 +270,6 @@ class SSHManager:
                                addr: Optional[str] = None,
                                log_command: Optional[bool] = True,
                                ) -> Tuple[str, str, int]:
-
         conn = await self._remote_connection(host, addr)
 
         # For hosts being added, always use root (no sudo) even if cluster
@@ -415,6 +414,68 @@ class SSHManager:
         with self.mgr.async_timeout_handler(host, " ".join(cmd)):
             return self.mgr.wait_async(self._check_execute_command(host, cmd, stdin, addr, log_command))
 
+    async def _execute_cephadm_exec(self,
+                                    host: str,
+                                    cmd_components: RemoteCommand,
+                                    stdin: Optional[str] = None,
+                                    addr: Optional[str] = None,
+                                    log_command: Optional[bool] = True,
+                                    ) -> Tuple[str, str, int]:
+        """
+        Execute a command on the remote host via 'cephadm exec --command <bash command>'
+        This routes the command through CephadmServe.run_cephadm_exec
+        """
+        if log_command:
+            logger.debug(f'Executing command via cephadm exec: {cmd_components}')
+
+        cmd_list = list(cmd_components)
+
+        from cephadm.serve import CephadmServe
+
+        out, err, code = await CephadmServe(self.mgr).run_cephadm_exec(
+            host=host,
+            cmd=cmd_list,
+            addr=addr,
+            stdin=stdin,
+            log_output=log_command
+        )
+        return out, err, code
+
+    def execute_cephadm_exec(self,
+                             host: str,
+                             cmd: RemoteCommand,
+                             stdin: Optional[str] = None,
+                             addr: Optional[str] = None,
+                             log_command: Optional[bool] = True
+                             ) -> Tuple[str, str, int]:
+        with self.mgr.async_timeout_handler(host, " ".join(cmd)):
+            return self.mgr.wait_async(self._execute_cephadm_exec(host, cmd, stdin, addr, log_command))
+
+    async def _check_execute_cephadm_exec(self,
+                                          host: str,
+                                          cmd: RemoteCommand,
+                                          stdin: Optional[str] = None,
+                                          addr: Optional[str] = None,
+                                          log_command: Optional[bool] = True
+                                          ) -> str:
+        """Execute a command via cephadm exec and raise error if it fails"""
+        out, err, code = await self._execute_cephadm_exec(host, cmd, stdin, addr, log_command)
+        if code != 0:
+            msg = f'Command {cmd} failed. {err}'
+            logger.debug(msg)
+            raise OrchestratorError(msg)
+        return out
+
+    def check_execute_cephadm_exec(self,
+                                   host: str,
+                                   cmd: RemoteCommand,
+                                   stdin: Optional[str] = None,
+                                   addr: Optional[str] = None,
+                                   log_command: Optional[bool] = True,
+                                   ) -> str:
+        with self.mgr.async_timeout_handler(host, " ".join(cmd)):
+            return self.mgr.wait_async(self._check_execute_cephadm_exec(host, cmd, stdin, addr, log_command))
+
     async def _write_remote_file(self,
                                  host: str,
                                  path: str,
@@ -423,26 +484,33 @@ class SSHManager:
                                  uid: Optional[int] = None,
                                  gid: Optional[int] = None,
                                  addr: Optional[str] = None,
+                                 bypass_cephadm_exec: Optional[bool] = False,
                                  ) -> None:
+        """
+        Write a file to a remote host.
+        """
         try:
             cephadm_tmp_dir = f"/tmp/cephadm-{self.mgr._cluster_fsid}"
             dirname = os.path.dirname(path)
+
+            # Choose execution method based on bypass flag
+            execute_method = self._check_execute_command if bypass_cephadm_exec else self._check_execute_cephadm_exec
             mkdir = RemoteCommand(Executables.MKDIR, ['-p', dirname])
-            await self._check_execute_command(host, mkdir, addr=addr)
+            await execute_method(host, mkdir, addr=addr)
             mkdir2 = RemoteCommand(Executables.MKDIR, ['-p', cephadm_tmp_dir + dirname])
-            await self._check_execute_command(host, mkdir2, addr=addr)
+            await execute_method(host, mkdir2, addr=addr)
             tmp_path = cephadm_tmp_dir + path + '.new'
             touch = RemoteCommand(Executables.TOUCH, [tmp_path])
-            await self._check_execute_command(host, touch, addr=addr)
+            await execute_method(host, touch, addr=addr)
             if self.mgr.ssh_user != 'root':
                 assert self.mgr.ssh_user
                 chown = RemoteCommand(
                     Executables.CHOWN,
                     ['-R', self.mgr.ssh_user, cephadm_tmp_dir]
                 )
-                await self._check_execute_command(host, chown, addr=addr)
+                await execute_method(host, chown, addr=addr)
                 chmod = RemoteCommand(Executables.CHMOD, [str(644), tmp_path])
-                await self._check_execute_command(host, chmod, addr=addr)
+                await execute_method(host, chmod, addr=addr)
             with NamedTemporaryFile(prefix='cephadm-write-remote-file-') as f:
                 os.fchmod(f.fileno(), 0o600)
                 f.write(content)
@@ -456,11 +524,11 @@ class SSHManager:
                     Executables.CHOWN,
                     ['-R', str(uid) + ':' + str(gid), tmp_path]
                 )
-                await self._check_execute_command(host, chown, addr=addr)
+                await execute_method(host, chown, addr=addr)
                 chmod = RemoteCommand(Executables.CHMOD, [oct(mode)[2:], tmp_path])
-                await self._check_execute_command(host, chmod, addr=addr)
+                await execute_method(host, chmod, addr=addr)
             mv = RemoteCommand(Executables.MV, ['-Z', tmp_path, path])
-            await self._check_execute_command(host, mv, addr=addr)
+            await execute_method(host, mv, addr=addr)
         except Exception as e:
             msg = f"Unable to write {host}:{path}: {e}"
             logger.exception(msg)
@@ -474,10 +542,11 @@ class SSHManager:
                           uid: Optional[int] = None,
                           gid: Optional[int] = None,
                           addr: Optional[str] = None,
+                          bypass_cephadm_exec: Optional[bool] = False,
                           ) -> None:
         with self.mgr.async_timeout_handler(host, f'writing file {path}'):
             self.mgr.wait_async(self._write_remote_file(
-                host, path, content, mode, uid, gid, addr))
+                host, path, content, mode, uid, gid, addr, bypass_cephadm_exec))
 
     async def _reset_con(self, host: str) -> None:
         conn = self.cons.get(host)
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index b97b7f175f2..9bc1148941a 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -2277,9 +2277,9 @@ class TestCephadm(object):
             CephadmServe(cephadm_module)._write_all_client_files()
             # Make sure both ceph conf locations (default and per fsid) are called
             _write_file.assert_has_calls([mock.call('test', '/etc/ceph/ceph.conf', b'',
-                                          0o644, 0, 0, None),
+                                          0o644, 0, 0, None, False),
                                          mock.call('test', '/var/lib/ceph/fsid/config/ceph.conf', b'',
-                                          0o644, 0, 0, None)]
+                                          0o644, 0, 0, None, False)]
                                          )
             ceph_conf_files = cephadm_module.cache.get_host_client_files('test')
             assert len(ceph_conf_files) == 2
@@ -2291,10 +2291,10 @@ class TestCephadm(object):
             CephadmServe(cephadm_module)._write_all_client_files()
             _write_file.assert_has_calls([mock.call('test',
                                                     '/etc/ceph/ceph.conf',
-                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None),
+                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None, False),
                                           mock.call('test',
                                                     '/var/lib/ceph/fsid/config/ceph.conf',
-                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None)])
+                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None, False)])
             # reload
             cephadm_module.cache.last_client_files = {}
             cephadm_module.cache.load()
diff --git a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
index 9db971f6f21..2eba05dfa57 100644
--- a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
@@ -80,6 +80,24 @@ class FakeMgr:
                                                      {'y': 'y'}).to_json()})
         return ''
 
+    def async_timeout_handler(self, host='', cmd='', timeout=None):
+        """Mock async_timeout_handler for tests"""
+        from contextlib import contextmanager
+
+        @contextmanager
+        def handler():
+            yield
+        return handler()
+
+    def wait_async(self, coro, timeout=None):
+        """Mock wait_async for tests - just run the coroutine"""
+        import asyncio
+        loop = asyncio.new_event_loop()
+        try:
+            return loop.run_until_complete(coro)
+        finally:
+            loop.close()
+
 
 class TestTunedProfiles:
     tspec1 = TunedProfileSpec('p1',
@@ -128,19 +146,19 @@ class TestTunedProfiles:
         ]
         _write_profiles.assert_has_calls(calls, any_order=True)
 
-    @mock.patch('cephadm.ssh.SSHManager.check_execute_command')
-    def test_rm_stray_tuned_profiles(self, _check_execute_command):
+    @mock.patch('cephadm.ssh.SSHManager.check_execute_cephadm_exec')
+    def test_rm_stray_tuned_profiles(self, _check_execute_cephadm_exec):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test, going to use host "a" and put 4 cephadm generated
         # profiles "p1" "p2", "p3" and "who" only two of which should be there ("p1", "p2")
         # as well as a file not generated by cephadm. Only the "p3" and "who"
         # profiles should be removed from the host. This should total to 4
-        # calls to check_execute_command, 1 "ls", 2 "rm", and 1 "sysctl --system"
-        _check_execute_command.return_value = '\n'.join(['p1-cephadm-tuned-profile.conf',
-                                                         'p2-cephadm-tuned-profile.conf',
-                                                         'p3-cephadm-tuned-profile.conf',
-                                                         'who-cephadm-tuned-profile.conf',
-                                                         'dont-touch-me'])
+        # calls to check_execute_cephadm_exec, 1 "ls", 2 "rm", and 1 "sysctl --system"
+        _check_execute_cephadm_exec.return_value = '\n'.join(['p1-cephadm-tuned-profile.conf',
+                                                              'p2-cephadm-tuned-profile.conf',
+                                                              'p3-cephadm-tuned-profile.conf',
+                                                              'who-cephadm-tuned-profile.conf',
+                                                              'dont-touch-me'])
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
                       [],
@@ -169,16 +187,16 @@ class TestTunedProfiles:
                 'a', RemoteCommand(Executables.SYSCTL, ['--system'])
             ),
         ]
-        _check_execute_command.assert_has_calls(calls, any_order=True)
+        _check_execute_cephadm_exec.assert_has_calls(calls, any_order=True)
 
-    @mock.patch('cephadm.ssh.SSHManager.check_execute_command')
+    @mock.patch('cephadm.ssh.SSHManager.check_execute_cephadm_exec')
     @mock.patch('cephadm.ssh.SSHManager.write_remote_file')
-    def test_write_tuned_profiles(self, _write_remote_file, _check_execute_command):
+    def test_write_tuned_profiles(self, _write_remote_file, _check_execute_cephadm_exec):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test we will use host "a" and have it so host_needs_tuned_profile_update
         # returns True for p2 and False for p1 (see FakeCache class). So we should see
         # 2 ssh calls, one to write p2, one to run sysctl --system
-        _check_execute_command.return_value = 'success'
+        _check_execute_cephadm_exec.return_value = 'success'
         _write_remote_file.return_value = 'success'
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
@@ -186,7 +204,7 @@ class TestTunedProfiles:
                       profiles)
         tp = TunedProfileUtils(mgr)
         tp._write_tuned_profiles('a', self.profiles_to_calls(tp, [self.tspec1, self.tspec2]))
-        _check_execute_command.assert_called_with(
+        _check_execute_cephadm_exec.assert_called_with(
             'a', RemoteCommand(Executables.SYSCTL, ['--system'])
         )
         _write_remote_file.assert_called_with(
diff --git a/src/pybind/mgr/cephadm/tuned_profiles.py b/src/pybind/mgr/cephadm/tuned_profiles.py
index 7a37d937904..5dbc2c102d2 100644
--- a/src/pybind/mgr/cephadm/tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tuned_profiles.py
@@ -73,7 +73,7 @@ class TunedProfileUtils():
         if self.mgr.cache.is_host_unreachable(host):
             return
         cmd = ssh.RemoteCommand(ssh.Executables.LS, [SYSCTL_DIR])
-        found_files = self.mgr.ssh.check_execute_command(host, cmd, log_command=self.mgr.log_refresh_metadata).split('\n')
+        found_files = self.mgr.ssh.check_execute_cephadm_exec(host, cmd, log_command=self.mgr.log_refresh_metadata).split('\n')
         found_files = [s.strip() for s in found_files]
         profile_names: List[str] = sum([[*p] for p in profiles], [])  # extract all profiles names
         profile_names = list(set(profile_names))  # remove duplicates
@@ -85,10 +85,10 @@ class TunedProfileUtils():
             if file not in expected_files:
                 logger.info(f'Removing stray tuned profile file {file}')
                 cmd = ssh.RemoteCommand(ssh.Executables.RM, ['-f', f'{SYSCTL_DIR}/{file}'])
-                self.mgr.ssh.check_execute_command(host, cmd)
+                self.mgr.ssh.check_execute_cephadm_exec(host, cmd)
                 updated = True
         if updated:
-            self.mgr.ssh.check_execute_command(host, SYSCTL_SYSTEM_CMD)
+            self.mgr.ssh.check_execute_cephadm_exec(host, SYSCTL_SYSTEM_CMD)
 
     def _write_tuned_profiles(self, host: str, profiles: List[Dict[str, str]]) -> None:
         if self.mgr.cache.is_host_unreachable(host):
@@ -102,5 +102,5 @@ class TunedProfileUtils():
                     self.mgr.ssh.write_remote_file(host, profile_filename, content.encode('utf-8'))
                     updated = True
         if updated:
-            self.mgr.ssh.check_execute_command(host, SYSCTL_SYSTEM_CMD)
+            self.mgr.ssh.check_execute_cephadm_exec(host, SYSCTL_SYSTEM_CMD)
         self.mgr.cache.last_tuned_profile_update[host] = datetime_now()

From 5bac52b4431d17bcb4ec90fff72c369dbf7cb983 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Tue, 2 Dec 2025 13:10:59 +0530
Subject: [PATCH 157/596] cephadm: Added invoker script Fixes:
 https://tracker.ceph.com/issues/74045

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm_invoker.py    | 335 ++++++++++++++++++++++++++++++
 src/cephadm/tests/test_invoker.py | 120 +++++++++++
 src/cephadm/tox.ini               |   4 +-
 3 files changed, 457 insertions(+), 2 deletions(-)
 create mode 100755 src/cephadm/cephadm_invoker.py
 create mode 100644 src/cephadm/tests/test_invoker.py

diff --git a/src/cephadm/cephadm_invoker.py b/src/cephadm/cephadm_invoker.py
new file mode 100755
index 00000000000..73343fed428
--- /dev/null
+++ b/src/cephadm/cephadm_invoker.py
@@ -0,0 +1,335 @@
+#!/usr/bin/env python3
+"""
+Cephadm Invoker - a wrapper intended for executing cephadm commands with limited sudo priviliges
+
+This script validates the cephadm binary hash before execution and provides
+a secure way to run cephadm commands and deploy binaries.
+
+Usage:
+    cephadm_invoker.py run <binary> [args...]
+    cephadm_invoker.py deploy_binary <temp_file> <final_path>
+    cephadm_invoker.py check_binary <cephadm_binary_path>
+
+Exit Codes:
+    0: Success
+    1: General error (file not found, permission issues, etc.)
+    2: Binary hash mismatch or file doesn't exist (triggers redeployment)
+    126: Permission denied during execution
+"""
+
+import argparse
+import datetime
+import fcntl
+import hashlib
+import logging
+import logging.handlers
+import os
+import pathlib
+import shutil
+import sys
+from typing import List, Optional, Tuple, IO
+
+
+logger = logging.getLogger('cephadm_invoker')
+
+
+def setup_logging() -> None:
+    """
+    Configure logging to output to both stdout and syslog.
+    If syslog is unavailable, continues with console logging only.
+    """
+    logger.setLevel(logging.INFO)
+    formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+
+    console_handler = logging.StreamHandler(sys.stdout)
+    console_handler.setLevel(logging.INFO)
+    console_handler.setFormatter(formatter)
+    logger.addHandler(console_handler)
+
+    try:
+        syslog_handler = logging.handlers.SysLogHandler(address='/dev/log')
+        syslog_handler.setLevel(logging.INFO)
+        syslog_handler.setFormatter(formatter)
+        logger.addHandler(syslog_handler)
+    except (OSError, ImportError):
+        pass
+
+
+def calculate_hash(content: bytes) -> str:
+    """
+    Calculate SHA256 hash of binary content.
+    """
+    return hashlib.sha256(content).hexdigest()
+
+
+def disable_cloexec(fh: IO[bytes]) -> None:
+    """
+    Disable the CLOEXEC flag on a file descriptor so it remains open across exec().
+    """
+    fd = fh.fileno()
+    flags = fcntl.fcntl(fd, fcntl.F_GETFD)
+    fcntl.fcntl(fd, fcntl.F_SETFD, flags & ~fcntl.FD_CLOEXEC)
+
+
+def extract_hash_from_path(path: str) -> Optional[str]:
+    """
+    Extract the expected hash from cephadm binary path.
+    Expected path format: /var/lib/ceph/{fsid}/cephadm.{hash}
+    """
+    basename = pathlib.Path(path).name
+    if basename.startswith('cephadm.') and len(basename) > 8:
+        return basename[8:]  # Extract hash after 'cephadm.' prefix
+    return None
+
+
+def verify_binary_hash(fh: IO[bytes], expected_hash: str) -> Tuple[bool, Optional[str], Optional[str]]:
+    """
+    Verify that the cephadm binary hash matches the expected hash.
+    Returns:
+        Tuple of (is_valid, expected_hash, actual_hash)
+    """
+    try:
+        content = fh.read()
+        actual_hash = calculate_hash(content)
+
+        is_valid = actual_hash == expected_hash
+        return (is_valid, expected_hash, actual_hash)
+
+    except (IOError, OSError) as e:
+        logger.error('Error reading cephadm binary: %s', e)
+        return (False, None, None)
+
+
+def execute_cephadm(fd: int, args: List[str]) -> None:
+    """
+    Execute cephadm binary using os.execve with file descriptor (replaces current process).
+    Uses file descriptor to prevent race conditions between verification and execution.
+    Exit codes:
+        2: Binary not found (triggers redeployment)
+        126: Permission denied
+        1: OS-specific error code
+    """
+    try:
+        os.execve(fd, args, os.environ)
+    except FileNotFoundError:
+        logger.error('Cephadm binary file descriptor %d not found', fd)
+        sys.exit(2)
+    except PermissionError:
+        logger.error('Permission denied executing cephadm with fd: %d', fd)
+        sys.exit(126)
+    except OSError as e:
+        logger.error(
+            'Failed to execute cephadm (fd=%d): errno=%s (%s)',
+            fd,
+            e.errno,
+            e.strerror,
+        )
+        sys.exit(1)
+
+
+def verify_and_execute_cephadm_binary(binary_path: str, cephadm_args: List[str]) -> None:
+    """
+    verify, and execute cephadm binary with hash validation.
+    """
+    fh = None
+    try:
+        expected_hash = extract_hash_from_path(binary_path)
+        if not expected_hash:
+            logger.error('Could not extract hash from binary path: %s', binary_path)
+            sys.exit(1)
+
+        fh = open(binary_path, 'rb')
+
+        is_valid, expected_hash, actual_hash = verify_binary_hash(fh, expected_hash)
+        if is_valid:
+            # Disable CLOEXEC so the FD stays open across exec
+            disable_cloexec(fh)
+            execute_cephadm(fh.fileno(), [binary_path] + cephadm_args)
+            sys.exit(0)
+
+        if actual_hash is None:
+            logger.error('Failed to read or hash binary at: %s', binary_path)
+            sys.exit(2)
+        else:
+            # Hash mismatch - backup the corrupted binary
+            logger.error('Binary hash mismatch at: %s', binary_path)
+            logger.error('Expected hash (from filename): %s', expected_hash)
+            logger.error('Actual hash (calculated): %s', actual_hash)
+
+            try:
+                timestamp = datetime.datetime.now().strftime('%Y%m%d_%H%M%S')
+                backup_path = f'{binary_path}_hash_mismatch_{timestamp}'
+                os.rename(binary_path, backup_path)
+                logger.info('Moved corrupted binary to: %s', backup_path)
+            except OSError as e:
+                logger.error('Could not backup corrupted binary: %s', e)
+
+            logger.info('Returning exit code 2 to trigger binary redeployment')
+            sys.exit(2)
+
+    except (IOError, OSError) as e:
+        logger.error('Error opening cephadm binary at %s: %s', binary_path, e)
+        sys.exit(2)
+    finally:
+        if fh is not None:
+            try:
+                fh.close()
+            except OSError:
+                pass
+
+
+def command_run(args: argparse.Namespace) -> int:
+    """
+    Run cephadm binary with arguments after hash verification.
+    """
+    verify_and_execute_cephadm_binary(args.binary, args.args)
+    return 0
+
+
+def command_deploy_binary(args: argparse.Namespace) -> int:
+    """
+    Deploy cephadm binary from temporary file to final location.
+    Performs deployment with proper permissions and directory creation:
+    1. Validates temp file exists
+    2. Creates destination directory if needed
+    3. Sets executable permissions (0o755)
+    4. Moves file to final location atomically with locking
+    """
+    temp_file = args.temp_file
+    final_path = args.final_path
+
+    if not os.path.isfile(temp_file):
+        logger.error('Temporary file does not exist: %s', temp_file)
+        return 1
+
+    final_dir = pathlib.Path(final_path).parent
+    try:
+        final_dir.mkdir(parents=True, exist_ok=True)
+        logger.debug('Created destination directory: %s', final_dir)
+    except OSError as e:
+        logger.error('Failed to create directory %s: %s', final_dir, e)
+        return 1
+
+    try:
+        os.chmod(temp_file, 0o755)
+        logger.debug('Set executable permissions (0o755) on: %s', temp_file)
+    except OSError as e:
+        logger.error('Failed to set permissions on %s: %s', temp_file, e)
+        return 1
+
+    lock_file = f'{final_path}.lock'
+    lock_fd = None
+    try:
+        # Create lock file and acquire exclusive lock
+        lock_fd = os.open(lock_file, os.O_CREAT | os.O_RDWR, 0o644)
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+
+        if os.path.exists(final_path):
+            logger.info('Binary already exists at %s, skipping deployment', final_path)
+            return 0
+
+        shutil.move(temp_file, final_path)
+        logger.info('Successfully deployed cephadm binary to: %s', final_path)
+        return 0
+
+    except OSError as e:
+        logger.error('Failed to deploy %s to %s: %s', temp_file, final_path, e)
+        return 1
+    finally:
+        if lock_fd is not None:
+            try:
+                os.close(lock_fd)
+            except OSError:
+                pass
+        try:
+            os.unlink(lock_file)
+        except OSError:
+            pass
+
+
+def command_check_binary(args: argparse.Namespace) -> int:
+    """
+    Check if a file exists.
+    Exit codes:
+        0: File exists
+        2: File does not exist (signals need for deployment)
+    """
+    if pathlib.Path(args.cephadm_binary_path).is_file():
+        logger.debug('File exists: %s', args.cephadm_binary_path)
+        return 0
+    else:
+        logger.debug('File does not exist: %s', args.cephadm_binary_path)
+        return 2
+
+
+def create_argument_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description='Cephadm Invoker - A secure wrapper for executing cephadm commands',
+        prog='cephadm_invoker.py'
+    )
+    subparsers = parser.add_subparsers(dest='command', help='Available commands')
+
+    run_parser = subparsers.add_parser(
+        'run',
+        help='Run cephadm binary with arguments after hash verification'
+    )
+    run_parser.add_argument(
+        'binary',
+        help='Path to the cephadm binary (must include hash in filename)'
+    )
+    run_parser.add_argument(
+        'args',
+        nargs=argparse.REMAINDER,
+        help='Arguments to pass to cephadm'
+    )
+    run_parser.set_defaults(func=command_run)
+
+    deploy_parser = subparsers.add_parser(
+        'deploy_binary',
+        help='Deploy cephadm binary from temp file to final location'
+    )
+    deploy_parser.add_argument(
+        'temp_file',
+        help='Path to temporary cephadm binary file'
+    )
+    deploy_parser.add_argument(
+        'final_path',
+        help='Final destination path for cephadm binary'
+    )
+    deploy_parser.set_defaults(func=command_deploy_binary)
+
+    check_parser = subparsers.add_parser(
+        'check_binary',
+        help='Check if a cephadm binary exists (exit 0 if exists, 2 if not)'
+    )
+    check_parser.add_argument(
+        'cephadm_binary_path',
+        help='Path to cephadm binary to check'
+    )
+    check_parser.set_defaults(func=command_check_binary)
+
+    return parser
+
+
+def main() -> int:
+    """
+    Main entry point - parses arguments and dispatches to appropriate handler.
+    """
+    setup_logging()
+    parser = create_argument_parser()
+    args = parser.parse_args()
+
+    if not hasattr(args, 'func'):
+        parser.print_help()
+        return 1
+    try:
+        return args.func(args)
+    except SystemExit:
+        raise
+    except Exception as e:
+        logger.error('Error executing command %s: %s', args.command, e)
+        return 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/src/cephadm/tests/test_invoker.py b/src/cephadm/tests/test_invoker.py
new file mode 100644
index 00000000000..fe5fb5bb945
--- /dev/null
+++ b/src/cephadm/tests/test_invoker.py
@@ -0,0 +1,120 @@
+# Tests for cephadm_invoker.py - secure wrapper for executing cephadm commands
+#
+import hashlib
+import io
+import os
+import sys
+import tempfile
+from pathlib import Path
+from unittest import mock
+import pytest
+
+import cephadm_invoker as invoker
+
+
+class TestInvoker:
+    """Tests for main function."""
+
+    def test_run_command_valid(self, monkeypatch, tmp_path):
+        """Test 'run' command with valid binary."""
+        content = b'#!/usr/bin/env python3\nprint("test")\n'
+        hash_value = hashlib.sha256(content).hexdigest()
+        test_file = tmp_path / f'cephadm.{hash_value}'
+        test_file.write_bytes(content)
+
+        monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'run', str(test_file), 'ls'])
+
+        with mock.patch('os.execve') as mock_execve:
+            with pytest.raises(SystemExit) as exc_info:
+                invoker.main()
+            assert exc_info.value.code == 0
+            mock_execve.assert_called_once()
+
+    def test_run_command_hash_mismatch(self, monkeypatch, tmp_path):
+        """Test 'run' command with hash mismatch."""
+        content = b'#!/usr/bin/env python3\nprint("test")\n'
+        wrong_hash = 'wronghash123'
+        test_file = tmp_path / f'cephadm.{wrong_hash}'
+        test_file.write_bytes(content)
+        
+        monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'run', str(test_file), 'ls'])
+        
+        with pytest.raises(SystemExit) as exc_info:
+            invoker.main()
+        assert exc_info.value.code == 2
+
+    def test_run_command_nonexistent(self, monkeypatch, tmp_path):
+        """Test 'run' command with nonexistent binary."""
+        nonexistent = tmp_path / 'nonexistent'
+        monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'run', str(nonexistent), 'ls'])
+        
+        with pytest.raises(SystemExit) as exc_info:
+            invoker.main()
+        assert exc_info.value.code == 1
+
+    def test_deploy_command_success(self, monkeypatch, tmp_path):
+        """Test 'deploy_binary' command."""
+        temp_file = tmp_path / 'temp_cephadm'
+        temp_file.write_text('#!/usr/bin/env python3\nprint("test")')
+        final_path = tmp_path / 'cephadm'
+
+        monkeypatch.setattr('sys.argv', [
+            'cephadm_invoker.py',
+            'deploy_binary',
+            str(temp_file),
+            str(final_path)
+        ])
+
+        result = invoker.main()
+        assert result == 0
+        assert final_path.exists()
+
+    def test_deploy_command_temp_not_exist(self, monkeypatch, tmp_path):
+        """Test 'deploy_binary' with nonexistent temp file."""
+        temp_file = tmp_path / 'nonexistent'
+        final_path = tmp_path / 'cephadm'
+        
+        monkeypatch.setattr('sys.argv', [
+            'cephadm_invoker.py',
+            'deploy_binary',
+            str(temp_file),
+            str(final_path)
+        ])
+        
+        result = invoker.main()
+        assert result == 1
+
+    def test_check_existence_exists(self, monkeypatch, tmp_path):
+        """Test 'check_binary' command when file exists."""
+        test_file = tmp_path / 'test_file'
+        test_file.write_text('content')
+        
+        monkeypatch.setattr('sys.argv', [
+            'cephadm_invoker.py', 
+            'check_binary',
+            str(test_file)
+        ])
+        
+        result = invoker.main()
+        assert result == 0
+
+    def test_check_existence_not_exists(self, monkeypatch, tmp_path):
+        """Test 'check_binary' command when file doesn't exist."""
+        test_file = tmp_path / 'nonexistent'
+
+        monkeypatch.setattr('sys.argv', [
+            'cephadm_invoker.py',
+            'check_binary',
+            str(test_file)
+        ])
+
+        result = invoker.main()
+        assert result == 2
+
+    def test_invalid_command(self, monkeypatch):
+        """Test invalid command."""
+        monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'invalid_command'])
+        with pytest.raises(SystemExit) as exc_info:
+            invoker.main()
+        # argparse exits with code 2 for invalid command
+        assert exc_info.value.code == 2
diff --git a/src/cephadm/tox.ini b/src/cephadm/tox.ini
index 751ff8c2558..2ca15427992 100644
--- a/src/cephadm/tox.ini
+++ b/src/cephadm/tox.ini
@@ -49,7 +49,7 @@ deps =
     types-PyYAML
     -rzipapp-reqs.txt
     -c{toxinidir}/../mypy-constrains.txt
-commands = mypy --config-file ../mypy.ini {posargs:cephadm.py cephadmlib}
+commands = mypy --config-file ../mypy.ini {posargs:cephadm.py cephadm_invoker.py cephadmlib}
 
 [testenv:flake8]
 allowlist_externals = bash
@@ -57,7 +57,7 @@ deps =
     flake8
     flake8-quotes
 commands =
-    flake8 --config=tox.ini {posargs:cephadm.py cephadmlib}
+    flake8 --config=tox.ini {posargs:cephadm.py cephadm_invoker.py cephadmlib}
     bash -c 'test $(git ls-files 'cephadm.py' 'cephadmlib/*.py' | sort -u | xargs grep "docker.io" | wc -l) == 1'
     bash -c 'test $(git ls-files 'cephadm.py' 'cephadmlib/*.py' | sort -u | xargs grep "quay.io" | wc -l) == 7'
 # Downstream distributions may choose to alter this "docker.io" number,

From a22ee365985baaf0d16d3f0ce10c8d24621703bb Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Sat, 13 Dec 2025 12:54:25 +0530
Subject: [PATCH 158/596] mgr/cephadm: Cephadm to call invoker if ssh hardening
 is enabled Fixes: https://tracker.ceph.com/issues/74045

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/module.py              | 13 ++++
 src/pybind/mgr/cephadm/serve.py               | 67 ++++++++++++-------
 src/pybind/mgr/cephadm/ssh.py                 | 64 +++++++++++++++++-
 .../cephadm/tests/test_remote_executables.py  |  4 +-
 src/pybind/mgr/cephadm/tests/test_ssh.py      | 11 ++-
 5 files changed, 125 insertions(+), 34 deletions(-)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 457695084b9..a9df95ff056 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -515,6 +515,14 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             default='169.254.1.1',
             desc="Default IP address for RedFish API (OOB management)."
         ),
+        Option(
+            'ssh_hardening',
+            type='bool',
+            default=False,
+            desc='Enable SSH hardening by routing all command execution through invoker.py. '
+                 'When enabled, cephadm and bash commands are validated and executed via '
+                 'the secure invoker wrapper.'
+        ),
     ]
     for image in DefaultImages:
         MODULE_OPTIONS.append(Option(image.key, default=image.image_ref, desc=image.desc))
@@ -542,6 +550,9 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
         else:
             self.paused = False
 
+        self.ssh_hardening = False
+        self.invoker_path = '/usr/libexec/cephadm_invoker.py'
+
         # for mypy which does not run the code
         if TYPE_CHECKING:
             self.ssh_config_file = None  # type: Optional[str]
@@ -621,6 +632,8 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             self.oob_default_addr = ''
             self.ssh_keepalive_interval = 0
             self.ssh_keepalive_count_max = 0
+            self.ssh_hardening = False
+            self.invoker_path = '/usr/libexec/cephadm_invoker.py'
             self.certificate_duration_days = 0
             self.certificate_renewal_threshold_days = 0
             self.certificate_automated_rotation_enabled = False
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 54985d2641f..4e60a702802 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -46,7 +46,6 @@ logger = logging.getLogger(__name__)
 
 REQUIRES_POST_ACTIONS = ['grafana', 'iscsi', 'prometheus', 'alertmanager', 'rgw', 'nvmeof', 'mgmt-gateway']
 
-WHICH = ssh.RemoteExecutable('which')
 CEPHADM_EXE = ssh.RemoteExecutable('/usr/bin/cephadm')
 
 
@@ -1785,30 +1784,36 @@ class CephadmServe:
             if stdin and 'agent' not in str(entity):
                 self.log.debug('stdin: %s' % stdin)
 
-            cmd = ssh.RemoteCommand(WHICH, ['python3'])
-            try:
-                # when connection was broken/closed, retrying resets the connection
-                python = await self.mgr.ssh._check_execute_command(host, cmd, addr=addr)
-            except ssh.HostConnectionError:
-                python = await self.mgr.ssh._check_execute_command(host, cmd, addr=addr)
-
-            # N.B. because the python3 executable is based on the results of the
-            # which command we can not know it ahead of time and must be converted
-            # into a RemoteExecutable.
-            cmd = ssh.RemoteCommand(
-                ssh.RemoteExecutable(python),
-                [self.mgr.cephadm_binary_path] + final_args
-            )
+            # If SSH hardening is enabled, call invoker directly without which python
+            if self.mgr.ssh_hardening and self.mgr.invoker_path:
+                # For invoker, pass all args as a single string
+                cmd = ssh.RemoteCommand(
+                    ssh.Executables.INVOKER,
+                    ['run', self.mgr.cephadm_binary_path, '--'] + final_args
+                )
+            else:
+                # cephadm_binary_path must be converted into a RemoteExecutable.
+                cmd = ssh.RemoteCommand(
+                    ssh.RemoteExecutable(self.mgr.cephadm_binary_path),
+                    final_args
+                )
 
             try:
                 out, err, code = await self.mgr.ssh._execute_command(
                     host, cmd, stdin=stdin, addr=addr)
-                if code == 2:
-                    ls_cmd = ssh.RemoteCommand(
-                        ssh.Executables.LS,
-                        [self.mgr.cephadm_binary_path]
-                    )
-                    out_ls, err_ls, code_ls = await self.mgr.ssh._execute_command(host, ls_cmd, addr=addr,
+                if code == 2 or code == 127:
+                    # Use invoker to check file existence when SSH hardening is enabled
+                    if self.mgr.ssh_hardening and self.mgr.invoker_path:
+                        check_cmd = ssh.RemoteCommand(
+                            ssh.Executables.INVOKER,
+                            ['check_existence', self.mgr.cephadm_binary_path]
+                        )
+                    else:
+                        check_cmd = ssh.RemoteCommand(
+                            ssh.Executables.LS,
+                            [self.mgr.cephadm_binary_path]
+                        )
+                    out_ls, err_ls, code_ls = await self.mgr.ssh._execute_command(host, check_cmd, addr=addr,
                                                                                   log_command=log_output)
                     if code_ls == 2:
                         await self._deploy_cephadm_binary(host, addr)
@@ -1828,7 +1833,14 @@ class CephadmServe:
 
         elif self.mgr.mode == 'cephadm-package':
             try:
-                cmd = ssh.RemoteCommand(CEPHADM_EXE, final_args)
+                # Wrap with invoker if SSH hardening is enabled
+                if self.mgr.ssh_hardening and self.mgr.invoker_path:
+                    cmd = ssh.RemoteCommand(
+                        ssh.Executables.INVOKER,
+                        ['run', str(CEPHADM_EXE), '--'] + final_args
+                    )
+                else:
+                    cmd = ssh.RemoteCommand(CEPHADM_EXE, final_args)
                 out, err, code = await self.mgr.ssh._execute_command(
                     host, cmd, stdin=stdin, addr=addr)
             except Exception as e:
@@ -1900,8 +1912,15 @@ class CephadmServe:
     async def _deploy_cephadm_binary(self, host: str, addr: Optional[str] = None) -> None:
         # Use tee (from coreutils) to create a copy of cephadm on the target machine
         self.log.info(f"Deploying cephadm binary to {host}")
-        await self.mgr.ssh._write_remote_file(host, self.mgr.cephadm_binary_path,
-                                              self.mgr._cephadm, addr=addr, bypass_cephadm_exec=True)
+        if self.mgr.ssh_hardening and self.mgr.invoker_path:
+            # Use invoker for secure deployment when SSH hardening is enabled
+            await self.mgr.ssh._deploy_cephadm_binary_via_invoker(
+                host, self.mgr.cephadm_binary_path, self.mgr._cephadm, addr=addr)
+        else:
+            await self.mgr.ssh._write_remote_file(host, self.mgr.cephadm_binary_path,
+                                                  self.mgr._cephadm, addr=addr, mode=0o744,
+                                                  bypass_cephadm_exec=True)
+
     async def run_cephadm_exec(self,
                                host: str,
                                cmd: List[str],
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index ab70b6d902a..53c0b2209df 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -111,6 +111,7 @@ class Executables(RemoteExecutable, enum.Enum):
     SYSCTL = RemoteExecutable('sysctl')
     TOUCH = RemoteExecutable('touch')
     TRUE = RemoteExecutable('true')
+    INVOKER = RemoteExecutable('/usr/libexec/cephadm_invoker.py')
 
     def __str__(self) -> str:
         return self.value
@@ -263,6 +264,27 @@ class SSHManager:
         with self.mgr.async_timeout_handler(host, f'ssh {host} (addr {addr})'):
             return self.mgr.wait_async(self._remote_connection(host, addr))
 
+    def _enforce_ssh_hardening(self,
+                               host: str,
+                               cmd_components: RemoteCommand) -> None:
+        """
+        Enforce that commands are wrapped with invoker when SSH hardening
+        is enabled.
+        """
+        if not self.mgr.ssh_hardening:
+            return
+
+        is_wrapped = (
+            isinstance(cmd_components.exe, RemoteExecutable)
+            and str(cmd_components.exe) == str(Executables.INVOKER)
+        )
+        if not is_wrapped:
+            msg = (f'SSH hardening is enabled but command is not '
+                   f'wrapped with invoker for host {host}. '
+                   f'Command: {cmd_components}')
+            logger.error(msg)
+            raise OrchestratorError(msg)
+
     async def _execute_command(self,
                                host: str,
                                cmd_components: RemoteCommand,
@@ -279,6 +301,9 @@ class SSHManager:
         if is_host_being_added:
             logger.debug(f'Host {host} is being added, using root user without sudo')
 
+        # Enforce invoker usage if SSH hardening is enabled
+        self._enforce_ssh_hardening(host, cmd_components)
+
         rcmd = RemoteSudoCommand.wrap(cmd_components, use_sudo=use_sudo)
         try:
             address = addr or self.mgr.inventory.get_addr(host)
@@ -518,13 +543,14 @@ class SSHManager:
                 conn = await self._remote_connection(host, addr)
                 async with conn.start_sftp_client() as sftp:
                     await sftp.put(f.name, tmp_path)
-            if uid is not None and gid is not None and mode is not None:
+            if uid is not None and gid is not None:
                 # shlex quote takes str or byte object, not int
                 chown = RemoteCommand(
                     Executables.CHOWN,
                     ['-R', str(uid) + ':' + str(gid), tmp_path]
                 )
                 await execute_method(host, chown, addr=addr)
+            if mode is not None:
                 chmod = RemoteCommand(Executables.CHMOD, [oct(mode)[2:], tmp_path])
                 await execute_method(host, chmod, addr=addr)
             mv = RemoteCommand(Executables.MV, ['-Z', tmp_path, path])
@@ -534,6 +560,42 @@ class SSHManager:
             logger.exception(msg)
             raise OrchestratorError(msg)
 
+    async def _deploy_cephadm_binary_via_invoker(
+        self,
+        host: str,
+        cephadm_path: str,
+        cephadm_content: bytes,
+        addr: Optional[str] = None
+    ) -> None:
+        """
+        Deploy cephadm binary using the invoker for secure operations.
+        This creates a temp file locally, copies it to remote host, then
+        calls the invoker to perform all deployment operations.
+        """
+        with NamedTemporaryFile(prefix='cephadm-deploy-', delete=False) as local_tmp:
+            local_tmp.write(cephadm_content)
+            local_tmp.flush()
+            local_tmp_path = local_tmp.name
+
+        try:
+            remote_tmp_path = f'/tmp/cephadm-{self.mgr._cluster_fsid}.new'
+
+            conn = await self._remote_connection(host, addr)
+            async with conn.start_sftp_client() as sftp:
+                await sftp.put(local_tmp_path, remote_tmp_path)
+
+            invoker_cmd = RemoteCommand(
+                Executables.INVOKER,
+                ['deploy_cephadm_binary', remote_tmp_path, cephadm_path]
+            )
+            await self._execute_command(host, invoker_cmd, addr=addr)
+
+        finally:
+            try:
+                os.unlink(local_tmp_path)
+            except OSError:
+                pass
+
     def write_remote_file(self,
                           host: str,
                           path: str,
diff --git a/src/pybind/mgr/cephadm/tests/test_remote_executables.py b/src/pybind/mgr/cephadm/tests/test_remote_executables.py
index 26b02e9de96..47fa6ee8463 100644
--- a/src/pybind/mgr/cephadm/tests/test_remote_executables.py
+++ b/src/pybind/mgr/cephadm/tests/test_remote_executables.py
@@ -54,9 +54,9 @@ EXPECTED = [
     ('sysctl', True, ssh_py),
     ('touch', True, ssh_py),
     ('true', True, ssh_py),
-    ('which', True, serve_py),
     # variable executables
-    ('python', False, serve_py),
+    ('self.mgr.cephadm_binary_path', False, serve_py),
+    ('/usr/libexec/cephadm_invoker.py', True, ssh_py),
 ]
 
 
diff --git a/src/pybind/mgr/cephadm/tests/test_ssh.py b/src/pybind/mgr/cephadm/tests/test_ssh.py
index 95cd87716f2..937e3156760 100644
--- a/src/pybind/mgr/cephadm/tests/test_ssh.py
+++ b/src/pybind/mgr/cephadm/tests/test_ssh.py
@@ -79,15 +79,12 @@ class TestWithSSH:
                     with with_host(cephadm_module, host):
                         CephadmServe(cephadm_module)._check_host(host)
 
-        # Test case 1: command failure
-        run_test('test1', FakeConn(returncode=1), "Command .+ failed")
+        # Test case 1: connection error
+        run_test('test1', FakeConn(exception=asyncssh.ChannelOpenError(1, "", "")), "Unable to reach remote host test1")
 
-        # Test case 2: connection error
-        run_test('test2', FakeConn(exception=asyncssh.ChannelOpenError(1, "", "")), "Unable to reach remote host test2.")
-
-        # Test case 3: asyncssh ProcessError
+        # Test case 2: asyncssh ProcessError
         stderr = "my-process-stderr"
-        run_test('test3', FakeConn(exception=asyncssh.ProcessError(returncode=3,
+        run_test('test2', FakeConn(exception=asyncssh.ProcessError(returncode=3,
                                                                    env="",
                                                                    command="",
                                                                    subsystem="",

From d4f6188d15f7c9622d535002b2770597ed901565 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 26 Dec 2025 17:21:42 +0530
Subject: [PATCH 159/596] mgr/cephadm: Added prepare host for ssh hardning
 command and add node handling if ssh hardning is enabled

It will perform following steps
1. prepare host for ssh hardning (enable passwordless ssh, install cephadm RPM, update sudoers)
2. enable ssh hardning
3. set cephadm user

Fixes:https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py                        |  84 +++++-
 src/cephadm/cephadmlib/user_utils.py          | 138 +++++++--
 src/pybind/mgr/cephadm/module.py              | 273 ++++++++++++++----
 src/pybind/mgr/cephadm/serve.py               |  10 +-
 src/pybind/mgr/cephadm/ssh.py                 |  14 +-
 .../mgr/cephadm/tests/test_ssh_hardening.py   | 187 ++++++++++++
 6 files changed, 614 insertions(+), 92 deletions(-)
 create mode 100644 src/pybind/mgr/cephadm/tests/test_ssh_hardening.py

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index d8c99403f51..34e1f1b5ed2 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -231,7 +231,12 @@ from cephadmlib.listing_updaters import (
 )
 from cephadmlib.container_lookup import infer_local_ceph_image, identify
 from ceph.cephadm.d3n_types import D3NCache, D3NCacheError
-from cephadmlib.user_utils import setup_ssh_user
+from cephadmlib.user_utils import (
+    setup_ssh_user,
+    validate_user_exists,
+    setup_sudoers_restricted,
+    install_or_upgrade_cephadm
+)
 
 
 FuncT = TypeVar('FuncT', bound=Callable)
@@ -4856,6 +4861,65 @@ def command_setup_ssh_user(ctx: CephadmContext) -> int:
 ##################################
 
 
+def command_prepare_host_sudo_hardening(ctx: CephadmContext) -> int:
+    """
+    Prepare host for sudo hardening by:
+    1. Authorizing SSH public key for the user
+    2. Installing/upgrading cephadm package to match cluster version (includes cephadm_invoker.py)
+    3. Setting up sudoers with restricted permissions for cephadm_invoker.py
+    """
+    logger.info('Preparing host for sudo hardening...')
+
+    user = ctx.ssh_user if hasattr(ctx, 'ssh_user') and ctx.ssh_user else 'root'
+    ssh_pub_key = ctx.ssh_pub_key if hasattr(ctx, 'ssh_pub_key') else None
+    cephadm_version = ctx.cephadm_version if hasattr(ctx, 'cephadm_version') else None
+
+    has_failures = False
+    try:
+        validate_user_exists(user)
+    except Exception as e:
+        logger.exception('User %s does not exists. err: %s', user, e)
+        return 1
+    # Step 1: Authorize SSH public key for the user
+    if ssh_pub_key:
+        try:
+            logger.debug('Authorizing SSH key for user %s', user)
+            authorize_ssh_key(ssh_pub_key, user)
+        except Exception as e:
+            logger.exception('Failed to authorize SSH key for %s. err: %s', user, e)
+            has_failures = True
+    else:
+        logger.warning('SSH key authorization skipped (no key provided)')
+
+    # Step 2: Install/upgrade the cephadm package (includes cephadm_invoker.py)
+    success, message = install_or_upgrade_cephadm(ctx, cephadm_version)
+    if success:
+        logger.debug('Installed the cephadm package: %s', message)
+    else:
+        logger.error('Failed to install the cephadm package: %s', message)
+        has_failures = True
+
+    # Step 3: Setup sudoers with restricted permissions for cephadm_invoker.py
+    if user and user != 'root':
+        try:
+            setup_sudoers_restricted(ctx, user, '/usr/libexec/cephadm_invoker.py')
+            logger.debug('Sudoers configured for %s (restricted to cephadm_nvoker.py)', user)
+        except Exception as e:
+            logger.exception('Failed to setup sudoers for %s. err: %s', user, e)
+            has_failures = True
+    else:
+        logger.debug('Sudoers setup skipped (root user)')
+
+    logger.info('Successfully prepared host for sudo hardening')
+
+    # Raise error if any step failed
+    if has_failures:
+        raise Error('Failed to prepare host for sudo hardening')
+    return 0
+
+##################################
+
+
 class ArgumentFacade:
     def __init__(self) -> None:
         self.defaults: Dict[str, Any] = {}
@@ -5588,7 +5652,7 @@ def _get_parser():
         help='Set hostname')
 
     parser_setup_ssh_user = subparsers.add_parser(
-        'setup-ssh-user', help='setup SSH user with passwordless sudo and SSH key')
+        'setup-ssh-user', help='set up SSH user with passwordless sudo and key')
     parser_setup_ssh_user.set_defaults(func=command_setup_ssh_user)
     parser_setup_ssh_user.add_argument(
         '--ssh-user',
@@ -5597,7 +5661,21 @@ def _get_parser():
     parser_setup_ssh_user.add_argument(
         '--ssh-pub-key',
         required=True,
-        help='SSH public key to add to user authorized_keys')
+        help='SSH public key to add to authorized_keys')
+
+    parser_prepare_host_sudo_hardening = subparsers.add_parser(
+        'prepare-host-sudo-hardening',
+        help='prepare host by installing cephadm, configuring sudoers, and enabling sudo hardening')
+    parser_prepare_host_sudo_hardening.set_defaults(func=command_prepare_host_sudo_hardening)
+    parser_prepare_host_sudo_hardening.add_argument(
+        '--ssh-user',
+        help='SSH user to configure (default: root)')
+    parser_prepare_host_sudo_hardening.add_argument(
+        '--ssh-pub-key',
+        help='SSH public key to authorize for the user')
+    parser_prepare_host_sudo_hardening.add_argument(
+        '--cephadm-version',
+        help='Specific cephadm version to install')
 
     parser_add_repo = subparsers.add_parser(
         'add-repo', help='configure package repository')
diff --git a/src/cephadm/cephadmlib/user_utils.py b/src/cephadm/cephadmlib/user_utils.py
index 39b21d3c44f..238d55ceca4 100644
--- a/src/cephadm/cephadmlib/user_utils.py
+++ b/src/cephadm/cephadmlib/user_utils.py
@@ -3,13 +3,15 @@
 import logging
 import os
 import pwd
-from typing import Tuple
+from typing import Tuple, Optional
 
 from .call_wrappers import call, CallVerbosity
 from .context import CephadmContext
-from .exceptions import Error
+from .exceptions import Error, TimeoutExpired
 from .exe_utils import find_program
+from .file_utils import write_new
 from .ssh import authorize_ssh_key
+from .packagers import create_packager
 
 logger = logging.getLogger()
 
@@ -33,29 +35,32 @@ def validate_user_exists(username: str) -> Tuple[int, int, str]:
         )
 
 
-def setup_sudoers(ctx: CephadmContext, username: str) -> None:
-    """Setup passwordless sudo for a user.
-    """
+def setup_sudoers(
+    ctx: CephadmContext, username: str, sudoers_content: Optional[str] = None
+) -> None:
+    """Setup sudoers for a user with custom or default permissions."""
     sudoers_file = f'/etc/sudoers.d/{username}'
-    sudoers_content = f'{username} ALL=(ALL) NOPASSWD: ALL\n'
+    if sudoers_content is None:
+        sudoers_content = f'{username} ALL=(ALL) NOPASSWD: ALL\n'
+
+    # Ensure content ends with newline
+    if not sudoers_content.endswith('\n'):
+        sudoers_content += '\n'
 
     logger.info('Setting up sudoers for user %s', username)
     try:
         # Write sudoers file with proper permissions
-        with open(sudoers_file, 'w') as f:
-            f.write(sudoers_content)
-        os.chmod(sudoers_file, 0o440)
-        os.chown(sudoers_file, 0, 0)
+        with write_new(sudoers_file, owner=(0, 0), perms=0o440) as fh:
+            fh.write(sudoers_content)
 
         # Validate sudoers syntax
         visudo_cmd = find_program('visudo')
         _out, _err, code = call(
             ctx,
             [visudo_cmd, '-c', '-f', sudoers_file],
-            verbosity=CallVerbosity.DEBUG
+            verbosity=CallVerbosity.DEBUG,
         )
         if code != 0:
-            # Clean up invalid file
             try:
                 os.remove(sudoers_file)
             except OSError:
@@ -70,17 +75,28 @@ def setup_sudoers(ctx: CephadmContext, username: str) -> None:
         raise Error(msg)
 
 
-def setup_ssh_user(ctx: CephadmContext, username: str, ssh_pub_key: str) -> None:
+def setup_sudoers_restricted(
+    ctx: CephadmContext, username: str, allowed_command: str
+) -> None:
+    """Setup sudoers with restricted permissions for a specific command.
+    Args:
+        ctx: CephadmContext
+        username: Username to configure sudoers for
+        allowed_command: Full path to the command that user can run with sudo
+    """
+    sudoers_content = f'{username} ALL=(ALL) NOPASSWD: {allowed_command}'
+    setup_sudoers(ctx, username, sudoers_content)
+
+
+def setup_ssh_user(
+    ctx: CephadmContext, username: str, ssh_pub_key: str
+) -> None:
     """Setup SSH user with passwordless sudo and SSH key authorization.
     This function performs the following operations:
     1. Validates that the user exists on the system
     2. Sets up passwordless sudo for the user (skipped for root)
     3. Authorizes the SSH public key for the user
     """
-    # Verify we're running as root
-    if os.geteuid() != 0:
-        raise Error('This operation must be run as root')
-
     if not ssh_pub_key or ssh_pub_key.isspace():
         raise Error('SSH public key is required and cannot be empty')
 
@@ -105,3 +121,91 @@ def setup_ssh_user(ctx: CephadmContext, username: str, ssh_pub_key: str) -> None
         raise Error(msg)
 
     logger.info('Successfully configured SSH user %s on this host', username)
+
+
+def _check_cephadm_version(ctx: CephadmContext) -> Tuple[Optional[str], bool]:
+    """Check if cephadm is installed and return its version.
+    Returns:
+        Tuple of (version_string_or_none, is_available)
+    """
+    try:
+        result_stdout, result_stderr, result_code = call(
+            ctx, ['cephadm', 'version']
+        )
+        if result_code == 0:
+            version = result_stdout.strip()
+            logger.info('Found installed cephadm: %s', version)
+            return version, True
+        else:
+            logger.info('cephadm command failed, package not available')
+            return None, False
+    except (TimeoutExpired, FileNotFoundError) as e:
+        logger.exception('cephadm not found: %s', e)
+        return None, False
+
+
+def install_or_upgrade_cephadm(
+    ctx: CephadmContext, requested_version: Optional[str] = None
+) -> Tuple[bool, str]:
+    """Install or upgrade cephadm package to match a specific version.
+    Returns:
+        Tuple of (success, message)
+    """
+    try:
+        current_version, is_available = _check_cephadm_version(ctx)
+        if is_available and current_version:
+            if requested_version and requested_version not in current_version:
+                logger.info(
+                    'Version mismatch: installed=%s, requested=%s',
+                    current_version,
+                    requested_version,
+                )
+                needs_install = True
+            elif requested_version:
+                logger.debug(
+                    'cephadm version %s already installed', requested_version
+                )
+                return True, f'cephadm {requested_version} already installed'
+            else:
+                logger.info(
+                    'cephadm installed, no specific version requested'
+                )
+                return True, f'cephadm already installed: {current_version}'
+        else:
+            needs_install = True
+
+        # Install or upgrade if needed
+        if needs_install:
+            logger.info('Installing/upgrading cephadm package...')
+            pkg = create_packager(ctx, version=requested_version)
+            pkg.install(['cephadm'])
+
+            # Verify installation
+            new_version, install_success = _check_cephadm_version(ctx)
+            if install_success and new_version:
+                logger.info(f'Successfully installed cephadm: {new_version}')
+                # Check version match if requested
+                if requested_version and requested_version not in new_version:
+                    logger.warning(
+                        'Installed version %s does not match requested %s',
+                        new_version,
+                        requested_version,
+                    )
+                    return (
+                        True,
+                        f'cephadm installed/upgraded: {new_version} (requested {requested_version} not available)',
+                    )
+                return True, f'cephadm installed/upgraded: {new_version}'
+            else:
+                logger.warning(
+                    'cephadm package installed but verification failed'
+                )
+                return (
+                    True,
+                    'cephadm package installed (verification unavailable)',
+                )
+        return True, 'cephadm operation completed'
+    except Exception as e:
+        error_msg = f'Failed to install/upgrade cephadm: {e}'
+        logger.exception(error_msg)
+        return False, error_msg
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index a9df95ff056..cb8c47a2b6d 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -516,10 +516,10 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             desc="Default IP address for RedFish API (OOB management)."
         ),
         Option(
-            'ssh_hardening',
+            'sudo_hardening',
             type='bool',
             default=False,
-            desc='Enable SSH hardening by routing all command execution through invoker.py. '
+            desc='Enable sudo hardening by routing all command execution through invoker.py. '
                  'When enabled, cephadm and bash commands are validated and executed via '
                  'the secure invoker wrapper.'
         ),
@@ -550,7 +550,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
         else:
             self.paused = False
 
-        self.ssh_hardening = False
+        self.sudo_hardening = False
         self.invoker_path = '/usr/libexec/cephadm_invoker.py'
 
         # for mypy which does not run the code
@@ -632,7 +632,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             self.oob_default_addr = ''
             self.ssh_keepalive_interval = 0
             self.ssh_keepalive_count_max = 0
-            self.ssh_hardening = False
+            self.sudo_hardening = False
             self.invoker_path = '/usr/libexec/cephadm_invoker.py'
             self.certificate_duration_days = 0
             self.certificate_renewal_threshold_days = 0
@@ -1579,6 +1579,126 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
                     self.event.set()
         return 0, '%s (%s) ok' % (host, addr), '\n'.join(err)
 
+    def _prepare_host_for_sudo_hardening(
+        self,
+        host: str,
+        cephadm_args: List[str],
+        addr: Optional[str] = None
+    ) -> Tuple[str, bool, str]:
+        """
+        Prepare a host for sudo hardening by executing 'cephadm prepare-host-sudo-hardening' command.
+        """
+        try:
+            self.log.debug('Preparing host %s for sudo hardening...', host)
+            addr = addr or (self.inventory.get_addr(host) if host in self.inventory else None)
+
+            with self.async_timeout_handler(host, 'cephadm prepare-host-sudo-hardening'):
+                out, err, code = self.wait_async(
+                    CephadmServe(self)._run_cephadm(
+                        host, cephadmNoImage, 'prepare-host-sudo-hardening', cephadm_args,
+                        addr=addr, error_ok=True, no_fsid=True))
+            if code:
+                error_msg = '\n'.join(err) if err else 'Unknown error'
+                self.log.error('Failed to prepare host %s: %s', host, error_msg)
+                return (host, False, error_msg)
+            self.log.debug('Successfully prepared host %s', host)
+            return (host, True, '')
+        except Exception as e:
+            error_msg = str(e)
+            self.log.exception('Exception while preparing host %s: %s', host, error_msg)
+            return (host, False, error_msg)
+
+    @forall_hosts
+    def _prepare_hosts_for_sudo_hardening(
+        self,
+        host: str,
+        cephadm_args: List[str],
+        addr: Optional[str] = None
+    ) -> Tuple[str, bool, str]:
+        return self._prepare_host_for_sudo_hardening(host, cephadm_args, addr)
+
+    @CephadmCLICommand.Write('cephadm prepare-host-and-enable-sudo-hardening')
+    def _prepare_host_and_enable_sudo_hardening(
+        self,
+        user: str,
+        host_label: Optional[str] = None
+    ) -> Tuple[int, str, str]:
+        """
+        Prepare hosts and enable sudo hardening for the cluster.
+        This command performs a complete sudo hardening setup:
+        1. Prepare each host for sudo hardening (install cephadm, configure sudoers) - executed on all hosts
+        2. Set SSH user to the specified user for cluster operations (without pre-steps)
+        3. Enable sudo hardening globally for the cluster
+        """
+        if not self.ssh_pub:
+            return 1, '', 'Error: No SSH public key configured. Run "ceph cephadm generate-key" first.'
+        if host_label:
+            hosts_to_prepare = [h for h in self.cache.get_hosts()
+                                if self.inventory.has_label(h, host_label)]
+        else:
+            hosts_to_prepare = self.cache.get_hosts()
+        if not hosts_to_prepare:
+            return 1, '', 'Error: No hosts found'
+        self.log.debug('Preparing %s host(s) in the cluster: %s', len(hosts_to_prepare), ", ".join(hosts_to_prepare))
+
+        # Prepare arguments for the cephadm command
+        args = []
+        args.extend(['--ssh-user', user])
+        args.extend(['--ssh-pub-key', self.ssh_pub])
+        ceph_version = self._get_cephadm_version_for_host_prep()
+        if ceph_version:
+            args.extend(['--cephadm-version', ceph_version])
+
+        # Step 1: Prepare each host for sudo hardening (executed on all target hosts in parallel)
+        self.log.debug('Step 1: Preparing %s host(s) for sudo hardening in parallel', len(hosts_to_prepare))
+        host_args = [(host, args) for host in hosts_to_prepare]
+        try:
+            host_results = self._prepare_hosts_for_sudo_hardening(host_args)
+        except Exception as e:
+            self.log.exception('Failed to prepare hosts in parallel: %s', e)
+            return 1, '', f'Failed to prepare hosts: {str(e)}'
+        failed_hosts = []
+        for hostname, success, error_msg in host_results:
+            if not success:
+                failed_hosts.append(hostname)
+        if failed_hosts:
+            return 1, '', f'Failed to prepare {len(failed_hosts)} host(s): {", ".join(failed_hosts)}'
+        self.log.debug('All %s hosts prepared successfully', len(hosts_to_prepare))
+
+        # Step 2: Enable sudo hardening globally
+        self.log.debug('Step 2: Enabling sudo hardening...')
+        try:
+            if not self.sudo_hardening:
+                self.set_module_option('sudo_hardening', True)
+                self.sudo_hardening = True
+        except Exception as e:
+            error_msg = f'Failed to enable sudo hardening: {e}'
+            self.log.exception(error_msg)
+            return 1, '', error_msg
+
+        # Step 3: Set SSH user for cluster operations
+        self.log.debug('Step 3: Setting SSH user to %s for cluster operations', user)
+        try:
+            # Call set_ssh_user with skip_pre_steps=True since we've already prepared the hosts
+            current_user = self.ssh_user
+            if current_user != user:
+                retval, out_msg, err_msg = self.set_ssh_user(user, skip_pre_steps=True)
+                if retval != 0:
+                    error_msg = f'Failed to set SSH user: {err_msg}'
+                    self.log.error(error_msg)
+                    return 1, '', error_msg
+        except Exception as e:
+            error_msg = f'Failed to set SSH user: {e}'
+            self.log.exception(error_msg)
+            return 1, '', error_msg
+
+        success_msg = (
+            f'Sudo hardening is now active for all cluster operations.\n'
+            f'Affected hosts: {", ".join(hosts_to_prepare)}\n'
+        )
+        self.log.debug(success_msg)
+        return 0, success_msg, ''
+
     @CephadmCLICommand.Write(
         prefix='cephadm set-extra-ceph-conf')
     def _set_extra_ceph_conf(self, inbuf: Optional[str] = None) -> HandleCommandResult:
@@ -2003,6 +2123,74 @@ Then run the following:
             raise OrchestratorError(str(e))
         return ip_addr
 
+    def _get_cephadm_version_for_host_prep(self) -> Optional[str]:
+        """Extract cephadm version from cluster version string."""
+        try:
+            if self.version:
+                parts = self.version.split()
+                if len(parts) > 2 and parts[0] == 'ceph' and parts[1] == 'version':
+                    return parts[2]
+        except Exception as e:
+            self.log.debug(f'Could not determine cluster version: {e}')
+        return None
+
+    def _cleanup_add_host_tracking(self, hostname: str) -> None:
+        """Clean up host from tracking sets and reset SSH connection."""
+        try:
+            self.hosts_being_added.discard(hostname)
+        except Exception as e:
+            self.log.debug(f'Failed to remove {hostname} from hosts_being_added: {e}')
+
+        try:
+            self.ssh.reset_con(hostname)
+        except Exception as e:
+            self.log.debug(f'Failed to reset SSH connection for {hostname}: {e}')
+
+    def _prepare_new_host_for_sudo_hardening(self, hostname: str, addr: str) -> None:
+        """
+        Prepare a new host for sudo hardening before adding to inventory.
+        Raises OrchestratorError on failure.
+        """
+        if not self.ssh_pub:
+            raise OrchestratorError('No SSH public key configured')
+        if not self.ssh_user:
+            raise OrchestratorError('No SSH user configured')
+
+        self.log.info('Preparing new host %s for sudo hardening with root', hostname)
+
+        # Build arguments
+        ceph_version = self._get_cephadm_version_for_host_prep()
+        if ceph_version:
+            self.log.debug('Will install cephadm version %s on %s', ceph_version, hostname)
+        cephadm_args = ['--ssh-user', self.ssh_user, '--ssh-pub-key', self.ssh_pub]
+        if ceph_version:
+            cephadm_args.extend(['--cephadm-version', ceph_version])
+
+        # Execute preparation
+        _, success, error_msg = self._prepare_host_for_sudo_hardening(
+            hostname, cephadm_args, addr
+        )
+        if not success:
+            raise OrchestratorError(
+                f'Failed to prepare host {hostname} for sudo hardening: {error_msg}'
+            )
+        self.log.info('Successfully prepared host %s for sudo hardening', hostname)
+
+    def _setup_user_on_new_host(self, hostname: str, addr: Optional[str]) -> None:
+        """
+        user setup for new hosts (when sudo hardening is disabled).
+        """
+        try:
+            assert self.ssh_pub
+            assert self.ssh_user
+            self._setup_user_on_host(hostname, self.ssh_user, self.ssh_pub, addr=addr)
+        except OrchestratorError as oe:
+            self.log.exception('Failed to setup user %s on %s: %s', self.ssh_user, hostname, oe)
+            self.log.warning('Please manually setup user %s on %s', hostname, self.ssh_user, hostname)
+        except Exception as e:
+            self.log.exception('Unexpected error setting up user %s on %s: %s', self.ssh_user, hostname, e)
+            self.log.warning('You may need to manually setup user %s on %s', self.ssh_user, hostname)
+
     def _add_host(self, spec):
         # type: (HostSpec) -> str
         """
@@ -2017,9 +2205,9 @@ Then run the following:
         if is_new_host and self.ssh_user and self.ssh_user != 'root':
             try:
                 self.hosts_being_added.add(spec.hostname)
-                self.log.info(f'Adding new host {spec.hostname}, will use root user temporarily for setup')
+                self.log.info('Adding new host %s, will use root user temporarily for setup', spec.hostname)
             except Exception as e:
-                self.log.warning(f'Failed to add {spec.hostname} to hosts_being_added tracking: {e}')
+                self.log.warning('Failed to add %s to hosts_being_added tracking: %s', spec.hostname, e)
 
         try:
             ip_addr = self._check_valid_addr(spec.hostname, spec.addr)
@@ -2049,6 +2237,20 @@ Then run the following:
                     'args': [f'{k}={v}' for k, v in spec.location.items()],
                 })
 
+            # BEFORE adding host to inventory, prepare it for sudo hardening if needed
+            if is_new_host and self.sudo_hardening and self.ssh_user and self.ssh_user != 'root':
+                try:
+                    self._prepare_new_host_for_sudo_hardening(spec.hostname, spec.addr)
+                except Exception as e:
+                    self.log.exception('Sudo hardening preparation failed for %s: %s', spec.hostname, e)
+                    raise OrchestratorError(
+                        f'Failed to prepare host {spec.hostname} for sudo hardening. '
+                        f'Host was not added to the cluster. Error: {e}'
+                    )
+            elif is_new_host and self.ssh_user and self.ssh_user != 'root':
+                # Sudo hardening not enabled, just perform set user setup presteps
+                self._setup_user_on_new_host(spec.hostname, spec.addr)
+
             if spec.hostname not in self.inventory:
                 self.cache.prime_empty_host(spec.hostname)
             self.inventory.add_host(spec)
@@ -2058,64 +2260,13 @@ Then run the following:
             self.event.set()  # refresh stray health check
             self.log.info('Added host %s' % spec.hostname)
 
-            # If this is a new host and using non-root user, setup the user now
-            if is_new_host and self.ssh_user and self.ssh_user != 'root':
-                self.log.info(f'Setting up user {self.ssh_user} on new host {spec.hostname}')
-                try:
-                    assert self.ssh_pub
-                    self._setup_user_on_host(spec.hostname, self.ssh_user, self.ssh_pub, addr=spec.addr)
-                    self.log.info(f'Successfully set up user {self.ssh_user} on {spec.hostname}')
-                except OrchestratorError as oe:
-                    # OrchestratorError from user setup (user doesn't exist, SSH failures, etc.)
-                    # Log warning but don't fail the add_host operation
-                    self.log.warning(f'Failed to setup user {self.ssh_user} on {spec.hostname}: {oe}')
-                    self.log.warning(
-                        f'Host {spec.hostname} added but user setup incomplete. '
-                        f'Please manually setup user {self.ssh_user} on {spec.hostname}')
-                except Exception as e:
-                    # Unexpected error during user setup
-                    # Log warning but don't fail the add_host operation
-                    self.log.error(f'Unexpected error setting up user {self.ssh_user} on {spec.hostname}: {e}')
-                    self.log.warning(f'You may need to manually setup user {self.ssh_user} on {spec.hostname}')
-                finally:
-                    # Always remove from hosts_being_added after setup attempt
-                    try:
-                        self.hosts_being_added.discard(spec.hostname)
-                    except Exception as discard_err:
-                        self.log.debug(f'Failed to remove {spec.hostname} from hosts_being_added: {discard_err}')
-
-                    # Reset SSH connection so next operations will use configured user
-                    try:
-                        self.ssh.reset_con(spec.hostname)
-                        self.log.debug(f'Reset SSH connection for {spec.hostname} to use configured user')
-                    except Exception as reset_err:
-                        # Connection reset failure is not critical - connection will be recreated on next use
-                        self.log.debug(f'Failed to reset SSH connection for {spec.hostname}: {reset_err}')
-            elif is_new_host:
-                # Root user, no need to track
-                try:
-                    self.hosts_being_added.discard(spec.hostname)
-                except Exception as e:
-                    self.log.debug(f'Failed to remove {spec.hostname} from hosts_being_added: {e}')
-
             return "Added host '{}' with addr '{}'".format(spec.hostname, spec.addr)
         except Exception:
-            # If anything fails in core add_host operations, cleanup the new tracking mechanisms
-            if is_new_host and self.ssh_user and self.ssh_user != 'root':
-                # Cleanup tracking set
-                try:
-                    self.hosts_being_added.discard(spec.hostname)
-                    self.log.debug(f'Cleaned up hosts_being_added tracking for {spec.hostname} after error')
-                except Exception as cleanup_err:
-                    self.log.debug(f'Failed to cleanup hosts_being_added for {spec.hostname}: {cleanup_err}')
-
-                # Cleanup any stale SSH connection
-                try:
-                    self.ssh.reset_con(spec.hostname)
-                    self.log.debug(f'Reset SSH connection for {spec.hostname} after error')
-                except Exception as reset_err:
-                    self.log.debug(f'Failed to reset SSH connection for {spec.hostname}: {reset_err}')
             raise
+        finally:
+            if is_new_host and self.ssh_user and self.ssh_user != 'root':
+                self.log.debug('Cleaning up %s ', spec.hostname)
+                self._cleanup_add_host_tracking(spec.hostname)
 
     @handle_orch_error
     def add_host(self, spec: HostSpec) -> str:
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 4e60a702802..0f284942398 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1785,7 +1785,7 @@ class CephadmServe:
                 self.log.debug('stdin: %s' % stdin)
 
             # If SSH hardening is enabled, call invoker directly without which python
-            if self.mgr.ssh_hardening and self.mgr.invoker_path:
+            if self.mgr.sudo_hardening and self.mgr.invoker_path:
                 # For invoker, pass all args as a single string
                 cmd = ssh.RemoteCommand(
                     ssh.Executables.INVOKER,
@@ -1803,10 +1803,10 @@ class CephadmServe:
                     host, cmd, stdin=stdin, addr=addr)
                 if code == 2 or code == 127:
                     # Use invoker to check file existence when SSH hardening is enabled
-                    if self.mgr.ssh_hardening and self.mgr.invoker_path:
+                    if self.mgr.sudo_hardening and self.mgr.invoker_path:
                         check_cmd = ssh.RemoteCommand(
                             ssh.Executables.INVOKER,
-                            ['check_existence', self.mgr.cephadm_binary_path]
+                            ['check_binary', self.mgr.cephadm_binary_path]
                         )
                     else:
                         check_cmd = ssh.RemoteCommand(
@@ -1834,7 +1834,7 @@ class CephadmServe:
         elif self.mgr.mode == 'cephadm-package':
             try:
                 # Wrap with invoker if SSH hardening is enabled
-                if self.mgr.ssh_hardening and self.mgr.invoker_path:
+                if self.mgr.sudo_hardening and self.mgr.invoker_path:
                     cmd = ssh.RemoteCommand(
                         ssh.Executables.INVOKER,
                         ['run', str(CEPHADM_EXE), '--'] + final_args
@@ -1912,7 +1912,7 @@ class CephadmServe:
     async def _deploy_cephadm_binary(self, host: str, addr: Optional[str] = None) -> None:
         # Use tee (from coreutils) to create a copy of cephadm on the target machine
         self.log.info(f"Deploying cephadm binary to {host}")
-        if self.mgr.ssh_hardening and self.mgr.invoker_path:
+        if self.mgr.sudo_hardening and self.mgr.invoker_path:
             # Use invoker for secure deployment when SSH hardening is enabled
             await self.mgr.ssh._deploy_cephadm_binary_via_invoker(
                 host, self.mgr.cephadm_binary_path, self.mgr._cephadm, addr=addr)
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index 53c0b2209df..f1e842d811e 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -264,14 +264,16 @@ class SSHManager:
         with self.mgr.async_timeout_handler(host, f'ssh {host} (addr {addr})'):
             return self.mgr.wait_async(self._remote_connection(host, addr))
 
-    def _enforce_ssh_hardening(self,
-                               host: str,
-                               cmd_components: RemoteCommand) -> None:
+    def _enforce_sudo_hardening(
+        self,
+        host: str,
+        cmd_components: RemoteCommand
+    ) -> None:
         """
         Enforce that commands are wrapped with invoker when SSH hardening
         is enabled.
         """
-        if not self.mgr.ssh_hardening:
+        if not self.mgr.sudo_hardening:
             return
 
         is_wrapped = (
@@ -302,7 +304,7 @@ class SSHManager:
             logger.debug(f'Host {host} is being added, using root user without sudo')
 
         # Enforce invoker usage if SSH hardening is enabled
-        self._enforce_ssh_hardening(host, cmd_components)
+        self._enforce_sudo_hardening(host, cmd_components)
 
         rcmd = RemoteSudoCommand.wrap(cmd_components, use_sudo=use_sudo)
         try:
@@ -586,7 +588,7 @@ class SSHManager:
 
             invoker_cmd = RemoteCommand(
                 Executables.INVOKER,
-                ['deploy_cephadm_binary', remote_tmp_path, cephadm_path]
+                ['deploy_binary', remote_tmp_path, cephadm_path]
             )
             await self._execute_command(host, invoker_cmd, addr=addr)
 
diff --git a/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py b/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py
new file mode 100644
index 00000000000..07bfd4befb4
--- /dev/null
+++ b/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+"""Tests for SSH hardening functionality in cephadm."""
+
+import pytest
+from unittest import mock
+try:
+    from unittest.mock import AsyncMock
+except ImportError:
+    from asyncmock import AsyncMock
+
+from orchestrator import OrchestratorError
+from cephadm.ssh import SSHManager, RemoteCommand, Executables
+from cephadm.tests.fixtures import with_host
+
+
+class TestSudoHardening:
+    """Test SSH hardening functionality."""
+
+    @pytest.fixture
+    def setup_sudo_hardening(self, cephadm_module):
+        """Common setup for SSH hardening tests."""
+        cephadm_module.sudo_hardening = True
+        cephadm_module.ssh_user = 'cephadm'
+        cephadm_module.cephadm_binary_path = '/var/lib/ceph/fsid/cephadm.abc123'
+        cephadm_module.invoker_path = '/usr/libexec/cephadm_invoker.py'
+        return cephadm_module
+
+    @pytest.fixture
+    def mock_connection(self):
+        """Create a mock SSH connection."""
+        mock_conn = AsyncMock()
+        mock_conn.run.return_value = mock.Mock(
+            stdout='', stderr='', returncode=0
+        )
+        return mock_conn
+
+    @pytest.mark.parametrize('command', [
+        lambda: RemoteCommand(RemoteCommand('python3'),
+                              ['/var/lib/ceph/fsid/cephadm.abc123',
+                               'check-host', '--expect-hostname', 'test-host']),
+        lambda: RemoteCommand(Executables.LS, ['-la', '/tmp']),
+        lambda: RemoteCommand(RemoteCommand('/var/lib/ceph/fsid/cephadm.abc123'),
+                              ['version']),
+    ])
+    def test_unwrapped_command_errors(self, setup_sudo_hardening,
+                                      mock_connection, command):
+        """Test that unwrapped commands error out when SSH hardening
+        is enabled."""
+        ssh_manager = SSHManager(setup_sudo_hardening)
+
+        with mock.patch.object(ssh_manager, '_remote_connection',
+                               return_value=mock_connection):
+            cmd = command()
+            with pytest.raises(OrchestratorError,
+                               match='command is not wrapped with invoker'):
+                setup_sudo_hardening.wait_async(
+                    ssh_manager._execute_command('test-host', cmd)
+                )
+
+    def test_sudo_hardening_disabled_no_wrapping(
+        self,
+        cephadm_module,
+        mock_connection
+    ):
+        """Test that commands are not wrapped when SSH hardening
+        is disabled."""
+        cephadm_module.sudo_hardening = False
+        cephadm_module.ssh_user = 'cephadm'
+        cephadm_module.cephadm_binary_path = '/var/lib/ceph/fsid/cephadm.abc123'
+        ssh_manager = SSHManager(cephadm_module)
+
+        with mock.patch.object(ssh_manager, '_remote_connection',
+                               return_value=mock_connection):
+            cmd = RemoteCommand(Executables.LS, ['-la', '/tmp'])
+            cephadm_module.wait_async(
+                ssh_manager._execute_command('test-host', cmd)
+            )
+
+            mock_connection.run.assert_called_once()
+            called_args = mock_connection.run.call_args[0][0]
+            assert called_args == 'sudo ls -la /tmp'
+
+    def test_wrapped_command_succeeds(self, setup_sudo_hardening,
+                                      mock_connection):
+        """Test that wrapped commands succeed when SSH hardening
+        is enabled."""
+        ssh_manager = SSHManager(setup_sudo_hardening)
+
+        with mock.patch.object(ssh_manager, '_remote_connection',
+                               return_value=mock_connection):
+            cmd = RemoteCommand(
+                Executables.INVOKER,
+                ['run', '/var/lib/ceph/fsid/cephadm.abc123', '--help']
+            )
+            setup_sudo_hardening.wait_async(
+                ssh_manager._execute_command('test-host', cmd)
+            )
+
+            mock_connection.run.assert_called()
+            called_args = mock_connection.run.call_args[0][0]
+            assert called_args == ('sudo /usr/libexec/cephadm_invoker.py '
+                                   'run /var/lib/ceph/fsid/cephadm.abc123 --help')
+
+    def test_check_host_with_sudo_hardening_integration(
+            self, setup_sudo_hardening, mock_connection):
+        """Integration test for check_host with SSH hardening enabled."""
+        with mock.patch.object(setup_sudo_hardening,
+                               '_prepare_new_host_for_sudo_hardening'):
+            with mock.patch.object(setup_sudo_hardening.ssh, '_remote_connection',
+                                   return_value=mock_connection):
+                with with_host(setup_sudo_hardening, 'test-host'):
+                    code, _, err = setup_sudo_hardening.check_host('test-host')
+                    assert code == 0
+                    assert err == ''
+
+                    called_args = mock_connection.run.call_args[0][0]
+                    assert '/usr/libexec/cephadm_invoker.py' in called_args
+                    assert 'sudo' in called_args
+                    assert 'run' in called_args
+                    assert 'check-host' in called_args
+                    assert '--expect-hostname test-host' in called_args
+
+    def test_check_host_without_sudo_hardening(
+        self,
+        cephadm_module,
+        mock_connection
+    ):
+        """Integration test for check_host with SSH hardening disabled."""
+        cephadm_module.sudo_hardening = False
+        cephadm_module.ssh_user = 'root'
+        cephadm_module.cephadm_binary_path = '/var/lib/ceph/fsid/cephadm.abc123'
+
+        with mock.patch.object(cephadm_module.ssh, '_remote_connection',
+                               return_value=mock_connection):
+            with with_host(cephadm_module, 'test-host'):
+                code, _, err = cephadm_module.check_host('test-host')
+                assert code == 0
+                assert err == ''
+
+                called_args = mock_connection.run.call_args[0][0]
+                assert '/usr/libexec/cephadm_invoker.py' not in called_args
+                assert 'sudo' not in called_args
+                assert 'check-host' in called_args
+                assert '--expect-hostname test-host' in called_args
+
+    def test_execute_cephadm_exec_with_hardening(self, setup_sudo_hardening):
+        """Test cephadm exec with SSH hardening enabled."""
+        ssh_manager = SSHManager(setup_sudo_hardening)
+        mock_conn = AsyncMock()
+        mock_conn.run.return_value = mock.Mock(
+            stdout='success', stderr='', returncode=0
+        )
+
+        with mock.patch.object(setup_sudo_hardening.ssh, '_remote_connection',
+                               return_value=mock_conn):
+            cmd = RemoteCommand(Executables.LS, ['-la', '/tmp'])
+            out, err, code = ssh_manager.execute_cephadm_exec('test-host', cmd)
+
+            called_args = mock_conn.run.call_args[0][0]
+            assert called_args.startswith('sudo /usr/libexec/cephadm_invoker.py')
+            assert setup_sudo_hardening.cephadm_binary_path in called_args
+            assert 'exec' in called_args and '--command' in called_args
+            assert (out, err, code) == ('success', '', 0)
+
+    def test_execute_cephadm_exec_without_hardening(self, cephadm_module):
+        """Test cephadm exec with SSH hardening disabled."""
+        cephadm_module.sudo_hardening = False
+        cephadm_module.ssh_user = 'cephadm'
+        cephadm_module.cephadm_binary_path = '/var/lib/ceph/fsid/cephadm.abc123'
+        ssh_manager = SSHManager(cephadm_module)
+
+        mock_conn = AsyncMock()
+        mock_conn.run.return_value = mock.Mock(
+            stdout='success', stderr='', returncode=0
+        )
+
+        with mock.patch.object(cephadm_module.ssh, '_remote_connection',
+                               return_value=mock_conn):
+            cmd = RemoteCommand(Executables.LS, ['-la', '/tmp'])
+            out, err, code = ssh_manager.execute_cephadm_exec('test-host', cmd)
+
+            called_args = mock_conn.run.call_args[0][0]
+            # When hardening is disabled, cephadm exec should use cephadm binary directly (not invoker)
+            assert cephadm_module.cephadm_binary_path in called_args
+            assert '/usr/libexec/cephadm_invoker.py' not in called_args
+            assert 'exec' in called_args and '--command' in called_args
+            assert (out, err, code) == ('success', '', 0)

From 3635d7750734421ecc80d5a563e026433fb4bbc1 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 9 Jan 2026 19:43:16 +0530
Subject: [PATCH 160/596] cephadm: Add cephadm_invoker.py in cephadm rpm at
 /usr/libexec/cephadm_invoker.py

Fixes:https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 ceph.spec.in               | 1 +
 src/cephadm/CMakeLists.txt | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/ceph.spec.in b/ceph.spec.in
index 0ec85c99755..5d5e2067a74 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -2139,6 +2139,7 @@ exit 0
 
 %files -n cephadm
 %{_sbindir}/cephadm
+%attr(0700,root,root) %{_libexecdir}/cephadm_invoker.py
 %{_mandir}/man8/cephadm.8*
 %attr(0700,cephadm,cephadm) %dir %{_sharedstatedir}/cephadm
 %attr(0700,cephadm,cephadm) %dir %{_sharedstatedir}/cephadm/.ssh
diff --git a/src/cephadm/CMakeLists.txt b/src/cephadm/CMakeLists.txt
index c8b7c74a985..fcdc886be78 100644
--- a/src/cephadm/CMakeLists.txt
+++ b/src/cephadm/CMakeLists.txt
@@ -14,6 +14,7 @@ add_custom_command(
   DEPENDS
     ${CMAKE_CURRENT_SOURCE_DIR}/cephadm.py
     ${CMAKE_CURRENT_SOURCE_DIR}/build.py
+    ${CMAKE_CURRENT_SOURCE_DIR}/cephadm_invoker.py
   WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
   COMMAND ${Python3_EXECUTABLE} build.py
     --set-version-var=CEPH_GIT_VER=${CEPH_GIT_VER}
@@ -31,3 +32,7 @@ add_custom_target(cephadm ALL
 install(PROGRAMS
   ${bin_target_file}
   DESTINATION ${CMAKE_INSTALL_SBINDIR})
+
+install(PROGRAMS
+  ${CMAKE_CURRENT_SOURCE_DIR}/cephadm_invoker.py
+  DESTINATION ${CMAKE_INSTALL_LIBEXECDIR})

From 0ecd33ca590252cb3aeffaedc43ff2ee56a15172 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 16 Jan 2026 13:19:06 +0530
Subject: [PATCH 161/596] doc: Documentation for ssh hardening

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/cephadm/host-management.rst     | 120 ++++++++++++++++++++++++++--
 doc/dev/cephadm/cephadm-invoker.rst |  58 ++++++++++++++
 doc/dev/cephadm/index.rst           |   1 +
 doc/man/8/cephadm.rst               |  63 ++++++++++++++-
 4 files changed, 235 insertions(+), 7 deletions(-)
 create mode 100644 doc/dev/cephadm/cephadm-invoker.rst

diff --git a/doc/cephadm/host-management.rst b/doc/cephadm/host-management.rst
index 3f15fb8fce8..7167ae31570 100644
--- a/doc/cephadm/host-management.rst
+++ b/doc/cephadm/host-management.rst
@@ -551,8 +551,29 @@ cephadm operations. Run a command of the following form:
 
    ceph cephadm set-user <user>
 
-Prior to running this, the cluster SSH key needs to be added to this user's
-``authorized_keys`` file and non-root users must have passwordless sudo access.
+The ``set-user`` command automatically configures the specified user on all cluster
+hosts by calling ``cephadm setup-ssh-user`` on each host. This command is available starting
+with the Umbrella release and includes the following:
+
+- Setting up passwordless sudo access for non-root users
+- Authorizing the cluster's SSH public key for the user
+
+If you have already manually configured the user on all hosts, you can skip
+the automatic setup by using the ``--skip-pre-steps`` flag:
+
+.. prompt:: bash #
+
+   ceph cephadm set-user <user> --skip-pre-steps
+
+For manual setup of SSH users on individual hosts, you can use the
+``cephadm setup-ssh-user`` command directly:
+
+.. prompt:: bash #
+
+   cephadm setup-ssh-user --ssh-user <user> --ssh-pub-key <public_key>
+
+This command validates that the user exists, configures passwordless sudo access,
+and authorizes the SSH public key.
 
 
 Customizing the SSH Configuration
@@ -668,6 +689,95 @@ when executing ``ceph * metadata``. This in turn means cephadm also
 requires the bare host name when adding a host to the cluster:
 ``ceph orch host add <bare-name>``.
 
-..
-  TODO: This chapter needs to provide way for users to configure
-  Grafana in the dashboard, as this is right now very hard to do.
+Sudo Hardening
+=============
+
+Cephadm supports sudo hardening to enhance security by restricting sudo privilege
+escalation for non-root SSH users. When sudo hardening is enabled, cephadm uses the
+``cephadm_invoker.py`` script to securely execute cephadm commands with controlled
+privilege escalation.
+
+Enabling Sudo Hardening
+----------------------
+
+To enable sudo hardening for the entire cluster, use the following command:
+
+.. prompt:: bash #
+
+  ceph cephadm prepare-host-and-enable-sudo-hardening <user>
+
+This command performs a comprehensive sudo hardening setup:
+
+1. **Host Preparation**: Prepares all cluster hosts for sudo hardening by:
+   - Installing/upgrading cephadm RPM with the invoker script
+   - Configuring restricted sudo access for non-root users
+   - Setting up SSH key authorization
+
+2. **SSH User Configuration**: Sets the specified user for cluster SSH operations
+
+3. **Global Enablement**: Enables sudo hardening cluster-wide
+
+The ``<user>`` parameter specifies which non-root user should be configured for SSH access.
+This user will have restricted sudo access configured through the sudoers file.
+
+You can manually prepare a host for sudo hardening using:
+
+.. prompt:: bash #
+
+  cephadm prepare-host-sudo-hardening --ssh-user <user> --ssh-pub-key <pub_key>
+
+.. note:: During initial host addition, the root user is used for setup. After
+   Sudo hardening is enabled, the specified non-root user with restricted sudo
+   access will be used for ongoing operations.
+
+Sudo Hardening Workflow
+----------------------
+
+When sudo hardening is enabled, the following workflow is used:
+
+1. **Host Addition**: Before adding a new host with ``ceph orch host add``,
+   the cluster SSH key needs to be added to this user's ``authorized_keys``
+   file and non-root users must have passwordless sudo access.
+2. **Command Execution**: Instead of executing cephadm directly, commands are
+   routed through ``cephadm_invoker.py``
+3. **Binary Verification**: The invoker validates the cephadm binary's hash before execution
+4. **Secure Execution**: Commands are executed with restricted permissions
+
+The ``cephadm_invoker.py`` script provides the following subcommands:
+
+- ``run``: Execute cephadm binary with hash verification
+- ``deploy_cephadm_binary``: Deploy cephadm binary to final location
+- ``check_existence``: Check if a file exists
+
+Sudo Access Restrictions
+-------------------------
+
+Sudo hardening restricts sudo access for non-root users to enhance security. When a
+host is prepared for sudo hardening, the sudoers configuration is modified to limit
+the commands that can be executed with sudo. This prevents unauthorized command
+execution while still allowing necessary cephadm operations.
+
+The sudoers configuration restricts access to only the ``cephadm_invoker.py`` script
+and essential system commands, providing a secure execution environment.
+
+Security Benefits
+-----------------
+Sudo hardening provides the following security benefits:
+
+1. The invoker validates the cephadm binary's hash
+2. If validation fails, it signals for binary redeployment
+3. Commands are executed with restricted sudo permissions
+4. All operations are logged for security auditing
+
+
+Disabling Sudo Hardening
+-----------------------
+
+To disable sudo hardening:
+
+.. prompt:: bash #
+
+  ceph config set mgr mgr/cephadm/sudo_hardening false
+
+.. note:: Disabling sudo hardening does not automatically revert host configurations.
+   Hosts that were prepared for sudo hardening will retain the invoker setup.
diff --git a/doc/dev/cephadm/cephadm-invoker.rst b/doc/dev/cephadm/cephadm-invoker.rst
new file mode 100644
index 00000000000..930b2af85d6
--- /dev/null
+++ b/doc/dev/cephadm/cephadm-invoker.rst
@@ -0,0 +1,58 @@
+Cephadm Invoker
+===============
+
+The ``cephadm_invoker.py`` script provides a wrapper intended for executing
+cephadm commands with limited sudo priviliges. It is used when sudo hardening
+is enabled.
+
+Overview
+--------
+
+The cephadm invoker validates the cephadm binary hash before execution and
+provides a secure way to run cephadm commands and deploy binaries. It is installed as
+part of the cephadm RPM at ``/usr/libexec/cephadm_invoker.py``.
+
+Commands
+--------
+
+The invoker supports the following subcommands:
+
+``run``
+
+Execute cephadm binary with arguments after hash verification::
+
+    cephadm_invoker.py run <binary> [args...]
+
+The binary path must include a hash in the filename for verification.
+
+``deploy_binary``
+
+Deploy cephadm binary from a temporary file to the final location::
+
+    cephadm_invoker.py deploy_binary <temp_file> <final_path>
+
+``check_binary``
+
+Check if a cephadm binary exists::
+
+    cephadm_invoker.py check_binary <cephadm_binary_path>
+
+Returns exit code 0 if the file exists, 2 if it does not exist.
+
+Exit Codes
+----------
+
+- ``0``: Success
+- ``1``: General error (file not found, permission issues, etc.)
+- ``2``: Binary hash mismatch or file doesn't exist (triggers redeployment)
+- ``126``: Permission denied during execution
+
+Security Features
+-----------------
+
+The cephadm invoker provides the following security features:
+
+- **Binary Hash Verification**: Validates the cephadm binary integrity before execution
+- **Restricted Execution**: Only allows execution of verified cephadm binaries
+- **Secure Deployment**: Safely deploys cephadm binaries with proper permissions
+- **Logging**: Comprehensive logging to both console and syslog for audit trails
diff --git a/doc/dev/cephadm/index.rst b/doc/dev/cephadm/index.rst
index f89e7ed262c..330eeefb059 100644
--- a/doc/dev/cephadm/index.rst
+++ b/doc/dev/cephadm/index.rst
@@ -11,5 +11,6 @@ CEPHADM Developer Documentation
    developing-cephadm
    host-maintenance
    compliance-check
+   cephadm-invoker
    Storage devices and OSDs management <./design/storage_devices_and_osds>
    scalability-notes
diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index ea7ea2651a5..ff2ee2d7695 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,8 +13,8 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,add-repo,rm-repo,install,list-images,update-osd-service}
-|             ...
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service,exec}
+|               ...
 
 
 | **cephadm** **pull**
@@ -420,6 +420,65 @@ Arguments:
 * [--expect-hostname EXPECT_HOSTNAME] Set hostname
 
 
+exec
+----
+
+Execute a shell command on a cluster host::
+
+    cephadm exec -- ls -la
+
+Positional arguments:
+
+* [command]               command to execute
+
+Arguments:
+
+* [--timeout TIMEOUT]     timeout in seconds (default: None)
+
+
+prepare-host-sudo-hardening
+--------------------------
+
+Prepare a host for sudo hardening by authorizing SSH keys, installing/upgrading
+the cephadm package, and setting up restricted sudoers permissions::
+
+    cephadm prepare-host-sudo-hardening --ssh-user cephadm --ssh-pub-key <key>
+
+This command performs the following steps:
+
+1. Authorizes the provided SSH public key for the specified user
+2. Installs or upgrades the cephadm package to match the cluster version (includes cephadm_invoker.py)
+3. Sets up sudoers with restricted permissions for cephadm_invoker.py
+
+Arguments:
+
+* [--ssh-user SSH_USER]       SSH user for key authorization (default: root)
+* [--ssh-pub-key SSH_PUB_KEY] SSH public key to authorize
+* [--cephadm-version VERSION] Specific cephadm version to install
+
+
+setup-ssh-user
+--------------
+
+Setup SSH user with passwordless sudo and SSH key authorization::
+
+    cephadm setup-ssh-user --ssh-user cephadm --ssh-pub-key <public_key>
+
+This command configures an SSH user for cephadm operations by:
+
+1. Validating that the user exists on the system
+2. Setting up passwordless sudo for the user (skipped for root)
+3. Authorizing the SSH public key for the user
+
+This command is automatically called by ``ceph cephadm set-user`` to configure
+SSH users across all cluster hosts.
+
+Arguments:
+
+* [--ssh-user SSH_USER]       SSH user to setup (required)
+* [--ssh-pub-key SSH_PUB_KEY] SSH public key to add to user's authorized_keys (required)
+
+
 pull
 ----
 

From 30cb2e354b909d80a4e0d024258b9d155ba84205 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 2 Apr 2026 12:12:47 +0530
Subject: [PATCH 162/596] cephadm: fix bootstrap ordering, configure SSH keys
 before set-user Fixes: https://tracker.ceph.com/issues/74045

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 34e1f1b5ed2..c98805f6c7f 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -2431,8 +2431,7 @@ def prepare_ssh(
     cli: Callable, wait_for_mgr_restart: Callable
 ) -> None:
 
-    cli(['cephadm', 'set-user', ctx.ssh_user])
-
+    # SSH identity must be in the mgr before set-user
     if ctx.ssh_config:
         logger.info('Using provided ssh config...')
         mounts = {
@@ -2467,6 +2466,8 @@ def prepare_ssh(
         logger.info('Wrote public SSH key to %s' % ctx.output_pub_ssh_key)
         authorize_ssh_key(ssh_pub, ctx.ssh_user)
 
+    cli(['cephadm', 'set-user', ctx.ssh_user])
+
     host = get_hostname()
     logger.info('Adding host %s...' % host)
     try:

From 4995a5924758989c3ea47014aa085c01636af288 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Wed, 15 Apr 2026 18:49:52 +0530
Subject: [PATCH 163/596] Revert "mgr/cephadm: Handle cephadm set user
 configuration for add node"

This reverts commit 46bcde4f812afb6a822ecb782815c49156674ea9.
Fixes: https://tracker.ceph.com/issues/74045

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/module.py | 140 ++++++++++---------------------
 src/pybind/mgr/cephadm/ssh.py    |   9 +-
 2 files changed, 45 insertions(+), 104 deletions(-)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index cb8c47a2b6d..c81ee9b9c3f 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -541,10 +541,6 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
         self.event = Event()
         self.ssh = ssh.SSHManager(self)
 
-        # Track hosts being added - these hosts will use root user temporarily
-        # even if cluster is configured to use non-root user
-        self.hosts_being_added: Set[str] = set()
-
         if self.get_store('pause'):
             self.paused = True
         else:
@@ -2134,18 +2130,6 @@ Then run the following:
             self.log.debug(f'Could not determine cluster version: {e}')
         return None
 
-    def _cleanup_add_host_tracking(self, hostname: str) -> None:
-        """Clean up host from tracking sets and reset SSH connection."""
-        try:
-            self.hosts_being_added.discard(hostname)
-        except Exception as e:
-            self.log.debug(f'Failed to remove {hostname} from hosts_being_added: {e}')
-
-        try:
-            self.ssh.reset_con(hostname)
-        except Exception as e:
-            self.log.debug(f'Failed to reset SSH connection for {hostname}: {e}')
-
     def _prepare_new_host_for_sudo_hardening(self, hostname: str, addr: str) -> None:
         """
         Prepare a new host for sudo hardening before adding to inventory.
@@ -2176,21 +2160,6 @@ Then run the following:
             )
         self.log.info('Successfully prepared host %s for sudo hardening', hostname)
 
-    def _setup_user_on_new_host(self, hostname: str, addr: Optional[str]) -> None:
-        """
-        user setup for new hosts (when sudo hardening is disabled).
-        """
-        try:
-            assert self.ssh_pub
-            assert self.ssh_user
-            self._setup_user_on_host(hostname, self.ssh_user, self.ssh_pub, addr=addr)
-        except OrchestratorError as oe:
-            self.log.exception('Failed to setup user %s on %s: %s', self.ssh_user, hostname, oe)
-            self.log.warning('Please manually setup user %s on %s', hostname, self.ssh_user, hostname)
-        except Exception as e:
-            self.log.exception('Unexpected error setting up user %s on %s: %s', self.ssh_user, hostname, e)
-            self.log.warning('You may need to manually setup user %s on %s', self.ssh_user, hostname)
-
     def _add_host(self, spec):
         # type: (HostSpec) -> str
         """
@@ -2199,74 +2168,53 @@ Then run the following:
         :param host: host name
         """
         HostSpec.validate(spec)
+        ip_addr = self._check_valid_addr(spec.hostname, spec.addr)
+        if spec.addr == spec.hostname and ip_addr:
+            spec.addr = ip_addr
 
-        # Check if this is a new host BEFORE any SSH operations
-        is_new_host = spec.hostname not in self.inventory
-        if is_new_host and self.ssh_user and self.ssh_user != 'root':
+        if spec.hostname in self.inventory and self.inventory.get_addr(spec.hostname) != spec.addr:
+            self.cache.refresh_all_host_info(spec.hostname)
+
+        if spec.oob:
+            if not spec.oob.get('addr'):
+                spec.oob['addr'] = self.oob_default_addr
+            if not spec.oob.get('port'):
+                spec.oob['port'] = '443'
+            host_oob_info = dict()
+            host_oob_info['addr'] = spec.oob['addr']
+            host_oob_info['port'] = spec.oob['port']
+            host_oob_info['username'] = spec.oob['username']
+            host_oob_info['password'] = spec.oob['password']
+            self.node_proxy_cache.update_oob(spec.hostname, host_oob_info)
+
+        # prime crush map?
+        if spec.location:
+            self.check_mon_command({
+                'prefix': 'osd crush add-bucket',
+                'name': spec.hostname,
+                'type': 'host',
+                'args': [f'{k}={v}' for k, v in spec.location.items()],
+            })
+
+        if spec.hostname not in self.inventory:
+            self.cache.prime_empty_host(spec.hostname)
+        self.inventory.add_host(spec)
+        self.offline_hosts_remove(spec.hostname)
+        if spec.status == 'maintenance':
+            self.update_maintenance_healthcheck()
+        self.event.set()  # refresh stray health check
+        self.log.info('Added host %s' % spec.hostname)
+
+        if self.sudo_hardening and self.ssh_user and self.ssh_user != 'root':
             try:
-                self.hosts_being_added.add(spec.hostname)
-                self.log.info('Adding new host %s, will use root user temporarily for setup', spec.hostname)
+                self._prepare_new_host_for_sudo_hardening(spec.hostname, spec.addr)
             except Exception as e:
-                self.log.warning('Failed to add %s to hosts_being_added tracking: %s', spec.hostname, e)
-
-        try:
-            ip_addr = self._check_valid_addr(spec.hostname, spec.addr)
-            if spec.addr == spec.hostname and ip_addr:
-                spec.addr = ip_addr
-            if spec.hostname in self.inventory and self.inventory.get_addr(spec.hostname) != spec.addr:
-                self.cache.refresh_all_host_info(spec.hostname)
-
-            if spec.oob:
-                if not spec.oob.get('addr'):
-                    spec.oob['addr'] = self.oob_default_addr
-                if not spec.oob.get('port'):
-                    spec.oob['port'] = '443'
-                host_oob_info = dict()
-                host_oob_info['addr'] = spec.oob['addr']
-                host_oob_info['port'] = spec.oob['port']
-                host_oob_info['username'] = spec.oob['username']
-                host_oob_info['password'] = spec.oob['password']
-                self.node_proxy_cache.update_oob(spec.hostname, host_oob_info)
-
-            # prime crush map?
-            if spec.location:
-                self.check_mon_command({
-                    'prefix': 'osd crush add-bucket',
-                    'name': spec.hostname,
-                    'type': 'host',
-                    'args': [f'{k}={v}' for k, v in spec.location.items()],
-                })
-
-            # BEFORE adding host to inventory, prepare it for sudo hardening if needed
-            if is_new_host and self.sudo_hardening and self.ssh_user and self.ssh_user != 'root':
-                try:
-                    self._prepare_new_host_for_sudo_hardening(spec.hostname, spec.addr)
-                except Exception as e:
-                    self.log.exception('Sudo hardening preparation failed for %s: %s', spec.hostname, e)
-                    raise OrchestratorError(
-                        f'Failed to prepare host {spec.hostname} for sudo hardening. '
-                        f'Host was not added to the cluster. Error: {e}'
-                    )
-            elif is_new_host and self.ssh_user and self.ssh_user != 'root':
-                # Sudo hardening not enabled, just perform set user setup presteps
-                self._setup_user_on_new_host(spec.hostname, spec.addr)
-
-            if spec.hostname not in self.inventory:
-                self.cache.prime_empty_host(spec.hostname)
-            self.inventory.add_host(spec)
-            self.offline_hosts_remove(spec.hostname)
-            if spec.status == 'maintenance':
-                self.update_maintenance_healthcheck()
-            self.event.set()  # refresh stray health check
-            self.log.info('Added host %s' % spec.hostname)
-
-            return "Added host '{}' with addr '{}'".format(spec.hostname, spec.addr)
-        except Exception:
-            raise
-        finally:
-            if is_new_host and self.ssh_user and self.ssh_user != 'root':
-                self.log.debug('Cleaning up %s ', spec.hostname)
-                self._cleanup_add_host_tracking(spec.hostname)
+                self.log.exception('Sudo hardening preparation failed for %s: %s', spec.hostname, e)
+                raise OrchestratorError(
+                    f'Failed to prepare host {spec.hostname} for sudo hardening. '
+                    f'Host was not added to the cluster. Error: {e}'
+                )
+        return "Added host '{}' with addr '{}'".format(spec.hostname, spec.addr)
 
     @handle_orch_error
     def add_host(self, spec: HostSpec) -> str:
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index f1e842d811e..101d488a6ff 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -295,17 +295,10 @@ class SSHManager:
                                log_command: Optional[bool] = True,
                                ) -> Tuple[str, str, int]:
         conn = await self._remote_connection(host, addr)
-
-        # For hosts being added, always use root (no sudo) even if cluster
-        # is configured to use non-root user. This allows initial setup.
-        is_host_being_added = host in self.mgr.hosts_being_added
-        use_sudo = (self.mgr.ssh_user != 'root') and not is_host_being_added
-        if is_host_being_added:
-            logger.debug(f'Host {host} is being added, using root user without sudo')
-
         # Enforce invoker usage if SSH hardening is enabled
         self._enforce_sudo_hardening(host, cmd_components)
 
+        use_sudo = (self.mgr.ssh_user != 'root')
         rcmd = RemoteSudoCommand.wrap(cmd_components, use_sudo=use_sudo)
         try:
             address = addr or self.mgr.inventory.get_addr(host)

From 9b9493345aa5d93179a630d1ccd8be9362c600f2 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 20 Apr 2026 10:07:47 +0530
Subject: [PATCH 164/596] mgr/cephadm: Handled cephadm binary creation with
 different ssh user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since we execute the cephadm binary directly with sudo,
we get exit code 1 with a “command not found” error if the binary does not exist.
Handled it in run_cephadm to generate cephadm binary in this case.

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/serve.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 0f284942398..71ae061cda6 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1801,7 +1801,7 @@ class CephadmServe:
             try:
                 out, err, code = await self.mgr.ssh._execute_command(
                     host, cmd, stdin=stdin, addr=addr)
-                if code == 2 or code == 127:
+                if code == 2 or code == 127 or 'command not found' in err:
                     # Use invoker to check file existence when SSH hardening is enabled
                     if self.mgr.sudo_hardening and self.mgr.invoker_path:
                         check_cmd = ssh.RemoteCommand(

From 23cc154e6a949f60694362df445b0af2689ecc25 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Wed, 6 May 2026 11:30:26 +0530
Subject: [PATCH 165/596] cephadm: Addressed review comments for
 validate_user_exists and command_run of invoker.py Fixes:
 https://tracker.ceph.com/issues/74045

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py               |  6 ++----
 src/cephadm/cephadm_invoker.py       | 16 +++++++-------
 src/cephadm/cephadmlib/user_utils.py | 26 +++++++++-------------
 src/cephadm/tests/test_invoker.py    | 32 ++++++++++------------------
 4 files changed, 31 insertions(+), 49 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index c98805f6c7f..74155f19af1 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4876,10 +4876,8 @@ def command_prepare_host_sudo_hardening(ctx: CephadmContext) -> int:
     cephadm_version = ctx.cephadm_version if hasattr(ctx, 'cephadm_version') else None
 
     has_failures = False
-    try:
-        validate_user_exists(user)
-    except Exception as e:
-        logger.exception('User %s does not exists. err: %s', user, e)
+    if not validate_user_exists(user):
+        logger.error('User %s does not exists on this host.', user)
         return 1
     # Step 1: Authorize SSH public key for the user
     if ssh_pub_key:
diff --git a/src/cephadm/cephadm_invoker.py b/src/cephadm/cephadm_invoker.py
index 73343fed428..5576655add6 100755
--- a/src/cephadm/cephadm_invoker.py
+++ b/src/cephadm/cephadm_invoker.py
@@ -127,7 +127,7 @@ def execute_cephadm(fd: int, args: List[str]) -> None:
         sys.exit(1)
 
 
-def verify_and_execute_cephadm_binary(binary_path: str, cephadm_args: List[str]) -> None:
+def verify_and_execute_cephadm_binary(binary_path: str, cephadm_args: List[str]) -> int:
     """
     verify, and execute cephadm binary with hash validation.
     """
@@ -136,7 +136,7 @@ def verify_and_execute_cephadm_binary(binary_path: str, cephadm_args: List[str])
         expected_hash = extract_hash_from_path(binary_path)
         if not expected_hash:
             logger.error('Could not extract hash from binary path: %s', binary_path)
-            sys.exit(1)
+            return 1
 
         fh = open(binary_path, 'rb')
 
@@ -145,11 +145,11 @@ def verify_and_execute_cephadm_binary(binary_path: str, cephadm_args: List[str])
             # Disable CLOEXEC so the FD stays open across exec
             disable_cloexec(fh)
             execute_cephadm(fh.fileno(), [binary_path] + cephadm_args)
-            sys.exit(0)
+            return 0
 
         if actual_hash is None:
             logger.error('Failed to read or hash binary at: %s', binary_path)
-            sys.exit(2)
+            return 2
         else:
             # Hash mismatch - backup the corrupted binary
             logger.error('Binary hash mismatch at: %s', binary_path)
@@ -165,11 +165,11 @@ def verify_and_execute_cephadm_binary(binary_path: str, cephadm_args: List[str])
                 logger.error('Could not backup corrupted binary: %s', e)
 
             logger.info('Returning exit code 2 to trigger binary redeployment')
-            sys.exit(2)
+            return 2
 
     except (IOError, OSError) as e:
         logger.error('Error opening cephadm binary at %s: %s', binary_path, e)
-        sys.exit(2)
+        return 2
     finally:
         if fh is not None:
             try:
@@ -182,8 +182,8 @@ def command_run(args: argparse.Namespace) -> int:
     """
     Run cephadm binary with arguments after hash verification.
     """
-    verify_and_execute_cephadm_binary(args.binary, args.args)
-    return 0
+    ret = verify_and_execute_cephadm_binary(args.binary, args.args)
+    return ret
 
 
 def command_deploy_binary(args: argparse.Namespace) -> int:
diff --git a/src/cephadm/cephadmlib/user_utils.py b/src/cephadm/cephadmlib/user_utils.py
index 238d55ceca4..884c7242da8 100644
--- a/src/cephadm/cephadmlib/user_utils.py
+++ b/src/cephadm/cephadmlib/user_utils.py
@@ -16,23 +16,13 @@ from .packagers import create_packager
 logger = logging.getLogger()
 
 
-def validate_user_exists(username: str) -> Tuple[int, int, str]:
-    """Validate that a user exists and return their uid, gid, and home directory.
-    Args:
-        username: The username to validate
-    Returns:
-        Tuple of (uid, gid, home_directory)
-    Raises:
-        Error: If the user does not exist
-    """
+def validate_user_exists(username: str) -> bool:
+    """Validate that a user exists"""
     try:
-        pwd_entry = pwd.getpwnam(username)
-        return pwd_entry.pw_uid, pwd_entry.pw_gid, pwd_entry.pw_dir
+        pwd.getpwnam(username)
+        return True
     except KeyError:
-        raise Error(
-            f'User {username} does not exist on this host. '
-            f'Please create the user first: useradd -m -s /bin/bash {username}'
-        )
+        return False
 
 
 def setup_sudoers(
@@ -103,7 +93,11 @@ def setup_ssh_user(
     logger.info('Setting up SSH user %s on this host', username)
 
     # Validate user exists (will raise Error if not)
-    validate_user_exists(username)
+    if not validate_user_exists(username):
+        raise Error(
+            f'User {username} does not exist on this host. '
+            f'Please create the user first: useradd -m -s /bin/bash {username}'
+        )
 
     # Setup sudoers (skip for root user)
     if username != 'root':
diff --git a/src/cephadm/tests/test_invoker.py b/src/cephadm/tests/test_invoker.py
index fe5fb5bb945..1e74366a375 100644
--- a/src/cephadm/tests/test_invoker.py
+++ b/src/cephadm/tests/test_invoker.py
@@ -1,10 +1,6 @@
 # Tests for cephadm_invoker.py - secure wrapper for executing cephadm commands
 #
 import hashlib
-import io
-import os
-import sys
-import tempfile
 from pathlib import Path
 from unittest import mock
 import pytest
@@ -25,9 +21,7 @@ class TestInvoker:
         monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'run', str(test_file), 'ls'])
 
         with mock.patch('os.execve') as mock_execve:
-            with pytest.raises(SystemExit) as exc_info:
-                invoker.main()
-            assert exc_info.value.code == 0
+            assert invoker.main() == 0
             mock_execve.assert_called_once()
 
     def test_run_command_hash_mismatch(self, monkeypatch, tmp_path):
@@ -36,21 +30,17 @@ class TestInvoker:
         wrong_hash = 'wronghash123'
         test_file = tmp_path / f'cephadm.{wrong_hash}'
         test_file.write_bytes(content)
-        
+
         monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'run', str(test_file), 'ls'])
-        
-        with pytest.raises(SystemExit) as exc_info:
-            invoker.main()
-        assert exc_info.value.code == 2
+
+        assert invoker.main() == 2
 
     def test_run_command_nonexistent(self, monkeypatch, tmp_path):
         """Test 'run' command with nonexistent binary."""
         nonexistent = tmp_path / 'nonexistent'
         monkeypatch.setattr('sys.argv', ['cephadm_invoker.py', 'run', str(nonexistent), 'ls'])
-        
-        with pytest.raises(SystemExit) as exc_info:
-            invoker.main()
-        assert exc_info.value.code == 1
+
+        assert invoker.main() == 1
 
     def test_deploy_command_success(self, monkeypatch, tmp_path):
         """Test 'deploy_binary' command."""
@@ -73,14 +63,14 @@ class TestInvoker:
         """Test 'deploy_binary' with nonexistent temp file."""
         temp_file = tmp_path / 'nonexistent'
         final_path = tmp_path / 'cephadm'
-        
+
         monkeypatch.setattr('sys.argv', [
             'cephadm_invoker.py',
             'deploy_binary',
             str(temp_file),
             str(final_path)
         ])
-        
+
         result = invoker.main()
         assert result == 1
 
@@ -88,13 +78,13 @@ class TestInvoker:
         """Test 'check_binary' command when file exists."""
         test_file = tmp_path / 'test_file'
         test_file.write_text('content')
-        
+
         monkeypatch.setattr('sys.argv', [
-            'cephadm_invoker.py', 
+            'cephadm_invoker.py',
             'check_binary',
             str(test_file)
         ])
-        
+
         result = invoker.main()
         assert result == 0
 

From 03aa50ef236fe4819fba05d56753a3c02b45e844 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 8 May 2026 13:11:44 +0530
Subject: [PATCH 166/596] cephadm: Removed 'cephadm exec' command

Fixes: https://tracker.ceph.com/issues/74045

Revert "mgr/cephadm: Use 'cephadm exec' to execute bash commands, just commands requires to deploy cephadm binary and which command should be executed directly"
This reverts commit 3a7000aa5010a8a4ad862b321aa32f36a49ac283.

Revert "cephadm: added cephadm exec command to execute shell commands"
This reverts commit 53d87b0697b5a6bd08caa03d0d795880ba4b742b.

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/man/8/cephadm.rst                         | 18 +---
 src/cephadm/cephadm.py                        | 46 ----------
 src/cephadm/tests/test_cephadm.py             | 57 ------------
 src/pybind/mgr/cephadm/offline_watcher.py     |  2 +-
 src/pybind/mgr/cephadm/serve.py               | 42 +--------
 src/pybind/mgr/cephadm/ssh.py                 | 89 +++----------------
 src/pybind/mgr/cephadm/tests/test_cephadm.py  |  8 +-
 .../mgr/cephadm/tests/test_ssh_hardening.py   | 43 ---------
 .../mgr/cephadm/tests/test_tuned_profiles.py  | 44 +++------
 src/pybind/mgr/cephadm/tuned_profiles.py      |  8 +-
 10 files changed, 35 insertions(+), 322 deletions(-)

diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index ff2ee2d7695..44d3beafb20 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,7 +13,7 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service,exec}
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
 |               ...
 
 
@@ -420,22 +420,6 @@ Arguments:
 * [--expect-hostname EXPECT_HOSTNAME] Set hostname
 
 
-exec
-----
-
-Execute a shell command on a cluster host::
-
-    cephadm exec -- ls -la
-
-Positional arguments:
-
-* [command]               command to execute
-
-Arguments:
-
-* [--timeout TIMEOUT]     timeout in seconds (default: None)
-
-
 prepare-host-sudo-hardening
 --------------------------
 
diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 74155f19af1..ba246ab7c40 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -74,7 +74,6 @@ from cephadmlib.context_getters import (
 from cephadmlib.exceptions import (
     ClusterAlreadyExists,
     Error,
-    TimeoutExpired,
     UnauthorizedRegistryError,
     DaemonStartException,
 )
@@ -3572,41 +3571,6 @@ def command_logs(ctx: CephadmContext) -> None:
 ##################################
 
 
-def command_exec(ctx: CephadmContext) -> int:
-    """
-    Execute a shell command on the host
-    Return Codes:
-        - `0`: Command executed successfully
-        - `124`: Command timed out
-        - `1`: Error during execution
-        - Other: Return code from the executed command
-    """
-    if not ctx.command:
-        raise Error('No command provided to execute')
-    cmd = ctx.command
-    logger.debug('Executing command: %s' % ' '.join(cmd))
-    try:
-        stdout, stderr, returncode = call(
-            ctx,
-            cmd,
-            verbosity=CallVerbosity.SILENT,
-            timeout=ctx.timeout
-        )
-        if stdout:
-            sys.stdout.write(stdout)
-        if stderr:
-            sys.stderr.write(stderr)
-        return returncode
-    except TimeoutExpired:
-        logger.exception('Command timed out after %s seconds' % ctx.timeout)
-        return 124
-    except Exception as e:
-        logger.exception('Error executing command: %s' % str(e))
-        return 1
-
-##################################
-
-
 def command_list_networks(ctx):
     # type: (CephadmContext) -> None
     r = list_networks(ctx)
@@ -5398,16 +5362,6 @@ def _get_parser():
         'command', nargs='*',
         help='additional journalctl args')
 
-    parser_exec = subparsers.add_parser(
-        'exec', help='execute a shell command on the host')
-    parser_exec.set_defaults(func=command_exec)
-    parser_exec.add_argument(
-        '--command', nargs=argparse.REMAINDER,
-        help='command to execute')
-    parser_exec.add_argument(
-        '--fsid',
-        help='cluster FSID')
-
     parser_bootstrap = subparsers.add_parser(
         'bootstrap', help='bootstrap a cluster (mon + mgr daemons)')
     parser_bootstrap.set_defaults(func=command_bootstrap)
diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index ac2bab1f865..7d2402d8b9b 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -3274,60 +3274,3 @@ class TestRmClusterConfigCleanup(fake_filesystem_unittest.TestCase):
 
         assert os.path.exists('/etc/ceph/ceph.conf')
         assert os.path.isdir('/etc/ceph/ceph.conf')
-
-
-class TestExec(object):
-    """Test cases for the 'cephadm exec' command"""
-
-    @mock.patch.object(_cephadm, 'call')
-    @mock.patch('cephadm.logger')
-    def test_exec_non_zero_exit(self, _logger, mock_call):
-        """Test command execution with non-zero exit code"""
-        mock_call.return_value = ('', 'command not found\n', 127)
-
-        cmd = ['exec', '--command', 'nonexistent_command']
-        with with_cephadm_ctx(cmd, mock_cephadm_call_fn=False) as ctx:
-            ctx.command = ['nonexistent_command']
-            ctx.timeout = 300
-            retval = _cephadm.command_exec(ctx)
-            assert retval == 127
-
-    @mock.patch('subprocess.run')
-    @mock.patch('cephadm.logger')
-    def test_exec_empty_command_list(self, _logger, mock_run):
-        """Test command_exec with empty command list"""
-        cmd = ['exec', '--command']
-        with with_cephadm_ctx(cmd) as ctx:
-            ctx.command = []
-            ctx.timeout = 300
-            with pytest.raises(_cephadm.Error, match='No command provided to execute'):
-                _cephadm.command_exec(ctx)
-
-    @mock.patch.object(_cephadm, 'call')
-    @mock.patch('cephadm.logger')
-    @mock.patch('sys.stdout')
-    @mock.patch('sys.stderr')
-    def test_exec_with_stdout_and_stderr(self, mock_stderr, mock_stdout, _logger, mock_call):
-        """Test command execution with both stdout and stderr"""
-        mock_call.return_value = ('Standard output\n', 'Standard error\n', 2)
-
-        cmd = ['exec', '--command', 'test_command']
-        with with_cephadm_ctx(cmd, mock_cephadm_call_fn=False) as ctx:
-            ctx.command = ['test_command']
-            ctx.timeout = 300
-            retval = _cephadm.command_exec(ctx)
-            assert retval == 2
-            mock_stdout.write.assert_called_once_with('Standard output\n')
-            mock_stderr.write.assert_called_once_with('Standard error\n')
-
-    @mock.patch.object(_cephadm, 'call')
-    @mock.patch('cephadm.logger')
-    def test_exec_general_exception(self, _logger, mock_call):
-        """Test command execution with general exception"""
-        mock_call.side_effect = Exception('Unexpected error')
-        cmd = ['exec', '--command', 'test']
-        with with_cephadm_ctx(cmd, mock_cephadm_call_fn=False) as ctx:
-            ctx.command = ['test']
-            ctx.timeout = 300
-            retval = _cephadm.command_exec(ctx)
-            assert retval == 1
diff --git a/src/pybind/mgr/cephadm/offline_watcher.py b/src/pybind/mgr/cephadm/offline_watcher.py
index 37c9e3bee58..4aa07e2f584 100644
--- a/src/pybind/mgr/cephadm/offline_watcher.py
+++ b/src/pybind/mgr/cephadm/offline_watcher.py
@@ -41,7 +41,7 @@ class OfflineHostWatcher(threading.Thread):
         if host not in self.mgr.offline_hosts:
             try:
                 rcmd = ssh.RemoteCommand(ssh.Executables.TRUE)
-                self.mgr.ssh.check_execute_cephadm_exec(host, rcmd, log_command=self.mgr.log_refresh_metadata)
+                self.mgr.ssh.check_execute_command(host, rcmd, log_command=self.mgr.log_refresh_metadata)
             except Exception:
                 logger.debug(f'OfflineHostDetector: detected {host} to be offline')
                 # kick serve loop in case corrective action must be taken for offline host
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 71ae061cda6..e45ec846df2 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1400,7 +1400,7 @@ class CephadmServe:
                 continue
             self.log.info(f'Removing {host}:{path}')
             cmd = ssh.RemoteCommand(ssh.Executables.RM, ['-f', path])
-            self.mgr.ssh.check_execute_cephadm_exec(host, cmd)
+            self.mgr.ssh.check_execute_command(host, cmd)
             updated_files = True
             self.mgr.cache.removed_client_file(host, path)
         if updated_files:
@@ -1918,45 +1918,7 @@ class CephadmServe:
                 host, self.mgr.cephadm_binary_path, self.mgr._cephadm, addr=addr)
         else:
             await self.mgr.ssh._write_remote_file(host, self.mgr.cephadm_binary_path,
-                                                  self.mgr._cephadm, addr=addr, mode=0o744,
-                                                  bypass_cephadm_exec=True)
-
-    async def run_cephadm_exec(self,
-                               host: str,
-                               cmd: List[str],
-                               addr: Optional[str] = None,
-                               stdin: Optional[str] = None,
-                               log_output: Optional[bool] = True,
-                               timeout: Optional[int] = None,
-                               ) -> Tuple[str, str, int]:
-        """
-        Execute a bash command on the remote host via 'cephadm exec --command <bash command>'
-        """
-        self.log.debug(f"run_cephadm_exec: Executing command on {host}: {cmd}")
-
-        exec_args = ['--command'] + cmd
-        try:
-            out, err, code = await self._run_cephadm(
-                host=host,
-                entity=cephadmNoImage,
-                command='exec',
-                args=exec_args,
-                addr=addr,
-                stdin=stdin,
-                no_fsid=True,  # exec doesn't need fsid
-                error_ok=True,  # We'll handle errors at a higher level
-                log_output=log_output,
-                timeout=timeout
-            )
-            stdout = out[0] if out else ''
-            stderr = err[0] if err else ''
-            if log_output:
-                self.log.debug(f"run_cephadm_exec result: code={code}, stdout={stdout}, stderr={stderr}")
-            return stdout, stderr, code
-
-        except Exception as e:
-            self.log.exception(f"Error executing command via cephadm exec on {host}: {e}")
-            return '', str(e), 1
+                                                  self.mgr._cephadm, addr=addr, mode=0o744)
 
     def _retry_failed_operations(self) -> None:
         self.log.debug('_retry_failed_operations')
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index 101d488a6ff..4e8cfcdb5e5 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -294,6 +294,7 @@ class SSHManager:
                                addr: Optional[str] = None,
                                log_command: Optional[bool] = True,
                                ) -> Tuple[str, str, int]:
+
         conn = await self._remote_connection(host, addr)
         # Enforce invoker usage if SSH hardening is enabled
         self._enforce_sudo_hardening(host, cmd_components)
@@ -434,68 +435,6 @@ class SSHManager:
         with self.mgr.async_timeout_handler(host, " ".join(cmd)):
             return self.mgr.wait_async(self._check_execute_command(host, cmd, stdin, addr, log_command))
 
-    async def _execute_cephadm_exec(self,
-                                    host: str,
-                                    cmd_components: RemoteCommand,
-                                    stdin: Optional[str] = None,
-                                    addr: Optional[str] = None,
-                                    log_command: Optional[bool] = True,
-                                    ) -> Tuple[str, str, int]:
-        """
-        Execute a command on the remote host via 'cephadm exec --command <bash command>'
-        This routes the command through CephadmServe.run_cephadm_exec
-        """
-        if log_command:
-            logger.debug(f'Executing command via cephadm exec: {cmd_components}')
-
-        cmd_list = list(cmd_components)
-
-        from cephadm.serve import CephadmServe
-
-        out, err, code = await CephadmServe(self.mgr).run_cephadm_exec(
-            host=host,
-            cmd=cmd_list,
-            addr=addr,
-            stdin=stdin,
-            log_output=log_command
-        )
-        return out, err, code
-
-    def execute_cephadm_exec(self,
-                             host: str,
-                             cmd: RemoteCommand,
-                             stdin: Optional[str] = None,
-                             addr: Optional[str] = None,
-                             log_command: Optional[bool] = True
-                             ) -> Tuple[str, str, int]:
-        with self.mgr.async_timeout_handler(host, " ".join(cmd)):
-            return self.mgr.wait_async(self._execute_cephadm_exec(host, cmd, stdin, addr, log_command))
-
-    async def _check_execute_cephadm_exec(self,
-                                          host: str,
-                                          cmd: RemoteCommand,
-                                          stdin: Optional[str] = None,
-                                          addr: Optional[str] = None,
-                                          log_command: Optional[bool] = True
-                                          ) -> str:
-        """Execute a command via cephadm exec and raise error if it fails"""
-        out, err, code = await self._execute_cephadm_exec(host, cmd, stdin, addr, log_command)
-        if code != 0:
-            msg = f'Command {cmd} failed. {err}'
-            logger.debug(msg)
-            raise OrchestratorError(msg)
-        return out
-
-    def check_execute_cephadm_exec(self,
-                                   host: str,
-                                   cmd: RemoteCommand,
-                                   stdin: Optional[str] = None,
-                                   addr: Optional[str] = None,
-                                   log_command: Optional[bool] = True,
-                                   ) -> str:
-        with self.mgr.async_timeout_handler(host, " ".join(cmd)):
-            return self.mgr.wait_async(self._check_execute_cephadm_exec(host, cmd, stdin, addr, log_command))
-
     async def _write_remote_file(self,
                                  host: str,
                                  path: str,
@@ -504,33 +443,26 @@ class SSHManager:
                                  uid: Optional[int] = None,
                                  gid: Optional[int] = None,
                                  addr: Optional[str] = None,
-                                 bypass_cephadm_exec: Optional[bool] = False,
                                  ) -> None:
-        """
-        Write a file to a remote host.
-        """
         try:
             cephadm_tmp_dir = f"/tmp/cephadm-{self.mgr._cluster_fsid}"
             dirname = os.path.dirname(path)
-
-            # Choose execution method based on bypass flag
-            execute_method = self._check_execute_command if bypass_cephadm_exec else self._check_execute_cephadm_exec
             mkdir = RemoteCommand(Executables.MKDIR, ['-p', dirname])
-            await execute_method(host, mkdir, addr=addr)
+            await self._check_execute_command(host, mkdir, addr=addr)
             mkdir2 = RemoteCommand(Executables.MKDIR, ['-p', cephadm_tmp_dir + dirname])
-            await execute_method(host, mkdir2, addr=addr)
+            await self._check_execute_command(host, mkdir2, addr=addr)
             tmp_path = cephadm_tmp_dir + path + '.new'
             touch = RemoteCommand(Executables.TOUCH, [tmp_path])
-            await execute_method(host, touch, addr=addr)
+            await self._check_execute_command(host, touch, addr=addr)
             if self.mgr.ssh_user != 'root':
                 assert self.mgr.ssh_user
                 chown = RemoteCommand(
                     Executables.CHOWN,
                     ['-R', self.mgr.ssh_user, cephadm_tmp_dir]
                 )
-                await execute_method(host, chown, addr=addr)
+                await self._check_execute_command(host, chown, addr=addr)
                 chmod = RemoteCommand(Executables.CHMOD, [str(644), tmp_path])
-                await execute_method(host, chmod, addr=addr)
+                await self._check_execute_command(host, chmod, addr=addr)
             with NamedTemporaryFile(prefix='cephadm-write-remote-file-') as f:
                 os.fchmod(f.fileno(), 0o600)
                 f.write(content)
@@ -544,12 +476,12 @@ class SSHManager:
                     Executables.CHOWN,
                     ['-R', str(uid) + ':' + str(gid), tmp_path]
                 )
-                await execute_method(host, chown, addr=addr)
+                await self._check_execute_command(host, chown, addr=addr)
             if mode is not None:
                 chmod = RemoteCommand(Executables.CHMOD, [oct(mode)[2:], tmp_path])
-                await execute_method(host, chmod, addr=addr)
+                await self._check_execute_command(host, chmod, addr=addr)
             mv = RemoteCommand(Executables.MV, ['-Z', tmp_path, path])
-            await execute_method(host, mv, addr=addr)
+            await self._check_execute_command(host, mv, addr=addr)
         except Exception as e:
             msg = f"Unable to write {host}:{path}: {e}"
             logger.exception(msg)
@@ -599,11 +531,10 @@ class SSHManager:
                           uid: Optional[int] = None,
                           gid: Optional[int] = None,
                           addr: Optional[str] = None,
-                          bypass_cephadm_exec: Optional[bool] = False,
                           ) -> None:
         with self.mgr.async_timeout_handler(host, f'writing file {path}'):
             self.mgr.wait_async(self._write_remote_file(
-                host, path, content, mode, uid, gid, addr, bypass_cephadm_exec))
+                host, path, content, mode, uid, gid, addr))
 
     async def _reset_con(self, host: str) -> None:
         conn = self.cons.get(host)
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index 9bc1148941a..b97b7f175f2 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -2277,9 +2277,9 @@ class TestCephadm(object):
             CephadmServe(cephadm_module)._write_all_client_files()
             # Make sure both ceph conf locations (default and per fsid) are called
             _write_file.assert_has_calls([mock.call('test', '/etc/ceph/ceph.conf', b'',
-                                          0o644, 0, 0, None, False),
+                                          0o644, 0, 0, None),
                                          mock.call('test', '/var/lib/ceph/fsid/config/ceph.conf', b'',
-                                          0o644, 0, 0, None, False)]
+                                          0o644, 0, 0, None)]
                                          )
             ceph_conf_files = cephadm_module.cache.get_host_client_files('test')
             assert len(ceph_conf_files) == 2
@@ -2291,10 +2291,10 @@ class TestCephadm(object):
             CephadmServe(cephadm_module)._write_all_client_files()
             _write_file.assert_has_calls([mock.call('test',
                                                     '/etc/ceph/ceph.conf',
-                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None, False),
+                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None),
                                           mock.call('test',
                                                     '/var/lib/ceph/fsid/config/ceph.conf',
-                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None, False)])
+                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None)])
             # reload
             cephadm_module.cache.last_client_files = {}
             cephadm_module.cache.load()
diff --git a/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py b/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py
index 07bfd4befb4..f525b217c01 100644
--- a/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py
+++ b/src/pybind/mgr/cephadm/tests/test_ssh_hardening.py
@@ -142,46 +142,3 @@ class TestSudoHardening:
                 assert 'sudo' not in called_args
                 assert 'check-host' in called_args
                 assert '--expect-hostname test-host' in called_args
-
-    def test_execute_cephadm_exec_with_hardening(self, setup_sudo_hardening):
-        """Test cephadm exec with SSH hardening enabled."""
-        ssh_manager = SSHManager(setup_sudo_hardening)
-        mock_conn = AsyncMock()
-        mock_conn.run.return_value = mock.Mock(
-            stdout='success', stderr='', returncode=0
-        )
-
-        with mock.patch.object(setup_sudo_hardening.ssh, '_remote_connection',
-                               return_value=mock_conn):
-            cmd = RemoteCommand(Executables.LS, ['-la', '/tmp'])
-            out, err, code = ssh_manager.execute_cephadm_exec('test-host', cmd)
-
-            called_args = mock_conn.run.call_args[0][0]
-            assert called_args.startswith('sudo /usr/libexec/cephadm_invoker.py')
-            assert setup_sudo_hardening.cephadm_binary_path in called_args
-            assert 'exec' in called_args and '--command' in called_args
-            assert (out, err, code) == ('success', '', 0)
-
-    def test_execute_cephadm_exec_without_hardening(self, cephadm_module):
-        """Test cephadm exec with SSH hardening disabled."""
-        cephadm_module.sudo_hardening = False
-        cephadm_module.ssh_user = 'cephadm'
-        cephadm_module.cephadm_binary_path = '/var/lib/ceph/fsid/cephadm.abc123'
-        ssh_manager = SSHManager(cephadm_module)
-
-        mock_conn = AsyncMock()
-        mock_conn.run.return_value = mock.Mock(
-            stdout='success', stderr='', returncode=0
-        )
-
-        with mock.patch.object(cephadm_module.ssh, '_remote_connection',
-                               return_value=mock_conn):
-            cmd = RemoteCommand(Executables.LS, ['-la', '/tmp'])
-            out, err, code = ssh_manager.execute_cephadm_exec('test-host', cmd)
-
-            called_args = mock_conn.run.call_args[0][0]
-            # When hardening is disabled, cephadm exec should use cephadm binary directly (not invoker)
-            assert cephadm_module.cephadm_binary_path in called_args
-            assert '/usr/libexec/cephadm_invoker.py' not in called_args
-            assert 'exec' in called_args and '--command' in called_args
-            assert (out, err, code) == ('success', '', 0)
diff --git a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
index 2eba05dfa57..9db971f6f21 100644
--- a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
@@ -80,24 +80,6 @@ class FakeMgr:
                                                      {'y': 'y'}).to_json()})
         return ''
 
-    def async_timeout_handler(self, host='', cmd='', timeout=None):
-        """Mock async_timeout_handler for tests"""
-        from contextlib import contextmanager
-
-        @contextmanager
-        def handler():
-            yield
-        return handler()
-
-    def wait_async(self, coro, timeout=None):
-        """Mock wait_async for tests - just run the coroutine"""
-        import asyncio
-        loop = asyncio.new_event_loop()
-        try:
-            return loop.run_until_complete(coro)
-        finally:
-            loop.close()
-
 
 class TestTunedProfiles:
     tspec1 = TunedProfileSpec('p1',
@@ -146,19 +128,19 @@ class TestTunedProfiles:
         ]
         _write_profiles.assert_has_calls(calls, any_order=True)
 
-    @mock.patch('cephadm.ssh.SSHManager.check_execute_cephadm_exec')
-    def test_rm_stray_tuned_profiles(self, _check_execute_cephadm_exec):
+    @mock.patch('cephadm.ssh.SSHManager.check_execute_command')
+    def test_rm_stray_tuned_profiles(self, _check_execute_command):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test, going to use host "a" and put 4 cephadm generated
         # profiles "p1" "p2", "p3" and "who" only two of which should be there ("p1", "p2")
         # as well as a file not generated by cephadm. Only the "p3" and "who"
         # profiles should be removed from the host. This should total to 4
-        # calls to check_execute_cephadm_exec, 1 "ls", 2 "rm", and 1 "sysctl --system"
-        _check_execute_cephadm_exec.return_value = '\n'.join(['p1-cephadm-tuned-profile.conf',
-                                                              'p2-cephadm-tuned-profile.conf',
-                                                              'p3-cephadm-tuned-profile.conf',
-                                                              'who-cephadm-tuned-profile.conf',
-                                                              'dont-touch-me'])
+        # calls to check_execute_command, 1 "ls", 2 "rm", and 1 "sysctl --system"
+        _check_execute_command.return_value = '\n'.join(['p1-cephadm-tuned-profile.conf',
+                                                         'p2-cephadm-tuned-profile.conf',
+                                                         'p3-cephadm-tuned-profile.conf',
+                                                         'who-cephadm-tuned-profile.conf',
+                                                         'dont-touch-me'])
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
                       [],
@@ -187,16 +169,16 @@ class TestTunedProfiles:
                 'a', RemoteCommand(Executables.SYSCTL, ['--system'])
             ),
         ]
-        _check_execute_cephadm_exec.assert_has_calls(calls, any_order=True)
+        _check_execute_command.assert_has_calls(calls, any_order=True)
 
-    @mock.patch('cephadm.ssh.SSHManager.check_execute_cephadm_exec')
+    @mock.patch('cephadm.ssh.SSHManager.check_execute_command')
     @mock.patch('cephadm.ssh.SSHManager.write_remote_file')
-    def test_write_tuned_profiles(self, _write_remote_file, _check_execute_cephadm_exec):
+    def test_write_tuned_profiles(self, _write_remote_file, _check_execute_command):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test we will use host "a" and have it so host_needs_tuned_profile_update
         # returns True for p2 and False for p1 (see FakeCache class). So we should see
         # 2 ssh calls, one to write p2, one to run sysctl --system
-        _check_execute_cephadm_exec.return_value = 'success'
+        _check_execute_command.return_value = 'success'
         _write_remote_file.return_value = 'success'
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
@@ -204,7 +186,7 @@ class TestTunedProfiles:
                       profiles)
         tp = TunedProfileUtils(mgr)
         tp._write_tuned_profiles('a', self.profiles_to_calls(tp, [self.tspec1, self.tspec2]))
-        _check_execute_cephadm_exec.assert_called_with(
+        _check_execute_command.assert_called_with(
             'a', RemoteCommand(Executables.SYSCTL, ['--system'])
         )
         _write_remote_file.assert_called_with(
diff --git a/src/pybind/mgr/cephadm/tuned_profiles.py b/src/pybind/mgr/cephadm/tuned_profiles.py
index 5dbc2c102d2..7a37d937904 100644
--- a/src/pybind/mgr/cephadm/tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tuned_profiles.py
@@ -73,7 +73,7 @@ class TunedProfileUtils():
         if self.mgr.cache.is_host_unreachable(host):
             return
         cmd = ssh.RemoteCommand(ssh.Executables.LS, [SYSCTL_DIR])
-        found_files = self.mgr.ssh.check_execute_cephadm_exec(host, cmd, log_command=self.mgr.log_refresh_metadata).split('\n')
+        found_files = self.mgr.ssh.check_execute_command(host, cmd, log_command=self.mgr.log_refresh_metadata).split('\n')
         found_files = [s.strip() for s in found_files]
         profile_names: List[str] = sum([[*p] for p in profiles], [])  # extract all profiles names
         profile_names = list(set(profile_names))  # remove duplicates
@@ -85,10 +85,10 @@ class TunedProfileUtils():
             if file not in expected_files:
                 logger.info(f'Removing stray tuned profile file {file}')
                 cmd = ssh.RemoteCommand(ssh.Executables.RM, ['-f', f'{SYSCTL_DIR}/{file}'])
-                self.mgr.ssh.check_execute_cephadm_exec(host, cmd)
+                self.mgr.ssh.check_execute_command(host, cmd)
                 updated = True
         if updated:
-            self.mgr.ssh.check_execute_cephadm_exec(host, SYSCTL_SYSTEM_CMD)
+            self.mgr.ssh.check_execute_command(host, SYSCTL_SYSTEM_CMD)
 
     def _write_tuned_profiles(self, host: str, profiles: List[Dict[str, str]]) -> None:
         if self.mgr.cache.is_host_unreachable(host):
@@ -102,5 +102,5 @@ class TunedProfileUtils():
                     self.mgr.ssh.write_remote_file(host, profile_filename, content.encode('utf-8'))
                     updated = True
         if updated:
-            self.mgr.ssh.check_execute_cephadm_exec(host, SYSCTL_SYSTEM_CMD)
+            self.mgr.ssh.check_execute_command(host, SYSCTL_SYSTEM_CMD)
         self.mgr.cache.last_tuned_profile_update[host] = datetime_now()

From 07edf265cb61fa1bdb492be405f7847620b6453f Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 8 May 2026 16:54:43 +0530
Subject: [PATCH 167/596] cephadm: Added cephadm check-online command for
 offline host watcher

Added a `cephadm check-online` subcommand that returns 0,
and use it from the mgr cephadm offline host watcher via
`CephadmServe._run_cephadm` instead of SSHing `true` directly.

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/man/8/cephadm.rst                     | 13 ++++++++++++-
 src/cephadm/cephadm.py                    |  9 +++++++++
 src/pybind/mgr/cephadm/offline_watcher.py |  9 ++++++---
 src/pybind/mgr/cephadm/tests/test_ssh.py  | 15 +++++++++++++++
 4 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index 44d3beafb20..c290bf7712d 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,7 +13,7 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
 |               ...
 
 
@@ -90,6 +90,8 @@ Synopsis
 
 | **cephadm** **check-host** [-h] [--expect-hostname EXPECT_HOSTNAME]
 
+| **cephadm** **check-online**
+
 | **cephadm** **prepare-host**
 
 | **cephadm** **add-repo** [-h] [--release RELEASE] [--version VERSION]
@@ -289,6 +291,15 @@ Arguments:
 * [--expect-hostname EXPECT_HOSTNAME] Check that hostname matches an expected value
 
 
+check-online
+------------
+
+check that the host is online by running ``true`` locally.
+
+This command is primarily intended for cephadm internals (for example, the
+offline host watcher), rather than direct operator workflows.
+
+
 deploy
 ------
 
diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index ba246ab7c40..2365054f42d 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4454,6 +4454,10 @@ def command_check_host(ctx: CephadmContext) -> None:
 ##################################
 
 
+def command_check_online(ctx: CephadmContext) -> int:
+    return 0
+
+
 def command_prepare_host(ctx: CephadmContext) -> None:
     logger.info('Verifying podman|docker is present...')
     pkg = None
@@ -5597,6 +5601,10 @@ def _get_parser():
         '--expect-hostname',
         help='Check that hostname matches an expected value')
 
+    parser_check_online = subparsers.add_parser(
+        'check-online', help='return true to indicate host is running')
+    parser_check_online.set_defaults(func=command_check_online)
+
     parser_prepare_host = subparsers.add_parser(
         'prepare-host', help='prepare a host for cephadm use')
     parser_prepare_host.set_defaults(func=command_prepare_host)
@@ -5832,6 +5840,7 @@ def main() -> None:
         if ctx.func not in \
                 [
                     command_check_host,
+                    command_check_online,
                     command_prepare_host,
                     command_add_repo,
                     command_rm_repo,
diff --git a/src/pybind/mgr/cephadm/offline_watcher.py b/src/pybind/mgr/cephadm/offline_watcher.py
index 4aa07e2f584..c8bfa4cb3d1 100644
--- a/src/pybind/mgr/cephadm/offline_watcher.py
+++ b/src/pybind/mgr/cephadm/offline_watcher.py
@@ -4,7 +4,8 @@ from typing import List, Optional, TYPE_CHECKING
 import multiprocessing as mp
 import threading
 
-from . import ssh
+from .serve import CephadmServe
+from .utils import cephadmNoImage
 
 if TYPE_CHECKING:
     from cephadm.module import CephadmOrchestrator
@@ -40,8 +41,10 @@ class OfflineHostWatcher(threading.Thread):
     def check_host(self, host: str) -> None:
         if host not in self.mgr.offline_hosts:
             try:
-                rcmd = ssh.RemoteCommand(ssh.Executables.TRUE)
-                self.mgr.ssh.check_execute_command(host, rcmd, log_command=self.mgr.log_refresh_metadata)
+                with self.mgr.async_timeout_handler(host, 'cephadm check-online'):
+                    self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
+                        host, cephadmNoImage, 'check-online', [],
+                        no_fsid=True, log_output=self.mgr.log_refresh_metadata))
             except Exception:
                 logger.debug(f'OfflineHostDetector: detected {host} to be offline')
                 # kick serve loop in case corrective action must be taken for offline host
diff --git a/src/pybind/mgr/cephadm/tests/test_ssh.py b/src/pybind/mgr/cephadm/tests/test_ssh.py
index 937e3156760..ebb80b18b94 100644
--- a/src/pybind/mgr/cephadm/tests/test_ssh.py
+++ b/src/pybind/mgr/cephadm/tests/test_ssh.py
@@ -21,6 +21,7 @@ from ceph.deployment.hostspec import HostSpec
 from cephadm import CephadmOrchestrator
 from cephadm.serve import CephadmServe
 from cephadm.tests.fixtures import with_host, wait, async_side_effect
+from cephadm.utils import cephadmNoImage
 from orchestrator import OrchestratorError
 
 
@@ -111,3 +112,17 @@ def test_remote_command():
         '-rf',
         '/tmp/blat',
     ]
+
+
+@mock.patch("cephadm.offline_watcher.CephadmServe._run_cephadm")
+def test_offline_watcher_uses_cephadm_check_online(run_cephadm, cephadm_module):
+    run_cephadm.side_effect = async_side_effect(([''], [''], 0))
+
+    with with_host(cephadm_module, 'test'):
+        run_cephadm.reset_mock()
+        cephadm_module.offline_watcher.check_host('test')
+
+    run_cephadm.assert_called_once_with(
+        'test', cephadmNoImage, 'check-online', [],
+        no_fsid=True, log_output=cephadm_module.log_refresh_metadata
+    )

From c40c6296a1cf3221e9da4ce7666255c017d7e202 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 11 May 2026 10:33:48 +0530
Subject: [PATCH 168/596] cephadm: added remove-file command for client file
 cleanup

Add a cephadm remove-file subcommand that deletes only regular files.
Have the mgr call it from CephadmServe._write_client_files when pruning
stale client keyrings instead of running ssh rm, so removal goes through
the same cephadm/invoker path as other host operations.

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/man/8/cephadm.rst                        | 17 ++++++++-
 src/cephadm/cephadm.py                       | 37 ++++++++++++++++++-
 src/cephadm/tests/test_cephadm.py            | 38 ++++++++++++++++++++
 src/pybind/mgr/cephadm/serve.py              |  5 +--
 src/pybind/mgr/cephadm/tests/test_cephadm.py | 16 ++++++++-
 5 files changed, 108 insertions(+), 5 deletions(-)

diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index c290bf7712d..1d352ded429 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,7 +13,7 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
 |               ...
 
 
@@ -92,6 +92,8 @@ Synopsis
 
 | **cephadm** **check-online**
 
+| **cephadm** **remove-file** [-h] [--fsid FSID] --path PATH
+
 | **cephadm** **prepare-host**
 
 | **cephadm** **add-repo** [-h] [--release RELEASE] [--version VERSION]
@@ -300,6 +302,19 @@ This command is primarily intended for cephadm internals (for example, the
 offline host watcher), rather than direct operator workflows.
 
 
+remove-file
+-----------
+
+Remove a regular file on the local host. Missing paths are ignored.
+Refuses directories and symbolic links, only plain files are
+removed.
+
+Arguments:
+
+* [--fsid FSID]   cluster FSID (passed automatically when invoked by the orchestrator)
+* --path PATH     absolute path of the file to remove (required)
+
+
 deploy
 ------
 
diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 2365054f42d..d49e96ea45b 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4643,6 +4643,29 @@ def command_gather_facts(ctx: CephadmContext) -> None:
     print(host.dump())
 
 
+def command_remove_file(ctx: CephadmContext) -> int:
+    """Remove a regular file on the host
+    """
+    norm = Path(os.path.normpath(str(Path(ctx.remove_file_path).expanduser())))
+
+    if not norm.is_absolute():
+        raise Error(f'Can not remove non-absolute path: {norm}')
+    try:
+        if not norm.exists():
+            return 0
+        # Refuse symlinks explicitly because is_file() follows them
+        if norm.is_symlink() or not norm.is_file():
+            raise Error(f'Can not remove non-regular file: {norm}')
+
+        norm.unlink()
+
+    except FileNotFoundError:
+        return 0
+    except OSError as e:
+        raise Error(f'failed to remove {norm}: {e}')
+    return 0
+
+
 ##################################
 
 
@@ -5697,6 +5720,18 @@ def _get_parser():
         'gather-facts', help='gather and return host related information (JSON format)')
     parser_gather_facts.set_defaults(func=command_gather_facts)
 
+    parser_remove_file = subparsers.add_parser(
+        'remove-file', help='remove a file on the host')
+    parser_remove_file.set_defaults(func=command_remove_file)
+    parser_remove_file.add_argument(
+        '--fsid',
+        help='cluster FSID')
+    parser_remove_file.add_argument(
+        '--path',
+        required=True,
+        dest='remove_file_path',
+        help='absolute path of the file to remove')
+
     parser_maintenance = subparsers.add_parser(
         'host-maintenance', help='Manage the maintenance state of a host')
     parser_maintenance.add_argument(
@@ -5845,7 +5880,7 @@ def main() -> None:
                     command_add_repo,
                     command_rm_repo,
                     command_install,
-                    command_bootstrap
+                    command_bootstrap,
                 ]:
             check_container_engine(ctx)
         # command handler
diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index 7d2402d8b9b..efba1cf777e 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -106,6 +106,44 @@ class TestCephAdm(object):
         _attempt_bind.side_effect = os_error
         assert port_in_use(empty_ctx, _cephadm.EndPoint('0.0.0.0', 9100)) == False
 
+    def test_command_remove_file(self, cephadm_fs):
+        rm_path = '/tmp/cephadm-remove-file-test'
+        cephadm_fs.create_file(rm_path, contents='x')
+        with with_cephadm_ctx(
+            ['remove-file', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--path', rm_path]
+        ) as ctx:
+            assert _cephadm.command_remove_file(ctx) == 0
+        assert not cephadm_fs.exists(rm_path)
+
+    def test_command_remove_file_missing_ok(self, cephadm_fs):
+        missing = '/tmp/cephadm-remove-file-missing'
+        with with_cephadm_ctx(
+            ['remove-file', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--path', missing]
+        ) as ctx:
+            assert _cephadm.command_remove_file(ctx) == 0
+
+    def test_command_remove_file_refuses_directory(self, cephadm_fs):
+        dpath = '/tmp/cephadm-remove-file-isdir'
+        cephadm_fs.create_dir(dpath)
+        with with_cephadm_ctx(
+            ['remove-file', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--path', dpath]
+        ) as ctx:
+            with pytest.raises(_cephadm.Error, match='Can not remove non-regular file'):
+                _cephadm.command_remove_file(ctx)
+        assert cephadm_fs.exists(dpath)
+
+    def test_command_remove_file_refuses_symlink(self, cephadm_fs):
+        target = '/tmp/cephadm-remove-file-symtarget'
+        link = '/tmp/cephadm-remove-file-symlink'
+        cephadm_fs.create_file(target, contents='x')
+        cephadm_fs.create_symlink(link, target)
+        with with_cephadm_ctx(
+            ['remove-file', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--path', link]
+        ) as ctx:
+            with pytest.raises(_cephadm.Error, match='Can not remove non-regular file'):
+                _cephadm.command_remove_file(ctx)
+        assert cephadm_fs.exists(link)
+
     @mock.patch('cephadm.socket.socket.bind')
     @mock.patch('cephadm.logger')
     def test_port_in_use_special_cases(self, _logger, _bind):
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index e45ec846df2..7d992260717 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1399,8 +1399,9 @@ class CephadmServe:
             if path == '/etc/ceph/ceph.conf':
                 continue
             self.log.info(f'Removing {host}:{path}')
-            cmd = ssh.RemoteCommand(ssh.Executables.RM, ['-f', path])
-            self.mgr.ssh.check_execute_command(host, cmd)
+            with self.mgr.async_timeout_handler(host, f'cephadm remove-file ({path})'):
+                self.mgr.wait_async(self._run_cephadm(
+                    host, cephadmNoImage, 'remove-file', ['--path', path]))
             updated_files = True
             self.mgr.cache.removed_client_file(host, path)
         if updated_files:
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index b97b7f175f2..bb5933152a7 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -15,7 +15,7 @@ from cephadm.inventory import (
 )
 from cephadm.services.osd import OSD, OSDRemovalQueue, OsdIdClaims
 from cephadm.services.nvmeof import NvmeofService
-from cephadm.utils import SpecialHostLabels
+from cephadm.utils import SpecialHostLabels, cephadmNoImage
 
 try:
     from typing import List
@@ -2346,6 +2346,20 @@ class TestCephadm(object):
         CephadmServe(cephadm_module)._write_client_files({}, 'host2')
         CephadmServe(cephadm_module)._write_client_files({}, 'host3')
 
+    @mock.patch('cephadm.serve.CephadmServe._run_cephadm', new_callable=mock.AsyncMock)
+    def test_write_client_files_remove_calls_cephadm_remove_file(self, _run_cephadm, cephadm_module):
+        _run_cephadm.return_value = ([''], [''], 0)
+        cephadm_module.inventory.add_host(HostSpec('host1', '10.0.0.1'))
+        cephadm_module.cache.prime_empty_host('host1')
+        stale = '/var/lib/ceph/fsid/config/foo.keyring'
+        cephadm_module.cache.update_client_file('host1', stale, 'digest', 0o600, 0, 0)
+        CephadmServe(cephadm_module)._write_client_files({'host1': {}}, 'host1')
+        _run_cephadm.assert_called_once()
+        pos_args = _run_cephadm.call_args[0]
+        # Bound method mock: call_args do not include self.
+        assert pos_args[0:4] == ('host1', cephadmNoImage, 'remove-file', ['--path', stale])
+        assert stale not in cephadm_module.cache.get_host_client_files('host1')
+
     @mock.patch('cephadm.CephadmOrchestrator.mon_command')
     @mock.patch("cephadm.inventory.HostCache.get_host_client_files")
     def test_dont_write_etc_ceph_client_files_when_turned_off(self, _get_client_files, _mon_command, cephadm_module):

From 56895ee07b9cf9d23ae46d7d71e7316cd3320227 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 11 May 2026 11:42:15 +0530
Subject: [PATCH 169/596] cephadm: added sysctl-dir command for tuned profiles,
 use remove-file for strays

Added cephadm sysctl-dir with mutually exclusive --list (sorted basenames
under /etc/sysctl.d) and --apply-system (sysctl --system).
The cephadm mgr tuned profile logic calls sysctl-dir for listing and
reload, and remove-file for stray *-cephadm-tuned-profile.conf files

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/man/8/cephadm.rst                         | 16 +++-
 src/cephadm/cephadm.py                        | 41 +++++++++++
 src/cephadm/tests/test_cephadm.py             | 40 ++++++++++
 .../mgr/cephadm/tests/test_tuned_profiles.py  | 73 +++++++++----------
 src/pybind/mgr/cephadm/tuned_profiles.py      | 38 ++++++++--
 5 files changed, 162 insertions(+), 46 deletions(-)

diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index 1d352ded429..35e5e8fe99f 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,7 +13,7 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,sysctl-dir,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
 |               ...
 
 
@@ -94,6 +94,8 @@ Synopsis
 
 | **cephadm** **remove-file** [-h] [--fsid FSID] --path PATH
 
+| **cephadm** **sysctl-dir** [-h] [--fsid FSID] (--list | --apply-system)
+
 | **cephadm** **prepare-host**
 
 | **cephadm** **add-repo** [-h] [--release RELEASE] [--version VERSION]
@@ -315,6 +317,18 @@ Arguments:
 * --path PATH     absolute path of the file to remove (required)
 
 
+sysctl-dir
+----------
+
+List basenames under ``/etc/sysctl.d`` or run ``sysctl --system`` on the local host.
+
+Arguments:
+
+* [--fsid FSID]      cluster FSID (passed automatically when invoked by the orchestrator)
+* --list             print one directory entry per line (sorted)
+* --apply-system     reload sysctl settings from all configuration paths
+
+
 deploy
 ------
 
diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index d49e96ea45b..20f26e48d25 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4666,6 +4666,25 @@ def command_remove_file(ctx: CephadmContext) -> int:
     return 0
 
 
+def command_sysctl_dir(ctx: CephadmContext) -> int:
+    """List basenames under sysctl.d or run sysctl --system"""
+    action = ctx.sysctl_dir_action
+    sysctl_dir = Path(SYSCTL_DIR)
+    if action == 'list':
+        if not sysctl_dir.is_dir():
+            raise Error(f'Not a directory: {SYSCTL_DIR}')
+        for name in sorted(p.name for p in sysctl_dir.iterdir()):
+            print(name)
+        return 0
+    if action == 'apply_system':
+        _out, _err, code = call(
+            ctx, ['sysctl', '--system'], verbosity=CallVerbosity.DEBUG)
+        if code:
+            raise Error(f'sysctl --system failed with code {code}: {_err}')
+        return 0
+    raise Error('sysctl-dir: no action specified')
+
+
 ##################################
 
 
@@ -5732,6 +5751,28 @@ def _get_parser():
         dest='remove_file_path',
         help='absolute path of the file to remove')
 
+    parser_sysctl_dir = subparsers.add_parser(
+        'sysctl-dir',
+        help='list entries in sysctl.d or run sysctl --system')
+    parser_sysctl_dir.set_defaults(func=command_sysctl_dir)
+    parser_sysctl_dir.add_argument(
+        '--fsid',
+        help='cluster FSID')
+    _sysctl_dir_action = parser_sysctl_dir.add_mutually_exclusive_group(
+        required=True)
+    _sysctl_dir_action.add_argument(
+        '--list',
+        dest='sysctl_dir_action',
+        action='store_const',
+        const='list',
+        help=f'print one basename per line from {SYSCTL_DIR}')
+    _sysctl_dir_action.add_argument(
+        '--apply-system',
+        dest='sysctl_dir_action',
+        action='store_const',
+        const='apply_system',
+        help='reload sysctl settings from all config paths (sysctl --system)')
+
     parser_maintenance = subparsers.add_parser(
         'host-maintenance', help='Manage the maintenance state of a host')
     parser_maintenance.add_argument(
diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index efba1cf777e..1644ceca0ef 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -144,6 +144,46 @@ class TestCephAdm(object):
                 _cephadm.command_remove_file(ctx)
         assert cephadm_fs.exists(link)
 
+    def test_command_sysctl_dir_list(self, cephadm_fs, capsys):
+        from cephadmlib.constants import SYSCTL_DIR
+        cephadm_fs.create_dir(SYSCTL_DIR)
+        cephadm_fs.create_file(os.path.join(SYSCTL_DIR, 'c.conf'))
+        cephadm_fs.create_file(os.path.join(SYSCTL_DIR, 'a.conf'))
+        with with_cephadm_ctx(
+            ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--list']
+        ) as ctx:
+            assert _cephadm.command_sysctl_dir(ctx) == 0
+        assert capsys.readouterr().out.splitlines() == ['a.conf', 'c.conf']
+
+    def test_command_sysctl_dir_list_missing_dir(self, cephadm_fs):
+        import shutil
+        from cephadmlib.constants import SYSCTL_DIR
+        # cephadm_fs already has /etc (e.g. from UNIT_DIR). Only sysctl.d must be absent.
+        if cephadm_fs.exists(SYSCTL_DIR):
+            shutil.rmtree(SYSCTL_DIR)
+        assert not cephadm_fs.exists(SYSCTL_DIR)
+        with with_cephadm_ctx(
+            ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--list']
+        ) as ctx:
+            with pytest.raises(_cephadm.Error, match='Not a directory'):
+                _cephadm.command_sysctl_dir(ctx)
+
+    def test_command_sysctl_dir_apply_system(self, cephadm_fs):
+        with with_cephadm_ctx(
+            ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--apply-system']
+        ) as ctx:
+            assert _cephadm.command_sysctl_dir(ctx) == 0
+
+    def test_command_sysctl_dir_apply_system_failure(self, cephadm_fs):
+        # Do not let with_cephadm_ctx re-patch cephadm.call back to success (exit 0).
+        with mock.patch('cephadm.call', return_value=('out', 'sysctl failed', 1)):
+            with with_cephadm_ctx(
+                ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--apply-system'],
+                mock_cephadm_call_fn=False,
+            ) as ctx:
+                with pytest.raises(_cephadm.Error, match='sysctl --system failed'):
+                    _cephadm.command_sysctl_dir(ctx)
+
     @mock.patch('cephadm.socket.socket.bind')
     @mock.patch('cephadm.logger')
     def test_port_in_use_special_cases(self, _logger, _bind):
diff --git a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
index 9db971f6f21..b1660d9e957 100644
--- a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
@@ -1,11 +1,14 @@
+import asyncio
 import pytest
 import json
+from contextlib import contextmanager
 from tests import mock
 from cephadm.tuned_profiles import TunedProfileUtils, SYSCTL_DIR
+from cephadm.utils import cephadmNoImage
 from cephadm.inventory import TunedProfileStore
 from ceph.utils import datetime_now
 from ceph.deployment.service_spec import TunedProfileSpec, PlacementSpec
-from cephadm.ssh import SSHManager, RemoteCommand, Executables
+from cephadm.ssh import SSHManager
 from orchestrator import HostSpec
 
 from typing import List, Dict
@@ -67,6 +70,13 @@ class FakeMgr:
         self.offline_hosts = []
         self.log_refresh_metadata = False
 
+    @contextmanager
+    def async_timeout_handler(self, _host, _msg):
+        yield
+
+    def wait_async(self, coro, timeout=None):
+        return asyncio.run(coro)
+
     def set_store(self, what: str, value: str):
         raise SaveError(f'{what}: {value}')
 
@@ -128,57 +138,48 @@ class TestTunedProfiles:
         ]
         _write_profiles.assert_has_calls(calls, any_order=True)
 
-    @mock.patch('cephadm.ssh.SSHManager.check_execute_command')
-    def test_rm_stray_tuned_profiles(self, _check_execute_command):
+    @mock.patch('cephadm.tuned_profiles.CephadmServe._run_cephadm', new_callable=mock.AsyncMock)
+    @mock.patch('cephadm.tuned_profiles.TunedProfileUtils._sysctl_dir_apply_system')
+    @mock.patch('cephadm.tuned_profiles.TunedProfileUtils._sysctl_dir_list')
+    def test_rm_stray_tuned_profiles(
+            self, _sysctl_dir_list, _sysctl_dir_apply_system, _run_cephadm):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test, going to use host "a" and put 4 cephadm generated
         # profiles "p1" "p2", "p3" and "who" only two of which should be there ("p1", "p2")
         # as well as a file not generated by cephadm. Only the "p3" and "who"
-        # profiles should be removed from the host. This should total to 4
-        # calls to check_execute_command, 1 "ls", 2 "rm", and 1 "sysctl --system"
-        _check_execute_command.return_value = '\n'.join(['p1-cephadm-tuned-profile.conf',
-                                                         'p2-cephadm-tuned-profile.conf',
-                                                         'p3-cephadm-tuned-profile.conf',
-                                                         'who-cephadm-tuned-profile.conf',
-                                                         'dont-touch-me'])
+        # profiles should be removed via cephadm remove-file. List/apply use cephadm.
+        _sysctl_dir_list.return_value = '\n'.join(['p1-cephadm-tuned-profile.conf',
+                                                   'p2-cephadm-tuned-profile.conf',
+                                                   'p3-cephadm-tuned-profile.conf',
+                                                   'who-cephadm-tuned-profile.conf',
+                                                   'dont-touch-me'])
+        _run_cephadm.return_value = ([''], [''], 0)
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
                       [],
                       profiles)
         tp = TunedProfileUtils(mgr)
         tp._remove_stray_tuned_profiles('a', self.profiles_to_calls(tp, [self.tspec1, self.tspec2]))
-        calls = [
+        _sysctl_dir_list.assert_called_once_with('a')
+        _sysctl_dir_apply_system.assert_called_once_with('a')
+        rm_calls = [
             mock.call(
-                'a', RemoteCommand(Executables.LS, [SYSCTL_DIR]), log_command=False
-            ),
+                'a', cephadmNoImage, 'remove-file',
+                ['--path', f'{SYSCTL_DIR}/p3-cephadm-tuned-profile.conf']),
             mock.call(
-                'a',
-                RemoteCommand(
-                    Executables.RM,
-                    ['-f', f'{SYSCTL_DIR}/p3-cephadm-tuned-profile.conf']
-                )
-            ),
-            mock.call(
-                'a',
-                RemoteCommand(
-                    Executables.RM,
-                    ['-f', f'{SYSCTL_DIR}/who-cephadm-tuned-profile.conf']
-                )
-            ),
-            mock.call(
-                'a', RemoteCommand(Executables.SYSCTL, ['--system'])
-            ),
+                'a', cephadmNoImage, 'remove-file',
+                ['--path', f'{SYSCTL_DIR}/who-cephadm-tuned-profile.conf']),
         ]
-        _check_execute_command.assert_has_calls(calls, any_order=True)
+        _run_cephadm.assert_has_calls(rm_calls, any_order=True)
+        assert _run_cephadm.call_count == 2
 
-    @mock.patch('cephadm.ssh.SSHManager.check_execute_command')
+    @mock.patch('cephadm.tuned_profiles.TunedProfileUtils._sysctl_dir_apply_system')
     @mock.patch('cephadm.ssh.SSHManager.write_remote_file')
-    def test_write_tuned_profiles(self, _write_remote_file, _check_execute_command):
+    def test_write_tuned_profiles(self, _write_remote_file, _sysctl_dir_apply_system):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test we will use host "a" and have it so host_needs_tuned_profile_update
         # returns True for p2 and False for p1 (see FakeCache class). So we should see
-        # 2 ssh calls, one to write p2, one to run sysctl --system
-        _check_execute_command.return_value = 'success'
+        # one write for p2 and sysctl-dir --apply-system via cephadm.
         _write_remote_file.return_value = 'success'
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
@@ -186,9 +187,7 @@ class TestTunedProfiles:
                       profiles)
         tp = TunedProfileUtils(mgr)
         tp._write_tuned_profiles('a', self.profiles_to_calls(tp, [self.tspec1, self.tspec2]))
-        _check_execute_command.assert_called_with(
-            'a', RemoteCommand(Executables.SYSCTL, ['--system'])
-        )
+        _sysctl_dir_apply_system.assert_called_once_with('a')
         _write_remote_file.assert_called_with(
             'a', f'{SYSCTL_DIR}/p2-cephadm-tuned-profile.conf', tp._profile_to_str(self.tspec2).encode('utf-8'))
 
diff --git a/src/pybind/mgr/cephadm/tuned_profiles.py b/src/pybind/mgr/cephadm/tuned_profiles.py
index 7a37d937904..d3f07342beb 100644
--- a/src/pybind/mgr/cephadm/tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tuned_profiles.py
@@ -3,7 +3,8 @@ from typing import Dict, List, TYPE_CHECKING
 from ceph.utils import datetime_now
 from .schedule import HostAssignment
 from ceph.deployment.service_spec import ServiceSpec, TunedProfileSpec
-from . import ssh
+from .serve import CephadmServe
+from .utils import cephadmNoImage
 
 if TYPE_CHECKING:
     from cephadm.module import CephadmOrchestrator
@@ -12,13 +13,33 @@ logger = logging.getLogger(__name__)
 
 SYSCTL_DIR = '/etc/sysctl.d'
 
-SYSCTL_SYSTEM_CMD = ssh.RemoteCommand(ssh.Executables.SYSCTL, ['--system'])
+SYSCTL_DIR_CEPHADM_CMD = 'sysctl-dir'
 
 
 class TunedProfileUtils():
     def __init__(self, mgr: "CephadmOrchestrator") -> None:
         self.mgr = mgr
 
+    def _sysctl_dir_list(self, host: str) -> str:
+        with self.mgr.async_timeout_handler(host, 'cephadm sysctl-dir --list'):
+            out, _err, _code = self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
+                host,
+                cephadmNoImage,
+                SYSCTL_DIR_CEPHADM_CMD,
+                ['--list'],
+                log_output=self.mgr.log_refresh_metadata,
+            ))
+        return ''.join(out)
+
+    def _sysctl_dir_apply_system(self, host: str) -> None:
+        with self.mgr.async_timeout_handler(host, 'cephadm sysctl-dir --apply-system'):
+            self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
+                host,
+                cephadmNoImage,
+                SYSCTL_DIR_CEPHADM_CMD,
+                ['--apply-system'],
+            ))
+
     def _profile_to_str(self, p: TunedProfileSpec) -> str:
         p_str = f'# created by cephadm\n# tuned profile "{p.profile_name}"\n\n'
         for k, v in p.settings.items():
@@ -72,8 +93,7 @@ class TunedProfileUtils():
         """
         if self.mgr.cache.is_host_unreachable(host):
             return
-        cmd = ssh.RemoteCommand(ssh.Executables.LS, [SYSCTL_DIR])
-        found_files = self.mgr.ssh.check_execute_command(host, cmd, log_command=self.mgr.log_refresh_metadata).split('\n')
+        found_files = self._sysctl_dir_list(host).split('\n')
         found_files = [s.strip() for s in found_files]
         profile_names: List[str] = sum([[*p] for p in profiles], [])  # extract all profiles names
         profile_names = list(set(profile_names))  # remove duplicates
@@ -84,11 +104,13 @@ class TunedProfileUtils():
                 continue
             if file not in expected_files:
                 logger.info(f'Removing stray tuned profile file {file}')
-                cmd = ssh.RemoteCommand(ssh.Executables.RM, ['-f', f'{SYSCTL_DIR}/{file}'])
-                self.mgr.ssh.check_execute_command(host, cmd)
+                path = f'{SYSCTL_DIR}/{file}'
+                with self.mgr.async_timeout_handler(host, f'cephadm remove-file ({path})'):
+                    self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
+                        host, cephadmNoImage, 'remove-file', ['--path', path]))
                 updated = True
         if updated:
-            self.mgr.ssh.check_execute_command(host, SYSCTL_SYSTEM_CMD)
+            self._sysctl_dir_apply_system(host)
 
     def _write_tuned_profiles(self, host: str, profiles: List[Dict[str, str]]) -> None:
         if self.mgr.cache.is_host_unreachable(host):
@@ -102,5 +124,5 @@ class TunedProfileUtils():
                     self.mgr.ssh.write_remote_file(host, profile_filename, content.encode('utf-8'))
                     updated = True
         if updated:
-            self.mgr.ssh.check_execute_command(host, SYSCTL_SYSTEM_CMD)
+            self._sysctl_dir_apply_system(host)
         self.mgr.cache.last_tuned_profile_update[host] = datetime_now()

From 4d35c61283ca61b975f1cd44010bd24cc6bfdf02 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 14 May 2026 14:50:16 +0530
Subject: [PATCH 170/596] mgr/cephadm: adding cephadm deploy-file command for
 mgr file writes

Add a cephadm "deploy-file" subcommand that reads raw file bytes from stdin
and atomically installs them at an absolute destination (--fsid, --path,
optional --mode, --uid/--gid). Use it from the mgr for client conf/keyring
sync and tuned profiles instead of SSHManager.write_remote_file.
Keep staging the cephadm binary over SSH via _write_remote_file when sudo
hardening is off, the invoker deploy_binary path is unchanged when hardening
is on.
SSH: pass encoding=None to asyncssh conn.run when stdin is bytes so binary
payloads (deploy-file) are not UTF-8-encoded as str. Only add the input kwarg
when stdin is not None.

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/man/8/cephadm.rst                         | 20 ++++-
 src/cephadm/cephadm.py                        | 57 +++++++++++++
 src/cephadm/cephadmlib/file_utils.py          |  4 +-
 src/cephadm/tests/test_cephadm.py             | 41 +++++++++
 src/pybind/mgr/cephadm/serve.py               | 36 +++++++-
 src/pybind/mgr/cephadm/ssh.py                 | 34 ++++----
 src/pybind/mgr/cephadm/tests/test_cephadm.py  | 84 +++++++++++++++----
 .../mgr/cephadm/tests/test_tuned_profiles.py  |  8 +-
 src/pybind/mgr/cephadm/tuned_profiles.py      |  8 +-
 9 files changed, 248 insertions(+), 44 deletions(-)

diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index 35e5e8fe99f..c8f2ba98d29 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,7 +13,7 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,sysctl-dir,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,deploy-file,sysctl-dir,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
 |               ...
 
 
@@ -94,6 +94,9 @@ Synopsis
 
 | **cephadm** **remove-file** [-h] [--fsid FSID] --path PATH
 
+| **cephadm** **deploy-file** [-h] [--fsid FSID] --path PATH [--mode MODE]
+|                          [--uid UID] [--gid GID]
+
 | **cephadm** **sysctl-dir** [-h] [--fsid FSID] (--list | --apply-system)
 
 | **cephadm** **prepare-host**
@@ -317,6 +320,21 @@ Arguments:
 * --path PATH     absolute path of the file to remove (required)
 
 
+deploy-file
+-----------
+
+Write or replace a file on the local host. The **entire file body** is read from
+**standard input** as raw bytes (no encoding or line-ending translation).
+
+Arguments:
+
+* [--fsid FSID]   cluster FSID (passed automatically when invoked by the orchestrator)
+* --path PATH     absolute destination path for the file (required)
+* [--mode MODE]   octal file mode (for example ``644`` or ``0644``)
+* [--uid UID]    numeric owner user id (**must** be given together with ``--gid``)
+* [--gid GID]    numeric owner group id (**must** be given together with ``--uid``)
+
+
 sysctl-dir
 ----------
 
diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 20f26e48d25..11de13858b5 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4666,6 +4666,33 @@ def command_remove_file(ctx: CephadmContext) -> int:
     return 0
 
 
+@infer_fsid
+def command_deploy_file(ctx: CephadmContext) -> int:
+    """Write or replace a host file from raw stdin bytes (for mgr-driven config sync)."""
+    dest = Path(ctx.deploy_file_path).expanduser()
+    if not dest.is_absolute():
+        raise Error(f'deploy-file: destination must be an absolute path: {dest}')
+
+    uid = ctx.deploy_file_uid
+    gid = ctx.deploy_file_gid
+    if (uid is None) != (gid is None):
+        raise Error('deploy-file: --uid and --gid must be given together')
+
+    owner = (uid, gid) if uid is not None and gid is not None else None
+    perms = None
+    if ctx.deploy_file_mode is not None:
+        perms = int(str(ctx.deploy_file_mode), 8)
+
+    dest.parent.mkdir(parents=True, mode=0o755, exist_ok=True)
+    try:
+        with write_new(dest, owner=owner, perms=perms, binary=True) as fh:
+            fh.write(sys.stdin.buffer.read())
+    except Exception as e:
+        logger.exception('deploy-file: Failed to write file, exception: %s', e)
+        raise
+    return 0
+
+
 def command_sysctl_dir(ctx: CephadmContext) -> int:
     """List basenames under sysctl.d or run sysctl --system"""
     action = ctx.sysctl_dir_action
@@ -5751,6 +5778,36 @@ def _get_parser():
         dest='remove_file_path',
         help='absolute path of the file to remove')
 
+    parser_deploy_file = subparsers.add_parser(
+        'deploy-file',
+        help='write or replace a host file from stdin (raw bytes)')
+    parser_deploy_file.set_defaults(func=command_deploy_file)
+    parser_deploy_file.add_argument(
+        '--fsid',
+        help='cluster FSID')
+    parser_deploy_file.add_argument(
+        '--path',
+        required=True,
+        dest='deploy_file_path',
+        help='absolute destination path for the file')
+    parser_deploy_file.add_argument(
+        '--mode',
+        dest='deploy_file_mode',
+        default=None,
+        help='octal mode for the file (e.g. 644 or 0644)')
+    parser_deploy_file.add_argument(
+        '--uid',
+        type=int,
+        dest='deploy_file_uid',
+        default=None,
+        help='numeric owner uid (requires --gid)')
+    parser_deploy_file.add_argument(
+        '--gid',
+        type=int,
+        dest='deploy_file_gid',
+        default=None,
+        help='numeric owner gid (requires --uid)')
+
     parser_sysctl_dir = subparsers.add_parser(
         'sysctl-dir',
         help='list entries in sysctl.d or run sysctl --system')
diff --git a/src/cephadm/cephadmlib/file_utils.py b/src/cephadm/cephadmlib/file_utils.py
index 1cd12adf018..be1f899fa3e 100644
--- a/src/cephadm/cephadmlib/file_utils.py
+++ b/src/cephadm/cephadmlib/file_utils.py
@@ -24,6 +24,7 @@ def write_new(
     owner: Optional[Tuple[int, int]] = None,
     perms: Optional[int] = DEFAULT_MODE,
     encoding: Optional[str] = None,
+    binary: bool = False,
 ) -> Generator[IO, None, None]:
     """Write a new file in a robust manner, optionally specifying the owner,
     permissions, or encoding. This function takes care to never leave a file in
@@ -38,8 +39,9 @@ def write_new(
     open_kwargs: Dict[str, Any] = {}
     if encoding:
         open_kwargs['encoding'] = encoding
+    file_mode = 'wb' if binary else 'w'
     try:
-        with open(tempname, 'w', **open_kwargs) as fh:
+        with open(tempname, file_mode, **open_kwargs) as fh:
             yield fh
             fh.flush()
             os.fsync(fh.fileno())
diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index 1644ceca0ef..f57b224468c 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -144,6 +144,47 @@ class TestCephAdm(object):
                 _cephadm.command_remove_file(ctx)
         assert cephadm_fs.exists(link)
 
+    def test_command_deploy_file(self, cephadm_fs):
+        import io
+        fsid = '00000000-0000-0000-0000-0000deadbeef'
+        dest = '/etc/ceph/kube.conf'
+        cephadm_fs.create_dir('/etc/ceph')
+        content = b'hello\xff'
+        stdin_mock = mock.Mock()
+        stdin_mock.buffer = io.BytesIO(content)
+        with mock.patch('sys.stdin', stdin_mock):
+            with with_cephadm_ctx(
+                ['deploy-file', '--fsid', fsid, '--path', dest, '--mode', '600']
+            ) as ctx:
+                assert _cephadm.command_deploy_file(ctx) == 0
+        assert cephadm_fs.exists(dest)
+        with open(dest, 'rb') as f:
+            assert f.read() == content
+
+    def test_command_deploy_file_rejects_relative_path(self, cephadm_fs):
+        import io
+        stdin_mock = mock.Mock()
+        stdin_mock.buffer = io.BytesIO(b'x')
+        with mock.patch('sys.stdin', stdin_mock):
+            with with_cephadm_ctx(
+                ['deploy-file', '--fsid', '00000000-0000-0000-0000-0000deadbeef',
+                 '--path', 'relative/path.conf']
+            ) as ctx:
+                with pytest.raises(_cephadm.Error, match='absolute path'):
+                    _cephadm.command_deploy_file(ctx)
+
+    def test_command_deploy_file_uid_gid_together(self, cephadm_fs):
+        import io
+        stdin_mock = mock.Mock()
+        stdin_mock.buffer = io.BytesIO(b'x')
+        with mock.patch('sys.stdin', stdin_mock):
+            with with_cephadm_ctx(
+                ['deploy-file', '--fsid', '00000000-0000-0000-0000-0000deadbeef',
+                 '--path', '/etc/ceph/a', '--uid', '0']
+            ) as ctx:
+                with pytest.raises(_cephadm.Error, match='together'):
+                    _cephadm.command_deploy_file(ctx)
+
     def test_command_sysctl_dir_list(self, cephadm_fs, capsys):
         from cephadmlib.constants import SYSCTL_DIR
         cephadm_fs.create_dir(SYSCTL_DIR)
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 7d992260717..568cda8e112 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1392,7 +1392,9 @@ class CephadmServe:
                 if match:
                     continue
             self.log.info(f'Updating {host}:{path}')
-            self.mgr.ssh.write_remote_file(host, path, content, mode, uid, gid)
+            with self.mgr.async_timeout_handler(host, f'cephadm deploy-file ({path})'):
+                self.mgr.wait_async(self._deploy_file_via_cephadm(
+                    host, path, content, mode, uid, gid))
             self.mgr.cache.update_client_file(host, path, digest, mode, uid, gid)
             updated_files = True
         for path in old_files.keys():
@@ -1695,7 +1697,7 @@ class CephadmServe:
                            command: Union[str, List[str]],
                            args: List[str],
                            addr: Optional[str] = "",
-                           stdin: Optional[str] = "",
+                           stdin: Optional[Union[str, bytes]] = "",
                            no_fsid: Optional[bool] = False,
                            error_ok: Optional[bool] = False,
                            image: Optional[str] = "",
@@ -1783,7 +1785,10 @@ class CephadmServe:
             # agent has cephadm binary as an extra file which is
             # therefore passed over stdin. Even for debug logs it's too much
             if stdin and 'agent' not in str(entity):
-                self.log.debug('stdin: %s' % stdin)
+                if isinstance(stdin, bytes):
+                    self.log.debug('stdin: <binary len %d>', len(stdin))
+                else:
+                    self.log.debug('stdin: %s', stdin)
 
             # If SSH hardening is enabled, call invoker directly without which python
             if self.mgr.sudo_hardening and self.mgr.invoker_path:
@@ -1910,6 +1915,31 @@ class CephadmServe:
             return f"Host {host} failed to login to all registries"
         return None
 
+    async def _deploy_file_via_cephadm(
+        self,
+        host: str,
+        path: str,
+        content: bytes,
+        mode: Optional[int] = None,
+        uid: Optional[int] = None,
+        gid: Optional[int] = None,
+        addr: Optional[str] = None,
+    ) -> None:
+        """Write a host file using ``cephadm deploy-file`` (stdin = raw file bytes)."""
+        args: List[str] = ['--path', path]
+        if mode is not None:
+            args.extend(['--mode', oct(mode)[2:]])
+        if uid is not None and gid is not None:
+            args.extend(['--uid', str(uid), '--gid', str(gid)])
+        await self._run_cephadm(
+            host,
+            cephadmNoImage,
+            'deploy-file',
+            args,
+            stdin=content,
+            addr=addr or '',
+        )
+
     async def _deploy_cephadm_binary(self, host: str, addr: Optional[str] = None) -> None:
         # Use tee (from coreutils) to create a copy of cephadm on the target machine
         self.log.info(f"Deploying cephadm binary to {host}")
diff --git a/src/pybind/mgr/cephadm/ssh.py b/src/pybind/mgr/cephadm/ssh.py
index 4e8cfcdb5e5..c6a57f9154b 100644
--- a/src/pybind/mgr/cephadm/ssh.py
+++ b/src/pybind/mgr/cephadm/ssh.py
@@ -8,7 +8,7 @@ from threading import Thread
 from contextlib import contextmanager
 from io import StringIO
 from shlex import quote
-from typing import TYPE_CHECKING, Optional, List, Tuple, Dict, Iterator, TypeVar, Awaitable, Union
+from typing import TYPE_CHECKING, Optional, List, Tuple, Dict, Iterator, TypeVar, Awaitable, Union, Any
 from orchestrator import OrchestratorError
 
 try:
@@ -290,7 +290,7 @@ class SSHManager:
     async def _execute_command(self,
                                host: str,
                                cmd_components: RemoteCommand,
-                               stdin: Optional[str] = None,
+                               stdin: Optional[Union[str, bytes]] = None,
                                addr: Optional[str] = None,
                                log_command: Optional[bool] = True,
                                ) -> Tuple[str, str, int]:
@@ -311,7 +311,13 @@ class SSHManager:
         # Retry logic for transient connection/channel errors
         for attempt in range(self.SSH_RETRY_COUNT):
             try:
-                r = await conn.run(str(rcmd), input=stdin)
+                run_kw: Dict[str, Any] = {}
+                if stdin is not None:
+                    run_kw['input'] = stdin
+                    # Bytes stdin: use encoding=None (else asyncssh expects str).
+                    if isinstance(stdin, bytes):
+                        run_kw['encoding'] = None
+                r = await conn.run(str(rcmd), **run_kw)
                 break  # Success, exit retry loop
             # Handle retryable exceptions (connection/channel errors)
             # Note: handle these Exceptions otherwise you might get a weird error like
@@ -404,7 +410,7 @@ class SSHManager:
     def execute_command(self,
                         host: str,
                         cmd: RemoteCommand,
-                        stdin: Optional[str] = None,
+                        stdin: Optional[Union[str, bytes]] = None,
                         addr: Optional[str] = None,
                         log_command: Optional[bool] = True
                         ) -> Tuple[str, str, int]:
@@ -414,7 +420,7 @@ class SSHManager:
     async def _check_execute_command(self,
                                      host: str,
                                      cmd: RemoteCommand,
-                                     stdin: Optional[str] = None,
+                                     stdin: Optional[Union[str, bytes]] = None,
                                      addr: Optional[str] = None,
                                      log_command: Optional[bool] = True
                                      ) -> str:
@@ -428,7 +434,7 @@ class SSHManager:
     def check_execute_command(self,
                               host: str,
                               cmd: RemoteCommand,
-                              stdin: Optional[str] = None,
+                              stdin: Optional[Union[str, bytes]] = None,
                               addr: Optional[str] = None,
                               log_command: Optional[bool] = True,
                               ) -> str:
@@ -444,6 +450,9 @@ class SSHManager:
                                  gid: Optional[int] = None,
                                  addr: Optional[str] = None,
                                  ) -> None:
+        """This method will be used to only write cephadm binary when sudo_hardening is disbaled.
+        Other host files are written via ``cephadm deploy-file`` on the target host.
+        """
         try:
             cephadm_tmp_dir = f"/tmp/cephadm-{self.mgr._cluster_fsid}"
             dirname = os.path.dirname(path)
@@ -523,19 +532,6 @@ class SSHManager:
             except OSError:
                 pass
 
-    def write_remote_file(self,
-                          host: str,
-                          path: str,
-                          content: bytes,
-                          mode: Optional[int] = None,
-                          uid: Optional[int] = None,
-                          gid: Optional[int] = None,
-                          addr: Optional[str] = None,
-                          ) -> None:
-        with self.mgr.async_timeout_handler(host, f'writing file {path}'):
-            self.mgr.wait_async(self._write_remote_file(
-                host, path, content, mode, uid, gid, addr))
-
     async def _reset_con(self, host: str) -> None:
         conn = self.cons.get(host)
         if conn:
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index bb5933152a7..fda43ce8f5e 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -2257,9 +2257,9 @@ class TestCephadm(object):
     @mock.patch("cephadm.ssh.SSHManager._remote_connection")
     @mock.patch("cephadm.ssh.SSHManager._execute_command")
     @mock.patch("cephadm.ssh.SSHManager._check_execute_command")
-    @mock.patch("cephadm.ssh.SSHManager._write_remote_file")
-    def test_etc_ceph(self, _write_file, check_execute_command, execute_command, remote_connection, cephadm_module):
-        _write_file.side_effect = async_side_effect(None)
+    @mock.patch("cephadm.serve.CephadmServe._deploy_file_via_cephadm", new_callable=mock.AsyncMock)
+    def test_etc_ceph(self, _deploy_file_via_cephadm, check_execute_command, execute_command, remote_connection, cephadm_module):
+        _deploy_file_via_cephadm.side_effect = async_side_effect(None)
         check_execute_command.side_effect = async_side_effect('')
         execute_command.side_effect = async_side_effect(('{}', '', 0))
         remote_connection.side_effect = async_side_effect(mock.Mock())
@@ -2276,11 +2276,26 @@ class TestCephadm(object):
 
             CephadmServe(cephadm_module)._write_all_client_files()
             # Make sure both ceph conf locations (default and per fsid) are called
-            _write_file.assert_has_calls([mock.call('test', '/etc/ceph/ceph.conf', b'',
-                                          0o644, 0, 0, None),
-                                         mock.call('test', '/var/lib/ceph/fsid/config/ceph.conf', b'',
-                                          0o644, 0, 0, None)]
-                                         )
+            _deploy_file_via_cephadm.assert_has_calls(
+                [
+                    mock.call(
+                        'test',
+                        '/etc/ceph/ceph.conf',
+                        b'',
+                        0o644,
+                        0,
+                        0,
+                    ),
+                    mock.call(
+                        'test',
+                        '/var/lib/ceph/fsid/config/ceph.conf',
+                        b'',
+                        0o644,
+                        0,
+                        0,
+                    ),
+                ],
+            )
             ceph_conf_files = cephadm_module.cache.get_host_client_files('test')
             assert len(ceph_conf_files) == 2
             assert '/etc/ceph/ceph.conf' in ceph_conf_files
@@ -2289,12 +2304,26 @@ class TestCephadm(object):
             # set extra config and expect that we deploy another ceph.conf
             cephadm_module._set_extra_ceph_conf('[mon]\nk=v')
             CephadmServe(cephadm_module)._write_all_client_files()
-            _write_file.assert_has_calls([mock.call('test',
-                                                    '/etc/ceph/ceph.conf',
-                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None),
-                                          mock.call('test',
-                                                    '/var/lib/ceph/fsid/config/ceph.conf',
-                                                    b'[mon]\nk=v\n', 0o644, 0, 0, None)])
+            _deploy_file_via_cephadm.assert_has_calls(
+                [
+                    mock.call(
+                        'test',
+                        '/etc/ceph/ceph.conf',
+                        b'[mon]\nk=v\n',
+                        0o644,
+                        0,
+                        0,
+                    ),
+                    mock.call(
+                        'test',
+                        '/var/lib/ceph/fsid/config/ceph.conf',
+                        b'[mon]\nk=v\n',
+                        0o644,
+                        0,
+                        0,
+                    ),
+                ],
+            )
             # reload
             cephadm_module.cache.last_client_files = {}
             cephadm_module.cache.load()
@@ -2318,6 +2347,33 @@ class TestCephadm(object):
             assert f1_before_digest != f1_after_digest
             assert f2_before_digest != f2_after_digest
 
+    @mock.patch('cephadm.ssh.SSHManager._deploy_cephadm_binary_via_invoker',
+                new_callable=mock.AsyncMock)
+    @mock.patch('cephadm.ssh.SSHManager._write_remote_file', new_callable=mock.AsyncMock)
+    def test_deploy_cephadm_binary_uses_write_remote_file_without_sudo_hardening(
+            self, _write_remote_file, _deploy_via_invoker, cephadm_module):
+        """Without sudo hardening, the mgr stages the cephadm binary via _write_remote_file."""
+        cephadm_module.sudo_hardening = False
+        cephadm_module.invoker_path = ''
+        cephadm_module.cephadm_binary_path = (
+            f'/var/lib/ceph/{cephadm_module._cluster_fsid}/cephadm.deadbeef')
+        fake_bin = b'#!/usr/bin/fake-cephadm\n'
+        cephadm_module._cephadm = fake_bin
+
+        _write_remote_file.side_effect = async_side_effect(None)
+        cephadm_module.wait_async(
+            CephadmServe(cephadm_module)._deploy_cephadm_binary('testhost'))
+
+        _write_remote_file.assert_called_once()
+        _write_remote_file.assert_called_with(
+            'testhost',
+            cephadm_module.cephadm_binary_path,
+            fake_bin,
+            addr=None,
+            mode=0o744,
+        )
+        _deploy_via_invoker.assert_not_called()
+
     @mock.patch("cephadm.inventory.HostCache.get_host_client_files")
     def test_dont_write_client_files_to_unreachable_hosts(self, _get_client_files, cephadm_module):
         cephadm_module.inventory.add_host(HostSpec('host1', '1.2.3.1'))  # online
diff --git a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
index b1660d9e957..0904d627bd9 100644
--- a/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tests/test_tuned_profiles.py
@@ -174,13 +174,13 @@ class TestTunedProfiles:
         assert _run_cephadm.call_count == 2
 
     @mock.patch('cephadm.tuned_profiles.TunedProfileUtils._sysctl_dir_apply_system')
-    @mock.patch('cephadm.ssh.SSHManager.write_remote_file')
-    def test_write_tuned_profiles(self, _write_remote_file, _sysctl_dir_apply_system):
+    @mock.patch('cephadm.serve.CephadmServe._deploy_file_via_cephadm', new_callable=mock.AsyncMock)
+    def test_write_tuned_profiles(self, _deploy_file_via_cephadm, _sysctl_dir_apply_system):
         profiles = {'p1': self.tspec1, 'p2': self.tspec2, 'p3': self.tspec3}
         # for this test we will use host "a" and have it so host_needs_tuned_profile_update
         # returns True for p2 and False for p1 (see FakeCache class). So we should see
         # one write for p2 and sysctl-dir --apply-system via cephadm.
-        _write_remote_file.return_value = 'success'
+        _deploy_file_via_cephadm.return_value = None
         mgr = FakeMgr(['a', 'b', 'c'],
                       ['a', 'b', 'c'],
                       [],
@@ -188,7 +188,7 @@ class TestTunedProfiles:
         tp = TunedProfileUtils(mgr)
         tp._write_tuned_profiles('a', self.profiles_to_calls(tp, [self.tspec1, self.tspec2]))
         _sysctl_dir_apply_system.assert_called_once_with('a')
-        _write_remote_file.assert_called_with(
+        _deploy_file_via_cephadm.assert_called_with(
             'a', f'{SYSCTL_DIR}/p2-cephadm-tuned-profile.conf', tp._profile_to_str(self.tspec2).encode('utf-8'))
 
     def test_dont_write_to_unreachable_hosts(self):
diff --git a/src/pybind/mgr/cephadm/tuned_profiles.py b/src/pybind/mgr/cephadm/tuned_profiles.py
index d3f07342beb..9223b1e0842 100644
--- a/src/pybind/mgr/cephadm/tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tuned_profiles.py
@@ -120,8 +120,12 @@ class TunedProfileUtils():
             for profile_name, content in p.items():
                 if self.mgr.cache.host_needs_tuned_profile_update(host, profile_name):
                     logger.info(f'Writing tuned profile {profile_name} to host {host}')
-                    profile_filename: str = f'{SYSCTL_DIR}/{profile_name}-cephadm-tuned-profile.conf'
-                    self.mgr.ssh.write_remote_file(host, profile_filename, content.encode('utf-8'))
+                    profile_filename: str = (
+                        f'{SYSCTL_DIR}/{profile_name}-cephadm-tuned-profile.conf')
+                    with self.mgr.async_timeout_handler(host, f'cephadm deploy-file ({profile_filename})'):
+                        self.mgr.wait_async(
+                            CephadmServe(self.mgr)._deploy_file_via_cephadm(
+                                host, profile_filename, content.encode('utf-8')))
                     updated = True
         if updated:
             self._sysctl_dir_apply_system(host)

From e05ba723be5c83543d9075ac8e64dcd799bbdc4a Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 18 May 2026 16:17:47 +0530
Subject: [PATCH 171/596] cephadm: moved check-online,sysctl-dir subcommands
 under _orch

Moved above mentioned commands under the existing cephadm _orch namespace

Fixes: https://tracker.ceph.com/issues/74045
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 doc/cephadm/host-management.rst           |  3 +-
 doc/man/8/cephadm.rst                     | 39 ++++------------
 src/cephadm/cephadm.py                    | 54 ++++++++++++-----------
 src/cephadm/tests/test_cephadm.py         |  8 ++--
 src/pybind/mgr/cephadm/module.py          |  9 ++--
 src/pybind/mgr/cephadm/offline_watcher.py | 14 ++++--
 src/pybind/mgr/cephadm/tests/test_ssh.py  |  2 +-
 src/pybind/mgr/cephadm/tuned_profiles.py  |  6 +--
 8 files changed, 62 insertions(+), 73 deletions(-)

diff --git a/doc/cephadm/host-management.rst b/doc/cephadm/host-management.rst
index 7167ae31570..0fd4f1284e0 100644
--- a/doc/cephadm/host-management.rst
+++ b/doc/cephadm/host-management.rst
@@ -552,8 +552,7 @@ cephadm operations. Run a command of the following form:
    ceph cephadm set-user <user>
 
 The ``set-user`` command automatically configures the specified user on all cluster
-hosts by calling ``cephadm setup-ssh-user`` on each host. This command is available starting
-with the Umbrella release and includes the following:
+hosts by calling ``cephadm setup-ssh-user`` on each host. This command includes the following:
 
 - Setting up passwordless sudo access for non-root users
 - Authorizing the cluster's SSH public key for the user
diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index c8f2ba98d29..5843448d19d 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -13,7 +13,7 @@ Synopsis
 |             [--log-dir LOG_DIR] [--logrotate-dir LOGROTATE_DIR]
 |             [--unit-dir UNIT_DIR] [--verbose] [--timeout TIMEOUT]
 |             [--retry RETRY] [--no-container-init]
-|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,deploy-file,sysctl-dir,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,check-online,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
+|             {version,pull,inspect-image,ls,list-networks,list-rdma,adopt,rm-daemon,rm-cluster,remove-file,deploy-file,run,shell,enter,ceph-volume,unit,logs,bootstrap,deploy,check-host,prepare-host,prepare-host-sudo-hardening,setup-ssh-user,add-repo,rm-repo,install,list-images,update-osd-service}
 |               ...
 
 
@@ -90,17 +90,19 @@ Synopsis
 
 | **cephadm** **check-host** [-h] [--expect-hostname EXPECT_HOSTNAME]
 
-| **cephadm** **check-online**
-
 | **cephadm** **remove-file** [-h] [--fsid FSID] --path PATH
 
 | **cephadm** **deploy-file** [-h] [--fsid FSID] --path PATH [--mode MODE]
 |                          [--uid UID] [--gid GID]
 
-| **cephadm** **sysctl-dir** [-h] [--fsid FSID] (--list | --apply-system)
-
 | **cephadm** **prepare-host**
 
+| **cephadm** **prepare-host-sudo-hardening** [-h] [--ssh-user SSH_USER]
+|                                          [--ssh-pub-key SSH_PUB_KEY]
+|                                          [--cephadm-version VERSION]
+
+| **cephadm** **setup-ssh-user** [-h] --ssh-user SSH_USER --ssh-pub-key SSH_PUB_KEY
+
 | **cephadm** **add-repo** [-h] [--release RELEASE] [--version VERSION]
 |                          [--dev DEV] [--dev-commit DEV_COMMIT]
 |                          [--gpg-url GPG_URL] [--repo-url REPO_URL]
@@ -298,25 +300,14 @@ Arguments:
 * [--expect-hostname EXPECT_HOSTNAME] Check that hostname matches an expected value
 
 
-check-online
-------------
-
-check that the host is online by running ``true`` locally.
-
-This command is primarily intended for cephadm internals (for example, the
-offline host watcher), rather than direct operator workflows.
-
-
 remove-file
 -----------
 
 Remove a regular file on the local host. Missing paths are ignored.
-Refuses directories and symbolic links, only plain files are
-removed.
 
 Arguments:
 
-* [--fsid FSID]   cluster FSID (passed automatically when invoked by the orchestrator)
+* [--fsid FSID]   cluster FSID
 * --path PATH     absolute path of the file to remove (required)
 
 
@@ -328,25 +319,13 @@ Write or replace a file on the local host. The **entire file body** is read from
 
 Arguments:
 
-* [--fsid FSID]   cluster FSID (passed automatically when invoked by the orchestrator)
+* [--fsid FSID]   cluster FSID
 * --path PATH     absolute destination path for the file (required)
 * [--mode MODE]   octal file mode (for example ``644`` or ``0644``)
 * [--uid UID]    numeric owner user id (**must** be given together with ``--gid``)
 * [--gid GID]    numeric owner group id (**must** be given together with ``--uid``)
 
 
-sysctl-dir
-----------
-
-List basenames under ``/etc/sysctl.d`` or run ``sysctl --system`` on the local host.
-
-Arguments:
-
-* [--fsid FSID]      cluster FSID (passed automatically when invoked by the orchestrator)
-* --list             print one directory entry per line (sorted)
-* --apply-system     reload sysctl settings from all configuration paths
-
-
 deploy
 ------
 
diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 11de13858b5..1e788ceadf2 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -5663,6 +5663,32 @@ def _get_parser():
         help='Configuration input source file',
     )
 
+    parser_check_online = subparsers_orch.add_parser(
+        'check-online', help='return true to indicate host is running')
+    parser_check_online.set_defaults(func=command_check_online)
+
+    parser_sysctl_dir = subparsers_orch.add_parser(
+        'sysctl-dir',
+        help='list entries in sysctl.d or run sysctl --system')
+    parser_sysctl_dir.set_defaults(func=command_sysctl_dir)
+    parser_sysctl_dir.add_argument(
+        '--fsid',
+        help='cluster FSID')
+    _sysctl_dir_action = parser_sysctl_dir.add_mutually_exclusive_group(
+        required=True)
+    _sysctl_dir_action.add_argument(
+        '--list',
+        dest='sysctl_dir_action',
+        action='store_const',
+        const='list',
+        help=f'print one basename per line from {SYSCTL_DIR}')
+    _sysctl_dir_action.add_argument(
+        '--apply-system',
+        dest='sysctl_dir_action',
+        action='store_const',
+        const='apply_system',
+        help='reload sysctl settings from all config paths (sysctl --system)')
+
     parser_check_host = subparsers.add_parser(
         'check-host', help='check host configuration')
     parser_check_host.set_defaults(func=command_check_host)
@@ -5670,10 +5696,6 @@ def _get_parser():
         '--expect-hostname',
         help='Check that hostname matches an expected value')
 
-    parser_check_online = subparsers.add_parser(
-        'check-online', help='return true to indicate host is running')
-    parser_check_online.set_defaults(func=command_check_online)
-
     parser_prepare_host = subparsers.add_parser(
         'prepare-host', help='prepare a host for cephadm use')
     parser_prepare_host.set_defaults(func=command_prepare_host)
@@ -5808,28 +5830,6 @@ def _get_parser():
         default=None,
         help='numeric owner gid (requires --uid)')
 
-    parser_sysctl_dir = subparsers.add_parser(
-        'sysctl-dir',
-        help='list entries in sysctl.d or run sysctl --system')
-    parser_sysctl_dir.set_defaults(func=command_sysctl_dir)
-    parser_sysctl_dir.add_argument(
-        '--fsid',
-        help='cluster FSID')
-    _sysctl_dir_action = parser_sysctl_dir.add_mutually_exclusive_group(
-        required=True)
-    _sysctl_dir_action.add_argument(
-        '--list',
-        dest='sysctl_dir_action',
-        action='store_const',
-        const='list',
-        help=f'print one basename per line from {SYSCTL_DIR}')
-    _sysctl_dir_action.add_argument(
-        '--apply-system',
-        dest='sysctl_dir_action',
-        action='store_const',
-        const='apply_system',
-        help='reload sysctl settings from all config paths (sysctl --system)')
-
     parser_maintenance = subparsers.add_parser(
         'host-maintenance', help='Manage the maintenance state of a host')
     parser_maintenance.add_argument(
@@ -5975,6 +5975,8 @@ def main() -> None:
                     command_check_host,
                     command_check_online,
                     command_prepare_host,
+                    command_setup_ssh_user,
+                    command_prepare_host_sudo_hardening,
                     command_add_repo,
                     command_rm_repo,
                     command_install,
diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index f57b224468c..3b9a70424a9 100644
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -191,7 +191,7 @@ class TestCephAdm(object):
         cephadm_fs.create_file(os.path.join(SYSCTL_DIR, 'c.conf'))
         cephadm_fs.create_file(os.path.join(SYSCTL_DIR, 'a.conf'))
         with with_cephadm_ctx(
-            ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--list']
+            ['_orch', 'sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--list']
         ) as ctx:
             assert _cephadm.command_sysctl_dir(ctx) == 0
         assert capsys.readouterr().out.splitlines() == ['a.conf', 'c.conf']
@@ -204,14 +204,14 @@ class TestCephAdm(object):
             shutil.rmtree(SYSCTL_DIR)
         assert not cephadm_fs.exists(SYSCTL_DIR)
         with with_cephadm_ctx(
-            ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--list']
+            ['_orch', 'sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--list']
         ) as ctx:
             with pytest.raises(_cephadm.Error, match='Not a directory'):
                 _cephadm.command_sysctl_dir(ctx)
 
     def test_command_sysctl_dir_apply_system(self, cephadm_fs):
         with with_cephadm_ctx(
-            ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--apply-system']
+            ['_orch', 'sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--apply-system']
         ) as ctx:
             assert _cephadm.command_sysctl_dir(ctx) == 0
 
@@ -219,7 +219,7 @@ class TestCephAdm(object):
         # Do not let with_cephadm_ctx re-patch cephadm.call back to success (exit 0).
         with mock.patch('cephadm.call', return_value=('out', 'sysctl failed', 1)):
             with with_cephadm_ctx(
-                ['sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--apply-system'],
+                ['_orch', 'sysctl-dir', '--fsid', '00000000-0000-0000-0000-0000deadbeef', '--apply-system'],
                 mock_cephadm_call_fn=False,
             ) as ctx:
                 with pytest.raises(_cephadm.Error, match='sysctl --system failed'):
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index c81ee9b9c3f..d201da57a0a 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -1197,7 +1197,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
     def _setup_user_on_host(self, host: str, user: str, ssh_pub_key: str,
                             addr: Optional[str] = None) -> None:
         """
-        Setup sudoers and copy SSH key by calling cephadm setup-ssh-user command.
+        Setup sudoers and copy SSH key by calling cephadm setup-ssh-user.
         User must already exist on the host.
         For root user, only SSH key is copied (sudoers setup is skipped).
         """
@@ -1582,7 +1582,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
         addr: Optional[str] = None
     ) -> Tuple[str, bool, str]:
         """
-        Prepare a host for sudo hardening by executing 'cephadm prepare-host-sudo-hardening' command.
+        Prepare a host for sudo hardening by executing cephadm prepare-host-sudo-hardening.
         """
         try:
             self.log.debug('Preparing host %s for sudo hardening...', host)
@@ -1591,7 +1591,10 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             with self.async_timeout_handler(host, 'cephadm prepare-host-sudo-hardening'):
                 out, err, code = self.wait_async(
                     CephadmServe(self)._run_cephadm(
-                        host, cephadmNoImage, 'prepare-host-sudo-hardening', cephadm_args,
+                        host,
+                        cephadmNoImage,
+                        'prepare-host-sudo-hardening',
+                        cephadm_args,
                         addr=addr, error_ok=True, no_fsid=True))
             if code:
                 error_msg = '\n'.join(err) if err else 'Unknown error'
diff --git a/src/pybind/mgr/cephadm/offline_watcher.py b/src/pybind/mgr/cephadm/offline_watcher.py
index c8bfa4cb3d1..b96475f9a98 100644
--- a/src/pybind/mgr/cephadm/offline_watcher.py
+++ b/src/pybind/mgr/cephadm/offline_watcher.py
@@ -41,10 +41,16 @@ class OfflineHostWatcher(threading.Thread):
     def check_host(self, host: str) -> None:
         if host not in self.mgr.offline_hosts:
             try:
-                with self.mgr.async_timeout_handler(host, 'cephadm check-online'):
-                    self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
-                        host, cephadmNoImage, 'check-online', [],
-                        no_fsid=True, log_output=self.mgr.log_refresh_metadata))
+                with self.mgr.async_timeout_handler(
+                        host, 'cephadm _orch check-online'):
+                    self.mgr.wait_async(
+                        CephadmServe(self.mgr)._run_cephadm(
+                            host,
+                            cephadmNoImage,
+                            ['_orch', 'check-online'],
+                            [],
+                            no_fsid=True,
+                            log_output=self.mgr.log_refresh_metadata))
             except Exception:
                 logger.debug(f'OfflineHostDetector: detected {host} to be offline')
                 # kick serve loop in case corrective action must be taken for offline host
diff --git a/src/pybind/mgr/cephadm/tests/test_ssh.py b/src/pybind/mgr/cephadm/tests/test_ssh.py
index ebb80b18b94..5a8b380a4b6 100644
--- a/src/pybind/mgr/cephadm/tests/test_ssh.py
+++ b/src/pybind/mgr/cephadm/tests/test_ssh.py
@@ -123,6 +123,6 @@ def test_offline_watcher_uses_cephadm_check_online(run_cephadm, cephadm_module):
         cephadm_module.offline_watcher.check_host('test')
 
     run_cephadm.assert_called_once_with(
-        'test', cephadmNoImage, 'check-online', [],
+        'test', cephadmNoImage, ['_orch', 'check-online'], [],
         no_fsid=True, log_output=cephadm_module.log_refresh_metadata
     )
diff --git a/src/pybind/mgr/cephadm/tuned_profiles.py b/src/pybind/mgr/cephadm/tuned_profiles.py
index 9223b1e0842..941494d299f 100644
--- a/src/pybind/mgr/cephadm/tuned_profiles.py
+++ b/src/pybind/mgr/cephadm/tuned_profiles.py
@@ -13,7 +13,7 @@ logger = logging.getLogger(__name__)
 
 SYSCTL_DIR = '/etc/sysctl.d'
 
-SYSCTL_DIR_CEPHADM_CMD = 'sysctl-dir'
+SYSCTL_DIR_CEPHADM_CMD = ['_orch', 'sysctl-dir']
 
 
 class TunedProfileUtils():
@@ -21,7 +21,7 @@ class TunedProfileUtils():
         self.mgr = mgr
 
     def _sysctl_dir_list(self, host: str) -> str:
-        with self.mgr.async_timeout_handler(host, 'cephadm sysctl-dir --list'):
+        with self.mgr.async_timeout_handler(host, 'cephadm _orch sysctl-dir --list'):
             out, _err, _code = self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
                 host,
                 cephadmNoImage,
@@ -32,7 +32,7 @@ class TunedProfileUtils():
         return ''.join(out)
 
     def _sysctl_dir_apply_system(self, host: str) -> None:
-        with self.mgr.async_timeout_handler(host, 'cephadm sysctl-dir --apply-system'):
+        with self.mgr.async_timeout_handler(host, 'cephadm _orch sysctl-dir --apply-system'):
             self.mgr.wait_async(CephadmServe(self.mgr)._run_cephadm(
                 host,
                 cephadmNoImage,

From b571051663fc4a0160aac618f8113b8664aeba79 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 11 Jun 2026 11:29:05 +0800
Subject: [PATCH 172/596] ceph.spec.in: use %{_sbindir} instead of ${_sbindir}
 in osd %preun

a37b5b5bde8c added %preun scriptlets that use ${_sbindir}, which is
shell syntax rather than an rpm macro, so it expands to empty at run
time and the scriptlet runs "/update-alternatives", failing on
uninstall/upgrade with:

  /var/tmp/rpm-tmp.K1fvm3: line 2: /update-alternatives: No such file or directory
  error: %preun(ceph-osd-crimson-2:20.3.0-5054.g33c1d671.el9.x86_64) scriptlet failed, exit status 127
  Error in PREUN scriptlet in rpm package ceph-osd-crimson.

use %{_sbindir}, like the %posttrans --install lines already do, so it
expands to /usr/sbin/update-alternatives at build time.

Fixes: https://tracker.ceph.com/issues/77323
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 30028a2c7cd..9876fe5813b 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -2750,7 +2750,7 @@ fi
 
 %preun osd-crimson
 if [ $1 -eq 0 ]; then
-    ${_sbindir}/update-alternatives --remove ceph-osd %{_bindir}/ceph-osd-crimson
+    %{_sbindir}/update-alternatives --remove ceph-osd %{_bindir}/ceph-osd-crimson
 fi
 %endif
 
@@ -2760,7 +2760,7 @@ fi
 
 %preun osd-classic
 if [ $1 -eq 0 ]; then
-    ${_sbindir}/update-alternatives --remove ceph-osd %{_bindir}/ceph-osd-classic
+    %{_sbindir}/update-alternatives --remove ceph-osd %{_bindir}/ceph-osd-classic
 fi
 
 %files volume

From 7fc3a9e12f7539eabcaf80d3960a588d81983710 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 11 Jun 2026 11:32:24 +0800
Subject: [PATCH 173/596] ceph.spec.in: require update-alternatives for the osd
 scriptlets

ceph-osd-crimson and ceph-osd-classic call update-alternatives in their
%posttrans and %preun scriptlets but don't depend on it. declare it as a
scriptlet dependency so the binary is there when they run.

Fixes: https://tracker.ceph.com/issues/77323
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ceph.spec.in b/ceph.spec.in
index 9876fe5813b..4564703a38a 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -1255,6 +1255,8 @@ Group:		System/Filesystems
 %endif
 Requires:   ceph-osd = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:  ceph-osd < %{_epoch_prefix}%{version}-%{release}
+Requires(posttrans): %{_sbindir}/update-alternatives
+Requires(preun): %{_sbindir}/update-alternatives
 %description osd-classic
 classic-osd is the object storage daemon for the Ceph distributed file
 system.  It is responsible for storing objects on a local file system
@@ -1275,6 +1277,8 @@ Requires:	binutils
 Requires:	c-ares%{?_isa} >= %{c_ares_min_version}
 %endif
 Requires:	protobuf
+Requires(posttrans): %{_sbindir}/update-alternatives
+Requires(preun): %{_sbindir}/update-alternatives
 %description osd-crimson
 crimson-osd is the object storage daemon for the Ceph distributed file
 system.  It is responsible for storing objects on a local file system

From 8ef8a1e2f378f13afc695be74590d3ffc3454dcb Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 23 Oct 2025 20:36:06 +0530
Subject: [PATCH 174/596] mgr/cephadm: Signal handling while daemon reconfig

Fixes: https://tracker.ceph.com/issues/73633
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py           | 25 +++++++++++++++++++++----
 src/pybind/mgr/cephadm/module.py |  8 ++++++--
 src/pybind/mgr/cephadm/serve.py  | 12 +++++++++++-
 3 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 7cf65220c80..201b0319ba9 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -1202,10 +1202,15 @@ def deploy_daemon(
     # If this was a reconfig and the daemon is not a Ceph daemon, restart it
     # so it can pick up potential changes to its configuration files
     if deployment_type == DeploymentType.RECONFIG and daemon_type not in ceph_daemons():
-        # ceph daemons do not need a restart; others (presumably) do to pick
-        # up the new config
-        call_throws(ctx, ['systemctl', 'reset-failed', ident.unit_name])
-        call_throws(ctx, ['systemctl', 'restart', ident.unit_name])
+        if not ctx.skip_restart_for_reconfig:
+            # ceph daemons do not need a restart; others (presumably) do to pick
+            # up the new config
+            call_throws(ctx, ['systemctl', 'reset-failed', ident.unit_name])
+            call_throws(ctx, ['systemctl', 'restart', ident.unit_name])
+        elif ctx.send_signal_to_daemon:
+            ctx.signal_name = ctx.send_signal_to_daemon
+            ctx.signal_number = None
+            command_signal(ctx)
 
 
 def clean_cgroup(ctx: CephadmContext, fsid: str, unit_name: str) -> None:
@@ -4896,6 +4901,18 @@ def _add_deploy_parser_args(
         default=None,
         help='Time in seconds to wait for graceful service shutdown before forcefully killing it'
     )
+    parser_deploy.add_argument(
+        '--skip-restart-for-reconfig',
+        action='store_true',
+        default=False,
+        help='skip restart for non ceph daemons and perform default action'
+    )
+    parser_deploy.add_argument(
+        '--send-signal-to-daemon',
+        action='store_true',
+        default=False,
+        help='Send signal to daemon'
+    )
 
 
 def _name_opts(parser: argparse.ArgumentParser) -> None:
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index ef4699838d1..bad6568f500 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -2710,7 +2710,9 @@ Then run the following:
     def _daemon_action(self,
                        daemon_spec: CephadmDaemonDeploySpec,
                        action: str,
-                       image: Optional[str] = None) -> str:
+                       image: Optional[str] = None,
+                       skip_restart_for_reconfig: bool = False,
+                       send_signal_to_daemon: Optional[str] = None) -> str:
         self._daemon_action_set_image(action, image, daemon_spec.daemon_type,
                                       daemon_spec.daemon_id)
 
@@ -2735,7 +2737,9 @@ Then run the following:
                     daemon_spec)
             with self.async_timeout_handler(daemon_spec.host, f'cephadm deploy ({daemon_spec.daemon_type} daemon)'):
                 return self.wait_async(
-                    CephadmServe(self)._create_daemon(daemon_spec, reconfig=(action == 'reconfig')))
+                    CephadmServe(self)._create_daemon(daemon_spec, reconfig=(action == 'reconfig'),
+                                                      skip_restart_for_reconfig=skip_restart_for_reconfig,
+                                                      send_signal_to_daemon=send_signal_to_daemon))
 
         actions = {
             'start': ['reset-failed', 'start'],
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 1f1b5c2fd6f..4f5d37250e2 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1182,6 +1182,8 @@ class CephadmServe:
                     dd.hostname, dd.name()
                 )
             )
+            skip_restart_for_reconfig = False
+            send_signal_to_daemon = None
             if not last_config:
                 self.log.info('Reconfiguring %s (unknown last config time)...' % (
                     dd.name()))
@@ -1231,7 +1233,9 @@ class CephadmServe:
                     action = 'redeploy'
                 try:
                     daemon_spec = CephadmDaemonDeploySpec.from_daemon_description(dd)
-                    self.mgr._daemon_action(daemon_spec, action=action)
+                    self.mgr._daemon_action(daemon_spec, action=action,
+                                            skip_restart_for_reconfig=skip_restart_for_reconfig,
+                                            send_signal_to_daemon=send_signal_to_daemon)
                     if self.mgr.cache.rm_scheduled_daemon_action(dd.hostname, dd.name()):
                         self.mgr.cache.save_host(dd.hostname)
                 except OrchestratorError as e:
@@ -1411,6 +1415,8 @@ class CephadmServe:
                              daemon_spec: CephadmDaemonDeploySpec,
                              reconfig: bool = False,
                              osd_uuid_map: Optional[Dict[str, Any]] = None,
+                             skip_restart_for_reconfig: bool = False,
+                             send_signal_to_daemon: Optional[str] = None,
                              ) -> str:
 
         daemon_params: Dict[str, Any] = {}
@@ -1451,6 +1457,10 @@ class CephadmServe:
 
                 if reconfig:
                     daemon_params['reconfig'] = True
+                if skip_restart_for_reconfig:
+                    daemon_params['skip_restart_for_reconfig'] = True
+                if send_signal_to_daemon:
+                    daemon_params['send_signal_to_daemon'] = send_signal_to_daemon
                 if self.mgr.allow_ptrace:
                     daemon_params['allow_ptrace'] = True
 

From efeb0fe52f921abaa6d60cb273674ec42819665d Mon Sep 17 00:00:00 2001
From: ShreeJejurikar <shreemj8@gmail.com>
Date: Wed, 3 Jun 2026 16:59:33 +0530
Subject: [PATCH 175/596] rgw: emit bucket logging records for lifecycle delete
 actions

LC delete actions now emit LIFECYCLE.DELETE.OBJECT journal records
via no-req_state overloads of the bucketlogging frontend.

Signed-off-by: ShreeJejurikar <shreemj8@gmail.com>
---
 src/rgw/radosgw-admin/radosgw-admin.cc        |   2 +-
 src/rgw/rgw_bucket_logging.cc                 | 257 ++++++++++-----
 src/rgw/rgw_bucket_logging.h                  |  44 ++-
 src/rgw/rgw_bucket_logging_types.h            |  59 ++++
 src/rgw/rgw_lc.cc                             |  61 +++-
 src/rgw/rgw_rest_bucket_logging.cc            |   4 +-
 .../rgw/bucket_logging/test_bucket_logging.py | 297 +++++++++++++++++-
 7 files changed, 638 insertions(+), 86 deletions(-)
 create mode 100644 src/rgw/rgw_bucket_logging_types.h

diff --git a/src/rgw/radosgw-admin/radosgw-admin.cc b/src/rgw/radosgw-admin/radosgw-admin.cc
index 2f2cbe9dc78..183b202be3a 100644
--- a/src/rgw/radosgw-admin/radosgw-admin.cc
+++ b/src/rgw/radosgw-admin/radosgw-admin.cc
@@ -7966,7 +7966,7 @@ int main(int argc, const char **argv)
     }
     std::string old_obj;
     const auto region = driver->get_zone()->get_zonegroup().get_api_name();
-    ret = rgw::bucketlogging::rollover_logging_object(configuration, target_bucket, obj_name, dpp(), region, bucket, null_yield, true, &objv_tracker, false, &old_obj);
+    ret = rgw::bucketlogging::rollover_logging_object(configuration, target_bucket, obj_name, dpp(), region, bucket.get(), null_yield, true, &objv_tracker, false, &old_obj);
     if (ret < 0) {
       cerr << "ERROR: failed to flush pending logging object '" << obj_name << "' to target bucket '" << configuration.target_bucket
         << "'. error: " << cpp_strerror(-ret) << std::endl;
diff --git a/src/rgw/rgw_bucket_logging.cc b/src/rgw/rgw_bucket_logging.cc
index c7f46605876..3ca820ee214 100644
--- a/src/rgw/rgw_bucket_logging.cc
+++ b/src/rgw/rgw_bucket_logging.cc
@@ -5,6 +5,7 @@
 #include <random>
 #include "common/ceph_time.h"
 #include "rgw_bucket_logging.h"
+#include "rgw_bucket_logging_types.h"
 #include "rgw_xml.h"
 #include "rgw_sal.h"
 #include "rgw_op.h"
@@ -239,7 +240,7 @@ ceph::coarse_real_time time_from_name(const std::string& obj_name, const DoutPre
   return extracted_time;
 }
 
-std::string full_bucket_name(const std::unique_ptr<rgw::sal::Bucket>& bucket) {
+std::string full_bucket_name(const rgw::sal::Bucket* bucket) {
   if (bucket->get_tenant().empty()) {
     return bucket->get_name();
   }
@@ -251,7 +252,7 @@ int new_logging_object(const configuration& conf,
     std::string& obj_name,
     const DoutPrefixProvider *dpp,
     const std::string& region,
-    const std::unique_ptr<rgw::sal::Bucket>& source_bucket,
+    rgw::sal::Bucket* source_bucket,
     optional_yield y,
     std::optional<std::string> old_name,
     RGWObjVersionTracker* objv_tracker) {
@@ -347,7 +348,7 @@ int rollover_logging_object(const configuration& conf,
     std::string& obj_name,
     const DoutPrefixProvider *dpp,
     const std::string& region,
-    const std::unique_ptr<rgw::sal::Bucket>& source_bucket,
+    rgw::sal::Bucket* source_bucket,
     optional_yield y,
     bool must_commit,
     RGWObjVersionTracker* objv_tracker,
@@ -465,16 +466,73 @@ int log_record(rgw::sal::Driver* driver,
     optional_yield y,
     bool async_completion,
     bool log_source_bucket) {
-  if (!s->bucket) {
-    ldpp_dout(dpp, 1) << "ERROR: only bucket operations are logged in bucket logging" << dendl;
-    return -EINVAL; // this should never happen
+  record_input input;
+  input.bucket = s->bucket.get();
+  input.time = s->time;
+  if (obj) {
+    input.version_id = obj->get_instance();
   }
-  auto set_journal_err = [&conf, s](const std::string& err_message) {
-    if (conf.logging_type == LoggingType::Journal) s->err.message = err_message;
+  input.journal_err_out = &s->err.message;
+  // AWS S3 spec: log the assumed-role ARN for STS-credentialed requests.
+  if (s->auth.identity && s->auth.identity->get_identity_type() == TYPE_ROLE) {
+    if (auto caller_arn = s->auth.identity->get_caller_identity(); caller_arn) {
+      input.user_or_account = caller_arn->to_string();
+    }
+  }
+  if (input.user_or_account.empty()) {
+    if (s->account_name.empty()) {
+      s->user->get_id().to_str(input.user_or_account);
+    } else {
+      input.user_or_account = s->account_name;
+    }
+  }
+  input.fqdn = s->info.host;
+  if (!s->info.domain.empty() && !input.fqdn.empty()) {
+    input.fqdn.append(".").append(s->info.domain);
+  }
+  rgw::auth::s3::get_aws_version_and_auth_type(s, input.aws_version, input.auth_type);
+  input.time_elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(s->time_elapsed());
+  input.remote_addr = s->info.env->get("REMOTE_ADDR", "-");
+  input.trans_id = s->trans_id;
+  input.method = s->info.method;
+  input.request_uri = s->info.request_uri;
+  input.request_params = s->info.request_params;
+  input.referrer = s->info.env->get("HTTP_REFERER", "-");
+  input.user_agent = s->info.env->get("HTTP_USER_AGENT", "-");
+  input.ssl_cipher = s->info.env->get("SSL_CIPHER", "-");
+  input.tls_version = s->info.env->get("TLS_VERSION", "-");
+  input.x_amz_id_2 = s->info.x_meta_map.contains("x-amz-id-2") ?
+                       s->info.x_meta_map.at("x-amz-id-2") : "-";
+  input.http_ret = s->err.http_ret;
+  input.err_code = s->err.err_code;
+  input.content_length = s->content_length;
+  input.granted_by_acl = s->granted_by_acl;
+  input.src_object = s->src_object.get();
+  input.src_bucket_name = s->src_bucket_name;
+  return log_record(driver, obj, input, op_name, etag, size, conf,
+                    dpp, y, async_completion, log_source_bucket);
+}
+
+int log_record(rgw::sal::Driver* driver,
+    const sal::Object* obj,
+    const record_input& input,
+    const std::string& op_name,
+    const std::string& etag,
+    size_t size,
+    const configuration& conf,
+    const DoutPrefixProvider *dpp,
+    optional_yield y,
+    bool async_completion,
+    bool log_source_bucket) {
+  auto set_journal_err = [&conf, &input](const std::string& err_message) {
+    if (conf.logging_type == LoggingType::Journal && input.journal_err_out) {
+      *input.journal_err_out = err_message;
+    }
   };
   std::string target_bucket_name;
   std::string target_tenant_name;
-  int ret = rgw_parse_url_bucket(conf.target_bucket, s->bucket_tenant, target_tenant_name, target_bucket_name);
+  int ret = rgw_parse_url_bucket(conf.target_bucket, input.bucket->get_tenant(),
+                                 target_tenant_name, target_bucket_name);
   if (ret < 0) {
     ldpp_dout(dpp, 1) << "ERROR: failed to parse logging bucket name '" << conf.target_bucket << "', ret = " << ret << dendl;
     set_journal_err(fmt::format("Failed to parse logging bucket name '{}'", conf.target_bucket));
@@ -492,7 +550,11 @@ int log_record(rgw::sal::Driver* driver,
 
   rgw::ARN target_resource_arn(target_bucket_id, conf.target_prefix);
   std::string err_message;
-  if (ret = verify_target_bucket_policy(dpp, target_bucket.get(), target_resource_arn, s, &err_message); ret < 0) {
+  if (ret = verify_target_bucket_policy(dpp, target_bucket.get(), target_resource_arn,
+                                        dpp->get_cct(),
+                                        rgw::ARN(input.bucket->get_key()).to_string(),
+                                        to_string(input.bucket->get_owner()),
+                                        &err_message); ret < 0) {
     set_journal_err(err_message);
     return ret;
   }
@@ -503,9 +565,9 @@ int log_record(rgw::sal::Driver* driver,
   }
 
   // make sure that the logging source attribute is up-to-date
-  if (ret = update_bucket_logging_sources(dpp, target_bucket, s->bucket->get_key(), true, y); ret < 0) {
+  if (ret = update_bucket_logging_sources(dpp, target_bucket, input.bucket->get_key(), true, y); ret < 0) {
     ldpp_dout(dpp, 5) << "WARNING: could not update bucket logging source '" <<
-      s->bucket->get_key() << "' in logging bucket '" << target_bucket_id << "' attribute, during record logging. ret = " << ret << dendl;
+      input.bucket->get_key() << "' in logging bucket '" << target_bucket_id << "' attribute, during record logging. ret = " << ret << dendl;
   }
 
   const auto region = driver->get_zone()->get_zonegroup().get_api_name();
@@ -517,7 +579,7 @@ int log_record(rgw::sal::Driver* driver,
     if (ceph::coarse_real_time::clock::now() > time_to_commit) {
       ldpp_dout(dpp, 20) << "INFO: logging object '" << obj_name << "' exceeded its time, will be committed to logging bucket '" <<
         target_bucket_id << "'" << dendl;
-      if (ret = rollover_logging_object(conf, target_bucket, obj_name, dpp, region, s->bucket, y, false, &objv_tracker, true, nullptr, &err_message); ret < 0 && ret != -ECANCELED) {
+      if (ret = rollover_logging_object(conf, target_bucket, obj_name, dpp, region, input.bucket, y, false, &objv_tracker, true, nullptr, &err_message); ret < 0 && ret != -ECANCELED) {
         set_journal_err(err_message);
         return ret;
       }
@@ -526,7 +588,7 @@ int log_record(rgw::sal::Driver* driver,
     }
   } else if (ret == -ENOENT) {
     // try to create the temporary log object for the first time
-    ret = new_logging_object(conf, target_bucket, obj_name, dpp, region, s->bucket, y, std::nullopt, &objv_tracker);
+    ret = new_logging_object(conf, target_bucket, obj_name, dpp, region, input.bucket, y, std::nullopt, &objv_tracker);
     if (ret == 0) {
       ldpp_dout(dpp, 20) << "INFO: first time logging for logging bucket '" << target_bucket_id << "' and prefix '" <<
         conf.target_prefix << "'" << dendl;
@@ -547,44 +609,23 @@ int log_record(rgw::sal::Driver* driver,
   }
 
   std::string record;
-  const auto tt = ceph::coarse_real_time::clock::to_time_t(s->time);
+  const auto tt = ceph::coarse_real_time::clock::to_time_t(input.time);
   std::tm t{};
   localtime_r(&tt, &t);
-  // AWS S3 spec: log the assumed-role ARN for STS-credentialed requests.
-  std::string user_or_account;
-  if (s->auth.identity && s->auth.identity->get_identity_type() == TYPE_ROLE) {
-    if (auto caller_arn = s->auth.identity->get_caller_identity(); caller_arn) {
-      user_or_account = caller_arn->to_string();
-    }
-  }
-  if (user_or_account.empty()) {
-    if (s->account_name.empty()) {
-      s->user->get_id().to_str(user_or_account);
-    } else {
-      user_or_account = s->account_name;
-    }
-  }
-  auto fqdn = s->info.host;
-  if (!s->info.domain.empty() && !fqdn.empty()) {
-    fqdn.append(".").append(s->info.domain);
-  }
 
-  std::string aws_version("-");
-  std::string auth_type("-");
-  rgw::auth::s3::get_aws_version_and_auth_type(s, aws_version, auth_type);
   std::string bucket_owner;
   std::string bucket_name;
   if (log_source_bucket && conf.logging_type == LoggingType::Standard) {
     // log source bucket for COPY operations only in standard mode
-    if (!s->src_object || !s->src_object->get_bucket()) {
+    if (!input.src_object || !input.src_object->get_bucket()) {
       ldpp_dout(dpp, 1) << "ERROR: source object or bucket is missing when logging source bucket" << dendl;
       return -EINVAL;
     }
-    bucket_owner = to_string(s->src_object->get_bucket()->get_owner());
-    bucket_name = s->src_bucket_name;
+    bucket_owner = to_string(input.src_object->get_bucket()->get_owner());
+    bucket_name = input.src_bucket_name;
   } else {
-    bucket_owner = to_string(s->bucket->get_owner());
-    bucket_name = full_bucket_name(s->bucket);
+    bucket_owner = to_string(input.bucket->get_owner());
+    bucket_name = full_bucket_name(input.bucket);
   }
 
   switch (conf.logging_type) {
@@ -593,32 +634,32 @@ int log_record(rgw::sal::Driver* driver,
         dash_if_empty(bucket_owner),
         dash_if_empty(bucket_name),
         t,
-        s->info.env->get("REMOTE_ADDR", "-"),
-        dash_if_empty(user_or_account),
-        dash_if_empty(s->trans_id),
+        dash_if_empty(input.remote_addr),
+        dash_if_empty(input.user_or_account),
+        dash_if_empty(input.trans_id),
         op_name,
         dash_if_empty_or_null(obj, obj->get_name()),
-        s->info.method,
-        s->info.request_uri,
-        s->info.request_params.empty() ? "" : "?",
-        s->info.request_params,
-        dash_if_zero(s->err.http_ret),
-        dash_if_empty(s->err.err_code),
-        dash_if_zero(s->content_length),
+        input.method,
+        input.request_uri,
+        input.request_params.empty() ? "" : "?",
+        input.request_params,
+        dash_if_zero(input.http_ret),
+        dash_if_empty(input.err_code),
+        dash_if_zero(input.content_length),
         dash_if_zero(size),
         "-", // no total time when logging record
-        std::chrono::duration_cast<std::chrono::milliseconds>(s->time_elapsed()),
-        s->info.env->get("HTTP_REFERER", "-"),
-        s->info.env->get("HTTP_USER_AGENT", "-"),
-        dash_if_empty_or_null(obj, obj->get_instance()),
-        s->info.x_meta_map.contains("x-amz-id-2") ? s->info.x_meta_map.at("x-amz-id-2") : "-",
-        aws_version,
-        s->info.env->get("SSL_CIPHER", "-"),
-        dash_if_empty(auth_type),
-        dash_if_empty(fqdn),
-        s->info.env->get("TLS_VERSION", "-"),
+        input.time_elapsed,
+        dash_if_empty(input.referrer),
+        dash_if_empty(input.user_agent),
+        dash_if_empty(input.version_id),
+        dash_if_empty(input.x_amz_id_2),
+        dash_if_empty(input.aws_version),
+        dash_if_empty(input.ssl_cipher),
+        dash_if_empty(input.auth_type),
+        dash_if_empty(input.fqdn),
+        dash_if_empty(input.tls_version),
         "-", // no access point ARN
-        (s->granted_by_acl) ? "Yes" : "-");
+        (input.granted_by_acl) ? "Yes" : "-");
       break;
     case LoggingType::Journal:
       record = fmt::format("{} {} [{:%d/%b/%Y:%H:%M:%S %z}] {} {} {} {} {}",
@@ -628,7 +669,7 @@ int log_record(rgw::sal::Driver* driver,
         op_name,
         dash_if_empty_or_null(obj, obj->get_name()),
         dash_if_zero(size),
-        dash_if_empty_or_null(obj, obj->get_instance()),
+        dash_if_empty(input.version_id),
         dash_if_empty(etag));
       break;
     case LoggingType::Any:
@@ -679,7 +720,7 @@ int log_record(rgw::sal::Driver* driver,
   if (ret == -EFBIG) {
     ldpp_dout(dpp, 5) << "WARNING: logging object '" << obj_name << "' is full, will be committed to logging bucket '" <<
       target_bucket->get_key() << "'" << dendl;
-    if (ret = rollover_logging_object(conf, target_bucket, obj_name, dpp, region, s->bucket, y, true, &objv_tracker, true, nullptr, &err_message); ret < 0 && ret != -ECANCELED) {
+    if (ret = rollover_logging_object(conf, target_bucket, obj_name, dpp, region, input.bucket, y, true, &objv_tracker, true, nullptr, &err_message); ret < 0 && ret != -ECANCELED) {
       set_journal_err(err_message);
       return ret;
     }
@@ -736,7 +777,9 @@ int log_record(rgw::sal::Driver* driver,
       return 0;
     }
     if (configuration.key_filter.has_content()) {
-      if (!match(configuration.key_filter, obj->get_name())) {
+      // No-op (rather than crash) for bucket-level ops with no object: can't
+      // tell if a missing key matches the filter.
+      if (!obj || !match(configuration.key_filter, obj->get_name())) {
         return 0;
       }
     }
@@ -747,6 +790,57 @@ int log_record(rgw::sal::Driver* driver,
         "'. ret=" << ret << dendl;
       return ret;
     }
+  } catch (buffer::error& err) {
+    ldpp_dout(dpp, 1) << "ERROR: failed to decode logging attribute '" << RGW_ATTR_BUCKET_LOGGING
+      << "'. error: " << err.what() << dendl;
+    return -EINVAL;
+  }
+  return 0;
+}
+
+int log_record(rgw::sal::Driver* driver,
+    LoggingType type,
+    const sal::Object* obj,
+    const record_input& input,
+    const std::string& op_name,
+    const std::string& etag,
+    size_t size,
+    const DoutPrefixProvider *dpp,
+    optional_yield y,
+    bool async_completion,
+    bool log_source_bucket) {
+  if (!input.bucket) {
+    ldpp_dout(dpp, 1) << "ERROR: only bucket operations are logged in bucket logging" << dendl;
+    return -EINVAL;
+  }
+  // check if bucket logging is needed
+  const auto& bucket_attrs = input.bucket->get_attrs();
+  auto iter = bucket_attrs.find(RGW_ATTR_BUCKET_LOGGING);
+  if (iter == bucket_attrs.end()) {
+    return 0;
+  }
+  configuration configuration;
+  try {
+    configuration.enabled = true;
+    auto bl_iter = iter->second.cbegin();
+    decode(configuration, bl_iter);
+    if (type != LoggingType::Any && configuration.logging_type != type) {
+      return 0;
+    }
+    if (configuration.key_filter.has_content()) {
+      // No-op (rather than crash) for bucket-level ops with no object: can't
+      // tell if a missing key matches the filter.
+      if (!obj || !match(configuration.key_filter, obj->get_name())) {
+        return 0;
+      }
+    }
+    ldpp_dout(dpp, 20) << "INFO: found matching logging configuration of bucket '" << input.bucket->get_key() <<
+      "' configuration: " << configuration.to_json_str() << dendl;
+    if (const int ret = log_record(driver, obj, input, op_name, etag, size, configuration, dpp, y, async_completion, log_source_bucket); ret < 0) {
+      ldpp_dout(dpp, 1) << "ERROR: failed to perform logging for bucket '" << input.bucket->get_key() <<
+        "'. ret=" << ret << dendl;
+      return ret;
+    }
   } catch (buffer::error& err) {
     ldpp_dout(dpp, 1) << "ERROR: failed to decode logging attribute '" << RGW_ATTR_BUCKET_LOGGING
       << "'. error: " << err.what() << dendl;
@@ -977,7 +1071,9 @@ int source_bucket_cleanup(const DoutPrefixProvider* dpp,
 int verify_target_bucket_policy(const DoutPrefixProvider* dpp,
     rgw::sal::Bucket* target_bucket,
     const rgw::ARN& target_resource_arn,
-    req_state* s,
+    CephContext* cct,
+    std::string source_bucket_arn,
+    std::string source_account,
     std::string* err_message) {
   // verify target permissions for bucket logging
   // this is implementing the policy based permission granting from:
@@ -993,19 +1089,20 @@ int verify_target_bucket_policy(const DoutPrefixProvider* dpp,
     return -EACCES;
   }
   try {
-    const rgw::IAM::Policy policy{s->cct, &target_bucket_id.tenant, policy_it->second.to_str(), false};
+    const rgw::IAM::Policy policy{cct, &target_bucket_id.tenant, policy_it->second.to_str(), false};
     ldpp_dout(dpp, 20) << "INFO: logging bucket '" << target_bucket_id <<
       "' policy: " << policy << dendl;
     rgw::auth::ServiceIdentity ident(rgw::bucketlogging::service_principal);
-    const auto source_bucket_arn = rgw::ARN(s->bucket->get_key()).to_string();
-    const auto source_account = to_string(s->bucket_owner.id);
-    s->env.emplace("aws:SourceArn", source_bucket_arn);
-    s->env.emplace("aws:SourceAccount", source_account);
-    if (policy.eval(s->env, ident, rgw::IAM::s3PutObject, target_resource_arn) != rgw::IAM::Effect::Allow) {
+    // The AWS-spec policy for the logging service principal references only
+    // aws:SourceArn and aws:SourceAccount. Build a minimal env to match.
+    rgw::IAM::Environment env;
+    const auto arn_it = env.emplace("aws:SourceArn", std::move(source_bucket_arn));
+    const auto acct_it = env.emplace("aws:SourceAccount", std::move(source_account));
+    if (policy.eval(env, ident, rgw::IAM::s3PutObject, target_resource_arn) != rgw::IAM::Effect::Allow) {
       ldpp_dout(dpp, 1) << "ERROR: logging bucket: '" << target_bucket_id <<
         "' must have a bucket policy that allows logging service principal to put objects in the following resource ARN: '" <<
-        target_resource_arn.to_string() << "' from source bucket ARN: '" << source_bucket_arn <<
-        "' and source account: '" << source_account << "'" <<  dendl;
+        target_resource_arn.to_string() << "' from source bucket ARN: '" << arn_it->second <<
+        "' and source account: '" << acct_it->second << "'" <<  dendl;
       if (err_message) {
         *err_message = fmt::format("Logging bucket '{}' policy does not allow logging", target_bucket->get_name());
       }
@@ -1022,6 +1119,18 @@ int verify_target_bucket_policy(const DoutPrefixProvider* dpp,
   return 0;
 }
 
+int verify_target_bucket_policy(const DoutPrefixProvider* dpp,
+    rgw::sal::Bucket* target_bucket,
+    const rgw::ARN& target_resource_arn,
+    req_state* s,
+    std::string* err_message) {
+  return verify_target_bucket_policy(dpp, target_bucket, target_resource_arn,
+                                     s->cct,
+                                     rgw::ARN(s->bucket->get_key()).to_string(),
+                                     to_string(s->bucket->get_owner()),
+                                     err_message);
+}
+
 int verify_target_bucket_attributes(const DoutPrefixProvider* dpp, rgw::sal::Bucket* target_bucket, std::string* err_message) {
   const auto& target_info = target_bucket->get_info();
   if (target_info.requester_pays) {
diff --git a/src/rgw/rgw_bucket_logging.h b/src/rgw/rgw_bucket_logging.h
index 6d5b70bc9c9..344d6ddcd9f 100644
--- a/src/rgw/rgw_bucket_logging.h
+++ b/src/rgw/rgw_bucket_logging.h
@@ -158,6 +158,11 @@ inline std::string to_string(const Records& records) {
   return str_records;
 }
 
+// Per-record input metadata for log_record(). Full definition lives in
+// rgw_bucket_logging_types.h; callers that only pass it by reference need
+// just this forward declaration.
+struct record_input;
+
 // log a bucket logging record according to the configuration
 int log_record(rgw::sal::Driver* driver,
     const sal::Object* obj,
@@ -171,6 +176,19 @@ int log_record(rgw::sal::Driver* driver,
     bool async_completion,
     bool log_source_bucket);
 
+// no-req_state variant of the log_record(req_state*, ..., configuration&) overload above
+int log_record(rgw::sal::Driver* driver,
+    const sal::Object* obj,
+    const record_input& input,
+    const std::string& op_name,
+    const std::string& etag,
+    size_t size,
+    const configuration& conf,
+    const DoutPrefixProvider *dpp,
+    optional_yield y,
+    bool async_completion,
+    bool log_source_bucket);
+
 // commit the pending log objec to the log bucket
 // and create a new pending log object
 // if "must_commit" is "false" the function will return success even if the pending log object was not committed
@@ -181,7 +199,7 @@ int rollover_logging_object(const configuration& conf,
     std::string& obj_name,
     const DoutPrefixProvider *dpp,
     const std::string& region,
-    const std::unique_ptr<rgw::sal::Bucket>& source_bucket,
+    rgw::sal::Bucket* source_bucket,
     optional_yield y,
     bool must_commit,
     RGWObjVersionTracker* objv_tracker,
@@ -209,6 +227,19 @@ int log_record(rgw::sal::Driver* driver,
     bool async_completion,
     bool log_source_bucket);
 
+// no-req_state variant of the log_record(LoggingType, ..., req_state*) overload above
+int log_record(rgw::sal::Driver* driver,
+    LoggingType type,
+    const sal::Object* obj,
+    const record_input& input,
+    const std::string& op_name,
+    const std::string& etag,
+    size_t size,
+    const DoutPrefixProvider *dpp,
+    optional_yield y,
+    bool async_completion,
+    bool log_source_bucket);
+
 // return (by ref) an rgw_bucket object with the bucket name and tenant name
 // fails if the bucket name is not in the format: [tenant name:]<bucket name>
 int get_bucket_id(const std::string& bucket_name, const std::string& tenant_name, rgw_bucket& bucket_id);
@@ -252,6 +283,17 @@ int verify_target_bucket_policy(const DoutPrefixProvider* dpp,
     req_state* s,
     std::string* err_message = nullptr);
 
+// no-req_state variant of the verify_target_bucket_policy(req_state*) overload above.
+// source_bucket_arn and source_account are the ARN of the source bucket
+// and the id of its owner; they are used as aws:SourceArn / aws:SourceAccount when evaluating the target (log) bucket's policy
+int verify_target_bucket_policy(const DoutPrefixProvider* dpp,
+    rgw::sal::Bucket* target_bucket,
+    const rgw::ARN& target_resource_arn,
+    CephContext* cct,
+    std::string source_bucket_arn,
+    std::string source_account,
+    std::string* err_message = nullptr);
+
 // verify that target bucket does not have:
 // - bucket logging
 // - requester pays
diff --git a/src/rgw/rgw_bucket_logging_types.h b/src/rgw/rgw_bucket_logging_types.h
new file mode 100644
index 00000000000..46db8a8e7f7
--- /dev/null
+++ b/src/rgw/rgw_bucket_logging_types.h
@@ -0,0 +1,59 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab ft=cpp
+
+#pragma once
+
+#include <chrono>
+#include <cstddef>
+#include <string>
+#include <string_view>
+#include "common/ceph_time.h"
+#include "rgw_sal_fwd.h"
+
+namespace rgw::bucketlogging {
+
+// Per-record input metadata for log_record(). The req_state* overloads populate
+// this from the request state; no-req_state callers (e.g. the lifecycle thread)
+// build it directly. Non-owning views point into request-lifetime storage.
+struct record_input {
+  rgw::sal::Bucket* bucket{nullptr};
+  // Requester field for Standard records. HTTP callers: assumed-role ARN,
+  // account name, or user id. LC callers: the source bucket's owner.
+  // std::string (not view) because the populate code builds it in place.
+  std::string user_or_account;
+  ceph::coarse_real_time time;
+  // Object's version id for the record. HTTP callers derive this from the
+  // request's object; LC callers pass the pre-deletion instance.
+  std::string_view version_id;
+  // Where to write the Journal-mode error message on failure. HTTP callers
+  // point at s->err.message; no-req_state callers leave it null.
+  std::string* journal_err_out{nullptr};
+
+  // Standard-mode-only fields. Views point at request-lifetime storage in
+  // req_state / env_map. The four std::string fields below are built in
+  // place by the populate code and therefore cannot be views.
+  std::chrono::milliseconds time_elapsed{};
+  std::string_view remote_addr;
+  std::string_view trans_id;
+  std::string_view method;
+  std::string_view request_uri;
+  std::string_view request_params;
+  std::string_view referrer;
+  std::string_view user_agent;
+  std::string_view ssl_cipher;
+  std::string_view tls_version;
+  std::string fqdn;          // appended in place with the domain suffix
+  std::string_view x_amz_id_2;
+  std::string aws_version;   // written by get_aws_version_and_auth_type
+  std::string auth_type;     // written by get_aws_version_and_auth_type
+  int http_ret{0};
+  std::string_view err_code;
+  size_t content_length{0};
+  bool granted_by_acl{false};
+
+  // For COPY operations (used only with log_source_bucket=true, Standard mode).
+  const sal::Object* src_object{nullptr};
+  std::string_view src_bucket_name;
+};
+
+} // namespace rgw::bucketlogging
diff --git a/src/rgw/rgw_lc.cc b/src/rgw/rgw_lc.cc
index fdfbbc5abf2..8b6adba2b8c 100644
--- a/src/rgw/rgw_lc.cc
+++ b/src/rgw/rgw_lc.cc
@@ -13,6 +13,7 @@
 #include <boost/algorithm/string/split.hpp>
 #include <boost/algorithm/string.hpp>
 #include <boost/algorithm/string/predicate.hpp>
+#include <boost/optional.hpp>
 
 #include "include/scope_guard.h"
 #include "include/function2.hpp"
@@ -34,6 +35,8 @@
 #include "rgw_sal.h"
 #include "rgw_multi_del.h"
 #include "rgw_multipart_meta_filter.h"
+#include "rgw_bucket_logging.h"
+#include "rgw_bucket_logging_types.h"
 
 #include "fmt/format.h"
 
@@ -704,6 +707,39 @@ static void send_notification(const DoutPrefixProvider* dpp,
   }
 }
 
+// Op name used in journal records for LC-driven deletions.
+static const std::string lifecycle_delete_object_op = "LIFECYCLE.DELETE.OBJECT";
+
+// LC has no req_state, so the source bucket's owner stands in as the
+// identity for the log-bucket write permission check.
+static void send_log_record(const DoutPrefixProvider* dpp,
+                            optional_yield y,
+                            rgw::sal::Driver* driver,
+                            rgw::sal::Object* obj,
+                            rgw::sal::Bucket* bucket,
+                            const std::string& etag,
+                            uint64_t size,
+                            const std::string& version_id,
+                            const std::string& op_name) {
+  rgw::bucketlogging::record_input input;
+  input.bucket = bucket;
+  input.user_or_account = to_string(bucket->get_owner());
+  input.time = ceph::coarse_real_time::clock::now();
+  input.version_id = version_id;
+
+  const int ret = rgw::bucketlogging::log_record(
+      driver,
+      rgw::bucketlogging::LoggingType::Journal,
+      obj, input, op_name, etag, size, dpp, y,
+      /*async_completion=*/true,
+      /*log_source_bucket=*/false);
+  if (ret < 0) {
+    ldpp_dout(dpp, 1) << "WARNING: bucket logging failed for lc object: "
+                      << obj->get_name() << " op: " << op_name
+                      << " ret: " << ret << dendl;
+  }
+}
+
 /* do all zones in the zone group process LC? */
 static bool zonegroup_lc_check(const DoutPrefixProvider *dpp, rgw::sal::Zone* zone)
 {
@@ -729,7 +765,8 @@ static bool zonegroup_lc_check(const DoutPrefixProvider *dpp, rgw::sal::Zone* zo
 static int remove_expired_obj(const DoutPrefixProvider* dpp,
                               optional_yield y, lc_op_ctx& oc,
                               bool remove_indeed,
-                              const rgw::notify::EventTypeList& event_types) {
+                              const rgw::notify::EventTypeList& event_types,
+                              boost::optional<const std::string&> log_op_name = boost::none) {
   int ret{0};
   auto& driver = oc.driver;
   auto& bucket_info = oc.bucket->get_info();
@@ -764,7 +801,8 @@ static int remove_expired_obj(const DoutPrefixProvider* dpp,
   }
 
   auto have_notify = !event_types.empty();
-  if (have_notify) {
+  // etag is needed for both notifications and bucket-logging records
+  if (have_notify || log_op_name) {
     auto attrset = obj->get_attrs();
     auto iter = attrset.find(RGW_ATTR_ETAG);
     if (iter != attrset.end()) {
@@ -796,6 +834,10 @@ static int remove_expired_obj(const DoutPrefixProvider* dpp,
       send_notification(dpp, y, driver, obj.get(), oc.bucket, etag, size,
 			version_id, event_types);
     }
+    if (log_op_name) {
+      send_log_record(dpp, y, driver, obj.get(), oc.bucket, etag, size,
+                      version_id, *log_op_name);
+    }
   }
 
   return ret;
@@ -1300,7 +1342,8 @@ public:
       /* ! o.is_delete_marker() */
       r = remove_expired_obj(oc.dpp, y, oc, !oc.bucket->versioning_enabled(),
                              {rgw::notify::ObjectExpirationCurrent,
-                              rgw::notify::LifecycleExpirationDelete});
+                              rgw::notify::LifecycleExpirationDelete},
+                             lifecycle_delete_object_op);
       if (r < 0) {
 	ldpp_dout(oc.dpp, 0) << "ERROR: remove_expired_obj "
 			 << oc.bucket << ":" << o.key
@@ -1357,7 +1400,8 @@ public:
     auto& o = oc.o;
     int r = remove_expired_obj(oc.dpp, y, oc, true,
                                {rgw::notify::LifecycleExpirationDelete,
-				rgw::notify::ObjectExpirationNoncurrent});
+				rgw::notify::ObjectExpirationNoncurrent},
+                               lifecycle_delete_object_op);
     if (r < 0) {
       ldpp_dout(oc.dpp, 0) << "ERROR: remove_expired_obj (non-current expiration) " 
 			   << oc.bucket << ":" << o.key
@@ -1488,20 +1532,23 @@ public:
      */
     if (! oc.bucket->versioning_enabled()) {
       ret =
-	remove_expired_obj(oc.dpp, y, oc, true, {/* no delete notify expected */});
+	remove_expired_obj(oc.dpp, y, oc, true, {/* no delete notify expected */},
+                           lifecycle_delete_object_op);
       ldpp_dout(oc.dpp, 20) << "delete_tier_obj Object(key:" << oc.o.key
                             << ") not versioned flags: " << oc.o.flags << dendl;
     } else {
       /* versioned */
       if (oc.o.is_current() && !oc.o.is_delete_marker()) {
-        ret = remove_expired_obj(oc.dpp, y, oc, false, {/* no delete notify expected */});
+        ret = remove_expired_obj(oc.dpp, y, oc, false, {/* no delete notify expected */},
+                                 lifecycle_delete_object_op);
         ldpp_dout(oc.dpp, 20) << "delete_tier_obj Object(key:" << oc.o.key
                               << ") current & not delete_marker"
                               << " versioned_epoch:  " << oc.o.versioned_epoch
                               << "flags: " << oc.o.flags << dendl;
       } else {
         ret = remove_expired_obj(oc.dpp, y, oc, true,
-				 {/* no delete notify expected */});
+				 {/* no delete notify expected */},
+                                 lifecycle_delete_object_op);
         ldpp_dout(oc.dpp, 20)
             << "delete_tier_obj Object(key:" << oc.o.key << ") not current "
             << "versioned_epoch:  " << oc.o.versioned_epoch
diff --git a/src/rgw/rgw_rest_bucket_logging.cc b/src/rgw/rgw_rest_bucket_logging.cc
index 9aa03204c3c..60c74946b21 100644
--- a/src/rgw/rgw_rest_bucket_logging.cc
+++ b/src/rgw/rgw_rest_bucket_logging.cc
@@ -323,7 +323,7 @@ class RGWPutBucketLoggingOp : public RGWDefaultResponseOp {
             obj_name,
             this,
             region,
-            src_bucket,
+            src_bucket.get(),
             y,
             false, // rollover should happen even if commit failed
             &objv_tracker,
@@ -436,7 +436,7 @@ class RGWPostBucketLoggingOp : public RGWDefaultResponseOp {
       ldpp_dout(this, 5) << "INFO: no pending logging object in logging bucket '" << target_bucket_id << "'. new object should be created" << dendl;
     }
     const auto region = driver->get_zone()->get_zonegroup().get_api_name();
-    op_ret = rgw::bucketlogging::rollover_logging_object(configuration, target_bucket, obj_name, this, region, source_bucket, y, true, &objv_tracker, false, &old_obj);
+    op_ret = rgw::bucketlogging::rollover_logging_object(configuration, target_bucket, obj_name, this, region, source_bucket.get(), y, true, &objv_tracker, false, &old_obj);
     if (op_ret < 0) {
       ldpp_dout(this, 1) << "ERROR: failed to flush pending logging object '" << obj_name << "'"
           << " to logging bucket '" << target_bucket_id << "'. "
diff --git a/src/test/rgw/bucket_logging/test_bucket_logging.py b/src/test/rgw/bucket_logging/test_bucket_logging.py
index f85aec6bc89..9e87c30e86c 100644
--- a/src/test/rgw/bucket_logging/test_bucket_logging.py
+++ b/src/test/rgw/bucket_logging/test_bucket_logging.py
@@ -273,6 +273,120 @@ def cleanup_bucket(s3_client, bucket_name):
         log.warning(f"Error cleaning up bucket {bucket_name}: {e}")
 
 
+def cleanup_versioned_bucket(s3_client, bucket_name):
+    """Delete all object versions and delete-markers, then the bucket."""
+    try:
+        resp = s3_client.list_object_versions(Bucket=bucket_name)
+        for v in resp.get('Versions', []):
+            s3_client.delete_object(Bucket=bucket_name, Key=v['Key'], VersionId=v['VersionId'])
+        for d in resp.get('DeleteMarkers', []):
+            s3_client.delete_object(Bucket=bucket_name, Key=d['Key'], VersionId=d['VersionId'])
+        s3_client.delete_bucket(Bucket=bucket_name)
+        log.debug(f"Deleted versioned bucket: {bucket_name}")
+    except ClientError as e:
+        log.warning(f"Error cleaning up versioned bucket {bucket_name}: {e}")
+
+
+def ceph(args, **kwargs):
+    cmd = [test_path + 'test-rgw-call.sh', 'call_ceph', 'noname'] + args
+    return bash(cmd, **kwargs)
+
+
+def set_lc_debug_interval(seconds):
+    # Each "1 day" in an LC rule becomes `seconds` real seconds.
+    return ceph(['config', 'set', 'client', 'rgw_lc_debug_interval', str(seconds)])
+
+
+def trigger_lc_processing():
+    return admin(['lc', 'process'])
+
+
+def wait_for_object_gone(s3_client, bucket, key, timeout=30, interval=1):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        resp = s3_client.list_objects_v2(Bucket=bucket, Prefix=key)
+        if not any(c['Key'] == key for c in resp.get('Contents', [])):
+            return True
+        time.sleep(interval)
+    return False
+
+
+def enable_versioning(s3_client, bucket):
+    s3_client.put_bucket_versioning(
+        Bucket=bucket,
+        VersioningConfiguration={'Status': 'Enabled'},
+    )
+
+
+def apply_lc_config(s3_client, bucket, rules):
+    s3_client.put_bucket_lifecycle_configuration(
+        Bucket=bucket,
+        LifecycleConfiguration={'Rules': rules},
+    )
+
+
+def make_lc_rule(prefix='', rule_id='rule', **action):
+    return {
+        'ID': rule_id,
+        'Status': 'Enabled',
+        'Filter': {'Prefix': prefix},
+        **action,
+    }
+
+
+def create_orphan_delete_marker(s3_client, bucket, key):
+    v1 = s3_client.put_object(Bucket=bucket, Key=key, Body=b'data')['VersionId']
+    s3_client.delete_object(Bucket=bucket, Key=key)
+    s3_client.delete_object(Bucket=bucket, Key=key, VersionId=v1)
+
+
+# {bucket_owner} {bucket_name} [{date}] {op_name} {key} {size} {version_id} {etag}
+_JOURNAL_RECORD_RE = re.compile(
+    r'^(\S+)\s+(\S+)\s+\[([^\]]+)\]\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s*$'
+)
+
+
+def parse_journal_record(line):
+    m = _JOURNAL_RECORD_RE.match(line)
+    if not m:
+        return None
+    return {
+        'bucket_owner': m.group(1),
+        'bucket_name': m.group(2),
+        'time': m.group(3),
+        'op_name': m.group(4),
+        'key': m.group(5),
+        'size': m.group(6),
+        'version_id': m.group(7),
+        'etag': m.group(8),
+    }
+
+
+def read_journal_records(s3_client, log_bucket, source_bucket, prefix=None, settle_time=5):
+    # settle_time waits for async log writes (async_completion=true) to drain
+    # before we flush; without it the pending log object may still be empty.
+    if prefix is None:
+        prefix = f'{source_bucket}/'
+    time.sleep(settle_time)
+    admin(['bucket', 'logging', 'flush', '--bucket', source_bucket])
+    resp = s3_client.list_objects_v2(Bucket=log_bucket, Prefix=prefix)
+    keys = sorted(obj['Key'] for obj in resp.get('Contents', []))
+    records = []
+    for key in keys:
+        body = s3_client.get_object(Bucket=log_bucket, Key=key)['Body'].read().decode('utf-8')
+        for line in body.splitlines():
+            parsed = parse_journal_record(line)
+            if parsed is not None:
+                records.append(parsed)
+    return records
+
+
+@pytest.fixture
+def lc_fast():
+    set_lc_debug_interval(5)
+    yield 5
+
+
 #####################
 # bucket logging tests
 #####################
@@ -736,4 +850,185 @@ def test_logging_commands_unconfigured_bucket(s3_client):
             assert not output.strip(), f"{cmd} on unconfigured bucket should produce empty stdout: {output}"
 
     finally:
-        cleanup_bucket(s3_client, bucket)
\ No newline at end of file
+        cleanup_bucket(s3_client, bucket)
+
+
+@pytest.mark.basic_test
+def test_lc_expiration_logs_journal_record(s3_client, logging_type, lc_fast):
+    """LC Expiration on a non-versioned bucket emits LIFECYCLE.DELETE.OBJECT"""
+    if logging_type != 'Journal':
+        pytest.skip("LC bucket logging is Journal-mode-only")
+    source = gen_bucket_name("lc-source")
+    log_bucket = gen_bucket_name("lc-log")
+
+    try:
+        assert create_bucket_with_logging(s3_client, source, log_bucket, 'Journal')
+        apply_lc_config(s3_client, source, [make_lc_rule(Expiration={'Days': 1})])
+        s3_client.put_object(Bucket=source, Key='obj.txt', Body=b'data')
+
+        time.sleep(lc_fast + 2)
+        trigger_lc_processing()
+        assert wait_for_object_gone(s3_client, source, 'obj.txt'), "LC did not delete the object"
+
+        records = read_journal_records(s3_client, log_bucket, source)
+        lc_records = [r for r in records if r['op_name'] == 'LIFECYCLE.DELETE.OBJECT']
+        assert len(lc_records) == 1, f"expected 1 LIFECYCLE.DELETE.OBJECT record, got {len(lc_records)}: {records}"
+        assert lc_records[0]['key'] == 'obj.txt'
+        assert lc_records[0]['bucket_name'] == source
+
+    finally:
+        cleanup_bucket(s3_client, source)
+        cleanup_bucket(s3_client, log_bucket)
+
+
+@pytest.mark.basic_test
+def test_lc_versioned_current_expiration_logs_journal_record(s3_client, logging_type, lc_fast):
+    """LC Expiration on a versioned bucket creates a delete marker and emits LIFECYCLE.DELETE.OBJECT for the expired current version."""
+    if logging_type != 'Journal':
+        pytest.skip("LC bucket logging is Journal-mode-only")
+    source = gen_bucket_name("lc-source")
+    log_bucket = gen_bucket_name("lc-log")
+
+    try:
+        assert create_bucket_with_logging(s3_client, source, log_bucket, 'Journal')
+        enable_versioning(s3_client, source)
+
+        apply_lc_config(s3_client, source, [make_lc_rule(Expiration={'Days': 1})])
+        v1 = s3_client.put_object(Bucket=source, Key='obj.txt', Body=b'data')['VersionId']
+
+        time.sleep(lc_fast + 2)
+        trigger_lc_processing()
+        time.sleep(lc_fast)
+
+        resp = s3_client.list_object_versions(Bucket=source, Prefix='obj.txt')
+        versions = [v['VersionId'] for v in resp.get('Versions', [])]
+        delete_markers = resp.get('DeleteMarkers', [])
+        assert versions == [v1], f"expected v1 to remain as noncurrent, got {versions}"
+        assert len(delete_markers) == 1, f"expected 1 delete marker, got {len(delete_markers)}"
+
+        records = read_journal_records(s3_client, log_bucket, source)
+        lc_records = [r for r in records if r['op_name'] == 'LIFECYCLE.DELETE.OBJECT']
+        assert len(lc_records) == 1, f"expected 1 LIFECYCLE.DELETE.OBJECT record, got {len(lc_records)}"
+        assert lc_records[0]['version_id'] == v1
+        assert lc_records[0]['key'] == 'obj.txt'
+        assert lc_records[0]['bucket_name'] == source
+
+    finally:
+        cleanup_versioned_bucket(s3_client, source)
+        cleanup_bucket(s3_client, log_bucket)
+
+
+@pytest.mark.basic_test
+def test_lc_noncurrent_expiration_logs_journal_record(s3_client, logging_type, lc_fast):
+    """LC NoncurrentVersionExpiration emits LIFECYCLE.DELETE.OBJECT for the deleted noncurrent version."""
+    if logging_type != 'Journal':
+        pytest.skip("LC bucket logging is Journal-mode-only")
+    source = gen_bucket_name("lc-source")
+    log_bucket = gen_bucket_name("lc-log")
+
+    try:
+        assert create_bucket_with_logging(s3_client, source, log_bucket, 'Journal')
+        enable_versioning(s3_client, source)
+
+        apply_lc_config(s3_client, source, [make_lc_rule(NoncurrentVersionExpiration={'NoncurrentDays': 1})])
+        v1 = s3_client.put_object(Bucket=source, Key='obj.txt', Body=b'v1')['VersionId']
+        v2 = s3_client.put_object(Bucket=source, Key='obj.txt', Body=b'v2')['VersionId']  # v1 -> noncurrent
+
+        time.sleep(lc_fast + 2)
+        trigger_lc_processing()
+        time.sleep(lc_fast)
+
+        resp = s3_client.list_object_versions(Bucket=source, Prefix='obj.txt')
+        remaining = [v['VersionId'] for v in resp.get('Versions', [])]
+        assert remaining == [v2], f"expected only current v2 to remain, got {remaining}"
+
+        records = read_journal_records(s3_client, log_bucket, source)
+        lc_records = [r for r in records if r['op_name'] == 'LIFECYCLE.DELETE.OBJECT']
+        assert len(lc_records) == 1, f"expected 1 LIFECYCLE.DELETE.OBJECT record, got {len(lc_records)}"
+        assert lc_records[0]['version_id'] == v1
+        assert lc_records[0]['key'] == 'obj.txt'
+        assert lc_records[0]['bucket_name'] == source
+
+    finally:
+        cleanup_versioned_bucket(s3_client, source)
+        cleanup_bucket(s3_client, log_bucket)
+
+
+@pytest.mark.basic_test
+def test_lc_dm_expiration_does_not_log(s3_client, logging_type, lc_fast):
+    """LC ExpiredObjectDeleteMarker must not emit LIFECYCLE.DELETE.OBJECT records."""
+    if logging_type != 'Journal':
+        pytest.skip("LC bucket logging is Journal-mode-only")
+    source = gen_bucket_name("lc-source")
+    log_bucket = gen_bucket_name("lc-log")
+
+    try:
+        assert create_bucket_with_logging(s3_client, source, log_bucket, 'Journal')
+        enable_versioning(s3_client, source)
+
+        create_orphan_delete_marker(s3_client, source, 'obj.txt')
+        apply_lc_config(s3_client, source, [make_lc_rule(Expiration={'ExpiredObjectDeleteMarker': True})])
+
+        time.sleep(lc_fast + 2)
+        trigger_lc_processing()
+        time.sleep(lc_fast)
+
+        resp = s3_client.list_object_versions(Bucket=source, Prefix='obj.txt')
+        assert not resp.get('Versions') and not resp.get('DeleteMarkers'), "delete marker was not expired, the rule never fired"
+        records = read_journal_records(s3_client, log_bucket, source)
+        lc_records = [r for r in records if r['op_name'] == 'LIFECYCLE.DELETE.OBJECT']
+        assert len(lc_records) == 0, f"expected 0 LIFECYCLE.DELETE.OBJECT records, got {len(lc_records)}"
+
+    finally:
+        cleanup_versioned_bucket(s3_client, source)
+        cleanup_bucket(s3_client, log_bucket)
+
+
+@pytest.mark.basic_test
+def test_lc_current_expiration_dm_branch_does_not_log(s3_client, logging_type, lc_fast):
+    """LC Expiration's delete-marker branch must not emit LIFECYCLE.DELETE.OBJECT records."""
+    if logging_type != 'Journal':
+        pytest.skip("LC bucket logging is Journal-mode-only")
+    source = gen_bucket_name("lc-source")
+    log_bucket = gen_bucket_name("lc-log")
+
+    try:
+        assert create_bucket_with_logging(s3_client, source, log_bucket, 'Journal')
+        enable_versioning(s3_client, source)
+
+        create_orphan_delete_marker(s3_client, source, 'obj.txt')
+        apply_lc_config(s3_client, source, [make_lc_rule(Expiration={'Days': 1})])
+
+        time.sleep(lc_fast + 2)
+        trigger_lc_processing()
+        time.sleep(lc_fast)
+
+        resp = s3_client.list_object_versions(Bucket=source, Prefix='obj.txt')
+        assert not resp.get('Versions') and not resp.get('DeleteMarkers'), "delete marker was not expired -- the rule never fired"
+
+        records = read_journal_records(s3_client, log_bucket, source)
+        lc_records = [r for r in records if r['op_name'] == 'LIFECYCLE.DELETE.OBJECT']
+        assert len(lc_records) == 0, f"expected 0 LIFECYCLE.DELETE.OBJECT records, got {len(lc_records)}"
+
+    finally:
+        cleanup_versioned_bucket(s3_client, source)
+        cleanup_bucket(s3_client, log_bucket)
+
+
+@pytest.mark.basic_test
+def test_lc_runs_safely_without_logging_config(s3_client, lc_fast):
+    """LC runs successfully on a bucket without bucket-logging configured."""
+    source = gen_bucket_name("lc-nolog")
+
+    try:
+        s3_client.create_bucket(Bucket=source)
+        apply_lc_config(s3_client, source, [make_lc_rule(Expiration={'Days': 1})])
+        s3_client.put_object(Bucket=source, Key='obj.txt', Body=b'data')
+
+        time.sleep(lc_fast + 2)
+        _, ret = trigger_lc_processing()
+        assert ret == 0, f"radosgw-admin lc process failed: rc={ret}"
+        assert wait_for_object_gone(s3_client, source, 'obj.txt'), "LC did not delete the object"
+
+    finally:
+        cleanup_bucket(s3_client, source)
\ No newline at end of file

From 391383dae2efb70b1eb346d1073db0ecec1250e2 Mon Sep 17 00:00:00 2001
From: Shubha Jain <SHUBHA.JAIN1@ibm.com>
Date: Tue, 9 Jun 2026 19:04:01 +0530
Subject: [PATCH 176/596] cephadm: report intentionally stopped daemons as
 stopped

node-exporter exits with status 143 when terminated via SIGTERM.
Systemd treats this as a failure by default, causing cephadm to
report an intentionally stopped daemon as being in an error state.

Allow daemon forms to provide daemon-specific success exit status
codes and generate a corresponding systemd SuccessExitStatus
drop-in when required.

For node-exporter, configure exit status 143 as successful so
intentional stops are reported as stopped rather than failed.

Fixes: https://tracker.ceph.com/issues/68863
Signed-off-by: Shubha Jain <SHUBHA.JAIN1@ibm.com>
---
 src/cephadm/cephadm.py                       |  6 +-
 src/cephadm/cephadmlib/container_types.py    |  1 +
 src/cephadm/cephadmlib/daemons/monitoring.py |  5 +-
 src/cephadm/cephadmlib/systemd_unit.py       | 38 +++++++++
 src/cephadm/tests/test_unit_file.py          | 85 ++++++++++++++++++++
 5 files changed, 133 insertions(+), 2 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 7cf65220c80..72e3c77e75e 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -1312,7 +1312,11 @@ def deploy_daemon_units(
         DaemonSubIdentity.must(sc.identity) for sc in sidecars or []
     ]
     systemd_unit.update_files(
-        ctx, ident, init_container_ids=ic_ids, sidecar_ids=sc_ids
+        ctx,
+        ident,
+        init_container_ids=ic_ids,
+        sidecar_ids=sc_ids,
+        success_exit_status=container.success_exit_status,
     )
     call_throws(ctx, ['systemctl', 'daemon-reload'])
 
diff --git a/src/cephadm/cephadmlib/container_types.py b/src/cephadm/cephadmlib/container_types.py
index c38a27d8daa..6c18ffdb4c1 100644
--- a/src/cephadm/cephadmlib/container_types.py
+++ b/src/cephadm/cephadmlib/container_types.py
@@ -254,6 +254,7 @@ class CephContainer(BasicContainer):
         self.remove = True
         self.ipc = 'host'
         self.network = 'host' if self.host_network else ''
+        self.success_exit_status: Optional[List[int]] = None
 
     @classmethod
     def for_daemon(
diff --git a/src/cephadm/cephadmlib/daemons/monitoring.py b/src/cephadm/cephadmlib/daemons/monitoring.py
index d93fc6c68ec..a992ca9db16 100644
--- a/src/cephadm/cephadmlib/daemons/monitoring.py
+++ b/src/cephadm/cephadmlib/daemons/monitoring.py
@@ -215,7 +215,10 @@ class Monitoring(ContainerDaemonForm):
     def container(self, ctx: CephadmContext) -> CephContainer:
         self._prevalidate(ctx)
         ctr = daemon_to_container(ctx, self)
-        return to_deployment_container(ctx, ctr)
+        ctr = to_deployment_container(ctx, ctr)
+        if self.identity.daemon_type == 'node-exporter':
+            ctr.success_exit_status = [143]
+        return ctr
 
     def uid_gid(self, ctx: CephadmContext) -> Tuple[int, int]:
         return self.extract_uid_gid(ctx, self.identity.daemon_type)
diff --git a/src/cephadm/cephadmlib/systemd_unit.py b/src/cephadm/cephadmlib/systemd_unit.py
index d3543174a8d..c76fee4e747 100644
--- a/src/cephadm/cephadmlib/systemd_unit.py
+++ b/src/cephadm/cephadmlib/systemd_unit.py
@@ -16,6 +16,7 @@ from .logging import write_cluster_logrotate_config
 
 
 _DROP_IN_FILENAME = '99-cephadm.conf'
+_SUCCESS_EXIT_STATUS_DROP_IN_FMT = '90-cephadm-{daemon_type}.conf'
 
 
 class PathInfo:
@@ -100,6 +101,39 @@ def _write_sidecar_unit_file(
     )
 
 
+def _install_success_exit_status_drop_in(
+    pinfo: PathInfo,
+    ident: DaemonIdentity,
+    exit_codes: List[int],
+) -> None:
+    """Install a drop-in that marks extra exit codes as success.
+
+    Container runtimes exit with 143 (128 + SIGTERM) on a clean stop.
+    Without an explicit SuccessExitStatus directive systemd treats this
+    as a failure, causing cephadm to report the daemon as ``error``
+    instead of ``stopped``.
+
+    The list of exit codes is carried on the ``CephContainer`` object
+    and populated by the daemon's ``container()`` method, keeping
+    daemon-specific knowledge out of this module.
+    """
+    if not exit_codes:
+        return
+    pinfo.drop_in_file.parent.mkdir(parents=True, exist_ok=True)
+    fname = _SUCCESS_EXIT_STATUS_DROP_IN_FMT.format(
+        daemon_type=ident.daemon_type
+    )
+    dest = pinfo.drop_in_file.parent / fname
+    codes = ' '.join(str(c) for c in exit_codes)
+    content = (
+        '# generated by cephadm\n'
+        '[Service]\n'
+        f'SuccessExitStatus={codes}\n'
+    )
+    with write_new(dest, perms=None) as f:
+        f.write(content)
+
+
 def _install_extended_systemd_services(
     ctx: CephadmContext,
     pinfo: PathInfo,
@@ -203,6 +237,7 @@ def update_files(
     *,
     init_container_ids: Optional[List[DaemonSubIdentity]] = None,
     sidecar_ids: Optional[List[DaemonSubIdentity]] = None,
+    success_exit_status: Optional[List[int]] = None,
 ) -> None:
     _install_base_units(ctx, ident.fsid)
     unit = _get_unit_file(ctx, ident.fsid)
@@ -212,6 +247,9 @@ def update_files(
     _install_extended_systemd_services(
         ctx, pathinfo, ident, bool(init_container_ids)
     )
+    _install_success_exit_status_drop_in(
+        pathinfo, ident, success_exit_status or []
+    )
 
 
 def sidecars_from_dropin(
diff --git a/src/cephadm/tests/test_unit_file.py b/src/cephadm/tests/test_unit_file.py
index 74cd89c1a82..43c2bd24653 100644
--- a/src/cephadm/tests/test_unit_file.py
+++ b/src/cephadm/tests/test_unit_file.py
@@ -19,6 +19,7 @@ from tests.fixtures import (
 from cephadmlib import context
 from cephadmlib import systemd_unit
 from cephadmlib.constants import CGROUPS_SPLIT_PODMAN_VERSION
+from cephadmlib.daemon_identity import DaemonIdentity
 
 _cephadm = import_cephadm()
 
@@ -147,3 +148,87 @@ def test_new_podman():
         '[Install]',
         'WantedBy=ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9.target',
     ]
+
+
+_FSID = '9b9d7609-f4d5-4aba-94c8-effa764d96c9'
+
+
+def test_success_exit_status_drop_in_written(tmp_path):
+    """When exit codes are provided, a drop-in with SuccessExitStatus is
+    written into the service's .d/ directory."""
+    ident = DaemonIdentity(_FSID, 'node-exporter', 'ceph-node-00')
+    pinfo = systemd_unit.PathInfo(tmp_path, ident)
+    systemd_unit._install_success_exit_status_drop_in(
+        pinfo, ident, [143]
+    )
+    fname = systemd_unit._SUCCESS_EXIT_STATUS_DROP_IN_FMT.format(
+        daemon_type='node-exporter'
+    )
+    drop_in = pinfo.drop_in_file.parent / fname
+    assert drop_in.exists()
+    assert fname == '90-cephadm-node-exporter.conf'
+    content = drop_in.read_text()
+    assert '[Service]' in content
+    assert 'SuccessExitStatus=143' in content
+
+
+def test_success_exit_status_drop_in_not_written_for_empty_list(tmp_path):
+    """When exit codes list is empty, no drop-in is created."""
+    ident = DaemonIdentity(_FSID, 'mgr', 'host1')
+    pinfo = systemd_unit.PathInfo(tmp_path, ident)
+    systemd_unit._install_success_exit_status_drop_in(
+        pinfo, ident, []
+    )
+    fname = systemd_unit._SUCCESS_EXIT_STATUS_DROP_IN_FMT.format(
+        daemon_type='mgr'
+    )
+    drop_in = pinfo.drop_in_file.parent / fname
+    assert not drop_in.exists()
+
+
+@mock.patch('cephadmlib.daemons.monitoring.Monitoring._prevalidate')
+@mock.patch('cephadmlib.daemons.monitoring.daemon_to_container')
+@mock.patch('cephadmlib.daemons.monitoring.to_deployment_container')
+def test_monitoring_node_exporter_container_has_success_exit_status(
+    _to_deploy, _to_ctr, _preval
+):
+    """Monitoring.container() sets success_exit_status=[143] for
+    node-exporter."""
+    from cephadmlib.daemons.monitoring import Monitoring
+    from cephadmlib.container_types import CephContainer
+
+    ctx = context.CephadmContext()
+    ctx.container_engine = mock_podman()
+    fake_ctr = mock.MagicMock(spec=CephContainer)
+    fake_ctr.success_exit_status = None
+    _to_deploy.return_value = fake_ctr
+    ident = DaemonIdentity(_FSID, 'node-exporter', 'host1')
+    daemon = Monitoring(ctx, ident)
+    ctr = daemon.container(ctx)
+    assert ctr.success_exit_status == [143]
+
+
+@mock.patch('cephadmlib.daemons.monitoring.Monitoring._prevalidate')
+@mock.patch('cephadmlib.daemons.monitoring.daemon_to_container')
+@mock.patch('cephadmlib.daemons.monitoring.to_deployment_container')
+@pytest.mark.parametrize(
+    'daemon_type',
+    ['prometheus', 'grafana', 'alertmanager', 'loki', 'promtail'],
+)
+def test_monitoring_other_types_no_success_exit_status(
+    _to_deploy, _to_ctr, _preval, daemon_type
+):
+    """Monitoring.container() leaves success_exit_status as None for
+    non-node-exporter types."""
+    from cephadmlib.daemons.monitoring import Monitoring
+    from cephadmlib.container_types import CephContainer
+
+    ctx = context.CephadmContext()
+    ctx.container_engine = mock_podman()
+    fake_ctr = mock.MagicMock(spec=CephContainer)
+    fake_ctr.success_exit_status = None
+    _to_deploy.return_value = fake_ctr
+    ident = DaemonIdentity(_FSID, daemon_type, 'host1')
+    daemon = Monitoring(ctx, ident)
+    ctr = daemon.container(ctx)
+    assert ctr.success_exit_status is None

From 91da0fd6ae6c0b82a4ff59a3b5786c4c34be2865 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 23 Feb 2026 10:39:49 +0100
Subject: [PATCH 177/596] mgr/ceph_secrets: add secret reference types and
 parsing helpers

Introduce the shared types and parsing logic used across the secrets
module: secret scopes, secret references, and the exception hierarchy.
Includes validation for all supported addressing forms and clear
error messages on malformed input.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets_types.py | 342 +++++++++++++++++++++++++++
 1 file changed, 342 insertions(+)
 create mode 100644 src/pybind/mgr/ceph_secrets_types.py

diff --git a/src/pybind/mgr/ceph_secrets_types.py b/src/pybind/mgr/ceph_secrets_types.py
new file mode 100644
index 00000000000..ae2ccd58672
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets_types.py
@@ -0,0 +1,342 @@
+# -*- coding: utf-8 -*-
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from enum import Enum
+from typing import Tuple
+from urllib.parse import urlparse, quote
+
+
+# Internal URI scheme for secret references.
+# Canonical form has no authority: secret:/<namespace>/<scope>/...
+SECRET_SCHEME = 'secret'
+
+
+class CephSecretException(Exception):
+    pass
+
+
+class CephSecretDataError(CephSecretException):
+    pass
+
+
+class CephSecretNotFoundError(CephSecretException):
+    pass
+
+
+# ---------------------------------------------------------------------------
+# Segment grammar
+# ---------------------------------------------------------------------------
+# Accepted characters: alphanumeric, dot, hyphen, underscore.
+# Additional rule: a segment must not end with '.' (Vault API restriction).
+# Applies to: namespace, global name, service/host target and name,
+# and each individual segment of a custom path.
+
+_SEGMENT_RE = re.compile(r'^[A-Za-z0-9._-]+$')
+
+
+def _validate_segment(label: str, value: str) -> None:
+    """Raise ValueError with a field-level message. No URI context — callers re-wrap."""
+    if not isinstance(value, str):
+        raise ValueError(f'{label} must be a string')
+    if not value:
+        raise ValueError(f'{label} must not be empty')
+    if not _SEGMENT_RE.fullmatch(value):
+        raise ValueError(f'{label} contains unsupported characters')
+    if value.endswith('.'):
+        raise ValueError(f"{label} must not end with '.'")
+
+
+def validate_secret_namespace(namespace: str) -> None:
+    """Validate a secret namespace segment. Raises ValueError."""
+    _validate_segment('namespace', namespace)
+
+
+def _validate_custom_path(value: str) -> None:
+    """Validate a slash-delimited custom path. Raises ValueError."""
+    if not isinstance(value, str):
+        raise ValueError('custom path must be a string')
+    if not value:
+        raise ValueError('custom path must not be empty')
+    parts = value.split('/')
+    if any(p == '' for p in parts):
+        raise ValueError('custom path must not contain empty segments')
+    for part in parts:
+        _validate_segment('custom path segment', part)
+
+
+# ---------------------------------------------------------------------------
+# URI serialisation helpers
+# ---------------------------------------------------------------------------
+# With strict segment validation, quoting is effectively a no-op. Kept as
+# defensive correctness for round-trip safety.
+
+def _quote_segment(v: str) -> str:
+    """Percent-encode a single path segment (slashes not preserved)."""
+    return quote(v, safe='')
+
+
+def _quote_custom_path(v: str) -> str:
+    """Percent-encode a custom path, preserving '/' as segment delimiters."""
+    return quote(v, safe='/')
+
+
+# ---------------------------------------------------------------------------
+# Scope
+# ---------------------------------------------------------------------------
+
+class SecretScope(str, Enum):
+    GLOBAL = 'global'
+    SERVICE = 'service'
+    HOST = 'host'
+    CUSTOM = 'custom'
+
+    @classmethod
+    def from_str(cls, s: str) -> 'SecretScope':
+        try:
+            return SecretScope(s)
+        except Exception as e:
+            allowed = ', '.join(x.value for x in SecretScope)
+            raise CephSecretException(
+                f'Invalid secret scope {s!r}. Expected one of: {allowed}'
+            ) from e
+
+    def validate_fields(self, target: str, name: str) -> None:
+        """Validate target/name for this scope. Raises ValueError."""
+        if self == SecretScope.GLOBAL:
+            if target:
+                raise ValueError('target must be empty for global scope')
+            _validate_segment('name', name)
+
+        elif self == SecretScope.CUSTOM:
+            if target:
+                raise ValueError('target must be empty for custom scope')
+            _validate_custom_path(name)
+
+        elif self in (SecretScope.SERVICE, SecretScope.HOST):
+            _validate_segment('target', target)
+            _validate_segment('name', name)
+
+        else:
+            raise ValueError(f'unsupported scope {self!r}')
+
+
+# ---------------------------------------------------------------------------
+# SecretRef
+# ---------------------------------------------------------------------------
+
+@dataclass(frozen=True)
+class SecretRef:
+    namespace: str
+    scope: SecretScope
+    target: str
+    name: str
+
+    def __post_init__(self) -> None:
+        try:
+            scope = (
+                self.scope
+                if isinstance(self.scope, SecretScope)
+                else SecretScope.from_str(str(self.scope))
+            )
+        except CephSecretException as e:
+            raise ValueError(str(e)) from e
+        object.__setattr__(self, 'scope', scope)
+        _validate_segment('namespace', self.namespace)
+        scope.validate_fields(self.target, self.name)
+
+    def ident(self) -> Tuple[str, str, str, str]:
+        return (self.namespace, self.scope.value, self.target, self.name)
+
+    def to_uri(self) -> str:
+        ns = _quote_segment(self.namespace)
+        scope = self.scope.value
+
+        if self.scope == SecretScope.CUSTOM:
+            return f'{SECRET_SCHEME}:/{ns}/{scope}/{_quote_custom_path(self.name)}'
+
+        if self.scope == SecretScope.GLOBAL:
+            return f'{SECRET_SCHEME}:/{ns}/{scope}/{_quote_segment(self.name)}'
+
+        return (
+            f'{SECRET_SCHEME}:/{ns}/{scope}/'
+            f'{_quote_segment(self.target)}/{_quote_segment(self.name)}'
+        )
+
+
+@dataclass(frozen=True)
+class BadSecretURI:
+    raw: str
+    error: str
+    namespace: str
+
+    def to_uri(self) -> str:
+        return self.raw
+
+
+# ---------------------------------------------------------------------------
+# Parsers
+# ---------------------------------------------------------------------------
+
+def parse_secret_uri(uri: str) -> SecretRef:
+    """
+    Parse a secret reference URI.
+
+    Canonical forms:
+      secret:/<namespace>/global/<name>
+      secret:/<namespace>/service/<target>/<name>
+      secret:/<namespace>/host/<target>/<name>
+      secret:/<namespace>/custom/<path>
+
+    All segments must match [A-Za-z0-9._-]+ and must not end with '.'.
+    Percent-encoding, query strings, fragments, and URI authority are not supported.
+    """
+    try:
+        if not isinstance(uri, str):
+            raise CephSecretException('secret uri must be a string')
+
+        parsed = urlparse(uri)
+        if parsed.scheme != SECRET_SCHEME:
+            raise CephSecretException(f'Not a secret uri: {uri!r}')
+        if parsed.query or parsed.fragment:
+            raise CephSecretException(
+                f'Invalid secret uri {uri!r}: query strings and fragments are not supported'
+            )
+        if uri.startswith(f'{SECRET_SCHEME}://') or parsed.netloc:
+            raise CephSecretException(
+                f'Invalid secret uri {uri!r}: authority is not supported; '
+                f'use secret:/<namespace>/<scope>/<path>'
+            )
+
+        # Canonical form: secret:/<namespace>/<scope>/<path>.
+        path = parsed.path or ''
+        if not path.startswith('/'):
+            raise CephSecretException(
+                f'Invalid secret uri {uri!r}: expected secret:/<namespace>/<scope>/<path>'
+            )
+
+        # Reject percent-encoding: the strict segment grammar has a single canonical
+        # spelling for every valid identifier. Accepting encoded aliases (e.g.
+        # db%2Dpassword → db-password, app%2Fdb → app/db) would silently create
+        # multiple URIs that resolve to the same secret.
+        if '%' in path:
+            raise CephSecretException(
+                f'Invalid secret uri {uri!r}: percent-encoding is not supported'
+            )
+
+        # Split on raw '/' — no unquote() needed since percent-encoding is rejected.
+        namespace_raw, sep, remainder = path.lstrip('/').partition('/')
+        scope_raw, sep2, rest_raw = remainder.partition('/') if sep else ('', '', '')
+        if not (sep and sep2):
+            raise CephSecretException(
+                f'Invalid secret uri {uri!r}: expected secret:/<namespace>/<scope>/<path>'
+            )
+
+        scope = SecretScope.from_str(scope_raw)
+
+        if scope in (SecretScope.GLOBAL, SecretScope.CUSTOM):
+            target = ''
+            name = rest_raw
+        else:
+            target_raw, _, name_raw = rest_raw.partition('/')
+            target = target_raw
+            name = name_raw
+
+        # Single construction point: SecretRef validates all fields.
+        # ValueError is re-raised with the original URI for user-facing messages.
+        try:
+            return SecretRef(namespace=namespace_raw, scope=scope, target=target, name=name)
+        except ValueError as e:
+            raise CephSecretException(f'Invalid secret uri {uri!r}: {e}') from e
+
+    except CephSecretException:
+        raise
+    except ValueError as e:
+        raise CephSecretException(str(e)) from e
+    except Exception as e:
+        raise CephSecretException(f'Invalid secret uri {uri!r}: {e}') from e
+
+
+def _coerce_scope(s: str) -> 'SecretScope':
+    # Accept both enum values ('global') and enum names ('GLOBAL').
+    if not s.strip():
+        raise CephSecretException('Scope must not be empty')
+    s_norm = s.strip()
+    try:
+        return SecretScope(s_norm)
+    except Exception:
+        try:
+            return SecretScope[s_norm.upper()]
+        except Exception:
+            allowed = ', '.join(x.value for x in SecretScope)
+            raise CephSecretException(
+                f'Unknown scope {s!r}. Expected one of: {allowed}'
+            )
+
+
+def parse_secret_path(path: str) -> SecretRef:
+    """
+    Parse a secret locator path (no URI scheme, no percent-encoding):
+      <namespace>/global/<name>
+      <namespace>/service/<target>/<name>
+      <namespace>/host/<target>/<name>
+      <namespace>/custom/<any-path>
+
+    Returns a validated SecretRef. Raises CephSecretException on any
+    structural or content error.
+    """
+    if not isinstance(path, str):
+        raise CephSecretException('secret path must be a string')
+
+    p = path.strip()
+    if not p:
+        raise CephSecretException('Invalid secret path: empty')
+
+    if p.startswith('//'):
+        raise CephSecretException(
+            f"Invalid secret path {path!r}: multiple leading slashes are not allowed"
+        )
+    p = p.lstrip('/')
+
+    segs = p.split('/')
+    if any(s == '' for s in segs):
+        raise CephSecretException(
+            f"Invalid secret path {path!r}: empty segment (check for '//' or trailing '/')"
+        )
+    if any(s != s.strip() for s in segs):
+        raise CephSecretException(
+            f"Invalid secret path {path!r}: segments must not contain leading/trailing whitespace"
+        )
+    if len(segs) < 3:
+        raise CephSecretException(
+            f"Invalid secret path {path!r}. Use '<namespace>/<scope>/<path>'."
+        )
+
+    ns, scope_s = segs[0], segs[1]
+    scope = _coerce_scope(scope_s)
+    rest = segs[2:]
+
+    if scope == SecretScope.GLOBAL:
+        if len(rest) != 1:
+            raise CephSecretException(
+                f"Invalid secret path {path!r}: global scope expects '<namespace>/global/<name>'"
+            )
+        target, name = '', rest[0]
+
+    elif scope == SecretScope.CUSTOM:
+        target, name = '', '/'.join(rest)
+
+    elif len(rest) != 2:
+        raise CephSecretException(
+            f"Invalid secret path {path!r}: {scope.value!r} scope expects "
+            f"'<namespace>/{scope.value}/<target>/<name>'"
+        )
+
+    else:
+        target, name = rest[0], rest[1]
+
+    try:
+        return SecretRef(ns, scope, target, name)
+    except ValueError as e:
+        raise CephSecretException(f'Invalid secret path {path!r}: {e}') from e

From 16ae0b3d2bef1b83f1a8a75d2026a9cbd5c372d8 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 26 Jan 2026 14:40:43 +0100
Subject: [PATCH 178/596] mgr/ceph_secrets: add storage backend protocol for
 mgr KV secrets

Define a minimal backend protocol for secret persistence
operations (get/set/rm/list), keeping the module implementation
decoupled from the backing store details. For now we will start with
monstore-db as secure KV store but the idea is to extend this to other
backends such as Vault.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets/backends.py       |  5 ++
 src/pybind/mgr/ceph_secrets/secret_backend.py | 72 +++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 src/pybind/mgr/ceph_secrets/backends.py
 create mode 100644 src/pybind/mgr/ceph_secrets/secret_backend.py

diff --git a/src/pybind/mgr/ceph_secrets/backends.py b/src/pybind/mgr/ceph_secrets/backends.py
new file mode 100644
index 00000000000..83da430d7b3
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/backends.py
@@ -0,0 +1,5 @@
+from .secret_store import SecretStoreMon
+
+BACKENDS = {
+    "mon": SecretStoreMon,
+}
diff --git a/src/pybind/mgr/ceph_secrets/secret_backend.py b/src/pybind/mgr/ceph_secrets/secret_backend.py
new file mode 100644
index 00000000000..af276da7241
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/secret_backend.py
@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*-
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from typing import List, Optional, TYPE_CHECKING
+from ceph_secrets_types import SecretScope
+
+
+if TYPE_CHECKING:
+    # Import only for type-checkers to avoid runtime import cycles
+    from .secret_store import SecretRecord
+
+
+class SecretStorageBackend(ABC):
+    """
+    Abstract base class for ceph secrets storage backends.
+
+    Backends store secret instances addressed by:
+      (namespace, scope, target, name)
+
+    For custom scope, target is empty and name stores the free-form path suffix.
+
+    Epoch:
+      Each namespace has an independent monotonic epoch counter that is bumped
+      on every set and on rm only when an existing secret is actually removed.
+      Consumers can use get_epoch(namespace) as a cheap change-detector to
+      avoid re-fetching secrets when nothing changed in their namespace.
+
+    Implementations:
+      - SecretStoreMon  (Mon KV store)
+      - Vault backend (future)
+    """
+
+    @abstractmethod
+    def get(self, namespace: str, scope: SecretScope, target: str, name: str) -> Optional["SecretRecord"]:
+        ...
+
+    @abstractmethod
+    def set(
+        self,
+        namespace: str,
+        scope: SecretScope,
+        target: str,
+        name: str,
+        data: str,
+        user_made: bool = True,
+        editable: bool = True,
+    ) -> "SecretRecord":
+        ...
+
+    @abstractmethod
+    def rm(self, namespace: str, scope: SecretScope, target: str, name: str) -> bool:
+        ...
+
+    @abstractmethod
+    def ls(
+        self,
+        namespace: Optional[str] = None,
+        scope: Optional[SecretScope] = None,
+        target: Optional[str] = None,
+    ) -> List["SecretRecord"]:
+        ...
+
+    @abstractmethod
+    def get_epoch(self, namespace: str) -> int:
+        """Return the current epoch for *namespace*."""
+        ...
+
+    @abstractmethod
+    def bump_epoch(self, namespace: str) -> int:
+        """Increment and persist the epoch for *namespace*; return the new value."""
+        ...

From 0937270bddae4835a89f3e637732eaa8578f61f1 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 23 Feb 2026 10:44:22 +0100
Subject: [PATCH 179/596] mgr/ceph_secrets: add SecretStoreMon mon-kv store
 implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce SecretRecord (data, metadata, versioning, timestamps) and
the canonical KV prefix (secret_store/v1/…). Add JSON serialization
helpers (to_json) including the ability to omit secret data unless
explicitly requested. This commit defines the “what we store and how
it looks” without wiring any mgr interactions yet.

Add SecretStoreMon implementing the backend using mgr’s KV
store (get_store, set_store, prefix listing). Implement set/get/rm
semantics, version increments, and list-by-prefix queries for
namespace/scope/target. This isolates persistence logic from CLI/RPC
concerns and provides deterministic record behavior for later layers.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets/secret_store.py | 536 ++++++++++++++++++++
 1 file changed, 536 insertions(+)
 create mode 100644 src/pybind/mgr/ceph_secrets/secret_store.py

diff --git a/src/pybind/mgr/ceph_secrets/secret_store.py b/src/pybind/mgr/ceph_secrets/secret_store.py
new file mode 100644
index 00000000000..c8508d8b089
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/secret_store.py
@@ -0,0 +1,536 @@
+# -*- coding: utf-8 -*-
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional, Tuple, Union
+
+from ceph_secrets_types import (
+    SecretScope,
+    SecretRef,
+    CephSecretException,
+    CephSecretDataError,
+    validate_secret_namespace,
+)
+from .secret_backend import SecretStorageBackend
+
+
+logger = logging.getLogger(__name__)
+
+
+# Secret data lives under this prefix:  secret_store/v1/<ns>/<scope>/...
+SECRET_STORE_PREFIX = 'secret_store/v1/'
+
+# Storage payload schema version. Stored records are strict: unknown or missing fields are rejected
+SECRET_STORE_FORMAT_VERSION = 1
+
+# Per-namespace epoch keys live under a completely separate prefix so they are
+# never picked up by the secret data scan in ls().
+# Key form:  secret_store/meta/<namespace>/_epoch
+SECRET_META_PREFIX = 'secret_store/meta/'
+
+
+JsonType = Union[
+    None,
+    bool,
+    int,
+    float,
+    str,
+    List["JsonType"],
+    Dict[str, "JsonType"],
+]
+
+JsonDict = Dict[str, JsonType]
+
+# Secret data is an opaque string. Callers are responsible for any structure
+# within it, for example JSON-encoding a dict before storing and decoding after
+# retrieval.
+SecretData = str
+
+
+def _checked_namespace(namespace: str) -> str:
+    try:
+        validate_secret_namespace(namespace)
+    except ValueError as e:
+        raise CephSecretDataError(str(e)) from e
+    return namespace
+
+
+def _epoch_key(namespace: str) -> str:
+    namespace = _checked_namespace(namespace)
+    return f'{SECRET_META_PREFIX}{namespace}/_epoch'
+
+
+def _checked_ref(
+    namespace: str,
+    scope: Union[SecretScope, str],
+    target: str,
+    name: str,
+) -> SecretRef:
+    try:
+        if not isinstance(scope, SecretScope):
+            scope = SecretScope.from_str(str(scope))
+        return SecretRef(
+            namespace=namespace,
+            scope=scope,
+            target=target or '',
+            name=name,
+        )
+    except (CephSecretException, ValueError) as e:
+        raise CephSecretDataError(str(e)) from e
+
+
+def _now_iso() -> str:
+    return (
+        datetime.now(timezone.utc)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace('+00:00', 'Z')
+    )
+
+
+def _expect_object(label: str, value: Any) -> JsonDict:
+    if not isinstance(value, dict):
+        raise CephSecretDataError(
+            f'{label} must be a JSON object (got {type(value).__name__})'
+        )
+    return value
+
+
+def _reject_unknown_keys(label: str, payload: JsonDict, allowed: set[str]) -> None:
+    unknown = set(payload) - allowed
+    if unknown:
+        raise CephSecretDataError(
+            f'{label} contains unknown field(s): {", ".join(sorted(unknown))}'
+        )
+
+
+def _require_keys(label: str, payload: JsonDict, required: set[str]) -> None:
+    missing = required - set(payload)
+    if missing:
+        raise CephSecretDataError(
+            f'{label} is missing required field(s): {", ".join(sorted(missing))}'
+        )
+
+
+def _expect_bool(label: str, value: Any) -> bool:
+    if not isinstance(value, bool):
+        raise CephSecretDataError(f'{label} must be a boolean')
+    return value
+
+
+def _expect_str(label: str, value: Any) -> str:
+    if not isinstance(value, str):
+        raise CephSecretDataError(f'{label} must be a string')
+    return value
+
+
+def _expect_positive_int(label: str, value: Any) -> int:
+    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
+        raise CephSecretDataError(f'{label} must be a positive integer')
+    return value
+
+
+def _ref_json(ref: SecretRef) -> JsonDict:
+    return {
+        'namespace': ref.namespace,
+        'scope': ref.scope.value,
+        'target': ref.target,
+        'name': ref.name,
+    }
+
+
+@dataclass(frozen=True)
+class SecretMetadata:
+    version: int = 1
+    created: str = ''
+    updated: str = ''
+
+    def __post_init__(self) -> None:
+        _expect_positive_int('SecretMetadata.version', self.version)
+        _expect_str('SecretMetadata.created', self.created)
+        _expect_str('SecretMetadata.updated', self.updated)
+
+    def to_json(self) -> JsonDict:
+        return {
+            'version': self.version,
+            'created': self.created,
+            'updated': self.updated,
+        }
+
+    @staticmethod
+    def from_json(payload: JsonDict) -> 'SecretMetadata':
+        payload = _expect_object('SecretMetadata', payload)
+        allowed = {'version', 'created', 'updated'}
+        _reject_unknown_keys('SecretMetadata', payload, allowed)
+        _require_keys('SecretMetadata', payload, allowed)
+        return SecretMetadata(
+            version=_expect_positive_int('SecretMetadata.version', payload['version']),
+            created=_expect_str('SecretMetadata.created', payload['created']),
+            updated=_expect_str('SecretMetadata.updated', payload['updated']),
+        )
+
+
+@dataclass(frozen=True)
+class SecretPolicy:
+    user_made: bool = True
+    editable: bool = True
+
+    def __post_init__(self) -> None:
+        _expect_bool('SecretPolicy.user_made', self.user_made)
+        _expect_bool('SecretPolicy.editable', self.editable)
+
+    def to_json(self) -> JsonDict:
+        return {
+            'user_made': self.user_made,
+            'editable': self.editable,
+        }
+
+    @staticmethod
+    def from_json(payload: JsonDict) -> 'SecretPolicy':
+        payload = _expect_object('SecretPolicy', payload)
+        allowed = {'user_made', 'editable'}
+        _reject_unknown_keys('SecretPolicy', payload, allowed)
+        _require_keys('SecretPolicy', payload, allowed)
+        return SecretPolicy(
+            user_made=_expect_bool('SecretPolicy.user_made', payload['user_made']),
+            editable=_expect_bool('SecretPolicy.editable', payload['editable']),
+        )
+
+
+@dataclass
+class SecretRecord:
+    ref: SecretRef
+    data: SecretData
+    metadata: SecretMetadata = field(default_factory=SecretMetadata)
+    policy: SecretPolicy = field(default_factory=SecretPolicy)
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.ref, SecretRef):
+            raise CephSecretDataError('SecretRecord.ref must be a SecretRef')
+        if not isinstance(self.metadata, SecretMetadata):
+            raise CephSecretDataError('SecretRecord.metadata must be SecretMetadata')
+        if not isinstance(self.policy, SecretPolicy):
+            raise CephSecretDataError('SecretRecord.policy must be SecretPolicy')
+        if not isinstance(self.data, str):
+            raise CephSecretDataError('SecretRecord.data must be a string')
+        if self.data == '':
+            raise CephSecretDataError('SecretRecord.data must not be empty')
+
+    # Compatibility/readability helpers for key construction, sorting, and callers
+    # that need the identity but should not mutate it directly.
+    @property
+    def namespace(self) -> str:
+        return self.ref.namespace
+
+    @property
+    def scope(self) -> SecretScope:
+        return self.ref.scope
+
+    @property
+    def target(self) -> str:
+        return self.ref.target
+
+    @property
+    def name(self) -> str:
+        return self.ref.name
+
+    def ident(self) -> Tuple[str, str, str, str]:
+        return self.ref.ident()
+
+    def to_public_json(
+        self,
+        include_data: bool = False,
+        include_policy: bool = False,
+        include_ref: bool = False,
+    ) -> JsonDict:
+        result: JsonDict = {
+            'metadata': self.metadata.to_json(),
+        }
+        if include_ref:
+            result['ref'] = _ref_json(self.ref)
+        if include_data:
+            result['data'] = self.data
+        if include_policy:
+            result['policy'] = self.policy.to_json()
+        return result
+
+    def to_store_json(self) -> JsonDict:
+        return {
+            'format_version': SECRET_STORE_FORMAT_VERSION,
+            'metadata': self.metadata.to_json(),
+            'policy': self.policy.to_json(),
+            'data': self.data,
+        }
+
+    @staticmethod
+    def from_store_json(ref: SecretRef, payload: JsonDict) -> 'SecretRecord':
+        payload = _expect_object('SecretRecord', payload)
+        allowed = {'format_version', 'metadata', 'data', 'policy'}
+        _reject_unknown_keys('SecretRecord', payload, allowed)
+        _require_keys('SecretRecord', payload, allowed)
+
+        format_version = payload['format_version']
+        if (
+            not isinstance(format_version, int)
+            or isinstance(format_version, bool)
+            or format_version != SECRET_STORE_FORMAT_VERSION
+        ):
+            raise CephSecretDataError(
+                f'unsupported SecretRecord.format_version: {format_version!r}'
+            )
+
+        metadata = _expect_object('SecretRecord.metadata', payload['metadata'])
+        data = _expect_str('SecretRecord.data', payload['data'])
+        policy = _expect_object('SecretRecord.policy', payload['policy'])
+        return SecretRecord(
+            ref=ref,
+            metadata=SecretMetadata.from_json(metadata),
+            data=data,
+            policy=SecretPolicy.from_json(policy),
+        )
+
+
+class SecretStoreMon(SecretStorageBackend):
+    """
+    Mon KV-store backed secret store.
+
+    Secret data keys:
+      secret_store/v1/<namespace>/<scope>/<target>/<secret_name>
+
+    Stored payload shape:
+      {
+        "format_version": 1,
+        "metadata": {"version": 1, "created": "...", "updated": "..."},
+        "policy": {"user_made": true, "editable": true}
+        "data": "<opaque string>",
+      }
+
+    Per-namespace epoch keys (never touched by ls()):
+      secret_store/meta/<namespace>/_epoch
+    """
+
+    def __init__(self, mgr: Any) -> None:
+        self.mgr = mgr
+
+    # ------------------------------------------------------------------ epoch
+
+    def get_epoch(self, namespace: str) -> int:
+        """Return the current epoch for *namespace* (0 if never set)."""
+        raw = self.mgr.get_store(_epoch_key(namespace))
+        if raw is None:
+            return 0
+        try:
+            return int(str(raw))
+        except Exception:
+            return 0
+
+    def bump_epoch(self, namespace: str) -> int:
+        """Increment and persist the epoch for *namespace*; return the new value.
+
+        Best-effort: the mon KV store has no atomic read-modify-write, so there
+        is a theoretical TOCTOU window under concurrent mutations.  This is
+        acceptable because the epoch is used only as a cheap change-detector,
+        not as a consistency guarantee.
+        """
+        epoch = self.get_epoch(namespace) + 1
+        self.mgr.set_store(_epoch_key(namespace), str(epoch))
+        return epoch
+
+    # ------------------------------------------------------------------ helpers
+
+    def _kv_key_from_ref(self, ref: SecretRef) -> str:
+        if ref.scope == SecretScope.CUSTOM:
+            return f'{SECRET_STORE_PREFIX}{ref.namespace}/{ref.scope.value}/{ref.name}'
+
+        if ref.scope == SecretScope.GLOBAL:
+            return f'{SECRET_STORE_PREFIX}{ref.namespace}/{ref.scope.value}/{ref.name}'
+
+        return (
+            f'{SECRET_STORE_PREFIX}{ref.namespace}/{ref.scope.value}/'
+            f'{ref.target}/{ref.name}'
+        )
+
+    # ------------------------------------------------------------------ CRUD
+
+    def get(self, namespace: str, scope: SecretScope, target: str, name: str) -> Optional[SecretRecord]:
+        ref = _checked_ref(namespace, scope, target, name)
+        k = self._kv_key_from_ref(ref)
+        raw = self.mgr.get_store(k)
+        if raw is None:
+            return None
+        try:
+            payload = json.loads(raw)
+            if not isinstance(payload, dict):
+                raise CephSecretDataError(
+                    f'expected a JSON object, got {type(payload).__name__}'
+                )
+            return SecretRecord.from_store_json(ref, payload)
+        except CephSecretDataError:
+            raise
+        except Exception as e:
+            msg = f"Corrupted secret entry at {k}: {e}"
+            logger.warning(msg)
+            raise CephSecretDataError(msg) from e
+
+    def set(self,
+            namespace: str,
+            scope: SecretScope,
+            target: str,
+            name: str,
+            data: SecretData,
+            user_made: bool = True,
+            editable: bool = True) -> SecretRecord:
+
+        if not isinstance(data, str):
+            raise CephSecretException('Secret data must be a string')
+        if data == '':
+            raise CephSecretException('Secret data must not be empty')
+
+        ref = _checked_ref(namespace, scope, target, name)
+        existing = None
+        try:
+            existing = self.get(ref.namespace, ref.scope, ref.target, ref.name)
+            if existing and not existing.policy.editable:
+                raise CephSecretException(f'Secret {ref.to_uri()} is not editable')
+        except CephSecretDataError as e:
+            raise CephSecretException(f'Secret {ref.to_uri()} is corrupted.') from e
+
+        now = _now_iso()
+        if existing:
+            metadata = SecretMetadata(
+                version=existing.metadata.version + 1,
+                # Preserve the original creation timestamp across updates.
+                created=existing.metadata.created or now,
+                updated=now,
+            )
+        else:
+            metadata = SecretMetadata(version=1, created=now, updated=now)
+
+        rec = SecretRecord(
+            ref=ref,
+            metadata=metadata,
+            policy=SecretPolicy(user_made=user_made, editable=editable),
+            data=data,
+        )
+        k = self._kv_key_from_ref(ref)
+        self.mgr.set_store(k, json.dumps(rec.to_store_json(), sort_keys=True))
+
+        # Bump epoch after a successful write so consumers can detect any change
+        # in this namespace without enumerating all secrets.
+        self.bump_epoch(ref.namespace)
+        return rec
+
+    def rm(
+        self,
+        namespace: str,
+        scope: SecretScope,
+        target: str,
+        name: str,
+    ) -> bool:
+        ref = _checked_ref(namespace, scope, target, name)
+        k = self._kv_key_from_ref(ref)
+        existed = self.mgr.get_store(k) is not None
+        self.mgr.set_store(k, None)
+        if existed:
+            self.bump_epoch(ref.namespace)
+        return existed
+
+    def ls(
+        self,
+        namespace: Optional[str] = None,
+        scope: Optional[SecretScope] = None,
+        target: Optional[str] = None,
+    ) -> List[SecretRecord]:
+        """
+        List secrets matching the given filters.
+
+        Corrupt/malformed module-owned entries are data errors, not part of the
+        normal listing contract, so they are raised as CephSecretDataError.
+        """
+        if namespace is not None:
+            _checked_namespace(namespace)
+        if scope is not None and not isinstance(scope, SecretScope):
+            scope = SecretScope.from_str(str(scope))
+
+        # list by prefix for efficiency
+        prefix = SECRET_STORE_PREFIX
+        if namespace:
+            prefix += f'{namespace}/'
+            if scope:
+                prefix += f'{scope.value}/'
+                if target and scope not in (SecretScope.GLOBAL, SecretScope.CUSTOM):
+                    prefix += f'{target}/'
+        items = self.mgr.get_store_prefix(prefix) or {}
+        records: List[SecretRecord] = []
+
+        for k, v in items.items():
+            # k is full key: secret_store/v1/ns/scope/target/name
+            suffix = k[len(SECRET_STORE_PREFIX):]
+            parts = suffix.split('/')
+
+            # reject keys with empty segments (double slash, trailing slash, etc.)
+            if '' in parts:
+                raise CephSecretDataError(f'{k}: empty path component in key')
+
+            if len(parts) < 3:
+                raise CephSecretDataError(f'{k}: unexpected key structure')
+
+            ns, sc = parts[0], parts[1]
+
+            try:
+                sc_enum = SecretScope.from_str(sc)
+            except Exception as e:
+                raise CephSecretDataError(f'{k}: invalid scope {sc!r}: {e}') from e
+
+            if sc_enum == SecretScope.CUSTOM:
+                tgt = ''
+                name = '/'.join(parts[2:])
+            elif sc_enum == SecretScope.GLOBAL:
+                if len(parts) != 3:
+                    raise CephSecretDataError(f'{k}: unexpected global key structure')
+                tgt = ''
+                name = parts[2]
+            else:
+                if len(parts) != 4:
+                    raise CephSecretDataError(
+                        f'{k}: unexpected targeted-scope key structure'
+                    )
+                tgt = parts[2]
+                name = parts[3]
+
+            try:
+                ref = SecretRef(ns, sc_enum, tgt, name)
+            except ValueError as e:
+                raise CephSecretDataError(f'{k}: invalid secret key: {e}') from e
+
+            # apply caller filters
+            if namespace and ref.namespace != namespace:
+                continue
+            if scope and ref.scope != scope:
+                continue
+            if target and ref.target != target:
+                continue
+
+            # parse payload
+            try:
+                payload = json.loads(v)
+            except Exception as e:
+                raise CephSecretDataError(f'{k}: invalid JSON payload: {e}') from e
+
+            if not isinstance(payload, dict):
+                raise CephSecretDataError(
+                    f'{k}: payload is not a JSON object (got {type(payload).__name__})'
+                )
+
+            try:
+                records.append(SecretRecord.from_store_json(ref, payload))
+            except CephSecretDataError as e:
+                raise CephSecretDataError(f'{k}: {e}') from e
+            except Exception as e:
+                raise CephSecretDataError(f'{k}: corrupted secret record: {e}') from e
+
+        records.sort(key=lambda r: (r.ref.namespace, r.ref.scope.value, r.ref.target, r.ref.name))
+        return records

From 9c220eec0eac3bec950116b1ee0d8ce8d2b3a80a Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 26 Jan 2026 14:46:39 +0100
Subject: [PATCH 180/596] mgr/ceph_secrets: add SecretMgr for secrets handling
 and resolution
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce SecretMgr to encapsulate higher-level behavior on top of
SecretStoreMon: listing helpers, scan_refs, scan_unresolved_refs, and
resolve_object (walk nested dict/list structures). This keeps
parsing/substitution logic out of the mgr module entrypoint and makes
consumer behavior consistent. The module can now resolve secret://…
references deterministically and provide structured scan output.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets/secret_mgr.py | 217 ++++++++++++++++++++++
 1 file changed, 217 insertions(+)
 create mode 100644 src/pybind/mgr/ceph_secrets/secret_mgr.py

diff --git a/src/pybind/mgr/ceph_secrets/secret_mgr.py b/src/pybind/mgr/ceph_secrets/secret_mgr.py
new file mode 100644
index 00000000000..d957be59275
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/secret_mgr.py
@@ -0,0 +1,217 @@
+# -*- coding: utf-8 -*-
+import logging
+from typing import Any, List, Optional, Set, Union, Hashable, Protocol
+
+from .secret_store import SecretRecord, SecretData
+from ceph_secrets_types import (
+    CephSecretException,
+    CephSecretNotFoundError,
+    SecretRef,
+    BadSecretURI,
+    SecretScope,
+    parse_secret_uri,
+    SECRET_SCHEME
+)
+
+
+_SECRET_URI_PREFIX = f'{SECRET_SCHEME}:/'
+
+
+logger = logging.getLogger(__name__)
+
+
+class SecretURI(Protocol, Hashable):
+    def to_uri(self) -> str:
+        ...
+
+
+def _coerce_scope(scope: Union[SecretScope, str]) -> SecretScope:
+    if isinstance(scope, SecretScope):
+        return scope
+    return SecretScope.from_str(str(scope))
+
+
+class SecretMgr:
+    """
+    Phase 1: Mon-store backend only.
+
+    Secret data is an opaque string.  Callers are responsible for any
+    structure within it (e.g. JSON-encoding a dict before storing and
+    decoding after retrieval).  resolve_object() substitutes a secret URI
+    with the stored string directly.
+    """
+
+    def __init__(self, store: Any) -> None:
+        self.store = store
+
+    def make_ref(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str = '',
+        name: str = '',
+    ) -> SecretRef:
+        try:
+            return SecretRef(
+                namespace=namespace,
+                scope=_coerce_scope(scope),
+                target=target or '',
+                name=name,
+            )
+        except ValueError as e:
+            raise CephSecretException(str(e)) from e
+
+    def get(self, ref: SecretRef) -> SecretRecord:
+        rec = self.store.get(ref.namespace, ref.scope, ref.target, ref.name)
+        if rec is None:
+            raise CephSecretNotFoundError(f"Secret not found: {ref.to_uri()}")
+        return rec
+
+    def get_value(self, ref: SecretRef) -> str:
+        """Return the opaque data string for a secret."""
+        rec = self.get(ref)
+        return rec.data
+
+    def set(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+        data: SecretData,
+        user_made: bool = True,
+        editable: bool = True,
+    ) -> SecretRecord:
+        if not isinstance(data, str):
+            raise CephSecretException('Secret data must be a string')
+        if data == '':
+            raise CephSecretException('Secret data must not be empty')
+
+        ref = self.make_ref(namespace, scope, target, name)
+        return self.store.set(
+            ref.namespace,
+            ref.scope,
+            ref.target,
+            ref.name,
+            data,
+            user_made,
+            editable,
+        )
+
+    def rm(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+    ) -> bool:
+        ref = self.make_ref(namespace, scope, target, name)
+        return self.store.rm(ref.namespace, ref.scope, ref.target, ref.name)
+
+    def ls(
+        self,
+        namespace: Optional[str] = None,
+        scope: Optional[Union[SecretScope, str]] = None,
+        target: Optional[str] = None,
+    ) -> List[SecretRecord]:
+        sc = _coerce_scope(scope) if scope else None
+        return self.store.ls(namespace=namespace, scope=sc, target=target)
+
+    def scan_unresolved_refs(self, obj: Any, namespace: str) -> Set[SecretURI]:
+        """
+        Return secret refs found in `obj` that cannot be fetched.
+        """
+        unresolved: Set[SecretURI] = set()
+        for ref in self.scan_refs(obj, namespace):
+            if isinstance(ref, SecretRef):
+                try:
+                    self.get_value(ref)
+                except CephSecretException:
+                    unresolved.add(ref)
+            else:
+                unresolved.add(ref)
+        return unresolved
+
+    def scan_refs(self, obj: Any, namespace: str) -> Set[SecretURI]:
+        """Collect secret references from *obj*.
+
+        A reference must be the *entire* (stripped) value of a string field —
+        e.g. ``"secret:/ns/global/pw"``.  Embedded URIs inside a larger string
+        (e.g. ``"Bearer secret:/..."``) are not supported and are surfaced as
+        a BadSecretURI rather than silently ignored, so validation can flag
+        them before deploy.
+        """
+        refs: Set[SecretURI] = set()
+
+        def _scan(v: Any) -> None:
+            if isinstance(v, dict):
+                for vv in v.values():
+                    _scan(vv)
+            elif isinstance(v, (list, tuple)):
+                for vv in v:
+                    _scan(vv)
+            elif isinstance(v, str):
+                s = v.strip()
+                if s.startswith(_SECRET_URI_PREFIX):
+                    try:
+                        refs.add(parse_secret_uri(s))
+                    except Exception as e:
+                        logger.warning("Failed to parse secret uri %r: %s", s, e)
+                        refs.add(BadSecretURI(raw=s, namespace=namespace, error=str(e)))
+                elif _SECRET_URI_PREFIX in s:
+                    # Contains a secret URI but is not a whole-value reference.
+                    err = ('embedded secret URIs are not supported; the entire '
+                           'field value must be the secret URI')
+                    logger.warning("Rejecting embedded secret uri in %r", v)
+                    refs.add(BadSecretURI(raw=v, namespace=namespace, error=err))
+                # otherwise: plain data, not a reference
+
+        _scan(obj)
+        return refs
+
+    def _resolve_secret_uri(self, uri: str) -> str:
+        """Resolve a single secret URI to its opaque data string."""
+        try:
+            parsed_secret = parse_secret_uri(uri)
+        except CephSecretException as e:
+            raise CephSecretException(f"Invalid secret URI {uri!r}: {e}") from e
+        if not isinstance(parsed_secret, SecretRef):
+            raise CephSecretException(f"Invalid secret URI {uri!r}")
+        return self.get_value(parsed_secret)
+
+    def _resolve(self, v: Any) -> Any:
+        """Recursively resolve secret URIs within a nested structure."""
+        if isinstance(v, dict):
+            return {k: self._resolve(vv) for k, vv in v.items()}
+        if isinstance(v, list):
+            return [self._resolve(vv) for vv in v]
+        if isinstance(v, tuple):
+            return tuple(self._resolve(vv) for vv in v)
+        if isinstance(v, str):
+            s = v.strip()
+            if s.startswith(_SECRET_URI_PREFIX):
+                return self._resolve_secret_uri(s)
+            if _SECRET_URI_PREFIX in s:
+                # A field that embeds a secret URI inside other text would be
+                # deployed verbatim (leaking the unresolved placeholder).  Fail
+                # loudly rather than silently passing it through.
+                raise CephSecretException(
+                    f"Invalid secret reference {v!r}: embedded secret URIs are "
+                    f"not supported; the entire field value must be the secret URI"
+                )
+        return v
+
+    def resolve_object(self, obj: Any) -> Any:
+        """Resolve secret references within nested dict/list/tuple structures.
+
+        A string whose entire (stripped) value is a secret URI is replaced by
+        the stored opaque data string for that secret.  Surrounding whitespace
+        around an otherwise-clean URI is tolerated; non-secret strings are
+        returned unchanged, preserving their original whitespace.
+
+        A string that embeds a secret URI inside other text (e.g.
+        ``"Bearer secret:/..."``) is rejected with CephSecretException, since
+        partial substitution is not supported and silently emitting the literal
+        URI would leak an unresolved placeholder into deployed configuration.
+        """
+        return self._resolve(obj)

From 5cfab473be7f572ade239f3f009ed9ffe9fb0f4c Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Fri, 24 Oct 2025 16:30:16 +0530
Subject: [PATCH 181/596] mgr/cephadm: For updating NFS backends in HAProxy,
 send a SIGHUP signal to reload the configuration instead of restart Fixes:
 https://tracker.ceph.com/issues/73633

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py                        |  4 +-
 src/pybind/mgr/cephadm/serve.py               | 20 ++++++----
 .../mgr/cephadm/services/cephadmservice.py    | 14 +++----
 src/pybind/mgr/cephadm/services/ingress.py    | 38 +++++++++++++------
 src/pybind/mgr/cephadm/services/jaeger.py     | 11 +++---
 src/pybind/mgr/cephadm/services/monitoring.py |  6 +--
 src/pybind/mgr/cephadm/services/nfs.py        |  6 +--
 src/pybind/mgr/cephadm/utils.py               | 11 ++++++
 8 files changed, 71 insertions(+), 39 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 201b0319ba9..f5b96ff712b 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4909,8 +4909,8 @@ def _add_deploy_parser_args(
     )
     parser_deploy.add_argument(
         '--send-signal-to-daemon',
-        action='store_true',
-        default=False,
+        type=str,
+        default=None,
         help='Send signal to daemon'
     )
 
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 4f5d37250e2..2c8ef279db2 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1203,27 +1203,29 @@ class CephadmServe:
             else:
                 # method uses new action enum type
                 _scheduled_action = utils.Action.create(scheduled_action)
-                _action = svc_obj.choose_next_action(
+                _step = svc_obj.choose_next_action(
                     _scheduled_action,
                     dd.daemon_type,
                     spec,
                     curr_deps=deps,
                     last_deps=last_deps,
                 )
-                if _action is not _scheduled_action:
+                if _step.action is not _scheduled_action:
                     self.log.info(
                         (
                             'Daemon %s chose new action %s (was %s)'
                             ' (deps: %r, last_deps: %r)'
                         ),
                         dd.name(),
-                        _action,
+                        _step.action,
                         _scheduled_action,
                         deps,
                         last_deps,
                     )
                     # convert back to legacy str type
-                    action = str(_action)
+                    action = str(_step.action)
+                skip_restart_for_reconfig = _step.skip_restart_for_reconfig
+                send_signal_to_daemon = _step.send_signal_to_daemon
             action = _ceph_service_next_action(
                 action, dd.daemon_type, dd.name(), self.mgr, last_config
             )
@@ -1233,9 +1235,13 @@ class CephadmServe:
                     action = 'redeploy'
                 try:
                     daemon_spec = CephadmDaemonDeploySpec.from_daemon_description(dd)
-                    self.mgr._daemon_action(daemon_spec, action=action,
-                                            skip_restart_for_reconfig=skip_restart_for_reconfig,
-                                            send_signal_to_daemon=send_signal_to_daemon)
+                    reconfig_extras: dict[str, Any] = {}
+                    if skip_restart_for_reconfig:
+                        reconfig_extras['skip_restart_for_reconfig'] = True
+                    if send_signal_to_daemon:
+                        reconfig_extras['send_signal_to_daemon'] = send_signal_to_daemon
+                    self.mgr._daemon_action(daemon_spec, action=action, **reconfig_extras)
+
                     if self.mgr.cache.rm_scheduled_daemon_action(dd.hostname, dd.name()):
                         self.mgr.cache.save_host(dd.hostname)
                 except OrchestratorError as e:
diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index c95d845aa8a..636eb0ddcc6 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -956,13 +956,13 @@ class CephadmService(metaclass=ABCMeta):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
         """
         if curr_deps == last_deps:
-            return scheduled_action
+            return utils.NextDaemonStep(scheduled_action)
         sym_diff = set(curr_deps).symmetric_difference(last_deps)
         logger.info(
             'Reconfigure wanted %s: deps %r -> %r (diff %r)',
@@ -971,7 +971,7 @@ class CephadmService(metaclass=ABCMeta):
             curr_deps,
             sym_diff,
         )
-        return utils.Action.RECONFIG
+        return utils.NextDaemonStep(utils.Action.RECONFIG)
 
 
 class CephService(CephadmService):
@@ -1970,7 +1970,7 @@ class CephExporterService(CephService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
@@ -2084,7 +2084,7 @@ def next_action_for_mgmt_stack_service(
     spec: Optional[ServiceSpec],
     curr_deps: List[str],
     last_deps: List[str],
-) -> utils.Action:
+) -> utils.NextDaemonStep:
     """This function exists to help refactor existing code to use
     choose_next_action instead of if-blocks inside serve.py.
     It avoids the need to muck around with common base classes at the
@@ -2092,7 +2092,7 @@ def next_action_for_mgmt_stack_service(
     Call this from choose_next_action.
     """
     if curr_deps == last_deps:
-        return scheduled_action
+        return utils.NextDaemonStep(scheduled_action)
     sym_diff = set(curr_deps).symmetric_difference(last_deps)
     logger.info(
         'Reconfigure wanted %s: deps %r -> %r (diff %r)',
@@ -2123,4 +2123,4 @@ def next_action_for_mgmt_stack_service(
     # If so we ought to be able to vastly simplify this...
     if any(svc in e for e in sym_diff for svc in REDEPLOY_TRIGGERS):
         action = utils.Action.REDEPLOY
-    return action
+    return utils.NextDaemonStep(action)
diff --git a/src/pybind/mgr/cephadm/services/ingress.py b/src/pybind/mgr/cephadm/services/ingress.py
index 05d8525b9fd..d546d73bae9 100644
--- a/src/pybind/mgr/cephadm/services/ingress.py
+++ b/src/pybind/mgr/cephadm/services/ingress.py
@@ -555,14 +555,15 @@ class IngressService(CephService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
         """
-        action = super().choose_next_action(
+        step = super().choose_next_action(
             scheduled_action, daemon_type, spec, curr_deps, last_deps
         )
+        action = step.action
         if (
             action is not utils.Action.REDEPLOY
             and daemon_type == 'haproxy'
@@ -570,13 +571,26 @@ class IngressService(CephService):
             and hasattr(spec, 'backend_service')
         ):
             backend_spec = self.mgr.spec_store[spec.backend_service].spec
-            if (
-                backend_spec.service_type == 'nfs'
-                and self.has_placement_changed(last_deps, spec)
-            ):
-                logger.debug(
-                    'Redeploy wanted %s: placement has changed',
-                    spec.service_name(),
-                )
-                action = utils.Action.REDEPLOY
-        return action
+            if backend_spec.service_type == 'nfs':
+                if self.has_placement_changed(last_deps, spec):
+                    logger.debug(
+                        'Redeploy wanted %s: placement has changed',
+                        spec.service_name(),
+                    )
+                    return utils.NextDaemonStep(utils.Action.REDEPLOY)
+                sym_diff = set(curr_deps).symmetric_difference(last_deps)
+                if sym_diff and all(
+                    s.startswith(f'nfs.{backend_spec.service_id}')
+                    for s in sym_diff
+                ):
+                    logger.debug(
+                        'Reconfigure HAProxy with SIGHUP due to change in NFS backend '
+                        '(%s)',
+                        spec.service_name(),
+                    )
+                    return utils.NextDaemonStep(
+                        utils.Action.RECONFIG,
+                        skip_restart_for_reconfig=True,
+                        send_signal_to_daemon='SIGHUP',
+                    )
+        return step
diff --git a/src/pybind/mgr/cephadm/services/jaeger.py b/src/pybind/mgr/cephadm/services/jaeger.py
index 1d60680cc0f..8d69c53cec8 100644
--- a/src/pybind/mgr/cephadm/services/jaeger.py
+++ b/src/pybind/mgr/cephadm/services/jaeger.py
@@ -1,3 +1,4 @@
+from dataclasses import replace
 from typing import List, cast, Optional, TYPE_CHECKING
 from cephadm.services.cephadmservice import CephadmService, CephadmDaemonDeploySpec
 from ceph.deployment.service_spec import TracingSpec, ServiceSpec
@@ -57,20 +58,20 @@ class JaegerAgentService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
         """
-        action = super().choose_next_action(
+        step = super().choose_next_action(
             scheduled_action, daemon_type, spec, curr_deps, last_deps
         )
         # changes to jaeger-agent deps affect the way the unit.run for
         # the daemon is written, which we rewrite on redeploy, but not
         # on reconfig.
-        if action is utils.Action.RECONFIG:
-            action = utils.Action.REDEPLOY
-        return action
+        if step.action is utils.Action.RECONFIG:
+            return replace(step, action=utils.Action.REDEPLOY)
+        return step
 
 
 @register_cephadm_service
diff --git a/src/pybind/mgr/cephadm/services/monitoring.py b/src/pybind/mgr/cephadm/services/monitoring.py
index 86f0aa0a8e8..71a19a7583d 100644
--- a/src/pybind/mgr/cephadm/services/monitoring.py
+++ b/src/pybind/mgr/cephadm/services/monitoring.py
@@ -485,7 +485,7 @@ class AlertmanagerService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
@@ -796,7 +796,7 @@ class PrometheusService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
@@ -863,7 +863,7 @@ class NodeExporterService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
diff --git a/src/pybind/mgr/cephadm/services/nfs.py b/src/pybind/mgr/cephadm/services/nfs.py
index 28d5ec7bed9..45d7aad1b9c 100644
--- a/src/pybind/mgr/cephadm/services/nfs.py
+++ b/src/pybind/mgr/cephadm/services/nfs.py
@@ -578,13 +578,13 @@ class NFSService(CephService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
-    ) -> utils.Action:
+    ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
         this service would prefer cephadm take.
         """
         if curr_deps == last_deps:
-            return scheduled_action
+            return utils.NextDaemonStep(scheduled_action)
         sym_diff = set(curr_deps).symmetric_difference(last_deps)
         logger.info(
             'Reconfigure wanted %s: deps %r -> %r (diff %r)',
@@ -598,4 +598,4 @@ class NFSService(CephService):
         only_kmip_updated = all(s.startswith('kmip') for s in sym_diff)
         if not only_kmip_updated:
             action = utils.Action.REDEPLOY
-        return action
+        return utils.NextDaemonStep(action)
diff --git a/src/pybind/mgr/cephadm/utils.py b/src/pybind/mgr/cephadm/utils.py
index 8221b950af4..92725badc55 100644
--- a/src/pybind/mgr/cephadm/utils.py
+++ b/src/pybind/mgr/cephadm/utils.py
@@ -1,6 +1,7 @@
 import logging
 import json
 import socket
+from dataclasses import dataclass
 from enum import Enum
 from functools import wraps
 from typing import (
@@ -92,6 +93,16 @@ class Action(str, Enum):
         return self.value
 
 
+@dataclass(frozen=True)
+class NextDaemonStep:
+    """Result of CephadmService.choose_next_action: high-level action plus
+    optional reconfig hints (e.g. HAProxy reload via signal instead of restart).
+    """
+    action: Action
+    skip_restart_for_reconfig: bool = False
+    send_signal_to_daemon: Optional[str] = None
+
+
 def name_to_config_section(name: str) -> ConfEntity:
     """
     Map from daemon names to ceph entity names (as seen in config)

From 349c12c6d0ca67157e75bc6cba63de525b9b1e97 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 26 Jan 2026 15:14:35 +0100
Subject: [PATCH 182/596] mgr/ceph_secrets: add 'ceph secret' CLI commands and
 input parsing

This commit has the following changes:

1) Add the ceph_secrets mgr module entrypoint and wire it to
SecretMgr. Implement the core RPC surface consumed by other mgr
modules (secret_ls/get/set/rm, secret_get_value, secret_get_version)
and keep the implementation focused on the internal API.

2) Add user-facing CLI commands (ceph secret ls/get/set/rm) using
parse_secret_path. Secret data is accepted via -i (inbuf) only for
script-friendly usage. Add secret get-value for plain-string output
without a JSON envelope. Ensure consistent JSON output and error
mapping to EINVAL/ENOENT, while preserving safe non-reveal defaults
unless explicitly requested.

3) Add the scanning and resolution helpers (scan_refs,
scan_unresolved_refs, resolve_object) through the ceph_secrets module
RPC API. This lets consumers reliably detect secret:/... references and
resolve them inside nested objects without duplicating logic. The
behavior is delegated to SecretMgr to keep parsing/resolution
consistent across the stack.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets/__init__.py |   2 +
 src/pybind/mgr/ceph_secrets/cli.py      |   3 +
 src/pybind/mgr/ceph_secrets/module.py   | 365 ++++++++++++++++++++++++
 3 files changed, 370 insertions(+)
 create mode 100644 src/pybind/mgr/ceph_secrets/__init__.py
 create mode 100644 src/pybind/mgr/ceph_secrets/cli.py
 create mode 100644 src/pybind/mgr/ceph_secrets/module.py

diff --git a/src/pybind/mgr/ceph_secrets/__init__.py b/src/pybind/mgr/ceph_secrets/__init__.py
new file mode 100644
index 00000000000..ee85dc9d376
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/__init__.py
@@ -0,0 +1,2 @@
+# flake8: noqa
+from .module import Module
diff --git a/src/pybind/mgr/ceph_secrets/cli.py b/src/pybind/mgr/ceph_secrets/cli.py
new file mode 100644
index 00000000000..eef1820f112
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/cli.py
@@ -0,0 +1,3 @@
+from mgr_module import CLICommandBase
+
+CephSecretsCLICommand = CLICommandBase.make_registry_subtype("CephSecretsCLICommand")
diff --git a/src/pybind/mgr/ceph_secrets/module.py b/src/pybind/mgr/ceph_secrets/module.py
new file mode 100644
index 00000000000..5e5e5b22db7
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/module.py
@@ -0,0 +1,365 @@
+# -*- coding: utf-8 -*-
+import functools
+from typing import Any, Dict, List, Optional, Callable, Tuple, TypeVar, Union
+import errno
+
+from .cli import CephSecretsCLICommand
+from object_format import ObjectFormatAdapter, ErrorResponse, Responder
+from mgr_module import (
+    MgrModule,
+    Option
+)
+from .secret_mgr import SecretMgr
+from ceph_secrets_types import (
+    CephSecretException,
+    CephSecretDataError,
+    CephSecretNotFoundError,
+    SecretRef,
+    SecretScope,
+    parse_secret_path,
+    parse_secret_uri,
+)
+from .backends import BACKENDS
+
+
+_T = TypeVar('_T')
+
+
+def _handle_secret_errors(fn: Callable[..., _T]) -> Callable[..., _T]:
+    """Decorator for CLI handlers: converts CephSecretException into
+    ErrorResponse so that Responder / ErrorResponseHandler can catch it."""
+    @functools.wraps(fn)
+    def wrapper(*args: Any, **kwargs: Any) -> _T:
+        try:
+            return fn(*args, **kwargs)
+        except CephSecretException as e:
+            raise ErrorResponse(str(e)) from e
+    return wrapper
+
+
+class Module(MgrModule):
+    """Standalone secrets mgr module.
+
+    This module owns the mgr KV-store entries for secrets (namespace: mgr/secrets)
+    and provides both:
+      - RPC methods for other mgr modules via `remote(...)`
+      - CLI commands: `ceph secret ...`
+
+    Storage keys inside the mgr KV store:
+      secret data:   secret_store/v1/<namespace>/<scope>/...
+      epoch (meta):  secret_store/meta/<namespace>/_epoch
+
+    Epoch is per-namespace: a mutation in namespace A does not affect the epoch
+    of namespace B, so consumers only see changes relevant to their namespace.
+    Epoch logic lives entirely in the store backend so future backends
+    (e.g. Vault) can implement it natively.
+
+    Method organisation:
+      - Public methods (no leading underscore): RPC surface called via
+        mgr.remote(). Accept individual kwargs for wire-format compatibility.
+        Each delegates immediately to the corresponding _secret_* method.
+      - Private _secret_* methods: real implementations, operate on SecretRef.
+        Called directly by CLI handlers and internal code.
+    """
+    CLICommand = CephSecretsCLICommand
+
+    MODULE_OPTIONS = [
+        Option(
+            'secrets_backend',
+            type='str',
+            default='mon',
+            desc='Secrets storage backend. Currently only "mon" (Mon KV store) is supported.',
+        ),
+    ]
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        backend_name: str = str(self.get_module_option('secrets_backend'))
+        try:
+            backend_cls = BACKENDS[backend_name]
+        except KeyError as e:
+            raise RuntimeError(
+                f"Unsupported secrets backend: {backend_name}"
+            ) from e
+        try:
+            self.secret_mgr = SecretMgr(backend_cls(self))
+        except Exception as e:
+            raise RuntimeError(
+                f"Failed to initialize secrets backend '{backend_name}': {e}"
+            ) from e
+
+    # ------------------------------------------------------------------ epoch
+
+    def secret_get_epoch(self, namespace: str) -> int:
+        """Return the current epoch for *namespace*.
+
+        Consumers (e.g., cephadm) can use this as a cheap change-detector:
+        if the epoch hasn't changed since the last check, no secrets in this
+        namespace have been mutated.
+        """
+        return self.secret_mgr.store.get_epoch(namespace)
+
+    # ------------------------------------------------------------------ RPC surface
+
+    def secret_ls(
+        self,
+        namespace: Optional[str] = None,
+        scope: Optional[str] = None,
+        target: Optional[str] = None,
+        show_values: bool = False,
+        show_internals: bool = False,
+    ) -> Dict[str, Any]:
+        sc = SecretScope.from_str(scope) if scope else None
+        records = self.secret_mgr.ls(namespace=namespace, scope=sc, target=target)
+        out: Dict[str, Any] = {}
+        for r in records:
+            if r.ref.target:
+                key = f'{r.ref.namespace}/{r.ref.scope.value}/{r.ref.target}/{r.ref.name}'
+            else:
+                key = f'{r.ref.namespace}/{r.ref.scope.value}/{r.ref.name}'
+            out[key] = r.to_public_json(
+                include_data=bool(show_values),
+                include_policy=show_internals,
+                include_ref=True,
+            )
+        return out
+
+    def secret_get(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+        reveal: bool = False,
+    ) -> Optional[Dict[str, Any]]:
+        """RPC surface — called via mgr.remote(). Internal code uses _secret_get()."""
+        return self._secret_get(
+            self.secret_mgr.make_ref(namespace, scope, target, name),
+            reveal=reveal,
+        )
+
+    def secret_get_value(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+    ) -> Optional[str]:
+        """RPC surface — return the raw secret data string, or None if not found.
+
+        Called via mgr.remote(). Internal code uses _secret_get_value().
+        """
+        return self._secret_get_value(
+            self.secret_mgr.make_ref(namespace, scope, target, name)
+        )
+
+    def secret_get_version(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+    ) -> Optional[int]:
+        """RPC surface — called via mgr.remote(). Internal code uses _secret_get_version()."""
+        return self._secret_get_version(
+            self.secret_mgr.make_ref(namespace, scope, target, name)
+        )
+
+    def secret_get_versions(self, uris: List[str]) -> Dict[str, Optional[int]]:
+        """Batch-fetch version numbers for a list of secret URIs.
+
+        Each entry in *uris* must be a canonical ``secret:/...`` URI, such as
+        one returned by ``SecretRef.to_uri()``. URIs that cannot be parsed are
+        skipped and logged at ERROR level; a missing key in the result indicates
+        malformed input rather than a not-found secret.
+
+        Note that ``scan_refs()`` may also return malformed or embedded
+        secret-like strings for validation/reporting. Callers should pass only
+        canonical ``secret:/...`` URIs to this method.
+
+        Returns a dict keyed by the input URI mapping to the current version
+        integer, or ``None`` if the secret does not exist.
+        """
+        out: Dict[str, Optional[int]] = {}
+        for uri in uris or []:
+            try:
+                ref = parse_secret_uri(uri)
+            except CephSecretException:
+                self.log.error(
+                    "secret_get_versions: skipping invalid URI %r",
+                    uri, exc_info=True
+                )
+                continue
+            out[uri] = self._secret_get_version(ref)  # CephSecretDataError propagates
+        return out
+
+    def secret_set(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+        data: str,
+        user_made: bool = True,
+        editable: bool = True,
+    ) -> Dict[str, Any]:
+        """RPC surface — called via mgr.remote(). Internal code uses _secret_set()."""
+        return self._secret_set(
+            self.secret_mgr.make_ref(namespace, scope, target, name),
+            data=data,
+            user_made=user_made,
+            editable=editable,
+        )
+
+    def secret_rm(
+        self,
+        namespace: str,
+        scope: Union[SecretScope, str],
+        target: str,
+        name: str,
+    ) -> bool:
+        """RPC surface — called via mgr.remote(). Internal code uses _secret_rm()."""
+        return self._secret_rm(self.secret_mgr.make_ref(namespace, scope, target, name))
+
+    def resolve_object(self, obj: Any) -> Any:
+        return self.secret_mgr.resolve_object(obj)
+
+    def scan_refs(self, obj: Any, namespace: str) -> List[str]:
+        return sorted({u.to_uri() for u in
+                       self.secret_mgr.scan_refs(obj, namespace)})
+
+    def scan_unresolved_refs(self, obj: Any, namespace: str) -> List[str]:
+        return sorted({u.to_uri() for u in
+                       self.secret_mgr.scan_unresolved_refs(obj, namespace)})
+
+    # ------------------------------------------------------------------ ref-based implementations
+
+    def _secret_get(self, ref: SecretRef, reveal: bool = False) -> Optional[Dict[str, Any]]:
+        try:
+            rec = self.secret_mgr.get(ref)
+        except CephSecretDataError:
+            # Corruption is not the same as absence; let callers/CLI report a
+            # data error instead of returning the same sentinel as "not found".
+            raise
+        except CephSecretNotFoundError:
+            return None
+        return rec.to_public_json(include_data=reveal, include_policy=False, include_ref=False)
+
+    def _secret_get_value(self, ref: SecretRef) -> Optional[str]:
+        """Return the raw data string for a secret, or None if not found."""
+        try:
+            rec = self.secret_mgr.get(ref)
+        except CephSecretDataError:
+            raise
+        except CephSecretNotFoundError:
+            return None
+        return rec.data
+
+    def _secret_get_version(self, ref: SecretRef) -> Optional[int]:
+        try:
+            rec = self.secret_mgr.get(ref)
+        except CephSecretDataError:
+            raise
+        except CephSecretNotFoundError:
+            return None
+        return rec.metadata.version
+
+    def _secret_set(
+        self,
+        ref: SecretRef,
+        data: str,
+        user_made: bool = True,
+        editable: bool = True,
+    ) -> Dict[str, Any]:
+        rec = self.secret_mgr.set(
+            namespace=ref.namespace,
+            scope=ref.scope,
+            target=ref.target,
+            name=ref.name,
+            data=data,
+            user_made=user_made,
+            editable=editable,
+        )
+        return rec.to_public_json(include_data=False, include_policy=False, include_ref=False)
+
+    def _secret_rm(self, ref: SecretRef) -> bool:
+        return self.secret_mgr.rm(ref.namespace, ref.scope, ref.target, ref.name)
+
+    # ------------------------------------------------------------------ CLI commands
+
+    @CephSecretsCLICommand.Read('secret ls')
+    @Responder(functools.partial(ObjectFormatAdapter, compatible=True))
+    @_handle_secret_errors
+    def _cli_secret_ls(
+        self,
+        namespace: Optional[str] = None,
+        scope: Optional[str] = None,
+        sec_target: Optional[str] = None,
+        reveal: bool = False,
+        show_internals: bool = False,
+    ) -> Dict[str, Any]:
+        return self.secret_ls(
+            namespace=namespace,
+            scope=scope,
+            target=sec_target,
+            show_values=reveal,
+            show_internals=show_internals,
+        )
+
+    @CephSecretsCLICommand.Read('secret get')
+    @Responder(functools.partial(ObjectFormatAdapter, compatible=True))
+    @_handle_secret_errors
+    def _cli_secret_get_by_path(
+        self,
+        path: str,
+        reveal: bool = False,
+    ) -> Dict[str, Any]:
+        ref = parse_secret_path(path)
+        res = self._secret_get(ref, reveal=reveal)
+        if res is None:
+            raise ErrorResponse('secret error: not found', return_value=-errno.ENOENT)
+        return res
+
+    @CephSecretsCLICommand.Read('secret get-value')
+    @_handle_secret_errors
+    def _cli_secret_get_value_by_path(
+        self,
+        path: str,
+    ) -> Tuple[int, str, str]:
+        """Return the raw secret data string for the given path.
+
+        Unlike ``secret get --reveal``, this command outputs the secret value
+        directly as a plain string with no JSON envelope, making it suitable
+        for use in shell scripts and pipelines.
+        """
+        ref = parse_secret_path(path)
+        value = self._secret_get_value(ref)
+        if value is None:
+            raise ErrorResponse('secret error: not found', return_value=-errno.ENOENT)
+        return 0, value, ''
+
+    @CephSecretsCLICommand.Write('secret set')
+    @Responder(functools.partial(ObjectFormatAdapter, compatible=True))
+    @_handle_secret_errors
+    def _cli_secret_set_by_path(
+        self,
+        path: str,
+        inbuf: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        if inbuf is None:
+            raise ErrorResponse('secret error: use -i to provide secret data')
+        if inbuf == '':
+            raise ErrorResponse('secret error: secret data must not be empty')
+        ref = parse_secret_path(path)
+        return self._secret_set(ref, data=inbuf)
+
+    @CephSecretsCLICommand.Write('secret rm')
+    @Responder(functools.partial(ObjectFormatAdapter, compatible=True))
+    @_handle_secret_errors
+    def _cli_secret_rm_by_path(
+        self,
+        path: str,
+    ) -> Dict[str, Any]:
+        ref = parse_secret_path(path)
+        existed = self._secret_rm(ref)
+        return {'status': 'removed' if existed else 'not_found'}

From e737f8b73fed73980528d1cd71211e5d71d9778b Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 26 Jan 2026 14:51:44 +0100
Subject: [PATCH 183/596] mgr: add CephSecretsClient wrapper for ceph_secrets
 RPC

Add a thin typed client around mgr.remote() for consuming the
ceph_secrets module. Exposes get/set/rm, epoch and version queries,
batch version fetch, scan and resolve helpers. Lives alongside
ceph_secrets_types.py so any mgr module can import it without
depending on the ceph_secrets package directly.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets_client.py | 363 ++++++++++++++++++++++++++
 1 file changed, 363 insertions(+)
 create mode 100644 src/pybind/mgr/ceph_secrets_client.py

diff --git a/src/pybind/mgr/ceph_secrets_client.py b/src/pybind/mgr/ceph_secrets_client.py
new file mode 100644
index 00000000000..2386de71043
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets_client.py
@@ -0,0 +1,363 @@
+# -*- coding: utf-8 -*-
+from __future__ import annotations
+
+import logging
+from typing import Any, Dict, List, Optional, Protocol, Union
+
+from ceph_secrets_types import SecretScope
+
+logger = logging.getLogger(__name__)
+
+ScopeArg = Union[SecretScope, str]
+
+
+class MgrRemote(Protocol):
+    """Minimal interface required from the mgr object."""
+    def remote(self, module: str, method: str, **kwargs: Any) -> Any:
+        ...
+
+
+class CephSecretsClient:
+    """Thin client for calling the ceph_secrets mgr module via mgr.remote().
+
+    This file lives in src/pybind/mgr/ alongside ceph_secrets_types.py so
+    any mgr module can import it without depending on the ceph_secrets module
+    directory directly.
+
+    All methods translate to a single mgr.remote() call and raise RuntimeError
+    if the ceph_secrets module is unreachable (e.g. not enabled).
+
+    Typical usage::
+
+        client = CephSecretsClient(self)   # self is a MgrModule instance
+        rec = client.secret_get("cephadm", SecretScope.HOST, "node1", "ssh_key")
+        if rec:
+            version = rec["metadata"]["version"]
+    """
+
+    DEFAULT_MODULE = "ceph_secrets"
+
+    def __init__(self, mgr: MgrRemote, module: str = DEFAULT_MODULE) -> None:
+        self.mgr = mgr
+        self.module = module
+
+    def _remote(self, method: str, **kwargs: Any) -> Any:
+        try:
+            return self.mgr.remote(self.module, method, **kwargs)
+        except Exception as e:
+            raise RuntimeError(
+                f"Cannot call secrets mgr-module '{self.module}' (is it enabled?) {e}"
+            ) from e
+
+    # ---- epoch ----
+
+    def secret_get_epoch(self, namespace: str) -> int:
+        """Return the current mutation epoch for *namespace*.
+
+        The epoch is a monotonically increasing integer that is incremented on
+        every successful set and on rm only when an existing secret is actually
+        removed (an idempotent rm returning not-found does not bump the epoch).  It is
+        deliberately per-namespace: a mutation in namespace A does not change
+        the epoch of namespace B.
+
+        Use this as a cheap change-detector: cache the epoch value after your
+        last sync; if it is unchanged on the next poll, no secrets in this
+        namespace have been mutated and you can skip a full refresh.
+
+        Args:
+            namespace: The secret namespace to query (e.g. ``"cephadm"``).
+
+        Returns:
+            The current epoch as a non-negative integer.  Starts at 0 for a
+            namespace that has never been written to.
+        """
+        return self._remote("secret_get_epoch", namespace=namespace)
+
+    # ---- module API wrappers ----
+
+    def secret_get(
+        self,
+        namespace: str,
+        scope: ScopeArg,
+        target: str,
+        name: str,
+        reveal: bool = False,
+    ) -> Optional[Dict[str, Any]]:
+        """Retrieve a secret record by its full address.
+
+        Returns the secret's metadata and, if *reveal* is True, its data
+        payload.  Returns ``None`` if the secret does not exist; raises
+        RuntimeError if the module is unreachable.
+
+        The returned dict contains a ``metadata`` object with fields such as ``version``,
+        ``created``, and ``updated``, etc.  It intentionally does not include a
+        ``ref`` object because the caller already supplied the identity.
+        The ``data`` key is only present when *reveal* is True.
+
+        Args:
+            namespace: The secret namespace (e.g. ``"cephadm"``).
+            scope:     The secret scope — a :class:`SecretScope` value or its
+                       string equivalent (``"global"``, ``"service"``,
+                       ``"host"``, ``"custom"``).
+            target:    The scope target.  Must be non-empty for ``service`` and
+                       ``host`` scopes; must be empty for ``global`` and
+                       ``custom``.
+            name:      The secret name or, for ``custom`` scope, the
+                       slash-delimited path (e.g. ``"app/db/password"``).
+            reveal:    If True, include the secret's data payload in the
+                       response.  Defaults to False to avoid accidental
+                       exposure in logs.
+
+        Returns:
+            A dict of the form ``{"metadata": {...}}`` plus optional ``data``,
+        or ``None`` if not found.
+        """
+        return self._remote(
+            "secret_get",
+            namespace=namespace,
+            scope=scope,
+            target=target,
+            name=name,
+            reveal=reveal,
+        )
+
+    def secret_get_value(
+        self,
+        namespace: str,
+        scope: ScopeArg,
+        target: str,
+        name: str,
+    ) -> Optional[str]:
+        """Return the raw secret data string.
+
+        Returns the stored opaque string directly, without any JSON envelope
+        or metadata.  Returns ``None`` if the secret does not exist.
+
+        Use this when you need the secret value itself — for example, to pass
+        a password to a subprocess or to resolve a credential at deploy time.
+        For metadata inspection or change-detection, use :meth:`secret_get` or
+        :meth:`secret_get_version` instead.
+
+        Args:
+            namespace: The secret namespace.
+            scope:     The secret scope.
+            target:    The scope target (empty for ``global`` and ``custom``).
+            name:      The secret name or custom path.
+
+        Returns:
+            The stored string, or ``None`` if the secret does not exist.
+        """
+        return self._remote(
+            "secret_get_value",
+            namespace=namespace,
+            scope=scope,
+            target=target,
+            name=name,
+        )
+
+    def secret_get_version(
+        self,
+        namespace: str,
+        scope: ScopeArg,
+        target: str,
+        name: str,
+    ) -> Optional[int]:
+        """Return the current version number of a secret.
+
+        A convenience wrapper around :meth:`secret_get` for callers that only
+        need to check whether a secret has changed since they last read it,
+        without fetching its payload.
+
+        The version is incremented on every successful :meth:`secret_set` call
+        for the same address.  The first write produces version 1.
+
+        Args:
+            namespace: The secret namespace.
+            scope:     The secret scope.
+            target:    The scope target (empty for ``global`` and ``custom``).
+            name:      The secret name or custom path.
+
+        Returns:
+            The current version as a positive integer, or ``None`` if the
+            secret does not exist.
+        """
+        return self._remote(
+            "secret_get_version",
+            namespace=namespace,
+            scope=scope,
+            target=target,
+            name=name,
+        )
+
+    def secret_get_versions(self, uris: List[str]) -> Dict[str, Optional[int]]:
+        """Batch-fetch version numbers for a list of secret URIs.
+
+        More efficient than calling :meth:`secret_get_version` in a loop when
+        you need to check many secrets at once (e.g. during a cephadm
+        reconciliation pass).
+
+        Each entry in *uris* must be a canonical ``secret:/...`` URI, such as
+        one returned by ``SecretRef.to_uri()``. URIs that cannot be parsed are
+        skipped and logged at ERROR level on the module side; a missing key in
+        the result indicates malformed input rather than a not-found secret.
+
+        Note that :meth:`scan_refs` may also return malformed or embedded
+        secret-like strings for validation/reporting. Pass only canonical
+        ``secret:/...`` URIs to this method.
+
+        Args:
+            uris: A list of canonical secret URIs.  Example::
+
+                    [
+                        "secret:/cephadm/host/node1/ssh_key",
+                        "secret:/cephadm/global/dashboard_password",
+                    ]
+
+        Returns:
+            A dict keyed by the input URI mapping to the current version
+            integer, or ``None`` if the secret does not exist.
+        """
+        return self._remote("secret_get_versions", uris=uris)
+
+    def secret_set(
+        self,
+        namespace: str,
+        scope: ScopeArg,
+        target: str,
+        name: str,
+        data: str,
+        user_made: bool = True,
+        editable: bool = True,
+    ) -> Dict[str, Any]:
+        """Create or update a secret.
+
+        If a secret at the given address already exists its data is replaced
+        and its version is incremented.  If it does not exist it is created at
+        version 1.  The ``created`` timestamp is set on first write and never
+        changed thereafter; ``updated`` is refreshed on every write.
+
+        Args:
+            namespace: The secret namespace.
+            scope:     The secret scope.
+            target:    The scope target (empty for ``global`` and ``custom``).
+            name:      The secret name or custom path.
+            data:      The secret payload as an opaque string.  Callers are
+                       responsible for any structure within it (e.g.
+                       JSON-encoding a dict before storing and decoding after
+                       retrieval).
+            user_made: Whether this secret was created by a human operator
+                       rather than automatically by a Ceph component.  Defaults
+                       to True; set to False for programmatically generated
+                       secrets.
+            editable:  Whether the secret may be updated or removed by
+                       automated tooling.  Defaults to True.
+
+        Returns:
+            A dict containing the written record's ``metadata`` object.  The
+            response intentionally omits ``ref`` and never includes the data
+            payload.
+        """
+        return self._remote(
+            "secret_set",
+            namespace=namespace,
+            scope=scope,
+            target=target,
+            name=name,
+            data=data,
+            user_made=user_made,
+            editable=editable,
+        )
+
+    def secret_rm(
+        self,
+        namespace: str,
+        scope: ScopeArg,
+        target: str,
+        name: str,
+    ) -> bool:
+        """Remove a secret.
+
+        Idempotent: returns False if the secret did not exist rather than
+        raising.  Raises RuntimeError only if the module is unreachable.
+
+        Args:
+            namespace: The secret namespace.
+            scope:     The secret scope.
+            target:    The scope target (empty for ``global`` and ``custom``).
+            name:      The secret name or custom path.
+
+        Returns:
+            True if the secret existed and was removed; False if it was not
+            found.
+        """
+        return bool(
+            self._remote(
+                "secret_rm",
+                namespace=namespace,
+                scope=scope,
+                target=target,
+                name=name,
+            )
+        )
+
+    def scan_unresolved_refs(self, obj: Any, namespace: str) -> Any:
+        """Return all unresolved secret URI references found in *obj*.
+
+        Walks *obj* recursively (dicts, lists, strings) and collects every
+        secret-like reference that cannot currently be resolved because it is
+        missing, malformed, embedded inside a larger string, or cannot be read
+        successfully.
+
+        Useful for validation: call this before deploying a configuration
+        object to detect missing or invalid secret references early.
+
+        Args:
+            obj:       The object to scan.  May be a dict, list, or any
+                       JSON-like structure.
+            namespace: The namespace context used while scanning/reporting
+                       references.
+
+        Returns:
+            A collection of unresolved reference strings found in *obj*.
+        """
+        return self._remote("scan_unresolved_refs", obj=obj, namespace=namespace)
+
+    def scan_refs(self, obj: Any, namespace: str) -> Any:
+        """Return all secret URI references found in *obj*.
+
+        Like :meth:`scan_unresolved_refs` but returns every whole-value secret
+        URI and every malformed or embedded secret-like reference found while
+        scanning. Malformed or embedded entries are returned as their raw string
+        value so callers can report them.
+
+        Useful for auditing which secrets a configuration object depends on and
+        for surfacing malformed or embedded references before deployment.
+
+        Args:
+            obj:       The object to scan.
+            namespace: The namespace context for the scan.
+
+        Returns:
+            A collection of all secret URI strings found in *obj*.
+        """
+        return self._remote("scan_refs", obj=obj, namespace=namespace)
+
+    def resolve_object(self, obj: Any) -> Any:
+        """Resolve all secret URI references in *obj*.
+
+        Walks *obj* recursively and replaces every whole-value ``secret:/...``
+        URI string with the stored opaque string for the referenced secret.
+        Surrounding whitespace around a URI reference is ignored, but embedding
+        a secret URI inside a larger string is rejected because partial
+        substitution is not supported.
+
+        Args:
+            obj: The object to resolve. May be a dict, list, or any JSON-like
+                  structure containing ``secret:/...`` URI strings.
+
+        Returns:
+             A resolved copy of *obj* with all secret URIs replaced by their stored opaque strings.
+             Raises RuntimeError if any referenced secret cannot be resolved
+             or if the module is unreachable.
+        """
+        return self._remote("resolve_object", obj=obj)

From 92981c7687b4959e138b5a8c02fa72d43e2e9294 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Thu, 21 May 2026 15:46:15 +0200
Subject: [PATCH 184/596] mgr/ceph_secrets: add ceph_secrets module to tox.ini

Adds ceph_secrets to tox.ini mypy and flake8 targets.

Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/tox.ini | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/pybind/mgr/tox.ini b/src/pybind/mgr/tox.ini
index 46892ade74e..647b9e45a93 100644
--- a/src/pybind/mgr/tox.ini
+++ b/src/pybind/mgr/tox.ini
@@ -112,6 +112,7 @@ commands =
            -m alerts \
            -m balancer \
            -m cephadm \
+           -m ceph_secrets \
            -m crash \
            -m dashboard \
            -m devicehealth \
@@ -166,6 +167,9 @@ modules =
     alerts \
     balancer \
     cephadm \
+    ceph_secrets \
+    ceph_secrets_client.py \
+    ceph_secrets_types.py \
     cli_api \
     crash \
     devicehealth \

From 431fac7aded8abb60f77fd272b11afc85137419f Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Thu, 11 Jun 2026 10:55:43 +0200
Subject: [PATCH 185/596] mgr/ceph_secrets: add unit tests for all modules

Add pytest coverage for the full stack: secret types and URI/path
parsing, storage backend contract, Mon KV store (CRUD, epoch,
serialization, corruption handling), SecretMgr (scan/resolve),
module RPC surface and CLI handlers, and the CephSecretsClient
wrapper. Gate test imports on the UNITTEST env var following the
SMB module pattern.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/pybind/mgr/ceph_secrets/__init__.py       |   8 +-
 src/pybind/mgr/ceph_secrets/tests/__init__.py |   0
 src/pybind/mgr/ceph_secrets/tests/conftest.py |  20 +
 .../mgr/ceph_secrets/tests/test_backends.py   |  23 +
 .../mgr/ceph_secrets/tests/test_module.py     | 424 ++++++++++++++
 .../ceph_secrets/tests/test_secret_backend.py |  80 +++
 .../mgr/ceph_secrets/tests/test_secret_mgr.py | 339 ++++++++++++
 .../ceph_secrets/tests/test_secret_store.py   | 516 ++++++++++++++++++
 src/pybind/mgr/ceph_secrets_client.py         |   5 +-
 src/pybind/mgr/ceph_secrets_types.py          |  10 +
 .../mgr/tests/test_ceph_secrets_client.py     | 317 +++++++++++
 .../mgr/tests/test_ceph_secrets_types.py      | 487 +++++++++++++++++
 12 files changed, 2226 insertions(+), 3 deletions(-)
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/__init__.py
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/conftest.py
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/test_backends.py
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/test_module.py
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/test_secret_backend.py
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/test_secret_mgr.py
 create mode 100644 src/pybind/mgr/ceph_secrets/tests/test_secret_store.py
 create mode 100644 src/pybind/mgr/tests/test_ceph_secrets_client.py
 create mode 100644 src/pybind/mgr/tests/test_ceph_secrets_types.py

diff --git a/src/pybind/mgr/ceph_secrets/__init__.py b/src/pybind/mgr/ceph_secrets/__init__.py
index ee85dc9d376..b02a13abff1 100644
--- a/src/pybind/mgr/ceph_secrets/__init__.py
+++ b/src/pybind/mgr/ceph_secrets/__init__.py
@@ -1,2 +1,8 @@
-# flake8: noqa
+import os
+
+if 'UNITTEST' in os.environ:
+    import tests  # noqa: F401
+
 from .module import Module
+
+__all__ = ['Module']
diff --git a/src/pybind/mgr/ceph_secrets/tests/__init__.py b/src/pybind/mgr/ceph_secrets/tests/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/ceph_secrets/tests/conftest.py b/src/pybind/mgr/ceph_secrets/tests/conftest.py
new file mode 100644
index 00000000000..3625d3edc9b
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/tests/conftest.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+import pytest
+from mgr_module import MgrModule
+
+
+@pytest.fixture
+def mgr() -> MgrModule:
+    return MgrModule.__new__(MgrModule)
+
+
+@pytest.fixture
+def store(mgr: MgrModule):
+    from ceph_secrets.secret_store import SecretStoreMon
+    return SecretStoreMon(mgr)
+
+
+@pytest.fixture
+def secret_mgr(store):
+    from ceph_secrets.secret_mgr import SecretMgr
+    return SecretMgr(store)
diff --git a/src/pybind/mgr/ceph_secrets/tests/test_backends.py b/src/pybind/mgr/ceph_secrets/tests/test_backends.py
new file mode 100644
index 00000000000..8f40f475066
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/tests/test_backends.py
@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+"""Tests for ceph_secrets.backends (registry of storage backends)."""
+from __future__ import annotations
+
+from ceph_secrets.backends import BACKENDS
+from ceph_secrets.secret_store import SecretStoreMon
+
+
+class TestBackendsRegistry:
+    def test_mon_backend_registered(self):
+        assert "mon" in BACKENDS
+
+    def test_mon_maps_to_correct_class(self):
+        assert BACKENDS["mon"] is SecretStoreMon
+
+    def test_only_known_backends(self):
+        # Update this test when new backends are added.
+        assert set(BACKENDS.keys()) == {"mon"}
+
+    def test_backend_is_instantiable(self, mgr):
+        cls = BACKENDS["mon"]
+        instance = cls(mgr)
+        assert isinstance(instance, SecretStoreMon)
diff --git a/src/pybind/mgr/ceph_secrets/tests/test_module.py b/src/pybind/mgr/ceph_secrets/tests/test_module.py
new file mode 100644
index 00000000000..8728ec8bb07
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/tests/test_module.py
@@ -0,0 +1,424 @@
+# -*- coding: utf-8 -*-
+"""Tests for ceph_secrets.module.Module — RPC surface and internal methods."""
+from __future__ import annotations
+
+import json
+import pytest
+from typing import Any
+from unittest.mock import MagicMock, patch
+
+from ceph_secrets.module import Module
+from ceph_secrets.secret_store import SecretStoreMon
+from ceph_secrets.secret_mgr import SecretMgr
+from ceph_secrets_types import (
+    SecretScope,
+    SecretRef,
+    CephSecretException,
+    CephSecretDataError,
+)
+
+
+# ---------------------------------------------------------------------------
+# Helper: build a Module without going through MgrModule.__init__
+# ---------------------------------------------------------------------------
+
+def _make_module(mgr_stub) -> Module:
+    """Bypass MgrModule.__init__ and wire up manually."""
+    mod = object.__new__(Module)
+    mod.secret_mgr = SecretMgr(SecretStoreMon(mgr_stub))
+    return mod
+
+
+# ---------------------------------------------------------------------------
+# ---------------------------------------------------------------------------
+# Module.__init__ — backend selection
+# ---------------------------------------------------------------------------
+
+class TestModuleInit:
+    def test_default_backend_initialises_secret_mgr(self, mgr):
+        """Module.__init__ with default 'mon' backend wires up SecretMgr."""
+        from mgr_module import MgrModule
+        mod = object.__new__(Module)
+        with patch.object(MgrModule, "__init__", lambda self, *a, **kw: None):
+            with patch.object(MgrModule, "get_module_option", return_value="mon"):
+                Module.__init__(mod, mgr)
+        assert isinstance(mod.secret_mgr, SecretMgr)
+
+    def test_unsupported_backend_raises(self, mgr):
+        """Unknown backend name raises RuntimeError."""
+        from mgr_module import MgrModule
+        with patch.object(MgrModule, "__init__", lambda self, *a, **kw: None):
+            with patch("ceph_secrets.module.BACKENDS", {}):
+                with patch.object(MgrModule, "get_module_option", return_value="vault"):
+                    with pytest.raises(RuntimeError, match="Unsupported secrets backend"):
+                        Module.__init__(object.__new__(Module), mgr)
+
+    def test_backend_init_failure_raises(self, mgr):
+        """Backend constructor failure raises RuntimeError with helpful message."""
+        from mgr_module import MgrModule
+        broken_cls = MagicMock(side_effect=Exception("connection refused"))
+        with patch.object(MgrModule, "__init__", lambda self, *a, **kw: None):
+            with patch("ceph_secrets.module.BACKENDS", {"mon": broken_cls}):
+                with patch.object(MgrModule, "get_module_option", return_value="mon"):
+                    with pytest.raises(RuntimeError, match="Failed to initialize secrets backend"):
+                        Module.__init__(object.__new__(Module), mgr)
+
+
+# ---------------------------------------------------------------------------
+# Module RPC surface
+# ---------------------------------------------------------------------------
+
+class TestModuleRPC:
+    @pytest.fixture
+    def mod(self, mgr):
+        return _make_module(mgr)
+
+    def test_secret_get_epoch_zero(self, mod):
+        assert mod.secret_get_epoch("cephadm") == 0
+
+    def test_secret_get_epoch_after_set(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        assert mod.secret_get_epoch("ns") == 1
+
+    def test_secret_set_and_get(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        result = mod.secret_get("ns", SecretScope.GLOBAL, "", "pw", reveal=True)
+        assert result is not None
+        assert result["data"] == "s3cr3t"
+
+    def test_secret_get_without_reveal_hides_data(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        result = mod.secret_get("ns", SecretScope.GLOBAL, "", "pw", reveal=False)
+        assert result is not None
+        assert "data" not in result
+
+    def test_secret_get_missing_returns_none(self, mod):
+        assert mod.secret_get("ns", SecretScope.GLOBAL, "", "ghost") is None
+
+    def test_secret_get_version_existing(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        assert mod.secret_get_version("ns", SecretScope.GLOBAL, "", "k") == 1
+
+    def test_secret_get_version_missing_returns_none(self, mod):
+        assert mod.secret_get_version("ns", SecretScope.GLOBAL, "", "ghost") is None
+
+    def test_secret_get_value_existing(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        assert mod.secret_get_value("ns", SecretScope.GLOBAL, "", "pw") == "s3cr3t"
+
+    def test_secret_get_value_missing_returns_none(self, mod):
+        assert mod.secret_get_value("ns", SecretScope.GLOBAL, "", "ghost") is None
+
+    def test_secret_get_value_opaque_string(self, mod):
+        # Any string is valid — including one that looks like JSON
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "creds", '{"u": "a", "p": "b"}')
+        assert mod.secret_get_value("ns", SecretScope.GLOBAL, "", "creds") == '{"u": "a", "p": "b"}'
+
+    def test_secret_get_value_corrupt_raises_data_error(self, mgr, mod):
+        mgr.set_store("secret_store/v1/ns/global/bad", "{not json")
+        with pytest.raises(CephSecretDataError):
+            mod.secret_get_value("ns", SecretScope.GLOBAL, "", "bad")
+
+    def test_secret_get_versions_batch(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "a", "data-a")
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "b", "data-b")
+        result = mod.secret_get_versions([
+            "secret:/ns/global/a",
+            "secret:/ns/global/b",
+            "secret:/ns/global/ghost",
+        ])
+        assert result["secret:/ns/global/a"] == 1
+        assert result["secret:/ns/global/b"] == 1
+        assert result["secret:/ns/global/ghost"] is None
+
+    def test_secret_get_versions_skips_invalid_uris(self, mod):
+        result = mod.secret_get_versions(["not-a-uri", "secret:/ns/badscope/key"])
+        assert len(result) == 0
+
+    def test_secret_get_versions_empty_list(self, mod):
+        assert mod.secret_get_versions([]) == {}
+
+    def test_secret_get_versions_corrupt_raises_data_error(self, mgr, mod):
+        """Corruption must not be silently swallowed as a missing/invalid URI."""
+        mgr.set_store("secret_store/v1/ns/global/bad", "{not json")
+        with pytest.raises(CephSecretDataError):
+            mod.secret_get_versions(["secret:/ns/global/bad"])
+
+    def test_secret_set_returns_metadata(self, mod):
+        result = mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        assert "metadata" in result
+        assert result["metadata"]["version"] == 1
+
+    def test_secret_set_empty_data_raises(self, mod):
+        with pytest.raises(CephSecretException, match="must not be empty"):
+            mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "")
+
+    def test_secret_rm_existing(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        assert mod.secret_rm("ns", SecretScope.GLOBAL, "", "k") is True
+
+    def test_secret_rm_nonexistent(self, mod):
+        assert mod.secret_rm("ns", SecretScope.GLOBAL, "", "ghost") is False
+
+    def test_secret_ls_empty(self, mod):
+        assert mod.secret_ls(namespace="ns") == {}
+
+    def test_secret_ls_returns_records(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "a", "data-a")
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "b", "data-b")
+        out = mod.secret_ls(namespace="ns")
+        assert "ns/global/a" in out
+        assert "ns/global/b" in out
+
+    def test_secret_ls_scope_filter(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "g", "data-g")
+        mod.secret_set("ns", SecretScope.SERVICE, "prom", "auth", "data-auth")
+        out = mod.secret_ls(namespace="ns", scope="service")
+        assert all("service" in k for k in out.keys())
+
+    def test_secret_ls_with_target(self, mod):
+        mod.secret_set("ns", SecretScope.SERVICE, "prom", "auth", "data-auth")
+        out = mod.secret_ls(namespace="ns", scope="service", target="prom")
+        assert "ns/service/prom/auth" in out
+
+    def test_secret_ls_show_internals(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        out = mod.secret_ls(namespace="ns", show_internals=True)
+        rec = out["ns/global/k"]
+        assert "policy" in rec
+
+    def test_secret_ls_key_format_global(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        out = mod.secret_ls(namespace="ns")
+        assert "ns/global/k" in out
+        for k in out:
+            assert "//" not in k
+
+    def test_scan_refs(self, mod):
+        result = mod.scan_refs({"key": "secret:/ns/global/pw"}, namespace="ns")
+        assert "secret:/ns/global/pw" in result
+
+    def test_scan_unresolved_refs_all_missing(self, mod):
+        result = mod.scan_unresolved_refs("secret:/ns/global/ghost", namespace="ns")
+        assert "secret:/ns/global/ghost" in result
+
+    def test_scan_unresolved_refs_exists(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "pw", "x")
+        result = mod.scan_unresolved_refs("secret:/ns/global/pw", namespace="ns")
+        assert result == []
+
+    def test_resolve_object(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        result = mod.resolve_object("secret:/ns/global/pw")
+        assert result == "s3cr3t"
+
+
+# ---------------------------------------------------------------------------
+# Module internal ref-based methods
+# ---------------------------------------------------------------------------
+
+class TestModuleInternals:
+    @pytest.fixture
+    def mod(self, mgr):
+        return _make_module(mgr)
+
+    def _ref(self, ns="ns", scope=SecretScope.GLOBAL, target="", name="key"):
+        return SecretRef(ns, scope, target, name)
+
+    def test_secret_get_existing(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "key", "data-x")
+        result = mod._secret_get(self._ref())
+        assert result is not None
+
+    def test_secret_get_not_found(self, mod):
+        assert mod._secret_get(self._ref(name="ghost")) is None
+
+    def test_secret_get_corrupt_raises_data_error(self, mgr, mod):
+        mgr.set_store("secret_store/v1/ns/global/bad", "{not json")
+        with pytest.raises(CephSecretDataError):
+            mod._secret_get(self._ref(name="bad"))
+
+    def test_secret_get_version_existing(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "key", "data-x")
+        assert mod._secret_get_version(self._ref()) == 1
+
+    def test_secret_get_version_not_found(self, mod):
+        assert mod._secret_get_version(self._ref(name="ghost")) is None
+
+    def test_secret_get_version_corrupt_raises_data_error(self, mgr, mod):
+        mgr.set_store("secret_store/v1/ns/global/bad", "{not json")
+        with pytest.raises(CephSecretDataError):
+            mod._secret_get_version(self._ref(name="bad"))
+
+    def test_secret_set_returns_metadata_without_data(self, mod):
+        result = mod._secret_set(self._ref(), "data-x")
+        assert "metadata" in result
+        assert "data" not in result
+
+    def test_secret_rm_existing(self, mod):
+        mod._secret_set(self._ref(), "data-x")
+        assert mod._secret_rm(self._ref()) is True
+
+    def test_secret_rm_nonexistent(self, mod):
+        assert mod._secret_rm(self._ref(name="ghost")) is False
+
+
+# ---------------------------------------------------------------------------
+# CLI handler logic (path-based dispatch)
+# ---------------------------------------------------------------------------
+
+class TestModuleCLIHandlers:
+    @pytest.fixture
+    def mod(self, mgr):
+        return _make_module(mgr)
+
+    def _ok(self, result: Any) -> Any:
+        """Unwrap a Responder tuple (retcode, body, status) → parsed dict.
+        Falls through unchanged when Responder is a no-op stub."""
+        if isinstance(result, tuple):
+            retcode, body, _ = result
+            assert retcode == 0, f"unexpected error retcode {retcode}: {body}"
+            return json.loads(body)
+        return result
+
+    def _assert_error(self, result: Any, match: str = "") -> None:
+        """Assert a CLI call failed — either via a non-zero tuple or ErrorResponse.
+        Never accepts a raw CephSecretException (would mean _handle_secret_errors broke)."""
+        from object_format import ErrorResponse
+        if isinstance(result, tuple):
+            retcode, body, status = result
+            assert retcode != 0, "expected non-zero retcode"
+            if match:
+                assert match in (body + status).lower(), \
+                    f"expected {match!r} in response, got body={body!r} status={status!r}"
+        elif isinstance(result, ErrorResponse):
+            if match:
+                assert match in str(result).lower()
+        else:
+            raise AssertionError(
+                f"expected error tuple or ErrorResponse, got {type(result).__name__}: {result!r}"
+            )
+
+    def test_cli_get_by_path_found(self, mod):
+        mod.secret_set("ns", SecretScope.GLOBAL, "", "key", "data-x")
+        result = self._ok(mod._cli_secret_get_by_path(path="ns/global/key"))
+        assert "metadata" in result
+
+    def test_cli_get_by_path_not_found(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_get_by_path(path="ns/global/ghost")
+            self._assert_error(result, match="not found")
+        except ErrorResponse as e:
+            assert "not found" in str(e).lower()
+
+    def test_cli_get_by_path_bad_path(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_get_by_path(path="ns/badscope/key")
+            self._assert_error(result)
+        except ErrorResponse:
+            pass
+
+    def test_cli_get_corrupt_raises_data_error(self, mgr, mod):
+        from object_format import ErrorResponse
+        mgr.set_store("secret_store/v1/ns/global/bad", "{not json")
+        # CephSecretDataError is a CephSecretException subclass so _handle_secret_errors
+        # wraps it into ErrorResponse; Responder formats it as a non-zero tuple.
+        try:
+            result = mod._cli_secret_get_by_path(path="ns/global/bad")
+            self._assert_error(result)
+        except ErrorResponse:
+            pass
+
+    def test_cli_set_by_path(self, mod):
+        result = self._ok(mod._cli_secret_set_by_path(
+            path="ns/global/key",
+            inbuf="s3cr3t"
+        ))
+        assert result["metadata"]["version"] == 1
+
+    def test_cli_set_by_path_no_inbuf(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_set_by_path(path="ns/global/key", inbuf=None)
+            self._assert_error(result, match="-i")
+        except ErrorResponse as e:
+            assert "-i" in str(e)
+
+    def test_cli_set_by_path_empty_data(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_set_by_path(path="ns/global/key", inbuf="")
+            self._assert_error(result, match="must not be empty")
+        except ErrorResponse as e:
+            assert "must not be empty" in str(e).lower()
+
+    def test_cli_rm_by_path_existing(self, mod):
+        mod._cli_secret_set_by_path(path="ns/global/key", inbuf='{"v": "x"}')
+        result = self._ok(mod._cli_secret_rm_by_path(path="ns/global/key"))
+        assert result["status"] == "removed"
+
+    def test_cli_rm_by_path_not_found(self, mod):
+        result = self._ok(mod._cli_secret_rm_by_path(path="ns/global/ghost"))
+        assert result["status"] == "not_found"
+
+    def test_cli_rm_by_path_bad_path(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_rm_by_path(path="ns/badscope/key")
+            self._assert_error(result)
+        except ErrorResponse:
+            pass
+
+    def test_cli_ls(self, mod):
+        mod._cli_secret_set_by_path(path="ns/global/a", inbuf='{"v": "1"}')
+        mod._cli_secret_set_by_path(path="ns/global/b", inbuf='{"v": "2"}')
+        result = self._ok(mod._cli_secret_ls(namespace="ns"))
+        assert "ns/global/a" in result
+        assert "ns/global/b" in result
+
+    def test_cli_get_with_reveal(self, mod):
+        mod._cli_secret_set_by_path(path="ns/global/pw", inbuf="s3cr3t")
+        result = self._ok(mod._cli_secret_get_by_path(path="ns/global/pw", reveal=True))
+        assert result["data"] == "s3cr3t"
+
+    def test_cli_get_without_reveal_hides_data(self, mod):
+        mod._cli_secret_set_by_path(path="ns/global/pw", inbuf="s3cr3t")
+        result = self._ok(mod._cli_secret_get_by_path(path="ns/global/pw", reveal=False))
+        assert "data" not in result
+
+    def _get_value(self, result: Any) -> str:
+        """Unwrap a get-value tuple (retcode, body, status) → raw string."""
+        if isinstance(result, tuple):
+            retcode, body, _ = result
+            assert retcode == 0, f"unexpected error retcode {retcode}: {body}"
+            return body
+        return result
+
+    def test_cli_get_value_returns_raw_string(self, mod):
+        mod._cli_secret_set_by_path(path="ns/global/pw", inbuf="s3cr3t")
+        result = self._get_value(mod._cli_secret_get_value_by_path(path="ns/global/pw"))
+        assert result == "s3cr3t"
+
+    def test_cli_get_value_not_found_raises(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_get_value_by_path(path="ns/global/ghost")
+            self._assert_error(result)
+        except ErrorResponse:
+            pass
+
+    def test_cli_get_value_bad_path_raises(self, mod):
+        from object_format import ErrorResponse
+        try:
+            result = mod._cli_secret_get_value_by_path(path="ns/badscope/key")
+            self._assert_error(result)
+        except ErrorResponse:
+            pass
+
+    def test_cli_get_value_opaque_json_string(self, mod):
+        payload = '{"u": "a", "p": "b"}'
+        mod._cli_secret_set_by_path(path="ns/global/creds", inbuf=payload)
+        result = self._get_value(mod._cli_secret_get_value_by_path(path="ns/global/creds"))
+        assert result == payload
diff --git a/src/pybind/mgr/ceph_secrets/tests/test_secret_backend.py b/src/pybind/mgr/ceph_secrets/tests/test_secret_backend.py
new file mode 100644
index 00000000000..1b98dd67355
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/tests/test_secret_backend.py
@@ -0,0 +1,80 @@
+# -*- coding: utf-8 -*-
+"""Tests for the SecretStorageBackend ABC and contract."""
+from __future__ import annotations
+
+import pytest
+from abc import ABC
+
+from ceph_secrets.secret_backend import SecretStorageBackend
+from ceph_secrets_types import SecretScope
+
+
+class TestSecretStorageBackend:
+    def test_is_abstract(self):
+        assert issubclass(SecretStorageBackend, ABC)
+
+    def test_cannot_instantiate_directly(self):
+        with pytest.raises(TypeError):
+            SecretStorageBackend()  # type: ignore[abstract]
+
+    def test_concrete_subclass_instantiates(self, store):
+        """SecretStoreMon (the concrete impl) must satisfy the ABC."""
+        assert isinstance(store, SecretStorageBackend)
+
+    def test_abstract_methods_defined(self):
+        abstract = SecretStorageBackend.__abstractmethods__
+        assert 'get' in abstract
+        assert 'set' in abstract
+        assert 'rm' in abstract
+        assert 'ls' in abstract
+        assert 'get_epoch' in abstract
+        assert 'bump_epoch' in abstract
+
+    def test_partial_implementation_still_abstract(self):
+        """Subclass missing any abstract method stays abstract."""
+        class PartialImpl(SecretStorageBackend):
+            def get(self, ns, scope, target, name):
+                pass
+
+            def set(self, ns, scope, target, name, data, user_made=True, editable=True):
+                pass
+
+            def rm(self, ns, scope, target, name):
+                pass
+
+            def ls(self, namespace=None, scope=None, target=None):
+                pass
+
+            def get_epoch(self, namespace):
+                pass
+            # missing bump_epoch
+
+        with pytest.raises(TypeError):
+            PartialImpl()  # type: ignore[abstract]
+
+    def test_full_implementation_is_instantiable(self):
+
+        class FullImpl(SecretStorageBackend):
+
+            def get(self, ns, scope, target, name):
+                return None
+
+            def set(self, ns, scope, target, name, data, user_made=True, editable=True):
+                pass
+
+            def rm(self, ns, scope, target, name):
+                return False
+
+            def ls(self, namespace=None, scope=None, target=None):
+                return []
+
+            def get_epoch(self, namespace):
+                return 0
+
+            def bump_epoch(self, namespace):
+                return 1
+
+        impl = FullImpl()
+        assert impl.get("ns", SecretScope.GLOBAL, "", "k") is None
+        assert impl.get_epoch("ns") == 0
+        assert impl.bump_epoch("ns") == 1
diff --git a/src/pybind/mgr/ceph_secrets/tests/test_secret_mgr.py b/src/pybind/mgr/ceph_secrets/tests/test_secret_mgr.py
new file mode 100644
index 00000000000..a4be58a4432
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/tests/test_secret_mgr.py
@@ -0,0 +1,339 @@
+# -*- coding: utf-8 -*-
+"""Tests for ceph_secrets.secret_mgr (SecretMgr)."""
+from __future__ import annotations
+
+import pytest
+
+from ceph_secrets_types import (
+    SecretScope, SecretRef,
+    CephSecretException, CephSecretNotFoundError,
+    BadSecretURI,
+)
+
+
+# ============================================================
+# make_ref
+# ============================================================
+
+class TestMakeRef:
+    def test_basic(self, secret_mgr):
+        ref = secret_mgr.make_ref("ns", SecretScope.GLOBAL, "", "key")
+        assert isinstance(ref, SecretRef)
+        assert ref.namespace == "ns"
+
+    def test_scope_as_string(self, secret_mgr):
+        ref = secret_mgr.make_ref("ns", "host", "node1", "ssh_key")
+        assert ref.scope == SecretScope.HOST
+
+    def test_bad_scope_raises(self, secret_mgr):
+        with pytest.raises(CephSecretException):
+            secret_mgr.make_ref("ns", "badscope", "", "key")
+
+    def test_bad_namespace_raises(self, secret_mgr):
+        with pytest.raises(CephSecretException):
+            secret_mgr.make_ref("bad ns!", SecretScope.GLOBAL, "", "key")
+
+
+# ============================================================
+# get / get_value
+# ============================================================
+
+class TestGet:
+    def test_get_existing(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "pw")
+        rec = secret_mgr.get(ref)
+        assert rec.data == "s3cr3t"
+
+    def test_get_missing_raises(self, secret_mgr):
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "ghost")
+        with pytest.raises(CephSecretNotFoundError):
+            secret_mgr.get(ref)
+
+    def test_get_value(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "pw")
+        assert secret_mgr.get_value(ref) == "s3cr3t"
+
+    def test_get_value_opaque_string(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "creds", '{"u": "admin", "p": "pw"}')
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "creds")
+        val = secret_mgr.get_value(ref)
+        assert isinstance(val, str)
+        assert val == '{"u": "admin", "p": "pw"}'
+
+    def test_get_value_missing_raises(self, secret_mgr):
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "ghost")
+        with pytest.raises(CephSecretNotFoundError):
+            secret_mgr.get_value(ref)
+
+
+# ============================================================
+# set
+# ============================================================
+
+class TestSet:
+    def test_set_global(self, secret_mgr):
+        rec = secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", "data-v1")
+        assert rec.metadata.version == 1
+        assert rec.data == "data-v1"
+
+    def test_set_service(self, secret_mgr):
+        rec = secret_mgr.set("ns", SecretScope.SERVICE, "prom", "auth", "user-a")
+        assert rec.target == "prom"
+
+    def test_set_custom(self, secret_mgr):
+        rec = secret_mgr.set("ns", SecretScope.CUSTOM, "", "a/b/c", "tok")
+        assert rec.name == "a/b/c"
+
+    def test_set_non_str_raises(self, secret_mgr):
+        with pytest.raises(CephSecretException, match="string"):
+            secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", {"not": "a-string"})  # type: ignore[arg-type]
+
+    def test_set_empty_string_raises(self, secret_mgr):
+        with pytest.raises(CephSecretException, match="must not be empty"):
+            secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", "")
+
+    def test_set_preserves_whitespace_and_newlines(self, secret_mgr):
+        payload = "  secret-value\n"
+        rec = secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", payload)
+        assert rec.data == payload
+        assert secret_mgr.get_value(SecretRef("ns", SecretScope.GLOBAL, "", "k")) == payload
+
+    def test_set_increments_version(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", "data-v1")
+        rec = secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", "data-v2")
+        assert rec.metadata.version == 2
+
+    def test_set_scope_string(self, secret_mgr):
+        rec = secret_mgr.set("ns", "global", "", "k", "data-x")
+        assert rec.scope == SecretScope.GLOBAL
+
+
+# ============================================================
+# rm
+# ============================================================
+
+class TestRm:
+    def test_rm_existing(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        assert secret_mgr.rm("ns", SecretScope.GLOBAL, "", "k") is True
+
+    def test_rm_nonexistent(self, secret_mgr):
+        assert secret_mgr.rm("ns", SecretScope.GLOBAL, "", "ghost") is False
+
+
+# ============================================================
+# ls
+# ============================================================
+
+class TestLs:
+    def test_ls_empty(self, secret_mgr):
+        assert secret_mgr.ls(namespace="ns") == []
+
+    def test_ls_returns_records(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "a", "data-a")
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "b", "data-b")
+        recs = secret_mgr.ls(namespace="ns")
+        assert len(recs) == 2
+
+    def test_ls_scope_filter(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "g", "data-g")
+        secret_mgr.set("ns", SecretScope.SERVICE, "prom", "auth", "data-auth")
+        recs = secret_mgr.ls(namespace="ns", scope="service")
+        assert len(recs) == 1
+        assert recs[0].scope == SecretScope.SERVICE
+
+
+# ============================================================
+# scan_refs / scan_unresolved_refs
+# ============================================================
+
+class TestScanRefs:
+    def test_scan_simple_string(self, secret_mgr):
+        obj = "secret:/ns/global/pw"
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        uris = {r.to_uri() for r in refs}
+        assert "secret:/ns/global/pw" in uris
+
+    def test_scan_in_dict(self, secret_mgr):
+        obj = {"key": "secret:/ns/global/pw"}
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        assert len(refs) == 1
+
+    def test_scan_in_list(self, secret_mgr):
+        obj = ["secret:/ns/global/pw", "secret:/ns/host/node1/ssh"]
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        assert len(refs) == 2
+
+    def test_scan_nested(self, secret_mgr):
+        obj = {"a": {"b": "secret:/ns/global/pw"}}
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        assert len(refs) == 1
+
+    def test_scan_no_refs(self, secret_mgr):
+        obj = {"plain": "value"}
+        assert secret_mgr.scan_refs(obj, namespace="ns") == set()
+
+    def test_scan_bad_uri_yields_bad_secret_uri(self, secret_mgr):
+        obj = "secret:/ns/badscope/key"
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        bad = [r for r in refs if isinstance(r, BadSecretURI)]
+        assert len(bad) == 1
+
+    def test_scan_unresolved_all_exist(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "x")
+        obj = "secret:/ns/global/pw"
+        unresolved = secret_mgr.scan_unresolved_refs(obj, namespace="ns")
+        assert len(unresolved) == 0
+
+    def test_scan_unresolved_missing(self, secret_mgr):
+        obj = "secret:/ns/global/ghost"
+        unresolved = secret_mgr.scan_unresolved_refs(obj, namespace="ns")
+        assert len(unresolved) == 1
+
+    def test_scan_unresolved_bad_uri_is_unresolved(self, secret_mgr):
+        obj = "secret:/ns/badscope/key"
+        unresolved = secret_mgr.scan_unresolved_refs(obj, namespace="ns")
+        assert len(unresolved) == 1
+
+    def test_scan_unresolved_embedded_uri_is_unresolved(self, secret_mgr):
+        # Even though the referenced secret exists, an embedded (non-whole-value)
+        # URI is never resolvable, so it must be reported as unresolved so that
+        # pre-deploy validation catches it.
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "x")
+        obj = {"auth": "Bearer secret:/ns/global/pw"}
+        unresolved = secret_mgr.scan_unresolved_refs(obj, namespace="ns")
+        assert len(unresolved) == 1
+
+
+# ============================================================
+# resolve_object
+# ============================================================
+
+class TestResolveObject:
+    def test_resolve_secret(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        result = secret_mgr.resolve_object("secret:/ns/global/pw")
+        assert result == "s3cr3t"
+
+    def test_resolve_opaque_json_string(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "creds", '{"u": "a", "p": "b"}')
+        result = secret_mgr.resolve_object("secret:/ns/global/creds")
+        assert isinstance(result, str)
+        assert result == '{"u": "a", "p": "b"}'
+
+    def test_resolve_in_dict(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        result = secret_mgr.resolve_object({"password": "secret:/ns/global/pw"})
+        assert result["password"] == "s3cr3t"
+
+    def test_resolve_in_list(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "a", "x")
+        result = secret_mgr.resolve_object(["secret:/ns/global/a", "plain"])
+        assert result[0] == "x"
+        assert result[1] == "plain"
+
+    def test_resolve_in_tuple(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "t", "y")
+        result = secret_mgr.resolve_object(("secret:/ns/global/t",))
+        assert result == ("y",)
+
+    def test_resolve_non_secret_string_unchanged(self, secret_mgr):
+        result = secret_mgr.resolve_object("just a normal string")
+        assert result == "just a normal string"
+
+    def test_resolve_non_string_unchanged(self, secret_mgr):
+        assert secret_mgr.resolve_object(42) == 42
+        assert secret_mgr.resolve_object(None) is None
+
+    def test_resolve_missing_secret_raises(self, secret_mgr):
+        with pytest.raises(CephSecretException):
+            secret_mgr.resolve_object("secret:/ns/global/ghost")
+
+    def test_resolve_invalid_uri_raises(self, secret_mgr):
+        with pytest.raises(CephSecretException):
+            secret_mgr.resolve_object("secret:/ns/badscope/key")
+
+    def test_resolve_edge_whitespace_tolerated(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        assert secret_mgr.resolve_object("  secret:/ns/global/pw  ") == "s3cr3t"
+
+    def test_resolve_newline_whitespace_tolerated(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        assert secret_mgr.resolve_object("\nsecret:/ns/global/pw\n") == "s3cr3t"
+
+    def test_resolve_ref_with_suffix_raises(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        with pytest.raises(CephSecretException):
+            secret_mgr.resolve_object("secret:/ns/global/pw suffix")
+
+    def test_resolve_embedded_uri_raises(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        with pytest.raises(CephSecretException, match="embedded"):
+            secret_mgr.resolve_object("Bearer secret:/ns/global/pw")
+
+    def test_resolve_embedded_uri_in_dict_raises(self, secret_mgr):
+        secret_mgr.set("ns", SecretScope.GLOBAL, "", "pw", "s3cr3t")
+        with pytest.raises(CephSecretException, match="embedded"):
+            secret_mgr.resolve_object({"auth": "Bearer secret:/ns/global/pw"})
+
+    def test_resolve_plain_string_whitespace_preserved(self, secret_mgr):
+        # non-secret strings pass through byte-for-byte, including whitespace
+        assert secret_mgr.resolve_object("  plain value  ") == "  plain value  "
+
+
+# ============================================================
+# scan_refs — edge cases
+# ============================================================
+
+class TestScanRefsEdgeCases:
+    def test_embedded_refs_rejected_as_bad(self, secret_mgr):
+        # A string that embeds URIs inside other text is NOT a whole-value
+        # reference; it is surfaced as a single BadSecretURI, not parsed into
+        # multiple SecretRefs.
+        obj = "use secret:/ns/global/a and secret:/ns/global/b"
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        assert len(refs) == 1
+        bad = [r for r in refs if isinstance(r, BadSecretURI)]
+        assert len(bad) == 1
+        assert bad[0].raw == obj
+
+    def test_duplicate_refs_deduped(self, secret_mgr):
+        obj = ["secret:/ns/global/pw", "secret:/ns/global/pw"]
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        uris = [r.to_uri() for r in refs]
+        assert uris.count("secret:/ns/global/pw") == 1
+
+    def test_ref_followed_by_punctuation(self, secret_mgr):
+        # "secret:/ns/global/pw," is a whole-value string that starts with the
+        # prefix but is not a valid URI (trailing comma in name) → BadSecretURI.
+        obj = "secret:/ns/global/pw,"
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        bad = [r for r in refs if isinstance(r, BadSecretURI)]
+        assert len(bad) == 1
+
+    def test_whole_value_ref_with_edge_whitespace(self, secret_mgr):
+        # Surrounding whitespace around an otherwise-clean URI is tolerated.
+        obj = "  secret:/ns/global/pw  "
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        uris = {r.to_uri() for r in refs if isinstance(r, SecretRef)}
+        assert "secret:/ns/global/pw" in uris
+
+    def test_embedded_ref_in_dict_value_is_bad(self, secret_mgr):
+        obj = {"auth": "Bearer secret:/ns/global/pw"}
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        bad = [r for r in refs if isinstance(r, BadSecretURI)]
+        assert len(bad) == 1
+
+    def test_ref_inside_tuple(self, secret_mgr):
+        obj = ("secret:/ns/global/pw",)
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        assert len(refs) == 1
+
+    def test_cross_namespace_ref_is_scanned(self, secret_mgr):
+        """scan_refs finds refs regardless of namespace — namespace arg does not filter."""
+        obj = "secret:/other/global/pw"
+        refs = secret_mgr.scan_refs(obj, namespace="ns")
+        uris = {r.to_uri() for r in refs}
+        assert "secret:/other/global/pw" in uris
diff --git a/src/pybind/mgr/ceph_secrets/tests/test_secret_store.py b/src/pybind/mgr/ceph_secrets/tests/test_secret_store.py
new file mode 100644
index 00000000000..5473944d695
--- /dev/null
+++ b/src/pybind/mgr/ceph_secrets/tests/test_secret_store.py
@@ -0,0 +1,516 @@
+# -*- coding: utf-8 -*-
+"""Tests for ceph_secrets.secret_store (SecretStoreMon + data model)."""
+from __future__ import annotations
+
+import pytest
+
+# conftest injects stubs; just import production code after.
+from ceph_secrets.secret_store import (
+    SecretRecord,
+    SecretMetadata,
+    SecretPolicy,
+    SECRET_STORE_PREFIX,
+    SECRET_STORE_FORMAT_VERSION,
+    _checked_ref,
+    _checked_namespace,
+    _epoch_key,
+    _now_iso,
+    _expect_bool,
+    _expect_str,
+    _expect_positive_int,
+    _expect_object,
+    _reject_unknown_keys,
+    _require_keys,
+)
+from ceph_secrets_types import (
+    SecretScope, SecretRef,
+    CephSecretException, CephSecretDataError,
+)
+
+
+# ============================================================
+# Helpers / primitive validators
+# ============================================================
+
+class TestPrimitiveHelpers:
+    def test_now_iso_format(self):
+        ts = _now_iso()
+        import re
+        assert re.match(r'\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$', ts)
+
+    def test_expect_bool_ok(self):
+        assert _expect_bool("f", True) is True
+        assert _expect_bool("f", False) is False
+
+    def test_expect_bool_bad(self):
+        with pytest.raises(CephSecretDataError, match="must be a boolean"):
+            _expect_bool("f", 1)
+
+    def test_expect_str_ok(self):
+        assert _expect_str("f", "hello") == "hello"
+
+    def test_expect_str_bad(self):
+        with pytest.raises(CephSecretDataError, match="must be a string"):
+            _expect_str("f", 42)
+
+    def test_expect_positive_int_ok(self):
+        assert _expect_positive_int("f", 1) == 1
+        assert _expect_positive_int("f", 99) == 99
+
+    def test_expect_positive_int_zero(self):
+        with pytest.raises(CephSecretDataError):
+            _expect_positive_int("f", 0)
+
+    def test_expect_positive_int_bool_rejected(self):
+        with pytest.raises(CephSecretDataError):
+            _expect_positive_int("f", True)
+
+    def test_expect_object_ok(self):
+        d = {"a": 1}
+        assert _expect_object("o", d) is d
+
+    def test_expect_object_bad(self):
+        with pytest.raises(CephSecretDataError, match="must be a JSON object"):
+            _expect_object("o", [1, 2])
+
+    def test_reject_unknown_keys(self):
+        with pytest.raises(CephSecretDataError, match="unknown field"):
+            _reject_unknown_keys("L", {"a": 1, "z": 2}, {"a"})
+
+    def test_require_keys_missing(self):
+        with pytest.raises(CephSecretDataError, match="missing required"):
+            _require_keys("L", {"a": 1}, {"a", "b"})
+
+    def test_checked_namespace_valid(self):
+        assert _checked_namespace("cephadm") == "cephadm"
+
+    def test_checked_namespace_bad(self):
+        with pytest.raises(CephSecretDataError):
+            _checked_namespace("bad ns!")
+
+    def test_epoch_key_format(self):
+        assert _epoch_key("cephadm") == "secret_store/meta/cephadm/_epoch"
+
+    def test_checked_ref_valid(self):
+        ref = _checked_ref("ns", SecretScope.GLOBAL, "", "key")
+        assert isinstance(ref, SecretRef)
+
+    def test_checked_ref_bad_scope(self):
+        with pytest.raises(CephSecretDataError):
+            _checked_ref("ns", "bad", "", "key")
+
+
+# ============================================================
+# SecretMetadata
+# ============================================================
+
+class TestSecretMetadata:
+    def test_defaults(self):
+        m = SecretMetadata(version=1, created="2024-01-01T00:00:00Z", updated="2024-01-01T00:00:00Z")
+        assert m.version == 1
+
+    def test_to_json(self):
+        m = SecretMetadata(version=2, created="2024-01-01T00:00:00Z", updated="2024-01-02T00:00:00Z")
+        d = m.to_json()
+        assert d["version"] == 2
+        assert "created" in d
+        assert "updated" in d
+
+    def test_from_json_roundtrip(self):
+        m = SecretMetadata(version=3, created="2024-01-01T00:00:00Z", updated="2024-01-02T00:00:00Z")
+        m2 = SecretMetadata.from_json(m.to_json())
+        assert m2.version == 3
+
+    def test_from_json_missing_field(self):
+        with pytest.raises(CephSecretDataError, match="missing required"):
+            SecretMetadata.from_json({"version": 1, "created": "x"})
+
+    def test_from_json_unknown_field(self):
+        with pytest.raises(CephSecretDataError, match="unknown"):
+            SecretMetadata.from_json({"version": 1, "created": "x", "updated": "y", "extra": 1})
+
+    def test_version_zero_raises(self):
+        with pytest.raises(CephSecretDataError):
+            SecretMetadata(version=0, created="x", updated="y")
+
+    def test_non_dict_raises(self):
+        with pytest.raises(CephSecretDataError):
+            SecretMetadata.from_json("not a dict")
+
+
+# ============================================================
+# SecretPolicy
+# ============================================================
+
+class TestSecretPolicy:
+    def test_defaults(self):
+        p = SecretPolicy()
+        assert p.user_made is True
+        assert p.editable is True
+
+    def test_to_json(self):
+        p = SecretPolicy(user_made=False, editable=True)
+        d = p.to_json()
+        assert d["user_made"] is False
+
+    def test_from_json_roundtrip(self):
+        p = SecretPolicy(user_made=True, editable=False)
+        p2 = SecretPolicy.from_json(p.to_json())
+        assert p2.editable is False
+
+    def test_from_json_missing(self):
+        with pytest.raises(CephSecretDataError):
+            SecretPolicy.from_json({"user_made": True})
+
+    def test_from_json_bad_type(self):
+        with pytest.raises(CephSecretDataError, match="must be a boolean"):
+            SecretPolicy.from_json({"user_made": 1, "editable": True})
+
+    def test_non_bool_raises(self):
+        with pytest.raises(CephSecretDataError):
+            SecretPolicy(user_made="yes", editable=True)  # type: ignore[arg-type]
+
+
+# ============================================================
+# SecretRecord
+# ============================================================
+
+class TestSecretRecord:
+    def _ref(self, scope=SecretScope.GLOBAL, target="", name="key"):
+        return SecretRef("ns", scope, target, name)
+
+    def _meta(self):
+        return SecretMetadata(version=1, created="2024-01-01T00:00:00Z", updated="2024-01-01T00:00:00Z")
+
+    def test_basic_construction(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="s3cr3t")
+        assert rec.namespace == "ns"
+        assert rec.scope == SecretScope.GLOBAL
+        assert rec.name == "key"
+
+    def test_to_public_json_no_data(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="s3cr3t")
+        out = rec.to_public_json(include_data=False)
+        assert "data" not in out
+        assert "metadata" in out
+
+    def test_to_public_json_with_data(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="s3cr3t")
+        out = rec.to_public_json(include_data=True)
+        assert out["data"] == "s3cr3t"
+
+    def test_to_public_json_with_ref(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="x")
+        out = rec.to_public_json(include_ref=True)
+        assert out["ref"]["namespace"] == "ns"
+        assert out["ref"]["scope"] == "global"
+
+    def test_to_public_json_with_policy(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="x")
+        out = rec.to_public_json(include_policy=True)
+        assert "policy" in out
+
+    def test_to_store_json(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="x")
+        stored = rec.to_store_json()
+        assert stored["format_version"] == SECRET_STORE_FORMAT_VERSION
+        assert "data" in stored
+        assert "policy" in stored
+
+    def test_from_store_json_roundtrip(self):
+        ref = self._ref()
+        rec = SecretRecord(ref=ref, metadata=self._meta(), data="pw")
+        rec2 = SecretRecord.from_store_json(ref, rec.to_store_json())
+        assert rec2.data == "pw"
+        assert rec2.metadata.version == 1
+
+    def test_from_store_json_wrong_version(self):
+        ref = self._ref()
+        payload = {
+            "format_version": 99,
+            "metadata": {"version": 1, "created": "x", "updated": "y"},
+            "policy": {"user_made": True, "editable": True},
+            "data": "x",
+        }
+        with pytest.raises(CephSecretDataError, match="unsupported"):
+            SecretRecord.from_store_json(ref, payload)
+
+    def test_from_store_json_missing_key(self):
+        ref = self._ref()
+        with pytest.raises(CephSecretDataError, match="missing required"):
+            SecretRecord.from_store_json(ref, {"format_version": 1, "metadata": {}})
+
+    def test_bad_ref_type_raises(self):
+        with pytest.raises(CephSecretDataError, match="must be a SecretRef"):
+            SecretRecord(ref="not-a-ref", metadata=self._meta(), data="x")  # type: ignore[arg-type]
+
+    def test_bad_metadata_type_raises(self):
+        with pytest.raises(CephSecretDataError):
+            SecretRecord(ref=self._ref(), metadata={"version": 1}, data="x")  # type: ignore[arg-type]
+
+    def test_bad_data_type_raises(self):
+        with pytest.raises(CephSecretDataError):
+            SecretRecord(ref=self._ref(), metadata=self._meta(), data={"not": "a-string"})  # type: ignore[arg-type]
+
+    def test_empty_data_raises(self):
+        with pytest.raises(CephSecretDataError, match="must not be empty"):
+            SecretRecord(ref=self._ref(), metadata=self._meta(), data="")
+
+    def test_data_in_store_json(self):
+        rec = SecretRecord(ref=self._ref(), metadata=self._meta(), data="myvalue")
+        stored = rec.to_store_json()
+        assert stored["data"] == "myvalue"
+
+    def test_ident(self):
+        ref = self._ref()
+        rec = SecretRecord(ref=ref, metadata=self._meta(), data="x")
+        assert rec.ident() == ("ns", "global", "", "key")
+
+
+# ============================================================
+# SecretStoreMon – epoch
+# ============================================================
+
+class TestSecretStoreMon_Epoch:
+    def test_initial_epoch_is_zero(self, store):
+        assert store.get_epoch("cephadm") == 0
+
+    def test_bump_epoch(self, store):
+        assert store.bump_epoch("cephadm") == 1
+        assert store.bump_epoch("cephadm") == 2
+
+    def test_namespace_isolation(self, store):
+        store.bump_epoch("cephadm")
+        store.bump_epoch("cephadm")
+        assert store.get_epoch("rook") == 0
+
+    def test_epoch_key_stored_correctly(self, mgr, store):
+        store.bump_epoch("myns")
+        assert mgr.get_store("secret_store/meta/myns/_epoch") == "1"
+
+    def test_corrupted_epoch_returns_zero(self, mgr, store):
+        mgr.set_store("secret_store/meta/ns/_epoch", "notanumber")
+        assert store.get_epoch("ns") == 0
+
+
+# ============================================================
+# SecretStoreMon – CRUD
+# ============================================================
+
+class TestSecretStoreMon_Crud:
+    def test_set_and_get_global(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "pw", "secret")
+        rec = store.get("ns", SecretScope.GLOBAL, "", "pw")
+        assert rec is not None
+        assert rec.data == "secret"
+
+    def test_get_missing_returns_none(self, store):
+        assert store.get("ns", SecretScope.GLOBAL, "", "noexist") is None
+
+    def test_set_increments_version(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1")
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v2")
+        rec = store.get("ns", SecretScope.GLOBAL, "", "k")
+        assert rec.metadata.version == 2
+
+    def test_set_preserves_created_timestamp(self, store):
+        import time
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1")
+        rec1 = store.get("ns", SecretScope.GLOBAL, "", "k")
+        time.sleep(1)
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v2")
+        rec2 = store.get("ns", SecretScope.GLOBAL, "", "k")
+        assert rec1.metadata.created == rec2.metadata.created
+        assert rec2.metadata.updated != rec2.metadata.created
+
+    def test_set_service_scope(self, store):
+        store.set("ns", SecretScope.SERVICE, "prometheus", "auth", "admin")
+        rec = store.get("ns", SecretScope.SERVICE, "prometheus", "auth")
+        assert rec.data == "admin"
+
+    def test_set_host_scope(self, store):
+        store.set("ns", SecretScope.HOST, "node1", "ssh", "abc")
+        rec = store.get("ns", SecretScope.HOST, "node1", "ssh")
+        assert rec.data == "abc"
+
+    def test_set_custom_scope(self, store):
+        store.set("ns", SecretScope.CUSTOM, "", "a/b/c", "tok")
+        rec = store.get("ns", SecretScope.CUSTOM, "", "a/b/c")
+        assert rec.data == "tok"
+
+    def test_set_bumps_epoch(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1")
+        assert store.get_epoch("ns") == 1
+
+    def test_set_non_str_data_raises(self, store):
+        with pytest.raises(CephSecretException):
+            store.set("ns", SecretScope.GLOBAL, "", "k", {"not": "a-string"})  # type: ignore[arg-type]
+
+    def test_set_empty_data_raises(self, store):
+        with pytest.raises(CephSecretException, match="must not be empty"):
+            store.set("ns", SecretScope.GLOBAL, "", "k", "")
+
+    def test_set_non_editable_raises(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1", editable=False)
+        with pytest.raises(CephSecretException, match="not editable"):
+            store.set("ns", SecretScope.GLOBAL, "", "k", "data-v2")
+
+    def test_rm_existing(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        assert store.rm("ns", SecretScope.GLOBAL, "", "k") is True
+        assert store.get("ns", SecretScope.GLOBAL, "", "k") is None
+
+    def test_rm_nonexistent(self, store):
+        assert store.rm("ns", SecretScope.GLOBAL, "", "ghost") is False
+
+    def test_rm_bumps_epoch(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-x")
+        epoch_after_set = store.get_epoch("ns")
+        store.rm("ns", SecretScope.GLOBAL, "", "k")
+        assert store.get_epoch("ns") == epoch_after_set + 1
+
+    def test_rm_nonexistent_no_epoch_bump(self, store):
+        assert store.get_epoch("ns") == 0
+        store.rm("ns", SecretScope.GLOBAL, "", "ghost")
+        assert store.get_epoch("ns") == 0
+
+    def test_get_corrupted_json_raises(self, mgr, store):
+        mgr.set_store(
+            f"{SECRET_STORE_PREFIX}ns/global/badkey", "NOT JSON"
+        )
+        with pytest.raises(CephSecretDataError):
+            store.get("ns", SecretScope.GLOBAL, "", "badkey")
+
+    def test_set_with_bad_scope_string(self, store):
+        with pytest.raises(CephSecretDataError):
+            store.set("ns", "badscope", "", "k", "data-v1")
+
+
+# ============================================================
+# SecretStoreMon – ls
+# ============================================================
+
+class TestSecretStoreMon_Ls:
+    def test_ls_empty(self, store):
+        assert store.ls(namespace="ns") == []
+
+    def test_ls_returns_all(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k1", "data-1")
+        store.set("ns", SecretScope.GLOBAL, "", "k2", "data-2")
+        recs = store.ls(namespace="ns")
+        assert len(recs) == 2
+
+    def test_ls_filter_scope(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "g", "data-g")
+        store.set("ns", SecretScope.SERVICE, "prom", "auth", "data-auth")
+        recs = store.ls(namespace="ns", scope=SecretScope.GLOBAL)
+        assert len(recs) == 1
+        assert recs[0].scope == SecretScope.GLOBAL
+
+    def test_ls_filter_target(self, store):
+        store.set("ns", SecretScope.SERVICE, "prom", "a1", "data-a1")
+        store.set("ns", SecretScope.SERVICE, "grafana", "a2", "data-a2")
+        recs = store.ls(namespace="ns", scope=SecretScope.SERVICE, target="prom")
+        assert len(recs) == 1
+        assert recs[0].target == "prom"
+
+    def test_ls_namespace_isolation(self, store):
+        store.set("ns1", SecretScope.GLOBAL, "", "k", "data-ns1")
+        store.set("ns2", SecretScope.GLOBAL, "", "k", "data-ns2")
+        recs = store.ls(namespace="ns1")
+        assert len(recs) == 1
+
+    def test_ls_custom_scope(self, store):
+        store.set("ns", SecretScope.CUSTOM, "", "a/b/c", "data-abc")
+        store.set("ns", SecretScope.CUSTOM, "", "x/y", "data-xy")
+        recs = store.ls(namespace="ns", scope=SecretScope.CUSTOM)
+        assert len(recs) == 2
+
+    def test_ls_sorted(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "zz", "data-zz")
+        store.set("ns", SecretScope.GLOBAL, "", "aa", "data-aa")
+        recs = store.ls(namespace="ns")
+        names = [r.name for r in recs]
+        assert names == sorted(names)
+
+    def test_ls_invalid_namespace(self, store):
+        with pytest.raises(CephSecretDataError):
+            store.ls(namespace="bad ns!")
+
+    def test_ls_scope_as_string(self, store):
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1")
+        recs = store.ls(namespace="ns", scope="global")
+        assert len(recs) == 1
+
+    def test_ls_corrupted_json_raises(self, mgr, store):
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/global/bad", "NOT-JSON")
+        with pytest.raises(CephSecretDataError):
+            store.ls(namespace="ns")
+
+    def test_ls_no_filter(self, store):
+        store.set("ns1", SecretScope.GLOBAL, "", "a", "data-a")
+        store.set("ns2", SecretScope.GLOBAL, "", "b", "data-b")
+        recs = store.ls()
+        assert len(recs) == 2
+
+    def test_ls_kv_key_structure_validation(self, mgr, store):
+        """A key with empty segments inside the prefix should raise CephSecretDataError."""
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns//global/k", "{}")
+        with pytest.raises(CephSecretDataError, match="empty path component"):
+            store.ls(namespace="ns")
+
+
+# ============================================================
+# TestSecretStoreMon_Ls — malformed persisted-record cases
+# ============================================================
+
+class TestSecretStoreMon_Ls_Malformed:
+    def test_ls_too_few_segments(self, mgr, store):
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/global", "{}")
+        with pytest.raises(CephSecretDataError, match="unexpected key structure"):
+            store.ls(namespace="ns")
+
+    def test_ls_invalid_scope_in_key(self, mgr, store):
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/badscope/key", "{}")
+        with pytest.raises(CephSecretDataError, match="invalid scope"):
+            store.ls(namespace="ns")
+
+    def test_ls_global_with_extra_segment(self, mgr, store):
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/global/target/name", "{}")
+        with pytest.raises(CephSecretDataError, match="unexpected global key structure"):
+            store.ls(namespace="ns")
+
+    def test_ls_service_with_missing_segment(self, mgr, store):
+        # service needs 4 parts (ns/service/target/name); 3 is too few
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/service/onlytarget", "{}")
+        with pytest.raises(CephSecretDataError, match="unexpected targeted-scope key structure"):
+            store.ls(namespace="ns")
+
+    def test_ls_payload_not_object(self, mgr, store):
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/global/k", '["not", "object"]')
+        with pytest.raises(CephSecretDataError, match="not a JSON object"):
+            store.ls(namespace="ns")
+
+    def test_ls_payload_valid_json_missing_fields(self, mgr, store):
+        # Valid JSON object but missing required secret record fields
+        mgr.set_store(f"{SECRET_STORE_PREFIX}ns/global/k", '{"unexpected": 1}')
+        with pytest.raises(CephSecretDataError):
+            store.ls(namespace="ns")
+
+
+# ============================================================
+# TestSecretStoreMon_Crud — editable=False allows rm by design
+# ============================================================
+
+class TestSecretStoreMon_EditableRm:
+    def test_rm_non_editable_secret_is_allowed(self, store):
+        """rm ignores editable — deletion is always permitted by design."""
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1", editable=False)
+        result = store.rm("ns", SecretScope.GLOBAL, "", "k")
+        assert result is True
+
+    def test_set_non_editable_blocks_update(self, store):
+        """Confirmed: set refuses to update a non-editable secret."""
+        store.set("ns", SecretScope.GLOBAL, "", "k", "data-v1", editable=False)
+        with pytest.raises(CephSecretException):
+            store.set("ns", SecretScope.GLOBAL, "", "k", "data-v2")
diff --git a/src/pybind/mgr/ceph_secrets_client.py b/src/pybind/mgr/ceph_secrets_client.py
index 2386de71043..3240641dbd8 100644
--- a/src/pybind/mgr/ceph_secrets_client.py
+++ b/src/pybind/mgr/ceph_secrets_client.py
@@ -249,8 +249,9 @@ class CephSecretsClient:
                        rather than automatically by a Ceph component.  Defaults
                        to True; set to False for programmatically generated
                        secrets.
-            editable:  Whether the secret may be updated or removed by
-                       automated tooling.  Defaults to True.
+            editable:  Whether the secret may be updated by automated
+                       tooling.  Deletion is always permitted regardless of
+                       this flag.  Defaults to True.
 
         Returns:
             A dict containing the written record's ``metadata`` object.  The
diff --git a/src/pybind/mgr/ceph_secrets_types.py b/src/pybind/mgr/ceph_secrets_types.py
index ae2ccd58672..88cdce45422 100644
--- a/src/pybind/mgr/ceph_secrets_types.py
+++ b/src/pybind/mgr/ceph_secrets_types.py
@@ -196,6 +196,11 @@ def parse_secret_uri(uri: str) -> SecretRef:
         if not isinstance(uri, str):
             raise CephSecretException('secret uri must be a string')
 
+        if uri != uri.strip():
+            raise CephSecretException(
+                f'Invalid secret uri {uri!r}: leading/trailing whitespace is not allowed'
+            )
+
         parsed = urlparse(uri)
         if parsed.scheme != SECRET_SCHEME:
             raise CephSecretException(f'Not a secret uri: {uri!r}')
@@ -289,6 +294,11 @@ def parse_secret_path(path: str) -> SecretRef:
     if not isinstance(path, str):
         raise CephSecretException('secret path must be a string')
 
+    if path != path.strip():
+        raise CephSecretException(
+            f'Invalid secret path {path!r}: leading/trailing whitespace is not allowed'
+        )
+
     p = path.strip()
     if not p:
         raise CephSecretException('Invalid secret path: empty')
diff --git a/src/pybind/mgr/tests/test_ceph_secrets_client.py b/src/pybind/mgr/tests/test_ceph_secrets_client.py
new file mode 100644
index 00000000000..ab52077cd27
--- /dev/null
+++ b/src/pybind/mgr/tests/test_ceph_secrets_client.py
@@ -0,0 +1,317 @@
+# -*- coding: utf-8 -*-
+"""
+Unit tests for ceph_secrets_client.py.
+Placed at the same level as the module under test (src/pybind/mgr/).
+"""
+from __future__ import annotations
+
+import sys, os
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import pytest
+from typing import Any
+from unittest.mock import MagicMock, call
+
+from ceph_secrets_client import CephSecretsClient, MgrRemote
+from ceph_secrets_types import SecretScope
+
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+def _make_mgr(return_value: Any = None, raise_exc: Exception = None) -> MagicMock:
+    """Return a mock that satisfies the MgrRemote Protocol."""
+    mgr = MagicMock()
+    if raise_exc is not None:
+        mgr.remote.side_effect = raise_exc
+    else:
+        mgr.remote.return_value = return_value
+    return mgr
+
+
+def _client(return_value: Any = None, raise_exc: Exception = None) -> CephSecretsClient:
+    return CephSecretsClient(_make_mgr(return_value, raise_exc))
+
+
+# ============================================================
+# CephSecretsClient construction
+# ============================================================
+
+class TestConstruction:
+    def test_default_module_name(self):
+        mgr = MagicMock()
+        client = CephSecretsClient(mgr)
+        assert client.module == "ceph_secrets"
+
+    def test_custom_module_name(self):
+        mgr = MagicMock()
+        client = CephSecretsClient(mgr, module="my_secrets")
+        assert client.module == "my_secrets"
+
+    def test_stores_mgr(self):
+        mgr = MagicMock()
+        client = CephSecretsClient(mgr)
+        assert client.mgr is mgr
+
+
+# ============================================================
+# _remote error handling
+# ============================================================
+
+class TestRemoteErrorHandling:
+    def test_passes_through_return_value(self):
+        client = _client(return_value=42)
+        assert client._remote("some_method", foo="bar") == 42
+
+    def test_wraps_exception_as_runtime_error(self):
+        client = _client(raise_exc=RuntimeError("module down"))
+        with pytest.raises(RuntimeError, match="Cannot call secrets mgr-module"):
+            client._remote("any_method")
+
+    def test_exception_includes_module_name(self):
+        mgr = _make_mgr(raise_exc=Exception("boom"))
+        client = CephSecretsClient(mgr, module="my_secrets")
+        with pytest.raises(RuntimeError, match="my_secrets"):
+            client._remote("any_method")
+
+    def test_exception_is_enabled_hint(self):
+        client = _client(raise_exc=Exception("unavailable"))
+        with pytest.raises(RuntimeError, match="enabled"):
+            client._remote("any_method")
+
+
+# ============================================================
+# secret_get_epoch
+# ============================================================
+
+class TestSecretGetEpoch:
+    def test_calls_correct_method(self):
+        mgr = _make_mgr(return_value=5)
+        client = CephSecretsClient(mgr)
+        result = client.secret_get_epoch("cephadm")
+        mgr.remote.assert_called_once_with("ceph_secrets", "secret_get_epoch", namespace="cephadm")
+        assert result == 5
+
+    def test_returns_zero_epoch(self):
+        assert _client(return_value=0).secret_get_epoch("ns") == 0
+
+
+# ============================================================
+# secret_get
+# ============================================================
+
+class TestSecretGet:
+    def test_calls_remote_correctly(self):
+        mgr = _make_mgr(return_value={"metadata": {"version": 1}})
+        client = CephSecretsClient(mgr)
+        result = client.secret_get("ns", SecretScope.GLOBAL, "", "pw")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "secret_get",
+            namespace="ns", scope=SecretScope.GLOBAL,
+            target="", name="pw", reveal=False,
+        )
+        assert result["metadata"]["version"] == 1
+
+    def test_reveal_kwarg_forwarded(self):
+        mgr = _make_mgr(return_value={"metadata": {}, "data": "s3cr3t"})
+        client = CephSecretsClient(mgr)
+        client.secret_get("ns", SecretScope.GLOBAL, "", "pw", reveal=True)
+        _, kwargs = mgr.remote.call_args
+        assert kwargs["reveal"] is True
+
+    def test_returns_none_when_not_found(self):
+        assert _client(return_value=None).secret_get("ns", "global", "", "ghost") is None
+
+    def test_scope_as_string(self):
+        mgr = _make_mgr(return_value=None)
+        client = CephSecretsClient(mgr)
+        client.secret_get("ns", "host", "node1", "ssh")
+        _, kwargs = mgr.remote.call_args
+        assert kwargs["scope"] == "host"
+
+
+# ============================================================
+# secret_get_value
+# ============================================================
+
+class TestSecretGetValue:
+    def test_calls_remote(self):
+        mgr = _make_mgr(return_value="s3cr3t")
+        client = CephSecretsClient(mgr)
+        result = client.secret_get_value("ns", SecretScope.GLOBAL, "", "pw")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "secret_get_value",
+            namespace="ns", scope=SecretScope.GLOBAL, target="", name="pw",
+        )
+        assert result == "s3cr3t"
+
+    def test_returns_none_if_not_found(self):
+        assert _client(return_value=None).secret_get_value("ns", "global", "", "ghost") is None
+
+    def test_returns_opaque_string(self):
+        payload = '{"u": "a", "p": "b"}'
+        result = _client(return_value=payload).secret_get_value("ns", "global", "", "creds")
+        assert result == payload
+
+    def test_module_unreachable_raises(self):
+        with pytest.raises(RuntimeError, match="Cannot call"):
+            _client(raise_exc=Exception("down")).secret_get_value("ns", "global", "", "pw")
+
+
+# secret_get_version
+# ============================================================
+
+class TestSecretGetVersion:
+    def test_calls_remote(self):
+        mgr = _make_mgr(return_value=3)
+        client = CephSecretsClient(mgr)
+        result = client.secret_get_version("ns", SecretScope.GLOBAL, "", "k")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "secret_get_version",
+            namespace="ns", scope=SecretScope.GLOBAL, target="", name="k",
+        )
+        assert result == 3
+
+    def test_returns_none_if_not_found(self):
+        assert _client(return_value=None).secret_get_version("ns", "global", "", "ghost") is None
+
+
+# ============================================================
+# secret_get_versions
+# ============================================================
+
+class TestSecretGetVersions:
+    def test_calls_remote_with_list(self):
+        uris = ["secret:/ns/global/a", "secret:/ns/global/b"]
+        expected = {"secret:/ns/global/a": 1, "secret:/ns/global/b": None}
+        mgr = _make_mgr(return_value=expected)
+        client = CephSecretsClient(mgr)
+        result = client.secret_get_versions(uris)
+        mgr.remote.assert_called_once_with("ceph_secrets", "secret_get_versions", uris=uris)
+        assert result == expected
+
+    def test_returns_empty_dict_for_empty_list(self):
+        result = _client(return_value={}).secret_get_versions([])
+        assert result == {}
+
+
+# ============================================================
+# secret_set
+# ============================================================
+
+class TestSecretSet:
+    def test_calls_remote_with_defaults(self):
+        expected = {"metadata": {"version": 1}}
+        mgr = _make_mgr(return_value=expected)
+        client = CephSecretsClient(mgr)
+        result = client.secret_set("ns", SecretScope.GLOBAL, "", "pw", "x")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "secret_set",
+            namespace="ns", scope=SecretScope.GLOBAL,
+            target="", name="pw", data="x",
+            user_made=True, editable=True,
+        )
+        assert result == expected
+
+    def test_user_made_editable_overrides(self):
+        mgr = _make_mgr(return_value={})
+        client = CephSecretsClient(mgr)
+        client.secret_set("ns", "global", "", "k", "x", user_made=False, editable=False)
+        _, kwargs = mgr.remote.call_args
+        assert kwargs["user_made"] is False
+        assert kwargs["editable"] is False
+
+    def test_raises_on_module_error(self):
+        with pytest.raises(RuntimeError):
+            _client(raise_exc=Exception("down")).secret_set("ns", "global", "", "k", "x")
+
+
+# ============================================================
+# secret_rm
+# ============================================================
+
+class TestSecretRm:
+    def test_calls_remote(self):
+        mgr = _make_mgr(return_value=True)
+        client = CephSecretsClient(mgr)
+        result = client.secret_rm("ns", SecretScope.GLOBAL, "", "k")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "secret_rm",
+            namespace="ns", scope=SecretScope.GLOBAL, target="", name="k",
+        )
+        assert result is True
+
+    def test_returns_false_when_not_found(self):
+        assert _client(return_value=False).secret_rm("ns", "global", "", "ghost") is False
+
+    def test_truthy_value_coerced_to_bool(self):
+        # remote might return 1 instead of True
+        assert _client(return_value=1).secret_rm("ns", "global", "", "k") is True
+
+    def test_falsy_value_coerced_to_bool(self):
+        assert _client(return_value=0).secret_rm("ns", "global", "", "k") is False
+
+
+# ============================================================
+# scan_unresolved_refs
+# ============================================================
+
+class TestScanUnresolvedRefs:
+    def test_calls_remote(self):
+        expected = ["secret:/ns/global/missing"]
+        mgr = _make_mgr(return_value=expected)
+        client = CephSecretsClient(mgr)
+        result = client.scan_unresolved_refs({"k": "secret:/ns/global/missing"}, "ns")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "scan_unresolved_refs",
+            obj={"k": "secret:/ns/global/missing"}, namespace="ns",
+        )
+        assert result == expected
+
+    def test_returns_empty_when_all_resolved(self):
+        assert _client(return_value=[]).scan_unresolved_refs({}, "ns") == []
+
+
+# ============================================================
+# scan_refs
+# ============================================================
+
+class TestScanRefs:
+    def test_calls_remote(self):
+        expected = ["secret:/ns/global/pw"]
+        mgr = _make_mgr(return_value=expected)
+        client = CephSecretsClient(mgr)
+        result = client.scan_refs("secret:/ns/global/pw", "ns")
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "scan_refs",
+            obj="secret:/ns/global/pw", namespace="ns",
+        )
+        assert result == expected
+
+    def test_returns_empty_for_no_refs(self):
+        assert _client(return_value=[]).scan_refs("no refs here", "ns") == []
+
+
+# ============================================================
+# resolve_object
+# ============================================================
+
+class TestResolveObject:
+    def test_calls_remote(self):
+        mgr = _make_mgr(return_value={"password": "s3cr3t"})
+        client = CephSecretsClient(mgr)
+        result = client.resolve_object({"password": "secret:/ns/global/pw"})
+        mgr.remote.assert_called_once_with(
+            "ceph_secrets", "resolve_object",
+            obj={"password": "secret:/ns/global/pw"},
+        )
+        assert result["password"] == "s3cr3t"
+
+    def test_raises_on_unresolvable(self):
+        with pytest.raises(RuntimeError):
+            _client(raise_exc=Exception("missing")).resolve_object("secret:/ns/global/ghost")
+
+    def test_returns_plain_value_unchanged(self):
+        result = _client(return_value="plain").resolve_object("plain")
+        assert result == "plain"
diff --git a/src/pybind/mgr/tests/test_ceph_secrets_types.py b/src/pybind/mgr/tests/test_ceph_secrets_types.py
new file mode 100644
index 00000000000..062af9b6fd9
--- /dev/null
+++ b/src/pybind/mgr/tests/test_ceph_secrets_types.py
@@ -0,0 +1,487 @@
+# -*- coding: utf-8 -*-
+"""
+Unit tests for ceph_secrets_types.py.
+Placed at the same level as the module under test (src/pybind/mgr/).
+"""
+from __future__ import annotations
+
+import sys, os
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import pytest
+
+from ceph_secrets_types import (
+    CephSecretException,
+    CephSecretDataError,
+    CephSecretNotFoundError,
+    SecretScope,
+    SecretRef,
+    BadSecretURI,
+    parse_secret_uri,
+    parse_secret_path,
+    validate_secret_namespace,
+    SECRET_SCHEME,
+    _validate_segment,
+    _validate_custom_path,
+    _quote_segment,
+    _quote_custom_path,
+)
+
+
+# ============================================================
+# Module constants
+# ============================================================
+
+class TestConstants:
+    def test_secret_scheme(self):
+        assert SECRET_SCHEME == "secret"
+
+
+# ============================================================
+# Exception hierarchy
+# ============================================================
+
+class TestExceptions:
+    def test_base_is_exception(self):
+        assert issubclass(CephSecretException, Exception)
+
+    def test_data_error_inherits_base(self):
+        assert issubclass(CephSecretDataError, CephSecretException)
+
+    def test_not_found_inherits_base(self):
+        assert issubclass(CephSecretNotFoundError, CephSecretException)
+
+    def test_can_raise_and_catch_base(self):
+        with pytest.raises(CephSecretException):
+            raise CephSecretException("test")
+
+    def test_can_raise_and_catch_data_error_as_base(self):
+        with pytest.raises(CephSecretException):
+            raise CephSecretDataError("data")
+
+    def test_can_raise_and_catch_not_found_as_base(self):
+        with pytest.raises(CephSecretException):
+            raise CephSecretNotFoundError("gone")
+
+
+# ============================================================
+# _validate_segment
+# ============================================================
+
+class TestValidateSegment:
+    @pytest.mark.parametrize("v", [
+        "simple", "with-dashes", "under_score", "dot.dot", "a1b2",
+        "UPPER", "Mixed123",
+    ])
+    def test_valid(self, v):
+        _validate_segment("f", v)
+
+    @pytest.mark.parametrize("bad", [
+        "", " ", "has space", "a/b", "a:b", "star*",
+    ])
+    def test_invalid(self, bad):
+        with pytest.raises(ValueError):
+            _validate_segment("f", bad)
+
+    def test_ends_with_dot_invalid(self):
+        with pytest.raises(ValueError, match="must not end"):
+            _validate_segment("f", "end.")
+
+    def test_non_string_raises(self):
+        with pytest.raises(ValueError, match="must be a string"):
+            _validate_segment("f", None)
+
+
+# ============================================================
+# _validate_custom_path
+# ============================================================
+
+class TestValidateCustomPath:
+    @pytest.mark.parametrize("p", [
+        "single", "a/b", "a/b/c", "deep/path/here",
+    ])
+    def test_valid(self, p):
+        _validate_custom_path(p)
+
+    def test_empty_string(self):
+        with pytest.raises(ValueError, match="must not be empty"):
+            _validate_custom_path("")
+
+    def test_empty_segment_in_middle(self):
+        with pytest.raises(ValueError, match="empty segments"):
+            _validate_custom_path("a//b")
+
+    def test_trailing_slash(self):
+        with pytest.raises(ValueError, match="empty segments"):
+            _validate_custom_path("a/b/")
+
+    def test_leading_slash_empty_first_segment(self):
+        with pytest.raises(ValueError, match="empty segments"):
+            _validate_custom_path("/a/b")
+
+    def test_segment_with_bad_chars(self):
+        with pytest.raises(ValueError):
+            _validate_custom_path("a/b c/d")
+
+
+# ============================================================
+# _quote helpers
+# ============================================================
+
+class TestQuoteHelpers:
+    def test_quote_segment_no_slash(self):
+        # clean identifiers are unchanged
+        assert _quote_segment("cephadm") == "cephadm"
+
+    def test_quote_custom_path_preserves_slash(self):
+        assert _quote_custom_path("a/b/c") == "a/b/c"
+
+
+# ============================================================
+# validate_secret_namespace
+# ============================================================
+
+class TestValidateSecretNamespace:
+    def test_valid_namespace(self):
+        validate_secret_namespace("cephadm")
+
+    def test_empty_namespace(self):
+        with pytest.raises(ValueError):
+            validate_secret_namespace("")
+
+    def test_namespace_with_space(self):
+        with pytest.raises(ValueError):
+            validate_secret_namespace("bad name")
+
+
+# ============================================================
+# SecretScope
+# ============================================================
+
+class TestSecretScope:
+    def test_all_values(self):
+        assert SecretScope.GLOBAL.value == "global"
+        assert SecretScope.SERVICE.value == "service"
+        assert SecretScope.HOST.value == "host"
+        assert SecretScope.CUSTOM.value == "custom"
+
+    def test_from_str_valid(self):
+        for v in ("global", "service", "host", "custom"):
+            scope = SecretScope.from_str(v)
+            assert scope.value == v
+
+    def test_from_str_invalid(self):
+        with pytest.raises(CephSecretException, match="Invalid secret scope"):
+            SecretScope.from_str("vault")
+
+    def test_is_str_subclass(self):
+        assert isinstance(SecretScope.GLOBAL, str)
+
+    # validate_fields – global
+    def test_global_valid(self):
+        SecretScope.GLOBAL.validate_fields("", "mykey")
+
+    def test_global_nonempty_target_fails(self):
+        with pytest.raises(ValueError, match="target must be empty"):
+            SecretScope.GLOBAL.validate_fields("target", "key")
+
+    def test_global_empty_name_fails(self):
+        with pytest.raises(ValueError):
+            SecretScope.GLOBAL.validate_fields("", "")
+
+    # validate_fields – service / host
+    def test_service_valid(self):
+        SecretScope.SERVICE.validate_fields("prometheus", "auth")
+
+    def test_service_empty_target_fails(self):
+        with pytest.raises(ValueError):
+            SecretScope.SERVICE.validate_fields("", "auth")
+
+    def test_host_valid(self):
+        SecretScope.HOST.validate_fields("node1", "ssh_key")
+
+    def test_host_empty_name_fails(self):
+        with pytest.raises(ValueError):
+            SecretScope.HOST.validate_fields("node1", "")
+
+    # validate_fields – custom
+    def test_custom_valid_flat(self):
+        SecretScope.CUSTOM.validate_fields("", "some-key")
+
+    def test_custom_valid_nested(self):
+        SecretScope.CUSTOM.validate_fields("", "a/b/c")
+
+    def test_custom_nonempty_target_fails(self):
+        with pytest.raises(ValueError, match="target must be empty"):
+            SecretScope.CUSTOM.validate_fields("badtarget", "key")
+
+    def test_custom_empty_name_fails(self):
+        with pytest.raises(ValueError):
+            SecretScope.CUSTOM.validate_fields("", "")
+
+
+# ============================================================
+# SecretRef
+# ============================================================
+
+class TestSecretRef:
+    def test_global_ref_construction(self):
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "pw")
+        assert ref.namespace == "ns"
+        assert ref.scope == SecretScope.GLOBAL
+        assert ref.target == ""
+        assert ref.name == "pw"
+
+    def test_service_ref(self):
+        ref = SecretRef("ns", SecretScope.SERVICE, "prom", "auth")
+        assert ref.target == "prom"
+
+    def test_host_ref(self):
+        ref = SecretRef("ns", SecretScope.HOST, "n1", "k")
+        assert ref.name == "k"
+
+    def test_custom_ref(self):
+        ref = SecretRef("ns", SecretScope.CUSTOM, "", "a/b/c")
+        assert ref.name == "a/b/c"
+
+    def test_is_frozen(self):
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "k")
+        with pytest.raises(Exception):
+            ref.name = "other"  # type: ignore[misc]
+
+    def test_scope_coerced_from_string(self):
+        ref = SecretRef("ns", "host", "node1", "k")
+        assert ref.scope == SecretScope.HOST
+
+    def test_invalid_scope_raises(self):
+        with pytest.raises(ValueError):
+            SecretRef("ns", "badscope", "", "k")
+
+    def test_invalid_namespace_raises(self):
+        with pytest.raises(ValueError):
+            SecretRef("bad ns", SecretScope.GLOBAL, "", "k")
+
+    def test_ident_global(self):
+        ref = SecretRef("ns", SecretScope.GLOBAL, "", "k")
+        assert ref.ident() == ("ns", "global", "", "k")
+
+    def test_ident_service(self):
+        ref = SecretRef("ns", SecretScope.SERVICE, "t", "n")
+        assert ref.ident() == ("ns", "service", "t", "n")
+
+    def test_to_uri_global(self):
+        ref = SecretRef("cephadm", SecretScope.GLOBAL, "", "pw")
+        assert ref.to_uri() == "secret:/cephadm/global/pw"
+
+    def test_to_uri_service(self):
+        ref = SecretRef("ns", SecretScope.SERVICE, "prom", "auth")
+        assert ref.to_uri() == "secret:/ns/service/prom/auth"
+
+    def test_to_uri_host(self):
+        ref = SecretRef("ns", SecretScope.HOST, "node1", "ssh")
+        assert ref.to_uri() == "secret:/ns/host/node1/ssh"
+
+    def test_to_uri_custom(self):
+        ref = SecretRef("ns", SecretScope.CUSTOM, "", "a/b/c")
+        assert ref.to_uri() == "secret:/ns/custom/a/b/c"
+
+    def test_equality(self):
+        r1 = SecretRef("ns", SecretScope.GLOBAL, "", "k")
+        r2 = SecretRef("ns", SecretScope.GLOBAL, "", "k")
+        assert r1 == r2
+
+    def test_inequality_different_name(self):
+        r1 = SecretRef("ns", SecretScope.GLOBAL, "", "k1")
+        r2 = SecretRef("ns", SecretScope.GLOBAL, "", "k2")
+        assert r1 != r2
+
+
+# ============================================================
+# BadSecretURI
+# ============================================================
+
+class TestBadSecretURI:
+    def test_construction(self):
+        b = BadSecretURI(raw="secret:/bad/scope/key", error="bad scope", namespace="ns")
+        assert b.raw == "secret:/bad/scope/key"
+        assert b.error == "bad scope"
+
+    def test_to_uri_returns_raw(self):
+        b = BadSecretURI(raw="secret:/bad", error="err", namespace="ns")
+        assert b.to_uri() == "secret:/bad"
+
+    def test_is_frozen(self):
+        b = BadSecretURI(raw="x", error="e", namespace="n")
+        with pytest.raises(Exception):
+            b.raw = "y"  # type: ignore[misc]
+
+
+# ============================================================
+# parse_secret_uri
+# ============================================================
+
+class TestParseSecretUri:
+    # --- valid inputs ---
+    def test_global(self):
+        ref = parse_secret_uri("secret:/ns/global/pw")
+        assert ref.scope == SecretScope.GLOBAL
+        assert ref.name == "pw"
+
+    def test_service(self):
+        ref = parse_secret_uri("secret:/ns/service/prom/auth")
+        assert ref.scope == SecretScope.SERVICE
+        assert ref.target == "prom"
+        assert ref.name == "auth"
+
+    def test_host(self):
+        ref = parse_secret_uri("secret:/ns/host/node1/ssh")
+        assert ref.target == "node1"
+        assert ref.name == "ssh"
+
+    def test_custom_flat(self):
+        ref = parse_secret_uri("secret:/ns/custom/single")
+        assert ref.scope == SecretScope.CUSTOM
+        assert ref.name == "single"
+
+    def test_custom_nested(self):
+        ref = parse_secret_uri("secret:/ns/custom/a/b/c")
+        assert ref.name == "a/b/c"
+
+    # --- invalid inputs ---
+    def test_wrong_scheme(self):
+        with pytest.raises(CephSecretException, match="Not a secret uri"):
+            parse_secret_uri("http://example.com/foo")
+
+    def test_authority_rejected(self):
+        with pytest.raises(CephSecretException, match="authority"):
+            parse_secret_uri("secret://ns/global/key")
+
+    def test_query_string_rejected(self):
+        with pytest.raises(CephSecretException, match="query"):
+            parse_secret_uri("secret:/ns/global/key?x=y")
+
+    def test_fragment_rejected(self):
+        with pytest.raises(CephSecretException, match="query"):
+            parse_secret_uri("secret:/ns/global/key#frag")
+
+    def test_percent_encoding_rejected(self):
+        with pytest.raises(CephSecretException, match="percent-encoding"):
+            parse_secret_uri("secret:/ns/global/my%2Dkey")
+
+    def test_too_short(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_uri("secret:/ns/global")
+
+    def test_bad_scope(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_uri("secret:/ns/vault/key")
+
+    def test_non_string_input(self):
+        with pytest.raises(CephSecretException, match="must be a string"):
+            parse_secret_uri(42)  # type: ignore[arg-type]
+
+    def test_global_with_extra_segment_rejected(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_uri("secret:/ns/global/target/name")
+
+    def test_service_missing_name(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_uri("secret:/ns/service/prom")
+
+
+# ============================================================
+# parse_secret_path
+# ============================================================
+
+class TestParseSecretPath:
+    # --- valid inputs ---
+    def test_global(self):
+        ref = parse_secret_path("cephadm/global/pw")
+        assert ref.namespace == "cephadm"
+        assert ref.scope == SecretScope.GLOBAL
+        assert ref.name == "pw"
+
+    def test_service(self):
+        ref = parse_secret_path("ns/service/prom/auth")
+        assert ref.target == "prom"
+        assert ref.name == "auth"
+
+    def test_host(self):
+        ref = parse_secret_path("ns/host/node1/ssh_key")
+        assert ref.name == "ssh_key"
+
+    def test_custom_flat(self):
+        ref = parse_secret_path("ns/custom/flat")
+        assert ref.scope == SecretScope.CUSTOM
+        assert ref.name == "flat"
+
+    def test_custom_nested(self):
+        ref = parse_secret_path("ns/custom/a/b/c")
+        assert ref.name == "a/b/c"
+
+    def test_leading_slash_stripped(self):
+        ref = parse_secret_path("/ns/global/k")
+        assert ref.namespace == "ns"
+
+    # --- invalid inputs ---
+    def test_empty_string(self):
+        with pytest.raises(CephSecretException, match="empty"):
+            parse_secret_path("")
+
+    def test_non_string(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_path(None)  # type: ignore[arg-type]
+
+    def test_too_few_segments(self):
+        with pytest.raises(CephSecretException, match="Use"):
+            parse_secret_path("ns/global")
+
+    def test_double_slash(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_path("ns//global/key")
+
+    def test_trailing_slash(self):
+        with pytest.raises(CephSecretException, match="empty segment"):
+            parse_secret_path("ns/global/key/")
+
+    def test_bad_scope(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_path("ns/badscope/key")
+
+    def test_global_extra_segment(self):
+        with pytest.raises(CephSecretException, match="global scope"):
+            parse_secret_path("ns/global/target/name")
+
+    def test_service_missing_name(self):
+        with pytest.raises(CephSecretException, match="service"):
+            parse_secret_path("ns/service/target")
+
+    def test_host_missing_name(self):
+        with pytest.raises(CephSecretException, match="host"):
+            parse_secret_path("ns/host/target")
+
+
+# ============================================================
+# Whitespace / canonicality
+# ============================================================
+
+class TestParseSecretPathWhitespace:
+    @pytest.mark.parametrize("path", [
+        " ns/global/key",
+        "ns/global/key ",
+        "\tns/global/key",
+        "ns/global/key\n",
+    ])
+    def test_rejects_outer_whitespace(self, path):
+        with pytest.raises(CephSecretException):
+            parse_secret_path(path)
+
+
+class TestParseSecretUriWhitespace:
+    def test_rejects_leading_whitespace(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_uri(" secret:/ns/global/key")
+
+    def test_rejects_trailing_whitespace(self):
+        with pytest.raises(CephSecretException):
+            parse_secret_uri("secret:/ns/global/key ")

From ead4ef7f9af55088b27a43969bcc0e093ea85ed4 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 8 Jun 2026 11:54:17 +0200
Subject: [PATCH 186/596] doc/mgr/ceph_secrets: add documentation for the
 ceph_secrets module

Document CLI commands (set/get/get-value/ls/rm), the Python API via
CephSecretsClient, secret URI embedding and resolution, and epoch-based
change detection.

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 doc/mgr/ceph_secrets.rst | 437 +++++++++++++++++++++++++++++++++++++++
 doc/mgr/index.rst        |   1 +
 2 files changed, 438 insertions(+)
 create mode 100644 doc/mgr/ceph_secrets.rst

diff --git a/doc/mgr/ceph_secrets.rst b/doc/mgr/ceph_secrets.rst
new file mode 100644
index 00000000000..45675c002d2
--- /dev/null
+++ b/doc/mgr/ceph_secrets.rst
@@ -0,0 +1,437 @@
+.. _mgr-ceph-secrets:
+
+===================
+Ceph Secrets Module
+===================
+
+The ``ceph_secrets`` manager module provides centralised secret storage for
+Ceph operators and Ceph manager modules.  Instead of embedding plaintext
+credentials in service specifications or configuration objects, secrets are
+stored once and referenced by URI.  Ceph manager modules such as cephadm
+and rook can store secret payloads centrally, reference them by URI, and
+resolve them to plaintext only when needed at deploy time.
+
+For example, a cephadm-managed service may need an API token.  Instead of
+embedding that token directly in the service specification, an operator can
+store it once:
+
+.. prompt:: bash $
+
+   ceph secret set cephadm/service/my-service/api_token -i /tmp/api-token
+
+and then use the URI
+``secret:/cephadm/service/my-service/api_token`` in the
+service spec instead of the plaintext token.  A cephadm integration can then
+resolve the URI at deploy time and write the token only into the daemon files
+that need it.
+
+Secrets are stored in the Mon KV store under the ``secret_store/v1/`` prefix
+and are organised by namespace, scope, and name.  Each secret is versioned and
+carries ``created``/``updated`` timestamps.  A per-namespace epoch counter
+is incremented on every ``set`` and on any ``rm`` that actually removes a
+secret, allowing consumers to detect changes without fetching the full secret
+list.
+
+.. note::
+
+   The ``mon`` backend stores secrets in the Mon KV store, which is not an
+   external KMS or vault.  Users and MGR modules with sufficient Ceph
+   permissions can still reveal or resolve stored secret values.  Namespaces
+   provide logical and storage isolation, not an authorisation boundary.
+
+If the module is not already enabled, run::
+
+    ceph mgr module enable ceph_secrets
+
+.. contents::
+   :local:
+   :depth: 2
+
+
+Concepts
+========
+
+Namespace
+---------
+
+A namespace is a logical storage boundary, typically matching the name of
+the consuming MGR module (e.g. ``cephadm``, ``rook``).  Secrets in different
+namespaces are stored independently and have independent epoch counters.
+Namespaces are not an authorisation boundary; any caller with access to the
+``ceph_secrets`` module can read secrets from any namespace.
+
+Scope
+-----
+
+Within a namespace, every secret has a scope that encodes what the secret
+belongs to:
+
+.. list-table::
+   :header-rows: 1
+   :widths: 15 40 45
+
+   * - Scope
+     - Meaning
+     - CLI path form
+   * - ``global``
+     - Cluster-wide secret, not tied to any specific target
+     - ``<namespace>/global/<name>``
+   * - ``service``
+     - Secret for a specific named service
+     - ``<namespace>/service/<service-name>/<name>``
+   * - ``host``
+     - Secret for a specific host
+     - ``<namespace>/host/<hostname>/<name>``
+   * - ``custom``
+     - Arbitrary slash-delimited path under the namespace
+     - ``<namespace>/custom/<path>``
+
+Path grammar
+------------
+
+All path segments (namespace, scope target, name, and each segment of a
+custom path) must match ``[A-Za-z0-9._-]+`` and must not end with ``'.'``.
+Empty segments, percent-encoding, and leading/trailing whitespace are
+rejected.
+
+Custom scope paths may contain multiple slash-separated segments (e.g.
+``cephadm/custom/app/db/password``).  Two custom paths that share a common
+prefix are independent secrets; ``cephadm/custom/a/b`` and
+``cephadm/custom/a/b/c`` do not conflict.
+
+Secret URIs
+-----------
+
+Internally, secrets are identified by URIs of the form::
+
+    secret:/<namespace>/global/<name>
+    secret:/<namespace>/service/<target>/<name>
+    secret:/<namespace>/host/<target>/<name>
+    secret:/<namespace>/custom/<path>
+
+These URIs appear in the output of :ref:`scan_refs <mgr-ceph-secrets-scan>`
+and may be embedded in configuration objects as opaque references to be
+resolved at deploy time.
+
+
+CLI Reference
+=============
+
+All CLI commands use the path form described above.  Responses are JSON by
+default; pass ``--format yaml`` for YAML output.
+
+.. _mgr-ceph-secrets-set:
+
+secret set
+----------
+
+Create or update a secret. The input file content is stored as an opaque string::
+
+    ceph secret set <path> -i <file>
+
+Secret data must not be empty.  Other contents, including leading or trailing
+whitespace and final newlines, are preserved exactly.  Callers that need to
+store structured data should encode it themselves, for example as JSON, and
+decode it after retrieval or resolution.
+
+If the secret already exists its data is replaced and its version
+incremented, unless the existing secret policy marks it non-editable (set via
+the Python API with ``editable=False``), in which case the update is rejected.
+The ``created`` timestamp is set on the first write and is never changed
+thereafter; ``updated`` is refreshed on every write.
+
+Example:
+
+.. prompt:: bash $
+
+   ceph secret set cephadm/service/my-service/api_token -i /tmp/api-token
+   {"metadata": {"version": 1, "created": "2025-06-01T12:00:00Z", "updated": "2025-06-01T12:00:00Z"}}
+
+.. _mgr-ceph-secrets-get:
+
+secret get
+----------
+
+Retrieve the metadata (and, optionally, the data) for a secret::
+
+    ceph secret get <path> [--reveal] [--format {json|yaml}]
+
+Without ``--reveal``, the ``data`` field is omitted from the response to
+avoid accidental exposure in terminal output or logs.  With ``--reveal``,
+``data`` contains the stored opaque string.
+
+Example:
+
+.. prompt:: bash $
+
+   ceph secret get cephadm/service/my-service/api_token
+   {
+     "metadata": {
+       "version": 1,
+       "created": "2025-06-01T12:00:00Z",
+       "updated": "2025-06-01T12:00:00Z"
+     }
+   }
+
+   ceph secret get cephadm/service/my-service/api_token --reveal
+   {
+     "metadata": {
+       "version": 1,
+       "created": "2025-06-01T12:00:00Z",
+       "updated": "2025-06-01T12:00:00Z"
+     },
+     "data": "api-token-value"
+   }
+
+.. _mgr-ceph-secrets-get-value:
+
+secret get-value
+----------------
+
+Return the raw secret data string directly, with no JSON envelope::
+
+    ceph secret get-value <path>
+
+Unlike ``secret get --reveal``, the output is the stored string itself,
+making it suitable for use in shell scripts and pipelines.  Returns an
+error if the secret does not exist.
+
+Example:
+
+.. prompt:: bash $
+
+   ceph secret get-value cephadm/service/my-service/api_token
+   api-token-value
+
+.. _mgr-ceph-secrets-ls:
+
+secret ls
+---------
+
+List secrets, optionally filtered by namespace, scope, and/or target::
+
+    ceph secret ls [--namespace <ns>] [--scope <scope>]
+                   [--sec_target <target>] [--reveal] [--show_internals]
+                   [--format {json|yaml}]
+
+Without filters, all secrets across all namespaces are listed.
+``--reveal`` includes the stored opaque data string in each output record.
+``--show_internals`` additionally includes the ``policy`` object (``user_made``
+and ``editable`` flags) in each record.
+
+Example:
+
+.. prompt:: bash $
+
+   ceph secret ls --namespace cephadm --scope host --sec_target node1
+   {
+     "cephadm/host/node1/ssh_key": {
+       "metadata": {
+         "version": 3,
+         "created": "2025-05-10T08:00:00Z",
+         "updated": "2025-06-01T09:00:00Z"
+       },
+       "ref": {
+         "namespace": "cephadm",
+         "scope": "host",
+         "target": "node1",
+         "name": "ssh_key"
+       }
+     }
+   }
+
+.. _mgr-ceph-secrets-rm:
+
+secret rm
+---------
+
+Remove a secret::
+
+    ceph secret rm <path>
+
+The operation is idempotent: removing a secret that does not exist succeeds
+and reports ``"status": "not_found"`` rather than an error.
+
+Example:
+
+.. prompt:: bash $
+
+   ceph secret rm cephadm/service/my-service/api_token
+   {"status": "removed"}
+
+   ceph secret rm cephadm/service/my-service/api_token
+   {"status": "not_found"}
+
+.. _mgr-ceph-secrets-get-epoch:
+
+Epoch
+-----
+
+The epoch for a namespace is accessible via the Python API only (see
+:ref:`Epoch-based change detection <mgr-ceph-secrets-epoch>`).  There is
+no CLI command for it.
+
+
+Module API
+==========
+
+Other MGR modules should consume ``ceph_secrets`` via ``CephSecretsClient``
+(``src/pybind/mgr/ceph_secrets_client.py``) rather than calling
+``mgr.remote()`` directly.  The client file, along with
+``ceph_secrets_types.py``, lives at the top level of ``src/pybind/mgr/`` so
+any MGR module can import it without depending on the ``ceph_secrets`` package
+internals.
+
+.. code-block:: python
+
+    from ceph_secrets_client import CephSecretsClient
+    from ceph_secrets_types import SecretScope
+
+    client = CephSecretsClient(self)   # self is a MgrModule instance
+
+    # Store a secret as an opaque string
+    client.secret_set(
+        namespace="cephadm",
+        scope=SecretScope.HOST,
+        target="node1",
+        name="ssh_key",
+        data="AQB...==",
+    )
+
+    # Retrieve metadata (no data unless reveal=True)
+    rec = client.secret_get("cephadm", SecretScope.HOST, "node1", "ssh_key")
+    if rec:
+        version = rec["metadata"]["version"]
+
+    # Remove
+    client.secret_rm("cephadm", SecretScope.HOST, "node1", "ssh_key")
+
+CephSecretsClient methods
+--------------------------
+
+.. list-table::
+   :header-rows: 1
+   :widths: 35 65
+
+   * - Method
+     - Description
+   * - ``secret_set(namespace, scope, target, name, data, ...)``
+     - Create or update a secret.  ``data`` must be a non-empty opaque
+       string.  Increments the version and refreshes ``updated`` on each
+       call; ``created`` is set only on the first write.  Optional
+       ``user_made`` and ``editable`` flags control the stored policy;
+       ``editable=False`` blocks future updates but does not prevent removal.
+   * - ``secret_get(namespace, scope, target, name, reveal=False)``
+     - Return the secret's metadata dict, plus the opaque ``data`` string if
+       *reveal* is True.  Returns ``None`` if the secret does not exist.
+   * - ``secret_get_value(namespace, scope, target, name)``
+     - Return the stored opaque string directly, or ``None`` if the secret
+       does not exist.  Use this when only the value is needed and the
+       metadata envelope is not required.
+   * - ``secret_get_version(namespace, scope, target, name)``
+     - Return the current version integer, or ``None`` if not found.  A
+       cheaper alternative to ``secret_get`` when only change-detection is needed.
+   * - ``secret_get_versions(uris)``
+     - Batch-fetch version numbers for a list of canonical ``secret:/...``
+       URIs.  Returns a dict keyed by URI; missing secrets map to ``None``.
+       Malformed URIs are skipped entirely, so a missing key indicates
+       malformed input rather than an absent secret.
+   * - ``secret_rm(namespace, scope, target, name)``
+     - Remove a secret.  Idempotent: returns ``False`` if not found.
+   * - ``secret_get_epoch(namespace)``
+     - Return the current epoch for the namespace.  Use as a cheap
+       change-detector before a full refresh.
+   * - ``scan_refs(obj, namespace)``
+     - Walk a JSON-like object and return secret-like reference strings found
+       within it.  This includes valid whole-value secret URIs and malformed
+       or embedded secret-like references that should be reported to the
+       caller.  Only canonical ``secret:/...`` URIs should be passed to
+       ``secret_get_versions``.
+   * - ``scan_unresolved_refs(obj, namespace)``
+     - Like ``scan_refs`` but returns only references that are missing,
+       malformed, embedded inside a larger string, or cannot currently be
+       read successfully.  Useful for pre-flight validation.
+   * - ``resolve_object(obj)``
+     - Walk a JSON-like object and replace every whole-value ``secret:/...``
+       URI string with the stored opaque string for the referenced secret.
+
+.. _mgr-ceph-secrets-scan:
+
+Secret URI embedding and resolution
+-----------------------------------
+
+Configuration objects that need to reference secrets without embedding
+plaintext can store ``secret:/...`` URIs as string values.  The module
+resolves them on demand:
+
+.. code-block:: python
+
+    spec = {
+        "service_type": "my-service",
+        "spec": {
+            "api_token": " secret:/cephadm/service/my-service/api_token ",
+        },
+    }
+
+    # Check for missing, malformed, embedded, or unresolvable secret references
+    unresolved = client.scan_unresolved_refs(spec, namespace="cephadm")
+    if unresolved:
+        raise RuntimeError(f"Unresolved secret references: {unresolved}")
+
+    # Replace URI references with plaintext values
+    resolved = client.resolve_object(spec)
+    # resolved["spec"]["api_token"] now holds the stored API token
+
+.. note::
+
+   Resolution replaces the entire string value of a field.  Surrounding
+   whitespace around a URI reference is ignored, so values such as
+   ``" secret:/cephadm/global/foo "`` are accepted.  Embedding a secret URI
+   inside a larger string (for example ``"Bearer secret:/..."``) is not
+   supported; after trimming surrounding whitespace, the field value must be
+   the URI.
+
+   The resolved value is the stored opaque string.  The module does not parse
+   stored data as JSON and does not support field-level URI selection.  If a
+   caller stores structured data, it must encode and decode that structure
+   itself.
+
+.. _mgr-ceph-secrets-epoch:
+
+Epoch-based change detection
+----------------------------
+
+Consumers that maintain a local cache of secrets can use the epoch to avoid
+unnecessary full refreshes:
+
+.. code-block:: python
+
+    def maybe_refresh(client, namespace, last_epoch):
+        current_epoch = client.secret_get_epoch(namespace)
+        if current_epoch == last_epoch:
+            return last_epoch   # nothing changed
+        # ... do a full refresh ...
+        return current_epoch
+
+    last_epoch = 0
+    last_epoch = maybe_refresh(client, "cephadm", last_epoch)
+
+The epoch is incremented by every successful ``set`` operation and by
+``rm`` only when an existing secret is actually removed (an idempotent
+``rm`` returning ``"not_found"`` does not bump the epoch).  It starts at 0
+for a namespace that has never been written to, and mutations in one namespace
+never affect another namespace's epoch.
+
+
+Configuration
+=============
+
+.. mgr_module:: ceph_secrets
+.. confval:: secrets_backend
+
+   :type: str
+   :default: ``mon``
+
+   The storage backend used for secrets.  Currently only the Mon KV store
+   (``mon``) is supported.  This option is reserved for future backends
+   (e.g. HashiCorp Vault).
diff --git a/doc/mgr/index.rst b/doc/mgr/index.rst
index e3c9f688204..25b629dbb80 100644
--- a/doc/mgr/index.rst
+++ b/doc/mgr/index.rst
@@ -47,5 +47,6 @@ sensible.
     MDS Autoscaler module <mds_autoscaler>
     NFS module <nfs>
     SMB module <smb>
+    Secrets module <ceph_secrets>
     Progress Module <progress>
     CLI API Commands module <cli_api>

From 8a28a1578e75b22476f8c0c4e1ba0688073df94d Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Thu, 4 Jun 2026 12:45:58 +0200
Subject: [PATCH 187/596] mgr: adding ceph_secrets_xxx.py files to the
 build/packaging

Fixes: https://tracker.ceph.com/issues/74562
Assisted-by: Claude <claude.ai>
Assisted-by: ChatGPT <chatgpt.com>
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 ceph.spec.in                  | 2 ++
 src/pybind/mgr/CMakeLists.txt | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 780889d5e73..352a70d2c14 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -1925,6 +1925,8 @@ fi
 %{_datadir}/ceph/mgr/mgr_module.*
 %{_datadir}/ceph/mgr/mgr_util.*
 %{_datadir}/ceph/mgr/object_format.*
+%{_datadir}/ceph/mgr/ceph_secrets_client.*
+%{_datadir}/ceph/mgr/ceph_secrets_types.*
 %{_datadir}/ceph/mgr/cherrypy_mgr.*
 %{_unitdir}/ceph-mgr@.service
 %{_unitdir}/ceph-mgr.target
diff --git a/src/pybind/mgr/CMakeLists.txt b/src/pybind/mgr/CMakeLists.txt
index 36abd1bb53f..f416f16e922 100644
--- a/src/pybind/mgr/CMakeLists.txt
+++ b/src/pybind/mgr/CMakeLists.txt
@@ -59,5 +59,5 @@ set(mgr_modules
 install(DIRECTORY ${mgr_modules}
   DESTINATION ${CEPH_INSTALL_DATADIR}/mgr
   ${mgr_module_install_excludes})
-install(FILES mgr_module.py mgr_util.py object_format.py cherrypy_mgr.py
+install(FILES mgr_module.py mgr_util.py object_format.py cherrypy_mgr.py ceph_secrets_client.py ceph_secrets_types.py
   DESTINATION ${CEPH_INSTALL_DATADIR}/mgr)

From 95a8c70be86569ef19f3d5c1b11f7cebed682db5 Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Thu, 11 Jun 2026 14:49:04 +0530
Subject: [PATCH 188/596] mgr/dashboard: fix zone creation in rgw service
 creation form

The zone creation request from the rgw service creation form was missing
the tier_type, sync_from and sync_from_all properties as a result the
zone creation was failing. This PR tends to fix this issue.

Fixes: https://tracker.ceph.com/issues/77263

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 .../create-rgw-service-entities.component.ts                   | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.ts
index 03206a6ddc3..e849c1bdbe6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.ts
@@ -75,6 +75,9 @@ export class CreateRgwServiceEntitiesComponent extends CdForm implements OnInit
     this.zone.system_key = new SystemKey();
     this.zone.system_key.access_key = '';
     this.zone.system_key.secret_key = '';
+    this.zone.tier_type = '';
+    this.zone.sync_from = '';
+    this.zone.sync_from_all = true;
     this.rgwRealmService
       .create(this.realm, true)
       .toPromise()

From e98037a639cec14dd9d70b9938b961da0df18cd2 Mon Sep 17 00:00:00 2001
From: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Date: Thu, 9 Apr 2026 00:09:17 +0530
Subject: [PATCH 189/596] rbd-mirror: fix missing initialization of Peer UUID

Initialize the uuid member in the Peer constructor and include it in
stream output operator to ensure correct peer identification in logs.

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
---
 src/tools/rbd_mirror/Types.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/tools/rbd_mirror/Types.h b/src/tools/rbd_mirror/Types.h
index c4357d9f2d8..f5e9c67fde8 100644
--- a/src/tools/rbd_mirror/Types.h
+++ b/src/tools/rbd_mirror/Types.h
@@ -103,7 +103,8 @@ struct Peer {
        librados::IoCtx& io_ctx,
        const RemotePoolMeta& remote_pool_meta,
        MirrorStatusUpdater<I>* mirror_status_updater)
-    : io_ctx(io_ctx),
+    : uuid(uuid),
+      io_ctx(io_ctx),
       remote_pool_meta(remote_pool_meta),
       mirror_status_updater(mirror_status_updater) {
   }
@@ -115,7 +116,8 @@ struct Peer {
 
 template <typename I>
 std::ostream& operator<<(std::ostream& os, const Peer<I>& peer) {
-  return os << peer.remote_pool_meta;
+  return os << "uuid=" << peer.uuid << ", "
+            << peer.remote_pool_meta;
 }
 
 struct PeerSpec {

From cae12eccddf0499f9c4dffa75ee23fd4b088ffb3 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Thu, 11 Jun 2026 11:33:42 +0000
Subject: [PATCH 190/596] crimson/osd: fix PGBackend::remove() to return ENOENT
 on no-op deletes

PGBackend::remove() was returning success when asked to delete a
non-existent object or an already-whiteout object that must remain
a whiteout. The classic OSD returns -ENOENT in both cases. Fix both
paths to return enoent, and remove the duplicate !os.exists check.

Fixes: https://tracker.ceph.com/issues/76529
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 src/crimson/osd/pg_backend.cc | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/crimson/osd/pg_backend.cc b/src/crimson/osd/pg_backend.cc
index b8971b2be2b..6a2e57d0992 100644
--- a/src/crimson/osd/pg_backend.cc
+++ b/src/crimson/osd/pg_backend.cc
@@ -1021,17 +1021,13 @@ PGBackend::remove(ObjectState& os, ceph::os::Transaction& txn,
   bool whiteout,
   int num_bytes)
 {
-  if (!os.exists) {
-    return crimson::ct_error::enoent::make();
-  }
-
   if (!os.exists) {
     logger().debug("{} {} does not exist",__func__, os.oi.soid);
-    return seastar::now();
+    return crimson::ct_error::enoent::make();
   }
   if (whiteout && os.oi.is_whiteout()) {
     logger().debug("{} whiteout set on {} ",__func__, os.oi.soid);
-    return seastar::now();
+    return crimson::ct_error::enoent::make();
   }
   txn.remove(coll->get_cid(),
 	     ghobject_t{os.oi.soid, ghobject_t::NO_GEN, get_shard()});

From b126cffe85e95d94e7e048bd9e51a97ec8840938 Mon Sep 17 00:00:00 2001
From: ShreeJejurikar <shreemj8@gmail.com>
Date: Thu, 11 Jun 2026 16:39:48 +0530
Subject: [PATCH 191/596] rgw: emit bucket logging record for lifecycle
 multipart upload abort

Signed-off-by: ShreeJejurikar <shreemj8@gmail.com>
---
 src/rgw/rgw_lc.cc                             | 14 +++--
 .../rgw/bucket_logging/test_bucket_logging.py | 62 +++++++++++++++++++
 2 files changed, 72 insertions(+), 4 deletions(-)

diff --git a/src/rgw/rgw_lc.cc b/src/rgw/rgw_lc.cc
index 8b6adba2b8c..941c955e4b6 100644
--- a/src/rgw/rgw_lc.cc
+++ b/src/rgw/rgw_lc.cc
@@ -707,8 +707,9 @@ static void send_notification(const DoutPrefixProvider* dpp,
   }
 }
 
-// Op name used in journal records for LC-driven deletions.
+// Op names used in records for LC-driven actions.
 static const std::string lifecycle_delete_object_op = "LIFECYCLE.DELETE.OBJECT";
+static const std::string lifecycle_delete_upload_op = "LIFECYCLE.DELETE.UPLOAD";
 
 // LC has no req_state, so the source bucket's owner stands in as the
 // identity for the log-bucket write permission check.
@@ -720,7 +721,8 @@ static void send_log_record(const DoutPrefixProvider* dpp,
                             const std::string& etag,
                             uint64_t size,
                             const std::string& version_id,
-                            const std::string& op_name) {
+                            const std::string& op_name,
+                            rgw::bucketlogging::LoggingType logging_type) {
   rgw::bucketlogging::record_input input;
   input.bucket = bucket;
   input.user_or_account = to_string(bucket->get_owner());
@@ -729,7 +731,7 @@ static void send_log_record(const DoutPrefixProvider* dpp,
 
   const int ret = rgw::bucketlogging::log_record(
       driver,
-      rgw::bucketlogging::LoggingType::Journal,
+      logging_type,
       obj, input, op_name, etag, size, dpp, y,
       /*async_completion=*/true,
       /*log_source_bucket=*/false);
@@ -836,7 +838,8 @@ static int remove_expired_obj(const DoutPrefixProvider* dpp,
     }
     if (log_op_name) {
       send_log_record(dpp, y, driver, obj.get(), oc.bucket, etag, size,
-                      version_id, *log_op_name);
+                      version_id, *log_op_name,
+                      rgw::bucketlogging::LoggingType::Journal);
     }
   }
 
@@ -1001,6 +1004,9 @@ int RGWLC::handle_multipart_expiration(rgw::sal::Bucket* target,
         const auto event_type = rgw::notify::ObjectExpirationAbortMPU;
         send_notification(this, y, driver, sal_obj.get(), target, etag, size,
                           obj.key.instance, {event_type});
+        send_log_record(this, y, driver, sal_obj.get(), target, etag, size,
+                        obj.key.instance, lifecycle_delete_upload_op,
+                        rgw::bucketlogging::LoggingType::Standard);
         if (perfcounter) {
           perfcounter->inc(l_rgw_lc_abort_mpu, 1);
         }
diff --git a/src/test/rgw/bucket_logging/test_bucket_logging.py b/src/test/rgw/bucket_logging/test_bucket_logging.py
index 9e87c30e86c..f798ccc72ca 100644
--- a/src/test/rgw/bucket_logging/test_bucket_logging.py
+++ b/src/test/rgw/bucket_logging/test_bucket_logging.py
@@ -381,6 +381,28 @@ def read_journal_records(s3_client, log_bucket, source_bucket, prefix=None, sett
     return records
 
 
+def wait_for_mpu_gone(s3_client, bucket, upload_id, timeout=30, interval=1):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        resp = s3_client.list_multipart_uploads(Bucket=bucket)
+        if not any(u.get('UploadId') == upload_id for u in resp.get('Uploads', [])):
+            return True
+        time.sleep(interval)
+    return False
+
+
+def abort_pending_mpus(s3_client, bucket):
+    try:
+        resp = s3_client.list_multipart_uploads(Bucket=bucket)
+    except ClientError:
+        return
+    for u in resp.get('Uploads', []):
+        try:
+            s3_client.abort_multipart_upload(Bucket=bucket, Key=u['Key'], UploadId=u['UploadId'])
+        except ClientError:
+            pass
+
+
 @pytest.fixture
 def lc_fast():
     set_lc_debug_interval(5)
@@ -1015,6 +1037,46 @@ def test_lc_current_expiration_dm_branch_does_not_log(s3_client, logging_type, l
         cleanup_bucket(s3_client, log_bucket)
 
 
+@pytest.mark.basic_test
+def test_lc_abort_mpu_logs_standard_record(s3_client, logging_type, lc_fast):
+    """LC AbortIncompleteMultipartUpload emits a Standard-mode LIFECYCLE.DELETE.UPLOAD record."""
+    if logging_type != 'Standard':
+        pytest.skip("AbortIncompleteMultipartUpload logging is Standard-mode-only")
+    source = gen_bucket_name("lc-mpu-source")
+    log_bucket = gen_bucket_name("lc-mpu-log")
+    key = 'incomplete-mpu.bin'
+
+    try:
+        assert create_bucket_with_logging(s3_client, source, log_bucket)
+        apply_lc_config(s3_client, source, [
+            make_lc_rule(AbortIncompleteMultipartUpload={'DaysAfterInitiation': 1})
+        ])
+
+        upload_id = s3_client.create_multipart_upload(Bucket=source, Key=key)['UploadId']
+
+        time.sleep(lc_fast + 2)
+        trigger_lc_processing()
+        assert wait_for_mpu_gone(s3_client, source, upload_id), "LC did not abort the incomplete multipart upload"
+
+        time.sleep(5)
+        admin(['bucket', 'logging', 'flush', '--bucket', source])
+        resp = s3_client.list_objects_v2(Bucket=log_bucket, Prefix=f'{source}/')
+        log_keys = [obj['Key'] for obj in resp.get('Contents', [])]
+        assert log_keys, "no log object emitted for MPU abort"
+
+        bodies = []
+        for log_key in log_keys:
+            body = s3_client.get_object(Bucket=log_bucket, Key=log_key)['Body'].read().decode('utf-8')
+            bodies.append(body)
+        joined = '\n'.join(bodies)
+        assert 'LIFECYCLE.DELETE.UPLOAD' in joined, f"LIFECYCLE.DELETE.UPLOAD not found in log: {joined!r}"
+
+    finally:
+        abort_pending_mpus(s3_client, source)
+        cleanup_bucket(s3_client, source)
+        cleanup_bucket(s3_client, log_bucket)
+
+
 @pytest.mark.basic_test
 def test_lc_runs_safely_without_logging_config(s3_client, lc_fast):
     """LC runs successfully on a bucket without bucket-logging configured."""

From 6761549c5a719f541a850f243318a1212b76c0a6 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
Date: Wed, 6 May 2026 20:41:33 +0530
Subject: [PATCH 192/596] mgr/DaemonServer: Aggregate and globally sort OSDs
 for ok-to-upgrade

The 'ok-to-upgrade' command output sorting did not scale accurately
when target CRUSH buckets contained multiple child buckets (e.g., a
chassis containing multiple hosts). OSDs were previously sorted
individually per child bucket and appended sequentially. This created
fragmented, per-host sort segments rather than a globally sorted list
for the parent bucket.

Changes:

1. Fix the issue above by aggregating all child OSDs into a single vector prior
to executing a single, global sort operation based on PG counts. Additionally,
optimize memory efficiency and future-proof the logic by reserving continuous
vector blocks to avoid dynamic heap reallocations.

2. Add integration tests with chassis and rack based CRUSH hierarchies which
verifies the ok-to-upgrade functionality. In addition, the tests crucially
verify the order of OSDs returned is according to the ascending order of
acting PG count. Additionally, make minor fix-ups to lines that determine the
length of a list in JSON response by removing the redundant "| bc".

Fixes: https://tracker.ceph.com/issues/77272
Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 qa/standalone/misc/ok-to-upgrade.sh | 436 ++++++++++++++++++++++++++--
 src/mgr/DaemonServer.cc             |  47 ++-
 2 files changed, 423 insertions(+), 60 deletions(-)

diff --git a/qa/standalone/misc/ok-to-upgrade.sh b/qa/standalone/misc/ok-to-upgrade.sh
index 5be0eee49fb..2bdb5d7497b 100755
--- a/qa/standalone/misc/ok-to-upgrade.sh
+++ b/qa/standalone/misc/ok-to-upgrade.sh
@@ -35,6 +35,33 @@ function run() {
     done
 }
 
+# Populate the global pg_count associative array with each OSD's acting
+# PG count from 'ceph osd df'.
+function snapshot_osd_pg_counts() {
+    declare -gA pg_count
+    pg_count=()
+    while read -r osd_id count; do
+        pg_count[$osd_id]=$count
+    done < <(ceph osd df --format=json | \
+             jq -r '.nodes[] | select(.id >= 0) | "\(.id) \(.pgs)"')
+}
+
+# Verify that the named OSD list in a JSON result is ordered in non-decreasing
+# acting PG count. Uses the global pg_count array populated by
+# snapshot_osd_pg_counts().
+# Usage: assert_osds_sorted_by_pg_count <field> <json>
+function assert_osds_sorted_by_pg_count() {
+    local field=$1
+    local json=$2
+    local prev_count=-1
+    local osd_id count
+    for osd_id in $(echo "$json" | jq -r ".${field}[]"); do
+        count=${pg_count[$osd_id]}
+        test "$count" -ge "$prev_count" || return 1
+        prev_count=$count
+    done
+}
+
 function TEST_ok_to_upgrade_invalid_args() {
     local dir=$1
     CEPH_ARGS="$ORIG_CEPH_ARGS --mon-host=$CEPH_MON "
@@ -103,9 +130,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
     # and verifies that at least the expected minimum OSDs are returned.
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -ge $exp_osds_upgradable || return 1
-    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test the same command as above, but exercise the 'max' parameter.
@@ -116,9 +143,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
     res=$(ceph osd ok-to-upgrade $crush_bucket $ceph_version $max --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -eq $exp_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test same command above with verbose syntax
@@ -126,9 +153,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
         --ceph_version $ceph_version --max $max --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -eq $exp_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for upgradability with min_size=1 and 1 OSD to upgrade. The outcome
@@ -139,9 +166,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
     res=$(ceph osd ok-to-upgrade $crush_bucket $ceph_version --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for upgradability with min_size=2
@@ -154,9 +181,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
     # 3 OSDs should be reported as upgradable.
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -ge $exp_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for upgradability with min_size=3
@@ -168,9 +195,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
     # No OSD should be reported as upgradable.
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = false || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for condition when all OSDs are running desired version.
@@ -179,9 +206,9 @@ function TEST_ok_to_upgrade_replicated_pool() {
     res=$(ceph osd ok-to-upgrade $crush_bucket $upgrade_version --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = true || return 1
     test $(echo $res | jq '.ok_to_upgrade') = false || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -eq 0 || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq $OSDS || return 1
 }
 
@@ -217,9 +244,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
     # in 3 OSDs being reported as upgradable.
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test the same command as above, but exercise the 'max' parameter.
@@ -230,9 +257,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
     res=$(ceph osd ok-to-upgrade $crush_bucket $ceph_version $max --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -eq $exp_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test command above with verbose syntax
@@ -240,9 +267,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
         --ceph_version $ceph_version --max $max --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -eq $exp_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for upgradability with min_size=5 and 1 OSD to upgrade. The outcome
@@ -253,9 +280,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
     res=$(ceph osd ok-to-upgrade $crush_bucket $ceph_version --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for upgradability with min_size=6
@@ -268,9 +295,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
     # 2 OSDs should be reported as upgradable.
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = true || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for upgradability with min_size=8
@@ -282,9 +309,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
     # No OSD should be reported as upgradable.
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = false || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq 0 || return 1
 
     # Test for condition when all OSDs are running desired version.
@@ -293,9 +320,9 @@ function TEST_ok_to_upgrade_erasure_pool() {
     res=$(ceph osd ok-to-upgrade $crush_bucket $ceph_version --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = true || return 1
     test $(echo $res | jq '.ok_to_upgrade') = false || return 1
-    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $num_osds_upgradable -eq 0 || return 1
-    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length' | bc)
+    num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
     test $num_osds_upgraded -eq $OSDS || return 1
 }
 
@@ -331,11 +358,360 @@ function TEST_ok_to_upgrade_bad_osd_version() {
     local res=$(ceph osd ok-to-upgrade $crush_bucket $ceph_version --format=json)
     test $(echo $res | jq '.all_osds_upgraded') = false || return 1
     test $(echo $res | jq '.ok_to_upgrade') = false || return 1
-    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length' | bc)
+    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
     test $exp_osds_upgradable = $num_osds_upgradable || return 1
-    local num_osds_bad_version=$(echo $res | jq '.bad_no_version | length' | bc)
+    local num_osds_bad_version=$(echo $res | jq '.bad_no_version | length')
     test $num_osds_bad_version -eq 3 || return 1
 }
 
+function TEST_ok_to_upgrade_chassis_bucket() {
+    local dir=$1
+    local poolname="test"
+    local OSDS=4
+    local ceph_version="01.2.3-1234-g1234deed"
+
+    CEPH_ARGS="$ORIG_CEPH_ARGS --mon-host=$CEPH_MON "
+
+    run_mon $dir a --public-addr=$CEPH_MON || return 1
+    run_mgr $dir x || return 1
+
+    for osd in $(seq 0 $(expr $OSDS - 1)); do
+      run_osd $dir $osd --osd-mclock-skip-benchmark=true || return 1
+    done
+
+    # Use size=2 so the pool can be satisfied with 2 distinct host buckets.
+    # min_size=1 allows upgrading all OSDs on one host simultaneously.
+    create_pool $poolname 8 8
+    ceph osd pool set $poolname pg_autoscale_mode off
+    ceph osd pool set $poolname size 2
+    ceph osd pool set $poolname min_size 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Build a chassis CRUSH hierarchy:
+    #   root "default"
+    #     chassis "chassis-0"
+    #       host "host-0-0" -> osd.0, osd.1
+    #       host "host-0-1" -> osd.2, osd.3
+    #
+    # OSDs start in auto-generated host buckets; crush set replaces each
+    # OSD's location with the new custom hierarchy.
+    ceph osd crush add-bucket chassis-0 chassis || return 1
+    ceph osd crush add-bucket host-0-0 host || return 1
+    ceph osd crush add-bucket host-0-1 host || return 1
+    ceph osd crush move host-0-0 chassis=chassis-0 || return 1
+    ceph osd crush move host-0-1 chassis=chassis-0 || return 1
+    ceph osd crush move chassis-0 root=default || return 1
+    ceph osd crush set 0 1.0 root=default chassis=chassis-0 host=host-0-0 || return 1
+    ceph osd crush set 1 1.0 root=default chassis=chassis-0 host=host-0-0 || return 1
+    ceph osd crush set 2 1.0 root=default chassis=chassis-0 host=host-0-1 || return 1
+    ceph osd crush set 3 1.0 root=default chassis=chassis-0 host=host-0-1 || return 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Snapshot acting PG counts per OSD. In a clean cluster 'pgs' in
+    # osd df equals the acting count the mgr's PGMap records internally.
+    snapshot_osd_pg_counts
+
+    # With min_size=1 some OSDs inside chassis-0 must be reported upgradable.
+    local res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -ge 1 || return 1
+    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
+    test $num_osds_upgraded -eq 0 || return 1
+
+    # Verify that osds_in_crush_bucket lists all chassis OSDs in non-decreasing
+    # order of acting PG count.  This directly tests the global sort inside
+    # _populate_crush_bucket_osds(): consecutive entries must never decrease.
+    assert_osds_sorted_by_pg_count osds_in_crush_bucket "$res" || return 1
+
+    # With max=1, exactly one OSD is returned.
+    local max=1
+    res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version $max --format=json)
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -eq 1 || return 1
+
+    # With min_size=2 on a size=2 pool, taking any OSD offline drops a PG
+    # below the minimum replica count -- no OSD should be upgradable.
+    ceph osd pool set $poolname min_size 2
+    sleep 5
+    wait_for_clean || return 1
+    res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = false || return 1
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -eq 0 || return 1
+}
+
+function TEST_ok_to_upgrade_rack_bucket() {
+    local dir=$1
+    local poolname="test"
+    local OSDS=4
+    local ceph_version="01.2.3-1234-g1234deed"
+
+    CEPH_ARGS="$ORIG_CEPH_ARGS --mon-host=$CEPH_MON "
+
+    run_mon $dir a --public-addr=$CEPH_MON || return 1
+    run_mgr $dir x || return 1
+
+    for osd in $(seq 0 $(expr $OSDS - 1)); do
+      run_osd $dir $osd --osd-mclock-skip-benchmark=true || return 1
+    done
+
+    # Use size=2 so the pool can be satisfied with 2 distinct host buckets.
+    # min_size=1 allows upgrading all OSDs on one host simultaneously.
+    create_pool $poolname 8 8
+    ceph osd pool set $poolname pg_autoscale_mode off
+    ceph osd pool set $poolname size 2
+    ceph osd pool set $poolname min_size 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Build a rack CRUSH hierarchy:
+    #   root "default"
+    #     rack "rack-0"
+    #       host "rack-host-0" -> osd.0, osd.1
+    #       host "rack-host-1" -> osd.2, osd.3
+    ceph osd crush add-bucket rack-0 rack || return 1
+    ceph osd crush add-bucket rack-host-0 host || return 1
+    ceph osd crush add-bucket rack-host-1 host || return 1
+    ceph osd crush move rack-host-0 rack=rack-0 || return 1
+    ceph osd crush move rack-host-1 rack=rack-0 || return 1
+    ceph osd crush move rack-0 root=default || return 1
+    ceph osd crush set 0 1.0 root=default rack=rack-0 host=rack-host-0 || return 1
+    ceph osd crush set 1 1.0 root=default rack=rack-0 host=rack-host-0 || return 1
+    ceph osd crush set 2 1.0 root=default rack=rack-0 host=rack-host-1 || return 1
+    ceph osd crush set 3 1.0 root=default rack=rack-0 host=rack-host-1 || return 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Snapshot acting PG counts per OSD. In a clean cluster 'pgs' in
+    # osd df equals the acting count the mgr's PGMap records internally.
+    snapshot_osd_pg_counts
+
+    # With min_size=1 some OSDs inside rack-0 must be reported upgradable.
+    local res=$(ceph osd ok-to-upgrade rack-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -ge 1 || return 1
+    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
+    test $num_osds_upgraded -eq 0 || return 1
+
+    # Verify that osds_in_crush_bucket lists all rack OSDs in non-decreasing
+    # order of acting PG count.  This directly tests the global sort inside
+    # _populate_crush_bucket_osds(): consecutive entries must never decrease.
+    assert_osds_sorted_by_pg_count osds_in_crush_bucket "$res" || return 1
+
+    # With max=1, exactly one OSD is returned.
+    local max=1
+    res=$(ceph osd ok-to-upgrade rack-0 $ceph_version $max --format=json)
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -eq 1 || return 1
+
+    # With min_size=2 on a size=2 pool, no OSD can go offline without
+    # violating the pool's minimum replica count.
+    ceph osd pool set $poolname min_size 2
+    sleep 5
+    wait_for_clean || return 1
+    res=$(ceph osd ok-to-upgrade rack-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = false || return 1
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -eq 0 || return 1
+}
+
+function TEST_ok_to_upgrade_rack_chassis_bucket() {
+    local dir=$1
+    local poolname="test"
+    local OSDS=4
+    local ceph_version="01.2.3-1234-g1234deed"
+
+    CEPH_ARGS="$ORIG_CEPH_ARGS --mon-host=$CEPH_MON "
+
+    run_mon $dir a --public-addr=$CEPH_MON || return 1
+    run_mgr $dir x || return 1
+
+    for osd in $(seq 0 $(expr $OSDS - 1)); do
+      run_osd $dir $osd --osd-mclock-skip-benchmark=true || return 1
+    done
+
+    # Use size=2 so the pool can be satisfied with 2 distinct host buckets.
+    # min_size=1 allows upgrading all OSDs on one host simultaneously.
+    create_pool $poolname 8 8
+    ceph osd pool set $poolname pg_autoscale_mode off
+    ceph osd pool set $poolname size 2
+    ceph osd pool set $poolname min_size 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Build a rack CRUSH hierarchy:
+    #   root "default"
+    #     rack "rack-0"
+    #       chassis "chassis-0"
+    #         host "chassis-host-0" -> osd.0, osd.1
+    #         host "chassis-host-1" -> osd.2, osd.3
+    ceph osd crush add-bucket rack-0 rack || return 1
+    ceph osd crush add-bucket chassis-0 chassis || return 1
+    ceph osd crush add-bucket chassis-host-0 host || return 1
+    ceph osd crush add-bucket chassis-host-1 host || return 1
+    ceph osd crush move chassis-host-0 chassis=chassis-0 || return 1
+    ceph osd crush move chassis-host-1 chassis=chassis-0 || return 1
+    ceph osd crush move chassis-0 rack=rack-0 || return 1
+    ceph osd crush move rack-0 root=default || return 1
+    ceph osd crush set 0 1.0 root=default rack=rack-0 host=chassis-host-0 || return 1
+    ceph osd crush set 1 1.0 root=default rack=rack-0 host=chassis-host-0 || return 1
+    ceph osd crush set 2 1.0 root=default rack=rack-0 host=chassis-host-1 || return 1
+    ceph osd crush set 3 1.0 root=default rack=rack-0 host=chassis-host-1 || return 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Snapshot acting PG counts per OSD. In a clean cluster 'pgs' in
+    # osd df equals the acting count the mgr's PGMap records internally.
+    snapshot_osd_pg_counts
+
+    # With min_size=1 some OSDs inside chassis-0 must be reported upgradable.
+    local res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    local num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -ge 1 || return 1
+    local num_osds_upgraded=$(echo $res | jq '.osds_upgraded | length')
+    test $num_osds_upgraded -eq 0 || return 1
+
+    # Verify that osds_in_crush_bucket lists all chassis OSDs in non-decreasing
+    # order of acting PG count.  This directly tests the global sort inside
+    # _populate_crush_bucket_osds(): consecutive entries must never decrease.
+    assert_osds_sorted_by_pg_count osds_in_crush_bucket "$res" || return 1
+
+    # With max=1, exactly one OSD is returned.
+    local max=1
+    res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version $max --format=json)
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -eq 1 || return 1
+
+    # With min_size=2 on a size=2 pool, no OSD can go offline without
+    # violating the pool's minimum replica count.
+    ceph osd pool set $poolname min_size 2
+    sleep 5
+    wait_for_clean || return 1
+    res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = false || return 1
+    num_osds_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_osds_upgradable -eq 0 || return 1
+}
+
+# Verify that ok-to-upgrade returns OSDs in ascending order of acting PG
+# count globally across the entire chassis (not per-host).
+#
+# _populate_crush_bucket_osds collects OSDs from every child host bucket,
+# then sorts them once globally by (num_pgs, osd_id) ascending before
+# returning to _maximize_ok_to_upgrade_set.  The convergence algorithm
+# prunes from the tail (osds.resize), preserving this global order in the
+# final osds_ok_to_upgrade output.
+#
+# Test design
+# -----------
+# 6 OSDs in a chassis (3 per host), pool with 7 PGs and size=2: CRUSH
+# maps each PG to one OSD per host. 7 % 3 != 0 produces an unequal
+# per-OSD acting count across the chassis, making the global ordering
+# non-trivial to predict without actually measuring it.  Using 7 (rather
+# than a larger number such as 16) widens the relative spread between
+# OSD PG counts, reducing ties and making the ordering invariant more
+# discriminating.
+#
+# The test snapshots the acting PG count per OSD from 'ceph osd df', then
+# checks two invariants:
+#   1. The returned list is non-decreasing by acting PG count (global sort).
+#   2. The first returned OSD holds the minimum acting PG count among all
+#      OSDs in chassis-0, confirming that the globally-least-loaded OSD
+#      is always offered for upgrade first.
+function TEST_ok_to_upgrade_osd_order_by_pg_count() {
+    local dir=$1
+    local poolname="test"
+    local OSDS=6
+    local ALL_CHASSIS_OSDS="0 1 2 3 4 5"
+    local ceph_version="01.2.3-1234-g1234deed"
+
+    CEPH_ARGS="$ORIG_CEPH_ARGS --mon-host=$CEPH_MON "
+
+    run_mon $dir a --public-addr=$CEPH_MON || return 1
+    run_mgr $dir x || return 1
+
+    for osd in $(seq 0 $(expr $OSDS - 1)); do
+      run_osd $dir $osd --osd-mclock-skip-benchmark=true || return 1
+    done
+
+    # 7 PGs, size=2, min_size=1. 7 % 3 != 0 guarantees an unequal
+    # per-OSD acting count within the chassis.
+    create_pool $poolname 7 7
+    ceph osd pool set $poolname pg_autoscale_mode off
+    ceph osd pool set $poolname size 2
+    ceph osd pool set $poolname min_size 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Build a chassis hierarchy:
+    #   root "default"
+    #     chassis "chassis-0"
+    #       host "host-0-0" -> osd.0, osd.1, osd.2
+    #       host "host-0-1" -> osd.3, osd.4, osd.5
+    ceph osd crush add-bucket chassis-0 chassis || return 1
+    ceph osd crush add-bucket host-0-0 host || return 1
+    ceph osd crush add-bucket host-0-1 host || return 1
+    ceph osd crush move host-0-0 chassis=chassis-0 || return 1
+    ceph osd crush move host-0-1 chassis=chassis-0 || return 1
+    ceph osd crush move chassis-0 root=default || return 1
+    ceph osd crush set 0 1.0 root=default chassis=chassis-0 host=host-0-0 || return 1
+    ceph osd crush set 1 1.0 root=default chassis=chassis-0 host=host-0-0 || return 1
+    ceph osd crush set 2 1.0 root=default chassis=chassis-0 host=host-0-0 || return 1
+    ceph osd crush set 3 1.0 root=default chassis=chassis-0 host=host-0-1 || return 1
+    ceph osd crush set 4 1.0 root=default chassis=chassis-0 host=host-0-1 || return 1
+    ceph osd crush set 5 1.0 root=default chassis=chassis-0 host=host-0-1 || return 1
+    sleep 5
+    wait_for_clean || return 1
+
+    # Snapshot acting PG counts per OSD. In a clean cluster 'pgs' in
+    # osd df equals the acting count the mgr's PGMap records internally.
+    snapshot_osd_pg_counts
+
+    local res=$(ceph osd ok-to-upgrade chassis-0 $ceph_version --format=json)
+    test $(echo $res | jq '.all_osds_upgraded') = false || return 1
+    test $(echo $res | jq '.ok_to_upgrade') = true || return 1
+    local num_upgradable=$(echo $res | jq '.osds_ok_to_upgrade | length')
+    test $num_upgradable -ge 1 || return 1
+
+    # Verify that osds_in_crush_bucket lists all chassis OSDs in non-decreasing
+    # order of acting PG count.  osds_in_crush_bucket is the direct output of
+    # _populate_crush_bucket_osds() before the convergence algorithm runs, so
+    # this check covers every OSD in the bucket, not just the upgrade subset.
+    assert_osds_sorted_by_pg_count osds_in_crush_bucket "$res" || return 1
+
+    # Invariant 1: the returned OSD list must be globally non-decreasing by
+    # acting PG count.  _populate_crush_bucket_osds sorts all chassis OSDs
+    # together; the convergence algorithm only prunes from the tail, so the
+    # ascending order is always preserved in the output.
+    local prev_count=-1
+    for osd_id in $(echo $res | jq -r '.osds_ok_to_upgrade[]'); do
+        local count=${pg_count[$osd_id]}
+        test "$count" -ge "$prev_count" || return 1
+        prev_count=$count
+    done
+
+    # Invariant 2: the first OSD in the list must have the globally minimum
+    # acting PG count across all OSDs in chassis-0.  This confirms that the
+    # globally-least-loaded OSD is always offered for upgrade first.
+    local first_osd=$(echo $res | jq -r '.osds_ok_to_upgrade[0]')
+    local first_count=${pg_count[$first_osd]}
+    for osd_id in $ALL_CHASSIS_OSDS; do
+        test "${pg_count[$osd_id]}" -ge "$first_count" || return 1
+    done
+}
 
 main ok-to-upgrade "$@"
diff --git a/src/mgr/DaemonServer.cc b/src/mgr/DaemonServer.cc
index afe0a0c37fa..a7ddac0868d 100644
--- a/src/mgr/DaemonServer.cc
+++ b/src/mgr/DaemonServer.cc
@@ -1276,6 +1276,7 @@ int DaemonServer::_populate_crush_bucket_osds(
   } else if (bucket_type_str == "host" || bucket_type_str == "osd") {
     bucket_names.push_back(item_name);
   }
+
   // The following struct is to help re-order the
   // osds based on the number of pgs on them.
   struct pgs_per_osd {
@@ -1283,10 +1284,8 @@ int DaemonServer::_populate_crush_bucket_osds(
     size_t num_pgs;
   };
   std::vector<pgs_per_osd> child_bucket_pgs_per_osd;
-  // get osds under each child bucket
+  // get osds under each child bucket and associate with their PG counts
   for (const auto &name : bucket_names) {
-    // Clear the items for the current child bucket
-    child_bucket_pgs_per_osd.clear();
     std::set<int> tmp_bucket_osds;
     r = osdmap.get_osds_by_bucket_name(name, &tmp_bucket_osds);
     if (r < 0) {
@@ -1300,39 +1299,27 @@ int DaemonServer::_populate_crush_bucket_osds(
       dout(20) << os.str() << dendl;
       return r;
     }
-
-    // Special case when bucket contains only 1 osd
-    if (tmp_bucket_osds.size() == 1) {
-      for (const auto &osd : tmp_bucket_osds) {
-        crush_bucket_osds.push_back(osd);
-      }
-      dout(20) << "picked osd: " << tmp_bucket_osds
-               << " from bucket: " << name << dendl;
-      continue;
-    }
-    /**
-     * The osds in this bucket are further re-ordered based on the
-     * number of pgs (ascending) they host. This helps optimize
-     * the result of _check_offlines_pgs() down the line.
-     */
     for (const auto &osd : tmp_bucket_osds) {
       child_bucket_pgs_per_osd.push_back({osd, pgmap.get_num_pg_by_osd(osd)});
     }
-    // Sort once after all data is added
-    std::sort(child_bucket_pgs_per_osd.begin(), child_bucket_pgs_per_osd.end(),
-              [](const pgs_per_osd& a, const pgs_per_osd& b) {
-        return std::tie(a.num_pgs, a.osd_id) < std::tie(b.num_pgs, b.osd_id);
-    });
-    /**
-     * The sorted osds are finally pushed to the passed crush_bucket_osds
-     * vector where osds are maintained according to the child order.
-     */
-    for (const auto &item : child_bucket_pgs_per_osd) {
-      crush_bucket_osds.push_back(item.osd_id);
-    }
     dout(20) << "picked osds: " << tmp_bucket_osds
              << " from bucket: " << name << dendl;
   }
+
+  /**
+   * Sort all collected osds globally based on the number of pgs (ascending)
+   * they host and update the crush_bucket_osds vector with the same order.
+   */
+  std::sort(child_bucket_pgs_per_osd.begin(), child_bucket_pgs_per_osd.end(),
+            [](const pgs_per_osd& a, const pgs_per_osd& b) {
+      return std::tie(a.num_pgs, a.osd_id) < std::tie(b.num_pgs, b.osd_id);
+  });
+  crush_bucket_osds.reserve(
+    crush_bucket_osds.size() + child_bucket_pgs_per_osd.size());
+  for (const auto &item : child_bucket_pgs_per_osd) {
+    crush_bucket_osds.push_back(item.osd_id);
+  }
+
   return r;
 }
 

From d27261d0c2641e92365cf590684567c58bbfb905 Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Thu, 11 Jun 2026 14:42:57 -0400
Subject: [PATCH 193/596] Reapply "qa/rgw/crypt: disable failing kmip testing"

This reverts commit fd2046798198db20e45b8abbb3cc866c9967fb88.

kmip tests are failing again on ubuntu 24 because PyKMIP doesn't support
python 3.12. we'll be removing ubuntu 22 from main, so can't just pin the
test to that distro in the meantime

we're expecing the nvmeof team to add python 3.12 support in our
ceph/PyKMIP fork, and can reenable kmip testing once that happens

Fixes: https://tracker.ceph.com/issues/76995

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 qa/suites/rgw/crypt/2-kms/kmip.yaml | 37 -----------------------------
 1 file changed, 37 deletions(-)
 delete mode 100644 qa/suites/rgw/crypt/2-kms/kmip.yaml

diff --git a/qa/suites/rgw/crypt/2-kms/kmip.yaml b/qa/suites/rgw/crypt/2-kms/kmip.yaml
deleted file mode 100644
index 0057d954e32..00000000000
--- a/qa/suites/rgw/crypt/2-kms/kmip.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-overrides:
-  ceph:
-    conf:
-      client:
-        rgw crypt s3 kms backend: kmip
-        rgw crypt kmip ca path: /etc/ceph/kmiproot.crt
-        rgw crypt kmip client cert: /etc/ceph/kmip-client.crt
-        rgw crypt kmip client key: /etc/ceph/kmip-client.key
-        rgw crypt kmip kms key template: pykmip-$keyid
-  rgw:
-    client.0:
-      use-pykmip-role: client.0
-
-tasks:
-- openssl_keys:
-    kmiproot:
-      client: client.0
-      cn: kmiproot
-      key-type: rsa:4096
-    kmip-server:
-      client: client.0
-      ca: kmiproot
-    kmip-client:
-      client: client.0
-      ca: kmiproot
-      cn: rgw-client
-- exec:
-    client.0:
-      - chmod 644 /home/ubuntu/cephtest/ca/kmip-client.key
-- pykmip:
-    client.0:
-      clientca: kmiproot
-      servercert: kmip-server
-      clientcert: kmip-client
-      secrets:
-      - name: pykmip-my-key-1
-      - name: pykmip-my-key-2

From 57d34f8e19bfe6cc83ef34be3d386586ccba0061 Mon Sep 17 00:00:00 2001
From: Gregory Farnum <greg@gregs42.com>
Date: Thu, 11 Jun 2026 11:50:16 -0700
Subject: [PATCH 194/596] libcephfs: increment extra version to indicate new
 flock functions

Signed-off-by: Greg Farnum <gfarnum@redhat.com>

Signed-off-by: Gregory Farnum <greg@gregs42.com>
---
 src/include/cephfs/libcephfs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/include/cephfs/libcephfs.h b/src/include/cephfs/libcephfs.h
index 2372e92eb2f..15bc0140043 100644
--- a/src/include/cephfs/libcephfs.h
+++ b/src/include/cephfs/libcephfs.h
@@ -42,7 +42,7 @@ extern "C" {
 
 #define LIBCEPHFS_VER_MAJOR 11
 #define LIBCEPHFS_VER_MINOR 0
-#define LIBCEPHFS_VER_EXTRA 0
+#define LIBCEPHFS_VER_EXTRA 1
 
 #define LIBCEPHFS_VERSION(maj, min, extra) ((maj << 16) + (min << 8) + extra)
 #define LIBCEPHFS_VERSION_CODE LIBCEPHFS_VERSION(LIBCEPHFS_VER_MAJOR, LIBCEPHFS_VER_MINOR, LIBCEPHFS_VER_EXTRA)

From fbfe653454c3bc7a485cb047a5f853b18f2667cc Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 11 Jun 2026 11:09:50 +0530
Subject: [PATCH 195/596] ceph.spec.in: disable -P in python shebang for
 cephadm binary

Fixes: https://tracker.ceph.com/issues/77340
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 ceph.spec.in | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ceph.spec.in b/ceph.spec.in
index 0ec85c99755..51366d43b5d 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -1993,6 +1993,9 @@ install -m 0644 -D udev/50-rbd.rules %{buildroot}%{_udevrulesdir}/50-rbd.rules
 install -m 0440 -D sudoers.d/ceph-smartctl %{buildroot}%{_sysconfdir}/sudoers.d/ceph-smartctl
 
 %if 0%{?rhel} >= 8 || 0%{?openEuler}
+# Undefine -P flag as it is only supported with python version >= 3.11
+%undefine _py3_shebang_P
+
 %{py3_shebang_fix} %{buildroot}%{_bindir}/* %{buildroot}%{_sbindir}/*
 %endif
 

From 0347cc859157c0a6057c80a5db55ed706e898bf8 Mon Sep 17 00:00:00 2001
From: Kobi Ginon <kginon@redhat.com>
Date: Tue, 19 May 2026 18:54:37 +0300
Subject: [PATCH 196/596] cephadm: address Copilot review on list-networks BGP
 parsing Skip default routes in ip -j BGP JSON parsing, fix black line-length
 in loopback check, and update list-networks CLI help for --allow-lo-routes
 and --allow-bgp-routes. Signed-off-by: Kobi Ginon <kginon@redhat.com>

---
 src/cephadm/cephadm.py                       |   4 +-
 src/cephadm/cephadmlib/host_facts.py         | 145 ++++++++++---------
 src/cephadm/tests/test_networks.py           |  22 +--
 src/cephadm/tests/test_networks_lo_routes.py |  37 +++++
 4 files changed, 115 insertions(+), 93 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index b3133088961..ba990aed6ad 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -5023,13 +5023,13 @@ def _get_parser():
         '--allow-lo-routes',
         action='store_true',
         default=False,
-        help='Reserved for future filtering of loopback-related routes',
+        help='Include loopback (lo) routes in the listing (default: omit)',
     )
     parser_list_networks.add_argument(
         '--allow-bgp-routes',
         action='store_true',
         default=False,
-        help='Reserved for future filtering of BGP-derived routes',
+        help='Merge BGP routes from ip -j route ls proto bgp (default: omit)',
     )
     parser_list_networks.set_defaults(func=command_list_networks)
 
diff --git a/src/cephadm/cephadmlib/host_facts.py b/src/cephadm/cephadmlib/host_facts.py
index c4acd4a6b69..c169632b072 100644
--- a/src/cephadm/cephadmlib/host_facts.py
+++ b/src/cephadm/cephadmlib/host_facts.py
@@ -909,45 +909,37 @@ def list_rdma(ctx: CephadmContext) -> List[Dict[str, str]]:
     return result
 
 
-_IPV4_LOOPBACK_SPACE = ipaddress.ip_network('127.0.0.0/8')
-_IPV6_LOOPBACK_HOST = ipaddress.ip_network('::1/128')
+def _list_ipv4_networks(
+    ctx: CephadmContext,
+    allow_lo_routes: bool = False,
+    allow_bgp_routes: bool = False,
+) -> Dict[str, Dict[str, Set[str]]]:
+    """IPv4 networks from ``ip route ls`` (and optional ``proto bgp`` supplement).
 
-
-def _is_ipv4_loopback(net_s: str) -> bool:
-    """True if *net_s* is an IPv4 prefix wholly within host loopback 127.0.0.0/8."""
-    try:
-        n = ipaddress.ip_network(net_s, strict=False)
-    except ValueError:
-        return False
-    return (
-        n.version == 4
-        and n.network_address in _IPV4_LOOPBACK_SPACE
-        and n.broadcast_address in _IPV4_LOOPBACK_SPACE
+    When *allow_lo_routes* is false, routes on ``lo`` are ignored by the parsers.
+    When true, ``_parse_ipv4_lo_route`` supplements the base table.
+    """
+    execstr: Optional[str] = find_executable('ip')
+    if not execstr:
+        raise FileNotFoundError("unable to find 'ip' command")
+    out, _, _ = call_throws(
+        ctx,
+        [execstr, 'route', 'ls'],
+        verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
     )
-
-
-def _is_ipv6_loopback(net_s: str) -> bool:
-    """True if *net_s* is exactly the host loopback prefix ::1/128."""
-    try:
-        n = ipaddress.ip_network(net_s, strict=False)
-    except ValueError:
-        return False
-    if n.version != 6:
-        return False
-    return n == _IPV6_LOOPBACK_HOST
-
-
-def _merge_ipv4_network_dicts(
-    dst: Dict[str, Dict[str, Set[str]]], add: Dict[str, Dict[str, Set[str]]]
-) -> None:
-    """Merge *add* into *dst* (nested sets)."""
-    for net, ifaces in add.items():
-        if net not in dst:
-            dst[net] = {}
-        for iface, ips in ifaces.items():
-            if iface not in dst[net]:
-                dst[net][iface] = set()
-            dst[net][iface].update(ips)
+    res = _parse_ipv4_route(out, allow_lo_routes)
+    if allow_lo_routes:
+        _merge_ipv4_network_dicts(res, _parse_ipv4_lo_route(out))
+    if allow_bgp_routes:
+        bgp_out, _, _ = call_throws(
+            ctx,
+            [execstr, '-j', 'route', 'ls', 'proto', 'bgp'],
+            verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
+        )
+        _merge_ipv4_network_dicts(
+            res, _parse_ipv4_bgp_route(bgp_out, allow_lo_routes)
+        )
+    return res
 
 
 def _parse_ipv4_route(
@@ -1056,9 +1048,10 @@ def _parse_bgp_routes_json(
 
     is_v4 = version == 4
     host_plen = 32 if is_v4 else 128
+    is_loopback_net = _is_ipv4_loopback if is_v4 else _is_ipv6_loopback
 
     def put(net: str, iface: str, ip: str) -> None:
-        if _is_ipv4_loopback(net) if is_v4 else _is_ipv6_loopback(net):
+        if is_loopback_net(net):
             return
         if net not in r:
             r[net] = {}
@@ -1070,7 +1063,7 @@ def _parse_bgp_routes_json(
         if not isinstance(route, dict):
             continue
         dst = route.get('dst')
-        if not dst:
+        if not dst or dst == 'default':
             continue
 
         net = _route_dst_to_network(dst, version)
@@ -1127,39 +1120,6 @@ def _parse_ipv6_bgp_route(
     return _parse_bgp_routes_json(out, 6, allow_lo_routes)
 
 
-def _list_ipv4_networks(
-    ctx: CephadmContext,
-    allow_lo_routes: bool = False,
-    allow_bgp_routes: bool = False,
-) -> Dict[str, Dict[str, Set[str]]]:
-    """IPv4 networks from ``ip route ls`` (and optional ``proto bgp`` supplement).
-
-    When *allow_lo_routes* is false, routes on ``lo`` are ignored by the parsers.
-    When true, ``_parse_ipv4_lo_route`` supplements the base table.
-    """
-    execstr: Optional[str] = find_executable('ip')
-    if not execstr:
-        raise FileNotFoundError("unable to find 'ip' command")
-    out, _, _ = call_throws(
-        ctx,
-        [execstr, 'route', 'ls'],
-        verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
-    )
-    res = _parse_ipv4_route(out, allow_lo_routes)
-    if allow_lo_routes:
-        _merge_ipv4_network_dicts(res, _parse_ipv4_lo_route(out))
-    if allow_bgp_routes:
-        bgp_out, _, _ = call_throws(
-            ctx,
-            [execstr, '-j', 'route', 'ls', 'proto', 'bgp'],
-            verbosity=CallVerbosity.QUIET_UNLESS_ERROR,
-        )
-        _merge_ipv4_network_dicts(
-            res, _parse_ipv4_bgp_route(bgp_out, allow_lo_routes)
-        )
-    return res
-
-
 def _list_ipv6_networks(
     ctx: CephadmContext,
     allow_lo_routes: bool = False,
@@ -1247,3 +1207,44 @@ def _parse_ipv6_route(
             r[net[0]][iface].add(ip)
 
     return r
+
+
+_IPV4_LOOPBACK_SPACE = ipaddress.ip_network('127.0.0.0/8')
+_IPV6_LOOPBACK_HOST = ipaddress.ip_network('::1/128')
+
+
+def _is_ipv4_loopback(net_s: str) -> bool:
+    """True if *net_s* is an IPv4 prefix wholly within host loopback 127.0.0.0/8."""
+    try:
+        n = ipaddress.ip_network(net_s, strict=False)
+    except ValueError:
+        return False
+    return (
+        n.version == 4
+        and n.network_address in _IPV4_LOOPBACK_SPACE
+        and n.broadcast_address in _IPV4_LOOPBACK_SPACE
+    )
+
+
+def _is_ipv6_loopback(net_s: str) -> bool:
+    """True if *net_s* is exactly the host loopback prefix ::1/128."""
+    try:
+        n = ipaddress.ip_network(net_s, strict=False)
+    except ValueError:
+        return False
+    if n.version != 6:
+        return False
+    return n == _IPV6_LOOPBACK_HOST
+
+
+def _merge_ipv4_network_dicts(
+    dst: Dict[str, Dict[str, Set[str]]], add: Dict[str, Dict[str, Set[str]]]
+) -> None:
+    """Merge *add* into *dst* (nested sets)."""
+    for net, ifaces in add.items():
+        if net not in dst:
+            dst[net] = {}
+        for iface, ips in ifaces.items():
+            if iface not in dst[net]:
+                dst[net][iface] = set()
+            dst[net][iface].update(ips)
diff --git a/src/cephadm/tests/test_networks.py b/src/cephadm/tests/test_networks.py
index f854dfab1fb..6401c53675e 100644
--- a/src/cephadm/tests/test_networks.py
+++ b/src/cephadm/tests/test_networks.py
@@ -48,8 +48,6 @@ class TestEndPoint:
 
 
 class TestCommandListNetworks:
-    # fmt: off
-    # Keep table-style parametrization unchanged for reviewable diffs (see PR discussion).
     @pytest.mark.parametrize("test_input, expected", [
         (
             dedent("""
@@ -108,11 +106,9 @@ class TestCommandListNetworks:
             }
         ),
     ])
-    # fmt: on
     def test_parse_ipv4_route(self, test_input, expected):
         assert _parse_ipv4_route(test_input) == expected
 
-    # fmt: off
     @pytest.mark.parametrize("test_routes, test_ips, expected", [
         (
             dedent("""
@@ -240,8 +236,7 @@ class TestCommandListNetworks:
             ::1 dev lo proto kernel metric 256 pref medium
             fe80::/64 dev ceph-brx proto kernel metric 256 pref medium
             fe80::/64 dev brx.0 proto kernel metric 256 pref medium
-            default via fe80::327c:5e00:6487:71e0 dev enp3s0f1 proto ra metric 1024 expires 1790sec hoplimit 64 pref medium
-            """),
+            default via fe80::327c:5e00:6487:71e0 dev enp3s0f1 proto ra metric 1024 expires 1790sec hoplimit 64 pref medium            """),
             dedent("""
             1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
                 inet6 ::1/128 scope host
@@ -264,7 +259,6 @@ class TestCommandListNetworks:
             }
         ),
     ])
-    # fmt: on
     def test_parse_ipv6_route(self, test_routes, test_ips, expected):
         assert _parse_ipv6_route(test_routes, test_ips) == expected
 
@@ -311,18 +305,8 @@ fe80000000000000505400fffe04c154 03 40 20 80     eth1
 
     @mock.patch('cephadmlib.host_facts.call_throws')
     @mock.patch('cephadmlib.host_facts.find_executable')
-    def test_command_list_networks(
-        self, _find_exe, _call_throws, cephadm_fs, capsys
-    ):
-        _call_throws.side_effect = [
-            (
-                '10.4.0.1 dev tun0 proto kernel scope link src 10.4.0.2 metric 50\n',
-                '',
-                '',
-            ),
-            ('', '', ''),
-            ('', '', ''),
-        ]
+    def test_command_list_networks(self, _find_exe, _call_throws, cephadm_fs, capsys):
+        _call_throws.return_value = ('10.4.0.1 dev tun0 proto kernel scope link src 10.4.0.2 metric 50\n', '', '')
         _find_exe.return_value = 'ip'
         with with_cephadm_ctx([]) as ctx:
             _cephadm.command_list_networks(ctx)
diff --git a/src/cephadm/tests/test_networks_lo_routes.py b/src/cephadm/tests/test_networks_lo_routes.py
index 4e02c972e35..4ce5fa75b3d 100644
--- a/src/cephadm/tests/test_networks_lo_routes.py
+++ b/src/cephadm/tests/test_networks_lo_routes.py
@@ -253,6 +253,43 @@ class TestLoopbackRouteParsing:
             '10.168.100.10/32': {'lo': {'10.168.100.10'}},
         }
 
+    def test_parse_ipv4_bgp_route_skips_default(self):
+        bgp_input = json.dumps(
+            [
+                {
+                    'dst': 'default',
+                    'protocol': 'bgp',
+                    'prefsrc': '192.168.100.11',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+                {
+                    'dst': '192.168.100.5',
+                    'protocol': 'bgp',
+                    'prefsrc': '192.168.100.11',
+                    'flags': [],
+                    'nexthops': [
+                        {
+                            'gateway': '169.254.0.1',
+                            'dev': 'ens1f0np0',
+                            'weight': 1,
+                            'flags': ['onlink'],
+                        },
+                    ],
+                },
+            ]
+        )
+        assert _parse_ipv4_bgp_route(bgp_input) == {
+            '192.168.100.5/32': {'ens1f0np0': {'192.168.100.11'}},
+        }
+
     def test_parse_ipv4_bgp_route_lo_from_full_table(self):
         # ``ip -j route ls`` entry for ``10.10.10.10 dev lo proto bgp``.
         bgp_input = json.dumps(

From 0b84dbe7013119295a720ee72e82f85e52764ec7 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sseshasa@redhat.com>
Date: Tue, 22 Jul 2025 13:13:55 +0530
Subject: [PATCH 197/596] src/common/mclock_common: Fix output formatting of
 SchedulerClass

The earlier output formatting was resulting in the value and string
representation of the SchedulerClass being clubbed together for
e.g., "3client"

The formatting is now fixed to log SchedulerClass as "3 (client)".

Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 src/common/mclock_common.cc | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/common/mclock_common.cc b/src/common/mclock_common.cc
index db0651232d6..616681018f7 100644
--- a/src/common/mclock_common.cc
+++ b/src/common/mclock_common.cc
@@ -34,23 +34,29 @@ namespace dmc = crimson::dmclock;
 
 std::ostream &operator<<(std::ostream &lhs, const SchedulerClass &c)
 {
-  lhs << static_cast<size_t>(c);
+  lhs << static_cast<size_t>(c) << " (";
   switch (c) {
   case SchedulerClass::background_best_effort:
-    return lhs << "background_best_effort";
+    lhs << "background_best_effort";
+    break;
   case SchedulerClass::background_recovery:
-    return lhs << "background_recovery";
+    lhs << "background_recovery";
+    break;
   case SchedulerClass::client:
-    return lhs << "client";
+    lhs << "client";
+    break;
 #ifdef WITH_CRIMSON
   case SchedulerClass::repop:
-    return lhs << "repop";
+    lhs << "repop";
+    break;
 #endif
   case SchedulerClass::immediate:
-    return lhs << "immediate";
+    lhs << "immediate";
+    break;
   default:
-    return lhs;
+    lhs << "unknown";
   }
+  return lhs << ")";
 }
 
 std::ostream& operator<<(std::ostream& out,

From 89c7b217efec511be1cc5892bc181ae499bedaef Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sseshasa@redhat.com>
Date: Tue, 22 Jul 2025 13:38:16 +0530
Subject: [PATCH 198/596] osd/scheduler/mClockScheduler: Log the size of high
 priority queues.

Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 src/osd/scheduler/mClockScheduler.cc | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/osd/scheduler/mClockScheduler.cc b/src/osd/scheduler/mClockScheduler.cc
index bd81b6c19a1..8be0a01b6ef 100644
--- a/src/osd/scheduler/mClockScheduler.cc
+++ b/src/osd/scheduler/mClockScheduler.cc
@@ -99,11 +99,19 @@ void mClockScheduler::enqueue(OpSchedulerItem&& item)
     mclock_conf.get_mclock_counter(id);
   }
 
- dout(20) << __func__ << " client_count: " << scheduler.client_count()
-          << " queue_sizes: [ "
-	  << " high_priority_queue: " << high_priority.size()
-          << " sched: " << scheduler.request_count() << " ]"
-          << dendl;
+  dout(20) << __func__ << ": sched client_count: " << scheduler.client_count()
+           << " sched queue size: " << scheduler.request_count()
+           << dendl;
+
+  auto fmt_prio = [this](priority_t p) -> std::string {
+    return (p == immediate_class_priority) ? "MAX" : std::to_string(p);
+  };
+
+  dout(20) << __func__ << " high_priority queues: " << high_priority.size();
+  for (const auto& [prio, queue] : high_priority) {
+    *_dout << ", priority " << fmt_prio(prio) << ": " << queue.size();
+  }
+  *_dout << dendl;
  dout(30) << __func__ << " mClockClients: "
           << scheduler
           << dendl;

From 913e8911760eeb21d48c6d1a8dd9cd8169dda23f Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sseshasa@redhat.com>
Date: Tue, 22 Jul 2025 13:53:07 +0530
Subject: [PATCH 199/596] osd/scheduler/mClockScheduler: Fix line alignments

Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 src/osd/scheduler/mClockScheduler.cc | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/osd/scheduler/mClockScheduler.cc b/src/osd/scheduler/mClockScheduler.cc
index 8be0a01b6ef..3cef5431ce9 100644
--- a/src/osd/scheduler/mClockScheduler.cc
+++ b/src/osd/scheduler/mClockScheduler.cc
@@ -112,12 +112,13 @@ void mClockScheduler::enqueue(OpSchedulerItem&& item)
     *_dout << ", priority " << fmt_prio(prio) << ": " << queue.size();
   }
   *_dout << dendl;
- dout(30) << __func__ << " mClockClients: "
-          << scheduler
-          << dendl;
- dout(30) << __func__ << " mClockQueues: { "
-          << display_queues() << " }"
-          << dendl;
+
+  dout(30) << __func__ << " mClockClients: "
+           << scheduler
+           << dendl;
+  dout(30) << __func__ << " mClockQueues: { "
+           << display_queues() << " }"
+           << dendl;
 }
 
 void mClockScheduler::enqueue_front(OpSchedulerItem&& item)

From a0464c3d82825beddb5598b15a8752e567160a05 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sseshasa@redhat.com>
Date: Tue, 22 Jul 2025 14:09:16 +0530
Subject: [PATCH 200/596] osd/scheduler: Classify EC subOp reads according to
 op priority for mClock

The change brings MSG_OSD_EC_READ into the fold of mClock scheduler. This
improves the scheduling of client and other classes of operation as they
are no longer unnecessarily preempted by the 'immediate' queue.
EC SubOps are now handled as follows:

 - EC SubOp reads generated during recovery will either go into the
   'background_recovery' or 'background_best_effort' class based on
   the recovery priority set for the op. EC SubOp reads generated due
   to client will continue to be classified as 'immediate'.

 - EC SubOp writes generated as a result of client operations will
   continue to be classified as 'immediate'.

 - EC SubOp replies are considered high priority and therefore
   continue to be classed as 'immediate'.

Fixes: https://tracker.ceph.com/issues/71655
Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 src/osd/scheduler/OpSchedulerItem.h | 45 +++++++++++++++++++++++++----
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/src/osd/scheduler/OpSchedulerItem.h b/src/osd/scheduler/OpSchedulerItem.h
index 129c3547325..21fbe1abd6b 100644
--- a/src/osd/scheduler/OpSchedulerItem.h
+++ b/src/osd/scheduler/OpSchedulerItem.h
@@ -237,12 +237,47 @@ public:
     return op;
   }
 
-   SchedulerClass get_scheduler_class() const final {
-    auto type = op->get_req()->get_type();
-    if (type == CEPH_MSG_OSD_OP ||
-	type == CEPH_MSG_OSD_BACKOFF) {
+  SchedulerClass get_scheduler_class() const final {
+    switch (op->get_req()->get_type()) {
+    case CEPH_MSG_OSD_OP:
+    case CEPH_MSG_OSD_BACKOFF:
       return SchedulerClass::client;
-    } else {
+    /**
+     * EC SubOp reads for mClock are now classed based on their priority.
+     * The primary reason is to prevent subOps from overwhelming the
+     * 'immediate' queue during OSD events like failures, removal,
+     * reweight and any operation that trigger recovery/backfills. A sudden
+     * and long enough sustained burst of subOps in the 'immediate' could
+     * result in slow ops since client ops are preempted due to ops in the
+     * higher priority 'immediate' queue.
+     *
+     * The new classification described below improves the scheduling
+     * of client and other classes of operation during recovery/backfill as
+     * they are no longer preempted by recovery EC subOps in the 'immediate'
+     * queue. EC SubOps are now handled as follows:
+     *
+     *  - EC SubOp reads generated during recovery will either go into the
+     *    'background_recovery' or 'background_best_effort' class based on
+     *    the recovery priority set for the op. EC SubOp reads generated due
+     *    to client will continue to be classified as 'immediate'.
+     *
+     *  - EC SubOp writes generated as a result of client operations will
+     *    continue to be classified as 'immediate'.
+     *
+     *  - EC SubOp replies are considered high priority and therefore
+     *    continue to be classed as 'immediate'.
+     *
+     *  Note: The 'cost' for EC subOp read operation is set according to
+     *  the amount of data to be read/written.
+     */
+    case MSG_OSD_EC_READ: {
+      auto prio = op->get_req()->get_priority();
+      if (prio <= PeeringState::recovery_msg_priority_t::FORCED) {
+        return priority_to_scheduler_class(prio);
+      }
+      [[fallthrough]];
+    }
+    default:
       return SchedulerClass::immediate;
     }
   }

From e79befea328e58366c43e490c129e2a467e6db84 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sseshasa@redhat.com>
Date: Mon, 28 Jul 2025 16:39:34 +0530
Subject: [PATCH 201/596] src/messages, osd: Calculate and set cost for
 subOpReads for mClock scheduler

Previously, sub-op reads returned a hardcoded cost of 0, bypassing
mClock's background bandwidth and tag calculation mechanisms. This
allowed backfill operations to proceed un-metered, occasionally causing
backend resource contention and driving up client tail latencies.

Cost is calculated based on whether the complete chunk/shard or a subchunk
needs to be read. The possible cases are:
1. Read the complete chunk aligned length:
   - Cost is set to the length of the chunk aligned extent size.
2. Fragmented reads:
   - Consider the subchunk length and count to calculate the cost.
   - compute_cost evaluates the exact layout of fragmented shard bytes on
     disk by summing up the active subchunk allocations exactly once
     (`fragmented_shard_bytes += k.second * subchunk_size`).
   - Linear Extent Scaling: Scale the baseline footprint cleanly by
     multiplying it against the true count of read extents (`tl.size()`),
     achieving a highly efficient O(N) time complexity.

This linear cost model is compatible with pools running with
'allow_ec_optimizations' set to true. Under the FastEC optimized
pipeline, most operations are unified and bypass fragment slicing,
meaning requests will primarily match the Case 1 chunk-aligned path.
In Case 2 where applicable, the O(N) loop ensures that cost will
scale proportionally according to the layout.

It is important to note that the amount of data to read was set to an upper
bound defined by osd_recovery_max_chunk (8 MiB) and was rounded up to the
stripe width. The reason for setting a higher than actual upper bound is that
there may be cases where the object doesn't have the xattrs yet to determine
its size. Therefore, the amount to read was ultimatly set to ~(8 MiB / k)
where k is the number of data shards. This can cause mClock to prolong
the recovery times as items stay longer in the queue. To address this, the
amount to read is set to the remaining length of the object to recover
if the object size is known. Otherwise, the amount to read is set to the
recovery chunk size as before. Therefore, in some cases, only the first
recovery read could be costly if the object context is not known.

The MOSDECSubOpRead class introduces the following:
 - cost member. This necessitates an increment to the HEAD_VERSION and
   appropriate handling within the encode and decode methods.
 - compute_cost() that is called when creating the message by
   ECCommonL::ReadPipeline::do_read_op(). This calls into ECSubRead::cost()
   that performs the actual calculations to set the cost based on the cases
   mentioned above.
 - The same sequence applies to the EC optimized path in
   ECCommon::ReadPipeline::do_read_op().

Fixes: https://tracker.ceph.com/issues/71655
Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 src/messages/MOSDECSubOpRead.h | 20 +++++++++--
 src/osd/ECBackendL.cc          | 11 ++++++
 src/osd/ECCommon.cc            |  4 +++
 src/osd/ECCommonL.cc           |  6 +++-
 src/osd/ECMsgTypes.cc          | 62 ++++++++++++++++++++++++++++++++++
 src/osd/ECMsgTypes.h           |  8 +++++
 6 files changed, 108 insertions(+), 3 deletions(-)

diff --git a/src/messages/MOSDECSubOpRead.h b/src/messages/MOSDECSubOpRead.h
index 22614a910e9..9d57cef1696 100644
--- a/src/messages/MOSDECSubOpRead.h
+++ b/src/messages/MOSDECSubOpRead.h
@@ -21,16 +21,26 @@
 
 class MOSDECSubOpRead : public MOSDFastDispatchOp {
 private:
-  static constexpr int HEAD_VERSION = 3;
+  static constexpr int HEAD_VERSION = 4;
   static constexpr int COMPAT_VERSION = 1;
 
 public:
   spg_t pgid;
   epoch_t map_epoch = 0, min_epoch = 0;
   ECSubRead op;
+  uint64_t cost = 0;
 
+  /**
+    * Calculate the cost of the SubOp read operation for mClock scheduler.
+    *
+    * @param *cct: *CephContext
+    * @param pair<int, int>&: subchunk_count and subchunk_size
+    */
+  void compute_cost(CephContext *cct, std::pair<int, int> &subchunk_info) {
+    cost = op.cost(cct, subchunk_info);
+  }
   int get_cost() const override {
-    return 0;
+    return cost;
   }
   epoch_t get_map_epoch() const override {
     return map_epoch;
@@ -58,6 +68,9 @@ public:
     } else {
       min_epoch = map_epoch;
     }
+    if (header.version >= 4) {
+      decode(cost, p);
+    }
   }
 
   void encode_payload(uint64_t features) override {
@@ -67,6 +80,9 @@ public:
     encode(op, payload, features);
     encode(min_epoch, payload);
     encode_trace(payload, features);
+    if (header.version >= 4) {
+      encode(cost, payload);
+    }
   }
 
   std::string_view get_type_name() const override { return "MOSDECSubOpRead"; }
diff --git a/src/osd/ECBackendL.cc b/src/osd/ECBackendL.cc
index 487c7d53d59..7d98cad28f5 100644
--- a/src/osd/ECBackendL.cc
+++ b/src/osd/ECBackendL.cc
@@ -573,7 +573,18 @@ void ECBackendL::RecoveryBackend::continue_recovery_op(
       ceph_assert(!op.recovery_progress.data_complete);
       set<int> want(op.missing_on_shards.begin(), op.missing_on_shards.end());
       uint64_t from = op.recovery_progress.data_recovered_to;
+      /* When beginning recovery, the OI may not be known. As such the object
+       * size is not known. For the first read, attempt to read the default
+       * size.  If this is larger than the object sizes, then the OSD will
+       * return truncated reads.  If the object size is known, then attempt
+       * correctly sized reads, capped at recovery chunk size.
+       * (Ref: ECCommon.cc -> ECCommon::RecoveryBackend::continue_recovery_op())
+       */
       uint64_t amount = get_recovery_chunk_size();
+      if (op.obc) {
+        uint64_t remaining = op.obc->obs.oi.size - from;
+        amount = std::min(remaining, amount);
+      }
 
       if (op.recovery_progress.first && op.obc) {
         if (auto [r, attrs, size] = ecbackend->get_attrs_n_size_from_disk(op.hoid);
diff --git a/src/osd/ECCommon.cc b/src/osd/ECCommon.cc
index 9982b0ffc05..cb177eb5517 100644
--- a/src/osd/ECCommon.cc
+++ b/src/osd/ECCommon.cc
@@ -524,6 +524,9 @@ void ECCommon::ReadPipeline::do_read_op(ReadOp &rop) {
   std::optional<ECSubRead> local_read_op;
   std::vector<std::pair<int, Message*>> m;
   m.reserve(messages.size());
+  std::pair<int, int> subchunk_info =
+    std::make_pair(ec_impl->get_sub_chunk_count(),
+      sinfo.get_chunk_size() / ec_impl->get_sub_chunk_count());
   for (auto &&[pg_shard, read]: messages) {
     rop.in_progress.insert(pg_shard);
     shard_to_read_map[pg_shard].insert(rop.tid);
@@ -547,6 +550,7 @@ void ECCommon::ReadPipeline::do_read_op(ReadOp &rop) {
       msg->trace.init("ec sub read", nullptr, &rop.trace);
       msg->trace.keyval("shard", pg_shard.shard.id);
     }
+    msg->compute_cost(cct, subchunk_info);
     m.push_back(std::make_pair(pg_shard.osd, msg));
     dout(10) << __func__ << ": will send msg " << *msg
              << " to osd." << pg_shard.osd << dendl;
diff --git a/src/osd/ECCommonL.cc b/src/osd/ECCommonL.cc
index 8dc08df190a..e60cd15cbe5 100644
--- a/src/osd/ECCommonL.cc
+++ b/src/osd/ECCommonL.cc
@@ -468,6 +468,9 @@ void ECCommonL::ReadPipeline::do_read_op(ReadOp &op)
 
   std::vector<std::pair<int, Message*>> m;
   m.reserve(messages.size());
+  std::pair<int, int> subchunk_info =
+    std::make_pair(ec_impl->get_sub_chunk_count(),
+      sinfo.get_chunk_size() / ec_impl->get_sub_chunk_count());
   for (map<pg_shard_t, ECSubRead>::iterator i = messages.begin();
        i != messages.end();
        ++i) {
@@ -489,6 +492,7 @@ void ECCommonL::ReadPipeline::do_read_op(ReadOp &op)
       msg->trace.init("ec sub read", nullptr, &op.trace);
       msg->trace.keyval("shard", i->first.shard.id);
     }
+    msg->compute_cost(cct, subchunk_info);
     m.push_back(std::make_pair(i->first.osd, msg));
   }
   if (!m.empty()) {
@@ -1179,4 +1183,4 @@ ECUtilL::HashInfoRef ECCommonL::UnstableHashInfoRegistry::get_hash_info(
 }
 }
 
-END_IGNORE_DEPRECATED
\ No newline at end of file
+END_IGNORE_DEPRECATED
diff --git a/src/osd/ECMsgTypes.cc b/src/osd/ECMsgTypes.cc
index 206378fe1f0..36480c20439 100644
--- a/src/osd/ECMsgTypes.cc
+++ b/src/osd/ECMsgTypes.cc
@@ -15,6 +15,8 @@
 
 #include "ECMsgTypes.h"
 
+#include "common/ceph_context.h"
+
 using std::list;
 using std::make_pair;
 using std::map;
@@ -266,6 +268,66 @@ void ECSubRead::decode(bufferlist::const_iterator &bl)
   DECODE_FINISH(bl);
 }
 
+/**
+ * Calculate the cost of the SubOp read operation for mClock scheduler.
+ * Cost is calculated based on whether the complete chunk/shard
+ * or a subchunk needs to be read:
+ * Case 1. Read the complete chunk aligned length:
+ *  - Cost is set to the length of the chunk aligned extent size.
+ * Case 2. Fragmented reads:
+ *  - Cost is set by considering the subchunk length and count.
+ *
+ * Note: To retain the legacy behavior, a cost of '0' is returned as
+ *       before for WeightedPriorityQueue scheduler.
+ */
+uint64_t ECSubRead::cost(CephContext *cct, std::pair<int, int>& subchunk_info)
+{
+  uint64_t total_cost = 0;
+  /**
+   * While the cost is calculated by the primary shard with mClock
+   * scheduler being active, the replica shard could still be
+   * running on the legacy WPQ scheduler. In such a case, the
+   * replica shard's decoding logic would set the cost to 0, which
+   * is consistent with what the legacy WPQ scheduler expects.
+   *
+   * In the converse case, the primary shard running with the
+   * legacy WPQ scheduler sends a cost of 0. The replica shard
+   * running with mClock scheduler will interpret this and set
+   * the cost to 1 accordingly.
+   */
+  if (cct->_conf->osd_op_queue != "mclock_scheduler") {
+    return total_cost; // Legacy behavior for WPQ scheduler
+  }
+
+  uint64_t subchunk_size = subchunk_info.second;
+
+  for (auto &&[hoid, tl] : to_read) {
+    auto it = subchunks.find(hoid);
+    if (it == subchunks.end()) continue;
+
+    auto &sc = it->second;
+    if (sc.empty()) continue;
+
+    // Case 1: Optimized / Complete chunk aligned read
+    if (sc.size() == 1 && sc.front().second == subchunk_info.first) {
+      for ([[maybe_unused]] auto &&[offset, len, flags] : tl) {
+        total_cost += len;
+      }
+      continue;
+    }
+
+    // Case 2: Fragmented / Subchunk Reads
+    uint64_t fragmented_shard_bytes = 0;
+    for (auto &&k : sc) {
+      fragmented_shard_bytes += (uint64_t)k.second * subchunk_size;
+    }
+    total_cost += fragmented_shard_bytes * tl.size();
+  }
+
+  // Safety Boundary: mClock requires non-zero costs for tracking active ops
+  return std::max<uint64_t>(total_cost, 1ULL);
+}
+
 std::ostream &operator<<(
   std::ostream &lhs, const ECSubRead &rhs)
 {
diff --git a/src/osd/ECMsgTypes.h b/src/osd/ECMsgTypes.h
index 72aace2335c..282ba480dc8 100644
--- a/src/osd/ECMsgTypes.h
+++ b/src/osd/ECMsgTypes.h
@@ -119,6 +119,14 @@ struct ECSubRead {
   std::map<hobject_t, std::vector<std::pair<int, int>>> subchunks;
   std::set<hobject_t> omap_headers_to_read;
   std::map<hobject_t, std::pair<std::string, uint64_t>> omap_read_from;
+  /**
+    * Calculate the cost of the SubOp read operation for mClock scheduler.
+    *
+    * @param *cct: *CephContext
+    * @param pair<int, int>&: subchunk_count and subchunk_size
+    * @return uint64_t - Cost of EC SubOpRead (size in Bytes)
+    */
+  uint64_t cost(CephContext *cct, std::pair<int, int>& subchunk_info);
   void encode(ceph::buffer::list &bl, uint64_t features) const;
   void decode(ceph::buffer::list::const_iterator &bl);
   void dump(ceph::Formatter *f) const;

From 5ae77683c1bb00fba249afbd5b5fd26fe95e536c Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
Date: Tue, 21 Apr 2026 18:00:50 +0530
Subject: [PATCH 202/596] mclock_common, mClockScheduler: Add perf counters for
 scheduler ops

Add perf counters to show the status pertaining to the number of ops,
dynamic queue lengths, queue latency and bytes read for the following
ops handled in the high queues and in the scheduler queues:
 - peering
 - client
 - ec reads/writes
 - ec recovery reads

Additional counters can be added in the future based on the requirement.

Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 src/common/mclock_common.cc          | 100 ++++++++++++++++++++++++---
 src/common/mclock_common.h           |  37 +++++++++-
 src/osd/scheduler/OpSchedulerItem.h  |  32 ++++++++-
 src/osd/scheduler/mClockScheduler.cc |  87 ++++++++++++++++++-----
 src/osd/scheduler/mClockScheduler.h  |   2 +
 5 files changed, 230 insertions(+), 28 deletions(-)

diff --git a/src/common/mclock_common.cc b/src/common/mclock_common.cc
index 616681018f7..ae6eca8d9a1 100644
--- a/src/common/mclock_common.cc
+++ b/src/common/mclock_common.cc
@@ -248,6 +248,7 @@ void MclockConfig::init_logger()
   PerfCountersBuilder m(cct, "mclock-shard-queue-" + std::to_string(shard_id),
                         l_mclock_first, l_mclock_last);
 
+  // scheduler class queue lengths
   m.add_u64_counter(l_mclock_immediate_queue_len, "mclock_immediate_queue_len",
                     "high_priority op count in mclock queue");
   m.add_u64_counter(l_mclock_client_queue_len, "mclock_client_queue_len",
@@ -258,6 +259,38 @@ void MclockConfig::init_logger()
                     "background_best_effort type op count in mclock queue");
   m.add_u64_counter(l_mclock_all_type_queue_len, "mclock_all_type_queue_len",
                     "all type op count in mclock queue");
+  // op specific counters
+  // peering
+  m.add_time_avg(l_mclock_peering_lat, "mclock_peering_lat",
+                 "peering op average latency in mclock high queue");
+  m.add_u64_counter(l_mclock_peering_len, "mclock_peering_len",
+                    "peering op count in mclock high queue");
+  // client op
+  m.add_time_avg(l_mclock_client_lat, "mclock_client_lat",
+                 "client op average latency in mclock queue");
+  // ec reads
+  m.add_u64_counter(l_mclock_ec_r_ops, "mclock_ec_r_ops",
+                    "ec read operations in mclock high queue");
+  m.add_time_avg(l_mclock_ec_r_lat, "mclock_ec_r_lat",
+                 "ec read latency in mclock high queue");
+  m.add_u64(l_mclock_ec_r_len, "mclock_ec_r_len",
+            "ec reads outstanding in mclock high queue");
+  // ec writes
+  m.add_u64_counter(l_mclock_ec_w_ops, "mclock_ec_w_ops",
+                    "ec write operations in mclock high queue");
+  m.add_time_avg(l_mclock_ec_w_lat, "mclock_ec_w_lat",
+                 "ec write latency in mclock high queue");
+  m.add_u64(l_mclock_ec_w_len, "mclock_ec_w_len",
+            "ec writes outstanding in mclock high queue");
+  // ec recovery reads
+  m.add_u64_counter(l_mclock_ec_rec_r_ops, "mclock_ec_rec_r_ops",
+                    "ec recovery read operations in mclock queue");
+  m.add_u64_counter(l_mclock_ec_rec_r_outb, "mclock_ec_rec_r_outb",
+                    "ec recovery read bytes", NULL, 0, unit_t(UNIT_BYTES));
+  m.add_time_avg(l_mclock_ec_rec_r_lat, "mclock_ec_rec_r_lat",
+                 "ec recovery read latency in mclock queue");
+  m.add_u64(l_mclock_ec_rec_r_len, "mclock_ec_rec_r_len",
+            "ec recovery reads outstanding in mclock queue");
 
   logger = m.create_perf_counters();
   cct->get_perfcounters_collection()->add(logger);
@@ -267,9 +300,23 @@ void MclockConfig::init_logger()
   logger->set(l_mclock_recovery_queue_len, 0);
   logger->set(l_mclock_best_effort_queue_len, 0);
   logger->set(l_mclock_all_type_queue_len, 0);
+  logger->set(l_mclock_peering_lat, 0);
+  logger->set(l_mclock_peering_len, 0);
+  logger->set(l_mclock_client_lat, 0);
+  logger->set(l_mclock_ec_r_ops, 0);
+  logger->set(l_mclock_ec_r_lat, 0);
+  logger->set(l_mclock_ec_r_len, 0);
+  logger->set(l_mclock_ec_w_ops, 0);
+  logger->set(l_mclock_ec_w_lat, 0);
+  logger->set(l_mclock_ec_w_len, 0);
+  logger->set(l_mclock_ec_rec_r_ops, 0);
+  logger->set(l_mclock_ec_rec_r_outb, 0);
+  logger->set(l_mclock_ec_rec_r_lat, 0);
+  logger->set(l_mclock_ec_rec_r_len, 0);
 }
 
-void MclockConfig::get_mclock_counter(scheduler_id_t id)
+void MclockConfig::get_mclock_counter(scheduler_id_t id,
+  scheduler_op_type_t op_type, uint64_t cost)
 {
   if (!logger) {
     return;
@@ -279,47 +326,84 @@ void MclockConfig::get_mclock_counter(scheduler_id_t id)
   logger->inc(l_mclock_all_type_queue_len);
 
   switch (id.class_id) {
-  case SchedulerClass::immediate:
+  case SchedulerClass::immediate: {
     logger->inc(l_mclock_immediate_queue_len);
+    if (op_type == scheduler_op_type_t::ec_read_op) {
+      logger->inc(l_mclock_ec_r_ops);
+      logger->inc(l_mclock_ec_r_len);
+    } else if (op_type == scheduler_op_type_t::ec_write_op) {
+      logger->inc(l_mclock_ec_w_ops);
+      logger->inc(l_mclock_ec_w_len);
+    } else if (op_type == scheduler_op_type_t::peering_op) {
+      logger->inc(l_mclock_peering_len);
+    }
     break;
+  }
   case SchedulerClass::client:
     logger->inc(l_mclock_client_queue_len);
     break;
   case SchedulerClass::background_recovery:
     logger->inc(l_mclock_recovery_queue_len);
     break;
-  case SchedulerClass::background_best_effort:
+  case SchedulerClass::background_best_effort: {
     logger->inc(l_mclock_best_effort_queue_len);
+    if (op_type == scheduler_op_type_t::ec_rec_read_op) {
+      logger->inc(l_mclock_ec_rec_r_ops);
+      logger->inc(l_mclock_ec_rec_r_outb, cost);
+      logger->inc(l_mclock_ec_rec_r_len);
+    }
     break;
-   default:
+  }
+  default:
     derr << __func__ << " unknown class_id=" << id.class_id
          << " unknown id=" << id << dendl;
     break;
   }
 }
 
-void MclockConfig::put_mclock_counter(scheduler_id_t id)
+void MclockConfig::put_mclock_counter(scheduler_id_t id,
+  scheduler_op_type_t op_type, utime_t time_queued)
 {
   if (!logger) {
     return;
   }
 
+  auto latency = ceph_clock_now() - time_queued;
+
   /* op leave mclock queue will -1 */
   logger->dec(l_mclock_all_type_queue_len);
 
   switch (id.class_id) {
-  case SchedulerClass::immediate:
+  case SchedulerClass::immediate: {
     logger->dec(l_mclock_immediate_queue_len);
+    if (op_type == scheduler_op_type_t::ec_read_op) {
+      logger->dec(l_mclock_ec_r_len);
+      logger->tinc(l_mclock_ec_r_lat, latency);
+    } else if (op_type == scheduler_op_type_t::ec_write_op) {
+      logger->dec(l_mclock_ec_w_len);
+      logger->tinc(l_mclock_ec_w_lat, latency);
+    } else if (op_type == scheduler_op_type_t::peering_op) {
+      logger->dec(l_mclock_peering_len);
+      logger->tinc(l_mclock_peering_lat, latency);
+    }
     break;
-  case SchedulerClass::client:
+  }
+  case SchedulerClass::client: {
     logger->dec(l_mclock_client_queue_len);
+    logger->tinc(l_mclock_client_lat, latency);
     break;
+  }
   case SchedulerClass::background_recovery:
     logger->dec(l_mclock_recovery_queue_len);
     break;
-  case SchedulerClass::background_best_effort:
+  case SchedulerClass::background_best_effort: {
     logger->dec(l_mclock_best_effort_queue_len);
+    if (op_type == scheduler_op_type_t::ec_rec_read_op) {
+      logger->dec(l_mclock_ec_rec_r_len);
+      logger->tinc(l_mclock_ec_rec_r_lat, latency);
+    }
     break;
+   }
    default:
     derr << __func__ << " unknown class_id=" << id.class_id
          << " unknown id=" << id << dendl;
diff --git a/src/common/mclock_common.h b/src/common/mclock_common.h
index 98beb317db3..b736308159d 100644
--- a/src/common/mclock_common.h
+++ b/src/common/mclock_common.h
@@ -41,6 +41,15 @@ enum class scheduler_class_t : uint8_t {
   immediate,
 };
 
+// scheduler op types - used for perf counters
+enum class scheduler_op_type_t : uint8_t {
+  peering_op = 0,
+  ec_read_op,
+  ec_write_op,
+  ec_rec_read_op,
+  unknown,
+};
+
 #ifdef WITH_CRIMSON
 using SchedulerClass = scheduler_class_t;
 using MonClient = crimson::mon::Client;
@@ -50,11 +59,31 @@ using SchedulerClass = op_scheduler_class;
 
 enum {
   l_mclock_first = 15000,
+  // scheduler class queue lengths
   l_mclock_immediate_queue_len,
   l_mclock_client_queue_len,
   l_mclock_recovery_queue_len,
   l_mclock_best_effort_queue_len,
   l_mclock_all_type_queue_len,
+  // op specific counters
+  // peering
+  l_mclock_peering_lat,
+  l_mclock_peering_len,
+  // client ops
+  l_mclock_client_lat,
+  // ec reads
+  l_mclock_ec_r_ops,
+  l_mclock_ec_r_lat,
+  l_mclock_ec_r_len,
+  // ec writes
+  l_mclock_ec_w_ops,
+  l_mclock_ec_w_lat,
+  l_mclock_ec_w_len,
+  // ec recovery reads
+  l_mclock_ec_rec_r_ops,
+  l_mclock_ec_rec_r_outb,
+  l_mclock_ec_rec_r_lat,
+  l_mclock_ec_rec_r_len,
   l_mclock_last,
 };
 
@@ -222,8 +251,12 @@ public:
 
   void set_from_config();
   void init_logger();
-  void get_mclock_counter(scheduler_id_t id);
-  void put_mclock_counter(scheduler_id_t id);
+  void get_mclock_counter(scheduler_id_t id,
+                          scheduler_op_type_t op_type,
+                          uint64_t cost);
+  void put_mclock_counter(scheduler_id_t id,
+                          scheduler_op_type_t op_type,
+                          utime_t time_queued);
   double get_cost_per_io() const;
   double get_capacity_per_shard() const;
   void handle_conf_change(const ConfigProxy& conf,
diff --git a/src/osd/scheduler/OpSchedulerItem.h b/src/osd/scheduler/OpSchedulerItem.h
index 21fbe1abd6b..e6643c627bb 100644
--- a/src/osd/scheduler/OpSchedulerItem.h
+++ b/src/osd/scheduler/OpSchedulerItem.h
@@ -74,6 +74,9 @@ public:
 
     virtual void run(OSD *osd, OSDShard *sdata, PGRef& pg, ThreadPool::TPHandle &handle) = 0;
     virtual SchedulerClass get_scheduler_class() const = 0;
+    virtual utime_t get_time_queued() const {
+      return utime_t();
+    }
 
     virtual ~OpQueueable() {}
     friend std::ostream& operator<<(std::ostream& out, const OpQueueable& q) {
@@ -166,6 +169,10 @@ public:
     qos_cost = scaled_cost;
   }
 
+  utime_t get_time_queued() const {
+    return qitem ? qitem->get_time_queued() : utime_t();
+  }
+
   friend std::ostream& operator<<(std::ostream& out, const OpSchedulerItem& item) {
     out << "OpSchedulerItem("
         << item.get_ordering_token() << " " << *item.qitem;
@@ -220,10 +227,12 @@ public:
 };
 
 class PGOpItem : public PGOpQueueable {
+  utime_t time_queued;
   OpRequestRef op;
 
 public:
-  PGOpItem(spg_t pg, OpRequestRef op) : PGOpQueueable(pg), op(std::move(op)) {}
+  PGOpItem(spg_t pg, OpRequestRef op)
+    : PGOpQueueable(pg), time_queued(ceph_clock_now()), op(std::move(op)) {}
 
   std::ostream &print(std::ostream &rhs) const final {
     return rhs << "PGOpItem(op=" << *(op->get_req()) << ")";
@@ -282,13 +291,19 @@ public:
     }
   }
 
+  utime_t get_time_queued() const final{
+    return time_queued;
+  }
+
   void run(OSD *osd, OSDShard *sdata, PGRef& pg, ThreadPool::TPHandle &handle) final;
 };
 
 class PGPeeringItem : public PGOpQueueable {
+  utime_t time_queued;
   PGPeeringEventRef evt;
 public:
-  PGPeeringItem(spg_t pg, PGPeeringEventRef e) : PGOpQueueable(pg), evt(e) {}
+  PGPeeringItem(spg_t pg, PGPeeringEventRef e)
+    : PGOpQueueable(pg), time_queued(ceph_clock_now()), evt(e) {}
   std::ostream &print(std::ostream &rhs) const final {
     return rhs << "PGPeeringEvent(" << evt->get_desc() << ")";
   }
@@ -308,6 +323,9 @@ public:
   SchedulerClass get_scheduler_class() const final {
     return SchedulerClass::immediate;
   }
+  utime_t get_time_queued() const final{
+    return time_queued;
+  }
 };
 
 class PGSnapTrim : public PGOpQueueable {
@@ -537,6 +555,9 @@ public:
   uint64_t get_reserved_pushes() const final {
     return reserved_pushes;
   }
+  utime_t get_time_queued() const final {
+    return time_queued;
+  }
   void run(
     OSD *osd, OSDShard *sdata, PGRef& pg, ThreadPool::TPHandle &handle) final;
   SchedulerClass get_scheduler_class() const final {
@@ -565,6 +586,9 @@ public:
     return fmt::format(
 	"PGRecoveryContext(pgid={} c={} epoch={})", get_pgid(), (void*)c.get(), epoch);
   }
+  utime_t get_time_queued() const final {
+    return time_queued;
+  }
   void run(
     OSD *osd, OSDShard *sdata, PGRef& pg, ThreadPool::TPHandle &handle) final;
   SchedulerClass get_scheduler_class() const final {
@@ -634,6 +658,10 @@ public:
     return priority_to_scheduler_class(op->get_req()->get_priority());
   }
 
+  utime_t get_time_queued() const final {
+    return time_queued;
+  }
+
   void run(OSD* osd, OSDShard* sdata, PGRef& pg, ThreadPool::TPHandle& handle)
       final;
 };
diff --git a/src/osd/scheduler/mClockScheduler.cc b/src/osd/scheduler/mClockScheduler.cc
index 3cef5431ce9..a66a06fd769 100644
--- a/src/osd/scheduler/mClockScheduler.cc
+++ b/src/osd/scheduler/mClockScheduler.cc
@@ -73,30 +73,71 @@ void mClockScheduler::dump(ceph::Formatter &f) const
   f.close_section();
 }
 
+scheduler_op_type_t
+mClockScheduler::get_scheduler_op_type(const OpSchedulerItem &item)
+{
+  if (item.is_peering()) {
+    return scheduler_op_type_t::peering_op;
+  }
+
+  const auto op = item.maybe_get_op();
+  if (!op.has_value() || !(*op) || !(*op)->get_req()) {
+    return scheduler_op_type_t::unknown;
+  }
+
+  scheduler_op_type_t sch_op_type = scheduler_op_type_t::unknown;
+  const auto op_type = (*op)->get_req()->get_type();
+  const auto id = get_scheduler_id(item);
+  switch (id.class_id) {
+  case SchedulerClass::immediate: {
+    if (op_type == MSG_OSD_EC_READ) {
+      sch_op_type = scheduler_op_type_t::ec_read_op;
+    } else if (op_type == MSG_OSD_EC_WRITE) {
+      sch_op_type = scheduler_op_type_t::ec_write_op;
+    }
+    break;
+  }
+  case SchedulerClass::background_best_effort: {
+    if (op_type == MSG_OSD_EC_READ) {
+      sch_op_type = scheduler_op_type_t::ec_rec_read_op;
+    }
+    break;
+  }
+  default:
+    break;
+  }
+
+  return sch_op_type;
+}
+
 void mClockScheduler::enqueue(OpSchedulerItem&& item)
 {
   auto id = get_scheduler_id(item);
   unsigned priority = item.get_priority();
-  
+  scheduler_op_type_t sch_op_type = get_scheduler_op_type(item);
+  auto item_cost = item.get_cost();
+
   // TODO: move this check into OpSchedulerItem, handle backwards compat
   if (SchedulerClass::immediate == id.class_id) {
     enqueue_high(immediate_class_priority, std::move(item));
   } else if (priority >= cutoff_priority) {
     enqueue_high(priority, std::move(item));
   } else {
-    auto cost = calc_scaled_cost(item.get_cost());
-    item.set_qos_cost(cost);
+    auto qos_cost = calc_scaled_cost(item_cost);
+    item.set_qos_cost(qos_cost);
     dout(20) << __func__ << " " << id
-             << " item_cost: " << item.get_cost()
-             << " scaled_cost: " << cost
+             << " item_cost: " << item_cost
+             << " scaled_cost: " << qos_cost
              << dendl;
 
+    // trigger perf counter calculations first
+    mclock_conf.get_mclock_counter(id, sch_op_type, item_cost);
+
     // Add item to scheduler queue
     scheduler.add_request(
       std::move(item),
       id,
-      cost);
-    mclock_conf.get_mclock_counter(id);
+      qos_cost);
   }
 
   dout(20) << __func__ << ": sched client_count: " << scheduler.client_count()
@@ -141,17 +182,20 @@ void mClockScheduler::enqueue_high(unsigned priority,
                                    OpSchedulerItem&& item,
 				   bool front)
 {
+  scheduler_op_type_t sch_op_type = get_scheduler_op_type(item);
+  scheduler_id_t id = scheduler_id_t {
+    SchedulerClass::immediate,
+    client_profile_id_t()
+  };
+
+  // trigger perf counter calculations first
+  mclock_conf.get_mclock_counter(id, sch_op_type, item.get_cost());
+
   if (front) {
     high_priority[priority].push_back(std::move(item));
   } else {
     high_priority[priority].push_front(std::move(item));
   }
-
-  scheduler_id_t id = scheduler_id_t {
-    SchedulerClass::immediate,
-    client_profile_id_t()
-  };
-  mclock_conf.get_mclock_counter(id);
 }
 
 WorkItem mClockScheduler::dequeue()
@@ -166,13 +210,15 @@ WorkItem mClockScheduler::dequeue()
       // maintain invariant, high priority entries are never empty
       high_priority.erase(iter);
     }
-    ceph_assert(std::get_if<OpSchedulerItem>(&ret));
+    auto *item_ptr = std::get_if<OpSchedulerItem>(&ret);
+    ceph_assert(item_ptr);
 
     scheduler_id_t id = scheduler_id_t {
       SchedulerClass::immediate,
       client_profile_id_t()
     };
-    mclock_conf.put_mclock_counter(id);
+    scheduler_op_type_t op_type = get_scheduler_op_type(*item_ptr);
+    mclock_conf.put_mclock_counter(id, op_type, item_ptr->get_time_queued());
     return ret;
   } else {
     mclock_queue_t::PullReq result = scheduler.pull_request();
@@ -186,7 +232,16 @@ WorkItem mClockScheduler::dequeue()
       ceph_assert(result.is_retn());
 
       auto &retn = result.get_retn();
-      mclock_conf.put_mclock_counter(retn.client);
+
+      // update perf counters
+      scheduler_op_type_t op_type = scheduler_op_type_t::unknown;
+      utime_t time_queued = utime_t();
+      if (retn.request) {
+        op_type = get_scheduler_op_type(*retn.request);
+        time_queued = retn.request->get_time_queued();
+      }
+      mclock_conf.put_mclock_counter(retn.client, op_type, time_queued);
+
       return std::move(*retn.request);
     }
   }
diff --git a/src/osd/scheduler/mClockScheduler.h b/src/osd/scheduler/mClockScheduler.h
index 503e9058025..109532a4273 100644
--- a/src/osd/scheduler/mClockScheduler.h
+++ b/src/osd/scheduler/mClockScheduler.h
@@ -149,6 +149,8 @@ public:
 private:
   // Enqueue the op to the high priority queue
   void enqueue_high(unsigned prio, OpSchedulerItem &&item, bool front = false);
+  // Return the scheduler op type - used to update perf counters
+  scheduler_op_type_t get_scheduler_op_type(const OpSchedulerItem &item);
 };
 
 }

From 77421c83665fdfd3343c487793e37e003d8c1891 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
Date: Mon, 25 May 2026 17:44:54 +0530
Subject: [PATCH 203/596] mclock_common: adjust mClock profile parameters to
 prevent backfill starvation

Adjust the 'background_best_effort' queue parameters across the
three standard mClock profiles (high_client_ops, balanced, and
high_recovery_ops) to ensure best effort ops are not starved.

Previously, the 'background_best_effort' queue carried a default allocation
of 0% (MIN) reservation and a weight of 1 under these profiles. When
concurrent client traffic is dense, the zero-reservation for example completely
starves backfill sub-ops (MSG_OSD_EC_READ) on pools with
'allow_ec_optimizations' set to false. This starvation forces the Primary OSD
to hold internal BlueStore transactions and PG object locks for extended
windows, causing severe client median (50th) latency inflation.

To prevent background starvation and resolve the effects of the primary lock
retention, the profile configurations are tuned as follows:

The following profile changes forces low-cost sub-ops to clear out of peer
queues rapidly to drop  primary locks, which helps improve the client
completion latency and tail latency (95th, 99th and 99.5th) percentile.

1. high_client_ops profile:
   - Grant 'background_best_effort' a safe 5% minimum reservation.
   - Scale the queue weight to 4.

2. balanced profile:
   - Grant 'background_best_effort' a 5% minimum reservation.
   - Set the queue weight to 2.

3. high_recovery_ops profile:
   - Grant 'background_best_effort' a 5% minimum reservation.
   - Set the queue weight to 2.

4. Modify the mClock config reference documentation to reflect the tuning
   changes to the best-effort QoS parameters across the profiles.

Note on Proportional Scaling Compatibility:
Configuring these changes shifts total reservations to 105% (e.g., 50%
client + 50% recovery + 5% best-effort under the Balanced profile). Under
heavy concurrent saturation, mClock's internal controls resolves this
gracefully via proportional down-scaling, preserving the underlying
device bandwidth limits for different classes of clients. For example instead
of the client being allocated 50% bandwidth, a slightly lower reservation is
allocated while shifting the remaining bandwidth to the best-effort queue.
This minor scaling shift is virtually unnoticeable to the client application,
but it prevents the internal queue deadlocks.

Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 doc/rados/configuration/mclock-config-ref.rst |  6 ++---
 src/common/mclock_common.h                    | 24 +++++++++----------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/doc/rados/configuration/mclock-config-ref.rst b/doc/rados/configuration/mclock-config-ref.rst
index 95d6e52c91e..316e1faa5e1 100644
--- a/doc/rados/configuration/mclock-config-ref.rst
+++ b/doc/rados/configuration/mclock-config-ref.rst
@@ -128,7 +128,7 @@ built-in profiles may be enabled by following the steps mentioned in next sectio
 +------------------------+-------------+--------+-------+
 | background recovery    | 50%         | 1      | MAX   |
 +------------------------+-------------+--------+-------+
-| background best-effort | MIN         | 1      | 90%   |
+| background best-effort |  5%         | 2      | 90%   |
 +------------------------+-------------+--------+-------+
 
 high_client_ops
@@ -147,7 +147,7 @@ the resource control parameters set by the profile:
 +------------------------+-------------+--------+-------+
 | background recovery    | 40%         | 1      | MAX   |
 +------------------------+-------------+--------+-------+
-| background best-effort | MIN         | 1      | 70%   |
+| background best-effort |  5%         | 4      | 70%   |
 +------------------------+-------------+--------+-------+
 
 high_recovery_ops
@@ -165,7 +165,7 @@ parameters set by the profile:
 +------------------------+-------------+--------+-------+
 | background recovery    | 70%         | 2      | MAX   |
 +------------------------+-------------+--------+-------+
-| background best-effort | MIN         | 1      | MAX   |
+| background best-effort |  5%         | 2      | MAX   |
 +------------------------+-------------+--------+-------+
 
 .. note:: Across the built-in profiles, internal background best-effort clients
diff --git a/src/common/mclock_common.h b/src/common/mclock_common.h
index b736308159d..498da12ca5a 100644
--- a/src/common/mclock_common.h
+++ b/src/common/mclock_common.h
@@ -128,12 +128,12 @@ struct profile_t {
  * Background Recovery Allocation:
  *   reservation: 40% | weight: 1 | limit: 0 (max) |
  * Background Best Effort Allocation:
- *   reservation: 0 (min) | weight: 1 | limit: 70% |
+ *   reservation:  5% | weight: 4 | limit: 70% |
  */
 constexpr profile_t HIGH_CLIENT_OPS{
-  { .6, 2,  0 },
-  { .4, 1,  0 },
-  {  0, 1, .7 }
+  { .6,  2,  0 },
+  { .4,  1,  0 },
+  { .05, 4, .7 }
 };
 
 /**
@@ -144,12 +144,12 @@ constexpr profile_t HIGH_CLIENT_OPS{
  * Background Recovery Allocation:
  *   reservation: 70% | weight: 2 | limit: 0 (max) |
  * Background Best Effort Allocation:
- *   reservation: 0 (min) | weight: 1 | limit: 0 (max) |
+ *   reservation:  5% | weight: 2 | limit: 0 (max) |
  */
 constexpr profile_t HIGH_RECOVERY_OPS{
-  { .3, 1, 0 },
-  { .7, 2, 0 },
-  {  0, 1, 0 }
+  { .3,  1, 0 },
+  { .7,  2, 0 },
+  { .05, 2, 0 }
 };
 
 /**
@@ -160,12 +160,12 @@ constexpr profile_t HIGH_RECOVERY_OPS{
  * Background Recovery Allocation:
  *   reservation: 50% | weight: 1 | limit: 0 (max) |
  * Background Best Effort Allocation:
- *   reservation: 0 (min) | weight: 1 | limit: 90% |
+ *   reservation:  5% | weight: 2 | limit: 90% |
  */
 constexpr profile_t BALANCED{
-  { .5, 1, 0 },
-  { .5, 1, 0 },
-  {  0, 1, .9 }
+  { .5,  1,  0 },
+  { .5,  1,  0 },
+  { .05, 2, .9 }
 };
 
 struct client_profile_id_t {

From 2cf1e713cec59c989602c001e710ba499005ab04 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
Date: Thu, 4 Jun 2026 12:28:35 +0530
Subject: [PATCH 204/596] doc/rados/configuration: Remove wpq recommendation
 warning for EC clusters

Remove the warning that recommends using wpq scheduler as a fallback for EC
clusters. This issue is addressed by considering EC recovery reads as
background, assigning an accurate cost for those reads and tuning the QoS
parameters associated with best-effort class of operations.

Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 doc/rados/configuration/mclock-config-ref.rst | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/doc/rados/configuration/mclock-config-ref.rst b/doc/rados/configuration/mclock-config-ref.rst
index 316e1faa5e1..fc5201b32fc 100644
--- a/doc/rados/configuration/mclock-config-ref.rst
+++ b/doc/rados/configuration/mclock-config-ref.rst
@@ -4,22 +4,6 @@
 
 .. index:: mclock; configuration
 
-.. warning:: On large clusters with erasure-coded pools, operators may
-   observe slow ops during recovery or backfill (for example, when an
-   OSD is drained out). Under mClock, EC sub-operation reads issued
-   during recovery are currently routed through the ``immediate``
-   high-priority queue and bypass mClock throttling. When many OSDs
-   read concurrently from a single source OSD, this can saturate that
-   OSD's high-priority queue and starve client and background work.
-   As an interim measure, such deployments are advised to switch to
-   the ``WeightedPriorityQueue`` (``wpq``) scheduler. The change can
-   be applied cluster-wide and takes effect after each OSD is
-   restarted:
-
-   .. prompt:: bash #
-
-     ceph config set osd osd_op_queue wpq
-
 QoS support in Ceph is implemented using a queuing scheduler based on `the
 dmClock algorithm`_. See :ref:`dmclock-qos` section for more details.
 

From 63b91836b00bae9fb2ba19ee837edccb7f2840bb Mon Sep 17 00:00:00 2001
From: "Ashwin M. Joshi" <ashjosh1@in.ibm.com>
Date: Tue, 10 Feb 2026 11:59:49 +0530
Subject: [PATCH 205/596] mgr/cephadm: Control cephadm.log messages based on a
 new mgr logging level flag

  Introduces a new 'cephadm_binary_logging_level' config option to control
  the verbosity of cephadm logging to persistent destinations (cephadm.log, syslog).

  - Adds --logging-level CLI flag (info, debug, error, warning)
  - Adds mgr/cephadm/cephadm_binary_logging_level config option
  - Applies logging level to file and syslog handlers
  - Console handlers maintain their defaults for terminal UX

Fixes: https://tracker.ceph.com/issues/74872
Signed-off-by: Ashwin M. Joshi <ashjosh1@in.ibm.com>
---
 src/cephadm/cephadm.py                       |   5 +
 src/cephadm/cephadmlib/context.py            |   1 +
 src/cephadm/cephadmlib/logging.py            |  13 ++-
 src/pybind/mgr/cephadm/module.py             |   8 ++
 src/pybind/mgr/cephadm/serve.py              |   3 +
 src/pybind/mgr/cephadm/tests/test_cephadm.py | 109 +++++++++++++++++++
 6 files changed, 138 insertions(+), 1 deletion(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 45cb599e648..4bf0f2b1015 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -4977,6 +4977,11 @@ def _get_parser():
         action='store_true',
         default=False,
         help='Do not run containers with --cgroups=split (currently only relevant when using podman)')
+    parser.add_argument(
+        '--logging-level',
+        choices=['info', 'debug', 'error', 'warning'],
+        default='debug',
+        help='Tunable log level for cephadm binary: info, debug, error, warning (default: debug)')
 
     subparsers = parser.add_subparsers(help='sub-command')
 
diff --git a/src/cephadm/cephadmlib/context.py b/src/cephadm/cephadmlib/context.py
index 3411c199ebb..502d2c239c7 100644
--- a/src/cephadm/cephadmlib/context.py
+++ b/src/cephadm/cephadmlib/context.py
@@ -31,6 +31,7 @@ class BaseConfig:
         self.memory_request: Optional[int] = None
         self.memory_limit: Optional[int] = None
         self.log_to_journald: Optional[bool] = None
+        self.logging_level: str = 'debug'
 
         self.container_init: bool = CONTAINER_INIT
         # FIXME(refactor) : should be Optional[ContainerEngine]
diff --git a/src/cephadm/cephadmlib/logging.py b/src/cephadm/cephadmlib/logging.py
index f722a33e78d..b343e0d79dc 100644
--- a/src/cephadm/cephadmlib/logging.py
+++ b/src/cephadm/cephadmlib/logging.py
@@ -173,7 +173,9 @@ def _copy(obj: Any) -> Any:
 
 
 def _complete_logging_config(
-    interactive: bool, destinations: Optional[List[str]]
+    interactive: bool,
+    destinations: Optional[List[str]],
+    logging_level: str = 'debug',
 ) -> Dict[str, Any]:
     """Return a logging configuration dict, based on the runtime parameters
     cephadm was invoked with.
@@ -183,6 +185,12 @@ def _complete_logging_config(
     if interactive:
         lc = _copy(_interactive_logging_config)
 
+    # Apply logging level to persistent destinations only (cephadm.log, syslog).
+    # Console handlers keep their template defaults for terminal UX.
+    level_upper = logging_level.upper()
+    lc['handlers']['log_file']['level'] = level_upper
+    lc['handlers']['syslog']['level'] = level_upper
+
     handlers = lc['loggers']['']['handlers']
     if not destinations:
         handlers.append(LogDestination.file.value)
@@ -206,9 +214,11 @@ def cephadm_init_logging(
     if not os.path.exists(LOG_DIR):
         os.makedirs(LOG_DIR)
 
+    logging_level = getattr(ctx, 'logging_level', 'debug').lower()
     lc = _complete_logging_config(
         any(op in args for op in _INTERACTIVE_CMDS),
         getattr(ctx, 'log_dest', None),
+        logging_level=logging_level,
     )
     logging.config.dictConfig(lc)
 
@@ -228,6 +238,7 @@ def cephadm_init_logging(
         # option is set
         if ctx.verbose and handler.name in _VERBOSE_HANDLERS:
             handler.setLevel(QUIET_LOG_LEVEL)
+
     logger.debug('%s\ncephadm %s' % ('-' * 80, args))
 
 
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index ef4699838d1..555b7065761 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -509,6 +509,13 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             desc="Destination for cephadm command persistent logging",
             enum_allowed=['file', 'syslog', 'file,syslog'],
         ),
+        Option(
+            'cephadm_binary_logging_level',
+            type='str',
+            default='debug',
+            desc='Logging verbosity for the cephadm binary when invoked by the mgr (e.g. check-host, gather-facts).',
+            enum_allowed=['info', 'debug', 'error', 'warning']
+        ),
         Option(
             'oob_default_addr',
             type='str',
@@ -622,6 +629,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             self.certificate_automated_rotation_enabled = False
             self.certificate_check_debug_mode = False
             self.certificate_check_period = 0
+            self.cephadm_binary_logging_level = 'debug'
 
         self.notify(NotifyType.mon_map, None)
         self.config_notify()
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 1f1b5c2fd6f..e4f57d8a7ee 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1738,6 +1738,9 @@ class CephadmServe:
         if image:
             final_args.extend(['--image', image])
 
+        cephadm_log_level = self.mgr.cephadm_binary_logging_level or 'debug'
+        final_args.extend(['--logging-level', cephadm_log_level])
+
         if not self.mgr.container_init:
             final_args += ['--no-container-init']
 
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index e462d17e761..269a1664e68 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -3117,3 +3117,112 @@ Traceback (most recent call last):
                 assert wait(cephadm_module, c) == ['Scheduled osd.foo update...']
 
                 cephadm_module.set_osd_spec('osd.foo', ['1'])
+
+
+class TestCephadmBinaryLoggingLevel:
+    """Test that host-status / cephadm binary logs are suppressed based on
+    mgr/cephadm/cephadm_binary_logging_level.
+    """
+    @pytest.mark.parametrize("logging_level", ['info', 'debug', 'error', 'warning'])
+    @mock.patch("cephadm.ssh.SSHManager._remote_connection")
+    @mock.patch("cephadm.ssh.SSHManager._execute_command")
+    @mock.patch("cephadm.ssh.SSHManager._check_execute_command")
+    def test_check_host_invokes_cephadm_with_logging_level(
+        self, check_execute_command, execute_command, remote_connection, cephadm_module, logging_level
+    ):
+        """Cephadm binary must be invoked with --logging-level matching
+        mgr/cephadm/cephadm_binary_logging_level (info, debug, error, warning).
+        Check that mgr builds the cephadm command with appropriate --logging-level flag
+        Use check-host as a sample command although all cephadm commands receive the flag.
+        """
+        remote_connection.side_effect = async_side_effect(mock.Mock())
+        check_execute_command.side_effect = async_side_effect('/usr/bin/python3')
+        captured_commands = []
+
+        async def capture_execute(host, cmd, *args, **kwargs):
+            if hasattr(cmd, 'args'):
+                if 'check-host' in cmd.args:
+                    captured_commands.append(cmd)
+                # Return valid JSON for commands that use _run_cephadm_json
+                if 'ls' in cmd.args:
+                    return ('[]', '', 0)
+                if 'gather-facts' in cmd.args:
+                    return ('{}', '', 0)
+                if 'list-networks' in cmd.args:
+                    return ('[]', '', 0)
+            return ('', '', 0)
+
+        execute_command.side_effect = capture_execute
+
+        cephadm_module.cephadm_binary_logging_level = logging_level
+        with with_host(cephadm_module, 'test'):
+            pass
+
+        check_host_cmds = [c for c in captured_commands if 'check-host' in c.args]
+        assert len(check_host_cmds) >= 1, (
+            f'expected at least one check-host invocation for level {logging_level!r}'
+        )
+        cmd = check_host_cmds[0]
+        assert '--logging-level' in cmd.args, (
+            f'cephadm should be called with --logging-level when level is {logging_level!r}'
+        )
+        idx = cmd.args.index('--logging-level')
+        assert cmd.args[idx + 1] == logging_level, (
+            f'cephadm should be called with --logging-level {logging_level!r}'
+        )
+
+
+class TestCephadmLogDestination:
+    """Test that cephadm is invoked with --log-dest matching
+    mgr/cephadm/cephadm_log_destination.
+    """
+    @pytest.mark.parametrize(
+        "log_destination,expected_log_dests",
+        [
+            ('file', ['file']),
+            ('syslog', ['syslog']),
+            ('file,syslog', ['file', 'syslog']),
+        ],
+    )
+    @mock.patch("cephadm.ssh.SSHManager._remote_connection")
+    @mock.patch("cephadm.ssh.SSHManager._execute_command")
+    @mock.patch("cephadm.ssh.SSHManager._check_execute_command")
+    def test_check_host_invokes_cephadm_with_log_dest(
+        self, check_execute_command, execute_command, remote_connection,
+        cephadm_module, log_destination, expected_log_dests,
+    ):
+        """check-host must be invoked with --log-dest matching
+        mgr/cephadm/cephadm_log_destination (file, syslog, or both).
+        """
+        remote_connection.side_effect = async_side_effect(mock.Mock())
+        check_execute_command.side_effect = async_side_effect('/usr/bin/python3')
+        captured_commands = []
+
+        async def capture_execute(host, cmd, *args, **kwargs):
+            if hasattr(cmd, 'args'):
+                if 'check-host' in cmd.args:
+                    captured_commands.append(cmd)
+                if 'ls' in cmd.args:
+                    return ('[]', '', 0)
+                if 'gather-facts' in cmd.args:
+                    return ('{}', '', 0)
+                if 'list-networks' in cmd.args:
+                    return ('[]', '', 0)
+            return ('', '', 0)
+
+        execute_command.side_effect = capture_execute
+
+        cephadm_module.cephadm_log_destination = log_destination
+        with with_host(cephadm_module, 'test'):
+            pass
+
+        check_host_cmds = [c for c in captured_commands if 'check-host' in c.args]
+        assert len(check_host_cmds) >= 1, (
+            f'expected at least one check-host invocation for dest {log_destination!r}'
+        )
+        cmd = check_host_cmds[0]
+        for dest in expected_log_dests:
+            assert f'--log-dest={dest}' in cmd.args, (
+                f'cephadm should be called with --log-dest={dest!r} '
+                f'when cephadm_log_destination is {log_destination!r}'
+            )

From e81c276963672626e6727cbf72392e25ac74c89c Mon Sep 17 00:00:00 2001
From: "Ashwin M. Joshi" <ashjosh1@in.ibm.com>
Date: Fri, 12 Jun 2026 14:08:18 +0530
Subject: [PATCH 206/596] doc/cephadm: Document cephadm_binary_logging_level
 option

Add documentation for the new cephadm binary logging level configuration

Fixes: https://tracker.ceph.com/issues/74872
Signed-off-by: Ashwin M. Joshi <ashjosh1@in.ibm.com>
---
 doc/cephadm/operations.rst | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/doc/cephadm/operations.rst b/doc/cephadm/operations.rst
index dc4a3c625ed..cc26465ecb4 100644
--- a/doc/cephadm/operations.rst
+++ b/doc/cephadm/operations.rst
@@ -393,6 +393,34 @@ For example:
    ``--log-dest`` options described in the bootstrap section above.
 
 
+Setting Cephadm Log Verbosity
+-----------------------------
+
+The verbosity of cephadm's persistent logging (``/var/log/ceph/cephadm.log``
+and syslog, when enabled) can be controlled separately from its terminal
+output. Valid levels are ``info``, ``debug``, ``error``, and ``warning``.
+The default is ``debug``.
+
+When the cephadm orchestration module runs ``cephadm`` on cluster hosts, it
+uses the :confval:`mgr/cephadm/cephadm_binary_logging_level` configuration
+value:
+
+.. prompt:: bash #
+
+  ceph config set mgr mgr/cephadm/cephadm_binary_logging_level info
+
+For manual invocations, pass ``--logging-level`` on the command line:
+
+.. prompt:: bash #
+
+  cephadm --logging-level info check-host
+
+.. note:: The logging level applies only to persistent log destinations
+   (the log file and syslog). Console output during bootstrap and other
+   interactive use is unchanged. When you run ``cephadm`` directly, the
+   mgr configuration does not apply; use ``--logging-level`` as shown above.
+
+
 Data Location
 =============
 

From 745f16a58ac8a9a160f349f7b932bc964f1ce75d Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Fri, 5 Jun 2026 10:14:28 +0200
Subject: [PATCH 207/596] qa: extend the ignore-list for the mgmt-gateway test
 suite

Let's add CEPHADM_AGENT_DOWN and CEPHADM_STRAY_DAEMON errors

Fixes: https://tracker.ceph.com/issues/77131
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 qa/suites/orch/cephadm/workunits/task/test_mgmt_gateway.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qa/suites/orch/cephadm/workunits/task/test_mgmt_gateway.yaml b/qa/suites/orch/cephadm/workunits/task/test_mgmt_gateway.yaml
index 7d37f65bf90..fae26afc9a9 100644
--- a/qa/suites/orch/cephadm/workunits/task/test_mgmt_gateway.yaml
+++ b/qa/suites/orch/cephadm/workunits/task/test_mgmt_gateway.yaml
@@ -2,6 +2,7 @@ overrides:
   ceph:
     log-ignorelist:
       - CEPHADM_FAILED_DAEMON
+      - CEPHADM_AGENT_DOWN
     log-only-match:
       - CEPHADM_
 roles:

From b4499d4f9afdb85ee87c36fe6b6e5a64677dade9 Mon Sep 17 00:00:00 2001
From: Kobi Ginon <kginon@redhat.com>
Date: Fri, 12 Jun 2026 19:01:44 +0300
Subject: [PATCH 208/596] mgr/test_orchestrator: accept force_delete_data in
 remove_daemons

PR #68428 plumbed force_delete_data through orchestrator daemon/service
removal; update the test_orchestrator stub so orchestrator_cli QA
(test_mds_rm, etc.) does not fail with an unexpected keyword argument.

Fixes: https://tracker.ceph.com/issues/77374
Signed-off-by: Kobi Ginon <kginon@redhat.com>
---
 src/pybind/mgr/test_orchestrator/module.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/test_orchestrator/module.py b/src/pybind/mgr/test_orchestrator/module.py
index e63efbdbdd8..9ccec1338a2 100644
--- a/src/pybind/mgr/test_orchestrator/module.py
+++ b/src/pybind/mgr/test_orchestrator/module.py
@@ -225,12 +225,12 @@ class TestOrchestrator(MgrModule, orchestrator.Orchestrator):
         return [self._create_osds(dg) for dg in specs]
 
     @handle_orch_error
-    def remove_daemons(self, names):
+    def remove_daemons(self, names, force_delete_data=False):
         assert isinstance(names, list)
         return 'done'
 
     @handle_orch_error
-    def remove_service(self, service_name, force = False):
+    def remove_service(self, service_name, force=False, force_delete_data=False):
         assert isinstance(service_name, str)
         return 'done'
 

From d7fedf1ecead7ad74579c2236f9fa175bc0c0ef4 Mon Sep 17 00:00:00 2001
From: Adam Kupczyk <akupczyk@ibm.com>
Date: Tue, 9 Jun 2026 20:16:03 +0200
Subject: [PATCH 209/596] doc/rados/bluestore: Fast onode recovery

Add new page of documentation about new feature: multithread onode
recovery.

Signed-off-by: Adam Kupczyk <akupczyk@ibm.com>
---
 doc/rados/bluestore/fast-onode-scan.rst | 168 ++++++++++++++++++++++++
 doc/rados/configuration/index.rst       |   1 +
 2 files changed, 169 insertions(+)
 create mode 100644 doc/rados/bluestore/fast-onode-scan.rst

diff --git a/doc/rados/bluestore/fast-onode-scan.rst b/doc/rados/bluestore/fast-onode-scan.rst
new file mode 100644
index 00000000000..f82f21aab9d
--- /dev/null
+++ b/doc/rados/bluestore/fast-onode-scan.rst
@@ -0,0 +1,168 @@
+============================
+ Multithread Onode Scanning
+============================
+
+.. index:: bluestore; rocksdb; allocator
+
+Since Pacific release BlueStore has the option to select 5-10% latency reduction
+at a cost of significantly longer ``OSD`` recovery after crash.
+
+.. confval:: bluestore_allocation_from_file
+
+During crash recovery BlueStore must reconstruct allocator state by scanning all stored objects.
+On systems with millions of objects this process can take several minutes.
+This page presents new multithreaded onode recovery that significantly reduces recovery time.
+
+Allocator
+=========
+
+In BlueStore ``Allocator`` is responsible for tracking unused allocation units on the disk.
+Up to 3 allocators can be in use concurrently, one for Main, one for DB, and one for WAL.
+Only Main device can contain RADOS object, and only Main's allocator is relevant here.
+When BlueStore is running, allocator state is fully loaded to memory. That way
+allocator can quickly respond when there is a need to allocate disk space for object,
+or when object no longer exists on disk.
+
+RocksDB persisted allocator
+---------------------------
+
+Original design envisioned that allocator state updates are stored in RocksDB's ``b`` column.
+When RADOS object change allocates or releases allocation unit the relevant state update information
+is kept together with object-modifying RocksDB atomic transaction. The information transfer is unidirectional,
+BlueStore is updating allocator state in RocksDB, but never retrieving it.
+The exception is OSD bootup when BlueStore retrieves allocator state from RocksDB ``b`` column.
+
+File persisted allocator
+------------------------
+
+It was tested that keeping RocksDB busy updating ``b`` column with allocation data
+has observable cost on write latency and cpu burden on compaction.
+To get that extra performance back the new default mode is to update in-memory allocator state only.
+Instead, on shutdown state is saved to BlueFS file named ``ALLOCATOR_NCB_DIR/ALLOCATOR_NCB_FILE``.
+
+Crash recovery
+--------------
+
+If BlueStore was not shutdown orderly there is no file to read allocator state from.
+Since it is the objects that define what is in use, the recovery procedure iterates over all objects and extracts used allocations.
+
+Multi-thread recovery
+=====================
+
+Iterating over all onodes in the RocksDB can take several minutes.
+To help with that a multi-threaded recovery procedure is created.
+It is significantly different procedure than the original one.
+There is just one configurable that selects and controls recovery.
+
+.. confval:: bluestore_allocation_recovery_threads
+
+
+Performance
+-----------
+
+Example recovery timings.
+OSD with NVME SSD, hosting 7.5M RBD objects, 4.6TiB used.
+
++------------------------+------------+------------+
+| recovery mechanism     | threads    | time(s)    |
++========================+============+============+
+| original               | 1          | 76.0       |
++------------------------+------------+------------+
+| multithread            | 1          | 55.8       |
++------------------------+------------+------------+
+| multithread            | 4          | 18.1       |
++------------------------+------------+------------+
+| multithread            | 8          | 10.8       |
++------------------------+------------+------------+
+| multithread            | 12         | 8.0        |
++------------------------+------------+------------+
+| multithread            | 16         | 6.8        |
++------------------------+------------+------------+
+| multithread            | 32         | 5.3        |
++------------------------+------------+------------+
+
+Testing
+-------
+
+If long recovery time has been a deciding factor for staying with allocations in RocksDB,
+there is a procedure for measuring directly recovery time.
+
+.. prompt:: bash #
+
+  ceph-bluestore-tool --path <osd-data-path> recovery-compare
+
+.. code-block::
+
+  recovery-compare bluestore compare new and legacy onode recovery
+  Legacy recovery start
+  Legacy recovery result=0 took 76.033992 seconds
+  Legacy recovery stats=
+  ==========================================================
+  onode_count             =    7500217
+  shard_count             =    9754950
+  shared_blob_count       =          0
+  compressed_blob_count   =          0
+  spanning_blob_count     =     264519
+  skipped_illegal_extent  =  100815206
+  extent_count            =  188685236
+  insert_count            =          0
+  store store_statfs(0x0/0x0/0x0, data 0x0/0x0, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 1 store_statfs(0x0/0x0/0x0, data 0x90220/0x94000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 2 store_statfs(0x0/0x0/0x0, data 0x4348a70e000/0x4c7ee684000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 18446744073709551615 store_statfs(0x0/0x0/0x0, data 0x26a3f/0x150000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  ==========================================================
+
+  bluestore_allocation_recovery_threads = 0
+  No multithread recovery to compare.
+  recovery-compare success
+
+.. prompt:: bash #
+
+  ceph-bluestore-tool --path <osd-data-path> --bluestore_allocation_recovery_threads=12 recovery-compare
+
+.. code-block::
+
+  recovery-compare bluestore compare new and legacy onode recovery
+  New recovery start
+  New recovery result=0 took 8.033309 seconds
+  New recovery stats=
+  ==========================================================
+  onode_count             =    7500217
+  shard_count             =    9754950
+  shared_blob_count       =          0
+  compressed_blob_count   =          0
+  spanning_blob_count     =     264519
+  skipped_illegal_extent  =          0
+  extent_count            =  188685236
+  insert_count            =          0
+  store store_statfs(0x0/0x0/0x0, data 0x0/0x0, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 1 store_statfs(0x0/0x0/0x0, data 0x90220/0x94000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 2 store_statfs(0x0/0x0/0x0, data 0x4348a70e000/0x4c7ee684000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 18446744073709551615 store_statfs(0x0/0x0/0x0, data 0x26a3f/0x150000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  ==========================================================
+
+  Legacy recovery start
+  Legacy recovery result=0 took 62.210723 seconds
+  Legacy recovery stats=
+  ==========================================================
+  onode_count             =    7500217
+  shard_count             =    9754950
+  shared_blob_count       =          0
+  compressed_blob_count   =          0
+  spanning_blob_count     =     264519
+  skipped_illegal_extent  =  100815206
+  extent_count            =  188685236
+  insert_count            =          0
+  store store_statfs(0x0/0x0/0x0, data 0x0/0x0, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 1 store_statfs(0x0/0x0/0x0, data 0x90220/0x94000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 2 store_statfs(0x0/0x0/0x0, data 0x4348a70e000/0x4c7ee684000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  pool 18446744073709551615 store_statfs(0x0/0x0/0x0, data 0x26a3f/0x150000, compress 0x0/0x0/0x0, omap 0x0, meta 0x0)
+  ==========================================================
+
+  FSstats the same.
+  Allocators the same.
+  recovery-compare success
+
+One can see above discrepancy between legacy recovery times: 76.0s vs 62.2s.
+This is an effect of RocksDB having the data already cached by new recovery when legacy recovery is the second one.
+
diff --git a/doc/rados/configuration/index.rst b/doc/rados/configuration/index.rst
index 01b83f95472..0367b449416 100644
--- a/doc/rados/configuration/index.rst
+++ b/doc/rados/configuration/index.rst
@@ -22,6 +22,7 @@ For general object store configuration, refer to the following:
    Storage devices <storage-devices>
    BlueStore RocksDB cache <../bluestore/rocksdb-config>
    BlueFS Spillover Cleaner <../bluestore/bluefs-spillover-cleaner>
+   Fast Crash Recovery for file-stored allocations <../bluestore/fast-onode-scan>
    ceph-conf
 
 

From ad02618007a60dcf92eb93c50b5c14cc6cf72c44 Mon Sep 17 00:00:00 2001
From: Adam Kupczyk <akupczyk@ibm.com>
Date: Wed, 10 Jun 2026 08:50:21 +0200
Subject: [PATCH 210/596] doc/man/8/ceph-bluestore-tool: Add doc for
 recovery-compare command

Signed-off-by: Adam Kupczyk <akupczyk@ibm.com>
---
 doc/man/8/ceph-bluestore-tool.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/man/8/ceph-bluestore-tool.rst b/doc/man/8/ceph-bluestore-tool.rst
index a958b298d49..276b4747e3a 100644
--- a/doc/man/8/ceph-bluestore-tool.rst
+++ b/doc/man/8/ceph-bluestore-tool.rst
@@ -20,6 +20,7 @@ Synopsis
 | **ceph-bluestore-tool** qfsck       --path *osd path*
 | **ceph-bluestore-tool** allocmap    --path *osd path*
 | **ceph-bluestore-tool** restore_cfb --path *osd path*
+| **ceph-bluestore-tool** recovery-compare --path *osd path*
 | **ceph-bluestore-tool** show-label --dev *device* ...
 | **ceph-bluestore-tool** show-label-at --dev *device* --offset *lba* ...
 | **ceph-bluestore-tool** prime-osd-dir --dev *device* --path *osd path*
@@ -72,6 +73,9 @@ Commands
 
    Reverses changes done by the new NCB code (either through ceph restart or when running allocmap command) and restores RocksDB B Column-Family (allocator-map).
 
+:command:`recovery-compare`
+
+   Runs legacy onode recovery and multithread onode recovery. Prints timings and compares results.
 
 :command:`bluefs-export`
 

From 23d7ec54d0b687b5c3e5cf3747fb0188393aa91b Mon Sep 17 00:00:00 2001
From: Adam Kupczyk <akupczyk@ibm.com>
Date: Fri, 12 Jun 2026 19:10:23 +0200
Subject: [PATCH 211/596] doc/rados/bluestore: Fix flags for
 bluestore_allocation_from_file

Set bluestore_allocation_from_file flags to 'startup'.
Without it, documentation claims the flag to be 'runtime updateable'.

Signed-off-by: Adam Kupczyk <akupczyk@ibm.com>
---
 src/common/options/global.yaml.in | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/common/options/global.yaml.in b/src/common/options/global.yaml.in
index 26391bfd64e..093e2907690 100644
--- a/src/common/options/global.yaml.in
+++ b/src/common/options/global.yaml.in
@@ -5460,6 +5460,8 @@ options:
   desc: Remove allocation info from RocksDB and store the info in a new allocation file
   default: true
   with_legacy: true
+  flags:
+    - startup
 - name: bluestore_allocation_recovery_threads
   type: uint
   level: basic

From 1b6cbbbe23c81de20e4828b50fd94da48ab64781 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 16 Feb 2026 16:29:31 +0530
Subject: [PATCH 212/596] tools/cephfs_mirror: Add inprogress bytes and files
 metric

Add following mirroring progress metrics to current_syncing_snap
as below

bytes:
  sync_bytes - bytes synced till now
  total_bytes - total bytes to be synced
  sync_percent - Percentage of bytes synced till now
files:
  total_files - Total files to be synced
  sync_files - files synced till now
  sync_percent - Percentage of files synced till now

sync_files and sync_bytes are also stored in last_synced_snap section
after the snapshot is synced.

The bytes is formatted as below.

Sample output:
--------
{
    "/d0": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 3,
            "name": "d0_snap1",
            "bytes": {
                "sync_bytes": "120.20 MiB",
                "total_bytes": "149.94 MiB",
                "sync_percent": "80.16%"
            },
            "files": {
                "sync_files": 4032,
                "total_files": 5000,
                "sync_percent": "80.64%"
            }
        },
        "last_synced_snap": {
            "id": 2,
            "name": "d0_snap0",
            "sync_duration": 45,
            "sync_time_stamp": "5642.805770s",
            "sync_bytes": "300.85 MiB",
            "sync_files": 10000
        },
        "snaps_synced": 1,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 55 ++++++++++++++++++++++++-
 src/tools/cephfs_mirror/PeerReplayer.h  | 30 +++++++++++++-
 2 files changed, 81 insertions(+), 4 deletions(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index d584b419790..ebadde544f8 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -910,6 +910,7 @@ int PeerReplayer::remote_file_op(std::shared_ptr<SyncMechanism>& syncm, const st
     }
   }
 
+  inc_sync_files(dir_root);
   return 0;
 }
 
@@ -1330,6 +1331,7 @@ PeerReplayer::SyncMechanism::~SyncMechanism() {
 void PeerReplayer::SyncMechanism::push_dataq_entry(SyncEntry e) {
   dout(10) << ": snapshot data replayer dataq pushed" << " syncm=" << this
 	   << " epath=" << e.epath << dendl;
+  m_peer_replayer.inc_total_bytes_files(std::string(m_dir_root), e.stx.stx_size);
   std::unique_lock lock(sdq_lock);
   m_sync_dataq.push(std::move(e));
   sdq_cv.notify_all();
@@ -2522,6 +2524,32 @@ void PeerReplayer::run_datasync(SnapshotDataSyncThread *data_replayer) {
   } // outer while
 }
 
+std::string PeerReplayer::format_bytes(double bytes) {
+  static constexpr double KiB = 1024.0;
+  static constexpr double MiB = KiB * 1024.0;
+  static constexpr double GiB = MiB * 1024.0;
+  static constexpr double TiB = GiB * 1024.0;
+  static constexpr double PiB = TiB * 1024.0;
+
+  std::ostringstream out;
+  out << std::fixed << std::setprecision(2);
+
+  if (bytes >= PiB) {
+    out << (bytes / PiB) << " PiB";
+  } else if (bytes >= TiB) {
+    out << (bytes / TiB) << " TiB";
+  } else if (bytes >= GiB) {
+    out << (bytes / GiB) << " GiB";
+  } else if (bytes >= MiB) {
+    out << (bytes / MiB) << " MiB";
+  } else if (bytes >= KiB) {
+    out << (bytes / KiB) << " KiB";
+  } else {
+    out << bytes << " B";
+  }
+  return out.str();
+};
+
 void PeerReplayer::peer_status(Formatter *f) {
   std::scoped_lock locker(m_lock);
   f->open_object_section("stats");
@@ -2539,7 +2567,27 @@ void PeerReplayer::peer_status(Formatter *f) {
       f->open_object_section("current_syncing_snap");
       f->dump_unsigned("id", (*sync_stat.current_syncing_snap).first);
       f->dump_string("name", (*sync_stat.current_syncing_snap).second);
-      f->close_section();
+      f->open_object_section("bytes");
+      f->dump_string("sync_bytes", format_bytes(sync_stat.sync_bytes));
+      f->dump_string("total_bytes", format_bytes(sync_stat.total_bytes));
+      if (sync_stat.total_bytes > 0) {
+        double sync_pct = (static_cast<double>(sync_stat.sync_bytes) * 100.0) / sync_stat.total_bytes;
+        std::ostringstream os;
+        os << std::fixed << std::setprecision(2) << sync_pct << "%";
+        f->dump_string("sync_percent", os.str());
+      }
+      f->close_section(); //bytes
+      f->open_object_section("files");
+      f->dump_unsigned("sync_files", sync_stat.sync_files);
+      f->dump_unsigned("total_files", sync_stat.total_files);
+      if (sync_stat.total_files > 0) {
+        double sync_file_pct = (static_cast<double>(sync_stat.sync_files) * 100.0) / sync_stat.total_files;
+        std::ostringstream os;
+        os << std::fixed << std::setprecision(2) << sync_file_pct << "%";
+        f->dump_string("sync_percent", os.str());
+      }
+      f->close_section(); //files
+      f->close_section(); //current_syncing_snap
     }
     if (sync_stat.last_synced_snap) {
       f->open_object_section("last_synced_snap");
@@ -2550,7 +2598,10 @@ void PeerReplayer::peer_status(Formatter *f) {
         f->dump_stream("sync_time_stamp") << sync_stat.last_synced;
       }
       if (sync_stat.last_sync_bytes) {
-	f->dump_unsigned("sync_bytes", *sync_stat.last_sync_bytes);
+	    f->dump_string("sync_bytes", format_bytes(*sync_stat.last_sync_bytes));
+      }
+      if (sync_stat.last_sync_files) {
+	    f->dump_unsigned("sync_files", *sync_stat.last_sync_files);
       }
       f->close_section();
     }
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 3609c992601..bb5e467da53 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -385,7 +385,11 @@ private:
     monotime last_synced = clock::zero();
     boost::optional<double> last_sync_duration;
     boost::optional<uint64_t> last_sync_bytes; //last sync bytes for display in status
+    boost::optional<uint64_t> last_sync_files; //last num of sync files for display in status
     uint64_t sync_bytes = 0; //sync bytes counter, independently for each directory sync.
+    uint64_t total_bytes = 0; //total bytes counter, independently for each directory sync.
+    uint64_t sync_files = 0; //sync files counter, independently for each directory sync.
+    uint64_t total_files = 0; //total files counter, independently for each directory sync.
   };
 
   void _inc_failed_count(const std::string &dir_root) {
@@ -415,6 +419,13 @@ private:
     sync_stat.last_failed_reason = boost::none;
   }
 
+  void _reset_sync_stat(const std::string &dir_root) {
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.sync_bytes = 0;
+    sync_stat.total_bytes = 0;
+    sync_stat.sync_files = 0;
+    sync_stat.total_files = 0;
+  }
   void _set_last_synced_snap(const std::string &dir_root, uint64_t snap_id,
                             const std::string &snap_name) {
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
@@ -425,14 +436,13 @@ private:
                             const std::string &snap_name) {
     std::scoped_lock locker(m_lock);
     _set_last_synced_snap(dir_root, snap_id, snap_name);
-    auto &sync_stat = m_snap_sync_stats.at(dir_root);
-    sync_stat.sync_bytes = 0;
   }
   void set_current_syncing_snap(const std::string &dir_root, uint64_t snap_id,
                                 const std::string &snap_name) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     sync_stat.current_syncing_snap = std::make_pair(snap_id, snap_name);
+    _reset_sync_stat(dir_root); //reset counters at the start of every snap sync
   }
   void clear_current_syncing_snap(const std::string &dir_root) {
     std::scoped_lock locker(m_lock);
@@ -457,13 +467,26 @@ private:
     sync_stat.last_synced = clock::now();
     sync_stat.last_sync_duration = duration;
     sync_stat.last_sync_bytes = sync_stat.sync_bytes;
+    sync_stat.last_sync_files = sync_stat.sync_files;
     ++sync_stat.synced_snap_count;
+    _reset_sync_stat(dir_root);
   }
   void inc_sync_bytes(const std::string &dir_root, const uint64_t& b) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     sync_stat.sync_bytes += b;
   }
+  void inc_sync_files(const std::string &dir_root) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.sync_files++;
+  }
+  void inc_total_bytes_files(const std::string &dir_root, const uint64_t& b) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.total_bytes += b;
+    sync_stat.total_files++;
+  }
   bool should_backoff(const std::string &dir_root, int *retval) {
     if (m_fs_mirror->is_blocklisted()) {
       *retval = -EBLOCKLISTED;
@@ -608,6 +631,9 @@ private:
   uint64_t set_datasync_files_per_batch(uint64_t value) {
     return datasync_files_per_batch.exchange(value, std::memory_order_relaxed);
   }
+
+  // format routines for peer_status
+  static std::string format_bytes(double bytes);
 };
 
 } // namespace mirror

From d593ad8aefe34dbaffcde22efc294500ca6f7f43 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sat, 28 Mar 2026 15:42:43 +0530
Subject: [PATCH 213/596] tools/cephfs_mirror: Add crawl-state and sync-mode
 metric

The 'crawl' and 'sync-mode' metric is added.

sync-mode: full/delta,
"crawl": {
           "state": "completed",
           "duration": "37s"
       }

sync-mode:
---------
The 'sync-mode: full/delta' is added to peer status.
The 'delta' means, blockdiff along with snapdiff is
being used to sync the files where as 'full' means
full directory is crawled and each file is synced
entirely.

crawl:
-----
The state can be in-progress/completed. This
identifies whether the crawler thread is done
queuing the files for data sync threads.

The time taken for the duration is also shown.
If the crawl is in-progress, the duration
would show the time taken till then from the
start of the crawl. If the crawl state is
completed, then duration indicates total
time taken for the crawl.

The crawl duration is shown in "d h m s" format.
The existing 'sync_duration' in last_synced_snap
is also formatted

The values are as below. When crawl state is
completed, the 'total_files' metric doesn't
grow anymore.

crawl_duration:
--------------
The crawl_duration of last snapshot is saved in last_synced_snap
section as well.

Sample outputs:
---------------
{
    "/d0": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 2,
            "name": "d0_snap0",
            "sync-mode": "full",
            "crawl": {
                "state": "in-progress",
                "duration": "21s"
            },
            "bytes": {
                "sync_bytes": "149.25 MiB",
                "total_bytes": "176.47 MiB",
                "sync_percent": "84.57%"
            },
            "files": {
                "sync_files": 4931,
                "total_files": 5845,
                "sync_percent": "84.36%"
            }
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}
------------------------------------------
{
    "/d0": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 2,
            "name": "d0_snap0",
            "sync-mode": "full",
            "crawl": {
                "state": "completed",
                "duration": "37s"
            },
            "bytes": {
                "sync_bytes": "891.39 MiB",
                "total_bytes": "901.52 MiB",
                "sync_percent": "98.88%"
            },
            "files": {
                "sync_files": 29656,
                "total_files": 30000,
                "sync_percent": "98.85%"
            }
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}
---------
  {
        "/d0": {
            "state": "syncing",
            "current_syncing_snap": {
                "id": 3,
                "name": "d0_snap1",
                "sync-mode": "delta",
                "crawl": {
                    "state": "completed",
                    "duration": "15s"
                },
                "bytes": {
                    "sync_bytes": "120.20 MiB",
                    "total_bytes": "149.94 MiB",
                    "sync_percent": "80.16%"
                },
                "files": {
                    "sync_files": 4032,
                    "total_files": 5000,
                    "sync_percent": "80.64%"
                }
            },
            "last_synced_snap": {
                "id": 2,
                "name": "d0_snap0",
                "crawl_duration": "17s",
                "sync_duration": 45,
                "sync_time_stamp": "5642.805770s",
                "sync_bytes": "300.85 MiB",
                "sync_files": 10000
            },
            "snaps_synced": 1,
            "snaps_deleted": 0,
            "snaps_renamed": 0
        }
    }
-------------
{
    "/d0": {
        "state": "idle",
        "last_synced_snap": {
            "id": 2,
            "name": "d0_snap0",
            "crawl_duration": "17s",
            "sync_duration": "2m 38s",
            "sync_time_stamp": "9259.225009s",
            "sync_bytes": "901.52 MiB",
            "sync_files": 30000
        },
        "snaps_synced": 1,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 89 +++++++++++++++++++++----
 src/tools/cephfs_mirror/PeerReplayer.h  | 35 ++++++++--
 2 files changed, 108 insertions(+), 16 deletions(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index ebadde544f8..57a6cd7b75d 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -30,6 +30,7 @@
                            << m_peer.uuid << ") " << __func__
 
 using namespace std;
+using sec_duration = std::chrono::duration<double>;
 
 // Performance Counters
 enum {
@@ -1421,12 +1422,16 @@ bool PeerReplayer::SyncMechanism::has_pending_work() const {
   return true;
 }
 
-void PeerReplayer::SyncMechanism::mark_crawl_finished(int ret) {
-  std::unique_lock lock(sdq_lock);
-  m_crawl_finished = true;
-  if (ret < 0)
-    m_crawl_error = true;
-  sdq_cv.notify_all();
+void PeerReplayer::SyncMechanism::mark_crawl_finished(int ret, double crawl_duration_secs) {
+  {
+    std::unique_lock lock(sdq_lock);
+    m_crawl_finished = true;
+    if (ret < 0)
+      m_crawl_error = true;
+    sdq_cv.notify_all();
+  }
+  // for crawl-state metrics
+  m_peer_replayer.set_crawl_finished(m_dir_root, true, crawl_duration_secs);
 }
 
 // Returns false if there is any error during data sync
@@ -1752,7 +1757,7 @@ int PeerReplayer::SnapDiffSync::get_changed_blocks(const std::string &epath,
   return r;
 }
 
-void PeerReplayer::SnapDiffSync::finish_crawl(int ret) {
+void PeerReplayer::SnapDiffSync::finish_crawl(int ret, double crawl_duration_secs) {
   dout(20) << dendl;
 
   while (!m_sync_stack.empty()) {
@@ -1768,7 +1773,7 @@ void PeerReplayer::SnapDiffSync::finish_crawl(int ret) {
   }
 
   // Crawl and entry operations are done syncing here. So mark crawl finished here
-  mark_crawl_finished(ret);
+  mark_crawl_finished(ret, crawl_duration_secs);
 }
 
 PeerReplayer::RemoteSync::RemoteSync(PeerReplayer& peer_replayer, std::string_view dir_root,
@@ -1905,7 +1910,7 @@ int PeerReplayer::RemoteSync::get_entry(std::string *epath, struct ceph_statx *s
   return 0;
 }
 
-void PeerReplayer::RemoteSync::finish_crawl(int ret) {
+void PeerReplayer::RemoteSync::finish_crawl(int ret, double crawl_duration_secs) {
   dout(20) << dendl;
 
   while (!m_sync_stack.empty()) {
@@ -1921,7 +1926,7 @@ void PeerReplayer::RemoteSync::finish_crawl(int ret) {
   }
 
   // Crawl and entry operations are done syncing here. So mark stack finished here
-  mark_crawl_finished(ret);
+  mark_crawl_finished(ret, crawl_duration_secs);
 }
 
 int PeerReplayer::do_synchronize(const std::string &dir_root, const Snapshot &current,
@@ -1951,9 +1956,11 @@ int PeerReplayer::do_synchronize(const std::string &dir_root, const Snapshot &cu
   if (fh.p_mnt == m_local_mount) {
     syncm = std::make_shared<SnapDiffSync>(*this, dir_root, m_local_mount, m_remote_mount,
                                            &fh, m_peer, current, prev);
+    set_snapdiff(dir_root, true); //for stats
   } else {
     syncm = std::make_shared<RemoteSync>(*this, dir_root, m_local_mount, m_remote_mount,
                                          &fh, m_peer, current, boost::none);
+    set_snapdiff(dir_root, false); //for stats
   }
 
   r = syncm->init_sync();
@@ -1968,6 +1975,9 @@ int PeerReplayer::do_synchronize(const std::string &dir_root, const Snapshot &cu
 
   // starting from this point we shouldn't care about manual closing of fh.c_fd,
   // it will be closed automatically when bound tdirp is closed.
+  sec_duration crawl_duration_time{0};
+  auto crawl_start_time = clock::now();
+  set_crawl_start_time(dir_root);
   while (true) {
     if (should_backoff(dir_root, &r)) {
       dout(0) << ": backing off r=" << r << dendl;
@@ -1996,7 +2006,9 @@ int PeerReplayer::do_synchronize(const std::string &dir_root, const Snapshot &cu
     }
   }
 
-  syncm->finish_crawl(r);
+  auto crawl_end_time = clock::now();
+  crawl_duration_time = sec_duration(crawl_end_time - crawl_start_time);
+  syncm->finish_crawl(r, crawl_duration_time.count());
 
   dout(20) << " cur:" << fh.c_fd
            << " prev:" << fh.p_fd
@@ -2524,6 +2536,40 @@ void PeerReplayer::run_datasync(SnapshotDataSyncThread *data_replayer) {
   } // outer while
 }
 
+std::string PeerReplayer::format_time(double total_seconds_d) {
+    // Round to nearest second
+    uint64_t total_seconds = static_cast<uint64_t>(std::llround(total_seconds_d));
+
+    uint64_t days = total_seconds / 86400;
+    total_seconds %= 86400;
+
+    uint64_t hours = total_seconds / 3600;
+    total_seconds %= 3600;
+
+    uint64_t minutes = total_seconds / 60;
+    uint64_t seconds = total_seconds % 60;
+
+    std::ostringstream oss;
+
+    if (days > 0) {
+        oss << days << "d "
+            << std::setw(2) << std::setfill('0') << hours   << "h "
+            << std::setw(2) << std::setfill('0') << minutes << "m "
+            << std::setw(2) << std::setfill('0') << seconds << "s";
+    } else if (hours > 0) {
+        oss << hours << "h "
+            << std::setw(2) << std::setfill('0') << minutes << "m "
+            << std::setw(2) << std::setfill('0') << seconds << "s";
+    } else if (minutes > 0) {
+        oss << minutes << "m "
+            << std::setw(2) << std::setfill('0') << seconds << "s";
+    } else {
+        oss << seconds << "s";
+    }
+
+    return oss.str();
+}
+
 std::string PeerReplayer::format_bytes(double bytes) {
   static constexpr double KiB = 1024.0;
   static constexpr double MiB = KiB * 1024.0;
@@ -2567,6 +2613,22 @@ void PeerReplayer::peer_status(Formatter *f) {
       f->open_object_section("current_syncing_snap");
       f->dump_unsigned("id", (*sync_stat.current_syncing_snap).first);
       f->dump_string("name", (*sync_stat.current_syncing_snap).second);
+      if (sync_stat.snapdiff)
+        f->dump_string("sync-mode", "delta");
+      else
+        f->dump_string("sync-mode", "full");
+      f->open_object_section("crawl");
+      if (sync_stat.crawl_finished) {
+        f->dump_string("state", "completed");
+        f->dump_string("duration", format_time(sync_stat.crawl_duration));
+      } else {
+        f->dump_string("state", "in-progress");
+        auto cur_time = clock::now();
+        sec_duration crawl_duration_till_now{0};
+        crawl_duration_till_now = sec_duration(cur_time - sync_stat.crawl_start_time);
+        f->dump_string("duration", format_time(crawl_duration_till_now.count()));
+      }
+      f->close_section(); //crawl
       f->open_object_section("bytes");
       f->dump_string("sync_bytes", format_bytes(sync_stat.sync_bytes));
       f->dump_string("total_bytes", format_bytes(sync_stat.total_bytes));
@@ -2593,8 +2655,11 @@ void PeerReplayer::peer_status(Formatter *f) {
       f->open_object_section("last_synced_snap");
       f->dump_unsigned("id", (*sync_stat.last_synced_snap).first);
       f->dump_string("name", (*sync_stat.last_synced_snap).second);
+      if (sync_stat.last_sync_crawl_duration) {
+        f->dump_string("crawl_duration", format_time(*sync_stat.last_sync_crawl_duration));
+      }
       if (sync_stat.last_sync_duration) {
-        f->dump_float("sync_duration", *sync_stat.last_sync_duration);
+        f->dump_string("sync_duration", format_time(*sync_stat.last_sync_duration));
         f->dump_stream("sync_time_stamp") << sync_stat.last_synced;
       }
       if (sync_stat.last_sync_bytes) {
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index bb5e467da53..34786c08f33 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -221,12 +221,12 @@ private:
                                    const struct ceph_statx &stx, bool sync_check,
                                    const std::function<int (uint64_t, struct cblock *)> &callback);
 
-    virtual void finish_crawl(int ret) = 0;
+    virtual void finish_crawl(int ret, double crawl_duration_secs) = 0;
 
     void push_dataq_entry(PeerReplayer::SyncEntry e);
     bool pop_dataq_entry(PeerReplayer::SyncEntry &out);
     bool has_pending_work() const;
-    void mark_crawl_finished(int ret);
+    void mark_crawl_finished(int ret, double crawl_duration_secs);
     bool is_dataq_empty_unlocked() const {
       return m_sync_dataq.empty();
     }
@@ -335,7 +335,7 @@ private:
                   const std::function<int (const std::string&)> &dirsync_func,
                   const std::function<int (const std::string&)> &purge_func);
 
-    void finish_crawl(int ret);
+    void finish_crawl(int ret, double crawl_duration_secs);
   };
 
   class SnapDiffSync : public SyncMechanism {
@@ -355,7 +355,7 @@ private:
                            const struct ceph_statx &stx, bool sync_check,
                            const std::function<int (uint64_t, struct cblock *)> &callback);
 
-    void finish_crawl(int ret);
+    void finish_crawl(int ret, double crawl_duration_secs);
 
   private:
     int init_directory(const std::string &epath,
@@ -384,12 +384,17 @@ private:
     uint64_t renamed_snap_count = 0;
     monotime last_synced = clock::zero();
     boost::optional<double> last_sync_duration;
+    boost::optional<double> last_sync_crawl_duration;
     boost::optional<uint64_t> last_sync_bytes; //last sync bytes for display in status
     boost::optional<uint64_t> last_sync_files; //last num of sync files for display in status
     uint64_t sync_bytes = 0; //sync bytes counter, independently for each directory sync.
     uint64_t total_bytes = 0; //total bytes counter, independently for each directory sync.
     uint64_t sync_files = 0; //sync files counter, independently for each directory sync.
     uint64_t total_files = 0; //total files counter, independently for each directory sync.
+    bool snapdiff = false; // RemoteSync/Snapdiff aka full/delta
+    bool crawl_finished = false; // crawl_state - in-progress/completed
+    clock::time_point crawl_start_time; // to show current crawl duration if crawl is in progress
+    double crawl_duration = 0.0; // time taken to complete the crawl, includes a few entry operation like mkdir as well
   };
 
   void _inc_failed_count(const std::string &dir_root) {
@@ -425,6 +430,10 @@ private:
     sync_stat.total_bytes = 0;
     sync_stat.sync_files = 0;
     sync_stat.total_files = 0;
+    sync_stat.snapdiff = false;
+    sync_stat.crawl_finished = false;
+    sync_stat.crawl_start_time = clock::now();
+    sync_stat.crawl_duration = 0.0;
   }
   void _set_last_synced_snap(const std::string &dir_root, uint64_t snap_id,
                             const std::string &snap_name) {
@@ -466,11 +475,23 @@ private:
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     sync_stat.last_synced = clock::now();
     sync_stat.last_sync_duration = duration;
+    sync_stat.last_sync_crawl_duration = sync_stat.crawl_duration;
     sync_stat.last_sync_bytes = sync_stat.sync_bytes;
     sync_stat.last_sync_files = sync_stat.sync_files;
     ++sync_stat.synced_snap_count;
     _reset_sync_stat(dir_root);
   }
+  void set_snapdiff(const std::string &dir_root, bool snapdiff) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.snapdiff = snapdiff;
+  }
+  void set_crawl_finished(const std::string &dir_root, bool state, double seconds) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.crawl_finished = state;
+    sync_stat.crawl_duration = seconds;
+  }
   void inc_sync_bytes(const std::string &dir_root, const uint64_t& b) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
@@ -481,6 +502,11 @@ private:
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     sync_stat.sync_files++;
   }
+  void set_crawl_start_time(const std::string &dir_root) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.crawl_start_time = clock::now();
+  }
   void inc_total_bytes_files(const std::string &dir_root, const uint64_t& b) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
@@ -634,6 +660,7 @@ private:
 
   // format routines for peer_status
   static std::string format_bytes(double bytes);
+  static std::string format_time(double total_seconds);
 };
 
 } // namespace mirror

From 4294819d9535145ea5e4cf7082fcbae7de95987c Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sat, 28 Mar 2026 16:27:02 +0530
Subject: [PATCH 214/596] tools/cephfs_mirror: Add read/write throughput

The read throughput added measures the bytes
read per second from the source ceph filesystem.
Similarly, the write throughput added measures
the bytes written per second to the remote ceph
filesystem. It's derived from the time spent
in preadv and pwritev calls.

Sample output:
-------------
{
    "/d0": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 2,
            "name": "d0_snap0",
            "sync-mode": "full",
            "avg_read_throughput_bytes": "12.69 MiB/s",
            "avg_write_throughput_bytes": "54.49 MiB/s",
            "crawl": {
                "state": "completed",
                "duration": "1s"
            },
            "bytes": {
                "sync_bytes": "149.94 MiB",
                "total_bytes": "149.94 MiB",
                "sync_percent": "100.00%"
            },
            "files": {
                "sync_files": 5000,
                "total_files": 5000,
                "sync_percent": "100.00%"
            }
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}
-------------

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 24 ++++++++++++++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.h  | 18 ++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 57a6cd7b75d..fecc82ea087 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -703,6 +703,10 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
   void *ptr;
   struct iovec iov[NR_IOVECS];
 
+  uint64_t bytes_read = 0;
+  uint64_t bytes_written = 0;
+  sec_duration read_time{0};
+  sec_duration write_time{0};
   int r = ceph_openat(m_local_mount, fh.c_fd, epath.c_str(), O_RDONLY | O_NOFOLLOW, 0);
   if (r < 0) {
     derr << ": failed to open local file path=" << epath << ": "
@@ -765,12 +769,16 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
         }
       }
 
+      auto rs = clock::now();
       r = ceph_preadv(m_local_mount, l_fd, iov, num_buffers, offset);
+      auto re = clock::now();
+      read_time += sec_duration(re - rs);
       if (r < 0) {
         derr << ": failed to read local file path=" << epath << ": "
              << cpp_strerror(r) << dendl;
         break;
       }
+      bytes_read += r;
       dout(10) << ": read: " << r << " bytes" << dendl;
       if (r == 0) {
         break;
@@ -784,12 +792,16 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
       }
 
       dout(10) << ": writing to offset: " << offset << dendl;
+      auto ws = clock::now();
       r = ceph_pwritev(m_remote_mount, r_fd, iov, iovs, offset);
+      auto we = clock::now();
+      write_time += sec_duration(we - ws);
       if (r < 0) {
         derr << ": failed to write remote file path=" << epath << ": "
              << cpp_strerror(r) << dendl;
         break;
       }
+      bytes_written += r;
 
       offset += r;
     }
@@ -798,6 +810,9 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
     ++b;
   }
 
+  //io accounting for metrics
+  add_io(dir_root, bytes_read, bytes_written, read_time.count(), write_time.count());
+
   if (num_blocks == 0 && r >= 0) { // handle blocklist case
     dout(20) << ": truncating epath=" << epath << " to " << stx.stx_size << " bytes"
              << dendl;
@@ -2617,6 +2632,15 @@ void PeerReplayer::peer_status(Formatter *f) {
         f->dump_string("sync-mode", "delta");
       else
         f->dump_string("sync-mode", "full");
+
+      //avg read/write throughput
+      double read_bps = sync_stat.read_time_sec > 0 ?
+          sync_stat.bytes_read / sync_stat.read_time_sec : 0;
+      double write_bps = sync_stat.write_time_sec > 0 ?
+          sync_stat.bytes_written / sync_stat.write_time_sec : 0;
+      f->dump_string("avg_read_throughput_bytes", format_bytes(read_bps) + "/s");
+      f->dump_string("avg_write_throughput_bytes", format_bytes(write_bps) + "/s");
+
       f->open_object_section("crawl");
       if (sync_stat.crawl_finished) {
         f->dump_string("state", "completed");
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 34786c08f33..c20da7962e0 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -395,6 +395,11 @@ private:
     bool crawl_finished = false; // crawl_state - in-progress/completed
     clock::time_point crawl_start_time; // to show current crawl duration if crawl is in progress
     double crawl_duration = 0.0; // time taken to complete the crawl, includes a few entry operation like mkdir as well
+    // actual io accounting
+    uint64_t bytes_read = 0; //actual bytes read counter, independently for each directory sync.
+    uint64_t bytes_written = 0; //actual bytes written counter, independently for each directory sync.
+    double read_time_sec = 0.0; //actual read time in seconds counter, independently for each directroy sync.
+    double write_time_sec = 0.0; //actual write time in seconds counter, independently for each directroy sync.
   };
 
   void _inc_failed_count(const std::string &dir_root) {
@@ -434,6 +439,10 @@ private:
     sync_stat.crawl_finished = false;
     sync_stat.crawl_start_time = clock::now();
     sync_stat.crawl_duration = 0.0;
+    sync_stat.bytes_read = 0;
+    sync_stat.bytes_written = 0;
+    sync_stat.read_time_sec = 0.0;
+    sync_stat.write_time_sec = 0.0;
   }
   void _set_last_synced_snap(const std::string &dir_root, uint64_t snap_id,
                             const std::string &snap_name) {
@@ -492,6 +501,15 @@ private:
     sync_stat.crawl_finished = state;
     sync_stat.crawl_duration = seconds;
   }
+  void add_io(const std::string &dir_root, const uint64_t& br, const uint64_t bw,
+              const double rt, const double wt) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.bytes_read += br;
+    sync_stat.bytes_written += bw;
+    sync_stat.read_time_sec += rt;
+    sync_stat.write_time_sec += wt;
+  }
   void inc_sync_bytes(const std::string &dir_root, const uint64_t& b) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);

From 0ae1ade4bc269a368bf29b059b1f20336ef79b2e Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sat, 28 Mar 2026 16:53:33 +0530
Subject: [PATCH 215/596] tools/cephfs_mirror: Add eta metrics

Add estimate time of completion for the current
syncing snapshot. The calculation takes into
account the average read/write throughput from
the start of snapshot sync and not the current
read/write throughput. So the ETA is affected
accordingly.

Sample output:
-------------
{
    "/d0": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 2,
            "name": "d0_snap0",
            "sync-mode": "full",
            "avg_read_throughput_bytes": "3.28 MiB/s",
            "avg_write_throughput_bytes": "71.03 MiB/s",
            "crawl": {
                "state": "completed",
                "duration": "1s"
            },
            "bytes": {
                "sync_bytes": "2.31 MiB",
                "total_bytes": "149.94 MiB",
                "sync_percent": "1.54%"
            },
            "files": {
                "sync_files": 67,
                "total_files": 5000,
                "sync_percent": "1.34%"
            },
            "eta": "calculating..."
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}
------------------------------------------
{
    "/d0": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 2,
            "name": "d0_snap0",
            "sync-mode": "full",
            "avg_read_throughput_bytes": "12.17 MiB/s",
            "avg_write_throughput_bytes": "66.46 MiB/s",
            "crawl": {
                "state": "completed",
                "duration": "1s"
            },
            "bytes": {
                "sync_bytes": "26.64 MiB",
                "total_bytes": "149.94 MiB",
                "sync_percent": "17.77%"
            },
            "files": {
                "sync_files": 892,
                "total_files": 5000,
                "sync_percent": "17.84%"
            },
            "eta": "10s"
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 105 +++++++++++++++++++++++-
 src/tools/cephfs_mirror/PeerReplayer.h  |  34 ++++++++
 2 files changed, 137 insertions(+), 2 deletions(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index fecc82ea087..334567b0c9d 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -707,6 +707,9 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
   uint64_t bytes_written = 0;
   sec_duration read_time{0};
   sec_duration write_time{0};
+  uint64_t discovered_delta = 0;
+
+  inc_files_started(dir_root);
   int r = ceph_openat(m_local_mount, fh.c_fd, epath.c_str(), O_RDONLY | O_NOFOLLOW, 0);
   if (r < 0) {
     derr << ": failed to open local file path=" << epath << ": "
@@ -734,6 +737,8 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
   while (num_blocks > 0) {
     auto offset = b->offset;
     auto len = b->len;
+    discovered_delta += b->len;
+    inc_delta_bytes(dir_root, discovered_delta);
 
     dout(10) << ": dir_root=" << dir_root << ", epath=" << epath << ", block: ["
              << offset << "~" << len << "]" << dendl;
@@ -802,6 +807,7 @@ int PeerReplayer::copy_to_remote(const std::string &dir_root,  const std::string
         break;
       }
       bytes_written += r;
+      inc_actual_sync_bytes(dir_root, r);
 
       offset += r;
     }
@@ -1726,8 +1732,20 @@ int PeerReplayer::SnapDiffSync::get_changed_blocks(const std::string &epath,
   dout(20) << ": dir_root=" << m_dir_root << ", epath=" << epath
            << ", sync_check=" << sync_check << dendl;
 
+  using clock = std::chrono::steady_clock;
+  using seconds = std::chrono::duration<double>;
+  seconds blockdiff_time{0};
+  uint64_t bd_synced_bytes = 0;
+
   if (!sync_check || stx.stx_size <= m_peer_replayer.get_blockdiff_min_file_size()) {
-    return SyncMechanism::get_changed_blocks(epath, stx, sync_check, callback);
+    auto bd_s = clock::now();
+    int r = SyncMechanism::get_changed_blocks(epath, stx, sync_check, callback);
+    auto bd_e = clock::now();
+    blockdiff_time = seconds(bd_e - bd_s);
+    bd_synced_bytes = stx.stx_size;
+    if ( r == 0 )
+      m_peer_replayer.set_blockdiff_metrics(m_dir_root, bd_synced_bytes, blockdiff_time.count());
+    return r;
   }
 
   ceph_file_blockdiff_info info;
@@ -1740,10 +1758,18 @@ int PeerReplayer::SnapDiffSync::get_changed_blocks(const std::string &epath,
 
   if (r < 0) {
     dout(20) << ": new file epath=" << epath << dendl;
-    return SyncMechanism::get_changed_blocks(epath, stx, sync_check, callback);
+    auto bd_s = clock::now();
+    int r = SyncMechanism::get_changed_blocks(epath, stx, sync_check, callback);
+    auto bd_e = clock::now();
+    blockdiff_time = seconds(bd_e - bd_s);
+    bd_synced_bytes = stx.stx_size;
+    if ( r == 0 )
+      m_peer_replayer.set_blockdiff_metrics(m_dir_root, bd_synced_bytes, blockdiff_time.count());
+    return r;
   }
 
   r = 1;
+  auto bd_s = clock::now();
   while (true) {
     ceph_file_blockdiff_changedblocks blocks;
     r = ceph_file_blockdiff(&info, &blocks);
@@ -1754,12 +1780,19 @@ int PeerReplayer::SnapDiffSync::get_changed_blocks(const std::string &epath,
 
     int rr = r;
     if (blocks.num_blocks) {
+      auto bd_num_blocks = blocks.num_blocks;
+      auto bd_cblock = blocks.b;
       r = callback(blocks.num_blocks, blocks.b);
       ceph_free_file_blockdiff_buffer(&blocks);
       if (r < 0) {
         derr << ": blockdiff callback returned error: r=" << r << dendl;
         break;
       }
+      while(bd_num_blocks > 0) {
+        bd_synced_bytes += bd_cblock->len;
+	    --bd_num_blocks;
+	    bd_cblock++;
+      }
     }
 
     if (rr == 0) {
@@ -1767,6 +1800,11 @@ int PeerReplayer::SnapDiffSync::get_changed_blocks(const std::string &epath,
     }
     // else fetch next changed blocks
   }
+  // blockdiff throughput
+  auto bd_e = clock::now();
+  blockdiff_time = seconds(bd_e - bd_s);
+  if ( r == 0 )
+    m_peer_replayer.set_blockdiff_metrics(m_dir_root, bd_synced_bytes, blockdiff_time.count());
 
   ceph_file_blockdiff_finish(&info);
   return r;
@@ -2611,6 +2649,64 @@ std::string PeerReplayer::format_bytes(double bytes) {
   return out.str();
 };
 
+double PeerReplayer::compute_eta(PeerReplayer::SnapSyncStat& sync_stat) {
+  // mlock is held by the caller
+
+  static constexpr uint64_t MIN_FILES_SAMPLE = 25;
+  static constexpr uint64_t MIN_BYTES_SAMPLE = 1ULL * 16 * 1024 * 1024; // 16MiB
+
+  double read_time = sync_stat.read_time_sec;
+  double write_time = sync_stat.write_time_sec;
+  double bytes_read = sync_stat.bytes_read;
+  double bytes_written = sync_stat.bytes_written;
+  uint64_t files_started = sync_stat.files_started;
+  uint64_t files_synced = sync_stat.sync_files;
+  double read_bps = read_time > 0 ?  bytes_read / read_time : 0;
+  double write_bps = write_time > 0 ?  bytes_written / write_time : 0;
+  uint64_t discovered_delta_bytes = sync_stat.discovered_delta_bytes;
+  uint64_t synced_bytes = sync_stat.actual_sync_bytes;
+  uint64_t file_synced_bytes = sync_stat.sync_bytes;
+  uint64_t total_files = sync_stat.total_files;
+
+  if (read_time == 0 || write_time == 0)
+    return -1.0; //Calculating
+  if (files_synced < MIN_FILES_SAMPLE && file_synced_bytes < MIN_BYTES_SAMPLE)
+    return -1.0; //Calculating
+
+
+  if (sync_stat.snapdiff) {
+    /* blockdiff :
+     *   - total number of files with delta to be synced is known
+     *   - delta of each file is unknown, the avg delta per file is estimated
+     *   - effective bandwidth should accommodate blockdiff time
+     *   - effective bandwidth is based on cumulative synced bytes and time taken, so
+     *     it considers total average past performance and hence it is mostly pessimistic
+     */
+    double avg_delta_per_file = (double)discovered_delta_bytes / (double)files_started;
+    double estimated_total_delta = avg_delta_per_file * total_files;
+    double effective_bw = (double) sync_stat.blockdiff_sync_bytes / sync_stat.blockdiff_time_sec;
+
+    uint64_t remaining =
+        estimated_total_delta > synced_bytes
+        ? static_cast<uint64_t>(estimated_total_delta - synced_bytes)
+        : 0;
+
+    if (effective_bw <= 0)
+      return -1.0;
+    return remaining / effective_bw;
+  } else {
+    /* full sync :
+     *   -  effective bandwidth is mostly dependant on read and write, again
+     *      it's cumulative, so prediction is based on average past performace.
+     */
+    uint64_t remaining = sync_stat.total_bytes - synced_bytes;
+    double effective_bw = std::min(read_bps, write_bps);
+    if (effective_bw <= 0)
+      return -1.0; //Calculating
+    return remaining / effective_bw;
+  }
+}
+
 void PeerReplayer::peer_status(Formatter *f) {
   std::scoped_lock locker(m_lock);
   f->open_object_section("stats");
@@ -2673,6 +2769,11 @@ void PeerReplayer::peer_status(Formatter *f) {
         f->dump_string("sync_percent", os.str());
       }
       f->close_section(); //files
+      double eta = compute_eta(sync_stat);
+      if (eta == -1.0)
+        f->dump_string("eta", "calculating...");
+      else
+        f->dump_string("eta", format_time(compute_eta(sync_stat)));
       f->close_section(); //current_syncing_snap
     }
     if (sync_stat.last_synced_snap) {
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index c20da7962e0..9cf3df07150 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -400,6 +400,13 @@ private:
     uint64_t bytes_written = 0; //actual bytes written counter, independently for each directory sync.
     double read_time_sec = 0.0; //actual read time in seconds counter, independently for each directroy sync.
     double write_time_sec = 0.0; //actual write time in seconds counter, independently for each directroy sync.
+    // eta related
+    // files_started will be ahead of sync_files as it's incremented just after delta discovery
+    uint64_t files_started = 0; //files picked up for sync counter, independently for each directory sync.
+    uint64_t actual_sync_bytes = 0; //actual bytes synced using delta, counter, independently for each directory sync.
+    uint64_t discovered_delta_bytes = 0; //discovered delta bytes counter, independently for each directory sync.
+    uint64_t blockdiff_sync_bytes = 0; //actual bytes synced using SnapDiff/blockdiff counter
+    double blockdiff_time_sec = 0.0; //actual sync time using SnapDiff/blockdiff counter
   };
 
   void _inc_failed_count(const std::string &dir_root) {
@@ -443,6 +450,11 @@ private:
     sync_stat.bytes_written = 0;
     sync_stat.read_time_sec = 0.0;
     sync_stat.write_time_sec = 0.0;
+    sync_stat.files_started = 0;
+    sync_stat.actual_sync_bytes = 0;
+    sync_stat.discovered_delta_bytes = 0;
+    sync_stat.blockdiff_sync_bytes = 0;
+    sync_stat.blockdiff_time_sec = 0.0;
   }
   void _set_last_synced_snap(const std::string &dir_root, uint64_t snap_id,
                             const std::string &snap_name) {
@@ -501,6 +513,12 @@ private:
     sync_stat.crawl_finished = state;
     sync_stat.crawl_duration = seconds;
   }
+  void set_blockdiff_metrics(const std::string &dir_root, const uint64_t bd_syncbytes, const double bd_time) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.blockdiff_sync_bytes += bd_syncbytes;
+    sync_stat.blockdiff_time_sec += bd_time;
+  }
   void add_io(const std::string &dir_root, const uint64_t& br, const uint64_t bw,
               const double rt, const double wt) {
     std::scoped_lock locker(m_lock);
@@ -510,11 +528,26 @@ private:
     sync_stat.read_time_sec += rt;
     sync_stat.write_time_sec += wt;
   }
+  void inc_delta_bytes(const std::string &dir_root, const uint64_t& b) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.discovered_delta_bytes += b;
+  }
   void inc_sync_bytes(const std::string &dir_root, const uint64_t& b) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     sync_stat.sync_bytes += b;
   }
+  void inc_actual_sync_bytes(const std::string &dir_root, const uint64_t& b) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.actual_sync_bytes += b;
+  }
+  void inc_files_started(const std::string &dir_root) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.files_started++;
+  }
   void inc_sync_files(const std::string &dir_root) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
@@ -679,6 +712,7 @@ private:
   // format routines for peer_status
   static std::string format_bytes(double bytes);
   static std::string format_time(double total_seconds);
+  static double compute_eta(SnapSyncStat& sync_stat);
 };
 
 } // namespace mirror

From 66c05f080b222897e3d28703de008e71f9721053 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Fri, 8 May 2026 05:52:59 +0530
Subject: [PATCH 216/596] tools/cephfs_mirror: Add datasync_queue_wait_duration
 metric

Add the metric which measures the time spent by the snapshot
in the data queue waiting for the datasync threads.

Sample output:
When still 'waiting' in queue
{
    "/d1": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 18,
            "name": "d1_snap5",
            "sync-mode": "delta",
            "avg_read_throughput_bytes": "0.00 B/s",
            "avg_write_throughput_bytes": "0.00 B/s",
            "crawl": {
                "state": "in-progress",
                "duration": "13s"
            },
            "datasync_queue_wait": {
                "state": "waiting",
                "duration": "12s"
            },
            "bytes": {
                "sync_bytes": "0.00 B",
                "total_bytes": "110.99 MiB",
                "sync_percent": "0.00%"
            },
            "files": {
                "sync_files": 0,
                "total_files": 3719,
                "sync_percent": "0.00%"
            },
            "eta": "calculating..."
        },
        "last_synced_snap": {
            "id": 15,
            "name": "d1_snap4"
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    },
}
---------------
After 'complete'
{
    "/d1": {
        "state": "syncing",
        "current_syncing_snap": {
            "id": 18,
            "name": "d1_snap5",
            "sync-mode": "delta",
            "avg_read_throughput_bytes": "11.66 MiB/s",
            "avg_write_throughput_bytes": "34.55 MiB/s",
            "crawl": {
                "state": "completed",
                "duration": "17s"
            },
            "datasync_queue_wait": {
                "state": "completed",
                "duration": "19s"
            },
            "bytes": {
                "sync_bytes": "149.94 MiB",
                "total_bytes": "149.94 MiB",
                "sync_percent": "100.00%"
            },
            "files": {
                "sync_files": 5000,
                "total_files": 5000,
                "sync_percent": "100.00%"
            },
            "eta": "0s"
        },
        "last_synced_snap": {
            "id": 15,
            "name": "d1_snap4"
        },
        "snaps_synced": 0,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}
-----
Also stored in last_sync_snap section
{
    "/d1": {
        "state": "idle",
        "last_synced_snap": {
            "id": 18,
            "name": "d1_snap5",
            "crawl_duration": "17s",
            "datasync_queue_wait_duration": "19s",
            "sync_duration": "44s",
            "sync_time_stamp": "8172.009480s",
            "sync_bytes": "149.94 MiB",
            "sync_files": 5000
        },
        "snaps_synced": 1,
        "snaps_deleted": 0,
        "snaps_renamed": 0
    }
}

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 35 ++++++++++++++++++++++++-
 src/tools/cephfs_mirror/PeerReplayer.h  | 25 ++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 334567b0c9d..11d4c7f67fa 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -1353,10 +1353,17 @@ PeerReplayer::SyncMechanism::~SyncMechanism() {
 void PeerReplayer::SyncMechanism::push_dataq_entry(SyncEntry e) {
   dout(10) << ": snapshot data replayer dataq pushed" << " syncm=" << this
 	   << " epath=" << e.epath << dendl;
-  m_peer_replayer.inc_total_bytes_files(std::string(m_dir_root), e.stx.stx_size);
+  const uint64_t entry_bytes = e.stx.stx_size;
   std::unique_lock lock(sdq_lock);
+  if (!m_first_dataq_push_time) {
+    m_first_dataq_push_time = clock::now();
+    m_peer_replayer.set_datasync_queue_wait_start_time(std::string(m_dir_root),
+                                                       *m_first_dataq_push_time);
+  }
   m_sync_dataq.push(std::move(e));
   sdq_cv.notify_all();
+  lock.unlock();
+  m_peer_replayer.inc_total_bytes_files(std::string(m_dir_root), entry_bytes);
 }
 
 bool PeerReplayer::SyncMechanism::pop_dataq_entry(SyncEntry &out_entry) {
@@ -1402,6 +1409,12 @@ bool PeerReplayer::SyncMechanism::pop_dataq_entry(SyncEntry &out_entry) {
     return false; // no more work
   }
 
+  if (!m_datasync_queue_wait_reported && m_first_dataq_push_time) {
+    sec_duration dq_wait{0};
+    dq_wait = sec_duration(clock::now() - *m_first_dataq_push_time);
+    m_peer_replayer.set_datasync_queue_wait_duration(std::string(m_dir_root), dq_wait.count());
+    m_datasync_queue_wait_reported = true;
+  }
   out_entry = std::move(m_sync_dataq.front());
   m_sync_dataq.pop();
   dout(10) << ": snapshot data replayer dataq popped" << " syncm=" << this
@@ -2749,6 +2762,22 @@ void PeerReplayer::peer_status(Formatter *f) {
         f->dump_string("duration", format_time(crawl_duration_till_now.count()));
       }
       f->close_section(); //crawl
+      if (sync_stat.datasync_queue_wait_duration ||
+          sync_stat.datasync_queue_wait_start_time) {
+        f->open_object_section("datasync_queue_wait");
+        if (sync_stat.datasync_queue_wait_duration) {
+          f->dump_string("state", "completed");
+          f->dump_string("duration",
+                         format_time(*sync_stat.datasync_queue_wait_duration));
+        } else {
+          f->dump_string("state", "waiting");
+          auto cur_time = clock::now();
+          sec_duration dq_wait{0};
+          dq_wait = sec_duration(cur_time - *sync_stat.datasync_queue_wait_start_time);
+          f->dump_string("duration", format_time(dq_wait.count()));
+        }
+        f->close_section();
+      }
       f->open_object_section("bytes");
       f->dump_string("sync_bytes", format_bytes(sync_stat.sync_bytes));
       f->dump_string("total_bytes", format_bytes(sync_stat.total_bytes));
@@ -2783,6 +2812,10 @@ void PeerReplayer::peer_status(Formatter *f) {
       if (sync_stat.last_sync_crawl_duration) {
         f->dump_string("crawl_duration", format_time(*sync_stat.last_sync_crawl_duration));
       }
+      if (sync_stat.last_sync_datasync_queue_wait_duration) {
+        f->dump_string("datasync_queue_wait_duration",
+                       format_time(*sync_stat.last_sync_datasync_queue_wait_duration));
+      }
       if (sync_stat.last_sync_duration) {
         f->dump_string("sync_duration", format_time(*sync_stat.last_sync_duration));
         f->dump_stream("sync_time_stamp") << sync_stat.last_synced;
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 9cf3df07150..6bfc84a5835 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -319,6 +319,8 @@ private:
     bool m_datasync_error = false;
     int m_datasync_errno = 0;
     bool m_backoff = false;
+    boost::optional<monotime> m_first_dataq_push_time;
+    bool m_datasync_queue_wait_reported = false;
   };
 
   class RemoteSync : public SyncMechanism {
@@ -385,6 +387,7 @@ private:
     monotime last_synced = clock::zero();
     boost::optional<double> last_sync_duration;
     boost::optional<double> last_sync_crawl_duration;
+    boost::optional<double> last_sync_datasync_queue_wait_duration;
     boost::optional<uint64_t> last_sync_bytes; //last sync bytes for display in status
     boost::optional<uint64_t> last_sync_files; //last num of sync files for display in status
     uint64_t sync_bytes = 0; //sync bytes counter, independently for each directory sync.
@@ -407,6 +410,8 @@ private:
     uint64_t discovered_delta_bytes = 0; //discovered delta bytes counter, independently for each directory sync.
     uint64_t blockdiff_sync_bytes = 0; //actual bytes synced using SnapDiff/blockdiff counter
     double blockdiff_time_sec = 0.0; //actual sync time using SnapDiff/blockdiff counter
+    boost::optional<double> datasync_queue_wait_duration; // first data_q push to first pop (final)
+    boost::optional<monotime> datasync_queue_wait_start_time; // until first pop; for in-progress display
   };
 
   void _inc_failed_count(const std::string &dir_root) {
@@ -455,6 +460,8 @@ private:
     sync_stat.discovered_delta_bytes = 0;
     sync_stat.blockdiff_sync_bytes = 0;
     sync_stat.blockdiff_time_sec = 0.0;
+    sync_stat.datasync_queue_wait_duration = boost::none;
+    sync_stat.datasync_queue_wait_start_time = boost::none;
   }
   void _set_last_synced_snap(const std::string &dir_root, uint64_t snap_id,
                             const std::string &snap_name) {
@@ -497,6 +504,9 @@ private:
     sync_stat.last_synced = clock::now();
     sync_stat.last_sync_duration = duration;
     sync_stat.last_sync_crawl_duration = sync_stat.crawl_duration;
+    //For empty snapshot sync, datasync_queue_wait_duration is 0
+    sync_stat.last_sync_datasync_queue_wait_duration =
+      sync_stat.datasync_queue_wait_duration.value_or(0.0);
     sync_stat.last_sync_bytes = sync_stat.sync_bytes;
     sync_stat.last_sync_files = sync_stat.sync_files;
     ++sync_stat.synced_snap_count;
@@ -513,6 +523,21 @@ private:
     sync_stat.crawl_finished = state;
     sync_stat.crawl_duration = seconds;
   }
+  void set_datasync_queue_wait_start_time(const std::string &dir_root, monotime t) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    if (!sync_stat.datasync_queue_wait_start_time && !sync_stat.datasync_queue_wait_duration) {
+      sync_stat.datasync_queue_wait_start_time = t;
+    }
+  }
+  void set_datasync_queue_wait_duration(const std::string &dir_root, double seconds) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    if (!sync_stat.datasync_queue_wait_duration) {
+      sync_stat.datasync_queue_wait_duration = seconds;
+      sync_stat.datasync_queue_wait_start_time = boost::none;
+    }
+  }
   void set_blockdiff_metrics(const std::string &dir_root, const uint64_t bd_syncbytes, const double bd_time) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);

From 2b325537171c04375145f9e0e5fbd439a09eb873 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Fri, 5 Jun 2026 19:53:14 +0530
Subject: [PATCH 217/596] tools/cephfs_mirror: Nest peer_status metrics by dir
 path and peer uuid

Restructure peer_status output so mirrored directory paths can be
shared by multiple peers without key collisions. Metrics are grouped
as metrics/<dir_path>/peer/<peer_uuid>/ instead of flat dir keys.

Sample output:
--------------
1. When two dirs are syncing.
{
    "metrics": {
        "/parent/d0": {
            "peer": {
                "8a85ab25-70f9-48e9-b82d-56324e75209b": {
                    "state": "syncing",
                    "current_syncing_snap": {
                        "id": 2,
                        "name": "d0_snap0",
                        "sync-mode": "full",
                        "avg_read_throughput_bytes": "9.01 MiB/s",
                        "avg_write_throughput_bytes": "26.74 MiB/s",
                        "crawl": {
                            "state": "completed",
                            "duration": "2s"
                        },
                        "datasync_queue_wait": {
                            "state": "completed",
                            "duration": "0s"
                        },
                        "bytes": {
                            "sync_bytes": "60.83 MiB",
                            "total_bytes": "149.94 MiB",
                            "sync_percent": "40.57%"
                        },
                        "files": {
                            "sync_files": 2028,
                            "total_files": 5000,
                            "sync_percent": "40.56%"
                        },
                        "eta": "10s"
                    },
                    "snaps_synced": 0,
                    "snaps_deleted": 0,
                    "snaps_renamed": 0
                }
            }
        },
        "/parent/d1": {
            "peer": {
                "8a85ab25-70f9-48e9-b82d-56324e75209b": {
                    "state": "syncing",
                    "current_syncing_snap": {
                        "id": 3,
                        "name": "d1_snap0",
                        "sync-mode": "full",
                        "avg_read_throughput_bytes": "6.80 MiB/s",
                        "avg_write_throughput_bytes": "20.04 MiB/s",
                        "crawl": {
                            "state": "in-progress",
                            "duration": "2s"
                        },
                        "datasync_queue_wait": {
                            "state": "completed",
                            "duration": "1s"
                        },
                        "bytes": {
                            "sync_bytes": "4.12 MiB",
                            "total_bytes": "124.98 MiB",
                            "sync_percent": "3.30%"
                        },
                        "files": {
                            "sync_files": 125,
                            "total_files": 4189,
                            "sync_percent": "2.98%"
                        },
                        "eta": "18s"
                    },
                    "snaps_synced": 0,
                    "snaps_deleted": 0,
                    "snaps_renamed": 0
                }
            }
        }
    }
}
---------
2. When two directories are synced

------------------------------------------
{
    "metrics": {
        "/parent/d0": {
            "peer": {
                "8a85ab25-70f9-48e9-b82d-56324e75209b": {
                    "state": "idle",
                    "last_synced_snap": {
                        "id": 2,
                        "name": "d0_snap0",
                        "crawl_duration": "2s",
                        "datasync_queue_wait_duration": "0s",
                        "sync_duration": "30s",
                        "sync_time_stamp": "422538.254127s",
                        "sync_bytes": "149.94 MiB",
                        "sync_files": 5000
                    },
                    "snaps_synced": 1,
                    "snaps_deleted": 0,
                    "snaps_renamed": 0
                }
            }
        },
        "/parent/d1": {
            "peer": {
                "8a85ab25-70f9-48e9-b82d-56324e75209b": {
                    "state": "idle",
                    "last_synced_snap": {
                        "id": 3,
                        "name": "d1_snap0",
                        "crawl_duration": "2s",
                        "datasync_queue_wait_duration": "1s",
                        "sync_duration": "33s",
                        "sync_time_stamp": "422546.205798s",
                        "sync_bytes": "149.94 MiB",
                        "sync_files": 5000
                    },
                    "snaps_synced": 1,
                    "snaps_deleted": 0,
                    "snaps_renamed": 0
                }
            }
        }
    }
}

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 226 +++++++++++++-----------
 src/tools/cephfs_mirror/PeerReplayer.h  |   3 +-
 2 files changed, 120 insertions(+), 109 deletions(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 11d4c7f67fa..7ee7e06b757 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -2662,7 +2662,7 @@ std::string PeerReplayer::format_bytes(double bytes) {
   return out.str();
 };
 
-double PeerReplayer::compute_eta(PeerReplayer::SnapSyncStat& sync_stat) {
+double PeerReplayer::compute_eta(const PeerReplayer::SnapSyncStat& sync_stat) {
   // mlock is held by the caller
 
   static constexpr uint64_t MIN_FILES_SAMPLE = 25;
@@ -2720,119 +2720,129 @@ double PeerReplayer::compute_eta(PeerReplayer::SnapSyncStat& sync_stat) {
   }
 }
 
-void PeerReplayer::peer_status(Formatter *f) {
-  std::scoped_lock locker(m_lock);
-  f->open_object_section("stats");
-  for (auto &[dir_root, sync_stat] : m_snap_sync_stats) {
-    f->open_object_section(dir_root);
-    if (sync_stat.failed) {
-      f->dump_string("state", "failed");
-      if (sync_stat.last_failed_reason) {
-	f->dump_string("failure_reason", *sync_stat.last_failed_reason);
-      }
-    } else if (!sync_stat.current_syncing_snap) {
-      f->dump_string("state", "idle");
-    } else {
-      f->dump_string("state", "syncing");
-      f->open_object_section("current_syncing_snap");
-      f->dump_unsigned("id", (*sync_stat.current_syncing_snap).first);
-      f->dump_string("name", (*sync_stat.current_syncing_snap).second);
-      if (sync_stat.snapdiff)
-        f->dump_string("sync-mode", "delta");
-      else
-        f->dump_string("sync-mode", "full");
-
-      //avg read/write throughput
-      double read_bps = sync_stat.read_time_sec > 0 ?
-          sync_stat.bytes_read / sync_stat.read_time_sec : 0;
-      double write_bps = sync_stat.write_time_sec > 0 ?
-          sync_stat.bytes_written / sync_stat.write_time_sec : 0;
-      f->dump_string("avg_read_throughput_bytes", format_bytes(read_bps) + "/s");
-      f->dump_string("avg_write_throughput_bytes", format_bytes(write_bps) + "/s");
-
-      f->open_object_section("crawl");
-      if (sync_stat.crawl_finished) {
-        f->dump_string("state", "completed");
-        f->dump_string("duration", format_time(sync_stat.crawl_duration));
-      } else {
-        f->dump_string("state", "in-progress");
-        auto cur_time = clock::now();
-        sec_duration crawl_duration_till_now{0};
-        crawl_duration_till_now = sec_duration(cur_time - sync_stat.crawl_start_time);
-        f->dump_string("duration", format_time(crawl_duration_till_now.count()));
-      }
-      f->close_section(); //crawl
-      if (sync_stat.datasync_queue_wait_duration ||
-          sync_stat.datasync_queue_wait_start_time) {
-        f->open_object_section("datasync_queue_wait");
-        if (sync_stat.datasync_queue_wait_duration) {
-          f->dump_string("state", "completed");
-          f->dump_string("duration",
-                         format_time(*sync_stat.datasync_queue_wait_duration));
-        } else {
-          f->dump_string("state", "waiting");
-          auto cur_time = clock::now();
-          sec_duration dq_wait{0};
-          dq_wait = sec_duration(cur_time - *sync_stat.datasync_queue_wait_start_time);
-          f->dump_string("duration", format_time(dq_wait.count()));
-        }
-        f->close_section();
-      }
-      f->open_object_section("bytes");
-      f->dump_string("sync_bytes", format_bytes(sync_stat.sync_bytes));
-      f->dump_string("total_bytes", format_bytes(sync_stat.total_bytes));
-      if (sync_stat.total_bytes > 0) {
-        double sync_pct = (static_cast<double>(sync_stat.sync_bytes) * 100.0) / sync_stat.total_bytes;
-        std::ostringstream os;
-        os << std::fixed << std::setprecision(2) << sync_pct << "%";
-        f->dump_string("sync_percent", os.str());
-      }
-      f->close_section(); //bytes
-      f->open_object_section("files");
-      f->dump_unsigned("sync_files", sync_stat.sync_files);
-      f->dump_unsigned("total_files", sync_stat.total_files);
-      if (sync_stat.total_files > 0) {
-        double sync_file_pct = (static_cast<double>(sync_stat.sync_files) * 100.0) / sync_stat.total_files;
-        std::ostringstream os;
-        os << std::fixed << std::setprecision(2) << sync_file_pct << "%";
-        f->dump_string("sync_percent", os.str());
-      }
-      f->close_section(); //files
-      double eta = compute_eta(sync_stat);
-      if (eta == -1.0)
-        f->dump_string("eta", "calculating...");
-      else
-        f->dump_string("eta", format_time(compute_eta(sync_stat)));
-      f->close_section(); //current_syncing_snap
+void PeerReplayer::dump_sync_stat(Formatter *f, const SnapSyncStat &sync_stat) {
+  if (sync_stat.failed) {
+    f->dump_string("state", "failed");
+    if (sync_stat.last_failed_reason) {
+      f->dump_string("failure_reason", *sync_stat.last_failed_reason);
     }
-    if (sync_stat.last_synced_snap) {
-      f->open_object_section("last_synced_snap");
-      f->dump_unsigned("id", (*sync_stat.last_synced_snap).first);
-      f->dump_string("name", (*sync_stat.last_synced_snap).second);
-      if (sync_stat.last_sync_crawl_duration) {
-        f->dump_string("crawl_duration", format_time(*sync_stat.last_sync_crawl_duration));
-      }
-      if (sync_stat.last_sync_datasync_queue_wait_duration) {
-        f->dump_string("datasync_queue_wait_duration",
-                       format_time(*sync_stat.last_sync_datasync_queue_wait_duration));
-      }
-      if (sync_stat.last_sync_duration) {
-        f->dump_string("sync_duration", format_time(*sync_stat.last_sync_duration));
-        f->dump_stream("sync_time_stamp") << sync_stat.last_synced;
-      }
-      if (sync_stat.last_sync_bytes) {
-	    f->dump_string("sync_bytes", format_bytes(*sync_stat.last_sync_bytes));
-      }
-      if (sync_stat.last_sync_files) {
-	    f->dump_unsigned("sync_files", *sync_stat.last_sync_files);
+  } else if (!sync_stat.current_syncing_snap) {
+    f->dump_string("state", "idle");
+  } else {
+    f->dump_string("state", "syncing");
+    f->open_object_section("current_syncing_snap");
+    f->dump_unsigned("id", (*sync_stat.current_syncing_snap).first);
+    f->dump_string("name", (*sync_stat.current_syncing_snap).second);
+    if (sync_stat.snapdiff)
+      f->dump_string("sync-mode", "delta");
+    else
+      f->dump_string("sync-mode", "full");
+
+    //avg read/write throughput
+    double read_bps = sync_stat.read_time_sec > 0 ?
+        sync_stat.bytes_read / sync_stat.read_time_sec : 0;
+    double write_bps = sync_stat.write_time_sec > 0 ?
+        sync_stat.bytes_written / sync_stat.write_time_sec : 0;
+    f->dump_string("avg_read_throughput_bytes", format_bytes(read_bps) + "/s");
+    f->dump_string("avg_write_throughput_bytes", format_bytes(write_bps) + "/s");
+
+    f->open_object_section("crawl");
+    if (sync_stat.crawl_finished) {
+      f->dump_string("state", "completed");
+      f->dump_string("duration", format_time(sync_stat.crawl_duration));
+    } else {
+      f->dump_string("state", "in-progress");
+      auto cur_time = clock::now();
+      sec_duration crawl_duration_till_now{0};
+      crawl_duration_till_now = sec_duration(cur_time - sync_stat.crawl_start_time);
+      f->dump_string("duration", format_time(crawl_duration_till_now.count()));
+    }
+    f->close_section(); //crawl
+    if (sync_stat.datasync_queue_wait_duration ||
+        sync_stat.datasync_queue_wait_start_time) {
+      f->open_object_section("datasync_queue_wait");
+      if (sync_stat.datasync_queue_wait_duration) {
+        f->dump_string("state", "completed");
+        f->dump_string("duration",
+                       format_time(*sync_stat.datasync_queue_wait_duration));
+      } else {
+        f->dump_string("state", "waiting");
+        auto cur_time = clock::now();
+        sec_duration dq_wait{0};
+        dq_wait = sec_duration(cur_time - *sync_stat.datasync_queue_wait_start_time);
+        f->dump_string("duration", format_time(dq_wait.count()));
       }
       f->close_section();
     }
-    f->dump_unsigned("snaps_synced", sync_stat.synced_snap_count);
-    f->dump_unsigned("snaps_deleted", sync_stat.deleted_snap_count);
-    f->dump_unsigned("snaps_renamed", sync_stat.renamed_snap_count);
+    f->open_object_section("bytes");
+    f->dump_string("sync_bytes", format_bytes(sync_stat.sync_bytes));
+    f->dump_string("total_bytes", format_bytes(sync_stat.total_bytes));
+    if (sync_stat.total_bytes > 0) {
+      double sync_pct = (static_cast<double>(sync_stat.sync_bytes) * 100.0) / sync_stat.total_bytes;
+      std::ostringstream os;
+      os << std::fixed << std::setprecision(2) << sync_pct << "%";
+      f->dump_string("sync_percent", os.str());
+    }
+    f->close_section(); //bytes
+    f->open_object_section("files");
+    f->dump_unsigned("sync_files", sync_stat.sync_files);
+    f->dump_unsigned("total_files", sync_stat.total_files);
+    if (sync_stat.total_files > 0) {
+      double sync_file_pct = (static_cast<double>(sync_stat.sync_files) * 100.0) / sync_stat.total_files;
+      std::ostringstream os;
+      os << std::fixed << std::setprecision(2) << sync_file_pct << "%";
+      f->dump_string("sync_percent", os.str());
+    }
+    f->close_section(); //files
+    double eta = compute_eta(sync_stat);
+    if (eta == -1.0)
+      f->dump_string("eta", "calculating...");
+    else
+      f->dump_string("eta", format_time(compute_eta(sync_stat)));
+    f->close_section(); //current_syncing_snap
+  }
+  if (sync_stat.last_synced_snap) {
+    f->open_object_section("last_synced_snap");
+    f->dump_unsigned("id", (*sync_stat.last_synced_snap).first);
+    f->dump_string("name", (*sync_stat.last_synced_snap).second);
+    if (sync_stat.last_sync_crawl_duration) {
+      f->dump_string("crawl_duration", format_time(*sync_stat.last_sync_crawl_duration));
+    }
+    if (sync_stat.last_sync_datasync_queue_wait_duration) {
+      f->dump_string("datasync_queue_wait_duration",
+                     format_time(*sync_stat.last_sync_datasync_queue_wait_duration));
+    }
+    if (sync_stat.last_sync_duration) {
+      f->dump_string("sync_duration", format_time(*sync_stat.last_sync_duration));
+      f->dump_stream("sync_time_stamp") << sync_stat.last_synced;
+    }
+    if (sync_stat.last_sync_bytes) {
+      f->dump_string("sync_bytes", format_bytes(*sync_stat.last_sync_bytes));
+    }
+    if (sync_stat.last_sync_files) {
+      f->dump_unsigned("sync_files", *sync_stat.last_sync_files);
+    }
+    f->close_section();
+  }
+  f->dump_unsigned("snaps_synced", sync_stat.synced_snap_count);
+  f->dump_unsigned("snaps_deleted", sync_stat.deleted_snap_count);
+  f->dump_unsigned("snaps_renamed", sync_stat.renamed_snap_count);
+}
+
+void PeerReplayer::peer_status(Formatter *f) {
+  std::scoped_lock locker(m_lock);
+  f->open_object_section("stats");
+  f->open_object_section("metrics");
+  for (auto &[dir_root, sync_stat] : m_snap_sync_stats) {
+    f->open_object_section(dir_root);
+    f->open_object_section("peer");
+    f->open_object_section(m_peer.uuid);
+    dump_sync_stat(f, sync_stat);
+    f->close_section(); // peer uuid
+    f->close_section(); // peer
     f->close_section(); // dir_root
   }
+  f->close_section(); // metrics
   f->close_section(); // stats
 }
 
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 6bfc84a5835..abe95c6dfe8 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -735,9 +735,10 @@ private:
   }
 
   // format routines for peer_status
+  static void dump_sync_stat(Formatter *f, const SnapSyncStat &sync_stat);
   static std::string format_bytes(double bytes);
   static std::string format_time(double total_seconds);
-  static double compute_eta(SnapSyncStat& sync_stat);
+  static double compute_eta(const SnapSyncStat& sync_stat);
 };
 
 } // namespace mirror

From 75093b138e33afb11c8548abb8fb2c01e307b9db Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 25 May 2026 23:04:57 +0530
Subject: [PATCH 218/596] qa: Fix the mirroring tests with new nested
 peer_status output

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 qa/tasks/cephfs/test_mirroring.py | 73 ++++++++++++++++++-------------
 1 file changed, 43 insertions(+), 30 deletions(-)

diff --git a/qa/tasks/cephfs/test_mirroring.py b/qa/tasks/cephfs/test_mirroring.py
index dbe6dfb1fa7..e5f7ac27884 100644
--- a/qa/tasks/cephfs/test_mirroring.py
+++ b/qa/tasks/cephfs/test_mirroring.py
@@ -259,6 +259,9 @@ class TestMirroring(CephFSTestCase):
         self.assertEqual(peer['stats']['failure_count'], 1)
         self.assertEqual(peer['stats']['recovery_count'], 1)
 
+    def peer_dir_status(self, res, dir_name, peer_uuid):
+        return res['metrics'][dir_name]['peer'][peer_uuid]
+
     @retry_assert(timeout=60, interval=3)
     def check_peer_status_empty(self, fs_name, fs_id, peer_spec):
         peer_uuid = self.get_peer_uuid(peer_spec)
@@ -266,7 +269,7 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{fs_name}@{fs_id}', peer_uuid)
         try:
-            self.assertFalse(res)
+            self.assertFalse(res.get('metrics'))
         except RETRY_EXCEPTIONS as e:
             e.res = res
             raise
@@ -279,9 +282,9 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{fs_name}@{fs_id}', peer_uuid)
         try:
-            self.assertTrue(dir_name in res)
-            self.assertTrue(res[dir_name]['last_synced_snap']['name'] == expected_snap_name)
-            self.assertTrue(res[dir_name]['snaps_synced'] == expected_snap_count)
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            self.assertTrue(dir_stat['last_synced_snap']['name'] == expected_snap_name)
+            self.assertTrue(dir_stat['snaps_synced'] == expected_snap_count)
         except RETRY_EXCEPTIONS as e:
             e.res = res
             raise
@@ -294,10 +297,10 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{fs_name}@{fs_id}', peer_uuid)
         try:
-            self.assertTrue(dir_name in res)
-            self.assertTrue('idle' == res[dir_name]['state'])
-            self.assertTrue(expected_snap_name == res[dir_name]['last_synced_snap']['name'])
-            self.assertTrue(expected_snap_count == res[dir_name]['snaps_synced'])
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            self.assertTrue('idle' == dir_stat['state'])
+            self.assertTrue(expected_snap_name == dir_stat['last_synced_snap']['name'])
+            self.assertTrue(expected_snap_count == dir_stat['snaps_synced'])
         except RETRY_EXCEPTIONS as e:
             e.res = res
             raise
@@ -310,8 +313,8 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{fs_name}@{fs_id}', peer_uuid)
         try:
-            self.assertTrue(dir_name in res)
-            self.assertTrue(res[dir_name]['snaps_deleted'] == expected_delete_count)
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            self.assertTrue(dir_stat['snaps_deleted'] == expected_delete_count)
         except RETRY_EXCEPTIONS as e:
             e.res = res
             raise
@@ -324,8 +327,8 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{fs_name}@{fs_id}', peer_uuid)
         try:
-            self.assertTrue(dir_name in res)
-            self.assertTrue(res[dir_name]['snaps_renamed'] == expected_rename_count)
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            self.assertTrue(dir_stat['snaps_renamed'] == expected_rename_count)
         except RETRY_EXCEPTIONS as e:
             e.res = res
             raise
@@ -339,8 +342,9 @@ class TestMirroring(CephFSTestCase):
                                              'fs', 'mirror', 'peer', 'status',
                                              f'{fs_name}@{fs_id}', peer_uuid)
 
-            self.assertTrue('syncing' == res[dir_name]['state'])
-            self.assertTrue(res[dir_name]['current_syncing_snap']['name'] == snap_name)
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            self.assertTrue('syncing' == dir_stat['state'])
+            self.assertTrue(dir_stat['current_syncing_snap']['name'] == snap_name)
         except RETRY_EXCEPTIONS as e:
             e.res = res
             raise
@@ -364,7 +368,7 @@ class TestMirroring(CephFSTestCase):
         res = self.mirror_daemon_command(f'peer status for fs: {fs_name}',
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{fs_name}@{fs_id}', peer_uuid)
-        self.assertTrue('failed' == res[dir_name]['state'])
+        self.assertTrue('failed' == self.peer_dir_status(res, dir_name, peer_uuid)['state'])
 
     def get_peer_uuid(self, peer_spec):
         status = self.fs.status()
@@ -1451,8 +1455,9 @@ class TestMirroring(CephFSTestCase):
                                                  'fs', 'mirror', 'peer', 'status',
                                                  f'{self.primary_fs_name}@{self.primary_fs_id}',
                                                  peer_uuid)
-                if ('syncing' == res["/d0"]['state'] and 'syncing' == res["/d1"]['state'] and \
-                    'syncing' == res["/d2"]['state']):
+                if ('syncing' == self.peer_dir_status(res, '/d0', peer_uuid)['state'] and
+                    'syncing' == self.peer_dir_status(res, '/d1', peer_uuid)['state'] and
+                    'syncing' == self.peer_dir_status(res, '/d2', peer_uuid)['state']):
                     break
 
         log.debug('removing directory 1')
@@ -1585,10 +1590,11 @@ class TestMirroring(CephFSTestCase):
                 res = self.mirror_daemon_command(f'peer status for fs: {self.primary_fs_name}',
                                                  'fs', 'mirror', 'peer', 'status',
                                                  f'{self.primary_fs_name}@{self.primary_fs_id}', peer_uuid)
-                if('failed' == res[dir_name]['state'] and \
-                   failure_reason == res.get(dir_name, {}).get('failure_reason', {}) and \
-                   snap_name == res[dir_name]['last_synced_snap']['name'] and \
-                   expected_snap_count == res[dir_name]['snaps_synced']):
+                dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+                if('failed' == dir_stat['state'] and \
+                   failure_reason == dir_stat.get('failure_reason', {}) and \
+                   snap_name == dir_stat['last_synced_snap']['name'] and \
+                   expected_snap_count == dir_stat['snaps_synced']):
                     break
         # remove the directory in the remote fs and check status restores to 'idle'
         self.mount_b.run_shell(['sudo', 'rmdir', remote_snap_path], omit_sudo=False)
@@ -1597,9 +1603,10 @@ class TestMirroring(CephFSTestCase):
                 res = self.mirror_daemon_command(f'peer status for fs: {self.primary_fs_name}',
                                                  'fs', 'mirror', 'peer', 'status',
                                                  f'{self.primary_fs_name}@{self.primary_fs_id}', peer_uuid)
-                if('idle' == res[dir_name]['state'] and 'failure_reason' not in res and \
-                   snap_name == res[dir_name]['last_synced_snap']['name'] and \
-                   expected_snap_count == res[dir_name]['snaps_synced']):
+                dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+                if('idle' == dir_stat['state'] and 'failure_reason' not in dir_stat and \
+                   snap_name == dir_stat['last_synced_snap']['name'] and \
+                   expected_snap_count == dir_stat['snaps_synced']):
                     break
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
 
@@ -1700,9 +1707,12 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{self.primary_fs_name}@{self.primary_fs_id}',
                                          peer_uuid)
-        d0_sync_time_stamp = float(res["/d0"]["last_synced_snap"]["sync_time_stamp"].rstrip('s'))
-        d1_sync_time_stamp = float(res["/d1"]["last_synced_snap"]["sync_time_stamp"].rstrip('s'))
-        d2_sync_time_stamp = float(res["/d2"]["last_synced_snap"]["sync_time_stamp"].rstrip('s'))
+        d0_sync_time_stamp = float(self.peer_dir_status(res, '/d0', peer_uuid)
+                                  ['last_synced_snap']['sync_time_stamp'].rstrip('s'))
+        d1_sync_time_stamp = float(self.peer_dir_status(res, '/d1', peer_uuid)
+                                  ['last_synced_snap']['sync_time_stamp'].rstrip('s'))
+        d2_sync_time_stamp = float(self.peer_dir_status(res, '/d2', peer_uuid)
+                                  ['last_synced_snap']['sync_time_stamp'].rstrip('s'))
 
         self.assertGreaterEqual(d1_sync_time_stamp, d0_sync_time_stamp)
         self.assertGreaterEqual(d2_sync_time_stamp, d0_sync_time_stamp)
@@ -1769,9 +1779,12 @@ class TestMirroring(CephFSTestCase):
                                          'fs', 'mirror', 'peer', 'status',
                                          f'{self.primary_fs_name}@{self.primary_fs_id}',
                                          peer_uuid)
-        d0_sync_time_stamp = float(res["/d0"]["last_synced_snap"]["sync_time_stamp"].rstrip('s'))
-        d1_sync_time_stamp = float(res["/d1"]["last_synced_snap"]["sync_time_stamp"].rstrip('s'))
-        d2_sync_time_stamp = float(res["/d2"]["last_synced_snap"]["sync_time_stamp"].rstrip('s'))
+        d0_sync_time_stamp = float(self.peer_dir_status(res, '/d0', peer_uuid)
+                                  ['last_synced_snap']['sync_time_stamp'].rstrip('s'))
+        d1_sync_time_stamp = float(self.peer_dir_status(res, '/d1', peer_uuid)
+                                  ['last_synced_snap']['sync_time_stamp'].rstrip('s'))
+        d2_sync_time_stamp = float(self.peer_dir_status(res, '/d2', peer_uuid)
+                                  ['last_synced_snap']['sync_time_stamp'].rstrip('s'))
 
         self.assertLess(d1_sync_time_stamp, d0_sync_time_stamp)
         self.assertLess(d2_sync_time_stamp, d0_sync_time_stamp)

From 55eceaae3d70d6e0d721bc8fadb0e5b6726257e6 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 25 May 2026 23:52:29 +0530
Subject: [PATCH 219/596] doc: Update the mirroring doc with new metrics fields

Update the mirroring documentation and also the
release notes with new metrics introduced and it's
availability via 'fs mirror peer status' asok
interface.

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 PendingReleaseNotes             |   5 +
 doc/cephfs/cephfs-mirroring.rst | 344 ++++++++++++++++++++++++++------
 doc/dev/cephfs-mirroring.rst    | 126 +++++++++---
 3 files changed, 386 insertions(+), 89 deletions(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index dca256f0dc7..90903a9875c 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -78,6 +78,11 @@
   ``ceph fs snapshot mirror daemon status`` now shows the remote cluster's
   monitor addresses and cluster ID for each configured peer, making it easier
   to verify peer connectivity and troubleshoot mirroring issues.
+* CephFS Mirroring: The ``fs mirror peer status`` admin socket command reports
+  additional per-directory sync metrics (sync mode, throughput, crawl and
+  data-sync queue timing, bytes/files progress, and ETA). Output is grouped
+  under ``metrics/<mirrored-dir-path>/peer/<peer-uuid>``. For more information,
+  see https://tracker.ceph.com/issues/73453
 * RBD: Mirror snapshot creation and trash purge schedules are now automatically
   staggered when no explicit "start-time" is specified. This reduces scheduling
   spikes and distributes work more evenly over time.
diff --git a/doc/cephfs/cephfs-mirroring.rst b/doc/cephfs/cephfs-mirroring.rst
index cbd51081dfc..5b12ed4dffc 100644
--- a/doc/cephfs/cephfs-mirroring.rst
+++ b/doc/cephfs/cephfs-mirroring.rst
@@ -356,21 +356,113 @@ command parameter is of format ``filesystem-name@filesystem-id peer-uuid``::
 
   $ ceph --admin-daemon /var/run/ceph/cephfs-mirror.asok fs mirror peer status cephfs@360 a2dc7784-e7a1-4723-b103-03ee8d8768f8
   {
-    "/d0": {
-        "state": "idle",
-        "last_synced_snap": {
-            "id": 120,
-            "name": "snap1",
-            "sync_duration": 3,
-            "sync_time_stamp": "274900.558797s",
-            "sync_bytes": 52428800
-        },
-        "snaps_synced": 2,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "idle",
+                    "last_synced_snap": {
+                        "id": 120,
+                        "name": "snap1",
+                        "crawl_duration": "2s",
+                        "datasync_queue_wait_duration": "1s",
+                        "sync_duration": "33s",
+                        "sync_time_stamp": "274900.558797s",
+                        "sync_bytes": "149.94 MiB",
+                        "sync_files": 5000
+                    },
+                    "snaps_synced": 2,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
     }
   }
 
+The per-directory fields are nested under ``metrics/<mirrored-dir-path>/peer/<peer-uuid>`` so
+the same directory path can be reported for multiple peers without key collisions.
+
+.. _cephfs_mirror_peer_status_formatting:
+
+Value formatting
+----------------
+
+Several fields in the status output are formatted for readability rather than reported as raw
+numbers. The subsections below describe each format; field tables later in this section refer
+back to them.
+
+.. _cephfs_mirror_status_durations:
+
+Durations
+---------
+
+Fields: ``crawl_duration``, ``datasync_queue_wait_duration``, ``sync_duration``,
+``crawl.duration``, ``datasync_queue_wait.duration``, and ``eta``.
+
+Elapsed time is rounded to the nearest whole second and displayed as a combination of days,
+hours, minutes, and seconds. The format adapts to the magnitude:
+
+- ``<SS>s`` — seconds only, when less than one minute (for example, ``2s`` or ``33s``)
+- ``<M>m <SS>s`` — minutes and seconds, when less than one hour (for example, ``5m 12s``)
+- ``<H>h <MM>m <SS>s`` — hours, minutes, and seconds, when less than one day
+  (for example, ``1h 05m 30s``)
+- ``<D>d <HH>h <MM>m <SS>s`` — days, hours, minutes, and seconds, when one day or longer
+  (for example, ``1d 02h 30m 45s``)
+
+.. _cephfs_mirror_status_data_sizes:
+
+Data sizes
+----------
+
+Fields: ``sync_bytes``, ``bytes.sync_bytes``, ``bytes.total_bytes``, and the byte counts in
+``last_synced_snap``.
+
+Byte counts use binary (IEC) units with two decimal places. The unit is chosen automatically
+from ``B``, ``KiB``, ``MiB``, ``GiB``, ``TiB``, or ``PiB`` (powers of 1024). For example,
+``149.94 MiB``.
+
+.. _cephfs_mirror_status_throughput:
+
+Throughput
+----------
+
+Fields: ``avg_read_throughput_bytes`` and ``avg_write_throughput_bytes``.
+
+Average transfer rate in bytes per second, using the same binary units as :ref:`data sizes
+<cephfs_mirror_status_data_sizes>` with a ``/s`` suffix. For example, ``13.03 MiB/s`` means
+13.03 mebibytes per second.
+
+.. _cephfs_mirror_status_percentages:
+
+Percentages
+-----------
+
+Fields: ``bytes.sync_percent`` and ``files.sync_percent``.
+
+Percentage complete with two decimal places and a ``%`` suffix (for example, ``40.29%``).
+
+.. _cephfs_mirror_status_counts:
+
+Counts
+------
+
+Fields: ``sync_files``, ``total_files``, ``snaps_synced``, ``snaps_deleted``, ``snaps_renamed``,
+and snapshot ``id``.
+
+Plain unsigned integers with no unit suffix.
+
+.. _cephfs_mirror_status_timestamp:
+
+Timestamp
+---------
+
+Field: ``sync_time_stamp``.
+
+Monotonic clock time in seconds (since daemon startup) when the snapshot sync finished,
+printed with sub-second precision and an ``s`` suffix (for example, ``274900.558797s``). This
+is not a wall-clock or epoch timestamp.
+
 Synchronization stats including ``snaps_synced``, ``snaps_deleted`` and ``snaps_renamed`` are reset
 on daemon restart and/or when a directory is reassigned to another mirror daemon (when
 multiple mirror daemons are deployed).
@@ -386,27 +478,128 @@ When a directory is currently being synchronized, the mirror daemon marks it as
 
   $ ceph --admin-daemon /var/run/ceph/cephfs-mirror.asok fs mirror peer status cephfs@360 a2dc7784-e7a1-4723-b103-03ee8d8768f8
   {
-    "/d0": {
-        "state": "syncing",
-        "current_syncing_snap": {
-            "id": 121,
-            "name": "snap2"
-        },
-        "last_synced_snap": {
-            "id": 120,
-            "name": "snap1",
-            "sync_duration": 3,
-            "sync_time_stamp": "274900.558797s",
-            "sync_bytes": 52428800
-        },
-        "snaps_synced": 2,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "syncing",
+                    "current_syncing_snap": {
+                        "id": 121,
+                        "name": "snap2",
+                        "sync-mode": "full",
+                        "avg_read_throughput_bytes": "13.03 MiB/s",
+                        "avg_write_throughput_bytes": "24.24 MiB/s",
+                        "crawl": {
+                            "state": "completed",
+                            "duration": "2s"
+                        },
+                        "datasync_queue_wait": {
+                            "state": "complete",
+                            "duration": "1s"
+                        },
+                        "bytes": {
+                            "sync_bytes": "60.40 MiB",
+                            "total_bytes": "149.94 MiB",
+                            "sync_percent": "40.29%"
+                        },
+                        "files": {
+                            "sync_files": 2013,
+                            "total_files": 5000,
+                            "sync_percent": "40.26%"
+                        },
+                        "eta": "7s"
+                    },
+                    "snaps_synced": 2,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
     }
   }
 
 The mirror daemon marks it back to ``idle``, when the syncing completes.
 
+When ``state`` is ``syncing``, ``current_syncing_snap`` includes the following
+progress fields (see :ref:`cephfs_mirror_peer_status_formatting` for how values are
+displayed):
+
+.. list-table::
+   :widths: 35 65
+   :header-rows: 1
+
+   * - Field
+     - Description
+   * - ``sync-mode``
+     - Whether the snapshot is synchronized with a full tree copy (``full``) or incremental snapdiff/blockdiff (``delta``).
+   * - ``avg_read_throughput_bytes``
+     - Average read rate from the primary filesystem for this snapshot sync. See
+       :ref:`Throughput <cephfs_mirror_status_throughput>`.
+   * - ``avg_write_throughput_bytes``
+     - Average write rate to the remote peer for this snapshot sync. See
+       :ref:`Throughput <cephfs_mirror_status_throughput>`.
+   * - ``crawl.state``
+     - Whether the directory tree walk is ``in-progress`` or ``completed``. While
+       ``in-progress``, ``bytes.total_bytes`` and ``files.total_files`` reflect only what
+       has been discovered so far and may keep increasing; once ``completed``, those totals
+       are fully discovered for this snapshot sync.
+   * - ``crawl.duration``
+     - Elapsed crawl time so far, or total crawl time once ``crawl.state`` is ``completed``.
+       See :ref:`Durations <cephfs_mirror_status_durations>`.
+   * - ``datasync_queue_wait.state``
+     - Whether the snapshot is still ``waiting`` in the data-sync queue or has started transfer (``complete``).
+   * - ``datasync_queue_wait.duration``
+     - Elapsed queue wait time so far, or total queue wait time once transfer has started.
+       See :ref:`Durations <cephfs_mirror_status_durations>`.
+   * - ``bytes.sync_bytes``
+     - Amount of file data synchronized so far for this snapshot. See
+       :ref:`Data sizes <cephfs_mirror_status_data_sizes>`.
+   * - ``bytes.total_bytes``
+     - Total file data discovered for this snapshot sync. See
+       :ref:`Data sizes <cephfs_mirror_status_data_sizes>`. Increases during the crawl while
+       ``crawl.state`` is ``in-progress``; final once ``crawl.state`` is ``completed``.
+   * - ``bytes.sync_percent``
+     - Percentage of ``total_bytes`` synchronized so far. See
+       :ref:`Percentages <cephfs_mirror_status_percentages>`.
+   * - ``files.sync_files``
+     - Number of files synchronized so far for this snapshot. See
+       :ref:`Counts <cephfs_mirror_status_counts>`.
+   * - ``files.total_files``
+     - Total number of files discovered for this snapshot sync. See
+       :ref:`Counts <cephfs_mirror_status_counts>`. Increases during the crawl while
+       ``crawl.state`` is ``in-progress``; final once ``crawl.state`` is ``completed``.
+   * - ``files.sync_percent``
+     - Percentage of ``total_files`` synchronized so far. See
+       :ref:`Percentages <cephfs_mirror_status_percentages>`.
+   * - ``eta``
+     - Estimated time remaining to finish the snapshot sync, or ``calculating...`` until enough
+       samples are collected. See :ref:`Durations <cephfs_mirror_status_durations>`.
+
+``last_synced_snap`` includes these additional fields for the last completed snapshot sync
+(see :ref:`cephfs_mirror_peer_status_formatting` for how values are displayed):
+
+.. list-table::
+   :widths: 35 65
+   :header-rows: 1
+
+   * - Field
+     - Description
+   * - ``crawl_duration``
+     - Total time spent walking the directory tree for that snapshot sync. See
+       :ref:`Durations <cephfs_mirror_status_durations>`.
+   * - ``datasync_queue_wait_duration``
+     - Total time the snapshot waited in the data-sync queue before file transfer began. See
+       :ref:`Durations <cephfs_mirror_status_durations>`.
+   * - ``sync_duration``
+     - Total elapsed time for the snapshot sync. See :ref:`Durations <cephfs_mirror_status_durations>`.
+   * - ``sync_time_stamp``
+     - When the sync finished. See :ref:`Timestamp <cephfs_mirror_status_timestamp>`.
+   * - ``sync_bytes``
+     - Total file data synchronized for that snapshot. See
+       :ref:`Data sizes <cephfs_mirror_status_data_sizes>`.
+   * - ``sync_files``
+     - Number of files synchronized for that snapshot. See :ref:`Counts <cephfs_mirror_status_counts>`.
+
 When a directory experiences a configured number of consecutive synchronization failures, the
 mirror daemon marks it as ``failed``. Synchronization for these directories is retried.
 By default, the number of consecutive failures before a directory is marked as failed
@@ -419,24 +612,37 @@ E.g., adding a regular file for synchronization would result in failed status::
   $ ceph fs snapshot mirror add cephfs /f0
   $ ceph --admin-daemon /var/run/ceph/cephfs-mirror.asok fs mirror peer status cephfs@360 a2dc7784-e7a1-4723-b103-03ee8d8768f8
   {
-    "/d0": {
-        "state": "idle",
-        "last_synced_snap": {
-            "id": 121,
-            "name": "snap2",
-            "sync_duration": 5,
-            "sync_time_stamp": "500900.600797s",
-            "sync_bytes": 78643200
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "idle",
+                    "last_synced_snap": {
+                        "id": 121,
+                        "name": "snap2",
+                        "crawl_duration": "2s",
+                        "datasync_queue_wait_duration": "1s",
+                        "sync_duration": "44s",
+                        "sync_time_stamp": "500900.600797s",
+                        "sync_bytes": "149.94 MiB",
+                        "sync_files": 5000
+                    },
+                    "snaps_synced": 3,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
         },
-        "snaps_synced": 3,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
-    },
-    "/f0": {
-        "state": "failed",
-        "snaps_synced": 0,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
+        "/f0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "failed",
+                    "snaps_synced": 0,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
     }
   }
 
@@ -454,24 +660,38 @@ In the remote filesystem::
 
   $ ceph --admin-daemon /var/run/ceph/cephfs-mirror.asok fs mirror peer status cephfs@360 a2dc7784-e7a1-4723-b103-03ee8d8768f8
   {
-    "/d0": {
-        "state": "failed",
-        "failure_reason": "snapshot 'snap2' has invalid metadata",
-        "last_synced_snap": {
-            "id": 120,
-            "name": "snap1",
-            "sync_duration": 3,
-            "sync_time_stamp": "274900.558797s"
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "failed",
+                    "failure_reason": "snapshot 'snap2' has invalid metadata",
+                    "last_synced_snap": {
+                        "id": 120,
+                        "name": "snap1",
+                        "crawl_duration": "2s",
+                        "datasync_queue_wait_duration": "1s",
+                        "sync_duration": "33s",
+                        "sync_time_stamp": "274900.558797s",
+                        "sync_bytes": "149.94 MiB",
+                        "sync_files": 5000
+                    },
+                    "snaps_synced": 2,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
         },
-        "snaps_synced": 2,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
-    },
-    "/f0": {
-        "state": "failed",
-        "snaps_synced": 0,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
+        "/f0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "failed",
+                    "snaps_synced": 0,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
     }
   }
 
diff --git a/doc/dev/cephfs-mirroring.rst b/doc/dev/cephfs-mirroring.rst
index 9fe072967f3..9cba6cce34c 100644
--- a/doc/dev/cephfs-mirroring.rst
+++ b/doc/dev/cephfs-mirroring.rst
@@ -393,20 +393,35 @@ status. Commands of this kind take the form ``filesystem-name@filesystem-id peer
 ::
 
   {
-    "/d0": {
-        "state": "idle",
-        "last_synced_snap": {
-            "id": 120,
-            "name": "snap1",
-            "sync_duration": 0.079997898999999997,
-            "sync_time_stamp": "274900.558797s"
-        },
-        "snaps_synced": 2,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "idle",
+                    "last_synced_snap": {
+                        "id": 120,
+                        "name": "snap1",
+                        "crawl_duration": "2s",
+                        "datasync_queue_wait_duration": "1s",
+                        "sync_duration": "33s",
+                        "sync_time_stamp": "274900.558797s",
+                        "sync_bytes": "149.94 MiB",
+                        "sync_files": 5000
+                    },
+                    "snaps_synced": 2,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
     }
   }
 
+Several fields in the status output are formatted for readability rather than reported as raw
+numbers. See :ref:`Value formatting <cephfs_mirror_peer_status_formatting>` in
+:doc:`/cephfs/cephfs-mirroring` for duration, data size, throughput, percentage, count, and
+timestamp formats.
+
 Synchronization stats such as ``snaps_synced``, ``snaps_deleted`` and
 ``snaps_renamed`` are reset when the daemon is restarted or (when multiple
 mirror daemons are deployed), when a directory is reassigned to another mirror
@@ -419,6 +434,49 @@ A directory can be in one of the following states::
   - `syncing`: The directory is currently being synchronized
   - `failed`: The directory has hit upper limit of consecutive failures
 
+::
+
+  {
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "syncing",
+                    "current_syncing_snap": {
+                        "id": 121,
+                        "name": "snap2",
+                        "sync-mode": "full",
+                        "avg_read_throughput_bytes": "13.03 MiB/s",
+                        "avg_write_throughput_bytes": "24.24 MiB/s",
+                        "crawl": {
+                            "state": "completed",
+                            "duration": "2s"
+                        },
+                        "datasync_queue_wait": {
+                            "state": "complete",
+                            "duration": "1s"
+                        },
+                        "bytes": {
+                            "sync_bytes": "60.40 MiB",
+                            "total_bytes": "149.94 MiB",
+                            "sync_percent": "40.29%"
+                        },
+                        "files": {
+                            "sync_files": 2013,
+                            "total_files": 5000,
+                            "sync_percent": "40.26%"
+                        },
+                        "eta": "7s"
+                    },
+                    "snaps_synced": 2,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
+    }
+  }
+
 When a directory hits a configured number of consecutive synchronization
 failures, the mirror daemon marks it as ``failed``. Synchronization for these
 directories is retried. By default, the number of consecutive failures before a
@@ -439,23 +497,37 @@ status:
 ::
 
   {
-    "/d0": {
-        "state": "idle",
-        "last_synced_snap": {
-            "id": 120,
-            "name": "snap1",
-            "sync_duration": 0.079997898999999997,
-            "sync_time_stamp": "274900.558797s"
+    "metrics": {
+        "/d0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "idle",
+                    "last_synced_snap": {
+                        "id": 120,
+                        "name": "snap1",
+                        "crawl_duration": "2s",
+                        "datasync_queue_wait_duration": "1s",
+                        "sync_duration": "33s",
+                        "sync_time_stamp": "274900.558797s",
+                        "sync_bytes": "149.94 MiB",
+                        "sync_files": 5000
+                    },
+                    "snaps_synced": 2,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
         },
-        "snaps_synced": 2,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
-    },
-    "/f0": {
-        "state": "failed",
-        "snaps_synced": 0,
-        "snaps_deleted": 0,
-        "snaps_renamed": 0
+        "/f0": {
+            "peer": {
+                "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                    "state": "failed",
+                    "snaps_synced": 0,
+                    "snaps_deleted": 0,
+                    "snaps_renamed": 0
+                }
+            }
+        }
     }
   }
 

From 1d676c2455ace8eb2bda07dd0b8c3057324dc38b Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 26 May 2026 00:14:03 +0530
Subject: [PATCH 220/596] qa: Add mirror metrics testcases

Add testcases for newly introduced mirror
metrics and validate it via 'fs mirror peer status'
asok interface.

Fixes: https://tracker.ceph.com/issues/73453
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 qa/tasks/cephfs/test_mirroring.py | 114 ++++++++++++++++++++++++++++++
 1 file changed, 114 insertions(+)

diff --git a/qa/tasks/cephfs/test_mirroring.py b/qa/tasks/cephfs/test_mirroring.py
index e5f7ac27884..1adb16e87d5 100644
--- a/qa/tasks/cephfs/test_mirroring.py
+++ b/qa/tasks/cephfs/test_mirroring.py
@@ -1,4 +1,5 @@
 import os
+import re
 import json
 import base64
 import errno
@@ -260,8 +261,62 @@ class TestMirroring(CephFSTestCase):
         self.assertEqual(peer['stats']['recovery_count'], 1)
 
     def peer_dir_status(self, res, dir_name, peer_uuid):
+        self.assertIn('metrics', res)
         return res['metrics'][dir_name]['peer'][peer_uuid]
 
+    def assert_last_synced_snap_metrics(self, last_synced_snap):
+        for key in ('crawl_duration', 'datasync_queue_wait_duration', 'sync_duration',
+                    'sync_time_stamp', 'sync_bytes', 'sync_files'):
+            self.assertIn(key, last_synced_snap, msg=f'missing last_synced_snap.{key}')
+        self.assertRegex(
+            last_synced_snap['sync_bytes'],
+            r'^\d+(\.\d+)?\s+(B|KiB|MiB|GiB|TiB|PiB)$')
+        self.assertIsInstance(last_synced_snap['sync_files'], int)
+        self.assertGreaterEqual(last_synced_snap['sync_files'], 0)
+
+    def assert_syncing_snap_metrics(self, snap, sync_mode=None):
+        for key in ('sync-mode', 'avg_read_throughput_bytes', 'avg_write_throughput_bytes',
+                    'crawl', 'bytes', 'files', 'eta'):
+            self.assertIn(key, snap, msg=f'missing current_syncing_snap.{key}')
+        if sync_mode is not None:
+            self.assertEqual(snap['sync-mode'], sync_mode)
+        self.assertTrue(snap['avg_read_throughput_bytes'].endswith('/s'))
+        self.assertTrue(snap['avg_write_throughput_bytes'].endswith('/s'))
+        self.assertIn(snap['crawl']['state'], ('in-progress', 'completed'))
+        self.assertTrue(snap['crawl']['duration'])
+        bytes_obj = snap['bytes']
+        self.assertIn('sync_bytes', bytes_obj)
+        self.assertIn('total_bytes', bytes_obj)
+        if bytes_obj.get('total_bytes') and bytes_obj['total_bytes'] != '0.00 B':
+            self.assertIn('sync_percent', bytes_obj)
+        files_obj = snap['files']
+        self.assertIn('sync_files', files_obj)
+        self.assertIn('total_files', files_obj)
+        if files_obj.get('total_files', 0) > 0:
+            self.assertIn('sync_percent', files_obj)
+        self.assertTrue(
+            snap['eta'] == 'calculating...' or bool(re.search(r'\d', snap['eta'])))
+
+    @retry_assert(timeout=120, interval=1)
+    def check_peer_syncing_progress_metrics(self, fs_name, fs_id, peer_spec, dir_name,
+                                            snap_name, sync_mode=None):
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        res = self.mirror_daemon_command(f'peer status for fs: {fs_name}',
+                                         'fs', 'mirror', 'peer', 'status',
+                                         f'{fs_name}@{fs_id}', peer_uuid)
+        try:
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            self.assertEqual(dir_stat['state'], 'syncing')
+            snap = dir_stat['current_syncing_snap']
+            self.assertEqual(snap['name'], snap_name)
+            self.assert_syncing_snap_metrics(snap, sync_mode=sync_mode)
+            if 'datasync_queue_wait' in snap:
+                self.assertIn(snap['datasync_queue_wait']['state'],
+                              ('waiting', 'completed'))
+        except RETRY_EXCEPTIONS as e:
+            e.res = res
+            raise
+
     @retry_assert(timeout=60, interval=3)
     def check_peer_status_empty(self, fs_name, fs_id, peer_spec):
         peer_uuid = self.get_peer_uuid(peer_spec)
@@ -1595,6 +1650,7 @@ class TestMirroring(CephFSTestCase):
                    failure_reason == dir_stat.get('failure_reason', {}) and \
                    snap_name == dir_stat['last_synced_snap']['name'] and \
                    expected_snap_count == dir_stat['snaps_synced']):
+                    self.assert_last_synced_snap_metrics(dir_stat['last_synced_snap'])
                     break
         # remove the directory in the remote fs and check status restores to 'idle'
         self.mount_b.run_shell(['sudo', 'rmdir', remote_snap_path], omit_sudo=False)
@@ -1607,9 +1663,67 @@ class TestMirroring(CephFSTestCase):
                 if('idle' == dir_stat['state'] and 'failure_reason' not in dir_stat and \
                    snap_name == dir_stat['last_synced_snap']['name'] and \
                    expected_snap_count == dir_stat['snaps_synced']):
+                    self.assert_last_synced_snap_metrics(dir_stat['last_synced_snap'])
                     break
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
 
+    def test_cephfs_mirror_peer_status_last_synced_metrics(self):
+        """Peer status last_synced_snap reports new sync timing and size metrics."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+
+        dir_name = 'metrics_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 50, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap_name = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap_name}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap_name, 1)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        res = self.mirror_daemon_command(f'peer status for fs: {self.primary_fs_name}',
+                                         'fs', 'mirror', 'peer', 'status',
+                                         f'{self.primary_fs_name}@{self.primary_fs_id}',
+                                         peer_uuid)
+        self.assert_last_synced_snap_metrics(
+            self.peer_dir_status(res, f'/{dir_name}', peer_uuid)['last_synced_snap'])
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_cephfs_mirror_peer_status_syncing_progress_metrics(self):
+        """Peer status current_syncing_snap reports sync progress metrics."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+
+        dir_name = 'd0'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 3000, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap0 = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap0}'])
+        self.check_peer_syncing_progress_metrics(
+            self.primary_fs_name, self.primary_fs_id, peer_spec, f'/{dir_name}',
+            snap0, sync_mode='full')
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, f'/{dir_name}', snap0, 1)
+
+        self.mount_a.write_n_mb(os.path.join(dir_name, 'file.0'), 1)
+        self.mount_a.create_n_files(f'{dir_name}/snapdiff_file', 3000, sync=True)
+        snap1 = 'snap1'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap1}'])
+        self.check_peer_syncing_progress_metrics(
+            self.primary_fs_name, self.primary_fs_id, peer_spec, f'/{dir_name}',
+            snap1, sync_mode='delta')
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, f'/{dir_name}', snap1, 2)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
     def test_cephfs_mirror_sync_already_existing_snapshots(self):
         """
         That mirroring syncs the already existing snapshot correctly.

From d5da88d349bd0f8f34cbb7968f491a1f50167e58 Mon Sep 17 00:00:00 2001
From: Josh Durgin <jdurgin@redhat.com>
Date: Fri, 12 Jun 2026 13:34:25 -0700
Subject: [PATCH 221/596] scripts/ceph-release-notes: use raw strings for
 escaped characters

And don't escape literals in strip().
This is required in newer python versions.

Signed-off-by: Josh Durgin <jdurgin@redhat.com>
---
 src/script/ceph-release-notes | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/script/ceph-release-notes b/src/script/ceph-release-notes
index 78dfc58fd6a..15b33d7d037 100755
--- a/src/script/ceph-release-notes
+++ b/src/script/ceph-release-notes
@@ -42,14 +42,14 @@ reviewed_by_re = re.compile(r"Rev(.*)By", re.IGNORECASE)
 labels = {'bluestore', 'build/ops', 'cephfs', 'common', 'core', 'mgr',
           'mon', 'performance', 'pybind', 'rdma', 'rgw', 'rbd', 'tests',
           'tools'}
-merge_re = re.compile("Merge (pull request|PR) #(\d+).*")
+merge_re = re.compile(r"Merge (pull request|PR) #(\d+).*")
 # prefixes is the list of commit description prefixes we recognize
 prefixes = ['bluestore', 'build/ops', 'cephfs', 'cephx', 'cli', 'cmake',
             'common', 'core', 'crush', 'doc', 'fs', 'librados', 'librbd',
             'log', 'mds', 'mgr', 'mon', 'msg', 'objecter', 'osd', 'pybind',
             'rbd', 'rbd-mirror', 'rbd-nbd', 'rgw', 'tests', 'tools']
-signed_off_re = re.compile("Signed-off-by: (.+) <")
-tracker_re = re.compile("http://tracker.ceph.com/issues/(\d+)")
+signed_off_re = re.compile(r"Signed-off-by: (.+) <")
+tracker_re = re.compile(r"http://tracker.ceph.com/issues/(\d+)")
 rst_link_re = re.compile(r"([a-zA-Z0-9])_(\W)")
 release_re = re.compile(r"^(nautilus|octopus|pacific|quincy|reef|squid|tentacle|umbrella):\s*", re.IGNORECASE)
 
@@ -216,14 +216,14 @@ def make_release_notes(gh, repo, ref, cherry_picks, plaintext, html, markdown, v
                     "{sha1}^1..{sha1}^2".format(sha1=commit.hexsha)
                     ):
                 for author in re.findall(
-                        "Signed-off-by:\s*(.*?)\s*<", c.message
+                        r"Signed-off-by:\s*(.*?)\s*<", c.message
                         ):
                     authors[author] = 1
                     issues.extend(fixes_re.findall(c.message) +
                             tracker_re.findall(c.message))
         else:
             for author in re.findall(
-                    "Signed-off-by:\s*(.*?)\s*<", message
+                    r"Signed-off-by:\s*(.*?)\s*<", message
                     ):
                 if author == "[Your Name]":
                     continue
@@ -243,7 +243,7 @@ def make_release_notes(gh, repo, ref, cherry_picks, plaintext, html, markdown, v
 
         if strict:
             title_re = (
-                '^(?:nautilus|octopus|pacific|quincy):\s+(' +
+                r'^(?:nautilus|octopus|pacific|quincy):\s+(' +
                 '|'.join(prefixes) +
                 ')(:.*)'
             )
@@ -257,10 +257,10 @@ def make_release_notes(gh, repo, ref, cherry_picks, plaintext, html, markdown, v
         if use_tags:
             title = split_component(title, gh, number)
 
-        title = title.strip(' \t\n\r\f\v\.\,\;\:\-\=')
+        title = title.strip(' \t\n\r\f\v.,;:-=')
         # escape asterisks, which is used by reStructuredTextrst for inline
         # emphasis
-        title = title.replace('*', '\*')
+        title = title.replace('*', r'\*')
         # and escape the underscores for noting a link
         title = rst_link_re.sub(r'\1\_\2', title)
         # remove release prefix for backports
@@ -326,7 +326,7 @@ def make_release_notes(gh, repo, ref, cherry_picks, plaintext, html, markdown, v
                 )
             )
         elif markdown:
-            markdown_title = title.replace('_', '\_').replace('.', '<span></span>.')
+            markdown_title = title.replace('_', r'\_').replace('.', '<span></span>.')
             print ("- {title} ({issues}[pr#{pr}](https://github.com/ceph/ceph/pull/{pr}), {author})\n".format(
                     title=markdown_title,
                     issues=issues,

From 1dda56b1a00a6cbf520d932332ff097716ab256e Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sat, 13 Jun 2026 09:50:09 +0800
Subject: [PATCH 222/596] python-common/cryptotools: stop using the removed
 X509Req API

pyOpenSSL deprecated OpenSSL.crypto.X509Req in 24.2.0 (2024-07-20) and
removed it in 26.3.0 (2026-06-12). as we don't pin pyopenssl, CI picked
up the new release, and create_self_signed_cert() started failing with:

  AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Req'

this took down run-tox-mgr, run-tox-mgr-dashboard-py3 and the mypy check.

we only used X509Req to build a subject name and then copied it into the
X509 cert. so drop it, and set the subject on the cert directly. the
resulting cert stays the same: subject from dname, issuer set to the same
subject, self-signed.

Fixes: https://tracker.ceph.com/issues/77391
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/python-common/ceph/cryptotools/internal.py | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/src/python-common/ceph/cryptotools/internal.py b/src/python-common/ceph/cryptotools/internal.py
index 7d6e0a487ec..db3d6a5c048 100644
--- a/src/python-common/ceph/cryptotools/internal.py
+++ b/src/python-common/ceph/cryptotools/internal.py
@@ -45,19 +45,13 @@ class InternalCryptoCaller(CryptoCaller):
     ) -> str:
         _pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, pkey)
 
-        # Create a "subject" object
-        with warnings.catch_warnings():
-            warnings.simplefilter("ignore")
-            req = crypto.X509Req()
-        subj = req.get_subject()
-
-        # populate the subject with the dname settings
+        # create a self-signed cert and populate its subject with the dname
+        # settings
+        cert = crypto.X509()
+        subj = cert.get_subject()
         for k, v in dname.items():
             setattr(subj, k, v)
-
-        # create a self-signed cert
-        cert = crypto.X509()
-        cert.set_subject(req.get_subject())
+        cert.set_subject(subj)
         cert.set_serial_number(int(uuid4()))
         cert.gmtime_adj_notBefore(0)
         cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)  # 10 years

From ede8e34f61baf53d3bd516c4492c09c433cefbc0 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 12 Jun 2026 18:17:26 +0800
Subject: [PATCH 223/596] cmake: find Protobuf via cmake config before module
 mode

Module-mode FindProtobuf defines only the classic targets, so
gRPCConfig.cmake's find_dependency(Protobuf) fails on the partial
export set. Prefer config mode; fall back to module mode.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/CMakeLists.txt | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index a93a38d7501..552dd7d760d 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -1023,10 +1023,12 @@ option(WITH_NVMEOF_GATEWAY_MONITOR_CLIENT "build nvmeof gateway monitor client"
 
 if(WITH_NVMEOF_GATEWAY_MONITOR_CLIENT)
 
-  # Find Protobuf installation
-  # Looks for protobuf-config.cmake file installed by Protobuf's cmake installation.
-  option(protobuf_MODULE_COMPATIBLE TRUE)
-  find_package(Protobuf REQUIRED)
+  # Prefer config mode so gRPC sees protobuf's full target set
+  # (incl. upb); fall back to module mode.
+  find_package(Protobuf CONFIG)
+  if(NOT Protobuf_FOUND)
+    find_package(Protobuf REQUIRED)
+  endif()
 
   set(_REFLECTION grpc++_reflection)
   if(CMAKE_CROSSCOMPILING)

From d688bc8f341df846d89f7c119b5528fe367ad66c Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sun, 14 Jun 2026 09:23:39 +0800
Subject: [PATCH 224/596] mgr/dashboard: fix "welcome" page reference in
 add-host e2e feature

0fb99092ef2 renamed the cypress page-registry key "welcome" to
"onboarding" in urls.po.ts and updated 01-create-cluster-welcome.feature,
but missed the Background of 02-create-cluster-add-host.feature. so
urlsCollection.pages["welcome"] is undefined and the step fails with

  TypeError: Cannot read properties of undefined (reading 'url')
   at cypress/e2e/common/global.feature.po.ts:12

this fails the Background of every scenario in the spec, and cascades to
the later create-cluster specs that depend on the expanded cluster.

update the reference to "onboarding" to match the registry.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 .../orchestrator/workflow/02-create-cluster-add-host.feature    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/02-create-cluster-add-host.feature b/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/02-create-cluster-add-host.feature
index 4709f36e9c4..7228f0c67a6 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/02-create-cluster-add-host.feature
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/02-create-cluster-add-host.feature
@@ -6,7 +6,7 @@ Feature: Cluster expansion host addition
 
     Background: Cluster expansion wizard
         Given I am logged in
-        And I am on the "welcome" page
+        And I am on the "onboarding" page
         And I click on "Add Storage" button
 
     Scenario Outline: Add hosts

From a3dad559e87600b394d80cd51b244b0dcc3f31d9 Mon Sep 17 00:00:00 2001
From: Nitzan Mordechai <nmordech@ibm.com>
Date: Sun, 14 Jun 2026 07:55:36 +0000
Subject: [PATCH 225/596] mgr: handle SIGTERM/SIGINT in standby mgr to avoid
 CEPHADM_FAILED_DAEMON

MgrStandby only registered SIGHUP, leaving SIGTERM/SIGINT at OS defaults.
When a standby is stopped via `ceph orch daemon stop`, SIGTERM terminates
it with exit code 143, causing systemd to mark the unit as failed instead
of stopped, which triggers CEPHADM_FAILED_DAEMON.

Mirror the handler already used in Mgr::init() for the active mgr.

Fixes: https://tracker.ceph.com/issues/77116
Signed-off-by: Nitzan Mordechai <nmordech@ibm.com>
---
 src/mgr/MgrStandby.cc | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/mgr/MgrStandby.cc b/src/mgr/MgrStandby.cc
index b0cfedbcc02..70db2135966 100644
--- a/src/mgr/MgrStandby.cc
+++ b/src/mgr/MgrStandby.cc
@@ -153,11 +153,18 @@ int MgrStandby::asok_command(std::string_view cmd, const cmdmap_t& cmdmap, Forma
   }
 }
 
+static void handle_standby_mgr_signal(int signum)
+{
+  derr << " *** Got signal " << sig_str(signum) << " ***" << dendl;
+  _exit(0);
+}
+
 int MgrStandby::init()
 {
   init_async_signal_handler();
   register_async_signal_handler(SIGHUP, sighup_handler);
-
+  register_async_signal_handler_oneshot(SIGTERM, handle_standby_mgr_signal);
+  register_async_signal_handler_oneshot(SIGINT, handle_standby_mgr_signal);
   cct->_conf.add_observer(this);
 
   std::lock_guard l(lock);
@@ -495,6 +502,8 @@ int MgrStandby::main(vector<const char *> args)
 
   // Disable signal handlers
   unregister_async_signal_handler(SIGHUP, sighup_handler);
+  unregister_async_signal_handler(SIGTERM, handle_standby_mgr_signal);
+  unregister_async_signal_handler(SIGINT, handle_standby_mgr_signal);
   shutdown_async_signal_handler();
 
   return 0;

From b57373872265c199ea986cdb259e4664c1cb4149 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 14 Jun 2026 22:29:54 +0800
Subject: [PATCH 226/596] build/script: print sccache stats alongside ccache

sccache is enabled via WITH_SCCACHE, but run-make.sh only printed
ccache statistics after the build. Print `sccache --show-stats` too
when sccache is available.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/script/run-make.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/script/run-make.sh b/src/script/run-make.sh
index 30ca35ce274..236af0cf669 100755
--- a/src/script/run-make.sh
+++ b/src/script/run-make.sh
@@ -190,6 +190,10 @@ function build() {
     ci_debug "Running cmake"
     $DRY_RUN cmake --build . $targets -- $BUILD_MAKEOPTS || return 1
     $DRY_RUN ccache -s # print the ccache statistics to evaluate the efficiency
+    # print sccache stats too when built with WITH_SCCACHE
+    if type sccache > /dev/null 2>&1; then
+        $DRY_RUN sccache --show-stats
+    fi
 }
 
 DEFAULT_MAKEOPTS=${DEFAULT_MAKEOPTS:--j$(get_processors)}

From 28a2a2c8821cf0fb79c0345a368f0f951d455223 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 15 Jun 2026 00:11:02 +0530
Subject: [PATCH 227/596] qa/cephfs: Add test for duplicate directory acquire
 notify

Verify that reloading the mirroring module and removing a directory
does not leave a ghost replayer entry that keeps syncing snapshots.

Fixes: https://tracker.ceph.com/issues/77398
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 qa/tasks/cephfs/test_mirroring.py | 81 +++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/qa/tasks/cephfs/test_mirroring.py b/qa/tasks/cephfs/test_mirroring.py
index 74bdb591757..f75f0216112 100644
--- a/qa/tasks/cephfs/test_mirroring.py
+++ b/qa/tasks/cephfs/test_mirroring.py
@@ -89,6 +89,37 @@ class TestMirroring(CephFSTestCase):
     def disable_mirroring_module(self):
         self.run_ceph_cmd("mgr", "module", "disable", TestMirroring.MODULE_NAME)
 
+    def is_mirroring_module_enabled(self):
+        modules = json.loads(
+            self.get_ceph_cmd_stdout('mgr', 'module', 'ls', '--format', 'json'))
+        return self.MODULE_NAME in modules.get('enabled_modules', [])
+
+    def wait_mirroring_module_disabled(self):
+        with safe_while(sleep=1, tries=30,
+                        action='wait for mirroring module disable') as proceed:
+            while proceed():
+                if not self.is_mirroring_module_enabled():
+                    return
+
+    def wait_mirroring_module_reload(self, fs_name, dir_name):
+        """Wait for mirroring module enable and directory re-acquire after reload."""
+        with safe_while(sleep=2, tries=60,
+                        action='wait for mirroring module reload') as proceed:
+            while proceed():
+                if not self.is_mirroring_module_enabled():
+                    continue
+                dirmap = self.mirror_dirmap(fs_name, dir_name)
+                if dirmap.get('state') == 'mapped':
+                    return
+
+    def wait_directory_mapped(self, fs_name, dir_name):
+        with safe_while(sleep=2, tries=30,
+                        action='wait for directory to be mapped') as proceed:
+            while proceed():
+                dirmap = self.mirror_dirmap(fs_name, dir_name)
+                if dirmap.get('state') == 'mapped':
+                    return
+
     def enable_mirroring(self, fs_name, fs_id):
         res = self.mirror_daemon_command(f'counter dump for fs: {fs_name}', 'counter', 'dump')
         vbefore = res[TestMirroring.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR][0]
@@ -417,6 +448,19 @@ class TestMirroring(CephFSTestCase):
         log.debug(f'destination snapshot checksum {snap_name} {dest_res}')
         self.assertTrue(source_res == dest_res)
 
+    def mirror_dirmap(self, fs_name, dir_name):
+        return json.loads(self.get_ceph_cmd_stdout(
+            'fs', 'snapshot', 'mirror', 'dirmap', fs_name, dir_name))
+
+    @retry_assert(timeout=60, interval=5)
+    def assert_snapshot_not_synced(self, dir_name, snap_name):
+        """Assert a snapshot on the primary has not appeared on the secondary."""
+        try:
+            snap_list = self.mount_b.ls(path=f'{dir_name}/.snap')
+        except CommandFailedError:
+            return
+        self.assertNotIn(snap_name, snap_list)
+
     @retry_assert(timeout=150, interval=5)
     def verify_failed_directory(self, fs_name, fs_id, peer_spec, dir_name):
         peer_uuid = self.get_peer_uuid(peer_spec)
@@ -1970,3 +2014,40 @@ class TestMirroring(CephFSTestCase):
 
         self.config_set('client.mirror', 'cephfs_mirror_distribute_datasync_threads', 'true')
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_cephfs_mirror_duplicate_acquire_notify(self):
+        """Duplicate acquire notifies must not leave a ghost replayer directory.
+
+        Disabling and re-enabling the mirroring module reloads FSPolicy from omap
+        and re-sends acquire for mapped directories. Without an idempotent
+        PeerReplayer::add_directory(), a duplicate vector entry survives
+        remove_directory() (only one list entry is erased) and the replayer
+        keeps syncing after the directory is removed from mirroring.
+
+        Without the fix, a ghost entry may also crash the replayer thread when
+        pick_directory() calls m_snap_sync_stats.at() after remove erased the map
+        entry; this test catches spurious sync when that path still runs.
+        """
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'dup_acquire_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        self.wait_directory_mapped(self.primary_fs_name, f'/{dir_name}')
+
+        self.disable_mirroring_module()
+        self.wait_mirroring_module_disabled()
+        self.enable_mirroring_module()
+        self.wait_mirroring_module_reload(self.primary_fs_name, f'/{dir_name}')
+
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap_name = 'snap_after_remove'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap_name}'])
+        self.assert_snapshot_not_synced(dir_name, snap_name)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)

From e74f11546a1b2b57ce9358c89785bddc843cfe5e Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 15 Jun 2026 00:11:07 +0530
Subject: [PATCH 228/596] tools/cephfs_mirror: Ignore duplicate directory
 acquire notifications

Make PeerReplayer::add_directory() idempotent when the mgr re-sends
acquire for a directory already in the replayer list.

Fixes: https://tracker.ceph.com/issues/77398
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 7ee7e06b757..93bc04ddaf8 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -357,10 +357,16 @@ void PeerReplayer::shutdown() {
 
 void PeerReplayer::add_directory(string_view dir_root) {
   dout(20) << ": dir_root=" << dir_root << dendl;
+  auto _dir_root = std::string(dir_root);
 
   std::scoped_lock locker(m_lock);
-  m_directories.emplace_back(dir_root);
-  m_snap_sync_stats.emplace(dir_root, SnapSyncStat());
+  if (std::find(m_directories.begin(), m_directories.end(), _dir_root) !=
+      m_directories.end()) {
+    dout(10) << ": dir_root=" << _dir_root << " already in replay list" << dendl;
+    return;
+  }
+  m_directories.emplace_back(_dir_root);
+  m_snap_sync_stats.emplace(_dir_root, SnapSyncStat());
   m_cond.notify_all();
 }
 

From 056b70613154506c55214e0dda85a4472d1b106e Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 15 Jun 2026 04:45:37 +0800
Subject: [PATCH 229/596] rgw: declare rgw_a's dependency on rgw_schedulers and
 kmip

rgw_a uses rgw::dmclock::* (rgw_schedulers) and kmip_* (kmip) but never
declared either, so each consumer relinked them by hand. ld.bfd hid this
via lazy archive extraction; mold pulls the members and fails with
undefined symbols. Declare it on rgw_a (PRIVATE) and drop the now
redundant explicit links from radosgw and the rgw shared library.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/rgw/CMakeLists.txt | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/rgw/CMakeLists.txt b/src/rgw/CMakeLists.txt
index f0f605d6200..a8082f580ad 100644
--- a/src/rgw/CMakeLists.txt
+++ b/src/rgw/CMakeLists.txt
@@ -508,6 +508,10 @@ if(COMPILER_SUPPORTS_VLA_ERROR)
     $<$<COMPILE_LANGUAGE:CXX>:-Werror=vla>)
 endif()
 
+# rgw_a references rgw::dmclock::* (rgw_schedulers) and kmip_* (kmip); declare
+# it here so the dependency propagates to every consumer. PRIVATE: not in headers.
+target_link_libraries(rgw_a PRIVATE rgw_schedulers kmip)
+
 set(radosgw_srcs
   rgw_main.cc)
 
@@ -532,8 +536,6 @@ target_include_directories(radosgw SYSTEM PUBLIC "../rapidjson/include")
 target_link_libraries(radosgw PRIVATE
   legacy-option-headers
   ${rgw_libs}
-  rgw_schedulers
-  kmip
   ${ALLOC_LIBS})
 
 install(TARGETS radosgw DESTINATION bin)
@@ -642,8 +644,6 @@ target_include_directories(rgw SYSTEM PUBLIC "../rapidjson/include")
 target_link_libraries(rgw
   PRIVATE
   ${rgw_libs}
-  rgw_schedulers
-  kmip
   librados
   cls_rgw_client
   cls_otp_client

From 13b334507f92e00dc55e2039550260295243c5cc Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Sun, 14 Jun 2026 11:17:27 -0400
Subject: [PATCH 230/596] script/ptl-tool: address datetime warning

    /home/runner/work/ceph/ceph/src/script/ptl-tool.py:1743: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 src/script/ptl-tool.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/script/ptl-tool.py b/src/script/ptl-tool.py
index 762069ca3b5..a9bb69f953f 100755
--- a/src/script/ptl-tool.py
+++ b/src/script/ptl-tool.py
@@ -1629,7 +1629,7 @@ def manage_qa_tracker(args, R, session, branch, prs, tag, qa_tracker_description
                     log.error(f"Failed to post comment: {r.status_code} {r.text}")
 
     elif args.create_qa:
-        now_str = datetime.datetime.utcnow().strftime("%Y-%m-%d-%H:%M")
+        now_str = datetime.datetime.now(datetime.UTC).strftime("%Y-%m-%d-%H:%M")
         default_subject = f"{base} integration testing by {USER} started {now_str}"
         issue_kwargs['subject'] = args.qa_subject if args.qa_subject else default_subject
 
@@ -1740,7 +1740,7 @@ def build_branch(args):
         args.skip_conflict_check = True
 
     # Compute branch names now that integration flags and auto-detect have settled
-    branch = datetime.datetime.utcnow().strftime(args.branch).format(user=USER)
+    branch = datetime.datetime.now(datetime.UTC).strftime(args.branch).format(user=USER)
     if args.branch_release:
         branch = branch + "-" + args.branch_release
     if args.branch_append:

From 88b9725be03dcd9267f8ab224dfd68be73631810 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Fri, 29 May 2026 10:40:45 -0400
Subject: [PATCH 231/596] script/ptl-tool: source githubmap only when producing
 credits

Assisted-by: Gemini
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 src/script/ptl-tool.py | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/src/script/ptl-tool.py b/src/script/ptl-tool.py
index 762069ca3b5..a2d9d781db1 100755
--- a/src/script/ptl-tool.py
+++ b/src/script/ptl-tool.py
@@ -1675,20 +1675,6 @@ def build_branch(args):
 
     G = git.Repo(args.git)
 
-    try:
-        c = resolve_ref(G, 'main', BASE_REMOTE_URL, args.always_fetch)
-        githubmap_content = G.git.show(f"{c.hexsha}:.githubmap")
-        comment = re.compile(r"\s*#")
-        patt = re.compile(r"([\w-]+)\s+(.*)")
-        for line in githubmap_content.splitlines():
-            if comment.match(line):
-                continue
-            m = patt.match(line)
-            if m:
-                CONTRIBUTORS[m.group(1)] = m.group(2)
-    except git.exc.GitCommandError as e:
-        raise SystemExit(f"Could not fetch .githubmap from {BASE_REMOTE_URL}:main:\n{e}")
-
     R = None
     if args.create_qa or args.update_qa or args.audit or args.final_merge:
         log.info("connecting to %s", REDMINE_ENDPOINT)
@@ -1739,6 +1725,21 @@ def build_branch(args):
         args.always_fetch = True
         args.skip_conflict_check = True
 
+    if args.credits:
+        try:
+            c = resolve_ref(G, 'main', BASE_REMOTE_URL, args.always_fetch)
+            githubmap_content = G.git.show(f"{c.hexsha}:.githubmap")
+            comment = re.compile(r"\s*#")
+            patt = re.compile(r"([\w-]+)\s+(.*)")
+            for line in githubmap_content.splitlines():
+                if comment.match(line):
+                    continue
+                m = patt.match(line)
+                if m:
+                    CONTRIBUTORS[m.group(1)] = m.group(2)
+        except git.exc.GitCommandError as e:
+            raise SystemExit(f"Could not fetch .githubmap from {BASE_REMOTE_URL}:main:\n{e}")
+
     # Compute branch names now that integration flags and auto-detect have settled
     branch = datetime.datetime.utcnow().strftime(args.branch).format(user=USER)
     if args.branch_release:

From 648794cce3fdcfad323d3661b75ed15ddc2ffdaa Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Fri, 22 May 2026 10:02:11 -0400
Subject: [PATCH 232/596] script/ptl-tool: do not update PRs for private QA

Assisted-by: Gemini
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 src/script/ptl-tool.py | 70 +++++++++++++++++++++++-------------------
 1 file changed, 38 insertions(+), 32 deletions(-)

diff --git a/src/script/ptl-tool.py b/src/script/ptl-tool.py
index 762069ca3b5..0591c59b661 100755
--- a/src/script/ptl-tool.py
+++ b/src/script/ptl-tool.py
@@ -1604,29 +1604,32 @@ def manage_qa_tracker(args, R, session, branch, prs, tag, qa_tracker_description
                 log.error(f"failed to update {issue}")
                 sys.exit(1)
 
-        for pr in added_prs:
-            body = f"This PR has been added to [{issue.subject}]({issue_url})."
-            if args.dry_run:
-                log.info(f"[DRY RUN] Would post comment to added PR #{pr}: {body}")
-            else:
-                endpoint = f"https://api.github.com/repos/{BASE_PROJECT}/{BASE_REPO}/issues/{pr}/comments"
-                r = session.post(endpoint, auth=GithubBearerAuth(), data=json.dumps({'body':body}))
-                if r.status_code == 201:
-                    log.info(f"Successfully posted added comment to PR #{pr}")
+        if getattr(issue, 'is_private', False):
+            log.info(f"QA ticket {issue.url} is private. Skipping GitHub PR updates for added/removed PRs.")
+        else:
+            for pr in added_prs:
+                body = f"This PR has been added to [{issue.subject}]({issue_url})."
+                if args.dry_run:
+                    log.info(f"[DRY RUN] Would post comment to added PR #{pr}: {body}")
                 else:
-                    log.error(f"Failed to post comment: {r.status_code} {r.text}")
+                    endpoint = f"https://api.github.com/repos/{BASE_PROJECT}/{BASE_REPO}/issues/{pr}/comments"
+                    r = session.post(endpoint, auth=GithubBearerAuth(), data=json.dumps({'body':body}))
+                    if r.status_code == 201:
+                        log.info(f"Successfully posted added comment to PR #{pr}")
+                    else:
+                        log.error(f"Failed to post comment: {r.status_code} {r.text}")
 
-        for pr in removed_prs:
-            body = f"This PR has been removed from [{issue.subject}]({issue_url})."
-            if args.dry_run:
-                log.info(f"[DRY RUN] Would post comment to removed PR #{pr}: {body}")
-            else:
-                endpoint = f"https://api.github.com/repos/{BASE_PROJECT}/{BASE_REPO}/issues/{pr}/comments"
-                r = session.post(endpoint, auth=GithubBearerAuth(), data=json.dumps({'body':body}))
-                if r.status_code == 201:
-                    log.info(f"Successfully posted removed comment to PR #{pr}")
+            for pr in removed_prs:
+                body = f"This PR has been removed from [{issue.subject}]({issue_url})."
+                if args.dry_run:
+                    log.info(f"[DRY RUN] Would post comment to removed PR #{pr}: {body}")
                 else:
-                    log.error(f"Failed to post comment: {r.status_code} {r.text}")
+                    endpoint = f"https://api.github.com/repos/{BASE_PROJECT}/{BASE_REPO}/issues/{pr}/comments"
+                    r = session.post(endpoint, auth=GithubBearerAuth(), data=json.dumps({'body':body}))
+                    if r.status_code == 201:
+                        log.info(f"Successfully posted removed comment to PR #{pr}")
+                    else:
+                        log.error(f"Failed to post comment: {r.status_code} {r.text}")
 
     elif args.create_qa:
         now_str = datetime.datetime.utcnow().strftime("%Y-%m-%d-%H:%M")
@@ -1642,19 +1645,22 @@ def manage_qa_tracker(args, R, session, branch, prs, tag, qa_tracker_description
             log.info("created redmine qa issue: %s", issue.url)
             issue_url = issue.url
 
-        for pr in prs:
-            log.debug(f"Posting QA Run in comment for ={pr}")
-            subject = issue_kwargs['subject']
-            body = f"This PR has been added to [{subject}]({issue_url})."
-            if args.dry_run:
-                log.info(f"[DRY RUN] Would post comment to PR #{pr}: {body}")
-            else:
-                endpoint = f"https://api.github.com/repos/{BASE_PROJECT}/{BASE_REPO}/issues/{pr}/comments"
-                r = session.post(endpoint, auth=GithubBearerAuth(), data=json.dumps({'body':body}))
-                if r.status_code == 201:
-                    log.info(f"Successfully posted comment to PR #{pr}")
+        if args.qa_private:
+            log.info("QA ticket is private. Skipping GitHub PR updates.")
+        else:
+            for pr in prs:
+                log.debug(f"Posting QA Run in comment for ={pr}")
+                subject = issue_kwargs['subject']
+                body = f"This PR has been added to [{subject}]({issue_url})."
+                if args.dry_run:
+                    log.info(f"[DRY RUN] Would post comment to PR #{pr}: {body}")
                 else:
-                    log.error(f"Failed to post comment: {r.status_code} {r.text}")
+                    endpoint = f"https://api.github.com/repos/{BASE_PROJECT}/{BASE_REPO}/issues/{pr}/comments"
+                    r = session.post(endpoint, auth=GithubBearerAuth(), data=json.dumps({'body':body}))
+                    if r.status_code == 201:
+                        log.info(f"Successfully posted comment to PR #{pr}")
+                    else:
+                        log.error(f"Failed to post comment: {r.status_code} {r.text}")
 
 def build_branch(args):
     base = args.base

From 1414770fbb47b8e097885a1f3fb626a82d915488 Mon Sep 17 00:00:00 2001
From: Vallari Agrawal <vallari.agrawal@ibm.com>
Date: Tue, 16 Jun 2026 00:30:12 +0300
Subject: [PATCH 233/596] mgr/dashboard: bump nvmeof submodule to 1.8.2

Update proto files and gateway submodule

Fixes: https://tracker.ceph.com/issues/77422

Signed-off-by: Vallari Agrawal <vallari.agrawal@ibm.com>
---
 src/nvmeof/gateway                            |   2 +-
 .../dashboard/services/proto/gateway.proto    |  25 +
 .../dashboard/services/proto/gateway_pb2.py   | 603 ++++++++++++------
 .../services/proto/gateway_pb2_grpc.py        |  68 ++
 4 files changed, 502 insertions(+), 196 deletions(-)

diff --git a/src/nvmeof/gateway b/src/nvmeof/gateway
index e27436eddac..c862723fe6d 160000
--- a/src/nvmeof/gateway
+++ b/src/nvmeof/gateway
@@ -1 +1 @@
-Subproject commit e27436eddacf8d4b2eace77c5fbd250adf48a155
+Subproject commit c862723fe6dcc2fd3d5217b7fd4772e5311c352e
diff --git a/src/pybind/mgr/dashboard/services/proto/gateway.proto b/src/pybind/mgr/dashboard/services/proto/gateway.proto
index 9ab09941741..7ea29a47e1e 100644
--- a/src/pybind/mgr/dashboard/services/proto/gateway.proto
+++ b/src/pybind/mgr/dashboard/services/proto/gateway.proto
@@ -71,6 +71,9 @@ service Gateway {
 	// Delete a subsystem network
 	rpc del_subsystem_network(del_subsystem_network_req) returns(req_status) {}
 
+	// Refresh auto-listeners for all network masks configured on the given subsystem on this gateway
+	rpc gw_refresh_network(gw_refresh_network_req) returns(gw_refresh_network_status) {}
+
 	// Add KMIP server endpoints
 	rpc add_kmip_server_endpoints(add_kmip_server_endpoints_req) returns(req_status) {}
 
@@ -125,6 +128,9 @@ service Gateway {
 	// Removes a host from a subsystem
 	rpc remove_host(remove_host_req) returns (req_status) {}
 
+	// Set keep host connected flag
+	rpc set_keep_host_connected(set_keep_host_connected_req) returns (req_status) {}
+
 	// Changes a host inband authentication keys
 	rpc change_host_key(change_host_key_req) returns (req_status) {}
 
@@ -326,6 +332,17 @@ message del_subsystem_network_req {
 	string network_mask = 2;
 }
 
+message gw_refresh_network_req {
+	string subsystem_nqn = 1;
+}
+
+message gw_refresh_network_status {
+	int32 status = 1;
+	string error_message = 2;
+	repeated string added = 3;
+	repeated string removed = 4;
+}
+
 message kmip_server_endpoint {
 	string address = 1;
 	optional uint32 port = 2;
@@ -395,6 +412,12 @@ message remove_host_req {
 	string subsystem_nqn = 1;
 	string host_nqn = 2;
 	optional bool force = 3;
+	optional bool keep_connections = 4;
+}
+
+message set_keep_host_connected_req {
+	string subsystem_nqn = 1;
+	string host_nqn = 2;
 }
 
 message list_hosts_req {
@@ -567,6 +590,7 @@ message namespace {
 	optional string nonce = 7;
 	optional bool auto_visible = 8;
 	repeated string hosts = 9;
+	optional string rados_namespace_name = 10;
 }
 
 message subsystems_info_cli {
@@ -749,6 +773,7 @@ message connection {
 	optional string subsystem = 12;
 	optional bool disconnected_due_to_keepalive_timeout = 13;
 	optional DHCHAPControllerKeyOrigin dhchap_controller_origin = 14;
+	optional bool host_deleted = 15;
 }
 
 message connections_info {
diff --git a/src/pybind/mgr/dashboard/services/proto/gateway_pb2.py b/src/pybind/mgr/dashboard/services/proto/gateway_pb2.py
index 834787e03aa..f09cd3a75b0 100644
--- a/src/pybind/mgr/dashboard/services/proto/gateway_pb2.py
+++ b/src/pybind/mgr/dashboard/services/proto/gateway_pb2.py
@@ -20,7 +20,7 @@ DESCRIPTOR = _descriptor.FileDescriptor(
   syntax='proto3',
   serialized_options=b'Z)github.com/ceph/ceph-nvmeof/lib/go/nvmeof',
   create_key=_descriptor._internal_create_key,
-  serialized_pb=b'\n&dashboard/services/proto/gateway.proto\"\x84\x06\n\x11namespace_add_req\x12\x15\n\rrbd_pool_name\x18\x01 \x01(\t\x12\x16\n\x0erbd_image_name\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\x11\n\x04nsid\x18\x04 \x01(\rH\x00\x88\x01\x01\x12\x12\n\nblock_size\x18\x05 \x01(\r\x12\x11\n\x04uuid\x18\x06 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08\x61nagrpid\x18\x07 \x01(\x05H\x02\x88\x01\x01\x12\x19\n\x0c\x63reate_image\x18\x08 \x01(\x08H\x03\x88\x01\x01\x12\x11\n\x04size\x18\t \x01(\x04H\x04\x88\x01\x01\x12\x12\n\x05\x66orce\x18\n \x01(\x08H\x05\x88\x01\x01\x12\x1c\n\x0fno_auto_visible\x18\x0b \x01(\x08H\x06\x88\x01\x01\x12\x18\n\x0btrash_image\x18\x0c \x01(\x08H\x07\x88\x01\x01\x12 \n\x13\x64isable_auto_resize\x18\r \x01(\x08H\x08\x88\x01\x01\x12\x16\n\tread_only\x18\x0e \x01(\x08H\t\x88\x01\x01\x12\x1f\n\x12rbd_data_pool_name\x18\x0f \x01(\tH\n\x88\x01\x01\x12\x15\n\x08location\x18\x10 \x01(\tH\x0b\x88\x01\x01\x12!\n\x14rados_namespace_name\x18\x11 \x01(\tH\x0c\x88\x01\x01\x12-\n\x12\x65ncryption_entries\x18\x12 \x03(\x0b\x32\x11.encryption_entry\x12\x37\n\x14\x65ncryption_algorithm\x18\x13 \x01(\x0e\x32\x14.EncryptionAlgorithmH\r\x88\x01\x01\x42\x07\n\x05_nsidB\x07\n\x05_uuidB\x0b\n\t_anagrpidB\x0f\n\r_create_imageB\x07\n\x05_sizeB\x08\n\x06_forceB\x12\n\x10_no_auto_visibleB\x0e\n\x0c_trash_imageB\x16\n\x14_disable_auto_resizeB\x0c\n\n_read_onlyB\x15\n\x13_rbd_data_pool_nameB\x0b\n\t_locationB\x17\n\x15_rados_namespace_nameB\x17\n\x15_encryption_algorithm\"{\n\x14namespace_resize_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x10\n\x08new_size\x18\x04 \x01(\x04\x42\x10\n\x0e_OBSOLETE_uuid\"o\n\x1anamespace_get_io_stats_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuid\"h\n\x1clist_namespaces_io_stats_req\x12\x1a\n\rsubsystem_nqn\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x11\n\x04nsid\x18\x02 \x01(\rH\x01\x88\x01\x01\x42\x10\n\x0e_subsystem_nqnB\x07\n\x05_nsid\"\xee\x02\n\x15namespace_set_qos_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x1e\n\x11rw_ios_per_second\x18\x04 \x01(\x04H\x01\x88\x01\x01\x12!\n\x14rw_mbytes_per_second\x18\x05 \x01(\x04H\x02\x88\x01\x01\x12 \n\x13r_mbytes_per_second\x18\x06 \x01(\x04H\x03\x88\x01\x01\x12 \n\x13w_mbytes_per_second\x18\x07 \x01(\x04H\x04\x88\x01\x01\x12\x12\n\x05\x66orce\x18\x08 \x01(\x08H\x05\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuidB\x14\n\x12_rw_ios_per_secondB\x17\n\x15_rw_mbytes_per_secondB\x16\n\x14_r_mbytes_per_secondB\x16\n\x14_w_mbytes_per_secondB\x08\n\x06_force\"\xbe\x01\n)namespace_change_load_balancing_group_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x10\n\x08\x61nagrpid\x18\x04 \x01(\x05\x12\x1a\n\rauto_lb_logic\x18\x05 \x01(\x08H\x01\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuidB\x10\n\x0e_auto_lb_logic\"z\n\x1fnamespace_change_visibility_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x14\n\x0c\x61uto_visible\x18\x03 \x01(\x08\x12\x12\n\x05\x66orce\x18\x04 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_force\"h\n\x1dnamespace_change_location_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x15\n\x08location\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0b\n\t_location\"]\n!namespace_set_rbd_trash_image_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x13\n\x0btrash_image\x18\x03 \x01(\x08\"Y\n\x1dnamespace_set_auto_resize_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x13\n\x0b\x61uto_resize\x18\x03 \x01(\x08\"\x8f\x01\n\x14namespace_delete_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x16\n\ti_am_sure\x18\x04 \x01(\x08H\x01\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuidB\x0c\n\n_i_am_sure\"m\n\x16namespace_add_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x10\n\x08host_nqn\x18\x03 \x01(\t\x12\x12\n\x05\x66orce\x18\x04 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_force\"R\n\x19namespace_delete_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x10\n\x08host_nqn\x18\x03 \x01(\t\"\xf5\x02\n\x14\x63reate_subsystem_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x15\n\rserial_number\x18\x02 \x01(\t\x12\x1b\n\x0emax_namespaces\x18\x03 \x01(\rH\x00\x88\x01\x01\x12\x11\n\tenable_ha\x18\x04 \x01(\x08\x12\x1c\n\x0fno_group_append\x18\x05 \x01(\x08H\x01\x88\x01\x01\x12\x17\n\ndhchap_key\x18\x06 \x01(\tH\x02\x88\x01\x01\x12\x1a\n\rkey_encrypted\x18\x07 \x01(\x08H\x03\x88\x01\x01\x12\x14\n\x0cnetwork_mask\x18\x08 \x03(\t\x12\x1d\n\x10secure_listeners\x18\t \x01(\x08H\x04\x88\x01\x01\x12\x11\n\x04port\x18\n \x01(\rH\x05\x88\x01\x01\x42\x11\n\x0f_max_namespacesB\x12\n\x10_no_group_appendB\r\n\x0b_dhchap_keyB\x10\n\x0e_key_encryptedB\x13\n\x11_secure_listenersB\x07\n\x05_port\"q\n\x14\x64\x65lete_subsystem_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x12\n\x05\x66orce\x18\x02 \x01(\x08H\x00\x88\x01\x01\x12\x16\n\ti_am_sure\x18\x03 \x01(\x08H\x01\x88\x01\x01\x42\x08\n\x06_forceB\x0c\n\n_i_am_sure\"Y\n\x18\x63hange_subsystem_key_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x17\n\ndhchap_key\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\r\n\x0b_dhchap_key\"H\n\x19\x61\x64\x64_subsystem_network_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x14\n\x0cnetwork_mask\x18\x02 \x01(\t\"H\n\x19\x64\x65l_subsystem_network_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x14\n\x0cnetwork_mask\x18\x02 \x01(\t\"C\n\x14kmip_server_endpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12\x11\n\x04port\x18\x02 \x01(\rH\x00\x88\x01\x01\x42\x07\n\x05_port\"e\n\x18kmip_server_endpoint_cli\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x13\n\x0bserver_name\x18\x02 \x01(\t\x12\x0f\n\x07\x61\x64\x64ress\x18\x03 \x01(\t\x12\x0c\n\x04port\x18\x04 \x01(\r\"u\n\x1d\x61\x64\x64_kmip_server_endpoints_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x13\n\x0bserver_name\x18\x02 \x01(\t\x12(\n\tendpoints\x18\x03 \x03(\x0b\x32\x15.kmip_server_endpoint\"u\n\x1d\x64\x65l_kmip_server_endpoints_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x13\n\x0bserver_name\x18\x02 \x01(\t\x12(\n\tendpoints\x18\x03 \x03(\x0b\x32\x15.kmip_server_endpoint\"x\n\x1elist_kmip_server_endpoints_req\x12\x1a\n\rsubsystem_nqn\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x18\n\x0bserver_name\x18\x02 \x01(\tH\x01\x88\x01\x01\x42\x10\n\x0e_subsystem_nqnB\x0e\n\x0c_server_name\"q\n\x1akmip_server_endpoints_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12,\n\tendpoints\x18\x03 \x03(\x0b\x32\x19.kmip_server_endpoint_cli\"`\n\x13list_namespaces_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\x12\x11\n\x04nsid\x18\x02 \x01(\rH\x00\x88\x01\x01\x12\x11\n\x04uuid\x18\x03 \x01(\tH\x01\x88\x01\x01\x42\x07\n\x05_nsidB\x07\n\x05_uuid\"\xc3\x02\n\x0c\x61\x64\x64_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x10\n\x03psk\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndhchap_key\x18\x04 \x01(\tH\x01\x88\x01\x01\x12\x1a\n\rpsk_encrypted\x18\x05 \x01(\x08H\x02\x88\x01\x01\x12\x1a\n\rkey_encrypted\x18\x06 \x01(\x08H\x03\x88\x01\x01\x12\x1d\n\x10\x64hchap_ctrlr_key\x18\x07 \x01(\tH\x04\x88\x01\x01\x12 \n\x13\x63trlr_key_encrypted\x18\x08 \x01(\x08H\x05\x88\x01\x01\x42\x06\n\x04_pskB\r\n\x0b_dhchap_keyB\x10\n\x0e_psk_encryptedB\x10\n\x0e_key_encryptedB\x13\n\x11_dhchap_ctrlr_keyB\x16\n\x14_ctrlr_key_encrypted\"\x9a\x01\n\x13\x63hange_host_key_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x17\n\ndhchap_key\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x1d\n\x10\x64hchap_ctrlr_key\x18\x04 \x01(\tH\x01\x88\x01\x01\x42\r\n\x0b_dhchap_keyB\x13\n\x11_dhchap_ctrlr_key\"i\n get_connection_io_statistics_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x12\n\x05reset\x18\x03 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_reset\"X\n\x0fremove_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x12\n\x05\x66orce\x18\x03 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_force\"O\n\x0elist_hosts_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\x12\x19\n\x0c\x63lear_alerts\x18\x02 \x01(\x08H\x00\x88\x01\x01\x42\x0f\n\r_clear_alerts\"U\n\x14list_connections_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\x12\x19\n\x0c\x63lear_alerts\x18\x02 \x01(\x08H\x00\x88\x01\x01\x42\x0f\n\r_clear_alerts\"\x89\x02\n\x13\x63reate_listener_req\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x11\n\thost_name\x18\x02 \x01(\t\x12\x0e\n\x06traddr\x18\x03 \x01(\t\x12#\n\x06\x61\x64rfam\x18\x05 \x01(\x0e\x32\x0e.AddressFamilyH\x00\x88\x01\x01\x12\x14\n\x07trsvcid\x18\x06 \x01(\rH\x01\x88\x01\x01\x12\x13\n\x06secure\x18\x07 \x01(\x08H\x02\x88\x01\x01\x12\x1d\n\x10verify_host_name\x18\x08 \x01(\x08H\x03\x88\x01\x01\x12\x12\n\x05\x66orce\x18\t \x01(\x08H\x04\x88\x01\x01\x42\t\n\x07_adrfamB\n\n\x08_trsvcidB\t\n\x07_secureB\x13\n\x11_verify_host_nameB\x08\n\x06_force\"\xb5\x01\n\x13\x64\x65lete_listener_req\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x11\n\thost_name\x18\x02 \x01(\t\x12\x0e\n\x06traddr\x18\x03 \x01(\t\x12#\n\x06\x61\x64rfam\x18\x05 \x01(\x0e\x32\x0e.AddressFamilyH\x00\x88\x01\x01\x12\x14\n\x07trsvcid\x18\x06 \x01(\rH\x01\x88\x01\x01\x12\x12\n\x05\x66orce\x18\x07 \x01(\x08H\x02\x88\x01\x01\x42\t\n\x07_adrfamB\n\n\x08_trsvcidB\x08\n\x06_force\"\'\n\x12list_listeners_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\"q\n\x13list_subsystems_req\x12\x1a\n\rsubsystem_nqn\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x1a\n\rserial_number\x18\x02 \x01(\tH\x01\x88\x01\x01\x42\x10\n\x0e_subsystem_nqnB\x10\n\x0e_serial_number\"\x14\n\x12get_subsystems_req\"U\n%get_spdk_nvmf_log_flags_and_level_req\x12\x1a\n\rall_log_flags\x18\x01 \x01(\x08H\x00\x88\x01\x01\x42\x10\n\x0e_all_log_flags\"5\n\x1a\x64isable_spdk_nvmf_logs_req\x12\x17\n\x0f\x65xtra_log_flags\x18\x01 \x03(\t\"\x97\x01\n\x16set_spdk_nvmf_logs_req\x12!\n\tlog_level\x18\x01 \x01(\x0e\x32\t.LogLevelH\x00\x88\x01\x01\x12#\n\x0bprint_level\x18\x02 \x01(\x0e\x32\t.LogLevelH\x01\x88\x01\x01\x12\x17\n\x0f\x65xtra_log_flags\x18\x03 \x03(\tB\x0c\n\n_log_levelB\x0e\n\x0c_print_level\"@\n\x14get_gateway_info_req\x12\x18\n\x0b\x63li_version\x18\x01 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_cli_version\"\x1b\n\x19get_gateway_log_level_req\";\n\x19set_gateway_log_level_req\x12\x1e\n\tlog_level\x18\x01 \x01(\x0e\x32\x0b.GwLogLevel\"8\n\x1fshow_gateway_listeners_info_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\"\x17\n\x15get_gateway_stats_req\"\x16\n\x14get_thread_stats_req\"0\n\x1dset_gateway_io_stats_mode_req\x12\x0f\n\x07\x65nabled\x18\x01 \x01(\x08\"<\n\x0f\x61na_group_state\x12\x0e\n\x06grp_id\x18\x01 \x01(\r\x12\x19\n\x05state\x18\x02 \x01(\x0e\x32\n.ana_state\"?\n\x0enqn_ana_states\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12 \n\x06states\x18\x02 \x03(\x0b\x32\x10.ana_group_state\"+\n\x08\x61na_info\x12\x1f\n\x06states\x18\x01 \x03(\x0b\x32\x0f.nqn_ana_states\"3\n\nreq_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\"C\n\rsubsys_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0b\n\x03nqn\x18\x03 \x01(\t\"B\n\x0bnsid_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0c\n\x04nsid\x18\x03 \x01(\r\"1\n\x0fsubsystems_info\x12\x1e\n\nsubsystems\x18\x01 \x03(\x0b\x32\n.subsystem\"\xc2\x03\n\tsubsystem\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x0f\n\x07subtype\x18\x02 \x01(\t\x12)\n\x10listen_addresses\x18\x03 \x03(\x0b\x32\x0f.listen_address\x12\x14\n\x05hosts\x18\x04 \x03(\x0b\x32\x05.host\x12\x16\n\x0e\x61llow_any_host\x18\x05 \x01(\x08\x12\x1a\n\rserial_number\x18\x06 \x01(\tH\x00\x88\x01\x01\x12\x19\n\x0cmodel_number\x18\x07 \x01(\tH\x01\x88\x01\x01\x12\x1b\n\x0emax_namespaces\x18\x08 \x01(\rH\x02\x88\x01\x01\x12\x17\n\nmin_cntlid\x18\t \x01(\rH\x03\x88\x01\x01\x12\x17\n\nmax_cntlid\x18\n \x01(\rH\x04\x88\x01\x01\x12\x1e\n\nnamespaces\x18\x0b \x03(\x0b\x32\n.namespace\x12\x1b\n\x0ehas_dhchap_key\x18\x0c \x01(\x08H\x05\x88\x01\x01\x12\x14\n\x0cnetwork_mask\x18\r \x03(\tB\x10\n\x0e_serial_numberB\x0f\n\r_model_numberB\x11\n\x0f_max_namespacesB\r\n\x0b_min_cntlidB\r\n\x0b_max_cntlidB\x11\n\x0f_has_dhchap_key\"\x97\x01\n\x0elisten_address\x12\x0e\n\x06trtype\x18\x01 \x01(\t\x12\x0e\n\x06\x61\x64rfam\x18\x02 \x01(\t\x12\x0e\n\x06traddr\x18\x03 \x01(\t\x12\x0f\n\x07trsvcid\x18\x04 \x01(\t\x12\x16\n\ttransport\x18\x05 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x06secure\x18\x06 \x01(\x08H\x01\x88\x01\x01\x42\x0c\n\n_transportB\t\n\x07_secure\"\x84\x02\n\tnamespace\x12\x0c\n\x04nsid\x18\x01 \x01(\r\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x16\n\tbdev_name\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05nguid\x18\x04 \x01(\tH\x01\x88\x01\x01\x12\x11\n\x04uuid\x18\x05 \x01(\tH\x02\x88\x01\x01\x12\x15\n\x08\x61nagrpid\x18\x06 \x01(\rH\x03\x88\x01\x01\x12\x12\n\x05nonce\x18\x07 \x01(\tH\x04\x88\x01\x01\x12\x19\n\x0c\x61uto_visible\x18\x08 \x01(\x08H\x05\x88\x01\x01\x12\r\n\x05hosts\x18\t \x03(\tB\x0c\n\n_bdev_nameB\x08\n\x06_nguidB\x07\n\x05_uuidB\x0b\n\t_anagrpidB\x08\n\x06_nonceB\x0f\n\r_auto_visible\"`\n\x13subsystems_info_cli\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\"\n\nsubsystems\x18\x03 \x03(\x0b\x32\x0e.subsystem_cli\"\xf6\x02\n\rsubsystem_cli\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x11\n\tenable_ha\x18\x02 \x01(\x08\x12\x15\n\rserial_number\x18\x03 \x01(\t\x12\x14\n\x0cmodel_number\x18\x04 \x01(\t\x12\x12\n\nmin_cntlid\x18\x05 \x01(\r\x12\x12\n\nmax_cntlid\x18\x06 \x01(\r\x12\x17\n\x0fnamespace_count\x18\x07 \x01(\r\x12\x0f\n\x07subtype\x18\x08 \x01(\t\x12\x16\n\x0emax_namespaces\x18\t \x01(\r\x12\x1b\n\x0ehas_dhchap_key\x18\n \x01(\x08H\x00\x88\x01\x01\x12\x1b\n\x0e\x61llow_any_host\x18\x0b \x01(\x08H\x01\x88\x01\x01\x12 \n\x13\x63reated_without_key\x18\x0c \x01(\x08H\x02\x88\x01\x01\x12\x14\n\x0cnetwork_mask\x18\r \x03(\tB\x11\n\x0f_has_dhchap_keyB\x11\n\x0f_allow_any_hostB\x16\n\x14_created_without_key\"\xbb\x05\n\x0cgateway_info\x12\x13\n\x0b\x63li_version\x18\x01 \x01(\t\x12\x0f\n\x07version\x18\x02 \x01(\t\x12\x0c\n\x04name\x18\x03 \x01(\t\x12\r\n\x05group\x18\x04 \x01(\t\x12\x0c\n\x04\x61\x64\x64r\x18\x05 \x01(\t\x12\x0c\n\x04port\x18\x06 \x01(\t\x12\x13\n\x0b\x62ool_status\x18\x07 \x01(\x08\x12\x0e\n\x06status\x18\x08 \x01(\x05\x12\x15\n\rerror_message\x18\t \x01(\t\x12\x19\n\x0cspdk_version\x18\n \x01(\tH\x00\x88\x01\x01\x12\x1c\n\x14load_balancing_group\x18\x0b \x01(\r\x12\x10\n\x08hostname\x18\x0c \x01(\t\x12\x1b\n\x0emax_subsystems\x18\r \x01(\rH\x01\x88\x01\x01\x12\x1b\n\x0emax_namespaces\x18\x0e \x01(\rH\x02\x88\x01\x01\x12$\n\x17max_hosts_per_subsystem\x18\x0f \x01(\rH\x03\x88\x01\x01\x12)\n\x1cmax_namespaces_per_subsystem\x18\x10 \x01(\rH\x04\x88\x01\x01\x12\x16\n\tmax_hosts\x18\x11 \x01(\rH\x05\x88\x01\x01\x12(\n\x1bgateway_initialization_over\x18\x12 \x01(\x08H\x06\x88\x01\x01\x12\x1d\n\x10io_stats_enabled\x18\x13 \x01(\x08H\x07\x88\x01\x01\x12\x15\n\x08location\x18\x14 \x01(\tH\x08\x88\x01\x01\x42\x0f\n\r_spdk_versionB\x11\n\x0f_max_subsystemsB\x11\n\x0f_max_namespacesB\x1a\n\x18_max_hosts_per_subsystemB\x1f\n\x1d_max_namespaces_per_subsystemB\x0c\n\n_max_hostsB\x1e\n\x1c_gateway_initialization_overB\x13\n\x11_io_stats_enabledB\x0b\n\t_location\"E\n\x0b\x63li_version\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0f\n\x07version\x18\x03 \x01(\t\"D\n\ngw_version\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0f\n\x07version\x18\x03 \x01(\t\"+\n\x19poll_group_transport_info\x12\x0e\n\x06trtype\x18\x01 \x01(\t\"\xe5\x01\n\x0fpoll_group_info\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x61\x64min_qpairs\x18\x02 \x01(\r\x12\x11\n\tio_qpairs\x18\x03 \x01(\r\x12\x1c\n\x14\x63urrent_admin_qpairs\x18\x04 \x01(\r\x12\x19\n\x11\x63urrent_io_qpairs\x18\x05 \x01(\r\x12\x17\n\x0fpending_bdev_io\x18\x06 \x01(\x04\x12\x19\n\x11\x63ompleted_nvme_io\x18\x07 \x01(\x04\x12.\n\ntransports\x18\x08 \x03(\x0b\x32\x1a.poll_group_transport_info\"u\n\x12gateway_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x11\n\ttick_rate\x18\x03 \x01(\x04\x12%\n\x0bpoll_groups\x18\x04 \x03(\x0b\x32\x10.poll_group_info\"q\n\x11thread_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\"\n\x07threads\x18\x03 \x03(\x0b\x32\x11.spdk_thread_info\x12\x11\n\ttick_rate\x18\x04 \x01(\x04\"<\n\x10spdk_thread_info\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04\x62usy\x18\x02 \x01(\x04\x12\x0c\n\x04idle\x18\x03 \x01(\x04\"\xd3\x01\n\rlistener_info\x12\x11\n\thost_name\x18\x01 \x01(\t\x12\x0e\n\x06trtype\x18\x02 \x01(\t\x12\x1e\n\x06\x61\x64rfam\x18\x03 \x01(\x0e\x32\x0e.AddressFamily\x12\x0e\n\x06traddr\x18\x04 \x01(\t\x12\x0f\n\x07trsvcid\x18\x05 \x01(\r\x12\x13\n\x06secure\x18\x06 \x01(\x08H\x00\x88\x01\x01\x12\x13\n\x06\x61\x63tive\x18\x07 \x01(\x08H\x01\x88\x01\x01\x12\x13\n\x06manual\x18\x08 \x01(\x08H\x02\x88\x01\x01\x42\t\n\x07_secureB\t\n\x07_activeB\t\n\x07_manual\"Z\n\x0elisteners_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12!\n\tlisteners\x18\x03 \x03(\x0b\x32\x0e.listener_info\"^\n\x15gateway_listener_info\x12 \n\x08listener\x18\x01 \x01(\x0b\x32\x0e.listener_info\x12#\n\tlb_states\x18\x02 \x03(\x0b\x32\x10.ana_group_state\"m\n\x16gateway_listeners_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12,\n\x0cgw_listeners\x18\x03 \x03(\x0b\x32\x16.gateway_listener_info\"\x9b\x02\n\x04host\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x14\n\x07use_psk\x18\x02 \x01(\x08H\x00\x88\x01\x01\x12\x17\n\nuse_dhchap\x18\x03 \x01(\x08H\x01\x88\x01\x01\x12\x32\n%disconnected_due_to_keepalive_timeout\x18\x04 \x01(\x08H\x02\x88\x01\x01\x12\x41\n\x18\x64hchap_controller_origin\x18\x05 \x01(\x0e\x32\x1a.DHCHAPControllerKeyOriginH\x03\x88\x01\x01\x42\n\n\x08_use_pskB\r\n\x0b_use_dhchapB(\n&_disconnected_due_to_keepalive_timeoutB\x1b\n\x19_dhchap_controller_origin\"7\n\rlatency_stats\x12\x0b\n\x03min\x18\x01 \x01(\x04\x12\x0b\n\x03max\x18\x02 \x01(\x04\x12\x0c\n\x04mean\x18\x03 \x01(\x04\"\x98\x01\n\rlatency_group\x12\x10\n\x08io_count\x18\x01 \x01(\x04\x12\x1d\n\x05total\x18\x02 \x01(\x0b\x32\x0e.latency_stats\x12\x1c\n\x04\x62\x64\x65v\x18\x03 \x01(\x0b\x32\x0e.latency_stats\x12\x1b\n\x03net\x18\x04 \x01(\x0b\x32\x0e.latency_stats\x12\x1b\n\x03qos\x18\x05 \x01(\x0b\x32\x0e.latency_stats\"X\n\x0b\x62ucket_info\x12\x0c\n\x04size\x18\x01 \x01(\r\x12\x1c\n\x04read\x18\x02 \x01(\x0b\x32\x0e.latency_group\x12\x1d\n\x05write\x18\x03 \x01(\x0b\x32\x0e.latency_group\"\xb7\x01\n\x18\x63onnection_io_statistics\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\x10\n\x08host_nqn\x18\x04 \x01(\t\x12\x1a\n\rtotal_num_ios\x18\x05 \x01(\x04H\x00\x88\x01\x01\x12\x1d\n\x07\x62uckets\x18\x06 \x03(\x0b\x32\x0c.bucket_infoB\x10\n\x0e_total_num_ios\"x\n\nhosts_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x16\n\x0e\x61llow_any_host\x18\x03 \x01(\x08\x12\x15\n\rsubsystem_nqn\x18\x04 \x01(\t\x12\x14\n\x05hosts\x18\x05 \x03(\x0b\x32\x05.host\"\xf8\x03\n\nconnection\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x0e\n\x06traddr\x18\x02 \x01(\t\x12\x0f\n\x07trsvcid\x18\x03 \x01(\r\x12\x0e\n\x06trtype\x18\x04 \x01(\t\x12\x1e\n\x06\x61\x64rfam\x18\x05 \x01(\x0e\x32\x0e.AddressFamily\x12\x11\n\tconnected\x18\x06 \x01(\x08\x12\x14\n\x0cqpairs_count\x18\x07 \x01(\x05\x12\x15\n\rcontroller_id\x18\x08 \x01(\x05\x12\x13\n\x06secure\x18\t \x01(\x08H\x00\x88\x01\x01\x12\x14\n\x07use_psk\x18\n \x01(\x08H\x01\x88\x01\x01\x12\x17\n\nuse_dhchap\x18\x0b \x01(\x08H\x02\x88\x01\x01\x12\x16\n\tsubsystem\x18\x0c \x01(\tH\x03\x88\x01\x01\x12\x32\n%disconnected_due_to_keepalive_timeout\x18\r \x01(\x08H\x04\x88\x01\x01\x12\x41\n\x18\x64hchap_controller_origin\x18\x0e \x01(\x0e\x32\x1a.DHCHAPControllerKeyOriginH\x05\x88\x01\x01\x42\t\n\x07_secureB\n\n\x08_use_pskB\r\n\x0b_use_dhchapB\x0c\n\n_subsystemB(\n&_disconnected_due_to_keepalive_timeoutB\x1b\n\x19_dhchap_controller_origin\"r\n\x10\x63onnections_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12 \n\x0b\x63onnections\x18\x04 \x03(\x0b\x32\x0b.connection\"\xd8\x07\n\rnamespace_cli\x12\x0c\n\x04nsid\x18\x01 \x01(\r\x12\x11\n\tbdev_name\x18\x02 \x01(\t\x12\x16\n\x0erbd_image_name\x18\x03 \x01(\t\x12\x15\n\rrbd_pool_name\x18\x04 \x01(\t\x12\x1c\n\x14load_balancing_group\x18\x05 \x01(\r\x12\x12\n\nblock_size\x18\x06 \x01(\r\x12\x16\n\x0erbd_image_size\x18\x07 \x01(\x04\x12\x0c\n\x04uuid\x18\x08 \x01(\t\x12\x19\n\x11rw_ios_per_second\x18\t \x01(\x04\x12\x1c\n\x14rw_mbytes_per_second\x18\n \x01(\x04\x12\x1b\n\x13r_mbytes_per_second\x18\x0b \x01(\x04\x12\x1b\n\x13w_mbytes_per_second\x18\x0c \x01(\x04\x12\x14\n\x0c\x61uto_visible\x18\r \x01(\x08\x12\r\n\x05hosts\x18\x0e \x03(\t\x12\x1d\n\x10ns_subsystem_nqn\x18\x0f \x01(\tH\x00\x88\x01\x01\x12\x18\n\x0btrash_image\x18\x10 \x01(\x08H\x01\x88\x01\x01\x12 \n\x13\x64isable_auto_resize\x18\x11 \x01(\x08H\x02\x88\x01\x01\x12\x16\n\tread_only\x18\x12 \x01(\x08H\x03\x88\x01\x01\x12\x19\n\x0c\x63luster_name\x18\x13 \x01(\tH\x04\x88\x01\x01\x12,\n\x1f\x63onfigured_load_balancing_group\x18\x14 \x01(\rH\x05\x88\x01\x01\x12\x1d\n\x10image_was_shrunk\x18\x15 \x01(\x08H\x06\x88\x01\x01\x12\x1f\n\x12rbd_data_pool_name\x18\x16 \x01(\tH\x07\x88\x01\x01\x12\x15\n\x08location\x18\x17 \x01(\tH\x08\x88\x01\x01\x12!\n\x14rados_namespace_name\x18\x18 \x01(\tH\t\x88\x01\x01\x12\x37\n\x14\x65ncryption_algorithm\x18\x19 \x01(\x0e\x32\x14.EncryptionAlgorithmH\n\x88\x01\x01\x12-\n\x12\x65ncryption_entries\x18\x1a \x03(\x0b\x32\x11.encryption_entryB\x13\n\x11_ns_subsystem_nqnB\x0e\n\x0c_trash_imageB\x16\n\x14_disable_auto_resizeB\x0c\n\n_read_onlyB\x0f\n\r_cluster_nameB\"\n _configured_load_balancing_groupB\x13\n\x11_image_was_shrunkB\x15\n\x13_rbd_data_pool_nameB\x0b\n\t_locationB\x17\n\x15_rados_namespace_nameB\x17\n\x15_encryption_algorithm\"s\n\x0fnamespaces_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\"\n\nnamespaces\x18\x04 \x03(\x0b\x32\x0e.namespace_cli\"1\n\x12namespace_io_error\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r\"\x91\x01\n\x1dlist_namespaces_io_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x11\n\ttick_rate\x18\x03 \x01(\x04\x12\r\n\x05ticks\x18\x04 \x01(\x04\x12\'\n\nnamespaces\x18\x05 \x03(\x0b\x32\x13.bdev_io_stats_info\"\xf7\x04\n\x12\x62\x64\x65v_io_stats_info\x12\x11\n\tbdev_name\x18\x01 \x01(\t\x12\x12\n\nbytes_read\x18\x02 \x01(\x04\x12\x14\n\x0cnum_read_ops\x18\x03 \x01(\x04\x12\x15\n\rbytes_written\x18\x04 \x01(\x04\x12\x15\n\rnum_write_ops\x18\x05 \x01(\x04\x12\x16\n\x0e\x62ytes_unmapped\x18\x06 \x01(\x04\x12\x15\n\rnum_unmap_ops\x18\x07 \x01(\x04\x12\x14\n\x0c\x62ytes_copied\x18\x08 \x01(\x04\x12\x14\n\x0cnum_copy_ops\x18\t \x01(\x04\x12\x1a\n\x12read_latency_ticks\x18\n \x01(\x04\x12\x1e\n\x16max_read_latency_ticks\x18\x0b \x01(\x04\x12\x1e\n\x16min_read_latency_ticks\x18\x0c \x01(\x04\x12\x1b\n\x13write_latency_ticks\x18\r \x01(\x04\x12\x1f\n\x17max_write_latency_ticks\x18\x0e \x01(\x04\x12\x1f\n\x17min_write_latency_ticks\x18\x0f \x01(\x04\x12\x1b\n\x13unmap_latency_ticks\x18\x10 \x01(\x04\x12\x1f\n\x17max_unmap_latency_ticks\x18\x11 \x01(\x04\x12\x1f\n\x17min_unmap_latency_ticks\x18\x12 \x01(\x04\x12\x1a\n\x12\x63opy_latency_ticks\x18\x13 \x01(\x04\x12\x1e\n\x16max_copy_latency_ticks\x18\x14 \x01(\x04\x12\x1e\n\x16min_copy_latency_ticks\x18\x15 \x01(\x04\x12%\n\x08io_error\x18\x16 \x03(\x0b\x32\x13.namespace_io_error\"\xda\x05\n\x17namespace_io_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\x0c\n\x04nsid\x18\x04 \x01(\r\x12\x11\n\x04uuid\x18\x05 \x01(\tH\x00\x88\x01\x01\x12\x11\n\tbdev_name\x18\x06 \x01(\t\x12\x11\n\ttick_rate\x18\x07 \x01(\x04\x12\r\n\x05ticks\x18\x08 \x01(\x04\x12\x12\n\nbytes_read\x18\t \x01(\x04\x12\x14\n\x0cnum_read_ops\x18\n \x01(\x04\x12\x15\n\rbytes_written\x18\x0b \x01(\x04\x12\x15\n\rnum_write_ops\x18\x0c \x01(\x04\x12\x16\n\x0e\x62ytes_unmapped\x18\r \x01(\x04\x12\x15\n\rnum_unmap_ops\x18\x0e \x01(\x04\x12\x1a\n\x12read_latency_ticks\x18\x0f \x01(\x04\x12\x1e\n\x16max_read_latency_ticks\x18\x10 \x01(\x04\x12\x1e\n\x16min_read_latency_ticks\x18\x11 \x01(\x04\x12\x1b\n\x13write_latency_ticks\x18\x12 \x01(\x04\x12\x1f\n\x17max_write_latency_ticks\x18\x13 \x01(\x04\x12\x1f\n\x17min_write_latency_ticks\x18\x14 \x01(\x04\x12\x1b\n\x13unmap_latency_ticks\x18\x15 \x01(\x04\x12\x1f\n\x17max_unmap_latency_ticks\x18\x16 \x01(\x04\x12\x1f\n\x17min_unmap_latency_ticks\x18\x17 \x01(\x04\x12\x1a\n\x12\x63opy_latency_ticks\x18\x18 \x01(\x04\x12\x1e\n\x16max_copy_latency_ticks\x18\x19 \x01(\x04\x12\x1e\n\x16min_copy_latency_ticks\x18\x1a \x01(\x04\x12%\n\x08io_error\x18\x1b \x03(\x0b\x32\x13.namespace_io_errorB\x07\n\x05_uuid\"3\n\x12spdk_log_flag_info\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x65nabled\x18\x02 \x01(\x08\"\xba\x01\n\"spdk_nvmf_log_flags_and_level_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12+\n\x0envmf_log_flags\x18\x03 \x03(\x0b\x32\x13.spdk_log_flag_info\x12\x1c\n\tlog_level\x18\x04 \x01(\x0e\x32\t.LogLevel\x12\"\n\x0flog_print_level\x18\x05 \x01(\x0e\x32\t.LogLevel\"_\n\x16gateway_log_level_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x1e\n\tlog_level\x18\x03 \x01(\x0e\x32\x0b.GwLogLevel\"E\n\x10\x65ncryption_entry\x12!\n\x06\x66ormat\x18\x01 \x01(\x0e\x32\x11.EncryptionFormat\x12\x0e\n\x06key_id\x18\x02 \x01(\t*#\n\rAddressFamily\x12\x08\n\x04ipv4\x10\x00\x12\x08\n\x04ipv6\x10\x01*C\n\x08LogLevel\x12\t\n\x05\x45RROR\x10\x00\x12\x0b\n\x07WARNING\x10\x01\x12\n\n\x06NOTICE\x10\x02\x12\x08\n\x04INFO\x10\x03\x12\t\n\x05\x44\x45\x42UG\x10\x04*S\n\nGwLogLevel\x12\n\n\x06notset\x10\x00\x12\t\n\x05\x64\x65\x62ug\x10\n\x12\x08\n\x04info\x10\x14\x12\x0b\n\x07warning\x10\x1e\x12\t\n\x05\x65rror\x10(\x12\x0c\n\x08\x63ritical\x10\x32*2\n\x10\x45ncryptionFormat\x12\x08\n\x04none\x10\x00\x12\t\n\x05luks1\x10\x01\x12\t\n\x05luks2\x10\x02*?\n\x13\x45ncryptionAlgorithm\x12\x10\n\x0cno_algorithm\x10\x00\x12\n\n\x06\x61\x65s128\x10\x01\x12\n\n\x06\x61\x65s256\x10\x02*R\n\x19\x44HCHAPControllerKeyOrigin\x12\n\n\x06no_key\x10\x00\x12\x11\n\rhost_specific\x10\x01\x12\x16\n\x12subsystem_implicit\x10\x02*J\n\tana_state\x12\t\n\x05UNSET\x10\x00\x12\r\n\tOPTIMIZED\x10\x01\x12\x11\n\rNON_OPTIMIZED\x10\x02\x12\x10\n\x0cINACCESSIBLE\x10\x03\x32\xe1\x17\n\x07Gateway\x12\x33\n\rnamespace_add\x12\x12.namespace_add_req\x1a\x0c.nsid_status\"\x00\x12;\n\x10\x63reate_subsystem\x12\x15.create_subsystem_req\x1a\x0e.subsys_status\"\x00\x12\x38\n\x10\x64\x65lete_subsystem\x12\x15.delete_subsystem_req\x1a\x0b.req_status\"\x00\x12@\n\x14\x63hange_subsystem_key\x12\x19.change_subsystem_key_req\x1a\x0b.req_status\"\x00\x12\x42\n\x15\x61\x64\x64_subsystem_network\x12\x1a.add_subsystem_network_req\x1a\x0b.req_status\"\x00\x12\x42\n\x15\x64\x65l_subsystem_network\x12\x1a.del_subsystem_network_req\x1a\x0b.req_status\"\x00\x12J\n\x19\x61\x64\x64_kmip_server_endpoints\x12\x1e.add_kmip_server_endpoints_req\x1a\x0b.req_status\"\x00\x12J\n\x19\x64\x65l_kmip_server_endpoints\x12\x1e.del_kmip_server_endpoints_req\x1a\x0b.req_status\"\x00\x12\\\n\x1alist_kmip_server_endpoints\x12\x1f.list_kmip_server_endpoints_req\x1a\x1b.kmip_server_endpoints_info\"\x00\x12;\n\x0flist_namespaces\x12\x14.list_namespaces_req\x1a\x10.namespaces_info\"\x00\x12\x38\n\x10namespace_resize\x12\x15.namespace_resize_req\x1a\x0b.req_status\"\x00\x12Q\n\x16namespace_get_io_stats\x12\x1b.namespace_get_io_stats_req\x1a\x18.namespace_io_stats_info\"\x00\x12[\n\x18list_namespaces_io_stats\x12\x1d.list_namespaces_io_stats_req\x1a\x1e.list_namespaces_io_stats_info\"\x00\x12\x41\n\x18namespace_set_qos_limits\x12\x16.namespace_set_qos_req\x1a\x0b.req_status\"\x00\x12\x62\n%namespace_change_load_balancing_group\x12*.namespace_change_load_balancing_group_req\x1a\x0b.req_status\"\x00\x12N\n\x1bnamespace_change_visibility\x12 .namespace_change_visibility_req\x1a\x0b.req_status\"\x00\x12J\n\x19namespace_change_location\x12\x1e.namespace_change_location_req\x1a\x0b.req_status\"\x00\x12R\n\x1dnamespace_set_rbd_trash_image\x12\".namespace_set_rbd_trash_image_req\x1a\x0b.req_status\"\x00\x12J\n\x19namespace_set_auto_resize\x12\x1e.namespace_set_auto_resize_req\x1a\x0b.req_status\"\x00\x12\x38\n\x10namespace_delete\x12\x15.namespace_delete_req\x1a\x0b.req_status\"\x00\x12<\n\x12namespace_add_host\x12\x17.namespace_add_host_req\x1a\x0b.req_status\"\x00\x12\x42\n\x15namespace_delete_host\x12\x1a.namespace_delete_host_req\x1a\x0b.req_status\"\x00\x12(\n\x08\x61\x64\x64_host\x12\r.add_host_req\x1a\x0b.req_status\"\x00\x12.\n\x0bremove_host\x12\x10.remove_host_req\x1a\x0b.req_status\"\x00\x12\x36\n\x0f\x63hange_host_key\x12\x14.change_host_key_req\x1a\x0b.req_status\"\x00\x12,\n\nlist_hosts\x12\x0f.list_hosts_req\x1a\x0b.hosts_info\"\x00\x12>\n\x10list_connections\x12\x15.list_connections_req\x1a\x11.connections_info\"\x00\x12^\n\x1cget_connection_io_statistics\x12!.get_connection_io_statistics_req\x1a\x19.connection_io_statistics\"\x00\x12\x36\n\x0f\x63reate_listener\x12\x14.create_listener_req\x1a\x0b.req_status\"\x00\x12\x36\n\x0f\x64\x65lete_listener\x12\x14.delete_listener_req\x1a\x0b.req_status\"\x00\x12\x38\n\x0elist_listeners\x12\x13.list_listeners_req\x1a\x0f.listeners_info\"\x00\x12?\n\x0flist_subsystems\x12\x14.list_subsystems_req\x1a\x14.subsystems_info_cli\"\x00\x12\x39\n\x0eget_subsystems\x12\x13.get_subsystems_req\x1a\x10.subsystems_info\"\x00\x12)\n\rset_ana_state\x12\t.ana_info\x1a\x0b.req_status\"\x00\x12r\n!get_spdk_nvmf_log_flags_and_level\x12&.get_spdk_nvmf_log_flags_and_level_req\x1a#.spdk_nvmf_log_flags_and_level_info\"\x00\x12\x44\n\x16\x64isable_spdk_nvmf_logs\x12\x1b.disable_spdk_nvmf_logs_req\x1a\x0b.req_status\"\x00\x12<\n\x12set_spdk_nvmf_logs\x12\x17.set_spdk_nvmf_logs_req\x1a\x0b.req_status\"\x00\x12:\n\x10get_gateway_info\x12\x15.get_gateway_info_req\x1a\r.gateway_info\"\x00\x12N\n\x15get_gateway_log_level\x12\x1a.get_gateway_log_level_req\x1a\x17.gateway_log_level_info\"\x00\x12\x42\n\x15set_gateway_log_level\x12\x1a.set_gateway_log_level_req\x1a\x0b.req_status\"\x00\x12Z\n\x1bshow_gateway_listeners_info\x12 .show_gateway_listeners_info_req\x1a\x17.gateway_listeners_info\"\x00\x12\x42\n\x11get_gateway_stats\x12\x16.get_gateway_stats_req\x1a\x13.gateway_stats_info\"\x00\x12?\n\x10get_thread_stats\x12\x15.get_thread_stats_req\x1a\x12.thread_stats_info\"\x00\x12J\n\x19set_gateway_io_stats_mode\x12\x1e.set_gateway_io_stats_mode_req\x1a\x0b.req_status\"\x00\x42+Z)github.com/ceph/ceph-nvmeof/lib/go/nvmeofb\x06proto3'
+  serialized_pb=b'\n&dashboard/services/proto/gateway.proto\"\x84\x06\n\x11namespace_add_req\x12\x15\n\rrbd_pool_name\x18\x01 \x01(\t\x12\x16\n\x0erbd_image_name\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\x11\n\x04nsid\x18\x04 \x01(\rH\x00\x88\x01\x01\x12\x12\n\nblock_size\x18\x05 \x01(\r\x12\x11\n\x04uuid\x18\x06 \x01(\tH\x01\x88\x01\x01\x12\x15\n\x08\x61nagrpid\x18\x07 \x01(\x05H\x02\x88\x01\x01\x12\x19\n\x0c\x63reate_image\x18\x08 \x01(\x08H\x03\x88\x01\x01\x12\x11\n\x04size\x18\t \x01(\x04H\x04\x88\x01\x01\x12\x12\n\x05\x66orce\x18\n \x01(\x08H\x05\x88\x01\x01\x12\x1c\n\x0fno_auto_visible\x18\x0b \x01(\x08H\x06\x88\x01\x01\x12\x18\n\x0btrash_image\x18\x0c \x01(\x08H\x07\x88\x01\x01\x12 \n\x13\x64isable_auto_resize\x18\r \x01(\x08H\x08\x88\x01\x01\x12\x16\n\tread_only\x18\x0e \x01(\x08H\t\x88\x01\x01\x12\x1f\n\x12rbd_data_pool_name\x18\x0f \x01(\tH\n\x88\x01\x01\x12\x15\n\x08location\x18\x10 \x01(\tH\x0b\x88\x01\x01\x12!\n\x14rados_namespace_name\x18\x11 \x01(\tH\x0c\x88\x01\x01\x12-\n\x12\x65ncryption_entries\x18\x12 \x03(\x0b\x32\x11.encryption_entry\x12\x37\n\x14\x65ncryption_algorithm\x18\x13 \x01(\x0e\x32\x14.EncryptionAlgorithmH\r\x88\x01\x01\x42\x07\n\x05_nsidB\x07\n\x05_uuidB\x0b\n\t_anagrpidB\x0f\n\r_create_imageB\x07\n\x05_sizeB\x08\n\x06_forceB\x12\n\x10_no_auto_visibleB\x0e\n\x0c_trash_imageB\x16\n\x14_disable_auto_resizeB\x0c\n\n_read_onlyB\x15\n\x13_rbd_data_pool_nameB\x0b\n\t_locationB\x17\n\x15_rados_namespace_nameB\x17\n\x15_encryption_algorithm\"{\n\x14namespace_resize_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x10\n\x08new_size\x18\x04 \x01(\x04\x42\x10\n\x0e_OBSOLETE_uuid\"o\n\x1anamespace_get_io_stats_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuid\"h\n\x1clist_namespaces_io_stats_req\x12\x1a\n\rsubsystem_nqn\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x11\n\x04nsid\x18\x02 \x01(\rH\x01\x88\x01\x01\x42\x10\n\x0e_subsystem_nqnB\x07\n\x05_nsid\"\xee\x02\n\x15namespace_set_qos_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x1e\n\x11rw_ios_per_second\x18\x04 \x01(\x04H\x01\x88\x01\x01\x12!\n\x14rw_mbytes_per_second\x18\x05 \x01(\x04H\x02\x88\x01\x01\x12 \n\x13r_mbytes_per_second\x18\x06 \x01(\x04H\x03\x88\x01\x01\x12 \n\x13w_mbytes_per_second\x18\x07 \x01(\x04H\x04\x88\x01\x01\x12\x12\n\x05\x66orce\x18\x08 \x01(\x08H\x05\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuidB\x14\n\x12_rw_ios_per_secondB\x17\n\x15_rw_mbytes_per_secondB\x16\n\x14_r_mbytes_per_secondB\x16\n\x14_w_mbytes_per_secondB\x08\n\x06_force\"\xbe\x01\n)namespace_change_load_balancing_group_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x10\n\x08\x61nagrpid\x18\x04 \x01(\x05\x12\x1a\n\rauto_lb_logic\x18\x05 \x01(\x08H\x01\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuidB\x10\n\x0e_auto_lb_logic\"z\n\x1fnamespace_change_visibility_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x14\n\x0c\x61uto_visible\x18\x03 \x01(\x08\x12\x12\n\x05\x66orce\x18\x04 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_force\"h\n\x1dnamespace_change_location_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x15\n\x08location\x18\x03 \x01(\tH\x00\x88\x01\x01\x42\x0b\n\t_location\"]\n!namespace_set_rbd_trash_image_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x13\n\x0btrash_image\x18\x03 \x01(\x08\"Y\n\x1dnamespace_set_auto_resize_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x13\n\x0b\x61uto_resize\x18\x03 \x01(\x08\"\x8f\x01\n\x14namespace_delete_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x1a\n\rOBSOLETE_uuid\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x16\n\ti_am_sure\x18\x04 \x01(\x08H\x01\x88\x01\x01\x42\x10\n\x0e_OBSOLETE_uuidB\x0c\n\n_i_am_sure\"m\n\x16namespace_add_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x10\n\x08host_nqn\x18\x03 \x01(\t\x12\x12\n\x05\x66orce\x18\x04 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_force\"R\n\x19namespace_delete_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x0c\n\x04nsid\x18\x02 \x01(\r\x12\x10\n\x08host_nqn\x18\x03 \x01(\t\"\xf5\x02\n\x14\x63reate_subsystem_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x15\n\rserial_number\x18\x02 \x01(\t\x12\x1b\n\x0emax_namespaces\x18\x03 \x01(\rH\x00\x88\x01\x01\x12\x11\n\tenable_ha\x18\x04 \x01(\x08\x12\x1c\n\x0fno_group_append\x18\x05 \x01(\x08H\x01\x88\x01\x01\x12\x17\n\ndhchap_key\x18\x06 \x01(\tH\x02\x88\x01\x01\x12\x1a\n\rkey_encrypted\x18\x07 \x01(\x08H\x03\x88\x01\x01\x12\x14\n\x0cnetwork_mask\x18\x08 \x03(\t\x12\x1d\n\x10secure_listeners\x18\t \x01(\x08H\x04\x88\x01\x01\x12\x11\n\x04port\x18\n \x01(\rH\x05\x88\x01\x01\x42\x11\n\x0f_max_namespacesB\x12\n\x10_no_group_appendB\r\n\x0b_dhchap_keyB\x10\n\x0e_key_encryptedB\x13\n\x11_secure_listenersB\x07\n\x05_port\"q\n\x14\x64\x65lete_subsystem_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x12\n\x05\x66orce\x18\x02 \x01(\x08H\x00\x88\x01\x01\x12\x16\n\ti_am_sure\x18\x03 \x01(\x08H\x01\x88\x01\x01\x42\x08\n\x06_forceB\x0c\n\n_i_am_sure\"Y\n\x18\x63hange_subsystem_key_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x17\n\ndhchap_key\x18\x02 \x01(\tH\x00\x88\x01\x01\x42\r\n\x0b_dhchap_key\"H\n\x19\x61\x64\x64_subsystem_network_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x14\n\x0cnetwork_mask\x18\x02 \x01(\t\"H\n\x19\x64\x65l_subsystem_network_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x14\n\x0cnetwork_mask\x18\x02 \x01(\t\"/\n\x16gw_refresh_network_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\"b\n\x19gw_refresh_network_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\r\n\x05\x61\x64\x64\x65\x64\x18\x03 \x03(\t\x12\x0f\n\x07removed\x18\x04 \x03(\t\"C\n\x14kmip_server_endpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12\x11\n\x04port\x18\x02 \x01(\rH\x00\x88\x01\x01\x42\x07\n\x05_port\"e\n\x18kmip_server_endpoint_cli\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x13\n\x0bserver_name\x18\x02 \x01(\t\x12\x0f\n\x07\x61\x64\x64ress\x18\x03 \x01(\t\x12\x0c\n\x04port\x18\x04 \x01(\r\"u\n\x1d\x61\x64\x64_kmip_server_endpoints_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x13\n\x0bserver_name\x18\x02 \x01(\t\x12(\n\tendpoints\x18\x03 \x03(\x0b\x32\x15.kmip_server_endpoint\"u\n\x1d\x64\x65l_kmip_server_endpoints_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x13\n\x0bserver_name\x18\x02 \x01(\t\x12(\n\tendpoints\x18\x03 \x03(\x0b\x32\x15.kmip_server_endpoint\"x\n\x1elist_kmip_server_endpoints_req\x12\x1a\n\rsubsystem_nqn\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x18\n\x0bserver_name\x18\x02 \x01(\tH\x01\x88\x01\x01\x42\x10\n\x0e_subsystem_nqnB\x0e\n\x0c_server_name\"q\n\x1akmip_server_endpoints_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12,\n\tendpoints\x18\x03 \x03(\x0b\x32\x19.kmip_server_endpoint_cli\"`\n\x13list_namespaces_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\x12\x11\n\x04nsid\x18\x02 \x01(\rH\x00\x88\x01\x01\x12\x11\n\x04uuid\x18\x03 \x01(\tH\x01\x88\x01\x01\x42\x07\n\x05_nsidB\x07\n\x05_uuid\"\xc3\x02\n\x0c\x61\x64\x64_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x10\n\x03psk\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x17\n\ndhchap_key\x18\x04 \x01(\tH\x01\x88\x01\x01\x12\x1a\n\rpsk_encrypted\x18\x05 \x01(\x08H\x02\x88\x01\x01\x12\x1a\n\rkey_encrypted\x18\x06 \x01(\x08H\x03\x88\x01\x01\x12\x1d\n\x10\x64hchap_ctrlr_key\x18\x07 \x01(\tH\x04\x88\x01\x01\x12 \n\x13\x63trlr_key_encrypted\x18\x08 \x01(\x08H\x05\x88\x01\x01\x42\x06\n\x04_pskB\r\n\x0b_dhchap_keyB\x10\n\x0e_psk_encryptedB\x10\n\x0e_key_encryptedB\x13\n\x11_dhchap_ctrlr_keyB\x16\n\x14_ctrlr_key_encrypted\"\x9a\x01\n\x13\x63hange_host_key_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x17\n\ndhchap_key\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x1d\n\x10\x64hchap_ctrlr_key\x18\x04 \x01(\tH\x01\x88\x01\x01\x42\r\n\x0b_dhchap_keyB\x13\n\x11_dhchap_ctrlr_key\"i\n get_connection_io_statistics_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x12\n\x05reset\x18\x03 \x01(\x08H\x00\x88\x01\x01\x42\x08\n\x06_reset\"\x8c\x01\n\x0fremove_host_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\x12\x12\n\x05\x66orce\x18\x03 \x01(\x08H\x00\x88\x01\x01\x12\x1d\n\x10keep_connections\x18\x04 \x01(\x08H\x01\x88\x01\x01\x42\x08\n\x06_forceB\x13\n\x11_keep_connections\"F\n\x1bset_keep_host_connected_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\x12\x10\n\x08host_nqn\x18\x02 \x01(\t\"O\n\x0elist_hosts_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\x12\x19\n\x0c\x63lear_alerts\x18\x02 \x01(\x08H\x00\x88\x01\x01\x42\x0f\n\r_clear_alerts\"U\n\x14list_connections_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\x12\x19\n\x0c\x63lear_alerts\x18\x02 \x01(\x08H\x00\x88\x01\x01\x42\x0f\n\r_clear_alerts\"\x89\x02\n\x13\x63reate_listener_req\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x11\n\thost_name\x18\x02 \x01(\t\x12\x0e\n\x06traddr\x18\x03 \x01(\t\x12#\n\x06\x61\x64rfam\x18\x05 \x01(\x0e\x32\x0e.AddressFamilyH\x00\x88\x01\x01\x12\x14\n\x07trsvcid\x18\x06 \x01(\rH\x01\x88\x01\x01\x12\x13\n\x06secure\x18\x07 \x01(\x08H\x02\x88\x01\x01\x12\x1d\n\x10verify_host_name\x18\x08 \x01(\x08H\x03\x88\x01\x01\x12\x12\n\x05\x66orce\x18\t \x01(\x08H\x04\x88\x01\x01\x42\t\n\x07_adrfamB\n\n\x08_trsvcidB\t\n\x07_secureB\x13\n\x11_verify_host_nameB\x08\n\x06_force\"\xb5\x01\n\x13\x64\x65lete_listener_req\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x11\n\thost_name\x18\x02 \x01(\t\x12\x0e\n\x06traddr\x18\x03 \x01(\t\x12#\n\x06\x61\x64rfam\x18\x05 \x01(\x0e\x32\x0e.AddressFamilyH\x00\x88\x01\x01\x12\x14\n\x07trsvcid\x18\x06 \x01(\rH\x01\x88\x01\x01\x12\x12\n\x05\x66orce\x18\x07 \x01(\x08H\x02\x88\x01\x01\x42\t\n\x07_adrfamB\n\n\x08_trsvcidB\x08\n\x06_force\"\'\n\x12list_listeners_req\x12\x11\n\tsubsystem\x18\x01 \x01(\t\"q\n\x13list_subsystems_req\x12\x1a\n\rsubsystem_nqn\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x1a\n\rserial_number\x18\x02 \x01(\tH\x01\x88\x01\x01\x42\x10\n\x0e_subsystem_nqnB\x10\n\x0e_serial_number\"\x14\n\x12get_subsystems_req\"U\n%get_spdk_nvmf_log_flags_and_level_req\x12\x1a\n\rall_log_flags\x18\x01 \x01(\x08H\x00\x88\x01\x01\x42\x10\n\x0e_all_log_flags\"5\n\x1a\x64isable_spdk_nvmf_logs_req\x12\x17\n\x0f\x65xtra_log_flags\x18\x01 \x03(\t\"\x97\x01\n\x16set_spdk_nvmf_logs_req\x12!\n\tlog_level\x18\x01 \x01(\x0e\x32\t.LogLevelH\x00\x88\x01\x01\x12#\n\x0bprint_level\x18\x02 \x01(\x0e\x32\t.LogLevelH\x01\x88\x01\x01\x12\x17\n\x0f\x65xtra_log_flags\x18\x03 \x03(\tB\x0c\n\n_log_levelB\x0e\n\x0c_print_level\"@\n\x14get_gateway_info_req\x12\x18\n\x0b\x63li_version\x18\x01 \x01(\tH\x00\x88\x01\x01\x42\x0e\n\x0c_cli_version\"\x1b\n\x19get_gateway_log_level_req\";\n\x19set_gateway_log_level_req\x12\x1e\n\tlog_level\x18\x01 \x01(\x0e\x32\x0b.GwLogLevel\"8\n\x1fshow_gateway_listeners_info_req\x12\x15\n\rsubsystem_nqn\x18\x01 \x01(\t\"\x17\n\x15get_gateway_stats_req\"\x16\n\x14get_thread_stats_req\"0\n\x1dset_gateway_io_stats_mode_req\x12\x0f\n\x07\x65nabled\x18\x01 \x01(\x08\"<\n\x0f\x61na_group_state\x12\x0e\n\x06grp_id\x18\x01 \x01(\r\x12\x19\n\x05state\x18\x02 \x01(\x0e\x32\n.ana_state\"?\n\x0enqn_ana_states\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12 \n\x06states\x18\x02 \x03(\x0b\x32\x10.ana_group_state\"+\n\x08\x61na_info\x12\x1f\n\x06states\x18\x01 \x03(\x0b\x32\x0f.nqn_ana_states\"3\n\nreq_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\"C\n\rsubsys_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0b\n\x03nqn\x18\x03 \x01(\t\"B\n\x0bnsid_status\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0c\n\x04nsid\x18\x03 \x01(\r\"1\n\x0fsubsystems_info\x12\x1e\n\nsubsystems\x18\x01 \x03(\x0b\x32\n.subsystem\"\xc2\x03\n\tsubsystem\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x0f\n\x07subtype\x18\x02 \x01(\t\x12)\n\x10listen_addresses\x18\x03 \x03(\x0b\x32\x0f.listen_address\x12\x14\n\x05hosts\x18\x04 \x03(\x0b\x32\x05.host\x12\x16\n\x0e\x61llow_any_host\x18\x05 \x01(\x08\x12\x1a\n\rserial_number\x18\x06 \x01(\tH\x00\x88\x01\x01\x12\x19\n\x0cmodel_number\x18\x07 \x01(\tH\x01\x88\x01\x01\x12\x1b\n\x0emax_namespaces\x18\x08 \x01(\rH\x02\x88\x01\x01\x12\x17\n\nmin_cntlid\x18\t \x01(\rH\x03\x88\x01\x01\x12\x17\n\nmax_cntlid\x18\n \x01(\rH\x04\x88\x01\x01\x12\x1e\n\nnamespaces\x18\x0b \x03(\x0b\x32\n.namespace\x12\x1b\n\x0ehas_dhchap_key\x18\x0c \x01(\x08H\x05\x88\x01\x01\x12\x14\n\x0cnetwork_mask\x18\r \x03(\tB\x10\n\x0e_serial_numberB\x0f\n\r_model_numberB\x11\n\x0f_max_namespacesB\r\n\x0b_min_cntlidB\r\n\x0b_max_cntlidB\x11\n\x0f_has_dhchap_key\"\x97\x01\n\x0elisten_address\x12\x0e\n\x06trtype\x18\x01 \x01(\t\x12\x0e\n\x06\x61\x64rfam\x18\x02 \x01(\t\x12\x0e\n\x06traddr\x18\x03 \x01(\t\x12\x0f\n\x07trsvcid\x18\x04 \x01(\t\x12\x16\n\ttransport\x18\x05 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x06secure\x18\x06 \x01(\x08H\x01\x88\x01\x01\x42\x0c\n\n_transportB\t\n\x07_secure\"\xc0\x02\n\tnamespace\x12\x0c\n\x04nsid\x18\x01 \x01(\r\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x16\n\tbdev_name\x18\x03 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05nguid\x18\x04 \x01(\tH\x01\x88\x01\x01\x12\x11\n\x04uuid\x18\x05 \x01(\tH\x02\x88\x01\x01\x12\x15\n\x08\x61nagrpid\x18\x06 \x01(\rH\x03\x88\x01\x01\x12\x12\n\x05nonce\x18\x07 \x01(\tH\x04\x88\x01\x01\x12\x19\n\x0c\x61uto_visible\x18\x08 \x01(\x08H\x05\x88\x01\x01\x12\r\n\x05hosts\x18\t \x03(\t\x12!\n\x14rados_namespace_name\x18\n \x01(\tH\x06\x88\x01\x01\x42\x0c\n\n_bdev_nameB\x08\n\x06_nguidB\x07\n\x05_uuidB\x0b\n\t_anagrpidB\x08\n\x06_nonceB\x0f\n\r_auto_visibleB\x17\n\x15_rados_namespace_name\"`\n\x13subsystems_info_cli\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\"\n\nsubsystems\x18\x03 \x03(\x0b\x32\x0e.subsystem_cli\"\xf6\x02\n\rsubsystem_cli\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x11\n\tenable_ha\x18\x02 \x01(\x08\x12\x15\n\rserial_number\x18\x03 \x01(\t\x12\x14\n\x0cmodel_number\x18\x04 \x01(\t\x12\x12\n\nmin_cntlid\x18\x05 \x01(\r\x12\x12\n\nmax_cntlid\x18\x06 \x01(\r\x12\x17\n\x0fnamespace_count\x18\x07 \x01(\r\x12\x0f\n\x07subtype\x18\x08 \x01(\t\x12\x16\n\x0emax_namespaces\x18\t \x01(\r\x12\x1b\n\x0ehas_dhchap_key\x18\n \x01(\x08H\x00\x88\x01\x01\x12\x1b\n\x0e\x61llow_any_host\x18\x0b \x01(\x08H\x01\x88\x01\x01\x12 \n\x13\x63reated_without_key\x18\x0c \x01(\x08H\x02\x88\x01\x01\x12\x14\n\x0cnetwork_mask\x18\r \x03(\tB\x11\n\x0f_has_dhchap_keyB\x11\n\x0f_allow_any_hostB\x16\n\x14_created_without_key\"\xbb\x05\n\x0cgateway_info\x12\x13\n\x0b\x63li_version\x18\x01 \x01(\t\x12\x0f\n\x07version\x18\x02 \x01(\t\x12\x0c\n\x04name\x18\x03 \x01(\t\x12\r\n\x05group\x18\x04 \x01(\t\x12\x0c\n\x04\x61\x64\x64r\x18\x05 \x01(\t\x12\x0c\n\x04port\x18\x06 \x01(\t\x12\x13\n\x0b\x62ool_status\x18\x07 \x01(\x08\x12\x0e\n\x06status\x18\x08 \x01(\x05\x12\x15\n\rerror_message\x18\t \x01(\t\x12\x19\n\x0cspdk_version\x18\n \x01(\tH\x00\x88\x01\x01\x12\x1c\n\x14load_balancing_group\x18\x0b \x01(\r\x12\x10\n\x08hostname\x18\x0c \x01(\t\x12\x1b\n\x0emax_subsystems\x18\r \x01(\rH\x01\x88\x01\x01\x12\x1b\n\x0emax_namespaces\x18\x0e \x01(\rH\x02\x88\x01\x01\x12$\n\x17max_hosts_per_subsystem\x18\x0f \x01(\rH\x03\x88\x01\x01\x12)\n\x1cmax_namespaces_per_subsystem\x18\x10 \x01(\rH\x04\x88\x01\x01\x12\x16\n\tmax_hosts\x18\x11 \x01(\rH\x05\x88\x01\x01\x12(\n\x1bgateway_initialization_over\x18\x12 \x01(\x08H\x06\x88\x01\x01\x12\x1d\n\x10io_stats_enabled\x18\x13 \x01(\x08H\x07\x88\x01\x01\x12\x15\n\x08location\x18\x14 \x01(\tH\x08\x88\x01\x01\x42\x0f\n\r_spdk_versionB\x11\n\x0f_max_subsystemsB\x11\n\x0f_max_namespacesB\x1a\n\x18_max_hosts_per_subsystemB\x1f\n\x1d_max_namespaces_per_subsystemB\x0c\n\n_max_hostsB\x1e\n\x1c_gateway_initialization_overB\x13\n\x11_io_stats_enabledB\x0b\n\t_location\"E\n\x0b\x63li_version\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0f\n\x07version\x18\x03 \x01(\t\"D\n\ngw_version\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x0f\n\x07version\x18\x03 \x01(\t\"+\n\x19poll_group_transport_info\x12\x0e\n\x06trtype\x18\x01 \x01(\t\"\xe5\x01\n\x0fpoll_group_info\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x61\x64min_qpairs\x18\x02 \x01(\r\x12\x11\n\tio_qpairs\x18\x03 \x01(\r\x12\x1c\n\x14\x63urrent_admin_qpairs\x18\x04 \x01(\r\x12\x19\n\x11\x63urrent_io_qpairs\x18\x05 \x01(\r\x12\x17\n\x0fpending_bdev_io\x18\x06 \x01(\x04\x12\x19\n\x11\x63ompleted_nvme_io\x18\x07 \x01(\x04\x12.\n\ntransports\x18\x08 \x03(\x0b\x32\x1a.poll_group_transport_info\"u\n\x12gateway_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x11\n\ttick_rate\x18\x03 \x01(\x04\x12%\n\x0bpoll_groups\x18\x04 \x03(\x0b\x32\x10.poll_group_info\"q\n\x11thread_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\"\n\x07threads\x18\x03 \x03(\x0b\x32\x11.spdk_thread_info\x12\x11\n\ttick_rate\x18\x04 \x01(\x04\"<\n\x10spdk_thread_info\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04\x62usy\x18\x02 \x01(\x04\x12\x0c\n\x04idle\x18\x03 \x01(\x04\"\xd3\x01\n\rlistener_info\x12\x11\n\thost_name\x18\x01 \x01(\t\x12\x0e\n\x06trtype\x18\x02 \x01(\t\x12\x1e\n\x06\x61\x64rfam\x18\x03 \x01(\x0e\x32\x0e.AddressFamily\x12\x0e\n\x06traddr\x18\x04 \x01(\t\x12\x0f\n\x07trsvcid\x18\x05 \x01(\r\x12\x13\n\x06secure\x18\x06 \x01(\x08H\x00\x88\x01\x01\x12\x13\n\x06\x61\x63tive\x18\x07 \x01(\x08H\x01\x88\x01\x01\x12\x13\n\x06manual\x18\x08 \x01(\x08H\x02\x88\x01\x01\x42\t\n\x07_secureB\t\n\x07_activeB\t\n\x07_manual\"Z\n\x0elisteners_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12!\n\tlisteners\x18\x03 \x03(\x0b\x32\x0e.listener_info\"^\n\x15gateway_listener_info\x12 \n\x08listener\x18\x01 \x01(\x0b\x32\x0e.listener_info\x12#\n\tlb_states\x18\x02 \x03(\x0b\x32\x10.ana_group_state\"m\n\x16gateway_listeners_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12,\n\x0cgw_listeners\x18\x03 \x03(\x0b\x32\x16.gateway_listener_info\"\x9b\x02\n\x04host\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x14\n\x07use_psk\x18\x02 \x01(\x08H\x00\x88\x01\x01\x12\x17\n\nuse_dhchap\x18\x03 \x01(\x08H\x01\x88\x01\x01\x12\x32\n%disconnected_due_to_keepalive_timeout\x18\x04 \x01(\x08H\x02\x88\x01\x01\x12\x41\n\x18\x64hchap_controller_origin\x18\x05 \x01(\x0e\x32\x1a.DHCHAPControllerKeyOriginH\x03\x88\x01\x01\x42\n\n\x08_use_pskB\r\n\x0b_use_dhchapB(\n&_disconnected_due_to_keepalive_timeoutB\x1b\n\x19_dhchap_controller_origin\"7\n\rlatency_stats\x12\x0b\n\x03min\x18\x01 \x01(\x04\x12\x0b\n\x03max\x18\x02 \x01(\x04\x12\x0c\n\x04mean\x18\x03 \x01(\x04\"\x98\x01\n\rlatency_group\x12\x10\n\x08io_count\x18\x01 \x01(\x04\x12\x1d\n\x05total\x18\x02 \x01(\x0b\x32\x0e.latency_stats\x12\x1c\n\x04\x62\x64\x65v\x18\x03 \x01(\x0b\x32\x0e.latency_stats\x12\x1b\n\x03net\x18\x04 \x01(\x0b\x32\x0e.latency_stats\x12\x1b\n\x03qos\x18\x05 \x01(\x0b\x32\x0e.latency_stats\"X\n\x0b\x62ucket_info\x12\x0c\n\x04size\x18\x01 \x01(\r\x12\x1c\n\x04read\x18\x02 \x01(\x0b\x32\x0e.latency_group\x12\x1d\n\x05write\x18\x03 \x01(\x0b\x32\x0e.latency_group\"\xb7\x01\n\x18\x63onnection_io_statistics\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\x10\n\x08host_nqn\x18\x04 \x01(\t\x12\x1a\n\rtotal_num_ios\x18\x05 \x01(\x04H\x00\x88\x01\x01\x12\x1d\n\x07\x62uckets\x18\x06 \x03(\x0b\x32\x0c.bucket_infoB\x10\n\x0e_total_num_ios\"x\n\nhosts_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x16\n\x0e\x61llow_any_host\x18\x03 \x01(\x08\x12\x15\n\rsubsystem_nqn\x18\x04 \x01(\t\x12\x14\n\x05hosts\x18\x05 \x03(\x0b\x32\x05.host\"\xa4\x04\n\nconnection\x12\x0b\n\x03nqn\x18\x01 \x01(\t\x12\x0e\n\x06traddr\x18\x02 \x01(\t\x12\x0f\n\x07trsvcid\x18\x03 \x01(\r\x12\x0e\n\x06trtype\x18\x04 \x01(\t\x12\x1e\n\x06\x61\x64rfam\x18\x05 \x01(\x0e\x32\x0e.AddressFamily\x12\x11\n\tconnected\x18\x06 \x01(\x08\x12\x14\n\x0cqpairs_count\x18\x07 \x01(\x05\x12\x15\n\rcontroller_id\x18\x08 \x01(\x05\x12\x13\n\x06secure\x18\t \x01(\x08H\x00\x88\x01\x01\x12\x14\n\x07use_psk\x18\n \x01(\x08H\x01\x88\x01\x01\x12\x17\n\nuse_dhchap\x18\x0b \x01(\x08H\x02\x88\x01\x01\x12\x16\n\tsubsystem\x18\x0c \x01(\tH\x03\x88\x01\x01\x12\x32\n%disconnected_due_to_keepalive_timeout\x18\r \x01(\x08H\x04\x88\x01\x01\x12\x41\n\x18\x64hchap_controller_origin\x18\x0e \x01(\x0e\x32\x1a.DHCHAPControllerKeyOriginH\x05\x88\x01\x01\x12\x19\n\x0chost_deleted\x18\x0f \x01(\x08H\x06\x88\x01\x01\x42\t\n\x07_secureB\n\n\x08_use_pskB\r\n\x0b_use_dhchapB\x0c\n\n_subsystemB(\n&_disconnected_due_to_keepalive_timeoutB\x1b\n\x19_dhchap_controller_originB\x0f\n\r_host_deleted\"r\n\x10\x63onnections_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12 \n\x0b\x63onnections\x18\x04 \x03(\x0b\x32\x0b.connection\"\xd8\x07\n\rnamespace_cli\x12\x0c\n\x04nsid\x18\x01 \x01(\r\x12\x11\n\tbdev_name\x18\x02 \x01(\t\x12\x16\n\x0erbd_image_name\x18\x03 \x01(\t\x12\x15\n\rrbd_pool_name\x18\x04 \x01(\t\x12\x1c\n\x14load_balancing_group\x18\x05 \x01(\r\x12\x12\n\nblock_size\x18\x06 \x01(\r\x12\x16\n\x0erbd_image_size\x18\x07 \x01(\x04\x12\x0c\n\x04uuid\x18\x08 \x01(\t\x12\x19\n\x11rw_ios_per_second\x18\t \x01(\x04\x12\x1c\n\x14rw_mbytes_per_second\x18\n \x01(\x04\x12\x1b\n\x13r_mbytes_per_second\x18\x0b \x01(\x04\x12\x1b\n\x13w_mbytes_per_second\x18\x0c \x01(\x04\x12\x14\n\x0c\x61uto_visible\x18\r \x01(\x08\x12\r\n\x05hosts\x18\x0e \x03(\t\x12\x1d\n\x10ns_subsystem_nqn\x18\x0f \x01(\tH\x00\x88\x01\x01\x12\x18\n\x0btrash_image\x18\x10 \x01(\x08H\x01\x88\x01\x01\x12 \n\x13\x64isable_auto_resize\x18\x11 \x01(\x08H\x02\x88\x01\x01\x12\x16\n\tread_only\x18\x12 \x01(\x08H\x03\x88\x01\x01\x12\x19\n\x0c\x63luster_name\x18\x13 \x01(\tH\x04\x88\x01\x01\x12,\n\x1f\x63onfigured_load_balancing_group\x18\x14 \x01(\rH\x05\x88\x01\x01\x12\x1d\n\x10image_was_shrunk\x18\x15 \x01(\x08H\x06\x88\x01\x01\x12\x1f\n\x12rbd_data_pool_name\x18\x16 \x01(\tH\x07\x88\x01\x01\x12\x15\n\x08location\x18\x17 \x01(\tH\x08\x88\x01\x01\x12!\n\x14rados_namespace_name\x18\x18 \x01(\tH\t\x88\x01\x01\x12\x37\n\x14\x65ncryption_algorithm\x18\x19 \x01(\x0e\x32\x14.EncryptionAlgorithmH\n\x88\x01\x01\x12-\n\x12\x65ncryption_entries\x18\x1a \x03(\x0b\x32\x11.encryption_entryB\x13\n\x11_ns_subsystem_nqnB\x0e\n\x0c_trash_imageB\x16\n\x14_disable_auto_resizeB\x0c\n\n_read_onlyB\x0f\n\r_cluster_nameB\"\n _configured_load_balancing_groupB\x13\n\x11_image_was_shrunkB\x15\n\x13_rbd_data_pool_nameB\x0b\n\t_locationB\x17\n\x15_rados_namespace_nameB\x17\n\x15_encryption_algorithm\"s\n\x0fnamespaces_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\"\n\nnamespaces\x18\x04 \x03(\x0b\x32\x0e.namespace_cli\"1\n\x12namespace_io_error\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r\"\x91\x01\n\x1dlist_namespaces_io_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x11\n\ttick_rate\x18\x03 \x01(\x04\x12\r\n\x05ticks\x18\x04 \x01(\x04\x12\'\n\nnamespaces\x18\x05 \x03(\x0b\x32\x13.bdev_io_stats_info\"\xf7\x04\n\x12\x62\x64\x65v_io_stats_info\x12\x11\n\tbdev_name\x18\x01 \x01(\t\x12\x12\n\nbytes_read\x18\x02 \x01(\x04\x12\x14\n\x0cnum_read_ops\x18\x03 \x01(\x04\x12\x15\n\rbytes_written\x18\x04 \x01(\x04\x12\x15\n\rnum_write_ops\x18\x05 \x01(\x04\x12\x16\n\x0e\x62ytes_unmapped\x18\x06 \x01(\x04\x12\x15\n\rnum_unmap_ops\x18\x07 \x01(\x04\x12\x14\n\x0c\x62ytes_copied\x18\x08 \x01(\x04\x12\x14\n\x0cnum_copy_ops\x18\t \x01(\x04\x12\x1a\n\x12read_latency_ticks\x18\n \x01(\x04\x12\x1e\n\x16max_read_latency_ticks\x18\x0b \x01(\x04\x12\x1e\n\x16min_read_latency_ticks\x18\x0c \x01(\x04\x12\x1b\n\x13write_latency_ticks\x18\r \x01(\x04\x12\x1f\n\x17max_write_latency_ticks\x18\x0e \x01(\x04\x12\x1f\n\x17min_write_latency_ticks\x18\x0f \x01(\x04\x12\x1b\n\x13unmap_latency_ticks\x18\x10 \x01(\x04\x12\x1f\n\x17max_unmap_latency_ticks\x18\x11 \x01(\x04\x12\x1f\n\x17min_unmap_latency_ticks\x18\x12 \x01(\x04\x12\x1a\n\x12\x63opy_latency_ticks\x18\x13 \x01(\x04\x12\x1e\n\x16max_copy_latency_ticks\x18\x14 \x01(\x04\x12\x1e\n\x16min_copy_latency_ticks\x18\x15 \x01(\x04\x12%\n\x08io_error\x18\x16 \x03(\x0b\x32\x13.namespace_io_error\"\xda\x05\n\x17namespace_io_stats_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x15\n\rsubsystem_nqn\x18\x03 \x01(\t\x12\x0c\n\x04nsid\x18\x04 \x01(\r\x12\x11\n\x04uuid\x18\x05 \x01(\tH\x00\x88\x01\x01\x12\x11\n\tbdev_name\x18\x06 \x01(\t\x12\x11\n\ttick_rate\x18\x07 \x01(\x04\x12\r\n\x05ticks\x18\x08 \x01(\x04\x12\x12\n\nbytes_read\x18\t \x01(\x04\x12\x14\n\x0cnum_read_ops\x18\n \x01(\x04\x12\x15\n\rbytes_written\x18\x0b \x01(\x04\x12\x15\n\rnum_write_ops\x18\x0c \x01(\x04\x12\x16\n\x0e\x62ytes_unmapped\x18\r \x01(\x04\x12\x15\n\rnum_unmap_ops\x18\x0e \x01(\x04\x12\x1a\n\x12read_latency_ticks\x18\x0f \x01(\x04\x12\x1e\n\x16max_read_latency_ticks\x18\x10 \x01(\x04\x12\x1e\n\x16min_read_latency_ticks\x18\x11 \x01(\x04\x12\x1b\n\x13write_latency_ticks\x18\x12 \x01(\x04\x12\x1f\n\x17max_write_latency_ticks\x18\x13 \x01(\x04\x12\x1f\n\x17min_write_latency_ticks\x18\x14 \x01(\x04\x12\x1b\n\x13unmap_latency_ticks\x18\x15 \x01(\x04\x12\x1f\n\x17max_unmap_latency_ticks\x18\x16 \x01(\x04\x12\x1f\n\x17min_unmap_latency_ticks\x18\x17 \x01(\x04\x12\x1a\n\x12\x63opy_latency_ticks\x18\x18 \x01(\x04\x12\x1e\n\x16max_copy_latency_ticks\x18\x19 \x01(\x04\x12\x1e\n\x16min_copy_latency_ticks\x18\x1a \x01(\x04\x12%\n\x08io_error\x18\x1b \x03(\x0b\x32\x13.namespace_io_errorB\x07\n\x05_uuid\"3\n\x12spdk_log_flag_info\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x65nabled\x18\x02 \x01(\x08\"\xba\x01\n\"spdk_nvmf_log_flags_and_level_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12+\n\x0envmf_log_flags\x18\x03 \x03(\x0b\x32\x13.spdk_log_flag_info\x12\x1c\n\tlog_level\x18\x04 \x01(\x0e\x32\t.LogLevel\x12\"\n\x0flog_print_level\x18\x05 \x01(\x0e\x32\t.LogLevel\"_\n\x16gateway_log_level_info\x12\x0e\n\x06status\x18\x01 \x01(\x05\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12\x1e\n\tlog_level\x18\x03 \x01(\x0e\x32\x0b.GwLogLevel\"E\n\x10\x65ncryption_entry\x12!\n\x06\x66ormat\x18\x01 \x01(\x0e\x32\x11.EncryptionFormat\x12\x0e\n\x06key_id\x18\x02 \x01(\t*#\n\rAddressFamily\x12\x08\n\x04ipv4\x10\x00\x12\x08\n\x04ipv6\x10\x01*C\n\x08LogLevel\x12\t\n\x05\x45RROR\x10\x00\x12\x0b\n\x07WARNING\x10\x01\x12\n\n\x06NOTICE\x10\x02\x12\x08\n\x04INFO\x10\x03\x12\t\n\x05\x44\x45\x42UG\x10\x04*S\n\nGwLogLevel\x12\n\n\x06notset\x10\x00\x12\t\n\x05\x64\x65\x62ug\x10\n\x12\x08\n\x04info\x10\x14\x12\x0b\n\x07warning\x10\x1e\x12\t\n\x05\x65rror\x10(\x12\x0c\n\x08\x63ritical\x10\x32*2\n\x10\x45ncryptionFormat\x12\x08\n\x04none\x10\x00\x12\t\n\x05luks1\x10\x01\x12\t\n\x05luks2\x10\x02*?\n\x13\x45ncryptionAlgorithm\x12\x10\n\x0cno_algorithm\x10\x00\x12\n\n\x06\x61\x65s128\x10\x01\x12\n\n\x06\x61\x65s256\x10\x02*R\n\x19\x44HCHAPControllerKeyOrigin\x12\n\n\x06no_key\x10\x00\x12\x11\n\rhost_specific\x10\x01\x12\x16\n\x12subsystem_implicit\x10\x02*J\n\tana_state\x12\t\n\x05UNSET\x10\x00\x12\r\n\tOPTIMIZED\x10\x01\x12\x11\n\rNON_OPTIMIZED\x10\x02\x12\x10\n\x0cINACCESSIBLE\x10\x03\x32\xf6\x18\n\x07Gateway\x12\x33\n\rnamespace_add\x12\x12.namespace_add_req\x1a\x0c.nsid_status\"\x00\x12;\n\x10\x63reate_subsystem\x12\x15.create_subsystem_req\x1a\x0e.subsys_status\"\x00\x12\x38\n\x10\x64\x65lete_subsystem\x12\x15.delete_subsystem_req\x1a\x0b.req_status\"\x00\x12@\n\x14\x63hange_subsystem_key\x12\x19.change_subsystem_key_req\x1a\x0b.req_status\"\x00\x12\x42\n\x15\x61\x64\x64_subsystem_network\x12\x1a.add_subsystem_network_req\x1a\x0b.req_status\"\x00\x12\x42\n\x15\x64\x65l_subsystem_network\x12\x1a.del_subsystem_network_req\x1a\x0b.req_status\"\x00\x12K\n\x12gw_refresh_network\x12\x17.gw_refresh_network_req\x1a\x1a.gw_refresh_network_status\"\x00\x12J\n\x19\x61\x64\x64_kmip_server_endpoints\x12\x1e.add_kmip_server_endpoints_req\x1a\x0b.req_status\"\x00\x12J\n\x19\x64\x65l_kmip_server_endpoints\x12\x1e.del_kmip_server_endpoints_req\x1a\x0b.req_status\"\x00\x12\\\n\x1alist_kmip_server_endpoints\x12\x1f.list_kmip_server_endpoints_req\x1a\x1b.kmip_server_endpoints_info\"\x00\x12;\n\x0flist_namespaces\x12\x14.list_namespaces_req\x1a\x10.namespaces_info\"\x00\x12\x38\n\x10namespace_resize\x12\x15.namespace_resize_req\x1a\x0b.req_status\"\x00\x12Q\n\x16namespace_get_io_stats\x12\x1b.namespace_get_io_stats_req\x1a\x18.namespace_io_stats_info\"\x00\x12[\n\x18list_namespaces_io_stats\x12\x1d.list_namespaces_io_stats_req\x1a\x1e.list_namespaces_io_stats_info\"\x00\x12\x41\n\x18namespace_set_qos_limits\x12\x16.namespace_set_qos_req\x1a\x0b.req_status\"\x00\x12\x62\n%namespace_change_load_balancing_group\x12*.namespace_change_load_balancing_group_req\x1a\x0b.req_status\"\x00\x12N\n\x1bnamespace_change_visibility\x12 .namespace_change_visibility_req\x1a\x0b.req_status\"\x00\x12J\n\x19namespace_change_location\x12\x1e.namespace_change_location_req\x1a\x0b.req_status\"\x00\x12R\n\x1dnamespace_set_rbd_trash_image\x12\".namespace_set_rbd_trash_image_req\x1a\x0b.req_status\"\x00\x12J\n\x19namespace_set_auto_resize\x12\x1e.namespace_set_auto_resize_req\x1a\x0b.req_status\"\x00\x12\x38\n\x10namespace_delete\x12\x15.namespace_delete_req\x1a\x0b.req_status\"\x00\x12<\n\x12namespace_add_host\x12\x17.namespace_add_host_req\x1a\x0b.req_status\"\x00\x12\x42\n\x15namespace_delete_host\x12\x1a.namespace_delete_host_req\x1a\x0b.req_status\"\x00\x12(\n\x08\x61\x64\x64_host\x12\r.add_host_req\x1a\x0b.req_status\"\x00\x12.\n\x0bremove_host\x12\x10.remove_host_req\x1a\x0b.req_status\"\x00\x12\x46\n\x17set_keep_host_connected\x12\x1c.set_keep_host_connected_req\x1a\x0b.req_status\"\x00\x12\x36\n\x0f\x63hange_host_key\x12\x14.change_host_key_req\x1a\x0b.req_status\"\x00\x12,\n\nlist_hosts\x12\x0f.list_hosts_req\x1a\x0b.hosts_info\"\x00\x12>\n\x10list_connections\x12\x15.list_connections_req\x1a\x11.connections_info\"\x00\x12^\n\x1cget_connection_io_statistics\x12!.get_connection_io_statistics_req\x1a\x19.connection_io_statistics\"\x00\x12\x36\n\x0f\x63reate_listener\x12\x14.create_listener_req\x1a\x0b.req_status\"\x00\x12\x36\n\x0f\x64\x65lete_listener\x12\x14.delete_listener_req\x1a\x0b.req_status\"\x00\x12\x38\n\x0elist_listeners\x12\x13.list_listeners_req\x1a\x0f.listeners_info\"\x00\x12?\n\x0flist_subsystems\x12\x14.list_subsystems_req\x1a\x14.subsystems_info_cli\"\x00\x12\x39\n\x0eget_subsystems\x12\x13.get_subsystems_req\x1a\x10.subsystems_info\"\x00\x12)\n\rset_ana_state\x12\t.ana_info\x1a\x0b.req_status\"\x00\x12r\n!get_spdk_nvmf_log_flags_and_level\x12&.get_spdk_nvmf_log_flags_and_level_req\x1a#.spdk_nvmf_log_flags_and_level_info\"\x00\x12\x44\n\x16\x64isable_spdk_nvmf_logs\x12\x1b.disable_spdk_nvmf_logs_req\x1a\x0b.req_status\"\x00\x12<\n\x12set_spdk_nvmf_logs\x12\x17.set_spdk_nvmf_logs_req\x1a\x0b.req_status\"\x00\x12:\n\x10get_gateway_info\x12\x15.get_gateway_info_req\x1a\r.gateway_info\"\x00\x12N\n\x15get_gateway_log_level\x12\x1a.get_gateway_log_level_req\x1a\x17.gateway_log_level_info\"\x00\x12\x42\n\x15set_gateway_log_level\x12\x1a.set_gateway_log_level_req\x1a\x0b.req_status\"\x00\x12Z\n\x1bshow_gateway_listeners_info\x12 .show_gateway_listeners_info_req\x1a\x17.gateway_listeners_info\"\x00\x12\x42\n\x11get_gateway_stats\x12\x16.get_gateway_stats_req\x1a\x13.gateway_stats_info\"\x00\x12?\n\x10get_thread_stats\x12\x15.get_thread_stats_req\x1a\x12.thread_stats_info\"\x00\x12J\n\x19set_gateway_io_stats_mode\x12\x1e.set_gateway_io_stats_mode_req\x1a\x0b.req_status\"\x00\x42+Z)github.com/ceph/ceph-nvmeof/lib/go/nvmeofb\x06proto3'
 )
 
 _ADDRESSFAMILY = _descriptor.EnumDescriptor(
@@ -43,8 +43,8 @@ _ADDRESSFAMILY = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14328,
-  serialized_end=14363,
+  serialized_start=14706,
+  serialized_end=14741,
 )
 _sym_db.RegisterEnumDescriptor(_ADDRESSFAMILY)
 
@@ -84,8 +84,8 @@ _LOGLEVEL = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14365,
-  serialized_end=14432,
+  serialized_start=14743,
+  serialized_end=14810,
 )
 _sym_db.RegisterEnumDescriptor(_LOGLEVEL)
 
@@ -130,8 +130,8 @@ _GWLOGLEVEL = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14434,
-  serialized_end=14517,
+  serialized_start=14812,
+  serialized_end=14895,
 )
 _sym_db.RegisterEnumDescriptor(_GWLOGLEVEL)
 
@@ -161,8 +161,8 @@ _ENCRYPTIONFORMAT = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14519,
-  serialized_end=14569,
+  serialized_start=14897,
+  serialized_end=14947,
 )
 _sym_db.RegisterEnumDescriptor(_ENCRYPTIONFORMAT)
 
@@ -192,8 +192,8 @@ _ENCRYPTIONALGORITHM = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14571,
-  serialized_end=14634,
+  serialized_start=14949,
+  serialized_end=15012,
 )
 _sym_db.RegisterEnumDescriptor(_ENCRYPTIONALGORITHM)
 
@@ -223,8 +223,8 @@ _DHCHAPCONTROLLERKEYORIGIN = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14636,
-  serialized_end=14718,
+  serialized_start=15014,
+  serialized_end=15096,
 )
 _sym_db.RegisterEnumDescriptor(_DHCHAPCONTROLLERKEYORIGIN)
 
@@ -259,8 +259,8 @@ _ANA_STATE = _descriptor.EnumDescriptor(
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=14720,
-  serialized_end=14794,
+  serialized_start=15098,
+  serialized_end=15172,
 )
 _sym_db.RegisterEnumDescriptor(_ANA_STATE)
 
@@ -1532,6 +1532,91 @@ _DEL_SUBSYSTEM_NETWORK_REQ = _descriptor.Descriptor(
 )
 
 
+_GW_REFRESH_NETWORK_REQ = _descriptor.Descriptor(
+  name='gw_refresh_network_req',
+  full_name='gw_refresh_network_req',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='subsystem_nqn', full_name='gw_refresh_network_req.subsystem_nqn', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=3210,
+  serialized_end=3257,
+)
+
+
+_GW_REFRESH_NETWORK_STATUS = _descriptor.Descriptor(
+  name='gw_refresh_network_status',
+  full_name='gw_refresh_network_status',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='status', full_name='gw_refresh_network_status.status', index=0,
+      number=1, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='error_message', full_name='gw_refresh_network_status.error_message', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='added', full_name='gw_refresh_network_status.added', index=2,
+      number=3, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='removed', full_name='gw_refresh_network_status.removed', index=3,
+      number=4, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=3259,
+  serialized_end=3357,
+)
+
+
 _KMIP_SERVER_ENDPOINT = _descriptor.Descriptor(
   name='kmip_server_endpoint',
   full_name='kmip_server_endpoint',
@@ -1571,8 +1656,8 @@ _KMIP_SERVER_ENDPOINT = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=3210,
-  serialized_end=3277,
+  serialized_start=3359,
+  serialized_end=3426,
 )
 
 
@@ -1624,8 +1709,8 @@ _KMIP_SERVER_ENDPOINT_CLI = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3279,
-  serialized_end=3380,
+  serialized_start=3428,
+  serialized_end=3529,
 )
 
 
@@ -1670,8 +1755,8 @@ _ADD_KMIP_SERVER_ENDPOINTS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3382,
-  serialized_end=3499,
+  serialized_start=3531,
+  serialized_end=3648,
 )
 
 
@@ -1716,8 +1801,8 @@ _DEL_KMIP_SERVER_ENDPOINTS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3501,
-  serialized_end=3618,
+  serialized_start=3650,
+  serialized_end=3767,
 )
 
 
@@ -1765,8 +1850,8 @@ _LIST_KMIP_SERVER_ENDPOINTS_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=3620,
-  serialized_end=3740,
+  serialized_start=3769,
+  serialized_end=3889,
 )
 
 
@@ -1811,8 +1896,8 @@ _KMIP_SERVER_ENDPOINTS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3742,
-  serialized_end=3855,
+  serialized_start=3891,
+  serialized_end=4004,
 )
 
 
@@ -1867,8 +1952,8 @@ _LIST_NAMESPACES_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=3857,
-  serialized_end=3953,
+  serialized_start=4006,
+  serialized_end=4102,
 )
 
 
@@ -1978,8 +2063,8 @@ _ADD_HOST_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=3956,
-  serialized_end=4279,
+  serialized_start=4105,
+  serialized_end=4428,
 )
 
 
@@ -2041,8 +2126,8 @@ _CHANGE_HOST_KEY_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=4282,
-  serialized_end=4436,
+  serialized_start=4431,
+  serialized_end=4585,
 )
 
 
@@ -2092,8 +2177,8 @@ _GET_CONNECTION_IO_STATISTICS_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=4438,
-  serialized_end=4543,
+  serialized_start=4587,
+  serialized_end=4692,
 )
 
 
@@ -2126,6 +2211,13 @@ _REMOVE_HOST_REQ = _descriptor.Descriptor(
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='keep_connections', full_name='remove_host_req.keep_connections', index=3,
+      number=4, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -2142,9 +2234,53 @@ _REMOVE_HOST_REQ = _descriptor.Descriptor(
       index=0, containing_type=None,
       create_key=_descriptor._internal_create_key,
     fields=[]),
+    _descriptor.OneofDescriptor(
+      name='_keep_connections', full_name='remove_host_req._keep_connections',
+      index=1, containing_type=None,
+      create_key=_descriptor._internal_create_key,
+    fields=[]),
   ],
-  serialized_start=4545,
-  serialized_end=4633,
+  serialized_start=4695,
+  serialized_end=4835,
+)
+
+
+_SET_KEEP_HOST_CONNECTED_REQ = _descriptor.Descriptor(
+  name='set_keep_host_connected_req',
+  full_name='set_keep_host_connected_req',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='subsystem_nqn', full_name='set_keep_host_connected_req.subsystem_nqn', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='host_nqn', full_name='set_keep_host_connected_req.host_nqn', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=4837,
+  serialized_end=4907,
 )
 
 
@@ -2187,8 +2323,8 @@ _LIST_HOSTS_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=4635,
-  serialized_end=4714,
+  serialized_start=4909,
+  serialized_end=4988,
 )
 
 
@@ -2231,8 +2367,8 @@ _LIST_CONNECTIONS_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=4716,
-  serialized_end=4801,
+  serialized_start=4990,
+  serialized_end=5075,
 )
 
 
@@ -2337,8 +2473,8 @@ _CREATE_LISTENER_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=4804,
-  serialized_end=5069,
+  serialized_start=5078,
+  serialized_end=5343,
 )
 
 
@@ -2419,8 +2555,8 @@ _DELETE_LISTENER_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=5072,
-  serialized_end=5253,
+  serialized_start=5346,
+  serialized_end=5527,
 )
 
 
@@ -2451,8 +2587,8 @@ _LIST_LISTENERS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5255,
-  serialized_end=5294,
+  serialized_start=5529,
+  serialized_end=5568,
 )
 
 
@@ -2500,8 +2636,8 @@ _LIST_SUBSYSTEMS_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=5296,
-  serialized_end=5409,
+  serialized_start=5570,
+  serialized_end=5683,
 )
 
 
@@ -2525,8 +2661,8 @@ _GET_SUBSYSTEMS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5411,
-  serialized_end=5431,
+  serialized_start=5685,
+  serialized_end=5705,
 )
 
 
@@ -2562,8 +2698,8 @@ _GET_SPDK_NVMF_LOG_FLAGS_AND_LEVEL_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=5433,
-  serialized_end=5518,
+  serialized_start=5707,
+  serialized_end=5792,
 )
 
 
@@ -2594,8 +2730,8 @@ _DISABLE_SPDK_NVMF_LOGS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5520,
-  serialized_end=5573,
+  serialized_start=5794,
+  serialized_end=5847,
 )
 
 
@@ -2650,8 +2786,8 @@ _SET_SPDK_NVMF_LOGS_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=5576,
-  serialized_end=5727,
+  serialized_start=5850,
+  serialized_end=6001,
 )
 
 
@@ -2687,8 +2823,8 @@ _GET_GATEWAY_INFO_REQ = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=5729,
-  serialized_end=5793,
+  serialized_start=6003,
+  serialized_end=6067,
 )
 
 
@@ -2712,8 +2848,8 @@ _GET_GATEWAY_LOG_LEVEL_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5795,
-  serialized_end=5822,
+  serialized_start=6069,
+  serialized_end=6096,
 )
 
 
@@ -2744,8 +2880,8 @@ _SET_GATEWAY_LOG_LEVEL_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5824,
-  serialized_end=5883,
+  serialized_start=6098,
+  serialized_end=6157,
 )
 
 
@@ -2776,8 +2912,8 @@ _SHOW_GATEWAY_LISTENERS_INFO_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5885,
-  serialized_end=5941,
+  serialized_start=6159,
+  serialized_end=6215,
 )
 
 
@@ -2801,8 +2937,8 @@ _GET_GATEWAY_STATS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5943,
-  serialized_end=5966,
+  serialized_start=6217,
+  serialized_end=6240,
 )
 
 
@@ -2826,8 +2962,8 @@ _GET_THREAD_STATS_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5968,
-  serialized_end=5990,
+  serialized_start=6242,
+  serialized_end=6264,
 )
 
 
@@ -2858,8 +2994,8 @@ _SET_GATEWAY_IO_STATS_MODE_REQ = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5992,
-  serialized_end=6040,
+  serialized_start=6266,
+  serialized_end=6314,
 )
 
 
@@ -2897,8 +3033,8 @@ _ANA_GROUP_STATE = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6042,
-  serialized_end=6102,
+  serialized_start=6316,
+  serialized_end=6376,
 )
 
 
@@ -2936,8 +3072,8 @@ _NQN_ANA_STATES = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6104,
-  serialized_end=6167,
+  serialized_start=6378,
+  serialized_end=6441,
 )
 
 
@@ -2968,8 +3104,8 @@ _ANA_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6169,
-  serialized_end=6212,
+  serialized_start=6443,
+  serialized_end=6486,
 )
 
 
@@ -3007,8 +3143,8 @@ _REQ_STATUS = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6214,
-  serialized_end=6265,
+  serialized_start=6488,
+  serialized_end=6539,
 )
 
 
@@ -3053,8 +3189,8 @@ _SUBSYS_STATUS = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6267,
-  serialized_end=6334,
+  serialized_start=6541,
+  serialized_end=6608,
 )
 
 
@@ -3099,8 +3235,8 @@ _NSID_STATUS = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6336,
-  serialized_end=6402,
+  serialized_start=6610,
+  serialized_end=6676,
 )
 
 
@@ -3131,8 +3267,8 @@ _SUBSYSTEMS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6404,
-  serialized_end=6453,
+  serialized_start=6678,
+  serialized_end=6727,
 )
 
 
@@ -3277,8 +3413,8 @@ _SUBSYSTEM = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=6456,
-  serialized_end=6906,
+  serialized_start=6730,
+  serialized_end=7180,
 )
 
 
@@ -3354,8 +3490,8 @@ _LISTEN_ADDRESS = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=6909,
-  serialized_end=7060,
+  serialized_start=7183,
+  serialized_end=7334,
 )
 
 
@@ -3430,6 +3566,13 @@ _NAMESPACE = _descriptor.Descriptor(
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rados_namespace_name', full_name='namespace.rados_namespace_name', index=9,
+      number=10, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -3471,9 +3614,14 @@ _NAMESPACE = _descriptor.Descriptor(
       index=5, containing_type=None,
       create_key=_descriptor._internal_create_key,
     fields=[]),
+    _descriptor.OneofDescriptor(
+      name='_rados_namespace_name', full_name='namespace._rados_namespace_name',
+      index=6, containing_type=None,
+      create_key=_descriptor._internal_create_key,
+    fields=[]),
   ],
-  serialized_start=7063,
-  serialized_end=7323,
+  serialized_start=7337,
+  serialized_end=7657,
 )
 
 
@@ -3518,8 +3666,8 @@ _SUBSYSTEMS_INFO_CLI = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=7325,
-  serialized_end=7421,
+  serialized_start=7659,
+  serialized_end=7755,
 )
 
 
@@ -3649,8 +3797,8 @@ _SUBSYSTEM_CLI = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=7424,
-  serialized_end=7798,
+  serialized_start=7758,
+  serialized_end=8132,
 )
 
 
@@ -3859,8 +4007,8 @@ _GATEWAY_INFO = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=7801,
-  serialized_end=8500,
+  serialized_start=8135,
+  serialized_end=8834,
 )
 
 
@@ -3905,8 +4053,8 @@ _CLI_VERSION = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8502,
-  serialized_end=8571,
+  serialized_start=8836,
+  serialized_end=8905,
 )
 
 
@@ -3951,8 +4099,8 @@ _GW_VERSION = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8573,
-  serialized_end=8641,
+  serialized_start=8907,
+  serialized_end=8975,
 )
 
 
@@ -3983,8 +4131,8 @@ _POLL_GROUP_TRANSPORT_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8643,
-  serialized_end=8686,
+  serialized_start=8977,
+  serialized_end=9020,
 )
 
 
@@ -4064,8 +4212,8 @@ _POLL_GROUP_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8689,
-  serialized_end=8918,
+  serialized_start=9023,
+  serialized_end=9252,
 )
 
 
@@ -4117,8 +4265,8 @@ _GATEWAY_STATS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8920,
-  serialized_end=9037,
+  serialized_start=9254,
+  serialized_end=9371,
 )
 
 
@@ -4170,8 +4318,8 @@ _THREAD_STATS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=9039,
-  serialized_end=9152,
+  serialized_start=9373,
+  serialized_end=9486,
 )
 
 
@@ -4216,8 +4364,8 @@ _SPDK_THREAD_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=9154,
-  serialized_end=9214,
+  serialized_start=9488,
+  serialized_end=9548,
 )
 
 
@@ -4312,8 +4460,8 @@ _LISTENER_INFO = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=9217,
-  serialized_end=9428,
+  serialized_start=9551,
+  serialized_end=9762,
 )
 
 
@@ -4358,8 +4506,8 @@ _LISTENERS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=9430,
-  serialized_end=9520,
+  serialized_start=9764,
+  serialized_end=9854,
 )
 
 
@@ -4397,8 +4545,8 @@ _GATEWAY_LISTENER_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=9522,
-  serialized_end=9616,
+  serialized_start=9856,
+  serialized_end=9950,
 )
 
 
@@ -4443,8 +4591,8 @@ _GATEWAY_LISTENERS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=9618,
-  serialized_end=9727,
+  serialized_start=9952,
+  serialized_end=10061,
 )
 
 
@@ -4523,8 +4671,8 @@ _HOST = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=9730,
-  serialized_end=10013,
+  serialized_start=10064,
+  serialized_end=10347,
 )
 
 
@@ -4569,8 +4717,8 @@ _LATENCY_STATS = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=10015,
-  serialized_end=10070,
+  serialized_start=10349,
+  serialized_end=10404,
 )
 
 
@@ -4629,8 +4777,8 @@ _LATENCY_GROUP = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=10073,
-  serialized_end=10225,
+  serialized_start=10407,
+  serialized_end=10559,
 )
 
 
@@ -4675,8 +4823,8 @@ _BUCKET_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=10227,
-  serialized_end=10315,
+  serialized_start=10561,
+  serialized_end=10649,
 )
 
 
@@ -4747,8 +4895,8 @@ _CONNECTION_IO_STATISTICS = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=10318,
-  serialized_end=10501,
+  serialized_start=10652,
+  serialized_end=10835,
 )
 
 
@@ -4807,8 +4955,8 @@ _HOSTS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=10503,
-  serialized_end=10623,
+  serialized_start=10837,
+  serialized_end=10957,
 )
 
 
@@ -4918,6 +5066,13 @@ _CONNECTION = _descriptor.Descriptor(
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='host_deleted', full_name='connection.host_deleted', index=14,
+      number=15, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
   ],
   extensions=[
   ],
@@ -4959,9 +5114,14 @@ _CONNECTION = _descriptor.Descriptor(
       index=5, containing_type=None,
       create_key=_descriptor._internal_create_key,
     fields=[]),
+    _descriptor.OneofDescriptor(
+      name='_host_deleted', full_name='connection._host_deleted',
+      index=6, containing_type=None,
+      create_key=_descriptor._internal_create_key,
+    fields=[]),
   ],
-  serialized_start=10626,
-  serialized_end=11130,
+  serialized_start=10960,
+  serialized_end=11508,
 )
 
 
@@ -5013,8 +5173,8 @@ _CONNECTIONS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=11132,
-  serialized_end=11246,
+  serialized_start=11510,
+  serialized_end=11624,
 )
 
 
@@ -5275,8 +5435,8 @@ _NAMESPACE_CLI = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=11249,
-  serialized_end=12233,
+  serialized_start=11627,
+  serialized_end=12611,
 )
 
 
@@ -5328,8 +5488,8 @@ _NAMESPACES_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=12235,
-  serialized_end=12350,
+  serialized_start=12613,
+  serialized_end=12728,
 )
 
 
@@ -5367,8 +5527,8 @@ _NAMESPACE_IO_ERROR = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=12352,
-  serialized_end=12401,
+  serialized_start=12730,
+  serialized_end=12779,
 )
 
 
@@ -5427,8 +5587,8 @@ _LIST_NAMESPACES_IO_STATS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=12404,
-  serialized_end=12549,
+  serialized_start=12782,
+  serialized_end=12927,
 )
 
 
@@ -5606,8 +5766,8 @@ _BDEV_IO_STATS_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=12552,
-  serialized_end=13183,
+  serialized_start=12930,
+  serialized_end=13561,
 )
 
 
@@ -5825,8 +5985,8 @@ _NAMESPACE_IO_STATS_INFO = _descriptor.Descriptor(
       create_key=_descriptor._internal_create_key,
     fields=[]),
   ],
-  serialized_start=13186,
-  serialized_end=13916,
+  serialized_start=13564,
+  serialized_end=14294,
 )
 
 
@@ -5864,8 +6024,8 @@ _SPDK_LOG_FLAG_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=13918,
-  serialized_end=13969,
+  serialized_start=14296,
+  serialized_end=14347,
 )
 
 
@@ -5924,8 +6084,8 @@ _SPDK_NVMF_LOG_FLAGS_AND_LEVEL_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=13972,
-  serialized_end=14158,
+  serialized_start=14350,
+  serialized_end=14536,
 )
 
 
@@ -5970,8 +6130,8 @@ _GATEWAY_LOG_LEVEL_INFO = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=14160,
-  serialized_end=14255,
+  serialized_start=14538,
+  serialized_end=14633,
 )
 
 
@@ -6009,8 +6169,8 @@ _ENCRYPTION_ENTRY = _descriptor.Descriptor(
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=14257,
-  serialized_end=14326,
+  serialized_start=14635,
+  serialized_end=14704,
 )
 
 _NAMESPACE_ADD_REQ.fields_by_name['encryption_entries'].message_type = _ENCRYPTION_ENTRY
@@ -6183,6 +6343,9 @@ _GET_CONNECTION_IO_STATISTICS_REQ.fields_by_name['reset'].containing_oneof = _GE
 _REMOVE_HOST_REQ.oneofs_by_name['_force'].fields.append(
   _REMOVE_HOST_REQ.fields_by_name['force'])
 _REMOVE_HOST_REQ.fields_by_name['force'].containing_oneof = _REMOVE_HOST_REQ.oneofs_by_name['_force']
+_REMOVE_HOST_REQ.oneofs_by_name['_keep_connections'].fields.append(
+  _REMOVE_HOST_REQ.fields_by_name['keep_connections'])
+_REMOVE_HOST_REQ.fields_by_name['keep_connections'].containing_oneof = _REMOVE_HOST_REQ.oneofs_by_name['_keep_connections']
 _LIST_HOSTS_REQ.oneofs_by_name['_clear_alerts'].fields.append(
   _LIST_HOSTS_REQ.fields_by_name['clear_alerts'])
 _LIST_HOSTS_REQ.fields_by_name['clear_alerts'].containing_oneof = _LIST_HOSTS_REQ.oneofs_by_name['_clear_alerts']
@@ -6285,6 +6448,9 @@ _NAMESPACE.fields_by_name['nonce'].containing_oneof = _NAMESPACE.oneofs_by_name[
 _NAMESPACE.oneofs_by_name['_auto_visible'].fields.append(
   _NAMESPACE.fields_by_name['auto_visible'])
 _NAMESPACE.fields_by_name['auto_visible'].containing_oneof = _NAMESPACE.oneofs_by_name['_auto_visible']
+_NAMESPACE.oneofs_by_name['_rados_namespace_name'].fields.append(
+  _NAMESPACE.fields_by_name['rados_namespace_name'])
+_NAMESPACE.fields_by_name['rados_namespace_name'].containing_oneof = _NAMESPACE.oneofs_by_name['_rados_namespace_name']
 _SUBSYSTEMS_INFO_CLI.fields_by_name['subsystems'].message_type = _SUBSYSTEM_CLI
 _SUBSYSTEM_CLI.oneofs_by_name['_has_dhchap_key'].fields.append(
   _SUBSYSTEM_CLI.fields_by_name['has_dhchap_key'])
@@ -6383,6 +6549,9 @@ _CONNECTION.fields_by_name['disconnected_due_to_keepalive_timeout'].containing_o
 _CONNECTION.oneofs_by_name['_dhchap_controller_origin'].fields.append(
   _CONNECTION.fields_by_name['dhchap_controller_origin'])
 _CONNECTION.fields_by_name['dhchap_controller_origin'].containing_oneof = _CONNECTION.oneofs_by_name['_dhchap_controller_origin']
+_CONNECTION.oneofs_by_name['_host_deleted'].fields.append(
+  _CONNECTION.fields_by_name['host_deleted'])
+_CONNECTION.fields_by_name['host_deleted'].containing_oneof = _CONNECTION.oneofs_by_name['_host_deleted']
 _CONNECTIONS_INFO.fields_by_name['connections'].message_type = _CONNECTION
 _NAMESPACE_CLI.fields_by_name['encryption_algorithm'].enum_type = _ENCRYPTIONALGORITHM
 _NAMESPACE_CLI.fields_by_name['encryption_entries'].message_type = _ENCRYPTION_ENTRY
@@ -6449,6 +6618,8 @@ DESCRIPTOR.message_types_by_name['delete_subsystem_req'] = _DELETE_SUBSYSTEM_REQ
 DESCRIPTOR.message_types_by_name['change_subsystem_key_req'] = _CHANGE_SUBSYSTEM_KEY_REQ
 DESCRIPTOR.message_types_by_name['add_subsystem_network_req'] = _ADD_SUBSYSTEM_NETWORK_REQ
 DESCRIPTOR.message_types_by_name['del_subsystem_network_req'] = _DEL_SUBSYSTEM_NETWORK_REQ
+DESCRIPTOR.message_types_by_name['gw_refresh_network_req'] = _GW_REFRESH_NETWORK_REQ
+DESCRIPTOR.message_types_by_name['gw_refresh_network_status'] = _GW_REFRESH_NETWORK_STATUS
 DESCRIPTOR.message_types_by_name['kmip_server_endpoint'] = _KMIP_SERVER_ENDPOINT
 DESCRIPTOR.message_types_by_name['kmip_server_endpoint_cli'] = _KMIP_SERVER_ENDPOINT_CLI
 DESCRIPTOR.message_types_by_name['add_kmip_server_endpoints_req'] = _ADD_KMIP_SERVER_ENDPOINTS_REQ
@@ -6460,6 +6631,7 @@ DESCRIPTOR.message_types_by_name['add_host_req'] = _ADD_HOST_REQ
 DESCRIPTOR.message_types_by_name['change_host_key_req'] = _CHANGE_HOST_KEY_REQ
 DESCRIPTOR.message_types_by_name['get_connection_io_statistics_req'] = _GET_CONNECTION_IO_STATISTICS_REQ
 DESCRIPTOR.message_types_by_name['remove_host_req'] = _REMOVE_HOST_REQ
+DESCRIPTOR.message_types_by_name['set_keep_host_connected_req'] = _SET_KEEP_HOST_CONNECTED_REQ
 DESCRIPTOR.message_types_by_name['list_hosts_req'] = _LIST_HOSTS_REQ
 DESCRIPTOR.message_types_by_name['list_connections_req'] = _LIST_CONNECTIONS_REQ
 DESCRIPTOR.message_types_by_name['create_listener_req'] = _CREATE_LISTENER_REQ
@@ -6654,6 +6826,20 @@ del_subsystem_network_req = _reflection.GeneratedProtocolMessageType('del_subsys
   })
 _sym_db.RegisterMessage(del_subsystem_network_req)
 
+gw_refresh_network_req = _reflection.GeneratedProtocolMessageType('gw_refresh_network_req', (_message.Message,), {
+  'DESCRIPTOR' : _GW_REFRESH_NETWORK_REQ,
+  '__module__' : 'dashboard.services.proto.gateway_pb2'
+  # @@protoc_insertion_point(class_scope:gw_refresh_network_req)
+  })
+_sym_db.RegisterMessage(gw_refresh_network_req)
+
+gw_refresh_network_status = _reflection.GeneratedProtocolMessageType('gw_refresh_network_status', (_message.Message,), {
+  'DESCRIPTOR' : _GW_REFRESH_NETWORK_STATUS,
+  '__module__' : 'dashboard.services.proto.gateway_pb2'
+  # @@protoc_insertion_point(class_scope:gw_refresh_network_status)
+  })
+_sym_db.RegisterMessage(gw_refresh_network_status)
+
 kmip_server_endpoint = _reflection.GeneratedProtocolMessageType('kmip_server_endpoint', (_message.Message,), {
   'DESCRIPTOR' : _KMIP_SERVER_ENDPOINT,
   '__module__' : 'dashboard.services.proto.gateway_pb2'
@@ -6731,6 +6917,13 @@ remove_host_req = _reflection.GeneratedProtocolMessageType('remove_host_req', (_
   })
 _sym_db.RegisterMessage(remove_host_req)
 
+set_keep_host_connected_req = _reflection.GeneratedProtocolMessageType('set_keep_host_connected_req', (_message.Message,), {
+  'DESCRIPTOR' : _SET_KEEP_HOST_CONNECTED_REQ,
+  '__module__' : 'dashboard.services.proto.gateway_pb2'
+  # @@protoc_insertion_point(class_scope:set_keep_host_connected_req)
+  })
+_sym_db.RegisterMessage(set_keep_host_connected_req)
+
 list_hosts_req = _reflection.GeneratedProtocolMessageType('list_hosts_req', (_message.Message,), {
   'DESCRIPTOR' : _LIST_HOSTS_REQ,
   '__module__' : 'dashboard.services.proto.gateway_pb2'
@@ -7154,8 +7347,8 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   index=0,
   serialized_options=None,
   create_key=_descriptor._internal_create_key,
-  serialized_start=14797,
-  serialized_end=17838,
+  serialized_start=15175,
+  serialized_end=18365,
   methods=[
   _descriptor.MethodDescriptor(
     name='namespace_add',
@@ -7217,10 +7410,20 @@ _GATEWAY = _descriptor.ServiceDescriptor(
     serialized_options=None,
     create_key=_descriptor._internal_create_key,
   ),
+  _descriptor.MethodDescriptor(
+    name='gw_refresh_network',
+    full_name='Gateway.gw_refresh_network',
+    index=6,
+    containing_service=None,
+    input_type=_GW_REFRESH_NETWORK_REQ,
+    output_type=_GW_REFRESH_NETWORK_STATUS,
+    serialized_options=None,
+    create_key=_descriptor._internal_create_key,
+  ),
   _descriptor.MethodDescriptor(
     name='add_kmip_server_endpoints',
     full_name='Gateway.add_kmip_server_endpoints',
-    index=6,
+    index=7,
     containing_service=None,
     input_type=_ADD_KMIP_SERVER_ENDPOINTS_REQ,
     output_type=_REQ_STATUS,
@@ -7230,7 +7433,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='del_kmip_server_endpoints',
     full_name='Gateway.del_kmip_server_endpoints',
-    index=7,
+    index=8,
     containing_service=None,
     input_type=_DEL_KMIP_SERVER_ENDPOINTS_REQ,
     output_type=_REQ_STATUS,
@@ -7240,7 +7443,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_kmip_server_endpoints',
     full_name='Gateway.list_kmip_server_endpoints',
-    index=8,
+    index=9,
     containing_service=None,
     input_type=_LIST_KMIP_SERVER_ENDPOINTS_REQ,
     output_type=_KMIP_SERVER_ENDPOINTS_INFO,
@@ -7250,7 +7453,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_namespaces',
     full_name='Gateway.list_namespaces',
-    index=9,
+    index=10,
     containing_service=None,
     input_type=_LIST_NAMESPACES_REQ,
     output_type=_NAMESPACES_INFO,
@@ -7260,7 +7463,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_resize',
     full_name='Gateway.namespace_resize',
-    index=10,
+    index=11,
     containing_service=None,
     input_type=_NAMESPACE_RESIZE_REQ,
     output_type=_REQ_STATUS,
@@ -7270,7 +7473,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_get_io_stats',
     full_name='Gateway.namespace_get_io_stats',
-    index=11,
+    index=12,
     containing_service=None,
     input_type=_NAMESPACE_GET_IO_STATS_REQ,
     output_type=_NAMESPACE_IO_STATS_INFO,
@@ -7280,7 +7483,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_namespaces_io_stats',
     full_name='Gateway.list_namespaces_io_stats',
-    index=12,
+    index=13,
     containing_service=None,
     input_type=_LIST_NAMESPACES_IO_STATS_REQ,
     output_type=_LIST_NAMESPACES_IO_STATS_INFO,
@@ -7290,7 +7493,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_set_qos_limits',
     full_name='Gateway.namespace_set_qos_limits',
-    index=13,
+    index=14,
     containing_service=None,
     input_type=_NAMESPACE_SET_QOS_REQ,
     output_type=_REQ_STATUS,
@@ -7300,7 +7503,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_change_load_balancing_group',
     full_name='Gateway.namespace_change_load_balancing_group',
-    index=14,
+    index=15,
     containing_service=None,
     input_type=_NAMESPACE_CHANGE_LOAD_BALANCING_GROUP_REQ,
     output_type=_REQ_STATUS,
@@ -7310,7 +7513,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_change_visibility',
     full_name='Gateway.namespace_change_visibility',
-    index=15,
+    index=16,
     containing_service=None,
     input_type=_NAMESPACE_CHANGE_VISIBILITY_REQ,
     output_type=_REQ_STATUS,
@@ -7320,7 +7523,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_change_location',
     full_name='Gateway.namespace_change_location',
-    index=16,
+    index=17,
     containing_service=None,
     input_type=_NAMESPACE_CHANGE_LOCATION_REQ,
     output_type=_REQ_STATUS,
@@ -7330,7 +7533,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_set_rbd_trash_image',
     full_name='Gateway.namespace_set_rbd_trash_image',
-    index=17,
+    index=18,
     containing_service=None,
     input_type=_NAMESPACE_SET_RBD_TRASH_IMAGE_REQ,
     output_type=_REQ_STATUS,
@@ -7340,7 +7543,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_set_auto_resize',
     full_name='Gateway.namespace_set_auto_resize',
-    index=18,
+    index=19,
     containing_service=None,
     input_type=_NAMESPACE_SET_AUTO_RESIZE_REQ,
     output_type=_REQ_STATUS,
@@ -7350,7 +7553,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_delete',
     full_name='Gateway.namespace_delete',
-    index=19,
+    index=20,
     containing_service=None,
     input_type=_NAMESPACE_DELETE_REQ,
     output_type=_REQ_STATUS,
@@ -7360,7 +7563,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_add_host',
     full_name='Gateway.namespace_add_host',
-    index=20,
+    index=21,
     containing_service=None,
     input_type=_NAMESPACE_ADD_HOST_REQ,
     output_type=_REQ_STATUS,
@@ -7370,7 +7573,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='namespace_delete_host',
     full_name='Gateway.namespace_delete_host',
-    index=21,
+    index=22,
     containing_service=None,
     input_type=_NAMESPACE_DELETE_HOST_REQ,
     output_type=_REQ_STATUS,
@@ -7380,7 +7583,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='add_host',
     full_name='Gateway.add_host',
-    index=22,
+    index=23,
     containing_service=None,
     input_type=_ADD_HOST_REQ,
     output_type=_REQ_STATUS,
@@ -7390,17 +7593,27 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='remove_host',
     full_name='Gateway.remove_host',
-    index=23,
+    index=24,
     containing_service=None,
     input_type=_REMOVE_HOST_REQ,
     output_type=_REQ_STATUS,
     serialized_options=None,
     create_key=_descriptor._internal_create_key,
   ),
+  _descriptor.MethodDescriptor(
+    name='set_keep_host_connected',
+    full_name='Gateway.set_keep_host_connected',
+    index=25,
+    containing_service=None,
+    input_type=_SET_KEEP_HOST_CONNECTED_REQ,
+    output_type=_REQ_STATUS,
+    serialized_options=None,
+    create_key=_descriptor._internal_create_key,
+  ),
   _descriptor.MethodDescriptor(
     name='change_host_key',
     full_name='Gateway.change_host_key',
-    index=24,
+    index=26,
     containing_service=None,
     input_type=_CHANGE_HOST_KEY_REQ,
     output_type=_REQ_STATUS,
@@ -7410,7 +7623,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_hosts',
     full_name='Gateway.list_hosts',
-    index=25,
+    index=27,
     containing_service=None,
     input_type=_LIST_HOSTS_REQ,
     output_type=_HOSTS_INFO,
@@ -7420,7 +7633,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_connections',
     full_name='Gateway.list_connections',
-    index=26,
+    index=28,
     containing_service=None,
     input_type=_LIST_CONNECTIONS_REQ,
     output_type=_CONNECTIONS_INFO,
@@ -7430,7 +7643,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_connection_io_statistics',
     full_name='Gateway.get_connection_io_statistics',
-    index=27,
+    index=29,
     containing_service=None,
     input_type=_GET_CONNECTION_IO_STATISTICS_REQ,
     output_type=_CONNECTION_IO_STATISTICS,
@@ -7440,7 +7653,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='create_listener',
     full_name='Gateway.create_listener',
-    index=28,
+    index=30,
     containing_service=None,
     input_type=_CREATE_LISTENER_REQ,
     output_type=_REQ_STATUS,
@@ -7450,7 +7663,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='delete_listener',
     full_name='Gateway.delete_listener',
-    index=29,
+    index=31,
     containing_service=None,
     input_type=_DELETE_LISTENER_REQ,
     output_type=_REQ_STATUS,
@@ -7460,7 +7673,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_listeners',
     full_name='Gateway.list_listeners',
-    index=30,
+    index=32,
     containing_service=None,
     input_type=_LIST_LISTENERS_REQ,
     output_type=_LISTENERS_INFO,
@@ -7470,7 +7683,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='list_subsystems',
     full_name='Gateway.list_subsystems',
-    index=31,
+    index=33,
     containing_service=None,
     input_type=_LIST_SUBSYSTEMS_REQ,
     output_type=_SUBSYSTEMS_INFO_CLI,
@@ -7480,7 +7693,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_subsystems',
     full_name='Gateway.get_subsystems',
-    index=32,
+    index=34,
     containing_service=None,
     input_type=_GET_SUBSYSTEMS_REQ,
     output_type=_SUBSYSTEMS_INFO,
@@ -7490,7 +7703,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='set_ana_state',
     full_name='Gateway.set_ana_state',
-    index=33,
+    index=35,
     containing_service=None,
     input_type=_ANA_INFO,
     output_type=_REQ_STATUS,
@@ -7500,7 +7713,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_spdk_nvmf_log_flags_and_level',
     full_name='Gateway.get_spdk_nvmf_log_flags_and_level',
-    index=34,
+    index=36,
     containing_service=None,
     input_type=_GET_SPDK_NVMF_LOG_FLAGS_AND_LEVEL_REQ,
     output_type=_SPDK_NVMF_LOG_FLAGS_AND_LEVEL_INFO,
@@ -7510,7 +7723,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='disable_spdk_nvmf_logs',
     full_name='Gateway.disable_spdk_nvmf_logs',
-    index=35,
+    index=37,
     containing_service=None,
     input_type=_DISABLE_SPDK_NVMF_LOGS_REQ,
     output_type=_REQ_STATUS,
@@ -7520,7 +7733,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='set_spdk_nvmf_logs',
     full_name='Gateway.set_spdk_nvmf_logs',
-    index=36,
+    index=38,
     containing_service=None,
     input_type=_SET_SPDK_NVMF_LOGS_REQ,
     output_type=_REQ_STATUS,
@@ -7530,7 +7743,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_gateway_info',
     full_name='Gateway.get_gateway_info',
-    index=37,
+    index=39,
     containing_service=None,
     input_type=_GET_GATEWAY_INFO_REQ,
     output_type=_GATEWAY_INFO,
@@ -7540,7 +7753,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_gateway_log_level',
     full_name='Gateway.get_gateway_log_level',
-    index=38,
+    index=40,
     containing_service=None,
     input_type=_GET_GATEWAY_LOG_LEVEL_REQ,
     output_type=_GATEWAY_LOG_LEVEL_INFO,
@@ -7550,7 +7763,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='set_gateway_log_level',
     full_name='Gateway.set_gateway_log_level',
-    index=39,
+    index=41,
     containing_service=None,
     input_type=_SET_GATEWAY_LOG_LEVEL_REQ,
     output_type=_REQ_STATUS,
@@ -7560,7 +7773,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='show_gateway_listeners_info',
     full_name='Gateway.show_gateway_listeners_info',
-    index=40,
+    index=42,
     containing_service=None,
     input_type=_SHOW_GATEWAY_LISTENERS_INFO_REQ,
     output_type=_GATEWAY_LISTENERS_INFO,
@@ -7570,7 +7783,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_gateway_stats',
     full_name='Gateway.get_gateway_stats',
-    index=41,
+    index=43,
     containing_service=None,
     input_type=_GET_GATEWAY_STATS_REQ,
     output_type=_GATEWAY_STATS_INFO,
@@ -7580,7 +7793,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='get_thread_stats',
     full_name='Gateway.get_thread_stats',
-    index=42,
+    index=44,
     containing_service=None,
     input_type=_GET_THREAD_STATS_REQ,
     output_type=_THREAD_STATS_INFO,
@@ -7590,7 +7803,7 @@ _GATEWAY = _descriptor.ServiceDescriptor(
   _descriptor.MethodDescriptor(
     name='set_gateway_io_stats_mode',
     full_name='Gateway.set_gateway_io_stats_mode',
-    index=43,
+    index=45,
     containing_service=None,
     input_type=_SET_GATEWAY_IO_STATS_MODE_REQ,
     output_type=_REQ_STATUS,
diff --git a/src/pybind/mgr/dashboard/services/proto/gateway_pb2_grpc.py b/src/pybind/mgr/dashboard/services/proto/gateway_pb2_grpc.py
index 338d542d3cf..99c60c5cab4 100644
--- a/src/pybind/mgr/dashboard/services/proto/gateway_pb2_grpc.py
+++ b/src/pybind/mgr/dashboard/services/proto/gateway_pb2_grpc.py
@@ -44,6 +44,11 @@ class GatewayStub(object):
                 request_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.del_subsystem_network_req.SerializeToString,
                 response_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.FromString,
                 )
+        self.gw_refresh_network = channel.unary_unary(
+                '/Gateway/gw_refresh_network',
+                request_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.gw_refresh_network_req.SerializeToString,
+                response_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.gw_refresh_network_status.FromString,
+                )
         self.add_kmip_server_endpoints = channel.unary_unary(
                 '/Gateway/add_kmip_server_endpoints',
                 request_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.add_kmip_server_endpoints_req.SerializeToString,
@@ -134,6 +139,11 @@ class GatewayStub(object):
                 request_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.remove_host_req.SerializeToString,
                 response_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.FromString,
                 )
+        self.set_keep_host_connected = channel.unary_unary(
+                '/Gateway/set_keep_host_connected',
+                request_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.set_keep_host_connected_req.SerializeToString,
+                response_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.FromString,
+                )
         self.change_host_key = channel.unary_unary(
                 '/Gateway/change_host_key',
                 request_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.change_host_key_req.SerializeToString,
@@ -281,6 +291,13 @@ class GatewayServicer(object):
         context.set_details('Method not implemented!')
         raise NotImplementedError('Method not implemented!')
 
+    def gw_refresh_network(self, request, context):
+        """Refresh auto-listeners for all network masks configured on the given subsystem on this gateway
+        """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
     def add_kmip_server_endpoints(self, request, context):
         """Add KMIP server endpoints
         """
@@ -407,6 +424,13 @@ class GatewayServicer(object):
         context.set_details('Method not implemented!')
         raise NotImplementedError('Method not implemented!')
 
+    def set_keep_host_connected(self, request, context):
+        """Set keep host connected flag
+        """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
     def change_host_key(self, request, context):
         """Changes a host inband authentication keys
         """
@@ -580,6 +604,11 @@ def add_GatewayServicer_to_server(servicer, server):
                     request_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.del_subsystem_network_req.FromString,
                     response_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.SerializeToString,
             ),
+            'gw_refresh_network': grpc.unary_unary_rpc_method_handler(
+                    servicer.gw_refresh_network,
+                    request_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.gw_refresh_network_req.FromString,
+                    response_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.gw_refresh_network_status.SerializeToString,
+            ),
             'add_kmip_server_endpoints': grpc.unary_unary_rpc_method_handler(
                     servicer.add_kmip_server_endpoints,
                     request_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.add_kmip_server_endpoints_req.FromString,
@@ -670,6 +699,11 @@ def add_GatewayServicer_to_server(servicer, server):
                     request_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.remove_host_req.FromString,
                     response_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.SerializeToString,
             ),
+            'set_keep_host_connected': grpc.unary_unary_rpc_method_handler(
+                    servicer.set_keep_host_connected,
+                    request_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.set_keep_host_connected_req.FromString,
+                    response_serializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.SerializeToString,
+            ),
             'change_host_key': grpc.unary_unary_rpc_method_handler(
                     servicer.change_host_key,
                     request_deserializer=dashboard_dot_services_dot_proto_dot_gateway__pb2.change_host_key_req.FromString,
@@ -882,6 +916,23 @@ class Gateway(object):
             options, channel_credentials,
             insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
 
+    @staticmethod
+    def gw_refresh_network(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/Gateway/gw_refresh_network',
+            dashboard_dot_services_dot_proto_dot_gateway__pb2.gw_refresh_network_req.SerializeToString,
+            dashboard_dot_services_dot_proto_dot_gateway__pb2.gw_refresh_network_status.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
     @staticmethod
     def add_kmip_server_endpoints(request,
             target,
@@ -1188,6 +1239,23 @@ class Gateway(object):
             options, channel_credentials,
             insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
 
+    @staticmethod
+    def set_keep_host_connected(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(request, target, '/Gateway/set_keep_host_connected',
+            dashboard_dot_services_dot_proto_dot_gateway__pb2.set_keep_host_connected_req.SerializeToString,
+            dashboard_dot_services_dot_proto_dot_gateway__pb2.req_status.FromString,
+            options, channel_credentials,
+            insecure, call_credentials, compression, wait_for_ready, timeout, metadata)
+
     @staticmethod
     def change_host_key(request,
             target,

From 937ffe0d03efa135cf08d3a4f90f07dacf3449ca Mon Sep 17 00:00:00 2001
From: David Galloway <david.galloway@ibm.com>
Date: Mon, 15 Jun 2026 17:29:22 -0400
Subject: [PATCH 234/596] doc: Document restarting failed release builds

Signed-off-by: David Galloway <david.galloway@ibm.com>
---
 doc/dev/release-process.rst | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/doc/dev/release-process.rst b/doc/dev/release-process.rst
index 7a5781b0e99..6bb5c2c5f5f 100644
--- a/doc/dev/release-process.rst
+++ b/doc/dev/release-process.rst
@@ -87,7 +87,7 @@ Once QE has determined a stopping point in the working (e.g., ``squid``) branch,
 
 Notify the "Build Lead" that the release branch is ready.
 
-2. Starting the build
+2a. Starting the build
 =====================
 
 We'll use a stable/regular 19.2.2 release of Squid as an example throughout this document.
@@ -123,6 +123,37 @@ NOTE: if for some reason the build has to be restarted (for example if one distr
 
 5. Click ``Build``.
 
+2b. What to do if your build fails
+==================================
+
+The ceph-release-pipeline parent job has three stages.
+
+If your build fails during the "create ceph release tag" stage, troubleshoot the child ceph-tag job and re-run the parent ceph-release-pipeline job with the same parameters.
+
+----
+
+If your build fails during the "package build" stage, troubleshoot the child ceph-dev-pipeline job.  If only one variant failed to build (e.g., centos9 arm64), start a new ceph-release-pipeline job specifying::
+
+    DISTROS=centos9
+    ARCHS=arm64
+    TAG=false <-- VERY IMPORTANT
+
+This will leave the version commit and previously-created tag intact in ceph-releases.git.  You will want the subsequent ceph-dev-pipeline job to reuse that SHA/tag.
+
+Once all of your variants are successfully built, you will have to manually run the ceph-tag job.  For example,::
+
+    BRANCH=tentacle
+    TAG=true
+    TAG_PHASE=push
+    VERSION=20.2.0
+    RELEASE_TYPE=STABLE
+
+Then proceed with the normal release process.
+
+----
+
+If your build fails during the "push ceph release tag" stage, troubleshoot the child ceph-tag job and re-run **just** the ceph-tag job again manually.  Do not re-run ceph-release-pipeline.
+
 3. Release Notes
 ================
 

From c72f9a86b8833e3b2d159e1411ef68fbfbe8ed5c Mon Sep 17 00:00:00 2001
From: "Kamoltat (Junior) Sirivadhna" <ksirivad@redhat.com>
Date: Tue, 2 Jun 2026 11:43:14 +0000
Subject: [PATCH 235/596] mon: fix ConnectionTracker::notify_rank_removed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem:
When multiple monitors are removed from the monmap in a single update,
the iterative rank adjustment in notify_rank_removed() fails to maintain
the invariant that our local rank matches the monmap's new_rank until
all iterations complete.

Problem:
The old code decremented rank for each removed rank:
```
  for (auto i = monmap->removed_ranks.rbegin(); ...) {
    int remove_rank = *i;
    int new_rank = monmap->get_rank(messenger->get_myaddrs());

    // Old logic (in ConnectionTracker):
    if (remove_rank < rank) {
      --rank;
    }

    // This assert would fail on first iteration when removed_ranks.size() > 1
    ceph_assert(rank == new_rank);
  }
```

When removed_ranks = {0, 1} and we are mon.d (originally rank 3):
- new_rank from monmap = 1 (final correct value after removing 0 and 1)

Iteration 1 (remove rank 1):
  Before: rank = 3
  Execute: rank_removed=1 < 3, so --rank -> rank = 2
  Check: rank == new_rank? -> 2 == 1? FAIL

Iteration 2 (remove rank 0):
  Before: rank = 2
  Execute: rank_removed=0 < 2, so --rank -> rank = 1
  Check: rank == new_rank? → 1 == 1? PASS

The invariant is violated during intermediate iterations because each
--rank adjustment only accounts for ONE removed rank, but new_rank
from monmap already accounts for ALL removed ranks.

Solution:
Trust the caller's new_rank from monmap instead of trying to compute it
iteratively. The monmap has already recalculated ranks correctly by
removing all monitors atomically, so we should just use that value.

Changed:
```
  if (rank_removed < rank) {
    --rank;
  }
```
To:
  // Trust the caller's new_rank from the monmap rather than trying to compute it.
  // This handles cases where multiple ranks are removed simultaneously.
  rank = new_rank;

Now the invariant holds on every iteration regardless of how many ranks
are removed.

Fixes: https://tracker.ceph.com/issues/77423

Signed-off-by: Kamoltat (Junior) Sirivadhna <ksirivad@redhat.com>
---
 src/mon/ConnectionTracker.cc | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/src/mon/ConnectionTracker.cc b/src/mon/ConnectionTracker.cc
index e78b5be3086..9cc05054357 100644
--- a/src/mon/ConnectionTracker.cc
+++ b/src/mon/ConnectionTracker.cc
@@ -261,18 +261,15 @@ void ConnectionTracker::notify_rank_removed(int rank_removed, int new_rank)
   ceph_assert((peer_reports.size() == starting_size) ||
 	  (peer_reports.size() + 1 == starting_size));
 
-  if (rank_removed < rank) { // if the rank removed is lower than us, we need to adjust.
-    --rank;
-    my_reports.rank = rank; // also adjust my_reports.rank.
-  }
+  // Trust the caller's new_rank from the monmap rather than trying to compute it.
+  // This handles cases where multiple ranks are removed simultaneously.
+  rank = new_rank;
+  my_reports.rank = new_rank;
 
   ldout(cct, 20) << "my rank after: " << rank << dendl;
   ldout(cct, 20) << "peer_reports after: " << peer_reports << dendl;
   ldout(cct, 20) << "my_reports after: " << my_reports << dendl;
 
-  //check if the new_rank from monmap is equal to our adjusted rank.
-  ceph_assert(rank == new_rank);
-
   increase_version();
 }
 

From 8a2cbbd4f89bf3410935c82f17bb2a621034f9c3 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Mon, 15 Jun 2026 17:14:13 -0400
Subject: [PATCH 236/596] doc/dev/release-process: update according to
 supported releases

From: https://docs.ceph.com/en/latest/start/os-recommendations/

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 doc/dev/release-process.rst      | 24 ++++++++++--------------
 doc/start/os-recommendations.rst |  2 ++
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/doc/dev/release-process.rst b/doc/dev/release-process.rst
index 7a5781b0e99..d02ee49ea0b 100644
--- a/doc/dev/release-process.rst
+++ b/doc/dev/release-process.rst
@@ -104,21 +104,17 @@ We'll use a stable/regular 19.2.2 release of Squid as an example throughout this
 
 NOTE: if for some reason the build has to be restarted (for example if one distro failed) then the ``TAG`` option has to be unchecked.
 
-4. Use https://docs.ceph.com/en/latest/start/os-recommendations/?highlight=debian#platforms to determine the ``DISTROS`` parameter.  For example,
+4. Use :ref:`start-platforms` to determine the ``DISTROS`` parameter.  For example,
 
-    +-------------------+--------------------------------------------------+
-    | Release           | Distro Codemap                                   |
-    +===================+==================================================+
-    | pacific (16.X.X)  | ``focal bionic buster bullseye``                 |
-    +-------------------+--------------------------------------------------+
-    | quincy (17.X.X)   | ``jammy focal centos9 bullseye``                 |
-    +-------------------+--------------------------------------------------+
-    | reef (18.X.X)     | ``jammy focal centos9 windows bookworm``         |
-    +-------------------+--------------------------------------------------+
-    | squid (19.X.X)    | ``jammy centos9 windows bookworm``               |
-    +-------------------+--------------------------------------------------+
-    | tentacle (20.X.X) | ``jammy centos9 noble windows bookworm rocky10`` |
-    +-------------------+--------------------------------------------------+
+    +-------------------+---------------------------------------------------------+
+    | Release           | Distro Codemap                                          |
+    +===================+=========================================================+
+    | squid (19.X.X)    | ``jammy centos9 windows bookworm``                      |
+    +-------------------+---------------------------------------------------------+
+    | tentacle (20.X.X) | ``jammy centos9 rocky10 windows bookworm``              |
+    +-------------------+---------------------------------------------------------+
+    | umbrella (21.X.X) | ``jammy noble centos9 rocky10 bookworm trixie windows`` |
+    +-------------------+---------------------------------------------------------+
 
 
 5. Click ``Build``.
diff --git a/doc/start/os-recommendations.rst b/doc/start/os-recommendations.rst
index da0589c08cf..6be7094b69f 100644
--- a/doc/start/os-recommendations.rst
+++ b/doc/start/os-recommendations.rst
@@ -54,6 +54,8 @@ Linux Kernel
   full-time maintainer. As of July 2025 there are no plans to remove this
   client but the future is uncertain.
 
+.. _start-platforms:
+
 Platforms
 =========
 

From 35447386bac00ae80758a9ba9ecc2b146c2b699f Mon Sep 17 00:00:00 2001
From: Yuri Weinstein <yweinste@redhat.com>
Date: Thu, 11 Jun 2026 10:09:25 -0700
Subject: [PATCH 237/596] doc: tentacle 20.2.2 release notes

Resolves: https://tracker.ceph.com/issues/77357
Signed-off-by: Yuri Weinstein <yweinste@redhat.com>
---
 doc/releases/index.rst    |   1 +
 doc/releases/releases.yml |   2 +
 doc/releases/tentacle.rst | 255 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 258 insertions(+)

diff --git a/doc/releases/index.rst b/doc/releases/index.rst
index 6d7e201d284..502bdcbaf45 100644
--- a/doc/releases/index.rst
+++ b/doc/releases/index.rst
@@ -67,6 +67,7 @@ Release timeline
 .. _Tentacle: tentacle
 .. _20.2.0: tentacle#v20-2-0-tentacle
 .. _20.2.1: tentacle#v20-2-1-tentacle
+.. _20.2.2: tentacle#v20-2-2-tentacle
 
 .. _Squid: squid
 .. _19.2.0: squid#v19-2-0-squid
diff --git a/doc/releases/releases.yml b/doc/releases/releases.yml
index 8f72917bec1..b3772b88dbc 100644
--- a/doc/releases/releases.yml
+++ b/doc/releases/releases.yml
@@ -19,6 +19,8 @@ releases:
   tentacle:
     target_eol: 2027-11-18
     releases:
+      - version: 20.2.2
+        released: 2026-06-15
       - version: 20.2.1
         released: 2026-04-06
       - version: 20.2.0
diff --git a/doc/releases/tentacle.rst b/doc/releases/tentacle.rst
index 7b020e88fd5..1de8b03c012 100644
--- a/doc/releases/tentacle.rst
+++ b/doc/releases/tentacle.rst
@@ -4,6 +4,261 @@ Tentacle
 
 Tentacle is the 20th stable release of Ceph.
 
+v20.2.2 Tentacle
+================
+
+This is the second minor release in the Tentacle series. We recommend that all users update to this release.
+
+Release Date
+------------
+
+June 15, 2026
+
+Notable Changes
+---------------
+
+* Rocky 10 is now supported starting with v20.2.2. Please see the `supported platforms <https://docs.ceph.com/en/latest/start/os-recommendations/#platforms>`_ for current and planned support in Ceph.
+
+MDS (Metadata Server)
+---------------------
+
+* Upgrade Testing Architecture: Split up existing upgrade sequences into distinct CentOS Stream 9 and Rocky Linux 10 automated test variants across multiple upgrade suites (including parallel, stress-split, and telemetry suites).
+* Queueing Logic Update: Retry requests are now added directly to the MDSRank wait queue rather than going through the finisher.
+* Optimization: Removed duplicate context completion calls and adjusted scan_stray_dir after refining the MDSContext class.
+* Reversion: Reverted a prior change that moved MDSContext completion handling to the finish method.
+* Segmentation fault fixed due to incorrect queueing of request retries.
+
+OSD (Object Storage Daemon)
+---------------------------
+
+* FastEC Activation: Always updates the pwlc epoch when activating.
+* PGLog Missed List: Fixed a bug to ensure the correct version is attached to the missing list when ignoring log entries.
+* Data Integrity Asserts: Added assertions to explicitly catch potential corruption in the OSD missing list.
+* Data Structure Changes: Modified the rmissing map key type from version_t to eversion_t.
+* Rollback & Vector Fixes: Corrected rollback logic for partial write object information (OI) and optimized Erasure Coding (EC) by ensuring Twiddle creates a full-sized vector.
+
+RGW (RADOS Gateway)
+-------------------
+
+* Lifecycle Management: Fixed lifecycle transition issues affecting encrypted multipart objects.
+* Multisite Concurrency: Improved concurrency handling when a value of 1 is provided by the caller, added logging for concurrency state transitions within adj_concurrency, exposed lock latency as a performance counter for data synchronization, and fixed an uninitialized LatencyMonitor average by shifting to an exponentially weighted moving average.
+* REST & Query Handling: RESTArgs::get_string() now properly URL-decodes incoming query parameters.
+
+RADOS / librados / neorados
+---------------------------
+
+* Linger Operations: Rewrote safety checks to eliminate use-after-free vulnerabilities and LingerOp memory leaks when an unwatch operation returns ENOTCONN. Replaced the flawed is_valid_watch() check with a safe linger_by_cookie() lookup which safely manages LingerOp references using intrusive_ptr. Ensured librados linger callbacks hold a persistent reference to LingerOp to protect against races with simultaneous linger_cancel() requests. Configured librados::IoCtxImpl::aio_unwatch() to asynchronously deliver ENOTCONN to AioCompletion instead of returning the error directly.
+* Watch/Notify: Fixed neorados notification queue bounds enforcement so that an overflow marker is only appended on the first message exceeding capacity, rather than duplicating it on every subsequent message. Prevented double-cleanup triggers in watch/notify operations when incoming errors arrive after maybe_cleanup() runs. Fixed a bug where notify would lose original error values by ensuring it no longer attempts to decode empty responses. Enhanced io_context shutdown procedures to clear handlers and route cleanly through linger_cancel to avoid use-after-free states.
+* Async Utilities: Fixed an issue regarding the improper removal of objects from the async service list.
+
+Dashboard
+-----------------
+
+* NVMeoF Revamp: Complete UI overhaul with DHCHAP controller key support, namespace encryption, and secure listeners configuration.
+* Pools & RGW: Added stretch cluster validation for pools, fixed RGW restart/stop issues, storage class restrictions, sync policy fixes, and MSR EC Profile support.
+* NFS: Toggle visibility for CephFS snapshots, fixed export creation and path value consistency issues
+
+ceph-volume
+-----------
+
+* Inventory Scanning: Enhanced inventory discovery logic to automatically skip RAM disk devices (/dev/ram*).
+
+External Block Device (extblkdev)
+---------------------------------
+
+* Plugin Stability: Fixed an assertion failure in the FCM plugin when encountering multivolume devices.
+
+Changelog
+---------
+* (tentacle) ceph-volume: backport PRs 67047 and 67240 (`pr#67343 <https://github.com/ceph/ceph/pull/67343>`_, Guillaume Abrioux, Parfait Detchenou)
+* 20.2.1 (`pr#68185 <https://github.com/ceph/ceph/pull/68185>`_, Ceph Release Team)
+* [tentacle] bluestore, extblkdev: Now plugins can raise health warnings (`pr#68663 <https://github.com/ceph/ceph/pull/68663>`_, Adam Kupczyk, Igor Fedotov, Martin Ohmacht)
+* Backporting PRs 67236 and 67419 (`pr#67533 <https://github.com/ceph/ceph/pull/67533>`_, Adam King)
+* Beacon diff + Stretched cluster (`pr#68347 <https://github.com/ceph/ceph/pull/68347>`_, Leonid Chernin, Samuel Just)
+* ceph-volume: include LVM mapper devices in get_devices() (`pr#67989 <https://github.com/ceph/ceph/pull/67989>`_, Guillaume Abrioux)
+* ceph-volume: skip /dev/ram\* devices in inventory (`pr#68552 <https://github.com/ceph/ceph/pull/68552>`_, Ujjawal Anand)
+* ceph-volume: skip mkfs discard for LVM NVMe OSDs (`pr#68286 <https://github.com/ceph/ceph/pull/68286>`_, Ujjawal Anand)
+* ceph-volume: skip redundant NVMe mkfs discards (`pr#67341 <https://github.com/ceph/ceph/pull/67341>`_, Ujjawal Anand)
+* ceph-volume: skip virtual cdrom devices in inventory (`pr#68108 <https://github.com/ceph/ceph/pull/68108>`_, Ujjawal Anand)
+* ceph.spec.in: replace golang github prometheus with promtool binary path (`pr#68420 <https://github.com/ceph/ceph/pull/68420>`_, Nizamudeen A)
+* ceph_mon: Fix shutdown order to destroy Monitor before closing mon store (`pr#68399 <https://github.com/ceph/ceph/pull/68399>`_, Prashant D)
+* cephadm: wait for latest osd map after ceph-volume before OSD deploy (`pr#68379 <https://github.com/ceph/ceph/pull/68379>`_, Guillaume Abrioux)
+* cephfs: MDCache request cleanup (`pr#66469 <https://github.com/ceph/ceph/pull/66469>`_, Abhishek Lekshmanan)
+* Check if `HTTP_X_AMZ_COPY_SOURCE` header is empty (`pr#66027 <https://github.com/ceph/ceph/pull/66027>`_, Suyash Dongre)
+* client: adjust `Fb` cap ref count check during synchronous fsync() (`issue#73624 <http://tracker.ceph.com/issues/73624>`_, `pr#65913 <https://github.com/ceph/ceph/pull/65913>`_, Venky Shankar)
+* client: crash caused by invalid iterator in _readdir_cache_cb (`pr#65957 <https://github.com/ceph/ceph/pull/65957>`_, Zhansong Gao)
+* container/build.sh: add 'rocky-10' suffix if necessary (`pr#67895 <https://github.com/ceph/ceph/pull/67895>`_, Dan Mick)
+* container/build.sh: FROM_IMAGE=rockylinux-10 default for >=tentacle backports (`pr#67960 <https://github.com/ceph/ceph/pull/67960>`_, Matan Breizman, David Galloway, John Mulligan, Dan Mick)
+* debian: package mgr/smb in ceph-mgr-modules-core (`pr#67510 <https://github.com/ceph/ceph/pull/67510>`_, Roland Sommer)
+* debian: remove invoke-rc.d calls from postrm scripts (`pr#67354 <https://github.com/ceph/ceph/pull/67354>`_, Kefu Chai)
+* debian: remove stale distutils override from py3dist-overrides (`pr#68276 <https://github.com/ceph/ceph/pull/68276>`_, Thomas Lamprecht, Max R. Carrara, Kefu Chai)
+* doc: Batch backport for start/hardware-recommendations.rst (`pr#67907 <https://github.com/ceph/ceph/pull/67907>`_, Anthony D'Atri, Marc Methot, Pierre Riteau, Ville Ojamo)
+* extblkdev: Fix FCM plugin asserting on multivolume devices (`pr#68877 <https://github.com/ceph/ceph/pull/68877>`_, Adam Kupczyk)
+* found duplicate series for the match group {fs_id="-1"} (`pr#68369 <https://github.com/ceph/ceph/pull/68369>`_, bst2002git)
+* Implement Admin REST APIs for Setting Account Quota (`pr#66905 <https://github.com/ceph/ceph/pull/66905>`_, Nicholas Liu, Jiffin Tony Thottan)
+* kv/RocksDB: Add instrumentation to BinnedLRUCache (`pr#67349 <https://github.com/ceph/ceph/pull/67349>`_, Adam Kupczyk)
+* libcephsqlite: ensure atexit handlers are registered after openssl (`pr#68263 <https://github.com/ceph/ceph/pull/68263>`_, Patrick Donnelly)
+* librbd/cache/pwl: WriteLogOperationSet::cell can be garbage (`pr#67705 <https://github.com/ceph/ceph/pull/67705>`_, Ilya Dryomov)
+* librbd/migration/QCOWFormat: avoid use-after-free in execute_request() (`pr#68188 <https://github.com/ceph/ceph/pull/68188>`_, Ilya Dryomov)
+* librbd/mirror: detect trashed snapshots in UnlinkPeerRequest (`pr#67583 <https://github.com/ceph/ceph/pull/67583>`_, Ilya Dryomov)
+* librbd: avoid losing sparseness in read_parent() (`pr#68463 <https://github.com/ceph/ceph/pull/68463>`_, Ilya Dryomov)
+* librbd: don't complete ImageUpdateWatchers::shut_down() prematurely (`pr#67581 <https://github.com/ceph/ceph/pull/67581>`_, Ilya Dryomov)
+* librbd: rbd_aio_write_with_crc32c (`pr#68038 <https://github.com/ceph/ceph/pull/68038>`_, Alexander Indenbaum)
+* mds: add ref counting to LogSegment (`pr#68439 <https://github.com/ceph/ceph/pull/68439>`_, Milind Changire)
+* mds: add retry request to MDSRank wait queue rather via finisher (`issue#76031 <http://tracker.ceph.com/issues/76031>`_, `pr#68905 <https://github.com/ceph/ceph/pull/68905>`_, Venky Shankar)
+* mds: scrub pins more inodes than the mds_cache_memory_limit (`pr#67808 <https://github.com/ceph/ceph/pull/67808>`_, Md Mahamudur Rahaman Sajib)
+* mds: use SimpleLock::WAIT_ALL for wait mask (`pr#68313 <https://github.com/ceph/ceph/pull/68313>`_, Patrick Donnelly)
+* mgr/cephadm: Add KMIP server support for NVMeoF gateway (`pr#68086 <https://github.com/ceph/ceph/pull/68086>`_, Gil Bregman)
+* mgr/cephadm: add rbd_with_crc32c parameter to nvmeof service spec (`pr#66933 <https://github.com/ceph/ceph/pull/66933>`_, Alexander Indenbaum)
+* mgr/cephadm: fix mgmt-gateway startup on IPv6 VIP (`pr#68387 <https://github.com/ceph/ceph/pull/68387>`_, Kobi Ginon)
+* mgr/cephadm: include cluster FSID in root CA Common Name (CN) (`pr#64692 <https://github.com/ceph/ceph/pull/64692>`_, Redouane Kachach, Kushal Deb)
+* mgr/cephadm: serialize OSD class before returning for OSD rm status (`pr#69226 <https://github.com/ceph/ceph/pull/69226>`_, Adam King)
+* mgr/DaemonServer: Implement ok-to-upgrade command (`pr#66948 <https://github.com/ceph/ceph/pull/66948>`_, Sridhar Seshasayee)
+* mgr/DaemonServer: Limit search for OSDs to upgrade within the crush bucket (`pr#68350 <https://github.com/ceph/ceph/pull/68350>`_, Sridhar Seshasayee)
+* mgr/dashboard : Add bottom padding for dashboard screens (`pr#68523 <https://github.com/ceph/ceph/pull/68523>`_, Abhishek Desai)
+* mgr/dashboard : add stretch cluster validation for pools form (`pr#68476 <https://github.com/ceph/ceph/pull/68476>`_, Afreen Misbah, Abhishek Desai)
+* mgr/dashboard : Fix RGW restart/stop issue (`pr#68554 <https://github.com/ceph/ceph/pull/68554>`_, Abhishek Desai)
+* mgr/dashboard : fix-non-versioning-bucket-issue (`pr#68520 <https://github.com/ceph/ceph/pull/68520>`_, Abhishek Desai)
+* mgr/dashboard : Fixes EC profile used pool empty (`pr#68730 <https://github.com/ceph/ceph/pull/68730>`_, Abhishek Desai)
+* mgr/dashboard : Restrict create storage class with existing name (`pr#68475 <https://github.com/ceph/ceph/pull/68475>`_, Abhishek Desai)
+* mgr/dashboard: [RGW-NFS]: User level export creation via UI fails with 500 - Internal Server Error (`pr#67013 <https://github.com/ceph/ceph/pull/67013>`_, Dnyaneshwari Talwekar)
+* mgr/dashboard: [snap-visibility]Edit Client config option remains stuck in loading when nfs user is configured (`pr#68542 <https://github.com/ceph/ceph/pull/68542>`_, Dnyaneshwari Talwekar)
+* mgr/dashboard: [storage-class]: Deleting local storage class from UI does not remove its entry from zone (`pr#67949 <https://github.com/ceph/ceph/pull/67949>`_, Dnyaneshwari Talwekar)
+* mgr/dashboard: Add DHCHAP controller key to NVME host commands (`pr#67600 <https://github.com/ceph/ceph/pull/67600>`_, Gil Bregman)
+* mgr/dashboard: add helper text to bucket form > policy and other spacing fixes (`pr#67871 <https://github.com/ceph/ceph/pull/67871>`_, Naman Munet)
+* mgr/dashboard: Add location to gateway info command in NVMeoF CLI (`pr#68345 <https://github.com/ceph/ceph/pull/68345>`_, Gil Bregman)
+* mgr/dashboard: Add namespace encryption support to NVMeoF CLI (`pr#68339 <https://github.com/ceph/ceph/pull/68339>`_, Gil Bregman)
+* mgr/dashboard: Add nvmeof_top_cli service (`pr#67566 <https://github.com/ceph/ceph/pull/67566>`_, Vallari Agrawal)
+* mgr/dashboard: Add option to edit zone with keys/ (`pr#68317 <https://github.com/ceph/ceph/pull/68317>`_, Aashish Sharma)
+* mgr/dashboard: Add option to set motd via api (`pr#68678 <https://github.com/ceph/ceph/pull/68678>`_, Aashish Sharma)
+* mgr/dashboard: Add overview page (`pr#67840 <https://github.com/ceph/ceph/pull/67840>`_, Afreen Misbah, Devika Babrekar, Aashish Sharma, Abhishek Desai, Naman Munet, Nizamudeen A)
+* mgr/dashboard: Add port and secure-listeners to subsystem add NVMeoF CLI command (`pr#68370 <https://github.com/ceph/ceph/pull/68370>`_, Vallari Agrawal, Gil Bregman)
+* mgr/dashboard: Add restore events in notification screen (`pr#67912 <https://github.com/ceph/ceph/pull/67912>`_, pujashahu, pujaoshahu)
+* mgr/dashboard: Add secure and verify-host-name to "listener add" on NVMeoF CLI (`pr#67799 <https://github.com/ceph/ceph/pull/67799>`_, Gil Bregman)
+* mgr/dashboard: Adding rados ns option into add_ns_req (`pr#67470 <https://github.com/ceph/ceph/pull/67470>`_, gadi-didi)
+* mgr/dashboard: Allow empty port value when adding a listener in NVMEoF CLI (`pr#68766 <https://github.com/ceph/ceph/pull/68766>`_, Gil Bregman)
+* mgr/dashboard: Batch backport nvmeof revamp (`pr#67839 <https://github.com/ceph/ceph/pull/67839>`_, Afreen Misbah, Nizamudeen A, Sagar Gopale, pujaoshahu, Puja Shahu, Ville Ojamo)
+* mgr/dashboard: Bump lodash (`pr#68695 <https://github.com/ceph/ceph/pull/68695>`_, Afreen Misbah)
+* mgr/dashboard: bump nvmeof submodule to 1.6.5 (`pr#67326 <https://github.com/ceph/ceph/pull/67326>`_, Vallari Agrawal, Tomer Haskalovitch)
+* mgr/dashboard: carbonize-osd-flags-modal (`pr#68133 <https://github.com/ceph/ceph/pull/68133>`_, Afreen Misbah, Sagar Gopale)
+* mgr/dashboard: Difference in "path" value observed when rgw user level export created via dashboard vs cli (`pr#68583 <https://github.com/ceph/ceph/pull/68583>`_, Dnyaneshwari Talwekar)
+* mgr/dashboard: fix subvolume group corruption from smb share form (`pr#68103 <https://github.com/ceph/ceph/pull/68103>`_, Nizamudeen A)
+* mgr/dashboard: Fix tags in subvolume list and subvolume groups list (`pr#68382 <https://github.com/ceph/ceph/pull/68382>`_, pujaoshahu)
+* mgr/dashboard: Making 'ISA' as default plugin for EC profiles created through dashboard (`pr#68373 <https://github.com/ceph/ceph/pull/68373>`_, Devika Babrekar)
+* mgr/dashboard: mgr/dashboard: Carbonize Realm Name and Token block in Multi-site Replication Wizard (`pr#68546 <https://github.com/ceph/ceph/pull/68546>`_, Sagar Gopale)
+* mgr/dashboard: Misleading warning when no eligible devices are available for OSD creation (`pr#67637 <https://github.com/ceph/ceph/pull/67637>`_, Naman Munet)
+* mgr/dashboard: nfs export creation fails with obj deserialization (`pr#67564 <https://github.com/ceph/ceph/pull/67564>`_, Nizamudeen A)
+* mgr/dashboard: NFS: Toggle visibility of CephFS snapshots (`pr#67636 <https://github.com/ceph/ceph/pull/67636>`_, Afreen Misbah, Dnyaneshwari Talwekar)
+* mgr/dashboard: Option to select archive option while Import Multi-site Token (`pr#68513 <https://github.com/ceph/ceph/pull/68513>`_, Aashish Sharma)
+* mgr/dashboard: remove sync_from entry when sync_from_all is true (`pr#68536 <https://github.com/ceph/ceph/pull/68536>`_, Aashish Sharma)
+* mgr/dashboard: Rename Alert breadcrumb to Alert Rules (`pr#68238 <https://github.com/ceph/ceph/pull/68238>`_, Sagar Gopale)
+* mgr/dashboard: sync policy created for a bucket in Object >> Multi-site >> Sync-policy, is not reflecting under bucket's replication (`pr#68512 <https://github.com/ceph/ceph/pull/68512>`_, Naman Munet)
+* mgr/dashboard:Adding MSR EC Profile via dashboard (`pr#68349 <https://github.com/ceph/ceph/pull/68349>`_, Devika Babrekar)
+* mgr/smb: fix error handling for fundamental resource parsing (`pr#65861 <https://github.com/ceph/ceph/pull/65861>`_, John Mulligan)
+* mgr/test_orchestrator: fixing daemon_action method signature (`pr#69231 <https://github.com/ceph/ceph/pull/69231>`_, Redouane Kachach)
+* mgr: add config to load modules in main interpreter instead of subinterpreter (`pr#67515 <https://github.com/ceph/ceph/pull/67515>`_, Nitzan Mordhai, Nitzan Mordechai, Samuel Just)
+* mgr: ensure that all modules have started before advertising active mgr (`pr#67850 <https://github.com/ceph/ceph/pull/67850>`_, Laura Flores)
+* mgr: fix continous smb MgrDBNotReady (`pr#68598 <https://github.com/ceph/ceph/pull/68598>`_, Pedro Gonzalez Gomez)
+* mgr: fix PyObject\* refcounting in TTLCache and cleanup logic (`pr#66482 <https://github.com/ceph/ceph/pull/66482>`_, Nitzan Mordechai)
+* mgr: isolated CherryPy to prevent global state sharing (`pr#67465 <https://github.com/ceph/ceph/pull/67465>`_, Nizamudeen A, Anmol Babu)
+* mon [stretch-mode]: Allow a max bucket weight diff threshold (`pr#67790 <https://github.com/ceph/ceph/pull/67790>`_, Kamoltat Sirivadhna, Kamoltat (Junior) Sirivadhna)
+* mon/AuthMonitor: add osd w cap for superuser client (`pr#68314 <https://github.com/ceph/ceph/pull/68314>`_, Venky Shankar, Patrick Donnelly)
+* monitoring: Fix application overview to show Raw used (`pr#68794 <https://github.com/ceph/ceph/pull/68794>`_, Ankush Behl)
+* mr/dashboard: remove rgw_servers filter from radosgw-sync-overview grafana dashboard (`pr#68604 <https://github.com/ceph/ceph/pull/68604>`_, Aashish Sharma)
+* neorados: Fix Neorados CephContext leak (`pr#67513 <https://github.com/ceph/ceph/pull/67513>`_, Adam C. Emerson)
+* neorados: specify alignments for aligned_storage (`pr#67512 <https://github.com/ceph/ceph/pull/67512>`_, Casey Bodley)
+* neorados: Various Fixes to Watch/Notify (`pr#68776 <https://github.com/ceph/ceph/pull/68776>`_, Adam C. Emerson, Casey Bodley)
+* node-proxy: major refactor and various fixes (`pr#67418 <https://github.com/ceph/ceph/pull/67418>`_, Guillaume Abrioux)
+* nvmeof: Change the NVMEOF image version to 1.6 (`pr#68415 <https://github.com/ceph/ceph/pull/68415>`_, Gil Bregman)
+* nvmeofgw: fix issue of delete all gws from the pool/group (`pr#67942 <https://github.com/ceph/ceph/pull/67942>`_, Leonid Chernin)
+* orch/cephadm: fix osd.default creation (`pr#68121 <https://github.com/ceph/ceph/pull/68121>`_, Guillaume Abrioux)
+* os/bluestore: track compression\_\*blob_size\* parameters for online update (`pr#67888 <https://github.com/ceph/ceph/pull/67888>`_, Igor Fedotov)
+* os/bluestore:fix bluestore_volume_selection_reserved_factor usage (`pr#66837 <https://github.com/ceph/ceph/pull/66837>`_, Igor Fedotov)
+* osd/scrub: support an operator-abort command (`pr#67031 <https://github.com/ceph/ceph/pull/67031>`_, Ronen Friedman)
+* osd: add pg-upmap-primary to clean_pg_upmaps (`pr#67407 <https://github.com/ceph/ceph/pull/67407>`_, Laura Flores)
+* osd: Avoid assertion on empty object read when reading multiple objects (`pr#68714 <https://github.com/ceph/ceph/pull/68714>`_, Alex Ainscow)
+* osd: Avoid pwlc spanning intervals (`pr#68708 <https://github.com/ceph/ceph/pull/68708>`_, Bill Scales)
+* osd: Change rmissing map key from version_t to eversion_t (`pr#68716 <https://github.com/ceph/ceph/pull/68716>`_, Alex Ainscow)
+* osd: Deleting PG should discard pwlc (`pr#68709 <https://github.com/ceph/ceph/pull/68709>`_, Bill Scales)
+* osd: FastEC: always update pwlc epoch when activating (`pr#68710 <https://github.com/ceph/ceph/pull/68710>`_, Bill Scales)
+* osd: Fix bug when calculating min_peer_features (`pr#69159 <https://github.com/ceph/ceph/pull/69159>`_, Bill Scales)
+* osd: Fix incorrect rollback logic for partial write OI (`pr#68715 <https://github.com/ceph/ceph/pull/68715>`_, Alex Ainscow)
+* osd: PGLog Attach correct version to missing list when ignoring log entries (`pr#68718 <https://github.com/ceph/ceph/pull/68718>`_, Alex Ainscow)
+* osd: Twiddle should create a full sized vector for optimized EC (`pr#68717 <https://github.com/ceph/ceph/pull/68717>`_, Alex Ainscow)
+* pybind/mgr: call new _ceph_exit for killpoints (`pr#68518 <https://github.com/ceph/ceph/pull/68518>`_, Patrick Donnelly)
+* pybind/mgr: update modules to use independent CLICommand subtypes with distinct COMMAND attributes (`pr#67511 <https://github.com/ceph/ceph/pull/67511>`_, Kefu Chai, Samuel Just)
+* qa/cephadm: derive container image from cephadm release (`pr#68328 <https://github.com/ceph/ceph/pull/68328>`_, Lumir Sliva)
+* qa/cephfs: lua to respect missing kernel in yaml (`pr#67293 <https://github.com/ceph/ceph/pull/67293>`_, Kyr Shatskyy)
+* qa/cephfs: treat "implicit declaration of function" for blogbench workunit for newer gcc version (`issue#75380 <http://tracker.ceph.com/issues/75380>`_, `pr#68820 <https://github.com/ceph/ceph/pull/68820>`_, Venky Shankar)
+* qa/distros: add rocky 10.0 as supported distro/container host (`pr#68569 <https://github.com/ceph/ceph/pull/68569>`_, Patrick Donnelly, Casey Bodley, Adam King, David Galloway)
+* qa/radosgw_admin: replace boto2 with boto3 (`pr#68739 <https://github.com/ceph/ceph/pull/68739>`_, Adam C. Emerson, Casey Bodley)
+* qa/rgw/multisite: remove duplicate test_suspended_delete_marker_incremental_sync (`pr#68846 <https://github.com/ceph/ceph/pull/68846>`_, Oguzhan Ozmen)
+* qa/rgw/upgrade: symlinks are explicit about distro versions (`pr#68057 <https://github.com/ceph/ceph/pull/68057>`_, Casey Bodley)
+* qa/rgw: Revive crypt kmip (`pr#68371 <https://github.com/ceph/ceph/pull/68371>`_, Kyr Shatskyy)
+* qa/suites/fs: fix extraneous distro links (`pr#69251 <https://github.com/ceph/ceph/pull/69251>`_, Patrick Donnelly)
+* qa/suites/upgrade: ignore osd in unknown state (`pr#69307 <https://github.com/ceph/ceph/pull/69307>`_, Patrick Donnelly)
+* qa/suites/upgrade: ignore undersized PG during stress splits (`pr#69310 <https://github.com/ceph/ceph/pull/69310>`_, Patrick Donnelly)
+* qa/suites/upgrade: update upgrade paths and exclude rocky10 from non-supported distros (`pr#68660 <https://github.com/ceph/ceph/pull/68660>`_, Yaarit Hatuka, Laura Flores)
+* qa/suites: remove centos restriction from valgrind yaml (`issue#18126 <http://tracker.ceph.com/issues/18126>`_, `issue#20360 <http://tracker.ceph.com/issues/20360>`_, `pr#67519 <https://github.com/ceph/ceph/pull/67519>`_, Samuel Just)
+* qa/suites: use tagged version of reef (`pr#68357 <https://github.com/ceph/ceph/pull/68357>`_, Laura Flores)
+* qa/tasks/backfill_toofull.py: Fix assert failures with & without compression (`pr#68118 <https://github.com/ceph/ceph/pull/68118>`_, Sridhar Seshasayee)
+* qa/tasks/keystone: upgrade keystone to 2025.2 (`pr#67757 <https://github.com/ceph/ceph/pull/67757>`_, Kyr Shatskyy)
+* qa/tasks/quiescer: remove racy assertion (`pr#68510 <https://github.com/ceph/ceph/pull/68510>`_, Patrick Donnelly)
+* qa/tasks: capture CommandCrashedError when running nvme list cmd (`pr#69232 <https://github.com/ceph/ceph/pull/69232>`_, Redouane Kachach)
+* qa/tasks: make rbd_mirror_thrash inherit from ThrasherGreenlet (`pr#67795 <https://github.com/ceph/ceph/pull/67795>`_, Ilya Dryomov)
+* qa/tasks: update egrep to 'grep -E' (`pr#67518 <https://github.com/ceph/ceph/pull/67518>`_, Nitzan Mordechai, Samuel Just)
+* qa/workunits/ceph-helpers-root: Add Rocky support for install packages (`pr#67507 <https://github.com/ceph/ceph/pull/67507>`_, Nitzan Mordechai)
+* qa/workunits/rbd: drop racy assert in test_tasks_recovery() (`pr#68190 <https://github.com/ceph/ceph/pull/68190>`_, Ilya Dryomov)
+* qa/workunits: Add updated kernel archive URL (`pr#68169 <https://github.com/ceph/ceph/pull/68169>`_, Brad Hubbard)
+* qa: add 'refresh' config to cephadm.wait_for_service (`pr#67038 <https://github.com/ceph/ceph/pull/67038>`_, Vallari Agrawal)
+* qa: add MDS_INSUFFICIENT_STANDBY to ignorelist (`pr#69036 <https://github.com/ceph/ceph/pull/69036>`_, Patrick Donnelly)
+* qa: Add nvmeof upgrade from v20.2.0 (`pr#68149 <https://github.com/ceph/ceph/pull/68149>`_, Vallari Agrawal)
+* qa: allow multiple mgr sessions during eviction test (`pr#68316 <https://github.com/ceph/ceph/pull/68316>`_, Patrick Donnelly)
+* qa: cephfs suite changes for rocky (`pr#68374 <https://github.com/ceph/ceph/pull/68374>`_, Patrick Donnelly)
+* qa: Fix coredumps caused by udisks (`pr#67526 <https://github.com/ceph/ceph/pull/67526>`_, Vallari Agrawal)
+* qa: Fix nvmeof 'errors during thrashing' (`pr#68148 <https://github.com/ceph/ceph/pull/68148>`_, Vallari Agrawal)
+* qa: fix setting rbd_sparse_read_threshold_bytes in test_migration_clone() (`pr#68617 <https://github.com/ceph/ceph/pull/68617>`_, Ilya Dryomov)
+* qa: fix TypeError in delay (`pr#67617 <https://github.com/ceph/ceph/pull/67617>`_, Jos Collin)
+* qa: fixing cephadm mgmt-gateway test to remove openssl dependency (`pr#67820 <https://github.com/ceph/ceph/pull/67820>`_, Redouane Kachach)
+* qa: ignore cephadm failed daemon warnings during thrashing (`pr#69309 <https://github.com/ceph/ceph/pull/69309>`_, Patrick Donnelly)
+* qa: ignore POOL_FULL for rbd tests exercising full pools (`pr#69304 <https://github.com/ceph/ceph/pull/69304>`_, Patrick Donnelly)
+* qa: install nvme-cli only if distro remains rocky10 (`pr#69252 <https://github.com/ceph/ceph/pull/69252>`_, Patrick Donnelly)
+* qa: krbd_rxbounce.sh: do more reads to generate more errors (`pr#67455 <https://github.com/ceph/ceph/pull/67455>`_, Ilya Dryomov)
+* qa: Leak_StillReachable RocksDB error_handler (`pr#68524 <https://github.com/ceph/ceph/pull/68524>`_, Nitzan Mordechai)
+* qa: rbd_mirror_fsx_compare.sh doesn't error out as expected (`pr#67797 <https://github.com/ceph/ceph/pull/67797>`_, Ilya Dryomov)
+* qa: Remove cephadm e2e tests from teuthology (`pr#68818 <https://github.com/ceph/ceph/pull/68818>`_, Afreen Misbah)
+* qa: resolve py3.12 regression for random.sample (`pr#68315 <https://github.com/ceph/ceph/pull/68315>`_, Patrick Donnelly)
+* qa: suppress false positive delete map mismatch errors (`pr#68431 <https://github.com/ceph/ceph/pull/68431>`_, Casey Bodley, Nitzan Mordechai)
+* qa: suppress MismatchedFree operator delete RocksDB (`pr#67508 <https://github.com/ceph/ceph/pull/67508>`_, Nitzan Mordechai)
+* rgw/beast: use strand executor for timeout timer to prevent concurrent socket access (`pr#68506 <https://github.com/ceph/ceph/pull/68506>`_, Oguzhan Ozmen)
+* rgw/lc: Do not delete DM if its at end of pagination list (`pr#67573 <https://github.com/ceph/ceph/pull/67573>`_, kchheda3)
+* rgw/multisite: check the local bucket's versioning status when replicating deletion from remote (`pr#66168 <https://github.com/ceph/ceph/pull/66168>`_, Jane Zhu)
+* RGW/multisite: fix bucket-full-sync infinite loop caused by stale bucket_list_result reuse (`pr#67923 <https://github.com/ceph/ceph/pull/67923>`_, Oguzhan Ozmen)
+* RGW/Multisite: fix uninitialized LatencyMonitor causing spurious "OSD cluster is overloaded" warning (`pr#68803 <https://github.com/ceph/ceph/pull/68803>`_, Oguzhan Ozmen)
+* rgw/s3: Always include x-amz-content-sha256 header in AWS v4 signatures (`pr#66358 <https://github.com/ceph/ceph/pull/66358>`_, Shilpa Jagannath, Matthew N. Heler)
+* rgw/tests: add os-specific java 1.7 install commands to keycloak task (`pr#67982 <https://github.com/ceph/ceph/pull/67982>`_, J. Eric Ivancich)
+* rgw/website: preserve nameservers for future use in dnsmasq (`pr#67061 <https://github.com/ceph/ceph/pull/67061>`_, Kyr Shatskyy)
+* rgw/zone: remove duplicated startup logic in RGWSI_Zone (`pr#66300 <https://github.com/ceph/ceph/pull/66300>`_, Casey Bodley)
+* rgw: bucket logging fixes (`pr#66769 <https://github.com/ceph/ceph/pull/66769>`_, Nithya Balachandran, N Balachandran, Yuval Lifshitz, Casey Bodley)
+* RGW: Change prerequest hook to run after authorization process (`pr#68594 <https://github.com/ceph/ceph/pull/68594>`_, Emin Sunacoglu)
+* rgw: discard olh\_ attributes when copying object from a versioning-suspended bucket to a versioning-disabled bucket (`pr#65557 <https://github.com/ceph/ceph/pull/65557>`_, Jane Zhu)
+* rgw: fix 'bucket stats' when bucket index doesn't exist (`pr#68505 <https://github.com/ceph/ceph/pull/68505>`_, Casey Bodley)
+* rgw: fix lifecycle transition of encrypted multipart objects (`pr#68826 <https://github.com/ceph/ceph/pull/68826>`_, Marcus Watts)
+* rgw: handle plain-text object tags in RGWObjTags::decode() (`pr#67927 <https://github.com/ceph/ceph/pull/67927>`_, Oguzhan Ozmen)
+* rgw: java s3-tests change setting of JAVA_HOME (`pr#68226 <https://github.com/ceph/ceph/pull/68226>`_, J. Eric Ivancich)
+* rgw: read_obj_policy() consults s3:prefix when deciding between 403/404 (`pr#68651 <https://github.com/ceph/ceph/pull/68651>`_, Casey Bodley)
+* RGW: remove custom copy constructor for RGWObjectCtx and enforce no copy/move (`pr#67440 <https://github.com/ceph/ceph/pull/67440>`_, Oguzhan Ozmen)
+* src/ceph-volume: fast device unavailable as error (`pr#67916 <https://github.com/ceph/ceph/pull/67916>`_, Timothy Q Nguyen)
+* test/rgw/kafka: fix kafka relase to more recent one (`pr#67993 <https://github.com/ceph/ceph/pull/67993>`_, Yuval Lifshitz)
+* test/rgw/lua: ignore hours for zero mtime (`pr#67468 <https://github.com/ceph/ceph/pull/67468>`_, Kyr Shatskyy)
+* test/rgw/notification: do not use netstat in the code (`pr#68142 <https://github.com/ceph/ceph/pull/68142>`_, Yuval Lifshitz)
+* test/rgw/notification: fix the cloudevents package version (`pr#68704 <https://github.com/ceph/ceph/pull/68704>`_, Yuval Lifshitz, Adam C. Emerson)
+* test/rgw: remove depracated boto dependency (`pr#68344 <https://github.com/ceph/ceph/pull/68344>`_, Yuval Lifshitz)
+* test: use json_extract instead of awkward json_tree (`pr#67321 <https://github.com/ceph/ceph/pull/67321>`_, Patrick Donnelly)
+* This change introduces the shared memory communication (SMC-D) for the cluster network (`pr#68254 <https://github.com/ceph/ceph/pull/68254>`_, Aliaksei Makarau)
+* tools/ceph-kvstore-tool: fix crash on db close (`pr#68406 <https://github.com/ceph/ceph/pull/68406>`_, Igor Fedotov, Max Kellermann)
+* upgrade suites update for Rocky10 and missing centos (`pr#68733 <https://github.com/ceph/ceph/pull/68733>`_, Nitzan Mordechai)
+
 v20.2.1 Tentacle
 ================
 

From b52f7f53ae383f8371f451852d444b11fba805b9 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Mon, 15 Jun 2026 19:30:24 -0400
Subject: [PATCH 238/596] doc/releases/tentacle: add more v20.2.2 blocker fixes

Resolves: https://tracker.ceph.com/issues/77357
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 doc/releases/releases.yml | 2 +-
 doc/releases/tentacle.rst | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/releases/releases.yml b/doc/releases/releases.yml
index b3772b88dbc..6afa8f6464d 100644
--- a/doc/releases/releases.yml
+++ b/doc/releases/releases.yml
@@ -20,7 +20,7 @@ releases:
     target_eol: 2027-11-18
     releases:
       - version: 20.2.2
-        released: 2026-06-15
+        released: 2026-06-16
       - version: 20.2.1
         released: 2026-04-06
       - version: 20.2.0
diff --git a/doc/releases/tentacle.rst b/doc/releases/tentacle.rst
index 1de8b03c012..0534c1438ef 100644
--- a/doc/releases/tentacle.rst
+++ b/doc/releases/tentacle.rst
@@ -12,7 +12,7 @@ This is the second minor release in the Tentacle series. We recommend that all u
 Release Date
 ------------
 
-June 15, 2026
+June 16, 2026
 
 Notable Changes
 ---------------
@@ -71,7 +71,6 @@ External Block Device (extblkdev)
 Changelog
 ---------
 * (tentacle) ceph-volume: backport PRs 67047 and 67240 (`pr#67343 <https://github.com/ceph/ceph/pull/67343>`_, Guillaume Abrioux, Parfait Detchenou)
-* 20.2.1 (`pr#68185 <https://github.com/ceph/ceph/pull/68185>`_, Ceph Release Team)
 * [tentacle] bluestore, extblkdev: Now plugins can raise health warnings (`pr#68663 <https://github.com/ceph/ceph/pull/68663>`_, Adam Kupczyk, Igor Fedotov, Martin Ohmacht)
 * Backporting PRs 67236 and 67419 (`pr#67533 <https://github.com/ceph/ceph/pull/67533>`_, Adam King)
 * Beacon diff + Stretched cluster (`pr#68347 <https://github.com/ceph/ceph/pull/68347>`_, Leonid Chernin, Samuel Just)
@@ -160,6 +159,7 @@ Changelog
 * mgr: ensure that all modules have started before advertising active mgr (`pr#67850 <https://github.com/ceph/ceph/pull/67850>`_, Laura Flores)
 * mgr: fix continous smb MgrDBNotReady (`pr#68598 <https://github.com/ceph/ceph/pull/68598>`_, Pedro Gonzalez Gomez)
 * mgr: fix PyObject\* refcounting in TTLCache and cleanup logic (`pr#66482 <https://github.com/ceph/ceph/pull/66482>`_, Nitzan Mordechai)
+* mgr: guard close_section calls in get_perf_schema_python (`pr#69436 <https://github.com/ceph/ceph/pull/69436>`_, Lumir Sliva)
 * mgr: isolated CherryPy to prevent global state sharing (`pr#67465 <https://github.com/ceph/ceph/pull/67465>`_, Nizamudeen A, Anmol Babu)
 * mon [stretch-mode]: Allow a max bucket weight diff threshold (`pr#67790 <https://github.com/ceph/ceph/pull/67790>`_, Kamoltat Sirivadhna, Kamoltat (Junior) Sirivadhna)
 * mon/AuthMonitor: add osd w cap for superuser client (`pr#68314 <https://github.com/ceph/ceph/pull/68314>`_, Venky Shankar, Patrick Donnelly)
@@ -176,6 +176,7 @@ Changelog
 * os/bluestore:fix bluestore_volume_selection_reserved_factor usage (`pr#66837 <https://github.com/ceph/ceph/pull/66837>`_, Igor Fedotov)
 * osd/scrub: support an operator-abort command (`pr#67031 <https://github.com/ceph/ceph/pull/67031>`_, Ronen Friedman)
 * osd: add pg-upmap-primary to clean_pg_upmaps (`pr#67407 <https://github.com/ceph/ceph/pull/67407>`_, Laura Flores)
+* osd: Allow multiple objects with same version in missing list (`pr#69450 <https://github.com/ceph/ceph/pull/69450>`_, Alex Ainscow)
 * osd: Avoid assertion on empty object read when reading multiple objects (`pr#68714 <https://github.com/ceph/ceph/pull/68714>`_, Alex Ainscow)
 * osd: Avoid pwlc spanning intervals (`pr#68708 <https://github.com/ceph/ceph/pull/68708>`_, Bill Scales)
 * osd: Change rmissing map key from version_t to eversion_t (`pr#68716 <https://github.com/ceph/ceph/pull/68716>`_, Alex Ainscow)

From 0b8c738927b476626d70f64f090767a6742cd8e1 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 16 Jun 2026 03:41:19 +0800
Subject: [PATCH 239/596] crimson,test: remove unused functions and dead
 variable

Fixing these warnings:

  src/crimson/os/seastore/seastore.cc:83: 'omaptree_initialize' defined but not used [-Wunused-function]
  src/crimson/osd/replicated_recovery_backend.cc:733: 'nullopt_if_empty' defined but not used [-Wunused-function]
  src/test/rgw/test_rgw_kms_cache.cc:63: 'rethrow' defined but not used [-Wunused-function]
  src/test/librados/test_cxx.cc:215: variable 'cmd' set but not used [-Wunused-but-set-variable]

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/crimson/os/seastore/seastore.cc            | 12 ------------
 src/crimson/osd/replicated_recovery_backend.cc |  5 -----
 src/test/librados/test_cxx.cc                  |  4 ----
 src/test/rgw/test_rgw_kms_cache.cc             |  6 ------
 4 files changed, 27 deletions(-)

diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index 324cf6b0a5a..d8165270476 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -79,18 +79,6 @@ namespace crimson::os::seastore {
 using crimson::os::seastore::omap_manager::BtreeOMapManager;
 using crimson::os::seastore::log_manager::LogManager;
 
-static OMapManager::initialize_omap_ret
-omaptree_initialize(
-  Transaction& t,
-  BtreeOMapManager& mgr,
-  omap_type_t type,
-  Onode& onode,
-  Device& device)
-{
-  return mgr.initialize_omap(
-    t, onode.get_metadata_hint(device.get_block_size()), type);
-}
-
 class FileMDStore final : public SeaStore::MDStore {
   std::string root;
 public:
diff --git a/src/crimson/osd/replicated_recovery_backend.cc b/src/crimson/osd/replicated_recovery_backend.cc
index 51d2ceee957..6d43707e14f 100644
--- a/src/crimson/osd/replicated_recovery_backend.cc
+++ b/src/crimson/osd/replicated_recovery_backend.cc
@@ -730,11 +730,6 @@ ReplicatedRecoveryBackend::read_object_for_push_op(
   }));
 }
 
-static std::optional<std::string> nullopt_if_empty(const std::string& s)
-{
-  return s.empty() ? std::nullopt : std::make_optional(s);
-}
-
 static bool is_too_many_entries_per_chunk(const PushOp* push_op)
 {
   const uint64_t entries_per_chunk =
diff --git a/src/test/librados/test_cxx.cc b/src/test/librados/test_cxx.cc
index 8d153739015..48ee8c64244 100644
--- a/src/test/librados/test_cxx.cc
+++ b/src/test/librados/test_cxx.cc
@@ -212,10 +212,6 @@ std::string set_pool_flags_pp(const std::string &pool_name, librados::Rados &clu
       flags
   );
 
-  char *cmd[2];
-  cmd[0] = (char *)cmdstr.c_str();
-  cmd[1] = NULL;
-
   int ret = cluster.mon_command(std::move(cmdstr), {}, NULL, NULL);
   if (ret) {
     oss << "rados_mon_command osd pool set set_pool_flags_pp failed with error " << ret;
diff --git a/src/test/rgw/test_rgw_kms_cache.cc b/src/test/rgw/test_rgw_kms_cache.cc
index 7fc3f18fc34..758bcc9e780 100644
--- a/src/test/rgw/test_rgw_kms_cache.cc
+++ b/src/test/rgw/test_rgw_kms_cache.cc
@@ -60,12 +60,6 @@ class TestKMSCacheReaperLifecycle : public ::testing::Test,
       : rgw::kms::KMSCache(g_ceph_context, std::make_unique<FakeKeyring>()) {};
 };
 
-static void rethrow(const std::exception_ptr& eptr) {
-  if (eptr) {
-    std::rethrow_exception(eptr);
-  }
-}
-
 TEST_F(TestKMSCacheReaperLifecycle, Threaded) {
   initialize_ttl_reaper(std::nullopt);
   EXPECT_TRUE(reaper_initialized());

From b943cb6d68de4a80da18e357cbac9b5796c16f17 Mon Sep 17 00:00:00 2001
From: Pritha Srivastava <prsrivas@redhat.com>
Date: Thu, 28 Aug 2025 12:36:07 +0530
Subject: [PATCH 240/596] rgw/d4n: deleting LFUDAEntry and LFUDAObjEntry
 instances in LFUDAPolicy destructor.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
---
 src/rgw/driver/d4n/d4n_policy.cc | 2 +-
 src/rgw/driver/d4n/d4n_policy.h  | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/rgw/driver/d4n/d4n_policy.cc b/src/rgw/driver/d4n/d4n_policy.cc
index ff3c917bebd..78259af039d 100644
--- a/src/rgw/driver/d4n/d4n_policy.cc
+++ b/src/rgw/driver/d4n/d4n_policy.cc
@@ -392,7 +392,7 @@ int LFUDAPolicy::eviction(const DoutPrefixProvider* dpp, uint64_t size, optional
       return ret;
     }
 
-    ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Block " << key << " has been evicted." << dendl;
+    ldpp_dout(dpp, 2) << "LFUDAPolicy::" << __func__ << "(): Block " << key << " has been evicted." << dendl;
 
     if (perfcounter) {
       perfcounter->inc(l_rgw_d4n_cache_evictions);
diff --git a/src/rgw/driver/d4n/d4n_policy.h b/src/rgw/driver/d4n/d4n_policy.h
index 0a6a9de856e..c51dd8e0d3f 100644
--- a/src/rgw/driver/d4n/d4n_policy.h
+++ b/src/rgw/driver/d4n/d4n_policy.h
@@ -199,6 +199,12 @@ class LFUDAPolicy : public CachePolicy {
       quit = true;
       cond.notify_all();
       if (tc.joinable()) { tc.join(); }
+      for (auto& it : entries_map) {
+        delete it.second;
+      }
+      for (auto& it : o_entries_map) {
+        delete it.second.first;
+      }
     } 
 
     virtual int init(CephContext *cct, const DoutPrefixProvider* dpp, asio::io_context& io_context, rgw::sal::Driver *_driver);

From 1265c6b5cd9ba2e45ac65333fc52f0aa91adada4 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 16 Jun 2026 03:41:27 +0800
Subject: [PATCH 241/596] test/crimson/seastore: use gtest assertion macros
 instead of assert()

Plain assert() is compiled out under NDEBUG, leaving the checked
variables unused. Use the always-evaluated gtest macros instead.

  src/test/crimson/seastore/test_cbjournal.cc:586: variable 'old_written_to' set but not used [-Wunused-but-set-variable]
  src/test/crimson/seastore/test_btree_lba_manager.cc:345: unused structured binding declaration [-Wunused-variable]

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/crimson/seastore/test_btree_lba_manager.cc | 5 +++--
 src/test/crimson/seastore/test_cbjournal.cc         | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/test/crimson/seastore/test_btree_lba_manager.cc b/src/test/crimson/seastore/test_btree_lba_manager.cc
index a312f5c3d03..6d02ec53c2e 100644
--- a/src/test/crimson/seastore/test_btree_lba_manager.cc
+++ b/src/test/crimson/seastore/test_btree_lba_manager.cc
@@ -342,8 +342,9 @@ struct lba_btree_test : btree_test_base {
 	    get_op_context(t), addr,
             get_map_val(len, extent->get_type()), extent.get()
 	  ).si_then([addr, extent](auto p){
-	    auto& [iter, inserted] = p;
-	    assert(inserted);
+	    // there should be no element at the given addr before insert(),
+	    // so the insertion (p.second) should take place here.
+	    EXPECT_TRUE(p.second);
 	    extent->set_laddr(addr);
 	  });
 	});
diff --git a/src/test/crimson/seastore/test_cbjournal.cc b/src/test/crimson/seastore/test_cbjournal.cc
index 932485a6476..ffd9c96c938 100644
--- a/src/test/crimson/seastore/test_cbjournal.cc
+++ b/src/test/crimson/seastore/test_cbjournal.cc
@@ -594,6 +594,6 @@ TEST_F(cbjournal_test_t, multiple_submit_at_end)
       return Journal::replay_ertr::make_ready_future<
 	std::pair<bool, CachedExtentRef>>(true, nullptr);
     }).unsafe_get();
-    assert(get_written_to() == old_written_to);
+    ASSERT_EQ(get_written_to(), old_written_to);
   });
 }

From d3c8d3fc6566d3c909d36875d9ba05345fc90cb2 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 16 Jun 2026 03:41:34 +0800
Subject: [PATCH 242/596] crimson,mgr: mark assert-only variables
 [[maybe_unused]]

These variables are only read inside assert(), which is compiled out
under NDEBUG. Mark them [[maybe_unused]] to silence the warnings while
keeping the debug-only assert() style used by the surrounding code:

  src/crimson/os/seastore/lba/btree_lba_manager.cc:1078: unused variable 'orig_len' [-Wunused-variable]
  src/crimson/os/seastore/omap_manager/log/log_manager.cc:73: variable 'ret' set but not used [-Wunused-but-set-variable]
  src/crimson/os/seastore/transaction_manager.cc:382: variable 'intermediate_key' set but not used [-Wunused-but-set-variable]
  src/mgr/PyModule.cc:166,186: unused variable 'r' [-Wunused-variable]

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/crimson/os/seastore/lba/btree_lba_manager.cc        | 2 +-
 src/crimson/os/seastore/omap_manager/log/log_manager.cc | 2 +-
 src/crimson/os/seastore/transaction_manager.cc          | 2 +-
 src/mgr/PyModule.cc                                     | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/crimson/os/seastore/lba/btree_lba_manager.cc b/src/crimson/os/seastore/lba/btree_lba_manager.cc
index 7f1bb7f4486..0d71c0969de 100644
--- a/src/crimson/os/seastore/lba/btree_lba_manager.cc
+++ b/src/crimson/os/seastore/lba/btree_lba_manager.cc
@@ -1075,7 +1075,7 @@ BtreeLBAManager::remap_mappings(
   assert(cursor->is_viewable());
   auto orig_indirect = cursor->is_indirect();
   auto orig_laddr = cursor->get_laddr();
-  auto orig_len = cursor->get_length();
+  [[maybe_unused]] auto orig_len = cursor->get_length();
   auto c = get_context(t);
   auto btree = co_await get_btree<LBABtree>(cache, c);
   auto iter = btree.make_partial_iter(c, *cursor);
diff --git a/src/crimson/os/seastore/omap_manager/log/log_manager.cc b/src/crimson/os/seastore/omap_manager/log/log_manager.cc
index f06a45bb2b1..03f16875c5c 100644
--- a/src/crimson/os/seastore/omap_manager/log/log_manager.cc
+++ b/src/crimson/os/seastore/omap_manager/log/log_manager.cc
@@ -70,7 +70,7 @@ LogManager::omap_set_keys(
   auto resync_node = [&](LogNodeRef e)
     -> log_load_extent_iertr::future<CachedExtentRef> {
     CachedExtentRef node;
-    Transaction::get_extent_ret ret;
+    [[maybe_unused]] Transaction::get_extent_ret ret;
     // To find mutable extent in the same transaction
     ret = t.get_extent(e->get_paddr(), &node);
     assert(ret == Transaction::get_extent_ret::PRESENT);
diff --git a/src/crimson/os/seastore/transaction_manager.cc b/src/crimson/os/seastore/transaction_manager.cc
index f0fd3509cea..f0e586220b9 100644
--- a/src/crimson/os/seastore/transaction_manager.cc
+++ b/src/crimson/os/seastore/transaction_manager.cc
@@ -379,7 +379,7 @@ TransactionManager::resolve_cursor_to_mapping(
 
   ceph_assert(direct_cursors.size() == 1);
   auto& direct_cursor = direct_cursors.front();
-  auto intermediate_key = cursor->get_intermediate_key();
+  [[maybe_unused]] auto intermediate_key = cursor->get_intermediate_key();
   assert(!direct_cursor->is_indirect());
   assert(direct_cursor->get_laddr() <= intermediate_key);
   assert(direct_cursor->get_laddr() + direct_cursor->get_length()
diff --git a/src/mgr/PyModule.cc b/src/mgr/PyModule.cc
index 46dc97073b8..40531f6db8f 100644
--- a/src/mgr/PyModule.cc
+++ b/src/mgr/PyModule.cc
@@ -163,7 +163,7 @@ std::span<std::byte const> py_bytes_as_span(PyObject *bytes)
   assert(PyBytes_CheckExact(bytes));
   Py_ssize_t length;
   char *buf;
-  int r = PyBytes_AsStringAndSize(
+  [[maybe_unused]] int r = PyBytes_AsStringAndSize(
     bytes, &buf, &length);
   assert(r == 0);
   return std::span<std::byte const>((const std::byte*)buf, size_t(length));
@@ -183,7 +183,7 @@ std::vector<std::byte> py_bytes_as_vec(PyObject *bytes)
   assert(PyBytes_CheckExact(bytes));
   Py_ssize_t length;
   char *buf;
-  int r = PyBytes_AsStringAndSize(
+  [[maybe_unused]] int r = PyBytes_AsStringAndSize(
     bytes, &buf, &length);
   assert(r == 0);
   return std::vector<std::byte>{

From e3d9ebb50e914bfa8a2518a7f22024b0d10f375b Mon Sep 17 00:00:00 2001
From: Tomer Haskalovitch <tomer.haska@ibm.com>
Date: Tue, 2 Jun 2026 13:20:28 +0300
Subject: [PATCH 243/596] mgr/dashboard: align nvmeof cli with missing
 parameters and functions from the old nvmeof cli

fixes: https://tracker.ceph.com/issues/77108
Signed-off-by: Tomer Haskalovitch <tomer.haska@ibm.com>
---
 .../mgr/dashboard/controllers/nvmeof.py       | 245 +++++++++++++++-
 src/pybind/mgr/dashboard/model/nvmeof.py      |  42 +++
 src/pybind/mgr/dashboard/openapi.yaml         | 274 +++++++++++++++++-
 3 files changed, 553 insertions(+), 8 deletions(-)

diff --git a/src/pybind/mgr/dashboard/controllers/nvmeof.py b/src/pybind/mgr/dashboard/controllers/nvmeof.py
index d6f7628803c..557ea546ef1 100644
--- a/src/pybind/mgr/dashboard/controllers/nvmeof.py
+++ b/src/pybind/mgr/dashboard/controllers/nvmeof.py
@@ -2,7 +2,7 @@
 # pylint: disable=too-many-lines
 import logging
 from functools import partial
-from typing import Any, Dict, List, Optional
+from typing import Any, Dict, List, Optional, Tuple
 
 import cherrypy
 from orchestrator import OrchestratorError
@@ -299,6 +299,37 @@ else:
             )
             return io_stats
 
+        @ReadPermission
+        @Endpoint('GET', '/thread_stats')
+        @NvmeofCLICommand(
+            "nvmeof gateway get_thread_stats", model.ThreadStatsInfo,
+            alias="nvmeof gw get_thread_stats")
+        @EndpointDoc(
+            "Get NVMeoF thread statistics for the gateway",
+            parameters={
+                "gw_group": Param(str, "NVMeoF gateway group", True, None),
+                "server_address": Param(str, "NVMeoF gateway address", True, None),
+                "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
+            }
+        )
+        @convert_to_model(model.ThreadStatsInfo)
+        @handle_nvmeof_error
+        def get_thread_stats(
+            self, gw_group: Optional[str] = None,
+            server_address: Optional[str] = None,
+            traddr: Optional[str] = None
+        ):
+            server_address = resolve_nvmeof_server_address(
+                server_address=server_address,
+                traddr=traddr
+            )
+            return NVMeoFClient(
+                gw_group=gw_group,
+                server_address=server_address
+            ).stub.get_thread_stats(
+                NVMeoFClient.pb2.get_thread_stats_req()
+            )
+
     @APIRouter("/nvmeof/spdk", Scope.NVME_OF)
     @APIDoc("NVMe-oF SPDK Management API", "NVMe-oF SPDK")
     class NVMeoFSpdk(RESTController):
@@ -416,6 +447,8 @@ else:
         @EndpointDoc(
             "List all NVMeoF subsystems",
             parameters={
+                "nqn": Param(str, "NVMeoF subsystem NQN to filter by", True, None),
+                "serial_number": Param(str, "Serial number to filter by", True, None),
                 "gw_group": Param(str, "NVMeoF gateway group", True, None),
                 "server_address": Param(str, "NVMeoF gateway address", True, None),
                 "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
@@ -423,7 +456,8 @@ else:
         )
         @convert_to_model(model.SubsystemList)
         @handle_nvmeof_error
-        def list(self, gw_group: Optional[str] = None, server_address: Optional[str] = None,
+        def list(self, nqn: Optional[str] = None, serial_number: Optional[str] = None,
+                 gw_group: Optional[str] = None, server_address: Optional[str] = None,
                  traddr: Optional[str] = None):
             server_address = resolve_nvmeof_server_address(
                 server_address=server_address,
@@ -433,7 +467,8 @@ else:
                 gw_group=gw_group,
                 server_address=server_address
             ).stub.list_subsystems(
-                NVMeoFClient.pb2.list_subsystems_req()
+                NVMeoFClient.pb2.list_subsystems_req(subsystem_nqn=nqn,
+                                                     serial_number=serial_number)
             )
 
         @pick(field="subsystems", first=True)
@@ -860,6 +895,12 @@ else:
                 "gw_group": Param(str, "NVMeoF gateway group", True, None),
                 "server_address": Param(str, "NVMeoF gateway address", True, None),
                 "secure": Param(bool, "Use a secure channel", True, False),
+                "force": Param(
+                    bool,
+                    "Allow contradiction in security with existing listeners",
+                    True,
+                    False
+                ),
                 "verify_host_name": Param(bool,
                                           "Fail if the host name doesn't match the "
                                           "gateway's host name",
@@ -878,6 +919,7 @@ else:
             gw_group: Optional[str] = None,
             server_address: Optional[str] = None,
             secure: Optional[bool] = False,
+            force: Optional[bool] = False,
             verify_host_name: Optional[bool] = False,
         ):
             client = NVMeoFClient(
@@ -892,6 +934,7 @@ else:
                     trsvcid=int(trsvcid) if trsvcid is not None else None,
                     adrfam=int(adrfam),
                     secure=str_to_bool(secure),
+                    force=str_to_bool(force),
                     verify_host_name=str_to_bool(verify_host_name),
                 )
             )
@@ -919,6 +962,15 @@ else:
                 "traddr": Param(str, "NVMeoF transport address"),
                 "trsvcid": Param(int, "NVMeoF transport service port"),
                 "adrfam": Param(int, "NVMeoF address family (0 - IPv4, 1 - IPv6)", True, 0),
+                "force": Param(
+                    bool,
+                    (
+                        "Delete listener even if there are active connections "
+                        "or host name doesn't match"
+                    ),
+                    True,
+                    False
+                ),
                 "gw_group": Param(str, "NVMeoF gateway group", True, None),
                 "server_address": Param(str, "NVMeoF gateway address", True, None),
             },
@@ -963,6 +1015,7 @@ else:
             parameters={
                 "nqn": Param(str, "NVMeoF subsystem NQN", True, None),
                 "nsid": Param(str, "NVMeoF Namespace ID to filter by", True, None),
+                "uuid": Param(str, "NVMeoF Namespace UUID to filter by", True, None),
                 "gw_group": Param(str, "NVMeoF gateway group", True, None),
                 "server_address": Param(str, "NVMeoF gateway address", True, None),
                 "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
@@ -971,6 +1024,7 @@ else:
         @convert_to_model(model.NamespaceList)
         @handle_nvmeof_error
         def list(self, nqn: Optional[str] = None, nsid: Optional[str] = None,
+                 uuid: Optional[str] = None,
                  gw_group: Optional[str] = None, server_address: Optional[str] = None,
                  traddr: Optional[str] = None):
             server_address = resolve_nvmeof_server_address(
@@ -982,7 +1036,8 @@ else:
                 server_address=server_address
             ).stub.list_namespaces(
                 NVMeoFClient.pb2.list_namespaces_req(subsystem=nqn,
-                                                     nsid=int(nsid) if nsid else None)
+                                                     nsid=int(nsid) if nsid else None,
+                                                     uuid=uuid)
             )
 
         @pick("namespaces", first=True)
@@ -1055,7 +1110,8 @@ else:
                 "rados_namespace": Param(str, "RADOS namespace name", True, None),
                 "rbd_pool": Param(str, "RBD pool name"),
                 "rbd_data_pool": Param(str, "RBD data pool name", True, None),
-                "nsid": Param(str, "Create RBD image", True, None),
+                "nsid": Param(str, "Namespace ID", True, None),
+                "uuid": Param(str, "UUID", True, None),
                 "create_image": Param(bool, "Create RBD image"),
                 "size": Param(int, "Deprecated. Use `rbd_image_size` instead"),
                 "rbd_image_size": Param(int, "RBD image size"),
@@ -1098,6 +1154,7 @@ else:
             rbd_pool: str = "rbd",
             rbd_data_pool: Optional[str] = None,
             nsid: Optional[str] = None,
+            uuid: Optional[str] = None,
             create_image: Optional[bool] = False,
             size: Optional[int] = None,
             rbd_image_size: Optional[int] = None,
@@ -1143,6 +1200,7 @@ else:
                 NVMeoFClient.pb2.namespace_add_req(
                     subsystem_nqn=nqn,
                     nsid=int(nsid) if nsid else None,
+                    uuid=uuid,
                     rbd_image_name=rbd_image_name,
                     rados_namespace_name=rados_namespace,
                     rbd_pool_name=rbd_pool,
@@ -1176,6 +1234,8 @@ else:
                 "rbd_data_pool": Param(str, "RBD data pool name", True, None),
                 "rados_namespace": Param(str, "RADOS namespace name", True, None),
                 "rbd_image_name": Param(str, "RBD image name"),
+                "nsid": Param(str, "Namespace ID", True, None),
+                "uuid": Param(str, "UUID", True, None),
                 "create_image": Param(bool, "Create RBD image"),
                 "size": Param(str, "Deprecated. Use `rbd_image_size` instead", True, None),
                 "rbd_image_size": Param(str, "RBD image size", True, None),
@@ -1218,6 +1278,7 @@ else:
             rbd_pool: str = "rbd",
             rbd_data_pool: Optional[str] = None,
             nsid: Optional[str] = None,
+            uuid: Optional[str] = None,
             create_image: Optional[bool] = False,
             size: Optional[str] = None,
             rbd_image_size: Optional[str] = None,
@@ -1278,6 +1339,7 @@ else:
                 NVMeoFClient.pb2.namespace_add_req(
                     subsystem_nqn=nqn,
                     nsid=int(nsid) if nsid else None,
+                    uuid=uuid,
                     rbd_image_name=rbd_image_name,
                     rados_namespace_name=rados_namespace,
                     rbd_pool_name=rbd_pool,
@@ -1638,6 +1700,170 @@ else:
                 )
             )
 
+        @ReadPermission
+        @Endpoint('PUT', '{nsid}/change_location')
+        @NvmeofCLICommand(
+            "nvmeof namespace change_location",
+            model=model.RequestStatus,
+            alias="nvmeof ns change_location",
+            success_message_template=(
+                'Setting location for namespace {nsid} in {nqn} to "{location}": Successful'
+            )
+        )
+        @EndpointDoc(
+            "Change the location of the specified NVMeoF namespace",
+            parameters={
+                "nqn": Param(str, "NVMeoF subsystem NQN"),
+                "nsid": Param(str, "NVMeoF Namespace ID"),
+                "location": Param(str, "Gateway location for namespace"),
+                "gw_group": Param(str, "NVMeoF gateway group", True, None),
+                "server_address": Param(str, "NVMeoF gateway address", True, None),
+                "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
+            },
+        )
+        @convert_to_model(model.RequestStatus)
+        @handle_nvmeof_error
+        def change_location(
+            self,
+            nqn: str,
+            nsid: str,
+            location: str,
+            gw_group: Optional[str] = None,
+            server_address: Optional[str] = None,
+            traddr: Optional[str] = None
+        ):
+            server_address = resolve_nvmeof_server_address(
+                server_address=server_address,
+                traddr=traddr
+            )
+            return NVMeoFClient(
+                gw_group=gw_group,
+                server_address=server_address
+            ).stub.namespace_change_location(
+                NVMeoFClient.pb2.namespace_change_location_req(
+                    subsystem_nqn=nqn,
+                    nsid=int(nsid),
+                    location=location,
+                )
+            )
+
+        @ReadPermission
+        @Endpoint('GET', 'list_hosts')
+        @NvmeofCLICommand(
+            "nvmeof namespace list_hosts",
+            model=model.NamespaceHostsList,
+            alias="nvmeof ns list_hosts"
+        )
+        @EndpointDoc(
+            "List all NVMeoF namespaces with their allowed hosts",
+            parameters={
+                "nqn": Param(str, "NVMeoF subsystem NQN", True, None),
+                "nsid": Param(str, "NVMeoF Namespace ID to filter by", True, None),
+                "uuid": Param(str, "NVMeoF Namespace UUID to filter by", True, None),
+                "gw_group": Param(str, "NVMeoF gateway group", True, None),
+                "server_address": Param(str, "NVMeoF gateway address", True, None),
+                "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
+            },
+        )
+        @handle_nvmeof_error
+        def list_hosts(
+            self, nqn: Optional[str] = None, nsid: Optional[str] = None,
+            uuid: Optional[str] = None,
+            gw_group: Optional[str] = None, server_address: Optional[str] = None,
+            traddr: Optional[str] = None
+        ):
+            server_address = resolve_nvmeof_server_address(
+                server_address=server_address,
+                traddr=traddr
+            )
+            ns_list = NVMeoFClient(
+                gw_group=gw_group,
+                server_address=server_address
+            ).stub.list_namespaces(
+                NVMeoFClient.pb2.list_namespaces_req(subsystem=nqn,
+                                                     nsid=int(nsid) if nsid else None,
+                                                     uuid=uuid)
+            )
+
+            # Transform to NamedTuple with only NQN, NSID, and Hosts
+            host_infos = []
+            for ns in ns_list.namespaces:
+                host_infos.append(model.NamespaceHostInfo(
+                    nqn=ns.ns_subsystem_nqn or nqn or "",
+                    nsid=ns.nsid,
+                    hosts=list(ns.hosts)
+                ))
+
+            return model.NamespaceHostsList(
+                status=ns_list.status,
+                error_message=ns_list.error_message,
+                namespaces=host_infos
+            )
+
+        @ReadPermission
+        @Endpoint('GET', 'list_locations')
+        @NvmeofCLICommand(
+            "nvmeof namespace list_locations",
+            model=model.NamespaceLocationsList,
+            alias="nvmeof ns list_locations"
+        )
+        @EndpointDoc(
+            "List namespace distribution per site locations",
+            parameters={
+                "nqn": Param(str, "NVMeoF subsystem NQN", True, None),
+                "nsid": Param(str, "NVMeoF Namespace ID to filter by", True, None),
+                "uuid": Param(str, "NVMeoF Namespace UUID to filter by", True, None),
+                "gw_group": Param(str, "NVMeoF gateway group", True, None),
+                "server_address": Param(str, "NVMeoF gateway address", True, None),
+                "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
+            },
+        )
+        @handle_nvmeof_error
+        def list_locations(
+            self, nqn: Optional[str] = None, nsid: Optional[str] = None,
+            uuid: Optional[str] = None,
+            gw_group: Optional[str] = None, server_address: Optional[str] = None,
+            traddr: Optional[str] = None
+        ):
+            server_address = resolve_nvmeof_server_address(
+                server_address=server_address,
+                traddr=traddr
+            )
+            ns_list = NVMeoFClient(
+                gw_group=gw_group,
+                server_address=server_address
+            ).stub.list_namespaces(
+                NVMeoFClient.pb2.list_namespaces_req(subsystem=nqn,
+                                                     nsid=int(nsid) if nsid else None,
+                                                     uuid=uuid)
+            )
+
+            # Aggregate namespaces by subsystem, load balancing group, and location
+            location_counts: Dict[Tuple[str, int, str], int] = {}
+            for ns in ns_list.namespaces:
+                subsystem_nqn = ns.ns_subsystem_nqn or nqn or ""
+                lb_group = ns.load_balancing_group if ns.load_balancing_group else 0
+                location = ns.location if ns.location else "<default>"
+
+                key = (subsystem_nqn, lb_group, location)
+                location_counts[key] = location_counts.get(key, 0) + 1
+
+            # Convert to NamedTuple list
+            location_infos = []
+            for (subsystem_nqn, lb_group, location), count in sorted(location_counts.items()):
+                location_infos.append(model.NamespaceLocationInfo(
+                    subsystem=subsystem_nqn,
+                    load_balancing_group=lb_group,
+                    location=location,
+                    namespace_count=count
+                ))
+
+            return model.NamespaceLocationsList(
+                status=ns_list.status,
+                error_message=ns_list.error_message,
+                locations=location_infos
+            )
+
         @ReadPermission
         @Endpoint('PUT', '{nsid}/set_auto_resize')
         @NvmeofCLICommand(
@@ -2064,6 +2290,10 @@ else:
             parameters={
                 "nqn": Param(str, "NVMeoF subsystem NQN"),
                 "host_nqn": Param(str, 'NVMeoF host NQN. Use "*" to disallow any host.'),
+                "force": Param(
+                    bool,
+                    "Delete the host even if it used in a namespace netmask",
+                    True, False),
                 "gw_group": Param(str, "NVMeoF gateway group", True, None),
                 "server_address": Param(str, "NVMeoF gateway address", True, None),
                 "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
@@ -2071,7 +2301,8 @@ else:
         )
         @convert_to_model(model.RequestStatus)
         @handle_nvmeof_error
-        def delete(self, nqn: str, host_nqn: str, gw_group: Optional[str] = None,
+        def delete(self, nqn: str, host_nqn: str, force: Optional[bool] = False,
+                   gw_group: Optional[str] = None,
                    server_address: Optional[str] = None,
                    traddr: Optional[str] = None):
             server_address = resolve_nvmeof_server_address(
@@ -2082,7 +2313,7 @@ else:
                 gw_group=gw_group,
                 server_address=server_address
             ).stub.remove_host(
-                NVMeoFClient.pb2.remove_host_req(subsystem_nqn=nqn, host_nqn=host_nqn)
+                NVMeoFClient.pb2.remove_host_req(subsystem_nqn=nqn, host_nqn=host_nqn, force=force)
             )
 
         @empty_response
diff --git a/src/pybind/mgr/dashboard/model/nvmeof.py b/src/pybind/mgr/dashboard/model/nvmeof.py
index d832eb26140..f4b7327514e 100644
--- a/src/pybind/mgr/dashboard/model/nvmeof.py
+++ b/src/pybind/mgr/dashboard/model/nvmeof.py
@@ -207,6 +207,35 @@ class NamespaceList(NamedTuple):
     namespaces: Annotated[List[Namespace], CliFlags.EXCLUSIVE_LIST]
 
 
+class NamespaceHostInfo(NamedTuple):
+    nqn: Annotated[str, CliHeader("NQN")]
+    nsid: Annotated[int, CliHeader("NSID")]
+    hosts: Annotated[
+        List[str],
+        CliHeader("Hosts"),
+        CliFieldTransformer(lambda v: "\n".join(v) if v else "None")
+    ]
+
+
+class NamespaceHostsList(NamedTuple):
+    status: int
+    error_message: str
+    namespaces: Annotated[List[NamespaceHostInfo], CliFlags.EXCLUSIVE_LIST]
+
+
+class NamespaceLocationInfo(NamedTuple):
+    subsystem: Annotated[str, CliHeader("Subsystem")]
+    load_balancing_group: Annotated[int, CliHeader("Load Balancing Group")]
+    location: Annotated[str, CliHeader("Location")]
+    namespace_count: Annotated[int, CliHeader("Count")]
+
+
+class NamespaceLocationsList(NamedTuple):
+    status: int
+    error_message: str
+    locations: Annotated[List[NamespaceLocationInfo], CliFlags.EXCLUSIVE_LIST]
+
+
 class NamespaceIOStats(NamedTuple):
     status: Annotated[int, CliFlags.DROP]
     error_message: Annotated[str, CliFlags.DROP]
@@ -292,6 +321,19 @@ class GatewayStatsInfo(NamedTuple):
     poll_groups: Annotated[List[PollGroupInfo], CliFlags.EXCLUSIVE_LIST]
 
 
+class SpdkThreadInfo(NamedTuple):
+    name: str
+    busy: int
+    idle: int
+
+
+class ThreadStatsInfo(NamedTuple):
+    status: int
+    error_message: str
+    tick_rate: int
+    threads: Annotated[List[SpdkThreadInfo], CliFlags.EXCLUSIVE_LIST]
+
+
 class AnaState(Enum):
     UNSET = 0
     OPTIMIZED = 1
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index abb7a7351ff..2ddd1190b47 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -12961,6 +12961,51 @@ paths:
       summary: Get NVMeoF statistics for the gateway
       tags:
       - NVMe-oF Gateway
+  /api/nvmeof/gateway/thread_stats:
+    get:
+      parameters:
+      - allowEmptyValue: true
+        description: NVMeoF gateway group
+        in: query
+        name: gw_group
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway address
+        in: query
+        name: server_address
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway address (deprecated)
+        in: query
+        name: traddr
+        schema:
+          type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: OK
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Get NVMeoF thread statistics for the gateway
+      tags:
+      - NVMe-oF Gateway
   /api/nvmeof/gateway/version:
     get:
       parameters:
@@ -13177,6 +13222,18 @@ paths:
   /api/nvmeof/subsystem:
     get:
       parameters:
+      - allowEmptyValue: true
+        description: NVMeoF subsystem NQN to filter by
+        in: query
+        name: nqn
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: Serial number to filter by
+        in: query
+        name: serial_number
+        schema:
+          type: string
       - allowEmptyValue: true
         description: NVMeoF gateway group
         in: query
@@ -13599,6 +13656,12 @@ paths:
         required: true
         schema:
           type: string
+      - default: false
+        description: Delete the host even if it used in a namespace netmask
+        in: query
+        name: force
+        schema:
+          type: boolean
       - allowEmptyValue: true
         description: NVMeoF gateway group
         in: query
@@ -13980,6 +14043,10 @@ paths:
                   default: 0
                   description: NVMeoF address family (0 - IPv4, 1 - IPv6)
                   type: integer
+                force:
+                  default: false
+                  description: Allow contradiction in security with existing listeners
+                  type: boolean
                 gw_group:
                   description: NVMeoF gateway group
                   type: string
@@ -14075,6 +14142,8 @@ paths:
         schema:
           type: integer
       - default: false
+        description: Delete listener even if there are active connections or host
+          name doesn't match
         in: query
         name: force
         schema:
@@ -14139,6 +14208,12 @@ paths:
         name: nsid
         schema:
           type: string
+      - allowEmptyValue: true
+        description: NVMeoF Namespace UUID to filter by
+        in: query
+        name: uuid
+        schema:
+          type: string
       - allowEmptyValue: true
         description: NVMeoF gateway group
         in: query
@@ -14240,7 +14315,7 @@ paths:
                   description: Namespace will be visible only for the allowed hosts
                   type: boolean
                 nsid:
-                  description: Create RBD image
+                  description: Namespace ID
                   type: string
                 rados_namespace:
                   description: RADOS namespace name
@@ -14275,6 +14350,9 @@ paths:
                   default: false
                   description: Trash the RBD image when namespace is removed
                   type: boolean
+                uuid:
+                  description: UUID
+                  type: string
               required:
               - rbd_image_name
               type: object
@@ -14311,6 +14389,132 @@ paths:
       summary: Create a new NVMeoF namespace.
       tags:
       - NVMe-oF Subsystem Namespace
+  /api/nvmeof/subsystem/{nqn}/namespace/list_hosts:
+    get:
+      parameters:
+      - allowEmptyValue: true
+        description: NVMeoF subsystem NQN
+        in: path
+        name: nqn
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF Namespace ID to filter by
+        in: query
+        name: nsid
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF Namespace UUID to filter by
+        in: query
+        name: uuid
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway group
+        in: query
+        name: gw_group
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway address
+        in: query
+        name: server_address
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway address (deprecated)
+        in: query
+        name: traddr
+        schema:
+          type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: OK
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: List all NVMeoF namespaces with their allowed hosts
+      tags:
+      - NVMe-oF Subsystem Namespace
+  /api/nvmeof/subsystem/{nqn}/namespace/list_locations:
+    get:
+      parameters:
+      - allowEmptyValue: true
+        description: NVMeoF subsystem NQN
+        in: path
+        name: nqn
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF Namespace ID to filter by
+        in: query
+        name: nsid
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF Namespace UUID to filter by
+        in: query
+        name: uuid
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway group
+        in: query
+        name: gw_group
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway address
+        in: query
+        name: server_address
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: NVMeoF gateway address (deprecated)
+        in: query
+        name: traddr
+        schema:
+          type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: OK
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: List namespace distribution per site locations
+      tags:
+      - NVMe-oF Subsystem Namespace
   /api/nvmeof/subsystem/{nqn}/namespace/{nsid}:
     delete:
       parameters:
@@ -14654,6 +14858,74 @@ paths:
       summary: set the load balancing group for specified NVMeoF namespace
       tags:
       - NVMe-oF Subsystem Namespace
+  /api/nvmeof/subsystem/{nqn}/namespace/{nsid}/change_location:
+    put:
+      parameters:
+      - description: NVMeoF subsystem NQN
+        in: path
+        name: nqn
+        required: true
+        schema:
+          type: string
+      - description: NVMeoF Namespace ID
+        in: path
+        name: nsid
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                gw_group:
+                  description: NVMeoF gateway group
+                  type: string
+                location:
+                  description: Gateway location for namespace
+                  type: string
+                server_address:
+                  description: NVMeoF gateway address
+                  type: string
+                traddr:
+                  description: NVMeoF gateway address (deprecated)
+                  type: string
+              required:
+              - location
+              type: object
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Resource updated.
+        '202':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Operation is still executing. Please check the task queue.
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Change the location of the specified NVMeoF namespace
+      tags:
+      - NVMe-oF Subsystem Namespace
   /api/nvmeof/subsystem/{nqn}/namespace/{nsid}/change_visibility:
     put:
       parameters:

From c1dbe78a1490d001b1c9115f071a04fc3280a93f Mon Sep 17 00:00:00 2001
From: Pritha Srivastava <prsrivas@redhat.com>
Date: Mon, 1 Sep 2025 14:26:17 +0530
Subject: [PATCH 244/596] rgw/d4n: adding a thread to asynchronously update
 localweight to the cache backend. Removing the code to update the localweight
 from GET and PUT requests.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
---
 src/common/options/rgw.yaml.in   |  10 ++
 src/rgw/driver/d4n/d4n_policy.cc | 213 ++++++++++++++++++++-----------
 src/rgw/driver/d4n/d4n_policy.h  |  15 ++-
 3 files changed, 159 insertions(+), 79 deletions(-)

diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index d9111ffeb07..06defc466e1 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -4468,6 +4468,16 @@ options:
   flags:
   - startup
   with_legacy: true
+- name: rgw_d4n_localweight_processing_interval
+  type: int
+  level: advanced
+  desc: This is the interval in seconds for invoking local weight writer thread
+  default: 3600
+  services:
+  - rgw
+  flags:
+  - startup
+  with_legacy: true
 - name: rgw_topic_persistency_time_to_live
   type: uint
   level: advanced
diff --git a/src/rgw/driver/d4n/d4n_policy.cc b/src/rgw/driver/d4n/d4n_policy.cc
index 78259af039d..45122f5436c 100644
--- a/src/rgw/driver/d4n/d4n_policy.cc
+++ b/src/rgw/driver/d4n/d4n_policy.cc
@@ -71,6 +71,9 @@ int LFUDAPolicy::init(CephContext* cct, const DoutPrefixProvider* dpp, asio::io_
     tc = std::thread(&CachePolicy::cleaning, this, dpp);
   }
 
+  lwthread = std::thread(&LFUDAPolicy::localweight_writer, this, dpp);
+  lw_quit = false;
+
   try {
     boost::system::error_code ec;
     response<
@@ -432,74 +435,80 @@ void LFUDAPolicy::update(const DoutPrefixProvider* dpp, const std::string& key,
 {
   ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): updating entry: " << key << dendl;
   using handle_type = boost::heap::fibonacci_heap<LFUDAEntry*, boost::heap::compare<EntryComparator<LFUDAEntry>>>::handle_type;
-  const std::lock_guard l(lfuda_lock);
-  int localWeight = age;
-  auto entry = find_entry(key);
-  bool updateLocalWeight = true;
-  uint64_t refcount = 0;
+  bool updateLocalWeight = true, should_notify = false;
+  {
+    const std::lock_guard l(lfuda_lock);
+    int localWeight = age;
+    auto entry = find_entry(key);
+    uint64_t refcount = 0;
+    if (!restore_val.empty()) {
+      updateLocalWeight = false;
+      localWeight = std::stoull(restore_val);
+      ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): restored localWeight is: " << localWeight << dendl;
+    }
 
-  if (!restore_val.empty()) {
-    updateLocalWeight = false;
-    localWeight = std::stoull(restore_val);
-    ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): restored localWeight is: " << localWeight << dendl;
-  }
-
-  /* check the dirty flag in the existing entry for the key and the incoming dirty flag. If the
-     incoming dirty flag is false, that means update() is invoked as part of cleaning process,
-     so we must not update its localWeight. */
-  if (entry) {
-    refcount = entry->refcount;
-    if (entry->dirty && dirty.has_value()) {
-      bool is_dirty = dirty.value();
-      if (!is_dirty) {
-        localWeight = entry->localWeight;
-        updateLocalWeight = false;
+    /* check the dirty flag in the existing entry for the key and the incoming dirty flag. If the
+      incoming dirty flag is false, that means update() is invoked as part of cleaning process,
+      so we must not update its localWeight. */
+    if (entry) {
+      refcount = entry->refcount;
+      if (entry->dirty && dirty.has_value()) {
+        bool is_dirty = dirty.value();
+        if (!is_dirty) {
+          localWeight = entry->localWeight;
+          updateLocalWeight = false;
+        }
+      }
+      if (updateLocalWeight) {
+        localWeight = entry->localWeight + age;
+      }
+      if (op == RefCount::INCR) {
+        refcount += 1;
+      }
+      if (op == RefCount::DECR) {
+        if (refcount > 0) {
+          refcount -= 1;
+        }
       }
     }
+    //pick the existing value of dirty, if no value has been passed in
+    bool is_dirty = false;
+    if (dirty.has_value()) {
+      is_dirty = dirty.value();
+    } else if (entry) {
+      is_dirty = entry->dirty;
+    }
+    ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): updated refcount is: " << refcount << dendl;
+
+    if (entry) {
+      entry->key = key;
+      entry->offset = offset;
+      entry->len = len;
+      entry->version = version;
+      entry->dirty = is_dirty;
+      entry->refcount = refcount;
+      entry->localWeight = localWeight;
+      entries_heap.update(entry->handle, entry);
+    } else {
+      LFUDAEntry* e = new LFUDAEntry(key, offset, len, version, is_dirty, refcount, localWeight);
+      handle_type handle = entries_heap.push(e);
+      e->set_handle(handle);
+      entries_map.emplace(key, e);
+    }
+
     if (updateLocalWeight) {
-      localWeight = entry->localWeight + age;
-    }
-    if (op == RefCount::INCR) {
-      refcount += 1;
-    }
-    if (op == RefCount::DECR) {
-      if (refcount > 0) {
-        refcount -= 1;
+      updated_blocks.emplace(key, localWeight);
+      if (updated_blocks.size() >= LOCALWEIGHT_BATCH_SIZE) {
+        should_notify = true;
       }
     }
-  }
-  //pick the existing value of dirty, if no value has been passed in
-  bool is_dirty = false;
-  if (dirty.has_value()) {
-    is_dirty = dirty.value();
-  } else if (entry) {
-    is_dirty = entry->dirty;
-  }
-  ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): updated refcount is: " << refcount << dendl;
 
-  if (entry) {
-    entry->key = key;
-    entry->offset = offset;
-    entry->len = len;
-    entry->version = version;
-    entry->dirty = is_dirty;
-    entry->refcount = refcount;
-    entry->localWeight = localWeight;
-    entries_heap.update(entry->handle, entry);
-  } else {
-    LFUDAEntry* e = new LFUDAEntry(key, offset, len, version, is_dirty, refcount, localWeight);
-    handle_type handle = entries_heap.push(e);
-    e->set_handle(handle);
-    entries_map.emplace(key, e);
+    weightSum += ((localWeight < 0) ? 0 : localWeight);
+  } //lock will be released here
+  if (should_notify) {
+    ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): notify_one: "<< dendl;
+    lw_cond.notify_one();
   }
-
-  if (updateLocalWeight) {
-    int ret = -1;
-    if ((ret = cacheDriver->set_attr(dpp, key, RGW_CACHE_ATTR_LOCAL_WEIGHT, std::to_string(localWeight), y)) < 0) 
-      ldpp_dout(dpp, 0) << "LFUDAPolicy::" << __func__ << "(): CacheDriver set_attr method failed, ret=" << ret << dendl;
-  }
-
-  weightSum += ((localWeight < 0) ? 0 : localWeight);
 }
 
 void LFUDAPolicy::update_dirty_object(const DoutPrefixProvider* dpp, const std::string& key, const std::string& version, bool deleteMarker, uint64_t size, double creationTime, const rgw_user& user, const std::string& etag, const std::string& bucket_name, const std::string& bucket_id, const rgw_obj_key& obj_key, uint8_t op, optional_yield y, std::string& restore_val)
@@ -515,11 +524,13 @@ void LFUDAPolicy::update_dirty_object(const DoutPrefixProvider* dpp, const std::
     state = State::INIT;
   }
 
-  const std::lock_guard l(lfuda_cleaning_lock);
-  LFUDAObjEntry* e = new LFUDAObjEntry{key, version, deleteMarker, size, creationTime, user, etag, bucket_name, bucket_id, obj_key};
-  handle_type handle = object_heap.push(e);
-  e->set_handle(handle);
-  o_entries_map.emplace(key, std::make_pair(e, state));
+  {
+    const std::lock_guard l(lfuda_cleaning_lock);
+    LFUDAObjEntry* e = new LFUDAObjEntry{key, version, deleteMarker, size, creationTime, user, etag, bucket_name, bucket_id, obj_key};
+    handle_type handle = object_heap.push(e);
+    e->set_handle(handle);
+    o_entries_map.emplace(key, std::make_pair(e, state));
+  }
   cond.notify_one();
 }
 
@@ -548,18 +559,19 @@ bool LFUDAPolicy::erase(const DoutPrefixProvider* dpp, const std::string& key, o
 
 bool LFUDAPolicy::erase_dirty_object(const DoutPrefixProvider* dpp, const std::string& key, optional_yield y)
 {
-  const std::lock_guard l(lfuda_cleaning_lock);
-  auto p = o_entries_map.find(key);
-  if (p == o_entries_map.end()) {
-    return false;
+  {
+    const std::lock_guard l(lfuda_cleaning_lock);
+    auto p = o_entries_map.find(key);
+    if (p == o_entries_map.end()) {
+      return false;
+    }
+
+    object_heap.erase(p->second.first->handle);
+    delete p->second.first;
+    p->second.first = nullptr;
+    o_entries_map.erase(p);
   }
-
-  object_heap.erase(p->second.first->handle);
-  delete p->second.first;
-  p->second.first = nullptr;
-  o_entries_map.erase(p);
   state_cond.notify_one();
-
   return true;
 }
 
@@ -908,7 +920,7 @@ void LFUDAPolicy::cleaning(const DoutPrefixProvider* dpp)
 	      }
 	    } //end-if (block.version == entry->version)
 	  } //end - else if op_ret == 0
-	  ldpp_dout(dpp, 10) << "D4NFilterObject::" << __func__ << "(): Removing object name: "<< c_obj->get_name() << " score: " << std::setprecision(std::numeric_limits<double>::max_digits10) << e->creationTime << " from ordered set" << dendl;
+	  ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Removing object name: "<< c_obj->get_name() << " score: " << std::setprecision(std::numeric_limits<double>::max_digits10) << e->creationTime << " from ordered set" << dendl;
 	  rgw::d4n::CacheObj dir_obj = rgw::d4n::CacheObj{
 	    .objName = c_obj->get_name(),
 	    .bucketName = c_obj->get_bucket()->get_bucket_id(),
@@ -962,7 +974,7 @@ void LFUDAPolicy::cleaning(const DoutPrefixProvider* dpp)
 		continue;
 	      }
 	    }
-	    ldpp_dout(dpp, 10) << "D4NFilterObject::" << __func__ << "(): Removing object name: "<< c_obj->get_name() << " score: " << std::setprecision(std::numeric_limits<double>::max_digits10) << e->creationTime << " from ordered set" << dendl;
+	    ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Removing object name: "<< c_obj->get_name() << " score: " << std::setprecision(std::numeric_limits<double>::max_digits10) << e->creationTime << " from ordered set" << dendl;
 	    rgw::d4n::CacheObj dir_obj = rgw::d4n::CacheObj{
 	      .objName = c_obj->get_name(),
 	      .bucketName = c_obj->get_bucket()->get_bucket_id(),
@@ -988,6 +1000,53 @@ void LFUDAPolicy::cleaning(const DoutPrefixProvider* dpp)
   } //end-while true
 }
 
+void LFUDAPolicy::localweight_writer(const DoutPrefixProvider* dpp)
+{
+  ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Starting thread " << dendl;
+  auto TIMEOUT_DURATION = std::chrono::seconds(dpp->get_cct()->_conf->rgw_d4n_localweight_processing_interval);
+  while (!lw_quit.load()) {
+    std::unordered_map<std::string, uint64_t> temp;
+    bool woke_up = false;
+    //sleep for some duration or till size crosses 10K before processing
+    {
+      std::unique_lock<std::mutex> wait_lock(lfuda_lock);
+      woke_up = lw_cond.wait_for(wait_lock, TIMEOUT_DURATION, [this] {
+                return updated_blocks.size() >= LOCALWEIGHT_BATCH_SIZE || lw_quit.load();
+      });
+      if (lw_quit.load()) {
+          ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Quit signal received, exiting" << dendl;
+          break;
+      }
+      if (!updated_blocks.empty()) {
+          updated_blocks.swap(temp);
+          if (woke_up) {
+              ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Woke up due to size threshold, processing " << temp.size() << " items" << dendl;
+          } else {
+              ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Woke up due to timeout, processing " << temp.size() << " items" << dendl;
+          }
+      }
+    } //lock released here
+    if (!temp.empty()) {
+      ldpp_dout(dpp, 5) << "LFUDAPolicy::" << __func__ << "(): Processing batch of " << temp.size() << " items" << dendl;
+      for (auto& it : temp) {
+        if (lw_quit.load()) {
+          ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): Quit signal received, exiting" << lw_quit << dendl;
+          break;
+        }
+        auto& key = it.first;
+        auto localWeight = it.second;
+        ldpp_dout(dpp, 10) << "LFUDAPolicy::" << __func__ << "(): CacheDriver set_attr method called for key: " << key << dendl;
+        int ret = cacheDriver->set_attr(dpp, key, RGW_CACHE_ATTR_LOCAL_WEIGHT, std::to_string(localWeight), y);
+        if (ret < 0) {
+          ldpp_dout(dpp, 0) << "LFUDAPolicy::" << __func__ << "(): CacheDriver set_attr method failed, ret=" << ret << dendl;
+        }
+      } //end-for
+      ldpp_dout(dpp, 5) << "LFUDAPolicy::" << __func__ << "(): Finished processing batch" << dendl;
+    } //end-if
+  }//end-while
+  ldpp_dout(dpp, 10) << "D4NFilterObject::" << __func__ << "(): Thread exiting" << dendl;
+}
+
 int LRUPolicy::exist_key(const std::string& key)
 {
   const std::lock_guard l(lru_lock);
diff --git a/src/rgw/driver/d4n/d4n_policy.h b/src/rgw/driver/d4n/d4n_policy.h
index c51dd8e0d3f..c3ca641b3cb 100644
--- a/src/rgw/driver/d4n/d4n_policy.h
+++ b/src/rgw/driver/d4n/d4n_policy.h
@@ -38,6 +38,7 @@ class CachePolicy {
       std::string version;
       bool dirty;
       uint64_t refcount{0};
+      Entry() = default;
       Entry(const std::string& key, uint64_t offset, uint64_t len, const std::string& version, bool dirty, uint64_t refcount) : key(key), offset(offset), 
 											        len(len), version(version), dirty(dirty), refcount(refcount) {}
       };
@@ -120,7 +121,7 @@ class LFUDAPolicy : public CachePolicy {
       int localWeight;
       using handle_type = boost::heap::fibonacci_heap<LFUDAEntry*, boost::heap::compare<EntryComparator<LFUDAEntry>>>::handle_type;
       handle_type handle;
-
+      LFUDAEntry() = default;
       LFUDAEntry(const std::string& key, uint64_t offset, uint64_t len, const std::string& version, bool dirty, uint64_t refcount, int localWeight) : Entry(key, offset, len, version, dirty, refcount), 
 														       localWeight(localWeight) {}
       
@@ -149,7 +150,9 @@ class LFUDAPolicy : public CachePolicy {
     std::mutex lfuda_cleaning_lock;
     std::condition_variable cond;
     std::condition_variable state_cond;
+    std::condition_variable lw_cond;
     inline static std::atomic<bool> quit{false};
+    inline static std::atomic<bool> lw_quit{false};
 
     int age = 1, weightSum = 0, postedSum = 0;
     optional_yield y = null_yield;
@@ -161,6 +164,10 @@ class LFUDAPolicy : public CachePolicy {
     std::optional<asio::steady_timer> rthread_timer;
     rgw::sal::Driver* driver;
     std::thread tc;
+    std::thread lwthread;
+    //data structure for accumulating updated blocks
+    std::unordered_map<std::string, uint64_t> updated_blocks;
+    static constexpr size_t LOCALWEIGHT_BATCH_SIZE = 10000;
 
     CacheBlock* get_victim_block(const DoutPrefixProvider* dpp, optional_yield y);
     int age_sync(const DoutPrefixProvider* dpp, optional_yield y); 
@@ -197,15 +204,18 @@ class LFUDAPolicy : public CachePolicy {
       delete blockDir;
       delete objDir;
       quit = true;
+      lw_quit = true;
       cond.notify_all();
+      lw_cond.notify_all();
       if (tc.joinable()) { tc.join(); }
+      if (lwthread.joinable()) { lwthread.join(); }
       for (auto& it : entries_map) {
         delete it.second;
       }
       for (auto& it : o_entries_map) {
         delete it.second.first;
       }
-    } 
+    }
 
     virtual int init(CephContext *cct, const DoutPrefixProvider* dpp, asio::io_context& io_context, rgw::sal::Driver *_driver);
     virtual int exist_key(const std::string& key) override;
@@ -228,6 +238,7 @@ class LFUDAPolicy : public CachePolicy {
       return it->second.first;
     }
     void save_y(optional_yield y) { this->y = y; }
+    void localweight_writer(const DoutPrefixProvider* dpp);
 };
 
 class LRUPolicy : public CachePolicy {

From 5910070aaba8daefbdee0dd4c2e62c8b4487bcbc Mon Sep 17 00:00:00 2001
From: Samarah Uriarte <samarah.uriarte@ibm.com>
Date: Thu, 11 Jun 2026 17:48:42 +0000
Subject: [PATCH 245/596] rgw/d4n: Update policy unit test

Signed-off-by: Samarah Uriarte <samarah.uriarte@ibm.com>
---
 src/test/rgw/test_d4n_policy.cc | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/test/rgw/test_d4n_policy.cc b/src/test/rgw/test_d4n_policy.cc
index 467a0dfdd31..0029847357b 100644
--- a/src/test/rgw/test_d4n_policy.cc
+++ b/src/test/rgw/test_d4n_policy.cc
@@ -114,7 +114,8 @@ class LFUDAPolicyFixture : public ::testing::Test {
       std::string oid = rgw::sal::get_key_in_cache(get_prefix(block->cacheObj.bucketName, block->cacheObj.objName, version), std::to_string(block->blockID), std::to_string(block->size));
 
       if (this->policyDriver->get_cache_policy()->exist_key(oid)) { /* Local copy */
-        policyDriver->get_cache_policy()->update(env->dpp, oid, 0, TEST_DATA_LENGTH, "", false, rgw::d4n::RefCount::NOOP, y);
+        policyDriver->get_cache_policy()->update(env->dpp, oid, 0, TEST_DATA_LENGTH, "", std::nullopt, rgw::d4n::RefCount::NOOP, y);
+        // The local weight will not update until the calls exceed 10000 in total
         return 0;
       } else {
         if (this->policyDriver->get_cache_policy()->eviction(dpp, block->size, y) < 0)
@@ -259,7 +260,7 @@ void rethrow(std::exception_ptr eptr) {
 TEST_F(LFUDAPolicyFixture, LocalGetBlockYield)
 {
   boost::asio::spawn(io, [this] (boost::asio::yield_context yield) {
-    env->cct->_conf->rgw_lfuda_sync_frequency = 1;
+    env->cct->_conf->rgw_lfuda_sync_frequency = 6;
     dynamic_cast<rgw::d4n::LFUDAPolicy*>(policyDriver->get_cache_policy())->save_y(optional_yield{yield});
     policyDriver->get_cache_policy()->init(env->cct, env->dpp, io, driver);
 
@@ -270,19 +271,22 @@ TEST_F(LFUDAPolicyFixture, LocalGetBlockYield)
 
     ASSERT_EQ(lfuda(env->dpp, block, cacheDriver, yield), 0);
 
+	boost::asio::steady_timer timer(io);
+	timer.expires_after(std::chrono::seconds(5));
+	boost::system::error_code timer_ec;
+	timer.async_wait(yield[timer_ec]);
+
     cacheDriver->shutdown();
 
     boost::system::error_code ec;
     request req;
-    req.push("HGET", "RedisCache/testBucket#testName#0#9", RGW_CACHE_ATTR_LOCAL_WEIGHT);
     req.push("FLUSHALL");
 
-    response<std::string, boost::redis::ignore_t> resp;
+    response<boost::redis::ignore_t> resp;
 
     conn->async_exec(req, resp, yield[ec]);
 
     ASSERT_EQ((bool)ec, false);
-    EXPECT_EQ(std::get<0>(resp).value(), "2");
     conn->cancel();
     
     delete policyDriver; 

From 59afb3d661ef6bc251bb65652032997d71844cee Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 16 Jun 2026 16:24:16 +0800
Subject: [PATCH 246/596] rocksdb: update submodule to fix FTBFS due to missing
 <cstdint>

43dd4cbd370 bumped the rocksdb submodule to v7.10.2 for CVE-2022-23476,
dropping the <cstdint> includes the v7.9.2 pin carried.
db/blob/blob_file_meta.h uses uint64_t but no longer includes <cstdint>,
so it compiles only where another header pulls <cstdint> in transitively.
GCC with libstdc++ 16.1.0 no longer does, so the build fails:

    db/blob/blob_file_meta.h: error: 'uint64_t' has not been declared

our targeted distros still pull it in, so the failure went unnoticed
there: ubuntu jammy (GCC 11.2.0) and noble (GCC 13.2).

bump the submodule to a cherry-pick of upstream rocksdb 72c3887167,
which fixes the same FTBFS.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/rocksdb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rocksdb b/src/rocksdb
index 0bd97e703ec..af6e913d159 160000
--- a/src/rocksdb
+++ b/src/rocksdb
@@ -1 +1 @@
-Subproject commit 0bd97e703ec62ad602717482508b08dd91baa8f5
+Subproject commit af6e913d15956f15ab888d1d0eb13120f462acba

From a8af36d04e0e7979188468a0ab5d2b31dba3465a Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Fri, 12 Jun 2026 15:39:31 +0800
Subject: [PATCH 247/596] crimson/os/seastore/transaction: clear
 copied_lba_keys on reset

Before this commit, Transaction::copied_lba_keys was never cleared
on reset, so when a transaction is reset, and another rewrite
transaction is committing, the rewrite transaction would try to
update the copied lba mapping which may not have been copied by
the reset transaction, which would result in unexpected errors.

This commit generally follows the regulations about resetting
transactions, which is clear everything on reset

Fixes: https://tracker.ceph.com/issues/76945
Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/transaction.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/crimson/os/seastore/transaction.h b/src/crimson/os/seastore/transaction.h
index a6e2e1c7272..c8c727e9a6f 100644
--- a/src/crimson/os/seastore/transaction.h
+++ b/src/crimson/os/seastore/transaction.h
@@ -535,6 +535,8 @@ public:
     }
     get_handle().exit();
     views.clear();
+    copied_lba_keys.clear();
+    update_copied_lba_key = nullptr;
   }
 
   bool did_reset() const {

From cdb37469b09e178b78c0ca161d0073f0842c034b Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sun, 14 Jun 2026 16:47:59 +0800
Subject: [PATCH 248/596] test/objectstore: hold split_blob cache shards in
 unique_ptr

ExtentMap.split_blob, added in be93e121a98, creates the onode and buffer cache
shards as raw pointers and never frees them. once we build with ASan,
LeakSanitizer reports them (and the structures they own):

  Direct leak of 9928 byte(s) ... BlueStore::OnodeCacheShard::create
  Direct leak of 224 byte(s) ... BlueStore::BufferCacheShard::create
  SUMMARY: AddressSanitizer: 10288 byte(s) leaked in 8 allocation(s).

every other test in this file already wraps these shards in a unique_ptr,
declared before the collection that borrows them so they outlive it. do
the same here.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/test/objectstore/test_bluestore_types.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/test/objectstore/test_bluestore_types.cc b/src/test/objectstore/test_bluestore_types.cc
index 23f7b847f83..c2025a25e1f 100644
--- a/src/test/objectstore/test_bluestore_types.cc
+++ b/src/test/objectstore/test_bluestore_types.cc
@@ -1078,12 +1078,12 @@ TEST(Blob, split) {
 
 TEST(ExtentMap, split_blob) {
   BlueStore store(g_ceph_context, "", 4096);
-  BlueStore::OnodeCacheShard *oc =
-      BlueStore::OnodeCacheShard::create(g_ceph_context, "lru", NULL);
-  BlueStore::BufferCacheShard *bc =
-      BlueStore::BufferCacheShard::create(&store, "lru", NULL);
+  std::unique_ptr<BlueStore::OnodeCacheShard> oc{
+      BlueStore::OnodeCacheShard::create(g_ceph_context, "lru", NULL)};
+  std::unique_ptr<BlueStore::BufferCacheShard> bc{
+      BlueStore::BufferCacheShard::create(&store, "lru", NULL)};
 
-  auto coll = ceph::make_ref<BlueStore::Collection>(&store, oc, bc, coll_t());
+  auto coll = ceph::make_ref<BlueStore::Collection>(&store, oc.get(), bc.get(), coll_t());
   BlueStore::Onode onode(coll.get(), ghobject_t(), "");
   size_t shard_size =
     g_ceph_context->_conf->bluestore_extent_map_inline_shard_prealloc_size;

From 45f943ddb89f0913c58841a895c807f94354a45c Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Thu, 11 Jun 2026 18:51:33 +0530
Subject: [PATCH 249/596] mgr/smb: Add client support mode for macOS-specific
 SMB features

This commit introduces a new cluster-level configuration option to enable
client-specific SMB optimizations, starting with macOS support.

Usage:
  ceph smb cluster create <cluster-id> --client-compat macos
  ceph smb cluster update client-compat macos <cluster-id>

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/smb/enums.py     | 13 ++++++
 src/pybind/mgr/smb/handler.py   | 18 ++++++++-
 src/pybind/mgr/smb/module.py    | 72 +++++++++++++++++++++++++++++++++
 src/pybind/mgr/smb/resources.py | 21 ++++++++++
 4 files changed, 122 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/smb/enums.py b/src/pybind/mgr/smb/enums.py
index 698cb6dde02..fac7ba54bbf 100644
--- a/src/pybind/mgr/smb/enums.py
+++ b/src/pybind/mgr/smb/enums.py
@@ -124,6 +124,19 @@ class ShowResults(_StrEnum):
     COLLAPSED = 'collapsed'
 
 
+class ClientSupportMode(_StrEnum):
+    """Determines if client-specific SMB features should be enabled.
+
+    - DEFAULT: Standard SMB behavior without client-specific optimizations
+    - MACOS: Enable macOS-specific features (AAPL extensions, fruit VFS, etc.)
+
+    Future values could include: WINDOWS_OPTIMIZED, LINUX_OPTIMIZED, etc.
+    """
+
+    DEFAULT = 'default'
+    MACOS = 'macos'
+
+
 class PasswordFilter(_StrEnum):
     """Filter type for password values."""
 
diff --git a/src/pybind/mgr/smb/handler.py b/src/pybind/mgr/smb/handler.py
index f376368bd6d..6f6954d0b2e 100644
--- a/src/pybind/mgr/smb/handler.py
+++ b/src/pybind/mgr/smb/handler.py
@@ -759,6 +759,7 @@ def order_resources(
 @dataclasses.dataclass(frozen=True)
 class _ShareConf:
     resource: resources.Share
+    cluster: resources.Cluster
     resolver: PathResolver
     cephx_entity: str
     ceph_cluster: str
@@ -807,7 +808,13 @@ class _ClusterConf:
         return cls(
             change_group.cluster,
             [
-                _ShareConf(s, resolver, cephx_entity, ceph_cluster)
+                _ShareConf(
+                    s,
+                    change_group.cluster,
+                    resolver,
+                    cephx_entity,
+                    ceph_cluster,
+                )
                 for s in change_group.shares
             ],
             change_group,
@@ -847,7 +854,14 @@ def _generate_share(conf: _ShareConf) -> Dict[str, Dict[str, str]]:
         if conf.ceph_cluster
         else '/etc/ceph/ceph.conf'
     )
-    modules = ["acl_xattr", "ceph_snapshots"]
+    # Build VFS modules list based on cluster configuration
+    modules = []
+    # Add macOS support modules if enabled
+    if conf.cluster.is_macos_compatibility_enabled:
+        modules.extend(["fruit", "streams_xattr"])
+
+    # Add standard modules
+    modules.extend(["acl_xattr", "ceph_snapshots"])
 
     if qos := cephfs.qos:
         vfs_rl = "aio_ratelimit"
diff --git a/src/pybind/mgr/smb/module.py b/src/pybind/mgr/smb/module.py
index 4f69eb9b2e5..9badbe57460 100644
--- a/src/pybind/mgr/smb/module.py
+++ b/src/pybind/mgr/smb/module.py
@@ -31,6 +31,7 @@ from . import (
 from .cli import SMBCLICommand
 from .enums import (
     AuthMode,
+    ClientSupportMode,
     InputPasswordFilter,
     JoinSourceType,
     PasswordFilter,
@@ -223,6 +224,7 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
         placement: Optional[str] = None,
         clustering: Optional[SMBClustering] = None,
         public_addrs: Optional[List[str]] = None,
+        client_compat: Optional[ClientSupportMode] = None,
         password_filter: InputPasswordFilter = InputPasswordFilter.NONE,
         password_filter_out: Optional[PasswordFilter] = None,
     ) -> results.Result:
@@ -333,6 +335,7 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             placement=pspec,
             clustering=clustering,
             public_addrs=c_public_addrs,
+            client_compat=client_compat,
         )
         to_apply.append(cluster)
         return self._apply_res(
@@ -442,6 +445,75 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             password_filter_out=password_filter,
         )
 
+    @SMBCLICommand('cluster update client-compat', perm='rw')
+    def cluster_update_client_compat(
+        self,
+        client_compat: ClientSupportMode,
+        cluster_id: str,
+    ) -> Simplified:
+        """Update client compatibility mode for an SMB cluster and all its shares"""
+        # Get the existing cluster
+        clusters = self._handler.matching_resources(
+            [f'ceph.smb.cluster.{cluster_id}']
+        )
+
+        active_clusters = [
+            c for c in clusters if isinstance(c, resources.Cluster)
+        ]
+
+        if not active_clusters:
+            raise ValueError(f"Cluster {cluster_id} not found")
+
+        if len(active_clusters) > 1:
+            raise ValueError(f"Multiple clusters found matching {cluster_id}")
+
+        cluster = active_clusters[0]
+
+        # Create updated cluster with new client_compat setting
+        updated_cluster = replace(cluster, client_compat=client_compat)
+
+        # Get all shares for this cluster
+        shares = self._handler.matching_resources(
+            [f'ceph.smb.share.{cluster_id}']
+        )
+
+        active_shares = [s for s in shares if isinstance(s, resources.Share)]
+
+        # Prepare resources to update: cluster + all shares
+        resources_to_update: List[resources.SMBResource] = [updated_cluster]
+        resources_to_update.extend(active_shares)
+
+        # Apply the updates
+        result_group = self._apply_res(resources_to_update)
+
+        # Process results
+        cluster_updated = False
+        successful_share_updates = []
+        failed_share_updates = []
+
+        for result in result_group:
+            if result.success:
+                if isinstance(result.src, resources.Cluster):
+                    cluster_updated = True
+                elif hasattr(result.src, 'share_id'):
+                    successful_share_updates.append(result.src.share_id)
+            else:
+                if isinstance(result.src, resources.Share) and hasattr(
+                    result.src, 'share_id'
+                ):
+                    failed_share_updates.append(
+                        {"share_id": result.src.share_id, "error": result.msg}
+                    )
+
+        return {
+            "cluster_id": cluster_id,
+            "client_compat": client_compat.value,
+            "cluster_updated": cluster_updated,
+            "successful_share_updates": successful_share_updates,
+            "failed_share_updates": failed_share_updates,
+            "total_shares": len(active_shares),
+        }
+
     @SMBCLICommand('cluster update cephfs qos', perm='rw')
     def cluster_update_qos(
         self,
diff --git a/src/pybind/mgr/smb/resources.py b/src/pybind/mgr/smb/resources.py
index fec79e8b102..0128b6346d2 100644
--- a/src/pybind/mgr/smb/resources.py
+++ b/src/pybind/mgr/smb/resources.py
@@ -29,6 +29,7 @@ from . import resourcelib, validation
 from .enums import (
     AuthMode,
     CephFSStorageProvider,
+    ClientSupportMode,
     HostAccess,
     Intent,
     JoinSourceType,
@@ -902,6 +903,8 @@ class Cluster(_RBase):
     debug_level: Optional[dict[str, str]] = None
     # configure the keybridge (KMS integration) for this cluster
     keybridge: Optional[KeyBridge] = None
+    # client support mode for client-specific optimizations (macOS, etc.)
+    client_compat: Optional[ClientSupportMode] = None
 
     def validate(self) -> None:
         if not self.cluster_id:
@@ -950,6 +953,24 @@ class Cluster(_RBase):
     def clustering_mode(self) -> SMBClustering:
         return self.clustering if self.clustering else SMBClustering.DEFAULT
 
+    @property
+    def effective_client_compat(self) -> ClientSupportMode:
+        """Return the effective client compat mode.
+
+        Returns ClientSupportMode.DEFAULT if not explicitly set, ensuring
+        client-specific features are disabled by default.
+        """
+        return (
+            self.client_compat
+            if self.client_compat
+            else ClientSupportMode.DEFAULT
+        )
+
+    @property
+    def is_macos_compatibility_enabled(self) -> bool:
+        """Return true if macOS-specific SMB features should be enabled."""
+        return self.effective_client_compat == ClientSupportMode.MACOS
+
     @property
     def remote_control_is_enabled(self) -> bool:
         """Return true if a remote control service should be enabled for this

From 6f59987690de84158f32b83b911f4785b4b8073a Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Fri, 12 Jun 2026 16:59:22 +0530
Subject: [PATCH 250/596] mgr/smb: add tests for client compatibility mode

Add comprehensive test coverage for the new client compatibility
feature that enables macOS-specific SMB optimizations:

- test_enums.py: Add tests for ClientSupportMode enum values
  (DEFAULT and MACOS) and string representation
- test_resources.py: Add tests for cluster client_compat field,
  effective_client_compat property, and is_macos_compatibility_enabled
  property with different mode configurations
- test_smb.py: Add integration tests for cluster_update_client_compat
  CLI command including successful updates and error handling for
  non-existent clusters

These tests ensure the client compatibility mode can be properly
set, retrieved, and updated at the cluster level.

Signed-off-by: Shweta Sodani <shsodani@redhat.com>
---
 src/pybind/mgr/smb/tests/test_enums.py     |  20 +++++
 src/pybind/mgr/smb/tests/test_resources.py |  83 +++++++++++++++++
 src/pybind/mgr/smb/tests/test_smb.py       | 100 +++++++++++++++++++++
 3 files changed, 203 insertions(+)

diff --git a/src/pybind/mgr/smb/tests/test_enums.py b/src/pybind/mgr/smb/tests/test_enums.py
index 1ebd40d238c..641d6593a46 100644
--- a/src/pybind/mgr/smb/tests/test_enums.py
+++ b/src/pybind/mgr/smb/tests/test_enums.py
@@ -43,3 +43,23 @@ def test_login_access_expand():
         == smb.enums.LoginAccess.READ_WRITE
     )
     assert smb.enums.LoginAccess.NONE.expand() == smb.enums.LoginAccess.NONE
+
+
+def test_client_compat_enum():
+    """Test ClientSupportMode enum values and string representation."""
+    assert smb.enums.ClientSupportMode.DEFAULT == 'default'
+    assert smb.enums.ClientSupportMode.MACOS == 'macos'
+    assert str(smb.enums.ClientSupportMode.DEFAULT) == 'default'
+    assert str(smb.enums.ClientSupportMode.MACOS) == 'macos'
+
+
+def test_client_compat_values():
+    """Test that ClientSupportMode can be constructed from string values."""
+    assert (
+        smb.enums.ClientSupportMode('default')
+        == smb.enums.ClientSupportMode.DEFAULT
+    )
+    assert (
+        smb.enums.ClientSupportMode('macos')
+        == smb.enums.ClientSupportMode.MACOS
+    )
diff --git a/src/pybind/mgr/smb/tests/test_resources.py b/src/pybind/mgr/smb/tests/test_resources.py
index cb90dd47fba..a9987b2a7ce 100644
--- a/src/pybind/mgr/smb/tests/test_resources.py
+++ b/src/pybind/mgr/smb/tests/test_resources.py
@@ -750,6 +750,89 @@ login_control:
     assert share.login_control[3].access == enums.LoginAccess.NONE
 
 
+def test_cluster_client_compat_default():
+    """Test cluster with default client support mode (not set)."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.cluster
+cluster_id: testcluster
+auth_mode: user
+user_group_settings:
+  - source_type: resource
+    ref: testusers
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+    cluster = loaded[0]
+
+    # When not set, should default to None
+    assert cluster.client_compat is None
+    # effective_client_compat should return DEFAULT
+    assert cluster.effective_client_compat == enums.ClientSupportMode.DEFAULT
+    # is_macos_compatibility_enabled should be False
+    assert cluster.is_macos_compatibility_enabled is False
+
+
+def test_cluster_client_compat_macos():
+    """Test cluster with macos client support mode enabled."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.cluster
+cluster_id: maccluster
+auth_mode: user
+user_group_settings:
+  - source_type: resource
+    ref: macusers
+client_compat: macos
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+    cluster = loaded[0]
+
+    # Should be set to MACOS
+    assert cluster.client_compat == enums.ClientSupportMode.MACOS
+    # effective_client_compat should return MACOS
+    assert cluster.effective_client_compat == enums.ClientSupportMode.MACOS
+    # is_macos_compatibility_enabled should be True
+    assert cluster.is_macos_compatibility_enabled is True
+
+    # Verify it's in the simplified output
+    sd = cluster.to_simplified()
+    assert sd
+    assert 'client_compat' in sd
+    assert sd['client_compat'] == 'macos'
+
+
+def test_cluster_client_compat_explicit_default():
+    """Test cluster with explicitly set default client support mode."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.cluster
+cluster_id: defaultcluster
+auth_mode: user
+user_group_settings:
+  - source_type: resource
+    ref: defaultusers
+client_compat: default
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+    cluster = loaded[0]
+
+    # Should be explicitly set to DEFAULT
+    assert cluster.client_compat == enums.ClientSupportMode.DEFAULT
+    # effective_client_compat should return DEFAULT
+    assert cluster.effective_client_compat == enums.ClientSupportMode.DEFAULT
+    # is_macos_compatibility_enabled should be False
+    assert cluster.is_macos_compatibility_enabled is False
+
+
 def test_tls_credential():
     import yaml
 
diff --git a/src/pybind/mgr/smb/tests/test_smb.py b/src/pybind/mgr/smb/tests/test_smb.py
index 54f9fb19fae..1d5245af6ea 100644
--- a/src/pybind/mgr/smb/tests/test_smb.py
+++ b/src/pybind/mgr/smb/tests/test_smb.py
@@ -1324,3 +1324,103 @@ def test_cluster_rm_wildcard_no_match(tmodule):
 
     with pytest.raises(smb.cli.NoMatchingValue):
         tmodule.cluster_rm('gonk', wildcard=True)
+
+
+def test_cluster_update_client_compat(tmodule):
+    """Test updating cluster client compatibility mode with shares."""
+    # Create a cluster with default client_compat
+    cluster = _cluster(
+        cluster_id='foo',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    rg = tmodule._handler.apply([cluster])
+    assert rg.success, rg.to_simplified()
+
+    # Create some shares
+    share1 = smb.resources.Share(
+        cluster_id='foo',
+        share_id='share1',
+        cephfs=smb.resources.CephFSStorage(
+            volume='cephfs',
+            path='/share1',
+        ),
+    )
+    share2 = smb.resources.Share(
+        cluster_id='foo',
+        share_id='share2',
+        cephfs=smb.resources.CephFSStorage(
+            volume='cephfs',
+            path='/share2',
+        ),
+    )
+    rg = tmodule._handler.apply([share1, share2])
+    assert rg.success, rg.to_simplified()
+
+    # Verify initial state (should be None/DEFAULT)
+    clusters = tmodule._handler.matching_resources(['ceph.smb.cluster.foo'])
+    assert len(clusters) == 1
+    initial_cluster = clusters[0]
+    assert initial_cluster.client_compat is None
+    assert (
+        initial_cluster.effective_client_compat
+        == smb.enums.ClientSupportMode.DEFAULT
+    )
+
+    # Update to MACOS compatibility mode
+    result = tmodule.cluster_update_client_compat(
+        smb.enums.ClientSupportMode.MACOS, 'foo'
+    )
+    assert isinstance(result, dict)
+    assert result['cluster_id'] == 'foo'
+    assert result['client_compat'] == 'macos'
+    assert result['cluster_updated'] is True
+    assert result['total_shares'] == 2
+    assert len(result['successful_share_updates']) == 2
+    assert 'share1' in result['successful_share_updates']
+    assert 'share2' in result['successful_share_updates']
+    assert len(result['failed_share_updates']) == 0
+
+    # Verify the update
+    clusters = tmodule._handler.matching_resources(['ceph.smb.cluster.foo'])
+    assert len(clusters) == 1
+    updated_cluster = clusters[0]
+    assert updated_cluster.client_compat == smb.enums.ClientSupportMode.MACOS
+    assert (
+        updated_cluster.effective_client_compat
+        == smb.enums.ClientSupportMode.MACOS
+    )
+    assert updated_cluster.is_macos_compatibility_enabled is True
+
+    # Update back to DEFAULT
+    result = tmodule.cluster_update_client_compat(
+        smb.enums.ClientSupportMode.DEFAULT, 'foo'
+    )
+    assert isinstance(result, dict)
+    assert result['cluster_id'] == 'foo'
+    assert result['client_compat'] == 'default'
+    assert result['cluster_updated'] is True
+    assert result['total_shares'] == 2
+
+    # Verify the update back to DEFAULT
+    clusters = tmodule._handler.matching_resources(['ceph.smb.cluster.foo'])
+    assert len(clusters) == 1
+    final_cluster = clusters[0]
+    assert final_cluster.client_compat == smb.enums.ClientSupportMode.DEFAULT
+    assert (
+        final_cluster.effective_client_compat
+        == smb.enums.ClientSupportMode.DEFAULT
+    )
+    assert final_cluster.is_macos_compatibility_enabled is False
+
+
+def test_cluster_update_client_compat_nonexistent(tmodule):
+    """Test updating client_compat for a non-existent cluster."""
+    with pytest.raises(ValueError, match="Cluster nonexistent not found"):
+        tmodule.cluster_update_client_compat(
+            smb.enums.ClientSupportMode.MACOS, 'nonexistent'
+        )

From 2bb17b80aa4c5813b6a8fc78fc0e2410b746a76b Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 16 Jun 2026 14:13:22 +0800
Subject: [PATCH 251/596] run-make-check.sh: build ctest cpu resource pool from
 sched_getaffinity

gen_ctest_resource_file assumed online CPUs are a contiguous 0..nproc-1 range.
When a middle core is hot-offlined (e.g. for a hardware fault), that both hands
out the offline cpu id and drops an online one; crimson seastar unittests feed
the ctest resource id straight to seastar --cpuset, so hitting the offline id
aborts with "Bad value for --cpuset: N not allowed".

Use the CPUs actually schedulable by the process via sched_getaffinity().

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 run-make-check.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/run-make-check.sh b/run-make-check.sh
index 264cac65c18..2c420f3dad1 100755
--- a/run-make-check.sh
+++ b/run-make-check.sh
@@ -24,9 +24,12 @@ set -e
 
 function gen_ctest_resource_file() {
     local file_name=$(mktemp /tmp/ctest-resource-XXXXXX)
-    local max_cpuid=$(($(nproc) - 1))
+    # Usable CPU ids for this process: excludes offline cores and honors cgroup/
+    # taskset limits. Not necessarily contiguous 0..nproc-1, so a crimson seastar
+    # unittest could otherwise get an offline id in --cpuset and abort.
+    local ids=$(python3 -c 'import os; print(*sorted(os.sched_getaffinity(0)))')
     jq -n '$ARGS.positional | map({id:., slots:1}) | {cpus:.} | {version: {major:1, minor:0}, local:[.]}' \
-        --args $(seq 0 $max_cpuid) > $file_name
+        --args $ids > $file_name
     echo "$file_name"
 }
 

From 82ab9cc2e3609cf0a172b3f322ac4420316c8642 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 16 Jun 2026 04:10:15 +0800
Subject: [PATCH 252/596] crimson/cmake: restrict -Wno-non-virtual-dtor to C++
 sources

The seastar target exports -Wno-non-virtual-dtor as a PUBLIC compile
option, so it leaks to every target that links seastar, including C
sources such as crimson-common's reverse.c, producing:

  cc1: warning: command-line option '-Wno-non-virtual-dtor' is valid for C++/ObjC++ but not for C

Guard the option with $<COMPILE_LANGUAGE:CXX> so that it only applies to
C++ compilations.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index a93a38d7501..b5fd500e8ea 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -502,7 +502,7 @@ if(WITH_CRIMSON)
   target_compile_options(seastar
   PUBLIC
     # required by any target that links to seastar
-    "-Wno-non-virtual-dtor"
+    "$<$<COMPILE_LANGUAGE:CXX>:-Wno-non-virtual-dtor>"
   PRIVATE
     "-DSEASTAR_NO_EXCEPTION_HACK"
     "-Wno-error"

From d4fc8b65b71239d6514e4389a06a927bb2a2d635 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 16 Jun 2026 04:10:52 +0800
Subject: [PATCH 253/596] pybind/cephfs: drop redundant int32_t typedef

int32_t is already provided by "from libc.stdint cimport *", so the extra
ctypedef in the platform_errno.h extern block redeclares it:

  warning: c_cephfs.pxd:29:4: 'int32_t' redeclared

Fixes: https://tracker.ceph.com/issues/77440

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/pybind/cephfs/c_cephfs.pxd | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/pybind/cephfs/c_cephfs.pxd b/src/pybind/cephfs/c_cephfs.pxd
index 9d5b93c0493..603906046a4 100644
--- a/src/pybind/cephfs/c_cephfs.pxd
+++ b/src/pybind/cephfs/c_cephfs.pxd
@@ -26,7 +26,6 @@ cdef extern from *:
     unsigned long DIRENT_D_OFF(dirent *d)
 
 cdef extern from "../include/platform_errno.h":
-    ctypedef signed int int32_t;
     int32_t ceph_to_hostos_errno(int32_t e)
 
 cdef extern from "cephfs/ceph_ll_client.h":

From 620d9362f24360aca966a6ee0817122ea71b70e3 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Mon, 15 Jun 2026 11:24:18 +0000
Subject: [PATCH 254/596] crimson/os/seastore: fix laddr_t formatter and its
 use

'laddr_t' existing formatter did not support a ':x' format specifier
(actually - the output was always hexadecomal).
Here we remove the ':x', but also refactor the custom formatter to
avoid using the streambuf mechanism.
Note - SEASTORE_LADDR_USE_BOOST_U128 is no longer supported by the formatter.

Fixes: https://tracker.ceph.com/issues/77399
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 .../os/seastore/object_data_handler.cc        |  2 +-
 src/crimson/os/seastore/seastore_types.h      | 38 ++++++++++++++++++-
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/src/crimson/os/seastore/object_data_handler.cc b/src/crimson/os/seastore/object_data_handler.cc
index 531aaebd233..a586a606d68 100644
--- a/src/crimson/os/seastore/object_data_handler.cc
+++ b/src/crimson/os/seastore/object_data_handler.cc
@@ -1442,7 +1442,7 @@ ObjectDataHandler::clear_ret ObjectDataHandler::trim_data_reservation(
   context_t ctx, object_data_t &object_data, extent_len_t size)
 {
   LOG_PREFIX(ObjectDataHandler::trim_data_reservation);
-  DEBUGT("0x{:x}~0x{:x}, 0x{:x}",
+  DEBUGT("{}~0x{:x}, 0x{:x}",
     ctx.t, object_data.get_reserved_data_base(),
     object_data.get_reserved_data_len(), size);
   ceph_assert(!object_data.is_null());
diff --git a/src/crimson/os/seastore/seastore_types.h b/src/crimson/os/seastore/seastore_types.h
index 6f29c9c9b70..082baeacea3 100644
--- a/src/crimson/os/seastore/seastore_types.h
+++ b/src/crimson/os/seastore/seastore_types.h
@@ -1487,6 +1487,7 @@ public:
   }
 
   friend std::ostream &operator<<(std::ostream &, const laddr_t &);
+  friend struct fmt::formatter<laddr_t>;
   friend bool operator==(const laddr_t&, const laddr_t&) = default;
   friend bool operator==(const laddr_t &laddr,
 			 const laddr_offset_t &laddr_offset) {
@@ -3622,7 +3623,6 @@ template <> struct fmt::formatter<crimson::os::seastore::extent_types_t> : fmt::
 template <> struct fmt::formatter<crimson::os::seastore::journal_seq_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::backend_type_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::journal_tail_delta_t> : fmt::ostream_formatter {};
-template <> struct fmt::formatter<crimson::os::seastore::laddr_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::laddr_hint_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::laddr_offset_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::laddr_list_t> : fmt::ostream_formatter {};
@@ -3652,6 +3652,42 @@ template <> struct fmt::formatter<crimson::os::seastore::omap_type_t> : fmt::ost
 template <> struct fmt::formatter<ceph::buffer::list> : fmt::ostream_formatter {};
 #endif
 
+namespace fmt {
+template <>
+struct formatter<crimson::os::seastore::laddr_t> {
+  constexpr auto
+  parse(format_parse_context& ctx)
+  {
+    return ctx.begin();
+  }
+
+  template <typename FormatContext>
+  auto
+  format(const crimson::os::seastore::laddr_t& laddr, FormatContext& ctx) const
+  {
+    if (laddr == crimson::os::seastore::L_ADDR_NULL) {
+      return fmt::format_to(ctx.out(), "L_ADDR_NULL");
+    }
+
+    fmt::format_to(ctx.out(), "L0x{:x}", laddr.value);
+    if (!laddr.is_global_address()) {
+      fmt::format_to(
+          ctx.out(), "({:x},{:x},{:x}", static_cast<int>(laddr.get_shard()),
+          laddr.get_pool(), laddr.get_reversed_hash());
+      if (laddr.is_object_address()) {
+        fmt::format_to(
+            ctx.out(), ",{:x},{:x},{:x},{:x}", laddr.get_local_object_id(),
+            laddr.get_local_clone_id(), static_cast<int>(laddr.is_metadata()),
+            laddr.get_offset_bytes());
+      }
+      fmt::format_to(ctx.out(), ")");
+    }
+    return ctx.out();
+  }
+};
+
+} // namespace fmt
+
 template <>
 struct std::hash<crimson::os::seastore::laddr_t> {
   using Laddr = crimson::os::seastore::laddr_t;

From c183e27deac5ede7c1614f453b0ab0d03fa415f8 Mon Sep 17 00:00:00 2001
From: Radoslaw Zarzynski <rzarzyns@redhat.com>
Date: Tue, 16 Jun 2026 16:02:22 +0000
Subject: [PATCH 255/596] tests/neorados: fix ceph_test_neorados_completions
 being not installed

Fixes: https://tracker.ceph.com/issues/77417
Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
---
 src/test/neorados/CMakeLists.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/test/neorados/CMakeLists.txt b/src/test/neorados/CMakeLists.txt
index e10672e3a57..3f623bbd64e 100644
--- a/src/test/neorados/CMakeLists.txt
+++ b/src/test/neorados/CMakeLists.txt
@@ -21,6 +21,9 @@ target_link_libraries(neoradostest-support
 add_executable(ceph_test_neorados_completions completions.cc)
 target_link_libraries(ceph_test_neorados_completions
   libneorados neoradostest-support GTest::Main)
+install(TARGETS
+  ceph_test_neorados_completions
+  DESTINATION ${CMAKE_INSTALL_BINDIR})
 
 add_executable(ceph_test_neorados_list_pool list_pool.cc)
 target_link_libraries(ceph_test_neorados_list_pool

From b8310f33c377b4c3e3f43026184f5fdd741f6a8e Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 16 Jun 2026 22:08:15 +0530
Subject: [PATCH 256/596] tools/cephfs_mirror: Add per-peer tick thread with
 configurable interval

Introduce a per-peer tick thread controlled by cephfs_mirror_tick_interval
(default 5 seconds). The interval is re-read each iteration so configuration
changes take effect without restarting the daemon. The thread provides a
generic hook for future periodic mirroring work.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/common/options/cephfs-mirror.yaml.in | 11 ++++++++++
 src/tools/cephfs_mirror/PeerReplayer.cc  | 26 ++++++++++++++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.h   | 17 ++++++++++++++++
 3 files changed, 54 insertions(+)

diff --git a/src/common/options/cephfs-mirror.yaml.in b/src/common/options/cephfs-mirror.yaml.in
index b009c0a8d6f..399076cda0b 100644
--- a/src/common/options/cephfs-mirror.yaml.in
+++ b/src/common/options/cephfs-mirror.yaml.in
@@ -104,6 +104,17 @@ options:
   services:
   - cephfs-mirror
   min: 1
+- name: cephfs_mirror_tick_interval
+  type: secs
+  level: advanced
+  desc: interval for the per-peer mirroring tick thread
+  long_desc: interval in seconds for the per-peer tick thread that runs periodic
+    mirroring work. The value is re-read each iteration so configuration changes
+    take effect without restarting the daemon.
+  default: 5
+  services:
+  - cephfs-mirror
+  min: 1
 - name: cephfs_mirror_max_consecutive_failures_per_directory
   type: uint
   level: advanced
diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 93bc04ddaf8..4bd4681f0e0 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -310,6 +310,12 @@ int PeerReplayer::init() {
     data_replayer->create(name.c_str());
     m_data_replayers.push_back(std::move(data_replayer));
   }
+
+  m_tick_thread.reset(new TickThread(this));
+  m_tick_thread->create("tick");
+
+  set_changed_mirroring_configurations();
+
   return 0;
 }
 
@@ -349,6 +355,11 @@ void PeerReplayer::shutdown() {
   }
   m_replayers.clear();
 
+  if (m_tick_thread) {
+    m_tick_thread->join();
+    m_tick_thread.reset();
+  }
+
   ceph_unmount(m_remote_mount);
   ceph_release(m_remote_mount);
   m_remote_mount = nullptr;
@@ -2336,6 +2347,21 @@ int PeerReplayer::sync_snaps(const std::string &dir_root,
   return r;
 }
 
+void PeerReplayer::run_tick() {
+  dout(10) << ": started" << dendl;
+
+  std::unique_lock locker(m_lock);
+  while (true) {
+    auto interval = g_ceph_context->_conf.get_val<std::chrono::seconds>(
+      "cephfs_mirror_tick_interval");
+    m_cond.wait_for(locker, interval, [this]{return is_stopping();});
+    if (is_stopping()) {
+      dout(5) << ": shutting down exiting" << dendl;
+      break;
+    }
+  }
+}
+
 void PeerReplayer::run(SnapshotReplayerThread *replayer) {
   dout(10) << ": snapshot replayer=" << replayer << dendl;
 
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index abe95c6dfe8..e91c5b495b2 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -129,6 +129,21 @@ private:
     PeerReplayer *m_peer_replayer;
   };
 
+  class TickThread : public Thread {
+  public:
+    explicit TickThread(PeerReplayer *peer_replayer)
+      : m_peer_replayer(peer_replayer) {
+    }
+
+    void *entry() override {
+      m_peer_replayer->run_tick();
+      return 0;
+    }
+
+  private:
+    PeerReplayer *m_peer_replayer;
+  };
+
   struct DirRegistry {
     int fd;
     bool canceled = false;
@@ -636,6 +651,7 @@ private:
   SnapshotReplayers m_replayers;
 
   SnapshotDataReplayers m_data_replayers;
+  std::unique_ptr<TickThread> m_tick_thread;
   std::atomic<int> m_active_datasync_threads{0};
 
   ceph::mutex smq_lock;
@@ -652,6 +668,7 @@ private:
 
   void run(SnapshotReplayerThread *replayer);
   void run_datasync(SnapshotDataSyncThread *data_replayer);
+  void run_tick();
   void remove_syncm(const std::shared_ptr<SyncMechanism>& syncm_obj);
   bool is_syncm_active(const std::shared_ptr<SyncMechanism>& syncm_obj);
   std::shared_ptr<SyncMechanism> pick_next_syncm_and_mark();

From 16009741876c7943a8db3e5428550c5707b8d7af Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 16 Jun 2026 22:52:21 +0530
Subject: [PATCH 257/596] tools/cephfs_mirror: Expose per-directory snap
 metrics via perf counters

Introduce a new labeled perf counter group, cephfs_mirror_directory, so
per-directory snapshot mirror progress can be scraped via "counter dump" and
exported to Prometheus by ceph-exporter (e.g.
ceph_cephfs_mirror_directory_current_sync_bytes).

Design
------

* One PerfCounters instance per mirrored directory on a peer, keyed in
  m_directory_perf_counters and registered on the daemon-wide
  PerfCountersCollection.
* Labels on each instance (flat counter dump array entries):
    - source_fscid, source_filesystem
    - peer_uuid, peer_cluster_name, peer_cluster_filesystem
    - directory (dir_root, e.g. "/parent/d1")
  The peer_uuid label disambiguates the same directory path mirrored to
  different peers.
* Counters are created in init() and add_directory(), removed in
  remove_directory() and the PeerReplayer destructor.
* Priority follows cephfs_mirror_perf_stats_prio (same as
  cephfs_mirror_peers).

Update path
-----------

Live / current_syncing_snap gauges are refreshed from
update_directory_current_sync_perf_counters(), called by
refresh_directory_current_sync_perf_counters() from the per-peer tick
thread (run_tick()). Each cephfs_mirror_tick_interval seconds (default 5)
the tick thread updates counters for each registered (actively syncing)
directory.

Counters registered (schema)
----------------------------

All of the following are added to the builder in this commit. Only the
"current sync" and dir_state fields listed under "Updated in this commit"
are written here; last_synced_snap and per-directory snap summary counters
are registered for a follow-up commit that updates them when stats change.

Directory state
  dir_state (gauge u64)
    0 = idle, 1 = syncing, 2 = failed
    Maps peer_status top-level "state" (numeric; no string values).

Current syncing snapshot (peer_status "current_syncing_snap")
  [Updated in this commit]
  current_snap_id          - snapshot id being synchronized
  current_sync_mode        - 0 = full, 1 = delta (snapdiff)
  current_read_bps         - bytes/sec read (raw, not formatted)
  current_write_bps        - bytes/sec written
  crawl_state              - 0 = N/A, 1 = in-progress, 2 = completed
  crawl_duration_seconds   - crawl duration; in-progress uses now - start
  datasync_wait_state      - 0 = none, 1 = waiting, 2 = complete
  datasync_wait_duration_seconds
  current_sync_bytes       - bytes synced so far for this snap
  current_total_bytes      - total bytes for this snap
  current_sync_bytes_percent - basis points (1745 = 17.45%)
  current_sync_files
  current_total_files
  current_sync_files_percent - basis points
  current_eta_valid        - 0 = calculating, 1 = ETA available
  current_eta_seconds      - ETA in seconds when valid

Per-directory snapshot summary (peer_status snaps_*)
  [Registered only; not updated in this commit]
  snaps_synced, snaps_deleted, snaps_renamed

Last synced snapshot (peer_status "last_synced_snap")
  [Registered only; not updated in this commit]
  last_snap_id
  last_crawl_duration_seconds
  last_datasync_wait_duration_seconds
  last_sync_duration_seconds
  last_sync_timestamp      - utime_t / seconds since epoch
  last_sync_bytes
  last_sync_files

When idle or failed, current_* counters are zeroed and dir_state reflects
0 or 2 respectively.

Fixes: https://tracker.ceph.com/issues/73457
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 271 ++++++++++++++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.h  |   8 +
 2 files changed, 279 insertions(+)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 4bd4681f0e0..d532b6a3adf 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -48,6 +48,38 @@ enum {
   l_cephfs_mirror_peer_replayer_last,
 };
 
+enum {
+  l_cephfs_mirror_directory_first = 7000,
+  l_cephfs_mirror_directory_dir_state,
+  l_cephfs_mirror_directory_current_snap_id,
+  l_cephfs_mirror_directory_current_sync_mode,
+  l_cephfs_mirror_directory_current_read_bps,
+  l_cephfs_mirror_directory_current_write_bps,
+  l_cephfs_mirror_directory_crawl_state,
+  l_cephfs_mirror_directory_crawl_duration_seconds,
+  l_cephfs_mirror_directory_datasync_wait_state,
+  l_cephfs_mirror_directory_datasync_wait_duration_seconds,
+  l_cephfs_mirror_directory_current_sync_bytes,
+  l_cephfs_mirror_directory_current_total_bytes,
+  l_cephfs_mirror_directory_current_sync_bytes_percent,
+  l_cephfs_mirror_directory_current_sync_files,
+  l_cephfs_mirror_directory_current_total_files,
+  l_cephfs_mirror_directory_current_sync_files_percent,
+  l_cephfs_mirror_directory_current_eta_valid,
+  l_cephfs_mirror_directory_current_eta_seconds,
+  l_cephfs_mirror_directory_snaps_synced,
+  l_cephfs_mirror_directory_snaps_deleted,
+  l_cephfs_mirror_directory_snaps_renamed,
+  l_cephfs_mirror_directory_last_snap_id,
+  l_cephfs_mirror_directory_last_crawl_duration_seconds,
+  l_cephfs_mirror_directory_last_datasync_wait_duration_seconds,
+  l_cephfs_mirror_directory_last_sync_duration_seconds,
+  l_cephfs_mirror_directory_last_sync_timestamp,
+  l_cephfs_mirror_directory_last_sync_bytes,
+  l_cephfs_mirror_directory_last_sync_files,
+  l_cephfs_mirror_directory_last,
+};
+
 namespace cephfs {
 namespace mirror {
 
@@ -221,6 +253,11 @@ PeerReplayer::PeerReplayer(CephContext *cct, FSMirror *fs_mirror,
 
 PeerReplayer::~PeerReplayer() {
   delete m_asok_hook;
+  for (auto &[dir_root, perf] : m_directory_perf_counters) {
+    m_cct->get_perfcounters_collection()->remove(perf);
+    delete perf;
+  }
+  m_directory_perf_counters.clear();
   PerfCounters *perf_counters = nullptr;
   std::swap(perf_counters, m_perf_counters);
   if (perf_counters != nullptr) {
@@ -229,11 +266,234 @@ PeerReplayer::~PeerReplayer() {
   }
 }
 
+uint64_t percent_basis_points(uint64_t num, uint64_t den) {
+  if (den == 0) {
+    return 0;
+  }
+  return static_cast<uint64_t>((static_cast<double>(num) * 10000.0) / den);
+}
+
+void PeerReplayer::create_directory_perf_counters(const std::string &dir_root) {
+  ceph_assert(m_directory_perf_counters.find(dir_root) ==
+              m_directory_perf_counters.end());
+
+  std::string labels = ceph::perf_counters::key_create("cephfs_mirror_directory", {
+    {"source_fscid", stringify(m_filesystem.fscid)},
+    {"source_filesystem", m_filesystem.fs_name},
+    {"peer_uuid", m_peer.uuid},
+    {"peer_cluster_name", m_peer.remote.cluster_name},
+    {"peer_cluster_filesystem", m_peer.remote.fs_name},
+    {"directory", dir_root},
+  });
+  PerfCountersBuilder plb(m_cct, labels, l_cephfs_mirror_directory_first,
+                          l_cephfs_mirror_directory_last);
+  auto prio = m_cct->_conf.get_val<int64_t>("cephfs_mirror_perf_stats_prio");
+
+  plb.add_u64(l_cephfs_mirror_directory_dir_state,
+              "dir_state", "Directory mirror state", "dste", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_snap_id,
+              "current_snap_id", "Current syncing snapshot id", "csid", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_sync_mode,
+              "current_sync_mode", "Current sync mode", "csmd", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_read_bps,
+              "current_read_bps", "Current read throughput bytes per second", "crbp", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_write_bps,
+              "current_write_bps", "Current write throughput bytes per second", "cwbp", prio);
+  plb.add_u64(l_cephfs_mirror_directory_crawl_state,
+              "crawl_state", "Current crawl state", "crst", prio);
+  plb.add_u64(l_cephfs_mirror_directory_crawl_duration_seconds,
+              "crawl_duration_seconds", "Current crawl duration seconds", "crdn", prio);
+  plb.add_u64(l_cephfs_mirror_directory_datasync_wait_state,
+              "datasync_wait_state", "Current datasync queue wait state", "dwst", prio);
+  plb.add_u64(l_cephfs_mirror_directory_datasync_wait_duration_seconds,
+              "datasync_wait_duration_seconds",
+              "Current datasync queue wait duration seconds", "dwdn", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_sync_bytes,
+              "current_sync_bytes", "Current sync bytes", "csby", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_total_bytes,
+              "current_total_bytes", "Current total bytes", "ctby", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_sync_bytes_percent,
+              "current_sync_bytes_percent",
+              "Current sync bytes percent in basis points", "csbp", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_sync_files,
+              "current_sync_files", "Current sync files", "csfl", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_total_files,
+              "current_total_files", "Current total files", "ctfl", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_sync_files_percent,
+              "current_sync_files_percent",
+              "Current sync files percent in basis points", "csfp", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_eta_valid,
+              "current_eta_valid", "Current sync ETA validity", "cetv", prio);
+  plb.add_u64(l_cephfs_mirror_directory_current_eta_seconds,
+              "current_eta_seconds", "Current sync ETA seconds", "cets", prio);
+  plb.add_u64(l_cephfs_mirror_directory_snaps_synced,
+              "snaps_synced", "Snapshots synchronized", "ssnc", prio);
+  plb.add_u64(l_cephfs_mirror_directory_snaps_deleted,
+              "snaps_deleted", "Snapshots deleted", "sdel", prio);
+  plb.add_u64(l_cephfs_mirror_directory_snaps_renamed,
+              "snaps_renamed", "Snapshots renamed", "sren", prio);
+  plb.add_u64(l_cephfs_mirror_directory_last_snap_id,
+              "last_snap_id", "Last synced snapshot id", "lsid", prio);
+  plb.add_u64(l_cephfs_mirror_directory_last_crawl_duration_seconds,
+              "last_crawl_duration_seconds",
+              "Last synced snapshot crawl duration seconds", "lcdn", prio);
+  plb.add_u64(l_cephfs_mirror_directory_last_datasync_wait_duration_seconds,
+              "last_datasync_wait_duration_seconds",
+              "Last synced snapshot datasync queue wait duration seconds", "ldwd", prio);
+  plb.add_u64(l_cephfs_mirror_directory_last_sync_duration_seconds,
+              "last_sync_duration_seconds",
+              "Last synced snapshot duration seconds", "lsdn", prio);
+  plb.add_time(l_cephfs_mirror_directory_last_sync_timestamp,
+               "last_sync_timestamp", "Last synced snapshot timestamp", "lsts", prio);
+  plb.add_u64(l_cephfs_mirror_directory_last_sync_bytes,
+              "last_sync_bytes", "Last synced snapshot bytes", "lsby", prio);
+  plb.add_u64(l_cephfs_mirror_directory_last_sync_files,
+              "last_sync_files", "Last synced snapshot files", "lsfl", prio);
+
+  PerfCounters *perf = plb.create_perf_counters();
+  m_cct->get_perfcounters_collection()->add(perf);
+  m_directory_perf_counters.emplace(dir_root, perf);
+}
+
+void PeerReplayer::remove_directory_perf_counters(const std::string &dir_root) {
+  auto it = m_directory_perf_counters.find(dir_root);
+  if (it == m_directory_perf_counters.end()) {
+    return;
+  }
+  m_cct->get_perfcounters_collection()->remove(it->second);
+  delete it->second;
+  m_directory_perf_counters.erase(it);
+}
+
+PerfCounters *PeerReplayer::find_directory_perf_counters(const std::string &dir_root) {
+  auto it = m_directory_perf_counters.find(dir_root);
+  if (it == m_directory_perf_counters.end()) {
+    return nullptr;
+  }
+  return it->second;
+}
+
+void PeerReplayer::update_directory_current_sync_perf_counters(
+    PerfCounters *perf, const SnapSyncStat &sync_stat) {
+  if (!perf) {
+    return;
+  }
+
+  auto clear_current = [&perf]() {
+    perf->set(l_cephfs_mirror_directory_current_snap_id, 0);
+    perf->set(l_cephfs_mirror_directory_current_sync_mode, 0);
+    perf->set(l_cephfs_mirror_directory_current_read_bps, 0);
+    perf->set(l_cephfs_mirror_directory_current_write_bps, 0);
+    perf->set(l_cephfs_mirror_directory_crawl_state, 0);
+    perf->set(l_cephfs_mirror_directory_crawl_duration_seconds, 0);
+    perf->set(l_cephfs_mirror_directory_datasync_wait_state, 0);
+    perf->set(l_cephfs_mirror_directory_datasync_wait_duration_seconds, 0);
+    perf->set(l_cephfs_mirror_directory_current_sync_bytes, 0);
+    perf->set(l_cephfs_mirror_directory_current_total_bytes, 0);
+    perf->set(l_cephfs_mirror_directory_current_sync_bytes_percent, 0);
+    perf->set(l_cephfs_mirror_directory_current_sync_files, 0);
+    perf->set(l_cephfs_mirror_directory_current_total_files, 0);
+    perf->set(l_cephfs_mirror_directory_current_sync_files_percent, 0);
+    perf->set(l_cephfs_mirror_directory_current_eta_valid, 0);
+    perf->set(l_cephfs_mirror_directory_current_eta_seconds, 0);
+  };
+
+  if (sync_stat.failed) {
+    perf->set(l_cephfs_mirror_directory_dir_state, 2);
+    clear_current();
+    return;
+  }
+
+  if (!sync_stat.current_syncing_snap) {
+    perf->set(l_cephfs_mirror_directory_dir_state, 0);
+    clear_current();
+    return;
+  }
+
+  perf->set(l_cephfs_mirror_directory_dir_state, 1);
+  perf->set(l_cephfs_mirror_directory_current_snap_id,
+            sync_stat.current_syncing_snap->first);
+  perf->set(l_cephfs_mirror_directory_current_sync_mode,
+            sync_stat.snapdiff ? 1 : 0);
+
+  double read_bps = sync_stat.read_time_sec > 0 ?
+      sync_stat.bytes_read / sync_stat.read_time_sec : 0;
+  double write_bps = sync_stat.write_time_sec > 0 ?
+      sync_stat.bytes_written / sync_stat.write_time_sec : 0;
+  perf->set(l_cephfs_mirror_directory_current_read_bps,
+            static_cast<uint64_t>(read_bps));
+  perf->set(l_cephfs_mirror_directory_current_write_bps,
+            static_cast<uint64_t>(write_bps));
+
+  if (sync_stat.crawl_finished) {
+    perf->set(l_cephfs_mirror_directory_crawl_state, 2);
+    perf->set(l_cephfs_mirror_directory_crawl_duration_seconds,
+              static_cast<uint64_t>(sync_stat.crawl_duration));
+  } else {
+    perf->set(l_cephfs_mirror_directory_crawl_state, 1);
+    auto cur_time = clock::now();
+    sec_duration crawl_duration =
+      sec_duration(cur_time - sync_stat.crawl_start_time);
+    perf->set(l_cephfs_mirror_directory_crawl_duration_seconds,
+              static_cast<uint64_t>(crawl_duration.count()));
+  }
+
+  if (sync_stat.datasync_queue_wait_duration) {
+    perf->set(l_cephfs_mirror_directory_datasync_wait_state, 2);
+    perf->set(l_cephfs_mirror_directory_datasync_wait_duration_seconds,
+              static_cast<uint64_t>(*sync_stat.datasync_queue_wait_duration));
+  } else if (sync_stat.datasync_queue_wait_start_time) {
+    perf->set(l_cephfs_mirror_directory_datasync_wait_state, 1);
+    auto cur_time = clock::now();
+    sec_duration dq_wait =
+      sec_duration(cur_time - *sync_stat.datasync_queue_wait_start_time);
+    perf->set(l_cephfs_mirror_directory_datasync_wait_duration_seconds,
+              static_cast<uint64_t>(dq_wait.count()));
+  } else {
+    perf->set(l_cephfs_mirror_directory_datasync_wait_state, 0);
+    perf->set(l_cephfs_mirror_directory_datasync_wait_duration_seconds, 0);
+  }
+
+  perf->set(l_cephfs_mirror_directory_current_sync_bytes, sync_stat.sync_bytes);
+  perf->set(l_cephfs_mirror_directory_current_total_bytes, sync_stat.total_bytes);
+  perf->set(l_cephfs_mirror_directory_current_sync_bytes_percent,
+            percent_basis_points(sync_stat.sync_bytes, sync_stat.total_bytes));
+  perf->set(l_cephfs_mirror_directory_current_sync_files, sync_stat.sync_files);
+  perf->set(l_cephfs_mirror_directory_current_total_files, sync_stat.total_files);
+  perf->set(l_cephfs_mirror_directory_current_sync_files_percent,
+            percent_basis_points(sync_stat.sync_files, sync_stat.total_files));
+
+  SnapSyncStat stat_for_eta = sync_stat;
+  double eta = compute_eta(stat_for_eta);
+  if (eta == -1.0) {
+    perf->set(l_cephfs_mirror_directory_current_eta_valid, 0);
+    perf->set(l_cephfs_mirror_directory_current_eta_seconds, 0);
+  } else {
+    perf->set(l_cephfs_mirror_directory_current_eta_valid, 1);
+    perf->set(l_cephfs_mirror_directory_current_eta_seconds,
+              static_cast<uint64_t>(eta));
+  }
+}
+
+void PeerReplayer::refresh_directory_current_sync_perf_counters(
+    const std::string &dir_root) {
+  // caller must hold m_lock
+  auto it = m_snap_sync_stats.find(dir_root);
+  if (it == m_snap_sync_stats.end()) {
+    return;
+  }
+  PerfCounters *dir_perf = find_directory_perf_counters(dir_root);
+  update_directory_current_sync_perf_counters(dir_perf, it->second);
+}
+
 int PeerReplayer::init() {
   dout(20) << ": initial dir list=[" << m_directories << "]" << dendl;
   for (auto &dir_root : m_directories) {
     m_snap_sync_stats.emplace(dir_root, SnapSyncStat());
   }
+  for (auto &dir_root : m_directories) {
+    create_directory_perf_counters(dir_root);
+  }
 
   auto &remote_client = m_peer.remote.client_name;
   auto &remote_cluster = m_peer.remote.cluster_name;
@@ -378,6 +638,10 @@ void PeerReplayer::add_directory(string_view dir_root) {
   }
   m_directories.emplace_back(_dir_root);
   m_snap_sync_stats.emplace(_dir_root, SnapSyncStat());
+  if (m_directory_perf_counters.find(_dir_root) ==
+      m_directory_perf_counters.end()) {
+    create_directory_perf_counters(_dir_root);
+  }
   m_cond.notify_all();
 }
 
@@ -393,6 +657,7 @@ void PeerReplayer::remove_directory(string_view dir_root) {
 
   auto it1 = m_registered.find(_dir_root);
   if (it1 == m_registered.end()) {
+    remove_directory_perf_counters(_dir_root);
     m_snap_sync_stats.erase(_dir_root);
   } else {
     it1->second.canceled = true;
@@ -460,6 +725,7 @@ void PeerReplayer::unregister_directory(const std::string &dir_root) {
   unlock_directory(it->first, it->second);
   m_registered.erase(it);
   if (std::find(m_directories.begin(), m_directories.end(), dir_root) == m_directories.end()) {
+    remove_directory_perf_counters(dir_root);
     m_snap_sync_stats.erase(dir_root);
   }
 }
@@ -2359,6 +2625,11 @@ void PeerReplayer::run_tick() {
       dout(5) << ": shutting down exiting" << dendl;
       break;
     }
+
+    // refresh current-sync perf counters for registered directories
+    for (const auto &kv : m_registered) {
+      refresh_directory_current_sync_perf_counters(kv.first);
+    }
   }
 }
 
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index e91c5b495b2..38e54516bdd 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -665,6 +665,14 @@ private:
   ServiceDaemonStats m_service_daemon_stats;
 
   PerfCounters *m_perf_counters;
+  std::map<std::string, PerfCounters *> m_directory_perf_counters;
+
+  void create_directory_perf_counters(const std::string &dir_root);
+  void remove_directory_perf_counters(const std::string &dir_root);
+  PerfCounters *find_directory_perf_counters(const std::string &dir_root);
+  void update_directory_current_sync_perf_counters(PerfCounters *perf,
+                                                   const SnapSyncStat &sync_stat);
+  void refresh_directory_current_sync_perf_counters(const std::string &dir_root);
 
   void run(SnapshotReplayerThread *replayer);
   void run_datasync(SnapshotDataSyncThread *data_replayer);

From 13b0a36eec562c04d25fe13dd64f21233b11e993 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 16 Jun 2026 22:27:12 +0530
Subject: [PATCH 258/596] cephfs_mirror: update per-directory last sync and
 summary perf counters

Wire the remaining cephfs_mirror_directory labeled counters that were
registered in the prior commit but not yet refreshed. Live
current_syncing_snap gauges continue to be updated from the per-peer tick
thread; this commit updates last_synced_snap and per-directory snap
summary counters at the points where SnapSyncStat is actually modified.

Depends-on the cephfs_mirror_directory PerfCounters schema (dir_state,
current_*, last_*, snaps_*) added when each mirrored directory is
registered.

Prometheus / counter dump
-------------------------

These counters appear under "cephfs_mirror_directory" in "counter dump" with
the same labels as current-sync metrics (source_fscid, source_filesystem,
peer_uuid, peer_cluster_name, peer_cluster_filesystem, directory). ceph-exporter
exposes them as e.g. ceph_cephfs_mirror_directory_last_sync_bytes and
ceph_cephfs_mirror_directory_snaps_synced.

Unlike cephfs_mirror_peers, values are per (peer_uuid, directory) rather than
aggregated across all directories on the peer. Peer-level counters are
unchanged.

Fixes: https://tracker.ceph.com/issues/73457
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 70 +++++++++++++++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.h  | 18 +++++++
 2 files changed, 88 insertions(+)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index d532b6a3adf..6b370df3c5c 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -273,6 +273,10 @@ uint64_t percent_basis_points(uint64_t num, uint64_t den) {
   return static_cast<uint64_t>((static_cast<double>(num) * 10000.0) / den);
 }
 
+double monotime_to_double(monotime t) {
+  return sec_duration(t.time_since_epoch()).count();
+}
+
 void PeerReplayer::create_directory_perf_counters(const std::string &dir_root) {
   ceph_assert(m_directory_perf_counters.find(dir_root) ==
               m_directory_perf_counters.end());
@@ -475,6 +479,54 @@ void PeerReplayer::update_directory_current_sync_perf_counters(
   }
 }
 
+void PeerReplayer::update_directory_last_sync_perf_counters(
+    PerfCounters *perf, const SnapSyncStat &sync_stat) {
+  if (!perf) {
+    return;
+  }
+
+  if (sync_stat.last_synced_snap) {
+    perf->set(l_cephfs_mirror_directory_last_snap_id,
+              sync_stat.last_synced_snap->first);
+  } else {
+    perf->set(l_cephfs_mirror_directory_last_snap_id, 0);
+  }
+
+  perf->set(l_cephfs_mirror_directory_last_crawl_duration_seconds,
+            sync_stat.last_sync_crawl_duration ?
+              static_cast<uint64_t>(*sync_stat.last_sync_crawl_duration) : 0);
+  perf->set(l_cephfs_mirror_directory_last_datasync_wait_duration_seconds,
+            sync_stat.last_sync_datasync_queue_wait_duration ?
+              static_cast<uint64_t>(*sync_stat.last_sync_datasync_queue_wait_duration) : 0);
+  perf->set(l_cephfs_mirror_directory_last_sync_duration_seconds,
+            sync_stat.last_sync_duration ?
+              static_cast<uint64_t>(*sync_stat.last_sync_duration) : 0);
+
+  utime_t t;
+  if (!clock::is_zero(sync_stat.last_synced)) {
+    t.set_from_double(monotime_to_double(sync_stat.last_synced));
+  } else {
+    t = utime_t();
+  }
+  perf->tset(l_cephfs_mirror_directory_last_sync_timestamp, t);
+
+  perf->set(l_cephfs_mirror_directory_last_sync_bytes,
+            sync_stat.last_sync_bytes ? *sync_stat.last_sync_bytes : 0);
+  perf->set(l_cephfs_mirror_directory_last_sync_files,
+            sync_stat.last_sync_files ? *sync_stat.last_sync_files : 0);
+}
+
+void PeerReplayer::update_directory_summary_perf_counters(
+    PerfCounters *perf, const SnapSyncStat &sync_stat) {
+  if (!perf) {
+    return;
+  }
+
+  perf->set(l_cephfs_mirror_directory_snaps_synced, sync_stat.synced_snap_count);
+  perf->set(l_cephfs_mirror_directory_snaps_deleted, sync_stat.deleted_snap_count);
+  perf->set(l_cephfs_mirror_directory_snaps_renamed, sync_stat.renamed_snap_count);
+}
+
 void PeerReplayer::refresh_directory_current_sync_perf_counters(
     const std::string &dir_root) {
   // caller must hold m_lock
@@ -493,6 +545,11 @@ int PeerReplayer::init() {
   }
   for (auto &dir_root : m_directories) {
     create_directory_perf_counters(dir_root);
+    auto *dir_perf = find_directory_perf_counters(dir_root);
+    update_directory_last_sync_perf_counters(dir_perf,
+                                             m_snap_sync_stats.at(dir_root));
+    update_directory_summary_perf_counters(dir_perf,
+                                           m_snap_sync_stats.at(dir_root));
   }
 
   auto &remote_client = m_peer.remote.client_name;
@@ -642,6 +699,11 @@ void PeerReplayer::add_directory(string_view dir_root) {
       m_directory_perf_counters.end()) {
     create_directory_perf_counters(_dir_root);
   }
+  auto *dir_perf = find_directory_perf_counters(_dir_root);
+  update_directory_last_sync_perf_counters(dir_perf,
+                                           m_snap_sync_stats.at(_dir_root));
+  update_directory_summary_perf_counters(dir_perf,
+                                         m_snap_sync_stats.at(_dir_root));
   m_cond.notify_all();
 }
 
@@ -2610,6 +2672,10 @@ int PeerReplayer::sync_snaps(const std::string &dir_root,
   } else {
     _reset_failed_count(dir_root);
   }
+  if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+    update_directory_current_sync_perf_counters(dir_perf,
+                                                m_snap_sync_stats.at(dir_root));
+  }
   return r;
 }
 
@@ -2675,6 +2741,10 @@ void PeerReplayer::run(SnapshotReplayerThread *replayer) {
             }
           } else {
             _inc_failed_count(*dir_root);
+            if (auto *dir_perf = find_directory_perf_counters(*dir_root)) {
+              update_directory_current_sync_perf_counters(
+                dir_perf, m_snap_sync_stats.at(*dir_root));
+            }
             if (m_perf_counters) {
               m_perf_counters->inc(l_cephfs_mirror_peer_replayer_snap_sync_failures);
             }
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 38e54516bdd..8d8d9f42119 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -488,6 +488,10 @@ private:
                             const std::string &snap_name) {
     std::scoped_lock locker(m_lock);
     _set_last_synced_snap(dir_root, snap_id, snap_name);
+    if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+      update_directory_last_sync_perf_counters(dir_perf,
+                                               m_snap_sync_stats.at(dir_root));
+    }
   }
   void set_current_syncing_snap(const std::string &dir_root, uint64_t snap_id,
                                 const std::string &snap_name) {
@@ -505,11 +509,17 @@ private:
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     ++sync_stat.deleted_snap_count;
+    if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+      update_directory_summary_perf_counters(dir_perf, sync_stat);
+    }
   }
   void inc_renamed_snap(const std::string &dir_root) {
     std::scoped_lock locker(m_lock);
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     ++sync_stat.renamed_snap_count;
+    if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+      update_directory_summary_perf_counters(dir_perf, sync_stat);
+    }
   }
   void set_last_synced_stat(const std::string &dir_root, uint64_t snap_id,
                             const std::string &snap_name, double duration) {
@@ -526,6 +536,10 @@ private:
     sync_stat.last_sync_files = sync_stat.sync_files;
     ++sync_stat.synced_snap_count;
     _reset_sync_stat(dir_root);
+    if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+      update_directory_last_sync_perf_counters(dir_perf, sync_stat);
+      update_directory_summary_perf_counters(dir_perf, sync_stat);
+    }
   }
   void set_snapdiff(const std::string &dir_root, bool snapdiff) {
     std::scoped_lock locker(m_lock);
@@ -672,6 +686,10 @@ private:
   PerfCounters *find_directory_perf_counters(const std::string &dir_root);
   void update_directory_current_sync_perf_counters(PerfCounters *perf,
                                                    const SnapSyncStat &sync_stat);
+  void update_directory_last_sync_perf_counters(PerfCounters *perf,
+                                                const SnapSyncStat &sync_stat);
+  void update_directory_summary_perf_counters(PerfCounters *perf,
+                                              const SnapSyncStat &sync_stat);
   void refresh_directory_current_sync_perf_counters(const std::string &dir_root);
 
   void run(SnapshotReplayerThread *replayer);

From c5be81c79d383acc8b1295a938e2854b0fe51d94 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 16 Jun 2026 22:58:33 +0530
Subject: [PATCH 259/596] doc/cephfs: Document cephfs_mirror_directory counter
 dump metrics

Describe per-directory labeled perf counters, labels, update behavior,
mapping to peer status, and counter reference tables. Document the
per-peer tick thread and cephfs_mirror_tick_interval, which refreshes
current-sync gauges on each tick. Add a PendingReleaseNotes entry for
the new cephfs_mirror_directory perf counter group.

Fixes: https://tracker.ceph.com/issues/73457
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 PendingReleaseNotes             |   6 +
 doc/cephfs/cephfs-mirroring.rst | 323 +++++++++++++++++++++++++++++++-
 2 files changed, 325 insertions(+), 4 deletions(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 2e2a19fc25f..d54ec981f3f 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -174,6 +174,12 @@
   data-sync queue timing, bytes/files progress, and ETA). Output is grouped
   under ``metrics/<mirrored-dir-path>/peer/<peer-uuid>``. For more information,
   see https://tracker.ceph.com/issues/73453
+* CephFS Mirroring: Per-directory snapshot sync progress is exposed as labeled perf
+  counters in the ``cephfs_mirror_directory`` group (``counter dump`` on the mirror
+  daemon admin socket, exportable via ``ceph-exporter``). Counters mirror
+  ``fs mirror peer status`` fields (directory state, current sync, last sync, and
+  snap summary) and are labeled by peer UUID and mirrored directory path. See
+  https://tracker.ceph.com/issues/73457
 * RBD: Mirror snapshot creation and trash purge schedules are now automatically
   staggered when no explicit "start-time" is specified. This reduces scheduling
   spikes and distributes work more evenly over time.
diff --git a/doc/cephfs/cephfs-mirroring.rst b/doc/cephfs/cephfs-mirroring.rst
index 5b12ed4dffc..b10184112b4 100644
--- a/doc/cephfs/cephfs-mirroring.rst
+++ b/doc/cephfs/cephfs-mirroring.rst
@@ -711,9 +711,39 @@ will not show up in command help.
 Metrics
 -------
 
-CephFS exports mirroring metrics as :ref:`Labeled Perf Counters` which will be consumed by the OCP/ODF Dashboard to provide monitoring of the Geo Replication. These metrics can be used to measure the progress of cephfs-mirror syncing and thus provide the monitoring capability. CephFS exports the following mirroring metrics, which are displayed using the ``counter dump`` command.
+CephFS exports mirroring metrics as :ref:`Labeled Perf Counters` for scraping by
+monitoring tools (for example Prometheus via ``ceph-exporter``). Operators can inspect
+them with the mirror daemon admin socket ``counter dump`` command (see
+:ref:`cephfs_mirror_counter_dump`).
 
-.. list-table:: Mirror Status Metrics
+Three labeled counter groups are relevant for snapshot mirroring:
+
+- ``cephfs_mirror_mirrored_filesystems`` — per primary file system on a mirror daemon
+  (for example ``directory_count``, ``mirroring_peers``).
+- ``cephfs_mirror_peers`` — aggregated across all mirrored directories for one peer
+  on a file system.
+- ``cephfs_mirror_directory`` — per mirrored directory path and peer (new; see
+  :ref:`cephfs_mirror_directory_perf_counters`).
+
+The JSON returned by ``fs mirror peer status`` and ``ceph fs snapshot mirror status``
+describes the same synchronization state in human-readable form. The
+``cephfs_mirror_directory`` counters expose that state as numeric gauges for monitoring
+systems.
+
+.. _cephfs_mirror_counter_dump:
+
+Accessing perf counters
+~~~~~~~~~~~~~~~~~~~~~~~
+
+On a host running ``cephfs-mirror``::
+
+  $ ceph --admin-daemon /var/run/ceph/cephfs-mirror.asok counter dump
+
+Labeled groups appear as top-level JSON arrays (for example ``"cephfs_mirror_directory": [ ... ]``).
+Each array element has a ``labels`` object and a ``counters`` object. Use
+``counter schema`` on the same admin socket to list counter names and types.
+
+.. list-table:: Mirror filesystem metrics (``cephfs_mirror_mirrored_filesystems``)
    :widths: 25 25 75
    :header-rows: 1
 
@@ -733,7 +763,7 @@ CephFS exports mirroring metrics as :ref:`Labeled Perf Counters` which will be c
      - Counter
      - Enable mirroring failures
 
-.. list-table:: Replication Metrics
+.. list-table:: Peer replication metrics (``cephfs_mirror_peers``)
    :widths: 25 25 75
    :header-rows: 1
 
@@ -742,7 +772,7 @@ CephFS exports mirroring metrics as :ref:`Labeled Perf Counters` which will be c
      - Description
    * - snaps_synced
      - Counter
-     - The total number of snapshots successfully synchronized
+     - Total snapshots synchronized for this peer on this file system (all directories combined)
    * - sync_bytes
      - Counter
      - The total bytes being synchronized
@@ -771,6 +801,290 @@ CephFS exports mirroring metrics as :ref:`Labeled Perf Counters` which will be c
      - Counter
      - The total bytes being synchronized for the last synced snapshot
 
+Peer-level counters are labeled with ``source_fscid``, ``source_filesystem``,
+``peer_cluster_name``, and ``peer_cluster_filesystem``. They do not include
+``peer_uuid`` or ``directory``; use ``cephfs_mirror_directory`` for per-path detail.
+
+.. _cephfs_mirror_directory_perf_counters:
+
+Per-directory replication metrics (``cephfs_mirror_directory``)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The ``cephfs_mirror_directory`` labeled counter group reports snapshot mirror
+progress for a single mirrored directory path toward a single peer. One perf counter
+instance is created when a directory is added for mirroring (``fs snapshot mirror add``)
+and removed when the directory is removed from the policy.
+
+This matches the per-directory fields under ``metrics/<mirrored-dir-path>/peer/<peer-uuid>``
+in ``fs mirror peer status`` (see :ref:`cephfs_mirroring_mgr_snapshot_status`), but uses
+raw numeric values suitable for graphs and alerts (bytes per second, seconds, basis points).
+
+**Labels**
+
+Each ``cephfs_mirror_directory`` entry in ``counter dump`` includes:
+
+.. list-table::
+   :widths: 30 70
+   :header-rows: 1
+
+   * - Label
+     - Description
+   * - ``source_fscid``
+     - File system cluster ID on the primary cluster
+   * - ``source_filesystem``
+     - File system name on the primary cluster
+   * - ``peer_uuid``
+     - Mirror peer UUID (disambiguates the same directory path mirrored to multiple peers)
+   * - ``peer_cluster_name``
+     - Remote cluster name of the peer
+   * - ``peer_cluster_filesystem``
+     - Remote file system name on the peer
+   * - ``directory``
+     - Mirrored directory path (for example ``/parent/d1``)
+
+Example (one directory, one peer)::
+
+  $ ceph --admin-daemon /var/run/ceph/cephfs-mirror.asok counter dump
+  {
+      "cephfs_mirror_directory": [
+          {
+              "labels": {
+                  "source_fscid": "360",
+                  "source_filesystem": "cephfs",
+                  "peer_uuid": "8a85ab25-70f9-48e9-b82d-56324e75209b",
+                  "peer_cluster_name": "site-a",
+                  "peer_cluster_filesystem": "backup_fs",
+                  "directory": "/parent/d1"
+              },
+              "counters": {
+                  "dir_state": 0,
+                  "current_snap_id": 0,
+                  "snaps_synced": 1,
+                  "last_snap_id": 3,
+                  "last_sync_bytes": 157286400,
+                  "last_sync_files": 5000,
+                  ...
+              }
+          }
+      ]
+  }
+
+When exported through ``ceph-exporter``, counter names are prefixed (for example
+``ceph_cephfs_mirror_directory_current_sync_bytes``) with label dimensions attached.
+
+**Update frequency**
+
+Counters are not updated on every file read or write. Behavior differs by field group:
+
+- **Current sync gauges** (``current_*``, ``crawl_*``, ``datasync_wait_*``, ``dir_state``
+  while syncing): refreshed by the :ref:`per-peer tick thread <cephfs_mirror_tick_thread>`
+  for each registered directory, on the interval configured by
+  ``cephfs_mirror_tick_interval`` (default ``5`` seconds). Only directories that are
+  actively registered for synchronization on this daemon are updated.
+- **Last synced gauges** (``last_*``): updated when a snapshot sync completes and when
+  a directory is added for mirroring.
+- **Summary gauges** (``snaps_synced``, ``snaps_deleted``, ``snaps_renamed``): updated when
+  the corresponding per-directory counters change (sync complete, snap delete, snap rename).
+
+**Mapping to ``fs mirror peer status``**
+
+.. list-table::
+   :widths: 35 35 30
+   :header-rows: 1
+
+   * - Perf counter
+     - Admin socket / mgr JSON field
+     - Notes
+   * - ``dir_state``
+     - ``state``
+     - ``0`` = idle, ``1`` = syncing, ``2`` = failed (not ``stale``; stale is mgr-only)
+   * - ``current_snap_id``
+     - ``current_syncing_snap.id``
+     - ``0`` when idle or failed
+   * - ``current_sync_mode``
+     - ``current_syncing_snap.sync-mode``
+     - ``0`` = full, ``1`` = delta
+   * - ``current_read_bps`` / ``current_write_bps``
+     - ``avg_read_throughput_bytes`` / ``avg_write_throughput_bytes``
+     - Raw bytes per second (not human-readable strings)
+   * - ``crawl_state`` / ``crawl_duration_seconds``
+     - ``current_syncing_snap.crawl``
+     - See crawl state table below
+   * - ``datasync_wait_state`` / ``datasync_wait_duration_seconds``
+     - ``current_syncing_snap.datasync_queue_wait``
+     - See datasync wait state table below
+   * - ``current_sync_bytes`` / ``current_total_bytes`` / ``current_sync_bytes_percent``
+     - ``current_syncing_snap.bytes``
+     - Percent is basis points (``4029`` = 40.29%)
+   * - ``current_sync_files`` / ``current_total_files`` / ``current_sync_files_percent``
+     - ``current_syncing_snap.files``
+     - Percent is basis points
+   * - ``current_eta_valid`` / ``current_eta_seconds``
+     - ``current_syncing_snap.eta``
+     - ``current_eta_valid``: ``0`` = calculating, ``1`` = ETA available
+   * - ``last_snap_id`` and ``last_*_duration_seconds``, ``last_sync_bytes``, ``last_sync_files``
+     - ``last_synced_snap``
+     - Durations in seconds; bytes are raw counts
+   * - ``last_sync_timestamp``
+     - ``last_synced_snap.sync_time_stamp``
+     - ``utime_t`` (seconds since epoch), not the monotonic string shown in admin JSON
+   * - ``snaps_synced`` / ``snaps_deleted`` / ``snaps_renamed``
+     - Same field names at directory level
+     - Reset on daemon restart or directory reassignment (same as admin socket)
+
+**Directory state (``dir_state``)**
+
+.. list-table::
+   :widths: 15 85
+   :header-rows: 1
+
+   * - Value
+     - Meaning
+   * - ``0``
+     - Idle — no snapshot is currently being synchronized for this directory
+   * - ``1``
+     - Syncing — ``current_*`` gauges reflect in-progress snapshot sync
+   * - ``2``
+     - Failed — directory hit the consecutive failure limit; ``current_*`` gauges are cleared
+
+When ``dir_state`` is ``0`` or ``2``, all ``current_*``, ``crawl_*``, and ``datasync_wait_*``
+counters are set to zero.
+
+**Current syncing snapshot counters**
+
+Present while ``dir_state`` is ``1``. Corresponds to ``current_syncing_snap`` in
+``fs mirror peer status``.
+
+.. list-table::
+   :widths: 30 15 55
+   :header-rows: 1
+
+   * - Counter
+     - Type
+     - Description
+   * - ``current_snap_id``
+     - Gauge
+     - Snapshot ID being synchronized
+   * - ``current_sync_mode``
+     - Gauge
+     - ``0`` = full sync, ``1`` = delta (snapdiff/blockdiff)
+   * - ``current_read_bps``
+     - Gauge
+     - Average primary read throughput in bytes per second for this sync
+   * - ``current_write_bps``
+     - Gauge
+     - Average remote write throughput in bytes per second for this sync
+   * - ``crawl_state``
+     - Gauge
+     - ``0`` = not applicable, ``1`` = in progress, ``2`` = completed
+   * - ``crawl_duration_seconds``
+     - Gauge
+     - Crawl duration in seconds (elapsed while in progress, total when completed)
+   * - ``datasync_wait_state``
+     - Gauge
+     - ``0`` = none, ``1`` = waiting in data-sync queue, ``2`` = transfer started
+   * - ``datasync_wait_duration_seconds``
+     - Gauge
+     - Time in the data-sync queue in seconds
+   * - ``current_sync_bytes``
+     - Gauge
+     - Bytes synchronized so far for this snapshot
+   * - ``current_total_bytes``
+     - Gauge
+     - Total bytes discovered for this snapshot sync
+   * - ``current_sync_bytes_percent``
+     - Gauge
+     - Sync progress in **basis points** (``10000`` = 100.00%)
+   * - ``current_sync_files``
+     - Gauge
+     - Files synchronized so far
+   * - ``current_total_files``
+     - Gauge
+     - Total files discovered for this snapshot sync
+   * - ``current_sync_files_percent``
+     - Gauge
+     - File progress in **basis points**
+   * - ``current_eta_valid``
+     - Gauge
+     - ``0`` = ETA not yet available (``calculating...`` in admin socket), ``1`` = ETA available
+   * - ``current_eta_seconds``
+     - Gauge
+     - Estimated seconds remaining when ``current_eta_valid`` is ``1``
+
+**Last synced snapshot counters**
+
+Updated after each successful snapshot synchronization. Corresponds to
+``last_synced_snap`` in ``fs mirror peer status``.
+
+.. list-table::
+   :widths: 35 15 50
+   :header-rows: 1
+
+   * - Counter
+     - Type
+     - Description
+   * - ``last_snap_id``
+     - Gauge
+     - Snapshot ID of the last successfully synchronized snapshot
+   * - ``last_crawl_duration_seconds``
+     - Gauge
+     - Directory crawl duration for that sync
+   * - ``last_datasync_wait_duration_seconds``
+     - Gauge
+     - Data-sync queue wait duration for that sync
+   * - ``last_sync_duration_seconds``
+     - Gauge
+     - Total time to synchronize that snapshot
+   * - ``last_sync_timestamp``
+     - Time
+     - Wall-clock time when that sync finished (``utime_t``)
+   * - ``last_sync_bytes``
+     - Gauge
+     - Bytes synchronized for that snapshot
+   * - ``last_sync_files``
+     - Gauge
+     - Files synchronized for that snapshot
+
+**Per-directory snapshot summary counters**
+
+.. list-table::
+   :widths: 25 15 60
+   :header-rows: 1
+
+   * - Counter
+     - Type
+     - Description
+   * - ``snaps_synced``
+     - Gauge
+     - Snapshots successfully synchronized since the last counter reset
+   * - ``snaps_deleted``
+     - Gauge
+     - Snapshot deletes propagated to the peer since the last reset
+   * - ``snaps_renamed``
+     - Gauge
+     - Snapshot renames propagated to the peer since the last reset
+
+These counters reset when the mirror daemon restarts or when a directory is reassigned to
+another mirror daemon, consistent with ``fs mirror peer status``.
+
+.. _cephfs_mirror_tick_thread:
+
+Per-peer tick thread
+~~~~~~~~~~~~~~~~~~~~
+
+Each mirror peer handled by a ``cephfs-mirror`` daemon runs a dedicated tick thread in its
+``PeerReplayer``. The thread wakes every :confval:`cephfs_mirror_tick_interval` seconds
+(default ``5``), re-reads that option on each iteration so configuration changes take effect
+without restarting the daemon, and runs periodic mirroring work.
+
+Currently, the tick thread refreshes the ``current_*``, ``crawl_*``, ``datasync_wait_*``, and
+``dir_state`` fields of :ref:`cephfs_mirror_directory_perf_counters` for each directory that
+is actively registered for synchronization on the daemon.
+
+Example — set the tick interval to 10 seconds for the mirror daemon user::
+
+  ceph config set client.mirror cephfs_mirror_tick_interval 10
+
 Configuration Options
 ---------------------
 
@@ -787,6 +1101,7 @@ Configuration Options
 .. confval:: cephfs_mirror_restart_mirror_on_failure_interval
 .. confval:: cephfs_mirror_mount_timeout
 .. confval:: cephfs_mirror_perf_stats_prio
+.. confval:: cephfs_mirror_tick_interval
 .. confval:: cephfs_mirror_blockdiff_min_file_size
 
 Re-adding Peers

From 23c910f52a9f49d95875f4040c5114bd680a61db Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Fri, 12 Jun 2026 17:11:15 +0530
Subject: [PATCH 260/596] doc/mgr/smb: document client compatibility mode

Add documentation for --client-compat parameter in 'cluster create'
command and new 'cluster update client-compat' command. This feature
enables macOS-specific SMB optimizations (fruit VFS, streams_xattr)
and can be set during cluster creation or updated for existing clusters.

Signed-off-by: Shweta Sodani <shsodani@redhat.com>
---
 doc/mgr/smb.rst | 83 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 82 insertions(+), 1 deletion(-)

diff --git a/doc/mgr/smb.rst b/doc/mgr/smb.rst
index ad70c13948a..6cf26482a58 100644
--- a/doc/mgr/smb.rst
+++ b/doc/mgr/smb.rst
@@ -55,7 +55,7 @@ Create Cluster
 
 .. prompt:: bash #
 
-   ceph smb cluster create <cluster_id> {user|active-directory} [--domain-realm=<domain_realm>] [--domain-join-user-pass=<domain_join_user_pass>] [--define-user-pass=<define_user_pass>] [--custom-dns=<custom_dns>] [--placement=<placement>] [--clustering=<clustering>] [--password-filter=<password_filter>] [--password-filter-out=<password_filter_out>]
+   ceph smb cluster create <cluster_id> {user|active-directory} [--domain-realm=<domain_realm>] [--domain-join-user-pass=<domain_join_user_pass>] [--define-user-pass=<define_user_pass>] [--custom-dns=<custom_dns>] [--placement=<placement>] [--clustering=<clustering>] [--client-compat={default|macos}] [--password-filter=<password_filter>] [--password-filter-out=<password_filter_out>]
 
 Create a new logical cluster, identified by the cluster ID value. The cluster
 create command must specify the authentication mode the cluster will use. This
@@ -100,6 +100,11 @@ clustering
     enables clustering regardless of the placement count. A value of ``never``
     disables clustering regardless of the placement count. If unspecified,
     ``default`` is assumed.
+client_compat
+    Optional. One of ``default`` or ``macos``. Controls client-specific SMB
+    features and optimizations. The ``default`` mode provides standard SMB
+    behavior with broad compatibility. The ``macos`` mode enables macOS-specific
+    optimized settings for macOS clients. If unspecified, ``default`` is assumed.
 public_addrs
     Optional. A string in the form of <ipaddress/prefixlength>[%<destination address>].
     Supported only when using Samba's clustering. Assign "virtual" IP addresses
@@ -165,6 +170,15 @@ previous example. Set three CTDB public address values and a custom placement:
         --public-address=192.168.76.112/24 \
         --placement="3 label:smb"
 
+Create a cluster for macOS clients with user authentication:
+
+.. prompt:: bash #
+
+    ceph smb cluster create mac_cluster user \
+        --define-user-pass=macuser%Passw0rd1 \
+        --client-compat=macos \
+        --placement="label:smb"
+
 
 Update Cluster QoS
 ++++++++++++++++++
@@ -216,6 +230,53 @@ Disable QoS for all shares in a cluster:
      --write-bw-limit=0
 
 
+
+Update Cluster Client Compatibility
+++++++++++++++++++++++++++++++++++++
+
+.. prompt:: bash #
+
+   ceph smb cluster update client-compat {default|macos} <cluster_id>
+
+Update the client compatibility mode for an SMB cluster. This setting controls whether client-specific SMB features and optimizations are enabled.
+
+The client compatibility mode determines how the Samba server is configured to optimize for specific client types:
+
+- ``default``: Standard SMB behavior without client-specific optimizations. This is the default mode and provides broad compatibility with all SMB clients.
+- ``macos``: Enable macOS-specific features including the Samba's fruit VFS module for proper handling of macOS metadata and optimized settings for macOS clients.
+
+When ``macos`` mode is enabled, the following features are automatically configured:
+
+- Fruit VFS module for proper handling of macOS-specific file attributes
+- Streams_xattr VFS module for extended attribute support
+
+Options:
+
+client_compat
+    One of ``default`` or ``macos``
+cluster_id
+    A short string uniquely identifying the cluster
+
+Examples
+~~~~~~~~
+
+Enable macOS compatibility mode for a cluster:
+
+.. prompt:: bash #
+
+   ceph smb cluster update client-compat macos mycluster
+
+Revert to default (standard) compatibility mode:
+
+.. prompt:: bash #
+
+   ceph smb cluster update client-compat default mycluster
+
+.. note::
+   The ``macos`` compatibility mode is recommended when the primary clients accessing the SMB shares are macOS systems. Otherwise default mode is recommended.
+
+
+
 Remove Cluster
 ++++++++++++++
 
@@ -879,6 +940,12 @@ custom_smb_global_options
     indicator that the user is aware that using this option can easily break
     things in ways that the Ceph team can not help with. This special key will
     automatically be removed from the list of options passed to Samba.
+client_compat
+    Optional. One of ``default`` or ``macos``. Controls client-specific SMB
+    features and optimizations. The ``default`` mode provides standard SMB
+    behavior with broad compatibility. The ``macos`` mode enables macOS-specific
+    features including Samba's fruit VFS module for proper handling of macOS and
+    optimized settings for macOS clients. If unspecified, ``default`` is assumed.
 
 .. warning::
    Setting the ``clustering`` option allows an administrator to choose exactly
@@ -977,6 +1044,20 @@ The following is an example of a cluster configured for standalone operation:
       hosts:
         - node6.mycluster.sink.test
 
+The following is an example of a cluster optimized for macOS clients:
+
+.. code-block:: yaml
+
+    resource_type: ceph.smb.cluster
+    cluster_id: macshare
+    auth_mode: user
+    client_compat: macos
+    user_group_settings:
+      - source_type: resource
+        ref: ug1
+    placement:
+      count: 1
+
 An example cluster resource with intent to remove:
 
 .. code-block:: yaml

From 3fc6457a8f77c9916476224c278fa8a6b6a8ceb1 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 16 Jun 2026 23:01:13 +0530
Subject: [PATCH 261/596] qa: Add tests for cephfs_mirror_directory perf
 counters

Verify counter dump registration, current-sync gauges while syncing
(full/delta), last-sync and summary counters after idle sync, and
extend mirror stats and remote-snap failure tests for per-directory
snaps_* and dir_state.

Fixes: https://tracker.ceph.com/issues/73457
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 qa/tasks/cephfs/test_mirroring.py | 160 ++++++++++++++++++++++++++++++
 1 file changed, 160 insertions(+)

diff --git a/qa/tasks/cephfs/test_mirroring.py b/qa/tasks/cephfs/test_mirroring.py
index f75f0216112..ad4642c4e7d 100644
--- a/qa/tasks/cephfs/test_mirroring.py
+++ b/qa/tasks/cephfs/test_mirroring.py
@@ -69,6 +69,7 @@ class TestMirroring(CephFSTestCase):
     PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR = "cephfs_mirror"
     PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_FS = "cephfs_mirror_mirrored_filesystems"
     PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER = "cephfs_mirror_peers"
+    PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_DIRECTORY = "cephfs_mirror_directory"
 
     def setUp(self):
         super(TestMirroring, self).setUp()
@@ -295,6 +296,39 @@ class TestMirroring(CephFSTestCase):
         self.assertIn('metrics', res)
         return res['metrics'][dir_name]['peer'][peer_uuid]
 
+    def directory_perf_entry(self, res, dir_path, peer_uuid):
+        for entry in res.get(self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_DIRECTORY, []):
+            labels = entry.get('labels', {})
+            if labels.get('directory') == dir_path and labels.get('peer_uuid') == peer_uuid:
+                return entry
+        return None
+
+    def get_directory_perf_counters(self, dir_path, peer_uuid):
+        res = self.mirror_daemon_command(
+            f'counter dump for fs: {self.primary_fs_name}', 'counter', 'dump')
+        entry = self.directory_perf_entry(res, dir_path, peer_uuid)
+        self.assertIsNotNone(entry,
+                             msg=f'missing {self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_DIRECTORY} '
+                                 f'for {dir_path}')
+        return entry['counters']
+
+    def assert_directory_perf_labels(self, labels, dir_path, peer_uuid):
+        self.assertEqual(labels['source_fscid'], str(self.primary_fs_id))
+        self.assertEqual(labels['source_filesystem'], self.primary_fs_name)
+        self.assertEqual(labels['peer_uuid'], peer_uuid)
+        self.assertEqual(labels['directory'], dir_path)
+        self.assertEqual(labels['peer_cluster_name'], 'ceph')
+        self.assertEqual(labels['peer_cluster_filesystem'], self.secondary_fs_name)
+
+    def assert_idle_directory_last_sync_perf(self, counters):
+        self.assertEqual(counters['dir_state'], 0)
+        self.assertEqual(counters['current_snap_id'], 0)
+        self.assertGreater(counters['last_snap_id'], 0)
+        self.assertGreater(counters['last_sync_bytes'], 0)
+        self.assertGreater(counters['last_sync_files'], 0)
+        self.assertGreaterEqual(counters['last_sync_duration_seconds'], 0)
+        self.assertGreaterEqual(counters['snaps_synced'], 1)
+
     def assert_last_synced_snap_metrics(self, last_synced_snap):
         for key in ('crawl_duration', 'datasync_queue_wait_duration', 'sync_duration',
                     'sync_time_stamp', 'sync_bytes', 'sync_files'):
@@ -348,6 +382,30 @@ class TestMirroring(CephFSTestCase):
             e.res = res
             raise
 
+    @retry_assert(timeout=120, interval=1)
+    def check_directory_perf_syncing(self, fs_name, fs_id, dir_path, peer_spec,
+                                     sync_mode=None):
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        res = self.mirror_daemon_command(f'counter dump for fs: {fs_name}',
+                                         'counter', 'dump')
+        try:
+            entry = self.directory_perf_entry(res, dir_path, peer_uuid)
+            self.assertIsNotNone(entry)
+            counters = entry['counters']
+            self.assertEqual(counters['dir_state'], 1)
+            self.assertGreater(counters['current_snap_id'], 0)
+            if sync_mode == 'full':
+                self.assertEqual(counters['current_sync_mode'], 0)
+            elif sync_mode == 'delta':
+                self.assertEqual(counters['current_sync_mode'], 1)
+            self.assertIn(counters['crawl_state'], (1, 2))
+            self.assertGreater(counters['current_total_files'], 0)
+            if counters['current_total_bytes'] > 0:
+                self.assertLessEqual(counters['current_sync_bytes_percent'], 10000)
+        except RETRY_EXCEPTIONS as e:
+            e.res = res
+            raise
+
     @retry_assert(timeout=60, interval=3)
     def check_peer_status_empty(self, fs_name, fs_id, peer_spec):
         peer_uuid = self.get_peer_uuid(peer_spec)
@@ -820,6 +878,9 @@ class TestMirroring(CephFSTestCase):
         self.assertGreaterEqual(second["counters"]["last_synced_end"], second["counters"]["last_synced_start"])
         self.assertGreater(second["counters"]["last_synced_duration"], 0)
         self.assertEqual(second["counters"]["last_synced_bytes"], 1048576000) # last_synced_bytes = 10 files of 1024MB size each
+        peer_uuid = self.get_peer_uuid("client.mirror_remote@ceph")
+        dir_second = self.get_directory_perf_counters('/d0', peer_uuid)
+        self.assertEqual(dir_second['snaps_synced'], second["counters"]["snaps_synced"])
 
         # some more IO
         for i in range(15):
@@ -853,6 +914,8 @@ class TestMirroring(CephFSTestCase):
         res = self.mirror_daemon_command(f'counter dump for fs: {self.primary_fs_name}', 'counter', 'dump')
         fourth = res[TestMirroring.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER][0]
         self.assertGreater(fourth["counters"]["snaps_deleted"], third["counters"]["snaps_deleted"])
+        dir_fourth = self.get_directory_perf_counters('/d0', peer_uuid)
+        self.assertGreater(dir_fourth['snaps_deleted'], dir_second['snaps_deleted'])
 
         # rename a snapshot
         self.mount_a.run_shell(["mv", "d0/.snap/snap1", "d0/.snap/snap2"])
@@ -866,6 +929,8 @@ class TestMirroring(CephFSTestCase):
         res = self.mirror_daemon_command(f'counter dump for fs: {self.primary_fs_name}', 'counter', 'dump')
         fifth = res[TestMirroring.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER][0]
         self.assertGreater(fifth["counters"]["snaps_renamed"], fourth["counters"]["snaps_renamed"])
+        dir_fifth = self.get_directory_perf_counters('/d0', peer_uuid)
+        self.assertGreater(dir_fifth['snaps_renamed'], dir_fourth['snaps_renamed'])
 
         self.remove_directory(self.primary_fs_name, self.primary_fs_id, '/d0')
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
@@ -1695,6 +1760,8 @@ class TestMirroring(CephFSTestCase):
                    snap_name == dir_stat['last_synced_snap']['name'] and \
                    expected_snap_count == dir_stat['snaps_synced']):
                     self.assert_last_synced_snap_metrics(dir_stat['last_synced_snap'])
+                    self.assertEqual(
+                        self.get_directory_perf_counters(dir_name, peer_uuid)['dir_state'], 2)
                     break
         # remove the directory in the remote fs and check status restores to 'idle'
         self.mount_b.run_shell(['sudo', 'rmdir', remote_snap_path], omit_sudo=False)
@@ -1768,6 +1835,99 @@ class TestMirroring(CephFSTestCase):
                                peer_spec, f'/{dir_name}', snap1, 2)
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
 
+    def test_cephfs_mirror_directory_perf_counters_registration(self):
+        """counter dump exposes cephfs_mirror_directory per mirrored path."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+        self.mount_a.run_shell(['mkdir', 'd0', 'd1'])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, '/d0')
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, '/d1', check_perf_counter=False)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        res = self.mirror_daemon_command(f'counter dump for fs: {self.primary_fs_name}',
+                                         'counter', 'dump')
+        self.assertIn(self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_DIRECTORY, res)
+        dirs = {e['labels']['directory']
+                for e in res[self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_DIRECTORY]
+                if e['labels'].get('peer_uuid') == peer_uuid}
+        self.assertEqual(dirs, {'/d0', '/d1'})
+        self.assert_directory_perf_labels(
+            self.directory_perf_entry(res, '/d0', peer_uuid)['labels'], '/d0', peer_uuid)
+
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, '/d0')
+        with safe_while(sleep=2, tries=30,
+                        action='wait for directory perf counter removal') as proceed:
+            while proceed():
+                res = self.mirror_daemon_command(
+                    f'counter dump for fs: {self.primary_fs_name}', 'counter', 'dump')
+                if self.directory_perf_entry(res, '/d0', peer_uuid) is None:
+                    break
+        res = self.mirror_daemon_command(f'counter dump for fs: {self.primary_fs_name}',
+                                         'counter', 'dump')
+        self.assertIsNotNone(self.directory_perf_entry(res, '/d1', peer_uuid))
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_cephfs_mirror_directory_perf_counters_syncing(self):
+        """counter dump current_* gauges update while a snapshot is syncing."""
+        self.setup_mount_b(mds_perm='rw')
+        self.config_set('client.mirror', 'cephfs_mirror_tick_interval', 1)
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+
+        dir_name = 'd0'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 3000, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap0 = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap0}'])
+        self.check_directory_perf_syncing(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_spec,
+            sync_mode='full')
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, f'/{dir_name}', snap0, 1)
+
+        self.mount_a.write_n_mb(os.path.join(dir_name, 'file.0'), 1)
+        self.mount_a.create_n_files(f'{dir_name}/snapdiff_file', 3000, sync=True)
+        snap1 = 'snap1'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap1}'])
+        self.check_directory_perf_syncing(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_spec,
+            sync_mode='delta')
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, f'/{dir_name}', snap1, 2)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        idle = self.get_directory_perf_counters(f'/{dir_name}', peer_uuid)
+        self.assertEqual(idle['dir_state'], 0)
+        self.assertEqual(idle['current_snap_id'], 0)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_cephfs_mirror_directory_perf_counters_last_sync_and_summary(self):
+        """counter dump last_* and snaps_* gauges reflect completed directory sync."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+
+        dir_name = 'metrics_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 50, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap_name = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap_name}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap_name, 1)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        self.assert_idle_directory_last_sync_perf(
+            self.get_directory_perf_counters(f'/{dir_name}', peer_uuid))
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
     def test_cephfs_mirror_sync_already_existing_snapshots(self):
         """
         That mirroring syncs the already existing snapshot correctly.

From f78b44aba3954155709fb32b0f67d2bea73edfb2 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Mon, 15 Jun 2026 19:38:20 -0400
Subject: [PATCH 262/596] doc/releases/tentacle: remove bogus notable changes

Resolves: https://tracker.ceph.com/issues/77357
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 doc/releases/tentacle.rst | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/doc/releases/tentacle.rst b/doc/releases/tentacle.rst
index 0534c1438ef..bce02033a02 100644
--- a/doc/releases/tentacle.rst
+++ b/doc/releases/tentacle.rst
@@ -22,26 +22,18 @@ Notable Changes
 MDS (Metadata Server)
 ---------------------
 
-* Upgrade Testing Architecture: Split up existing upgrade sequences into distinct CentOS Stream 9 and Rocky Linux 10 automated test variants across multiple upgrade suites (including parallel, stress-split, and telemetry suites).
-* Queueing Logic Update: Retry requests are now added directly to the MDSRank wait queue rather than going through the finisher.
-* Optimization: Removed duplicate context completion calls and adjusted scan_stray_dir after refining the MDSContext class.
-* Reversion: Reverted a prior change that moved MDSContext completion handling to the finish method.
 * Segmentation fault fixed due to incorrect queueing of request retries.
 
 OSD (Object Storage Daemon)
 ---------------------------
 
-* FastEC Activation: Always updates the pwlc epoch when activating.
 * PGLog Missed List: Fixed a bug to ensure the correct version is attached to the missing list when ignoring log entries.
 * Data Integrity Asserts: Added assertions to explicitly catch potential corruption in the OSD missing list.
-* Data Structure Changes: Modified the rmissing map key type from version_t to eversion_t.
-* Rollback & Vector Fixes: Corrected rollback logic for partial write object information (OI) and optimized Erasure Coding (EC) by ensuring Twiddle creates a full-sized vector.
 
 RGW (RADOS Gateway)
 -------------------
 
 * Lifecycle Management: Fixed lifecycle transition issues affecting encrypted multipart objects.
-* Multisite Concurrency: Improved concurrency handling when a value of 1 is provided by the caller, added logging for concurrency state transitions within adj_concurrency, exposed lock latency as a performance counter for data synchronization, and fixed an uninitialized LatencyMonitor average by shifting to an exponentially weighted moving average.
 * REST & Query Handling: RESTArgs::get_string() now properly URL-decodes incoming query parameters.
 
 RADOS / librados / neorados

From 1578756c74f88a094f01ff08cc514e2908c9f431 Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Mon, 15 Jun 2026 22:51:58 -0400
Subject: [PATCH 263/596] doc/releases/tentacle: scope wording to package
 installs

Resolves: https://tracker.ceph.com/issues/77357
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 doc/releases/tentacle.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/releases/tentacle.rst b/doc/releases/tentacle.rst
index bce02033a02..07a6d66b24f 100644
--- a/doc/releases/tentacle.rst
+++ b/doc/releases/tentacle.rst
@@ -17,7 +17,7 @@ June 16, 2026
 Notable Changes
 ---------------
 
-* Rocky 10 is now supported starting with v20.2.2. Please see the `supported platforms <https://docs.ceph.com/en/latest/start/os-recommendations/#platforms>`_ for current and planned support in Ceph.
+* Rocky 10 package-based installs are now supported starting with v20.2.2. Please see the `supported platforms <https://docs.ceph.com/en/latest/start/os-recommendations/#platforms>`_ for current and planned support in Ceph.
 
 MDS (Metadata Server)
 ---------------------

From fe6af7fc85d47ad25fb77e1728b0eb100c208129 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Tue, 24 Mar 2026 17:54:22 +0000
Subject: [PATCH 264/596] doc: add PendingReleaseNotes entry for rgw multisite
 DNS endpoint resolution

Documents the new rgw_rest_conn_connect_to_resolved_ips feature that
enables RGW to resolve HTTP endpoints for RGW services such as multisite,
into all IP addresses and distribute requests across them using
round-robin with per-IP health tracking, supporting DNS service
discovery deployments without external load balancers.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 PendingReleaseNotes | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 2eb6e6be2e8..f53c1eac16c 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -100,6 +100,17 @@
   than instantly aborting I/O and returning an error. It's possible to switch
   from ``RBD_LOCK_MODE_EXCLUSIVE`` to ``RBD_LOCK_MODE_EXCLUSIVE_TRANSIENT``
   policy and vice versa even if the lock is already held.
+* RGW: In multisite deployments, zone endpoints configured in the zonegroup
+  (e.g. ``https://zone-a.example.com``) can now be resolved to all IP addresses
+  returned by DNS, with inter-zone traffic distributed across them using
+  round-robin and per-IP health tracking. This enables DNS-based service discovery
+  for inter-zone traffic without an external load balancer. This feature is disabled
+  by default: to opt in, set ``rgw_rest_conn_connect_to_resolved_ips = true``. The
+  per-IP retry-after-failure timeout is controlled by ``rgw_rest_conn_ip_fail_timeout_secs``
+  (default: 2 seconds). Deployments that work around libcurl's single-address behavior
+  by repeating the same endpoint multiple times in zone configuration should review that
+  setup before enabling, as round-robin distribution makes such duplication unnecessary.
+
 * OSD: A health warning is reported when BlueFS usage exceeds the
   configured ratio of the main OSD data device size. This warning is
   informational and can be muted with:

From c7c62383d8d2d27aca82d9bfa0a32b809817d7b4 Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Wed, 10 Jun 2026 10:51:33 +0530
Subject: [PATCH 265/596] mgr/dashboard: add custom filtering rules to the
 table

```
<cd-table #table
                id="pool-list"
                [data]="pools"
                [columns]="columns"
                selectionType="single"
                [hasDetails]="true"
                [status]="tableStatus"
                [autoReload]="-1"
                (fetchData)="taskListService.fetch()"
                (setExpandedRow)="setExpandedRow($event)"
                (updateSelection)="updateSelection($event)"
                [customFilter]="true" # set this to true
                (customFilterChange)="onCustomFilterChange($event)" #
get the new rules from here>
```

Fixes: https://tracker.ceph.com/issues/77290
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../datatable/table/table.component.html      |  98 +++++++--
 .../datatable/table/table.component.scss      |  20 +-
 .../datatable/table/table.component.spec.ts   |  51 +++++
 .../shared/datatable/table/table.component.ts | 194 ++++++++++++++++--
 .../src/app/shared/enum/icons.enum.ts         |   3 +-
 .../shared/models/cd-table-column-filter.ts   |  17 ++
 6 files changed, 354 insertions(+), 29 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
index 1460f9ca77a..f5a7297b167 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
@@ -51,7 +51,7 @@
       </cds-table-toolbar-search>
       <!-- end search -->
       <!-- column filters -->
-       @if (columnFilters.length !== 0) {
+       @if (columnFilters.length !== 0 || customFilter) {
         <div cdsPopover
              [isOpen]="openFilterPopover"
              [autoAlign]="true"
@@ -66,11 +66,20 @@
                  class="cds--toolbar-action__icon"></svg>
           </cds-icon-button>
           <cds-popover-content [cdsLayer]="0">
+            <div cdsStack="horizontal" class="filter--header">
+              <span class="cds--type-heading-03" i18n>Filters</span>
+              <cds-icon-button kind="ghost"
+                              size="sm"
+                              (click)="toggleFilterPopover()">
+                <cd-icon type="destroy"></cd-icon>
+              </cds-icon-button>
+            </div>
             <div
               cdsGrid
               [fullWidth]="true"
               [condensed]="true"
               [narrow]="true">
+            @if (columnFilters.length !== 0) {
             @for (filter of columnFilters; track filter.column.name; let i = $index) {
             <div
               cdsRow
@@ -84,7 +93,7 @@
                 <cds-text-label>Filter
                   <input cdsText
                          readonly
-                         size="sm"
+                         size="md"
                          [id]="'filter_key_' + i"
                          [name]="'filter_key_' + i"
                          [value]="filter.column.name">
@@ -98,7 +107,7 @@
                 <cds-select (valueChange)="onChangeFilter($event, filter)"
                             [id]="'filter_value_' + i"
                             label="Value"
-                            size="sm"
+                            size="md"
                             [attr.data-testid]="'filter-select-' + filter.column.name"
                             i18n-label>
                   <option i18n>Any</option>
@@ -112,18 +121,83 @@
                 </cds-select>
               </div>
             </div>
+          }}
+          @if (customFilter) {
+          @for (filter of stagedCustomFilters; track filter.id; let i = $index) {
+            @if (typeof customFilter === 'string') {
+              <div cdsRow
+                   class="cds-mt-4 cds--type-body-02">
+                Filter {{ customFilter }}:
+              </div>
+            }
+            <div cdsRow
+                 [cdsLayer]="1"
+                 class="cds-mt-4">
+              <div cdsCol
+                   [columnNumbers]="{sm: 4, md: 3, lg: 7}">
+                <cds-text-label>Key
+                  <input cdsText
+                         size="md"
+                         [id]="'filter_key_' + i"
+                         [value]="filter.key"
+                         (input)="filter.key = $any($event.target).value">
+                </cds-text-label>
+              </div>
+
+              <div cdsCol
+                   [columnNumbers]="{sm: 4, md: 3, lg: 7}">
+                <cds-text-label>Value
+                  <input cdsText
+                         size="md"
+                         [id]="'filter_value_' + i"
+                         [value]="filter.value"
+                         (input)="filter.value = $any($event.target).value">
+                </cds-text-label>
+            </div>
+
+            @if (i !== 0) {
+            <div cdsCol
+                 [columnNumbers]="{sm: 2, md: 2, lg: 2}"
+                class="cds-mt-6">
+              <cds-icon-button kind="ghost"
+                               size="sm"
+                               (click)="removeCustomFilter(filter.id)">
+                <cd-icon type="trash"></cd-icon>
+              </cds-icon-button>
+            </div>
+            }
+          </div>
           }
-          <div cdsRow
-               class="cds-mt-4 cds-mb-4">
+            @if (stagedCustomFilters.length < 5) {
+            <div cdsRow
+                class="cds-mt-4">
+              <div cdsCol>
+                <button
+                  cdsButton="tertiary"
+                  size="md"
+                  (click)="addCustomFilter()">Add new filter rule +</button>
+              </div>
+            </div>
+            }
+          }
+          </div>
+
+          <div class="filter--footer">
+            <button cdsButton="secondary"
+                    size="lg"
+                    data-testid="clear-filters"
+                    (click)="onClearFilters()">
+              <ng-container i18n>Clear all</ng-container>
+            </button>
 
             <button cdsButton="primary"
-                    size="sm"
+                    size="lg"
                     data-testid="apply-filters"
+                    [disabled]="isApplyFilterDisabled"
                     (click)="onSubmitFilter()">
-              <ng-container i18n>Apply filters</ng-container>
+              <ng-container i18n>Apply</ng-container>
             </button>
           </div>
-          </div>
           </cds-popover-content>
         </div>
       }
@@ -183,13 +257,13 @@
         class="align-items-center"
         cdsStack="horizontal"
         [gap]="2">
-        @for (filter of activeFilters | slice:0:3; track filter.column.name) {
+        @for (filter of activeFilters | slice:0:3; track filter.id) {
           @if (filter.value) {
             <cds-tag-filter
               closeButtonLabel="Clear"
               i18n-closeButtonLabel
               (close)="onRemoveFilter(filter)">
-              {{ filter.column.name }}={{ filter.value.formatted }}
+              {{ filter.name }}={{ filter.value }}
             </cds-tag-filter>
           }
         }
@@ -203,12 +277,12 @@
               <div
                 cdsStack="vertical"
                 [gap]="2">
-              @for (filter of activeFilters | slice:3; track filter.column.name) {
+              @for (filter of activeFilters | slice:3; track filter.id) {
                 <cds-tag-filter
                   closeButtonLabel="Clear"
                   i18n-closeButtonLabel
                   (close)="onRemoveFilter(filter)">
-                  {{ filter.column.name }}={{ filter.value.formatted }}
+                  {{ filter.name }}={{ filter.value }}
                 </cds-tag-filter>
               }
               </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.scss
index 611a3b9e93f..a4357ed13b9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.scss
@@ -111,8 +111,22 @@ tr:hover .edit-btn {
   white-space: nowrap;
 }
 
-.filter-wrapper {
-  display: inline-flex;
+.filter--header {
   align-items: center;
-  gap: 0.5rem;
+  border-bottom: 1px solid var(--cds-ui-03);
+  display: flex;
+  justify-content: space-between;
+  padding: var(--cds-spacing-04);
+}
+
+.filter--footer {
+  display: flex;
+  margin-top: var(--cds-spacing-08);
+  width: 100%;
+
+  button {
+    flex: 1;
+    justify-content: center;
+    max-width: 50%;
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.spec.ts
index 889439dcc6e..e92aafaf71d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.spec.ts
@@ -280,6 +280,57 @@ describe('TableComponent', () => {
     });
   });
 
+  describe('test custom filtering', () => {
+    beforeEach(() => {
+      component.customFilter = true;
+      component.customFilters = [];
+      component.stagedCustomFilters = [];
+      spyOn(component.customFilterChange, 'emit');
+      spyOn(component, 'updateFilter');
+    });
+
+    it('should toggle popover and add an empty rule', () => {
+      component.toggleFilterPopover();
+
+      expect(component.openFilterPopover).toBe(true);
+      expect(component.stagedCustomFilters.length).toBe(1);
+      expect(component.stagedCustomFilters[0]).toEqual({ id: 0, key: '', value: '' });
+
+      // toggling again should close but not add a new rule
+      component.toggleFilterPopover();
+      expect(component.openFilterPopover).toBe(false);
+      expect(component.stagedCustomFilters.length).toBe(1);
+    });
+
+    it('should manually add new custom filters', () => {
+      component.addCustomFilter();
+      component.addCustomFilter();
+      expect(component.stagedCustomFilters.length).toBe(2);
+      expect(component.stagedCustomFilters[0]).toEqual({ id: 0, key: '', value: '' });
+      expect(component.stagedCustomFilters[1]).toEqual({ id: 1, key: '', value: '' });
+    });
+
+    it('should remove a filter by its id', () => {
+      component.addCustomFilter();
+      component.addCustomFilter();
+      component.addCustomFilter();
+
+      component.removeCustomFilter(1);
+      expect(component.stagedCustomFilters.length).toBe(2);
+      expect(component.stagedCustomFilters[0]).toEqual({ id: 0, key: '', value: '' });
+      expect(component.stagedCustomFilters[1]).toEqual({ id: 2, key: '', value: '' });
+    });
+
+    it('should emit custom filters on submit', () => {
+      component.addCustomFilter();
+      component.stagedCustomFilters[0] = { id: 0, key: 'foo', value: 'bar' };
+      component.onSubmitFilter();
+      expect(component.customFilterChange.emit).toHaveBeenCalledWith([
+        { id: 0, key: 'foo', value: 'bar' }
+      ]);
+    });
+  });
+
   describe('test search', () => {
     const expectSearch = (keyword: string, expectedResult: object[]) => {
       component.search = keyword;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
index 7d4c8284784..a261212f324 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
@@ -26,10 +26,12 @@ import { Icons, IconSize, EMPTY_STATE_IMAGE } from '~/app/shared/enum/icons.enum
 
 import { CdTableColumn } from '~/app/shared/models/cd-table-column';
 import {
+  CdTableActiveColumnFilter,
   CdTableColumnFilter,
   CdTableColumnFilterOption,
   CdTableColumnSelectedFilter,
-  CdTableColumnStagedFilter
+  CdTableColumnStagedFilter,
+  CdTableCustomColumnFilter
 } from '~/app/shared/models/cd-table-column-filter';
 import { CdTableColumnFiltersChange } from '~/app/shared/models/cd-table-column-filters-change';
 import { CdTableFetchDataContext } from '~/app/shared/models/cd-table-fetch-data-context';
@@ -197,6 +199,14 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
   @Input()
   extraFilterableColumns: CdTableColumn[] = [];
 
+  /*
+  Used to set custom filters on the table.
+  boolean - if you just want to enable custom filters with default settings
+  string - if you want to enable custom filters and set a specific col prop to be used as filter name
+  */
+  @Input()
+  customFilter: boolean | string = false;
+
   @Input()
   status = new TableStatus();
 
@@ -293,6 +303,9 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
   @Output()
   isCellEditingEvent = new EventEmitter<boolean>();
 
+  @Output()
+  customFilterChange = new EventEmitter<CdTableCustomColumnFilter[]>();
+
   /**
    * Use this variable to access the selected row(s).
    */
@@ -428,10 +441,15 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
   columnFilters: CdTableColumnFilter[] = [];
   selectedFilter: CdTableColumnFilter;
   get columnFiltered(): boolean {
-    return _.some(this.columnFilters, (filter: any) => {
+    const hasStandardFilters = _.some(this.columnFilters, (filter: any) => {
       return filter.value !== undefined;
     });
+    const hasCustomFilters = this.customFilters && this.customFilters.length > 0;
+
+    return hasStandardFilters || hasCustomFilters;
   }
+  customFilters: CdTableCustomColumnFilter[] = [];
+  private nextFilterId = 0;
   private previousRows = new Map<string | number, TableItem[]>();
   private debouncedSearch = this.reloadData.bind(this);
 
@@ -442,9 +460,32 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
   openFilterPopover = false;
   stagedFilters: CdTableColumnStagedFilter = {};
   selectedFilters: CdTableColumnSelectedFilter = {};
+  stagedCustomFilters: CdTableCustomColumnFilter[] = [];
 
   get activeFilters() {
-    return this.columnFilters.filter((filter) => filter.value);
+    const standard: CdTableActiveColumnFilter[] = this.columnFilters
+      .filter((filter) => filter.value)
+      .map((filter) => ({
+        isCustom: false,
+        id: `std_${filter.column.name}`,
+        name: filter.column.name,
+        value: filter.value.formatted,
+        original: filter
+      }));
+
+    const custom: CdTableActiveColumnFilter[] = (this.customFilters || []).map((filter) => ({
+      isCustom: true,
+      id: `cst_${filter.id}`,
+      name: filter.key,
+      value: filter.value,
+      original: filter
+    }));
+
+    return [...standard, ...custom];
+  }
+
+  get isApplyFilterDisabled(): boolean {
+    return this.stagedCustomFilters.some((filter) => !filter.key.trim() || !filter.value.trim());
   }
 
   constructor(
@@ -769,6 +810,27 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
 
   toggleFilterPopover() {
     this.openFilterPopover = !this.openFilterPopover;
+
+    if (this.openFilterPopover) {
+      this.stagedCustomFilters = _.cloneDeep(this.customFilters || []);
+
+      if (this.customFilter && this.customFilters.length === 0) {
+        this.addCustomFilter();
+      }
+    }
+  }
+
+  addCustomFilter() {
+    this.stagedCustomFilters = [
+      ...this.stagedCustomFilters,
+      { id: this.nextFilterId++, key: '', value: '' }
+    ];
+  }
+
+  removeCustomFilter(idToRemove: number) {
+    this.stagedCustomFilters = this.stagedCustomFilters.filter(
+      (filter) => filter.id !== idToRemove
+    );
   }
 
   initColumnFilters() {
@@ -852,21 +914,41 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
         this.selectedFilter = filter;
       }
     });
-
     this.stagedFilters = {};
+
+    if (this.customFilter) {
+      this.customFilters = this.stagedCustomFilters.filter(
+        (customFilter: CdTableCustomColumnFilter) =>
+          customFilter.key.trim() !== '' && customFilter.value.trim() !== ''
+      );
+      this.customFilterChange.emit(this.customFilters);
+    }
+
     this.updateFilter();
     this.openFilterPopover = false;
   }
 
-  onRemoveFilter(filter: CdTableColumnFilter) {
-    const filterName = filter.column.name;
-    filter.value = undefined;
-    this.selectedFilters[filterName] = undefined;
-    delete this.stagedFilters[filterName];
-    if (this.selectedFilter?.column.name === filterName) {
-      this.selectedFilter = undefined;
+  onRemoveFilter(filter: CdTableActiveColumnFilter) {
+    if (filter.isCustom) {
+      this.customFilters = (this.customFilters || []).filter(
+        (customFilter: CdTableCustomColumnFilter) => customFilter.id !== filter.original.id
+      );
+      this.stagedCustomFilters = this.stagedCustomFilters.filter(
+        (customFilter: CdTableCustomColumnFilter) => customFilter.id !== filter.original.id
+      );
+
+      this.customFilterChange.emit(this.customFilters);
+      this.updateFilter();
+    } else {
+      const filterName = filter.original.name;
+      filter.original.value = undefined;
+      this.selectedFilters[filterName] = undefined;
+      delete this.stagedFilters[filterName];
+      if (this.selectedFilter?.column.name === filterName) {
+        this.selectedFilter = undefined;
+      }
+      this.updateFilter();
     }
-    this.updateFilter();
   }
 
   doColumnFiltering() {
@@ -897,6 +979,85 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
       dataOut = [...dataOut, ...parts[1]];
     });
 
+    if (this.customFilter && this.customFilters.length > 0) {
+      this.customFilters.forEach((customFilter: CdTableCustomColumnFilter) => {
+        const matchingColumn = this.localColumns.find(
+          (col: CdTableColumn) =>
+            col.name && col.name.toLowerCase() === customFilter.key.trim().toLowerCase()
+        );
+        const resolvedProp = matchingColumn
+          ? (matchingColumn.prop as string)
+          : customFilter.key.trim();
+        const displayKeyName = matchingColumn ? matchingColumn.name : customFilter.key;
+
+        appliedFilters.push({
+          name: displayKeyName,
+          prop: typeof this.customFilter === 'string' ? this.customFilter : resolvedProp,
+          value: { raw: customFilter.value, formatted: customFilter.value }
+        });
+      });
+
+      // grouping filters by keys so we can filter the data with all the given filters
+      const groupedFilters = _.groupBy(
+        this.customFilters,
+        (customFilter: CdTableCustomColumnFilter) => customFilter.key.trim().toLowerCase()
+      );
+      const filterGroups = Object.values(groupedFilters);
+
+      const parts = _.partition(data, (row) => {
+        return filterGroups.every((group) => {
+          return group.some((customFilter: CdTableCustomColumnFilter) => {
+            const matchingColumn = this.localColumns.find(
+              (col: CdTableColumn) =>
+                col.name && col.name.toLowerCase() === customFilter.key.trim().toLowerCase()
+            );
+
+            const filterKey = matchingColumn
+              ? (matchingColumn.prop as string)
+              : customFilter.key.trim();
+            const rawKey = customFilter.key.trim();
+            const filterValue = customFilter.value;
+
+            if (_.has(row, filterKey)) {
+              if (`${_.get(row, filterKey)}` === filterValue) return true;
+            }
+
+            // this is only when the customFilter is for a column that has a
+            // key-value pair for its values.
+            // eg: tags of objects in s3.
+            if (typeof this.customFilter === 'string' && _.has(row, this.customFilter)) {
+              const nestedData = _.get(row, this.customFilter);
+
+              // when the data is an array of objects or strings,
+              // we need to check each element in the array.
+              if (_.isArray(nestedData)) {
+                return _.some(nestedData, (key) => {
+                  if (_.isObject(key) && _.has(key, rawKey)) {
+                    return `${(key as any)[rawKey]}` === filterValue;
+                  }
+                  if (typeof key === 'string') {
+                    return key === `${rawKey}:${filterValue}` || key === `${rawKey}=${filterValue}`;
+                  }
+                  return false;
+                });
+              }
+
+              // if object is a simple dict
+              if (_.isObject(nestedData) && !_.isArray(nestedData)) {
+                if (_.has(nestedData, rawKey)) {
+                  if (`${(nestedData as any)[rawKey]}` === filterValue) return true;
+                }
+              }
+            }
+            return false;
+          });
+        });
+      });
+
+      data = parts[0];
+      dataOut = [...dataOut, ...parts[1]];
+    }
+
     this.columnFiltersChanged.emit({
       filters: appliedFilters,
       data: data,
@@ -1340,6 +1501,13 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
       filter.value = undefined;
     });
     this.selectedFilter = _.first(this.columnFilters);
+    this.customFilters = [];
+    this.stagedCustomFilters = [];
+
+    if (this.customFilter) {
+      this.addCustomFilter();
+    }
+
     this.updateFilter();
     this.initSelectedColumnFilters();
   }
@@ -1357,7 +1525,7 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
       }
       this.rows = this.data;
     } else {
-      let rows = this.columnFilters.length !== 0 ? this.doColumnFiltering() : this.data;
+      let rows = this.doColumnFiltering();
 
       if (this.search.length > 0 && rows?.length) {
         const columns = this.localColumns.filter(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/icons.enum.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/icons.enum.ts
index 60de24cc8ed..c5190555b6a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/icons.enum.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/icons.enum.ts
@@ -174,7 +174,8 @@ export const ICON_TYPE = {
   leftArrow: 'caret--left',
   rightArrow: 'caret--right',
   locked: 'locked',
-  cloudMonitoring: 'cloud--monitoring'
+  cloudMonitoring: 'cloud--monitoring',
+  trash: 'trash-can'
 } as const;
 
 export const EMPTY_STATE_IMAGE = {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/cd-table-column-filter.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/cd-table-column-filter.ts
index d4d45ac91ba..c02817e9265 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/cd-table-column-filter.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/cd-table-column-filter.ts
@@ -4,6 +4,8 @@ export interface CdTableColumnFilter {
   column: CdTableColumn;
   options: CdTableColumnFilterOption[]; // possible options of a filter
   value?: CdTableColumnFilterOption; // selected option
+  id?: string;
+  name?: string;
 }
 
 export interface CdTableColumnStagedFilter {
@@ -18,3 +20,18 @@ export interface CdTableColumnFilterOption {
   raw: string;
   formatted: string;
 }
+
+export interface CdTableCustomColumnFilter {
+  id: number;
+  key: string;
+  value: string;
+  name?: string;
+}
+
+export interface CdTableActiveColumnFilter {
+  id: string;
+  name: string;
+  value: string;
+  isCustom: boolean;
+  original: CdTableColumnFilter | CdTableCustomColumnFilter;
+}

From 0419e34f8dcdd5cfacb72fee0f202996210d3548 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Sun, 24 May 2026 15:27:04 +0800
Subject: [PATCH 266/596] crimson/os/seastore/transaction_manager: prevent
 paddr from  being passed across coroutines.

This is because rewrite transactions no longer invalidates other
transactions, so if paddr get passed across coroutines, it may
become outdated.

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/transaction_manager.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/crimson/os/seastore/transaction_manager.h b/src/crimson/os/seastore/transaction_manager.h
index 793d03bee98..3e22411f080 100644
--- a/src/crimson/os/seastore/transaction_manager.h
+++ b/src/crimson/os/seastore/transaction_manager.h
@@ -1411,10 +1411,10 @@ private:
     }
 #endif
 
+    co_await pin.co_refresh();
     if (pin.is_indirect()) {
       SUBDEBUGT(seastore_tm, "{} into {} remaps ...",
         t, pin, remaps.size());
-      co_await pin.co_refresh();
       pin = co_await complete_mapping(t, std::move(pin));
     } else {
       laddr_t original_laddr = pin.get_key();
@@ -1425,7 +1425,6 @@ private:
       ceph_assert(!pin.is_clone());
 
       TCachedExtentRef<T> extent;
-      co_await pin.co_refresh();
       if (full_extent_integrity_check) {
         SUBTRACET(seastore_tm, "{} reading pin...", t, pin);
         // read the entire extent from disk (See: pin_to_extent)
@@ -1447,7 +1446,7 @@ private:
           auto &child_pos = ret.get_child_pos();
           auto laddr = pin.get_key();
           std::ignore = cache->retire_absent_extent_addr_by_type(
-            t, laddr, original_paddr, original_len, pin.get_extent_type(),
+            t, laddr, pin.get_val(), original_len, pin.get_extent_type(),
             [&child_pos, laddr](auto &extent) mutable {
               auto lextent = extent.template cast<LogicalChildNode>();
               assert(extent.is_logical());
@@ -1473,7 +1472,7 @@ private:
         SUBDEBUGT(seastore_tm, "extent fully loaded...", t);
         ceph_assert(extent->is_data_stable());
         ceph_assert(extent->get_length() >= original_len);
-        ceph_assert(extent->get_paddr() == original_paddr);
+        ceph_assert(extent->get_paddr() == pin.get_val());
         original_bptr = extent->get_bptr();
       }
       if (extent) {
@@ -1485,7 +1484,7 @@ private:
         auto remap_offset = remap.offset;
         auto remap_len = remap.len;
         auto remap_laddr = (original_laddr + remap_offset).checked_to_laddr();
-        auto remap_paddr = original_paddr.add_offset(remap_offset);
+        auto remap_paddr = pin.get_val().add_offset(remap_offset);
         SUBDEBUGT(seastore_tm, "remap direct pin into {}~0x{:x} {} ...",
                   t, remap_laddr, remap_len, remap_paddr);
         ceph_assert(remap_len < original_len);

From af137a0d86678fe868a5d8339d7c059eadef107a Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Sun, 24 May 2026 16:45:01 +0800
Subject: [PATCH 267/596] crimson/os/seastore/lba: avoid paddr from crossing
 coroutines

Previously, LBAManager::remap_mappings() works as follows:

1. get the mapping's val;
2. remove the mapping;
3. insert the remapped mappings.

With pessimistic cc in place, during the above step 2 and 3, a rewrite
transaction that modifies the same mapping might be committed and miss
the pending lba leaf nodes because it doesn't contain the mapping at the
time.

This commit change the above workflow as follows:

1. replace the mapping with the first remapped mapping;
2. insert the remaining remapped mappings.

Note that all the remaining mapped mappings' paddrs are calculated based
on the mapping before it in the same coroutine as the insertion, which
means it'll always see the modification of a background rewrite
transaction.

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 .../os/seastore/btree/fixed_kv_btree.h        | 83 +++++++++++++++++++
 .../os/seastore/lba/btree_lba_manager.cc      | 70 ++++++++++------
 src/crimson/os/seastore/lba/lba_btree_node.h  | 18 ++++
 src/crimson/os/seastore/linked_tree_node.h    |  4 +-
 4 files changed, 147 insertions(+), 28 deletions(-)

diff --git a/src/crimson/os/seastore/btree/fixed_kv_btree.h b/src/crimson/os/seastore/btree/fixed_kv_btree.h
index d1891e1441a..b701062610a 100644
--- a/src/crimson/os/seastore/btree/fixed_kv_btree.h
+++ b/src/crimson/os/seastore/btree/fixed_kv_btree.h
@@ -1135,6 +1135,89 @@ public:
     return iter;
   }
 
+  /**
+   * replace
+   *
+   * Replace the entry pointed by iter with the key and val. key
+   * must be within the range iter.get_key()~iter.get_length()
+   *
+   * @param c [in] op context
+   * @param iter [in] iterator to element to update, must not be end
+   * @param key [in] key with which to replace
+   * @param val [in] val with which to replace
+   * @return iterator to newly replaced element
+   */
+  using replace_iertr = base_iertr;
+  using replace_ret = replace_iertr::future<iterator>;
+  using get_val_func_t = std::function<node_val_t ()>;
+  replace_ret replace(
+    op_context_t c,
+    iterator iter,
+    node_key_t key,
+    get_val_func_t func,
+    BaseChildNode<leaf_node_t, node_key_t> *child)
+  {
+    LOG_PREFIX(FixedKVBtree::replace);
+    SUBTRACET(
+      seastore_fixedkv_tree,
+      "replace element at {} with {}",
+      c.trans,
+      iter.is_end() ? min_max_t<node_key_t>::max : iter.get_key(),
+      key);
+    if (likely(iter.leaf.node->get_meta().end > key)) {
+      // the replacing key is also within the range of the current
+      // leaf node, so do the replacing directly
+      if (!iter.leaf.node->is_mutable()) {
+        CachedExtentRef mut = c.cache.duplicate_for_write(
+          c.trans, iter.leaf.node
+        );
+        iter.leaf.node = mut->cast<leaf_node_t>();
+      }
+      ++(get_tree_stats<self_type>(c.trans).num_updates);
+      iter.leaf.node->replace(
+        iter.leaf.node->iter_idx(iter.leaf.pos),
+        key,
+        func());
+      if constexpr (std::is_base_of_v<
+          ParentNode<leaf_node_t, node_key_t>, leaf_node_t>) {
+        if (child) {
+          iter.leaf.node->update_child_ptr(iter.leaf.pos, child);
+        }
+      }
+      co_return iter;
+    }
+    // the replacing key fall beyond the end of the current leaf
+    // node, insert it into the next leaf node and remove the
+    // original key
+    auto niter = co_await iter.next(c);
+    assert(!niter.is_end());
+    assert(niter.get_key() > key);
+    co_await handle_split(c, niter);
+    if (!niter.leaf.node->is_mutable()) {
+      CachedExtentRef mut = c.cache.duplicate_for_write(
+        c.trans, niter.leaf.node
+      );
+      niter.leaf.node = mut->cast<leaf_node_t>();
+    }
+    auto it = typename leaf_node_t::const_iterator(
+        niter.leaf.node.get(), niter.leaf.pos);
+    assert(key >= niter.leaf.node->get_meta().begin &&
+           key < niter.leaf.node->get_meta().end);
+    niter.leaf.node->insert(it, key, func());
+    if constexpr (std::is_base_of_v<
+        ParentNode<leaf_node_t, node_key_t>, leaf_node_t>) {
+      niter.leaf.node->insert_child_ptr(
+        niter.leaf.pos, child, niter.leaf.node->get_size() - 1);
+    }
+    (void)child;
+    // TODO: the keys pointed by iter and niter are overlapped which
+    // is against the invariant of the lba/backref tree, but since
+    // remove directly removes the iter, it wouldn't cause any issue
+    // for the time being.
+    niter = co_await remove(c, std::move(iter));
+    assert(niter.get_key() == key);
+    co_return niter;
+  }
 
   /**
    * remove
diff --git a/src/crimson/os/seastore/lba/btree_lba_manager.cc b/src/crimson/os/seastore/lba/btree_lba_manager.cc
index 0d71c0969de..6a42f5ae662 100644
--- a/src/crimson/os/seastore/lba/btree_lba_manager.cc
+++ b/src/crimson/os/seastore/lba/btree_lba_manager.cc
@@ -1086,38 +1086,54 @@ BtreeLBAManager::remap_mappings(
 	 (orig_val.pladdr.is_paddr() &&
 	  orig_val.pladdr.get_paddr().is_absolute()));
   auto type = cursor->get_extent_type();
-  cursor = co_await update_mapping_refcount(
-    c.trans, cursor, -1);
-  iter = btree.make_partial_iter(c, *cursor);
+  auto off = 0;
+  auto last_iter = iter;
   for (auto &remap : remaps) {
     assert(remap.offset + remap.len <= orig_len);
     assert((bool)remap.extent == !orig_indirect);
-    lba_map_val_t val = orig_val;
     auto new_key = (orig_laddr + remap.offset).checked_to_laddr();
-    val.len = remap.len;
-    if (val.pladdr.is_laddr()) {
-      DEBUGT("{} + {:#x}",
-        t,
-        val.pladdr.get_local_clone_id(),
-        remap.offset);
-    } else {
-      auto paddr = val.pladdr.get_paddr();
-      val.pladdr = paddr + remap.offset;
-    }
-    val.refcount = EXTENT_DEFAULT_REF_COUNT;
-    // Checksum will be updated when the committing the transaction
-    val.checksum = CRC_NULL;
-    val.type = type;
+    auto f = [&last_iter, &remap, &off, &t, FNAME, type] {
+      lba_map_val_t val = last_iter.get_val();
+      auto cur_off = remap.offset - off;
+      if (val.pladdr.is_laddr()) {
+        DEBUGT("{} + {:#x}",
+          t,
+          val.pladdr.get_local_clone_id(),
+          remap.offset);
+      } else {
+        auto paddr = val.pladdr.get_paddr();
+        val.pladdr = paddr + cur_off;
+      }
+      val.len = remap.len;
+      val.refcount = EXTENT_DEFAULT_REF_COUNT;
+      // Checksum will be updated when the committing the transaction
+      val.checksum = CRC_NULL;
+      val.type = type;
+      return val;
+    };
     // committing the transaction
-    auto p = co_await btree.insert(
-      c, iter, new_key, std::move(val),
-      orig_indirect
-        ? get_reserved_ptr<LBALeafNode, laddr_t>()
-        : remap.extent);
-    auto &[it, inserted] = p;
-    ceph_assert(inserted);
-    ret.push_back(it.get_cursor(c));
-    iter = co_await it.next(c);
+    if (remap.offset == remaps.front().offset) {
+      iter = co_await btree.replace(
+        c, std::move(iter), new_key,
+        std::move(f),
+        orig_indirect
+          ? get_reserved_ptr<LBALeafNode, laddr_t>()
+          : remap.extent);
+      ret.push_back(iter.get_cursor(c));
+      iter = co_await iter.next(c);
+    } else {
+      auto p = co_await btree.insert(
+        c, iter, new_key, f(),
+        orig_indirect
+          ? get_reserved_ptr<LBALeafNode, laddr_t>()
+          : remap.extent);
+      auto &[it, inserted] = p;
+      ceph_assert(inserted);
+      ret.push_back(it.get_cursor(c));
+      last_iter = it;
+      iter = co_await it.next(c);
+    }
+    off = remap.offset;
   }
   co_await trans_intr::parallel_for_each(
     ret,
diff --git a/src/crimson/os/seastore/lba/lba_btree_node.h b/src/crimson/os/seastore/lba/lba_btree_node.h
index dd15c2a8cf2..cabb652bebf 100644
--- a/src/crimson/os/seastore/lba/lba_btree_node.h
+++ b/src/crimson/os/seastore/lba/lba_btree_node.h
@@ -148,6 +148,24 @@ struct LBALeafNode
     laddr_t addr,
     lba_map_val_t val) final;
 
+  void replace(
+    internal_const_iterator_t iter,
+    laddr_t pivot,
+    lba_map_val_t val) {
+    LOG_PREFIX(FixedKVInternalNode::replace);
+    SUBTRACE(seastore_fixedkv_tree, "trans.{}, pos {}, old key {}, key {}",
+      this->pending_for_transaction,
+      iter.get_offset(),
+      iter.get_key(),
+      pivot);
+    this->on_modify();
+    return this->journal_replace(
+      iter,
+      pivot,
+      std::move(val),
+      maybe_get_delta_buffer());
+  }
+
   void remove(internal_const_iterator_t iter) final {
     LOG_PREFIX(LBALeafNode::remove);
     SUBTRACE(seastore_fixedkv_tree, "trans.{}, pos {}, key {}",
diff --git a/src/crimson/os/seastore/linked_tree_node.h b/src/crimson/os/seastore/linked_tree_node.h
index 3683f90972b..1b136c8a6a2 100644
--- a/src/crimson/os/seastore/linked_tree_node.h
+++ b/src/crimson/os/seastore/linked_tree_node.h
@@ -426,7 +426,9 @@ public:
 
   void update_child_ptr(btreenode_pos_t pos, BaseChildNode<T, node_key_t>* child) {
     children[pos] = child;
-    set_child_ptracker(child);
+    if (!is_reserved_ptr(child)) {
+      set_child_ptracker(child);
+    }
   }
 
   // copy dests points from a stable node back to its pending nodes

From cb5ea45c28fd20d996d5875dbdb7148eb728d3a6 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 16 Jun 2026 20:19:11 +0800
Subject: [PATCH 268/596] crimson/osd: fix malformed debug log format strings

a few debug() calls had format strings that did not match their
arguments. with the seastar logger formatting at runtime these only
threw an fmt error at the matching log level, or went unnoticed:

- pg_backend.cc: "{}: object does not exist: {}" had two placeholders
  but one argument; drop the stray leading "{}: ".
- pg.cc do_recover_missing(): the "need to wait for recovery ... version
  {}" message never passed the eversion_t; add it.
- client_request.cc: a DEBUGDPP() carried an extra leading "{}: " on top
  of the prefix the macro already injects (also fix the "rwoedered"
  typo).

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd_operations/client_request.cc | 2 +-
 src/crimson/osd/pg.cc                            | 2 +-
 src/crimson/osd/pg_backend.cc                    | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/crimson/osd/osd_operations/client_request.cc b/src/crimson/osd/osd_operations/client_request.cc
index d470d8bb35e..f1a5d400496 100644
--- a/src/crimson/osd/osd_operations/client_request.cc
+++ b/src/crimson/osd/osd_operations/client_request.cc
@@ -624,7 +624,7 @@ bool ClientRequest::is_misdirected_replica_read(const PG& pg) const
       flags & CEPH_OSD_FLAG_BALANCE_READS ||
       flags & CEPH_OSD_FLAG_LOCALIZE_READS) {
     if (op_info.rwordered()) {
-      DEBUGDPP("{}: dropping - rwoedered with balanced/localize read {}", pg, *this);
+      DEBUGDPP("dropping - reordered with balanced/localize read {}", pg, *this);
       return true;
     }
     if (!op_info.may_read()) {
diff --git a/src/crimson/osd/pg.cc b/src/crimson/osd/pg.cc
index f79e8272d99..dfd756f9908 100644
--- a/src/crimson/osd/pg.cc
+++ b/src/crimson/osd/pg.cc
@@ -760,7 +760,7 @@ PG::interruptible_future<bool> PG::do_recover_missing(
   }
   DEBUGDPP(
     "reqid {} need to wait for recovery, {} version {}",
-    *this, reqid, soid);
+    *this, reqid, soid, ver);
   if (recovery_backend->is_recovering(soid)) {
     DEBUGDPP(
       "reqid {} object {} version {}, already recovering",
diff --git a/src/crimson/osd/pg_backend.cc b/src/crimson/osd/pg_backend.cc
index 6a2e57d0992..e17c7aa9d41 100644
--- a/src/crimson/osd/pg_backend.cc
+++ b/src/crimson/osd/pg_backend.cc
@@ -1451,7 +1451,7 @@ PGBackend::omap_get_keys(
   object_stat_sum_t& delta_stats) const
 {
   if (!os.exists || os.oi.is_whiteout()) {
-    logger().debug("{}: object does not exist: {}", os.oi.soid);
+    logger().debug("object does not exist: {}", os.oi.soid);
     co_await ll_read_ierrorator::future<>(crimson::ct_error::enoent::make());
   }
   std::string start_after;
@@ -1545,7 +1545,7 @@ PGBackend::omap_cmp(
   object_stat_sum_t& delta_stats) const
 {
   if (!os.exists || os.oi.is_whiteout()) {
-    logger().debug("{}: object does not exist: {}", os.oi.soid);
+    logger().debug("object does not exist: {}", os.oi.soid);
     return crimson::ct_error::enoent::make();
   }
 
@@ -1581,7 +1581,7 @@ PGBackend::omap_get_vals(
   object_stat_sum_t& delta_stats) const
 {
   if (!os.exists || os.oi.is_whiteout()) {
-    logger().debug("{}: object does not exist: {}", os.oi.soid);
+    logger().debug("object does not exist: {}", os.oi.soid);
     co_await ll_read_ierrorator::future<>(crimson::ct_error::enoent::make());
   }
   std::string start_after;
@@ -1778,7 +1778,7 @@ PGBackend::omap_clear(
   object_stat_sum_t& delta_stats)
 {
   if (!os.exists || os.oi.is_whiteout()) {
-    logger().debug("{}: object does not exist: {}", os.oi.soid);
+    logger().debug("object does not exist: {}", os.oi.soid);
     return crimson::ct_error::enoent::make();
   }
   if (!os.oi.is_omap()) {

From d5d2ff2e49352314734561ad1129a33d62bf36a3 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 16 Jun 2026 20:19:11 +0800
Subject: [PATCH 269/596] crimson, osd: declare fmt formatters before they are
 used

the seastar logger checks log format strings with a consteval call at
the use site, which instantiates fmt::formatter<T> there. a
specialization declared at the bottom of a header, after inline methods
that already log T, is then "explicit specialization after
instantiation".

move the offending specializations ahead of the type: PG, LBALeafNode,
DummyNodeExtent and WatchTimeoutRequest get a forward declaration plus
the formatter before the class; overwrite_range_t, data_t and edge_t in
object_data_handler.cc move ahead of the functions that log them. while
here, trim_data_reservation() formatted a laddr_t base with 0x{:x}, but
laddr_t's formatter takes no spec, so use {}.

osd_types_fmt.h includes msg/msg_fmt.h: formatter<osd_reqid_t> formats
req_id.name (an entity_name_t), so it depends on that type's formatter
and must pull it in. otherwise logging a reqid instantiates
formatter<entity_name_t> before msg_fmt.h is seen.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/os/seastore/lba/lba_btree_node.h  | 12 ++++++++++-
 .../os/seastore/object_data_handler.cc        | 21 ++++++++++++-------
 .../staged-fltree/node_extent_manager/dummy.h | 14 +++++++++----
 src/crimson/osd/pg.h                          | 16 ++++++++++----
 src/crimson/osd/watch.cc                      | 14 +++++++++----
 src/osd/osd_types_fmt.h                       |  5 +++++
 6 files changed, 61 insertions(+), 21 deletions(-)

diff --git a/src/crimson/os/seastore/lba/lba_btree_node.h b/src/crimson/os/seastore/lba/lba_btree_node.h
index dd15c2a8cf2..de7e18d8e6e 100644
--- a/src/crimson/os/seastore/lba/lba_btree_node.h
+++ b/src/crimson/os/seastore/lba/lba_btree_node.h
@@ -7,6 +7,7 @@
 #include <memory>
 #include <string.h>
 
+#include <fmt/ostream.h>
 
 #include "include/buffer.h"
 
@@ -24,6 +25,16 @@ namespace crimson::os::seastore {
 class LogicalChildNode;
 }
 
+namespace crimson::os::seastore::lba {
+struct LBALeafNode;
+}
+
+// declared ahead of the struct so the consteval {fmt} check sees it from
+// LBALeafNode's own inline logging methods.
+#if FMT_VERSION >= 90000
+template <> struct fmt::formatter<crimson::os::seastore::lba::LBALeafNode> : fmt::ostream_formatter {};
+#endif
+
 namespace crimson::os::seastore::lba {
 
 using LBANode = FixedKVNode<laddr_t>;
@@ -470,6 +481,5 @@ using LBACursorRef = boost::intrusive_ptr<LBACursor>;
 template <> struct fmt::formatter<crimson::os::seastore::lba::lba_node_meta_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::lba::lba_map_val_t> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::lba::LBAInternalNode> : fmt::ostream_formatter {};
-template <> struct fmt::formatter<crimson::os::seastore::lba::LBALeafNode> : fmt::ostream_formatter {};
 template <> struct fmt::formatter<crimson::os::seastore::lba::LBACursor> : fmt::ostream_formatter {};
 #endif
diff --git a/src/crimson/os/seastore/object_data_handler.cc b/src/crimson/os/seastore/object_data_handler.cc
index a586a606d68..a71de486352 100644
--- a/src/crimson/os/seastore/object_data_handler.cc
+++ b/src/crimson/os/seastore/object_data_handler.cc
@@ -4,10 +4,23 @@
 #include <utility>
 #include <functional>
 
+#include <fmt/ostream.h>
+
 #include "crimson/common/log.h"
 
 #include "crimson/os/seastore/object_data_handler.h"
 
+// declared ahead of the logging functions below so the consteval {fmt}
+// check can see them at the call sites.
+#if FMT_VERSION >= 90000
+template <> struct fmt::formatter<crimson::os::seastore::overwrite_range_t>
+  : fmt::ostream_formatter {};
+template <> struct fmt::formatter<crimson::os::seastore::data_t>
+  : fmt::ostream_formatter {};
+template <> struct fmt::formatter<crimson::os::seastore::edge_t>
+  : fmt::ostream_formatter {};
+#endif
+
 namespace {
   seastar::logger& logger() {
     return crimson::get_logger(ceph_subsys_seastore_odata);
@@ -1881,11 +1894,3 @@ ObjectDataHandler::rename(context_t ctx)
 
 } // namespace crimson::os::seastore
 
-#if FMT_VERSION >= 90000
-template <> struct fmt::formatter<crimson::os::seastore::overwrite_range_t>
-  : fmt::ostream_formatter {};
-template <> struct fmt::formatter<crimson::os::seastore::data_t>
-  : fmt::ostream_formatter {};
-template <> struct fmt::formatter<crimson::os::seastore::edge_t>
-  : fmt::ostream_formatter {};
-#endif
diff --git a/src/crimson/os/seastore/onode_manager/staged-fltree/node_extent_manager/dummy.h b/src/crimson/os/seastore/onode_manager/staged-fltree/node_extent_manager/dummy.h
index 6852ec0298c..3a1610d1578 100644
--- a/src/crimson/os/seastore/onode_manager/staged-fltree/node_extent_manager/dummy.h
+++ b/src/crimson/os/seastore/onode_manager/staged-fltree/node_extent_manager/dummy.h
@@ -11,12 +11,22 @@
 
 #include "crimson/os/seastore/onode_manager/staged-fltree/node_extent_manager.h"
 
+#include <fmt/ostream.h>
+
 /**
  * dummy.h
  *
  * Dummy backend implementations for test purposes.
  */
 
+namespace crimson::os::seastore::onode {
+class DummyNodeExtent;
+}
+
+#if FMT_VERSION >= 90000
+template <> struct fmt::formatter<crimson::os::seastore::onode::DummyNodeExtent> : fmt::ostream_formatter {};
+#endif
+
 namespace crimson::os::seastore::onode {
 
 class DummySuper final: public Super {
@@ -191,7 +201,3 @@ class DummyNodeExtentManager final: public NodeExtentManager {
 };
 
 }
-
-#if FMT_VERSION >= 90000
-template <> struct fmt::formatter<crimson::os::seastore::onode::DummyNodeExtent> : fmt::ostream_formatter {};
-#endif
diff --git a/src/crimson/osd/pg.h b/src/crimson/osd/pg.h
index 6e5e47c591c..d44f4455a01 100644
--- a/src/crimson/osd/pg.h
+++ b/src/crimson/osd/pg.h
@@ -11,6 +11,8 @@
 #include <seastar/core/semaphore.hh>
 #include <seastar/core/sharded.hh>
 
+#include <fmt/ostream.h>
+
 #include "common/dout.h"
 #include "common/ostream_temp.h"
 #include "include/interval_set.h"
@@ -67,6 +69,16 @@ namespace crimson::os {
   class FuturizedStore;
 }
 
+namespace crimson::osd {
+class PG;
+}
+
+// declared ahead of the class so the consteval {fmt} check can see it from
+// PG's own inline logging methods (which format *this) above the class.
+#if FMT_VERSION >= 90000
+template <> struct fmt::formatter<crimson::osd::PG> : fmt::ostream_formatter {};
+#endif
+
 namespace crimson::osd {
 class OpsExecuter;
 class SnapTrimEvent;
@@ -1356,7 +1368,3 @@ struct PG::do_osd_ops_params_t {
 std::ostream& operator<<(std::ostream&, const PG& pg);
 
 }
-
-#if FMT_VERSION >= 90000
-template <> struct fmt::formatter<crimson::osd::PG> : fmt::ostream_formatter {};
-#endif
diff --git a/src/crimson/osd/watch.cc b/src/crimson/osd/watch.cc
index d8db6ba628e..08534540941 100644
--- a/src/crimson/osd/watch.cc
+++ b/src/crimson/osd/watch.cc
@@ -11,6 +11,8 @@
 
 #include "messages/MWatchNotify.h"
 
+#include <fmt/ostream.h>
+
 
 namespace {
   seastar::logger& logger() {
@@ -18,6 +20,14 @@ namespace {
   }
 }
 
+namespace crimson::osd {
+class WatchTimeoutRequest;
+}
+
+#if FMT_VERSION >= 90000
+template <> struct fmt::formatter<crimson::osd::WatchTimeoutRequest> : fmt::ostream_formatter {};
+#endif
+
 namespace crimson::osd {
 
 // a watcher can remove itself if it has not seen a notification after a period of time.
@@ -348,7 +358,3 @@ void Notify::do_notify_timeout()
 }
 
 } // namespace crimson::osd
-
-#if FMT_VERSION >= 90000
-template <> struct fmt::formatter<crimson::osd::WatchTimeoutRequest> : fmt::ostream_formatter {};
-#endif
diff --git a/src/osd/osd_types_fmt.h b/src/osd/osd_types_fmt.h
index 0e36755782a..402453bc2e9 100644
--- a/src/osd/osd_types_fmt.h
+++ b/src/osd/osd_types_fmt.h
@@ -8,6 +8,11 @@
 
 #include "common/hobject.h"
 #include "include/types_fmt.h"
+// formatter<osd_reqid_t> below formats req_id.name (entity_name_t), so its
+// formatter must be visible here, otherwise it gets instantiated before
+// msg_fmt.h is pulled in by a later include (explicit-specialization-after-
+// instantiation under compile-time {fmt} checking).
+#include "msg/msg_fmt.h"
 #include "osd/osd_types.h"
 #include <fmt/chrono.h>
 #include <fmt/ranges.h>

From 846f9294c6ee5b13ed0194a9fabea79023ec0549 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 16 Jun 2026 20:25:45 +0800
Subject: [PATCH 270/596] crimson/net: log io_state_t out of line in
 shard_states_t

try_enter_out_dispatching()'s impossible default case logs io_state_t,
which would instantiate fmt::formatter<io_state_t> inside IOHandler,
before the formatter (declarable only after the class, since io_state_t
is nested) is visible. move just that abort path to io_handler.cc, where
the formatter is in scope, and keep the hot switch inline.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/net/io_handler.cc |  8 ++++++++
 src/crimson/net/io_handler.h  | 11 +++++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/crimson/net/io_handler.cc b/src/crimson/net/io_handler.cc
index c08bdc87422..df55f1b6f07 100644
--- a/src/crimson/net/io_handler.cc
+++ b/src/crimson/net/io_handler.cc
@@ -1293,6 +1293,14 @@ IOHandler::shard_states_t::notify_out_dispatching_stopped(
   }
 }
 
+void
+IOHandler::shard_states_t::abort_wrong_io_state(SocketConnection &conn)
+{
+  logger().error("{} try_enter_out_dispatching() got wrong io_state {}",
+                 conn, io_state);
+  ceph_abort_msg("impossible");
+}
+
 seastar::future<>
 IOHandler::shard_states_t::wait_io_exit_dispatching()
 {
diff --git a/src/crimson/net/io_handler.h b/src/crimson/net/io_handler.h
index 9cb489af941..c86419c76b8 100644
--- a/src/crimson/net/io_handler.h
+++ b/src/crimson/net/io_handler.h
@@ -326,13 +326,16 @@ public:
         // do not dispatch out
         return false;
       default:
-        crimson::get_logger(ceph_subsys_ms).error(
-          "{} try_enter_out_dispatching() got wrong io_state {}",
-          conn, io_state);
-        ceph_abort_msg("impossible");
+        abort_wrong_io_state(conn);
       }
     }
 
+    // defined out of line: logging io_state_t here, inside IOHandler, would
+    // instantiate fmt::formatter<io_state_t> before it is declared (it can
+    // only be declared after IOHandler). only this impossible-state path
+    // formats it, so keep the hot switch inline and move the abort out.
+    [[noreturn]] void abort_wrong_io_state(SocketConnection &conn);
+
     void notify_out_dispatching_stopped(
         const char *what, SocketConnection &conn);
 

From 863f65fdee51c02812257aeb8bfc6771b379c29d Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 16 Jun 2026 20:34:05 +0800
Subject: [PATCH 271/596] crimson/osd, seastore: fix log argument mismatches in
 error paths

two log calls in errorator continuations were missing an argument. the
compile-time fmt check surfaced these as a confusing "call to immediate
function ... is not a constant expression" deep in the errorator/composer
machinery rather than a plain "too few arguments", because the consteval
format failure escalates through the continuation templates:

- shard_services.cc handle_pg_create_info(): "ignore pgid {}" never
  passed pgid.
- node.cc: the read_extent error handler logged "{} -- addr={},
  is_level_tail={}" without the leading error; pass the std::error_code
  and include <fmt/std.h> for its formatter.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/os/seastore/onode_manager/staged-fltree/node.cc | 4 +++-
 src/crimson/osd/shard_services.cc                           | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc b/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc
index 9d78d87a8cd..6145018240f 100644
--- a/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc
+++ b/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc
@@ -7,6 +7,8 @@
 #include <exception>
 #include <sstream>
 
+#include <fmt/std.h>  // for fmt::formatter<std::error_code>
+
 #include "common/likely.h"
 #include "crimson/common/utility.h"
 #include "crimson/os/seastore/logging.h"
@@ -693,7 +695,7 @@ eagain_ifuture<Ref<Node>> Node::load(
     crimson::ct_error::all_same_way(
       [FNAME, c, addr, expect_is_level_tail](const auto &e) {
       ERRORT("{} -- addr={}, is_level_tail={}",
-        c.t, addr, expect_is_level_tail);
+        c.t, e, addr, expect_is_level_tail);
       ceph_abort();
       return eagain_iertr::make_ready_future<NodeExtentRef>();
     })
diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index bfb75e645ea..abeeb439c0b 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -933,7 +933,7 @@ seastar::future<Ref<PG>> ShardServices::handle_pg_create_info(
 	  const spg_t &pgid = info->pgid;
 	  if (!get_map()->is_up_acting_osd_shard(pgid, local_state.whoami)
 	      || !startmap->is_up_acting_osd_shard(pgid, local_state.whoami)) {
-	    DEBUG("ignore pgid {}, doesn't exist anymore, discarding");
+	    DEBUG("ignore pgid {}, doesn't exist anymore, discarding", pgid);
 	    local_state.pg_map.pg_creation_canceled(pgid);
 	    return seastar::make_ready_future<
 	      std::tuple<Ref<PG>, OSDMapService::cached_map_t>

From 1d18b19997d3bbcd4f7d82d8430a3d63986cea9f Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 16 Jun 2026 20:19:11 +0800
Subject: [PATCH 272/596] cmake: enable compile-time fmt format string checking

seastar checks log format strings at compile time when
Seastar_LOGGER_COMPILE_TIME_FMT is on; the option is gated on
fmt_VERSION >= 9.0.0. ceph builds fmt via add_subdirectory(), which
leaves the version in fmt's own FMT_VERSION and never sets the lowercase
fmt_VERSION the option reads, so the check was silently off for crimson.
read the version off the fmt target and expose it so the option turns
on.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/CMakeLists.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index a93a38d7501..a53365e1f7f 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -446,6 +446,8 @@ else()
   set(BUILD_SHARED_LIBS ${old_BUILD_SHARED_LIBS})
   unset(old_BUILD_SHARED_LIBS)
   include_directories(SYSTEM "${CMAKE_SOURCE_DIR}/src/fmt/include")
+  get_target_property(FMT_VERSION fmt VERSION)
+  set(fmt_VERSION "${FMT_VERSION}")
 endif()
 
 # in osd/PeeringState.h, the number of elements in PeeringState::Active::reactions

From 488c7fdf0940edadbbb2b38c5099cc0e9c9d2348 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Wed, 17 Jun 2026 15:48:07 +0530
Subject: [PATCH 273/596] mgr/nfs: read full conf object when removing export
 URL

remove_obj() called ioctx.read() without a length, so only the first
8192 bytes of conf-nfs.* were read before write_full(). Removing exports
from a large cluster truncated and corrupted the shared config object,
leaving malformed entries such as '%url "rados:' while export objects
were deleted.

Fixes: https://tracker.ceph.com/issues/77463
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/nfs/rados_utils.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/pybind/mgr/nfs/rados_utils.py b/src/pybind/mgr/nfs/rados_utils.py
index e8af2c71680..37e4ae683fb 100644
--- a/src/pybind/mgr/nfs/rados_utils.py
+++ b/src/pybind/mgr/nfs/rados_utils.py
@@ -72,7 +72,8 @@ class NFSRados:
     def remove_obj(self, obj: str, config_obj: str, should_notify: Optional[bool] = True) -> None:
         with self.rados.open_ioctx(self.pool) as ioctx:
             ioctx.set_namespace(self.namespace)
-            export_urls = ioctx.read(config_obj)
+            size, _ = ioctx.stat(config_obj)
+            export_urls = ioctx.read(config_obj, size)
             url = '%url "{}"\n\n'.format(self._make_rados_url(obj))
             export_urls = export_urls.replace(url.encode('utf-8'), b'')
             ioctx.remove_object(obj)

From 90b925d824a12164962c55615bb8b6ad87ab42df Mon Sep 17 00:00:00 2001
From: Nitzan Mordechai <nmordech@ibm.com>
Date: Thu, 11 Jun 2026 11:15:59 +0000
Subject: [PATCH 274/596] osd-recovery-prio: race condition fix in
 TEST_recovery_pool_priority

Use norecover to pause recovery ops while inspecting reservation
state. Without it, recovery can complete before the admin-socket
dump is captured, causing intermittent test failures

Fixes: https://tracker.ceph.com/issues/77113
Signed-off-by: Nitzan Mordechai <nmordech@ibm.com>
---
 qa/standalone/osd/osd-recovery-prio.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/qa/standalone/osd/osd-recovery-prio.sh b/qa/standalone/osd/osd-recovery-prio.sh
index 02b65f67a27..2d533a5df65 100755
--- a/qa/standalone/osd/osd-recovery-prio.sh
+++ b/qa/standalone/osd/osd-recovery-prio.sh
@@ -426,13 +426,19 @@ function TEST_recovery_pool_priority() {
     ceph pg dump pgs
     ERRORS=0
 
+    # Pause recovery so reservations are held while we inspect them
+    ceph osd set norecover
+
     ceph osd pool set $pool1 size 2
     ceph osd pool set $pool2 size 2
 
     # Wait for both PGs to be in recovering state
     ceph pg dump pgs
 
-    # Wait for recovery to start
+    # Wait for recovery to start on both PGs so reservations are
+    # created. If we check too early we may miss the reservation
+    # creation and if we wait too long the recovery may complete
+    # and reservations be removed.
     set -o pipefail
     count=0
     while(true)
@@ -446,6 +452,7 @@ function TEST_recovery_pool_priority() {
       if test "$count" -eq "10"
       then
         echo "Recovery never started on both PGs"
+        ceph osd unset norecover
         return 1
       fi
       count=$(expr $count + 1)
@@ -520,6 +527,8 @@ function TEST_recovery_pool_priority() {
       fi
     fi
 
+    ceph osd unset norecover
+
     wait_for_clean || return 1
 
     if [ $ERRORS != "0" ];

From a10f58df8cb95deae899f35562bd024ad0c2bae9 Mon Sep 17 00:00:00 2001
From: Miki Patel <miki.patel132@gmail.com>
Date: Sun, 19 Apr 2026 11:59:40 +0530
Subject: [PATCH 275/596] rbd-mirror: prune obsolete primary mirror snapshots
 after relocation

Previously, obsolete primary and demoted primary snapshots on the
secondary cluster were not cleaned up immediately after relocation.
Instead, old primary snapshots remained until a subsequent promote
operation triggered their cleanup, while old demoted primary snapshots
persisted until a later demote operation removed them.

Adding changes for proactive cleanup of obsolete primary and demoted
primary snapshots that are no longer required after relocation.

Also adding test coverage to validate the cleanup behavior.

Fixes: https://tracker.ceph.com/issues/76154

Signed-off-by: Miki Patel <miki.patel132@gmail.com>
---
 qa/workunits/rbd/rbd_mirror.sh                |  54 ++++
 qa/workunits/rbd/rbd_mirror_helpers.sh        |  37 +++
 .../snapshot/test_mock_Replayer.cc            | 272 +++++++++++-------
 .../rbd_mirror/test_mock_ImageReplayer.cc     |  10 +-
 src/tools/rbd_mirror/ImageReplayer.cc         |   1 +
 src/tools/rbd_mirror/Types.h                  |   2 +-
 .../rbd_mirror/image_replayer/StateBuilder.h  |   1 +
 .../image_replayer/journal/StateBuilder.cc    |   1 +
 .../image_replayer/journal/StateBuilder.h     |   1 +
 .../image_replayer/snapshot/Replayer.cc       |  32 ++-
 .../image_replayer/snapshot/Replayer.h        |  10 +-
 .../image_replayer/snapshot/StateBuilder.cc   |   5 +-
 .../image_replayer/snapshot/StateBuilder.h    |   1 +
 13 files changed, 312 insertions(+), 115 deletions(-)

diff --git a/qa/workunits/rbd/rbd_mirror.sh b/qa/workunits/rbd/rbd_mirror.sh
index 7f8afddc613..99166f169ba 100755
--- a/qa/workunits/rbd/rbd_mirror.sh
+++ b/qa/workunits/rbd/rbd_mirror.sh
@@ -274,6 +274,60 @@ wait_for_replaying_status_in_pool_dir ${CLUSTER1} ${POOL} ${image}
 wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+stopped'
 compare_images ${CLUSTER1} ${CLUSTER2} ${POOL} ${POOL} ${image}
 
+if [ "${RBD_MIRROR_MODE}" = "snapshot" ]; then
+  testlog "TEST: failover / failback loop with snapshot presence checks"
+  snap_id_1=""
+  demote_snap_id_1=""
+  snap_id_2=""
+  demote_snap_id_2=""
+  get_newest_complete_mirror_snapshot_id ${CLUSTER2} ${POOL} ${image} snap_id_2
+  for i in `seq 1 5`; do
+    demote_image ${CLUSTER2} ${POOL} ${image}
+    wait_for_image_replay_stopped ${CLUSTER1} ${POOL} ${image}
+    wait_for_status_in_pool_dir ${CLUSTER1} ${POOL} ${image} 'up+unknown'
+    wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+unknown'
+    get_newest_complete_mirror_snapshot_id ${CLUSTER2} ${POOL} ${image} demote_snap_id_2
+    wait_for_non_primary_snap_present ${CLUSTER1} ${POOL} ${image} ${demote_snap_id_2}
+    wait_for_non_primary_snap_not_present ${CLUSTER1} ${POOL} ${image} ${snap_id_2}
+
+    promote_image ${CLUSTER1} ${POOL} ${image}
+    wait_for_image_replay_started ${CLUSTER2} ${POOL} ${image}
+    wait_for_status_in_pool_dir ${CLUSTER1} ${POOL} ${image} 'up+stopped'
+    wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+replaying'
+    get_newest_complete_mirror_snapshot_id ${CLUSTER1} ${POOL} ${image} snap_id_1
+    wait_for_non_primary_snap_present ${CLUSTER2} ${POOL} ${image} ${snap_id_1}
+    wait_for_snap_not_present ${CLUSTER2} ${POOL} ${image} ${snap_id_2}
+    wait_for_snap_not_present ${CLUSTER2} ${POOL} ${image} ${demote_snap_id_2}
+
+    demote_image ${CLUSTER1} ${POOL} ${image}
+    wait_for_non_primary_snap_not_present ${CLUSTER1} ${POOL} ${image} ${demote_snap_id_2}
+    wait_for_image_replay_stopped ${CLUSTER2} ${POOL} ${image}
+    wait_for_status_in_pool_dir ${CLUSTER1} ${POOL} ${image} 'up+unknown'
+    wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+unknown'
+    get_newest_complete_mirror_snapshot_id ${CLUSTER1} ${POOL} ${image} demote_snap_id_1
+    wait_for_non_primary_snap_present ${CLUSTER2} ${POOL} ${image} ${demote_snap_id_1}
+    wait_for_non_primary_snap_not_present ${CLUSTER2} ${POOL} ${image} ${snap_id_1}
+
+    promote_image ${CLUSTER2} ${POOL} ${image}
+    wait_for_image_replay_started ${CLUSTER1} ${POOL} ${image}
+    wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+stopped'
+    wait_for_status_in_pool_dir ${CLUSTER1} ${POOL} ${image} 'up+replaying'
+    get_newest_complete_mirror_snapshot_id ${CLUSTER2} ${POOL} ${image} snap_id_2
+    wait_for_non_primary_snap_present ${CLUSTER1} ${POOL} ${image} ${snap_id_2}
+    wait_for_snap_not_present ${CLUSTER1} ${POOL} ${image} ${snap_id_1}
+    wait_for_snap_not_present ${CLUSTER1} ${POOL} ${image} ${demote_snap_id_1}
+  done
+  # expected snapshot in non-primary image: non-primary
+  SNAPS=$(get_snaps_json ${CLUSTER1} ${POOL} ${image})
+  jq -e 'length == 1' <<< ${SNAPS}
+  jq -e '.[0].namespace["type"] == "mirror" and .[0].namespace["state"] == "non-primary"' <<< ${SNAPS}
+  # expected snapshots in primary image: non-primary demoted, primary
+  SNAPS=$(get_snaps_json ${CLUSTER2} ${POOL} ${image})
+  jq -e 'length == 2' <<< ${SNAPS}
+  jq -e '.[0].namespace["type"] == "mirror" and .[0].namespace["state"] == "demoted" and (.[0]["name"] | startswith(".mirror.non_primary"))' <<< ${SNAPS}
+  jq -e '.[1].namespace["type"] == "mirror" and .[1].namespace["state"] == "primary"' <<< ${SNAPS}
+fi
+
 testlog "TEST: failover / failback loop"
 for i in `seq 1 20`; do
   demote_image ${CLUSTER2} ${POOL} ${image}
diff --git a/qa/workunits/rbd/rbd_mirror_helpers.sh b/qa/workunits/rbd/rbd_mirror_helpers.sh
index 324b0877655..50903971643 100755
--- a/qa/workunits/rbd/rbd_mirror_helpers.sh
+++ b/qa/workunits/rbd/rbd_mirror_helpers.sh
@@ -826,6 +826,43 @@ wait_for_non_primary_snap_present()
     return 1
 }
 
+wait_for_snap_not_present()
+{
+    local cluster=$1
+    local pool=$2
+    local image=$3
+    local snap_id=$4
+    local snap_count
+    local s
+
+    for s in 0.1 1 2 4 8 8 8 8 8 8 8 8 16 16 32 32; do
+        sleep ${s}
+        snap_count=$(rbd --cluster ${cluster} snap list --all ${pool}/${image} --format xml | \
+                     xmlstarlet sel -t -v "count(//snapshots/snapshot[id='${snap_id}'])")
+        [ "${snap_count}" = "0" ] && return 0
+    done
+
+    return 1
+}
+
+wait_for_non_primary_snap_not_present()
+{
+    local cluster=$1
+    local pool=$2
+    local image=$3
+    local primary_snap_id=$4
+    local snap_count
+    local s
+
+    for s in 0.1 1 2 4 8 8 8 8 8 8 8 8 16 16 32 32; do
+        sleep ${s}
+        snap_count=$(rbd --cluster ${cluster} snap list --all ${pool}/${image} --format xml | \
+            xmlstarlet sel -t -v "count(//snapshots/snapshot/namespace[primary_snap_id='${primary_snap_id}'])")
+        [ "${snap_count}" = "0" ] && return 0
+    done
+    return 1
+}
+
 wait_for_snapshot_sync_complete()
 {
     local local_cluster=$1
diff --git a/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc b/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc
index db85304f06b..a2dabf2e0ae 100644
--- a/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc
+++ b/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc
@@ -495,8 +495,8 @@ public:
       }));
   }
 
-  void expect_prune_non_primary_snapshot(librbd::MockTestImageCtx& mock_image_ctx,
-                                         uint64_t snap_id, int r) {
+  void expect_prune_mirror_snapshot(librbd::MockTestImageCtx& mock_image_ctx,
+                                    uint64_t snap_id, int r) {
     EXPECT_CALL(mock_image_ctx, get_snap_info(snap_id))
       .WillOnce(Invoke([&mock_image_ctx](uint64_t snap_id) -> librbd::SnapInfo* {
         auto it = mock_image_ctx.snap_info.find(snap_id);
@@ -734,8 +734,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InitShutDown) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -788,8 +789,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, SyncSnapshot) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -913,7 +915,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, SyncSnapshot) {
          4, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
-  expect_prune_non_primary_snapshot(mock_local_image_ctx, 11, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 11, 0);
 
   // idle
   expect_load_image_meta(mock_image_meta, false, 0);
@@ -966,8 +968,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncInitial) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1051,8 +1054,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncDelta) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1129,7 +1133,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncDelta) {
          2, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
-  expect_prune_non_primary_snapshot(mock_local_image_ctx, 11, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 11, 0);
 
   // idle
   expect_load_image_meta(mock_image_meta, false, 0);
@@ -1172,8 +1176,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncDeltaDemote) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1201,7 +1206,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncDeltaDemote) {
   mock_local_image_ctx.snap_info = {
     {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
        cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
-       {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+       {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
      0, {}, 0, 0, {}}},
     {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
        cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
@@ -1229,7 +1234,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncDeltaDemote) {
                      false, 0);
   expect_notify_sync_complete(mock_instance_watcher, mock_local_image_ctx.id);
 
-  // idle
+  // prune primary demotion snap1
   expect_load_image_meta(mock_image_meta, false, 0);
   expect_is_refresh_required(mock_remote_image_ctx, true);
   expect_refresh(
@@ -1244,13 +1249,26 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedSyncDeltaDemote) {
     mock_local_image_ctx, {
       {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
-         {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+         {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
        0, {}, 0, 0, {}}},
       {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
          2, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 11, 0);
+
+  // idle
+  expect_load_image_meta(mock_image_meta, false, 0);
+  expect_is_refresh_required(mock_remote_image_ctx, false);
+  expect_is_refresh_required(mock_local_image_ctx, true);
+  expect_refresh(
+    mock_local_image_ctx, {
+      {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
+         cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
+         2, true, 0, {}},
+       0, {}, 0, 0, {}}},
+    }, 0);
 
   // wake-up replayer
   update_watch_ctx->handle_notify();
@@ -1281,8 +1299,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncInitial) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1365,8 +1384,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDelta) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1404,7 +1424,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDelta) {
   expect_load_image_meta(mock_image_meta, false, 0);
   expect_is_refresh_required(mock_remote_image_ctx, false);
   expect_is_refresh_required(mock_local_image_ctx, false);
-  expect_prune_non_primary_snapshot(mock_local_image_ctx, 12, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 12, 0);
 
   // sync snap2
   expect_load_image_meta(mock_image_meta, false, 0);
@@ -1462,7 +1482,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDelta) {
          2, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
-  expect_prune_non_primary_snapshot(mock_local_image_ctx, 11, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 11, 0);
 
   // idle
   expect_load_image_meta(mock_image_meta, false, 0);
@@ -1505,8 +1525,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDeltaDemote)
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1534,7 +1555,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDeltaDemote)
   mock_local_image_ctx.snap_info = {
     {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
        cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
-       {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+       {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
      0, {}, 0, 0, {}}},
     {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
        cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
@@ -1545,7 +1566,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDeltaDemote)
   expect_load_image_meta(mock_image_meta, false, 0);
   expect_is_refresh_required(mock_remote_image_ctx, false);
   expect_is_refresh_required(mock_local_image_ctx, false);
-  expect_prune_non_primary_snapshot(mock_local_image_ctx, 12, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 12, 0);
 
   // sync snap2
   expect_load_image_meta(mock_image_meta, false, 0);
@@ -1555,7 +1576,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDeltaDemote)
     mock_local_image_ctx, {
       {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
-         {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+         {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
   MockSnapshotCopyRequest mock_snapshot_copy_request;
@@ -1581,7 +1602,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDeltaDemote)
                      false, 0);
   expect_notify_sync_complete(mock_instance_watcher, mock_local_image_ctx.id);
 
-  // idle
+  // prune primary demotion snap1
   expect_load_image_meta(mock_image_meta, false, 0);
   expect_is_refresh_required(mock_remote_image_ctx, true);
   expect_refresh(
@@ -1596,13 +1617,26 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, InterruptedPendingSyncDeltaDemote)
     mock_local_image_ctx, {
       {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
-         {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+         {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
        0, {}, 0, 0, {}}},
       {13U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
          2, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 11, 0);
+
+  // idle
+  expect_load_image_meta(mock_image_meta, false, 0);
+  expect_is_refresh_required(mock_remote_image_ctx, false);
+  expect_is_refresh_required(mock_local_image_ctx, true);
+  expect_refresh(
+    mock_local_image_ctx, {
+      {13U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
+         cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
+         2, true, 0, {}},
+       0, {}, 0, 0, {}}},
+    }, 0);
 
   // wake-up replayer
   update_watch_ctx->handle_notify();
@@ -1633,8 +1667,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteImageDemoted) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1687,8 +1722,8 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteImageDemoted) {
   expect_refresh(
     mock_local_image_ctx, {
       {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
-         cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {}, "remote mirror uuid",
-         1, true, 0, {}},
+         cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY_DEMOTED,
+         {"local mirror peer uuid"}, "remote mirror uuid", 1, true, 0, {}},
        0, {}, 0, 0, {}}},
     }, 0);
 
@@ -1722,8 +1757,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, LocalImagePromoted) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1740,7 +1776,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, LocalImagePromoted) {
   mock_local_image_ctx.snap_info = {
     {1U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
        cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY,
-       {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+       {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
      0, {}, 0, 0, {}}}};
 
   // idle
@@ -1778,8 +1814,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ResyncRequested) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1834,8 +1871,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ResyncRequestedRemoteNotPrimary) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1890,8 +1928,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ResyncRequestedRemoteNotPrimary) {
   expect_refresh(
     mock_local_image_ctx, {
       {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
-        cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY_DEMOTED, {"uuid"},
-        "remote mirror uuid", 1, true, 0, {{1, CEPH_NOSNAP}}},
+        cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY_DEMOTED,
+        {"local mirror peer uuid"}, "remote mirror uuid", 1, true, 0,
+        {{1, CEPH_NOSNAP}}},
        0, {}, 0, 0, {}}},
     }, 0);
 
@@ -1923,8 +1962,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RegisterLocalUpdateWatcherError) {
                                       mock_image_meta);
   MockReplayerListener mock_replayer_listener;
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1956,8 +1996,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RegisterRemoteUpdateWatcherError)
                                       mock_image_meta);
   MockReplayerListener mock_replayer_listener;
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -1995,8 +2036,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, UnregisterRemoteUpdateWatcherError
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2037,8 +2079,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, UnregisterLocalUpdateWatcherError)
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2079,8 +2122,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, LoadImageMetaError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2127,8 +2171,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RefreshLocalImageError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2178,8 +2223,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RefreshRemoteImageError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2228,8 +2274,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, CopySnapshotsError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2288,8 +2335,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, GetImageStateError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2350,8 +2398,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, CreateNonPrimarySnapshotError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2416,8 +2465,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, UpdateMirrorImageStateError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2484,8 +2534,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RequestSyncError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2554,8 +2605,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, CopyImageError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2627,8 +2679,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, UpdateNonPrimarySnapshotError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2704,8 +2757,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, UnlinkPeerError) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2792,8 +2846,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, SplitBrain) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2855,8 +2910,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteSnapshotMissingSplitBrain) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2923,8 +2979,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteFailover) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -2956,8 +3013,8 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteFailover) {
     {11U, librbd::SnapInfo{"snap1", cls::rbd::UserSnapshotNamespace{},
      0, {}, 0, 0, {}}},
     {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
-       cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED, {}, "", CEPH_NOSNAP,
-       true, 0, {}},
+       cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
+       {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
      0, {}, 0, 0, {}}}};
 
   // attach to promoted remote image
@@ -2988,7 +3045,7 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteFailover) {
                      false, 0);
   expect_notify_sync_complete(mock_instance_watcher, mock_local_image_ctx.id);
 
-  // idle
+  // prune primary demotion snap2
   expect_load_image_meta(mock_image_meta, false, 0);
   expect_is_refresh_required(mock_remote_image_ctx, true);
   expect_refresh(
@@ -2997,11 +3054,11 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteFailover) {
          0, {}, 0, 0, {}}},
       {2U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY_DEMOTED,
-         {"remote mirror peer uuid"}, "local mirror uuid", 12U, true, 0, {}},
+         {}, "local mirror uuid", 12U, true, 0, {}},
        0, {}, 0, 0, {}}},
       {3U, librbd::SnapInfo{"snap3", cls::rbd::MirrorSnapshotNamespace{
-         cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY, {}, "", CEPH_NOSNAP, true, 0,
-         {}},
+         cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY, {"remote mirror peer uuid"},
+         "", CEPH_NOSNAP, true, 0, {}},
        0, {}, 0, 0, {}}}
     }, 0);
   expect_is_refresh_required(mock_local_image_ctx, true);
@@ -3010,8 +3067,8 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteFailover) {
       {11U, librbd::SnapInfo{"snap1", cls::rbd::UserSnapshotNamespace{},
          0, {}, 0, 0, {}}},
       {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
-         cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED, {}, "", CEPH_NOSNAP,
-         true, 0, {}},
+         cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
+         {"local mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
        0, {}, 0, 0, {}}},
       {13U, librbd::SnapInfo{"snap3", cls::rbd::MirrorSnapshotNamespace{
          cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {},
@@ -3019,6 +3076,22 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, RemoteFailover) {
          {{1, 11}, {2, 12}, {3, CEPH_NOSNAP}}},
        0, {}, 0, 0, {}}},
     }, 0);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 12, 0);
+
+  // idle
+  expect_load_image_meta(mock_image_meta, false, 0);
+  expect_is_refresh_required(mock_remote_image_ctx, false);
+  expect_is_refresh_required(mock_local_image_ctx, true);
+  expect_refresh(
+    mock_local_image_ctx, {
+      {11U, librbd::SnapInfo{"snap1", cls::rbd::UserSnapshotNamespace{},
+         0, {}, 0, 0, {}}},
+      {13U, librbd::SnapInfo{"snap3", cls::rbd::MirrorSnapshotNamespace{
+         cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY, {},
+         "remote mirror uuid", 3, true, 0,
+         {{1, 11}, {2, 12}, {3, CEPH_NOSNAP}}},
+       0, {}, 0, 0, {}}},
+    }, 0);
 
   // wake-up replayer
   update_watch_ctx->handle_notify();
@@ -3065,8 +3138,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, UnlinkRemoteSnapshot) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -3143,8 +3217,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, SkipImageSync) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -3222,8 +3297,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ImageNameUpdated) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
     {"remote mirror uuid", "remote mirror peer uuid"});
@@ -3284,8 +3360,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ApplyImageStatePendingShutdown) {
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   C_SaferCond shutdown_ctx;
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
@@ -3371,8 +3448,9 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ApplyImageStateErrorPendingShutdow
                                       mock_remote_image_ctx,
                                       mock_image_meta);
   MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
-                             "local mirror uuid", &m_pool_meta_cache,
-                             &mock_state_builder, &mock_replayer_listener};
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
   C_SaferCond shutdown_ctx;
   m_pool_meta_cache.set_remote_pool_meta(
     m_remote_fsid, m_remote_io_ctx.get_id(),
diff --git a/src/test/rbd_mirror/test_mock_ImageReplayer.cc b/src/test/rbd_mirror/test_mock_ImageReplayer.cc
index 0788ce51bfa..1bdd0c6b96f 100644
--- a/src/test/rbd_mirror/test_mock_ImageReplayer.cc
+++ b/src/test/rbd_mirror/test_mock_ImageReplayer.cc
@@ -178,9 +178,11 @@ struct StateBuilder<librbd::MockTestImageCtx> {
   }
 
   MOCK_METHOD1(close, void(Context*));
-  MOCK_METHOD5(create_replayer, Replayer*(Threads<librbd::MockTestImageCtx>*,
+  MOCK_METHOD6(create_replayer, Replayer*(Threads<librbd::MockTestImageCtx>*,
                                           InstanceWatcher<librbd::MockTestImageCtx>*,
-                                          const std::string&, PoolMetaCache*,
+                                          const std::string&,
+                                          const std::string&,
+                                          PoolMetaCache*,
                                           ReplayerListener*));
 
   StateBuilder() {
@@ -312,8 +314,8 @@ public:
 
   void expect_create_replayer(MockStateBuilder& mock_state_builder,
                               MockReplayer& mock_replayer) {
-    EXPECT_CALL(mock_state_builder, create_replayer(_, _, _, _, _))
-      .WillOnce(WithArg<4>(
+    EXPECT_CALL(mock_state_builder, create_replayer(_, _, _, _, _, _))
+      .WillOnce(WithArg<5>(
         Invoke([&mock_replayer]
                (image_replayer::ReplayerListener* replayer_listener) {
           mock_replayer.replayer_listener = replayer_listener;
diff --git a/src/tools/rbd_mirror/ImageReplayer.cc b/src/tools/rbd_mirror/ImageReplayer.cc
index de4ef76b7c7..9aee9a96b4d 100644
--- a/src/tools/rbd_mirror/ImageReplayer.cc
+++ b/src/tools/rbd_mirror/ImageReplayer.cc
@@ -431,6 +431,7 @@ void ImageReplayer<I>::start_replay() {
   ceph_assert(m_replayer == nullptr);
   m_replayer = m_state_builder->create_replayer(m_threads, m_instance_watcher,
                                                 m_local_mirror_uuid,
+                                                m_remote_image_peer.uuid,
                                                 m_pool_meta_cache,
                                                 m_replayer_listener);
 
diff --git a/src/tools/rbd_mirror/Types.h b/src/tools/rbd_mirror/Types.h
index f5e9c67fde8..ef13f20fa9c 100644
--- a/src/tools/rbd_mirror/Types.h
+++ b/src/tools/rbd_mirror/Types.h
@@ -116,7 +116,7 @@ struct Peer {
 
 template <typename I>
 std::ostream& operator<<(std::ostream& os, const Peer<I>& peer) {
-  return os << "uuid=" << peer.uuid << ", "
+  return os << "uuid=" << peer.uuid << ", remote_pool_meta="
             << peer.remote_pool_meta;
 }
 
diff --git a/src/tools/rbd_mirror/image_replayer/StateBuilder.h b/src/tools/rbd_mirror/image_replayer/StateBuilder.h
index 0831f72f130..79c27cb19b9 100644
--- a/src/tools/rbd_mirror/image_replayer/StateBuilder.h
+++ b/src/tools/rbd_mirror/image_replayer/StateBuilder.h
@@ -75,6 +75,7 @@ public:
       Threads<ImageCtxT>* threads,
       InstanceWatcher<ImageCtxT>* instance_watcher,
       const std::string& local_mirror_uuid,
+      const std::string& local_mirror_peer_uuid,
       PoolMetaCache* pool_meta_cache,
       ReplayerListener* replayer_listener) = 0;
 
diff --git a/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.cc b/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.cc
index 358af64bea2..9e346e7adc6 100644
--- a/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.cc
+++ b/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.cc
@@ -106,6 +106,7 @@ image_replayer::Replayer* StateBuilder<I>::create_replayer(
     Threads<I>* threads,
     InstanceWatcher<I>* instance_watcher,
     const std::string& local_mirror_uuid,
+    const std::string& local_mirror_peer_uuid,
     PoolMetaCache* pool_meta_cache,
     ReplayerListener* replayer_listener) {
   return Replayer<I>::create(
diff --git a/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.h b/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.h
index 903cce98bfb..5605b1631fa 100644
--- a/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.h
+++ b/src/tools/rbd_mirror/image_replayer/journal/StateBuilder.h
@@ -65,6 +65,7 @@ public:
       Threads<ImageCtxT>* threads,
       InstanceWatcher<ImageCtxT>* instance_watcher,
       const std::string& local_mirror_uuid,
+      const std::string& local_mirror_peer_uuid,
       PoolMetaCache* pool_meta_cache,
       ReplayerListener* replayer_listener) override;
 
diff --git a/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc b/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc
index 14a2113bea5..b85edfc105d 100644
--- a/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc
+++ b/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc
@@ -116,12 +116,14 @@ Replayer<I>::Replayer(
     Threads<I>* threads,
     InstanceWatcher<I>* instance_watcher,
     const std::string& local_mirror_uuid,
+    const std::string& local_mirror_peer_uuid,
     PoolMetaCache* pool_meta_cache,
     StateBuilder<I>* state_builder,
     ReplayerListener* replayer_listener)
   : m_threads(threads),
     m_instance_watcher(instance_watcher),
     m_local_mirror_uuid(local_mirror_uuid),
+    m_local_mirror_peer_uuid(local_mirror_peer_uuid),
     m_pool_meta_cache(pool_meta_cache),
     m_state_builder(state_builder),
     m_replayer_listener(replayer_listener),
@@ -171,7 +173,9 @@ void Replayer<I>::init(Context* on_finish) {
   }
 
   m_remote_mirror_peer_uuid = remote_pool_meta.mirror_peer_uuid;
-  dout(10) << "remote_mirror_peer_uuid=" << m_remote_mirror_peer_uuid << dendl;
+  dout(10) << "local_mirror_peer_uuid=" << m_local_mirror_peer_uuid
+           << ", remote_mirror_peer_uuid=" << m_remote_mirror_peer_uuid
+           << dendl;
 
   {
     auto local_image_ctx = m_state_builder->local_image_ctx;
@@ -539,6 +543,18 @@ void Replayer<I>::scan_local_mirror_snapshots(
       }
     } else if (mirror_ns->is_primary()) {
       if (mirror_ns->complete) {
+        const auto& peer_uuids = mirror_ns->mirror_peer_uuids;
+        if (peer_uuids.empty() ||
+            (mirror_ns->state == cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED &&
+             peer_uuids.size() == 1 &&
+             peer_uuids.count(m_local_mirror_peer_uuid) == 1)) {
+          // After relocation, the primary snapshots on the new secondary become
+          // obsolete snapshots. They can be pruned if they are already unlinked.
+          // Additionally, in this case, a demoted primary snapshot that is linked
+          // to only a single remote (current primary) peer is safe to prune,
+          // because no other peer depends on it waiting for sync.
+          prune_snap_ids.insert(local_snap_id);
+        }
         m_local_snap_id_start = local_snap_id;
         ceph_assert(m_local_snap_id_end == CEPH_NOSNAP);
       } else {
@@ -564,8 +580,8 @@ void Replayer<I>::scan_local_mirror_snapshots(
     locker->unlock();
 
     auto prune_snap_id = *prune_snap_ids.begin();
-    dout(5) << "pruning unused non-primary snapshot " << prune_snap_id << dendl;
-    prune_non_primary_snapshot(prune_snap_id);
+    dout(5) << "pruning unused mirror snapshot " << prune_snap_id << dendl;
+    prune_mirror_snapshot(prune_snap_id);
     return;
   }
 
@@ -798,7 +814,7 @@ void Replayer<I>::scan_remote_mirror_snapshots(
 }
 
 template <typename I>
-void Replayer<I>::prune_non_primary_snapshot(uint64_t snap_id) {
+void Replayer<I>::prune_mirror_snapshot(uint64_t snap_id) {
   dout(10) << "snap_id=" << snap_id << dendl;
 
   auto local_image_ctx = m_state_builder->local_image_ctx;
@@ -825,18 +841,18 @@ void Replayer<I>::prune_non_primary_snapshot(uint64_t snap_id) {
   }
 
   auto ctx = create_context_callback<
-    Replayer<I>, &Replayer<I>::handle_prune_non_primary_snapshot>(this);
+    Replayer<I>, &Replayer<I>::handle_prune_mirror_snapshot>(this);
   local_image_ctx->operations->snap_remove(snap_namespace, snap_name, ctx);
 }
 
 template <typename I>
-void Replayer<I>::handle_prune_non_primary_snapshot(int r) {
+void Replayer<I>::handle_prune_mirror_snapshot(int r) {
   dout(10) << "r=" << r << dendl;
 
   if (r < 0 && r != -ENOENT) {
-    derr << "failed to prune non-primary snapshot: " << cpp_strerror(r)
+    derr << "failed to prune mirror snapshot: " << cpp_strerror(r)
          << dendl;
-    handle_replay_complete(r, "failed to prune non-primary snapshot");
+    handle_replay_complete(r, "failed to prune mirror snapshot");
     return;
   }
 
diff --git a/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.h b/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.h
index 399e636a919..6f111b26d76 100644
--- a/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.h
+++ b/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.h
@@ -47,17 +47,20 @@ public:
       Threads<ImageCtxT>* threads,
       InstanceWatcher<ImageCtxT>* instance_watcher,
       const std::string& local_mirror_uuid,
+      const std::string& local_mirror_peer_uuid,
       PoolMetaCache* pool_meta_cache,
       StateBuilder<ImageCtxT>* state_builder,
       ReplayerListener* replayer_listener) {
     return new Replayer(threads, instance_watcher, local_mirror_uuid,
-                        pool_meta_cache, state_builder, replayer_listener);
+                        local_mirror_peer_uuid, pool_meta_cache, state_builder,
+                        replayer_listener);
   }
 
   Replayer(
       Threads<ImageCtxT>* threads,
       InstanceWatcher<ImageCtxT>* instance_watcher,
       const std::string& local_mirror_uuid,
+      const std::string& local_mirror_peer_uuid,
       PoolMetaCache* pool_meta_cache,
       StateBuilder<ImageCtxT>* state_builder,
       ReplayerListener* replayer_listener);
@@ -202,6 +205,7 @@ private:
   Threads<ImageCtxT>* m_threads;
   InstanceWatcher<ImageCtxT>* m_instance_watcher;
   std::string m_local_mirror_uuid;
+  std::string m_local_mirror_peer_uuid;
   PoolMetaCache* m_pool_meta_cache;
   StateBuilder<ImageCtxT>* m_state_builder;
   ReplayerListener* m_replayer_listener;
@@ -271,8 +275,8 @@ private:
   void scan_local_mirror_snapshots(std::unique_lock<ceph::mutex>* locker);
   void scan_remote_mirror_snapshots(std::unique_lock<ceph::mutex>* locker);
 
-  void prune_non_primary_snapshot(uint64_t snap_id);
-  void handle_prune_non_primary_snapshot(int r);
+  void prune_mirror_snapshot(uint64_t snap_id);
+  void handle_prune_mirror_snapshot(int r);
 
   void copy_snapshots();
   void handle_copy_snapshots(int r);
diff --git a/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.cc b/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.cc
index b3c58be95f6..d678e6ea87c 100644
--- a/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.cc
+++ b/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.cc
@@ -105,11 +105,12 @@ image_replayer::Replayer* StateBuilder<I>::create_replayer(
     Threads<I>* threads,
     InstanceWatcher<I>* instance_watcher,
     const std::string& local_mirror_uuid,
+    const std::string& local_mirror_peer_uuid,
     PoolMetaCache* pool_meta_cache,
     ReplayerListener* replayer_listener) {
   return Replayer<I>::create(
-    threads, instance_watcher, local_mirror_uuid, pool_meta_cache, this,
-    replayer_listener);
+    threads, instance_watcher, local_mirror_uuid, local_mirror_peer_uuid,
+    pool_meta_cache, this, replayer_listener);
 }
 
 } // namespace snapshot
diff --git a/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.h b/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.h
index baa8dcedc7a..c2669074014 100644
--- a/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.h
+++ b/src/tools/rbd_mirror/image_replayer/snapshot/StateBuilder.h
@@ -70,6 +70,7 @@ public:
       Threads<ImageCtxT>* threads,
       InstanceWatcher<ImageCtxT>* instance_watcher,
       const std::string& local_mirror_uuid,
+      const std::string& local_mirror_peer_uuid,
       PoolMetaCache* pool_meta_cache,
       ReplayerListener* replayer_listener) override;
 

From 8e7fc84fef10abe1754df7515292b1352e3e7b2b Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Fri, 12 Jun 2026 16:06:33 +0800
Subject: [PATCH 276/596] crimson/osd: remove extraneous co_return

no need to use co_return at the end of a coroutine which returns
future<>. despite that this does not incur performance penalty,
because:

co_await func() // func returns future<>

returns void

co_return is called with void operand, this statement is lowered to

promise.return_void()

and a bare "co_await func()" also calls return_void(). so they are
equivalent at runtime. but the extraneous co_return can be dispensed.

also take this opportunity to remove the bare co_return at the end
of a coroutine. it's unnecessary just like a `return` at the end of
a function returning `void`.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index d742eef94be..55e01cabef4 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -344,7 +344,6 @@ seastar::future<> OSD::mkfs(
   co_await store.umount();
 
   co_await store.stop();
-  co_return;
 }
 
 seastar::future<> OSD::_write_superblock(
@@ -712,7 +711,7 @@ seastar::future<> OSD::_send_boot()
   if (ret == 0) {
     m->metadata["osd_objectstore"] = type;
   }
-  co_return co_await monc->send_message(std::move(m));
+  co_await monc->send_message(std::move(m));
 }
 
 seastar::future<> OSD::_add_device_class()
@@ -744,8 +743,6 @@ seastar::future<> OSD::_add_device_class()
   } else {
     INFO("device_class was set: {}", message);
   }
-
-  co_return;
 }
 
 seastar::future<> OSD::_add_me_to_crush()

From 15be0e2d3b04ce6435e910d6551546e72024252b Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Fri, 12 Jun 2026 16:28:57 +0800
Subject: [PATCH 277/596] crimson/osd: avoid unnecessary co_await
 make_ready_future call

no need to create a future then co_await it. let's just co_return
it.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 55e01cabef4..63b5d4901cc 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -1723,7 +1723,7 @@ seastar::future<double> OSD::run_bench(int64_t count, int64_t bsize, int64_t osi
     auto end = std::chrono::steady_clock::now();
     double elapsed = std::chrono::duration<double>(end - start).count();
     co_await seastar::when_all_succeed(cleanup_futures.begin(), cleanup_futures.end());
-    co_return co_await seastar::make_ready_future<double>(elapsed);
+    co_return elapsed;
 }
 
 seastar::future<> OSD::update_heartbeat_peers()

From 17c6e03f17f464b3c94e8e0f45c34e09746cbab7 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Fri, 12 Jun 2026 16:36:32 +0800
Subject: [PATCH 278/596] crimson/osd: use std::unique_lock when appropriate

instead of lock and unlock a mutex manually, let's use the RAII
helper. simpler this way.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 63b5d4901cc..0030e04a781 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -1187,11 +1187,8 @@ seastar::future<> OSD::handle_osd_map(Ref<MOSDMap> m)
   * See https://tracker.ceph.com/issues/59165
   */
   ceph_assert(seastar::this_shard_id() == PRIMARY_CORE);
-  return handle_osd_map_lock.lock().then([this, m] {
-    return _handle_osd_map(m);
-  }).finally([this] {
-    return handle_osd_map_lock.unlock();
-  });
+  const auto lock = co_await seastar::get_unique_lock(handle_osd_map_lock);
+  co_await _handle_osd_map(m);
 }
 
 seastar::future<> OSD::_handle_osd_map(Ref<MOSDMap> m)

From ded0d4c14649206a58b3ca3236315f9a29cb328e Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Fri, 12 Jun 2026 17:30:11 +0800
Subject: [PATCH 279/596] crimson/osd: coroutinize OSD methods

this change migrate most of the OSD implementation to C++20 coroutine
when appropriate to improve the readability and maintainability.

there are two patterns in this migration:

- mechanic replacing future-promise then() chain with co_await/co_return
- replace `return <ready future>` with a `co_return` statement
- replace `seastar::do_for_each()` with a regular for loop, and
  optionally restructure the code so it's more compacted.
- replace handle_exception() with regular try-catch block

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd.cc | 275 ++++++++++++++++-------------------------
 1 file changed, 107 insertions(+), 168 deletions(-)

diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 0030e04a781..25096a1fb8a 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -352,12 +352,8 @@ seastar::future<> OSD::_write_superblock(
   OSDSuperblock superblock)
 {
   LOG_PREFIX(OSD::_write_superblock);
-  return seastar::do_with(
-    std::move(meta_coll),
-    std::move(superblock),
-    [&store, FNAME](auto &meta_coll, auto &superblock) {
-      DEBUG("try loading existing superblock");
-      return meta_coll.load_superblock(
+  DEBUG("try loading existing superblock");
+  co_await meta_coll.load_superblock(
       ).safe_then([&superblock, FNAME](OSDSuperblock&& sb) {
 	if (sb.cluster_fsid != superblock.cluster_fsid) {
 	  ERROR("provided cluster fsid {} != superblock's {}",
@@ -386,7 +382,6 @@ seastar::future<> OSD::_write_superblock(
 	}),
 	crimson::ct_error::assert_all("_write_superblock error")
       );
-    });
 }
 
 // this `to_string` sits in the `crimson::osd` namespace, so we don't brake
@@ -400,19 +395,18 @@ seastar::future<> OSD::_write_key_meta(FuturizedStore &store)
 {
   LOG_PREFIX(OSD::_write_key_meta);
   if (auto key = local_conf().get_val<std::string>("key"); !std::empty(key)) {
-    return store.write_meta("osd_key", key);
+    co_await store.write_meta("osd_key", key);
   } else if (auto keyfile = local_conf().get_val<std::string>("keyfile");
              !std::empty(keyfile)) {
-    return read_file(keyfile).then([&store](const auto& temp_buf) {
+    try {
+      const auto temp_buf = co_await read_file(keyfile);
       // it's on a truly cold path, so don't worry about memcpy.
-      return store.write_meta("osd_key", to_string(temp_buf));
-    }).handle_exception([FNAME, keyfile] (auto ep) {
+      co_await store.write_meta("osd_key", to_string(temp_buf));
+    } catch (...) {
       ERROR("_write_key_meta: failed to handle keyfile {}: {}",
-	    keyfile, ep);
+	    keyfile, std::current_exception());
       ceph_abort();
-    });
-  } else {
-    return seastar::now();
+    };
   }
 }
 
@@ -749,47 +743,33 @@ seastar::future<> OSD::_add_me_to_crush()
 {
   LOG_PREFIX(OSD::_add_me_to_crush);
   if (!local_conf().get_val<bool>("osd_crush_update_on_start")) {
-    return seastar::now();
+    co_return;
   }
-  auto get_weight = [this] {
-    if (auto w = local_conf().get_val<double>("osd_crush_initial_weight");
-	w >= 0) {
-      return seastar::make_ready_future<double>(w);
-    } else {
-       return store.stat().then([](auto st) {
-         auto total = st.total;
-	 return seastar::make_ready_future<double>(
-           std::max(.00001,
-		    double(total) / double(1ull << 40))); // TB
-       });
-    }
-  };
-  return get_weight().then([FNAME, this](auto weight) {
-    const crimson::crush::CrushLocation loc;
-    return seastar::do_with(
-      std::move(loc),
-      [FNAME, this, weight] (crimson::crush::CrushLocation& loc) {
-      return loc.init_on_startup().then([FNAME, this, weight, &loc]() {
-        INFO("crush location is {}", loc);
-        string cmd = fmt::format(R"({{
+  double weight = 0;
+  if (auto w = local_conf().get_val<double>("osd_crush_initial_weight");
+      w >= 0) {
+    weight = w;
+  } else {
+    auto st = co_await store.stat();
+    auto total = st.total;
+    weight = std::max(.00001,
+                      double(total) / double(1ull << 40)); // TB
+  }
+  crimson::crush::CrushLocation loc;
+  co_await loc.init_on_startup();
+  INFO("crush location is {}", loc);
+  string cmd = fmt::format(R"({{
           "prefix": "osd crush create-or-move",
           "id": {},
           "weight": {:.4f},
           "args": [{}]
         }})", whoami, weight, loc);
-        return monc->run_command(std::move(cmd), {});
-      });
-    });
-  }).then([FNAME](auto&& command_result) {
-    [[maybe_unused]] auto [code, message, out] = std::move(command_result);
-    if (code) {
-      WARN("fail to add to crush: {} ({})", message, code);
-      throw std::runtime_error("fail to add to crush");
-    } else {
-      INFO("added to crush: {}", message);
-    }
-    return seastar::now();
-  });
+  [[maybe_unused]] auto [code, message, out] = co_await monc->run_command(std::move(cmd), {});
+  if (code) {
+    WARN("fail to add to crush: {} ({})", message, code);
+    throw std::runtime_error("fail to add to crush");
+  }
+  INFO("added to crush: {}", message);
 }
 
 seastar::future<> OSD::handle_command(
@@ -862,45 +842,33 @@ seastar::future<> OSD::stop()
   beacon_timer.cancel();
   tick_timer.cancel();
   // see also OSD::shutdown()
-  return prepare_to_stop().then([this] {
-    return pg_shard_manager.set_stopping();
-  }).then([FNAME, this] {
+  co_await prepare_to_stop();
+  co_await pg_shard_manager.set_stopping();
+
+  try {
     DEBUG("prepared to stop");
     public_msgr->stop();
     cluster_msgr->stop();
     auto gate_close_fut = gate.close_all();
-    return asok->stop().then([this] {
-      return heartbeat->stop();
-    }).then([this] {
-      return pg_shard_manager.stop_registries();
-    }).then([this] {
-      return store.umount();
-    }).then([this] {
-      return store.stop();
-    }).then([this] {
-      return pg_shard_manager.stop_pgs();
-    }).then([this] {
-      return monc->stop();
-    }).then([this] {
-      return mgrc->stop();
-    }).then([this] {
-      return shard_services.stop();
-    }).then([this] {
-      return osd_states.stop();
-    }).then([this] {
-      return osd_singleton_state.stop();
-    }).then([this] {
-      return pg_to_shard_mappings.stop();
-    }).then([fut=std::move(gate_close_fut)]() mutable {
-      return std::move(fut);
-    }).then([this] {
-      return when_all_succeed(
-	  public_msgr->shutdown(),
-	  cluster_msgr->shutdown()).discard_result();
-    }).handle_exception([FNAME](auto ep) {
-      ERROR("error while stopping osd: {}", ep);
-    });
-  });
+    co_await asok->stop();
+    co_await heartbeat->stop();
+    co_await pg_shard_manager.stop_registries();
+    co_await store.umount();
+    co_await store.stop();
+    co_await pg_shard_manager.stop_pgs();
+    co_await monc->stop();
+    co_await mgrc->stop();
+    co_await shard_services.stop();
+    co_await osd_states.stop();
+    co_await osd_singleton_state.stop();
+    co_await pg_to_shard_mappings.stop();
+    co_await std::move(gate_close_fut);
+    co_await when_all_succeed(
+      public_msgr->shutdown(),
+      cluster_msgr->shutdown()).discard_result();
+  } catch (...) {
+    ERROR("error while stopping osd: {}", std::current_exception());
+  };
 }
 
 void OSD::dump_status(Formatter* f) const
@@ -1127,52 +1095,33 @@ seastar::future<MessageURef> OSD::get_stats()
 {
   // MPGStats::had_map_for is not used since PGMonitor was removed
   auto m = crimson::make_message<MPGStats>(monc->get_fsid(), osdmap->get_epoch());
-  return get_shard_services().get_osd_stat().then([this, m=m.get()](auto&& osd_stat) {
-    m->osd_stat = std::move(osd_stat);
-    return pg_shard_manager.get_pg_stats();
-  }).then([this, m=std::move(m)](auto &&stats) mutable {
-    min_last_epoch_clean = osdmap->get_epoch();
-    min_last_epoch_clean_pgs.clear();
-    std::set<int64_t> pool_set;
-    for (auto [pgid, stat] : stats) {
-      min_last_epoch_clean = std::min(min_last_epoch_clean,
-                                      stat.get_effective_last_epoch_clean());
-      min_last_epoch_clean_pgs.push_back(pgid);
-      int64_t pool_id = pgid.pool();
-      pool_set.emplace(pool_id);
+  m->osd_stat = co_await get_shard_services().get_osd_stat();
+
+  auto stats = co_await pg_shard_manager.get_pg_stats();
+  min_last_epoch_clean = osdmap->get_epoch();
+  min_last_epoch_clean_pgs.clear();
+
+  std::map<int64_t, store_statfs_t> pool_stat;
+  for (auto [pgid, stat] : stats) {
+    min_last_epoch_clean = std::min(min_last_epoch_clean,
+                                    stat.get_effective_last_epoch_clean());
+    min_last_epoch_clean_pgs.push_back(pgid);
+
+    if (int64_t pool_id = pgid.pool(); !pool_stat.contains(pool_id)) {
+      pool_stat[pool_id] = co_await store.pool_statfs(pool_id);
     }
-    m->pg_stat = std::move(stats);
-    return std::make_pair(pool_set, std::move(m));
-  }).then([this] (auto message) mutable {
-    std::map<int64_t, store_statfs_t> pool_stat;
-    auto pool_set = message.first;
-    auto m = std::move(message.second);
-    return seastar::do_with(std::move(m), 
-                            pool_stat, 
-                            pool_set, [this] (auto &&msg, 
-                                             auto &pool_stat,
-                                             auto &pool_set) {
-      return seastar::do_for_each(pool_set, [this, &pool_stat]
-      (auto& pool_id) {
-        return store.pool_statfs(pool_id).then([pool_id, &pool_stat](
-        store_statfs_t st) mutable {
-          pool_stat[pool_id] = st;
-        });
-      }).then([&pool_stat, msg=std::move(msg)] () mutable {
-        msg->pool_stat = std::move(pool_stat);
-        return seastar::make_ready_future<MessageURef>(std::move(msg));
-      });
-    });
-  });
+  }
+  m->pg_stat = std::move(stats);
+  m->pool_stat = std::move(pool_stat);
+  co_return std::move(m);
 }
 
 seastar::future<uint64_t> OSD::send_pg_stats()
 {
-  return get_shard_services().get_osd_stat().then([this](auto&& osd_stat) {
-    // mgr client sends the report message in background
-    mgrc->report();
-    return osd_stat.seq;
-  });
+  const auto osd_stat = co_await get_shard_services().get_osd_stat();
+  // mgr client sends the report message in background
+  mgrc->report();
+  co_return osd_stat.seq;
 }
 
 seastar::future<> OSD::handle_osd_map(Ref<MOSDMap> m)
@@ -1383,8 +1332,7 @@ seastar::future<> OSD::handle_pg_create(
   Ref<MOSDPGCreate2> m)
 {
   LOG_PREFIX(OSD::handle_pg_create);
-  return seastar::do_for_each(m->pgs, [FNAME, this, conn, m](auto& pg) {
-    auto& [pgid, when] = pg;
+  for (auto& [pgid, when] : m->pgs) {
     const auto &[created, created_stamp] = when;
     auto q = m->pg_extra.find(pgid);
     ceph_assert(q != m->pg_extra.end());
@@ -1401,19 +1349,18 @@ seastar::future<> OSD::handle_pg_create(
         "unmatched past_intervals {} (history {})",
         pgid, m->epoch,
         pi, history);
-        return seastar::now();
-    } else {
-      return pg_shard_manager.start_pg_operation<RemotePeeringEvent>(
-	  conn,
-	  pg_shard_t(),
-	  pgid,
-	  m->epoch,
-	  m->epoch,
-	  NullEvt(),
-	  true,
-	  new PGCreateInfo(pgid, m->epoch, history, pi, true)).second;
+      continue;
     }
-  });
+    co_await pg_shard_manager.start_pg_operation<RemotePeeringEvent>(
+      conn,
+      pg_shard_t(),
+      pgid,
+      m->epoch,
+      m->epoch,
+      NullEvt(),
+      true,
+      new PGCreateInfo(pgid, m->epoch, history, pi, true)).second;
+  }
 }
 
 seastar::future<> OSD::handle_update_log_missing(
@@ -1468,9 +1415,9 @@ seastar::future<> OSD::handle_scrub_command(
   LOG_PREFIX(OSD::handle_scrub_command);
   if (m->fsid != superblock.cluster_fsid) {
     WARN("fsid mismatched");
-    return seastar::now();
+    co_return;
   }
-  return seastar::parallel_for_each(std::move(m->scrub_pgs),
+  co_await seastar::parallel_for_each(std::move(m->scrub_pgs),
     [m, conn, this](spg_t pgid) {
     return pg_shard_manager.start_pg_operation<
       crimson::osd::ScrubRequested
@@ -1495,7 +1442,7 @@ seastar::future<> OSD::handle_mark_me_down(
   if (pg_shard_manager.is_prestop()) {
     got_stop_ack();
   }
-  return seastar::now();
+  co_return;
 }
 
 seastar::future<> OSD::handle_recovery_subreq(
@@ -1607,7 +1554,7 @@ OSD::handle_some_ec_messages(crimson::net::ConnectionRef conn, MessageRefT&& m)
   (void) pg_shard_manager.start_pg_operation<ECRepRequest>(
     std::move(conn),
     std::forward<MessageRefT>(m));
-  return seastar::now();
+  co_return;
 }
 
 
@@ -1616,14 +1563,11 @@ seastar::future<> OSD::restart()
   beacon_timer.cancel();
   tick_timer.cancel();
   stats_timer.cancel();
-  return pg_shard_manager.set_up_epoch(
-    0
-  ).then([this] {
-    bind_epoch = osdmap->get_epoch();
-    // TODO: promote to shutdown if being marked down for multiple times
-    // rebind messengers
-    return start_boot();
-  });
+  co_await pg_shard_manager.set_up_epoch(0);
+  bind_epoch = osdmap->get_epoch();
+  // TODO: promote to shutdown if being marked down for multiple times
+  // rebind messengers
+  co_await start_boot();
 }
 
 seastar::future<> OSD::shutdown()
@@ -1631,14 +1575,14 @@ seastar::future<> OSD::shutdown()
   LOG_PREFIX(OSD::shutdown);
   INFO("shutting down per osdmap");
   abort_source.request_abort();
-  return seastar::now();
+  co_return;
 }
 
 seastar::future<> OSD::send_beacon()
 {
   LOG_PREFIX(OSD::send_beacon);
   if (!pg_shard_manager.is_active()) {
-    return seastar::now();
+    co_return;
   }
   auto beacon = crimson::make_message<MOSDBeacon>(osdmap->get_epoch(),
                                     min_last_epoch_clean,
@@ -1646,7 +1590,7 @@ seastar::future<> OSD::send_beacon()
                                     local_conf()->osd_beacon_report_interval);
   beacon->pgs = min_last_epoch_clean_pgs;
   DEBUG("{}", *beacon);
-  return monc->send_message(std::move(beacon));
+  co_await monc->send_message(std::move(beacon));
 }
 
 seastar::future<double> OSD::run_bench(int64_t count, int64_t bsize, int64_t osize, int64_t onum) {
@@ -1726,7 +1670,7 @@ seastar::future<double> OSD::run_bench(int64_t count, int64_t bsize, int64_t osi
 seastar::future<> OSD::update_heartbeat_peers()
 {
   if (!pg_shard_manager.is_active()) {
-    return seastar::now();;
+    co_return;
   }
 
   pg_shard_manager.for_each_pgid([this](auto &pgid) {
@@ -1743,7 +1687,6 @@ seastar::future<> OSD::update_heartbeat_peers()
     }
   });
   heartbeat->update_peers(whoami);
-  return seastar::now();
 }
 
 seastar::future<> OSD::handle_peering_op(
@@ -1792,11 +1735,10 @@ seastar::future<> OSD::check_osdmap_features()
           to_string(last_require_osd_release),
           to_string(osdmap->require_osd_release));
     last_require_osd_release = osdmap->require_osd_release;
-    return store.write_meta(
+    co_await store.write_meta(
         "require_osd_release",
         stringify((int)osdmap->require_osd_release));
   }
-  return seastar::now();
 }
 
 seastar::future<> OSD::prepare_to_stop()
@@ -1808,9 +1750,10 @@ seastar::future<> OSD::prepare_to_stop()
 	std::chrono::duration<double>(
 	  local_conf().get_val<double>("osd_mon_shutdown_timeout")));
 
-    return seastar::with_timeout(
-      seastar::timer<>::clock::now() + timeout,
-      monc->send_message(
+    try {
+      co_await seastar::with_timeout(
+        seastar::timer<>::clock::now() + timeout,
+        monc->send_message(
 	  crimson::make_message<MOSDMarkMeDown>(
 	    monc->get_fsid(),
 	    whoami,
@@ -1818,13 +1761,9 @@ seastar::future<> OSD::prepare_to_stop()
 	    osdmap->get_epoch(),
 	    true)).then([this] {
 	return stop_acked.get_future();
-      })
-    ).handle_exception_type(
-      [](seastar::timed_out_error&) {
-      return seastar::now();
-    });
+      }));
+    } catch (seastar::timed_out_error&) {}
   }
-  return seastar::now();
 }
 
 }

From b9b725cab162c093109212b50a35b675a3c867a1 Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:19:27 +0100
Subject: [PATCH 280/596] doc: Replace Python 2 package names with Python 3
 equivalents

librados-intro.rst referenced ``python-rados`` for CentOS/RHEL.
rbd-openstack.rst referenced ``python-rbd`` for both apt and yum.
Python 2 reached end-of-life in January 2020; these package names
install the Python 2 bindings (or fail entirely) on current distros.
Replace with the correct Python 3 package names: python3-rados and
python3-rbd.

Fixes: https://tracker.ceph.com/issues/77200

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/rados/api/librados-intro.rst | 5 ++---
 doc/rbd/rbd-openstack.rst        | 4 ++--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/doc/rados/api/librados-intro.rst b/doc/rados/api/librados-intro.rst
index 4365482c01c..42d2dd62dfe 100644
--- a/doc/rados/api/librados-intro.rst
+++ b/doc/rados/api/librados-intro.rst
@@ -70,8 +70,7 @@ Getting librados for Python
 ---------------------------
 
 The ``rados`` module provides ``librados`` support to Python
-applications. You may install ``python3-rados`` for Debian, Ubuntu, SLE or
-openSUSE or the ``python-rados`` package for CentOS/RHEL.
+applications. You may install the ``python3-rados`` package.
 
 To install ``librados`` development support files for Python on Debian/Ubuntu
 distributions, execute the following:
@@ -85,7 +84,7 @@ distributions, execute the following:
 
 .. prompt:: bash $
 
-   sudo yum install python-rados
+   sudo yum install python3-rados
 
 To install ``librados`` development support files for Python on SLE/openSUSE
 distributions, execute the following:
diff --git a/doc/rbd/rbd-openstack.rst b/doc/rbd/rbd-openstack.rst
index 7d64b3548b9..e9a62c2a988 100644
--- a/doc/rbd/rbd-openstack.rst
+++ b/doc/rbd/rbd-openstack.rst
@@ -117,8 +117,8 @@ Install Ceph client packages
 
 On the ``glance-api`` node, you will need the Python bindings for ``librbd``::
 
-  sudo apt-get install python-rbd
-  sudo yum install python-rbd
+  sudo apt-get install python3-rbd
+  sudo yum install python3-rbd
 
 On the ``nova-compute``, ``cinder-backup`` and on the ``cinder-volume`` node,
 use both the Python bindings and the client command line tools::

From 3966415dab62d7ce250a8d14fdd762f94f0365bb Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:21:38 +0100
Subject: [PATCH 281/596] doc/install: Update mirrors.rst to use https and
 current release

All mirror URLs used insecure http://. Update to https://. The example
repository paths used debian-hammer and rpm-hammer (Hammer was EOL in
2016); update to the current stable release (tentacle). Also update
the GitHub mirroring link from the stale master branch to main.

Fixes: https://tracker.ceph.com/issues/77197

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/install/mirrors.rst | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/doc/install/mirrors.rst b/doc/install/mirrors.rst
index 11c60db8dc6..ef12f3a49bd 100644
--- a/doc/install/mirrors.rst
+++ b/doc/install/mirrors.rst
@@ -24,17 +24,18 @@ These mirrors are available on the following locations:
 - **US-West: US West Coast**: http://us-west.ceph.com/
 - **CN: China**: http://mirrors.ustc.edu.cn/ceph/
 
-You can replace all download.ceph.com URLs with any of the mirrors, for example:
+You can replace all ``download.ceph.com`` URLs with any of the mirrors,
+for example:
 
-- http://download.ceph.com/tarballs/
-- http://download.ceph.com/debian-hammer/
-- http://download.ceph.com/rpm-hammer/
+- https://download.ceph.com/tarballs/
+- https://download.ceph.com/debian-tentacle/
+- https://download.ceph.com/rpm-tentacle/
 
 Change this to:
 
-- http://eu.ceph.com/tarballs/
-- http://eu.ceph.com/debian-hammer/
-- http://eu.ceph.com/rpm-hammer/
+- https://eu.ceph.com/tarballs/
+- https://eu.ceph.com/debian-tentacle/
+- https://eu.ceph.com/rpm-tentacle/
 
 
 Mirroring
@@ -62,4 +63,4 @@ set for all mirrors. These can be found on `GitHub`_.
 If you want to apply for an official mirror, please contact the ceph-users mailinglist.
 
 
-.. _GitHub: https://github.com/ceph/ceph/tree/master/mirroring
+.. _GitHub: https://github.com/ceph/ceph/tree/main/mirroring

From 0531ac89504e07830f372640d28d95dd323b71a6 Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:24:52 +0100
Subject: [PATCH 282/596] doc/install: Update EOL version floor references in
 index.rst

The install overview cited Octopus (EOL 2022) as the cephadm minimum
and Nautilus (EOL 2021) as the Rook minimum. Update to Reef and Pacific
respectively, which are the currently supported release floor values.
Remove the repeated Nautilus/Octopus codename references in the
ceph-ansible paragraph, as these are historical release names not
needed to convey the message.

Fixes: https://tracker.ceph.com/issues/77192

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/install/index.rst | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/doc/install/index.rst b/doc/install/index.rst
index ed3dec18888..5be6dda1ffa 100644
--- a/doc/install/index.rst
+++ b/doc/install/index.rst
@@ -12,7 +12,6 @@ Recommended methods
 :ref:`Cephadm <cephadm_deploying_new_cluster>` is a tool that can be used to
 install and manage a Ceph cluster.
 
-* cephadm supports only Octopus and newer releases.
 * cephadm is fully integrated with the orchestration API and fully supports the
   CLI and dashboard features that are used to manage cluster deployment.
 * cephadm requires container support (in the form of Podman or Docker) and
@@ -24,7 +23,6 @@ in Kubernetes, while also enabling management of storage resources and
 provisioning via Kubernetes APIs. We recommend Rook as the way to run Ceph in
 Kubernetes or to connect an existing Ceph storage cluster to Kubernetes.
 
-* Rook supports only Nautilus and newer releases of Ceph.
 * Rook is the preferred method for running Ceph on Kubernetes, or for
   connecting a Kubernetes cluster to an existing (external) Ceph
   cluster.
@@ -34,15 +32,6 @@ Kubernetes or to connect an existing Ceph storage cluster to Kubernetes.
 Other methods
 ~~~~~~~~~~~~~
 
-`ceph-ansible <https://docs.ceph.com/ceph-ansible/>`_ deploys and manages
-Ceph clusters using Ansible.
-
-* ceph-ansible is widely deployed.
-* ceph-ansible is not integrated with the orchestrator APIs that were
-  introduced in Nautilus and Octopus, which means that the management features
-  and dashboard integration introduced in Nautilus and Octopus are not
-  available in Ceph clusters deployed by means of ceph-ansible.
-
 `ceph-salt <https://github.com/ceph/ceph-salt>`_ installs Ceph using Salt and cephadm.
 
 `jaas.ai/ceph-mon <https://jaas.ai/ceph-mon>`_ installs Ceph using Juju.

From be52c92ace53387cb578a938c82cee6af4689261 Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:34:31 +0100
Subject: [PATCH 283/596] doc/rados/configuration: Fix FileStore contradiction
 in journal-ref.rst

The page carried a deprecation warning on line 4 stating FileStore
"is no longer supported" but line 10 said "Filestore is preferred for
new deployments" -- a direct contradiction. Fix by:

- Expanding the warning to explicitly state FileStore must not be used
  for new deployments and to use BlueStore instead
- Updating the intro paragraph to reflect that BlueStore is the
  default and recommended back end, and that this page is for
  pre-existing Filestore OSDs pending migration only

Fixes: https://tracker.ceph.com/issues/77183

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/rados/configuration/journal-ref.rst | 31 ++++---------------------
 1 file changed, 5 insertions(+), 26 deletions(-)

diff --git a/doc/rados/configuration/journal-ref.rst b/doc/rados/configuration/journal-ref.rst
index ea87f9ac9c3..7bb72238750 100644
--- a/doc/rados/configuration/journal-ref.rst
+++ b/doc/rados/configuration/journal-ref.rst
@@ -1,34 +1,13 @@
 ==========================
  Journal Config Reference
 ==========================
-.. warning:: Filestore has been deprecated in the Reef release and is no longer supported.
+.. warning:: Filestore is not supported. Migrate existing Filestore OSDs to
+   BlueStore. See :ref:`rados_operations_bluestore_migration`.
+
 .. index:: journal; journal configuration
 
-Filestore OSDs use a journal for two reasons: speed and consistency.  Note
-that since Luminous, the BlueStore OSD back end has been preferred and default.
-This information is provided for pre-existing OSDs and for rare situations where
-Filestore is preferred for new deployments.
-
-- **Speed:** The journal enables the Ceph OSD Daemon to commit small writes 
-  quickly. Ceph writes small, random I/O to the journal sequentially, which 
-  tends to speed up bursty workloads by allowing the backing file system more 
-  time to coalesce writes. The Ceph OSD Daemon's journal, however, can lead 
-  to spiky performance with short spurts of high-speed writes followed by 
-  periods without any write progress as the file system catches up to the 
-  journal.
-
-- **Consistency:** Ceph OSD Daemons require a file system interface that 
-  guarantees atomic compound operations. Ceph OSD Daemons write a description 
-  of the operation to the journal and apply the operation to the file system. 
-  This enables atomic updates to an object (for example, placement group 
-  metadata). Every few seconds--between ``filestore max sync interval`` and
-  ``filestore min sync interval``--the Ceph OSD Daemon stops writes and 
-  synchronizes the journal with the file system, allowing Ceph OSD Daemons to 
-  trim operations from the journal and reuse the space. On failure, Ceph 
-  OSD Daemons replay the journal starting after the last synchronization 
-  operation.
-
-Ceph OSD Daemons recognize the following journal settings: 
+The following journal settings are provided for reference to assist with
+migration of existing Filestore OSDs to BlueStore.
 
 .. confval:: journal_dio
 .. confval:: journal_aio

From a3a347e6d1352dd286fdd3dba416d7971c64753b Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 9 Jun 2026 13:35:34 +0100
Subject: [PATCH 284/596] doc/rados/operations: Strengthen cache-tiering
 deprecation notice

The existing warning hedged with "this does not mean it will certainly
be removed", softening the message for a deprecated feature. Operators
scanning the page may begin a how-to setup without reading past the
introductory prose.

- Remove the hedging language; state plainly that cache tiering may be
  removed without further notice
- Add a bold "Do not deploy new cache tiers" directive
- Add a note immediately before the how-to content scoping the page
  to existing deployments only, with a pointer to preferred alternatives

Fixes: https://tracker.ceph.com/issues/77184

Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/rados/operations/cache-tiering.rst | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/doc/rados/operations/cache-tiering.rst b/doc/rados/operations/cache-tiering.rst
index f9edf936fb8..a1f8e49a933 100644
--- a/doc/rados/operations/cache-tiering.rst
+++ b/doc/rados/operations/cache-tiering.rst
@@ -2,14 +2,16 @@
  Cache Tiering
 ===============
 
-.. warning:: Cache tiering has been deprecated in the Reef release. Cache
-   tiering has lacked a maintainer for a long time. This does not mean that
-   it will certainly be removed, but it might be removed without much
-   notice.
+.. warning:: Cache tiering was deprecated in the Reef release and has lacked
+   a maintainer for a long time. It will be removed in a future release without
+   notice. **Do not deploy new cache tiers.** Migrate existing cache
+   tier deployments as soon as possible.
 
-   The upstream Ceph community strongly advises against deploying new cache
-   tiers. The upstream Ceph community also recommends migrating from legacy
-   deployments.
+.. note:: The following documentation is retained for reference for existing
+   deployments only. For new deployments, use erasure-coded pools or fast
+   storage pools directly. As a community-supported block-level caching
+   alternative, consider ``dm-cache`` (the Linux kernel's device-mapper cache
+   target).
 
 A cache tier provides Ceph clients with better I/O performance for a subset of
 the data stored in a backing storage tier. Cache tiering involves creating a

From d814088ce7d0297e134bb0f3894a11c53d7a554a Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sat, 13 Jun 2026 10:23:39 +0800
Subject: [PATCH 285/596] python-common/cryptotools: reimplement on top of
 cryptography

the last change dropped X509Req, but InternalCryptoCaller still uses
pyOpenSSL, which keeps deprecating and removing its OpenSSL.crypto and
OpenSSL.SSL APIs. pyOpenSSL's own README [1] says:

  If you are using pyOpenSSL for anything other than making a TLS
  connection you should move to cryptography and drop your pyOpenSSL
  dependency.

none of this module makes a TLS connection, and we already depend on
cryptography and use it in cephadm/ssl_cert_utils.py.

so reimplement the caller with cryptography:

- create_private_key(): rsa.generate_private_key() dumped as PKCS8 PEM,
  the same format pyOpenSSL produced.
- create_self_signed_cert(): x509.CertificateBuilder, with the dname
  fields mapped to their NameOIDs.
- _load_cert() and get_cert_issuer_info(): load_pem_x509_certificate()
  and cert.issuer.
- certificate_days_to_expire(): cert.not_valid_after.
- verify_tls(): compare the cert's and the key's public keys instead of
  loading them into an SSL.Context.

password_hash() and verify_password() already used bcrypt, so they are
left as is. the output formats and error behavior are unchanged, hence
the existing tls tests pass without changes.

[1] https://github.com/pyca/pyopenssl/blob/main/README.rst

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/mypy.ini                                  |   3 +
 .../ceph/cryptotools/internal.py              | 161 ++++++++++--------
 2 files changed, 96 insertions(+), 68 deletions(-)

diff --git a/src/mypy.ini b/src/mypy.ini
index 9fe2f82a535..0be1f430484 100755
--- a/src/mypy.ini
+++ b/src/mypy.ini
@@ -34,6 +34,9 @@ ignore_errors = True
 [mypy-OpenSSL]
 ignore_missing_imports = True
 
+[mypy-cryptography,cryptography.*]
+ignore_missing_imports = True
+
 [mypy-prettytable]
 ignore_missing_imports = True
 
diff --git a/src/python-common/ceph/cryptotools/internal.py b/src/python-common/ceph/cryptotools/internal.py
index db3d6a5c048..b5410f1177e 100644
--- a/src/python-common/ceph/cryptotools/internal.py
+++ b/src/python-common/ceph/cryptotools/internal.py
@@ -1,25 +1,43 @@
 """Internal execution of cryptographic functions for the ceph mgr
 """
 
-from typing import Dict, Any, Tuple, Union
+from typing import Any, Dict, NoReturn, Tuple, Union
 
 from uuid import uuid4
 import datetime
 import warnings
 
-from OpenSSL import crypto, SSL
 import bcrypt
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.serialization import load_pem_private_key
+from cryptography.x509.oid import NameOID
 
 
 from .caller import CryptoCaller, CryptoCallError
 
 
+# the relative distinguished names accepted by create_self_signed_cert(),
+# mapped to their x509 object identifiers. mgr_util validates the dname
+# fields against the same set before we get here.
+_RDN_OIDS = {
+    'C': NameOID.COUNTRY_NAME,
+    'ST': NameOID.STATE_OR_PROVINCE_NAME,
+    'L': NameOID.LOCALITY_NAME,
+    'O': NameOID.ORGANIZATION_NAME,
+    'OU': NameOID.ORGANIZATIONAL_UNIT_NAME,
+    'CN': NameOID.COMMON_NAME,
+    'emailAddress': NameOID.EMAIL_ADDRESS,
+}
+
+
 class InternalError(CryptoCallError):
     pass
 
 
 class InternalCryptoCaller(CryptoCaller):
-    def fail(self, msg: str) -> None:
+    def fail(self, msg: str) -> NoReturn:
         raise InternalError(msg)
 
     def password_hash(self, password: str, salt_password: str) -> str:
@@ -36,93 +54,100 @@ class InternalCryptoCaller(CryptoCaller):
         return ok
 
     def create_private_key(self) -> str:
-        pkey = crypto.PKey()
-        pkey.generate_key(crypto.TYPE_RSA, 2048)
-        return crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey).decode()
+        pkey = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        # PKCS8 PEM, the format pyOpenSSL's dump_privatekey() produced
+        return pkey.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.PKCS8,
+            encryption_algorithm=serialization.NoEncryption(),
+        ).decode()
 
     def create_self_signed_cert(
         self, dname: Dict[str, str], pkey: str
     ) -> str:
-        _pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, pkey)
+        _pkey: Any = load_pem_private_key(pkey.encode(), password=None)
 
-        # create a self-signed cert and populate its subject with the dname
-        # settings
-        cert = crypto.X509()
-        subj = cert.get_subject()
+        # build the subject, which is also the issuer as the cert is
+        # self-signed, from the dname settings
+        attrs = []
         for k, v in dname.items():
-            setattr(subj, k, v)
-        cert.set_subject(subj)
-        cert.set_serial_number(int(uuid4()))
-        cert.gmtime_adj_notBefore(0)
-        cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)  # 10 years
-        cert.set_issuer(cert.get_subject())
-        cert.set_pubkey(_pkey)
-        cert.sign(_pkey, 'sha512')
-        return crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode()
+            oid = _RDN_OIDS.get(k)
+            if oid is None:
+                self.fail('unsupported certificate subject field: %s' % k)
+            attrs.append(x509.NameAttribute(oid, v))
+        name = x509.Name(attrs)
 
-    def _load_cert(self, crt: Union[str, bytes]) -> Any:
+        now = datetime.datetime.now(datetime.timezone.utc)
+        cert = (
+            x509.CertificateBuilder()
+            .subject_name(name)
+            .issuer_name(name)
+            .public_key(_pkey.public_key())
+            .serial_number(int(uuid4()))
+            .not_valid_before(now)
+            .not_valid_after(now + datetime.timedelta(days=10 * 365))
+            .sign(_pkey, hashes.SHA512())
+        )
+        return cert.public_bytes(serialization.Encoding.PEM).decode()
+
+    def _load_cert(self, crt: Union[str, bytes]) -> x509.Certificate:
         crt_buffer = crt.encode() if isinstance(crt, str) else crt
         try:
-            cert = crypto.load_certificate(crypto.FILETYPE_PEM, crt_buffer)
-        except (ValueError, crypto.Error) as e:
+            cert = x509.load_pem_x509_certificate(crt_buffer)
+        except ValueError as e:
             self.fail('Invalid certificate: %s' % str(e))
         return cert
 
-    def _issuer_info(self, cert: Any) -> Tuple[str, str]:
-        components = cert.get_issuer().get_components()
-        org_name = cn = ''
-        for c in components:
-            if c[0].decode() == 'O':  # org comp
-                org_name = c[1].decode()
-            elif c[0].decode() == 'CN':  # common name comp
-                cn = c[1].decode()
+    def _name_value(self, name: x509.Name, oid: x509.ObjectIdentifier) -> str:
+        attrs = name.get_attributes_for_oid(oid)
+        if not attrs:
+            return ''
+        # cryptography types NameAttribute.value as str in some releases and
+        # str | bytes in others; keep it Any so the bytes path type-checks
+        # either way (like the other cryptography objects in this file).
+        value: Any = attrs[0].value
+        return value if isinstance(value, str) else value.decode('utf-8')
+
+    def _issuer_info(self, cert: x509.Certificate) -> Tuple[str, str]:
+        org_name = self._name_value(cert.issuer, NameOID.ORGANIZATION_NAME)
+        cn = self._name_value(cert.issuer, NameOID.COMMON_NAME)
         return (org_name, cn)
 
     def certificate_days_to_expire(self, crt: str) -> int:
-        x509 = self._load_cert(crt)
-        no_after = x509.get_notAfter()
-        if not no_after:
-            self.fail("Certificate does not have an expiration date.")
-
-        end_date = datetime.datetime.strptime(
-            no_after.decode(), '%Y%m%d%H%M%SZ'
-        )
-
-        if x509.has_expired():
-            org, cn = self._issuer_info(x509)
-            msg = 'Certificate issued by "%s/%s" expired on %s' % (
-                org,
-                cn,
-                end_date,
-            )
-            self.fail(msg)
-
-        # Certificate still valid, calculate and return days until expiration
+        cert = self._load_cert(crt)
+        # not_valid_after is naive UTC; not_valid_after_utc only exists since
+        # cryptography 42, so stick with the portable accessor and silence
+        # its deprecation warning, same as for utcnow().
         with warnings.catch_warnings():
-            warnings.simplefilter("ignore")
-            days_until_exp = (end_date - datetime.datetime.utcnow()).days
-        return int(days_until_exp)
+            warnings.simplefilter('ignore')
+            not_after = cert.not_valid_after
+            now = datetime.datetime.utcnow()
+
+        if now > not_after:
+            org, cn = self._issuer_info(cert)
+            self.fail(
+                'Certificate issued by "%s/%s" expired on %s'
+                % (org, cn, not_after)
+            )
+
+        return int((not_after - now).days)
 
     def get_cert_issuer_info(self, crt: str) -> Tuple[str, str]:
         return self._issuer_info(self._load_cert(crt))
 
     def verify_tls(self, crt: str, key: str) -> None:
         try:
-            _key = crypto.load_privatekey(crypto.FILETYPE_PEM, key)
-            _key.check()
-        except (ValueError, crypto.Error) as e:
+            _key: Any = load_pem_private_key(key.encode(), password=None)
+        except (ValueError, TypeError) as e:
             self.fail('Invalid private key: %s' % str(e))
-        _crt = self._load_cert(crt)
-        try:
-            context = SSL.Context(SSL.TLSv1_METHOD)
-            with warnings.catch_warnings():
-                warnings.simplefilter("ignore")
-                context.use_certificate(_crt)
-                context.use_privatekey(_key)
-            context.check_privatekey()
-        except crypto.Error as e:
+        _crt: Any = self._load_cert(crt)
+        # the cert and key match iff they share the same public key
+        pem = serialization.Encoding.PEM
+        spki = serialization.PublicFormat.SubjectPublicKeyInfo
+        key_pub = _key.public_key().public_bytes(pem, spki)
+        crt_pub = _crt.public_key().public_bytes(pem, spki)
+        if key_pub != crt_pub:
             self.fail(
-                'Private key and certificate do not match up: %s' % str(e)
+                'Invalid cert/key pair: '
+                'private key and certificate do not match up'
             )
-        except SSL.Error as e:
-            self.fail(f'Invalid cert/key pair: {e}')

From e5c20fa6a8c8ec030253428c77a8142e22d915ec Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Sun, 14 Jun 2026 09:19:20 +0000
Subject: [PATCH 286/596] crimson,crimson/test: clean-up 'unused' warnings

Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 src/crimson/net/io_handler.cc                  | 1 +
 src/crimson/os/seastore/object_data_handler.cc | 1 +
 src/crimson/os/seastore/transaction_manager.cc | 2 +-
 src/crimson/osd/ec_backend.cc                  | 1 +
 src/test/crimson/seastore/test_cbjournal.cc    | 4 ++--
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/crimson/net/io_handler.cc b/src/crimson/net/io_handler.cc
index c08bdc87422..f9e9198c748 100644
--- a/src/crimson/net/io_handler.cc
+++ b/src/crimson/net/io_handler.cc
@@ -1266,6 +1266,7 @@ IOHandler::close_io(
   } else {
     return shard_states->close(
     ).then([this] {
+      std::ignore = this; // as we are 'assert'ing, not ceph_assert'ing
       assert(shard_states->assert_closed_and_exit());
     });
   }
diff --git a/src/crimson/os/seastore/object_data_handler.cc b/src/crimson/os/seastore/object_data_handler.cc
index a586a606d68..65e6b9cf47c 100644
--- a/src/crimson/os/seastore/object_data_handler.cc
+++ b/src/crimson/os/seastore/object_data_handler.cc
@@ -1453,6 +1453,7 @@ ObjectDataHandler::clear_ret ObjectDataHandler::trim_data_reservation(
     ctx.t, unaligned_begin.get_aligned_laddr(ctx.tm.get_block_size())
   ).si_then([ctx, data_base, size, this,
 	    unaligned_begin, &object_data](auto mapping) {
+    std::ignore = unaligned_begin;
     assert(mapping.get_key() <= unaligned_begin &&
       mapping.get_key() + mapping.get_length() > unaligned_begin);
     auto data_len = object_data.get_reserved_data_len();
diff --git a/src/crimson/os/seastore/transaction_manager.cc b/src/crimson/os/seastore/transaction_manager.cc
index f0e586220b9..62d24945517 100644
--- a/src/crimson/os/seastore/transaction_manager.cc
+++ b/src/crimson/os/seastore/transaction_manager.cc
@@ -945,7 +945,7 @@ TransactionManager::move_region(
             ).handle_error_interruptible(
               move_region_iertr::pass_further(),
               crimson::ct_error::assert_all("invalid error"));
-            auto off = 0;
+            [[maybe_unused]] auto off = 0;
             auto bl = maybe_indirect_extent.get_range(
               src.get_intermediate_offset(),
               src.get_length());
diff --git a/src/crimson/osd/ec_backend.cc b/src/crimson/osd/ec_backend.cc
index 368d29c7147..4ce37c77920 100644
--- a/src/crimson/osd/ec_backend.cc
+++ b/src/crimson/osd/ec_backend.cc
@@ -457,6 +457,7 @@ ECBackend::handle_rep_write_op(
   return handle_sub_write(
     m->op.from, std::move(m->op), pg
   ).si_then([&pg] {
+    std::ignore = pg;
     assert(!pg.pgb_is_primary());
     return write_iertr::now();
   }, crimson::ct_error::assert_all("unexpected error"));
diff --git a/src/test/crimson/seastore/test_cbjournal.cc b/src/test/crimson/seastore/test_cbjournal.cc
index ffd9c96c938..c97b771cf3b 100644
--- a/src/test/crimson/seastore/test_cbjournal.cc
+++ b/src/test/crimson/seastore/test_cbjournal.cc
@@ -249,7 +249,7 @@ struct cbjournal_test_t : public seastar_test_suite_t, JournalTrimmer
 	     auto &dirty_seq,
 	     auto &alloc_seq,
 	     auto last_modified) {
-      bool found = false;
+      [[maybe_unused]] bool found = false;
       for (auto &i : entries) {
 	paddr_t base = offsets.write_result.start_seq.offset; 
 	rbm_abs_addr addr = convert_paddr_to_abs_addr(base);
@@ -583,7 +583,7 @@ TEST_F(cbjournal_test_t, multiple_submit_at_end)
 	  }
 	});
       }).get();
-    auto old_written_to = get_written_to();
+    [[maybe_unused]] auto old_written_to = get_written_to();
     cbj->close().unsafe_get();
     cbj->replay(
       [](const auto &offsets,

From a803d372ade421a583be2f5c39f0500ab7a0d1e1 Mon Sep 17 00:00:00 2001
From: David Galloway <david.galloway@ibm.com>
Date: Wed, 17 Jun 2026 08:53:12 -0400
Subject: [PATCH 287/596] Containerfile: Support pulp repo URLs

Signed-off-by: David Galloway <david.galloway@ibm.com>
---
 container/Containerfile | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/container/Containerfile b/container/Containerfile
index d277de30dad..9cc72d164b9 100644
--- a/container/Containerfile
+++ b/container/Containerfile
@@ -124,7 +124,16 @@ RUN --mount=type=secret,id=prerelease_creds set -ex && \
         source /run/secrets/prerelease_creds; \
         REPO_URL="https://${PRERELEASE_USERNAME}:${PRERELEASE_PASSWORD}@download.ceph.com/prerelease/ceph/rpm-${CEPH_REF}/${EL_VER}/" ;\
     fi && \
-    rpm -Uvh "$REPO_URL/noarch/ceph-release-1-${IS_RELEASE}.${EL_VER}.noarch.rpm" ; \
+    # Trim trailing slashes
+    REPO_URL="${REPO_URL%/}" && \
+    if [[ "$REPO_URL" == */pulp/content/* ]] ; then \
+        # Pulp nests packages under noarch/Packages/<first-letter>/
+        CEPH_RELEASE_RPM="$REPO_URL/noarch/Packages/c/ceph-release-1-${IS_RELEASE}.${EL_VER}.noarch.rpm" ; \
+    else \
+        # chacra serves packages flat under noarch/
+        CEPH_RELEASE_RPM="$REPO_URL/noarch/ceph-release-1-${IS_RELEASE}.${EL_VER}.noarch.rpm" ; \
+    fi && \
+    rpm -Uvh "$CEPH_RELEASE_RPM" ; \
     if [[ "$IS_RELEASE" == 1 ]] ; then \
         sed -i "s;http://download.ceph.com/;https://${PRERELEASE_USERNAME}:${PRERELEASE_PASSWORD}@download.ceph.com/prerelease/ceph/;" /etc/yum.repos.d/ceph.repo ; \
         dnf clean expire-cache ; \

From 3a9ae41e2a8fd614d67e3dac39d28ddf5dd6ca4a Mon Sep 17 00:00:00 2001
From: "Matthew N. Heler" <matthew.heler@hotmail.com>
Date: Sun, 17 May 2026 20:57:01 -0500
Subject: [PATCH 288/596] mon: add monitor RocksDB backup and restore

Implements an opt-in backup mechanism for the monitor using
rocksdb::BackupEngine. Backups run on a schedule when
mon_backup_interval is set, or are triggered manually via
`ceph tell mon.* backup`. Cleanup keeps the last N, hourly,
and daily snapshots, with a free-space guard. Off by default.

Restore is offline: stop the mon and run
  ceph-mon --restore-backup <dir> --yes-i-really-mean-it
optionally with --backup-version (BackupEngine logical version,
as shown by --list-backups). The mon keyring is stashed alongside
the RocksDB backup so a wiped mon_data is recovered end-to-end,
and kv_backend is stamped back when missing.

Co-authored-by: Daniel Poelzleithner <poelzleithner@b1-systems.de>
Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
---
 doc/rados/configuration/mon-config-ref.rst    | 355 ++++++++++++++++++
 .../troubleshooting/troubleshooting-mon.rst   |  91 +++++
 src/ceph_mon.cc                               |  75 +++-
 src/common/options/mon.yaml.in                |  68 ++++
 src/kv/KeyValueDB.cc                          |  50 +++
 src/kv/KeyValueDB.h                           |  47 ++-
 src/kv/RocksDBStore.cc                        | 283 +++++++++++++-
 src/kv/RocksDBStore.h                         |  21 ++
 src/mon/CMakeLists.txt                        |   1 +
 src/mon/Monitor.cc                            |  93 ++++-
 src/mon/Monitor.h                             |  26 ++
 src/mon/MonitorBackup.cc                      | 214 +++++++++++
 src/mon/MonitorBackup.h                       | 101 +++++
 src/mon/MonitorDBStore.h                      | 233 +++++++++++-
 src/vstart.sh                                 |   1 +
 15 files changed, 1641 insertions(+), 18 deletions(-)
 create mode 100644 src/mon/MonitorBackup.cc
 create mode 100644 src/mon/MonitorBackup.h

diff --git a/doc/rados/configuration/mon-config-ref.rst b/doc/rados/configuration/mon-config-ref.rst
index 18006d0611b..85c003f16b5 100644
--- a/doc/rados/configuration/mon-config-ref.rst
+++ b/doc/rados/configuration/mon-config-ref.rst
@@ -600,6 +600,361 @@ is far outweighed by the number of accidental pool (and thus data) deletions it
 
 For more information about the pool flags see :ref:`Pool values <setpoolvalues>`.
 
+Monitor backup
+==============
+
+In normal operation, Monitor backups are not required: surviving members
+of the Monitor quorum re-sync new or replaced Monitors automatically,
+and the Monitor store can be largely rebuilt from the OSDs after total
+quorum loss (see :ref:`mon-store-recovery-using-osds`).
+
+However, ``mon-store-recovery-using-osds`` only recovers state that the
+OSDs can report: osdmap history, auth keys associated with running
+OSDs, and similar. Some Monitor state has no copy outside the Monitor
+store and is unrecoverable if all Monitors are lost:
+
+* **Encryption keys for dm-crypt OSDs** are stored only in the
+  Monitor's ``config-key`` store under
+  ``dm-crypt/osd/<osd-uuid>/luks``. Without these keys the underlying
+  block devices cannot be unlocked, even when the OSD daemons and data
+  are physically intact.
+* **Cephadm orchestrator state** under ``mgr/cephadm/*`` in the
+  ``config-key`` store, including host inventory, daemon placement
+  specs, and service definitions.
+* **Config-key entries** populated by users or third-party tooling via
+  ``ceph config-key set``.
+* **Dashboard and manager module state** persisted to the
+  ``config-key`` store.
+
+A Monitor backup lets an operator restore this state if all running
+Monitors are lost. It is most valuable for clusters that use
+dm-crypt-encrypted OSDs or that depend heavily on cephadm-managed
+deployment state, where loss of the Monitor store would be a
+protracted data-availability incident rather than a recoverable inconvenience.
+
+Monitor backups complement, but do not replace, the existing Monitor
+recovery procedures. They are not a means of "undoing" cluster-level
+operations such as pool deletion or CRUSH changes: once OSDs have
+observed and acted on a newer osdmap, restoring an older Monitor store
+does not roll back the OSD-side effects.
+
+The Ceph Monitor uses the native RocksDB ``BackupEngine`` to create
+consistent snapshots of its store, which can be copied elsewhere
+without downtime.
+
+When :confval:`mon_backup_interval` is set, a backup is triggered every
+N seconds. Pair it with :confval:`mon_backup_cleanup_interval`; if only
+the backup interval is set, backups accumulate indefinitely because
+retention is only applied during cleanup.
+
+Backups share table files (``.sst``) within the backup directory: each
+new backup only copies SSTables that the running database has produced
+since the previous backup. Restoring any individual backup version is
+independent of the others, but the on-disk files for every version
+live in a single shared tree under ``mon_backup_path``.
+
+Layout of the backup directory
+------------------------------
+
+A backup path managed by the RocksDB ``BackupEngine`` contains three
+top-level directories plus a per-version copy of the Monitor keyring::
+
+   /path/to/backups/
+   ├── meta/
+   │   ├── 1
+   │   ├── 2
+   │   └── 3
+   ├── private/
+   │   ├── 1/
+   │   ├── 2/
+   │   └── 3/
+   ├── shared_checksum/
+   │   ├── 000007.sst
+   │   ├── 000010.sst
+   │   └── ...
+   ├── keyring.1
+   ├── keyring.2
+   └── keyring.3
+
+* ``meta/<N>`` is a metadata file describing logical backup version
+  ``N``.
+* ``private/<N>/`` contains files unique to backup ``N`` (RocksDB
+  descriptors and other per-version state).
+* ``shared_checksum/`` contains SSTables shared across backup
+  versions. A single SSTable in this directory may belong to several
+  versions; the BackupEngine deletes a file from here only when no
+  remaining backup references it.
+* ``keyring.<N>`` is a copy of ``$mon_data/keyring`` taken at the time
+  of backup ``N``. The Monitor needs this key to authenticate at
+  startup, and it is not stored inside the RocksDB database; restoring
+  version ``N`` copies the matching ``keyring.<N>`` back into
+  ``$mon_data`` so an older snapshot is paired with the keyring of its
+  vintage. Cleanup removes ``keyring.<N>`` files whose backup version
+  has been pruned.
+
+  Stashing the keyring is **best effort**: if the copy fails (for
+  example, permission denied on the backup directory or out of space
+  after the RocksDB snapshot completed), the backup is still recorded
+  as successful and the RocksDB data remains usable. On restore, a
+  missing ``keyring.<N>`` is silently skipped, and the operator must
+  supply the Monitor keyring out-of-band before starting the daemon.
+
+.. warning::
+
+   The backup directory contains the ``[mon.]`` private key. Treat
+   it with the same access controls as ``$mon_data`` itself; a
+   complete backup is sufficient material to impersonate a Monitor
+   in the cluster.
+
+Do not delete a ``private/<N>/`` directory or files under
+``shared_checksum/`` by hand: removing a referenced shared file
+corrupts every backup that points to it. Use ``backup_cleanup`` or
+the configured retention parameters to remove old versions so the
+BackupEngine can release shared files safely.
+
+If the Monitor cluster fails and you need to copy a backup elsewhere,
+copy the entire ``/path/to/backups/`` directory. Copying only
+``private/<N>/`` is not sufficient; the version's SSTables live in
+``shared_checksum/``.
+
+
+The :confval:`mon_backup_cleanup_interval` specifies the interval for
+backup cleanup. The cleanup algorithm keeps the last
+``mon_backup_keep_last`` backups. It then collects hourly
+``mon_backup_keep_hourly`` and daily ``mon_backup_keep_daily``
+versions, retaining the newest backup in each time window.
+
+You can trigger ``backup`` and ``backup_cleanup`` through any running
+Monitor's admin socket.
+
+.. prompt:: bash #
+
+   ceph --admin-daemon .../mon.asok backup
+
+.. prompt:: bash #
+
+   ceph --admin-daemon .../mon.asok backup_cleanup
+
+The following metrics related to the monitor backup process are
+tracked by ``ceph-mon``.
+
+.. list-table:: Ceph Monitor Backup Metrics
+   :widths: 30 12 58
+   :header-rows: 1
+
+   * - Name
+     - Type
+     - Description
+   * - ``backup_running``
+     - Gauge
+     - ``1`` while a backup is in progress, ``0`` otherwise
+   * - ``backup_started``
+     - Counter
+     - Backup attempts (includes attempts rejected at the :confval:`mon_backup_min_avail` pre-flight check)
+   * - ``backup_success``
+     - Counter
+     - Backups completed by the ``BackupEngine``
+   * - ``backup_failed``
+     - Counter
+     - Failed backup attempts (pre-flight or ``BackupEngine``)
+   * - ``backup_duration``
+     - Average
+     - Backup wall-clock time
+   * - ``backup_last_success``
+     - Gauge
+     - UTC timestamp of the most recent successful backup, or ``0`` if none
+   * - ``backup_last_success_id``
+     - Gauge
+     - ``BackupEngine`` version ID of the most recent successful backup (the value passed to ``--restore-backup --backup-version``)
+   * - ``backup_last_failed``
+     - Gauge
+     - UTC timestamp of the most recent failed attempt, or ``0`` if none
+   * - ``backup_last_size``
+     - Gauge
+     - Payload size in bytes of the most recent attempt (may be partial on failure)
+   * - ``backup_last_files``
+     - Gauge
+     - File count of the most recent attempt (may be partial on failure)
+   * - ``backup_cleanup_started``
+     - Counter
+     - Cleanup invocations
+   * - ``backup_cleanup_running``
+     - Gauge
+     - ``1`` while a cleanup is in progress, ``0`` otherwise
+   * - ``backup_cleanup_success``
+     - Counter
+     - Cleanup passes completed without error
+   * - ``backup_cleanup_failed``
+     - Counter
+     - Failed cleanup passes
+   * - ``backup_cleanup_duration``
+     - Average
+     - Cleanup wall-clock time
+   * - ``backup_cleanup_kept``
+     - Gauge
+     - Backups retained by the most recent cleanup pass
+   * - ``backup_cleanup_deleted``
+     - Gauge
+     - Backups removed by the most recent cleanup pass
+   * - ``backup_cleanup_freed``
+     - Gauge
+     - Bytes released by the most recent cleanup pass (overstated when shared backups are in use, because the ``BackupEngine`` payload sum ignores file sharing)
+   * - ``backup_cleanup_size``
+     - Gauge
+     - Bytes retained by the most recent cleanup pass (same sharing caveat as ``backup_cleanup_freed``)
+
+The ``backup_started``/``backup_success``/``backup_failed`` and
+``backup_cleanup_started``/``backup_cleanup_success``/``backup_cleanup_failed``
+counters are monotonic and accumulate for the lifetime of the
+``ceph-mon`` process. The ``backup_last_*`` fields and the four
+cleanup result gauges (``backup_cleanup_kept``, ``backup_cleanup_deleted``,
+``backup_cleanup_freed``, ``backup_cleanup_size``) describe only the
+most recent invocation and are overwritten on every pass.
+
+To retrieve backup metrics from a running monitor's admin socket:
+
+.. prompt:: bash #
+
+   ceph --admin-daemon .../mon.asok perf dump | jq '.["mon"] | with_entries(select(.key | startswith("backup_")))'
+
+.. code-block:: json
+
+   {
+     "backup_running": 0,
+     "backup_started": 2,
+     "backup_success": 2,
+     "backup_failed": 0,
+     "backup_duration": {
+       "avgcount": 2,
+       "sum": 0.149076498,
+       "avgtime": 0.074538249
+     },
+     "backup_last_success": 1722001989.849262,
+     "backup_last_success_id": 3,
+     "backup_last_failed": 0,
+     "backup_last_size": 3924677,
+     "backup_last_files": 6,
+     "backup_cleanup_started": 1,
+     "backup_cleanup_running": 0,
+     "backup_cleanup_success": 1,
+     "backup_cleanup_failed": 0,
+     "backup_cleanup_size": 86144,
+     "backup_cleanup_kept": 1,
+     "backup_cleanup_duration": {
+       "avgcount": 1,
+       "sum": 0.002031246,
+       "avgtime": 0.002031246
+     },
+     "backup_cleanup_freed": 0,
+     "backup_cleanup_deleted": 0
+   }
+
+Monitor Backup Metric Usage Examples
+------------------------------------
+
+The following examples show how to use the monitor backup performance
+counters. PromQL examples assume that the ``ceph-exporter`` is being
+scraped by Prometheus. Admin-socket examples use ``ceph daemon``
+directly against a specific ``ceph-mon`` daemon.
+
+``backup_last_success`` (gauge, Unix epoch seconds)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The timestamp when the most recent successful backup completed. ``0``
+means no successful backup has occurred since the mon started.
+
+* Age of the most recent successful backup, per mon:
+
+  .. code-block:: promql
+
+      time() - mon_backup_last_success
+
+* Detect a stalled backup schedule (no success in over 2 hours; adjust
+  the threshold to roughly 2× your :confval:`mon_backup_interval`):
+
+  .. code-block:: promql
+
+      time() - mon_backup_last_success > 7200 and mon_backup_last_success > 0
+
+``backup_failed`` (counter)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Cumulative count of failed backup attempts (pre-flight or
+``BackupEngine``) since the mon started.
+
+* Backup failures per mon in the last hour:
+
+  .. code-block:: promql
+
+      increase(mon_backup_failed[1h])
+
+* Alert when any mon has logged a backup failure recently:
+
+  .. code-block:: promql
+
+      increase(mon_backup_failed[15m]) > 0
+
+``backup_last_size`` (gauge, bytes)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Payload size in bytes of the most recent backup attempt.
+
+* Backup size trend across all mons:
+
+  .. code-block:: promql
+
+      mon_backup_last_size
+
+* Live size check for a single mon via admin socket:
+
+  .. code-block:: bash
+
+      ceph daemon mon.<id> perf dump | jq '.mon.backup_last_size'
+
+``backup_cleanup_kept`` (gauge)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Number of backups retained by the most recent cleanup pass.
+
+* Mons whose retention has grown beyond an expected ceiling:
+
+  .. code-block:: promql
+
+      mon_backup_cleanup_kept > 100
+
+``backup_cleanup_freed`` (gauge, bytes)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Bytes released by the most recent cleanup pass. Overstated when shared
+backups are in use.
+
+* Bytes reclaimed by the latest cleanup, per mon:
+
+  .. code-block:: promql
+
+      mon_backup_cleanup_freed
+
+* Total bytes released by the most recent cleanup across all mons:
+
+  .. code-block:: promql
+
+      sum(mon_backup_cleanup_freed)
+
+Monitor Backup Configuration Options
+------------------------------------
+
+The following options control monitor backup behavior. All are
+runtime-tunable.
+
+.. confval:: mon_backup_path
+.. confval:: mon_backup_min_avail
+.. confval:: mon_backup_keep_last
+.. confval:: mon_backup_keep_hourly
+.. confval:: mon_backup_keep_daily
+.. confval:: mon_backup_interval
+.. confval:: mon_backup_cleanup_interval
+
+
 Miscellaneous
 =============
 
diff --git a/doc/rados/troubleshooting/troubleshooting-mon.rst b/doc/rados/troubleshooting/troubleshooting-mon.rst
index 10e49dc8b2b..791b8a7b53a 100644
--- a/doc/rados/troubleshooting/troubleshooting-mon.rst
+++ b/doc/rados/troubleshooting/troubleshooting-mon.rst
@@ -518,6 +518,97 @@ or::
 
   Corruption: 1 missing files; e.g.: /var/lib/ceph/mon/mon.foo/store.db/1234567.ldb
 
+Recovery Using Mon Backup
+-------------------------
+
+If Monitor backups are enabled, backups can be found in the configured
+``mon_backup_path``. To list the available backup versions, run:
+
+.. code-block:: bash
+
+   ceph-mon -i [num] --list-backups /path/to/backups
+
+In containerized deployments, run this from inside the Monitor
+container (``cephadm shell --name mon.<id>``), or install
+``ceph-common`` on the host.
+
+This invokes the RocksDB ``BackupEngine`` to enumerate the logical
+backup versions at the path. Output looks like::
+
+   ID:     Time:                           Size:
+   1       Sun May 18 03:00:01 2026         4 MiB
+   2       Sun May 18 04:00:02 2026         12 KiB
+   3       Sun May 18 05:00:01 2026         16 KiB
+
+The ``ID`` column is the value to pass as ``--backup-version`` when
+restoring. A plain ``ls`` of the backup path shows the BackupEngine's
+internal ``meta/``, ``private/``, and ``shared_checksum/`` directories,
+which are not directly usable for restore; always use ``--list-backups``
+to obtain the IDs.
+
+To restore a backup, stop the monitor and run:
+
+.. code-block:: bash
+
+   ceph-mon -i [num] --restore-backup /path/to/backups --backup-version <version> --yes-i-really-mean-it
+
+The ``--yes-i-really-mean-it`` flag is required because restore overwrites the existing monitor store.
+If the ``--backup-version`` argument is omitted, the latest version will be restored.
+The restored store contains everything that was in the mon at the time the backup was taken,
+including auth records; any changes (auth, pools, CRUSH, etc.) made after that point are lost.
+OSDs will reconcile their state with the restored osdmap as the cluster comes back up.
+
+If ``ceph-mon --restore-backup`` is invoked as ``root`` (typical when running
+from a service shell), the restored ``kv_backend`` file and the rehydrated
+``keyring`` will be owned by ``root``. Before starting the monitor daemon,
+``chown -R ceph:ceph <mon_data>`` so the unprivileged ``ceph`` user can read
+them.
+
+Restoring a multi-monitor cluster
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Each monitor has its own Paxos state (rank, accepted proposal numbers,
+``last_committed``), so backups are per-monitor: a backup taken from
+``mon.a`` should be restored into ``mon.a``'s ``mon_data``, not copied
+onto ``mon.b`` or ``mon.c``.
+
+To recover a cluster from monitor backups:
+
+#. Stop all monitors.
+#. Restore each monitor you have a backup for from its own backup path
+   using the ``--restore-backup`` command above.
+#. Start the restored monitors. Quorum forms once a majority of the
+   monmap members are running. Restoring and starting a majority is the
+   simplest path: the recovered monmap is the original one, and the
+   monitors elect among themselves as normal.
+
+If you cannot bring back a majority of monitors (because backups are
+missing or storage is lost on the other hosts), the restored seed will
+not form quorum on its own. The monmap recovered from the backup still
+lists every monitor in the original cluster, and Paxos requires a
+majority to elect. The seed will sit in ``probing`` / ``electing``
+indefinitely.
+
+To reduce the monmap on the offline seed so it can elect itself:
+
+#. Stop all monitors.
+#. Restore the seed monitor from its backup as above.
+#. Edit the monmap directly in the offline mon store::
+
+     # extract from the offline mon store
+     ceph-mon -i <seed-id> --extract-monmap /tmp/monmap
+     # drop monitors that will not come back
+     monmaptool /tmp/monmap --rm <other-id-1> --rm <other-id-2>
+     # write it back into the store
+     ceph-mon -i <seed-id> --inject-monmap /tmp/monmap
+
+#. Start the seed monitor. With the reduced monmap it can elect itself
+   and form a single-member quorum.
+#. Re-add any remaining monitors as new sync members per
+   :ref:`adding-and-removing-monitors`; they will synchronize from the
+   recovered seed rather than reusing their old backups.
+
+
 Recovery Using Healthy Monitor(s)
 ---------------------------------
 
diff --git a/src/ceph_mon.cc b/src/ceph_mon.cc
index e1475368d01..de928f0e4cd 100644
--- a/src/ceph_mon.cc
+++ b/src/ceph_mon.cc
@@ -19,6 +19,7 @@
 #include <fcntl.h>
 
 #include <iostream>
+#include <optional>
 #include <sstream>
 #include <string>
 
@@ -42,6 +43,7 @@
 #include "common/Throttle.h"
 #include "common/Timer.h"
 #include "common/errno.h"
+#include "common/strtol.h"
 #include "common/Preforker.h"
 
 #include "global/global_init.h"
@@ -213,7 +215,7 @@ static void usage()
        << "  --force-sync\n"
        << "        force a sync from another mon by wiping local data (BE CAREFUL)\n"
        << "  --yes-i-really-mean-it\n"
-       << "        mandatory safeguard for --force-sync\n"
+       << "        mandatory safeguard for --force-sync and --restore-backup\n"
        << "  --compact\n"
        << "        compact the monitor store\n"
        << "  --osdmap <filename>\n"
@@ -224,8 +226,14 @@ static void usage()
        << "        extract the monmap from the local monitor store and exit\n"
        << "  --mon-data <directory>\n"
        << "        where the mon store and keyring are located\n"
-       << "  --set-crush-location <bucket>=<foo>"
-       << "        sets monitor's crush bucket location (only for stretch mode)"
+       << "  --set-crush-location <bucket>=<foo>\n"
+       << "        sets monitor's crush bucket location (only for stretch mode)\n"
+       << "  --restore-backup <directory>\n"
+       << "        restore the backup from location and exit (requires --yes-i-really-mean-it)\n"
+       << "  --backup-version <version>\n"
+       << "        BackupEngine version ID (uint32); defaults to the latest backup when omitted\n"
+       << "  --list-backups <directory>\n"
+       << "        list available backups\n"
        << std::endl;
   generic_server_usage();
 }
@@ -265,6 +273,8 @@ int main(int argc, const char **argv)
   bool force_sync = false;
   bool yes_really = false;
   std::string osdmapfn, inject_monmap, extract_monmap, crush_loc;
+  std::string restore_backup_location, list_backup_location;
+  std::optional<uint32_t> restore_backup_version;
 
   auto args = argv_to_vec(argc, argv);
   if (args.empty()) {
@@ -337,6 +347,18 @@ int main(int argc, const char **argv)
       extract_monmap = val;
     } else if (ceph_argparse_witharg(args, i, &val, "--set-crush-location", (char*)NULL)) {
       crush_loc = val;
+    } else if (ceph_argparse_witharg(args, i, &val, "--list-backups", (char*)NULL)) {
+      list_backup_location = val;
+    } else if (ceph_argparse_witharg(args, i, &val, "--restore-backup", (char*)NULL)) {
+      restore_backup_location = val;
+    } else if (ceph_argparse_witharg(args, i, &val, "--backup-version", (char*)NULL)) {
+      std::string parse_err;
+      long long v = strict_strtoll(val.c_str(), 10, &parse_err);
+      if (!parse_err.empty() || v < 0 || v > UINT32_MAX) {
+        cerr << "invalid --backup-version '" << val << "'" << std::endl;
+        exit(1);
+      }
+      restore_backup_version = static_cast<uint32_t>(v);
     } else {
       ++i;
     }
@@ -362,6 +384,51 @@ int main(int argc, const char **argv)
     exit(1);
   }
 
+  // -- list backups --
+  if (!list_backup_location.empty()) {
+    cout << "list backup from location '" << list_backup_location << "'" << std::endl << std::endl;
+    auto backup_infos = MonitorDBStore::list_backups(
+      cct.get(), g_conf()->mon_data, list_backup_location);
+    if (!backup_infos) {
+      cerr << "failed to enumerate backups at '" << list_backup_location
+           << "' (see log for details)" << std::endl;
+      exit(1);
+    }
+    if (backup_infos->empty()) {
+      cout << "no backups found at '" << list_backup_location << "'" << std::endl;
+      exit(0);
+    }
+    cout << "ID:\tTime:\t\t\t\tSize:" << std::endl;
+    for (const KeyValueDB::BackupStats& bi : *backup_infos) {
+      cout << bi.id << "\t";
+      bi.timestamp.asctime(cout);
+      cout << "\t" << byte_u_t(bi.size) << std::endl;
+    }
+    exit(0);
+  }
+
+  // -- restore backup --
+  if (!restore_backup_location.empty()) {
+    if (!yes_really) {
+      cerr << "restoring will overwrite the monitor store at '" << g_conf()->mon_data
+           << "'. Pass --yes-i-really-mean-it to proceed." << std::endl;
+      exit(1);
+    }
+    cerr << "restoring backup from location '" << restore_backup_location << "' to '"
+         << g_conf()->mon_data << "'" << std::endl;
+    if (MonitorDBStore::restore_backup(cct.get(), g_conf()->mon_data, restore_backup_location, restore_backup_version)) {
+        cout << "successfully restored backup. Start ceph-mon normally" << std::endl;
+        exit(0);
+    }
+    cerr << "restore failed. Check the backup path and version (use --list-backups to enumerate)." << std::endl;
+    exit(1);
+  }
+
+  if (restore_backup_version.has_value()) {
+    cerr << "--backup-version requires --restore-backup" << std::endl;
+    exit(1);
+  }
+
   MonitorDBStore store(g_conf()->mon_data);
 
   // -- mkfs --
@@ -537,7 +604,7 @@ int main(int argc, const char **argv)
       exit(1);
     }
     store.close();
-    dout(0) << argv[0] << ": created monfs at " << g_conf()->mon_data 
+    dout(0) << argv[0] << ": created monfs at " << g_conf()->mon_data
 	    << " for " << g_conf()->name << dendl;
     return 0;
   }
diff --git a/src/common/options/mon.yaml.in b/src/common/options/mon.yaml.in
index 9c81dbac734..ef875ef8058 100644
--- a/src/common/options/mon.yaml.in
+++ b/src/common/options/mon.yaml.in
@@ -1176,6 +1176,74 @@ options:
   flags:
   - no_mon_update
   with_legacy: true
+- name: mon_backup_path
+  type: str
+  level: advanced
+  desc: Path to Monitor database backups
+  fmt_desc: The Monitor's backup location.
+  default: /var/backups/ceph/mon/$cluster-$id
+  services:
+  - mon
+  flags:
+  - runtime
+- name: mon_backup_min_avail
+  type: int
+  level: advanced
+  desc: Only capture backups if at least this percentage of the target filesystem is free
+  default: 10
+  min: 0
+  max: 100
+  services:
+  - mon
+  flags:
+  - runtime
+- name: mon_backup_keep_last
+  type: uint
+  level: advanced
+  desc: Keep the last N backups
+  fmt_desc: Keep the last N backups of the Monitor database.
+  default: 6
+  services:
+  - mon
+  flags:
+  - runtime
+- name: mon_backup_keep_hourly
+  type: uint
+  level: advanced
+  desc: Number of hourly backups
+  default: 5
+  services:
+  - mon
+  flags:
+  - runtime
+- name: mon_backup_keep_daily
+  type: uint
+  level: advanced
+  desc: Number of daily backups
+  fmt_desc: Keep one backup per day, for the specified number of days.
+  default: 7
+  services:
+  - mon
+  flags:
+  - runtime
+- name: mon_backup_interval
+  type: secs
+  level: advanced
+  desc: Automatic backups every N seconds (0 disables)
+  default: 0
+  services:
+  - mon
+  flags:
+  - runtime
+- name: mon_backup_cleanup_interval
+  type: secs
+  level: advanced
+  desc: Trigger backup cleanup every N seconds (0 disables)
+  default: 0
+  services:
+  - mon
+  flags:
+  - runtime
 - name: mon_rocksdb_options
   type: str
   level: advanced
diff --git a/src/kv/KeyValueDB.cc b/src/kv/KeyValueDB.cc
index 41eb30873b8..c7700fd6f3f 100644
--- a/src/kv/KeyValueDB.cc
+++ b/src/kv/KeyValueDB.cc
@@ -1,6 +1,10 @@
 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
 // vim: ts=8 sw=2 sts=2 expandtab
 
+#include <filesystem>
+#include <memory>
+#include <sstream>
+
 #include "KeyValueDB.h"
 #include "RocksDBStore.h"
 
@@ -18,6 +22,52 @@ KeyValueDB *KeyValueDB::create(CephContext *cct, const string& type,
   return NULL;
 }
 
+bool KeyValueDB::restore_backup(CephContext *cct,
+                                const std::string &type,
+                                const std::string &path,
+                                const std::string &backup_location,
+                                const std::optional<uint32_t> &version)
+{
+  if (std::filesystem::exists(path) &&
+      !std::filesystem::is_empty(path)) {
+    std::unique_ptr<KeyValueDB> probe(KeyValueDB::create(cct, type, path));
+    if (!probe) {
+      lderr(cct) << __func__ << " unsupported kv backend: " << type << dendl;
+      return false;
+    }
+    std::ostringstream err;
+    if (probe->open(err) < 0) {
+      // Heuristic: rocksdb's PosixEnv lock path surfaces "lock" in the
+      // error text. Any other open failure (corruption, I/O) is precisely
+      // why a restore is being run -- warn and proceed.
+      const std::string msg = err.str();
+      if (msg.find("lock") != std::string::npos) {
+        lderr(cct) << __func__ << " another monitor is using this data dir: "
+                   << path << ": " << msg << dendl;
+        return false;
+      }
+      lderr(cct) << __func__ << " existing store at " << path
+                 << " is unreadable, proceeding with restore: " << msg << dendl;
+    } else {
+      probe->close();
+    }
+  }
+  if (type == "rocksdb") {
+    return RocksDBStore::restore_backup(cct, path, backup_location, version);
+  }
+  return false;
+}
+
+std::optional<std::vector<KeyValueDB::BackupStats>> KeyValueDB::list_backups(
+  CephContext *cct, const std::string &type, const std::string &backup_location)
+{
+  if (type == "rocksdb") {
+    return RocksDBStore::list_backups(cct, backup_location);
+  }
+  lderr(cct) << __func__ << " unsupported kv backend: " << type << dendl;
+  return std::nullopt;
+}
+
 int KeyValueDB::test_init(const string& type, const string& dir)
 {
   if (type == "rocksdb") {
diff --git a/src/kv/KeyValueDB.h b/src/kv/KeyValueDB.h
index 2d861eda82d..381492fa1d7 100644
--- a/src/kv/KeyValueDB.h
+++ b/src/kv/KeyValueDB.h
@@ -13,6 +13,7 @@
 #include <string_view>
 #include <boost/scoped_ptr.hpp>
 #include "include/encoding.h"
+#include "include/utime.h"
 #include "common/Formatter.h"
 #include "common/perf_counters.h"
 #include "common/PriorityCache.h"
@@ -24,6 +25,25 @@
  */
 class KeyValueDB {
 public:
+  struct BackupCleanupStats {
+    bool error{false};
+    utime_t timestamp;
+    uint32_t corrupted{0};
+    uint32_t deleted{0};
+    uint32_t kept{0};
+    uint64_t size{0};
+    uint64_t freed{0};
+  };
+
+  struct BackupStats {
+    bool error{false};
+    uint64_t id{0};
+    utime_t timestamp;
+    std::string msg;
+    uint64_t size{0};
+    uint64_t number_files{0};
+  };
+
   class TransactionImpl {
   public:
     // amount of ops included
@@ -112,8 +132,8 @@ public:
     }
 
     /// Remove Single Key which exists and was not overwritten.
-    /// This API is only related to performance optimization, and should only be 
-    /// re-implemented by log-insert-merge tree based keyvalue stores(such as RocksDB). 
+    /// This API is only related to performance optimization, and should only be
+    /// re-implemented by log-insert-merge tree based keyvalue stores(such as RocksDB).
     /// If a key is overwritten (by calling set multiple times), then the result
     /// of calling rm_single_key on this key is undefined.
     virtual void rm_single_key(
@@ -418,6 +438,29 @@ public:
       return 0;
   };
 
+  /// Create a kv database backup in directory path.
+  virtual BackupStats backup(const std::string &path) {
+    return {.error = true, .msg = "backup not supported by this backend"};
+  }
+
+  /// Remove old backups in directory path according to retention.
+  virtual BackupCleanupStats backup_cleanup(const std::string &path,
+                                            uint64_t keep_last,
+                                            uint64_t keep_hourly,
+                                            uint64_t keep_daily) {
+    return {.error = true};
+  }
+
+  /// restore from backup the specified backup version
+  static bool restore_backup(CephContext *cct, const std::string &type,
+                             const std::string &path,
+                             const std::string &backup_location,
+                             const std::optional<uint32_t> &version);
+
+  static std::optional<std::vector<BackupStats>> list_backups(
+    CephContext *cct, const std::string &type,
+    const std::string &backup_location);
+
   /// compact the underlying store
   virtual void compact() {}
 
diff --git a/src/kv/RocksDBStore.cc b/src/kv/RocksDBStore.cc
index ae308fafdf6..6d9470306a1 100644
--- a/src/kv/RocksDBStore.cc
+++ b/src/kv/RocksDBStore.cc
@@ -7,6 +7,7 @@
 #include <set>
 #include <string>
 #include <string_view>
+#include <tuple>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/types.h>
@@ -18,10 +19,14 @@
 #include "rocksdb/slice.h"
 #include "rocksdb/cache.h"
 #include "rocksdb/filter_policy.h"
+#include "rocksdb/utilities/backup_engine.h"
 #include "rocksdb/utilities/convenience.h"
 #include "rocksdb/utilities/table_properties_collectors.h"
 #include "rocksdb/merge_operator.h"
 
+#include "common/version.h"
+#include "rocksdb/util/stderr_logger.h"
+
 #include "common/Clock.h" // for ceph_clock_now()
 #include "common/perf_counters.h"
 #include "common/PriorityCache.h"
@@ -70,6 +75,7 @@ static const char* sharding_def_file = "sharding/def";
 static const char* sharding_recreate = "sharding/recreate_columns";
 static const char* resharding_column_lock = "reshardingXcommencingXlocked";
 
+
 static bufferlist to_bufferlist(rocksdb::Slice in) {
   bufferlist bl;
   bl.append(bufferptr(in.data(), in.size()));
@@ -1143,6 +1149,7 @@ int RocksDBStore::do_open(ostream &out,
   if (create_if_missing) {
     status = rocksdb::DB::Open(opt, path, &db);
     if (!status.ok()) {
+      out << status.ToString();
       derr << status.ToString() << dendl;
       return -EINVAL;
     }
@@ -1191,6 +1198,7 @@ int RocksDBStore::do_open(ostream &out,
         status = rocksdb::DB::Open(opt, path, &db);
       }
       if (!status.ok()) {
+	out << status.ToString();
 	derr << status.ToString() << dendl;
 	return -EINVAL;
       }
@@ -1206,6 +1214,7 @@ int RocksDBStore::do_open(ostream &out,
 				   path, existing_cfs, &handles, &db);
       }
       if (!status.ok()) {
+	out << status.ToString();
 	derr << status.ToString() << dendl;
 	return -EINVAL;
       }
@@ -2076,6 +2085,278 @@ int RocksDBStore::split_key(rocksdb::Slice in, string_view *prefix, string_view
   return 0;
 }
 
+KeyValueDB::BackupStats RocksDBStore::backup(const std::string &path)
+{
+  ldout(cct, 20) << __func__ << " start backup action" << dendl;
+  std::lock_guard backup_locker{backup_lock};
+  // stamp timestamp up front so every return path (including early Open
+  // failures) carries a real time the scheduler can gate retries on.
+  KeyValueDB::BackupStats rv;
+  rv.timestamp = ceph_clock_now();
+
+  rocksdb::BackupEngine* engine_ptr = nullptr;
+  rocksdb::BackupEngineOptions engine_options = rocksdb::BackupEngineOptions(path);
+  // BackupEngineOptions must be stable across opens to the same directory,
+  // and share_files_with_checksum=false is deprecated by rocksdb.
+  engine_options.share_table_files = true;
+  engine_options.share_files_with_checksum = true;
+  engine_options.sync = true;
+
+  rocksdb::Status s = rocksdb::BackupEngine::Open(
+    engine_options,
+    rocksdb::Env::Default(),
+    &engine_ptr);
+  std::unique_ptr<rocksdb::BackupEngine> backup_engine{engine_ptr};
+
+  if (!backup_engine || !s.ok()) {
+    ldout(cct, 0) << __func__ << " can't create backup_engine: " << s.ToString() << dendl;
+    rv.msg = s.ToString();
+    rv.error = true;
+    return rv;
+  }
+
+  // we remove corrupted backups first to not link to broken ones
+  remove_corrupted_backups(backup_engine.get(), nullptr);
+
+  rocksdb::BackupID new_backup;
+  rocksdb::BackupInfo new_backup_info;
+  rocksdb::CreateBackupOptions new_backup_options = rocksdb::CreateBackupOptions();
+  new_backup_options.flush_before_backup = true;
+
+  std::string app_metadata = std::string("ceph_version=") + ceph_version_to_str();
+  s = backup_engine->CreateNewBackupWithMetadata(new_backup_options, db, app_metadata, &new_backup);
+
+  rv.timestamp = ceph_clock_now();
+  rv.msg = s.ToString();
+
+  if (!s.ok()) {
+    ldout(cct, 0) << __func__ << " can't create backup: " << s.ToString() << dendl;
+    rv.error = true;
+    remove_corrupted_backups(backup_engine.get(), nullptr);
+    return rv;
+  } else {
+    ldout(cct, 10) << __func__ << " created backup successfully: " << s.ToString() << dendl;
+    rv.msg = s.ToString();
+  }
+  s = backup_engine->GetBackupInfo(new_backup, &new_backup_info);
+  if (!s.ok()) {
+    ldout(cct, 0) << __func__ << " can't get backup info: " << s.ToString() << dendl;
+    rv.error = true;
+    rv.msg = s.ToString();
+    return rv;
+  }
+  rv.id = new_backup_info.backup_id;
+  rv.size = new_backup_info.size;
+  rv.number_files = new_backup_info.number_files;
+
+  return rv;
+}
+
+bool RocksDBStore::restore_backup(CephContext *cct, const std::string &path,
+                                  const std::string &backup_location,
+                                  const std::optional<uint32_t> &version)
+{
+  rocksdb::BackupEngineReadOnly* engine_ptr = nullptr;
+  rocksdb::StderrLogger logger = rocksdb::StderrLogger();
+  rocksdb::BackupEngineOptions engine_options = rocksdb::BackupEngineOptions(backup_location);
+  engine_options.info_log = &logger;
+
+  rocksdb::Status s = rocksdb::BackupEngineReadOnly::Open(
+    rocksdb::Env::Default(),
+    engine_options,
+    &engine_ptr);
+  std::unique_ptr<rocksdb::BackupEngineReadOnly> backup_engine{engine_ptr};
+  const rocksdb::RestoreOptions options = rocksdb::RestoreOptions();
+  if (!s.ok()) {
+    derr << __func__ << " can't open backup folder: " << s.ToString() << dendl;
+    return false;
+  }
+  if (!version) {
+    derr << __func__ << " restore last valid backup" << dendl;
+    s = backup_engine->RestoreDBFromLatestBackup(options, path, path);
+  } else {
+    s = backup_engine->RestoreDBFromBackup(
+        options, static_cast<rocksdb::BackupID>(*version), path, path);
+  }
+  if (!s.ok()) {
+    derr << "Error when restoring backup: " << s.ToString() << dendl;
+  }
+  return s.ok();
+}
+
+namespace {
+
+bool compare_backupinfo_by_timestamp(const rocksdb::BackupInfo& a, const rocksdb::BackupInfo& b)
+{
+  // newest first; tie-break on backup_id so cleanup never keeps an older entry
+  // in preference to a newer one with the same second-resolution timestamp.
+  return std::tie(a.timestamp, a.backup_id) > std::tie(b.timestamp, b.backup_id);
+}
+
+struct TimeBucket {
+  utime_t start;
+  utime_t end;
+  rocksdb::BackupID backup_id;
+
+  TimeBucket(utime_t start, utime_t end) :
+              start(start), end(end), backup_id(0) {}
+};
+
+} // namespace
+
+void RocksDBStore::remove_corrupted_backups(rocksdb::BackupEngine *backup_engine, KeyValueDB::BackupCleanupStats *rv) {
+  std::vector<rocksdb::BackupID> corrupt_backup_ids;
+  backup_engine->GetCorruptedBackups(&corrupt_backup_ids);
+  for (rocksdb::BackupID backup_id : corrupt_backup_ids) {
+    ldout(cct, 1) << __func__ << " delete corrupted backup: " << backup_id << dendl;
+    rocksdb::Status s = backup_engine->DeleteBackup(backup_id);
+    if (!s.ok()) {
+      lderr(cct) << __func__ << " failed to delete corrupted backup "
+                 << backup_id << ": " << s.ToString() << dendl;
+      if (rv) {
+        rv->error = true;
+      }
+      continue;
+    }
+    if (rv) {
+      rv->corrupted++;
+    }
+  }
+}
+
+KeyValueDB::BackupCleanupStats RocksDBStore::backup_cleanup(const std::string &path,
+                                                            uint64_t keep_last,
+                                                            uint64_t keep_hourly,
+                                                            uint64_t keep_daily)
+{
+  ldout(cct, 20) << __func__ << " start backup cleanup" << dendl;
+  std::lock_guard backup_locker{backup_lock};
+  // stamp timestamp up front so every return path (including early Open
+  // failures and empty result) carries a real time for the retry gate.
+  BackupCleanupStats rv;
+  rv.timestamp = ceph_clock_now();
+
+  rocksdb::BackupEngine* engine_ptr = nullptr;
+  rocksdb::Status s = rocksdb::BackupEngine::Open(
+    rocksdb::BackupEngineOptions(path),
+    rocksdb::Env::Default(),
+    &engine_ptr);
+  std::unique_ptr<rocksdb::BackupEngine> backup_engine{engine_ptr};
+  if (!backup_engine || !s.ok()) {
+    // cleaning backups when folder is not available is minor problem
+    ldout(cct, 10) << __func__ << " can't clean backups: " << s.ToString() << dendl;
+    rv.error = true;
+    return rv;
+  }
+  // remove corrupted backups first
+  std::set<rocksdb::BackupID> keep_backups;
+
+  remove_corrupted_backups(backup_engine.get(), &rv);
+  ldout(cct, 20) << __func__ << " collect garbage" << dendl;
+
+  std::vector<rocksdb::BackupInfo> backup_infos;
+  backup_engine->GetBackupInfo(&backup_infos);
+
+  if (backup_infos.empty()) {
+    ldout(cct, 15) << __func__ << " no backup infos" << dendl;
+    return rv;
+  }
+  // sort all backups with newest backup first
+  std::stable_sort(backup_infos.begin(), backup_infos.end(), compare_backupinfo_by_timestamp);
+  // always retain the newest backup, regardless of retention settings, so
+  // cleanup can never leave zero backups for a subsequent failed backup.
+  keep_backups.insert(backup_infos.front().backup_id);
+  utime_t now = ceph_clock_now();
+
+  std::vector<TimeBucket> buckets;
+  // half-open intervals [start, end) so adjacent buckets meet without gaps
+  utime_t start = now.round_to_hour();
+  for (uint64_t i = 0; i < keep_hourly; i++) {
+    buckets.push_back(TimeBucket(start, start + utime_t(3600, 0)));
+    start -= 3600.0;
+  }
+  start = now.round_to_day();
+  for (uint64_t i = 0; i < keep_daily; i++) {
+    buckets.push_back(TimeBucket(start, start + utime_t(86400, 0)));
+    start -= 86400.0;
+  }
+
+  size_t i = 0;
+  for (const rocksdb::BackupInfo& bi : backup_infos) {
+    if (i++ < keep_last) {
+      keep_backups.insert(bi.backup_id);
+    }
+    utime_t ts = utime_t(bi.timestamp, 0);
+    for (TimeBucket& bucket : buckets) {
+      if (ts >= bucket.start && ts < bucket.end) {
+        if (bucket.backup_id == 0) {
+          bucket.backup_id = bi.backup_id;
+        }
+      }
+    }
+  }
+  // push the winners into the list
+  for (const TimeBucket& bucket : buckets) {
+    if (bucket.backup_id) {
+      keep_backups.insert(bucket.backup_id);
+    }
+  }
+
+  rv.kept = keep_backups.size();
+
+  for (const rocksdb::BackupInfo& bi : backup_infos) {
+    if (keep_backups.count(bi.backup_id)) {
+      // payload-sum across kept backups (does not account for file sharing,
+      // so it overstates the on-disk footprint).
+      rv.size += bi.size;
+      continue;
+    }
+    ldout(cct, 10) << __func__ << " delete old backup: " << bi.backup_id << dendl;
+    rocksdb::Status s = backup_engine->DeleteBackup(bi.backup_id);
+    if (!s.ok()) {
+      lderr(cct) << __func__ << " failed to delete backup " << bi.backup_id
+                 << ": " << s.ToString() << dendl;
+      rv.error = true;
+      continue;
+    }
+    rv.freed += bi.size;
+    rv.deleted++;
+  }
+  rv.timestamp = ceph_clock_now();
+  return rv;
+}
+
+std::optional<std::vector<KeyValueDB::BackupStats>>
+RocksDBStore::list_backups(CephContext *cct, const std::string &backup_location) {
+  rocksdb::BackupEngineReadOnly* engine_ptr = nullptr;
+  rocksdb::Status s = rocksdb::BackupEngineReadOnly::Open(
+    rocksdb::BackupEngineOptions(backup_location),
+    rocksdb::Env::Default(),
+    &engine_ptr);
+  std::unique_ptr<rocksdb::BackupEngineReadOnly> backup_engine{engine_ptr};
+
+  if (!backup_engine || !s.ok()) {
+    lderr(cct) << __func__ << " can't open backup location " << backup_location
+               << ": " << s.ToString() << dendl;
+    return std::nullopt;
+  }
+
+  std::vector<rocksdb::BackupInfo> backup_infos;
+  backup_engine->GetBackupInfo(&backup_infos);
+  std::stable_sort(backup_infos.begin(), backup_infos.end(), compare_backupinfo_by_timestamp);
+  std::vector<KeyValueDB::BackupStats> rv;
+  for (const rocksdb::BackupInfo& bi : backup_infos) {
+    KeyValueDB::BackupStats br;
+    br.id = bi.backup_id;
+    br.timestamp = utime_t(bi.timestamp, 0);
+    br.size = bi.size;
+    br.number_files = bi.number_files;
+    rv.push_back(br);
+  }
+  return rv;
+}
+
+
 void RocksDBStore::compact()
 {
   dout(2) << __func__ << " starting" << dendl;
@@ -3386,7 +3667,7 @@ int RocksDBStore::prepare_for_reshard(const std::string& new_sharding,
 	   << full_name << dendl;
       return -EINVAL;
     }
-    dout(10) << "created column " << full_name << " handle = " << (void*)cf << dendl; 
+    dout(10) << "created column " << full_name << " handle = " << (void*)cf << dendl;
     existing_columns.push_back(full_name);
     handles.push_back(cf);
   }
diff --git a/src/kv/RocksDBStore.h b/src/kv/RocksDBStore.h
index e4dd5ca54c5..2bd310aa44f 100644
--- a/src/kv/RocksDBStore.h
+++ b/src/kv/RocksDBStore.h
@@ -21,6 +21,7 @@
 #include "rocksdb/statistics.h"
 #include "rocksdb/table.h"
 #include "rocksdb/db.h"
+#include "rocksdb/utilities/backup_engine.h"
 #include "kv/rocksdb_cache/BinnedLRUCache.h"
 #include <errno.h>
 #include "common/errno.h"
@@ -115,11 +116,13 @@ public:
 		 uint32_t hash_l, uint32_t hash_h)
       : name(name), shard_cnt(shard_cnt), options(options), hash_l(hash_l), hash_h(hash_h) {}
   };
+
 private:
   friend std::ostream& operator<<(std::ostream& out, const ColumnFamily& cf);
 
   bool must_close_default_cf = false;
   rocksdb::ColumnFamilyHandle *default_cf = nullptr;
+  ceph::mutex backup_lock = ceph::make_mutex("RocksDBStore::Backup");
 
   /// column families in use, name->handles
   struct prefix_shards {
@@ -147,6 +150,7 @@ private:
   int do_open(std::ostream &out, bool create_if_missing, bool open_readonly,
 	      const std::string& cfs="");
   int load_rocksdb_options(bool create_if_missing, rocksdb::Options& opt);
+  void remove_corrupted_backups(rocksdb::BackupEngine *engine, KeyValueDB::BackupCleanupStats *result);
 public:
   static bool parse_sharding_def(const std::string_view text_def,
 				std::vector<ColumnFamily>& sharding_def,
@@ -212,6 +216,23 @@ public:
     return cct->_conf.get_val<uint64_t>("rocksdb_delete_range_threshold");
   }
 
+  KeyValueDB::BackupStats backup(const std::string &path) override;
+  KeyValueDB::BackupCleanupStats backup_cleanup(const std::string &path,
+                                                uint64_t keep_last,
+                                                uint64_t keep_hourly,
+                                                uint64_t keep_daily) override;
+
+  /// Restore a backup into @p path. @p version is the rocksdb backup id, or
+  /// nullopt for the most recent. Must be called on a closed store.
+  static bool restore_backup(CephContext *cct, const std::string &path,
+                             const std::string &backup_location,
+                             const std::optional<uint32_t> &version);
+
+  /// List backups at @p backup_location, newest first.
+  /// Returns nullopt if the BackupEngine could not be opened.
+  static std::optional<std::vector<BackupStats>> list_backups(
+    CephContext *cct, const std::string &backup_location);
+
   void compact() override;
 
   void compact_async() override {
diff --git a/src/mon/CMakeLists.txt b/src/mon/CMakeLists.txt
index 34f48e55424..94944d792c1 100644
--- a/src/mon/CMakeLists.txt
+++ b/src/mon/CMakeLists.txt
@@ -10,6 +10,7 @@ set(lib_mon_srcs
   MgrMonitor.cc
   MgrStatMonitor.cc
   Monitor.cc
+  MonitorBackup.cc
   MonmapMonitor.cc
   LogMonitor.cc
   AuthMonitor.cc
diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc
index 205fb23c7ce..8ef4bdbbd3d 100644
--- a/src/mon/Monitor.cc
+++ b/src/mon/Monitor.cc
@@ -41,6 +41,7 @@
 #include "MonitorDBStore.h"
 #include "MonMap.h"
 #include "Paxos.h"
+#include "MonitorBackup.h"
 
 #include "messages/PaxosServiceMessage.h"
 #include "messages/MMonCommand.h"
@@ -549,7 +550,11 @@ will start to track new ops received afterwards.";
 	    << duration << " seconds" << dendl;
     out << "compacted " << g_conf().get_val<std::string>("mon_keyvaluedb")
 	<< " in " << duration << " seconds";
- } else {
+  } else if (command == "backup") {
+    r = perform_backup();
+  } else if (command == "backup_cleanup") {
+    r = cleanup_backup();
+  } else {
     ceph_abort_msg("bad AdminSocket command binding");
   }
   (read_only ? audit_clog->debug() : audit_clog->info())
@@ -568,6 +573,40 @@ abort:
   return r;
 }
 
+int Monitor::perform_backup()
+{
+  std::string backup_path = g_conf().get_val<string>("mon_backup_path");
+  dout(1) << "triggering backup" << dendl;
+  if (backup_path.empty()) {
+    derr << "backup failed: mon_backup_path is empty" << dendl;
+    return -ENOTDIR;
+  }
+  if (!backup_manager) {
+    derr << "backup failed: monitor still initializing" << dendl;
+    return -EAGAIN;
+  }
+  uint64_t jobid = backup_manager->backup();
+  dout(1) << "queued backup job id " << jobid << dendl;
+  return 0;
+}
+
+int Monitor::cleanup_backup()
+{
+  std::string backup_path = g_conf().get_val<string>("mon_backup_path");
+  dout(1) << "triggering backup_cleanup" << dendl;
+  if (backup_path.empty()) {
+    derr << "backup_cleanup failed: mon_backup_path is empty" << dendl;
+    return -ENOTDIR;
+  }
+  if (!backup_manager) {
+    derr << "backup_cleanup failed: monitor still initializing" << dendl;
+    return -EAGAIN;
+  }
+  uint64_t jobid = backup_manager->cleanup();
+  dout(1) << "queued backup cleanup job id " << jobid << dendl;
+  return 0;
+}
+
 void Monitor::handle_signal(int signum)
 {
   derr << "*** Got Signal " << sig_str(signum) << " ***" << dendl;
@@ -825,6 +864,44 @@ int Monitor::preinit()
         "ewon", PerfCountersBuilder::PRIO_INTERESTING);
     pcb.add_u64_counter(l_mon_election_lose, "election_lose", "Elections lost",
         "elst", PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64(l_mon_backup_running, "backup_running", "Mon backup process is running",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_u64_counter(l_mon_backup_started, "backup_started", "Mon backups started",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64_counter(l_mon_backup_success, "backup_success", "Mon backups finished successfully",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_u64_counter(l_mon_backup_failed, "backup_failed", "Mon backups failed",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_time_avg(l_mon_backup_duration, "backup_duration", "Mon backup duration",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_time(l_mon_backup_last_success, "backup_last_success", "Last successful mon backup",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_u64(l_mon_backup_last_success_id, "backup_last_success_id", "Last successful mon backup id",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_time(l_mon_backup_last_failed, "backup_last_failed", "Last failed mon backup",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_u64(l_mon_backup_last_size, "backup_last_size", "Last backup size",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64(l_mon_backup_last_files, "backup_last_files", "Last backup file numbers",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64_counter(l_mon_backup_cleanup_started, "backup_cleanup_started", "Mon backup cleanup started",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64(l_mon_backup_cleanup_running, "backup_cleanup_running", "Mon backup cleanup is running",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64_counter(l_mon_backup_cleanup_success, "backup_cleanup_success", "Mon backup cleanup finished successfully",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_u64_counter(l_mon_backup_cleanup_failed, "backup_cleanup_failed", "Mon backup cleanup failed",
+        nullptr, PerfCountersBuilder::PRIO_USEFUL);
+    pcb.add_u64(l_mon_backup_cleanup_size, "backup_cleanup_size", "Size of backups removed",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64(l_mon_backup_cleanup_kept, "backup_cleanup_kept", "Number of backups kept after cleanup",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_time_avg(l_mon_backup_cleanup_duration, "backup_cleanup_duration", "Mon backup cleanup duration",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64(l_mon_backup_cleanup_freed, "backup_cleanup_freed", "Mon backup cleanup freed size in bytes",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
+    pcb.add_u64(l_mon_backup_cleanup_deleted, "backup_cleanup_deleted", "Mon backup cleanup deleted backups",
+        nullptr, PerfCountersBuilder::PRIO_INTERESTING);
     logger = pcb.create_perf_counters();
     cct->get_perfcounters_collection()->add(logger);
   }
@@ -983,6 +1060,13 @@ int Monitor::preinit()
 				       command.helpstring);
     ceph_assert(r == 0);
   }
+  r = admin_socket->register_command("backup", admin_hook,
+				     "create a backup of the mon database");
+  ceph_assert(r == 0);
+  r = admin_socket->register_command(
+    "backup_cleanup", admin_hook,
+    "delete old mon database backups according to retention config");
+  ceph_assert(r == 0);
   l.lock();
 
   // add ourselves as a conf observer
@@ -1031,6 +1115,9 @@ int Monitor::init()
 
   // add features of myself into feature_map
   session_map.feature_map.add_mon(con_self->get_features());
+
+  backup_manager = std::make_unique<MonitorBackupManager>(cct, this);
+
   return 0;
 }
 
@@ -1126,6 +1213,9 @@ void Monitor::shutdown()
     delete admin_hook;
     admin_hook = NULL;
   }
+  if (backup_manager) {
+    backup_manager->stop();
+  }
 
   elector.shutdown();
 
@@ -6119,6 +6209,7 @@ void Monitor::tick()
     prepare_new_fingerprint(t);
     paxos->trigger_propose();
   }
+  backup_manager->tick();
 
   mgr_client.update_daemon_health(get_health_metrics());
   new_tick();
diff --git a/src/mon/Monitor.h b/src/mon/Monitor.h
index cc7d7b12e02..a914969ed35 100644
--- a/src/mon/Monitor.h
+++ b/src/mon/Monitor.h
@@ -50,6 +50,7 @@
 #include "include/CompatSet.h"
 #include "mon/MonitorDBStore.h"
 #include "mon/mon_types.h" // for Metadata, PAXOS_*, ScrubResult
+#include "mon/MonitorBackup.h"
 #include "mgr/MgrClient.h"
 #include <boost/smart_ptr/atomic_shared_ptr.hpp>
 #include <boost/smart_ptr/shared_ptr.hpp>
@@ -100,6 +101,25 @@ enum {
   l_mon_election_call,
   l_mon_election_win,
   l_mon_election_lose,
+  l_mon_backup_running,
+  l_mon_backup_started,
+  l_mon_backup_success,
+  l_mon_backup_failed,
+  l_mon_backup_duration,
+  l_mon_backup_last_success,
+  l_mon_backup_last_success_id,
+  l_mon_backup_last_failed,
+  l_mon_backup_last_size,
+  l_mon_backup_last_files,
+  l_mon_backup_cleanup_started,
+  l_mon_backup_cleanup_running,
+  l_mon_backup_cleanup_success,
+  l_mon_backup_cleanup_failed,
+  l_mon_backup_cleanup_size,
+  l_mon_backup_cleanup_kept,
+  l_mon_backup_cleanup_duration,
+  l_mon_backup_cleanup_freed,
+  l_mon_backup_cleanup_deleted,
   l_mon_last,
 };
 
@@ -1001,6 +1021,8 @@ private:
 
   OpTracker op_tracker;
 
+  std::unique_ptr<MonitorBackupManager> backup_manager;
+
  public:
   Monitor(CephContext *cct_, std::string nm, MonitorDBStore *s,
 	  Messenger *m, Messenger *mgr_m, MonMap *map);
@@ -1046,6 +1068,10 @@ private:
 		       std::ostream& err,
 		       std::ostream& out);
 
+  // Execute mon database backup
+  int perform_backup();
+  int cleanup_backup();
+
 private:
   // don't allow copying
   Monitor(const Monitor& rhs);
diff --git a/src/mon/MonitorBackup.cc b/src/mon/MonitorBackup.cc
new file mode 100644
index 00000000000..aff1bebdaf8
--- /dev/null
+++ b/src/mon/MonitorBackup.cc
@@ -0,0 +1,214 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab
+/*
+* Ceph - scalable distributed file system
+*
+* Copyright (C) 2021 B1-Systems GmbH
+*
+* This is free software; you can redistribute it and/or
+* modify it under the terms of the GNU Lesser General Public
+* License version 2.1, as published by the Free Software
+* Foundation. See file COPYING.
+*/
+
+#include <chrono>
+#include <filesystem>
+
+#include "include/util.h"
+#include "mon/MonitorBackup.h"
+#include "mon/Monitor.h"
+
+#define dout_subsys ceph_subsys_mon
+#undef dout_context
+#define dout_context cct
+
+namespace fs = std::filesystem;
+
+/***
+ * Thread which runs monitor backup operations
+ */
+void *MonitorBackupManager::entry() {
+  std::unique_lock lock{mutex};
+  auto wakeup_predicate = [this] {
+    return should_stop || should_backup || should_cleanup || wakeup_pending;
+  };
+  while (true) {
+    // Wait for any signal (tick, request, or stop) before doing
+    // scheduled work. Predicate-based so notifications delivered
+    // before the worker entered wait() are not lost, and so we don't
+    // fire scheduled work while init() is still wiring the mon up.
+    work_cond.wait(lock, wakeup_predicate);
+    if (should_stop) {
+      return nullptr;
+    }
+    wakeup_pending = false;
+
+    auto now = ceph_clock_now();
+    std::string backup_path = cct->_conf.get_val<std::string>("mon_backup_path");
+    auto interval = cct->_conf.get_val<std::chrono::seconds>("mon_backup_interval");
+    auto cleanup_interval = cct->_conf.get_val<std::chrono::seconds>("mon_backup_cleanup_interval");
+    bool path_ok = !backup_path.empty();
+
+    bool timer_backup = false;
+    bool timer_cleanup = false;
+
+    if (path_ok && interval.count() > 0 &&
+        (mon->is_leader() || mon->is_peon())) {
+      if (!last_backup) {
+        dout(10) << "trigger first timed backup" << dendl;
+        timer_backup = true;
+      } else if ((now - last_backup->timestamp) >= utime_t(interval.count(), 0)) {
+        dout(10) << "trigger timed backup" << dendl;
+        timer_backup = true;
+      }
+    }
+    if (path_ok && cleanup_interval.count() > 0) {
+      if (!last_cleanup) {
+        dout(10) << "trigger first timed backup cleanup" << dendl;
+        timer_cleanup = true;
+      } else if ((now - last_cleanup->timestamp) >= utime_t(cleanup_interval.count(), 0)) {
+        dout(10) << "trigger timed backup cleanup" << dendl;
+        timer_cleanup = true;
+      }
+    }
+
+    bool run_cleanup = should_cleanup || timer_cleanup;
+    bool run_backup = should_backup || timer_backup;
+
+    should_backup = false;
+    should_cleanup = false;
+
+    if (!run_backup && !run_cleanup) {
+      continue;
+    }
+
+    lock.unlock();
+    if (run_cleanup) {
+      do_cleanup();
+    }
+    if (run_backup) {
+      do_backup();
+    }
+    lock.lock();
+  }
+}
+
+void MonitorBackupManager::stop() {
+  {
+    std::lock_guard guard{mutex};
+    if (should_stop) {
+      return;
+    }
+    should_stop = true;
+    work_cond.notify_one();
+  }
+  join();
+}
+
+void MonitorBackupManager::do_cleanup() {
+  dout(5) << "start backup cleanup" << dendl;
+  mon->logger->inc(l_mon_backup_cleanup_started);
+  mon->logger->set(l_mon_backup_cleanup_running, 1);
+  auto start = ceph_clock_now();
+  KeyValueDB::BackupCleanupStats stats = mon->store->backup_cleanup();
+  mon->logger->set(l_mon_backup_cleanup_size, stats.size);
+  mon->logger->set(l_mon_backup_cleanup_kept, stats.kept);
+  mon->logger->set(l_mon_backup_cleanup_freed, stats.freed);
+  mon->logger->set(l_mon_backup_cleanup_deleted, stats.deleted);
+  if (stats.error) {
+    mon->logger->inc(l_mon_backup_cleanup_failed);
+  } else {
+    mon->logger->inc(l_mon_backup_cleanup_success);
+  }
+  auto ptr = std::make_shared<KeyValueDB::BackupCleanupStats>(stats);
+  last_cleanup.swap(ptr);
+  auto end = ceph_clock_now();
+  utime_t duration = end - start;
+  mon->logger->tinc(l_mon_backup_cleanup_duration, duration);
+  mon->logger->set(l_mon_backup_cleanup_running, 0);
+}
+
+void MonitorBackupManager::record_last_backup(std::shared_ptr<KeyValueDB::BackupStats> stats) {
+  if (stats->error && last_backup) {
+    stats->id = last_backup->id;
+  }
+  last_backup.swap(stats);
+}
+
+// Returns true if there is enough free space on the backup volume.
+bool MonitorBackupManager::check_free_space() {
+  auto backup_path = cct->_conf.get_val<std::string>("mon_backup_path");
+
+  std::error_code ec;
+  if (!fs::exists(backup_path, ec)) {
+    if (!fs::create_directories(backup_path, ec)) {
+      dout(1) << "failed to create monitor backup directory '"
+              << backup_path << "': " << ec.message() << dendl;
+      return false;
+    }
+    fs::permissions(backup_path, fs::perms::owner_all,
+                    fs::perm_options::replace, ec);
+    if (ec) {
+      dout(1) << "failed to set permissions on monitor backup directory '"
+              << backup_path << "': " << ec.message() << dendl;
+      return false;
+    }
+    dout(5) << "created monitor backup directory '" << backup_path
+            << "'" << dendl;
+  }
+
+  ceph_data_stats_t stats;
+  int err = get_fs_stats(stats, backup_path.c_str());
+  if (err < 0) {
+    dout(1) << "error checking monitor backup directory: " << cpp_strerror(err)
+            << dendl;
+    return false;
+  }
+
+  if (stats.avail_percent <= cct->_conf.get_val<int64_t>("mon_backup_min_avail")) {
+    dout(1) << "ERROR: not enough disk space to start backup: " << "(available: "
+            << stats.avail_percent << "% " << byte_u_t(stats.byte_avail) << ")\n"
+            << "run backup_cleanup regularly or decrease mon_backup_min_avail" << dendl;
+    return false;
+  }
+  return true;
+}
+
+void MonitorBackupManager::do_backup() {
+  dout(1) << "start backup" << dendl;
+  mon->logger->inc(l_mon_backup_started);
+  mon->logger->set(l_mon_backup_running, 1);
+  auto start = ceph_clock_now();
+
+  std::shared_ptr<KeyValueDB::BackupStats> result;
+
+  if (!check_free_space()) {
+    mon->logger->inc(l_mon_backup_failed);
+    mon->logger->tset(l_mon_backup_last_failed, start);
+    result = std::make_shared<KeyValueDB::BackupStats>();
+    result->error = true;
+    result->timestamp = start;
+    result->msg = "insufficient free space";
+  } else {
+    KeyValueDB::BackupStats stats = mon->store->backup();
+    utime_t duration = ceph_clock_now() - start;
+    mon->logger->tinc(l_mon_backup_duration, duration);
+    mon->logger->set(l_mon_backup_last_size, stats.size);
+    mon->logger->set(l_mon_backup_last_files, stats.number_files);
+    if (stats.error) {
+      mon->logger->inc(l_mon_backup_failed);
+      mon->logger->tset(l_mon_backup_last_failed, stats.timestamp);
+      dout(1) << "failed backup in " << utimespan_str(duration) << dendl;
+    } else {
+      mon->logger->inc(l_mon_backup_success);
+      mon->logger->tset(l_mon_backup_last_success, stats.timestamp);
+      mon->logger->set(l_mon_backup_last_success_id, stats.id);
+      dout(1) << "finished backup in " << utimespan_str(duration) << dendl;
+    }
+    result = std::make_shared<KeyValueDB::BackupStats>(stats);
+  }
+
+  record_last_backup(result);
+  mon->logger->set(l_mon_backup_running, 0);
+}
+
diff --git a/src/mon/MonitorBackup.h b/src/mon/MonitorBackup.h
new file mode 100644
index 00000000000..74d5fc879b5
--- /dev/null
+++ b/src/mon/MonitorBackup.h
@@ -0,0 +1,101 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab
+/*
+* Ceph - scalable distributed file system
+*
+* Copyright (C) 2021 B1-Systems GmbH
+*
+* This is free software; you can redistribute it and/or
+* modify it under the terms of the GNU Lesser General Public
+* License version 2.1, as published by the Free Software
+* Foundation. See file COPYING.
+*/
+
+
+#ifndef CEPH_MONITOR_BACKUP_H
+#define CEPH_MONITOR_BACKUP_H
+
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <string>
+
+
+#include "common/Thread.h"
+#include "common/ceph_context.h"
+#include "common/ceph_mutex.h"
+#include "kv/KeyValueDB.h"
+#include "mon/MonitorDBStore.h"
+
+class Monitor;
+
+class MonitorBackupManager : public Thread {
+  CephContext *cct;
+  Monitor *mon;
+  ceph::mutex mutex;
+  ceph::condition_variable work_cond;
+  bool should_stop{false};
+  // set by tick(); a sticky flag so a notification delivered before the
+  // worker enters wait() is not lost. cleared each time the worker
+  // re-evaluates timer triggers.
+  bool wakeup_pending{false};
+
+  bool should_backup{false};
+  bool should_cleanup{false};
+  uint64_t last_job_id{0};
+  std::shared_ptr<KeyValueDB::BackupCleanupStats> last_cleanup;
+  std::shared_ptr<KeyValueDB::BackupStats> last_backup;
+
+  void do_backup();
+  void do_cleanup();
+  bool check_free_space();
+  void record_last_backup(std::shared_ptr<KeyValueDB::BackupStats> stats);
+protected:
+  void *entry() override;
+
+public:
+  explicit MonitorBackupManager(CephContext *cct, Monitor *monitor) :
+    cct(cct),
+    mon(monitor),
+    mutex(ceph::make_mutex("mon::BackupManager::mutex")) {
+      create("mon::backups");
+  }
+
+  void tick() {
+    std::lock_guard guard{mutex};
+    if (should_stop) {
+      return;
+    }
+    wakeup_pending = true;
+    work_cond.notify_one();
+  }
+
+  /**
+   * Stop the backup manager thread. Safe to call more than once.
+   **/
+  void stop();
+  /**
+   * Start a new backup.
+   * @returns {uint64_t} new job id
+   **/
+  uint64_t backup() {
+    std::lock_guard guard{mutex};
+    should_backup = true;
+    uint64_t rv = ++last_job_id;
+    work_cond.notify_one();
+    return rv;
+  }
+
+  /// Queue a cleanup pass.
+  uint64_t cleanup() {
+    std::lock_guard guard{mutex};
+    should_cleanup = true;
+    uint64_t rv = ++last_job_id;
+    work_cond.notify_one();
+    return rv;
+  }
+
+};
+
+#endif
+
diff --git a/src/mon/MonitorDBStore.h b/src/mon/MonitorDBStore.h
index a645bb7e4ae..c316d23768b 100644
--- a/src/mon/MonitorDBStore.h
+++ b/src/mon/MonitorDBStore.h
@@ -14,6 +14,8 @@
 #ifndef CEPH_MONITOR_DB_STORE_H
 #define CEPH_MONITOR_DB_STORE_H
 
+#include <algorithm>
+#include <filesystem>
 #include <set>
 #include <map>
 #include <string>
@@ -32,6 +34,7 @@
 #include "common/Clock.h"
 #include "common/debug.h"
 #include "common/safe_io.h"
+#include "common/strtol.h"
 #include "common/blkdev.h"
 #include "common/PriorityCache.h"
 #include "common/version.h"
@@ -65,6 +68,11 @@ class MonitorDBStore
     return path;
   }
 
+  // returns the database store path
+  static std::string get_store_path(const std::string& path) {
+    return (std::filesystem::path(path) / "store.db").string();
+  }
+
   std::shared_ptr<PriorityCache::PriCache> get_priority_cache() const {
     return db->get_priority_cache();
   }
@@ -631,14 +639,7 @@ class MonitorDBStore
   }
 
   void _open(const std::string& kv_type) {
-    int pos = 0;
-    for (auto rit = path.rbegin(); rit != path.rend(); ++rit, ++pos) {
-      if (*rit != '/')
-	break;
-    }
-    std::ostringstream os;
-    os << path.substr(0, path.size() - pos) << "/store.db";
-    std::string full_path = os.str();
+    std::string full_path = get_store_path(path);
 
     KeyValueDB *db_ptr = KeyValueDB::create(g_ceph_context,
 					    kv_type,
@@ -691,7 +692,7 @@ class MonitorDBStore
     if (r < 0)
       return r;
 
-    // Monitors are few in number, so the resource cost of exposing 
+    // Monitors are few in number, so the resource cost of exposing
     // very detailed stats is low: ramp up the priority of all the
     // KV store's perf counters.  Do this after open, because backend may
     // not have constructed PerfCounters earlier.
@@ -743,6 +744,200 @@ class MonitorDBStore
     db.reset(NULL);
   }
 
+  /// @brief Creates a backup of the database under mon_backup_path.
+  /// @return stats describing the created backup
+  KeyValueDB::BackupStats backup() {
+    auto backup_path = g_conf().get_val<std::string>("mon_backup_path");
+    auto stats = db->backup(backup_path);
+    if (!stats.error) {
+      // Stash the mon keyring alongside the rocksdb backup, keyed by
+      // backup id, so a restore of an older version is paired with the
+      // keyring of that vintage. The [mon.] secret can rotate; using a
+      // single fixed filename would break authentication after restore.
+      std::error_code ec;
+      auto dest = backup_path + "/keyring." + std::to_string(stats.id);
+      std::filesystem::copy_file(
+        path + "/keyring", dest,
+        std::filesystem::copy_options::overwrite_existing, ec);
+      if (!ec) {
+        std::filesystem::permissions(dest,
+          std::filesystem::perms::owner_read | std::filesystem::perms::owner_write,
+          std::filesystem::perm_options::replace, ec);
+      }
+      if (ec) {
+        // Best-effort: a rocksdb backup without a stashed keyring is still
+        // valid; the operator can supply a keyring out-of-band on restore.
+        derr << __func__ << " failed to stash keyring at "
+             << dest << ": " << ec.message() << dendl;
+      }
+    }
+    return stats;
+  }
+
+  /// @brief Remove old backups in mon_backup_path according to the retention config.
+  /// @return stats describing what was kept, deleted, and freed
+  KeyValueDB::BackupCleanupStats backup_cleanup() {
+    auto backup_path = g_conf().get_val<std::string>("mon_backup_path");
+    auto stats = db->backup_cleanup(
+      backup_path,
+      g_conf().get_val<uint64_t>("mon_backup_keep_last"),
+      g_conf().get_val<uint64_t>("mon_backup_keep_hourly"),
+      g_conf().get_val<uint64_t>("mon_backup_keep_daily"));
+    if (stats.error) {
+      return stats;
+    }
+    // Remove keyring.<id> files for backup ids the kv layer just dropped.
+    std::string kv_type;
+    if (read_meta("kv_backend", &kv_type) < 0 || kv_type.empty()) {
+      kv_type = "rocksdb";
+    }
+    std::set<uint64_t> surviving;
+    auto remaining = KeyValueDB::list_backups(g_ceph_context, kv_type, backup_path);
+    if (!remaining) {
+      return stats;
+    }
+    for (const auto& b : *remaining) {
+      surviving.insert(b.id);
+    }
+    std::error_code ec;
+    for (auto it = std::filesystem::directory_iterator(backup_path, ec);
+         it != std::filesystem::directory_iterator();
+         it.increment(ec)) {
+      auto name = it->path().filename().string();
+      if (name.compare(0, 8, "keyring.") != 0) {
+        continue;
+      }
+      std::string idstr = name.substr(8);
+      std::string parse_err;
+      long long id = strict_strtoll(idstr.c_str(), 10, &parse_err);
+      if (!parse_err.empty() || id < 0) {
+        continue;
+      }
+      if (surviving.count(static_cast<uint64_t>(id))) {
+        continue;
+      }
+      std::error_code rm_ec;
+      std::filesystem::remove(it->path(), rm_ec);
+    }
+    return stats;
+  }
+
+  /// @brief List all backup versions at backup_path.
+  /// @param cct ceph context
+  /// @param path path to the local mon data dir (used to discover the kv backend)
+  /// @param backup_path path to the backup location
+  /// @return list of BackupStats, one per backup
+  static std::optional<std::vector<KeyValueDB::BackupStats>> list_backups(
+    CephContext *cct, const std::string &path, const std::string &backup_path) {
+    std::string kv_type;
+    int r = read_meta_path("kv_backend", &kv_type, path);
+    if (r < 0 || kv_type.empty()) {
+      // Disaster recovery: mon_data may be empty or absent. We only ship
+      // a rocksdb kv backend today, so default to it for enumeration.
+      kv_type = "rocksdb";
+    }
+    return KeyValueDB::list_backups(cct, kv_type, backup_path);
+  }
+
+
+  /// @brief Restore the backup with the given version from backup_path into path.
+  /// @param cct ceph context
+  /// @param path path to the local mon data dir to restore into
+  /// @param backup_path path to the backup location
+  /// @param version version of the backup to restore (nullopt for latest)
+  /// @return true on success
+  static bool restore_backup(CephContext *cct, const std::string &path,
+                             const std::string &backup_path,
+                             const std::optional<uint32_t> &version) {
+    std::string kv_type;
+    int r = read_meta_path("kv_backend", &kv_type, path);
+    if (r < 0 || kv_type.empty()) {
+      // Disaster recovery: mon_data is empty or freshly initialized, so
+      // there is no kv_backend marker. Default to rocksdb and stamp the
+      // file back so the subsequent open() finds it.
+      kv_type = "rocksdb";
+      std::error_code ec;
+      std::filesystem::create_directories(path, ec);
+      if (ec) {
+        lderr(cct) << __func__ << " failed to create " << path
+                   << ": " << ec.message() << dendl;
+        return false;
+      }
+      std::filesystem::permissions(path,
+        std::filesystem::perms::owner_all,
+        std::filesystem::perm_options::replace, ec);
+      const std::string v = kv_type + "\n";
+      if (safe_write_file(path.c_str(), "kv_backend",
+                          v.c_str(), v.length(), 0600) < 0) {
+        lderr(cct) << __func__ << " failed to write kv_backend in "
+                   << path << dendl;
+        return false;
+      }
+    }
+    std::string store_path = get_store_path(path);
+
+    // Resolve "latest" up front so we know which versioned keyring to
+    // rehydrate alongside the rocksdb restore. Pick by BackupEngine id
+    // (monotonic per rocksdb) rather than timestamp, so a clock skew
+    // between backups cannot make the default restore pick a stale one.
+    uint32_t resolved_version;
+    if (version) {
+      resolved_version = *version;
+    } else {
+      auto backups = KeyValueDB::list_backups(cct, kv_type, backup_path);
+      if (!backups || backups->empty()) {
+        lderr(cct) << __func__ << " no backups found at " << backup_path << dendl;
+        return false;
+      }
+      resolved_version = std::max_element(
+        backups->begin(), backups->end(),
+        [](const auto& a, const auto& b) { return a.id < b.id; })->id;
+    }
+
+    if (!KeyValueDB::restore_backup(cct, kv_type, store_path, backup_path,
+                                    resolved_version)) {
+      return false;
+    }
+
+    // Rehydrate the matching keyring (skipped silently if the operator
+    // keeps the keyring out-of-band).
+    std::error_code ec;
+    auto keyring_src = backup_path + "/keyring." + std::to_string(resolved_version);
+    if (std::filesystem::exists(keyring_src, ec)) {
+      std::filesystem::copy_file(
+        keyring_src,
+        path + "/keyring",
+        std::filesystem::copy_options::overwrite_existing,
+        ec);
+      if (ec) {
+        lderr(cct) << __func__ << " failed to restore keyring from "
+                   << keyring_src << ": " << ec.message() << dendl;
+        return false;
+      }
+    }
+
+    // The mon store holds auth, config-key and dm-crypt secrets;
+    // tighten everything we just restored to owner-only.
+    std::filesystem::permissions(path,
+      std::filesystem::perms::owner_all,
+      std::filesystem::perm_options::replace, ec);
+    for (auto it = std::filesystem::recursive_directory_iterator(path, ec);
+         it != std::filesystem::recursive_directory_iterator();
+         it.increment(ec)) {
+      std::error_code ec_chmod;
+      auto perms = it->is_directory(ec_chmod)
+        ? std::filesystem::perms::owner_all
+        : (std::filesystem::perms::owner_read | std::filesystem::perms::owner_write);
+      std::filesystem::permissions(it->path(), perms,
+        std::filesystem::perm_options::replace, ec_chmod);
+      if (ec_chmod) {
+        lderr(cct) << __func__ << " failed to chmod " << it->path()
+                   << ": " << ec_chmod.message() << dendl;
+      }
+    }
+    return true;
+  }
+
   void compact() {
     db->compact();
   }
@@ -788,7 +983,7 @@ class MonitorDBStore
   /**
    * read_meta - read a simple configuration key out-of-band
    *
-   * Read a simple key value to an unopened/mounted store.
+   * Read a simple key value from an unopened/unmounted store.
    *
    * Trailing whitespace is stripped off.
    *
@@ -798,6 +993,24 @@ class MonitorDBStore
    */
   int read_meta(const std::string& key,
 		std::string *value) const {
+    return read_meta_path(key, value, path);
+  }
+
+  /**
+   * read_meta_path - read a simple configuration key out-of-band
+   *
+   * Read a simple key value from a specified path store.
+   *
+   * Trailing whitespace is stripped off.
+   *
+   * @param key key name
+   * @param value pointer to value string
+   * @param path path to directory
+   * @returns 0 for success, or an error code
+   */
+  static int read_meta_path(const std::string& key,
+                            std::string *value,
+                            const std::string& path) {
     char buf[4096];
     int r = safe_read_file(path.c_str(), key.c_str(),
 			   buf, sizeof(buf));
diff --git a/src/vstart.sh b/src/vstart.sh
index b478c00b090..7f5421bffce 100755
--- a/src/vstart.sh
+++ b/src/vstart.sh
@@ -1157,6 +1157,7 @@ start_mon() {
 [mon.$f]
         host = $HOSTNAME
         mon data = $CEPH_DEV_DIR/mon.$f
+        mon backup path = $CEPH_DEV_DIR/mon.$f-backup
 EOF
             count=$(($count + 2))
         done

From 83189af8e663d867649d003afaa9d1cf09c88391 Mon Sep 17 00:00:00 2001
From: "Matthew N. Heler" <matthew.heler@hotmail.com>
Date: Tue, 16 Jun 2026 13:07:59 -0500
Subject: [PATCH 289/596] rgw/lc: Warn against changing rgw_lc_max_objs once
 lifecycle is in use

Each bucket's lifecycle entry is hashed onto a shard by this count, so
changing it remaps existing entries and can leave duplicates behind.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
---
 src/common/options/rgw.yaml.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index d9111ffeb07..1a0df1c7fbc 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -474,7 +474,8 @@ options:
   level: advanced
   desc: Number of lifecycle data shards
   long_desc: Number of RADOS objects to use for storing lifecycle index. This affects
-    concurrency of lifecycle maintenance, as shards can be processed in parallel.
+    concurrency of lifecycle maintenance, as shards can be processed in parallel. Do not
+    change this value after deployment unless `radosgw-admin lc list` is empty.
   default: 32
   services:
   - rgw

From a2f175f677f4e4cd276f8e27d950fe35ae54a8a3 Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubo.li@clyso.com>
Date: Wed, 17 Jun 2026 09:14:43 +0800
Subject: [PATCH 290/596] common/options: mark client_force_lazyio as not
 runtime updatable

The client_force_lazyio option is currently marked as supporting
runtime updates in the configuration schema, but this is misleading.

The value is read once during each file open/create and stored in
the file flags. There is no config observer registered to handle
dynamic updates, and there is no logic to propagate changes to the
already opened file handles.

This patch adds the NO_RUNTIME flag to the option definition to
correctly reflect reality.

Fixes: https://tracker.ceph.com/issues/77451
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
---
 PendingReleaseNotes                   | 6 ++++++
 doc/cephfs/lazyio.rst                 | 2 +-
 src/common/options/mds-client.yaml.in | 2 ++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 2e2a19fc25f..b858940b1e2 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -1,3 +1,9 @@
+* CephFS: The ``client_force_lazyio`` configuration option is now correctly marked
+  as not supporting runtime updates. Previously, the configuration schema indicated
+  this option could be changed at runtime, but changes had no effect on opened file
+  handlers in ceph-fuse or libcephfs clients because there is no logic to propagate
+  changes to open file handles.
+
 * RADOS: PG autoscaler allows overlapping roots. Each root receives a PG target based
   on its OSDs, with OSDs shared across multiple roots contributing proportionally
   less to each root's allocation.
diff --git a/doc/cephfs/lazyio.rst b/doc/cephfs/lazyio.rst
index 01cb2704e5f..cd6064ad415 100644
--- a/doc/cephfs/lazyio.rst
+++ b/doc/cephfs/lazyio.rst
@@ -14,7 +14,7 @@ Enable LazyIO
 LazyIO can be enabled in the following ways.
 
 - ``client_force_lazyio`` option enables LAZY_IO globally for libcephfs and
-  ceph-fuse mount.
+  ceph-fuse mount. This is strictly a startup flag.
 
 - ``ceph_lazyio(...)`` and ``ceph_ll_lazyio(...)`` enable LAZY_IO for file handle
   in libcephfs.
diff --git a/src/common/options/mds-client.yaml.in b/src/common/options/mds-client.yaml.in
index 2e7ee29bc3b..94d717dfbe9 100644
--- a/src/common/options/mds-client.yaml.in
+++ b/src/common/options/mds-client.yaml.in
@@ -333,6 +333,8 @@ options:
   default: false
   services:
   - mds_client
+  flags:
+  - startup
 - name: fuse_use_invalidate_cb
   type: bool
   level: advanced

From bf5080c08cd86fe39976ebd5310506d7059dbfc6 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Thu, 27 Nov 2025 19:40:27 +0530
Subject: [PATCH 291/596] client: add client code to allow snap metadata
 mutations

Fixes: https://tracker.ceph.com/issues/66293
Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 ceph.spec.in                    |  1 +
 src/client/Client.cc            | 50 +++++++++++++++++++++++++++++++++
 src/client/Client.h             |  3 ++
 src/include/ceph_fs.h           |  1 +
 src/include/cephfs/snap_types.h | 25 +++++++++++++++++
 5 files changed, 80 insertions(+)
 create mode 100644 src/include/cephfs/snap_types.h

diff --git a/ceph.spec.in b/ceph.spec.in
index b0fba106c2c..7bb56a985a8 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -2996,6 +2996,7 @@ fi
 %{_includedir}/cephfs/dump.h
 %{_includedir}/cephfs/json.h
 %{_includedir}/cephfs/keys_and_values.h
+%{_includedir}/cephfs/snap_types.h
 %{_libdir}/libcephfs.so
 %{_libdir}/libcephfs_proxy.so
 %{_libdir}/pkgconfig/cephfs.pc
diff --git a/src/client/Client.cc b/src/client/Client.cc
index 3e0135a024f..3a2041a8753 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -14245,6 +14245,56 @@ int Client::rmsnap(const char *relpath, const char *name, const UserPerm& perms,
   return _rmdir(snapdir.get(), name, perms, check_perms);
 }
 
+int Client::do_snap_md_op(const char* path, const string& md_key,
+                          const string& md_val, const unsigned int op_flag,
+                          const UserPerm &perms)
+{
+  if (op_flag != CEPH_SNAP_MD_OP_CREATE &&
+      op_flag != (CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL) &&
+      op_flag != CEPH_SNAP_MD_OP_REMOVE) {
+    return -EINVAL;
+  }
+
+  RWRef_t mref_reader(mount_state, CLIENT_MOUNTING);
+  if (!mref_reader.is_state_satisfied())
+    return -ENOTCONN;
+
+  std::scoped_lock l(client_lock);
+
+  walk_dentry_result wdr;
+  if (int rc = path_walk(cwd, filepath(path), &wdr, perms, {}); rc < 0) {
+    return rc;
+  }
+
+  if (wdr.target->snapid == CEPH_NOSNAP) {
+    return -EINVAL;
+  }
+
+  MetaRequest *req = new MetaRequest(CEPH_MDS_OP_SNAP_METADATA);
+  req->set_filepath(wdr.getpath());
+  req->set_inode(wdr.diri);
+  req->set_dentry(wdr.dn);
+  req->dentry_drop = CEPH_CAP_FILE_SHARED;
+  req->dentry_unless = CEPH_CAP_FILE_EXCL;
+
+  bufferlist bl;
+  encode(md_key, bl);
+  encode(md_val, bl);
+  encode(op_flag, bl);
+  req->set_data(bl);
+
+  ldout(cct, 10) << __func__ << ": making request" << dendl;
+  int res = make_request(req, perms, &wdr.target);
+  ldout(cct, 10) << __func__ << ": result is " << res << dendl;
+
+  trim_cache();
+
+  ldout(cct, 8) << __func__ << "(" << wdr.getpath() << ", " << perms
+                << ") = " << res << dendl;
+
+  return res;
+}
+
 // =============================
 // expose caps
 
diff --git a/src/client/Client.h b/src/client/Client.h
index 42459f40a59..99c33fe534c 100644
--- a/src/client/Client.h
+++ b/src/client/Client.h
@@ -633,6 +633,9 @@ public:
   int mksnap(const char *path, const char *name, const UserPerm& perm,
              mode_t mode=0, const std::map<std::string, std::string> &metadata={});
   int rmsnap(const char *path, const char *name, const UserPerm& perm, bool check_perms=false);
+  int do_snap_md_op(const char* path, const std::string& md_key,
+                    const std::string& md_val, const unsigned int op_flag,
+                    const UserPerm &perms);
 
   // cephx mds auth caps checking
   int mds_check_access(std::string& path, const UserPerm& perms, int mask);
diff --git a/src/include/ceph_fs.h b/src/include/ceph_fs.h
index 9c0b67004cc..b3aca907506 100644
--- a/src/include/ceph_fs.h
+++ b/src/include/ceph_fs.h
@@ -15,6 +15,7 @@
 #include "msgr.h"
 #include "rados.h"
 #include "include/buffer.h" // for ceph::buffer::list
+#include "include/cephfs/snap_types.h"
 
 /*
  * The data structures defined here are shared between Linux kernel and
diff --git a/src/include/cephfs/snap_types.h b/src/include/cephfs/snap_types.h
new file mode 100644
index 00000000000..755b3e6f562
--- /dev/null
+++ b/src/include/cephfs/snap_types.h
@@ -0,0 +1,25 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab
+
+/*
+ * snap_types.h - Contains types associated with CephFS snapshots that needs
+ * to be imported in Cython (Python bindings). Placing these types in ceph_fs.h
+ * (where it was initially place) causes an Cython import error.
+ *
+ * LGPL-2.1 or LGPL-3.0
+ */
+
+
+/*
+ * snapshot metadata operations
+ *
+ * XXX: DON'T FORGET to update cephfs.pyx if any changes are made to this enum.
+ */
+enum {
+        // allows both, snap MD create and update
+	CEPH_SNAP_MD_OP_CREATE    = (1 << 0),
+        // when passed with CREATE, allows only snap MD create and rejects
+        // update
+	CEPH_SNAP_MD_OP_EXCL      = (1 << 1),
+	CEPH_SNAP_MD_OP_REMOVE    = (1 << 2),
+};

From 2aed10be29fa7736051f03c66493d99606fe61e1 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Sat, 14 Mar 2026 16:07:00 +0530
Subject: [PATCH 292/596] mds: enable logging for snap.cc

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/mds/snap.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/mds/snap.cc b/src/mds/snap.cc
index 5e594e2d7ca..9fa77bcf997 100644
--- a/src/mds/snap.cc
+++ b/src/mds/snap.cc
@@ -15,10 +15,16 @@
 
 #include "snap.h"
 #include "common/Formatter.h"
+#include "common/debug.h"
 
 #include <ostream>
 #include <sstream>
 
+#define dout_context g_ceph_context
+#define dout_subsys ceph_subsys_mds
+#undef dout_prefix
+#define dout_prefix *_dout << "mds.snap "
+
 using namespace std;
 /*
  * SnapInfo

From 047f41aac142bd70d07e25affed7d99cbd96320c Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 2 Mar 2026 21:46:32 +0530
Subject: [PATCH 293/596] mds: rename a finisher method in Server.cc since...

it will be used in a different context as well in the upcoming commit.

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/mds/Server.cc | 14 ++++++++------
 src/mds/Server.h  |  2 +-
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/mds/Server.cc b/src/mds/Server.cc
index 688c21d3364..12636a0e363 100644
--- a/src/mds/Server.cc
+++ b/src/mds/Server.cc
@@ -11778,13 +11778,13 @@ void Server::_rmsnap_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snap
   diri->purge_stale_snap_data(diri->snaprealm->get_snaps());
 }
 
-struct C_MDS_renamesnap_finish : public ServerLogContext {
+struct C_MDS_SnapMutateGeneric_finish : public ServerLogContext {
   CInode *diri;
   snapid_t snapid;
-  C_MDS_renamesnap_finish(Server *s, const MDRequestRef& r, CInode *di, snapid_t sn) :
+  C_MDS_SnapMutateGeneric_finish(Server *s, const MDRequestRef& r, CInode *di, snapid_t sn) :
     ServerLogContext(s, r), diri(di), snapid(sn) {}
   void finish(int r) override {
-    server->_renamesnap_finish(mdr, diri, snapid);
+    server->_snap_mutate_generic_finish(mdr, diri, snapid);
   }
 };
 
@@ -11890,14 +11890,16 @@ void Server::handle_client_renamesnap(const MDRequestRef& mdr)
   mdcache->journal_dirty_inode(mdr.get(), &le->metablob, diri);
 
   // journal the snaprealm changes
-  submit_mdlog_entry(le, new C_MDS_renamesnap_finish(this, mdr, diri, snapid),
+  submit_mdlog_entry(le, new C_MDS_SnapMutateGeneric_finish(this, mdr, diri, snapid),
                      mdr, __func__);
   mdlog->flush();
 }
 
-void Server::_renamesnap_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid)
+// Finisher method for updating any snapshot metadata, be it custom user metadata
+// or snapshot name
+void Server::_snap_mutate_generic_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid)
 {
-  dout(10) << "_renamesnap_finish " << *mdr << " " << snapid << dendl;
+  dout(10) << __func__ << " " << *mdr << " " << snapid << dendl;
 
   mdr->apply();
 
diff --git a/src/mds/Server.h b/src/mds/Server.h
index b8cfb56452e..e9e9bf4ae25 100644
--- a/src/mds/Server.h
+++ b/src/mds/Server.h
@@ -347,7 +347,7 @@ public:
   void handle_client_rmsnap(const MDRequestRef& mdr);
   void _rmsnap_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid);
   void handle_client_renamesnap(const MDRequestRef& mdr);
-  void _renamesnap_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid);
+  void _snap_mutate_generic_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid);
   void handle_client_readdir_snapdiff(const MDRequestRef& mdr);
   void handle_client_file_blockdiff(const MDRequestRef& mdr);
   void handle_file_blockdiff_finish(const MDRequestRef& mdr, CInode *in, const BlockDiff &block_diff,

From a7617f354eb897ce86ba0b45eafa3005c3924d47 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 17 Nov 2025 17:51:48 +0530
Subject: [PATCH 294/596] mds: add MDS code to allow snap metadata mutations

Fixes: https://tracker.ceph.com/issues/66293
Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/common/ceph_strings.cc |   1 +
 src/include/ceph_fs.h      |   1 +
 src/mds/Server.cc          | 124 +++++++++++++++++++++++++++++++++++++
 src/mds/Server.h           |   2 +
 src/mds/SnapRealm.cc       |   9 +++
 src/mds/SnapRealm.h        |   4 ++
 src/mds/snap.cc            |  63 +++++++++++++++++++
 src/mds/snap.h             |   6 ++
 8 files changed, 210 insertions(+)

diff --git a/src/common/ceph_strings.cc b/src/common/ceph_strings.cc
index 01c613b60d4..63437bd2d91 100644
--- a/src/common/ceph_strings.cc
+++ b/src/common/ceph_strings.cc
@@ -318,6 +318,7 @@ const char *ceph_mds_op_name(int op)
 	case CEPH_MDS_OP_MKSNAP: return "mksnap";
 	case CEPH_MDS_OP_RMSNAP: return "rmsnap";
 	case CEPH_MDS_OP_RENAMESNAP: return "renamesnap";
+	case CEPH_MDS_OP_SNAP_METADATA: return "snap_md_op";
 	case CEPH_MDS_OP_READDIR_SNAPDIFF: return "readdir_snapdiff";
 	case CEPH_MDS_OP_SETFILELOCK: return "setfilelock";
 	case CEPH_MDS_OP_GETFILELOCK: return "getfilelock";
diff --git a/src/include/ceph_fs.h b/src/include/ceph_fs.h
index b3aca907506..d9af11a7389 100644
--- a/src/include/ceph_fs.h
+++ b/src/include/ceph_fs.h
@@ -429,6 +429,7 @@ enum {
 	CEPH_MDS_OP_RENAMESNAP = 0x01403,
 	CEPH_MDS_OP_READDIR_SNAPDIFF   = 0x01404,
 	CEPH_MDS_OP_FILE_BLOCKDIFF = 0x01405,
+	CEPH_MDS_OP_SNAP_METADATA = 0x1406,
 
 	// internal op
 	CEPH_MDS_OP_FRAGMENTDIR= 0x01500,
diff --git a/src/mds/Server.cc b/src/mds/Server.cc
index 12636a0e363..2ad6a617160 100644
--- a/src/mds/Server.cc
+++ b/src/mds/Server.cc
@@ -268,6 +268,8 @@ void Server::create_logger()
                    "Request type remove snapshot latency");
   plb.add_time_avg(l_mdss_req_renamesnap_latency, "req_renamesnap_latency",
                    "Request type rename snapshot latency");
+  plb.add_time_avg(l_mdss_req_snap_md_op_latency, "req_snap_md_op_latency",
+                   "Request type snapshot metadata op latency");
   plb.add_time_avg(l_mdss_req_snapdiff_latency, "req_snapdiff_latency",
 		   "Request type snapshot difference latency");
     plb.add_time_avg(l_mdss_req_file_blockdiff_latency, "req_blockdiff_latency",
@@ -2273,6 +2275,9 @@ void Server::perf_gather_op_latency(const cref_t<MClientRequest> &req, utime_t l
   case CEPH_MDS_OP_RENAMESNAP:
     code = l_mdss_req_renamesnap_latency;
     break;
+  case CEPH_MDS_OP_SNAP_METADATA:
+    code = l_mdss_req_snap_md_op_latency;
+    break;
   case CEPH_MDS_OP_READDIR_SNAPDIFF:
     code = l_mdss_req_snapdiff_latency;
     break;
@@ -2937,6 +2942,9 @@ void Server::dispatch_client_request(const MDRequestRef& mdr)
   case CEPH_MDS_OP_RENAMESNAP:
     handle_client_renamesnap(mdr);
     break;
+  case CEPH_MDS_OP_SNAP_METADATA:
+    handle_client_snap_md_op(mdr);
+    break;
   case CEPH_MDS_OP_READDIR_SNAPDIFF:
     handle_client_readdir_snapdiff(mdr);
     break;
@@ -11919,6 +11927,122 @@ void Server::_snap_mutate_generic_finish(const MDRequestRef& mdr, CInode *diri,
   respond_to_request(mdr, 0);
 }
 
+void Server::handle_client_snap_md_op(const MDRequestRef& mdr)
+{
+  const cref_t<MClientRequest> &req = mdr->client_request;
+
+  CInode* diri = rdlock_path_pin_ref(mdr, false, true);
+  if (!diri)
+    return;
+
+  if (!diri->is_dir()) {
+    respond_to_request(mdr, -ENOTDIR);
+    return;
+  }
+
+  std::string_view snapname = req->get_filepath().last_dentry();
+
+  if (req->get_caller_uid() < g_conf()->mds_snap_min_uid ||
+      req->get_caller_uid() > g_conf()->mds_snap_max_uid) {
+    dout(20) << __func__ << " " << snapname << " on " << *diri <<
+                " denied to uid " << req->get_caller_uid() << dendl;
+    respond_to_request(mdr, -EPERM);
+    return;
+  }
+
+  dout(10) << __func__ << " for " << snapname << " on " << *diri << dendl;
+  // does this snap exist?
+  if (snapname.length() == 0 || snapname[0] == '_') {
+    respond_to_request(mdr, -EINVAL);
+    return;
+  }
+
+  if (!diri->snaprealm || !diri->snaprealm->exists(snapname)) {
+    respond_to_request(mdr, -ENOENT);
+    return;
+  }
+
+  string md_key;
+  string md_val;
+  // setting initial value to an invalid mode to ensure no valid mode is
+  // assumed by default due to any unexpected errors from any code from the
+  // following try-catch blocks. the invalid mode would cause
+  // will_md_op_succeed() to reply negatively, preventing accidental changes
+  // to the snap MD.
+  unsigned int op_flag = 3;
+  if (req->get_data().length()) {
+    try {
+      auto iter = req->get_data().cbegin();
+      decode(md_key, iter);
+      decode(md_val, iter);
+      decode(op_flag, iter);
+    } catch (const ceph::buffer::error &e) {
+      dout(20) << __func__ << " : no metadata in payload" << dendl;
+      respond_to_request(mdr, -EBADMSG);
+      return;
+    }
+  }
+
+  snapid_t snapid = diri->snaprealm->resolve_snapname(snapname, diri->ino());
+  dout(10) << __func__ << " snapid " << snapid << dendl;
+
+  // NOTE: check if metadata op will succeed before intiating the transaction or
+  // projecting the inode so that there is not need to roll back.
+  bool will_succeed = diri->snaprealm->will_md_op_succeed(snapid, md_key,
+                                                          md_val, op_flag);
+  if (!will_succeed) {
+    dout(10) << __func__ << " will_metadata_op_succeed() failed with md_key="
+             << md_key << ", md_val=" << md_val << " and op_flag=" << op_flag
+             << dendl;
+    respond_to_request(mdr, -EINVAL);
+    return;
+  }
+
+  // get stid
+  if (!mdr->more()->stid) {
+    mds->snapclient->prepare_update(diri->ino(), snapid, snapname, utime_t(),
+                                   &mdr->more()->stid,
+                                   new C_MDS_RetryRequest(mdcache, mdr));
+    return;
+  }
+  version_t stid = mdr->more()->stid;
+  dout(10) << __func__ << " stid = " << stid << dendl;
+
+  // project the inode.
+  auto pi = diri->project_inode(mdr, false, true);
+  pi.inode->ctime = mdr->get_op_stamp();
+  if (mdr->get_op_stamp() > pi.inode->rstat.rctime)
+    pi.inode->rstat.rctime = mdr->get_op_stamp();
+  pi.inode->version = diri->pre_dirty();
+
+  // update snap md.
+  auto& snapnode = *(pi.snapnode);
+  auto it = snapnode.snaps.find(snapid);
+  if (it == snapnode.snaps.end()) {
+    respond_to_request(mdr, -ENOENT);
+    return;
+  } else {
+    auto& snapinfo = (*it).second;
+    snapinfo.stamp = mdr->get_op_stamp();
+    snapinfo.do_md_op(md_key, md_val, op_flag);
+  }
+  snapnode.last_modified = mdr->get_op_stamp();
+  snapnode.change_attr++;
+
+  // journal inode changes.
+  mdr->ls = mdlog->get_current_segment();
+  EUpdate *le = new EUpdate(mdlog, "snap_metadata_op");
+  le->metablob.add_client_req(req->get_reqid(), req->get_oldest_client_tid());
+  le->metablob.add_table_transaction(TABLE_SNAP, stid);
+  mdcache->predirty_journal_parents(mdr, &le->metablob, diri, 0, PREDIRTY_PRIMARY, false);
+  mdcache->journal_dirty_inode(mdr.get(), &le->metablob, diri);
+
+  // journal the snaprealm changes
+  auto finisher = new C_MDS_SnapMutateGeneric_finish(this, mdr, diri, snapid);
+  submit_mdlog_entry(le, finisher, mdr, __func__);
+  mdlog->flush();
+}
+
 class C_MDS_file_blockdiff_finish : public ServerContext {
 public:
   C_MDS_file_blockdiff_finish(Server *server, const MDRequestRef& mdr, CInode *in, uint64_t scan_idx)
diff --git a/src/mds/Server.h b/src/mds/Server.h
index e9e9bf4ae25..016007db7b7 100644
--- a/src/mds/Server.h
+++ b/src/mds/Server.h
@@ -112,6 +112,7 @@ enum {
   l_mdss_req_snapdiff_latency,
   l_mdss_req_rmdir_latency,
   l_mdss_req_rmsnap_latency,
+  l_mdss_req_snap_md_op_latency,
   l_mdss_req_rmxattr_latency,
   l_mdss_req_setattr_latency,
   l_mdss_req_setdirlayout_latency,
@@ -347,6 +348,7 @@ public:
   void handle_client_rmsnap(const MDRequestRef& mdr);
   void _rmsnap_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid);
   void handle_client_renamesnap(const MDRequestRef& mdr);
+  void handle_client_snap_md_op(const MDRequestRef& mdr);
   void _snap_mutate_generic_finish(const MDRequestRef& mdr, CInode *diri, snapid_t snapid);
   void handle_client_readdir_snapdiff(const MDRequestRef& mdr);
   void handle_client_file_blockdiff(const MDRequestRef& mdr);
diff --git a/src/mds/SnapRealm.cc b/src/mds/SnapRealm.cc
index 6eed30da6d9..e9dd2f8bc31 100644
--- a/src/mds/SnapRealm.cc
+++ b/src/mds/SnapRealm.cc
@@ -21,6 +21,7 @@
 #include "MDSRank.h"
 #include "SnapClient.h"
 #include "common/debug.h"
+#include "include/ceph_assert.h"
 
 #include <string_view>
 
@@ -305,6 +306,14 @@ snapid_t SnapRealm::resolve_snapname(std::string_view n, inodeno_t atino, snapid
 }
 
 
+bool SnapRealm::will_md_op_succeed(const snapid_t snap_id, const string& md_key,
+                                   const string& md_val,
+                                   const unsigned int op_flag) const
+{
+  return srnode.snaps.at(snap_id).will_md_op_succeed(md_key, md_val, op_flag);
+}
+
+
 void SnapRealm::adjust_parent()
 {
   SnapRealm *newparent;
diff --git a/src/mds/SnapRealm.h b/src/mds/SnapRealm.h
index e723fb5c3e8..d5eebf5c42f 100644
--- a/src/mds/SnapRealm.h
+++ b/src/mds/SnapRealm.h
@@ -42,6 +42,10 @@ public:
     return false;
   }
 
+  bool will_md_op_succeed(const snapid_t snap_id, const std::string& md_key,
+                          const std::string& md_val,
+                          const unsigned int op_flag) const;
+
   void prune_past_parent_snaps();
   bool has_past_parent_snaps() const {
     return !srnode.past_parent_snaps.empty();
diff --git a/src/mds/snap.cc b/src/mds/snap.cc
index 9fa77bcf997..89eb5a0b134 100644
--- a/src/mds/snap.cc
+++ b/src/mds/snap.cc
@@ -71,6 +71,69 @@ void SnapInfo::dump(Formatter *f) const
   f->close_section();
 }
 
+/* Will metadata operation succeed?
+ *
+ * NOTE: Call this method before projecting the inode to check if snap metadata
+ * will be mutated successfully. This avoids un-projecting the inode and rolling
+ * back the transaction in case the mutation fails.
+ */
+bool SnapInfo::will_md_op_succeed(const string& key, const string& val,
+                                  const unsigned int op_flag) const {
+  if (op_flag == CEPH_SNAP_MD_OP_CREATE) {
+    // CREATE flags adds k-v pair if absent and updates if k-v is present.
+    if (metadata.count(key) == 0) {
+      dout(10) << __func__ << " snapshot metadata op will pass: create is "
+               << "being attempted with CREATE flag. op_flag=" << op_flag
+               << dendl;
+    } else if (metadata.count(key) > 0) {
+      dout(10) << __func__ << " snapshot metadata op will pass: update is "
+               << "being attempted with CREATE flag. op_flag=" << op_flag
+               << dendl;
+    }
+  } else if (op_flag == (CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL)) {
+    if (metadata.count(key) > 0) {
+      dout(10) << __func__ << " snapshot metadata op will fail: update would "
+               << "be attempted in with EXCL flag. op_flag=" << op_flag
+               << dendl;
+      return false;
+    }
+  } else if (op_flag == CEPH_SNAP_MD_OP_REMOVE) {
+    if (metadata.count(key) == 0) {
+      dout(10) << __func__ << " snapshot metadata op will fail: remove would "
+               << "be attempted for a non-existing key. op_flag=" << op_flag
+               << dendl;
+      return false;
+    }
+  } else {
+    // NOTE: in case of wrong mode/op_flag value, client code exits with
+    // appropriate error number instead of contacting MDS with wrong
+    // mode/op_flag value.
+    // NOTE: Aborting on receiving wrong flag (via ceph_assert() or otherwise)
+    // is to be avoided since a corrupted client can be used to deliberately
+    // crash MDS by sending wrong op_mode flag.
+    return false;
+  }
+
+  return true;
+}
+
+// Perform metadata operation indicated by op_flag.
+//
+// NOTE: to avoid unprojecting the inode and rolling back the transaction for
+// snap metadata mutation in case of failure, call this method only when success
+// is guaranteed. whether success is guaranted or not, can be found out by
+// will_md_op_succeed(), which is present here as well as in SnapRealm.cc.
+void SnapInfo::do_md_op(const string& key, const string& val,
+                        const unsigned int op_flag) {
+  if (op_flag == CEPH_SNAP_MD_OP_CREATE) {
+    metadata.insert_or_assign(key, val);
+  } else if (op_flag == (CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL)) {
+    metadata.emplace(key, val);
+  } else if (op_flag == CEPH_SNAP_MD_OP_REMOVE) {
+    metadata.erase(key);
+  }
+}
+
 std::list<SnapInfo> SnapInfo::generate_test_instances()
 {
   std::list<SnapInfo> ls;
diff --git a/src/mds/snap.h b/src/mds/snap.h
index fb8ccccc78d..41a52c8ba94 100644
--- a/src/mds/snap.h
+++ b/src/mds/snap.h
@@ -37,6 +37,12 @@ struct SnapInfo {
   void encode(ceph::buffer::list &bl) const;
   void decode(ceph::buffer::list::const_iterator &bl);
   void dump(ceph::Formatter *f) const;
+
+  bool will_md_op_succeed(const std::string& key, const std::string& val,
+                          const unsigned int op_flag) const;
+  void do_md_op(const std::string& key, const std::string& val,
+                const unsigned int op_flag);
+
   static std::list<SnapInfo> generate_test_instances();
 
   std::string_view get_long_name() const;

From 5726edbcf37ed9c3cf7835bdc3447c7a4fecec55 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 17 Nov 2025 17:53:56 +0530
Subject: [PATCH 295/596] libcephfs: provide API to mutate snapshot metadata

Fixes: https://tracker.ceph.com/issues/66293
Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/include/cephfs/libcephfs.h | 16 ++++++++++++++++
 src/libcephfs.cc               | 12 ++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/src/include/cephfs/libcephfs.h b/src/include/cephfs/libcephfs.h
index 12c202ae12e..237cbbec0cd 100644
--- a/src/include/cephfs/libcephfs.h
+++ b/src/include/cephfs/libcephfs.h
@@ -861,6 +861,22 @@ int ceph_mksnap(struct ceph_mount_info *cmount, const char *path, const char *na
  */
 int ceph_rmsnap(struct ceph_mount_info *cmount, const char *path, const char *name);
 
+/**
+ * Add, update or remove snapshot metadata.
+ *
+ * @param cmount the ceph mount handle to use for making the directory.
+ * @param path the path of the snapshot. This must be either an absolute
+ *        path or a path relative to CWD.
+ * @param mds_key key for the key-value pair in snapshot metadata.
+ * @param mds_val value for the key-value pair in snapshot metadata.
+ * @param op_flag unsigned integer to indicate whether metadata op is create,
+ *        update or remove.
+ * @returns 0 on success or a negative return value on error.
+ */
+int ceph_do_snap_md_op(struct ceph_mount_info* cmount, const char* path,
+                       const char* md_key, const char* md_val,
+                       const unsigned int op_flag);
+
 /**
  * Create multiple directories at once.
  *
diff --git a/src/libcephfs.cc b/src/libcephfs.cc
index 0eeddd7167e..add7e30ad3a 100644
--- a/src/libcephfs.cc
+++ b/src/libcephfs.cc
@@ -1077,6 +1077,18 @@ extern "C" int ceph_rmsnap(struct ceph_mount_info *cmount, const char *path, con
   return cmount->get_client()->rmsnap(path, name, cmount->default_perms, true);
 }
 
+extern "C" int ceph_do_snap_md_op(struct ceph_mount_info* cmount,
+                                  const char* path, const char* md_key,
+                                  const char* md_val,
+                                  const unsigned int op_flag)
+{
+  if (!cmount->is_mounted())
+    return -ENOTCONN;
+
+  return cmount->get_client()->do_snap_md_op(path, md_key, md_val, op_flag,
+                                             cmount->default_perms);
+}
+
 extern "C" int ceph_mkdirs(struct ceph_mount_info *cmount, const char *path, mode_t mode)
 {
   if (!cmount->is_mounted())

From 446bd6af1123884912ffbb743950c99c6b699267 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Wed, 19 Nov 2025 22:42:35 +0530
Subject: [PATCH 296/596] tests/libcephfs: add tests for snap metadata
 mutations

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/test/libcephfs/multiclient.cc |  66 +++++
 src/test/libcephfs/test.cc        | 426 ++++++++++++++++++++++++++++++
 2 files changed, 492 insertions(+)

diff --git a/src/test/libcephfs/multiclient.cc b/src/test/libcephfs/multiclient.cc
index a7155853f57..371b82b7bb6 100644
--- a/src/test/libcephfs/multiclient.cc
+++ b/src/test/libcephfs/multiclient.cc
@@ -16,6 +16,7 @@
 #include "gtest/gtest.h"
 #include "include/compat.h"
 #include "include/cephfs/libcephfs.h"
+#include "include/ceph_fs.h"
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -179,3 +180,68 @@ TEST(LibCephFS, MulticlientRevokeCaps) {
   thread1.join();
   thread2.join();
 }
+
+
+// Test that client #2 can successfully read snap metadata mutation made by
+// client #1.
+TEST(LibCephFS, SnapMdMutate) {
+  struct ceph_mount_info *cmount, *cmount2;
+
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(ceph_mount(cmount, NULL), 0);
+
+  ASSERT_EQ(ceph_create(&cmount2, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount2, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount2, NULL), 0);
+  ASSERT_EQ(ceph_mount(cmount2, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-5", getpid());
+  sprintf(snap_name, "snap_%d_5", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"},
+                                      {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test -
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "foo", "bar123",
+                                  CEPH_SNAP_MD_OP_CREATE));
+
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount2, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 3);
+
+  // verify snap metadata
+  struct snap_metadata snap_meta2[] = {{"foo", "bar123"}, {"this", "that"},
+                                       {"abcde", "12345"}};
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0;  j < std::size(snap_meta2); ++j) {
+      if (k == snap_meta2[j].key and v == snap_meta2[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+  ceph_shutdown(cmount2);
+}
diff --git a/src/test/libcephfs/test.cc b/src/test/libcephfs/test.cc
index 7d3aed44a2b..2347cc45670 100644
--- a/src/test/libcephfs/test.cc
+++ b/src/test/libcephfs/test.cc
@@ -17,6 +17,7 @@
 #include "include/filepath.h"
 #include "gtest/gtest.h"
 #include "include/cephfs/libcephfs.h"
+#include "include/ceph_fs.h"
 #include "mds/mdstypes.h"
 #include "include/stat.h"
 #include <errno.h>
@@ -2799,6 +2800,431 @@ TEST(LibCephFS, SnapInfo) {
   ceph_shutdown(cmount);
 }
 
+// Test that ceph_do_snap_md_op() in create mode successfully adds new k-v
+// pairs to snapshot metadata.
+TEST(LibCephFS, SnapMdCreateAdds) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-2", getpid());
+  sprintf(snap_name, "snap_%d_2", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"},
+                                      {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test.
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "foo2", "bar2",
+                                  CEPH_SNAP_MD_OP_CREATE));
+
+  // get latest snap metadata
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 4);
+
+  // verify snap metadata
+  struct snap_metadata snap_meta2[] = {{"foo", "bar"}, {"foo2", "bar2"},
+                                       {"this", "that"}, {"abcde", "12345"}};
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0;  j < std::size(snap_meta2); ++j) {
+      if (k == snap_meta2[j].key and v == snap_meta2[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ceph_free_snap_info_buffer(&info);
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
+
+// Test that ceph_do_snap_md_op() in create mode successfully updates new k-v
+// pairs to snapshot metadata.
+TEST(LibCephFS, SnapMdCreateUpdates) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-2", getpid());
+  sprintf(snap_name, "snap_%d_2", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"},
+                                      {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test.
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "foo", "bar2",
+                                  CEPH_SNAP_MD_OP_CREATE));
+
+  // get latest snap metadata
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 3);
+
+  // verify snap metadata
+  struct snap_metadata snap_meta2[] = {{"foo", "bar2"}, {"this", "that"},
+                                       {"abcde", "12345"}};
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0;  j < std::size(snap_meta2); ++j) {
+      if (k == snap_meta2[j].key and v == snap_meta2[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ceph_free_snap_info_buffer(&info);
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
+
+// Test that k-v pair is added successfully by ceph_do_snap_md_op() in
+// EXCL mode.
+TEST(LibCephFS, SnapMdExclAdds) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-1", getpid());
+  sprintf(snap_name, "snap_%d_1", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"}, {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test.
+  ASSERT_EQ(0,
+            ceph_do_snap_md_op(cmount, snap_path, "foo2", "bar2",
+                               CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL));
+
+  // get latest snap metadata
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 4);
+
+  // verify snap metadata
+  struct snap_metadata snap_meta2[] = {{"foo", "bar"}, {"foo2", "bar2"},
+                                       {"this", "that"}, {"abcde", "12345"}};
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0;  j < std::size(snap_meta2); ++j) {
+      if (k == snap_meta2[j].key and v == snap_meta2[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ceph_free_snap_info_buffer(&info);
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
+
+// Test that k-v pair update is rejected successfully by ceph_do_snap_md_op() in
+// EXCL mode.
+TEST(LibCephFS, SnapMdExclRejectsUpdate) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-1", getpid());
+  sprintf(snap_name, "snap_%d_1", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"}, {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test.
+  ASSERT_EQ(-EINVAL,
+            ceph_do_snap_md_op(cmount, snap_path, "foo", "bar2",
+                               CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL));
+
+  // get latest snap metadata
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 3);
+
+  // verify snap metadata
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0;  j < std::size(snap_meta); ++j) {
+      if (k == snap_meta[j].key and v == snap_meta[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ceph_free_snap_info_buffer(&info);
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
+
+// Test that ceph_do_snap_md_op() in remove mode successfully removes k-v
+// pairs from snapshot metadata.
+TEST(LibCephFS, SnapMdRemove) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-3", getpid());
+  sprintf(snap_name, "snap_%d_3", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"},
+                                      {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test.
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "foo", "bar",
+                                  CEPH_SNAP_MD_OP_REMOVE));
+
+  // get latest snap metadata
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 2);
+
+  // verify snap metadata
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    assert(k != "foo");
+    assert(v != "bar");
+
+    bool found = false;
+    for (size_t j = 1; j < std::size(snap_meta); ++j) {
+      if (k == snap_meta[j].key and v == snap_meta[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
+// Test all snap MD operations with empty strings.
+TEST(LibCephFS, SnapMdOpEmptyStrings) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-4", getpid());
+  sprintf(snap_name, "snap_%d_4", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"}, {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual testing begins...
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "", "",
+                                  CEPH_SNAP_MD_OP_CREATE));
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "", "1",
+                                  CEPH_SNAP_MD_OP_CREATE));
+
+  ASSERT_EQ(0,
+            ceph_do_snap_md_op(cmount, snap_path, "1", "",
+                               CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL));
+
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "", "",
+                                  CEPH_SNAP_MD_OP_REMOVE));
+  ASSERT_EQ(0, ceph_do_snap_md_op(cmount, snap_path, "1", "",
+                                  CEPH_SNAP_MD_OP_REMOVE));
+
+  // get latest snap metadata
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 3);
+
+  // verify snap metadata
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0; j < std::size(snap_meta); ++j) {
+      if (k == snap_meta[j].key and v == snap_meta[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
+// Test that ceph_do_snap_md_op() disallows inapproriate ops depending on
+// mode.
+TEST(LibCephFS, SnapMdNegTest) {
+  struct ceph_mount_info *cmount;
+  ASSERT_EQ(ceph_create(&cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_read_file(cmount, NULL), 0);
+  ASSERT_EQ(ceph_conf_parse_env(cmount, NULL), 0);
+  ASSERT_EQ(do_ceph_mount(cmount, NULL), 0);
+
+  char dir_path[64];
+  char snap_name[64];
+  char snap_path[PATH_MAX];
+  sprintf(dir_path, "/dir0_%d-5", getpid());
+  sprintf(snap_name, "snap_%d_5", getpid());
+  sprintf(snap_path, "%s/.snap/%s", dir_path, snap_name);
+
+  ASSERT_EQ(0, ceph_mkdir(cmount, dir_path, 0755));
+  // snapshot with custom metadata
+  struct snap_metadata snap_meta[] = {{"foo", "bar"},
+                                      {"this", "that"},
+                                      {"abcde", "12345"}};
+  ASSERT_EQ(0, ceph_mksnap(cmount, dir_path, snap_name, 0755, snap_meta,
+                           std::size(snap_meta)));
+
+  // actual test -
+  // attempt create in EXCL mode.
+  ASSERT_EQ(-EINVAL,
+            ceph_do_snap_md_op(cmount, snap_path, "foo", "bar2",
+                               CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL));
+  // attempt remove for an unexisting key.
+  ASSERT_EQ(-EINVAL, ceph_do_snap_md_op(cmount, snap_path, "foo2", "bar2",
+                                        CEPH_SNAP_MD_OP_REMOVE));
+  // run ceph_do_snap_md_op() in invalid mode/with invalid op_flag.
+  ASSERT_EQ(-EINVAL, ceph_do_snap_md_op(cmount, snap_path, "foo123", "bar123",
+                                        5));
+
+  struct snap_info info;
+  ASSERT_EQ(0, ceph_get_snap_info(cmount, snap_path, &info));
+  ASSERT_GT(info.id, 1);
+  ASSERT_EQ(info.nr_snap_metadata, 3);
+
+  // verify snap metadata
+  for (size_t i = 0; i < info.nr_snap_metadata; ++i) {
+    auto k = std::string(info.snap_metadata[i].key);
+    auto v = std::string(info.snap_metadata[i].value);
+
+    bool found = false;
+    for (size_t j = 0; j < std::size(snap_meta); ++j) {
+      if (k == snap_meta[j].key and v == snap_meta[j].value) {
+        found = true;
+        break;
+      }
+    }
+
+    ASSERT_EQ(found, true);
+  }
+
+  // teardown
+  ASSERT_EQ(0, ceph_rmsnap(cmount, dir_path, snap_name));
+  ASSERT_EQ(0, ceph_rmdir(cmount, dir_path));
+  ceph_shutdown(cmount);
+}
+
 TEST(LibCephFS, LookupInoMDSDir) {
   struct ceph_mount_info *cmount;
   ASSERT_EQ(ceph_create(&cmount, NULL), 0);

From 8d5cf70ba6affe5fcb921509befc59c990c5a3bf Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Wed, 1 Apr 2026 18:01:56 +0530
Subject: [PATCH 297/596] pybind/cephfs: add python binding for
 ceph_do_snap_md_op()

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/pybind/cephfs/c_cephfs.pxd    |  5 ++++
 src/pybind/cephfs/cephfs.pyx      | 49 +++++++++++++++++++++++++++++++
 src/pybind/cephfs/mock_cephfs.pxi |  6 ++++
 3 files changed, 60 insertions(+)

diff --git a/src/pybind/cephfs/c_cephfs.pxd b/src/pybind/cephfs/c_cephfs.pxd
index 9d5b93c0493..56f1d7d1899 100644
--- a/src/pybind/cephfs/c_cephfs.pxd
+++ b/src/pybind/cephfs/c_cephfs.pxd
@@ -148,10 +148,15 @@ cdef extern from "cephfs/libcephfs.h" nogil:
 
     int ceph_mkdir(ceph_mount_info *cmount, const char *path, mode_t mode)
     int ceph_mkdirat(ceph_mount_info *cmount, int dirfd, const char *relpath, mode_t mode)
+
     int ceph_mksnap(ceph_mount_info *cmount, const char *path, const char *name, mode_t mode, snap_metadata *snap_metadata, size_t nr_snap_metadata)
     int ceph_rmsnap(ceph_mount_info *cmount, const char *path, const char *name)
     int ceph_get_snap_info(ceph_mount_info *cmount, const char *path, snap_info *snap_info)
     void ceph_free_snap_info_buffer(snap_info *snap_info)
+    int ceph_do_snap_md_op(ceph_mount_info *cmount, const char *path,
+                           const char *md_key, const char *md_val,
+                           const unsigned int op_flag)
+
     int ceph_mkdirs(ceph_mount_info *cmount, const char *path, mode_t mode)
     int ceph_closedir(ceph_mount_info *cmount, ceph_dir_result *dirp)
     int ceph_opendir(ceph_mount_info *cmount, const char *name, ceph_dir_result **dirpp)
diff --git a/src/pybind/cephfs/cephfs.pyx b/src/pybind/cephfs/cephfs.pyx
index 650beacb975..6e0264fc17c 100644
--- a/src/pybind/cephfs/cephfs.pyx
+++ b/src/pybind/cephfs/cephfs.pyx
@@ -72,6 +72,20 @@ CEPH_SETATTR_BTIME = 0x200
 
 CEPH_NOSNAP = -2
 
+
+# XXX: DON'T FORGET to update values in src/include/cephfs/snap_types.h, if you
+# make any changes below.
+#
+# NOTE: Regretfully re-defined here to avoid all the compiler/path black magic
+# required to pass the "docs" CI job. Compiling via 'cdef extern' works locally
+# but fails in the isolated ReadTheDocs build environment due to missing directory
+# hierarchies.
+cpdef enum:
+    CEPH_SNAP_MD_OP_CREATE = (1 << 0)
+    CEPH_SNAP_MD_OP_EXCL   = (1 << 1)
+    CEPH_SNAP_MD_OP_REMOVE = (1 << 2)
+
+
 # XXX: errno definitions, hard-coded numbers here are errnos defined by Linux
 # that are used for the Ceph on-the-wire status codes.
 EBLOCKLISTED = ceph_to_hostos_errno(108)
@@ -1255,6 +1269,41 @@ cdef class LibCephFS(object):
             ceph_free_snap_info_buffer(&info)
         return {'id': info.id, 'metadata': md}
 
+    def do_snap_md_op(self, snap_path, md_key, md_val, op_flag):
+        '''
+        Create, update or remove a key-value pair from snapshot metadata.
+
+        :param snap_path: snapshot path
+        :param md_key: key for the key-value pair
+        :param md_val: value for the key-value pair
+        :param op_flag: flag indicating the op to be performed. it can be
+                        create, update or remove.
+
+        :raises: :class: `TypeError`
+        :raises: :class: `Error`
+
+        :returns: 0 on success
+        '''
+        self.require_state('mounted')
+
+        snap_path = cstr(snap_path, 'snap_path')
+        md_key = cstr(md_key, 'md_key')
+        md_val = cstr(md_val, 'md_val')
+
+        if not isinstance(op_flag, int):
+            raise TypeError('"op_flag" must be an int')
+
+        cdef:
+            char* _snap_path = snap_path
+            char* _md_key = md_key
+            char* _md_val = md_val
+            int _op_flag = op_flag
+
+        with nogil:
+            ret = ceph_do_snap_md_op(self.cluster, _snap_path, _md_key, _md_val, _op_flag)
+        if ret < 0:
+            raise make_ex(ret, 'snap_md_op')
+
     def chmod(self, path, mode) -> None:
         """
         Change directory mode.
diff --git a/src/pybind/cephfs/mock_cephfs.pxi b/src/pybind/cephfs/mock_cephfs.pxi
index 9c2b0f2e0bd..bd3e54e040e 100644
--- a/src/pybind/cephfs/mock_cephfs.pxi
+++ b/src/pybind/cephfs/mock_cephfs.pxi
@@ -207,6 +207,7 @@ cdef nogil:
         pass
     int ceph_mkdirat(ceph_mount_info *cmount, int dirfd, const char *relpath, mode_t mode):
         pass
+
     int ceph_mksnap(ceph_mount_info *cmount, const char *path, const char *name, mode_t mode, snap_metadata *snap_metadata, size_t nr_snap_metadata):
         pass
     int ceph_rmsnap(ceph_mount_info *cmount, const char *path, const char *name):
@@ -215,6 +216,11 @@ cdef nogil:
         pass
     void ceph_free_snap_info_buffer(snap_info *snap_info):
         pass
+    int ceph_do_snap_md_op(ceph_mount_info* cmount, const char* path,
+                           const char* md_key, const char* md_val,
+                           const unsigned int op_flag):
+        pass
+
     int ceph_mkdirs(ceph_mount_info *cmount, const char *path, mode_t mode):
         pass
     int ceph_closedir(ceph_mount_info *cmount, ceph_dir_result *dirp):

From df7abb7a7b7be952e30e2ac286b108c3cab5ca90 Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Wed, 1 Apr 2026 18:02:28 +0530
Subject: [PATCH 298/596] test_cephfs.py: add tests for do_snap_md_op()

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 src/test/pybind/test_cephfs.py | 227 +++++++++++++++++++++++++++++++++
 1 file changed, 227 insertions(+)

diff --git a/src/test/pybind/test_cephfs.py b/src/test/pybind/test_cephfs.py
index 89db36fa8a7..72ed8097930 100644
--- a/src/test/pybind/test_cephfs.py
+++ b/src/test/pybind/test_cephfs.py
@@ -3243,3 +3243,230 @@ class TestFcopyfile:
         mode.
         '''
         self._write_file_and_test_fcopyfile(testdir, int(1 * 1000 * 1000 * 1000))
+
+
+class TestDoSnapMdOp:
+    '''
+    Contains tests for do_snap_md_op().
+    '''
+
+    def test_create_allows_adding(self, testdir):
+        '''
+        Test that do_snap_md_op() allows adding new key-value pairs to snapshot
+        metadata in create mode.
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        cephfs.do_snap_md_op(snap_path, 'foo2', 'bar2',
+                             libcephfs.CEPH_SNAP_MD_OP_CREATE)
+        # update metadata at our end too.
+        md['foo2'] = 'bar2'
+
+        # verify that "create" was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['foo2'], md['foo2'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+        assert_greater(snap_info['id'], 1)
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)
+
+    def test_create_allows_updating(self, testdir):
+        '''
+        Test that do_snap_md_op() allows updating new key-value pairs to snapshot
+        metadata in create mode.
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        cephfs.do_snap_md_op(snap_path, 'foo', 'bar123',
+                             libcephfs.CEPH_SNAP_MD_OP_CREATE)
+        # update metadata at our end too.
+        md['foo'] = 'bar123'
+
+        # verify that "create" was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+        assert_greater(snap_info['id'], 1)
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)
+
+    def test_excl_allows_adding(self, testdir):
+        '''
+        Test that do_snap_md_op() allows adding key-value pair in snapshot
+        metadata in EXCL mode.
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        cephfs.do_snap_md_op(snap_path, 'foo2', 'bar2',
+                             libcephfs.CEPH_SNAP_MD_OP_CREATE | \
+                             libcephfs.CEPH_SNAP_MD_OP_EXCL)
+        # update metadata at our end too.
+        md['foo2'] = 'bar2'
+
+        # verify that update was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+        assert_greater(snap_info['id'], 1)
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)
+
+    def test_excl_disallows_updating(self, testdir):
+        '''
+        Test that do_snap_md_op() rejects updating key-value pair in snapshot
+        metadata in EXCL mode.
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        assert_raises(libcephfs.InvalidValue, cephfs.do_snap_md_op, snap_path,
+                      'foo', 'bar123', libcephfs.CEPH_SNAP_MD_OP_CREATE | \
+                      libcephfs.CEPH_SNAP_MD_OP_EXCL)
+
+        # verify that update was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+        assert_greater(snap_info['id'], 1)
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)
+
+    def test_remove(self, testdir):
+        '''
+        Test that do_snap_md_op() allows removing key-value pairs from snapshot
+        metadata.
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'foo2': 'bar2', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        cephfs.do_snap_md_op(snap_path, 'foo2', 'bar2',
+                             libcephfs.CEPH_SNAP_MD_OP_REMOVE)
+        # update metadata at our end too.
+        md.pop('foo2')
+
+        # verify that "create" was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+        try:
+            snap_info['metadata']['foo2']
+        except KeyError:
+            pass
+        else:
+            raise RuntimeError('Key "foo2" must\'ve been absent in snapshot '
+                                'metadata')
+        assert_greater(snap_info['id'], 1)
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)
+
+    def test_with_empty_strings(self, testdir):
+        '''
+        Test all snap MD ops with empty string
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        # test adding k-v pair via CREATE with empty strings
+        cephfs.do_snap_md_op(snap_path, '', '',
+                             libcephfs.CEPH_SNAP_MD_OP_CREATE)
+        cephfs.do_snap_md_op(snap_path, '', '1',
+                             libcephfs.CEPH_SNAP_MD_OP_CREATE)
+
+        # test adding k-v pair via EXCL with empty strings
+        cephfs.do_snap_md_op(snap_path, '1', '',
+                             libcephfs.CEPH_SNAP_MD_OP_CREATE | \
+                             libcephfs.CEPH_SNAP_MD_OP_EXCL)
+
+        # test remove k-v with empty strings
+        cephfs.do_snap_md_op(snap_path, '', '',
+                             libcephfs.CEPH_SNAP_MD_OP_REMOVE)
+        cephfs.do_snap_md_op(snap_path, '1', '',
+                             libcephfs.CEPH_SNAP_MD_OP_REMOVE)
+
+        # verify that "create" was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)
+
+    def test_neg(self, testdir):
+        '''
+        Test that do_snap_md_op() errors out when snapshot metadata operation
+        fails.
+        '''
+        dir_path = '/dir1'
+        snap_name = 'snap0'
+        snap_path = os.path.join(dir_path, '.snap', snap_name)
+
+        cephfs.mkdir(dir_path, 0o755)
+        md = {'foo': 'bar', 'zig': 'zag', 'abcdefg': '12345'}
+        cephfs.mksnap(dir_path, snap_name, 0o755, metadata=md)
+
+        # actual testing begins
+        # test updating k-v pair in EXCL mode
+        assert_raises(libcephfs.InvalidValue, cephfs.do_snap_md_op, snap_path,
+                      'foo', 'bar2', libcephfs.CEPH_SNAP_MD_OP_CREATE | \
+                      libcephfs.CEPH_SNAP_MD_OP_EXCL)
+        # test remove non-existing k-v pair
+        assert_raises(libcephfs.InvalidValue, cephfs.do_snap_md_op, snap_path,
+                      'foo2', 'bar2', libcephfs.CEPH_SNAP_MD_OP_REMOVE)
+        # test with invalid op_flag
+        assert_raises(libcephfs.InvalidValue, cephfs.do_snap_md_op, snap_path,
+                      'foo2', 'bar2', 5)
+
+        # verify that "create" was successful
+        snap_info = cephfs.snap_info(snap_path)
+        assert_equal(snap_info['metadata']['foo'], md['foo'])
+        assert_equal(snap_info['metadata']['zig'], md['zig'])
+        assert_equal(snap_info['metadata']['abcdefg'], md['abcdefg'])
+        assert_greater(snap_info['id'], 1)
+
+        cephfs.rmsnap(dir_path, snap_name)
+        cephfs.rmdir(dir_path)

From 7f1f0e9eb2fabb88a8e44525cb8490a44a95a79d Mon Sep 17 00:00:00 2001
From: Rishabh Dave <ridave@redhat.com>
Date: Mon, 15 Jun 2026 16:39:25 +0530
Subject: [PATCH 299/596] PendingReleaseNotes: add note for mutability of
 CephFS snapshot metadata

Signed-off-by: Rishabh Dave <ridave@redhat.com>
---
 PendingReleaseNotes | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 2e2a19fc25f..edb30eea8b0 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -2,6 +2,10 @@
   on its OSDs, with OSDs shared across multiple roots contributing proportionally
   less to each root's allocation.
   
+* CephFS: CephFS snapshots metadata is now mutable. It is now possible to add,
+  update and remove existing key-value pairs that are part of a snapshot
+  metadata via libcephfs API ceph_do_snap_md_op().
+
 * librados/neorados: The C++ APIs for executing Ceph Class (CLS) methods
   have undergone a breaking change to enforce compile-time type safety, replacing
   legacy string-based parameters with strongly-typed ClsMethod structs. C++

From 955d7e68ea548c29cb9267894b7221e61f93af17 Mon Sep 17 00:00:00 2001
From: Vallari Agrawal <vallari.agrawal@ibm.com>
Date: Tue, 16 Jun 2026 20:08:29 +0530
Subject: [PATCH 300/596] mgr/dashboard: Add "gw refresh_network" cmd

Fixes: https://tracker.ceph.com/issues/77442

Signed-off-by: Vallari Agrawal <vallari.agrawal@ibm.com>
---
 .../mgr/dashboard/controllers/nvmeof.py       | 37 ++++++++++++
 src/pybind/mgr/dashboard/model/nvmeof.py      |  7 +++
 src/pybind/mgr/dashboard/openapi.yaml         | 57 +++++++++++++++++++
 3 files changed, 101 insertions(+)

diff --git a/src/pybind/mgr/dashboard/controllers/nvmeof.py b/src/pybind/mgr/dashboard/controllers/nvmeof.py
index 557ea546ef1..95065f361bd 100644
--- a/src/pybind/mgr/dashboard/controllers/nvmeof.py
+++ b/src/pybind/mgr/dashboard/controllers/nvmeof.py
@@ -330,6 +330,43 @@ else:
                 NVMeoFClient.pb2.get_thread_stats_req()
             )
 
+        @UpdatePermission
+        @Endpoint('PUT', '/refresh_network')
+        @NvmeofCLICommand(
+            "nvmeof gateway refresh_network", model.GwRefreshNetworkStatus,
+            alias="nvmeof gw refresh_network",
+            success_message_template=("Refreshed configured network masks for subsystem "
+                                      "{nqn} on this gateway: Successful{added}{removed}"),
+            success_message_map={
+                "added": lambda v, _f: f"\nAdded: {', '.join(v)}" if v else "",
+                "removed": lambda v, _f: f"\nRemoved: {', '.join(v)}" if v else "",
+            }
+        )
+        @EndpointDoc(
+            "Re-evaluate subsystem network masks and update auto-listeners for this gateway",
+            parameters={
+                "nqn": Param(str, "NVMeoF subsystem NQN"),
+                "gw_group": Param(str, "NVMeoF gateway group", True, None),
+                "server_address": Param(str, "NVMeoF gateway address", True, None),
+                "traddr": Param(str, "NVMeoF gateway address (deprecated)", True, None),
+            },
+        )
+        @convert_to_model(model.GwRefreshNetworkStatus)
+        @handle_nvmeof_error
+        def refresh_network(self, nqn: str, gw_group: Optional[str] = None,
+                            server_address: Optional[str] = None,
+                            traddr: Optional[str] = None):
+            server_address = resolve_nvmeof_server_address(
+                server_address=server_address,
+                traddr=traddr
+            )
+            return NVMeoFClient(
+                gw_group=gw_group,
+                server_address=server_address
+            ).stub.gw_refresh_network(
+                NVMeoFClient.pb2.gw_refresh_network_req(subsystem_nqn=nqn)
+            )
+
     @APIRouter("/nvmeof/spdk", Scope.NVME_OF)
     @APIDoc("NVMe-oF SPDK Management API", "NVMe-oF SPDK")
     class NVMeoFSpdk(RESTController):
diff --git a/src/pybind/mgr/dashboard/model/nvmeof.py b/src/pybind/mgr/dashboard/model/nvmeof.py
index f4b7327514e..ec703740042 100644
--- a/src/pybind/mgr/dashboard/model/nvmeof.py
+++ b/src/pybind/mgr/dashboard/model/nvmeof.py
@@ -369,6 +369,13 @@ class RequestStatus(NamedTuple):
     error_message: str
 
 
+class GwRefreshNetworkStatus(NamedTuple):
+    status: int
+    error_message: str
+    added: List[str]
+    removed: List[str]
+
+
 class ListenAdress(NamedTuple):
     trtype: str
     adrfam: str
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index 2ddd1190b47..1bbd2efbee7 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -12916,6 +12916,63 @@ paths:
       summary: Set NVMeoF gateway log levels
       tags:
       - NVMe-oF Gateway
+  /api/nvmeof/gateway/refresh_network:
+    put:
+      parameters: []
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                gw_group:
+                  description: NVMeoF gateway group
+                  type: string
+                nqn:
+                  description: NVMeoF subsystem NQN
+                  type: string
+                server_address:
+                  description: NVMeoF gateway address
+                  type: string
+                traddr:
+                  description: NVMeoF gateway address (deprecated)
+                  type: string
+              required:
+              - nqn
+              type: object
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Resource updated.
+        '202':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Operation is still executing. Please check the task queue.
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Re-evaluate subsystem network masks and update auto-listeners for this
+        gateway
+      tags:
+      - NVMe-oF Gateway
   /api/nvmeof/gateway/stats:
     get:
       parameters:

From 268a8578032498dde6caaacf1edd1b9700bfa2cd Mon Sep 17 00:00:00 2001
From: Naman Munet <naman.munet@ibm.com>
Date: Thu, 18 Jun 2026 13:34:55 +0530
Subject: [PATCH 301/596] mgr/dashboard: fix daemon e2e

fixes: https://tracker.ceph.com/issues/77489

Signed-off-by: Naman Munet <naman.munet@ibm.com>
---
 .../mgr/dashboard/frontend/cypress/e2e/rgw/daemons.po.ts   | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/daemons.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/daemons.po.ts
index 6fabffd9e2e..258b21bf466 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/daemons.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/daemons.po.ts
@@ -25,8 +25,11 @@ export class DaemonsPageHelper extends PageHelper {
     // click on performance counters tab and check table is loaded
     cy.contains('.nav-link', 'Performance Counters').click();
 
-    // check at least one field is present
-    this.getTableCell().should('be.visible').should('contain.text', 'objecter.op_r');
+    // check at least one field is present (objecter counter may have memory address suffix)
+    this.getTableCell()
+      .should('be.visible')
+      .invoke('text')
+      .should('match', /objecter.*\.op_r/);
 
     // click on performance details tab
     cy.contains('.nav-link', 'Performance Details').click();

From 3d174f6b40704b42add17e6f96795bf237880fa0 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Sat, 13 Jun 2026 18:24:45 +0800
Subject: [PATCH 302/596] crimson/os/seastore/lba: no need to pass the
 reference to the transaction when synchronously updating the lba mapping

Because the transaction can be captured by the functor itself

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/lba/btree_lba_manager.cc | 4 ++--
 src/crimson/os/seastore/transaction.h            | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/crimson/os/seastore/lba/btree_lba_manager.cc b/src/crimson/os/seastore/lba/btree_lba_manager.cc
index 6a42f5ae662..6fa10fcd948 100644
--- a/src/crimson/os/seastore/lba/btree_lba_manager.cc
+++ b/src/crimson/os/seastore/lba/btree_lba_manager.cc
@@ -1204,8 +1204,8 @@ BtreeLBAManager::_copy_mapping(
   c.trans.new_lba_key_copied(
     ret.src->get_key(),
     dest_laddr,
-    [this](Transaction &t, laddr_t laddr, paddr_t paddr) {
-      update_paddr_sync(t, laddr, paddr);
+    [this, c](laddr_t laddr, paddr_t paddr) {
+      update_paddr_sync(c.trans, laddr, paddr);
     });
   auto [niter, inserted] = co_await btree.copy(
       c,
diff --git a/src/crimson/os/seastore/transaction.h b/src/crimson/os/seastore/transaction.h
index 3c2be49db9a..dc2751e5835 100644
--- a/src/crimson/os/seastore/transaction.h
+++ b/src/crimson/os/seastore/transaction.h
@@ -671,7 +671,7 @@ public:
   bool force_rewrite_conflict = false;
 
   using update_copied_lba_key_func_t =
-    std::function<void (Transaction&, laddr_t, paddr_t)>;
+    std::function<void (laddr_t, paddr_t)>;
   void new_lba_key_copied(
     laddr_t src,
     laddr_t dest,
@@ -691,7 +691,7 @@ public:
       return;
     }
     laddr_t key = it->second;
-    update_copied_lba_key(*this, key, paddr);
+    update_copied_lba_key(key, paddr);
   }
   RootBlockRef peek_root() {
     return root;
@@ -923,7 +923,7 @@ private:
   cache_hint_t cache_hint = CACHE_HINT_TOUCH;
 
   std::map<laddr_t, laddr_t> copied_lba_keys;
-  std::function<void (Transaction&, laddr_t, paddr_t)> update_copied_lba_key;
+  update_copied_lba_key_func_t update_copied_lba_key;
 };
 using TransactionRef = Transaction::Ref;
 

From 5d52c075903dc0792ce97e20985d299c964aad40 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Sat, 13 Jun 2026 18:25:51 +0800
Subject: [PATCH 303/596] crimson/os/seastore/lba: don't update the lba mapping
 if its child is an initial pending one.

Because initial pending extents' paddrs are considered newer.

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/lba/btree_lba_manager.cc | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/crimson/os/seastore/lba/btree_lba_manager.cc b/src/crimson/os/seastore/lba/btree_lba_manager.cc
index 6fa10fcd948..1558802eb71 100644
--- a/src/crimson/os/seastore/lba/btree_lba_manager.cc
+++ b/src/crimson/os/seastore/lba/btree_lba_manager.cc
@@ -1154,6 +1154,14 @@ void BtreeLBAManager::update_paddr_sync(
   auto btree = get_btree_sync<LBABtree>(c);
   auto iter = btree.lower_bound_sync(c, laddr);
   assert(iter.get_leaf_node()->is_pending());
+  auto child = iter.get_leaf_node()->get_child_sync<LogicalChildNode>(
+    c.trans, c.cache, iter.get_leaf_pos(), iter.get_key());
+  ceph_assert(child);
+  if (child->is_initial_pending()) {
+    TRACET("{} is initial_pending, skipping", t, *child);
+    return;
+  }
+  ceph_assert(child->is_exist_clean());
   auto cursor = iter.get_cursor(c);
   assert(cursor->get_laddr() == laddr);
   btree.update(

From f08533c4877d30462d1c86e89486d7f6be9dced9 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Mon, 15 Jun 2026 10:43:36 +0800
Subject: [PATCH 304/596] crimson/os/seastore/lba: don't update
 LBALeafNode::modifications when updating the lba mapping for committing
 rewrite transactions

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 .../os/seastore/backref/backref_tree_node.h   |  3 ++-
 .../os/seastore/btree/fixed_kv_btree.h        | 19 +++++++++++++++++--
 src/crimson/os/seastore/btree/fixed_kv_node.h |  3 ++-
 .../os/seastore/lba/btree_lba_manager.cc      |  3 ++-
 src/crimson/os/seastore/lba/lba_btree_node.cc |  7 +++++--
 src/crimson/os/seastore/lba/lba_btree_node.h  |  3 ++-
 6 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/src/crimson/os/seastore/backref/backref_tree_node.h b/src/crimson/os/seastore/backref/backref_tree_node.h
index d8d5961a9ad..8af8afaebe0 100644
--- a/src/crimson/os/seastore/backref/backref_tree_node.h
+++ b/src/crimson/os/seastore/backref/backref_tree_node.h
@@ -105,7 +105,8 @@ public:
 
   void update(
     const_iterator iter,
-    backref_map_val_t val) final {
+    backref_map_val_t val,
+    modification_t) final {
     return journal_update(
       iter,
       val,
diff --git a/src/crimson/os/seastore/btree/fixed_kv_btree.h b/src/crimson/os/seastore/btree/fixed_kv_btree.h
index b701062610a..fdfa31230ab 100644
--- a/src/crimson/os/seastore/btree/fixed_kv_btree.h
+++ b/src/crimson/os/seastore/btree/fixed_kv_btree.h
@@ -20,6 +20,16 @@
 
 namespace crimson::os::seastore {
 
+enum modification_t {
+  USER_MODIFY,  // logical update (affects node state)
+  TRANS_SYNC    // synchronization-only update (should NOT count
+                // as modification and should avoid on_modify(),
+                // for example, BtreeLBAManager::update_paddr_sync
+                // does not change the logical mapping, only the
+                // physical location (paddr) of the same data, so
+                // TRANS_SYNC is used.
+};
+
 template <typename T>
 phy_tree_root_t& get_phy_tree_root(root_t& r);
 
@@ -1108,7 +1118,8 @@ public:
     op_context_t c,
     iterator iter,
     node_val_t val,
-    BaseChildNode<leaf_node_t, node_key_t> *child)
+    BaseChildNode<leaf_node_t, node_key_t> *child,
+    modification_t mod = modification_t::USER_MODIFY)
   {
     LOG_PREFIX(FixedKVBtree::update);
     SUBTRACET(
@@ -1116,6 +1127,9 @@ public:
       "update element at {}",
       c.trans,
       iter.is_end() ? min_max_t<node_key_t>::max : iter.get_key());
+    if (mod == modification_t::TRANS_SYNC) {
+      assert(child == nullptr);
+    }
     if (!iter.leaf.node->is_mutable()) {
       CachedExtentRef mut = c.cache.duplicate_for_write(
         c.trans, iter.leaf.node
@@ -1125,7 +1139,8 @@ public:
     ++(get_tree_stats<self_type>(c.trans).num_updates);
     iter.leaf.node->update(
       iter.leaf.node->iter_idx(iter.leaf.pos),
-      val);
+      val,
+      mod);
     if constexpr (std::is_base_of_v<
         ParentNode<leaf_node_t, node_key_t>, leaf_node_t>) {
       if (child) {
diff --git a/src/crimson/os/seastore/btree/fixed_kv_node.h b/src/crimson/os/seastore/btree/fixed_kv_node.h
index 74e5d47af7b..24475157938 100644
--- a/src/crimson/os/seastore/btree/fixed_kv_node.h
+++ b/src/crimson/os/seastore/btree/fixed_kv_node.h
@@ -729,7 +729,8 @@ struct FixedKVLeafNode
 
   virtual void update(
     internal_const_iterator_t iter,
-    VAL val) = 0;
+    VAL val,
+    modification_t mod) = 0;
   virtual internal_const_iterator_t insert(
     internal_const_iterator_t iter,
     NODE_KEY addr,
diff --git a/src/crimson/os/seastore/lba/btree_lba_manager.cc b/src/crimson/os/seastore/lba/btree_lba_manager.cc
index 1558802eb71..124aa1a4da2 100644
--- a/src/crimson/os/seastore/lba/btree_lba_manager.cc
+++ b/src/crimson/os/seastore/lba/btree_lba_manager.cc
@@ -1173,7 +1173,8 @@ void BtreeLBAManager::update_paddr_sync(
       cursor->get_refcount(),
       cursor->get_checksum(),
       cursor->get_extent_type()},
-    nullptr);
+    nullptr,
+    modification_t::TRANS_SYNC);
 }
 
 BtreeLBAManager::move_mapping_ret
diff --git a/src/crimson/os/seastore/lba/lba_btree_node.cc b/src/crimson/os/seastore/lba/lba_btree_node.cc
index ed94290f72a..1e819b032e5 100644
--- a/src/crimson/os/seastore/lba/lba_btree_node.cc
+++ b/src/crimson/os/seastore/lba/lba_btree_node.cc
@@ -46,13 +46,16 @@ void LBALeafNode::resolve_relative_addrs(paddr_t base)
 
 void LBALeafNode::update(
   internal_const_iterator_t iter,
-  lba_map_val_t val)
+  lba_map_val_t val,
+  modification_t mod)
 {
   LOG_PREFIX(LBALeafNode::update);
   SUBTRACE(seastore_fixedkv_tree, "trans.{}, pos {}",
     this->pending_for_transaction,
     iter.get_offset());
-  this->on_modify();
+  if (likely(mod == modification_t::USER_MODIFY)) {
+    this->on_modify();
+  }
   if (val.pladdr.is_paddr()) {
     val.pladdr = maybe_generate_relative(val.pladdr.get_paddr());
   }
diff --git a/src/crimson/os/seastore/lba/lba_btree_node.h b/src/crimson/os/seastore/lba/lba_btree_node.h
index cabb652bebf..92e2c333a53 100644
--- a/src/crimson/os/seastore/lba/lba_btree_node.h
+++ b/src/crimson/os/seastore/lba/lba_btree_node.h
@@ -141,7 +141,8 @@ struct LBALeafNode
 
   void update(
     internal_const_iterator_t iter,
-    lba_map_val_t val) final;
+    lba_map_val_t val,
+    modification_t mod) final;
 
   internal_const_iterator_t insert(
     internal_const_iterator_t iter,

From a35a92639f5dc8d6a98415711242f2491fb45f46 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sun, 14 Jun 2026 14:52:00 +0800
Subject: [PATCH 305/596] journal/ObjectPlayer: don't acquire locks in
 destructor

~ObjectPlayer took m_timer_lock only to assert two invariants. but that
lock is borrowed by reference from the caller's SafeTimer, and an
ObjectPlayer can outlive it: a C_Fetch/C_WatchFetch completion on the
librados finisher may hold the last reference and run ~ObjectPlayer after
the timer and its lock are already gone. re-taking the freed lock is a
heap-use-after-free, which unittest_journal hits on arm64 under ASan:

  ==ERROR: AddressSanitizer: heap-use-after-free
    journal::ObjectPlayer::~ObjectPlayer  ObjectPlayer.cc:63
    journal::ObjectPlayer::C_WatchFetch::~C_WatchFetch
    journal::ObjectPlayer::C_Fetch::finish

the lock isn't needed though: at refcount 0 the watch has been cancelled
(m_watch_ctx == nullptr, asserted below) so no timer task references us, and
no fetch is in flight since a pending fetch holds a reference. nothing else
can touch our state. Furthermore, we can also skip acquiring `m_lock` as
well, because, in the destructor, it shouldn't really matter -- if one
of these asserts fails because the execution of the destructor races
with some `ObjectPlayer` mthod, we would get what the `assert()` was
added for. They are here to catch bugs and such a race just being
possible is a bug in itself.

Fixes: https://tracker.ceph.com/issues/77496
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/journal/ObjectPlayer.cc | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/journal/ObjectPlayer.cc b/src/journal/ObjectPlayer.cc
index 29893cec2d9..e01355e2f72 100644
--- a/src/journal/ObjectPlayer.cc
+++ b/src/journal/ObjectPlayer.cc
@@ -59,12 +59,8 @@ ObjectPlayer::ObjectPlayer(librados::IoCtx &ioctx,
 }
 
 ObjectPlayer::~ObjectPlayer() {
-  {
-    std::lock_guard timer_locker{m_timer_lock};
-    std::lock_guard locker{m_lock};
-    ceph_assert(!m_fetch_in_progress);
-    ceph_assert(m_watch_ctx == nullptr);
-  }
+  ceph_assert(!m_fetch_in_progress);
+  ceph_assert(m_watch_ctx == nullptr);
 }
 
 void ObjectPlayer::fetch(Context *on_finish) {

From 7e8c2e062f4ee141c67ffe774b32857319ea9870 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 18 Jun 2026 20:31:13 +0800
Subject: [PATCH 306/596] debian/copyright: silence
 old-fsf-address-in-copyright-file

in order to silence the warnings like:

```
W: rbd-nbd: old-fsf-address-in-copyright-file
```

let's refere to the email address of FSF, instead of its old postal
address.

See https://lintian.debian.org/tags/old-fsf-address-in-copyright-file.html

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 debian/copyright | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/debian/copyright b/debian/copyright
index 8dc4b9e4f49..23e4ee2b9bd 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -209,9 +209,8 @@ License: GPL-2
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.
  .
- You should have received a copy of the GNU General Public License along
- with this program; if not, write to the Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ You should have received a copy of the GNU General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
  .
  On Debian systems, the complete text of the GNU General Public License
  version 2 can be found in `/usr/share/common-licenses/GPL-2' file.

From 1d3e33140b8f694e75a14f6530ec54712b984179 Mon Sep 17 00:00:00 2001
From: Sagar Gopale <sagar.gopale@ibm.com>
Date: Wed, 10 Jun 2026 18:59:50 +0530
Subject: [PATCH 307/596] mgr/dashboard: align RGW role management with Carbon
 and fix API routing

Fixes: https://tracker.ceph.com/issues/77328

Signed-off-by: Sagar Gopale <sagar.gopale@ibm.com>
---
 src/pybind/mgr/dashboard/controllers/rgw.py   |  37 +-
 .../frontend/cypress/e2e/rgw/accounts.po.ts   |   4 +-
 .../cypress/e2e/rgw/roles.e2e-spec.ts         |  31 +-
 .../frontend/cypress/e2e/rgw/roles.po.ts      |  99 +++--
 .../src/app/ceph/rgw/models/rgw-role.ts       |  22 +
 .../rgw-account-role-form.component.html      | 136 ++++++
 .../rgw-account-role-form.component.scss      |   0
 .../rgw-account-role-form.component.spec.ts   |  51 +++
 .../rgw-account-role-form.component.ts        | 114 +++++
 .../rgw-account-roles-list.component.html     |  14 +
 .../rgw-account-roles-list.component.scss     |   1 +
 .../rgw-account-roles-list.component.spec.ts  |  71 ++++
 .../rgw-account-roles-list.component.ts       | 167 ++++++++
 .../rgw-user-accounts-details.component.html  |  40 +-
 .../frontend/src/app/ceph/rgw/rgw.module.ts   |   6 +-
 .../app/shared/api/rgw-role.service.spec.ts   |  59 +++
 .../src/app/shared/api/rgw-role.service.ts    |  41 ++
 src/pybind/mgr/dashboard/openapi.yaml         | 388 ++++++++++--------
 .../mgr/dashboard/services/rgw_client.py      |  42 +-
 19 files changed, 1079 insertions(+), 244 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-role.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.ts

diff --git a/src/pybind/mgr/dashboard/controllers/rgw.py b/src/pybind/mgr/dashboard/controllers/rgw.py
index 9e06597f171..a0ef6965771 100755
--- a/src/pybind/mgr/dashboard/controllers/rgw.py
+++ b/src/pybind/mgr/dashboard/controllers/rgw.py
@@ -1230,49 +1230,52 @@ class RgwUser(RgwRESTController):
 
 class RGWRoleEndpoints:
     @staticmethod
-    def role_list(_):
+    def role_list(_, account_id: Optional[str] = None):
         rgw_client = RgwClient.admin_instance()
-        roles = rgw_client.list_roles()
+        roles = rgw_client.list_roles(account_id)
         return roles
 
     @staticmethod
-    def role_create(_, role_name: str = '', role_path: str = '', role_assume_policy_doc: str = ''):
+    def role_create(_, role_name: str = '', role_path: str = '', role_assume_policy_doc: str = '',
+                    account_id: Optional[str] = None):
         assert role_name
         assert role_path
         rgw_client = RgwClient.admin_instance()
-        rgw_client.create_role(role_name, role_path, role_assume_policy_doc)
+        rgw_client.create_role(role_name, role_path, role_assume_policy_doc, account_id)
         return f'Role {role_name} created successfully'
 
     @staticmethod
-    def role_update(_, role_name: str, max_session_duration: str):
+    def role_update(_, role_name: str, max_session_duration: str, account_id: Optional[str] = None):
         assert role_name
         assert max_session_duration
         # convert max_session_duration which is in hours to seconds
         max_session_duration = int(float(max_session_duration) * 3600)
         rgw_client = RgwClient.admin_instance()
-        rgw_client.update_role(role_name, str(max_session_duration))
+        rgw_client.update_role(role_name, str(max_session_duration), account_id)
         return f'Role {role_name} updated successfully'
 
     @staticmethod
-    def role_delete(_, role_name: str):
+    def role_delete(_, role_name: str, account_id: Optional[str] = None):
         assert role_name
         rgw_client = RgwClient.admin_instance()
-        rgw_client.delete_role(role_name)
+        rgw_client.delete_role(role_name, account_id)
         return f'Role {role_name} deleted successfully'
 
     @staticmethod
-    def model(role_name: str):
+    def get(_, role_name: str, account_id: Optional[str] = None):
         assert role_name
         rgw_client = RgwClient.admin_instance()
-        role = rgw_client.get_role(role_name)
-        model = {'role_name': '', 'max_session_duration': ''}
-        model['role_name'] = role['RoleName']
-
+        role = rgw_client.get_role(role_name, account_id)
+        model = {'role_name': role['RoleName'], 'max_session_duration': ''}
         # convert maxsessionduration which is in seconds to hours
         if role['MaxSessionDuration']:
             model['max_session_duration'] = role['MaxSessionDuration'] / 3600
         return model
 
+    @staticmethod
+    def model(role_name: str, account_id: Optional[str] = None):
+        return RGWRoleEndpoints.get(None, role_name, account_id)
+
 
 # pylint: disable=C0301
 assume_role_policy_help = (
@@ -1317,7 +1320,7 @@ edit_role_form = Form(path='/edit',
 
 
 @CRUDEndpoint(
-    router=APIRouter('/rgw/roles', Scope.RGW),
+    router=APIRouter('/rgw/accounts/{account_id}/roles', Scope.RGW),
     doc=APIDoc("List of RGW roles", "RGW"),
     actions=[
         TableAction(name='Create', permission='create', icon=Icon.ADD.value,
@@ -1335,6 +1338,12 @@ edit_role_form = Form(path='/edit',
         func=RGWRoleEndpoints.role_list,
         doc=EndpointDoc("List RGW roles")
     ),
+    extra_endpoints=[
+        ('get', CRUDCollectionMethod(
+            func=RGWRoleEndpoints.get,
+            doc=EndpointDoc("Get RGW role")
+        ))
+    ],
     create=CRUDCollectionMethod(
         func=RGWRoleEndpoints.role_create,
         doc=EndpointDoc("Create RGW role")
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts
index 215507045a5..f58932982fd 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts
@@ -53,7 +53,9 @@ export class AccountsPageHelper extends PageHelper {
 
     this.getFirstTableCell(account.name).should('have.text', account.name);
     this.getTableRow(account.name).within(() => {
-      cy.get('td').eq(this.columnIndex.tenant).should('have.text', account.tenant);
+      cy.get('td')
+        .eq(this.columnIndex.tenant)
+        .should('have.text', account.tenant || '');
       cy.get('td').eq(this.columnIndex.account_id).should('not.be.empty');
       cy.get('td').eq(this.columnIndex.email).should('have.text', account.email);
       cy.get('td').eq(this.columnIndex.max_users).should('have.text', 1000);
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.e2e-spec.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.e2e-spec.ts
index 87031750385..2026d0dc589 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.e2e-spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.e2e-spec.ts
@@ -1,20 +1,36 @@
 import { RolesPageHelper } from './roles.po';
+import { AccountsPageHelper } from './accounts.po';
 
 describe('RGW roles page', () => {
   const roles = new RolesPageHelper();
+  const accounts = new AccountsPageHelper();
+  const accountName = 'roles-test-account';
+  const roleName = 'testRole';
+
+  before(() => {
+    cy.login();
+    accounts.navigateTo('create');
+    accounts.create({ name: accountName, email: 'test@example.com' });
+  });
+
+  after(() => {
+    cy.login();
+    accounts.navigateTo();
+    accounts.delete(accountName, null, null, true, false, false, false);
+  });
 
   beforeEach(() => {
     cy.login();
-    roles.navigateTo();
+    accounts.navigateTo();
+    accounts.getExpandCollapseElement(accountName).click();
+    cy.contains('cds-tab-headers button[role="tab"]', 'Roles').click();
+    // Wait for the roles list to render
+    cy.get('cd-rgw-account-roles-list').should('exist');
   });
 
   describe('Create, Edit & Delete rgw roles', () => {
-    const roleName = 'testRole';
-
-    it('should create rgw roles', () => {
-      roles.navigateTo('create');
+    it('should create rgw role', () => {
       roles.create(roleName, '/', '{}');
-      roles.navigateTo();
       roles.checkExist(roleName, true);
     });
 
@@ -23,7 +39,8 @@ describe('RGW roles page', () => {
     });
 
     it('should delete rgw role', () => {
-      roles.delete(roleName, null, null, true);
+      roles.deleteRole(roleName);
+      roles.checkExist(roleName, false);
     });
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts
index 920a9d1d110..611a060236e 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts
@@ -1,55 +1,88 @@
 import { PageHelper } from '../page-helper.po';
 
-const pages = {
-  index: { url: '#/rgw/roles', id: 'cd-crud-table' },
-  create: { url: '#/rgw/roles/create', id: 'cd-crud-form' }
-};
-
 export class RolesPageHelper extends PageHelper {
-  pages = pages;
+  pages = {};
 
   columnIndex = {
-    roleName: 2,
-    path: 3,
-    arn: 4,
-    createDate: 5,
-    maxSessionDuration: 6
+    roleName: 1,
+    path: 2,
+    arn: 3,
+    createDate: 4,
+    maxSessionDuration: 5
   };
 
-  @PageHelper.restrictTo(pages.create.url)
   create(name: string, path: string, policyDocument: string) {
-    cy.get('[id$="string_role_name_0"]').type(name);
-    cy.get('[id$="role_assume_policy_doc_2"]').type(policyDocument);
-    cy.get('[id$="role_path_1"]').type(path);
-    cy.get("[aria-label='Create Role']").should('exist').click();
-    cy.get('cd-crud-table').should('exist');
+    cy.get('cd-rgw-account-roles-list cd-table-actions button[aria-label="Create"]')
+      .should('exist')
+      .click();
+    cy.get('cds-modal').should('be.visible');
+    cy.get('#role_name').type(name);
+    cy.get('#role_assume_policy_doc')
+      .clear()
+      .type(policyDocument, { parseSpecialCharSequences: false, delay: 0 });
+    cy.get('#role_path').type(path);
+    cy.get('cds-modal').contains('button', 'Create').click();
+    cy.get('cds-modal').should('not.exist');
   }
 
   edit(name: string, maxSessionDuration: number) {
-    this.navigateEdit(name);
-    cy.get('[id$="max_session_duration_1"]').clear().type(maxSessionDuration.toString());
-    cy.get("[aria-label='Edit Role']").should('exist').click();
-    cy.get('cd-crud-table').should('exist');
+    this.getRolesTableCell(this.columnIndex.roleName, name).click();
+    this.getRolesTableCell(this.columnIndex.roleName, name)
+      .parent('tr')
+      .find('[data-testid="table-action-btn"]')
+      .should('exist')
+      .click();
+    cy.get('cds-overflow-menu-option[aria-label="Edit"]').should('exist').click();
+    cy.get('cds-modal').should('be.visible');
 
-    this.getTableCell(this.columnIndex.roleName, name)
-      .click()
+    cy.get('cds-number[formControlName="max_session_duration"] input')
+      .clear()
+      .type(maxSessionDuration.toString());
+    cy.get('cds-modal').contains('button', 'Edit').click();
+    cy.get('cds-modal').should('not.exist');
+
+    this.getRolesTableCell(this.columnIndex.roleName, name)
       .parent()
-      .find(`[cdstabledata]:nth-child(${this.columnIndex.maxSessionDuration})`)
+      .find(`td:nth-child(${this.columnIndex.maxSessionDuration})`)
       .should(($elements) => {
         const roleName = $elements.map((_, el) => el.textContent).get();
         expect(roleName).to.include(`${maxSessionDuration} hours`);
       });
   }
 
-  @PageHelper.restrictTo(pages.index.url)
-  checkExist(name: string, exist: boolean) {
-    this.getTableCell(this.columnIndex.roleName, name).should(($elements) => {
-      const roleName = $elements.map((_, el) => el.textContent).get();
-      if (exist) {
-        expect(roleName).to.include(name);
-      } else {
-        expect(roleName).to.not.include(name);
-      }
+  deleteRole(name: string) {
+    this.getRolesTableCell(this.columnIndex.roleName, name).click();
+    this.getRolesTableCell(this.columnIndex.roleName, name)
+      .parent('tr')
+      .find('[data-testid="table-action-btn"]')
+      .should('exist')
+      .click();
+    cy.get('cds-overflow-menu-option[aria-label="Delete"]').should('exist').click();
+    cy.get('cds-modal').should('be.visible');
+    cy.get('cds-modal [aria-label="confirmation"]').click({ force: true });
+    cy.get('cds-modal').contains('button', 'Delete Role').click();
+    cy.get('cds-modal').should('not.exist');
+  }
+
+  private getRolesTableCell(columnIndex: number, exactContent: string, partialMatch = false) {
+    cy.get('cd-rgw-account-roles-list').within(() => {
+      cy.get('.cds--search-close').first().click({ force: true });
+      cy.get('.cds--search-input').first().clear({ force: true }).type(exactContent, { delay: 35 });
     });
+    const selector = `tbody tr td:nth-child(${columnIndex})`;
+    if (partialMatch) {
+      return cy.get('cd-rgw-account-roles-list').contains(selector, exactContent);
+    }
+    return cy
+      .get('cd-rgw-account-roles-list')
+      .contains(selector, new RegExp(`^\\s*${exactContent}\\s*$`, 'i'));
+  }
+
+  checkExist(name: string, exist: boolean) {
+    if (exist) {
+      this.getRolesTableCell(this.columnIndex.roleName, name).should('exist');
+    } else {
+      cy.get('cd-rgw-account-roles-list').contains(name).should('not.exist');
+    }
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-role.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-role.ts
new file mode 100644
index 00000000000..8522e8f1775
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-role.ts
@@ -0,0 +1,22 @@
+export interface RgwRole {
+  RoleId: string;
+  RoleName: string;
+  Path: string;
+  Arn: string;
+  CreateDate: string;
+  MaxSessionDuration: number;
+  AssumeRolePolicyDocument: string;
+}
+
+export interface RgwRoleCreatePayload {
+  role_name: string;
+  role_path: string;
+  role_assume_policy_doc: string;
+  account_id: string;
+}
+
+export interface RgwRoleUpdatePayload {
+  role_name: string;
+  max_session_duration: number;
+  account_id: string;
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
new file mode 100644
index 00000000000..11fff876688
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
@@ -0,0 +1,136 @@
+<cds-modal size="md" [open]="open" [hasScrollingContent]="false" (overlaySelected)="closeModal()">
+  <cds-modal-header (closeSelect)="closeModal()">
+    <h4 cdsModalHeaderLabel class="cds--type-label-01">{{ accountName }}</h4>
+    <h3 cdsModalHeaderHeading i18n>{{ mode }} role</h3>
+  </cds-modal-header>
+
+  <form class="form" #formDir="ngForm" [formGroup]="form">
+    <div cdsModalContent>
+      <!-- Role Name -->
+      <div class="form-item">
+        <cds-text-label
+          label="Role name"
+          for="role_name"
+          cdRequiredField="Role name"
+          [invalid]="roleName.isInvalid"
+          [invalidText]="roleNameError"
+          >Role name
+          <input
+            cdsText
+            cdValidate
+            #roleName="cdValidate"
+            type="text"
+            id="role_name"
+            name="role_name"
+            formControlName="role_name"
+            placeholder="Placeholder text"
+            [invalid]="roleName.isInvalid"
+            [autofocus]="true"
+            modal-primary-focus
+          />
+        </cds-text-label>
+        <ng-template #roleNameError>
+          @if (form.showError('role_name', formDir, 'required')) {
+          <span class="invalid-feedback" i18n>This field is required.</span>
+          }
+        </ng-template>
+      </div>
+
+      <!-- Path & Assume Role Policy Document (Create only) -->
+      @if (!isEdit) {
+      <!-- Path -->
+      <div class="form-item">
+        <cds-text-label
+          label="Path"
+          for="role_path"
+          cdRequiredField="Path"
+          [invalid]="rolePath.isInvalid"
+          [invalidText]="pathError"
+          >Path
+          <input
+            cdsText
+            cdValidate
+            #rolePath="cdValidate"
+            type="text"
+            id="role_path"
+            name="role_path"
+            formControlName="role_path"
+            placeholder="Placeholder text"
+            [invalid]="rolePath.isInvalid"
+          />
+        </cds-text-label>
+        <ng-template #pathError>
+          @if (form.showError('role_path', formDir, 'required')) {
+          <span class="invalid-feedback" i18n>This field is required.</span>
+          }
+        </ng-template>
+      </div>
+
+      <!-- Assume Role Policy Document -->
+      <div class="form-item">
+        <cds-textarea-label
+          labelInputID="role_assume_policy_doc"
+          [invalid]="policyDoc.isInvalid"
+          [invalidText]="policyError"
+          cdRequiredField="Trust Policy"
+          >Trust policy
+          <textarea
+            cdsTextArea
+            cdValidate
+            #policyDoc="cdValidate"
+            id="role_assume_policy_doc"
+            name="role_assume_policy_doc"
+            formControlName="role_assume_policy_doc"
+            placeholder="Placeholder text"
+            rows="8"
+            cols="200"
+            [invalid]="policyDoc.isInvalid"
+            [invalidText]="policyError"
+          ></textarea>
+        </cds-textarea-label>
+        <ng-template #policyError>
+          @if (form.showError('role_assume_policy_doc', formDir, 'required')) {
+          <span class="invalid-feedback" i18n>This field is required.</span>
+          } @if (form.showError('role_assume_policy_doc', formDir, 'json')) {
+          <span class="invalid-feedback" i18n>Must be a valid JSON.</span>
+          }
+        </ng-template>
+      </div>
+      }
+
+      <!-- Max Session Duration (Edit only) -->
+      @if (isEdit) {
+      <div class="form-item">
+        <cds-number
+          label="Max Session Duration (Hours)"
+          cdValidate
+          #maxSessionDuration="cdValidate"
+          [invalid]="maxSessionDuration.isInvalid"
+          [invalidText]="durationError"
+          formControlName="max_session_duration"
+          min="1"
+          max="12"
+          i18n-label
+        >
+        </cds-number>
+        <ng-template #durationError>
+          @if (form.showError('max_session_duration', formDir, 'required')) {
+          <span class="invalid-feedback" i18n>This field is required.</span>
+          } @if (form.showError('max_session_duration', formDir, 'min')) {
+          <span class="invalid-feedback" i18n>Minimum value is 1 hour.</span>
+          } @if (form.showError('max_session_duration', formDir, 'max')) {
+          <span class="invalid-feedback" i18n>Maximum value is 12 hours.</span>
+          }
+        </ng-template>
+      </div>
+      }
+    </div>
+
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="form"
+      [submitText]="mode"
+      [modalForm]="true"
+    ></cd-form-button-panel>
+  </form>
+</cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.scss
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.spec.ts
new file mode 100644
index 00000000000..e2f6b2fabb1
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.spec.ts
@@ -0,0 +1,51 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { RouterTestingModule } from '@angular/router/testing';
+
+import { ReactiveFormsModule } from '@angular/forms';
+
+import { RgwAccountRoleFormComponent } from './rgw-account-role-form.component';
+import { SharedModule } from '~/app/shared/shared.module';
+
+describe('RgwAccountRoleFormComponent', () => {
+  let component: RgwAccountRoleFormComponent;
+  let fixture: ComponentFixture<RgwAccountRoleFormComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [HttpClientTestingModule, RouterTestingModule, SharedModule, ReactiveFormsModule],
+      declarations: [RgwAccountRoleFormComponent]
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(RgwAccountRoleFormComponent);
+    component = fixture.componentInstance;
+    component.accountId = 'test-account';
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should create form correctly on init', () => {
+    expect(component.form).toBeDefined();
+    expect(component.form.contains('role_name')).toBeTruthy();
+    expect(component.form.contains('role_path')).toBeTruthy();
+    expect(component.form.contains('role_assume_policy_doc')).toBeTruthy();
+  });
+
+  it('should patch value in edit mode', () => {
+    component.isEdit = true;
+    component.roleName = 'test-role';
+    component.role = {
+      RoleName: 'test-role',
+      Path: '/path',
+      MaxSessionDuration: 3 * 3600
+    } as any;
+
+    component.ngOnInit();
+
+    expect(component.form.get('role_name').value).toBe('test-role');
+    expect(component.form.get('max_session_duration').value).toBe(3);
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts
new file mode 100644
index 00000000000..8cd266cdf46
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts
@@ -0,0 +1,114 @@
+import { Component, Inject, OnInit, Optional } from '@angular/core';
+import { Validators } from '@angular/forms';
+import { BaseModal } from 'carbon-components-angular';
+import { ActionLabelsI18n } from '~/app/shared/constants/app.constants';
+import { CdFormBuilder } from '~/app/shared/forms/cd-form-builder';
+import { CdFormGroup } from '~/app/shared/forms/cd-form-group';
+import { CdValidators } from '~/app/shared/forms/cd-validators';
+import { RgwRoleService } from '~/app/shared/api/rgw-role.service';
+import { NotificationService } from '~/app/shared/services/notification.service';
+import { NotificationType } from '~/app/shared/enum/notification-type.enum';
+import { RgwRole } from '../models/rgw-role';
+
+@Component({
+  selector: 'cd-rgw-account-role-form',
+  templateUrl: './rgw-account-role-form.component.html',
+  styleUrls: ['./rgw-account-role-form.component.scss'],
+  standalone: false
+})
+export class RgwAccountRoleFormComponent extends BaseModal implements OnInit {
+  form: CdFormGroup;
+  mode: string;
+
+  constructor(
+    @Optional() @Inject('accountId') public accountId: string,
+    @Optional() @Inject('accountName') public accountName: string,
+    @Optional() @Inject('roleName') public roleName: string,
+    @Optional() @Inject('isEdit') public isEdit = false,
+    @Optional() @Inject('role') public role: RgwRole = null,
+    private formBuilder: CdFormBuilder,
+    public actionLabels: ActionLabelsI18n,
+    private rgwRoleService: RgwRoleService,
+    private notificationService: NotificationService
+  ) {
+    super();
+  }
+
+  ngOnInit(): void {
+    this.mode = this.isEdit ? this.actionLabels.EDIT : this.actionLabels.CREATE;
+    this.createForm();
+    if (this.isEdit && this.role) {
+      this.form.patchValue({
+        role_name: this.role.RoleName,
+        role_path: this.role.Path || '/',
+        max_session_duration: this.role.MaxSessionDuration ? this.role.MaxSessionDuration / 3600 : 1
+      });
+    }
+  }
+
+  private createForm() {
+    this.form = this.formBuilder.group({
+      role_name: [{ value: '', disabled: this.isEdit }, [Validators.required]],
+      role_path: [{ value: '', disabled: this.isEdit }, [Validators.required]],
+      role_assume_policy_doc: [''],
+      max_session_duration: [1]
+    });
+
+    CdValidators.validateIf(this.form.get('role_assume_policy_doc'), () => !this.isEdit, [
+      Validators.required,
+      CdValidators.json()
+    ]);
+
+    CdValidators.validateIf(this.form.get('max_session_duration'), () => this.isEdit, [
+      Validators.required,
+      Validators.min(1),
+      Validators.max(12)
+    ]);
+  }
+
+  onSubmit() {
+    if (this.form.invalid) {
+      return;
+    }
+
+    const payload = this.form.getRawValue();
+    payload.account_id = this.accountId;
+    if (!this.isEdit) {
+      delete payload.max_session_duration;
+    }
+
+    if (this.isEdit) {
+      this.rgwRoleService
+        .update(this.roleName, {
+          role_name: this.roleName,
+          max_session_duration: payload.max_session_duration,
+          account_id: this.accountId
+        })
+        .subscribe({
+          next: () => {
+            this.notificationService.show(
+              NotificationType.success,
+              $localize`Role updated successfully`
+            );
+            this.closeModal();
+          },
+          error: () => {
+            this.form.setErrors({ cdSubmitButton: true });
+          }
+        });
+    } else {
+      this.rgwRoleService.create(payload).subscribe({
+        next: () => {
+          this.notificationService.show(
+            NotificationType.success,
+            $localize`Role created successfully`
+          );
+          this.closeModal();
+        },
+        error: () => {
+          this.form.setErrors({ cdSubmitButton: true });
+        }
+      });
+    }
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html
new file mode 100644
index 00000000000..209f15a6daa
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html
@@ -0,0 +1,14 @@
+<cd-table #table
+          [autoReload]="true"
+          [data]="data$ | async"
+          [columns]="columns"
+          selectionType="single"
+          columnMode="flex"
+          (updateSelection)="updateSelection($event)"
+          identifier="RoleName">
+  <cd-table-actions class="table-actions"
+                    [permission]="permission"
+                    [selection]="selection"
+                    [tableActions]="tableActions">
+  </cd-table-actions>
+</cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.scss
new file mode 100644
index 00000000000..dfca32bf3c2
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.scss
@@ -0,0 +1 @@
+/* Scss stylesheet for RGW account roles list */
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.spec.ts
new file mode 100644
index 00000000000..6beb2fa5ccb
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.spec.ts
@@ -0,0 +1,71 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { RouterTestingModule } from '@angular/router/testing';
+
+import { of } from 'rxjs';
+
+import { RgwAccountRolesListComponent } from './rgw-account-roles-list.component';
+import { RgwRoleService } from '~/app/shared/api/rgw-role.service';
+import { SharedModule } from '~/app/shared/shared.module';
+import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
+import { NotificationService } from '~/app/shared/services/notification.service';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
+
+describe('RgwAccountRolesListComponent', () => {
+  let component: RgwAccountRolesListComponent;
+  let fixture: ComponentFixture<RgwAccountRolesListComponent>;
+  let rgwRoleService: RgwRoleService;
+  let notificationService: NotificationService;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [HttpClientTestingModule, RouterTestingModule, SharedModule],
+      declarations: [RgwAccountRolesListComponent],
+      providers: [
+        {
+          provide: AuthStorageService,
+          useValue: {
+            getPermissions: () => ({ rgw: { create: true, update: true, delete: true } })
+          }
+        }
+      ]
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(RgwAccountRolesListComponent);
+    component = fixture.componentInstance;
+    rgwRoleService = TestBed.inject(RgwRoleService);
+    notificationService = TestBed.inject(NotificationService);
+    spyOn(notificationService, 'show');
+    component.accountId = 'test-account';
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should load roles on init', () => {
+    const roles = [{ RoleName: 'test-role' }];
+    spyOn(rgwRoleService, 'list').and.returnValue(of(roles));
+    component.loadRoles();
+    expect(rgwRoleService.list).toHaveBeenCalledWith('test-account');
+    component.data$.subscribe((res) => {
+      expect(res).toEqual(roles);
+    });
+  });
+
+  it('should delete a role and show notification', () => {
+    spyOn(rgwRoleService, 'delete').and.returnValue(of(null));
+    spyOn(component, 'loadRoles');
+    component.selection.selected = [{ RoleName: 'test-role' }];
+    spyOn(TestBed.inject(ModalCdsService), 'show').and.callFake((_componentClass, config) => {
+      config.submitActionObservable().subscribe();
+      return null;
+    });
+
+    component.deleteRole();
+    expect(rgwRoleService.delete).toHaveBeenCalledWith('test-role', 'test-account');
+    expect(notificationService.show).toHaveBeenCalled();
+    expect(component.loadRoles).toHaveBeenCalled();
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.ts
new file mode 100644
index 00000000000..af1c13f0a4b
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.ts
@@ -0,0 +1,167 @@
+import { Component, Input, OnChanges, OnInit, SimpleChanges, ViewChild } from '@angular/core';
+import { ActionLabelsI18n } from '~/app/shared/constants/app.constants';
+import { TableComponent } from '~/app/shared/datatable/table/table.component';
+import { CdTableAction } from '~/app/shared/models/cd-table-action';
+import { CdTableColumn } from '~/app/shared/models/cd-table-column';
+import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
+import { Icons } from '~/app/shared/enum/icons.enum';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
+import { RgwRoleService } from '~/app/shared/api/rgw-role.service';
+import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
+import { RgwAccountRoleFormComponent } from '../rgw-account-role-form/rgw-account-role-form.component';
+import { Observable, Subscriber, of } from 'rxjs';
+import { Permission } from '~/app/shared/models/permissions';
+import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
+import { NotificationService } from '~/app/shared/services/notification.service';
+import { NotificationType } from '~/app/shared/enum/notification-type.enum';
+
+import { CdDatePipe } from '~/app/shared/pipes/cd-date.pipe';
+import { DurationPipe } from '~/app/shared/pipes/duration.pipe';
+import { RgwRole } from '../models/rgw-role';
+
+@Component({
+  selector: 'cd-rgw-account-roles-list',
+  templateUrl: './rgw-account-roles-list.component.html',
+  styleUrls: ['./rgw-account-roles-list.component.scss'],
+  standalone: false
+})
+export class RgwAccountRolesListComponent implements OnInit, OnChanges {
+  @Input()
+  accountId: string;
+
+  @Input()
+  accountName: string;
+
+  @ViewChild('table')
+  table: TableComponent;
+
+  columns: CdTableColumn[] = [];
+  data$: Observable<RgwRole[]>;
+  tableActions: CdTableAction[] = [];
+  selection: CdTableSelection = new CdTableSelection();
+  permission: Permission;
+
+  constructor(
+    public actionLabels: ActionLabelsI18n,
+    private rgwRoleService: RgwRoleService,
+    private modalService: ModalCdsService,
+    private authStorageService: AuthStorageService,
+    private cdDatePipe: CdDatePipe,
+    private durationPipe: DurationPipe,
+    private notificationService: NotificationService
+  ) {
+    this.permission = this.authStorageService.getPermissions().rgw;
+  }
+
+  ngOnInit(): void {
+    this.loadRoles();
+    this.columns = [
+      {
+        name: $localize`Role name`,
+        prop: 'RoleName',
+        flexGrow: 2
+      },
+      {
+        name: $localize`Path`,
+        prop: 'Path',
+        flexGrow: 2
+      },
+      {
+        name: $localize`Arn`,
+        prop: 'Arn',
+        flexGrow: 3
+      },
+      {
+        name: $localize`Created at`,
+        prop: 'CreateDate',
+        flexGrow: 2,
+        pipe: this.cdDatePipe
+      },
+      {
+        name: $localize`Max session duration`,
+        prop: 'MaxSessionDuration',
+        flexGrow: 2,
+        pipe: this.durationPipe
+      }
+    ];
+
+    this.tableActions = [
+      {
+        permission: 'create',
+        icon: Icons.add,
+        click: () => this.openRoleForm(false),
+        name: this.actionLabels.CREATE,
+        canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
+      },
+      {
+        permission: 'update',
+        icon: Icons.edit,
+        click: () => this.openRoleForm(true),
+        name: this.actionLabels.EDIT
+      },
+      {
+        permission: 'delete',
+        icon: Icons.destroy,
+        click: () => this.deleteRole(),
+        name: this.actionLabels.DELETE,
+        disable: () => !this.selection.hasSelection
+      }
+    ];
+  }
+
+  ngOnChanges(changes: SimpleChanges): void {
+    if (changes.accountId) {
+      this.loadRoles();
+    }
+  }
+
+  loadRoles(): void {
+    if (!this.accountId) {
+      this.data$ = of([]);
+      return;
+    }
+    this.data$ = this.rgwRoleService.list(this.accountId);
+  }
+
+  updateSelection(selection: CdTableSelection): void {
+    this.selection = selection;
+  }
+
+  openRoleForm(isEdit: boolean): void {
+    const role = isEdit ? this.selection.first() : null;
+    const modalRef = this.modalService.show(RgwAccountRoleFormComponent, {
+      accountId: this.accountId,
+      accountName: this.accountName,
+      roleName: role ? role.RoleName : '',
+      isEdit: isEdit,
+      role: role
+    });
+    modalRef?.close?.subscribe(() => this.loadRoles());
+  }
+
+  deleteRole(): void {
+    const roleName = this.selection.first().RoleName;
+    this.modalService.show(DeleteConfirmationModalComponent, {
+      itemDescription: $localize`Role`,
+      itemNames: [roleName],
+      submitActionObservable: () => {
+        return new Observable((observer: Subscriber<any>) => {
+          this.rgwRoleService.delete(roleName, this.accountId).subscribe({
+            next: () => {
+              this.notificationService.show(
+                NotificationType.success,
+                $localize`Role deleted successfully`
+              );
+              observer.next();
+              observer.complete();
+              this.loadRoles();
+            },
+            error: (err) => {
+              observer.error(err);
+            }
+          });
+        });
+      }
+    });
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html
index 77a4008580d..f5511853d44 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html
@@ -1,13 +1,27 @@
-<!-- Account quota -->
-<div *ngIf="selection.quota">
-  <legend i18n>Account quota</legend>
-  <cd-table-key-value [data]="quota">
-  </cd-table-key-value>
-</div>
-
-<!-- Bucket quota -->
-<div *ngIf="selection.bucket_quota">
-  <legend i18n>Bucket quota</legend>
-  <cd-table-key-value [data]="bucket_quota">
-  </cd-table-key-value>
-</div>
+@if (selection) {
+<cds-tabs>
+  <cds-tab heading="Quotas" i18n-heading>
+    <div class="row">
+      @if (selection.quota) {
+      <div class="col-sm-6">
+        <legend i18n>Account quota</legend>
+        <cd-table-key-value [data]="quota"> </cd-table-key-value>
+      </div>
+      } @if (selection.bucket_quota) {
+      <div class="col-sm-6">
+        <legend i18n>Bucket quota</legend>
+        <cd-table-key-value [data]="bucket_quota"> </cd-table-key-value>
+      </div>
+      }
+    </div>
+  </cds-tab>
+  <cds-tab heading="Roles" i18n-heading>
+    <div class="mt-4">
+      <cd-rgw-account-roles-list
+        [accountId]="selection.id"
+        [accountName]="selection.name"
+      ></cd-rgw-account-roles-list>
+    </div>
+  </cds-tab>
+</cds-tabs>
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
index c573b617bf0..585f3c25f12 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
@@ -120,6 +120,8 @@ import { RgwTopicFormComponent } from './rgw-topic-form/rgw-topic-form.component
 import { RgwBucketNotificationListComponent } from './rgw-bucket-notification-list/rgw-bucket-notification-list.component';
 import { RgwNotificationFormComponent } from './rgw-notification-form/rgw-notification-form.component';
 import { ComponentsModule } from '~/app/shared/components/components.module';
+import { RgwAccountRolesListComponent } from './rgw-account-roles-list/rgw-account-roles-list.component';
+import { RgwAccountRoleFormComponent } from './rgw-account-role-form/rgw-account-role-form.component';
 
 @NgModule({
   imports: [
@@ -229,7 +231,9 @@ import { ComponentsModule } from '~/app/shared/components/components.module';
     RgwTopicDetailsComponent,
     RgwTopicFormComponent,
     RgwBucketNotificationListComponent,
-    RgwNotificationFormComponent
+    RgwNotificationFormComponent,
+    RgwAccountRolesListComponent,
+    RgwAccountRoleFormComponent
   ],
   providers: [TitleCasePipe]
 })
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.spec.ts
new file mode 100644
index 00000000000..3ec6598338d
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.spec.ts
@@ -0,0 +1,59 @@
+import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
+import { TestBed } from '@angular/core/testing';
+
+import { RgwRoleService } from './rgw-role.service';
+
+describe('RgwRoleService', () => {
+  let service: RgwRoleService;
+  let httpTesting: HttpTestingController;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [HttpClientTestingModule]
+    });
+    service = TestBed.inject(RgwRoleService);
+    httpTesting = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => {
+    httpTesting.verify();
+  });
+
+  it('should be created', () => {
+    expect(service).toBeTruthy();
+  });
+
+  it('should call list with account_id', () => {
+    service.list('test-account').subscribe();
+    const req = httpTesting.expectOne('api/rgw/accounts/test-account/roles');
+    expect(req.request.method).toBe('GET');
+  });
+
+  it('should call get with account_id', () => {
+    service.get('test-role', 'test-account').subscribe();
+    const req = httpTesting.expectOne('api/rgw/accounts/test-account/roles/test-role');
+    expect(req.request.method).toBe('GET');
+  });
+
+  it('should call create', () => {
+    const payload = { role_name: 'test', account_id: 'test-account' };
+    service.create(payload as any).subscribe();
+    const req = httpTesting.expectOne('api/rgw/accounts/test-account/roles');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.body).toEqual(payload);
+  });
+
+  it('should call update', () => {
+    const payload = { max_session_duration: 2, account_id: 'test-account' };
+    service.update('test-role', payload as any).subscribe();
+    const req = httpTesting.expectOne('api/rgw/accounts/test-account/roles');
+    expect(req.request.method).toBe('PUT');
+    expect(req.request.body).toEqual(payload);
+  });
+
+  it('should call delete with account_id', () => {
+    service.delete('test-role', 'test-account').subscribe();
+    const req = httpTesting.expectOne('api/rgw/accounts/test-account/roles/test-role');
+    expect(req.request.method).toBe('DELETE');
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.ts
new file mode 100644
index 00000000000..57afbb253e8
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-role.service.ts
@@ -0,0 +1,41 @@
+import { HttpClient } from '@angular/common/http';
+import { Injectable } from '@angular/core';
+import { Observable } from 'rxjs';
+import {
+  RgwRole,
+  RgwRoleCreatePayload,
+  RgwRoleUpdatePayload
+} from '~/app/ceph/rgw/models/rgw-role';
+
+@Injectable({
+  providedIn: 'root'
+})
+export class RgwRoleService {
+  constructor(private http: HttpClient) {}
+
+  private getUrl(accountId: string): string {
+    return `api/rgw/accounts/${accountId}/roles`;
+  }
+
+  list(accountId: string): Observable<RgwRole[]> {
+    return this.http.get<RgwRole[]>(this.getUrl(accountId));
+  }
+
+  get(roleName: string, accountId: string): Observable<RgwRole> {
+    return this.http.get<RgwRole>(`${this.getUrl(accountId)}/${roleName}`);
+  }
+
+  create(role: RgwRoleCreatePayload): Observable<RgwRole> {
+    const accountId = role.account_id;
+    return this.http.post<RgwRole>(this.getUrl(accountId), role);
+  }
+
+  update(_roleName: string, payload: RgwRoleUpdatePayload): Observable<RgwRole> {
+    const accountId = payload.account_id;
+    return this.http.put<RgwRole>(this.getUrl(accountId), payload);
+  }
+
+  delete(roleName: string, accountId: string): Observable<any> {
+    return this.http.delete(`${this.getUrl(accountId)}/${roleName}`);
+  }
+}
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index abb7a7351ff..1a46d821cc6 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -18007,6 +18007,228 @@ paths:
       summary: Enable/Disable RGW Account/Bucket quota
       tags:
       - RgwUserAccounts
+  /api/rgw/accounts/{account_id}/roles:
+    get:
+      parameters:
+      - allowEmptyValue: true
+        in: path
+        name: account_id
+        schema:
+          type: integer
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: OK
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: List RGW roles
+      tags:
+      - RGW
+    post:
+      parameters:
+      - allowEmptyValue: true
+        in: path
+        name: account_id
+        schema:
+          type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                role_assume_policy_doc:
+                  default: ''
+                  type: string
+                role_name:
+                  default: ''
+                  type: string
+                role_path:
+                  default: ''
+                  type: string
+              type: object
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Resource created.
+        '202':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Operation is still executing. Please check the task queue.
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Create RGW role
+      tags:
+      - RGW
+    put:
+      parameters:
+      - allowEmptyValue: true
+        in: path
+        name: account_id
+        schema:
+          type: integer
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                max_session_duration:
+                  type: string
+                role_name:
+                  type: string
+              required:
+              - role_name
+              - max_session_duration
+              type: object
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Resource updated.
+        '202':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Operation is still executing. Please check the task queue.
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Edit RGW role
+      tags:
+      - RGW
+  /api/rgw/accounts/{account_id}/roles/{role_name}:
+    delete:
+      parameters:
+      - in: path
+        name: role_name
+        required: true
+        schema:
+          type: string
+      - allowEmptyValue: true
+        in: path
+        name: account_id
+        schema:
+          type: integer
+      responses:
+        '202':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Operation is still executing. Please check the task queue.
+        '204':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Resource deleted.
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Delete RGW role
+      tags:
+      - RGW
+    get:
+      parameters:
+      - in: path
+        name: role_name
+        required: true
+        schema:
+          type: string
+      - allowEmptyValue: true
+        in: path
+        name: account_id
+        schema:
+          type: integer
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: OK
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Get RGW role
+      tags:
+      - RGW
   /api/rgw/bucket:
     get:
       parameters:
@@ -19857,172 +20079,6 @@ paths:
       - jwt: []
       tags:
       - RgwRealm
-  /api/rgw/roles:
-    get:
-      parameters: []
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: OK
-        '400':
-          description: Operation exception. Please check the response body for details.
-        '401':
-          description: Unauthenticated access. Please login first.
-        '403':
-          description: Unauthorized access. Please check your permissions.
-        '500':
-          description: Unexpected error. Please check the response body for the stack
-            trace.
-      security:
-      - jwt: []
-      summary: List RGW roles
-      tags:
-      - RGW
-    post:
-      parameters: []
-      requestBody:
-        content:
-          application/json:
-            schema:
-              properties:
-                role_assume_policy_doc:
-                  default: ''
-                  type: string
-                role_name:
-                  default: ''
-                  type: string
-                role_path:
-                  default: ''
-                  type: string
-              type: object
-      responses:
-        '201':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: Resource created.
-        '202':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: Operation is still executing. Please check the task queue.
-        '400':
-          description: Operation exception. Please check the response body for details.
-        '401':
-          description: Unauthenticated access. Please login first.
-        '403':
-          description: Unauthorized access. Please check your permissions.
-        '500':
-          description: Unexpected error. Please check the response body for the stack
-            trace.
-      security:
-      - jwt: []
-      summary: Create RGW role
-      tags:
-      - RGW
-    put:
-      parameters: []
-      requestBody:
-        content:
-          application/json:
-            schema:
-              properties:
-                max_session_duration:
-                  type: string
-                role_name:
-                  type: string
-              required:
-              - role_name
-              - max_session_duration
-              type: object
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: Resource updated.
-        '202':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: Operation is still executing. Please check the task queue.
-        '400':
-          description: Operation exception. Please check the response body for details.
-        '401':
-          description: Unauthenticated access. Please login first.
-        '403':
-          description: Unauthorized access. Please check your permissions.
-        '500':
-          description: Unexpected error. Please check the response body for the stack
-            trace.
-      security:
-      - jwt: []
-      summary: Edit RGW role
-      tags:
-      - RGW
-  /api/rgw/roles/{role_name}:
-    delete:
-      parameters:
-      - in: path
-        name: role_name
-        required: true
-        schema:
-          type: string
-      responses:
-        '202':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: Operation is still executing. Please check the task queue.
-        '204':
-          content:
-            application/json:
-              schema:
-                type: object
-            application/vnd.ceph.api.v1.0+json:
-              schema:
-                type: object
-          description: Resource deleted.
-        '400':
-          description: Operation exception. Please check the response body for details.
-        '401':
-          description: Unauthenticated access. Please login first.
-        '403':
-          description: Unauthorized access. Please check your permissions.
-        '500':
-          description: Unexpected error. Please check the response body for the stack
-            trace.
-      security:
-      - jwt: []
-      summary: Delete RGW role
-      tags:
-      - RGW
   /api/rgw/site:
     get:
       parameters:
diff --git a/src/pybind/mgr/dashboard/services/rgw_client.py b/src/pybind/mgr/dashboard/services/rgw_client.py
index e4ab27911ec..a36eded72dd 100755
--- a/src/pybind/mgr/dashboard/services/rgw_client.py
+++ b/src/pybind/mgr/dashboard/services/rgw_client.py
@@ -1020,19 +1020,31 @@ class RgwClient(RestClient):
         except RequestException as e:
             raise DashboardException(msg=str(e), component='rgw')
 
-    def list_roles(self) -> List[Dict[str, Any]]:
+    def list_roles(self, account_id: Optional[str] = None) -> List[Dict[str, Any]]:
         rgw_list_roles_command = ['role', 'list']
+        if account_id:
+            rgw_list_roles_command += ['--account-id', account_id]
         code, roles, err = mgr.send_rgwadmin_command(rgw_list_roles_command)
-        if code < 0:
+        if code != 0:
             logger.warning('Error listing roles with code %d: %s', code, err)
             return []
 
+        if isinstance(roles, dict):
+            roles = roles.get('Roles', [])
+
+        result = []
         for role in roles:
+            if isinstance(role, dict) and 'member' in role:
+                role = role['member']
+            if not isinstance(role, dict):
+                continue
             if 'PermissionPolicies' not in role:
                 role['PermissionPolicies'] = []
-        return roles
+            result.append(role)
+        return result
 
-    def create_role(self, role_name: str, role_path: str, role_assume_policy_doc: str) -> None:
+    def create_role(self, role_name: str, role_path: str, role_assume_policy_doc: str,
+                    account_id: Optional[str] = None) -> None:
         try:
             json.loads(role_assume_policy_doc)
         except:  # noqa: E722
@@ -1065,6 +1077,8 @@ class RgwClient(RestClient):
         rgw_create_role_command = ['role', 'create', '--role-name', role_name, '--path', role_path]
         if role_assume_policy_doc:
             rgw_create_role_command += ['--assume-role-policy-doc', f"{role_assume_policy_doc}"]
+        if account_id:
+            rgw_create_role_command += ['--account-id', account_id]
 
         code, _roles, _err = mgr.send_rgwadmin_command(rgw_create_role_command,
                                                        stdout_as_json=False)
@@ -1084,25 +1098,34 @@ class RgwClient(RestClient):
                                      component='rgw')
         return lifecycle_progress
 
-    def get_role(self, role_name: str):
+    def get_role(self, role_name: str, account_id: Optional[str] = None):
         rgw_get_role_command = ['role', 'get', '--role-name', role_name]
+        if account_id:
+            rgw_get_role_command += ['--account-id', account_id]
         code, role, _err = mgr.send_rgwadmin_command(rgw_get_role_command)
         if code != 0:
             raise DashboardException(msg=f'Error getting role with code {code}: {_err}',
                                      component='rgw')
+        if isinstance(role, dict) and 'role' in role:
+            role = role['role']
         return role
 
-    def update_role(self, role_name: str, max_session_duration: str):
+    def update_role(self, role_name: str, max_session_duration: str,
+                    account_id: Optional[str] = None):
         rgw_update_role_command = ['role', 'update', '--role-name',
                                    role_name, '--max_session_duration', max_session_duration]
+        if account_id:
+            rgw_update_role_command += ['--account-id', account_id]
         code, _, _err = mgr.send_rgwadmin_command(rgw_update_role_command,
                                                   stdout_as_json=False)
         if code != 0:
             raise DashboardException(msg=f'Error updating role with code {code}: {_err}',
                                      component='rgw')
 
-    def delete_role(self, role_name: str) -> None:
+    def delete_role(self, role_name: str, account_id: Optional[str] = None) -> None:
         rgw_delete_role_command = ['role', 'delete', '--role-name', role_name]
+        if account_id:
+            rgw_delete_role_command += ['--account-id', account_id]
         code, _, _err = mgr.send_rgwadmin_command(rgw_delete_role_command,
                                                   stdout_as_json=False)
         if code != 0:
@@ -2734,10 +2757,11 @@ class RgwMultisite:
 
     def get_user_list(self, zoneName=None, realmName=None):
         user_list = []
+        rgw_user_list_cmd = ['user', 'list']
         if zoneName:
-            rgw_user_list_cmd = ['user', 'list', '--rgw-zone', zoneName]
+            rgw_user_list_cmd.extend(['--rgw-zone', zoneName])
         if realmName:
-            rgw_user_list_cmd = ['user', 'list', '--rgw-realm', realmName]
+            rgw_user_list_cmd.extend(['--rgw-realm', realmName])
         try:
             exit_code, out, _ = mgr.send_rgwadmin_command(rgw_user_list_cmd)
             if exit_code > 0:

From 176de7b9030919ee268c733de387170ea60ca454 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Fri, 24 Apr 2026 16:17:40 +0530
Subject: [PATCH 308/596] ceph/deployment: Adding class SSLParameters for
 storing cert, key and ca-cert for ssl and other features

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 .../ceph/deployment/service_spec.py           | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)

diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index b5726820ee5..1d4b913c4c2 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -3959,6 +3959,68 @@ class SMBClusterBindIPSpec:
         return out
 
 
+class SSLParameters:
+    def __init__(
+        self,
+        enabled: bool = False,
+        ssl_cert: Optional[str] = None,
+        ssl_key: Optional[str] = None,
+        ssl_ca_cert: Optional[str] = None,
+        certificate_source: Optional[str] = None,
+    ):
+        self.enabled = enabled
+        self.ssl_cert = ssl_cert
+        self.ssl_key = ssl_key
+        self.ssl_ca_cert = ssl_ca_cert
+        self.certificate_source = certificate_source
+        self.validate()
+
+    def validate(
+        self,
+        component: str = "ssl",
+        ca_cert_required: bool = False,
+    ) -> None:
+        if not self.enabled:
+            return
+        missing: list[Any] = []
+        if not self.certificate_source:
+            missing.append("certificate_source")
+        if self.certificate_source == 'inline':
+            if not self.ssl_cert:
+                missing.append("ssl_cert")
+            if not self.ssl_key:
+                missing.append("ssl_key")
+            if ca_cert_required and not self.ssl_ca_cert:
+                missing.append("ssl_ca_cert")
+        if missing:
+            raise ValueError(
+                f"[{component}] SSL is enabled "
+                f"but the following fields are missing: {', '.join(missing)}"
+            )
+
+    @classmethod
+    def from_dict(cls, data: Any) -> 'SSLParameters':
+        if not isinstance(data, dict):
+            return cls(enabled=False)
+
+        return cls(
+            enabled=data.get('enabled', False),
+            ssl_cert=data.get('ssl_cert'),
+            ssl_key=data.get('ssl_key'),
+            ssl_ca_cert=data.get('ssl_ca_cert'),
+            certificate_source=data.get('certificate_source'),
+        )
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            'enabled': self.enabled,
+            'ssl_cert': self.ssl_cert,
+            'ssl_key': self.ssl_key,
+            'ssl_ca_cert': self.ssl_ca_cert,
+            'certificate_source': self.certificate_source,
+        }
+
+
 class SMBExternalCephCluster:
     """Configure access to a non-local Ceph cluster for SMB services."""
     def __init__(
@@ -4101,6 +4163,8 @@ class SMBSpec(ServiceSpec):
         # not listed the default port will be used.
         custom_ports: Optional[Dict[str, int]] = None,
         bind_addrs: Optional[List[SMBClusterBindIPSpec]] = None,
+        ssl: Optional[bool] = None,
+        ssl_certificates: Optional[Dict[str, SSLParameters]] = None,
         # === remote control server ===
         remote_control_ssl_cert: Optional[str] = None,
         remote_control_ssl_key: Optional[str] = None,
@@ -4124,12 +4188,23 @@ class SMBSpec(ServiceSpec):
     ) -> None:
         if service_type != self.service_type:
             raise ValueError(f'invalid service_type: {service_type!r}')
+
+        self.ssl_certificates = {
+            name: (
+                value
+                if isinstance(value, SSLParameters)
+                else SSLParameters.from_dict(value)
+            )
+            for name, value in (ssl_certificates or {}).items()
+        }
+        any_ssl = any(p.enabled for p in self.ssl_certificates.values())
         super().__init__(
             self.service_type,
             service_id=service_id,
             placement=placement,
             count=count,
             config=config,
+            ssl=any_ssl,
             unmanaged=unmanaged,
             preview_only=preview_only,
             networks=networks,
@@ -4200,6 +4275,12 @@ class SMBSpec(ServiceSpec):
         for key in self.custom_ports or {}:
             if key not in self._valid_service_names:
                 raise ValueError(f'{key} is not a valid service name')
+        # TLS certificate validation
+        for feature_name, ssl_params in self.ssl_certificates.items():
+            ssl_params.validate(
+                component=feature_name,
+                ca_cert_required=feature_name in smbconst.CA_CERT_REQUIRED_FEATURES
+            )
 
     def _derive_cluster_uri(self, uri: str, objname: str) -> str:
         if not uri.startswith(('rados://', 'mem:')):
@@ -4253,6 +4334,10 @@ class SMBSpec(ServiceSpec):
             spec['ceph_cluster_configs'] = [
                 c.to_json() for c in spec['ceph_cluster_configs']
             ]
+        if spec and spec.get('ssl_certificates'):
+            spec['ssl_certificates'] = {
+                k: v.to_json() for k, v in self.ssl_certificates.items()
+            }
         return obj
 
 

From 16553bfa2360d85216c76f0dff7105c702d69b89 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Wed, 29 Apr 2026 06:40:12 +0530
Subject: [PATCH 309/596] mgr/cephadm: Add function all to get ssl certificates

A function call added to get ssl certificates from ssl_certificates
buffer. it returns TLSCredentials:

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 .../mgr/cephadm/services/cephadmservice.py      | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index c95d845aa8a..649474c3be5 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -373,12 +373,21 @@ class CephadmService(metaclass=ABCMeta):
             self.mgr.cert_mgr.save_self_signed_cert_key_pair(svc_name, tls_creds, host=daemon_spec.host, label=label)
         return tls_creds
 
+    def _get_certificates_from_spec_ssl_certificates(
+        self,
+        svc_spec: ServiceSpec,
+        daemon_spec: CephadmDaemonDeploySpec,
+        feature: Optional[str] = None
+    ) -> TLSCredentials:
+        return EMPTY_TLS_CREDENTIALS
+
     def get_certificates(self,
                          daemon_spec: CephadmDaemonDeploySpec,
                          ips: List[str] = [],
                          fqdns: List[str] = [],
                          custom_sans: List[str] = [],
-                         ca_cert_required: bool = False
+                         ca_cert_required: bool = False,
+                         feature: Optional[str] = None
                          ) -> TLSCredentials:
 
         svc_spec = cast(ServiceSpec, self.mgr.spec_store[daemon_spec.service_name].spec)
@@ -398,6 +407,7 @@ class CephadmService(metaclass=ABCMeta):
             ips=ips,
             fqdns=fqdns,
             custom_sans=custom_sans,
+            feature=feature,
         )
 
     def get_certificates_generic(
@@ -414,6 +424,7 @@ class CephadmService(metaclass=ABCMeta):
         custom_sans: Optional[List[str]] = None,
         ips: Optional[List[str]] = None,
         fqdns: Optional[List[str]] = None,
+        feature: Optional[str] = None,
     ) -> TLSCredentials:
 
         ips = ips or [self.mgr.inventory.get_addr(daemon_spec.host)]
@@ -423,7 +434,9 @@ class CephadmService(metaclass=ABCMeta):
         cert_source = getattr(svc_spec, cert_source_attr, None)
         logger.debug(f'Getting certificate for {svc_spec.service_name()} using source: {cert_source}')
 
-        if cert_source == CertificateSource.INLINE.value:
+        if feature is not None:
+            return self._get_certificates_from_spec_ssl_certificates(svc_spec, daemon_spec, feature)
+        elif cert_source == CertificateSource.INLINE.value:
             return self._get_certificates_from_spec(svc_spec, daemon_spec, cert_attr, key_attr, cert_name, key_name, ca_cert_attr, ca_cert_name)
         elif cert_source == CertificateSource.REFERENCE.value:
             return self._get_certificates_from_certmgr_store(svc_spec, fqdns, cert_name, key_name, ca_cert_name)

From 8202dae834125ee3d9ffdf32a904645a3ed0393b Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Wed, 29 Apr 2026 07:26:23 +0530
Subject: [PATCH 310/596] ceph/deployment: Adding smb to REQUIRES_CERTIFICATES
 list

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 src/python-common/ceph/deployment/service_spec.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 1d4b913c4c2..8e183f2414b 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -907,6 +907,7 @@ class ServiceSpec(object):
         'mgmt-gateway': {'user_cert_allowed': True, 'scope': 'global', 'requires_ca_cert': False},
         'nvmeof': {'user_cert_allowed': True, 'scope': 'service', 'requires_ca_cert': False},
         'nfs': {'user_cert_allowed': True, 'scope': 'service', 'requires_ca_cert': True},
+        'smb': {'user_cert_allowed': True, 'scope': 'service', 'requires_ca_cert': True},
 
         # Services that only support cephadm-signed certificates
         'agent': {'user_cert_allowed': False, 'scope': 'host', 'requires_ca_cert': False},

From ee6fd847b03e9d2c68c9f2f7644b8b9bede1437a Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Fri, 8 May 2026 10:58:09 +0530
Subject: [PATCH 311/596] mgr/cephadm: Add function to get ssl certificate from
 ssl_certificates

A function is added _get_certificates_from_spec_ssl_certificates to get
certificates from ssl_certificates buffer. it returns TLSCredentials from
SSLParameters of ssl_certificates[feature]

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/cephadm/services/smb.py | 135 ++++++++++++++++++-------
 1 file changed, 101 insertions(+), 34 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/smb.py b/src/pybind/mgr/cephadm/services/smb.py
index fbb4fcf57d8..831b89dc1ef 100644
--- a/src/pybind/mgr/cephadm/services/smb.py
+++ b/src/pybind/mgr/cephadm/services/smb.py
@@ -16,6 +16,12 @@ from typing import (
 )
 
 from mgr_module import HandleCommandResult
+from cephadm.tlsobject_types import TLSObjectScope, TLSCredentials, EMPTY_TLS_CREDENTIALS
+from ceph.smb.constants import (
+    KEYBRIDGE, 
+    REMOTE_CONTROL,
+    FEATURES,
+)
 
 from ceph.deployment.service_spec import (
     SMBExternalCephCluster,
@@ -31,6 +37,7 @@ from .cephadmservice import (
     CephadmDaemonDeploySpec,
     simplified_keyring,
 )
+from ..tlsobject_types import TLSCredentials, EMPTY_TLS_CREDENTIALS
 from ..schedule import DaemonPlacement
 
 if TYPE_CHECKING:
@@ -145,14 +152,80 @@ class SMBService(CephService):
         )
         return daemon_spec
 
+    def _feature_tls_filename(self, feature: str) -> Optional[str]:
+        return {
+                KEYBRIDGE: "keybridge",
+                REMOTE_CONTROL: "remote_control"
+            }.get(feature)
+
+    # Flat SSL fields on SMBSpec per feature, used as a fallback when
+    # ssl_certificates is not set (backward compatibility).
+    _FEATURE_FLAT_ATTRS: Dict[str, Tuple[str, str, str]] = {
+        REMOTE_CONTROL: (
+            'remote_control_ssl_cert',
+            'remote_control_ssl_key',
+            'remote_control_ca_cert',
+        ),
+        KEYBRIDGE: (
+            'keybridge_kmip_ssl_cert',
+            'keybridge_kmip_ssl_key',
+            'keybridge_kmip_ca_cert',
+        ),
+    }
+
+    def _get_feature_certs(
+        self,
+        daemon_spec: CephadmDaemonDeploySpec,
+        smb_spec: SMBSpec,
+        support_feature: str,
+        feature: str,
+    ) -> TLSCredentials:
+        feature_creds = self.get_certificates(
+            daemon_spec, ca_cert_required=True, feature=feature
+        )
+        if feature_creds:
+            return feature_creds
+        flat_attrs = self._FEATURE_FLAT_ATTRS.get(support_feature)
+        if flat_attrs is None:
+            return EMPTY_TLS_CREDENTIALS
+        cert_attr, key_attr, ca_attr = flat_attrs
+        tc = TLSCredentials(
+            cert=getattr(smb_spec, cert_attr, None) or '',
+            key=getattr(smb_spec, key_attr, None) or '',
+            ca_cert=getattr(smb_spec, ca_attr, None) or '',
+        )
+        return tc if tc else EMPTY_TLS_CREDENTIALS
+
+    def _get_certificates_from_spec_ssl_certificates(
+        self,
+        svc_spec: ServiceSpec,
+        _daemon_spec: CephadmDaemonDeploySpec,
+        feature: Optional[str] = None,
+    ) -> TLSCredentials:
+        smb_spec = cast(SMBSpec, svc_spec)
+        ssl_certs = getattr(smb_spec, 'ssl_certificates', None)
+        if not ssl_certs:
+            return EMPTY_TLS_CREDENTIALS
+        feature_key = feature if feature is not None else ''
+        ssl_params = smb_spec.ssl_certificates.get(feature_key)
+        if not ssl_params:
+            return EMPTY_TLS_CREDENTIALS
+        return TLSCredentials(
+            cert=ssl_params.ssl_cert or '',
+            key=ssl_params.ssl_key or '',
+            ca_cert=ssl_params.ssl_ca_cert or '',
+        )
+
     def generate_config(
         self, daemon_spec: CephadmDaemonDeploySpec
     ) -> Tuple[Dict[str, Any], List[str]]:
         logger.debug('smb generate_config')
         assert self.TYPE == daemon_spec.daemon_type
+        super().register_for_certificates(daemon_spec)
         smb_spec = cast(
             SMBSpec, self.mgr.spec_store[daemon_spec.service_name].spec
         )
+        ssl_certificates = smb_spec.ssl_certificates or {}
         config_blobs: Dict[str, Any] = {}
 
         config_blobs['cluster_id'] = smb_spec.cluster_id
@@ -181,40 +254,34 @@ class SMBService(CephService):
         config_blobs['service_ports'] = smb_spec.service_ports()
         if smb_spec.bind_addrs:
             config_blobs['bind_networks'] = smb_spec.bind_networks()
-        if 'remote-control' in smb_spec.features:
-            files = config_blobs.setdefault('files', {})
-            _add_cfg(
-                files,
-                'remote_control.ssl.crt',
-                self._cert_or_uri(smb_spec.remote_control_ssl_cert),
-            )
-            _add_cfg(
-                files,
-                'remote_control.ssl.key',
-                self._cert_or_uri(smb_spec.remote_control_ssl_key),
-            )
-            _add_cfg(
-                files,
-                'remote_control.ca.crt',
-                self._cert_or_uri(smb_spec.remote_control_ca_cert),
-            )
-        if 'keybridge' in smb_spec.features:
-            files = config_blobs.setdefault('files', {})
-            _add_cfg(
-                files,
-                'keybridge.ssl.crt',
-                self._cert_or_uri(smb_spec.keybridge_kmip_ssl_cert),
-            )
-            _add_cfg(
-                files,
-                'keybridge.ssl.key',
-                self._cert_or_uri(smb_spec.keybridge_kmip_ssl_key),
-            )
-            _add_cfg(
-                files,
-                'keybridge.ca.crt',
-                self._cert_or_uri(smb_spec.keybridge_kmip_ca_cert),
-            )
+        for support_feature in smb_spec.features:
+            feature = self._feature_tls_filename(support_feature)
+            if feature is not None:
+                feature_creds = self._get_feature_certs(
+                    daemon_spec, smb_spec, support_feature, feature
+                )
+                if feature_creds:
+                    files = config_blobs.setdefault('files', {})
+                    cert_pem = self._cert_or_uri(feature_creds.cert)
+                    key_pem = self._cert_or_uri(feature_creds.key)
+                    ca_pem = self._cert_or_uri(feature_creds.ca_cert)
+                    _add_cfg(files, f'{feature}.ssl.crt', cert_pem)
+                    _add_cfg(files, f'{feature}.ssl.key', key_pem)
+                    _add_cfg(files, f'{feature}.ca.crt', ca_pem)
+                    svc_name = smb_spec.service_name()
+                    host = daemon_spec.host
+                    cert_name = f'smb_{feature}_ssl_cert'
+                    key_name = f'smb_{feature}_ssl_key'
+                    ca_cert_name = f'smb_{feature}_ca_cert'
+                    self.mgr.cert_mgr.register_cert_key_pair(
+                        'smb', cert_name, key_name, self.SCOPE, ca_cert_name
+                    )
+                    if cert_pem:
+                        self.mgr.cert_mgr.save_cert(cert_name, cert_pem, svc_name, host, user_made=True)
+                    if key_pem:
+                        self.mgr.cert_mgr.save_key(key_name, key_pem, svc_name, host, user_made=True)
+                    if ca_pem:
+                        self.mgr.cert_mgr.save_cert(ca_cert_name, ca_pem, svc_name, host, user_made=True)
         for ext_cluster in smb_spec.ceph_cluster_configs or []:
             files = config_blobs.setdefault('files', {})
             c_name = f'{ext_cluster.alias}.ceph.conf'

From 362580714d20ced87485ee16efc07b6ba0038118 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Fri, 8 May 2026 11:03:06 +0530
Subject: [PATCH 312/596] mgr/smb: Add is_feature_enabled function to resource
 class

This funality added to find if feature like remote_control
and keybride is enable.

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 src/pybind/mgr/smb/resources.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/pybind/mgr/smb/resources.py b/src/pybind/mgr/smb/resources.py
index 0128b6346d2..2956703e68e 100644
--- a/src/pybind/mgr/smb/resources.py
+++ b/src/pybind/mgr/smb/resources.py
@@ -19,6 +19,7 @@ from ceph.smb.constants import (
     BURST_MULT_MIN,
     BYTES_LIMIT_MAX,
     IOPS_LIMIT_MAX,
+    KEYBRIDGE,
     REMOTE_CONTROL,
     REMOTE_CONTROL_LOCAL,
 )
@@ -989,6 +990,15 @@ class Cluster(_RBase):
             return False
         return self.keybridge.is_enabled
 
+    def is_feature_enabled(self, feature: str) -> bool:
+        """Return true if the specified SMB feature is enabled for this
+        cluster.
+        """
+        return {
+            REMOTE_CONTROL: self.remote_control_is_enabled,
+            KEYBRIDGE: self.keybridge_is_enabled,
+        }[feature]
+
     def is_clustered(self) -> bool:
         """Return true if smbd instance should use (CTDB) clustering."""
         if self.clustering_mode == SMBClustering.ALWAYS:

From 66fc26d43b77d8ed72186722b5e4f69447536364 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Fri, 8 May 2026 11:04:39 +0530
Subject: [PATCH 313/596] mgr/smb: Add ssl_certificates buffer for smb features

Add ssl_certificates buffer for smb features like remote_control
and keybridge. when certificate applied it stores as a feature
name and SSLParameters as value where SSLParameters holds cert,
key and ca-cert.

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/smb/handler.py | 43 +++++++++++++++++++++++++++--------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/src/pybind/mgr/smb/handler.py b/src/pybind/mgr/smb/handler.py
index 6f6954d0b2e..10364024181 100644
--- a/src/pybind/mgr/smb/handler.py
+++ b/src/pybind/mgr/smb/handler.py
@@ -20,7 +20,11 @@ import logging
 import time
 
 import ceph.smb.constants
-from ceph.deployment.service_spec import SMBExternalCephCluster, SMBSpec
+from ceph.deployment.service_spec import (
+    SMBExternalCephCluster,
+    SMBSpec,
+    SSLParameters,
+)
 from ceph.fs.earmarking import EarmarkTopScope
 
 from . import config_store, external, resources
@@ -631,6 +635,7 @@ class ClusterConfigHandler:
             change_group.cluster.cluster_id,
         )
         cluster = change_group.cluster
+        ssl_certificates: Dict[str, SSLParameters] = {}
         assert isinstance(cluster, resources.Cluster)
         # vols: hold the cephfs volumes our shares touch. some operations are
         # disabled/skipped unless we touch volumes.
@@ -688,6 +693,7 @@ class ClusterConfigHandler:
         if change_group.ext_ceph_clusters:
             assert len(change_group.ext_ceph_clusters) == 1
             ext_ceph_cluster = change_group.ext_ceph_clusters[0]
+
         smb_spec = _generate_smb_service_spec(
             cluster,
             config_entries=config_entries,
@@ -697,6 +703,7 @@ class ClusterConfigHandler:
             data_entity=cluster_conf.data_entity,
             needs_proxy=_has_proxied_vfs(change_group),
             ext_ceph_cluster=ext_ceph_cluster,
+            ssl_certificates=ssl_certificates,
         )
         _save_pending_spec_backup(self.public_store, change_group, smb_spec)
         # if orch was ever needed in the past we must "re-orch", but if we have
@@ -1058,6 +1065,7 @@ def _generate_smb_service_spec(
     data_entity: str = '',
     needs_proxy: bool = False,
     ext_ceph_cluster: Optional[resources.ExternalCephCluster],
+    ssl_certificates: Dict[str, SSLParameters],
 ) -> SMBSpec:
     features = []
     if cluster.auth_mode == AuthMode.ACTIVE_DIRECTORY:
@@ -1092,8 +1100,9 @@ def _generate_smb_service_spec(
     user_entities: Optional[List[str]] = None
     if data_entity:
         user_entities = [data_entity]
+
     rc_cert = rc_key = rc_ca_cert = None
-    if cluster.remote_control_is_enabled:
+    if cluster.is_feature_enabled(_REMOTE_CONTROL):
         assert cluster.remote_control
         rc_cert = _tls_uri(
             cluster.remote_control.cert, tls_credential_entries
@@ -1102,8 +1111,18 @@ def _generate_smb_service_spec(
         rc_ca_cert = _tls_uri(
             cluster.remote_control.ca_cert, tls_credential_entries
         )
+        feature = ceph.smb.constants.FEATURE_FILE_NAMES.get(_REMOTE_CONTROL)
+        if feature is not None:
+            ssl_certificates[feature] = SSLParameters(
+                enabled=bool(rc_cert and rc_key),
+                ssl_cert=rc_cert,
+                ssl_key=rc_key,
+                ssl_ca_cert=rc_ca_cert,
+                certificate_source='uri',
+            )
+
     kb_cert = kb_key = kb_ca_cert = None
-    if cluster.keybridge_is_enabled:
+    if cluster.is_feature_enabled(_KEYBRIDGE):
         assert cluster.keybridge  # type narrow
         # TODO: current all KMIP scopes must share the same tls creds
         # and that sucks. need to update keybridge to fetch cert URIs directly
@@ -1122,6 +1141,16 @@ def _generate_smb_service_spec(
             kb_ca_cert = _tls_uri(
                 kmip_scope.kmip_ca_cert, tls_credential_entries
             )
+            feature = ceph.smb.constants.FEATURE_FILE_NAMES.get(_KEYBRIDGE)
+            if feature is not None:
+                ssl_certificates[feature] = SSLParameters(
+                    enabled=bool(kb_cert and kb_key),
+                    ssl_cert=kb_cert,
+                    ssl_key=kb_key,
+                    ssl_ca_cert=kb_ca_cert,
+                    certificate_source='uri',
+                )
+
     ceph_cluster_configs = None
     if ext_ceph_cluster:
         exo = checked(ext_ceph_cluster.cluster)
@@ -1134,7 +1163,6 @@ def _generate_smb_service_spec(
                 key=exo.cephfs_user.key,
             )
         ]
-
     return SMBSpec(
         service_id=cluster.cluster_id,
         placement=cluster.placement,
@@ -1148,12 +1176,7 @@ def _generate_smb_service_spec(
         cluster_public_addrs=cluster.service_spec_public_addrs(),
         custom_ports=cluster.custom_ports,
         bind_addrs=cluster.service_spec_bind_addrs(),
-        remote_control_ssl_cert=rc_cert,
-        remote_control_ssl_key=rc_key,
-        remote_control_ca_cert=rc_ca_cert,
-        keybridge_kmip_ssl_cert=kb_cert,
-        keybridge_kmip_ssl_key=kb_key,
-        keybridge_kmip_ca_cert=kb_ca_cert,
+        ssl_certificates=ssl_certificates or None,
         ceph_cluster_configs=ceph_cluster_configs,
         tunables=_service_spec_tunables(cluster),
     )

From 38105f70153160b05d9fb542ea33f5fedc8fdb3a Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Fri, 8 May 2026 13:08:22 +0530
Subject: [PATCH 314/596] mgr/cephadm: Test case are updated to validate for
 ssl certificate for smb services

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/cephadm/tests/test_certmgr.py | 36 ++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/src/pybind/mgr/cephadm/tests/test_certmgr.py b/src/pybind/mgr/cephadm/tests/test_certmgr.py
index e6eb1db2262..b76fa174b54 100644
--- a/src/pybind/mgr/cephadm/tests/test_certmgr.py
+++ b/src/pybind/mgr/cephadm/tests/test_certmgr.py
@@ -307,6 +307,8 @@ class TestCertMgr(object):
         grafana_cert_host_2 = 'grafana-cert-host-2'
         nfs_ssl_cert = 'nfs-ssl-cert'
         nfs_ssl_ca_cert = 'nfs-ssl-ca-cert'
+        smb_ssl_cert = 'smb-ssl-cert'
+        smb_ssl_ca_cert = 'smb-ssl-ca-cert'
         cephadm_module.cert_mgr.save_cert('rgw_ssl_cert', rgw_frontend_rgw_foo_host2_cert, service_name='rgw.foo', user_made=True)
         cephadm_module.cert_mgr.save_cert('nvmeof_ssl_cert', nvmeof_ssl_cert, service_name='nvmeof.self-signed.foo', user_made=False)
         cephadm_module.cert_mgr.save_cert('nvmeof_client_cert', nvmeof_client_cert, service_name='nvmeof.foo', user_made=True)
@@ -315,6 +317,8 @@ class TestCertMgr(object):
         cephadm_module.cert_mgr.save_cert('grafana_ssl_cert', grafana_cert_host_2, host='host-2', user_made=True)
         cephadm_module.cert_mgr.save_cert('nfs_ssl_cert', nfs_ssl_cert, service_name='nfs.foo', user_made=True)
         cephadm_module.cert_mgr.save_cert('nfs_ssl_ca_cert', nfs_ssl_ca_cert, service_name='nfs.foo', user_made=True)
+        cephadm_module.cert_mgr.save_cert('smb_ssl_cert', smb_ssl_cert, service_name='smb.foo', user_made=True)
+        cephadm_module.cert_mgr.save_cert('smb_ssl_ca_cert', smb_ssl_ca_cert, service_name='smb.foo', user_made=True)
 
         expected_calls = [
             mock.call(f'{TLSOBJECT_STORE_CERT_PREFIX}rgw_ssl_cert', json.dumps({'rgw.foo': Cert(rgw_frontend_rgw_foo_host2_cert, True).to_json()})),
@@ -326,6 +330,8 @@ class TestCertMgr(object):
                                                                                     'host-2': Cert(grafana_cert_host_2, True).to_json()})),
             mock.call(f'{TLSOBJECT_STORE_CERT_PREFIX}nfs_ssl_cert', json.dumps({'nfs.foo': Cert(nfs_ssl_cert, True).to_json()})),
             mock.call(f'{TLSOBJECT_STORE_CERT_PREFIX}nfs_ssl_ca_cert', json.dumps({'nfs.foo': Cert(nfs_ssl_ca_cert, True).to_json()})),
+            mock.call(f'{TLSOBJECT_STORE_CERT_PREFIX}smb_ssl_cert', json.dumps({'smb.foo': Cert(smb_ssl_cert, True).to_json()})),
+            mock.call(f'{TLSOBJECT_STORE_CERT_PREFIX}smb_ssl_ca_cert', json.dumps({'smb.foo': Cert(smb_ssl_ca_cert, True).to_json()})),
         ]
         _set_store.assert_has_calls(expected_calls)
 
@@ -448,6 +454,24 @@ class TestCertMgr(object):
         }
         compare_certls_dicts(expected_ls)
 
+        cephadm_module.cert_mgr.save_cert('smb_ssl_cert', CEPHADM_SELF_GENERATED_CERT_1, service_name='smb.foo', user_made=True)
+        expected_ls["smb_ssl_cert"] = {
+            "scope": "service",
+            "certificates": {
+                "smb.foo": get_generated_cephadm_cert_info_1(),
+            },
+        }
+        compare_certls_dicts(expected_ls)
+
+        cephadm_module.cert_mgr.save_cert('smb_ssl_ca_cert', CEPHADM_SELF_GENERATED_CERT_2, service_name='smb.foo', user_made=True)
+        expected_ls["smb_ssl_ca_cert"] = {
+            "scope": "service",
+            "certificates": {
+                "smb.foo": get_generated_cephadm_cert_info_2(),
+            },
+        }
+        compare_certls_dicts(expected_ls)
+
         # Services with host target/scope
         cephadm_module.cert_mgr.save_cert('grafana_ssl_cert', CEPHADM_SELF_GENERATED_CERT_1, host='host1', user_made=True)
         cephadm_module.cert_mgr.save_cert('grafana_ssl_cert', CEPHADM_SELF_GENERATED_CERT_2, host='host2', user_made=True)
@@ -612,6 +636,8 @@ class TestCertMgr(object):
             'mgmt_gateway_ssl_cert': ('mgmt-gateway', 'mgmt-gw-cert', TLSObjectScope.GLOBAL),
             'nfs_ssl_cert': ('nfs.foo', 'nfs-ssl-cert', TLSObjectScope.SERVICE),
             'nfs_ssl_ca_cert': ('nfs.foo', 'nfs-ssl-ca-cert', TLSObjectScope.SERVICE),
+            'smb_ssl_cert': ('smb.foo', 'smb-ssl-cert', TLSObjectScope.SERVICE),
+            'smb_ssl_ca_cert': ('smb.foo', 'smb-ssl-ca-cert', TLSObjectScope.SERVICE),
         }
         unknown_certs = {
             'unknown_per_service_cert': ('unknown-svc.foo', 'unknown-cert', TLSObjectScope.SERVICE),
@@ -629,6 +655,7 @@ class TestCertMgr(object):
             'ingress_ssl_key': ('ingress', 'ingress-ssl-key', TLSObjectScope.SERVICE),
             'iscsi_ssl_key': ('iscsi', 'iscsi-ssl-key', TLSObjectScope.SERVICE),
             'nfs_ssl_key': ('nfs.foo', 'nfs-ssl-key', TLSObjectScope.SERVICE),
+            'smb_ssl_key': ('smb.foo', 'smb-ssl-key', TLSObjectScope.SERVICE),
         }
         unknown_keys = {
             'unknown_per_service_key': ('unknown-svc.foo', 'unknown-key', TLSObjectScope.SERVICE),
@@ -703,10 +730,13 @@ class TestCertMgr(object):
             'mgmt_gateway_ssl_cert': ('mgmt-gateway', 'good-global-cert', TLSObjectScope.GLOBAL),
             'nfs_ssl_cert': ('nfs.foo', 'nfs-ssl-cert', TLSObjectScope.SERVICE),
             'nfs_ssl_ca_cert': ('nfs.foo', 'nfs-ssl-ca-cert', TLSObjectScope.SERVICE),
+            'smb_ssl_cert': ('smb.foo', 'smb-ssl-cert', TLSObjectScope.SERVICE),
+            'smb_ssl_ca_cert': ('smb.foo', 'smb-ssl-ca-cert', TLSObjectScope.SERVICE),
         }
         good_keys = {
             'rgw_ssl_key': ('rgw.foo', 'good-key', TLSObjectScope.SERVICE),
             'nfs_ssl_key': ('nfs.foo', 'nfs-ssl-key', TLSObjectScope.SERVICE),
+            'smb_ssl_key': ('smb.foo', 'smb-ssl-key', TLSObjectScope.SERVICE),
         }
 
         # Helpers to dump valid JSON structures
@@ -757,12 +787,18 @@ class TestCertMgr(object):
         assert cert_store['nfs_ssl_cert']['nfs.foo'] == Cert('nfs-ssl-cert', True)
         assert 'nfs_ssl_ca_cert' in cert_store
         assert cert_store['nfs_ssl_ca_cert']['nfs.foo'] == Cert('nfs-ssl-ca-cert', True)
+        assert 'smb_ssl_cert' in cert_store
+        assert cert_store['smb_ssl_cert']['smb.foo'] == Cert('smb-ssl-cert', True)
+        assert 'smb_ssl_ca_cert' in cert_store
+        assert cert_store['smb_ssl_ca_cert']['smb.foo'] == Cert('smb-ssl-ca-cert', True)
         assert 'mgmt_gateway_ssl_cert' in cert_store
         assert cert_store['mgmt_gateway_ssl_cert'] == Cert('good-global-cert', True)
         assert 'rgw_ssl_key' in key_store
         assert key_store['rgw_ssl_key']['rgw.foo'] == PrivKey('good-key')
         assert 'nfs_ssl_key' in key_store
         assert key_store['nfs_ssl_key']['nfs.foo'] == PrivKey('nfs-ssl-key')
+        assert 'smb_ssl_key' in key_store
+        assert key_store['smb_ssl_key']['smb.foo'] == PrivKey('smb-ssl-key')
 
         # Bad ones: object names exist (pre-registered), but **no targets** were added
         # Service / Host scoped => dict should be empty

From 035b96985ead64f158d9df550378591cb490dfff Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Fri, 8 May 2026 18:08:52 +0530
Subject: [PATCH 315/596] mgr/cephadm: Add test case from smb spec and
 validating functionality with test

Here we have added a test case to test_smb.py to validate functionality
of certificate manager after apply certificates.

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 .../mgr/cephadm/tests/services/test_smb.py    | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/src/pybind/mgr/cephadm/tests/services/test_smb.py b/src/pybind/mgr/cephadm/tests/services/test_smb.py
index f6da6f557ab..2add9e5fe6e 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_smb.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_smb.py
@@ -1,13 +1,23 @@
 import json
 from unittest.mock import patch
 
+from ceph.smb.constants import REMOTE_CONTROL
 from cephadm.services.smb import SMBSpec, SMBExternalCephCluster
 from cephadm.module import CephadmOrchestrator
 from cephadm.tests.fixtures import with_host, with_service, async_side_effect
 
+from cephadm.services.service_registry import service_registry
+from cephadm.services.cephadmservice import CephadmDaemonDeploySpec
+from ceph.deployment.service_spec import PlacementSpec
 
 _SAMBA_METRICS_IMAGE = 'quay.io/samba.org/samba-metrics:devbuilds-centos-any'
 
+cephadm_root_ca = """-----BEGIN CERTIFICATE-----\nMIIE7DCCAtSgAwIBAgIUE8b2zZ64geu2ns3Zfn3/4L+Cf6MwDQYJKoZIhvcNAQEL\nBQAwFzEVMBMGA1UEAwwMY2VwaGFkbS1yb290MB4XDTI0MDYyNjE0NDA1M1oXDTM0\nMDYyNzE0NDA1M1owFzEVMBMGA1UEAwwMY2VwaGFkbS1yb290MIICIjANBgkqhkiG\n9w0BAQEFAAOCAg8AMIICCgKCAgEAsZRJsdtTr9GLG1lWFql5SGc46ldFanNJd1Gl\nqXq5vgZVKRDTmNgAb/XFuNEEmbDAXYIRZolZeYKMHfn0pouPRSel0OsC6/02ZUOW\nIuN89Wgo3IYleCFpkVIumD8URP3hwdu85plRxYZTtlruBaTRH38lssyCqxaOdEt7\nAUhvYhcMPJThB17eOSQ73mb8JEC83vB47fosI7IhZuvXvRSuZwUW30rJanWNhyZq\neS2B8qw2RSO0+77H6gA4ftBnitfsE1Y8/F9Z/f92JOZuSMQXUB07msznPbRJia3f\nueO8gOc32vxd1A1/Qzp14uX34yEGY9ko2lW226cZO29IVUtXOX+LueQttwtdlpz8\ne6Npm09pXhXAHxV/OW3M28MdXmobIqT/m9MfkeAErt5guUeC5y8doz6/3VQRjFEn\nRpN0WkblgnNAQ3DONPc+Qd9Fi/wZV2X7bXoYpNdoWDsEOiE/eLmhG1A2GqU/mneP\nzQ6u79nbdwTYpwqHpa+PvusXeLfKauzI8lLUJotdXy9EK8iHUofibB61OljYye6B\nG3b8C4QfGsw8cDb4APZd/6AZYyMx/V3cGZ+GcOV7WvsC8k7yx5Uqasm/kiGQ3EZo\nuNenNEYoGYrjb8D/8QzqNUTwlEh27/ps80tO7l2GGTvWVZL0PRZbmLDvO77amtOf\nOiRXMoUCAwEAAaMwMC4wGwYDVR0RBBQwEocQAAAAAAAAAAAAAAAAAAAAATAPBgNV\nHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAxwzX5AhYEWhTV4VUwUj5+\nqPdl4Q2tIxRokqyE+cDxoSd+6JfGUefUbNyBxDt0HaBq8obDqqrbcytxnn7mpnDu\nhtiauY+I4Amt7hqFOiFA4cCLi2mfok6g2vL53tvhd9IrsfflAU2wy7hL76Ejm5El\nA+nXlkJwps01Whl9pBkUvIbOn3pXX50LT4hb5zN0PSu957rjd2xb4HdfuySm6nW4\n4GxtVWfmGA6zbC4XMEwvkuhZ7kD2qjkAguGDF01uMglkrkCJT3OROlNBuSTSBGqt\ntntp5VytHvb7KTF7GttM3ha8/EU2KYaHM6WImQQTrOfiImAktOk4B3lzUZX3HYIx\n+sByO4P4dCvAoGz1nlWYB2AvCOGbKf0Tgrh4t4jkiF8FHTXGdfvWmjgi1pddCNAy\nn65WOCmVmLZPERAHOk1oBwqyReSvgoCFo8FxbZcNxJdlhM0Z6hzKggm3O3Dl88Xl\n5euqJjh2STkBW8Xuowkg1TOs5XyWvKoDFAUzyzeLOL8YSG+gXV22gPTUaPSVAqdb\nwd0Fx2kjConuC5bgTzQHs8XWA930U3XWZraj21Vaa8UxlBLH4fUro8H5lMSYlZNE\nJHRNW8BkznAClaFSDG3dybLsrzrBFAu/Qb5zVkT1xyq0YkepGB7leXwq6vjWA5Pw\nmZbKSphWfh0qipoqxqhfkw==\n-----END CERTIFICATE-----\n"""
+
+ceph_generated_cert = """-----BEGIN CERTIFICATE-----\nMIICxjCCAa4CEQDIZSujNBlKaLJzmvntjukjMA0GCSqGSIb3DQEBDQUAMCExDTAL\nBgNVBAoMBENlcGgxEDAOBgNVBAMMB2NlcGhhZG0wHhcNMjIwNzEzMTE0NzA3WhcN\nMzIwNzEwMTE0NzA3WjAhMQ0wCwYDVQQKDARDZXBoMRAwDgYDVQQDDAdjZXBoYWRt\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyyMe4DMA+MeYK7BHZMHB\nq7zjliEOcNgxomjU8qbf5USF7Mqrf6+/87XWqj4pCyAW8x0WXEr6A56a+cmBVmt+\nqtWDzl020aoId6lL5EgLLn6/kMDCCJLq++Lg9cEofMSvcZh+lY2f+1p+C+00xent\nrLXvXGOilAZWaQfojT2BpRnNWWIFbpFwlcKrlg2G0cFjV5c1m6a0wpsQ9JHOieq0\nSvwCixajwq3CwAYuuiU1wjI4oJO4Io1+g8yB3nH2Mo/25SApCxMXuXh4kHLQr/T4\n4hqisvG4uJYgKMcSIrWj5o25mclByGi1UI/kZkCUES94i7Z/3ihx4Bad0AMs/9tw\nFwIDAQABMA0GCSqGSIb3DQEBDQUAA4IBAQAf+pwz7Gd7mDwU2LY0TQXsK6/8KGzh\nHuX+ErOb8h5cOAbvCnHjyJFWf6gCITG98k9nxU9NToG0WYuNm/max1y/54f0dtxZ\npUo6KSNl3w6iYCfGOeUIj8isi06xMmeTgMNzv8DYhDt+P2igN6LenqWTVztogkiV\nxQ5ZJFFLEw4sN0CXnrZX3t5ruakxLXLTLKeE0I91YJvjClSBGkVJq26wOKQNHMhx\npWxeydQ5EgPZY+Aviz5Dnxe8aB7oSSovpXByzxURSabOuCK21awW5WJCGNpmqhWK\nZzACBDEstccj57c4OGV0eayHJRsluVr2e9NHRINZA3qdB37e6gsI1xHo\n-----END CERTIFICATE-----\n"""
+
+ceph_generated_key = """-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDLIx7gMwD4x5gr\nsEdkwcGrvOOWIQ5w2DGiaNTypt/lRIXsyqt/r7/ztdaqPikLIBbzHRZcSvoDnpr5\nyYFWa36q1YPOXTbRqgh3qUvkSAsufr+QwMIIkur74uD1wSh8xK9xmH6VjZ/7Wn4L\n7TTF6e2ste9cY6KUBlZpB+iNPYGlGc1ZYgVukXCVwquWDYbRwWNXlzWbprTCmxD0\nkc6J6rRK/AKLFqPCrcLABi66JTXCMjigk7gijX6DzIHecfYyj/blICkLExe5eHiQ\nctCv9PjiGqKy8bi4liAoxxIitaPmjbmZyUHIaLVQj+RmQJQRL3iLtn/eKHHgFp3Q\nAyz/23AXAgMBAAECggEAVoTB3Mm8azlPlaQB9GcV3tiXslSn+uYJ1duCf0sV52dV\nBzKW8s5fGiTjpiTNhGCJhchowqxoaew+o47wmGc2TvqbpeRLuecKrjScD0GkCYyQ\neM2wlshEbz4FhIZdgS6gbuh9WaM1dW/oaZoBNR5aTYo7xYTmNNeyLA/jO2zr7+4W\n5yES1lMSBXpKk7bDGKYY4bsX2b5RLr2Grh2u2bp7hoLABCEvuu8tSQdWXLEXWpXo\njwmV3hc6tabypIa0mj2Dmn2Dmt1ppSO0AZWG/WAizN3f4Z0r/u9HnbVrVmh0IEDw\n3uf2LP5o3msG9qKCbzv3lMgt9mMr70HOKnJ8ohMSKQKBgQDLkNb+0nr152HU9AeJ\nvdz8BeMxcwxCG77iwZphZ1HprmYKvvXgedqWtS6FRU+nV6UuQoPUbQxJBQzrN1Qv\nwKSlOAPCrTJgNgF/RbfxZTrIgCPuK2KM8I89VZv92TSGi362oQA4MazXC8RAWjoJ\nSu1/PHzK3aXOfVNSLrOWvIYeZQKBgQD/dgT6RUXKg0UhmXj7ExevV+c7oOJTDlMl\nvLngrmbjRgPO9VxLnZQGdyaBJeRngU/UXfNgajT/MU8B5fSKInnTMawv/tW7634B\nw3v6n5kNIMIjJmENRsXBVMllDTkT9S7ApV+VoGnXRccbTiDapBThSGd0wri/CuwK\nNWK1YFOeywKBgEDyI/XG114PBUJ43NLQVWm+wx5qszWAPqV/2S5MVXD1qC6zgCSv\nG9NLWN1CIMimCNg6dm7Wn73IM7fzvhNCJgVkWqbItTLG6DFf3/DPODLx1wTMqLOI\nqFqMLqmNm9l1Nec0dKp5BsjRQzq4zp1aX21hsfrTPmwjxeqJZdioqy2VAoGAXR5X\nCCdSHlSlUW8RE2xNOOQw7KJjfWT+WAYoN0c7R+MQplL31rRU7dpm1bLLRBN11vJ8\nMYvlT5RYuVdqQSP6BkrX+hLJNBvOLbRlL+EXOBrVyVxHCkDe+u7+DnC4epbn+N8P\nLYpwqkDMKB7diPVAizIKTBxinXjMu5fkKDs5n+sCgYBbZheYKk5M0sIxiDfZuXGB\nkf4mJdEkTI1KUGRdCwO/O7hXbroGoUVJTwqBLi1tKqLLarwCITje2T200BYOzj82\nqwRkCXGtXPKnxYEEUOiFx9OeDrzsZV00cxsEnX0Zdj+PucQ/J3Cvd0dWUspJfLHJ\n39gnaegswnz9KMQAvzKFdg==\n-----END PRIVATE KEY-----\n"""
+
 
 class TestSMB:
     @patch("cephadm.module.CephadmOrchestrator.get_unique_name")
@@ -149,6 +159,49 @@ class TestSMB:
                     use_current_daemon_image=False,
                 )
 
+    @patch("cephadm.serve.CephadmServe._run_cephadm")
+    def test_smb_tls_feature_cert_in_config_blobs(
+        self, _run_cephadm, cephadm_module: CephadmOrchestrator
+    ):
+        _run_cephadm.side_effect = async_side_effect(('{}', '', 0))
+
+        with with_host(cephadm_module, 'test', addr='1.2.3.7'):
+            cephadm_module.cache.update_host_networks(
+                'test',
+                {'1.2.3.0/24': {'if0': ['1.2.3.7']}}
+            )
+
+            smb_spec = SMBSpec(
+                cluster_id='foxtrot',
+                service_id='foo',
+                config_uri='rados://.smb/foxtrot/config2.json',
+                placement=PlacementSpec(hosts=['test']),
+                features=[REMOTE_CONTROL],
+                ssl_certificates={
+                    'remote_control': {
+                        'enabled': True,
+                        'ssl_cert': ceph_generated_cert,
+                        'ssl_key': ceph_generated_key,
+                        'ssl_ca_cert': cephadm_root_ca,
+                        'certificate_source': 'inline',
+                    },
+                },
+            )
+            service_name = smb_spec.service_name()
+
+            with with_service(cephadm_module, smb_spec):
+                smb_conf, _ = service_registry.get_service('smb').generate_config(
+                    CephadmDaemonDeploySpec(
+                        host='test',
+                        daemon_id='foo.test.0',
+                        service_name=service_name,
+                    )
+                )
+                files = smb_conf.get('files', {})
+                assert files.get('remote_control.ssl.crt') == ceph_generated_cert
+                assert files.get('remote_control.ssl.key') == ceph_generated_key
+                assert files.get('remote_control.ca.crt') == cephadm_root_ca
+
 
 def test_smb_get_dependencies(cephadm_module):
     from cephadm.services.smb import SMBService

From 33c9e66cea3be9225b7462dde85f456909d48199 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Sun, 10 May 2026 13:01:22 +0530
Subject: [PATCH 316/596] doc/cephadm: Add SMB TLS/SSL configuration and
 examples

Add SMB TLS/SSL configuration with example for SMB features
remote_control and keybridge

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 doc/cephadm/services/smb.rst | 89 +++++++++++++++++++++++++++++++++++-
 1 file changed, 88 insertions(+), 1 deletion(-)

diff --git a/doc/cephadm/services/smb.rst b/doc/cephadm/services/smb.rst
index ea7ae632f9e..bc5b7c7cfdf 100644
--- a/doc/cephadm/services/smb.rst
+++ b/doc/cephadm/services/smb.rst
@@ -53,13 +53,100 @@ An SMB service can be applied using a specification. An example in YAML follows:
       include_ceph_users:
         - client.smb.fs.cluster.tango
 
+TLS/SSL Example
+---------------
+
+Here's an example SMB service specification with TLS/SSL configuration:
+
+.. code-block:: yaml
+
+   service_id: smbcluster
+   service_type: smb
+   cluster_id: tango
+   config_uri: rados://smb/foxtrot/config.json
+   placement:
+     hosts:
+       - host0
+   spec:
+     ssl_certificates:
+       remote_control:
+         enabled: true
+         certificate_source: inline
+         ssl_cert: |
+           -----BEGIN CERTIFICATE-----
+           ...
+           -----END CERTIFICATE-----
+
+         ssl_key: |
+           -----BEGIN PRIVATE KEY-----
+           ...
+           -----END PRIVATE KEY-----
+
+         ssl_ca_cert: |
+           -----BEGIN CERTIFICATE-----
+           ...
+           -----END CERTIFICATE-----
+       keybridge:
+         enabled: true
+         certificate_source: inline
+         ssl_cert: |
+           -----BEGIN CERTIFICATE-----
+           ...
+           -----END CERTIFICATE-----
+
+         ssl_key: |
+           -----BEGIN PRIVATE KEY-----
+           ...
+           -----END PRIVATE KEY-----
+
+         ssl_ca_cert: |
+           -----BEGIN CERTIFICATE-----
+           ...
+           -----END CERTIFICATE-----
+
+This example configures an SMB service with TLS encryption enabled using
+inline certificates.
+
+TLS/SSL Parameters
+~~~~~~~~~~~~~~~~~~
+
+The following parameters can be used to configure TLS/SSL encryption per sidecar
+for the SMB service:
+
+* ``enabled`` (boolean): Enable or disable SSL/TLS encryption. Default is ``false``.
+
+* ``certificate_source`` (string): Specifies the source of the TLS certificates.
+  Options include:
+
+  - ``cephadm-signed``: Use certificates signed by cephadm's internal CA
+  - ``inline``: Provide certificates directly in the specification using ``ssl_cert``,
+    ``ssl_key`` and ``ssl_ca_cert`` fields
+  - ``reference``: Users can register their own certificate and key with certmgr and
+    set the ``certificate_source`` to ``reference`` in the spec.
+
+* ``ssl_cert`` (string): The SSL certificate in PEM format. Required when using
+  ``inline`` certificate source.
+
+* ``ssl_key`` (string): The SSL private key in PEM format. Required when using
+  ``inline`` certificate source.
+
+* ``ssl_ca_cert`` (string): The SSL CA certificate in PEM format. Required when
+  using ``inline`` certificate source.
+
+.. note::
+   ``ssl_key``, ``ssl_cert`` and ``ssl_ca_cert`` can be set from the smb manager
+   module. If ``cert`` and ``key`` are specified in the resource_type
+   ``ceph.smb.tls.credential`` and applied from the smb manager will be automatically
+   configured as ssl_certificate is enabled and update ``ssl_key``, ``ssl_cert`` to
+   the certificate manager. ``ssl_ca_cert`` will be set if it is specified in the
+   resource_type ``ceph.smb.tls.credential``
+
 The specification can then be applied by running the following command:
 
 .. prompt:: bash #
 
    ceph orch apply -i smb.yaml
 
-
 Service Spec Options
 --------------------
 

From a3aa69398767f9c3db26d18b7bc298300a52c9b8 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Sun, 31 May 2026 22:09:09 +0530
Subject: [PATCH 317/596] mgr/cephadm: add ca_cert_required parameter to
 get_certificates mock in test

Add the ca_cert_required parameter to the lambda function mocking
CephadmService.get_certificates in test_prometheus_config_security_enabled
to match the updated method signature.

This ensures the test mock properly handles the new parameter that was
added to the get_certificates method.

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 src/pybind/mgr/cephadm/tests/services/test_monitoring.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/cephadm/tests/services/test_monitoring.py b/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
index 6c23592dd78..340a231d2e3 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_monitoring.py
@@ -793,7 +793,7 @@ class TestMonitoring:
     @patch("cephadm.services.monitoring.password_hash", lambda password: 'prometheus_password_hash')
     @patch('cephadm.cert_mgr.CertMgr.get_root_ca', lambda instance: 'cephadm_root_cert')
     @patch("cephadm.services.cephadmservice.CephadmService.get_certificates",
-           lambda instance, dspec, ips=None, fqdns=None: TLSCredentials('mycert', 'mykey'))
+           lambda instance, dspec, ips=None, fqdns=None, ca_cert_required=False: TLSCredentials('mycert', 'mykey'))
     def test_prometheus_config_security_enabled(self, _run_cephadm, _get_uname, cephadm_module: CephadmOrchestrator):
         _run_cephadm.side_effect = async_side_effect(('{}', '', 0))
         _get_uname.return_value = 'test'

From d74b88500b654774ba05339f4ee7c2d673af4f55 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 18 Jun 2026 22:06:36 +0800
Subject: [PATCH 318/596] debian/rules: exclude CI and test directories from
 mgr plugin packages

The ceph-mgr-dashboard and ceph-mgr-rook packages install their entire
mgr module directory, which includes a ci/ subdirectory containing
Dockerfiles, e2e test scripts, and cluster specs used only for upstream
CI pipelines.  ceph-mgr-cephadm similarly ships a tests/ directory with
Python unit tests.  These files have no runtime purpose on a deployed
system and should not be shipped in the binary packages.

Exclude mgr/cephadm/tests, mgr/dashboard/ci, and mgr/rook/ci via
dh_install --exclude.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 debian/rules | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index 48b8634a1c4..d27dac6a664 100755
--- a/debian/rules
+++ b/debian/rules
@@ -158,7 +158,10 @@ override_dh_python3:
 	dh_python3 -p ceph-fuse --shebang=/usr/bin/python3
 	dh_python3 -p ceph-volume --shebang=/usr/bin/python3
 
+override_dh_install:
+	dh_install --exclude=mgr/cephadm/tests --exclude=mgr/dashboard/ci --exclude=mgr/rook/ci
+
 # do not run tests
 override_dh_auto_test:
 
-.PHONY: override_dh_autoreconf override_dh_auto_configure override_dh_auto_clean override_dh_auto_install override_dh_installlogrotate override_dh_installinit override_dh_strip override_dh_auto_test
+.PHONY: override_dh_autoreconf override_dh_auto_configure override_dh_auto_clean override_dh_auto_install override_dh_installlogrotate override_dh_installinit override_dh_install override_dh_strip override_dh_auto_test

From 8a2e0eb2fcd12abf4917c74dcd39f6e7f25e5e75 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 18 Jun 2026 22:06:43 +0800
Subject: [PATCH 319/596] ceph.spec.in: exclude CI and test directories from
 mgr plugin packages

The ceph-mgr-dashboard and ceph-mgr-rook packages install their entire
mgr module directory, which includes a ci/ subdirectory containing
Dockerfiles, e2e test scripts, and cluster specs used only for upstream
CI pipelines.  ceph-mgr-cephadm similarly ships a tests/ directory with
Python unit tests.  These files have no runtime purpose on a deployed
system and should not be shipped in the binary packages.

Exclude mgr/cephadm/tests, mgr/dashboard/ci, and mgr/rook/ci via
%exclude directives.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ceph.spec.in b/ceph.spec.in
index b0fba106c2c..186cacb9a86 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -2345,6 +2345,7 @@ fi
 
 %files mgr-dashboard
 %{_datadir}/ceph/mgr/dashboard
+%exclude %{_datadir}/ceph/mgr/dashboard/ci
 
 %ceph_mgr_module_scripts mgr-dashboard
 
@@ -2465,6 +2466,7 @@ fi
 
 %files mgr-rook
 %{_datadir}/ceph/mgr/rook
+%exclude %{_datadir}/ceph/mgr/rook/ci
 
 %ceph_mgr_module_scripts mgr-rook
 
@@ -2475,6 +2477,7 @@ fi
 
 %files mgr-cephadm
 %{_datadir}/ceph/mgr/cephadm
+%exclude %{_datadir}/ceph/mgr/cephadm/tests
 
 %ceph_mgr_module_scripts mgr-cephadm
 

From 8a35d17c7207a530a4e76b52468fc606849024c3 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 29 May 2026 16:35:26 +0800
Subject: [PATCH 320/596] librbd/cache/pwl: cancel periodic_stats timer before
 perf_stop()

AbstractWriteLog::shut_down() calls perf_stop(), which deletes
m_perfcounter, but the 5s periodic_stats timer is only canceled later
in the destructor. If it fires in between, periodic_stats ->
update_image_cache_state dereferences the freed m_perfcounter. Cancel
the timer under m_timer_lock first.

Destroying an AbstractWriteLog that was init()'ed without a matching
shut_down() is illegal, so the cancel_event() in the destructor is now
redundant and is dropped.

Fixes: https://tracker.ceph.com/issues/77501

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/librbd/cache/pwl/AbstractWriteLog.cc | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/librbd/cache/pwl/AbstractWriteLog.cc b/src/librbd/cache/pwl/AbstractWriteLog.cc
index 70d8d7418a1..44ea8271b50 100644
--- a/src/librbd/cache/pwl/AbstractWriteLog.cc
+++ b/src/librbd/cache/pwl/AbstractWriteLog.cc
@@ -85,9 +85,7 @@ template <typename I>
 AbstractWriteLog<I>::~AbstractWriteLog() {
   ldout(m_image_ctx.cct, 15) << "enter" << dendl;
   {
-    std::lock_guard timer_locker(*m_timer_lock);
     std::lock_guard locker(m_lock);
-    m_timer->cancel_event(m_timer_ctx);
     m_thread_pool.stop();
     ceph_assert(m_deferred_ios.size() == 0);
     ceph_assert(m_ops_to_flush.size() == 0);
@@ -649,6 +647,11 @@ void AbstractWriteLog<I>::shut_down(Context *on_finish) {
 
   Context *ctx = new LambdaContext(
     [this, on_finish](int r) {
+      {
+        std::lock_guard timer_locker(*m_timer_lock);
+        m_timer->cancel_event(m_timer_ctx);
+        m_timer_ctx = nullptr;
+      }
       if (m_perfcounter) {
         perf_stop();
       }

From dbf322147969fe0e7fe2060fcfec7500fc5b4712 Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Sun, 31 May 2026 23:02:11 +0530
Subject: [PATCH 321/596] mgr/cephadm/services: Add supported function for ssl
 certificates

Added function for get smb features TLSCredentials using _get_feature_certs

Added function _get_certificates_from_spec_ssl_certificates to get the
certificates for ssl_certificates

Updating features ssl certificates to default path of containers

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/cephadm/services/smb.py | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/smb.py b/src/pybind/mgr/cephadm/services/smb.py
index 831b89dc1ef..d6f31c8312a 100644
--- a/src/pybind/mgr/cephadm/services/smb.py
+++ b/src/pybind/mgr/cephadm/services/smb.py
@@ -16,11 +16,8 @@ from typing import (
 )
 
 from mgr_module import HandleCommandResult
-from cephadm.tlsobject_types import TLSObjectScope, TLSCredentials, EMPTY_TLS_CREDENTIALS
 from ceph.smb.constants import (
-    KEYBRIDGE, 
-    REMOTE_CONTROL,
-    FEATURES,
+    SMB_FEATURE_SUPPORTS_SSL,
 )
 
 from ceph.deployment.service_spec import (
@@ -152,21 +149,15 @@ class SMBService(CephService):
         )
         return daemon_spec
 
-    def _feature_tls_filename(self, feature: str) -> Optional[str]:
-        return {
-                KEYBRIDGE: "keybridge",
-                REMOTE_CONTROL: "remote_control"
-            }.get(feature)
-
     # Flat SSL fields on SMBSpec per feature, used as a fallback when
     # ssl_certificates is not set (backward compatibility).
     _FEATURE_FLAT_ATTRS: Dict[str, Tuple[str, str, str]] = {
-        REMOTE_CONTROL: (
+        "remote_control": (
             'remote_control_ssl_cert',
             'remote_control_ssl_key',
             'remote_control_ca_cert',
         ),
-        KEYBRIDGE: (
+        "keybridge": (
             'keybridge_kmip_ssl_cert',
             'keybridge_kmip_ssl_key',
             'keybridge_kmip_ca_cert',
@@ -177,7 +168,6 @@ class SMBService(CephService):
         self,
         daemon_spec: CephadmDaemonDeploySpec,
         smb_spec: SMBSpec,
-        support_feature: str,
         feature: str,
     ) -> TLSCredentials:
         feature_creds = self.get_certificates(
@@ -185,7 +175,7 @@ class SMBService(CephService):
         )
         if feature_creds:
             return feature_creds
-        flat_attrs = self._FEATURE_FLAT_ATTRS.get(support_feature)
+        flat_attrs = self._FEATURE_FLAT_ATTRS.get(feature)
         if flat_attrs is None:
             return EMPTY_TLS_CREDENTIALS
         cert_attr, key_attr, ca_attr = flat_attrs
@@ -225,7 +215,6 @@ class SMBService(CephService):
         smb_spec = cast(
             SMBSpec, self.mgr.spec_store[daemon_spec.service_name].spec
         )
-        ssl_certificates = smb_spec.ssl_certificates or {}
         config_blobs: Dict[str, Any] = {}
 
         config_blobs['cluster_id'] = smb_spec.cluster_id
@@ -254,11 +243,10 @@ class SMBService(CephService):
         config_blobs['service_ports'] = smb_spec.service_ports()
         if smb_spec.bind_addrs:
             config_blobs['bind_networks'] = smb_spec.bind_networks()
-        for support_feature in smb_spec.features:
-            feature = self._feature_tls_filename(support_feature)
-            if feature is not None:
+        for feature in smb_spec.ssl_certificates.keys():
+            if feature is not None and feature in SMB_FEATURE_SUPPORTS_SSL:
                 feature_creds = self._get_feature_certs(
-                    daemon_spec, smb_spec, support_feature, feature
+                    daemon_spec, smb_spec, feature
                 )
                 if feature_creds:
                     files = config_blobs.setdefault('files', {})

From 6f598d751326b49898852d640b0731dddcbb1f5a Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Tue, 16 Jun 2026 00:40:58 +0530
Subject: [PATCH 322/596] mgr/cephadm: Registering smb features for ssl
 certificate with certmgr

Here we are registering smb features such remote_control and keybridge
with certificate manager and can be list with ceph orch certmgr bindings
ls

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 src/pybind/mgr/cephadm/module.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 0798b44fff4..96cb2aee2d0 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -776,6 +776,15 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
         self.cert_mgr.register_cert('nvmeof', 'nvmeof_root_ca_cert', TLSObjectScope.SERVICE)
         # register haproxy monitor ssl cert and key
         self.cert_mgr.register_cert_key_pair('ingress', 'haproxy_monitor_ssl_cert', 'haproxy_monitor_ssl_key', TLSObjectScope.SERVICE)
+        # register per-feature SMB TLS cert names
+        for _smb_feature in ['remote_control', 'keybridge']:
+            self.cert_mgr.register_cert_key_pair(
+                'smb',
+                f'smb_{_smb_feature}_ssl_cert',
+                f'smb_{_smb_feature}_ssl_key',
+                TLSObjectScope.SERVICE,
+                f'smb_{_smb_feature}_ca_cert',
+            )
 
         self.cert_mgr.init_tlsobject_store()
 

From f02b985bd84f4e2a60eed57fc0cd2f8c43ece0cb Mon Sep 17 00:00:00 2001
From: Rabinarayan Panigrahi <rapanigr@redhat.com>
Date: Thu, 18 Jun 2026 17:15:01 +0530
Subject: [PATCH 323/596] python-common/ceph/smb: Add smb features constants
 for SSL

Add smb constants to support for ca_certificate validation and string
alteration

Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com>
---
 src/python-common/ceph/smb/constants.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/python-common/ceph/smb/constants.py b/src/python-common/ceph/smb/constants.py
index 53745b3a421..f82a0c912f1 100644
--- a/src/python-common/ceph/smb/constants.py
+++ b/src/python-common/ceph/smb/constants.py
@@ -17,7 +17,6 @@ REMOTE_CONTROL = 'remote-control'
 REMOTE_CONTROL_LOCAL = 'remote-control-local'
 SMBMETRICS = 'smbmetrics'
 
-
 # Features are optional components that can be deployed in a suite of smb
 # related containers. It may run as a separate sidecar or side-effect the
 # configuration of another component.
@@ -39,6 +38,15 @@ SERVICES = {
     SMBMETRICS,
 }
 
+FEATURE_FILE_NAMES = {
+    KEYBRIDGE: KEYBRIDGE,
+    REMOTE_CONTROL: "remote_control",
+}
+SMB_FEATURE_SUPPORTS_SSL = {
+    "remote_control",
+    KEYBRIDGE,
+}
+CA_CERT_REQUIRED_FEATURES = {'keybridge'}
 
 # Default port values
 SMB_PORT = 445

From eee6a15dcd845914595dbb1d76470bd4b73947c1 Mon Sep 17 00:00:00 2001
From: Abhishek Desai <abhishek.desai1@ibm.com>
Date: Tue, 26 May 2026 13:18:40 +0530
Subject: [PATCH 324/596] mgr/dashboard : Support wildcard sans and zonegroup
 hostnames fixes : https://tracker.ceph.com/issues/76795 Signed-off-by:
 Abhishek Desai <abhishek.desai1@ibm.com>

---
 .../service-form/service-form.component.html  |  55 +++++++++-
 .../service-form.component.spec.ts            |  58 ++++++++++
 .../service-form/service-form.component.ts    | 103 ++++++++++++++----
 .../app/shared/models/service.interface.ts    |   8 ++
 4 files changed, 197 insertions(+), 27 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index 9cdf6e025bc..c77c36abc14 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -403,6 +403,37 @@
           }
         </ng-template>
       </div>
+
+      @if (!rgwModuleEnabled) {
+      <cd-alert-panel type="warning"
+                      spacingClass="mb-3"
+                      actionName="Enable"
+                      (action)="enableRgwModule()"
+                      i18n-actionName
+                      i18n>
+        The RGW mgr module must be enabled to configure S3 hostnames.
+        Enabling the module will cause temporary manager downtime while it loads.
+      </cd-alert-panel>
+      }
+      <div class="form-item">
+        <cds-checkbox i18n-label
+                      formControlName="virtual_host_enabled">
+          Enable virtual-host style bucket access
+          <cd-help-text i18n>
+            Allows bucket access via hostnames such as mybucket.s3.example.com.
+          </cd-help-text>
+        </cds-checkbox>
+      </div>
+      @if (serviceForm.controls.virtual_host_enabled.value) {
+      <div class="form-item">
+        <cd-text-label-list formControlName="zonegroup_hostnames"
+                            label="S3 hostname"
+                            i18n-label
+                            helperText="Domain names for S3 virtual-host bucket access (e.g., s3.example.com). Enables bucket URLs like bucket.s3.example.com instead of s3.example.com/bucket."
+                            i18n-helperText>
+        </cd-text-label-list>
+      </div>
+      }
       }
 
       <!-- iSCSI -->
@@ -1218,13 +1249,13 @@
           <cds-radio-group formControlName="certificateType"
                            orientation="horizontal"
                            helperText="Select how certificates will be signed for this service. Choose internal to use the cluster’s CA, or external to upload certificates signed by your organization.">
-            <cds-radio value="internal"
-                       (change)="onCertificateTypeChange('internal')"
+            <cds-radio [value]="CertificateType.internal"
+                       (change)="onCertificateTypeChange(CertificateType.internal)"
                        i18n>
               Internal
             </cds-radio>
-            <cds-radio value="external"
-                       (change)="onCertificateTypeChange('external')"
+            <cds-radio [value]="CertificateType.external"
+                       (change)="onCertificateTypeChange(CertificateType.external)"
                        i18n>
               External
             </cds-radio>
@@ -1239,7 +1270,7 @@
           </cd-alert-panel>
         }
 
-        @if (serviceForm.controls.certificateType.value === 'internal') {
+        @if (serviceForm.controls.certificateType.value === CertificateType.internal) {
         <cd-alert-panel type="info"
                         spacingClass="mb-3"
                         i18n>
@@ -1253,6 +1284,18 @@
                               i18n-helperText>
           </cd-text-label-list>
         </div>
+        @if (serviceForm.controls.service_type.value === 'rgw'
+             && serviceForm.controls.virtual_host_enabled.value) {
+        <div class="form-item">
+          <cds-checkbox i18n-label
+                        formControlName="wildcard_enabled">
+            Include wildcard certificate for bucket subdomains
+            <cd-help-text i18n>
+              Add wildcard certificates (*.domain) to allow SSL for all bucket subdomains. Required for virtual-host style with SSL.
+            </cd-help-text>
+          </cds-checkbox>
+        </div>
+        }
         }
       </div>
       }
@@ -1288,7 +1331,7 @@
         </ng-template>
       </div>
       <!-- ssl_ca_cert - Only show for NFS when SSL is enabled AND certificate type is external -->
-      @if (serviceForm.controls.ssl.value && serviceForm.controls.certificateType.value === 'external' && serviceForm.controls.service_type.value === 'nfs') {
+      @if (serviceForm.controls.ssl.value && serviceForm.controls.certificateType.value === CertificateType.external && serviceForm.controls.service_type.value === 'nfs') {
       <div class="form-item">
         <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'ssl_ca_cert', title: 'CA Certificate Input', helperText: 'Uploaded files will populate the CA certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a CA certificate file, or paste the CA certificate PEM content directly.', invalidTemplate: invalidSslCaCertError, isRequired: false }"></ng-container>
         <ng-template #invalidSslCaCertError>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
index 6ffd5be14c6..915c320bacc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
@@ -263,6 +263,64 @@ describe('ServiceFormComponent', () => {
         });
       });
 
+      it('should submit rgw with virtual-host style bucket access and SSL', () => {
+        formHelper.setValue('virtual_host_enabled', true);
+        formHelper.setValue('ssl', true);
+        formHelper.setValue('zonegroup_hostnames', ['s3.cephlab.com']);
+        formHelper.setValue('wildcard_enabled', true);
+        component.onSubmit();
+        expect(cephServiceService.create).toHaveBeenCalledWith({
+          service_type: 'rgw',
+          service_id: 'svc',
+          rgw_realm: null,
+          rgw_zone: null,
+          rgw_zonegroup: null,
+          placement: {},
+          unmanaged: false,
+          ssl: true,
+          certificate_source: 'cephadm-signed',
+          zonegroup_hostnames: ['s3.cephlab.com'],
+          wildcard_enabled: true
+        });
+      });
+
+      it('should submit rgw with SSL and without virtual-host style bucket access', () => {
+        formHelper.setValue('ssl', true);
+        component.onSubmit();
+        expect(cephServiceService.create).toHaveBeenCalledWith({
+          service_type: 'rgw',
+          service_id: 'svc',
+          rgw_realm: null,
+          rgw_zone: null,
+          rgw_zonegroup: null,
+          placement: {},
+          unmanaged: false,
+          ssl: true,
+          certificate_source: 'cephadm-signed'
+        });
+      });
+
+      it('should submit rgw with virtual-host style bucket access and SSL without wildcard certificate', () => {
+        formHelper.setValue('virtual_host_enabled', true);
+        formHelper.setValue('ssl', true);
+        formHelper.setValue('zonegroup_hostnames', ['s3.cephlab.com']);
+        formHelper.setValue('wildcard_enabled', false);
+        component.onSubmit();
+        expect(cephServiceService.create).toHaveBeenCalledWith({
+          service_type: 'rgw',
+          service_id: 'svc',
+          rgw_realm: null,
+          rgw_zone: null,
+          rgw_zonegroup: null,
+          placement: {},
+          unmanaged: false,
+          ssl: true,
+          certificate_source: 'cephadm-signed',
+          zonegroup_hostnames: ['s3.cephlab.com'],
+          wildcard_enabled: false
+        });
+      });
+
       it('should submit valid rgw port (1)', () => {
         formHelper.setValue('rgw_frontend_port', 1);
         component.onSubmit();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index bbde926b6b5..fb5f36af337 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -18,6 +18,7 @@ import { HostService } from '~/app/shared/api/host.service';
 import { PoolService } from '~/app/shared/api/pool.service';
 import { RbdService } from '~/app/shared/api/rbd.service';
 import { RgwMultisiteService } from '~/app/shared/api/rgw-multisite.service';
+import { MgrModuleService } from '~/app/shared/api/mgr-module.service';
 import { RgwRealmService } from '~/app/shared/api/rgw-realm.service';
 import { RgwZoneService } from '~/app/shared/api/rgw-zone.service';
 import { RgwZonegroupService } from '~/app/shared/api/rgw-zonegroup.service';
@@ -37,6 +38,7 @@ import { Host } from '~/app/shared/models/host.interface';
 import {
   CephServiceCertificate,
   CephServiceSpec,
+  CertificateType,
   QatOptions,
   QatSepcs,
   CERTIFICATE_STATUS_ICON_MAP
@@ -54,6 +56,7 @@ import { TimerService } from '~/app/shared/services/timer.service';
 export class ServiceFormComponent extends CdForm implements OnInit {
   public sub = new Subscription();
 
+  readonly CertificateType = CertificateType;
   readonly MDS_SVC_ID_PATTERN = /^[a-zA-Z_.-][a-zA-Z0-9_.-]*$/;
   readonly SNMP_DESTINATION_PATTERN = /^[^\:]+:[0-9]/;
   readonly SNMP_ENGINE_ID_PATTERN = /^[0-9A-Fa-f]{10,64}/g;
@@ -115,6 +118,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
   }));
   showMgmtGatewayMessage: boolean = false;
   showCertSourceChangeWarning: boolean = false;
+  rgwModuleEnabled = false;
   qatCompressionOptions = [
     { value: QatOptions.hw, label: 'Hardware' },
     { value: QatOptions.sw, label: 'Software' },
@@ -141,6 +145,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
     public rgwZonegroupService: RgwZonegroupService,
     public rgwZoneService: RgwZoneService,
     public rgwMultisiteService: RgwMultisiteService,
+    private mgrModuleService: MgrModuleService,
     private route: ActivatedRoute,
     public modalService: ModalCdsService,
     private location: Location
@@ -422,7 +427,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'rgw',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.pemCert()]
           ),
@@ -431,7 +436,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'iscsi',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslCert()]
           ),
@@ -440,7 +445,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'ingress',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.pemCert()]
           ),
@@ -449,7 +454,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'oauth2-proxy',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslCert()]
           ),
@@ -458,7 +463,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'mgmt-gateway',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslCert()]
           ),
@@ -467,7 +472,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'nfs',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.pemCert()]
           )
@@ -481,7 +486,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'iscsi',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslPrivKey()]
           ),
@@ -490,7 +495,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'oauth2-proxy',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslPrivKey()]
           ),
@@ -499,7 +504,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'mgmt-gateway',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslPrivKey()]
           ),
@@ -508,14 +513,17 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'nfs',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.sslPrivKey()]
           )
         ]
       ],
-      certificateType: ['internal'],
+      certificateType: [CertificateType.internal],
       custom_sans: [null],
+      virtual_host_enabled: [false],
+      zonegroup_hostnames: [null],
+      wildcard_enabled: [true],
       ssl_ca_cert: [
         '',
         [
@@ -524,7 +532,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               service_type: 'nfs',
               unmanaged: false,
               ssl: true,
-              certificateType: 'external'
+              certificateType: CertificateType.external
             },
             [Validators.required, CdValidators.pemCert()]
           )
@@ -686,6 +694,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
     this.open = true;
     this.action = this.actionLabels.CREATE;
     this.resolveRoute();
+    this.getRgwModuleStatus();
+    this.mgrModuleService.updateCompleted$.subscribe(() => this.getRgwModuleStatus());
 
     this.cephServiceService
       .list(new HttpParams({ fromObject: { limit: -1, offset: 0 } }))
@@ -792,10 +802,21 @@ export class ServiceFormComponent extends CdForm implements OnInit {
                 response[0].spec?.qat
               );
               this.serviceForm.get('ssl').setValue(response[0].spec?.ssl);
+              if (response[0].spec?.zonegroup_hostnames?.length) {
+                this.serviceForm
+                  .get('zonegroup_hostnames')
+                  .setValue(response[0].spec.zonegroup_hostnames);
+                if (this.rgwModuleEnabled) {
+                  this.serviceForm.get('virtual_host_enabled').setValue(true);
+                }
+              }
+              this.serviceForm
+                .get('wildcard_enabled')
+                .setValue(response[0].spec?.wildcard_enabled ?? true);
               if (response[0].spec?.ssl) {
                 // Special case for rgw: if certificate_source is not cephadm-signed, set certificateType to external
                 if (response[0].spec?.certificate_source != 'cephadm-signed') {
-                  this.serviceForm.get('certificateType').setValue('external');
+                  this.serviceForm.get('certificateType').setValue(CertificateType.external);
                 }
                 let certValue = response[0].spec?.rgw_frontend_ssl_certificate || '';
                 if (response[0].spec?.ssl_cert) {
@@ -805,6 +826,9 @@ export class ServiceFormComponent extends CdForm implements OnInit {
                   }
                 }
                 this.serviceForm.get('ssl_cert').setValue(certValue);
+                if (response[0].spec?.custom_sans) {
+                  this.serviceForm.get('custom_sans').setValue(response[0].spec.custom_sans);
+                }
               }
               break;
             case 'ingress':
@@ -830,7 +854,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               this.port = response[0].spec?.port;
               this.serviceForm.get('ssl').setValue(true);
               if (response[0].spec?.certificate_source !== 'cephadm-signed') {
-                this.serviceForm.get('certificateType').setValue('external');
+                this.serviceForm.get('certificateType').setValue(CertificateType.external);
               }
               if (response[0].spec?.ssl_protocols) {
                 let selectedValues: Array<ListItem> = [];
@@ -1232,15 +1256,37 @@ export class ServiceFormComponent extends CdForm implements OnInit {
     }
   }
 
-  onCertificateTypeChange(type: string) {
+  onCertificateTypeChange(type: CertificateType) {
     this.serviceForm.get('certificateType').setValue(type);
     if (this.editing && this.currentCertificate?.has_certificate) {
       const originalSource =
-        this.currentSpecCertificateSource === 'cephadm-signed' ? 'internal' : 'external';
+        this.currentSpecCertificateSource === 'cephadm-signed'
+          ? CertificateType.internal
+          : CertificateType.external;
       this.showCertSourceChangeWarning = type !== originalSource;
     }
   }
 
+  private getRgwModuleStatus(): void {
+    this.rgwMultisiteService.getRgwModuleStatus().subscribe((enabled: boolean) => {
+      this.rgwModuleEnabled = enabled;
+      const virtualHostControl = this.serviceForm.get('virtual_host_enabled');
+      if (enabled) {
+        virtualHostControl.enable({ emitEvent: false });
+        if (this.serviceForm.get('zonegroup_hostnames').value?.length) {
+          virtualHostControl.setValue(true, { emitEvent: false });
+        }
+      } else {
+        virtualHostControl.setValue(false, { emitEvent: false });
+        virtualHostControl.disable({ emitEvent: false });
+      }
+    });
+  }
+
+  enableRgwModule(): void {
+    this.mgrModuleService.updateModuleState('rgw', false, null, '', $localize`Enabled RGW Module`);
+  }
+
   prePopulateId() {
     const control: AbstractControl = this.serviceForm.get('service_id');
     const backendService = this.serviceForm.getValue('backend_service');
@@ -1386,11 +1432,21 @@ export class ServiceFormComponent extends CdForm implements OnInit {
             serviceSpec['rgw_frontend_port'] = values['rgw_frontend_port'];
           }
           serviceSpec['ssl'] = values['ssl'];
+          if (values['virtual_host_enabled'] && values['zonegroup_hostnames']?.length > 0) {
+            serviceSpec['zonegroup_hostnames'] = values['zonegroup_hostnames'];
+          }
           if (values['ssl']) {
             this.applySslCertificateConfig(serviceSpec, values, {
               sslCertField: 'rgw_frontend_ssl_certificate',
               includeSslKey: false
             });
+            if (
+              values['certificateType'] === CertificateType.internal &&
+              values['virtual_host_enabled'] &&
+              values['zonegroup_hostnames']?.length > 0
+            ) {
+              serviceSpec['wildcard_enabled'] = values['wildcard_enabled'];
+            }
           }
           break;
         case 'iscsi':
@@ -1538,7 +1594,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
 
   get showExternalSslCert(): boolean {
     const serviceType = this.serviceForm.controls.service_type?.value;
-    const isExternalCert = this.serviceForm.controls.certificateType?.value === 'external';
+    const isExternalCert =
+      this.serviceForm.controls.certificateType?.value === CertificateType.external;
     const isSslEnabled = this.serviceForm.controls.ssl?.value;
 
     if (serviceType === 'mgmt-gateway') {
@@ -1551,7 +1608,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
 
   get showExternalSslKey(): boolean {
     const serviceType = this.serviceForm.controls.service_type?.value;
-    const isExternalCert = this.serviceForm.controls.certificateType?.value === 'external';
+    const isExternalCert =
+      this.serviceForm.controls.certificateType?.value === CertificateType.external;
     const isSslEnabled = this.serviceForm.controls.ssl?.value;
 
     const sslKeyServices = ['iscsi', 'grafana', 'oauth2-proxy', 'nvmeof', 'nfs', 'mgmt-gateway'];
@@ -1585,13 +1643,16 @@ export class ServiceFormComponent extends CdForm implements OnInit {
     } = options;
 
     serviceSpec['certificate_source'] =
-      values['certificateType'] === 'internal' ? 'cephadm-signed' : 'inline';
+      values['certificateType'] === CertificateType.internal ? 'cephadm-signed' : 'inline';
 
-    if (values['certificateType'] === 'internal' && values['custom_sans']?.length > 0) {
+    if (
+      values['certificateType'] === CertificateType.internal &&
+      values['custom_sans']?.length > 0
+    ) {
       serviceSpec['custom_sans'] = values['custom_sans'];
     }
 
-    if (values['certificateType'] === 'external') {
+    if (values['certificateType'] === CertificateType.external) {
       serviceSpec[sslCertField] = values['ssl_cert']?.trim();
       if (includeSslKey) {
         serviceSpec[sslKeyField] = values['ssl_key']?.trim();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts
index af1e36c703d..eaca956d3ad 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts
@@ -91,6 +91,9 @@ export interface CephServiceAdditionalSpec {
   ssl_protocols: string[];
   ssl_ciphers: string[];
   certificate_source: string;
+  custom_sans?: string[];
+  zonegroup_hostnames?: string[];
+  wildcard_enabled?: boolean;
   port: number;
   initial_admin_password: string;
   rgw_realm: string;
@@ -123,6 +126,11 @@ export interface QatSepcs {
   [key: string]: string;
 }
 
+export enum CertificateType {
+  internal = 'internal',
+  external = 'external'
+}
+
 export enum QatOptions {
   hw = 'hw',
   sw = 'sw',

From 517c72f659ee194e089d3b3615d58c23c3aa3123 Mon Sep 17 00:00:00 2001
From: Adarsha Dinda <adarshadinda@Adarshas-MacBook-Pro.local>
Date: Thu, 11 Jun 2026 16:41:51 +0530
Subject: [PATCH 325/596] qa/smoke/basic: add log-ignorelist entries for
 expected smoke test warnings

Ignore FS_DEGRADED in libcephfs_interface_tests and MON_DOWN in
rbd_python_api_tests to avoid false failures from transient cluster health
messages.

Signed-off-by: Adarsha Dinda <adarshadinda@Adarshas-MacBook-Pro.local>
---
 qa/suites/smoke/basic/tasks/test/libcephfs_interface_tests.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qa/suites/smoke/basic/tasks/test/libcephfs_interface_tests.yaml b/qa/suites/smoke/basic/tasks/test/libcephfs_interface_tests.yaml
index 3be975b6bf2..48d1d9e3aeb 100644
--- a/qa/suites/smoke/basic/tasks/test/libcephfs_interface_tests.yaml
+++ b/qa/suites/smoke/basic/tasks/test/libcephfs_interface_tests.yaml
@@ -11,6 +11,7 @@ tasks:
 - ceph:
     log-ignorelist:
       - \(POOL_APP_NOT_ENABLED\)
+      - \(FS_DEGRADED\)
 - ceph-fuse:
 - workunit:
     clients:

From daec7e125a167bb8fd0fb9faaa04879f0bb215d2 Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Thu, 18 Jun 2026 07:19:43 +0200
Subject: [PATCH 326/596] ceph-volume: skip internal raid mirror LVs in
 inventory

ceph-volume inventory started including all LVM mapper devices after
c06bee965f1. On hosts with raid mirrored system volumes, that pulls in
hidden legs like var_rmeta_0 which have no /dev/vg/lv node and makes
cephadm's ceph-volume inventory call fail.

Skip those internal LVs in get_devices() and avoid rewriting the device
path to a missing lv_path in Device._parse().

Fixces: https://tracker.ceph.com/issues/77486

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 .../ceph_volume/tests/util/test_device.py     | 22 ++++++
 .../ceph_volume/tests/util/test_disk.py       | 72 +++++++++++++++++++
 src/ceph-volume/ceph_volume/util/device.py    |  8 ++-
 src/ceph-volume/ceph_volume/util/disk.py      | 47 +++++++++---
 4 files changed, 136 insertions(+), 13 deletions(-)

diff --git a/src/ceph-volume/ceph_volume/tests/util/test_device.py b/src/ceph-volume/ceph_volume/tests/util/test_device.py
index ea7d97e1634..77007749b82 100644
--- a/src/ceph-volume/ceph_volume/tests/util/test_device.py
+++ b/src/ceph-volume/ceph_volume/tests/util/test_device.py
@@ -313,11 +313,13 @@ class TestDevice(object):
         assert not disk.available
 
     @patch("ceph_volume.util.disk.has_bluestore_label", lambda x: False)
+    @patch('ceph_volume.util.device.disk.path_is_block_device', return_value=True)
     @patch('ceph_volume.util.device.os.path.realpath')
     @patch('ceph_volume.util.device.os.path.islink')
     def test_reject_lv_symlink_to_device(self,
                                          m_os_path_islink,
                                          m_os_path_realpath,
+                                         m_path_is_block_device,
                                          device_info,
                                          fake_call):
         m_os_path_islink.return_value = True
@@ -327,6 +329,26 @@ class TestDevice(object):
         device_info(lv=lv,lsblk=lsblk)
         disk = device.Device("/dev/vg/lv")
         assert disk.path == '/dev/vg/lv'
+        m_path_is_block_device.assert_called_with('/dev/vg/lv')
+
+    @patch("ceph_volume.util.disk.has_bluestore_label", lambda x: False)
+    @patch('ceph_volume.util.device.disk.path_is_block_device', return_value=False)
+    @patch('ceph_volume.util.device.os.path.realpath')
+    @patch('ceph_volume.util.device.os.path.islink')
+    def test_lv_keeps_mapper_path_when_lv_path_missing(self,
+                                                       m_os_path_islink,
+                                                       m_os_path_realpath,
+                                                       m_path_is_block_device,
+                                                       device_info,
+                                                       fake_call):
+        m_os_path_islink.return_value = False
+        m_os_path_realpath.return_value = '/dev/mapper/vg-var_rmeta_0'
+        lv = {"lv_path": "/dev/vg/var_rmeta_0", "vg_name": "vg", "name": "var_rmeta_0", "tags": {}}
+        lsblk = {"TYPE": "lvm", "NAME": "vg-var_rmeta_0"}
+        device_info(lv=lv, lsblk=lsblk)
+        disk = device.Device("/dev/mapper/vg-var_rmeta_0")
+        assert disk.path == '/dev/mapper/vg-var_rmeta_0'
+        m_path_is_block_device.assert_called_with('/dev/vg/var_rmeta_0')
 
     @patch("ceph_volume.util.disk.has_bluestore_label", lambda x: False)
     def test_reject_smaller_than_5gb(self, fake_call, device_info):
diff --git a/src/ceph-volume/ceph_volume/tests/util/test_disk.py b/src/ceph-volume/ceph_volume/tests/util/test_disk.py
index b5e7450c417..d081e378ad5 100644
--- a/src/ceph-volume/ceph_volume/tests/util/test_disk.py
+++ b/src/ceph-volume/ceph_volume/tests/util/test_disk.py
@@ -428,8 +428,10 @@ class TestGetDevices(object):
         fake_filesystem.create_file('/sys/block/dm-0/size', contents='204800')
         fake_filesystem.create_file('/sys/block/dm-0/queue/rotational', contents='1')
         fake_filesystem.create_file('/sys/block/dm-0/queue/hw_sector_size', contents='512')
+        fake_filesystem.create_file(lv_path, st_mode=(stat.S_IFBLK | 0o600))
         with patch("ceph_volume.util.disk.UdevData") as MockUdevData:
             mock_instance = MagicMock()
+            mock_instance.is_internal_lv = False
             mock_instance.preferred_block_path = lv_path
             mock_instance.environment = {}
             MockUdevData.return_value = mock_instance
@@ -438,6 +440,46 @@ class TestGetDevices(object):
         assert result[lv_path]['type'] == 'lvm'
         assert result[lv_path]['human_readable_size'] == '100.00 MB'
 
+    def test_internal_raid_lv_is_excluded(self, patched_get_block_devs_sysfs, fake_filesystem):
+        mapper_path = '/dev/mapper/debian-var_rmeta_0'
+        dm_path = '/dev/dm-5'
+        patched_get_block_devs_sysfs.return_value = [
+            [dm_path, mapper_path, 'lvm', dm_path]
+        ]
+        fake_filesystem.create_dir('/sys/block/dm-5/slaves')
+        fake_filesystem.create_dir('/sys/block/dm-5/queue')
+        fake_filesystem.create_file('/sys/block/dm-5/size', contents='8192')
+        fake_filesystem.create_file('/sys/block/dm-5/queue/rotational', contents='1')
+        fake_filesystem.create_file('/sys/block/dm-5/queue/hw_sector_size', contents='512')
+        with patch("ceph_volume.util.disk.UdevData") as MockUdevData:
+            mock_instance = MagicMock()
+            mock_instance.is_internal_lv = True
+            MockUdevData.return_value = mock_instance
+            result = disk.get_devices()
+        assert mapper_path not in result
+        assert not result
+
+    def test_lvm_device_without_accessible_node_is_excluded(
+        self, patched_get_block_devs_sysfs, fake_filesystem
+    ):
+        mapper_path = '/dev/mapper/debian-var_rmeta_0'
+        dm_path = '/dev/dm-5'
+        patched_get_block_devs_sysfs.return_value = [
+            [dm_path, mapper_path, 'lvm', dm_path]
+        ]
+        fake_filesystem.create_dir('/sys/block/dm-5/slaves')
+        fake_filesystem.create_dir('/sys/block/dm-5/queue')
+        fake_filesystem.create_file('/sys/block/dm-5/size', contents='8192')
+        fake_filesystem.create_file('/sys/block/dm-5/queue/rotational', contents='1')
+        fake_filesystem.create_file('/sys/block/dm-5/queue/hw_sector_size', contents='512')
+        with patch("ceph_volume.util.disk.UdevData") as MockUdevData:
+            mock_instance = MagicMock()
+            mock_instance.is_internal_lv = False
+            mock_instance.preferred_block_path = '/dev/debian/var_rmeta_0'
+            MockUdevData.return_value = mock_instance
+            result = disk.get_devices()
+        assert not result
+
     def test_nvme_reads_vendor_model_rev_under_controller(
         self, patched_get_block_devs_sysfs, fake_filesystem
     ):
@@ -1047,6 +1089,36 @@ V:1"""
     def test_dashed_path_with_lvm(self) -> None:
         assert disk.UdevData(self.fake_device).dashed_path == '/dev/mapper/fake_vg1-fake-lv1'
 
+    @patch('ceph_volume.util.disk.os.stat', _udev_data_patched_os_stat)
+    @patch('ceph_volume.util.disk.os.minor', Mock(return_value=1))
+    @patch('ceph_volume.util.disk.os.major', Mock(return_value=998))
+    def test_is_internal_lv_true_for_raid_metadata(self) -> None:
+        udev = disk.UdevData(self.fake_device)
+        udev.environment['DM_LV_NAME'] = 'var_rmeta_0'
+        assert udev.is_internal_lv
+
+    @patch('ceph_volume.util.disk.os.stat', _udev_data_patched_os_stat)
+    @patch('ceph_volume.util.disk.os.minor', Mock(return_value=1))
+    @patch('ceph_volume.util.disk.os.major', Mock(return_value=998))
+    def test_is_internal_lv_true_for_raid_image(self) -> None:
+        udev = disk.UdevData(self.fake_device)
+        udev.environment['DM_LV_NAME'] = 'var_rimage_1'
+        assert udev.is_internal_lv
+
+    @patch('ceph_volume.util.disk.os.stat', _udev_data_patched_os_stat)
+    @patch('ceph_volume.util.disk.os.minor', Mock(return_value=1))
+    @patch('ceph_volume.util.disk.os.major', Mock(return_value=998))
+    def test_is_internal_lv_true_for_layered_lv(self) -> None:
+        udev = disk.UdevData(self.fake_device)
+        udev.environment['DM_LV_LAYER'] = 'var'
+        assert udev.is_internal_lv
+
+    @patch('ceph_volume.util.disk.os.stat', _udev_data_patched_os_stat)
+    @patch('ceph_volume.util.disk.os.minor', Mock(return_value=1))
+    @patch('ceph_volume.util.disk.os.major', Mock(return_value=998))
+    def test_is_internal_lv_false_for_public_lv(self) -> None:
+        assert not disk.UdevData(self.fake_device).is_internal_lv
+
     @patch('ceph_volume.util.disk.os.stat', _udev_data_patched_os_stat)
     @patch('ceph_volume.util.disk.os.minor', Mock(return_value=1))
     @patch('ceph_volume.util.disk.os.major', Mock(return_value=998))
diff --git a/src/ceph-volume/ceph_volume/util/device.py b/src/ceph-volume/ceph_volume/util/device.py
index c5b35e48598..5082c6aee28 100644
--- a/src/ceph-volume/ceph_volume/util/device.py
+++ b/src/ceph-volume/ceph_volume/util/device.py
@@ -236,7 +236,8 @@ class Device(object):
         if lv:
             self.lv_api = lv
             self.lvs = [lv]
-            self.path = lv.lv_path
+            if disk.path_is_block_device(lv.lv_path):
+                self.path = lv.lv_path
             self.vg_name = lv.vg_name
             self.lv_name = lv.name
             self.ceph_device_lvm = lvm.is_ceph_device(lv)
@@ -319,7 +320,10 @@ class Device(object):
         src/common/blkdev.cc
         """
 
-        udev_data = disk.UdevData(self.path)
+        try:
+            udev_data = disk.UdevData(self.path)
+        except RuntimeError:
+            return ''
         env = udev_data.environment
         parts: list[str] = []
         model = env.get('ID_MODEL', '')
diff --git a/src/ceph-volume/ceph_volume/util/disk.py b/src/ceph-volume/ceph_volume/util/disk.py
index 70ece5b49dc..1c4b44f53de 100644
--- a/src/ceph-volume/ceph_volume/util/disk.py
+++ b/src/ceph-volume/ceph_volume/util/disk.py
@@ -175,6 +175,14 @@ def _stat_is_device(stat_obj):
     return stat.S_ISBLK(stat_obj)
 
 
+def path_is_block_device(path: str) -> bool:
+    """True if ``path`` exists and is a block device (follows symlinks)."""
+    try:
+        return _stat_is_device(os.stat(path).st_mode)
+    except OSError:
+        return False
+
+
 def _lsblk_parser(line):
     """
     Parses lines in lsblk output. Requires output to be in pair mode (``-P`` flag). Lines
@@ -921,7 +929,22 @@ def get_devices(_sys_block_path='/sys/block', device=''):
     for block in block_devs:
         metadata: Dict[str, Any] = {}
         if block[2] == 'lvm':
-            block[1] = UdevData(block[1]).preferred_block_path
+            try:
+                udev_data = UdevData(block[1])
+            except RuntimeError as exc:
+                logger.debug(
+                    'get_devices(): skipping LVM device %s: %s', block[1], exc)
+                continue
+            if udev_data.is_internal_lv:
+                logger.debug(
+                    'get_devices(): skipping internal LVM LV %s', block[1])
+                continue
+            block[1] = udev_data.preferred_block_path
+            if not path_is_block_device(block[1]):
+                logger.debug(
+                    'get_devices(): skipping LVM device without accessible node %s',
+                    block[1])
+                continue
         devname = os.path.basename(block[0])
         diskname = block[1]
         if block[2] not in block_types:
@@ -1546,6 +1569,16 @@ class UdevData:
         """
         return self.environment.get('DM_UUID', '').startswith('LVM')
 
+    @property
+    def is_internal_lv(self) -> bool:
+        lv_name = self.environment.get('DM_LV_NAME', '')
+        if not lv_name:
+            return False
+        for marker in ('_rmeta_', '_rimage_', '_rtmeta_', '_rtimage_'):
+            if marker in lv_name:
+                return True
+        return bool(self.environment.get('DM_LV_LAYER', ''))
+
     @property
     def slashed_path(self) -> str:
         """Get the LVM path structured with slashes.
@@ -1575,14 +1608,6 @@ class UdevData:
             result = f'/dev/mapper/{name}'
         return result
 
-    @staticmethod
-    def _path_is_block_device(path: str) -> bool:
-        """True if ``path`` exists and is a block device (follows symlinks)."""
-        try:
-            return _stat_is_device(os.stat(path).st_mode)
-        except OSError:
-            return False
-
     @property
     def preferred_block_path(self) -> str:
         """Return a device path that exists for typical open(2) / blkid usage.
@@ -1598,9 +1623,9 @@ class UdevData:
         if not self.is_lvm:
             return self.path
         slashed: str = self.slashed_path
-        if self._path_is_block_device(slashed):
+        if path_is_block_device(slashed):
             return slashed
         dashed: str = self.dashed_path
-        if self._path_is_block_device(dashed):
+        if path_is_block_device(dashed):
             return dashed
         return self.path

From 8ac962c698df959da1866d41b04d69c806bb72c0 Mon Sep 17 00:00:00 2001
From: Kefu Chai <tchaikov@gmail.com>
Date: Sun, 17 Mar 2024 18:42:44 +0800
Subject: [PATCH 327/596] script/run-make: enable ASan

when performing tests, we should enable sanitizers for detecting
potential issues. so, in this change, we enable ASsan, TSan and
UBSan.

script/run-make.sh is used by our CI job for testing PRs, so
enabling these sanitizers helps us to identify issues as early as
possible. because ASan cannot be used along with TSan, we prefer
using ASan for capturing memory related issue in favor of
detecting the multi-threading issues.

also, because of https://bugs.llvm.org/show_bug.cgi?id=23272, we
cannot enable multiple sanitizers. but we should enable UBSan as well,
once we can use a higher version of Clang than Clang-14. with
Clang-14, when enabling UBSan, we'd have following FTBFS
```
error: Cannot represent a difference across sections
```
when compiling `src/tools/neorados.cc`

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
---
 src/script/run-make.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/script/run-make.sh b/src/script/run-make.sh
index 30ca35ce274..e990a827de5 100755
--- a/src/script/run-make.sh
+++ b/src/script/run-make.sh
@@ -143,6 +143,7 @@ EOM
     local cxx_compiler="${discovered_cxx_compiler}"
     local c_compiler="${discovered_c_compiler}"
     local cmake_opts
+    cmake_opts+=" -DWITH_ASAN=ON"
     cmake_opts+=" -DCMAKE_CXX_COMPILER=$cxx_compiler -DCMAKE_C_COMPILER=$c_compiler"
     cmake_opts+=" -DENABLE_GIT_VERSION=OFF"
     cmake_opts+=" -DWITH_GTEST_PARALLEL=ON"

From 9df2719e63eed89781c0ab73db9cdfa8b320da22 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Fri, 19 Jun 2026 19:20:09 +0800
Subject: [PATCH 328/596] rocksdb: update submodule to fix FTBFS due to missing
 <cstdint>

59afb3d6 bumped rocksdb submodule in hope to address the FTBFS failure
when building rocksdb with GCC 16, but the tree still failed to build:

```
In file included from /ceph/src/rocksdb/include/rocksdb/trace_record_result.h:14,
                 from /ceph/src/rocksdb/trace_replay/trace_record_result.cc:6:
/ceph/src/rocksdb/include/rocksdb/trace_record.h:55:32: error: expected ')' before 'timestamp'
   55 |   explicit TraceRecord(uint64_t timestamp);
      |                       ~        ^~~~~~~~~~
      |                                )
/ceph/src/rocksdb/include/rocksdb/trace_record.h:63:11: error: 'uint64_t' does not name a type
   63 |   virtual uint64_t GetTimestamp() const;
      |           ^~~~~~~~
/ceph/src/rocksdb/include/rocksdb/trace_record.h:1:1: note: 'uint64_t' is defined in header '<cstdint>'; this is probably fixable by adding '#include <cstdint>'
```

in this change, we cherry-pick upstream fix to address this build
failure.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/rocksdb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rocksdb b/src/rocksdb
index af6e913d159..c7a7c6340c5 160000
--- a/src/rocksdb
+++ b/src/rocksdb
@@ -1 +1 @@
-Subproject commit af6e913d15956f15ab888d1d0eb13120f462acba
+Subproject commit c7a7c6340c522d2ecc21625e2b726554cb61eb72

From 2aabf864f3140c92cbdb4ef0606cc6f6dec59134 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 19 Jun 2026 03:06:06 +0800
Subject: [PATCH 329/596] mgr/tox: run pytest in parallel

The py3 and coverage tox environments run the full mgr pytest suite
serially, which makes run-tox-mgr the longest test in CI. Add
pytest-xdist and pass `-n auto` to both so the suite is distributed
across the available CPUs.

pytest-xdist is constrained to <2 to stay compatible with the pinned
pytest-cov. Running in parallel also surfaced a hard-coded port in
cephadm's test_node_proxy, which now allocates an ephemeral port per
process.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/pybind/mgr/cephadm/tests/test_node_proxy.py | 12 +++++++++++-
 src/pybind/mgr/requirements.txt                 |  1 +
 src/pybind/mgr/tox.ini                          |  4 ++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/pybind/mgr/cephadm/tests/test_node_proxy.py b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
index dd5f99f508c..75fe7d6fab9 100644
--- a/src/pybind/mgr/cephadm/tests/test_node_proxy.py
+++ b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
@@ -1,5 +1,6 @@
 import cherrypy
 import json
+import socket
 from _pytest.monkeypatch import MonkeyPatch
 from urllib.error import URLError
 from cherrypy.test import helper
@@ -9,7 +10,16 @@ from cephadm.inventory import AgentCache, NodeProxyCache, Inventory
 from cephadm.ssl_cert_utils import SSLCerts
 from . import node_proxy_data
 
-PORT = 58585
+
+def _free_port() -> int:
+    # Pick an ephemeral port so the test server does not clash with other
+    # pytest-xdist workers running this module in parallel.
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(('127.0.0.1', 0))
+        return s.getsockname()[1]
+
+
+PORT = _free_port()
 fake_cert = """-----BEGIN CERTIFICATE-----\nMIICxjCCAa4CEQDIZSujNBlKaLJzmvntjukjMA0GCSqGSIb3DQEBDQUAMCExDTAL\nBgNVBAoMBENlcGgxEDAOBgNVBAMMB2NlcGhhZG0wHhcNMjIwNzEzMTE0NzA3WhcN\nMzIwNzEwMTE0NzA3WjAhMQ0wCwYDVQQKDARDZXBoMRAwDgYDVQQDDAdjZXBoYWRt\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyyMe4DMA+MeYK7BHZMHB\nq7zjliEOcNgxomjU8qbf5USF7Mqrf6+/87XWqj4pCyAW8x0WXEr6A56a+cmBVmt+\nqtWDzl020aoId6lL5EgLLn6/kMDCCJLq++Lg9cEofMSvcZh+lY2f+1p+C+00xent\nrLXvXGOilAZWaQfojT2BpRnNWWIFbpFwlcKrlg2G0cFjV5c1m6a0wpsQ9JHOieq0\nSvwCixajwq3CwAYuuiU1wjI4oJO4Io1+g8yB3nH2Mo/25SApCxMXuXh4kHLQr/T4\n4hqisvG4uJYgKMcSIrWj5o25mclByGi1UI/kZkCUES94i7Z/3ihx4Bad0AMs/9tw\nFwIDAQABMA0GCSqGSIb3DQEBDQUAA4IBAQAf+pwz7Gd7mDwU2LY0TQXsK6/8KGzh\nHuX+ErOb8h5cOAbvCnHjyJFWf6gCITG98k9nxU9NToG0WYuNm/max1y/54f0dtxZ\npUo6KSNl3w6iYCfGOeUIj8isi06xMmeTgMNzv8DYhDt+P2igN6LenqWTVztogkiV\nxQ5ZJFFLEw4sN0CXnrZX3t5ruakxLXLTLKeE0I91YJvjClSBGkVJq26wOKQNHMhx\npWxeydQ5EgPZY+Aviz5Dnxe8aB7oSSovpXByzxURSabOuCK21awW5WJCGNpmqhWK\nZzACBDEstccj57c4OGV0eayHJRsluVr2e9NHRINZA3qdB37e6gsI1xHo\n-----END CERTIFICATE-----\n"""
 
 
diff --git a/src/pybind/mgr/requirements.txt b/src/pybind/mgr/requirements.txt
index 044674f9be5..96712691c76 100644
--- a/src/pybind/mgr/requirements.txt
+++ b/src/pybind/mgr/requirements.txt
@@ -3,3 +3,4 @@ asyncssh==2.9
 kubernetes
 urllib3==1.26.15
 pytest==7.4.4
+pytest-xdist <2
diff --git a/src/pybind/mgr/tox.ini b/src/pybind/mgr/tox.ini
index 647b9e45a93..1443659719b 100644
--- a/src/pybind/mgr/tox.ini
+++ b/src/pybind/mgr/tox.ini
@@ -61,7 +61,7 @@ deps =
     -rrequirements.txt
     -rrook/requirements.txt
 commands =
-    pytest --doctest-modules {posargs:}
+    pytest -n auto --doctest-modules {posargs:}
 
 [testenv:nooptional]
 setenv =
@@ -87,7 +87,7 @@ deps =
 #   COVERAGE_REPORT=html tox -e coverage -- <module>
 #   <your-browser> htmlcov/index.html
 commands =
-    pytest --cov={posargs:.} --cov-report={env:COVERAGE_REPORT:term} {posargs:.}
+    pytest -n auto --cov={posargs:.} --cov-report={env:COVERAGE_REPORT:term} {posargs:.}
 
 
 [testenv:{,py37-,py38-,py39-,py310-}mypy]

From 0705c6d60b152bc5e705ddf3b35f5f7dc0a33259 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Fri, 19 Jun 2026 14:38:10 +0800
Subject: [PATCH 330/596] cmake: make GTEST_PARALLEL_COMMAND visible to all
 test directories

GTEST_PARALLEL_COMMAND was set as an ordinary variable inside the
`if(NOT TARGET gtest-parallel_ext)` guard, so it only existed in the
first directory that include()s AddCephTest (src/common/options). Later
includes skip the guarded block and leave it empty, so PARALLEL
unittests under src/test silently ran serially.

Promote it to CACHE INTERNAL so it is visible across all directories
regardless of include order.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 cmake/modules/AddCephTest.cmake | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cmake/modules/AddCephTest.cmake b/cmake/modules/AddCephTest.cmake
index 83f442aec19..49562e569b0 100644
--- a/cmake/modules/AddCephTest.cmake
+++ b/cmake/modules/AddCephTest.cmake
@@ -73,8 +73,11 @@ if(WITH_GTEST_PARALLEL)
       BUILD_COMMAND ""
       INSTALL_COMMAND "")
     add_dependencies(tests gtest-parallel_ext)
+    # CACHE INTERNAL: the set() runs only in the first directory to create the
+    # target, so a plain variable would be invisible to PARALLEL tests elsewhere.
     set(GTEST_PARALLEL_COMMAND
-      ${Python3_EXECUTABLE} ${gtest_parallel_source_dir}/gtest-parallel)
+      ${Python3_EXECUTABLE} ${gtest_parallel_source_dir}/gtest-parallel
+      CACHE INTERNAL "command to run a gtest binary through gtest-parallel")
   endif()
 endif()
 

From 0e0d2c6b2b9135496d0d288b54c68d7308989d6f Mon Sep 17 00:00:00 2001
From: Anthony D'Atri <anthonyeleven@users.noreply.github.com>
Date: Fri, 19 Jun 2026 10:47:15 -0400
Subject: [PATCH 331/596] doc/rados/bluestore: Improve fast-onode-scan.rst

Signed-off-by: Anthony D'Atri <anthonyeleven@users.noreply.github.com>
---
 doc/rados/bluestore/fast-onode-scan.rst | 114 +++++++++++++-----------
 1 file changed, 60 insertions(+), 54 deletions(-)

diff --git a/doc/rados/bluestore/fast-onode-scan.rst b/doc/rados/bluestore/fast-onode-scan.rst
index f82f21aab9d..320491a0e36 100644
--- a/doc/rados/bluestore/fast-onode-scan.rst
+++ b/doc/rados/bluestore/fast-onode-scan.rst
@@ -4,55 +4,59 @@
 
 .. index:: bluestore; rocksdb; allocator
 
-Since Pacific release BlueStore has the option to select 5-10% latency reduction
-at a cost of significantly longer ``OSD`` recovery after crash.
+Beginning with the Pacific release, BlueStore has the option to configure a 5-10% latency reduction
+at a cost of significantly longer ``OSD`` recovery after a crash.
 
 .. confval:: bluestore_allocation_from_file
 
-During crash recovery BlueStore must reconstruct allocator state by scanning all stored objects.
-On systems with millions of objects this process can take several minutes.
-This page presents new multithreaded onode recovery that significantly reduces recovery time.
+During crash recovery BlueStore must reconstruct allocator state by scanning all stored RADOS objects.
+For OSDs storing millions of RADOS objects this process may take several minutes to several hours to complete.
+This page describes multithreaded onode recovery that significantly reduces recovery time.
 
 Allocator
 =========
 
-In BlueStore ``Allocator`` is responsible for tracking unused allocation units on the disk.
-Up to 3 allocators can be in use concurrently, one for Main, one for DB, and one for WAL.
-Only Main device can contain RADOS object, and only Main's allocator is relevant here.
-When BlueStore is running, allocator state is fully loaded to memory. That way
-allocator can quickly respond when there is a need to allocate disk space for object,
-or when object no longer exists on disk.
+In BlueStore, the configured ``Allocator`` is responsible for tracking unused allocation units on the underlying device.
+As many as three allocators may be in use concurrently: one for the main block device, one for the DB, and one for the WAL.
+Only the main device stores RADOS objects, and thus is the only allocator that is relevant here.
+When a BlueStore OSD is running, allocator state is fully loaded in memory. This ensures that the
+allocator can quickly respond when there is a need to allocate space for RADOS objects,
+or when RADOS objects no longer exist and their underlying space should be reclaimed.
 
-RocksDB persisted allocator
+RocksDB-persisted allocator
 ---------------------------
 
-Original design envisioned that allocator state updates are stored in RocksDB's ``b`` column.
-When RADOS object change allocates or releases allocation unit the relevant state update information
-is kept together with object-modifying RocksDB atomic transaction. The information transfer is unidirectional,
-BlueStore is updating allocator state in RocksDB, but never retrieving it.
-The exception is OSD bootup when BlueStore retrieves allocator state from RocksDB ``b`` column.
+The original design envisioned that allocator state updates are stored in RocksDB's ``b`` column.
+When RADOS objects are written or release allocation units, the relevant state information
+is updated with an object-modifying RocksDB atomic transaction. The information transfer is unidirectional:
+BlueStore updates allocator state in RocksDB, but never retrieves it.
+The exception is at OSD boot when BlueStore retrieves allocator state from the RocksDB ``b`` column.
 
-File persisted allocator
+File-persisted allocator
 ------------------------
 
-It was tested that keeping RocksDB busy updating ``b`` column with allocation data
-has observable cost on write latency and cpu burden on compaction.
-To get that extra performance back the new default mode is to update in-memory allocator state only.
-Instead, on shutdown state is saved to BlueFS file named ``ALLOCATOR_NCB_DIR/ALLOCATOR_NCB_FILE``.
+Tests showed that keeping RocksDB busy by updating ``b`` column with allocation data
+has observable cost in terms of write latency and CPU burden when compacting.
+To avoid this performance impact the new default mode is to update allocator state only in-memory.
+Only on shutdown is state saved to a BlueFS file named ``ALLOCATOR_NCB_DIR/ALLOCATOR_NCB_FILE``.
 
 Crash recovery
---------------
+==============
 
-If BlueStore was not shutdown orderly there is no file to read allocator state from.
-Since it is the objects that define what is in use, the recovery procedure iterates over all objects and extracts used allocations.
+If BlueStore was not shut down gracefully there will be no updated file from which to read allocator state.
+Since RADOS objects are then the only only source of truth regarding underlying device usage,
+the recovery procedure must iterate over all RADOS objects in order to determine used vs
+available device blocks.
 
-Multi-thread recovery
-=====================
+Multi-threaded recovery
+=======================
 
-Iterating over all onodes in the RocksDB can take several minutes.
-To help with that a multi-threaded recovery procedure is created.
-It is significantly different procedure than the original one.
-There is just one configurable that selects and controls recovery.
+Iterating over all onodes in the RocksDB can take several minutes on
+a relatively small SSD; for large and slow devices it may take several *hours*.
+To mitigate this significant impact on OSD boot time, a multi-threaded recovery procedure
+has been added for the Vampire release and may be backported to Umbrella and Tentacle.
+This is a significantly different procedure than the original.
+One config option selects and controls this new recovery strategy.
 
 .. confval:: bluestore_allocation_recovery_threads
 
@@ -60,32 +64,34 @@ There is just one configurable that selects and controls recovery.
 Performance
 -----------
 
-Example recovery timings.
-OSD with NVME SSD, hosting 7.5M RBD objects, 4.6TiB used.
+Below are example elapsed recovery timings for an
+OSD on an NVMe SSD hosting 7.5M RBD objects, with 4.6TiB used:
 
-+------------------------+------------+------------+
-| recovery mechanism     | threads    | time(s)    |
-+========================+============+============+
-| original               | 1          | 76.0       |
-+------------------------+------------+------------+
-| multithread            | 1          | 55.8       |
-+------------------------+------------+------------+
-| multithread            | 4          | 18.1       |
-+------------------------+------------+------------+
-| multithread            | 8          | 10.8       |
-+------------------------+------------+------------+
-| multithread            | 12         | 8.0        |
-+------------------------+------------+------------+
-| multithread            | 16         | 6.8        |
-+------------------------+------------+------------+
-| multithread            | 32         | 5.3        |
-+------------------------+------------+------------+
++---------------------+------------+-----------------+
+| Recovery Mechanism  | Threads    | Time in seconds |
++=====================+============+=================+
+| original            | 1          | 76.0            |
++---------------------+------------+-----------------+
+| multi-threaded      | 1          | 55.8            |
++---------------------+------------+-----------------+
+| multi-threaded      | 4          | 18.1            |
++---------------------+------------+-----------------+
+| multi-threaded      | 8          | 10.8            |
++---------------------+------------+-----------------+
+| multi-threaded      | 12         | 8.0             |
++---------------------+------------+-----------------+
+| multi-threaded      | 16         | 6.8             |
++---------------------+------------+-----------------+
+| multit-hreaded      | 32         | 5.3             |
++---------------------+------------+-----------------+
 
 Testing
 -------
 
-If long recovery time has been a deciding factor for staying with allocations in RocksDB,
-there is a procedure for measuring directly recovery time.
+Concern for long recovery time has led some Ceph operators to configure
+legacy synchronous persistance of allocator state in RocksDB.
+There is now a procedure for predicting the legacy recovery time for a given OSD,
+allowing an informed decision:
 
 .. prompt:: bash #
 
@@ -163,6 +169,6 @@ there is a procedure for measuring directly recovery time.
   Allocators the same.
   recovery-compare success
 
-One can see above discrepancy between legacy recovery times: 76.0s vs 62.2s.
-This is an effect of RocksDB having the data already cached by new recovery when legacy recovery is the second one.
+One can see in the above example the improvement in legacy recovery times: 76.0s vs 62.2s.
+The second run shows the effect of RocksDB having the data already cached by the new recovery strategy.
 

From ae6bc8220b7b7a229d32064ea5dc2f3d88badbae Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 7 Jun 2026 02:05:34 +0800
Subject: [PATCH 332/596] test: optionally run test venvs with system
 site-packages

Add a CEPH_PYTHON_SYSTEM_SITE switch (off by default). When set:

  - setup-virtualenv.sh builds its venv with --system-site-packages;
  - run_tox.sh exports VIRTUALENV_SYSTEM_SITE_PACKAGES=true for tox's venvs.

This lets distro packages satisfy test dependencies instead of pip building
them from sdist, which helps where prebuilt wheels are missing (e.g. scipy and
numpy on riscv64) by avoiding a slow rebuild when the RPMs are installed.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/script/run_tox.sh         | 4 ++++
 src/tools/setup-virtualenv.sh | 7 ++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/script/run_tox.sh b/src/script/run_tox.sh
index f2f71a60f29..61fdea28ccf 100755
--- a/src/script/run_tox.sh
+++ b/src/script/run_tox.sh
@@ -125,6 +125,10 @@ function main() {
     export CEPH_BUILD_DIR=$build_dir
     # use the wheelhouse prepared by install-deps.sh
     export PIP_FIND_LINKS="$tox_path/wheelhouse"
+    # CEPH_PYTHON_SYSTEM_SITE (default off): let tox's venvs see system site-packages
+    if ${CEPH_PYTHON_SYSTEM_SITE:-false}; then
+        export VIRTUALENV_SYSTEM_SITE_PACKAGES=true
+    fi
     tox_cmd=(tox -c $tox_path/tox.ini)
     if [ "$tox_envs" != "__tox_defaults__" ]; then
         tox_cmd+=("-e" "$tox_envs")
diff --git a/src/tools/setup-virtualenv.sh b/src/tools/setup-virtualenv.sh
index 152e4859715..5dba693c26e 100755
--- a/src/tools/setup-virtualenv.sh
+++ b/src/tools/setup-virtualenv.sh
@@ -62,7 +62,12 @@ if [ -z "$DIR" ] ; then
 fi
 rm -fr $DIR
 mkdir -p $DIR
-$PYTHON -m venv $DIR
+# CEPH_PYTHON_SYSTEM_SITE (default off): build venv against system site-packages
+VENV_OPTS=
+if ${CEPH_PYTHON_SYSTEM_SITE:-false}; then
+    VENV_OPTS="--system-site-packages"
+fi
+$PYTHON -m venv $VENV_OPTS $DIR
 . $DIR/bin/activate
 
 if pip --help | grep -q disable-pip-version-check; then

From ba5da131ec745f5eab799e9de6b374b1e101d851 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 7 Jun 2026 22:19:08 +0800
Subject: [PATCH 333/596] mypy: skip follow_imports for prettytable

With test venvs on system site-packages, mypy picks up the system
prettytable (3.4.0+, typed). It flags mgr's add_row(tuple) against the
list[Any] signature (src/mypy.ini) and qa's float_format = str against
the dict[str, str] property (qa/mypy.ini). Skip follow_imports in both.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 qa/mypy.ini  | 6 +++++-
 src/mypy.ini | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/qa/mypy.ini b/qa/mypy.ini
index 1215375ed9b..3d88b720b94 100644
--- a/qa/mypy.ini
+++ b/qa/mypy.ini
@@ -1,2 +1,6 @@
 [mypy]
-ignore_missing_imports = True
\ No newline at end of file
+ignore_missing_imports = True
+
+[mypy-prettytable]
+ignore_missing_imports = True
+follow_imports = skip
diff --git a/src/mypy.ini b/src/mypy.ini
index 9fe2f82a535..579644374c5 100755
--- a/src/mypy.ini
+++ b/src/mypy.ini
@@ -36,6 +36,7 @@ ignore_missing_imports = True
 
 [mypy-prettytable]
 ignore_missing_imports = True
+follow_imports = skip
 
 [mypy-jsonpatch]
 ignore_missing_imports = True

From 3652faa3fbc752407d57f74b8c258cbf0d0cd56e Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sat, 20 Jun 2026 13:51:39 +0800
Subject: [PATCH 334/596] test/cmake: drop dead env_vars_for_tox_tests
 set_property

Both `tox_tests` and `env_vars_for_tox_tests` have been undefined since
f0079a1030b, so this expands to `set_property(TEST PROPERTY ENVIRONMENT)`
-- a no-op. The actual per-test environment for tox tests is set in
add_tox_test() (cmake/modules/AddCephTest.cmake). Remove the leftover.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/CMakeLists.txt | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/test/CMakeLists.txt b/src/test/CMakeLists.txt
index ecba4a139bc..caba0b1f236 100644
--- a/src/test/CMakeLists.txt
+++ b/src/test/CMakeLists.txt
@@ -684,10 +684,6 @@ add_ceph_test(run-cli-tests ${CMAKE_CURRENT_SOURCE_DIR}/run-cli-tests)
 
 add_ceph_test(smoke.sh ${CMAKE_CURRENT_SOURCE_DIR}/smoke.sh)
 
-set_property(
-  TEST ${tox_tests}
-  PROPERTY ENVIRONMENT ${env_vars_for_tox_tests})
-
 # unittest_admin_socket
 add_executable(unittest_admin_socket
   admin_socket.cc

From 5d82294f3f5b6204f2fe601f1e2349d806854d9e Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sat, 20 Jun 2026 10:53:51 +0800
Subject: [PATCH 335/596] cmake/boost: load context Jamfile before passing
 context-impl to b2

With WITH_ASAN, b2 runs as `b2 context-impl=ucontext headers stage` for the
build step and `b2 context-impl=ucontext install` for the install step. The
`context-impl` feature is declared in libs/context/build/Jamfile.v2, which
neither the headers/stage nor the install targets load, so b2 aborts with:

    error: unknown feature "<context-impl>"

Name the context project as a target in both commands so its Jamfile (and the
feature) loads before the build request is expanded.

This works around https://github.com/boostorg/context/issues/297, fixed
upstream in
https://github.com/boostorg/context/commit/12ac945158ae3c2373ec0c888899373218aa209f
and first released in Boost 1.88; drop it once the bundled Boost is bumped to
1.88 or newer.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 cmake/modules/BuildBoost.cmake | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/cmake/modules/BuildBoost.cmake b/cmake/modules/BuildBoost.cmake
index 4b80296f9df..d47e1eeb471 100644
--- a/cmake/modules/BuildBoost.cmake
+++ b/cmake/modules/BuildBoost.cmake
@@ -144,15 +144,23 @@ function(do_build_boost root_dir version)
   if(WITH_BOOST_VALGRIND)
     list(APPEND b2 valgrind=on)
   endif()
+  set(b2_targets headers stage)
+  set(b2_install_targets install)
   if(WITH_ASAN)
     list(APPEND b2 context-impl=ucontext)
+    # `context-impl` is declared in libs/context/build/Jamfile.v2; the headers/stage
+    # and install targets never load it, so b2 aborts with `unknown feature
+    # "<context-impl>"`. Name the context project as a target so its Jamfile loads
+    # the feature first.
+    list(PREPEND b2_targets libs/context/build)
+    list(PREPEND b2_install_targets libs/context/build)
   endif()
   set(build_command
-    ${b2} headers stage
+    ${b2} ${b2_targets}
     #"--buildid=ceph" # changes lib names--can omit for static
     ${boost_features})
   set(install_command
-    ${b2} install)
+    ${b2} ${b2_install_targets})
   if(EXISTS "${PROJECT_SOURCE_DIR}/src/boost/bootstrap.sh")
     check_boost_version("${PROJECT_SOURCE_DIR}/src/boost" ${version})
     set(source_dir

From a764ecf720c536cec35095872e1db41b363104a3 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sat, 20 Jun 2026 23:21:01 +0800
Subject: [PATCH 336/596] monitoring/ceph-mixin: make jsonnet-bundler clone
 idempotent

A run that aborts before the cleanup fixture runs (timeout, OOM,
interrupt) leaves the clone dir behind, so the next build fails with
"destination path already exists". Remove it first.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 monitoring/ceph-mixin/jsonnet-bundler-build.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/monitoring/ceph-mixin/jsonnet-bundler-build.sh b/monitoring/ceph-mixin/jsonnet-bundler-build.sh
index 463658f186b..bb5b323500c 100755
--- a/monitoring/ceph-mixin/jsonnet-bundler-build.sh
+++ b/monitoring/ceph-mixin/jsonnet-bundler-build.sh
@@ -3,6 +3,8 @@
 JSONNET_VERSION="v0.6.0"
 OUTPUT_DIR=${1:-$(pwd)}
 
+# clean up leftovers from an aborted run so the clone stays idempotent
+rm -rf jsonnet-bundler
 git clone -b ${JSONNET_VERSION} --depth 1 https://github.com/jsonnet-bundler/jsonnet-bundler
 make -C jsonnet-bundler  build
 mv jsonnet-bundler/_output/jb ${OUTPUT_DIR}

From b11c0eaedc3c9108bab9c85b72d4fcc074c8e1d5 Mon Sep 17 00:00:00 2001
From: Dax Kelson <daxkelson@gmail.com>
Date: Sat, 20 Jun 2026 13:18:19 -0600
Subject: [PATCH 337/596] msg/async/rdma: don't abort on an invalid
 per-connection eventfd

The async RDMA messenger reports each connection's per-connection eventfd
(notify_fd) as its socket fd().  notify_fd can legitimately be -1 -- under
fd-table pressure eventfd() returns -1, and the base RDMAConnectedSocketImpl
constructor skips queue pair *and* eventfd creation entirely when
ms_async_rdma_cm=true (the cm path is only implemented by the iwarp socket
classes).  Either way an fd() == -1 socket reaches the success path of
Processor::accept and trips ceph_assert(socket.fd() >= 0) in
AsyncConnection::accept, or is fed to EventCenter::create_file_event() and
indexes file_events[-1] out of bounds.  Both abort the OSD under connection
load.

Make the messenger surface the failure instead of handing back a broken
socket:

- Initialize RDMAConnectedSocketImpl::qp to nullptr.  It was uninitialized and
  read via get_qp() when ms_async_rdma_cm=true skips its assignment.

- Create the notify eventfd before the queue pair in the base constructor, and
  adopt the cm id/channel before the eventfd in the iwarp constructor, so a
  failure leaks nothing and the two failure causes stay distinguishable.  Check
  the rdma_create_event_channel()/rdma_create_id() return values on the touched
  paths, and destroy the per-request cm id on the accept error paths (acking the
  event does not free it).

- At each accept/connect construction site, reject a socket with fd() < 0
  (-EMFILE) or a null queue pair (-EIO) instead of returning it.  Free the
  half-built socket on its owning worker thread via center.submit_to() so
  ~RDMAConnectedSocketImpl's center.in_thread() assertion holds and no RDMA/fd
  state leaks (this also fixes the pre-existing leak on the rdma_accept()
  failure path).

- Require ms_async_rdma_cm and ms_async_rdma_type=iwarp to be enabled together
  in RDMAWorker::listen()/connect() (-EOPNOTSUPP with a clear message).  The
  two are coupled -- only the iwarp classes implement rdma_cm and they always
  use it -- so any mismatch leaves a socket half-built and would otherwise
  crash-loop the daemon.

- Guard EventCenter::create_file_event() against a negative fd as defense in
  depth.

Fixes: https://tracker.ceph.com/issues/77547

Signed-off-by: Dax Kelson <daxkelson@gmail.com>
---
 src/msg/async/Event.cc                        |  1 +
 src/msg/async/rdma/RDMAConnectedSocketImpl.cc | 14 +++++-
 .../rdma/RDMAIWARPConnectedSocketImpl.cc      | 38 +++++++++++++---
 .../async/rdma/RDMAIWARPServerSocketImpl.cc   | 31 ++++++++++++-
 src/msg/async/rdma/RDMAServerSocketImpl.cc    | 20 ++++++---
 src/msg/async/rdma/RDMAStack.cc               | 43 ++++++++++++++++++-
 src/msg/async/rdma/RDMAStack.h                |  2 +-
 7 files changed, 131 insertions(+), 18 deletions(-)

diff --git a/src/msg/async/Event.cc b/src/msg/async/Event.cc
index 7399494a93f..567bb9e0ea0 100644
--- a/src/msg/async/Event.cc
+++ b/src/msg/async/Event.cc
@@ -253,6 +253,7 @@ void EventCenter::set_owner()
 int EventCenter::create_file_event(int fd, int mask, EventCallbackRef ctxt)
 {
   ceph_assert(in_thread());
+  ceph_assert(fd >= 0);
   int r = 0;
   if (fd >= nevent) {
     int new_size = nevent << 2;
diff --git a/src/msg/async/rdma/RDMAConnectedSocketImpl.cc b/src/msg/async/rdma/RDMAConnectedSocketImpl.cc
index d5ebf8ae2cc..6bbd672968e 100644
--- a/src/msg/async/rdma/RDMAConnectedSocketImpl.cc
+++ b/src/msg/async/rdma/RDMAConnectedSocketImpl.cc
@@ -58,13 +58,22 @@ RDMAConnectedSocketImpl::RDMAConnectedSocketImpl(CephContext *cct, std::shared_p
     active(false), pending(false)
 {
   if (!cct->_conf->ms_async_rdma_cm) {
+    // Create the per-connection notify eventfd before the queue pair.  Under fd
+    // pressure eventfd() can fail (-1); doing it first means a failure leaves no
+    // queue pair to leak.  The two failure states are kept distinct on purpose so
+    // the accept/connect paths can return an honest errno: eventfd failure ->
+    // fd() < 0 && qp == nullptr; queue pair failure -> fd() >= 0 && qp == nullptr.
+    notify_fd = eventfd(0, EFD_CLOEXEC|EFD_NONBLOCK);
+    if (notify_fd < 0) {
+      lderr(cct) << __func__ << " failed to create eventfd: " << cpp_strerror(errno) << dendl;
+      return;
+    }
     qp = ib->create_queue_pair(cct, dispatcher->get_tx_cq(), dispatcher->get_rx_cq(), IBV_QPT_RC, NULL);
     if (!qp) {
       lderr(cct) << __func__ << " queue pair create failed" << dendl;
       return;
     }
     local_qpn = qp->get_local_qp_number();
-    notify_fd = eventfd(0, EFD_CLOEXEC|EFD_NONBLOCK);
     dispatcher->register_qp(qp, this);
     dispatcher->perf_logger->inc(l_msgr_rdma_created_queue_pair);
     dispatcher->perf_logger->inc(l_msgr_rdma_active_queue_pair);
@@ -76,7 +85,8 @@ RDMAConnectedSocketImpl::~RDMAConnectedSocketImpl()
   ldout(cct, 20) << __func__ << " destruct." << dendl;
   cleanup();
   worker->remove_pending_conn(this);
-  dispatcher->schedule_qp_destroy(local_qpn);
+  if (qp)  // null on construction-failure paths; local_qpn 0 is unregistered
+    dispatcher->schedule_qp_destroy(local_qpn);
 
   for (unsigned i=0; i < wc.size(); ++i) {
     dispatcher->post_chunk_to_pool(reinterpret_cast<Chunk*>(wc[i].wr_id));
diff --git a/src/msg/async/rdma/RDMAIWARPConnectedSocketImpl.cc b/src/msg/async/rdma/RDMAIWARPConnectedSocketImpl.cc
index 606dbd2817c..1844f695c88 100644
--- a/src/msg/async/rdma/RDMAIWARPConnectedSocketImpl.cc
+++ b/src/msg/async/rdma/RDMAIWARPConnectedSocketImpl.cc
@@ -13,13 +13,43 @@ RDMAIWARPConnectedSocketImpl::RDMAIWARPConnectedSocketImpl(CephContext *cct, std
   : RDMAConnectedSocketImpl(cct, ib, rdma_dispatcher, w), cm_con_handler(new C_handle_cm_connection(this))
 {
   status = IDLE;
-  notify_fd = eventfd(0, EFD_CLOEXEC|EFD_NONBLOCK);
+  // Take ownership of the CM id/channel *before* creating the notify eventfd, so
+  // that if eventfd() fails (e.g. under fd exhaustion) the destructor still frees
+  // them (it only does so for status >= RDMA_ID_CREATED).  Every failure path
+  // calls close_notify() so a later delete cannot block on close_condition.
   if (info) {
     is_server = true;
     cm_id = info->cm_id;
     cm_channel = info->cm_channel;
     status = RDMA_ID_CREATED;
     peer_qpn = info->qp_num;
+  } else {
+    is_server = false;
+    cm_channel = rdma_create_event_channel();
+    if (!cm_channel) {
+      lderr(cct) << __func__ << " failed to create cm event channel: " << cpp_strerror(errno) << dendl;
+      close_notify();
+      return;
+    }
+    if (rdma_create_id(cm_channel, &cm_id, NULL, RDMA_PS_TCP)) {
+      lderr(cct) << __func__ << " failed to create cm id: " << cpp_strerror(errno) << dendl;
+      rdma_destroy_event_channel(cm_channel);
+      cm_channel = nullptr;
+      close_notify();
+      return;
+    }
+    status = RDMA_ID_CREATED;
+    ldout(cct, 20) << __func__ << " successfully created cm id: " << cm_id << dendl;
+  }
+
+  notify_fd = eventfd(0, EFD_CLOEXEC|EFD_NONBLOCK);
+  if (notify_fd < 0) {
+    lderr(cct) << __func__ << " failed to create eventfd: " << cpp_strerror(errno) << dendl;
+    close_notify();
+    return;
+  }
+
+  if (info) {
     if (alloc_resource()) {
       close_notify();
       return;
@@ -31,12 +61,6 @@ RDMAIWARPConnectedSocketImpl::RDMAIWARPConnectedSocketImpl(CephContext *cct, std
     status = RESOURCE_ALLOCATED;
     qp->get_local_cm_meta().peer_qpn = peer_qpn;
     qp->get_peer_cm_meta().local_qpn = peer_qpn;
-  } else {
-    is_server = false;
-    cm_channel = rdma_create_event_channel();
-    rdma_create_id(cm_channel, &cm_id, NULL, RDMA_PS_TCP);
-    status = RDMA_ID_CREATED;
-    ldout(cct, 20) << __func__ << " successfully created cm id: " << cm_id << dendl;
   }
 }
 
diff --git a/src/msg/async/rdma/RDMAIWARPServerSocketImpl.cc b/src/msg/async/rdma/RDMAIWARPServerSocketImpl.cc
index 0500b4420f9..f5c3479b1de 100644
--- a/src/msg/async/rdma/RDMAIWARPServerSocketImpl.cc
+++ b/src/msg/async/rdma/RDMAIWARPServerSocketImpl.cc
@@ -71,13 +71,25 @@ int RDMAIWARPServerSocketImpl::accept(ConnectedSocket *sock, const SocketOptions
   rdma_get_cm_event(cm_channel, &cm_event);
   ldout(cct, 20) << __func__ << " event name: " << rdma_event_str(cm_event->event) << dendl;
 
+  // rdma_get_cm_event() handed us a new cm id for the incoming connection; on any
+  // error path before it is adopted into a socket (whose destructor would free it)
+  // we must rdma_destroy_id() it ourselves -- acking the event does not.  The event
+  // must be acked *before* destroying the id: rdma_destroy_id() blocks until the
+  // connect-request event for that id has been acknowledged.
   struct rdma_cm_id *event_cm_id = cm_event->id;
   struct rdma_event_channel *event_channel = rdma_create_event_channel();
+  if (!event_channel) {
+    lderr(cct) << __func__ << " failed to create event channel: " << cpp_strerror(errno) << dendl;
+    rdma_ack_cm_event(cm_event);
+    rdma_destroy_id(event_cm_id);
+    return -EMFILE;
+  }
 
   if (net.set_nonblock(event_channel->fd) < 0) {
       lderr(cct) << __func__ << " failed to switch event channel to non-block, close event channel " << dendl;
       rdma_destroy_event_channel(event_channel);
       rdma_ack_cm_event(cm_event);
+      rdma_destroy_id(event_cm_id);
       return -errno;
   }
 
@@ -86,15 +98,32 @@ int RDMAIWARPServerSocketImpl::accept(ConnectedSocket *sock, const SocketOptions
   struct rdma_conn_param *remote_conn_param = &cm_event->param.conn;
   struct rdma_conn_param local_conn_param;
 
+  RDMAWorker *rw = dynamic_cast<RDMAWorker*>(w);
   RDMACMInfo info(event_cm_id, event_channel, remote_conn_param->qp_num);
   RDMAIWARPConnectedSocketImpl* server =
-    new RDMAIWARPConnectedSocketImpl(cct, ib, dispatcher, dynamic_cast<RDMAWorker*>(w), &info);
+    new RDMAIWARPConnectedSocketImpl(cct, ib, dispatcher, rw, &info);
+
+  // Construction can fail under fd pressure (eventfd) or on queue pair creation;
+  // such a socket must not reach the messenger (its fd() is -1).  Free it on its
+  // owning worker thread (close() marks it closed so ~IWARP won't block and frees
+  // the adopted cm id/channel) and return an honest errno (fd-first).
+  if (server->fd() < 0 || !server->get_qp()) {
+    int err = server->fd() < 0 ? -EMFILE : -EIO;
+    lderr(cct) << __func__ << " failed to create connected socket: "
+               << cpp_strerror(err) << dendl;
+    rdma_ack_cm_event(cm_event);
+    rw->center.submit_to(rw->center.get_id(), [server]() { server->close(); delete server; }, false);
+    return err;
+  }
 
   // FIPS zeroization audit 20191115: this memset is not security related.
   memset(&local_conn_param, 0, sizeof(local_conn_param));
   local_conn_param.qp_num = server->get_local_qpn();
 
   if (rdma_accept(event_cm_id, &local_conn_param)) {
+    lderr(cct) << __func__ << " rdma_accept failed: " << cpp_strerror(errno) << dendl;
+    rdma_ack_cm_event(cm_event);
+    rw->center.submit_to(rw->center.get_id(), [server]() { server->close(); delete server; }, false);
     return -EAGAIN;
   }
   server->activate();
diff --git a/src/msg/async/rdma/RDMAServerSocketImpl.cc b/src/msg/async/rdma/RDMAServerSocketImpl.cc
index 69ad2d2dc94..4435c95915a 100644
--- a/src/msg/async/rdma/RDMAServerSocketImpl.cc
+++ b/src/msg/async/rdma/RDMAServerSocketImpl.cc
@@ -111,15 +111,23 @@ int RDMAServerSocketImpl::accept(ConnectedSocket *sock, const SocketOptions &opt
   out->set_sockaddr((sockaddr*)&ss);
   net.set_priority(sd, opt.priority, out->get_family());
 
+  RDMAWorker *rw = dynamic_cast<RDMAWorker*>(w);
   RDMAConnectedSocketImpl* server;
   //Worker* w = dispatcher->get_stack()->get_worker();
-  server = new RDMAConnectedSocketImpl(cct, ib, dispatcher, dynamic_cast<RDMAWorker*>(w));
-  if (!server->get_qp()) {
-    lderr(cct) << __func__ << " server->qp is null" << dendl;
-    // cann't use delete server here, destructor will fail.
-    server->cleanup();
+  server = new RDMAConnectedSocketImpl(cct, ib, dispatcher, rw);
+  // Construction can fail under fd pressure (eventfd) or on queue pair creation.
+  // Such a socket has fd() < 0 and/or a null qp; handing it back on the success
+  // path would trip ceph_assert(socket.fd() >= 0) in AsyncConnection::accept.
+  // Return an honest errno (fd-first, so eventfd exhaustion maps to -EMFILE rather
+  // than -EIO) and free the half-built socket on its owning worker thread, where
+  // ~RDMAConnectedSocketImpl's center.in_thread() assertion holds.
+  if (server->fd() < 0 || !server->get_qp()) {
+    int err = server->fd() < 0 ? -EMFILE : -EIO;
+    lderr(cct) << __func__ << " failed to create connected socket: "
+               << cpp_strerror(err) << dendl;
+    rw->center.submit_to(rw->center.get_id(), [server]() { delete server; }, false);
     ::close(sd);
-    return -1;
+    return err;
   }
   server->set_accept_fd(sd);
   ldout(cct, 20) << __func__ << " accepted a new QP, tcp_fd: " << sd << dendl;
diff --git a/src/msg/async/rdma/RDMAStack.cc b/src/msg/async/rdma/RDMAStack.cc
index 34dda383a3f..e8a86631628 100644
--- a/src/msg/async/rdma/RDMAStack.cc
+++ b/src/msg/async/rdma/RDMAStack.cc
@@ -692,6 +692,17 @@ void RDMAWorker::initialize()
 int RDMAWorker::listen(entity_addr_t &sa, unsigned addr_slot,
 		       const SocketOptions &opt,ServerSocket *sock)
 {
+  // The rdma_cm path and the iwarp socket classes are coupled: only the iwarp
+  // classes implement rdma_cm, and they always use it.  Any other pairing leaves a
+  // socket half-built (the base ctor skips queue pair / eventfd creation when
+  // ms_async_rdma_cm=true, and a non-cm iwarp socket has no usable cm channel), so
+  // require the two to be enabled together and fail fast with a clear message.
+  if (cct->_conf->ms_async_rdma_cm != (cct->_conf->ms_async_rdma_type == "iwarp")) {
+    lderr(cct) << __func__ << " ms_async_rdma_cm and ms_async_rdma_type=iwarp must be "
+                  "enabled together" << dendl;
+    return -EOPNOTSUPP;
+  }
+
   ib->init();
   dispatcher->polling_start();
 
@@ -713,15 +724,45 @@ int RDMAWorker::listen(entity_addr_t &sa, unsigned addr_slot,
 
 int RDMAWorker::connect(const entity_addr_t &addr, const SocketOptions &opts, ConnectedSocket *socket)
 {
+  const bool iwarp = cct->_conf->ms_async_rdma_type == "iwarp";
+  // The rdma_cm (connection manager) path and the iwarp socket classes are coupled:
+  // only the iwarp classes implement rdma_cm, and they always use it.  Any other
+  // pairing leaves a socket half-built -- with ms_async_rdma_cm=true and a non-iwarp
+  // type the base ctor skips queue pair / eventfd creation (fd() == -1 on every
+  // connection); with an iwarp type and ms_async_rdma_cm=false the cm channel is
+  // never set up.  Require the two together and fail fast.
+  if (cct->_conf->ms_async_rdma_cm != iwarp) {
+    lderr(cct) << __func__ << " ms_async_rdma_cm and ms_async_rdma_type=iwarp must be "
+                  "enabled together" << dendl;
+    return -EOPNOTSUPP;
+  }
+
   ib->init();
   dispatcher->polling_start();
 
   RDMAConnectedSocketImpl* p;
-  if (cct->_conf->ms_async_rdma_type == "iwarp") {
+  if (iwarp) {
     p = new RDMAIWARPConnectedSocketImpl(cct, ib, dispatcher, this);
   } else {
     p = new RDMAConnectedSocketImpl(cct, ib, dispatcher, this);
   }
+
+  // Reject a socket whose construction failed before wiring it up, otherwise it
+  // reaches the messenger with fd() == -1.  fd-first so eventfd exhaustion maps to
+  // -EMFILE; the non-iwarp qp check then catches a queue pair failure that left a
+  // valid eventfd (an iwarp client legitimately has a null qp until its route is
+  // resolved, so it is excluded here).
+  if (p->fd() < 0) {
+    lderr(cct) << __func__ << " failed to create eventfd (fd limit reached?)" << dendl;
+    delete p;
+    return -EMFILE;
+  }
+  if (!iwarp && !p->get_qp()) {
+    lderr(cct) << __func__ << " failed to create queue pair" << dendl;
+    delete p;
+    return -EIO;
+  }
+
   int r = p->try_connect(addr, opts);
 
   if (r < 0) {
diff --git a/src/msg/async/rdma/RDMAStack.h b/src/msg/async/rdma/RDMAStack.h
index dc01763ce34..7e225c8a915 100644
--- a/src/msg/async/rdma/RDMAStack.h
+++ b/src/msg/async/rdma/RDMAStack.h
@@ -176,7 +176,7 @@ class RDMAConnectedSocketImpl : public ConnectedSocketImpl {
 
  protected:
   CephContext *cct;
-  Infiniband::QueuePair *qp;
+  Infiniband::QueuePair *qp = nullptr;
   uint32_t peer_qpn = 0;
   uint32_t local_qpn = 0;
   int connected;

From d5f14772184d782c604a7c96cb219c384d21f779 Mon Sep 17 00:00:00 2001
From: benhanokh <gbenhano@redhat.com>
Date: Fri, 12 Jun 2026 12:48:32 +0300
Subject: [PATCH 338/596] rgw/dedup: extend shard tiers, add overflow guard,
 and fix bucket filter   The dedup subsystem was limited to 512 MD5 shards
 with 10% headroom,   capping effective operation at ~4 billion objects.   -
 Raise MAX_MD5_SHARD from 512 to 2048 and add new shard tiers for     1024
 (2GB), 2048 (4GB) shards, supporting up to ~213 billion objects.   - Increase
 headroom from 10% to 20% to improve hash table load factor.   - Reject pools
 that exceed the maximum capacity with -EOVERFLOW   - Apply bucket filter in
 collect_all_buckets_stats() so that filtered     buckets do not inflate the
 object count used for shard sizing.   - Update sizing table, comments, and
 documentation to reflect the new     tiers and capacity limit.

Signed-off-by: benhanokh <gbenhano@redhat.com>
---
 doc/radosgw/s3_objects_dedup.rst       | 24 ++++++++-----
 src/rgw/driver/rados/rgw_dedup.cc      | 50 +++++++++++++++++++++-----
 src/rgw/driver/rados/rgw_dedup_utils.h |  2 +-
 3 files changed, 59 insertions(+), 17 deletions(-)

diff --git a/doc/radosgw/s3_objects_dedup.rst b/doc/radosgw/s3_objects_dedup.rst
index 132a02319b7..3c731766b76 100644
--- a/doc/radosgw/s3_objects_dedup.rst
+++ b/doc/radosgw/s3_objects_dedup.rst
@@ -158,19 +158,27 @@ Memory Usage
  +------------------+----------+
  | RGW Object Count |  Memory  |
  +==================+==========+
- | 1M               | 8 MB     |
+ |      1M          |    8 MB  |
  +------------------+----------+
- | 4M               | 16 MB    |
+ |      4M          |   16 MB  |
  +------------------+----------+
- | 16M              | 32 MB    |
+ |     16M          |   32 MB  |
  +------------------+----------+
- | 64M              | 64 MB    |
+ |     64M          |   64 MB  |
  +------------------+----------+
- | 256M             | 128 MB   |
+ |    256M          |  128 MB  |
  +------------------+----------+
- | 1024M (1G)       | 256 MB   |
+ |   1024M   (1G)   |  256 MB  |
  +------------------+----------+
- | 4096M (4G)       | 512 MB   |
+ |   4096M   (4G)   |  512 MB  |
  +------------------+----------+
- | 16384M (16G)     | 1024 MB  |
+ |  16384M  (16G)   | 1024 MB  |
  +------------------+----------+
+ |  65536M  (64G)   | 2048 MB  |
+ +------------------+----------+
+ | 262144M (256G)   | 4096 MB  |
+ +------------------+----------+
+
+ .. note::
+     Pools with more than ~213 billion user objects (256B with headroom) exceed the
+     dedup system's maximum capacity and will be rejected at startup.
diff --git a/src/rgw/driver/rados/rgw_dedup.cc b/src/rgw/driver/rados/rgw_dedup.cc
index 260a8315f5e..d9551159a48 100644
--- a/src/rgw/driver/rados/rgw_dedup.cc
+++ b/src/rgw/driver/rados/rgw_dedup.cc
@@ -2681,6 +2681,11 @@ namespace rgw::dedup {
             goto err;
           }
           ldpp_dout(dpp, 20) <<__func__ << "::bucket=" << bucket << dendl;
+          if (!d_filter.allow_bucket(bucket.name)) {
+            ldpp_dout(dpp, 10) << __func__ << "::skip bucket (filter): "
+                               << bucket.name << dendl;
+            continue;
+          }
           ret = read_bucket_stats(bucket, &d_all_buckets_obj_count,
                                   &d_all_buckets_obj_size);
           if (unlikely(ret != 0)) {
@@ -2944,14 +2949,22 @@ namespace rgw::dedup {
   //-------------------------------------------------------------------------------
   //    64M      ||     32       ||    64MB ||   64MB/32 =  2.00M *  32 =    64M ||
   //   256M      ||     64       ||   128MB ||  128MB/32 =  4.00M *  64 =   256M ||
-  //  1024M( 1G) ||    128       ||   256MB ||  256MB/32 =  8.00M * 128 =  1024M ||
-  //  4096M( 4G) ||    256       ||   512MB ||  512MB/32 = 16M.00 * 256 =  4096M ||
-  // 16384M(16G) ||    512       ||  1024MB || 1024MB/32 = 32M.00 * 512 = 16384M ||
+  //  1024M(  1G)||    128       ||   256MB ||  256MB/32 =  8.00M * 128 =  1024M ||
+  //  4096M(  4G)||    256       ||   512MB ||  512MB/32 = 16M.00 * 256 =  4096M ||
+  //-------------------------------------------------------------------------------
+  // 16384M( 16G)||    512       ||  1024MB || 1024MB/32 = 32M.00 * 512 = 16384M ||
+  // 65536M( 64G)||   1024       ||  2048MB || 2048MB/32 = 64M.00 *1024 = 65536M ||
+  //262144M(256G)||   2048       ||  4096MB || 4096MB/32 =128M.00 *2048 =262144M ||
   //-------------||--------------||---------||-----------------------------------||
+  //   > 256G    ||  REJECTED    ||   N/A   || Pool exceeds max supported size   ||
+  //=============||==============||=========||===================================||
+
   static md5_shard_t calc_num_md5_shards(uint64_t obj_count)
   {
-    // create headroom by allocating space for a 10% bigger system
-    obj_count = obj_count + (obj_count/10);
+    // create headroom by allocating space for a 20% bigger system
+    // NOTE: all thresholds below compare against the inflated obj_count,
+    // not the raw count reported by pool stats.
+    obj_count = obj_count + (obj_count/5);
 
     uint64_t M = 1024 * 1024;
     if (obj_count < 1*M) {
@@ -2979,12 +2992,26 @@ namespace rgw::dedup {
       return 128;
     }
     else if (obj_count < 4*1024*M) {
-      // less than 4096M objects -> use 256 shards (512MB)
+      // less than   4B objects -> use 256 shards (512MB)
       return 256;
     }
-    else {
+    else if (obj_count < 16*1024*M) {
+      // less than  16B objects -> use 512 shards (1GB)
       return 512;
     }
+    else if (obj_count < 64*1024*M) {
+      // less than  64B objects -> use 1024 shards (2GB)
+      return 1024;
+    }
+    else if (obj_count < 256*1024*M) {
+      // less than 256B objects -> use 2048 shards (4GB)
+      return 2048;
+    }
+    else {
+      // Dedup supports systems with up-to ~213 billion user objects per-pool
+      // With headroom that translates to about 256B objects
+      return MD5_SHARD_HARD_LIMIT + 1;
+    }
   }
 
   //---------------------------------------------------------------------------
@@ -2996,10 +3023,17 @@ namespace rgw::dedup {
     }
 
     md5_shard_t num_md5_shards = calc_num_md5_shards(d_all_buckets_obj_count);
+    if (num_md5_shards > MD5_SHARD_HARD_LIMIT) {
+      derr << __func__ << "::Pool has too many objects: ("
+           << d_all_buckets_obj_count << ") Max supported is 213 billion" << dendl;
+      return -EOVERFLOW;
+    }
+
     num_md5_shards = std::min(num_md5_shards, MAX_MD5_SHARD);
     num_md5_shards = std::max(num_md5_shards, MIN_MD5_SHARD);
     work_shard_t num_work_shards = num_md5_shards;
     num_work_shards = std::min(num_work_shards, MAX_WORK_SHARD);
+    num_work_shards = std::max(num_work_shards, MIN_WORK_SHARD);
 
     ldpp_dout(dpp, 5) << __func__ << "::obj_count=" <<d_all_buckets_obj_count
                       << "::num_md5_shards=" << num_md5_shards
@@ -3007,7 +3041,7 @@ namespace rgw::dedup {
     // init handles and create the dedup_pool
     ret = init_rados_access_handles(true);
     if (ret != 0) {
-      derr << "dedup_bg::resume() failed init_rados_access_handles() ret="
+      derr << __func__ << "::failed init_rados_access_handles() ret="
            << ret << "::" << cpp_strerror(-ret) << dendl;
       return ret;
     }
diff --git a/src/rgw/driver/rados/rgw_dedup_utils.h b/src/rgw/driver/rados/rgw_dedup_utils.h
index 1159c130c60..a09786bf72d 100644
--- a/src/rgw/driver/rados/rgw_dedup_utils.h
+++ b/src/rgw/driver/rados/rgw_dedup_utils.h
@@ -38,7 +38,7 @@ namespace rgw::dedup {
 
   // Those are the correct values for production system
   const work_shard_t MAX_WORK_SHARD = 255;
-  const md5_shard_t  MAX_MD5_SHARD  = 512;
+  const md5_shard_t  MAX_MD5_SHARD  = 2048;
 
   const work_shard_t NULL_WORK_SHARD = 0xFFFF;
   const md5_shard_t  NULL_MD5_SHARD  = 0xFFFF;

From 9a7299c455b19bef1282a18d8fd3c6f8c8b2596f Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sun, 21 Jun 2026 16:14:49 +0800
Subject: [PATCH 339/596] cmake,deb,rpm: exclude CI and test directories from
 installed modules

The mgr module install rule already excluded tests/*, but that glob only
dropped the files inside tests/ and left an empty tests/ directory in the
installed tree.  The ci/ directories, which hold Dockerfiles, e2e test
scripts, and cluster specs used only for upstream CI pipelines, were not
excluded at all and were shipped by ceph-mgr-dashboard and ceph-mgr-rook.

Change the install pattern from tests/* to tests so the whole directory
is pruned, and add a ci pattern.  Both patterns live in the exclude list
shared by every mgr module install rule (the module list, dashboard, and
rook), so this covers all of them in one place.

This supersedes the per-package excludes added in 8a2e0eb2fc and
d74b88500b, so drop them from ceph.spec.in and debian/rules.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in                  | 3 ---
 debian/rules                  | 5 +----
 src/pybind/mgr/CMakeLists.txt | 3 ++-
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 186cacb9a86..b0fba106c2c 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -2345,7 +2345,6 @@ fi
 
 %files mgr-dashboard
 %{_datadir}/ceph/mgr/dashboard
-%exclude %{_datadir}/ceph/mgr/dashboard/ci
 
 %ceph_mgr_module_scripts mgr-dashboard
 
@@ -2466,7 +2465,6 @@ fi
 
 %files mgr-rook
 %{_datadir}/ceph/mgr/rook
-%exclude %{_datadir}/ceph/mgr/rook/ci
 
 %ceph_mgr_module_scripts mgr-rook
 
@@ -2477,7 +2475,6 @@ fi
 
 %files mgr-cephadm
 %{_datadir}/ceph/mgr/cephadm
-%exclude %{_datadir}/ceph/mgr/cephadm/tests
 
 %ceph_mgr_module_scripts mgr-cephadm
 
diff --git a/debian/rules b/debian/rules
index d27dac6a664..48b8634a1c4 100755
--- a/debian/rules
+++ b/debian/rules
@@ -158,10 +158,7 @@ override_dh_python3:
 	dh_python3 -p ceph-fuse --shebang=/usr/bin/python3
 	dh_python3 -p ceph-volume --shebang=/usr/bin/python3
 
-override_dh_install:
-	dh_install --exclude=mgr/cephadm/tests --exclude=mgr/dashboard/ci --exclude=mgr/rook/ci
-
 # do not run tests
 override_dh_auto_test:
 
-.PHONY: override_dh_autoreconf override_dh_auto_configure override_dh_auto_clean override_dh_auto_install override_dh_installlogrotate override_dh_installinit override_dh_install override_dh_strip override_dh_auto_test
+.PHONY: override_dh_autoreconf override_dh_auto_configure override_dh_auto_clean override_dh_auto_install override_dh_installlogrotate override_dh_installinit override_dh_strip override_dh_auto_test
diff --git a/src/pybind/mgr/CMakeLists.txt b/src/pybind/mgr/CMakeLists.txt
index 9edfe705dee..342b2b942d7 100644
--- a/src/pybind/mgr/CMakeLists.txt
+++ b/src/pybind/mgr/CMakeLists.txt
@@ -4,7 +4,8 @@ set(mgr_module_install_excludes
   PATTERN "tox.ini" EXCLUDE
   PATTERN "requirements*.txt" EXCLUDE
   PATTERN "constraints*.txt" EXCLUDE
-  PATTERN "tests/*" EXCLUDE)
+  PATTERN "tests" EXCLUDE
+  PATTERN "ci" EXCLUDE)
 
 add_subdirectory(dashboard)
 

From ecd883a1b3924b981042df3903cb1dc6b55d5920 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 22 Jun 2026 07:44:20 +0800
Subject: [PATCH 340/596] librbd: fix use-after-free releasing object map locks
 in deep copy

DeepCopyRequest::send_copy_object_map() holds the destination image's
owner_lock and image_lock (shared), issues an asynchronous
object_map->rollback(), and then releases the two locks through
m_dst_image_ctx.  The rollback callback drives the rest of the request to
completion (handle_copy_object_map() ... finish() -> put()) on other
threads.  That path needs image_lock, so it only proceeds once this method
releases it, and can then run to completion and free 'this' before the
following owner_lock.unlock_shared() executes, dereferencing the freed
DeepCopyRequest.

ASan reported this as a heap-use-after-free in
TestImageReplayer.StartReplayAndWrite: the object was freed on the finisher
thread (handle_copy_metadata() -> finish()) while the io_context thread was
still in send_copy_object_map().

The destination image ctx outlives the request, so operate through a local
reference to it and release the locks through that reference rather than
through 'this', as
operation/SnapshotRollbackRequest::send_rollback_object_map() already does.

Keep the explicit lock_shared()/unlock_shared() calls rather than scoped
std::shared_lock guards: unlike
operation/SnapshotRollbackRequest::send_rollback_object_map(),
send_copy_object_map() has four exit paths (send_copy_metadata(),
send_refresh_object_map(), finish(), and the object map rollback), each of
which must release the locks before running a different continuation, so
RAII guards would push that continuation out of the locked scope and read
less clearly than unlocking at each exit.

Fixes: https://tracker.ceph.com/issues/77551
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/librbd/DeepCopyRequest.cc | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/src/librbd/DeepCopyRequest.cc b/src/librbd/DeepCopyRequest.cc
index 6878f145f26..934dad4a4ba 100644
--- a/src/librbd/DeepCopyRequest.cc
+++ b/src/librbd/DeepCopyRequest.cc
@@ -197,36 +197,38 @@ void DeepCopyRequest<I>::handle_copy_image(int r) {
 
 template <typename I>
 void DeepCopyRequest<I>::send_copy_object_map() {
-  m_dst_image_ctx->owner_lock.lock_shared();
-  m_dst_image_ctx->image_lock.lock_shared();
+  // local ref so the unlocks don't touch 'this', which rollback() may free
+  I &dst_image_ctx = *m_dst_image_ctx;
+  dst_image_ctx.owner_lock.lock_shared();
+  dst_image_ctx.image_lock.lock_shared();
 
-  if (!m_dst_image_ctx->test_features(RBD_FEATURE_OBJECT_MAP,
-                                      m_dst_image_ctx->image_lock)) {
-    m_dst_image_ctx->image_lock.unlock_shared();
-    m_dst_image_ctx->owner_lock.unlock_shared();
+  if (!dst_image_ctx.test_features(RBD_FEATURE_OBJECT_MAP,
+                                   dst_image_ctx.image_lock)) {
+    dst_image_ctx.image_lock.unlock_shared();
+    dst_image_ctx.owner_lock.unlock_shared();
     send_copy_metadata();
     return;
   }
   if (m_src_snap_id_end == CEPH_NOSNAP) {
-    m_dst_image_ctx->image_lock.unlock_shared();
-    m_dst_image_ctx->owner_lock.unlock_shared();
+    dst_image_ctx.image_lock.unlock_shared();
+    dst_image_ctx.owner_lock.unlock_shared();
     send_refresh_object_map();
     return;
   }
 
-  ceph_assert(m_dst_image_ctx->object_map != nullptr);
+  ceph_assert(dst_image_ctx.object_map != nullptr);
 
   ldout(m_cct, 20) << dendl;
 
   Context *finish_op_ctx = nullptr;
   int r;
-  if (m_dst_image_ctx->exclusive_lock != nullptr) {
-    finish_op_ctx = m_dst_image_ctx->exclusive_lock->start_op(&r);
+  if (dst_image_ctx.exclusive_lock != nullptr) {
+    finish_op_ctx = dst_image_ctx.exclusive_lock->start_op(&r);
   }
   if (finish_op_ctx == nullptr) {
     lderr(m_cct) << "lost exclusive lock" << dendl;
-    m_dst_image_ctx->image_lock.unlock_shared();
-    m_dst_image_ctx->owner_lock.unlock_shared();
+    dst_image_ctx.image_lock.unlock_shared();
+    dst_image_ctx.owner_lock.unlock_shared();
     finish(r);
     return;
   }
@@ -238,9 +240,9 @@ void DeepCopyRequest<I>::send_copy_object_map() {
     });
   ceph_assert(m_snap_seqs->count(m_src_snap_id_end) > 0);
   librados::snap_t copy_snap_id = (*m_snap_seqs)[m_src_snap_id_end];
-  m_dst_image_ctx->object_map->rollback(copy_snap_id, ctx);
-  m_dst_image_ctx->image_lock.unlock_shared();
-  m_dst_image_ctx->owner_lock.unlock_shared();
+  dst_image_ctx.object_map->rollback(copy_snap_id, ctx);
+  dst_image_ctx.image_lock.unlock_shared();
+  dst_image_ctx.owner_lock.unlock_shared();
 }
 
 template <typename I>

From 82162c04bb714610f5ec6dbaa4f233eb0493d997 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 22 Jun 2026 00:14:55 +0800
Subject: [PATCH 341/596] cmake: use the libc allocator for sanitizer builds

tcmalloc/jemalloc keep exporting the global operator new/delete even though
their malloc is shadowed by the sanitizer interceptor, so memory the sanitizer
allocated gets freed through tcmalloc and SIGSEGVs (e.g. seastar coroutine
frames). Force libc when WITH_ASAN is set.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 CMakeLists.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 46a0efc680d..6de3055dc4f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -460,6 +460,10 @@ if(ALLOCATOR)
   elseif(NOT ALLOCATOR STREQUAL "libc")
     message(FATAL_ERROR "Unsupported allocator selected: ${ALLOCATOR}")
   endif()
+elseif(WITH_ASAN)
+  # Force libc: tcmalloc/jemalloc still export operator new/delete even when the
+  # sanitizer shadows malloc, so sanitizer-allocated memory is freed via tcmalloc and SIGSEGVs.
+  set(ALLOCATOR "libc")
 else(ALLOCATOR)
   find_package(gperftools 2.6.2)
   set(HAVE_LIBTCMALLOC ${gperftools_FOUND})

From 1089fa3a6fd8d64685909ca4ef146f68843f0334 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 21 Jun 2026 16:42:54 +0800
Subject: [PATCH 342/596] crimson: build seastar with the default allocator
 under ASan

With this build configured as RelWithDebInfo, seastar keeps its own
allocator instead of falling back to libc's. Under ASan that allocator
is called (via dlsym) before it is initialized and SIGSEGVs every
seastar/crimson unittest before main(). Define SEASTAR_DEFAULT_ALLOCATOR
under WITH_ASAN to keep seastar on the libc allocator.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/CMakeLists.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index a93a38d7501..8b0cd023cfc 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -510,6 +510,11 @@ if(WITH_CRIMSON)
     "-Wno-attributes"
     "-Wno-pessimizing-move"
     "-Wno-address-of-packed-member")
+  if(WITH_ASAN)
+    # As built here (RelWithDebInfo) seastar keeps its own allocator, which
+    # ASan calls via dlsym before init, crashing every test before main().
+    target_compile_definitions(seastar PUBLIC SEASTAR_DEFAULT_ALLOCATOR)
+  endif()
   add_subdirectory(crimson)
   add_dependencies(crimson-osd erasure_code)
 endif()

From 3ba08f88ade0cff63783ffcdfc238cbe7d91f16d Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 21 Jun 2026 16:42:54 +0800
Subject: [PATCH 343/596] test/encoding: probe `setarch -R` and drop the arch
 argument

readable.sh wraps ceph-dencoder with `setarch $(uname -m) -R` to disable
ASLR on ASan builds, but the arch-qualified form also sets the personality
to that arch, which fails where setarch can't (e.g. riscv64). Use bare
`setarch -R` to only clear ASLR, and probe it first so the script falls
back to running ceph-dencoder unwrapped.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/encoding/readable.sh | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/test/encoding/readable.sh b/src/test/encoding/readable.sh
index 115d6d7b6f1..dcf53d2c8ae 100755
--- a/src/test/encoding/readable.sh
+++ b/src/test/encoding/readable.sh
@@ -24,9 +24,16 @@ fi
 
 # ASAN builds need setarch -R to disable ASLR so each process can find a
 # contiguous 16+ TB shadow memory region. See https://clang.llvm.org/docs/AddressSanitizer.html
+# Use bare `setarch -R` (no arch): the arch-qualified form also sets the
+# personality, which fails where setarch can't (e.g. riscv64). Check it works
+# before wrapping, and just run ceph-dencoder unwrapped if it doesn't.
 if ldd $(command -v $CEPH_DENCODER) 2>/dev/null | grep -q libasan; then
-  echo "ASAN build detected: wrapping ceph-dencoder with 'setarch \$(uname -m) -R'"
-  CEPH_DENCODER="setarch $(uname -m) -R $CEPH_DENCODER"
+  if setarch -R true >/dev/null 2>&1; then
+    echo "ASAN build detected: wrapping ceph-dencoder with 'setarch -R'"
+    CEPH_DENCODER="setarch -R $CEPH_DENCODER"
+  else
+    echo "ASAN build detected but 'setarch -R' is unavailable; running ceph-dencoder without ASLR disable"
+  fi
 fi
 
 myversion=$($CEPH_DENCODER version)

From 5166ec6f064fcc9a3299022ccebfdf69c8f6ec93 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sat, 20 Jun 2026 15:17:26 +0800
Subject: [PATCH 344/596] cmake: define BOOST_USE_UCONTEXT tree-wide under ASan

Under WITH_ASAN Boost.Context is built ucontext-only, so consumers that
include its headers without linking Boost::context (e.g. libosd) were
still built for the fcontext backend and broke the link:

    mold: error: undefined symbol: boost::context::detail::make_fcontext

Define the backend tree-wide so every consumer agrees on it.

riscv64's ASan runtime mis-handles makecontext/swapcontext, so the
ucontext fiber backend reports false-positive heap-buffer-overflows on
fiber switch that can't be suppressed. So exclude it.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 CMakeLists.txt                 | 11 +++++++++++
 cmake/modules/BuildBoost.cmake |  9 ++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 46a0efc680d..99e389ff3e6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -817,6 +817,17 @@ else()
   include(BuildBoost)
   build_boost(1.87
     COMPONENTS ${BOOST_COMPONENTS} ${BOOST_HEADER_COMPONENTS})
+  if(WITH_ASAN)
+    # Boost.Context is built ucontext-only here (context-impl=ucontext); define
+    # the matching backend tree-wide so every Boost.Context/Coroutine2 consumer
+    # agrees on it, instead of relying on per-target propagation that is easy to miss.
+    # Except riscv64: its ASan mis-handles ucontext, so it keeps fcontext.
+    if(CMAKE_SYSTEM_PROCESSOR MATCHES "riscv")
+      add_compile_definitions(BOOST_USE_ASAN)
+    else()
+      add_compile_definitions(BOOST_USE_ASAN BOOST_USE_UCONTEXT)
+    endif()
+  endif()
 endif()
 include_directories(BEFORE SYSTEM ${Boost_INCLUDE_DIRS})
 add_library(Boost::asio INTERFACE IMPORTED)
diff --git a/cmake/modules/BuildBoost.cmake b/cmake/modules/BuildBoost.cmake
index d47e1eeb471..6f409dcdce1 100644
--- a/cmake/modules/BuildBoost.cmake
+++ b/cmake/modules/BuildBoost.cmake
@@ -146,7 +146,8 @@ function(do_build_boost root_dir version)
   endif()
   set(b2_targets headers stage)
   set(b2_install_targets install)
-  if(WITH_ASAN)
+  # Except riscv64: its ASan mis-handles ucontext, so it keeps fcontext.
+  if(WITH_ASAN AND NOT (CMAKE_SYSTEM_PROCESSOR MATCHES "riscv"))
     list(APPEND b2 context-impl=ucontext)
     # `context-impl` is declared in libs/context/build/Jamfile.v2; the headers/stage
     # and install targets never load it, so b2 aborts with `unknown feature
@@ -262,10 +263,8 @@ macro(build_boost version)
       set_target_properties(Boost::${c} PROPERTIES
         INTERFACE_COMPILE_DEFINITIONS "BOOST_USE_VALGRIND")
     endif()
-    if((c MATCHES "context") AND (WITH_ASAN))
-      set_target_properties(Boost::${c} PROPERTIES
-        INTERFACE_COMPILE_DEFINITIONS "BOOST_USE_ASAN;BOOST_USE_UCONTEXT")
-    endif()
+    # ASan's BOOST_USE_ASAN/BOOST_USE_UCONTEXT are defined tree-wide in the
+    # top-level CMakeLists.txt, not per-target.
     list(APPEND Boost_LIBRARIES ${Boost_${upper_c}_LIBRARY})
   endforeach()
   foreach(c ${Boost_BUILD_COMPONENTS})

From 0a4edc5213ba90f29db908996e095733a5e0572e Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 21 Jun 2026 16:42:54 +0800
Subject: [PATCH 345/596] vstart: load lsan/asan suppressions on WITH_ASAN
 builds

AddCephTest.cmake runs unittests with
ASAN_OPTIONS/LSAN_OPTIONS=suppressions=qa/{asan,lsan}.supp, but vstart.sh
does not, so on a WITH_ASAN build `ceph-mon --mkfs` aborts on a still-reachable
leak that those suppressions cover and fails the "ceph API tests" job. Export
the same options when WITH_ASAN=ON.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/vstart.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/vstart.sh b/src/vstart.sh
index 7f5421bffce..9e5e6cd3c68 100755
--- a/src/vstart.sh
+++ b/src/vstart.sh
@@ -64,6 +64,14 @@ if [ -e CMakeCache.txt ]; then
     CEPH_ROOT=$(get_cmake_variable ceph_SOURCE_DIR)
     CEPH_BUILD_DIR=`pwd`
     [ -z "$MGR_PYTHON_PATH" ] && MGR_PYTHON_PATH=$CEPH_ROOT/src/pybind/mgr
+
+    # Point the sanitizers at the in-tree suppression files so vstart daemons
+    # ignore the same still-reachable third-party leaks AddCephTest.cmake suppresses for
+    # unittests. Without this `ceph-mon --mkfs` aborts on LeakSanitizer.
+    if [ "$(get_cmake_variable WITH_ASAN)" = "ON" ]; then
+        [ -z "$ASAN_OPTIONS" ] && export ASAN_OPTIONS="suppressions=$CEPH_ROOT/qa/asan.supp,detect_odr_violation=0"
+        [ -z "$LSAN_OPTIONS" ] && export LSAN_OPTIONS="suppressions=$CEPH_ROOT/qa/lsan.supp,print_suppressions=0"
+    fi
 fi
 
 # use CEPH_BUILD_ROOT to vstart from a 'make install'

From e35cdb71232c69d20ddb5e2f0104f48c20fa5d86 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 22 Jun 2026 14:52:22 +0800
Subject: [PATCH 346/596] qa/lsan.supp: suppress still-reachable third-party
 leaks

Several unittests fail LeakSanitizer on still-reachable allocations that
belong to third-party libraries, not to Ceph. These are boost.thread's
main-thread TLS, OpenSSL's one-time init (the ForkDeathTest children
_exit() before it is freed), and the cipher, DRBG and error-stack state
that OpenSSL and libcryptsetup keep behind the librbd encryption and
migration unittests. None get freed without OPENSSL_cleanup(), so suppress
them by their allocation entry points.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 qa/lsan.supp | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/qa/lsan.supp b/qa/lsan.supp
index 329389e5b5f..8dd1faa5e81 100644
--- a/qa/lsan.supp
+++ b/qa/lsan.supp
@@ -48,3 +48,22 @@ leak:^ceph::ErasureCodePluginRegistry::load
 # SQLite internal allocations
 # These are indirect leaks from SQLite's internal memory management
 leak:libsqlite3.so
+
+# boost.thread main-thread TLS; freed only when a boost-created thread exits, so
+# still reachable at exit. Benign.
+leak:boost::detail::make_external_thread_data
+
+# OpenSSL one-time init; ForkDeathTest children _exit() without OPENSSL_cleanup.
+leak:^OPENSSL_init_crypto
+
+# Still-reachable OpenSSL / libcryptsetup state with no API to free at exit;
+# seen in the librbd encryption and migration unittests under ASan.
+#
+# libcryptsetup OpenSSL cipher/per-thread state that survives crypt_free().
+leak:libcryptsetup
+# OpenSSL DRBG global state, freed only by OPENSSL_cleanup (never called here).
+leak:^RAND_bytes_ex
+leak:^RAND_priv_bytes_ex
+# OpenSSL per-thread error stack/strings, freed only by OPENSSL_thread_stop.
+leak:^ossl_err_get_state_int
+leak:^ERR_add_error_vdata

From 51a82211edc43c2612b75e84eea7cdeee978e777 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 22 Jun 2026 14:52:57 +0800
Subject: [PATCH 347/596] qa/lsan.supp: suppress seastore reactor-teardown
 leaks

unittest-seastore runs the seastar reactor on a separate thread
(SeastarRunner) and stops it at exit without draining its pending
tasks, so a few cached extents those tasks still held are leaked at
shutdown. Suppress them by the three seastore subsystems they come from.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 qa/lsan.supp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/qa/lsan.supp b/qa/lsan.supp
index 8dd1faa5e81..e1a20fdccd8 100644
--- a/qa/lsan.supp
+++ b/qa/lsan.supp
@@ -67,3 +67,11 @@ leak:^RAND_priv_bytes_ex
 # OpenSSL per-thread error stack/strings, freed only by OPENSSL_thread_stop.
 leak:^ossl_err_get_state_int
 leak:^ERR_add_error_vdata
+
+# unittest-seastore stops the seastar reactor (SeastarRunner, on its own thread)
+# without draining its pending tasks, so a few cached extents those tasks still
+# held are leaked at shutdown. Three anchors for the three seastore subsystems
+# they come from.
+leak:crimson::os::seastore::Cache::
+leak:crimson::os::seastore::omap_manager
+leak:crimson::os::seastore::FixedKVBtree

From d123f74bb2f5c699a6a61314e430a89f2c0768f4 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 22 Jun 2026 15:25:18 +0800
Subject: [PATCH 348/596] doc/rados/operations: document the kernel-client
 min-compat holdout

A kernel CephFS or RBD mount can keep ``set-require-min-compat-client
reef`` from succeeding: the kernel client does not advertise the
pg-upmap-primary feature, so ``ceph features`` reports it as a luminous
client even when the daemons and every userspace client are newer.
ceph-fuse, libcephfs, and librbd advertise the full feature set and are
not affected.

Document this, and add a section on finding the holdout with
``ceph features`` and switching it to a userspace client.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 .../operations/require-min-compat-client.rst  | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/doc/rados/operations/require-min-compat-client.rst b/doc/rados/operations/require-min-compat-client.rst
index dbfa6204f5d..ad5cb938d05 100644
--- a/doc/rados/operations/require-min-compat-client.rst
+++ b/doc/rados/operations/require-min-compat-client.rst
@@ -112,7 +112,10 @@ The Linux kernel Ceph client (``krbd`` for RBD block devices, ``kcephfs``
 for CephFS) ships with the kernel, not with Ceph packages, so its version
 is independent of the cluster release. New OSD map features reach the
 kernel client only after they are implemented and merged upstream, which
-can lag the Ceph daemon release by months or years.
+can lag the Ceph daemon release by months or years. The userspace clients
+(``ceph-fuse`` and ``libcephfs`` for CephFS, ``librbd`` for RBD) link the
+Ceph release they were built from and advertise its full feature set, so
+they are not subject to this lag.
 
 The *Min kernel* column shows the minimum Linux kernel version required on
 kernel client hosts before the corresponding commands are used. If no
@@ -164,6 +167,21 @@ kernel clients are present in the cluster, that column can be ignored.
 
    See :ref:`read_balancer` for removal commands.
 
+When a kernel mount blocks the flag
+===================================
+
+A single kernel mount can hold the whole cluster below the release you
+want, even when every daemon and userspace client is already newer.
+``ceph features`` reports such a mount as ``luminous`` because the kernel
+client does not advertise the ``pg-upmap-primary`` (reef) feature. To
+confirm which entry it adds, run ``ceph features`` with the mount
+unmounted, then again with it mounted, and compare the client counts.
+
+Since the userspace clients advertise the full feature set, switching the
+holdout to its userspace equivalent (``ceph-fuse`` or ``libcephfs`` for
+CephFS, ``librbd`` for RBD) clears the blocker, after which the flag can
+be raised and the read balancer enabled.
+
 See :ref:`upmap` and :ref:`read_balancer` for the operational procedures
 that depend on raising the flag. CephFS clients must satisfy both this
 flag and any per-filesystem :ref:`cephfs_required_client_features` on

From 8ab6f707ced8c3dea32afffbb3ff8be1740adf31 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Thu, 18 Jun 2026 13:18:47 +0800
Subject: [PATCH 349/596] crimson/os/seastore/transaction_manager: refresh the
 indirect_cursor after removing the direct_cursor in _remove()

Fixes: https://tracker.ceph.com/issues/77485
Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/transaction_manager.cc | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/crimson/os/seastore/transaction_manager.cc b/src/crimson/os/seastore/transaction_manager.cc
index f0e586220b9..9a66a80d3b8 100644
--- a/src/crimson/os/seastore/transaction_manager.cc
+++ b/src/crimson/os/seastore/transaction_manager.cc
@@ -331,6 +331,12 @@ TransactionManager::_remove(
     indirect_cursor = co_await lba_manager->update_mapping_refcount(
       t, mapping.indirect_cursor, -1);
     co_await mapping.direct_cursor->refresh();
+    if (unlikely(indirect_cursor->get_key() ==
+          mapping.direct_cursor->get_key())) {
+      // indirect_cursor points to the same mapping as direct_cursor,
+      // no need to keep it
+      indirect_cursor.reset();
+    }
   }
 
   DEBUGT("removing direct mapping {}~0x{:x} refcount={} -- offset={}",
@@ -345,6 +351,10 @@ TransactionManager::_remove(
   LBACursorRef direct_cursor = co_await lba_manager->update_mapping_refcount(
     t, mapping.direct_cursor, -1);
 
+  if (indirect_cursor) {
+    co_await indirect_cursor->refresh();
+  }
+
   auto ret = co_await resolve_cursor_to_mapping(
     t,
     indirect_cursor ? std::move(indirect_cursor) : std::move(direct_cursor)

From 01c0602b1d959f2559f66f21adaa6182dcbfe8fd Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Mon, 22 Jun 2026 20:47:12 +0800
Subject: [PATCH 350/596] crimson/os/seastore/lba: coroutinize
 LBACursor::refresh()

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/lba/lba_btree_node.cc | 95 +++++++++----------
 1 file changed, 45 insertions(+), 50 deletions(-)

diff --git a/src/crimson/os/seastore/lba/lba_btree_node.cc b/src/crimson/os/seastore/lba/lba_btree_node.cc
index ed94290f72a..5f64cba2217 100644
--- a/src/crimson/os/seastore/lba/lba_btree_node.cc
+++ b/src/crimson/os/seastore/lba/lba_btree_node.cc
@@ -87,60 +87,55 @@ LBALeafNode::internal_const_iterator_t LBALeafNode::insert(
 base_iertr::future<> LBACursor::refresh()
 {
   LOG_PREFIX(LBACursor::refresh);
-  return with_btree<lba::LBABtree>(
-    ctx.cache,
-    ctx,
-    [this, FNAME, c=ctx](auto &btree) {
-    c.trans.cursor_stats.num_refresh_parent_total++;
 
-    if (!parent->is_valid()) {
-      c.trans.cursor_stats.num_refresh_invalid_parent++;
-      SUBTRACET(
-	seastore_lba,
-	"cursor {} parent is invalid, re-search from scratch",
-	 c.trans, *this);
-      return btree.lower_bound(c, this->get_laddr()
-      ).si_then([this](lba::LBABtree::iterator it) {
-	assert(this->get_laddr() == it.get_key());
-	iter = LBALeafNode::iterator(
-	  it.get_leaf_node().get(),
-	  it.get_leaf_pos());
-	auto leaf = it.get_leaf_node();
-	parent = leaf;
-	modifications = leaf->modifications;
-      });
-    }
-    assert(parent->is_stable() ||
-      parent->is_pending_in_trans(c.trans.get_trans_id()));
-    auto leaf = parent->cast<lba::LBALeafNode>();
-    if (leaf->is_pending_in_trans(c.trans.get_trans_id())) {
-      if (leaf->modified_since(modifications)) {
-	c.trans.cursor_stats.num_refresh_modified_viewable_parent++;
-      } else {
-	// no need to refresh
-	return base_iertr::now();
-      }
-    } else {
-      auto [viewable, l] = leaf->resolve_transaction(c.trans, get_laddr());
-	SUBTRACET(seastore_lba, "cursor: {} viewable: {}",
-	  c.trans, *this, viewable);
-      if (!viewable) {
-	leaf = l;
-	c.trans.cursor_stats.num_refresh_unviewable_parent++;
-	parent = leaf;
-      } else {
-	assert(leaf.get() == l.get());
-	assert(leaf->is_stable());
-	return base_iertr::now();
-      }
-    }
+  auto btree = co_await get_btree<LBABtree>(ctx.cache, ctx);
+  ctx.trans.cursor_stats.num_refresh_parent_total++;
 
+  if (!parent->is_valid()) {
+    ctx.trans.cursor_stats.num_refresh_invalid_parent++;
+    SUBTRACET(
+      seastore_lba,
+      "cursor {} parent is invalid, re-search from scratch",
+       ctx.trans, *this);
+    lba::LBABtree::iterator it = co_await btree.lower_bound(
+      ctx, this->get_laddr());
+    assert(this->get_laddr() == it.get_key());
+    iter = LBALeafNode::iterator(
+      it.get_leaf_node().get(),
+      it.get_leaf_pos());
+    auto leaf = it.get_leaf_node();
+    parent = leaf;
     modifications = leaf->modifications;
-    iter = leaf->lower_bound(get_laddr());
-    assert(is_viewable());
+    co_return;
+  }
+  assert(parent->is_stable() ||
+    parent->is_pending_in_trans(ctx.trans.get_trans_id()));
+  auto leaf = parent->cast<lba::LBALeafNode>();
+  if (leaf->is_pending_in_trans(ctx.trans.get_trans_id())) {
+    if (leaf->modified_since(modifications)) {
+      ctx.trans.cursor_stats.num_refresh_modified_viewable_parent++;
+    } else {
+      // no need to refresh
+      co_return;
+    }
+  } else {
+    auto [viewable, l] = leaf->resolve_transaction(ctx.trans, get_laddr());
+      SUBTRACET(seastore_lba, "cursor: {} viewable: {}",
+        ctx.trans, *this, viewable);
+    if (!viewable) {
+      leaf = l;
+      ctx.trans.cursor_stats.num_refresh_unviewable_parent++;
+      parent = leaf;
+    } else {
+      assert(leaf.get() == l.get());
+      assert(leaf->is_stable());
+      co_return;
+    }
+  }
 
-    return base_iertr::now();
-  });
+  modifications = leaf->modifications;
+  iter = leaf->lower_bound(get_laddr());
+  assert(is_viewable());
 }
 
 }

From 4d29f4e4021081f19a304dea6938b6f4350eb748 Mon Sep 17 00:00:00 2001
From: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
Date: Wed, 6 May 2026 20:41:33 +0530
Subject: [PATCH 351/596] osd/PeeringState: add perf counters for PG rebuild
 times

Track per-OSD PG rebuild duration in prepare_stats_for_publish()
(primary OSD only). Three new counters are added to the
recoverystate_perf collection:

 - pg_rebuild_duration: LONGRUNAVG time counter (sum+count pair);
   This counter internally maintains 'avgcount' that tracks the
   cumulative number of rebuild events.
 - pg_rebuild_max_secs: maximum rebuild duration observed in seconds
 - pg_rebuild_min_secs: minimum rebuild duration observed in seconds

The logic uses a per-PG in-memory latch (rebuild_start_time) to
capture the redundancy failure entry point. When a PG is first observed
to be in a vulnerable state (PG_STATE_DEGRADED,
PG_STATE_UNDERSIZED, or num_objects_misplaced/degraded > 0), it
latches info.stats.last_change as the start time, provided
last_change > last_clean, which ensures only genuine new failures
after the prior clean interval are tracked.

On recovery, the rebuild duration is computed as (now - rebuild_start_time)
and is only recorded if delta num_objects_recovered > 0 or the PG had
confirmed redundancy loss at latch time, filtering out spurious state
transitions. The latch is cleared after each recorded event.

The latch is also cleared in clear_primary_state() so that an interval
change or role transition (primary -> replica) does not carry a stale
start time or baseline recovered count into a future interval.

The new last_degraded is intentionally not used here to retain compatibility
with older Ceph branches where the field doesn't exist and requires encoding
changes. A future simplification can replace the latch with a direct
(last_clean - last_degraded) calculation once last_degraded is consistently
available.

This interim solution is a close approximation of the PG rebuild time.

These counters are scraped per-OSD by ceph-exporter and exposed to
Prometheus, enabling durability score calculations over user-defined
time windows.

Other Changes:
1. Add unit tests to TestPeeringState.cc that exercise the latch logic.
2. Add a standalone integration test to verify that the rebuild perf counters
   are incremented on the primary OSD after a recovery event.

Fixes: https://tracker.ceph.com/issues/77493
Signed-off-by: Sridhar Seshasayee <sridhar.seshasayee@ibm.com>
---
 qa/standalone/osd/osd-recovery-stats.sh |  81 ++++++
 src/osd/PeeringState.cc                 |  93 +++++++
 src/osd/PeeringState.h                  |  22 ++
 src/osd/osd_perf_counters.cc            |   9 +
 src/osd/osd_perf_counters.h             |   3 +
 src/test/osd/TestPeeringState.cc        | 342 ++++++++++++++++++++++++
 6 files changed, 550 insertions(+)

diff --git a/qa/standalone/osd/osd-recovery-stats.sh b/qa/standalone/osd/osd-recovery-stats.sh
index 6a402d4914f..4d780ccbcb3 100755
--- a/qa/standalone/osd/osd-recovery-stats.sh
+++ b/qa/standalone/osd/osd-recovery-stats.sh
@@ -716,6 +716,87 @@ function TEST_recovery_last_degraded_undersized() {
     kill_daemons $dir || return 1
 }
 
+# Verify that the rebuild perf counters on the primary OSD increment after a
+# real EC shard recovery.  Kill one non-primary OSD so the PG goes degraded,
+# then let recovery run to completion.  After the PG is clean again:
+#   - pg_rebuild_duration.avgcount must be >= 1
+#   - pg_rebuild_duration.sum must be > 0 (real time elapsed)
+function TEST_rebuild_perf_ec_increments() {
+    local dir=$1
+    local OSDS=4
+    local ecpoolname=ectest
+
+    run_mon $dir a || return 1
+    run_mgr $dir x || return 1
+    for osd in $(seq 0 $(expr $OSDS - 1))
+    do
+      run_osd $dir $osd --osd-mclock-skip-benchmark=true || return 1
+    done
+
+    ceph osd erasure-code-profile set ecprofile \
+        plugin=jerasure technique=reed_sol_van k=2 m=1 \
+        crush-failure-domain=osd || return 1
+    ceph osd pool create $ecpoolname 1 1 erasure ecprofile || return 1
+    ceph osd pool set $ecpoolname min_size 2 || return 1
+    wait_for_clean || return 1
+
+    # Write a few objects so the PG has data that must be recovered.
+    for i in $(seq 1 5)
+    do
+      rados -p $ecpoolname put obj$i /etc/hostname || return 1
+    done
+    wait_for_clean || return 1
+
+    local primary
+    primary=$(get_primary $ecpoolname obj1)
+    local replica
+    replica=$(get_not_primary $ecpoolname obj1)
+
+    # Pause recovery so the PG stays degraded long enough for the latch to
+    # fire inside prepare_stats_for_publish before recovery completes.
+    ceph osd set norecover || return 1
+
+    # Kill one non-primary OSD so the PG becomes degraded.
+    kill $(cat $dir/osd.${replica}.pid)
+    ceph osd down osd.${replica} || return 1
+    ceph osd out osd.${replica} || return 1
+
+    # Release the hold and wait for full recovery.
+    ceph osd unset norecover || return 1
+    wait_for_clean || return 1
+
+    # flush_pg_stats triggers publish_stats_to_osd on every OSD, which calls
+    # prepare_stats_for_publish and commits the rebuild counters.
+    flush_pg_stats || return 1
+
+    # The primary may be the same OSD we started with (we only killed a
+    # replica), but re-query in case CRUSH remapped the primary shard.
+    primary=$(get_primary $ecpoolname obj1)
+
+    local dump
+    dump=$(CEPH_ARGS='' ceph --admin-daemon $(get_asok_path osd.${primary}) \
+           perf dump) || return 1
+
+    local rebuild_avgcount
+    rebuild_avgcount=$(jq '.recoverystate_perf.pg_rebuild_duration.avgcount' \
+      <<< "$dump")
+    test "$rebuild_avgcount" -ge 1 || {
+      echo "FAIL: expected pg_rebuild_duration.avgcount>=1, got $rebuild_avgcount"
+      return 1
+    }
+
+    echo "$dump" | \
+      jq -e '.recoverystate_perf.pg_rebuild_duration.sum > 0' > /dev/null || {
+      local rebuild_sum
+      rebuild_sum=$(jq '.recoverystate_perf.pg_rebuild_duration.sum' <<< "$dump")
+      echo "FAIL: expected pg_rebuild_duration.sum>0, got $rebuild_sum"
+      return 1
+    }
+
+    delete_pool $ecpoolname
+    kill_daemons $dir || return 1
+}
+
 main osd-recovery-stats "$@"
 
 # Local Variables:
diff --git a/src/osd/PeeringState.cc b/src/osd/PeeringState.cc
index ba093f648b4..c3ed6be8107 100644
--- a/src/osd/PeeringState.cc
+++ b/src/osd/PeeringState.cc
@@ -1062,6 +1062,10 @@ void PeeringState::clear_primary_state()
 
   clear_recovery_state();
 
+  rebuild_start_time = utime_t();
+  rebuild_base_recovered = 0;
+  rebuild_had_redundancy_loss = false;
+
   pg_committed_to = eversion_t();
   missing_loc.clear();
   pl->clear_primary_state();
@@ -4498,6 +4502,95 @@ std::optional<pg_stat_t> PeeringState::prepare_stats_for_publish(
     if ((info.stats.state & PG_STATE_UNDERSIZED) == 0)
       info.stats.last_fullsized = now;
 
+    /**
+     * The following block is an interim solution to aggregate PG rebuild stats
+     * into a set of perf counters. The counterss are set based on the following
+     * existing pg_stat_t fields:
+     *  - last_clean, last_change
+     *  - num_objects_degraded, num_objects_misplaced, num_objects_recovered
+     *
+     * The PG rebuild stats are aggregated into the following recoverystate
+     * perf counters:
+     *  - rs_pg_rebuild_duration: rebuild duration LONGRUNAVG time counter
+     *  - rs_pg_rebuild_max_secs: maximum rebuild duration (secs)
+     *  - rs_pg_rebuild_min_secs: minimum rebuild duration (secs)
+     *
+     * Workflow:
+     *  1. Only the acting primary OSD of the PG executes the logic to
+     *     determine the rebuild stats.
+     *  2. The logic uses rebuild_start_time as a per-PG in-memory latch that
+     *     captures the failure entry point. When a PG is considered vulnerable,
+     *     rebuild_start_time latches info.stats.last_change as the start time,
+     *     provided last_change > last_clean, which ensures only genuine new
+     *     failures after the prior clean interval are tracked.
+     *  3. On recovery, the rebuild duration is computed as
+     *     (now - rebuild_start_time) and is only recorded if delta
+     *     num_objects_recovered > 0 or the PG had confirmed redundancy loss
+     *     at latch time, filtering out spurious state transitions. The latch
+     *     is cleared after each recorded event.
+     *
+     * last_degraded is intentionally not used in the interim solution to
+     * retain compatibility with older Ceph releases where this field doesn't
+     * exist and requires encoding changes. The interim solution is a
+     * close approximation of the PG rebuild time.
+     *
+     * A future simplification can replace the latch with a direct
+     * (last_clean - last_degraded) calculation once last_degraded is
+     * consistently available.
+     */
+    if (is_primary()) {
+      const int64_t num_degraded  = info.stats.stats.sum.num_objects_degraded;
+      const int64_t num_misplaced = info.stats.stats.sum.num_objects_misplaced;
+      const int64_t num_recovered = info.stats.stats.sum.num_objects_recovered;
+      const bool is_vulnerable =
+        (info.stats.state & (PG_STATE_DEGRADED | PG_STATE_UNDERSIZED)) ||
+        num_degraded > 0 || num_misplaced > 0;
+
+      if (is_vulnerable) {
+        // Latch the failure entry point on the first publish after a new
+        // failure; last_change captures when the state transition occurred.
+        if (rebuild_start_time == utime_t()) {
+          const bool new_failure =
+            info.stats.last_clean == utime_t() ||
+            info.stats.last_change > info.stats.last_clean;
+          if (new_failure) {
+            rebuild_start_time = info.stats.last_change;
+            rebuild_base_recovered = num_recovered;
+            rebuild_had_redundancy_loss =
+              (num_degraded > 0 || num_misplaced > 0);
+            psdout(15) << "rebuild-stats: latched failure start for "
+                       << info.pgid << " at " << rebuild_start_time << dendl;
+          }
+        }
+      } else if (rebuild_start_time != utime_t()) {
+        // PG recovered — record rebuild time if this was a genuine event.
+        const int64_t delta_recovered = num_recovered - rebuild_base_recovered;
+        const utime_t rebuild_dur  = now - rebuild_start_time;
+
+        if (rebuild_dur.to_msec() > 0 &&
+            (delta_recovered > 0 || rebuild_had_redundancy_loss)) {
+          PerfCounters &perf = pl->get_peering_perf();
+          perf.tinc(rs_pg_rebuild_duration, rebuild_dur);
+
+          const uint64_t rebuild_secs = (uint64_t)rebuild_dur.sec();
+          if (rebuild_secs > perf.get(rs_pg_rebuild_max_secs)) {
+            perf.set(rs_pg_rebuild_max_secs, rebuild_secs);
+          }
+          const uint64_t cur_min = perf.get(rs_pg_rebuild_min_secs);
+          if (cur_min == 0 || rebuild_secs < cur_min) {
+            perf.set(rs_pg_rebuild_min_secs, rebuild_secs);
+          }
+          psdout(15) << "rebuild-stats: recorded rebuild for " << info.pgid
+                     << " duration=" << rebuild_dur
+                     << " delta_recovered=" << delta_recovered << dendl;
+        }
+        // reset for the next event
+        rebuild_start_time = utime_t();
+        rebuild_base_recovered = 0;
+        rebuild_had_redundancy_loss = false;
+      }
+    }
+
     // check if the PG is vulnerable
     if (info.stats.state & (PG_STATE_DEGRADED|PG_STATE_UNDERSIZED)) {
       // set last_degraded only if we are entering a new
diff --git a/src/osd/PeeringState.h b/src/osd/PeeringState.h
index ae426060aba..94ee299cdfb 100644
--- a/src/osd/PeeringState.h
+++ b/src/osd/PeeringState.h
@@ -1579,6 +1579,17 @@ public:
   bool backfill_reserved = false;
   bool backfill_reserving = false;
 
+  /**
+   * Per-PG latch state for rebuild time tracking. Cleared after each
+   * completed rebuild event is recorded in the perf counters.
+   * The state is also cleared in clear_primary_state() so that an interval
+   * change or role transition (primary -> replica) does not carry a stale
+   * start time or baseline recovered count into a future interval.
+   */
+  utime_t rebuild_start_time;
+  int64_t rebuild_base_recovered = 0;
+  bool rebuild_had_redundancy_loss = false;
+
   PeeringMachine machine;
 
   void update_osdmap_ref(OSDMapRef newmap) {
@@ -1680,6 +1691,17 @@ public:
     }
   }
 
+  // Accessors for the per-PG rebuild latch state.
+  utime_t get_rebuild_start_time() const {
+    return rebuild_start_time;
+  }
+  int64_t get_rebuild_base_recovered() const {
+    return rebuild_base_recovered;
+  }
+  bool get_rebuild_had_redundancy_loss() const {
+    return rebuild_had_redundancy_loss;
+  }
+
 private:
   bool check_prior_readable_down_osds(const OSDMapRef& map);
 
diff --git a/src/osd/osd_perf_counters.cc b/src/osd/osd_perf_counters.cc
index 51d98431713..2fc483131ec 100644
--- a/src/osd/osd_perf_counters.cc
+++ b/src/osd/osd_perf_counters.cc
@@ -542,6 +542,15 @@ PerfCounters *build_recoverystate_perf(CephContext *cct) {
   rs_perf.add_u64_counter(rs_update_stats_invalidated, "update_stats_invalidated", "Number of times pg stats received invalidations during stats updates");
   rs_perf.add_u64_counter(rs_append_log_stats_invalidated, "append_log_stats_invalidated", "Number of times pg stats received invalidations when appending new log entries");
   rs_perf.add_u64_counter(rs_merge_log_stats_invalidated, "merge_log_stats_invalidated", "Number of times pg stats received invalidations during merging of log entries");
+  rs_perf.add_time_avg(rs_pg_rebuild_duration, "pg_rebuild_duration",
+    "Average PG rebuild duration on this OSD (primary role only)",
+    NULL, PerfCountersBuilder::PRIO_USEFUL);
+  rs_perf.add_u64(rs_pg_rebuild_max_secs, "pg_rebuild_max_secs",
+    "Max PG rebuild duration seen on this OSD in seconds (primary role only)",
+    NULL, PerfCountersBuilder::PRIO_USEFUL);
+  rs_perf.add_u64(rs_pg_rebuild_min_secs, "pg_rebuild_min_secs",
+    "Min PG rebuild duration seen on this OSD in seconds (primary role only)",
+    NULL, PerfCountersBuilder::PRIO_USEFUL);
 
   return rs_perf.create_perf_counters();
 }
diff --git a/src/osd/osd_perf_counters.h b/src/osd/osd_perf_counters.h
index 4b56b79215d..c8fccb95152 100644
--- a/src/osd/osd_perf_counters.h
+++ b/src/osd/osd_perf_counters.h
@@ -263,6 +263,9 @@ enum {
   rs_update_stats_invalidated,
   rs_append_log_stats_invalidated,
   rs_merge_log_stats_invalidated,
+  rs_pg_rebuild_duration,
+  rs_pg_rebuild_max_secs,
+  rs_pg_rebuild_min_secs,
   rs_last,
 };
 
diff --git a/src/test/osd/TestPeeringState.cc b/src/test/osd/TestPeeringState.cc
index f77898f16a0..067456f4261 100644
--- a/src/test/osd/TestPeeringState.cc
+++ b/src/test/osd/TestPeeringState.cc
@@ -29,7 +29,9 @@
   * PrimaryLogPG to allow this to be tested.
   */
 
+#include <chrono>
 #include <memory>
+#include <thread>
 #include <gtest/gtest.h>
 #include "test/osd/MockConnection.h"
 #include "test/osd/MockECRecPred.h"
@@ -1185,6 +1187,15 @@ protected:
     }
   }
 
+  // Helper - call prepare_stats_for_publish on an OSD, discarding the result.
+  // Passing nullopt forces the publish branch unconditionally (no last-known
+  // stat to compare against), which is what we need to drive the latch logic.
+  void call_prepare_stats(int osd)
+  {
+    get_ps(osd)->prepare_stats_for_publish(
+      std::nullopt, object_stat_collection_t());
+  }
+
   // ============================================================================
   // GTest - Setup and Teardown
   // ============================================================================
@@ -2181,6 +2192,337 @@ TEST_F(PeeringStateTest, Issue74218) {
   verify_logs();
 }
 
+// ============================================================================
+// Rebuild Stats Perf Counter Tests
+//
+// These tests exercise the latch logic in prepare_stats_for_publish() that
+// feeds rs_pg_rebuild_duration, rs_pg_rebuild_max_secs, and
+// rs_pg_rebuild_min_secs.
+// Design notes:
+//   - call_prepare_stats(osd) passes nullopt so the publish branch always
+//     runs, which is needed to drive the latch even when stats are unchanged.
+//   - A 10 ms sleep between the latch call and the clean call ensures
+//     rebuild_dur.to_msec() > 0 so the record is committed.
+//   - rebuild_secs = (uint64_t)rebuild_dur.sec(), so sub-second rebuilds
+//     leave pg_rebuild_max_secs and pg_rebuild_min_secs at 0.  Those gauges
+//     are verified only for their mutual ordering (min <= max); absolute
+//     values are verified via pg_rebuild_duration.sum which is in nanoseconds.
+// ============================================================================
+
+// One complete failure+recovery cycle does the following:
+// - Swaps acting[slot] from old_osd to new_osd.
+// - Peers, latches (via call_prepare_stats while degraded).
+// - Sleeps sleep_ms to guarantee non-zero rebuild duration.
+// - Recovers, verifies clean, calls prepare_stats to commit the record.
+//
+// Acting set BEFORE call: [..., old_osd, ...] at position slot.
+// Acting set AFTER call:  [..., new_osd, ...] at position slot.
+// The old_osd PeeringState is left in osd_peeringstate (may go stale).
+
+// ============================================================================
+// Test 1: Primary OSD records all four counters after a recovery event.
+// ============================================================================
+TEST_F(PeeringStateTest, RebuildStatsLatchAndCount) {
+  dout(0) << "== RebuildStatsLatchAndCount ==" << dendl;
+  test_create_peering_state();
+  test_init();
+  test_event_initialize();
+  eversion_t v = test_append_log_entry();
+  test_peering();
+  verify_all_active_clean(v, eversion_t());
+
+  // Stamp last_clean on the primary so new_failure detection works later.
+  call_prepare_stats(acting_primary);
+
+  PerfCounters *perf = get_listener(acting_primary)->recoverystate_perf;
+
+  // Introduce a missing replica: swap acting[1] from OSD 1 to OSD 9.
+  // OSD 9 starts fresh and needs the log entry recovered to it.
+  modify_up_acting(1, 9);
+  test_create_peering_state(9, 1);
+  test_init(9);
+  test_event_initialize(9);
+  test_peering();
+  // PG is now active+recovering+degraded on the primary.
+
+  // Latch: first prepare_stats call while vulnerable.
+  // The state-change block sets info.stats.last_change = now and
+  // rebuild_start_time = last_change inside the latch branch.
+  call_prepare_stats(acting_primary);
+
+  // Sleep so that rebuild_dur.to_msec() > 0 when the record fires.
+  std::this_thread::sleep_for(std::chrono::milliseconds(10));
+
+  // Drive the PG back to active+clean.
+  test_begin_peer_recover(9, 1);
+  test_on_peer_recover(9, 1, v);
+  test_recover_got(9, v);
+  test_object_recovered();
+  test_event_all_replicas_recovered();
+  verify_all_active_clean(v, eversion_t());
+
+  // Record: prepare_stats while clean fires the else branch, commits record.
+  call_prepare_stats(acting_primary);
+
+  // pg_rebuild_duration: at least one sample with a positive nanosecond sum.
+  auto [sum_ns, count] = perf->get_tavg_ns(rs_pg_rebuild_duration);
+  EXPECT_GE(count, 1u);
+  EXPECT_GT(sum_ns, 0u);
+
+  // max/min gauges track whole seconds; sub-second rebuilds leave both at 0.
+  // The key invariant is that min never exceeds max.
+  EXPECT_LE(perf->get(rs_pg_rebuild_min_secs), perf->get(rs_pg_rebuild_max_secs));
+}
+
+// ============================================================================
+// Test 2: A replica OSD never records anything, even when the PG is degraded.
+// ============================================================================
+TEST_F(PeeringStateTest, RebuildStatsReplicaSkips) {
+  dout(0) << "== RebuildStatsReplicaSkips ==" << dendl;
+  test_create_peering_state();
+  test_init();
+  test_event_initialize();
+  eversion_t v = test_append_log_entry();
+  test_peering();
+  verify_all_active_clean(v, eversion_t());
+
+  call_prepare_stats(acting_primary);
+
+  modify_up_acting(1, 9);
+  test_create_peering_state(9, 1);
+  test_init(9);
+  test_event_initialize(9);
+  test_peering();
+
+  // OSD 9 is the recovering replica. prepare_stats_for_publish() is only
+  // called by the primary.
+  PerfCounters *replica_perf = get_listener(9)->recoverystate_perf;
+
+  // Drive the primary through the full latch+record cycle.
+  call_prepare_stats(acting_primary);   // latch fires on primary
+  std::this_thread::sleep_for(std::chrono::milliseconds(10));
+
+  test_begin_peer_recover(9, 1);
+  test_on_peer_recover(9, 1, v);
+  test_recover_got(9, v);
+  test_object_recovered();
+  test_event_all_replicas_recovered();
+  verify_all_active_clean(v, eversion_t());
+
+  call_prepare_stats(acting_primary);   // record fires on primary
+
+  // All rebuild counters on the replica must remain at their initial values.
+  EXPECT_EQ(replica_perf->get(rs_pg_rebuild_max_secs), 0u);
+  EXPECT_EQ(replica_perf->get(rs_pg_rebuild_min_secs), 0u);
+  auto [sum_ns, count] =
+    replica_perf->get_tavg_ns(rs_pg_rebuild_duration);
+  EXPECT_EQ(count, 0u);
+  EXPECT_EQ(sum_ns, 0u);
+
+  // Primary must have recorded the event (sanity-check the other side).
+  auto [primary_sum_ns, primary_count] =
+    get_listener(acting_primary)->recoverystate_perf->get_tavg_ns(rs_pg_rebuild_duration);
+  EXPECT_GE(primary_count, 1u);
+}
+
+// ============================================================================
+// Test 3: A second prepare_stats call while still vulnerable does not
+// overwrite the already-latched start time or double-record the event.
+// ============================================================================
+TEST_F(PeeringStateTest, RebuildStatsNoDoubleLatch) {
+  dout(0) << "== RebuildStatsNoDoubleLatch ==" << dendl;
+  test_create_peering_state();
+  test_init();
+  test_event_initialize();
+  eversion_t v = test_append_log_entry();
+  test_peering();
+  verify_all_active_clean(v, eversion_t());
+
+  call_prepare_stats(acting_primary);
+
+  modify_up_acting(1, 9);
+  test_create_peering_state(9, 1);
+  test_init(9);
+  test_event_initialize(9);
+  test_peering();
+
+  PerfCounters *perf = get_listener(acting_primary)->recoverystate_perf;
+
+  // First vulnerable call — latch fires (rebuild_start_time set).
+  call_prepare_stats(acting_primary);
+
+  // Second vulnerable call while still degraded. The latch is guarded by
+  // rebuild_start_time == utime_t(), which is now false, so the start
+  // time is not overwritten and no record is emitted.
+  call_prepare_stats(acting_primary);
+
+  // Nothing recorded yet (PG still degraded): duration avgcount must be 0.
+  {
+    auto [sum_ns, count] = perf->get_tavg_ns(rs_pg_rebuild_duration);
+    EXPECT_EQ(count, 0u);
+  }
+
+  // Now complete the recovery and verify exactly one event is recorded.
+  std::this_thread::sleep_for(std::chrono::milliseconds(10));
+  test_begin_peer_recover(9, 1);
+  test_on_peer_recover(9, 1, v);
+  test_recover_got(9, v);
+  test_object_recovered();
+  test_event_all_replicas_recovered();
+  verify_all_active_clean(v, eversion_t());
+  call_prepare_stats(acting_primary);
+
+  {
+    auto [sum_ns, count] = perf->get_tavg_ns(rs_pg_rebuild_duration);
+    EXPECT_EQ(count, 1u);
+  }
+}
+
+// ============================================================================
+// Test 4: Two sequential failure+recovery cycles accumulate independently.
+//
+// Cycle 1: acting[1] = 9   (OSD 1 -> OSD 9)
+// Cycle 2: acting[2] = 8   (OSD 2 -> OSD 8, while OSD 9 stays in slot 1)
+//
+// Using distinct slots avoids having to bring OSD 9 stale mid-test while
+// still exercising two independent latch+record sequences on the same primary.
+// ============================================================================
+TEST_F(PeeringStateTest, RebuildStatsCountAccumulates) {
+  dout(0) << "== RebuildStatsCountAccumulates ==" << dendl;
+  test_create_peering_state();
+  test_init();
+  test_event_initialize();
+  eversion_t v = test_append_log_entry();
+  test_peering();
+  verify_all_active_clean(v, eversion_t());
+
+  PerfCounters *perf = get_listener(acting_primary)->recoverystate_perf;
+
+  // ---- Cycle 1: replace acting[1] with OSD 9 ----
+  call_prepare_stats(acting_primary);     // stamp last_clean
+
+  modify_up_acting(1, 9);
+  test_create_peering_state(9, 1);
+  test_init(9);
+  test_event_initialize(9);
+  test_peering();
+  // active+recovering: OSD 9 needs recovery.
+
+  call_prepare_stats(acting_primary);     // latch fires
+  std::this_thread::sleep_for(std::chrono::milliseconds(10));
+
+  test_begin_peer_recover(9, 1);
+  test_on_peer_recover(9, 1, v);
+  test_recover_got(9, v);
+  test_object_recovered();
+  test_event_all_replicas_recovered();
+  verify_all_active_clean(v, eversion_t());
+  // Flush share_pg_info messages queued by cycle 1's Clean so they are
+  // delivered to the current replicas now, not stale during cycle 2.
+  dispatch_all();
+  call_prepare_stats(acting_primary);     // record fires
+
+  {
+    auto [sum_ns, count] = perf->get_tavg_ns(rs_pg_rebuild_duration);
+    EXPECT_EQ(count, 1u);
+  }
+
+  // ---- Cycle 2: replace acting[2] with OSD 8 ----
+  // OSD 9 remains in slot 1; OSD 8 joins as a fresh replica at slot 2.
+  call_prepare_stats(acting_primary);     // stamp last_clean for cycle 2
+
+  modify_up_acting(2, 8);
+  test_create_peering_state(8, 2);
+  test_init(8);
+  test_event_initialize(8);
+  test_peering();
+  // active+recovering: OSD 8 needs the object recovered to it.
+
+  call_prepare_stats(acting_primary);     // second latch fires
+  std::this_thread::sleep_for(std::chrono::milliseconds(10));
+
+  test_begin_peer_recover(8, 2);
+  test_on_peer_recover(8, 2, v);
+  test_recover_got(8, v);
+  test_object_recovered();
+  test_event_all_replicas_recovered();
+  verify_all_active_clean(v, eversion_t());
+  call_prepare_stats(acting_primary);     // second record fires
+
+  // Both events must appear in the duration avgcount.
+  auto [sum_ns, count] = perf->get_tavg_ns(rs_pg_rebuild_duration);
+  EXPECT_EQ(count, 2u);
+  EXPECT_GT(sum_ns, 0u);
+
+  // min <= max invariant must hold across both events.
+  EXPECT_LE(perf->get(rs_pg_rebuild_min_secs), perf->get(rs_pg_rebuild_max_secs));
+}
+
+// ============================================================================
+// Test 5: Latch is discarded when the OSD loses its primary role mid-rebuild.
+//
+// If a new interval begins while rebuild_start_time is set and the OSD
+// transitions from primary to stray, clear_primary_state() must discard the
+// stale latch so no spurious rebuild event is emitted for a recovery that the
+// OSD no longer owns.
+// ============================================================================
+TEST_F(PeeringStateTest, RebuildStatsLatchClearedOnRoleChange) {
+  dout(0) << "== RebuildStatsLatchClearedOnRoleChange ==" << dendl;
+  test_create_peering_state();
+  test_init();
+  test_event_initialize();
+  eversion_t v = test_append_log_entry();
+  test_peering();
+  verify_all_active_clean(v, eversion_t());
+
+  // Record last_clean so the new_failure guard inside the latch is satisfied.
+  call_prepare_stats(acting_primary);        // acting_primary = OSD 0
+
+  // --- Phase 1: degrade the PG while OSD 0 is still primary. ---
+  // Replace acting[1] (OSD 1) with OSD 9; OSD 9 needs recovery.
+  modify_up_acting(1, 9);
+  test_create_peering_state(9, 1);
+  test_init(9);
+  test_event_initialize(9);
+  test_peering();
+  // PG is now active+recovering+degraded; OSD 0 remains primary.
+
+  PerfCounters *perf_osd0 = get_listener(0)->recoverystate_perf;
+
+  // Latch: first prepare_stats call while vulnerable sets rebuild_start_time
+  // on OSD 0.
+  call_prepare_stats(acting_primary);
+  ASSERT_NE(get_ps(0)->get_rebuild_start_time(), utime_t())
+      << "latch must be set before role change";
+
+  // --- Phase 2: change the primary before recovery completes. ---
+  // Swap acting[0] from OSD 0 to OSD 7. OSD 0 leaves the acting set
+  // entirely and becomes a stray; OSD 7 takes over as primary.
+  modify_up_acting(0, 7);
+  acting_primary = 7;
+  up_primary = 7;
+  test_create_peering_state(7, 0);
+  test_init(7);
+  test_event_initialize(7);
+
+  // advance_map on OSD 0: the new acting set excludes OSD 0, so
+  // should_restart_peering()->start_peering_interval()->clear_primary_state()
+  // resets the three latch variables.
+  test_event_advance_map();
+
+  // --- Phase 3: verify latch is cleared on the old primary. ---
+  EXPECT_EQ(get_ps(0)->get_rebuild_start_time(), utime_t());
+  EXPECT_EQ(get_ps(0)->get_rebuild_base_recovered(), 0);
+  EXPECT_FALSE(get_ps(0)->get_rebuild_had_redundancy_loss());
+
+  // No rebuild record must have been emitted: the latch was discarded, not
+  // fired. A spurious emission here would record a duration spanning a
+  // recovery that OSD 0 did not complete.
+  auto [sum_ns, count] = perf_osd0->get_tavg_ns(rs_pg_rebuild_duration);
+  EXPECT_EQ(count, 0u);
+  EXPECT_EQ(sum_ns,  0u);
+}
+
 // ============================================================================
 // Main
 // ============================================================================

From 70a122f21b07ffefa38984411965655f68c12cd4 Mon Sep 17 00:00:00 2001
From: Sagar Gopale <sagar.gopale@ibm.com>
Date: Mon, 1 Jun 2026 17:59:40 +0530
Subject: [PATCH 352/596] mgr/dashboard: fix-user-creation-validation

Fixes: https://tracker.ceph.com/issues/77024

Signed-off-by: Sagar Gopale <sagar.gopale@ibm.com>
---
 .../frontend/cypress/e2e/ui/user-mgmt.po.ts   |   9 +
 .../auth/user-form/user-form.component.html   | 328 ++++++++++--------
 .../user-form/user-form.component.spec.ts     |  39 +++
 .../auth/user-form/user-form.component.ts     |  25 +-
 .../src/app/shared/forms/cd-validators.ts     |   3 +-
 5 files changed, 254 insertions(+), 150 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/ui/user-mgmt.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/ui/user-mgmt.po.ts
index 76679806a88..eb79748be1d 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/ui/user-mgmt.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/ui/user-mgmt.po.ts
@@ -16,6 +16,15 @@ export class UserMgmtPageHelper extends PageHelper {
     cy.get('#name').type(name);
     cy.get('#email').type(email);
 
+    // Select role 'administrator'
+    cy.get('cds-combo-box[type="multi"] input.cds--text-input').first().click({ force: true });
+    cy.get('.cds--list-box__menu.cds--multi-select').should('be.visible');
+    cy.get('.cds--list-box__menu.cds--multi-select .cds--checkbox-label')
+      .contains('.cds--checkbox-label-text', 'administrator', { matchCase: false })
+      .parent()
+      .click({ force: true });
+    cy.get('body').type('{esc}');
+
     // Click the create button and wait for user to be made
     cy.get('[data-testid=submitBtn]').click();
     this.getFirstTableCell(username).should('exist');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
index ea8f8aed077..843c08e5b5c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
@@ -1,73 +1,82 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}">
+<div cdsCol [columnNumbers]="{ md: 4 }">
   <ng-container *cdFormLoading="loading">
-    <form #frm="ngForm"
-          #formDir="ngForm"
-          [formGroup]="userForm"
-          novalidate>
-      <div i18n="form title"
-           class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}
+    <form #frm="ngForm" #formDir="ngForm" [formGroup]="userForm" novalidate>
+      <div i18n="form title" class="form-header">
+        {{ action | titlecase }} {{ resource | upperFirst }}
       </div>
       <!-- UserName -->
       <div class="form-item">
-        <cds-text-label labelInputID="username"
-                        cdRequiredField="Username"
-                        [invalid]="!userForm.controls.username.valid && userForm.controls.username.dirty"
-                        [invalidText]="usernameError"
-                        i18n>Username
-          <input cdsText
-                 placeholder="Username..."
-                 i18n-placeholder
-                 id="username"
-                 formControlName="username"
-                 [invalid]="!userForm.controls.username.valid && userForm.controls.username.dirty"
-                 autofocus
-                 ngbTooltip="White spaces at the beginning and end will be trimmed"
-                 i18n-ngbTooltip
-                 cdTrim>
+        <cds-text-label
+          labelInputID="username"
+          cdRequiredField="Username"
+          [invalid]="!userForm.controls.username.valid && userForm.controls.username.dirty"
+          [invalidText]="usernameError"
+          i18n
+          >Username
+          <input
+            cdsText
+            placeholder="Username..."
+            i18n-placeholder
+            id="username"
+            formControlName="username"
+            [invalid]="!userForm.controls.username.valid && userForm.controls.username.dirty"
+            autofocus
+            ngbTooltip="White spaces at the beginning and end will be trimmed"
+            i18n-ngbTooltip
+            cdTrim
+          />
         </cds-text-label>
         <ng-template #usernameError>
           <span *ngIf="userForm.showError('username', formDir, 'required')">
-            <ng-container i18n>
-             This field is required.
-            </ng-container>
+            <ng-container i18n> This field is required. </ng-container>
           </span>
           <span *ngIf="userForm.showError('username', formDir, 'notUnique')">
-            <ng-container i18n>
-              The username already exists.
-            </ng-container>
+            <ng-container i18n> The username already exists. </ng-container>
           </span>
         </ng-template>
       </div>
       <!-- Password -->
       <div class="form-item">
-        <cds-password-label labelInputID="password"
-                            label="Password..."
-                            [invalid]="!userForm.controls.password.valid && userForm.controls.password.dirty"
-                            [invalidText]="passwordError"
-                            i18n>Password
-        <cd-helper *ngIf="passwordPolicyHelpText.length > 0"
-                    class="text-pre-wrap"
-                    html="{{ passwordPolicyHelpText }}">
-        </cd-helper>
-        <input cdsPassword
-               type="password"
-               placeholder="Password..."
-               id="password"
-               autocomplete="new-password"
-               formControlName="password"
-               >
+        <cds-password-label
+          labelInputID="password"
+          label="Password..."
+          [cdRequiredField]="mode !== userFormMode.editing && !isSSO ? 'Password' : ''"
+          [invalid]="!userForm.controls.password.valid && userForm.controls.password.dirty"
+          [invalidText]="passwordError"
+          i18n
+          >Password
+          <cd-helper
+            *ngIf="passwordPolicyHelpText.length > 0"
+            class="text-pre-wrap"
+            html="{{ passwordPolicyHelpText }}"
+          >
+          </cd-helper>
+          <input
+            cdsPassword
+            type="password"
+            placeholder="Password..."
+            id="password"
+            autocomplete="new-password"
+            formControlName="password"
+          />
         </cds-password-label>
         <ng-template #passwordError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('password', formDir, 'match')"
-                i18n>Password confirmation doesn't match the password.
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('password', formDir, 'match')"
+            i18n
+            >Password confirmation doesn't match the password.
           </span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('password', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('password', formDir, 'passwordPolicy')">
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('password', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('password', formDir, 'passwordPolicy')"
+          >
             {{ passwordValuation }}
           </span>
         </ng-template>
@@ -75,142 +84,171 @@
 
       <!-- Confirm password -->
       <div class="form-item">
-        <cds-password-label labelInputID="confirmpassword"
-                            label="Confirm password..."
-                            [invalid]="!userForm.controls.confirmpassword.valid && userForm.controls.confirmpassword.dirty"
-                            [invalidText]="confirmpasswordError"
-                            i18n> Confirm password
-          <input cdsPassword
-                 type="password"
-                 placeholder="Confirm password..."
-                 id="confirmpassword"
-                 formControlName="confirmpassword">
+        <cds-password-label
+          labelInputID="confirmpassword"
+          label="Confirm password..."
+          [cdRequiredField]="mode !== userFormMode.editing && !isSSO ? 'Confirm password' : ''"
+          [invalid]="
+            !userForm.controls.confirmpassword.valid && userForm.controls.confirmpassword.dirty
+          "
+          [invalidText]="confirmpasswordError"
+          i18n
+        >
+          Confirm password
+          <input
+            cdsPassword
+            type="password"
+            placeholder="Confirm password..."
+            id="confirmpassword"
+            formControlName="confirmpassword"
+          />
         </cds-password-label>
         <ng-template #confirmpasswordError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('confirmpassword', formDir, 'match')"
-                i18n>Password confirmation doesn't match the password.</span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('confirmpassword', formDir, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('confirmpassword', formDir, 'match')"
+            i18n
+            >Password confirmation doesn't match the password.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('confirmpassword', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
       <!-- Password expiration date -->
-      <div class="form-item"
-           *ngIf="!authStorageService.isSSO()">
-        <cds-text-label  [ngClass]="{'required': pwdExpirationSettings.pwdExpirationSpan > 0}">{{'Password Expiration Date'}}
-          <cd-helper class="text-pre-wrap"
-                     *ngIf="pwdExpirationSettings.pwdExpirationSpan == 0">
+      <div class="form-item" *ngIf="!isSSO">
+        <cds-text-label [ngClass]="{ required: pwdExpirationSettings.pwdExpirationSpan > 0 }"
+          >{{ 'Password Expiration Date' }}
+          <cd-helper class="text-pre-wrap" *ngIf="pwdExpirationSettings.pwdExpirationSpan == 0">
             <span>
-                The Dashboard setting defining the expiration interval of
-                passwords is currently set to <strong>0</strong>. This means
-                if a date is set, the user password will only expire once.
+              The Dashboard setting defining the expiration interval of passwords is currently set
+              to <strong>0</strong>. This means if a date is set, the user password will only expire
+              once.
             </span>
-            <span>Consider configuring the Dashboard setting
-              <a routerLink="/mgr-modules/edit/dashboard"
-                 class="alert-link">USER_PWD_EXPIRATION_SPAN</a>
-                  in order to let passwords expire periodically.
+            <span
+              >Consider configuring the Dashboard setting
+              <a routerLink="/mgr-modules/edit/dashboard" class="alert-link"
+                >USER_PWD_EXPIRATION_SPAN</a
+              >
+              in order to let passwords expire periodically.
             </span>
           </cd-helper>
-        <cd-date-time-picker [control]="userForm.get('pwdExpirationDate')"
-                             placeHolder="Password expiration date"
-                             [hasTime]="false"
-                             [defaultDate]="passwordexp"
-                             i18n-name
-                             >
-        </cd-date-time-picker>
-      </cds-text-label>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('pwdExpirationDate', formDir, 'required')"
-              i18n>This field is required.
+          <cd-date-time-picker
+            [control]="userForm.get('pwdExpirationDate')"
+            placeHolder="Password expiration date"
+            [hasTime]="false"
+            [defaultDate]="passwordexp"
+            i18n-name
+          >
+          </cd-date-time-picker>
+        </cds-text-label>
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('pwdExpirationDate', formDir, 'required')"
+          i18n
+          >This field is required.
         </span>
       </div>
       <!--Full Name-->
       <div class="form-item">
-        <cds-text-label for="name"
-                        i18n> Full Name
-          <input cdsText
-                 type="text"
-                 placeholder="Full Name..."
-                 id="name"
-                 formControlName="name">
+        <cds-text-label for="name" i18n>
+          Full Name
+          <input cdsText type="text" placeholder="Full Name..." id="name" formControlName="name" />
         </cds-text-label>
       </div>
       <!-- Email -->
       <div class="form-item">
-        <cds-text-label for="email"
-                        [invalid]="!userForm.controls.email.valid && userForm.controls.email.dirty"
-                        [invalidText]="emailError"
-                        i18n>
+        <cds-text-label
+          for="email"
+          [invalid]="!userForm.controls.email.valid && userForm.controls.email.dirty"
+          [invalidText]="emailError"
+          i18n
+        >
           Email
-          <input cdsText
-                 type="email"
-                 placeholder="Email..."
-                 id="email"
-                 formControlName="email">
+          <input cdsText type="email" placeholder="Email..." id="email" formControlName="email" />
         </cds-text-label>
         <ng-template #emailError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('email', formDir, 'email')"
-                i18n>Invalid email.
+          <span class="invalid-feedback" *ngIf="userForm.showError('email', formDir, 'email')" i18n
+            >Invalid email.
           </span>
         </ng-template>
       </div>
       <!-- Roles -->
-      <div class="form-item"
-           *ngIf="allRoles">
-        <cds-combo-box label="Roles"
-                       type="multi"
-                       selectionFeedback="top-after-reopen"
-                       for="roles"
-                       formControlName="roles"
-                       id="roles"
-                       placeholder="Select Roles..."
-                       i18n-placeholder
-                       [appendInline]="true"
-                       [items]="allRoles"
-                       itemValueKey="name"
-                       i18n>
+      <div class="form-item" *ngIf="allRoles">
+        <cds-combo-box
+          label="Roles"
+          type="multi"
+          selectionFeedback="top-after-reopen"
+          for="roles"
+          formControlName="roles"
+          id="roles"
+          placeholder="Select Roles..."
+          i18n-placeholder
+          [appendInline]="true"
+          [items]="allRoles"
+          itemValueKey="name"
+          [cdRequiredField]="!isSSO ? 'Roles' : ''"
+          [invalid]="!userForm.controls.roles.valid && userForm.controls.roles.dirty"
+          [invalidText]="rolesError"
+          i18n
+        >
           <cds-dropdown-list></cds-dropdown-list>
         </cds-combo-box>
+        <ng-template #rolesError>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('roles', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+        </ng-template>
       </div>
       <!-- Enabled -->
-      <div class="form-item"
-           *ngIf="!isCurrentUser()">
-        <cds-checkbox id="enabled"
-                      formControlName="enabled"
-                      name="enabled"
-                      i18n>Enabled
+      <div class="form-item" *ngIf="!isCurrentUser()">
+        <cds-checkbox id="enabled" formControlName="enabled" name="enabled" i18n
+          >Enabled
         </cds-checkbox>
       </div>
       <!-- Force change password -->
-      <div class="form-item"
-           *ngIf="!isCurrentUser() && !authStorageService.isSSO()">
-        <cds-checkbox id="pwdUpdateRequired"
-                      formControlName="pwdUpdateRequired"
-                      name="pwdUpdateRequired"
-                      i18n>User must change password at next login
+      <div class="form-item" *ngIf="!isCurrentUser() && !isSSO">
+        <cds-checkbox
+          id="pwdUpdateRequired"
+          formControlName="pwdUpdateRequired"
+          name="pwdUpdateRequired"
+          i18n
+          >User must change password at next login
         </cds-checkbox>
       </div>
       <!--Submit Button-->
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="userForm"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                            wrappingClass="text-right">
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="userForm"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        wrappingClass="text-right"
+      >
       </cd-form-button-panel>
     </form>
   </ng-container>
 </div>
 
 <ng-template #removeSelfUserReadUpdatePermissionTpl>
-  <p><strong i18n>You are about to remove "user read / update" permissions from your own user.</strong></p>
-  <br>
+  <p>
+    <strong i18n
+      >You are about to remove "user read / update" permissions from your own user.</strong
+    >
+  </p>
+  <br />
   <p i18n>If you continue, you will no longer be able to add or remove roles from any user.</p>
 
   <ng-container i18n>Are you sure you want to continue?</ng-container>
 </ng-template>
 
 <ng-template #popContent>
-  <cd-date-time-picker [control]="userForm.get('pwdExpirationDate')"
-                       [hasTime]="false"></cd-date-time-picker>
+  <cd-date-time-picker
+    [control]="userForm.get('pwdExpirationDate')"
+    [hasTime]="false"
+  ></cd-date-time-picker>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.spec.ts
index 13034934486..850dff1c5a7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.spec.ts
@@ -62,12 +62,16 @@ describe('UserFormComponent', () => {
     form = component.userForm;
     httpTesting = TestBed.inject(HttpTestingController);
     userService = TestBed.inject(UserService);
+    spyOn(userService, 'validatePassword').and.returnValue(
+      of({ valid: true, credits: 10, valuation: 'strong' })
+    );
     modalService = TestBed.inject(ModalCdsService);
     router = TestBed.inject(Router);
     spyOn(router, 'navigate');
     fixture.detectChanges();
     const notify = TestBed.inject(NotificationService);
     spyOn(notify, 'show');
+    spyOn(TestBed.inject(AuthStorageService), 'isSSO').and.returnValue(false);
     formHelper = new FormHelper(form);
   });
 
@@ -109,6 +113,34 @@ describe('UserFormComponent', () => {
       formHelper.expectErrorChange('email', 'aaa', 'email');
     });
 
+    it('should validate password required in create mode', () => {
+      formHelper.expectErrorChange('password', '', 'required');
+      formHelper.expectValidChange('password', 'pass123');
+    });
+
+    it('should validate confirmpassword required in create mode', () => {
+      formHelper.setValue('password', 'pass123');
+      formHelper.expectErrorChange('confirmpassword', '', 'required');
+      formHelper.expectValidChange('confirmpassword', 'pass123');
+    });
+
+    it('should validate roles required in create mode', () => {
+      formHelper.expectErrorChange('roles', [], 'required');
+      formHelper.expectValidChange('roles', ['administrator']);
+    });
+
+    it('should not validate password and roles if SSO is enabled', () => {
+      component.isSSO = true;
+      component.createForm();
+      form = component.userForm;
+      form.get('password').updateValueAndValidity();
+      expect(form.get('password').valid).toBeTruthy();
+      form.get('confirmpassword').updateValueAndValidity();
+      expect(form.get('confirmpassword').valid).toBeTruthy();
+      form.get('roles').updateValueAndValidity();
+      expect(form.get('roles').valid).toBeTruthy();
+    });
+
     it('should set mode', () => {
       expect(component.mode).toBeUndefined();
     });
@@ -210,6 +242,13 @@ describe('UserFormComponent', () => {
       expect(component.mode).toBe('editing');
     });
 
+    it('should not validate password required in edit mode', () => {
+      form.get('password').setValue('');
+      expect(form.get('password').valid).toBeTruthy();
+      form.get('confirmpassword').setValue('');
+      expect(form.get('confirmpassword').valid).toBeTruthy();
+    });
+
     it('should alert if user is removing needed role permission', () => {
       spyOn(TestBed.inject(AuthStorageService), 'getUsername').and.callFake(() => user.username);
       let modalBodyTpl = null;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
index c67dbad95d3..6ee9b986525 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
@@ -58,6 +58,7 @@ export class UserFormComponent extends CdForm implements OnInit {
   pwdExpirationFormat = 'YYYY-MM-DD';
   selectedRole: string[];
   passwordexp: boolean = false;
+  isSSO = false;
   constructor(
     private authService: AuthService,
     private authStorageService: AuthStorageService,
@@ -74,6 +75,7 @@ export class UserFormComponent extends CdForm implements OnInit {
   ) {
     super();
     this.resource = $localize`user`;
+    this.isSSO = this.authStorageService.isSSO();
     this.createForm();
     this.messages = new SelectMessages({ empty: $localize`There are no roles.` });
   }
@@ -92,8 +94,12 @@ export class UserFormComponent extends CdForm implements OnInit {
         name: [''],
         password: [
           '',
-          [],
-
+          [
+            (control) =>
+              this.mode === this.userFormMode.editing || this.isSSO
+                ? null
+                : Validators.required(control)
+          ],
           [
             CdValidators.passwordPolicy(
               this.userService,
@@ -107,10 +113,18 @@ export class UserFormComponent extends CdForm implements OnInit {
             )
           ]
         ],
-        confirmpassword: [''],
+        confirmpassword: [
+          '',
+          [
+            (control) =>
+              this.mode === this.userFormMode.editing || this.isSSO
+                ? null
+                : Validators.required(control)
+          ]
+        ],
         pwdExpirationDate: [''],
         email: ['', [CdValidators.email]],
-        roles: [[]],
+        roles: [[], [(control) => (this.isSSO ? null : Validators.required(control))]],
         enabled: [true, [Validators.required]],
         pwdUpdateRequired: [true]
       },
@@ -129,6 +143,8 @@ export class UserFormComponent extends CdForm implements OnInit {
       this.action = this.actionLabels.CREATE;
       this.passwordexp = true;
     }
+    this.userForm.get('password').updateValueAndValidity();
+    this.userForm.get('confirmpassword').updateValueAndValidity();
 
     const observables = [this.roleService.list(), this.settingsService.getStandardSettings()];
     observableForkJoin(observables).subscribe(
@@ -149,6 +165,7 @@ export class UserFormComponent extends CdForm implements OnInit {
             expirationDate.add(this.pwdExpirationSettings.pwdExpirationSpan, 'day');
             pwdExpirationDateField.setValue(expirationDate.format(this.pwdExpirationFormat));
             pwdExpirationDateField.setValidators([Validators.required]);
+            pwdExpirationDateField.updateValueAndValidity();
           }
 
           this.loadingReady();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts
index 997564a983c..288151c24fa 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts
@@ -349,7 +349,8 @@ export class CdValidators {
         return null;
       }
       if (ctrl1.value !== ctrl2.value) {
-        ctrl2.setErrors({ match: true });
+        const errors = _.merge({}, ctrl2.errors, { match: true });
+        ctrl2.setErrors(errors);
       } else {
         const hasError = ctrl2.hasError('match');
         if (hasError) {

From 617f55391339c1c94259de63a6e7886fcb11ca31 Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Tue, 9 Jun 2026 14:04:53 -0400
Subject: [PATCH 353/596] qa/dnsmasq: use managed dnsmasq instead of editing
 resolv.conf

this task was manually editing /etc/resolv.conf to configure dns names.
on ubuntu 24, these changes were getting clobbered by NetworkManager or
systemd service restarts

instead, manage dnsmasq depending on host distro. rpm-based distros use
NetworkManager's dnsmasq plugin, while deb-based distros use
systemd-resolved to point at the local dnsmasq

Fixes: https://tracker.ceph.com/issues/76961

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 qa/tasks/dnsmasq.py | 117 +++++++++++++++++++++++++++-----------------
 1 file changed, 73 insertions(+), 44 deletions(-)

diff --git a/qa/tasks/dnsmasq.py b/qa/tasks/dnsmasq.py
index ea6b0bbf5ac..13e44bbfe1f 100644
--- a/qa/tasks/dnsmasq.py
+++ b/qa/tasks/dnsmasq.py
@@ -66,47 +66,75 @@ def replace_resolv(remote, path, table):
         remote.run(args=['rm', path])
 
 @contextlib.contextmanager
-def setup_dnsmasq(remote, testdir, cnames, table):
-    """ configure dnsmasq on the given remote, adding each cname given """
-    log.info('Configuring dnsmasq on remote %s..', remote.name)
-    # banner first
-    dnsmasq = ["# This file is generated by dnsmasq teuthology task", ""]
-
-    # lookup previously used nameservers for the remote in the table
-    servers = table.get(remote.name, {}).get('nameserver', None)
-    if servers:
-        log.info('Reusing nameservers: %s', servers)
-        dnsmasq.extend(f"server={a}" for a in servers)
-    else:
-        log.info('No predefined nameservers found, using 8.8.x.x')
-        dnsmasq.extend(["server=8.8.8.8", "server=8.8.4.4"])
-
+def configure_dnsmasq(remote, path, cnames):
+    """
+    configure dnsmasq on the given remote, adding each cname given
+    """
+    data = """# This file is generated by dnsmasq teuthology task
+"""
     for cname, ip_address in cnames.items():
-        dnsmasq.append(f"address=/{cname}/{ip_address}")
-
-    dnsmasq.append('')
-    dnsmasq_data = "\n".join(dnsmasq)
-    dnsmasq_path = '/etc/dnsmasq.d/ceph'
-    remote.sudo_write_file(dnsmasq_path, dnsmasq_data)
-    # restore selinux context if necessary
-    remote.run(args=['sudo', 'restorecon', dnsmasq_path], check_status=False)
-
-    # restart dnsmasq
-    remote.run(args=['sudo', 'systemctl', 'restart', 'dnsmasq'])
-    # some pause is required for dnsmasq to become operational,
-    # though, trying to just print out the config now instead
-    remote.sh(f'cat {dnsmasq_path}')
-    # verify dns name is set
-    remote.run(args=['ping', '-c', '4', next(iter(cnames.keys()))])
+        data += f"address=/.{cname}/{ip_address}\n"
 
+    remote.sudo_write_file(path, data)
+    remote.run(args=['sudo', 'restorecon', path], check_status=False)
+    remote.sh(f'cat {path}')
     try:
         yield
     finally:
-        log.info('Removing dnsmasq configuration from remote %s..', remote.name)
-        # remove /etc/dnsmasq.d/ceph
-        remote.run(args=['sudo', 'rm', dnsmasq_path])
-        # restart dnsmasq
-        remote.run(args=['sudo', 'systemctl', 'restart', 'dnsmasq'])
+        remote.run(args=['sudo', 'rm', path])
+
+@contextlib.contextmanager
+def configure_network_manager(remote):
+    """
+    enable NetworkManager's dnsmasq plugin
+    """
+    path = '/etc/NetworkManager/conf.d/dnsmasq.conf'
+    data = """# This file is generated by dnsmasq teuthology task
+[main]
+dns=dnsmasq
+"""
+    remote.sudo_write_file(path, data)
+    remote.run(args=['sudo', 'restorecon', path], check_status=False)
+    remote.run(args=['sudo', 'systemctl', 'restart', 'NetworkManager'])
+    remote.sh(f'cat {path}')
+    try:
+        yield
+    finally:
+        remote.run(args=['sudo', 'rm', path])
+        remote.run(args=['sudo', 'systemctl', 'restart', 'NetworkManager'])
+
+@contextlib.contextmanager
+def configure_systemd_resolved(remote, cnames):
+    """
+    configure systemd-resolved to search for listed cnames through dnsmasq at 127.0.0.1
+    """
+    dir = '/etc/systemd/resolved.conf.d'
+    remote.sh(f'sudo mkdir {dir}')
+
+    path = dir + '/dnsmasq.conf'
+    domains = ' '.join([f'~{cname}' for cname in cnames.keys()])
+    data = f"""# This file is generated by dnsmasq teuthology task
+[Resolve]
+DNS=127.0.0.1
+Domains={domains}
+"""
+    remote.sudo_write_file(path, data)
+    remote.run(args=['sudo', 'restorecon', path], check_status=False)
+    remote.run(args=['sudo', 'systemctl', 'restart', 'dnsmasq'])
+    remote.run(args=['sudo', 'systemctl', 'restart', 'systemd-resolved'])
+    remote.sh(f'cat {path}')
+    try:
+        yield
+    finally:
+        remote.run(args=['sudo', 'rm', path])
+        remote.run(args=['sudo', 'systemctl', 'restart', 'systemd-resolved'])
+
+@contextlib.contextmanager
+def test_dns_names(remote, cnames):
+    """ verify that ping can resolve the configured names """
+    for cname in cnames.keys():
+        remote.run(args=['ping', '-c', '4', cname])
+    yield
 
 @contextlib.contextmanager
 def task(ctx, config):
@@ -168,18 +196,19 @@ def task(ctx, config):
 
         remote_names[remote] = names
 
-    testdir = misc.get_testdir(ctx)
-    resolv_bak = '/'.join((testdir, 'resolv.bak'))
-    resolv_tmp = '/'.join((testdir, 'resolv.tmp'))
-    resolv_tbl = dict() # { remote.name -> nameserver list } lookup table
-
     # run subtasks for each unique remote
     subtasks = []
     for remote, cnames in remote_names.items():
         subtasks.extend([ lambda r=remote: install_dnsmasq(r) ])
-        subtasks.extend([ lambda r=remote: backup_resolv(r, resolv_bak, resolv_tbl) ])
-        subtasks.extend([ lambda r=remote: replace_resolv(r, resolv_tmp, resolv_tbl) ])
-        subtasks.extend([ lambda r=remote, cn=cnames: setup_dnsmasq(r, testdir, cn, resolv_tbl) ])
+        if remote.os.package_type == 'rpm':
+            path = '/etc/NetworkManager/dnsmasq.d/ceph.conf'
+            subtasks.extend([ lambda r=remote, p=path, cn=cnames: configure_dnsmasq(r, p, cn) ])
+            subtasks.extend([ lambda r=remote: configure_network_manager(r) ])
+        else:
+            path = '/etc/dnsmasq.d/ceph.conf'
+            subtasks.extend([ lambda r=remote, p=path, cn=cnames: configure_dnsmasq(r, p, cn) ])
+            subtasks.extend([ lambda r=remote, cn=cnames: configure_systemd_resolved(r, cn) ])
+        subtasks.extend([ lambda r=remote, cn=cnames: test_dns_names(r, cn) ])
 
     with contextutil.nested(*subtasks):
         yield

From 591ce1234b4fa646a0c2edadea5a6a245d2e4c44 Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Tue, 9 Jun 2026 14:13:23 -0400
Subject: [PATCH 354/596] qa/dnsmasq: remove unused backup/replace_resolv()

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 qa/tasks/dnsmasq.py | 35 -----------------------------------
 1 file changed, 35 deletions(-)

diff --git a/qa/tasks/dnsmasq.py b/qa/tasks/dnsmasq.py
index 13e44bbfe1f..4e44c8aa74d 100644
--- a/qa/tasks/dnsmasq.py
+++ b/qa/tasks/dnsmasq.py
@@ -3,7 +3,6 @@ Task for dnsmasq configuration
 """
 import contextlib
 import logging
-import re
 
 from teuthology import misc
 from teuthology.exceptions import ConfigError
@@ -31,40 +30,6 @@ def install_dnsmasq(remote):
         if existing is None:
             packaging.remove_package('dnsmasq', remote)
 
-@contextlib.contextmanager
-def backup_resolv(remote, path, table):
-    """
-    Store a backup of resolv.conf in the testdir and restore it after the task.
-    Reserve 'nameserver' values per remote name in lookup 'table' for future use.
-    """
-    resolv_conf = remote.sh(f"cat /etc/resolv.conf | tee {path}")
-    nameserver_re = re.compile(r'\s*nameserver\s+([^\s]*)')
-    for line in resolv_conf.split('\n'):
-        if m := nameserver_re.match(line):
-            table.setdefault(remote.name, {}).setdefault('nameserver', []).append(m[1])
-    try:
-        yield
-    finally:
-        # restore with 'cp' to avoid overwriting its security context
-        remote.run(args=['sudo', 'cp', path, '/etc/resolv.conf'])
-        remote.run(args=['rm', path])
-
-@contextlib.contextmanager
-def replace_resolv(remote, path, table):
-    """
-    Update resolv.conf to point the nameserver at localhost.
-    """
-    remote.write_file(path, "nameserver 127.0.0.1\n")
-    try:
-        # install it
-        if remote.os.package_type == "rpm":
-            # for centos ovh resolv.conf has immutable attribute set
-            remote.run(args=['sudo', 'chattr', '-i', '/etc/resolv.conf'], check_status=False)
-        remote.run(args=['sudo', 'cp', path, '/etc/resolv.conf'])
-        yield
-    finally:
-        remote.run(args=['rm', path])
-
 @contextlib.contextmanager
 def configure_dnsmasq(remote, path, cnames):
     """

From af88cf4531ef5f83a7a4f588813d5d28ea47aeb6 Mon Sep 17 00:00:00 2001
From: Laura Flores <lflores@ibm.com>
Date: Mon, 22 Jun 2026 10:18:50 -0500
Subject: [PATCH 355/596] doc: update email address for Laura Flores

Changed Red Hat email to IBM.

Signed-off-by: Laura Flores <lflores@ibm.com>
---
 doc/governance.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/governance.rst b/doc/governance.rst
index 0675d8fcd85..97df9d767d2 100644
--- a/doc/governance.rst
+++ b/doc/governance.rst
@@ -99,7 +99,7 @@ Current Members
  * Joseph Mundackal <jmundackal@bloomberg.net>
  * Josh Durgin <jdurgin@redhat.com>
  * João Eduardo Luis <joao@clyso.com>
- * Laura Flores <lflores@redhat.com>
+ * Laura Flores <lflores@ibm.com>
  * Mark Nelson <mark.nelson@clyso.com>
  * Matan Breizman <mbreizma@redhat.com>
  * Matt Benjamin <mbenjami@redhat.com>

From 1651ec9a0f65d566b7677b539e3802fdeee15496 Mon Sep 17 00:00:00 2001
From: Yonatan Zaken <yzaken@redhat.com>
Date: Mon, 22 Jun 2026 20:02:39 +0300
Subject: [PATCH 356/596] ceph.in: reject -w/--watch flags when used with
 subcommands

parse_known_args() silently consumes -w and all --watch-* flags
before subcommand arguments reach the command validator. When a
user ran "ceph orch ps -w", the watch handler entered cluster log
streaming mode while discarding the subcommand entirely, with no
error or indication that the orch ps command was ignored.

Add a guard at the entry of the watch handler: if any watch flag
is active and childargs is non-empty, print "Invalid command:
unused arguments: [...]" and return EINVAL. This matches the
behaviour already seen when -s/--status is combined with a
subcommand.

Assisted-by: Claude:claude-4.6-sonnet
Fixes: https://tracker.ceph.com/issues/77121
Signed-off-by: Yonatan Zaken <yzaken@redhat.com>
---
 src/ceph.in | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/ceph.in b/src/ceph.in
index 4694da29db5..3379de7488e 100755
--- a/src/ceph.in
+++ b/src/ceph.in
@@ -1131,6 +1131,9 @@ def main():
             elif k != "watch_channel":
                 level = k.replace('watch_', '')
     if level:
+        if childargs:
+            print('Invalid command: unused arguments: {0}'.format(childargs), file=sys.stderr)
+            return errno.EINVAL
         # an awfully simple callback
         def watch_cb(arg, line, channel, name, who, stamp_sec, stamp_nsec, seq, level, msg):
             # Filter on channel

From 868d20182a08685265e0b5831bad703fdcf3189b Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Thu, 11 Jun 2026 18:46:45 -0400
Subject: [PATCH 357/596] test/rgw: Include s3-tests in Ceph repo

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/test/rgw/s3-tests/LICENSE                 |    19 +
 src/test/rgw/s3-tests/README.rst              |   120 +
 src/test/rgw/s3-tests/pytest.ini              |    60 +
 src/test/rgw/s3-tests/requirements.txt        |    13 +
 src/test/rgw/s3-tests/s3tests.conf.SAMPLE     |   181 +
 src/test/rgw/s3-tests/s3tests/__init__.py     |     0
 src/test/rgw/s3-tests/s3tests/common.py       |   301 +
 .../s3-tests/s3tests/functional/__init__.py   |   883 +
 .../rgw/s3-tests/s3tests/functional/iam.py    |   199 +
 .../rgw/s3-tests/s3tests/functional/policy.py |    46 +
 .../s3tests/functional/rgw_interactive.py     |    92 +
 .../s3tests/functional/test_headers.py        |   578 +
 .../s3-tests/s3tests/functional/test_iam.py   |  3007 +++
 .../s3-tests/s3tests/functional/test_s3.py    | 20779 ++++++++++++++++
 .../s3tests/functional/test_s3control.py      |    90 +
 .../s3tests/functional/test_s3select.py       |  1685 ++
 .../s3-tests/s3tests/functional/test_sns.py   |   186 +
 .../s3-tests/s3tests/functional/test_sts.py   |  2073 ++
 .../s3-tests/s3tests/functional/test_utils.py |     9 +
 .../rgw/s3-tests/s3tests/functional/utils.py  |    47 +
 src/test/rgw/s3-tests/setup.py                |    22 +
 src/test/rgw/s3-tests/tox.ini                 |     9 +
 22 files changed, 30399 insertions(+)
 create mode 100644 src/test/rgw/s3-tests/LICENSE
 create mode 100644 src/test/rgw/s3-tests/README.rst
 create mode 100644 src/test/rgw/s3-tests/pytest.ini
 create mode 100644 src/test/rgw/s3-tests/requirements.txt
 create mode 100644 src/test/rgw/s3-tests/s3tests.conf.SAMPLE
 create mode 100644 src/test/rgw/s3-tests/s3tests/__init__.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/common.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/__init__.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/iam.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/policy.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/rgw_interactive.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_headers.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_iam.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_s3.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_s3control.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_s3select.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_sns.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_sts.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/test_utils.py
 create mode 100644 src/test/rgw/s3-tests/s3tests/functional/utils.py
 create mode 100644 src/test/rgw/s3-tests/setup.py
 create mode 100644 src/test/rgw/s3-tests/tox.ini

diff --git a/src/test/rgw/s3-tests/LICENSE b/src/test/rgw/s3-tests/LICENSE
new file mode 100644
index 00000000000..10996d2f3a1
--- /dev/null
+++ b/src/test/rgw/s3-tests/LICENSE
@@ -0,0 +1,19 @@
+Copyright (c) 2011 New Dream Network, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/src/test/rgw/s3-tests/README.rst b/src/test/rgw/s3-tests/README.rst
new file mode 100644
index 00000000000..0713aeeae99
--- /dev/null
+++ b/src/test/rgw/s3-tests/README.rst
@@ -0,0 +1,120 @@
+========================
+ S3 compatibility tests
+========================
+
+This is a set of unofficial Amazon AWS S3 compatibility
+tests, that can be useful to people implementing software
+that exposes an S3-like API. The tests use the Boto2 and Boto3 libraries.
+
+The tests use the Tox tool. To get started, ensure you have the ``tox``
+software installed; e.g. on Debian/Ubuntu::
+
+	sudo apt-get install tox
+
+You will need to create a configuration file with the location of the
+service and two different credentials. A sample configuration file named
+``s3tests.conf.SAMPLE`` has been provided in this repo. This file can be
+used to run the s3 tests on a Ceph cluster started with vstart.
+
+Once you have that file copied and edited, you can run the tests with::
+
+	S3TEST_CONF=your.conf tox
+
+You can specify which directory of tests to run::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional
+
+You can specify which file of tests to run::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional/test_s3.py
+
+You can specify which test to run::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional/test_s3.py::test_bucket_list_empty
+
+Some tests have attributes set based on their current reliability and
+things like AWS not enforcing their spec stricly. You can filter tests
+based on their attributes::
+
+	S3TEST_CONF=aws.conf tox -- -m 'not fails_on_aws'
+
+Most of the tests have both Boto3 and Boto2 versions. Tests written in
+Boto2 are in the ``s3tests`` directory. Tests written in Boto3 are
+located in the ``s3test_boto3`` directory.
+
+You can run only the boto3 tests with::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional
+
+========================
+ STS compatibility tests
+========================
+
+This section contains some basic tests for the AssumeRole, GetSessionToken and AssumeRoleWithWebIdentity API's. The test file is located under ``s3tests/functional``.
+
+To run the STS tests, the vstart cluster should be started with the following parameter (in addition to any parameters already used with it)::
+
+        vstart.sh -o rgw_sts_key=abcdefghijklmnop -o rgw_s3_auth_use_sts=true
+
+Note that the ``rgw_sts_key`` can be set to anything that is 128 bits in length.
+After the cluster is up the following command should be executed::
+
+      radosgw-admin caps add --tenant=testx --uid="9876543210abcdef0123456789abcdef0123456789abcdef0123456789abcdef" --caps="roles=*"
+
+You can run only the sts tests (all the three API's) with::
+
+        S3TEST_CONF=your.conf tox -- s3tests/functional/test_sts.py
+
+You can filter tests based on the attributes. There is a attribute named ``test_of_sts`` to run AssumeRole and GetSessionToken tests and ``webidentity_test`` to run the AssumeRoleWithWebIdentity tests. If you want to execute only ``test_of_sts`` tests you can apply that filter as below::
+
+        S3TEST_CONF=your.conf tox -- -m test_of_sts s3tests/functional/test_sts.py
+
+For running ``webidentity_test`` you'll need have Keycloak running.
+
+In order to run any STS test you'll need to add "iam" section to the config file. For further reference on how your config file should look check ``s3tests.conf.SAMPLE``.
+
+========================
+ IAM policy tests
+========================
+
+This is a set of IAM policy tests.
+This section covers tests for user policies such as Put, Get, List, Delete, user policies with s3 actions, conflicting user policies etc
+These tests uses Boto3 libraries. Tests are written in the ``s3test_boto3`` directory.
+
+These iam policy tests uses two users with profile name "iam" and "s3 alt" as mentioned in s3tests.conf.SAMPLE.
+If Ceph cluster is started with vstart, then above two users will get created as part of vstart with same access key, secrete key etc as mentioned in s3tests.conf.SAMPLE.
+Out of those two users, "iam" user is with capabilities --caps=user-policy=* and "s3 alt" user is without capabilities.
+Adding above capabilities to "iam" user is also taken care by vstart (If Ceph cluster is started with vstart).
+
+To run these tests, create configuration file with section "iam" and "s3 alt" refer s3tests.conf.SAMPLE.
+Once you have that configuration file copied and edited, you can run all the tests with::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional/test_iam.py
+
+You can also specify specific test to run::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional/test_iam.py::test_put_user_policy
+
+Some tests have attributes set such as "fails_on_rgw".
+You can filter tests based on their attributes::
+
+	S3TEST_CONF=your.conf tox -- s3tests/functional/test_iam.py -m 'not fails_on_rgw'
+
+========================
+ Bucket logging tests
+========================
+
+Ceph has extensions for the bucket logging S3 API. For the tests to cover these extensions, the following file: `examples/rgw/boto3/service-2.sdk-extras.json` from the Ceph repo,
+should be copied to the: `~/.aws/models/s3/2006-03-01/` directory on the machine where the tests are run.
+If the file is not present, the tests will still run, but the extension tests will be skipped. In this case, the bucket logging object roll time must be decreased manually from its default of
+300 seconds to 5 seconds::
+
+  vstart.sh -o rgw_bucket_logging_object_roll_time=5
+
+Then the tests can be run with::
+
+  S3TEST_CONF=your.conf tox -- -m 'bucket_logging'
+
+To run the only bucket logging tests that do not need extension of rollover time, use::
+
+  S3TEST_CONF=your.conf tox -- -m 'bucket_logging and not fails_without_logging_rollover'
diff --git a/src/test/rgw/s3-tests/pytest.ini b/src/test/rgw/s3-tests/pytest.ini
new file mode 100644
index 00000000000..b3c3465e8b8
--- /dev/null
+++ b/src/test/rgw/s3-tests/pytest.ini
@@ -0,0 +1,60 @@
+[pytest]
+markers =
+    abac_test
+    appendobject
+    auth_aws2
+    auth_aws4
+    auth_common
+    bucket_policy
+    bucket_encryption
+    bucket_logging
+    bucket_logging_cleanup
+    conditional_write
+    fails_without_logging_rollover
+    checksum
+    cloud_transition
+    cloud_restore
+    target_by_bucket
+    encryption
+    fails_on_aws
+    fails_on_dbstore
+    fails_on_dho
+    fails_on_mod_proxy_fcgi
+    fails_on_rgw
+    fails_on_s3
+    fails_with_subdomain
+    group
+    group_policy
+    iam_account
+    iam_cross_account
+    iam_role
+    iam_tenant
+    iam_user
+    lifecycle
+    lifecycle_expiration
+    lifecycle_transition
+    list_objects_v2
+    object_lock
+    object_ownership
+    role_policy
+    session_policy
+    s3control
+    s3select
+    s3website
+    s3website_routing_rules
+    s3website_redirect_location
+    sns
+    sse_s3
+    storage_class
+    tagging
+    test_of_sts
+    token_claims_trust_policy_test
+    token_principal_tag_role_policy_test
+    token_request_tag_trust_policy_test
+    token_resource_tags_test
+    token_role_tags_test
+    token_tag_keys_test
+    user_policy
+    versioning
+    webidentity_test
+    delete_marker
diff --git a/src/test/rgw/s3-tests/requirements.txt b/src/test/rgw/s3-tests/requirements.txt
new file mode 100644
index 00000000000..0b8e452f21e
--- /dev/null
+++ b/src/test/rgw/s3-tests/requirements.txt
@@ -0,0 +1,13 @@
+PyYAML
+boto3 >=1.0.0
+botocore
+munch >=2.0.0
+# 0.14 switches to libev, that means bootstrap needs to change too
+gevent >=1.0
+isodate >=0.4.4
+requests >=2.23.0
+pytz
+httplib2
+lxml
+pytest
+tox
diff --git a/src/test/rgw/s3-tests/s3tests.conf.SAMPLE b/src/test/rgw/s3-tests/s3tests.conf.SAMPLE
new file mode 100644
index 00000000000..5a4c4b4f625
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests.conf.SAMPLE
@@ -0,0 +1,181 @@
+[DEFAULT]
+## this section is just used for host, port and bucket_prefix
+
+# host set for rgw in vstart.sh
+host = localhost
+
+# port set for rgw in vstart.sh
+port = 8000
+
+## say "False" to disable TLS
+is_secure = False
+
+## say "False" to disable SSL Verify
+ssl_verify = False
+
+[fixtures]
+## all the buckets created will start with this prefix;
+## {random} will be filled with random characters to pad
+## the prefix to 30 characters long, and avoid collisions
+bucket prefix = yournamehere-{random}-
+
+# all the iam account resources (users, roles, etc) created
+# will start with this name prefix
+iam name prefix = s3-tests-
+
+# all the iam account resources (users, roles, etc) created
+# will start with this path prefix
+iam path prefix = /s3-tests/
+
+[s3 main]
+# main display_name set in vstart.sh
+display_name = M. Tester
+
+# main user_idname set in vstart.sh
+user_id = testid
+
+# main email set in vstart.sh
+email = tester@ceph.com
+
+# zonegroup api_name for bucket location
+api_name = default
+
+## main AWS access key
+access_key = 0555b35654ad1656d804
+
+## main AWS secret key
+secret_key = h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q==
+
+## replace with key id obtained when secret is created, or delete if KMS not tested
+#kms_keyid = 01234567-89ab-cdef-0123-456789abcdef
+
+## Storage classes
+#storage_classes = "LUKEWARM, FROZEN"
+
+## Lifecycle debug interval (default: 10)
+#lc_debug_interval = 20
+## Restore debug interval (default: 100)
+#rgw_restore_debug_interval = 60
+#rgw_restore_processor_period = 60
+
+[s3 alt]
+# alt display_name set in vstart.sh
+display_name = john.doe
+## alt email set in vstart.sh
+email = john.doe@example.com
+
+# alt user_id set in vstart.sh
+user_id = 56789abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234
+
+# alt AWS access key set in vstart.sh
+access_key = NOPQRSTUVWXYZABCDEFG
+
+# alt AWS secret key set in vstart.sh
+secret_key = nopqrstuvwxyzabcdefghijklmnabcdefghijklm
+
+#[s3 cloud]
+## to run the testcases with "cloud_transition" for transition
+## and "cloud_restore" for restore attribute.
+## Note: the waiting time may have to tweaked depending on
+## the I/O latency to the cloud endpoint.
+
+## host set for cloud endpoint
+# host = localhost
+
+## port set for cloud endpoint
+# port = 8001
+
+## say "False" to disable TLS
+# is_secure = False
+
+## cloud endpoint credentials
+# access_key = 0555b35654ad1656d804
+# secret_key = h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q==
+
+## storage class configured as cloud tier on local rgw server
+# cloud_storage_class = CLOUDTIER
+
+## Below are optional -
+
+## Above configured cloud storage class config options
+# retain_head_object = false
+# allow_read_through = false    # change it to enable read_through
+# read_through_restore_days = 2
+# target_storage_class = Target_SC
+# target_path = cloud-bucket
+# target_by_bucket = false    # when true, each source bucket gets its own target bucket
+# target_by_bucket_prefix = rgwx-${zonegroup}-${storage_class}-${bucket}  # template for per-bucket target names
+
+## another regular storage class to test multiple transition rules,
+# storage_class = S1
+
+[s3 tenant]
+# tenant display_name set in vstart.sh
+display_name = testx$tenanteduser
+
+# tenant user_id set in vstart.sh
+user_id = testx$9876543210abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+
+# tenant AWS secret key set in vstart.sh
+access_key = HIJKLMNOPQRSTUVWXYZA
+
+# tenant AWS secret key set in vstart.sh
+secret_key = opqrstuvwxyzabcdefghijklmnopqrstuvwxyzab
+
+# tenant email set in vstart.sh
+email = tenanteduser@example.com
+
+# tenant name
+tenant = testx
+
+#following section needs to be added for all sts-tests
+[iam]
+#used for iam operations in sts-tests
+#email from vstart.sh
+email = s3@example.com
+
+#user_id from vstart.sh
+user_id = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+
+#access_key from vstart.sh
+access_key = ABCDEFGHIJKLMNOPQRST
+
+#secret_key vstart.sh
+secret_key = abcdefghijklmnopqrstuvwxyzabcdefghijklmn
+
+#display_name from vstart.sh
+display_name = youruseridhere
+
+# iam account root user for iam_account tests
+[iam root]
+access_key = AAAAAAAAAAAAAAAAAAaa
+secret_key = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+account_id = RGW11111111111111111
+user_id = RGW11111111111111111
+email = account1@ceph.com
+
+# iam account root user in a different account than [iam root]
+[iam alt root]
+access_key = BBBBBBBBBBBBBBBBBBbb
+secret_key = bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+account_id = RGW22222222222222222
+user_id = RGW22222222222222222
+email = account2@ceph.com
+
+#following section needs to be added when you want to run Assume Role With Webidentity test
+[webidentity]
+#used for assume role with web identity test in sts-tests
+#all parameters will be obtained from ceph/qa/tasks/keycloak.py
+token=<access_token>
+
+aud=<obtained after introspecting token>
+
+sub=<obtained after introspecting token>
+
+azp=<obtained after introspecting token>
+
+user_token=<access token for a user, with attribute Department=[Engineering, Marketing>]
+
+thumbprint=<obtained from x509 certificate>
+
+KC_REALM=<name of the realm>
diff --git a/src/test/rgw/s3-tests/s3tests/__init__.py b/src/test/rgw/s3-tests/s3tests/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/test/rgw/s3-tests/s3tests/common.py b/src/test/rgw/s3-tests/s3tests/common.py
new file mode 100644
index 00000000000..987ec6b631b
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/common.py
@@ -0,0 +1,301 @@
+import boto.s3.connection
+import munch
+import itertools
+import os
+import random
+import string
+import yaml
+import re
+from lxml import etree
+
+from doctest import Example
+from lxml.doctestcompare import LXMLOutputChecker
+
+s3 = munch.Munch()
+config = munch.Munch()
+prefix = ''
+
+bucket_counter = itertools.count(1)
+key_counter = itertools.count(1)
+
+def choose_bucket_prefix(template, max_len=30):
+    """
+    Choose a prefix for our test buckets, so they're easy to identify.
+
+    Use template and feed it more and more random filler, until it's
+    as long as possible but still below max_len.
+    """
+    rand = ''.join(
+        random.choice(string.ascii_lowercase + string.digits)
+        for c in range(255)
+        )
+
+    while rand:
+        s = template.format(random=rand)
+        if len(s) <= max_len:
+            return s
+        rand = rand[:-1]
+
+    raise RuntimeError(
+        'Bucket prefix template is impossible to fulfill: {template!r}'.format(
+            template=template,
+            ),
+        )
+
+def nuke_bucket(bucket):
+    try:
+        bucket.set_canned_acl('private')
+        # TODO: deleted_cnt and the while loop is a work around for rgw
+        # not sending the
+        deleted_cnt = 1
+        while deleted_cnt:
+            deleted_cnt = 0
+            for key in bucket.list():
+                print('Cleaning bucket {bucket} key {key}'.format(
+                    bucket=bucket,
+                    key=key,
+                    ))
+                key.set_canned_acl('private')
+                key.delete()
+                deleted_cnt += 1
+        bucket.delete()
+    except boto.exception.S3ResponseError as e:
+        # TODO workaround for buggy rgw that fails to send
+        # error_code, remove
+        if (e.status == 403
+            and e.error_code is None
+            and e.body == ''):
+            e.error_code = 'AccessDenied'
+        if e.error_code != 'AccessDenied':
+            print('GOT UNWANTED ERROR', e.error_code)
+            raise
+        # seems like we're not the owner of the bucket; ignore
+        pass
+
+def nuke_prefixed_buckets():
+    for name, conn in list(s3.items()):
+        print('Cleaning buckets from connection {name}'.format(name=name))
+        for bucket in conn.get_all_buckets():
+            if bucket.name.startswith(prefix):
+                print('Cleaning bucket {bucket}'.format(bucket=bucket))
+                nuke_bucket(bucket)
+
+    print('Done with cleanup of test buckets.')
+
+def read_config(fp):
+    config = munch.Munch()
+    g = yaml.safe_load_all(fp)
+    for new in g:
+        config.update(munch.Munchify(new))
+    return config
+
+def connect(conf):
+    mapping = dict(
+        port='port',
+        host='host',
+        is_secure='is_secure',
+        access_key='aws_access_key_id',
+        secret_key='aws_secret_access_key',
+        )
+    kwargs = dict((mapping[k],v) for (k,v) in conf.items() if k in mapping)
+    #process calling_format argument
+    calling_formats = dict(
+        ordinary=boto.s3.connection.OrdinaryCallingFormat(),
+        subdomain=boto.s3.connection.SubdomainCallingFormat(),
+        vhost=boto.s3.connection.VHostCallingFormat(),
+        )
+    kwargs['calling_format'] = calling_formats['ordinary']
+    if 'calling_format' in conf:
+        raw_calling_format = conf['calling_format']
+        try:
+            kwargs['calling_format'] = calling_formats[raw_calling_format]
+        except KeyError:
+            raise RuntimeError(
+                'calling_format unknown: %r' % raw_calling_format
+                )
+    # TODO test vhost calling format
+    conn = boto.s3.connection.S3Connection(**kwargs)
+    return conn
+
+def setup():
+    global s3, config, prefix
+    s3.clear()
+    config.clear()
+
+    try:
+        path = os.environ['S3TEST_CONF']
+    except KeyError:
+        raise RuntimeError(
+            'To run tests, point environment '
+            + 'variable S3TEST_CONF to a config file.',
+            )
+    with file(path) as f:
+        config.update(read_config(f))
+
+    # These 3 should always be present.
+    if 's3' not in config:
+        raise RuntimeError('Your config file is missing the s3 section!')
+    if 'defaults' not in config.s3:
+        raise RuntimeError('Your config file is missing the s3.defaults section!')
+    if 'fixtures' not in config:
+        raise RuntimeError('Your config file is missing the fixtures section!')
+
+    template = config.fixtures.get('bucket prefix', 'test-{random}-')
+    prefix = choose_bucket_prefix(template=template)
+    if prefix == '':
+        raise RuntimeError("Empty Prefix! Aborting!")
+
+    defaults = config.s3.defaults
+    for section in list(config.s3.keys()):
+        if section == 'defaults':
+            continue
+
+        conf = {}
+        conf.update(defaults)
+        conf.update(config.s3[section])
+        conn = connect(conf)
+        s3[section] = conn
+
+    # WARNING! we actively delete all buckets we see with the prefix
+    # we've chosen! Choose your prefix with care, and don't reuse
+    # credentials!
+
+    # We also assume nobody else is going to use buckets with that
+    # prefix. This is racy but given enough randomness, should not
+    # really fail.
+    nuke_prefixed_buckets()
+
+def get_new_bucket(connection=None):
+    """
+    Get a bucket that exists and is empty.
+
+    Always recreates a bucket from scratch. This is useful to also
+    reset ACLs and such.
+    """
+    if connection is None:
+        connection = s3.main
+    name = '{prefix}{num}'.format(
+        prefix=prefix,
+        num=next(bucket_counter),
+        )
+    # the only way for this to fail with a pre-existing bucket is if
+    # someone raced us between setup nuke_prefixed_buckets and here;
+    # ignore that as astronomically unlikely
+    bucket = connection.create_bucket(name)
+    return bucket
+
+def teardown():
+    nuke_prefixed_buckets()
+
+def with_setup_kwargs(setup, teardown=None):
+    """Decorator to add setup and/or teardown methods to a test function::
+
+      @with_setup_args(setup, teardown)
+      def test_something():
+          " ... "
+
+    The setup function should return (kwargs) which will be passed to
+    test function, and teardown function.
+
+    Note that `with_setup_kwargs` is useful *only* for test functions, not for test
+    methods or inside of TestCase subclasses.
+    """
+    def decorate(func):
+        kwargs = {}
+
+        def test_wrapped(*args, **kwargs2):
+            k2 = kwargs.copy()
+            k2.update(kwargs2)
+            k2['testname'] = func.__name__
+            func(*args, **k2)
+
+        test_wrapped.__name__ = func.__name__
+
+        def setup_wrapped():
+            k = setup()
+            kwargs.update(k)
+            if hasattr(func, 'setup'):
+                func.setup()
+        test_wrapped.setup = setup_wrapped
+
+        if teardown:
+            def teardown_wrapped():
+                if hasattr(func, 'teardown'):
+                    func.teardown()
+                teardown(**kwargs)
+
+            test_wrapped.teardown = teardown_wrapped
+        else:
+            if hasattr(func, 'teardown'):
+                test_wrapped.teardown = func.teardown()
+        return test_wrapped
+    return decorate
+
+# Demo case for the above, when you run test_gen():
+# _test_gen will run twice,
+# with the following stderr printing
+# setup_func {'b': 2}
+# testcase ('1',) {'b': 2, 'testname': '_test_gen'}
+# teardown_func {'b': 2}
+# setup_func {'b': 2}
+# testcase () {'b': 2, 'testname': '_test_gen'}
+# teardown_func {'b': 2}
+# 
+#def setup_func():
+#    kwargs = {'b': 2}
+#    print("setup_func", kwargs, file=sys.stderr)
+#    return kwargs
+#
+#def teardown_func(**kwargs):
+#    print("teardown_func", kwargs, file=sys.stderr)
+#
+#@with_setup_kwargs(setup=setup_func, teardown=teardown_func)
+#def _test_gen(*args, **kwargs):
+#    print("testcase", args, kwargs, file=sys.stderr)
+#
+#def test_gen():
+#    yield _test_gen, '1'
+#    yield _test_gen
+
+def trim_xml(xml_str):
+    p = etree.XMLParser(remove_blank_text=True)
+    elem = etree.XML(xml_str, parser=p)
+    return etree.tostring(elem)
+
+def normalize_xml(xml, pretty_print=True):
+    if xml is None:
+        return xml
+
+    root = etree.fromstring(xml.encode(encoding='ascii'))
+
+    for element in root.iter('*'):
+        if element.text is not None and not element.text.strip():
+            element.text = None
+        if element.text is not None:
+            element.text = element.text.strip().replace("\n", "").replace("\r", "")
+        if element.tail is not None and not element.tail.strip():
+            element.tail = None
+        if element.tail is not None:
+            element.tail = element.tail.strip().replace("\n", "").replace("\r", "")
+
+    # Sort the elements
+    for parent in root.xpath('//*[./*]'): # Search for parent elements
+          parent[:] = sorted(parent,key=lambda x: x.tag)
+
+    xmlstr = etree.tostring(root, encoding="utf-8", xml_declaration=True, pretty_print=pretty_print)
+    # there are two different DTD URIs
+    xmlstr = re.sub(r'xmlns="[^"]+"', 'xmlns="s3"', xmlstr)
+    xmlstr = re.sub(r'xmlns=\'[^\']+\'', 'xmlns="s3"', xmlstr)
+    for uri in ['http://doc.s3.amazonaws.com/doc/2006-03-01/', 'http://s3.amazonaws.com/doc/2006-03-01/']:
+        xmlstr = xmlstr.replace(uri, 'URI-DTD')
+    #xmlstr = re.sub(r'>\s+', '>', xmlstr, count=0, flags=re.MULTILINE)
+    return xmlstr
+
+def assert_xml_equal(got, want):
+    assert want is not None, 'Wanted XML cannot be None'
+    if got is None:
+        raise AssertionError('Got input to validate was None')
+    checker = LXMLOutputChecker()
+    if not checker.check_output(want, got, 0):
+        message = checker.output_difference(Example("", want), got, 0)
+        raise AssertionError(message)
diff --git a/src/test/rgw/s3-tests/s3tests/functional/__init__.py b/src/test/rgw/s3-tests/s3tests/functional/__init__.py
new file mode 100644
index 00000000000..5fcb1f47121
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/__init__.py
@@ -0,0 +1,883 @@
+import pytest
+import boto3
+from botocore import UNSIGNED
+from botocore.client import Config
+from botocore.exceptions import ClientError
+from botocore.handlers import disable_signing
+import configparser
+import datetime
+import time
+import os
+import munch
+import random
+import string
+import itertools
+import urllib3
+import re
+
+config = munch.Munch
+
+# this will be assigned by setup()
+prefix = None
+
+def get_prefix():
+    assert prefix is not None
+    return prefix
+
+def choose_bucket_prefix(template, max_len=30):
+    """
+    Choose a prefix for our test buckets, so they're easy to identify.
+
+    Use template and feed it more and more random filler, until it's
+    as long as possible but still below max_len.
+    """
+    rand = ''.join(
+        random.choice(string.ascii_lowercase + string.digits)
+        for c in range(255)
+        )
+
+    while rand:
+        s = template.format(random=rand)
+        if len(s) <= max_len:
+            return s
+        rand = rand[:-1]
+
+    raise RuntimeError(
+        'Bucket prefix template is impossible to fulfill: {template!r}'.format(
+            template=template,
+            ),
+        )
+
+def get_buckets_list(client=None, prefix=None):
+    if client == None:
+        client = get_client()
+    if prefix == None:
+        prefix = get_prefix()
+    response = client.list_buckets()
+    bucket_dicts = response['Buckets']
+    buckets_list = []
+    for bucket in bucket_dicts:
+        if prefix in bucket['Name']:
+            buckets_list.append(bucket['Name'])
+
+    return buckets_list
+
+def get_objects_list(bucket, client=None, prefix=None):
+    if client == None:
+        client = get_client()
+
+    if prefix == None:
+        response = client.list_objects(Bucket=bucket)
+    else:
+        response = client.list_objects(Bucket=bucket, Prefix=prefix)
+    objects_list = []
+
+    if 'Contents' in response:
+        contents = response['Contents']
+        for obj in contents:
+            objects_list.append(obj['Key'])
+
+    return objects_list
+
+# generator function that returns object listings in batches, where each
+# batch is a list of dicts compatible with delete_objects()
+def list_versions(client, bucket, batch_size):
+    kwargs = {'Bucket': bucket, 'MaxKeys': batch_size}
+    truncated = True
+    while truncated:
+        listing = client.list_object_versions(**kwargs)
+
+        kwargs['KeyMarker'] = listing.get('NextKeyMarker')
+        kwargs['VersionIdMarker'] = listing.get('NextVersionIdMarker')
+        truncated = listing['IsTruncated']
+
+        objs = listing.get('Versions', []) + listing.get('DeleteMarkers', [])
+        if len(objs):
+            yield [{'Key': o['Key'], 'VersionId': o['VersionId']} for o in objs]
+
+def nuke_bucket(client, bucket):
+    batch_size = 128
+    max_retain_date = None
+
+    # list and delete objects in batches
+    for objects in list_versions(client, bucket, batch_size):
+        delete = client.delete_objects(Bucket=bucket,
+                Delete={'Objects': objects, 'Quiet': True},
+                BypassGovernanceRetention=True)
+
+        # check for object locks on 403 AccessDenied errors
+        for err in delete.get('Errors', []):
+            if err.get('Code') != 'AccessDenied':
+                continue
+            try:
+                res = client.get_object_retention(Bucket=bucket,
+                        Key=err['Key'], VersionId=err['VersionId'])
+                retain_date = res['Retention']['RetainUntilDate']
+                if not max_retain_date or max_retain_date < retain_date:
+                    max_retain_date = retain_date
+            except ClientError:
+                pass
+
+    if max_retain_date:
+        # wait out the retention period (up to 60 seconds)
+        now = datetime.datetime.now(max_retain_date.tzinfo)
+        if max_retain_date > now:
+            delta = max_retain_date - now
+            if delta.total_seconds() > 60:
+                raise RuntimeError('bucket {} still has objects \
+locked for {} more seconds, not waiting for \
+bucket cleanup'.format(bucket, delta.total_seconds()))
+            print('nuke_bucket', bucket, 'waiting', delta.total_seconds(),
+                    'seconds for object locks to expire')
+            time.sleep(delta.total_seconds())
+
+        for objects in list_versions(client, bucket, batch_size):
+            client.delete_objects(Bucket=bucket,
+                    Delete={'Objects': objects, 'Quiet': True},
+                    BypassGovernanceRetention=True)
+
+    client.delete_bucket(Bucket=bucket)
+
+def nuke_prefixed_buckets(prefix, client=None):
+    if client == None:
+        client = get_client()
+
+    buckets = get_buckets_list(client, prefix)
+
+    err = None
+    for bucket_name in buckets:
+        try:
+            nuke_bucket(client, bucket_name)
+        except Exception as e:
+            # The exception shouldn't be raised when doing cleanup. Pass and continue
+            # the bucket cleanup process. Otherwise left buckets wouldn't be cleared
+            # resulting in some kind of resource leak. err is used to hint user some
+            # exception once occurred.
+            err = e
+            pass
+    if err:
+        raise err
+
+    print('Done with cleanup of buckets in tests.')
+
+def configured_storage_classes():
+    sc = ['STANDARD']
+
+    extra_sc = re.split(r"[\b\W\b]+", config.storage_classes)
+
+    for item in extra_sc:
+        if item != 'STANDARD':
+             sc.append(item)
+
+    sc = [i for i in sc if i]
+    print("storage classes configured: " + str(sc))
+
+    return sc
+
+def configure():
+    cfg = configparser.RawConfigParser()
+    try:
+        path = os.environ['S3TEST_CONF']
+    except KeyError:
+        raise RuntimeError(
+            'To run tests, point environment '
+            + 'variable S3TEST_CONF to a config file.',
+            )
+    cfg.read(path)
+
+    if not cfg.defaults():
+        raise RuntimeError('Your config file is missing the DEFAULT section!')
+    if not cfg.has_section("s3 main"):
+        raise RuntimeError('Your config file is missing the "s3 main" section!')
+    if not cfg.has_section("s3 alt"):
+        raise RuntimeError('Your config file is missing the "s3 alt" section!')
+    if not cfg.has_section("s3 tenant"):
+        raise RuntimeError('Your config file is missing the "s3 tenant" section!')
+
+    global prefix
+
+    defaults = cfg.defaults()
+
+    # vars from the DEFAULT section
+    config.default_host = defaults.get("host")
+    config.default_port = int(defaults.get("port"))
+    config.default_is_secure = cfg.getboolean('DEFAULT', "is_secure")
+
+    proto = 'https' if config.default_is_secure else 'http'
+    config.default_endpoint = "%s://%s:%d" % (proto, config.default_host, config.default_port)
+
+    try:
+        config.default_ssl_verify = cfg.getboolean('DEFAULT', "ssl_verify")
+    except configparser.NoOptionError:
+        config.default_ssl_verify = False
+
+    # Disable InsecureRequestWarning reported by urllib3 when ssl_verify is False
+    if not config.default_ssl_verify:
+        urllib3.disable_warnings()
+
+    # vars from the main section
+    config.main_access_key = cfg.get('s3 main',"access_key")
+    config.main_secret_key = cfg.get('s3 main',"secret_key")
+    config.main_display_name = cfg.get('s3 main',"display_name")
+    config.main_user_id = cfg.get('s3 main',"user_id")
+    config.main_email = cfg.get('s3 main',"email")
+    config.main_account_id = cfg.get('s3 main', 'account_id', fallback=None)
+    try:
+        config.main_kms_keyid = cfg.get('s3 main',"kms_keyid")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.main_kms_keyid = 'testkey-1'
+
+    try:
+        config.main_kms_keyid2 = cfg.get('s3 main',"kms_keyid2")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.main_kms_keyid2 = 'testkey-2'
+
+    try:
+        config.main_api_name = cfg.get('s3 main',"api_name")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.main_api_name = ""
+        pass
+
+    try:
+        config.storage_classes = cfg.get('s3 main',"storage_classes")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.storage_classes = ""
+        pass
+
+    try:
+        config.lc_debug_interval = int(cfg.get('s3 main',"lc_debug_interval"))
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.lc_debug_interval = 10
+
+    try:
+        config.rgw_restore_debug_interval = int(cfg.get('s3 main',"rgw_restore_debug_interval"))
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.rgw_restore_debug_interval = 100
+
+    try:
+        config.rgw_restore_processor_period = int(cfg.get('s3 main',"rgw_restore_processor_period"))
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.rgw_restore_processor_period = 100
+
+    config.alt_access_key = cfg.get('s3 alt',"access_key")
+    config.alt_secret_key = cfg.get('s3 alt',"secret_key")
+    config.alt_display_name = cfg.get('s3 alt',"display_name")
+    config.alt_user_id = cfg.get('s3 alt',"user_id")
+    config.alt_email = cfg.get('s3 alt',"email")
+    config.alt_account_id = cfg.get('s3 alt', 'account_id', fallback=None)
+
+    config.tenant_access_key = cfg.get('s3 tenant',"access_key")
+    config.tenant_secret_key = cfg.get('s3 tenant',"secret_key")
+    config.tenant_display_name = cfg.get('s3 tenant',"display_name")
+    config.tenant_user_id = cfg.get('s3 tenant',"user_id")
+    config.tenant_email = cfg.get('s3 tenant',"email")
+    config.tenant_account_id = cfg.get('s3 tenant', 'account_id', fallback=None)
+    config.tenant_name = cfg.get('s3 tenant',"tenant")
+
+    config.iam_access_key = cfg.get('iam',"access_key")
+    config.iam_secret_key = cfg.get('iam',"secret_key")
+    config.iam_display_name = cfg.get('iam',"display_name")
+    config.iam_user_id = cfg.get('iam',"user_id")
+    config.iam_email = cfg.get('iam',"email")
+
+    config.iam_root_access_key = cfg.get('iam root',"access_key")
+    config.iam_root_secret_key = cfg.get('iam root',"secret_key")
+    config.iam_root_user_id = cfg.get('iam root',"user_id")
+    config.iam_root_email = cfg.get('iam root',"email")
+    config.iam_root_account_id = cfg.get('iam root', 'account_id', fallback=None)
+
+    config.iam_alt_root_access_key = cfg.get('iam alt root',"access_key")
+    config.iam_alt_root_secret_key = cfg.get('iam alt root',"secret_key")
+    config.iam_alt_root_user_id = cfg.get('iam alt root',"user_id")
+    config.iam_alt_root_email = cfg.get('iam alt root',"email")
+    config.iam_alt_root_account_id = cfg.get('iam alt root', 'account_id', fallback=None)
+
+    # vars from the fixtures section
+    template = cfg.get('fixtures', "bucket prefix", fallback='test-{random}-')
+    prefix = choose_bucket_prefix(template=template)
+    template = cfg.get('fixtures', "iam name prefix", fallback="s3-tests-")
+    config.iam_name_prefix = choose_bucket_prefix(template=template)
+    template = cfg.get('fixtures', "iam path prefix", fallback="/s3-tests/")
+    config.iam_path_prefix = choose_bucket_prefix(template=template)
+
+    if cfg.has_section("s3 cloud"):
+        get_cloud_config(cfg)
+    else:
+        config.cloud_storage_class = None
+
+def setup():
+    alt_client = get_alt_client()
+    tenant_client = get_tenant_client()
+    nuke_prefixed_buckets(prefix=prefix)
+    nuke_prefixed_buckets(prefix=prefix, client=alt_client)
+    nuke_prefixed_buckets(prefix=prefix, client=tenant_client)
+
+def teardown():
+    alt_client = get_alt_client()
+    tenant_client = get_tenant_client()
+    nuke_prefixed_buckets(prefix=prefix)
+    nuke_prefixed_buckets(prefix=prefix, client=alt_client)
+    nuke_prefixed_buckets(prefix=prefix, client=tenant_client)
+    try:
+        iam_client = get_iam_client()
+        list_roles_resp = iam_client.list_roles()
+        for role in list_roles_resp['Roles']:
+            list_policies_resp = iam_client.list_role_policies(RoleName=role['RoleName'])
+            for policy in list_policies_resp['PolicyNames']:
+                del_policy_resp = iam_client.delete_role_policy(
+                                         RoleName=role['RoleName'],
+                                         PolicyName=policy
+                                        )
+            del_role_resp = iam_client.delete_role(RoleName=role['RoleName'])
+        list_oidc_resp = iam_client.list_open_id_connect_providers()
+        for oidcprovider in list_oidc_resp['OpenIDConnectProviderList']:
+            del_oidc_resp = iam_client.delete_open_id_connect_provider(
+                        OpenIDConnectProviderArn=oidcprovider['Arn']
+                    )
+    except:
+        pass
+
+@pytest.fixture(scope="package")
+def configfile():
+    configure()
+    return config
+
+@pytest.fixture(autouse=True)
+def setup_teardown(configfile):
+    setup()
+    yield
+    teardown()
+
+def check_webidentity():
+    cfg = configparser.RawConfigParser()
+    try:
+        path = os.environ['S3TEST_CONF']
+    except KeyError:
+        raise RuntimeError(
+            'To run tests, point environment '
+            + 'variable S3TEST_CONF to a config file.',
+            )
+    cfg.read(path)
+    if not cfg.has_section("webidentity"):
+        raise RuntimeError('Your config file is missing the "webidentity" section!')
+
+    config.webidentity_thumbprint = cfg.get('webidentity', "thumbprint")
+    config.webidentity_aud = cfg.get('webidentity', "aud")
+    config.webidentity_token = cfg.get('webidentity', "token")
+    config.webidentity_realm = cfg.get('webidentity', "KC_REALM")
+    config.webidentity_sub = cfg.get('webidentity', "sub")
+    config.webidentity_azp = cfg.get('webidentity', "azp")
+    config.webidentity_user_token = cfg.get('webidentity', "user_token")
+
+def get_cloud_config(cfg):
+    config.cloud_host = cfg.get('s3 cloud',"host")
+    config.cloud_port = int(cfg.get('s3 cloud',"port"))
+    config.cloud_is_secure = cfg.getboolean('s3 cloud', "is_secure")
+
+    proto = 'https' if config.cloud_is_secure else 'http'
+    config.cloud_endpoint = "%s://%s:%d" % (proto, config.cloud_host, config.cloud_port)
+
+    config.cloud_access_key = cfg.get('s3 cloud',"access_key")
+    config.cloud_secret_key = cfg.get('s3 cloud',"secret_key")
+
+    try:
+        config.cloud_storage_class = cfg.get('s3 cloud', "cloud_storage_class")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_storage_class = None
+    
+    try:
+        config.cloud_retain_head_object = cfg.get('s3 cloud',"retain_head_object")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_retain_head_object = None
+
+    try:
+        config.allow_read_through = cfg.get('s3 cloud',"allow_read_through")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.allow_read_through = False
+
+    try:
+        config.cloud_target_path = cfg.get('s3 cloud',"target_path")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_target_path = None
+
+    try:
+        config.cloud_target_storage_class = cfg.get('s3 cloud',"target_storage_class")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_target_storage_class = 'STANDARD'
+
+    try:
+        config.cloud_regular_storage_class = cfg.get('s3 cloud', "storage_class")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_regular_storage_class  = None
+
+    try:
+        config.read_through_restore_days = int(cfg.get('s3 cloud', "read_through_restore_days"))
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.read_through_restore_days = 10
+
+    try:
+        config.cloud_target_by_bucket = cfg.getboolean('s3 cloud', "target_by_bucket")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_target_by_bucket = False
+
+    try:
+        config.cloud_target_by_bucket_prefix = cfg.get('s3 cloud', "target_by_bucket_prefix")
+    except (configparser.NoSectionError, configparser.NoOptionError):
+        config.cloud_target_by_bucket_prefix = None
+
+
+def get_client(client_config=None):
+    if client_config == None:
+        client_config = Config(signature_version='s3v4')
+
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id=config.main_access_key,
+                        aws_secret_access_key=config.main_secret_key,
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=client_config)
+    return client
+
+def get_v2_client():
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id=config.main_access_key,
+                        aws_secret_access_key=config.main_secret_key,
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=Config(signature_version='s3'))
+    return client
+
+def get_sts_client(**kwargs):
+    kwargs.setdefault('region_name', '')
+    kwargs.setdefault('aws_access_key_id', config.alt_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.alt_secret_key)
+    kwargs.setdefault('config', Config(signature_version='s3v4'))
+
+    client = boto3.client(service_name='sts',
+                          endpoint_url=config.default_endpoint,
+                          use_ssl=config.default_is_secure,
+                          verify=config.default_ssl_verify,
+                          **kwargs)
+    return client
+
+def get_iam_client(**kwargs):
+    kwargs.setdefault('region_name', '')
+    kwargs.setdefault('aws_access_key_id', config.iam_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.iam_secret_key)
+
+    client = boto3.client(service_name='iam',
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        **kwargs)
+    return client
+
+def get_iam_s3client(**kwargs):
+    kwargs.setdefault('aws_access_key_id', config.iam_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.iam_secret_key)
+    kwargs.setdefault('config', Config(signature_version='s3v4'))
+
+    client = boto3.client(service_name='s3',
+                          endpoint_url=config.default_endpoint,
+                          use_ssl=config.default_is_secure,
+                          verify=config.default_ssl_verify,
+                          **kwargs)
+    return client
+
+def get_iam_root_s3client(**kwargs):
+    kwargs.setdefault('aws_access_key_id', config.iam_root_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.iam_root_secret_key)
+    kwargs.setdefault('config', Config(signature_version='s3v4'))
+
+    client = boto3.client(service_name='s3',
+                          endpoint_url=config.default_endpoint,
+                          use_ssl=config.default_is_secure,
+                          verify=config.default_ssl_verify,
+                          **kwargs)
+    return client
+
+def get_iam_root_client(**kwargs):
+    kwargs.setdefault('service_name', 'iam')
+    kwargs.setdefault('region_name', '')
+    kwargs.setdefault('aws_access_key_id', config.iam_root_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.iam_root_secret_key)
+
+    return boto3.client(endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        **kwargs)
+
+def get_iam_alt_root_client(**kwargs):
+    kwargs.setdefault('service_name', 'iam')
+    kwargs.setdefault('region_name', '')
+    kwargs.setdefault('aws_access_key_id', config.iam_alt_root_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.iam_alt_root_secret_key)
+
+    return boto3.client(endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        **kwargs)
+
+def get_alt_client(client_config=None):
+    if client_config == None:
+        client_config = Config(signature_version='s3v4')
+
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id=config.alt_access_key,
+                        aws_secret_access_key=config.alt_secret_key,
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=client_config)
+    return client
+
+def get_cloud_client(client_config=None):
+    if client_config == None:
+        client_config = Config(signature_version='s3v4')
+
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id=config.cloud_access_key,
+                        aws_secret_access_key=config.cloud_secret_key,
+                        endpoint_url=config.cloud_endpoint,
+                        use_ssl=config.cloud_is_secure,
+                        config=client_config)
+    return client
+
+def get_tenant_client(client_config=None):
+    if client_config == None:
+        client_config = Config(signature_version='s3v4')
+
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id=config.tenant_access_key,
+                        aws_secret_access_key=config.tenant_secret_key,
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=client_config)
+    return client
+
+def get_v2_tenant_client():
+    client_config = Config(signature_version='s3')
+    client = boto3.client(service_name='s3',
+                          aws_access_key_id=config.tenant_access_key,
+                          aws_secret_access_key=config.tenant_secret_key,
+                          endpoint_url=config.default_endpoint,
+                          use_ssl=config.default_is_secure,
+                          verify=config.default_ssl_verify,
+                          config=client_config)
+    return client
+
+def get_tenant_iam_client():
+
+    client = boto3.client(service_name='iam',
+                          region_name='us-east-1',
+                          aws_access_key_id=config.tenant_access_key,
+                          aws_secret_access_key=config.tenant_secret_key,
+                          endpoint_url=config.default_endpoint,
+                          verify=config.default_ssl_verify,
+                          use_ssl=config.default_is_secure)
+    return client
+
+def get_alt_iam_client():
+
+    client = boto3.client(service_name='iam',
+                          region_name='',
+                          aws_access_key_id=config.alt_access_key,
+                          aws_secret_access_key=config.alt_secret_key,
+                          endpoint_url=config.default_endpoint,
+                          verify=config.default_ssl_verify,
+                          use_ssl=config.default_is_secure)
+    return client
+
+def get_unauthenticated_client():
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id='',
+                        aws_secret_access_key='',
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=Config(signature_version=UNSIGNED))
+    return client
+
+def get_bad_auth_client(aws_access_key_id='badauth'):
+    client = boto3.client(service_name='s3',
+                        aws_access_key_id=aws_access_key_id,
+                        aws_secret_access_key='roflmao',
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=Config(signature_version='s3v4'))
+    return client
+
+def get_svc_client(client_config=None, svc='s3'):
+    if client_config == None:
+        client_config = Config(signature_version='s3v4')
+
+    client = boto3.client(service_name=svc,
+                        aws_access_key_id=config.main_access_key,
+                        aws_secret_access_key=config.main_secret_key,
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        config=client_config)
+    return client
+
+bucket_counter = itertools.count(1)
+
+def get_new_bucket_name():
+    """
+    Get a bucket name that probably does not exist.
+
+    We make every attempt to use a unique random prefix, so if a
+    bucket by this name happens to exist, it's ok if tests give
+    false negatives.
+    """
+    name = '{prefix}{num}'.format(
+        prefix=prefix,
+        num=next(bucket_counter),
+        )
+    return name
+
+def get_new_bucket_resource(name=None):
+    """
+    Get a bucket that exists and is empty.
+
+    Always recreates a bucket from scratch. This is useful to also
+    reset ACLs and such.
+    """
+    s3 = boto3.resource('s3',
+                        aws_access_key_id=config.main_access_key,
+                        aws_secret_access_key=config.main_secret_key,
+                        endpoint_url=config.default_endpoint,
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify)
+    if name is None:
+        name = get_new_bucket_name()
+    bucket = s3.Bucket(name)
+    bucket_location = bucket.create()
+    return bucket
+
+def get_new_bucket(client=None, name=None):
+    """
+    Get a bucket that exists and is empty.
+
+    Always recreates a bucket from scratch. This is useful to also
+    reset ACLs and such.
+    """
+    if client is None:
+        client = get_client()
+    if name is None:
+        name = get_new_bucket_name()
+
+    client.create_bucket(Bucket=name)
+    return name
+
+def get_parameter_name():
+    parameter_name=""
+    rand = ''.join(
+        random.choice(string.ascii_lowercase + string.digits)
+        for c in range(255)
+        )
+    while rand:
+        parameter_name = '{random}'.format(random=rand)
+        if len(parameter_name) <= 10:
+            return parameter_name
+        rand = rand[:-1]
+    return parameter_name
+
+def get_sts_user_id():
+    return config.alt_user_id
+
+def get_config_is_secure():
+    return config.default_is_secure
+
+def get_config_host():
+    return config.default_host
+
+def get_config_port():
+    return config.default_port
+
+def get_config_endpoint():
+    return config.default_endpoint
+
+def get_config_ssl_verify():
+    return config.default_ssl_verify
+
+def get_main_aws_access_key():
+    return config.main_access_key
+
+def get_main_aws_secret_key():
+    return config.main_secret_key
+
+def get_main_display_name():
+    return config.main_display_name
+
+def get_main_user_id():
+    return config.main_user_id
+
+def get_main_email():
+    return config.main_email
+
+def get_main_account_id():
+    return config.main_account_id
+
+def get_main_api_name():
+    return config.main_api_name
+
+def get_main_kms_keyid():
+    return config.main_kms_keyid
+
+def get_secondary_kms_keyid():
+    return config.main_kms_keyid2
+
+def get_alt_aws_access_key():
+    return config.alt_access_key
+
+def get_alt_aws_secret_key():
+    return config.alt_secret_key
+
+def get_alt_display_name():
+    return config.alt_display_name
+
+def get_alt_user_id():
+    return config.alt_user_id
+
+def get_alt_account_id():
+    return config.alt_account_id
+
+def get_alt_email():
+    return config.alt_email
+
+def get_tenant_aws_access_key():
+    return config.tenant_access_key
+
+def get_tenant_aws_secret_key():
+    return config.tenant_secret_key
+
+def get_tenant_display_name():
+    return config.tenant_display_name
+
+def get_tenant_account_id():
+    return config.tenant_account_id
+
+def get_tenant_name():
+    return config.tenant_name
+
+def get_tenant_user_id():
+    return config.tenant_user_id
+
+def get_tenant_email():
+    return config.tenant_email
+
+def get_thumbprint():
+    return config.webidentity_thumbprint
+
+def get_aud():
+    return config.webidentity_aud
+
+def get_sub():
+    return config.webidentity_sub
+
+def get_azp():
+    return config.webidentity_azp
+
+def get_token():
+    return config.webidentity_token
+
+def get_realm_name():
+    return config.webidentity_realm
+
+def get_iam_name_prefix():
+    return config.iam_name_prefix
+
+def make_iam_name(name):
+    return config.iam_name_prefix + name
+
+def get_iam_path_prefix():
+    return config.iam_path_prefix
+
+def get_iam_access_key():
+    return config.iam_access_key
+
+def get_iam_secret_key():
+    return config.iam_secret_key
+
+def get_iam_root_user_id():
+    return config.iam_root_user_id
+
+def get_iam_root_email():
+    return config.iam_root_email
+
+def get_iam_root_account_id():
+    return config.iam_root_account_id
+
+def get_iam_alt_root_user_id():
+    return config.iam_alt_root_user_id
+
+def get_iam_alt_root_email():
+    return config.iam_alt_root_email
+
+def get_iam_alt_root_account_id():
+    return config.iam_alt_root_account_id
+
+def get_user_token():
+    return config.webidentity_user_token
+
+def get_cloud_storage_class():
+    return config.cloud_storage_class
+
+def get_cloud_retain_head_object():
+    return config.cloud_retain_head_object
+
+def get_allow_read_through():
+    return config.allow_read_through
+
+def get_cloud_regular_storage_class():
+    return config.cloud_regular_storage_class
+
+def get_cloud_target_path():
+    return config.cloud_target_path
+
+def get_cloud_target_storage_class():
+    return config.cloud_target_storage_class
+
+def get_lc_debug_interval():
+    return config.lc_debug_interval
+
+def get_restore_debug_interval():
+    return config.rgw_restore_debug_interval
+
+def get_restore_processor_period():
+    return config.rgw_restore_processor_period
+
+def get_read_through_days():
+    return config.read_through_restore_days
+
+def get_cloud_target_by_bucket():
+    return config.cloud_target_by_bucket
+
+def get_cloud_target_by_bucket_prefix():
+    return config.cloud_target_by_bucket_prefix
+
+def create_iam_user_s3client(client):
+    prefix = get_iam_path_prefix()
+
+    # generate random name
+    randname = ''.join(
+        random.choice(string.ascii_lowercase + string.digits)
+        for c in range(8)
+    )
+    name = make_iam_name(randname)
+
+    user = client.create_user(UserName=name, Path=prefix)
+
+    # create s3 access and secret keys
+    keys = client.create_access_key(UserName=user['User']['UserName'])
+
+    # create s3 client
+    return get_iam_s3client(
+        aws_access_key_id=keys['AccessKey']['AccessKeyId'],
+        aws_secret_access_key=keys['AccessKey']['SecretAccessKey'],
+    )
diff --git a/src/test/rgw/s3-tests/s3tests/functional/iam.py b/src/test/rgw/s3-tests/s3tests/functional/iam.py
new file mode 100644
index 00000000000..a070e5d84d9
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/iam.py
@@ -0,0 +1,199 @@
+from botocore.exceptions import ClientError
+import pytest
+
+from . import (
+    configfile,
+    get_iam_root_client,
+    get_iam_root_user_id,
+    get_iam_root_email,
+    get_iam_alt_root_client,
+    get_iam_alt_root_user_id,
+    get_iam_alt_root_email,
+    get_iam_path_prefix,
+)
+
+def nuke_user_keys(client, name):
+    p = client.get_paginator('list_access_keys')
+    for response in p.paginate(UserName=name):
+        for key in response['AccessKeyMetadata']:
+            try:
+                client.delete_access_key(UserName=name, AccessKeyId=key['AccessKeyId'])
+            except:
+                pass
+
+def nuke_user_policies(client, name):
+    p = client.get_paginator('list_user_policies')
+    for response in p.paginate(UserName=name):
+        for policy in response['PolicyNames']:
+            try:
+                client.delete_user_policy(UserName=name, PolicyName=policy)
+            except:
+                pass
+
+def nuke_attached_user_policies(client, name):
+    p = client.get_paginator('list_attached_user_policies')
+    for response in p.paginate(UserName=name):
+        for policy in response['AttachedPolicies']:
+            try:
+                client.detach_user_policy(UserName=name, PolicyArn=policy['PolicyArn'])
+            except:
+                pass
+
+def nuke_user(client, name):
+    # delete access keys, user policies, etc
+    try:
+        nuke_user_keys(client, name)
+    except:
+        pass
+    try:
+        nuke_user_policies(client, name)
+    except:
+        pass
+    try:
+        nuke_attached_user_policies(client, name)
+    except:
+        pass
+    client.delete_user(UserName=name)
+
+def nuke_users(client, **kwargs):
+    p = client.get_paginator('list_users')
+    for response in p.paginate(**kwargs):
+        for user in response['Users']:
+            try:
+                nuke_user(client, user['UserName'])
+            except:
+                pass
+
+def nuke_group_policies(client, name):
+    p = client.get_paginator('list_group_policies')
+    for response in p.paginate(GroupName=name):
+        for policy in response['PolicyNames']:
+            try:
+                client.delete_group_policy(GroupName=name, PolicyName=policy)
+            except:
+                pass
+
+def nuke_attached_group_policies(client, name):
+    p = client.get_paginator('list_attached_group_policies')
+    for response in p.paginate(GroupName=name):
+        for policy in response['AttachedPolicies']:
+            try:
+                client.detach_group_policy(GroupName=name, PolicyArn=policy['PolicyArn'])
+            except:
+                pass
+
+def nuke_group_users(client, name):
+    p = client.get_paginator('get_group')
+    for response in p.paginate(GroupName=name):
+        for user in response['Users']:
+            try:
+                client.remove_user_from_group(GroupName=name, UserName=user['UserName'])
+            except:
+                pass
+
+def nuke_group(client, name):
+    # delete group policies and remove all users
+    try:
+        nuke_group_policies(client, name)
+    except:
+        pass
+    try:
+        nuke_attached_group_policies(client, name)
+    except:
+        pass
+    try:
+        nuke_group_users(client, name)
+    except:
+        pass
+    client.delete_group(GroupName=name)
+
+def nuke_groups(client, **kwargs):
+    p = client.get_paginator('list_groups')
+    for response in p.paginate(**kwargs):
+        for user in response['Groups']:
+            try:
+                nuke_group(client, user['GroupName'])
+            except:
+                pass
+
+def nuke_role_policies(client, name):
+    p = client.get_paginator('list_role_policies')
+    for response in p.paginate(RoleName=name):
+        for policy in response['PolicyNames']:
+            try:
+                client.delete_role_policy(RoleName=name, PolicyName=policy)
+            except:
+                pass
+
+def nuke_attached_role_policies(client, name):
+    p = client.get_paginator('list_attached_role_policies')
+    for response in p.paginate(RoleName=name):
+        for policy in response['AttachedPolicies']:
+            try:
+                client.detach_role_policy(RoleName=name, PolicyArn=policy['PolicyArn'])
+            except:
+                pass
+
+def nuke_role(client, name):
+    # delete role policies, etc
+    try:
+        nuke_role_policies(client, name)
+    except:
+        pass
+    try:
+        nuke_attached_role_policies(client, name)
+    except:
+        pass
+    client.delete_role(RoleName=name)
+
+def nuke_roles(client, **kwargs):
+    p = client.get_paginator('list_roles')
+    for response in p.paginate(**kwargs):
+        for role in response['Roles']:
+            try:
+                nuke_role(client, role['RoleName'])
+            except:
+                pass
+
+def nuke_oidc_providers(client, prefix):
+    result = client.list_open_id_connect_providers()
+    for provider in result['OpenIDConnectProviderList']:
+        arn = provider['Arn']
+        if f':oidc-provider{prefix}' in arn:
+            try:
+                client.delete_open_id_connect_provider(OpenIDConnectProviderArn=arn)
+            except:
+                pass
+
+
+# fixture for iam account root user
+@pytest.fixture
+def iam_root(configfile):
+    client = get_iam_root_client()
+    try:
+        arn = client.get_user()['User']['Arn']
+        if not arn.endswith(':root'):
+            pytest.skip('[iam root] user does not have :root arn')
+    except ClientError as e:
+        pytest.skip('[iam root] user does not belong to an account')
+
+    yield client
+    nuke_users(client, PathPrefix=get_iam_path_prefix())
+    nuke_groups(client, PathPrefix=get_iam_path_prefix())
+    nuke_roles(client, PathPrefix=get_iam_path_prefix())
+    nuke_oidc_providers(client, get_iam_path_prefix())
+
+# fixture for iam alt account root user
+@pytest.fixture
+def iam_alt_root(configfile):
+    client = get_iam_alt_root_client()
+    try:
+        arn = client.get_user()['User']['Arn']
+        if not arn.endswith(':root'):
+            pytest.skip('[iam alt root] user does not have :root arn')
+    except ClientError as e:
+        pytest.skip('[iam alt root] user does not belong to an account')
+
+    yield client
+    nuke_users(client, PathPrefix=get_iam_path_prefix())
+    nuke_roles(client, PathPrefix=get_iam_path_prefix())
diff --git a/src/test/rgw/s3-tests/s3tests/functional/policy.py b/src/test/rgw/s3-tests/s3tests/functional/policy.py
new file mode 100644
index 00000000000..123496afc2f
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/policy.py
@@ -0,0 +1,46 @@
+import json
+
+class Statement(object):
+    def __init__(self, action, resource, principal = {"AWS" : "*"}, effect= "Allow", condition = None):
+        self.principal = principal
+        self.action = action
+        self.resource = resource
+        self.condition = condition
+        self.effect = effect
+
+    def to_dict(self):
+        d = { "Action" : self.action,
+              "Principal" : self.principal,
+              "Effect" : self.effect,
+              "Resource" : self.resource
+        }
+
+        if self.condition is not None:
+            d["Condition"] = self.condition
+
+        return d
+
+class Policy(object):
+    def __init__(self):
+        self.statements = []
+
+    def add_statement(self, s):
+        self.statements.append(s)
+        return self
+
+    def to_json(self):
+        policy_dict = {
+            "Version" : "2012-10-17",
+            "Statement":
+            [s.to_dict() for s in self.statements]
+        }
+
+        return json.dumps(policy_dict)
+
+def make_json_policy(action, resource, principal={"AWS": "*"}, effect="Allow", conditions=None):
+    """
+    Helper function to make single statement policies
+    """
+    s = Statement(action, resource, principal, effect=effect, condition=conditions)
+    p = Policy()
+    return p.add_statement(s).to_json()
diff --git a/src/test/rgw/s3-tests/s3tests/functional/rgw_interactive.py b/src/test/rgw/s3-tests/s3tests/functional/rgw_interactive.py
new file mode 100644
index 00000000000..873a145911c
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/rgw_interactive.py
@@ -0,0 +1,92 @@
+#!/usr/bin/python
+import boto3
+import os
+import random
+import string
+import itertools
+
+host = "localhost"
+port = 8000
+
+## AWS access key
+access_key = "0555b35654ad1656d804"
+
+## AWS secret key
+secret_key = "h7GhxuBLTrlhVUyxSPUKUV8r/2EI4ngqJxD7iBdBYLhwluN30JaT3Q=="
+
+prefix = "YOURNAMEHERE-1234-"
+
+endpoint_url = "http://%s:%d" % (host, port)
+
+client = boto3.client(service_name='s3',
+                    aws_access_key_id=access_key,
+                    aws_secret_access_key=secret_key,
+                    endpoint_url=endpoint_url,
+                    use_ssl=False,
+                    verify=False)
+
+s3 = boto3.resource('s3', 
+                    use_ssl=False,
+                    verify=False,
+                    endpoint_url=endpoint_url, 
+                    aws_access_key_id=access_key,
+                    aws_secret_access_key=secret_key)
+
+def choose_bucket_prefix(template, max_len=30):
+    """
+    Choose a prefix for our test buckets, so they're easy to identify.
+
+    Use template and feed it more and more random filler, until it's
+    as long as possible but still below max_len.
+    """
+    rand = ''.join(
+        random.choice(string.ascii_lowercase + string.digits)
+        for c in range(255)
+        )
+
+    while rand:
+        s = template.format(random=rand)
+        if len(s) <= max_len:
+            return s
+        rand = rand[:-1]
+
+    raise RuntimeError(
+        'Bucket prefix template is impossible to fulfill: {template!r}'.format(
+            template=template,
+            ),
+        )
+
+bucket_counter = itertools.count(1)
+
+def get_new_bucket_name():
+    """
+    Get a bucket name that probably does not exist.
+
+    We make every attempt to use a unique random prefix, so if a
+    bucket by this name happens to exist, it's ok if tests give
+    false negatives.
+    """
+    name = '{prefix}{num}'.format(
+        prefix=prefix,
+        num=next(bucket_counter),
+        )
+    return name
+
+def get_new_bucket(session=boto3, name=None, headers=None):
+    """
+    Get a bucket that exists and is empty.
+
+    Always recreates a bucket from scratch. This is useful to also
+    reset ACLs and such.
+    """
+    s3 = session.resource('s3', 
+                        use_ssl=False,
+                        verify=False,
+                        endpoint_url=endpoint_url, 
+                        aws_access_key_id=access_key,
+                        aws_secret_access_key=secret_key)
+    if name is None:
+        name = get_new_bucket_name()
+    bucket = s3.Bucket(name)
+    bucket_location = bucket.create()
+    return bucket
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_headers.py b/src/test/rgw/s3-tests/s3tests/functional/test_headers.py
new file mode 100644
index 00000000000..360a2e6643b
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_headers.py
@@ -0,0 +1,578 @@
+import boto3
+import pytest
+import botocore.config
+from botocore.exceptions import ClientError
+from email.utils import formatdate
+
+from .utils import assert_raises
+from .utils import _get_status_and_error_code
+from .utils import _get_status
+
+from . import (
+    configfile,
+    setup_teardown,
+    get_client,
+    get_v2_client,
+    get_new_bucket,
+    get_new_bucket_name,
+    )
+
+def _add_header_create_object(headers, client=None):
+    """ Create a new bucket, add an object w/header customizations
+    """
+    bucket_name = get_new_bucket()
+    if client == None:
+        client = get_client()
+    key_name = 'foo'
+
+    # pass in custom headers before PutObject call
+    add_headers = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.PutObject', add_headers)
+    client.put_object(Bucket=bucket_name, Key=key_name)
+
+    return bucket_name, key_name
+
+
+def _add_header_create_bad_object(headers, client=None):
+    """ Create a new bucket, add an object with a header. This should cause a failure 
+    """
+    bucket_name = get_new_bucket()
+    if client == None:
+        client = get_client()
+    key_name = 'foo'
+
+    # pass in custom headers before PutObject call
+    add_headers = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.PutObject', add_headers)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key_name, Body='bar')
+
+    return e
+
+
+def _remove_header_create_object(remove, client=None):
+    """ Create a new bucket, add an object without a header
+    """
+    bucket_name = get_new_bucket()
+    if client == None:
+        client = get_client()
+    key_name = 'foo'
+
+    # remove custom headers before PutObject call
+    def remove_header(**kwargs):
+        if (remove in kwargs['params']['headers']):
+            del kwargs['params']['headers'][remove]
+
+    client.meta.events.register('before-call.s3.PutObject', remove_header)
+    client.put_object(Bucket=bucket_name, Key=key_name)
+
+    return bucket_name, key_name
+
+def _remove_header_create_bad_object(remove, client=None):
+    """ Create a new bucket, add an object without a header. This should cause a failure
+    """
+    bucket_name = get_new_bucket()
+    if client == None:
+        client = get_client()
+    key_name = 'foo'
+
+    # remove custom headers before PutObject call
+    def remove_header(**kwargs):
+        if (remove in kwargs['params']['headers']):
+            del kwargs['params']['headers'][remove]
+
+    client.meta.events.register('before-call.s3.PutObject', remove_header)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key_name, Body='bar')
+
+    return e
+
+
+def _add_header_create_bucket(headers, client=None):
+    """ Create a new bucket, w/header customizations
+    """
+    bucket_name = get_new_bucket_name()
+    if client == None:
+        client = get_client()
+
+    # pass in custom headers before PutObject call
+    add_headers = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.CreateBucket', add_headers)
+    client.create_bucket(Bucket=bucket_name)
+
+    return bucket_name
+
+
+def _add_header_create_bad_bucket(headers=None, client=None):
+    """ Create a new bucket, w/header customizations that should cause a failure 
+    """
+    bucket_name = get_new_bucket_name()
+    if client == None:
+        client = get_client()
+
+    # pass in custom headers before PutObject call
+    add_headers = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.CreateBucket', add_headers)
+    e = assert_raises(ClientError, client.create_bucket, Bucket=bucket_name)
+
+    return e
+
+
+def _remove_header_create_bucket(remove, client=None):
+    """ Create a new bucket, without a header
+    """
+    bucket_name = get_new_bucket_name()
+    if client == None:
+        client = get_client()
+
+    # remove custom headers before PutObject call
+    def remove_header(**kwargs):
+        if (remove in kwargs['params']['headers']):
+            del kwargs['params']['headers'][remove]
+
+    client.meta.events.register('before-call.s3.CreateBucket', remove_header)
+    client.create_bucket(Bucket=bucket_name)
+
+    return bucket_name
+
+def _remove_header_create_bad_bucket(remove, client=None):
+    """ Create a new bucket, without a header. This should cause a failure
+    """
+    bucket_name = get_new_bucket_name()
+    if client == None:
+        client = get_client()
+
+    # remove custom headers before PutObject call
+    def remove_header(**kwargs):
+        if (remove in kwargs['params']['headers']):
+            del kwargs['params']['headers'][remove]
+
+    client.meta.events.register('before-call.s3.CreateBucket', remove_header)
+    e = assert_raises(ClientError, client.create_bucket, Bucket=bucket_name)
+
+    return e
+
+#
+# common tests
+#
+
+@pytest.mark.auth_common
+def test_object_create_bad_md5_invalid_short():
+    e = _add_header_create_bad_object({'Content-MD5':'YWJyYWNhZGFicmE='})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidDigest'
+
+@pytest.mark.auth_common
+def test_object_create_bad_md5_bad():
+    e = _add_header_create_bad_object({'Content-MD5':'rL0Y20xC+Fzt72VPzMSk2A=='})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'BadDigest'
+
+@pytest.mark.auth_common
+def test_object_create_bad_md5_empty():
+    e = _add_header_create_bad_object({'Content-MD5':''})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidDigest'
+
+@pytest.mark.auth_common
+def test_object_create_bad_md5_none():
+    bucket_name, key_name = _remove_header_create_object('Content-MD5')
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_common
+def test_object_create_bad_expect_mismatch():
+    bucket_name, key_name = _add_header_create_object({'Expect': 200})
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_common
+def test_object_create_bad_expect_empty():
+    bucket_name, key_name = _add_header_create_object({'Expect': ''})
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_common
+def test_object_create_bad_expect_none():
+    bucket_name, key_name = _remove_header_create_object('Expect')
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the content-length header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_contentlength_empty():
+    e = _add_header_create_bad_object({'Content-Length':''})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.auth_common
+@pytest.mark.fails_on_mod_proxy_fcgi
+def test_object_create_bad_contentlength_negative():
+    # to test Content-Length=-1, we have to prevent the checksum calculation
+    # from switching to STREAMING-UNSIGNED-PAYLOAD-TRAILER
+    config = botocore.config.Config(request_checksum_calculation = 'when_required')
+    client = get_client(config)
+    bucket_name = get_new_bucket()
+    key_name = 'foo'
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key_name, ContentLength=-1)
+    status = _get_status(e.response)
+    assert status == 400
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the content-length header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_contentlength_none():
+    remove = 'Content-Length'
+    e = _remove_header_create_bad_object('Content-Length')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 411
+    assert error_code == 'MissingContentLength'
+
+@pytest.mark.auth_common
+def test_object_create_bad_contenttype_invalid():
+    bucket_name, key_name = _add_header_create_object({'Content-Type': 'text/plain'})
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_common
+def test_object_create_bad_contenttype_empty():
+    client = get_client()
+    key_name = 'foo'
+    bucket_name = get_new_bucket()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar', ContentType='')
+
+@pytest.mark.auth_common
+def test_object_create_bad_contenttype_none():
+    bucket_name = get_new_bucket()
+    key_name = 'foo'
+    client = get_client()
+    # as long as ContentType isn't specified in put_object it isn't going into the request
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the authorization header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_authorization_empty():
+    e = _add_header_create_bad_object({'Authorization': ''})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to pass both the 'Date' and 'X-Amz-Date' header during signing and not 'X-Amz-Date' before
+@pytest.mark.fails_on_rgw
+def test_object_create_date_and_amz_date():
+    date = formatdate(usegmt=True)
+    bucket_name, key_name = _add_header_create_object({'Date': date, 'X-Amz-Date': date})
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to pass both the 'Date' and 'X-Amz-Date' header during signing and not 'X-Amz-Date' before
+@pytest.mark.fails_on_rgw
+def test_object_create_amz_date_and_no_date():
+    date = formatdate(usegmt=True)
+    bucket_name, key_name = _add_header_create_object({'Date': '', 'X-Amz-Date': date})
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+# the teardown is really messed up here. check it out
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the authorization header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_authorization_none():
+    e = _remove_header_create_bad_object('Authorization')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the content-length header
+@pytest.mark.fails_on_rgw
+def test_bucket_create_contentlength_none():
+    remove = 'Content-Length'
+    _remove_header_create_bucket(remove)
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the content-length header
+@pytest.mark.fails_on_rgw
+def test_object_acl_create_contentlength_none():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    remove = 'Content-Length'
+    def remove_header(**kwargs):
+        if (remove in kwargs['params']['headers']):
+            del kwargs['params']['headers'][remove]
+
+    client.meta.events.register('before-call.s3.PutObjectAcl', remove_header)
+    client.put_object_acl(Bucket=bucket_name, Key='foo', ACL='public-read')
+
+@pytest.mark.auth_common
+def test_bucket_put_bad_canned_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    headers = {'x-amz-acl': 'public-ready'}
+    add_headers = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.PutBucketAcl', add_headers)
+
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket_name, ACL='public-read')
+    status = _get_status(e.response)
+    assert status == 400
+
+@pytest.mark.auth_common
+def test_bucket_create_bad_expect_mismatch():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    headers = {'Expect': 200}
+    add_headers = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.CreateBucket', add_headers)
+    client.create_bucket(Bucket=bucket_name)
+
+@pytest.mark.auth_common
+def test_bucket_create_bad_expect_empty():
+    headers = {'Expect': ''}
+    _add_header_create_bucket(headers)
+
+@pytest.mark.auth_common
+# TODO: The request isn't even making it to the RGW past the frontend
+# This test had 'fails_on_rgw' before the move to boto3
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_contentlength_empty():
+    headers = {'Content-Length': ''}
+    e = _add_header_create_bad_bucket(headers)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.auth_common
+@pytest.mark.fails_on_mod_proxy_fcgi
+def test_bucket_create_bad_contentlength_negative():
+    headers = {'Content-Length': '-1'}
+    e = _add_header_create_bad_bucket(headers)
+    status = _get_status(e.response)
+    assert status == 400
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the content-length header
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_contentlength_none():
+    remove = 'Content-Length'
+    _remove_header_create_bucket(remove)
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to manipulate the authorization header
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_authorization_empty():
+    headers = {'Authorization': ''}
+    e = _add_header_create_bad_bucket(headers)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_common
+# TODO: remove 'fails_on_rgw' and once we have learned how to manipulate the authorization header
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_authorization_none():
+    e = _remove_header_create_bad_bucket('Authorization')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_md5_invalid_garbage_aws2():
+    v2_client = get_v2_client()
+    headers = {'Content-MD5': 'AWS HAHAHA'}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidDigest'
+
+@pytest.mark.auth_aws2
+# TODO: remove 'fails_on_rgw' and once we have learned how to manipulate the Content-Length header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_contentlength_mismatch_below_aws2():
+    v2_client = get_v2_client()
+    content = 'bar'
+    length = len(content) - 1
+    headers = {'Content-Length': str(length)}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'BadDigest'
+
+@pytest.mark.auth_aws2
+# TODO: remove 'fails_on_rgw' and once we have learned how to manipulate the authorization header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_authorization_incorrect_aws2():
+    v2_client = get_v2_client()
+    headers = {'Authorization': 'AWS AKIAIGR7ZNNBHC5BKSUB:FWeDfwojDSdS2Ztmpfeubhd9isU='}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'InvalidDigest'
+
+@pytest.mark.auth_aws2
+# TODO: remove 'fails_on_rgw' and once we have learned how to manipulate the authorization header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_authorization_invalid_aws2():
+    v2_client = get_v2_client()
+    headers = {'Authorization': 'AWS HAHAHA'}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_ua_empty_aws2():
+    v2_client = get_v2_client()
+    headers = {'User-Agent': ''}
+    bucket_name, key_name = _add_header_create_object(headers, v2_client)
+    v2_client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_ua_none_aws2():
+    v2_client = get_v2_client()
+    remove = 'User-Agent'
+    bucket_name, key_name = _remove_header_create_object(remove, v2_client)
+    v2_client.put_object(Bucket=bucket_name, Key=key_name, Body='bar')
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_date_invalid_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Bad Date'}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_date_empty_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': ''}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the date header
+@pytest.mark.fails_on_rgw
+def test_object_create_bad_date_none_aws2():
+    v2_client = get_v2_client()
+    remove = 'x-amz-date'
+    e = _remove_header_create_bad_object(remove, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_date_before_today_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Tue, 07 Jul 2010 21:53:04 GMT'}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'RequestTimeTooSkewed'
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_date_before_epoch_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Tue, 07 Jul 1950 21:53:04 GMT'}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+def test_object_create_bad_date_after_end_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Tue, 07 Jul 9999 21:53:04 GMT'}
+    e = _add_header_create_bad_object(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'RequestTimeTooSkewed'
+
+@pytest.mark.auth_aws2
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the date header
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_authorization_invalid_aws2():
+    v2_client = get_v2_client()
+    headers = {'Authorization': 'AWS HAHAHA'}
+    e = _add_header_create_bad_bucket(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.auth_aws2
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_ua_empty_aws2():
+    v2_client = get_v2_client()
+    headers = {'User-Agent': ''}
+    _add_header_create_bucket(headers, v2_client)
+
+@pytest.mark.auth_aws2
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_ua_none_aws2():
+    v2_client = get_v2_client()
+    remove = 'User-Agent'
+    _remove_header_create_bucket(remove, v2_client)
+
+@pytest.mark.auth_aws2
+def test_bucket_create_bad_date_invalid_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Bad Date'}
+    e = _add_header_create_bad_bucket(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+def test_bucket_create_bad_date_empty_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': ''}
+    e = _add_header_create_bad_bucket(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+# TODO: remove 'fails_on_rgw' and once we have learned how to remove the date header
+@pytest.mark.fails_on_rgw
+def test_bucket_create_bad_date_none_aws2():
+    v2_client = get_v2_client()
+    remove = 'x-amz-date'
+    e = _remove_header_create_bad_bucket(remove, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.auth_aws2
+def test_bucket_create_bad_date_before_today_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Tue, 07 Jul 2010 21:53:04 GMT'}
+    e = _add_header_create_bad_bucket(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'RequestTimeTooSkewed'
+
+@pytest.mark.auth_aws2
+def test_bucket_create_bad_date_after_today_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Tue, 07 Jul 2030 21:53:04 GMT'}
+    e = _add_header_create_bad_bucket(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'RequestTimeTooSkewed'
+
+@pytest.mark.auth_aws2
+def test_bucket_create_bad_date_before_epoch_aws2():
+    v2_client = get_v2_client()
+    headers = {'x-amz-date': 'Tue, 07 Jul 1950 21:53:04 GMT'}
+    e = _add_header_create_bad_bucket(headers, v2_client)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_iam.py b/src/test/rgw/s3-tests/s3tests/functional/test_iam.py
new file mode 100644
index 00000000000..d16015b9554
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_iam.py
@@ -0,0 +1,3007 @@
+import json
+import datetime
+import time
+
+from botocore.exceptions import ClientError
+import pytest
+
+from .utils import assert_raises
+from .test_s3 import _multipart_upload
+from . import (
+    configfile,
+    setup_teardown,
+    get_alt_client,
+    get_iam_client,
+    get_iam_root_client,
+    get_iam_root_account_id,
+    get_iam_alt_root_client,
+    get_iam_alt_root_user_id,
+    get_iam_alt_root_email,
+    get_iam_alt_root_account_id,
+    make_iam_name,
+    get_iam_path_prefix,
+    get_new_bucket,
+    get_new_bucket_name,
+    get_iam_s3client,
+    get_alt_iam_client,
+    get_alt_user_id,
+    get_sts_client,
+)
+from .utils import _get_status, _get_status_and_error_code
+from .iam import iam_root, iam_alt_root
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_put_user_policy():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.delete_user_policy(PolicyName='AllAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_put_user_policy_invalid_user():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+    e = assert_raises(ClientError, client.put_user_policy, PolicyDocument=policy_document,
+                      PolicyName='AllAccessPolicy', UserName="some-non-existing-user-id")
+    status = _get_status(e.response)
+    assert status == 404
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_put_user_policy_parameter_limit():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": [{
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}] * 1000
+         }
+    )
+    e = assert_raises(ClientError, client.put_user_policy, PolicyDocument=policy_document,
+                      PolicyName='AllAccessPolicy' * 10, UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 400
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_rgw
+def test_put_user_policy_invalid_element():
+    client = get_iam_client()
+
+    # With Version other than 2012-10-17
+    policy_document = json.dumps(
+        {"Version": "2010-10-17",
+         "Statement": [{
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}]
+         }
+    )
+    e = assert_raises(ClientError, client.put_user_policy, PolicyDocument=policy_document,
+                      PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 400
+
+    # With no Statement
+    policy_document = json.dumps(
+        {
+            "Version": "2012-10-17",
+        }
+    )
+    e = assert_raises(ClientError, client.put_user_policy, PolicyDocument=policy_document,
+                      PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 400
+
+    # with same Sid for 2 statements
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": [
+             {"Sid": "98AB54CF",
+              "Effect": "Allow",
+              "Action": "*",
+              "Resource": "*"},
+             {"Sid": "98AB54CF",
+              "Effect": "Allow",
+              "Action": "*",
+              "Resource": "*"}]
+         }
+    )
+    e = assert_raises(ClientError, client.put_user_policy, PolicyDocument=policy_document,
+                      PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 400
+
+    # with Principal
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": [{
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*",
+             "Principal": "arn:aws:iam:::username"}]
+         }
+    )
+    e = assert_raises(ClientError, client.put_user_policy, PolicyDocument=policy_document,
+                      PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 400
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_put_existing_user_policy():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}
+         }
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                           UserName=get_alt_user_id())
+    client.delete_user_policy(PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_list_user_policy():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}
+         }
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.list_user_policies(UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    client.delete_user_policy(PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_list_user_policy_invalid_user():
+    client = get_iam_client()
+    e = assert_raises(ClientError, client.list_user_policies, UserName="some-non-existing-user-id")
+    status = _get_status(e.response)
+    assert status == 404
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_get_user_policy():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_user_policy(PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.delete_user_policy(PolicyName='AllAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_get_user_policy_invalid_user():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    e = assert_raises(ClientError, client.get_user_policy, PolicyName='AllAccessPolicy',
+                      UserName="some-non-existing-user-id")
+    status = _get_status(e.response)
+    assert status == 404
+    client.delete_user_policy(PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_rgw
+def test_get_user_policy_invalid_policy_name():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+    client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                           UserName=get_alt_user_id())
+    e = assert_raises(ClientError, client.get_user_policy, PolicyName='non-existing-policy-name',
+                      UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 404
+    client.delete_user_policy(PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_rgw
+def test_get_deleted_user_policy():
+    client = get_iam_client()
+
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+    client.put_user_policy(PolicyDocument=policy_document, PolicyName='AllAccessPolicy',
+                           UserName=get_alt_user_id())
+    client.delete_user_policy(PolicyName='AllAccessPolicy', UserName=get_alt_user_id())
+    e = assert_raises(ClientError, client.get_user_policy, PolicyName='AllAccessPolicy',
+                      UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 404
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_get_user_policy_from_multiple_policies():
+    client = get_iam_client()
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy1',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy2',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_user_policy(PolicyName='AllowAccessPolicy2',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy1',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy2',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_delete_user_policy():
+    client = get_iam_client()
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_delete_user_policy_invalid_user():
+    client = get_iam_client()
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    e = assert_raises(ClientError, client.delete_user_policy, PolicyName='AllAccessPolicy',
+                      UserName="some-non-existing-user-id")
+    status = _get_status(e.response)
+    assert status == 404
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_delete_user_policy_invalid_policy_name():
+    client = get_iam_client()
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    e = assert_raises(ClientError, client.delete_user_policy, PolicyName='non-existing-policy-name',
+                      UserName=get_alt_user_id())
+    status = _get_status(e.response)
+    assert status == 404
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_delete_user_policy_from_multiple_policies():
+    client = get_iam_client()
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": "*",
+             "Resource": "*"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy1',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy2',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy3',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy1',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy2',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_user_policy(PolicyName='AllowAccessPolicy3',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy3',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_allow_bucket_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client_alt = get_alt_client()
+
+    s3_client_iam = get_iam_s3client()
+    bucket = get_new_bucket(client=s3_client_iam)
+    s3_client_iam.put_object(Bucket=bucket, Key='foo', Body='bar')
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": ["s3:ListBucket", "s3:DeleteBucket"],
+             "Resource": f"arn:aws:s3:::{bucket}"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy', UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = s3_client_alt.list_objects(Bucket=bucket)
+    object_found = False
+    for object_received in response['Contents']:
+        if "foo" == object_received['Key']:
+            object_found = True
+            break
+    if not object_found:
+        raise AssertionError("Object is not listed")
+
+    response = s3_client_iam.delete_object(Bucket=bucket, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = s3_client_alt.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = s3_client_iam.list_buckets()
+    for bucket in response['Buckets']:
+        if bucket == bucket['Name']:
+            raise AssertionError("deleted bucket is getting listed")
+
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_deny_bucket_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client = get_alt_client()
+    bucket = get_new_bucket(client=s3_client)
+
+    policy_document_deny = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Deny",
+             "Action": ["s3:ListAllMyBuckets", "s3:DeleteBucket"],
+             "Resource": "arn:aws:s3:::*"}}
+    )
+
+    response = client.put_user_policy(PolicyDocument=policy_document_deny,
+                                      PolicyName='DenyAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    e = assert_raises(ClientError, s3_client.list_buckets)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    e = assert_raises(ClientError, s3_client.delete_bucket, Bucket=bucket)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    response = client.delete_user_policy(PolicyName='DenyAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = s3_client.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_allow_object_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client_alt = get_alt_client()
+    s3_client_iam = get_iam_s3client()
+    bucket = get_new_bucket(client=s3_client_iam)
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
+             "Resource": f"arn:aws:s3:::{bucket}/*"}}
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy', UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_alt.put_object(Bucket=bucket, Key='foo', Body='bar')
+    response = s3_client_alt.get_object(Bucket=bucket, Key='foo')
+    body = response['Body'].read()
+    if type(body) is bytes:
+        body = body.decode()
+    assert body == "bar"
+    response = s3_client_alt.delete_object(Bucket=bucket, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    e = assert_raises(ClientError, s3_client_iam.get_object, Bucket=bucket, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+    response = s3_client_iam.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_deny_object_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client_alt = get_alt_client()
+    bucket = get_new_bucket(client=s3_client_alt)
+    s3_client_alt.put_object(Bucket=bucket, Key='foo', Body='bar')
+
+    policy_document_deny = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": [{
+             "Effect": "Deny",
+             "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
+             "Resource": f"arn:aws:s3:::{bucket}/*"}, {
+             "Effect": "Allow",
+             "Action": ["s3:DeleteBucket"],
+             "Resource": f"arn:aws:s3:::{bucket}"}]}
+    )
+    client.put_user_policy(PolicyDocument=policy_document_deny, PolicyName='DenyAccessPolicy',
+                           UserName=get_alt_user_id())
+
+    e = assert_raises(ClientError, s3_client_alt.put_object, Bucket=bucket, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    e = assert_raises(ClientError, s3_client_alt.get_object, Bucket=bucket, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    e = assert_raises(ClientError, s3_client_alt.delete_object, Bucket=bucket, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    response = client.delete_user_policy(PolicyName='DenyAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_allow_multipart_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client_alt = get_alt_client()
+    s3_client_iam = get_iam_s3client()
+    bucket = get_new_bucket(client=s3_client_iam)
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": ["s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload"],
+             "Resource": "arn:aws:s3:::*"}}
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document_allow,
+                                      PolicyName='AllowAccessPolicy', UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    key = "mymultipart"
+    mb = 1024 * 1024
+
+    (upload_id, _, _) = _multipart_upload(client=s3_client_iam, bucket_name=bucket, key=key,
+                                          size=5 * mb)
+    response = s3_client_alt.list_multipart_uploads(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = s3_client_alt.abort_multipart_upload(Bucket=bucket, Key=key, UploadId=upload_id)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = s3_client_iam.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_deny_multipart_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client = get_alt_client()
+    bucket = get_new_bucket(client=s3_client)
+
+    policy_document_deny = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Deny",
+             "Action": ["s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload"],
+             "Resource": "arn:aws:s3:::*"}}
+    )
+    response = client.put_user_policy(PolicyDocument=policy_document_deny,
+                                      PolicyName='DenyAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    key = "mymultipart"
+    mb = 1024 * 1024
+
+    (upload_id, _, _) = _multipart_upload(client=s3_client, bucket_name=bucket, key=key,
+                                          size=5 * mb)
+
+    e = assert_raises(ClientError, s3_client.list_multipart_uploads, Bucket=bucket)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    e = assert_raises(ClientError, s3_client.abort_multipart_upload, Bucket=bucket,
+                      Key=key, UploadId=upload_id)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    response = s3_client.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = client.delete_user_policy(PolicyName='DenyAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_allow_tagging_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client_alt = get_alt_client()
+    s3_client_iam = get_iam_s3client()
+    bucket = get_new_bucket(client=s3_client_iam)
+
+    policy_document_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Allow",
+             "Action": ["s3:PutBucketTagging", "s3:GetBucketTagging",
+                        "s3:PutObjectTagging", "s3:GetObjectTagging"],
+             "Resource": f"arn:aws:s3:::*"}}
+    )
+    client.put_user_policy(PolicyDocument=policy_document_allow, PolicyName='AllowAccessPolicy',
+                           UserName=get_alt_user_id())
+    tags = {'TagSet': [{'Key': 'Hello', 'Value': 'World'}, ]}
+
+    response = s3_client_alt.put_bucket_tagging(Bucket=bucket, Tagging=tags)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = s3_client_alt.get_bucket_tagging(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['TagSet'][0]['Key'] == 'Hello'
+    assert response['TagSet'][0]['Value'] == 'World'
+
+    obj_key = 'obj'
+    response = s3_client_iam.put_object(Bucket=bucket, Key=obj_key, Body='obj_body')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = s3_client_alt.put_object_tagging(Bucket=bucket, Key=obj_key, Tagging=tags)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = s3_client_alt.get_object_tagging(Bucket=bucket, Key=obj_key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['TagSet'] == tags['TagSet']
+
+    response = s3_client_iam.delete_object(Bucket=bucket, Key=obj_key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = s3_client_iam.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_deny_tagging_actions_in_user_policy():
+    client = get_iam_client()
+    s3_client = get_alt_client()
+    bucket = get_new_bucket(client=s3_client)
+
+    policy_document_deny = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {
+             "Effect": "Deny",
+             "Action": ["s3:PutBucketTagging", "s3:GetBucketTagging",
+                        "s3:PutObjectTagging", "s3:DeleteObjectTagging"],
+             "Resource": "arn:aws:s3:::*"}}
+    )
+    client.put_user_policy(PolicyDocument=policy_document_deny, PolicyName='DenyAccessPolicy',
+                           UserName=get_alt_user_id())
+    tags = {'TagSet': [{'Key': 'Hello', 'Value': 'World'}, ]}
+
+    e = assert_raises(ClientError, s3_client.put_bucket_tagging, Bucket=bucket, Tagging=tags)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    e = assert_raises(ClientError, s3_client.get_bucket_tagging, Bucket=bucket)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    obj_key = 'obj'
+    response = s3_client.put_object(Bucket=bucket, Key=obj_key, Body='obj_body')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    e = assert_raises(ClientError, s3_client.put_object_tagging, Bucket=bucket, Key=obj_key,
+                      Tagging=tags)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    e = assert_raises(ClientError, s3_client.delete_object_tagging, Bucket=bucket, Key=obj_key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    response = s3_client.delete_object(Bucket=bucket, Key=obj_key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = s3_client.delete_bucket(Bucket=bucket)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    response = client.delete_user_policy(PolicyName='DenyAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_verify_conflicting_user_policy_statements():
+    s3client = get_alt_client()
+    bucket = get_new_bucket(client=s3client)
+    policy_document = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": [
+             {"Sid": "98AB54CG",
+              "Effect": "Allow",
+              "Action": "s3:ListBucket",
+              "Resource": f"arn:aws:s3:::{bucket}"},
+             {"Sid": "98AB54CA",
+              "Effect": "Deny",
+              "Action": "s3:ListBucket",
+              "Resource": f"arn:aws:s3:::{bucket}"}
+         ]}
+    )
+    client = get_iam_client()
+    response = client.put_user_policy(PolicyDocument=policy_document, PolicyName='DenyAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    e = assert_raises(ClientError, s3client.list_objects, Bucket=bucket)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    response = client.delete_user_policy(PolicyName='DenyAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+@pytest.mark.fails_on_dbstore
+def test_verify_conflicting_user_policies():
+    s3client = get_alt_client()
+    bucket = get_new_bucket(client=s3client)
+    policy_allow = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {"Sid": "98AB54CG",
+                       "Effect": "Allow",
+                       "Action": "s3:ListBucket",
+                       "Resource": f"arn:aws:s3:::{bucket}"}}
+    )
+    policy_deny = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {"Sid": "98AB54CGZ",
+                       "Effect": "Deny",
+                       "Action": "s3:ListBucket",
+                       "Resource": f"arn:aws:s3:::{bucket}"}}
+    )
+    client = get_iam_client()
+    response = client.put_user_policy(PolicyDocument=policy_allow, PolicyName='AllowAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.put_user_policy(PolicyDocument=policy_deny, PolicyName='DenyAccessPolicy',
+                                      UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    e = assert_raises(ClientError, s3client.list_objects, Bucket=bucket)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    response = client.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.delete_user_policy(PolicyName='DenyAccessPolicy',
+                                         UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.user_policy
+@pytest.mark.iam_tenant
+def test_verify_allow_iam_actions():
+    policy1 = json.dumps(
+        {"Version": "2012-10-17",
+         "Statement": {"Sid": "98AB54CGA",
+                       "Effect": "Allow",
+                       "Action": ["iam:PutUserPolicy", "iam:GetUserPolicy",
+                                  "iam:ListUserPolicies", "iam:DeleteUserPolicy"],
+                       "Resource": f"arn:aws:iam:::user/{get_alt_user_id()}"}}
+    )
+    client1 = get_iam_client()
+    iam_client_alt = get_alt_iam_client()
+
+    response = client1.put_user_policy(PolicyDocument=policy1, PolicyName='AllowAccessPolicy',
+                                       UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = iam_client_alt.get_user_policy(PolicyName='AllowAccessPolicy',
+                                       UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = iam_client_alt.list_user_policies(UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = iam_client_alt.delete_user_policy(PolicyName='AllowAccessPolicy',
+                                          UserName=get_alt_user_id())
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+# IAM User apis
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_create(iam_root):
+    path = get_iam_path_prefix()
+    name1 = make_iam_name('U1')
+    response = iam_root.create_user(UserName=name1, Path=path)
+    user = response['User']
+    assert user['Path'] == path
+    assert user['UserName'] == name1
+    assert len(user['UserId'])
+    assert user['Arn'].startswith('arn:aws:iam:')
+    assert user['Arn'].endswith(f':user{path}{name1}')
+    assert user['CreateDate'] > datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
+
+    path2 = get_iam_path_prefix() + 'foo/'
+    with pytest.raises(iam_root.exceptions.EntityAlreadyExistsException):
+        iam_root.create_user(UserName=name1, Path=path2)
+
+    name2 = make_iam_name('U2')
+    response = iam_root.create_user(UserName=name2, Path=path2)
+    user = response['User']
+    assert user['Path'] == path2
+    assert user['UserName'] == name2
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_case_insensitive_name(iam_root):
+    path = get_iam_path_prefix()
+    name_upper = make_iam_name('U1')
+    name_lower = make_iam_name('u1')
+    response = iam_root.create_user(UserName=name_upper, Path=path)
+    user = response['User']
+
+    # name is case-insensitive, so 'u1' should also conflict
+    with pytest.raises(iam_root.exceptions.EntityAlreadyExistsException):
+        iam_root.create_user(UserName=name_lower)
+
+    # search for 'u1' should return the same 'U1' user
+    response = iam_root.get_user(UserName=name_lower)
+    assert user == response['User']
+
+    # delete for 'u1' should delete the same 'U1' user
+    iam_root.delete_user(UserName=name_lower)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_user(UserName=name_lower)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_delete(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('U1')
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_user(UserName=name)
+
+    response = iam_root.create_user(UserName=name, Path=path)
+    uid = response['User']['UserId']
+    create_date = response['User']['CreateDate']
+
+    iam_root.delete_user(UserName=name)
+
+    response = iam_root.create_user(UserName=name, Path=path)
+    assert uid != response['User']['UserId']
+    assert create_date <= response['User']['CreateDate']
+
+def user_list_names(client, **kwargs):
+    p = client.get_paginator('list_users')
+    usernames = []
+    for response in p.paginate(**kwargs):
+        usernames += [u['UserName'] for u in response['Users']]
+    return usernames
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_list(iam_root):
+    path = get_iam_path_prefix()
+    response = iam_root.list_users(PathPrefix=path)
+    assert len(response['Users']) == 0
+    assert response['IsTruncated'] == False
+
+    name1 = make_iam_name('aa')
+    name2 = make_iam_name('Ab')
+    name3 = make_iam_name('ac')
+    name4 = make_iam_name('Ad')
+
+    # sort order is independent of CreateDate, Path, and UserName capitalization
+    iam_root.create_user(UserName=name4, Path=path+'w/')
+    iam_root.create_user(UserName=name3, Path=path+'x/')
+    iam_root.create_user(UserName=name2, Path=path+'y/')
+    iam_root.create_user(UserName=name1, Path=path+'z/')
+
+    assert [name1, name2, name3, name4] == \
+            user_list_names(iam_root, PathPrefix=path)
+    assert [name1, name2, name3, name4] == \
+            user_list_names(iam_root, PathPrefix=path, PaginationConfig={'PageSize': 1})
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_list_path_prefix(iam_root):
+    path = get_iam_path_prefix()
+    response = iam_root.list_users(PathPrefix=path)
+    assert len(response['Users']) == 0
+    assert response['IsTruncated'] == False
+
+    name1 = make_iam_name('a')
+    name2 = make_iam_name('b')
+    name3 = make_iam_name('c')
+    name4 = make_iam_name('d')
+
+    iam_root.create_user(UserName=name1, Path=path)
+    iam_root.create_user(UserName=name2, Path=path)
+    iam_root.create_user(UserName=name3, Path=path+'a/')
+    iam_root.create_user(UserName=name4, Path=path+'a/x/')
+
+    assert [name1, name2, name3, name4] == \
+            user_list_names(iam_root, PathPrefix=path)
+    assert [name1, name2, name3, name4] == \
+            user_list_names(iam_root, PathPrefix=path,
+                            PaginationConfig={'PageSize': 1})
+    assert [name3, name4] == \
+            user_list_names(iam_root, PathPrefix=path+'a')
+    assert [name3, name4] == \
+            user_list_names(iam_root, PathPrefix=path+'a',
+                            PaginationConfig={'PageSize': 1})
+    assert [name4] == \
+            user_list_names(iam_root, PathPrefix=path+'a/x')
+    assert [name4] == \
+            user_list_names(iam_root, PathPrefix=path+'a/x',
+                            PaginationConfig={'PageSize': 1})
+    assert [] == user_list_names(iam_root, PathPrefix=path+'a/x/d')
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_update_name(iam_root):
+    path = get_iam_path_prefix()
+    name1 = make_iam_name('a')
+    new_name1 = make_iam_name('z')
+    name2 = make_iam_name('b')
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.update_user(UserName=name1, NewUserName=new_name1)
+
+    iam_root.create_user(UserName=name1, Path=path)
+    iam_root.create_user(UserName=name2, Path=path+'m/')
+    assert [name1, name2] == user_list_names(iam_root, PathPrefix=path)
+
+    response = iam_root.get_user(UserName=name1)
+    assert name1 == response['User']['UserName']
+    uid = response['User']['UserId']
+
+    iam_root.update_user(UserName=name1, NewUserName=new_name1)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_user(UserName=name1)
+
+    response = iam_root.get_user(UserName=new_name1)
+    assert new_name1 == response['User']['UserName']
+    assert uid == response['User']['UserId']
+    assert response['User']['Arn'].endswith(f':user{path}{new_name1}')
+
+    assert [name2, new_name1] == user_list_names(iam_root, PathPrefix=path)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_update_path(iam_root):
+    path = get_iam_path_prefix()
+    name1 = make_iam_name('a')
+    name2 = make_iam_name('b')
+    iam_root.create_user(UserName=name1, Path=path)
+    iam_root.create_user(UserName=name2, Path=path+'m/')
+    assert [name1, name2] == user_list_names(iam_root, PathPrefix=path)
+
+    response = iam_root.get_user(UserName=name1)
+    assert name1 == response['User']['UserName']
+    assert path == response['User']['Path']
+    uid = response['User']['UserId']
+
+    iam_root.update_user(UserName=name1, NewPath=path+'z/')
+
+    response = iam_root.get_user(UserName=name1)
+    assert name1 == response['User']['UserName']
+    assert f'{path}z/' == response['User']['Path']
+    assert uid == response['User']['UserId']
+    assert response['User']['Arn'].endswith(f':user{path}z/{name1}')
+
+    assert [name1, name2] == user_list_names(iam_root, PathPrefix=path)
+
+
+# IAM AccessKey apis
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_access_key_create(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('a')
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.create_access_key(UserName=name)
+
+    iam_root.create_user(UserName=name, Path=path)
+
+    response = iam_root.create_access_key(UserName=name)
+    key = response['AccessKey']
+    assert name == key['UserName']
+    assert len(key['AccessKeyId'])
+    assert len(key['SecretAccessKey'])
+    assert 'Active' == key['Status']
+    assert key['CreateDate'] > datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_current_user_access_key_create(iam_root):
+    # omit the UserName argument to operate on the current authenticated
+    # user (assumed to be an account root user)
+
+    response = iam_root.create_access_key()
+    key = response['AccessKey']
+    keyid = key['AccessKeyId']
+    assert len(keyid)
+    try:
+        assert len(key['SecretAccessKey'])
+        assert 'Active' == key['Status']
+        assert key['CreateDate'] > datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
+    finally:
+        # iam_root doesn't see the account root user, so clean up
+        # this key manually
+        iam_root.delete_access_key(AccessKeyId=keyid)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_access_key_update(iam_root):
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.update_access_key(UserName='nosuchuser', AccessKeyId='abcdefghijklmnopqrstu', Status='Active')
+
+    path = get_iam_path_prefix()
+    name = make_iam_name('a')
+    iam_root.create_user(UserName=name, Path=path)
+
+    response = iam_root.create_access_key(UserName=name)
+    key = response['AccessKey']
+    keyid = key['AccessKeyId']
+    create_date = key['CreateDate']
+    assert create_date > datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.update_access_key(UserName=name, AccessKeyId='abcdefghijklmnopqrstu', Status='Active')
+
+    iam_root.update_access_key(UserName=name, AccessKeyId=keyid, Status='Active')
+    iam_root.update_access_key(UserName=name, AccessKeyId=keyid, Status='Inactive')
+
+    response = iam_root.list_access_keys(UserName=name)
+    keys = response['AccessKeyMetadata']
+    assert 1 == len(keys)
+    key = keys[0]
+    assert name == key['UserName']
+    assert keyid == key['AccessKeyId']
+    assert 'Inactive' == key['Status']
+    assert create_date == key['CreateDate'] # CreateDate unchanged by update_access_key()
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_current_user_access_key_update(iam_root):
+    # omit the UserName argument to operate on the current authenticated
+    # user (assumed to be an account root user)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.update_access_key(AccessKeyId='abcdefghijklmnopqrstu', Status='Active')
+
+    response = iam_root.create_access_key()
+    key = response['AccessKey']
+    keyid = key['AccessKeyId']
+    assert len(keyid)
+    try:
+        iam_root.update_access_key(AccessKeyId=keyid, Status='Active')
+        iam_root.update_access_key(AccessKeyId=keyid, Status='Inactive')
+
+        # find the access key id we created
+        p = iam_root.get_paginator('list_access_keys')
+        for response in p.paginate():
+            for key in response['AccessKeyMetadata']:
+                if keyid == key['AccessKeyId']:
+                    assert 'Inactive' == key['Status']
+                    return
+        assert False, f'AccessKeyId={keyid} not found in list_access_keys()'
+
+    finally:
+        # iam_root doesn't see the account root user, so clean up
+        # this key manually
+        iam_root.delete_access_key(AccessKeyId=keyid)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_access_key_delete(iam_root):
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_access_key(UserName='nosuchuser', AccessKeyId='abcdefghijklmnopqrstu')
+
+    path = get_iam_path_prefix()
+    name = make_iam_name('a')
+    iam_root.create_user(UserName=name, Path=path)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_access_key(UserName=name, AccessKeyId='abcdefghijklmnopqrstu')
+
+    response = iam_root.create_access_key(UserName=name)
+    keyid = response['AccessKey']['AccessKeyId']
+
+    iam_root.delete_access_key(UserName=name, AccessKeyId=keyid)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_access_key(UserName=name, AccessKeyId=keyid)
+
+    response = iam_root.list_access_keys(UserName=name)
+    keys = response['AccessKeyMetadata']
+    assert 0 == len(keys)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_current_user_access_key_delete(iam_root):
+    # omit the UserName argument to operate on the current authenticated
+    # user (assumed to be an account root user)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_access_key(AccessKeyId='abcdefghijklmnopqrstu')
+
+    response = iam_root.create_access_key()
+    keyid = response['AccessKey']['AccessKeyId']
+
+    iam_root.delete_access_key(AccessKeyId=keyid)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_access_key(AccessKeyId=keyid)
+
+    # make sure list_access_keys() doesn't return the access key id we deleted
+    p = iam_root.get_paginator('list_access_keys')
+    for response in p.paginate():
+        for key in response['AccessKeyMetadata']:
+            assert keyid != key['AccessKeyId']
+
+def user_list_key_ids(client, **kwargs):
+    p = client.get_paginator('list_access_keys')
+    ids = []
+    for response in p.paginate(**kwargs):
+        ids += [k['AccessKeyId'] for k in response['AccessKeyMetadata']]
+    return ids
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_access_key_list(iam_root):
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.list_access_keys(UserName='nosuchuser')
+
+    path = get_iam_path_prefix()
+    name = make_iam_name('a')
+    iam_root.create_user(UserName=name, Path=path)
+
+    assert [] == user_list_key_ids(iam_root, UserName=name)
+    assert [] == user_list_key_ids(iam_root, UserName=name, PaginationConfig={'PageSize': 1})
+
+    id1 = iam_root.create_access_key(UserName=name)['AccessKey']['AccessKeyId']
+
+    assert [id1] == user_list_key_ids(iam_root, UserName=name)
+    assert [id1] == user_list_key_ids(iam_root, UserName=name, PaginationConfig={'PageSize': 1})
+
+    id2 = iam_root.create_access_key(UserName=name)['AccessKey']['AccessKeyId']
+    # AccessKeysPerUser=2 is the default quota in aws
+
+    keys = sorted([id1, id2])
+    assert keys == sorted(user_list_key_ids(iam_root, UserName=name))
+    assert keys == sorted(user_list_key_ids(iam_root, UserName=name, PaginationConfig={'PageSize': 1}))
+
+def retry_on(code, tries, func, *args, **kwargs):
+    for i in range(tries):
+        try:
+            return func(*args, **kwargs)
+        except ClientError as e:
+            err = e.response['Error']['Code']
+            if i + 1 < tries and err in code:
+                print(f'Got {err}, retrying in {i}s..')
+                time.sleep(i)
+                continue
+            raise
+
+
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_account_user_bucket_policy_allow(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    response = iam_root.create_user(UserName=name, Path=path)
+    user_arn = response['User']['Arn']
+    assert user_arn.startswith('arn:aws:iam:')
+    assert user_arn.endswith(f':user{path}{name}')
+
+    key = iam_root.create_access_key(UserName=name)['AccessKey']
+    client = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                              aws_secret_access_key=key['SecretAccessKey'])
+
+    # create a bucket with the root user
+    roots3 = get_iam_root_client(service_name='s3')
+    bucket = get_new_bucket(roots3)
+    try:
+        # the access key may take a bit to start working. retry until it returns
+        # something other than InvalidAccessKeyId
+        e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, client.list_objects, Bucket=bucket)
+        # expect AccessDenied because no identity policy allows s3 actions
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a bucket policy that allows s3:ListBucket for the iam user's arn
+        policy = json.dumps({
+            'Version': '2012-10-17',
+            'Statement': [{
+                'Effect': 'Allow',
+                'Principal': {'AWS': user_arn},
+                'Action': 's3:ListBucket',
+                'Resource': f'arn:aws:s3:::{bucket}'
+                }]
+            })
+        roots3.put_bucket_policy(Bucket=bucket, Policy=policy)
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, client.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+
+# IAM UserPolicy apis
+@pytest.mark.user_policy
+@pytest.mark.iam_account
+def test_account_user_policy(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    policy_name = 'List'
+    bucket_name = get_new_bucket_name()
+    policy1 = json.dumps({'Version': '2012-10-17', 'Statement': [
+        {'Effect': 'Deny',
+         'Action': 's3:ListBucket',
+         'Resource': f'arn:aws:s3:::{bucket_name}'}]})
+    policy2 = json.dumps({'Version': '2012-10-17', 'Statement': [
+        {'Effect': 'Allow',
+         'Action': 's3:ListBucket',
+         'Resource': f'arn:aws:s3:::{bucket_name}'}]})
+
+    # Get/Put/Delete fail on nonexistent UserName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_user_policy(UserName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_user_policy(UserName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.put_user_policy(UserName=name, PolicyName=policy_name, PolicyDocument=policy1)
+
+    iam_root.create_user(UserName=name, Path=path)
+
+    # Get/Delete fail on nonexistent PolicyName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_user_policy(UserName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_user_policy(UserName=name, PolicyName=policy_name)
+
+    iam_root.put_user_policy(UserName=name, PolicyName=policy_name, PolicyDocument=policy1)
+
+    response = iam_root.get_user_policy(UserName=name, PolicyName=policy_name)
+    assert policy1 == json.dumps(response['PolicyDocument'])
+    response = iam_root.list_user_policies(UserName=name)
+    assert [policy_name] == response['PolicyNames']
+
+    iam_root.put_user_policy(UserName=name, PolicyName=policy_name, PolicyDocument=policy2)
+
+    response = iam_root.get_user_policy(UserName=name, PolicyName=policy_name)
+    assert policy2 == json.dumps(response['PolicyDocument'])
+    response = iam_root.list_user_policies(UserName=name)
+    assert [policy_name] == response['PolicyNames']
+
+    iam_root.delete_user_policy(UserName=name, PolicyName=policy_name)
+
+    # Get/Delete fail after Delete
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_user_policy(UserName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_user_policy(UserName=name, PolicyName=policy_name)
+
+    response = iam_root.list_user_policies(UserName=name)
+    assert [] == response['PolicyNames']
+
+@pytest.mark.user_policy
+@pytest.mark.iam_account
+def test_account_user_policy_managed(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    policy1 = 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
+    policy2 = 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
+
+    # Attach/Detach/List fail on nonexistent UserName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.attach_user_policy(UserName=name, PolicyArn=policy1)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_user_policy(UserName=name, PolicyArn=policy1)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.list_attached_user_policies(UserName=name)
+
+    iam_root.create_user(UserName=name, Path=path)
+
+    # Detach fails on unattached PolicyArn
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_user_policy(UserName=name, PolicyArn=policy1)
+
+    iam_root.attach_user_policy(UserName=name, PolicyArn=policy1)
+    iam_root.attach_user_policy(UserName=name, PolicyArn=policy1)
+
+    response = iam_root.list_attached_user_policies(UserName=name)
+    assert len(response['AttachedPolicies']) == 1
+    assert 'AmazonS3FullAccess' == response['AttachedPolicies'][0]['PolicyName']
+    assert policy1 == response['AttachedPolicies'][0]['PolicyArn']
+
+    iam_root.attach_user_policy(UserName=name, PolicyArn=policy2)
+
+    response = iam_root.list_attached_user_policies(UserName=name)
+    policies = response['AttachedPolicies']
+    assert len(policies) == 2
+    names = [p['PolicyName'] for p in policies]
+    arns = [p['PolicyArn'] for p in policies]
+    assert 'AmazonS3FullAccess' in names
+    assert policy1 in arns
+    assert 'AmazonS3ReadOnlyAccess' in names
+    assert policy2 in arns
+
+    iam_root.detach_user_policy(UserName=name, PolicyArn=policy2)
+
+    # Detach fails after Detach
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_user_policy(UserName=name, PolicyArn=policy2)
+
+    response = iam_root.list_attached_user_policies(UserName=name)
+    assert len(response['AttachedPolicies']) == 1
+    assert 'AmazonS3FullAccess' == response['AttachedPolicies'][0]['PolicyName']
+    assert policy1 == response['AttachedPolicies'][0]['PolicyArn']
+
+    # DeleteUser fails while policies are still attached
+    with pytest.raises(iam_root.exceptions.DeleteConflictException):
+        iam_root.delete_user(UserName=name)
+
+@pytest.mark.user_policy
+@pytest.mark.iam_account
+def test_account_user_policy_allow(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    bucket_name = get_new_bucket_name()
+    iam_root.create_user(UserName=name, Path=path)
+
+    key = iam_root.create_access_key(UserName=name)['AccessKey']
+    client = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                              aws_secret_access_key=key['SecretAccessKey'])
+
+    # the access key may take a bit to start working. retry until it returns
+    # something other than InvalidAccessKeyId
+    e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, client.list_buckets)
+    # expect AccessDenied because no identity policy allows s3 actions
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    # add a user policy that allows s3 actions
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:*',
+            'Resource': '*'
+            }]
+        })
+    policy_name = 'AllowStar'
+    iam_root.put_user_policy(UserName=name, PolicyName=policy_name, PolicyDocument=policy)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, client.list_buckets)
+
+
+def group_list_names(client, **kwargs):
+    p = client.get_paginator('list_groups')
+    names = []
+    for response in p.paginate(**kwargs):
+        names += [u['GroupName'] for u in response['Groups']]
+    return names
+
+# IAM Group apis
+@pytest.mark.group
+@pytest.mark.iam_account
+def test_account_group_create(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('G1')
+
+    assert [] == group_list_names(iam_root, PathPrefix=path)
+
+    response = iam_root.create_group(GroupName=name, Path=path)
+    group = response['Group']
+    assert path == group['Path']
+    assert name == group['GroupName']
+    assert len(group['GroupId'])
+    arn = group['Arn']
+    assert arn.startswith('arn:aws:iam:')
+    assert arn.endswith(f':group{path}{name}')
+
+    with pytest.raises(iam_root.exceptions.EntityAlreadyExistsException):
+        iam_root.create_group(GroupName=name)
+
+    response = iam_root.get_group(GroupName=name)
+    assert group == response['Group']
+
+    assert [name] == group_list_names(iam_root, PathPrefix=path)
+
+    iam_root.delete_group(GroupName=name)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_group(GroupName=name)
+
+    assert [] == group_list_names(iam_root, PathPrefix=path)
+
+@pytest.mark.iam_account
+@pytest.mark.group
+def test_account_group_case_insensitive_name(iam_root):
+    path = get_iam_path_prefix()
+    name_upper = make_iam_name('G1')
+    name_lower = make_iam_name('g1')
+    response = iam_root.create_group(GroupName=name_upper, Path=path)
+    group = response['Group']
+
+    with pytest.raises(iam_root.exceptions.EntityAlreadyExistsException):
+        iam_root.create_group(GroupName=name_lower)
+
+    response = iam_root.get_group(GroupName=name_lower)
+    assert group == response['Group']
+
+    iam_root.delete_group(GroupName=name_lower)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_group(GroupName=name_upper)
+
+@pytest.mark.iam_account
+@pytest.mark.group
+def test_account_group_list(iam_root):
+    path = get_iam_path_prefix()
+    response = iam_root.list_groups(PathPrefix=path)
+    assert len(response['Groups']) == 0
+    assert response['IsTruncated'] == False
+
+    name1 = make_iam_name('aa')
+    name2 = make_iam_name('Ab')
+    name3 = make_iam_name('ac')
+    name4 = make_iam_name('Ad')
+
+    # sort order is independent of Path and GroupName capitalization
+    iam_root.create_group(GroupName=name4, Path=path+'w/')
+    iam_root.create_group(GroupName=name3, Path=path+'x/')
+    iam_root.create_group(GroupName=name2, Path=path+'y/')
+    iam_root.create_group(GroupName=name1, Path=path+'z/')
+
+    assert [name1, name2, name3, name4] == \
+            group_list_names(iam_root, PathPrefix=path)
+    assert [name1, name2, name3, name4] == \
+            group_list_names(iam_root, PathPrefix=path, PaginationConfig={'PageSize': 1})
+
+@pytest.mark.group
+@pytest.mark.iam_account
+def test_account_group_update(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('G1')
+    response = iam_root.create_group(GroupName=name, Path=path)
+    group_id = response['Group']['GroupId']
+
+    username = make_iam_name('U1')
+    iam_root.create_user(UserName=username, Path=path)
+
+    iam_root.add_user_to_group(GroupName=name, UserName=username)
+
+    response = iam_root.list_groups_for_user(UserName=username)
+    groups = response['Groups']
+    assert len(groups) == 1
+    assert path == groups[0]['Path']
+    assert name == groups[0]['GroupName']
+    assert group_id == groups[0]['GroupId']
+
+    new_path = path + 'new/'
+    new_name = make_iam_name('NG1')
+    iam_root.update_group(GroupName=name, NewPath=new_path, NewGroupName=new_name)
+
+    response = iam_root.get_group(GroupName=new_name)
+    group = response['Group']
+    assert new_path == group['Path']
+    assert new_name == group['GroupName']
+    assert group_id == group['GroupId']
+    arn = group['Arn']
+    assert arn.startswith('arn:aws:iam:')
+    assert arn.endswith(f':group{new_path}{new_name}')
+    users = response['Users']
+    assert len(users) == 1
+    assert username == users[0]['UserName']
+
+    response = iam_root.list_groups_for_user(UserName=username)
+    groups = response['Groups']
+    assert len(groups) == 1
+    assert new_path == groups[0]['Path']
+    assert new_name == groups[0]['GroupName']
+    assert group_id == groups[0]['GroupId']
+
+
+# IAM GroupPolicy apis
+@pytest.mark.group_policy
+@pytest.mark.iam_account
+def test_account_inline_group_policy(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    policy_name = 'List'
+    bucket_name = get_new_bucket_name()
+    policy1 = json.dumps({'Version': '2012-10-17', 'Statement': [
+        {'Effect': 'Deny',
+         'Action': 's3:ListBucket',
+         'Resource': f'arn:aws:s3:::{bucket_name}'}]})
+    policy2 = json.dumps({'Version': '2012-10-17', 'Statement': [
+        {'Effect': 'Allow',
+         'Action': 's3:ListBucket',
+         'Resource': f'arn:aws:s3:::{bucket_name}'}]})
+
+    # Get/Put/Delete fail on nonexistent GroupName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_group_policy(GroupName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_group_policy(GroupName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.put_group_policy(GroupName=name, PolicyName=policy_name, PolicyDocument=policy1)
+
+    iam_root.create_group(GroupName=name, Path=path)
+
+    # Get/Delete fail on nonexistent PolicyName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_group_policy(GroupName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_group_policy(GroupName=name, PolicyName=policy_name)
+
+    iam_root.put_group_policy(GroupName=name, PolicyName=policy_name, PolicyDocument=policy1)
+
+    response = iam_root.get_group_policy(GroupName=name, PolicyName=policy_name)
+    assert policy1 == json.dumps(response['PolicyDocument'])
+    response = iam_root.list_group_policies(GroupName=name)
+    assert [policy_name] == response['PolicyNames']
+
+    iam_root.put_group_policy(GroupName=name, PolicyName=policy_name, PolicyDocument=policy2)
+
+    response = iam_root.get_group_policy(GroupName=name, PolicyName=policy_name)
+    assert policy2 == json.dumps(response['PolicyDocument'])
+    response = iam_root.list_group_policies(GroupName=name)
+    assert [policy_name] == response['PolicyNames']
+
+    # DeleteGroup fails while policies are still attached
+    with pytest.raises(iam_root.exceptions.DeleteConflictException):
+        iam_root.delete_group(GroupName=name)
+
+    iam_root.delete_group_policy(GroupName=name, PolicyName=policy_name)
+
+    # Get/Delete fail after Delete
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_group_policy(GroupName=name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_group_policy(GroupName=name, PolicyName=policy_name)
+
+    response = iam_root.list_group_policies(GroupName=name)
+    assert [] == response['PolicyNames']
+
+@pytest.mark.group_policy
+@pytest.mark.iam_account
+def test_account_managed_group_policy(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    policy1 = 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
+    policy2 = 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
+
+    # Attach/Detach/List fail on nonexistent GroupName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.attach_group_policy(GroupName=name, PolicyArn=policy1)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_group_policy(GroupName=name, PolicyArn=policy1)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.list_attached_group_policies(GroupName=name)
+
+    iam_root.create_group(GroupName=name, Path=path)
+
+    # Detach fails on unattached PolicyArn
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_group_policy(GroupName=name, PolicyArn=policy1)
+
+    iam_root.attach_group_policy(GroupName=name, PolicyArn=policy1)
+    iam_root.attach_group_policy(GroupName=name, PolicyArn=policy1)
+
+    response = iam_root.list_attached_group_policies(GroupName=name)
+    assert len(response['AttachedPolicies']) == 1
+    assert 'AmazonS3FullAccess' == response['AttachedPolicies'][0]['PolicyName']
+    assert policy1 == response['AttachedPolicies'][0]['PolicyArn']
+
+    iam_root.attach_group_policy(GroupName=name, PolicyArn=policy2)
+
+    response = iam_root.list_attached_group_policies(GroupName=name)
+    policies = response['AttachedPolicies']
+    assert len(policies) == 2
+    names = [p['PolicyName'] for p in policies]
+    arns = [p['PolicyArn'] for p in policies]
+    assert 'AmazonS3FullAccess' in names
+    assert policy1 in arns
+    assert 'AmazonS3ReadOnlyAccess' in names
+    assert policy2 in arns
+
+    iam_root.detach_group_policy(GroupName=name, PolicyArn=policy2)
+
+    # Detach fails after Detach
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_group_policy(GroupName=name, PolicyArn=policy2)
+
+    response = iam_root.list_attached_group_policies(GroupName=name)
+    assert len(response['AttachedPolicies']) == 1
+    assert 'AmazonS3FullAccess' == response['AttachedPolicies'][0]['PolicyName']
+    assert policy1 == response['AttachedPolicies'][0]['PolicyArn']
+
+    # DeleteGroup fails while policies are still attached
+    with pytest.raises(iam_root.exceptions.DeleteConflictException):
+        iam_root.delete_group(GroupName=name)
+
+@pytest.mark.group_policy
+@pytest.mark.iam_account
+def test_account_inline_group_policy_allow(iam_root):
+    path = get_iam_path_prefix()
+    username = make_iam_name('User')
+    groupname = make_iam_name('Group')
+    bucket_name = get_new_bucket_name()
+
+    iam_root.create_user(UserName=username, Path=path)
+
+    key = iam_root.create_access_key(UserName=username)['AccessKey']
+    client = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                              aws_secret_access_key=key['SecretAccessKey'])
+
+    iam_root.create_group(GroupName=groupname, Path=path)
+    iam_root.add_user_to_group(GroupName=groupname, UserName=username)
+
+    # the access key may take a bit to start working. retry until it returns
+    # something other than InvalidAccessKeyId
+    e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, client.list_buckets)
+    # expect AccessDenied because no identity policy allows s3 actions
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    # add a group policy that allows s3 actions
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:*',
+            'Resource': '*'
+            }]
+        })
+    policy_name = 'AllowStar'
+    iam_root.put_group_policy(GroupName=groupname, PolicyName=policy_name, PolicyDocument=policy)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, client.list_buckets)
+
+@pytest.mark.group_policy
+@pytest.mark.iam_account
+def test_account_managed_group_policy_allow(iam_root):
+    path = get_iam_path_prefix()
+    username = make_iam_name('User')
+    groupname = make_iam_name('Group')
+    bucket_name = get_new_bucket_name()
+
+    iam_root.create_user(UserName=username, Path=path)
+
+    key = iam_root.create_access_key(UserName=username)['AccessKey']
+    client = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                              aws_secret_access_key=key['SecretAccessKey'])
+
+    iam_root.create_group(GroupName=groupname, Path=path)
+    iam_root.add_user_to_group(GroupName=groupname, UserName=username)
+
+    # the access key may take a bit to start working. retry until it returns
+    # something other than InvalidAccessKeyId
+    e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, client.list_buckets)
+    # expect AccessDenied because no identity policy allows s3 actions
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    # add a group policy that allows s3 read actions
+    policy_arn = 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
+    iam_root.attach_group_policy(GroupName=groupname, PolicyArn=policy_arn)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, client.list_buckets)
+
+
+assume_role_policy = json.dumps({
+    'Version': '2012-10-17',
+    'Statement': [{
+        'Effect': 'Allow',
+        'Action': 'sts:AssumeRole',
+        'Principal': {'AWS': '*'}
+        }]
+    })
+
+# IAM Role apis
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+def test_account_role_create(iam_root):
+    path = get_iam_path_prefix()
+    name1 = make_iam_name('R1')
+    desc = 'my role description'
+    max_duration = 43200
+    response = iam_root.create_role(RoleName=name1, Path=path, AssumeRolePolicyDocument=assume_role_policy, Description=desc, MaxSessionDuration=max_duration)
+    role = response['Role']
+    assert role['Path'] == path
+    assert role['RoleName'] == name1
+    assert assume_role_policy == json.dumps(role['AssumeRolePolicyDocument'])
+    assert len(role['RoleId'])
+    arn = role['Arn']
+    assert arn.startswith('arn:aws:iam:')
+    assert arn.endswith(f':role{path}{name1}')
+    assert role['CreateDate'] > datetime.datetime(1970, 1, 1, tzinfo=datetime.timezone.utc)
+    # AWS doesn't include these for CreateRole, only GetRole
+    #assert desc == role['Description']
+    #assert max_duration == role['MaxSessionDuration']
+
+    response = iam_root.get_role(RoleName=name1)
+    role = response['Role']
+    assert arn == role['Arn']
+    assert desc == role['Description']
+    assert max_duration == role['MaxSessionDuration']
+
+    path2 = get_iam_path_prefix() + 'foo/'
+    with pytest.raises(iam_root.exceptions.EntityAlreadyExistsException):
+        iam_root.create_role(RoleName=name1, Path=path2, AssumeRolePolicyDocument=assume_role_policy)
+
+    name2 = make_iam_name('R2')
+    response = iam_root.create_role(RoleName=name2, Path=path2, AssumeRolePolicyDocument=assume_role_policy)
+    role = response['Role']
+    assert role['Path'] == path2
+    assert role['RoleName'] == name2
+
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+def test_account_role_case_insensitive_name(iam_root):
+    path = get_iam_path_prefix()
+    name_upper = make_iam_name('R1')
+    name_lower = make_iam_name('r1')
+    response = iam_root.create_role(RoleName=name_upper, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+    rid = response['Role']['RoleId']
+
+    # name is case-insensitive, so 'r1' should also conflict
+    with pytest.raises(iam_root.exceptions.EntityAlreadyExistsException):
+        iam_root.create_role(RoleName=name_lower, AssumeRolePolicyDocument=assume_role_policy)
+
+    # search for 'r1' should return the same 'R1' role
+    response = iam_root.get_role(RoleName=name_lower)
+    assert rid == response['Role']['RoleId']
+
+    # delete for 'r1' should delete the same 'R1' role
+    iam_root.delete_role(RoleName=name_lower)
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_role(RoleName=name_lower)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+def test_account_role_delete(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('U1')
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_role(RoleName=name)
+
+    response = iam_root.create_role(RoleName=name, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+    uid = response['Role']['RoleId']
+    create_date = response['Role']['CreateDate']
+
+    iam_root.delete_role(RoleName=name)
+
+    response = iam_root.create_role(RoleName=name, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+    assert uid != response['Role']['RoleId']
+    assert create_date <= response['Role']['CreateDate']
+
+def role_list_names(client, **kwargs):
+    p = client.get_paginator('list_roles')
+    rolenames = []
+    for response in p.paginate(**kwargs):
+        rolenames += [u['RoleName'] for u in response['Roles']]
+    return rolenames
+
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+def test_account_role_list(iam_root):
+    path = get_iam_path_prefix()
+    response = iam_root.list_roles(PathPrefix=path)
+    assert len(response['Roles']) == 0
+    assert response['IsTruncated'] == False
+
+    name1 = make_iam_name('aa')
+    name2 = make_iam_name('Ab')
+    name3 = make_iam_name('ac')
+    name4 = make_iam_name('Ad')
+
+    # sort order is independent of CreateDate, Path, and RoleName capitalization
+    iam_root.create_role(RoleName=name4, Path=path+'w/', AssumeRolePolicyDocument=assume_role_policy)
+    iam_root.create_role(RoleName=name3, Path=path+'x/', AssumeRolePolicyDocument=assume_role_policy)
+    iam_root.create_role(RoleName=name2, Path=path+'y/', AssumeRolePolicyDocument=assume_role_policy)
+    iam_root.create_role(RoleName=name1, Path=path+'z/', AssumeRolePolicyDocument=assume_role_policy)
+
+    assert [name1, name2, name3, name4] == \
+            role_list_names(iam_root, PathPrefix=path)
+    assert [name1, name2, name3, name4] == \
+            role_list_names(iam_root, PathPrefix=path, PaginationConfig={'PageSize': 1})
+
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+def test_account_role_list_path_prefix(iam_root):
+    path = get_iam_path_prefix()
+    response = iam_root.list_roles(PathPrefix=path)
+    assert len(response['Roles']) == 0
+    assert response['IsTruncated'] == False
+
+    name1 = make_iam_name('a')
+    name2 = make_iam_name('b')
+    name3 = make_iam_name('c')
+    name4 = make_iam_name('d')
+
+    iam_root.create_role(RoleName=name1, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+    iam_root.create_role(RoleName=name2, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+    iam_root.create_role(RoleName=name3, Path=path+'a/', AssumeRolePolicyDocument=assume_role_policy)
+    iam_root.create_role(RoleName=name4, Path=path+'a/x/', AssumeRolePolicyDocument=assume_role_policy)
+
+    assert [name1, name2, name3, name4] == \
+            role_list_names(iam_root, PathPrefix=path)
+    assert [name1, name2, name3, name4] == \
+            role_list_names(iam_root, PathPrefix=path,
+                            PaginationConfig={'PageSize': 1})
+    assert [name3, name4] == \
+            role_list_names(iam_root, PathPrefix=path+'a')
+    assert [name3, name4] == \
+            role_list_names(iam_root, PathPrefix=path+'a',
+                            PaginationConfig={'PageSize': 1})
+    assert [name4] == \
+            role_list_names(iam_root, PathPrefix=path+'a/x')
+    assert [name4] == \
+            role_list_names(iam_root, PathPrefix=path+'a/x',
+                            PaginationConfig={'PageSize': 1})
+    assert [] == role_list_names(iam_root, PathPrefix=path+'a/x/d')
+
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+def test_account_role_update(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('a')
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.update_role(RoleName=name)
+
+    iam_root.create_role(RoleName=name, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+
+    response = iam_root.get_role(RoleName=name)
+    assert name == response['Role']['RoleName']
+    arn = response['Role']['Arn']
+    rid = response['Role']['RoleId']
+
+    desc = 'my role description'
+    iam_root.update_role(RoleName=name, Description=desc, MaxSessionDuration=43200)
+
+    response = iam_root.get_role(RoleName=name)
+    assert rid == response['Role']['RoleId']
+    assert arn == response['Role']['Arn']
+    assert desc == response['Role']['Description']
+    assert 43200 == response['Role']['MaxSessionDuration']
+
+
+role_policy = json.dumps({
+    'Version': '2012-10-17',
+    'Statement': [{
+        'Effect': 'Allow',
+        'Action': 's3:*',
+        "Resource": "*"
+        }]
+    })
+
+# IAM RolePolicy apis
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+@pytest.mark.role_policy
+def test_account_role_policy(iam_root):
+    path = get_iam_path_prefix()
+    role_name = make_iam_name('r')
+    policy_name = 'MyPolicy'
+    policy2_name = 'AnotherPolicy'
+
+    # Get/Put/Delete fail on nonexistent RoleName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_role_policy(RoleName=role_name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=role_policy)
+
+    iam_root.create_role(RoleName=role_name, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+
+    # Get/Delete fail on nonexistent PolicyName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_role_policy(RoleName=role_name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
+
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=role_policy)
+
+    response = iam_root.get_role_policy(RoleName=role_name, PolicyName=policy_name)
+    assert role_name == response['RoleName']
+    assert policy_name == response['PolicyName']
+    assert role_policy == json.dumps(response['PolicyDocument'])
+
+    response = iam_root.list_role_policies(RoleName=role_name)
+    assert [policy_name] == response['PolicyNames']
+
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy2_name, PolicyDocument=role_policy)
+
+    response = iam_root.list_role_policies(RoleName=role_name)
+    assert [policy2_name, policy_name] == response['PolicyNames']
+
+    iam_root.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
+    iam_root.delete_role_policy(RoleName=role_name, PolicyName=policy2_name)
+
+    # Get/Delete fail after Delete
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_role_policy(RoleName=role_name, PolicyName=policy_name)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
+
+@pytest.mark.role_policy
+@pytest.mark.iam_account
+def test_account_role_policy_managed(iam_root):
+    path = get_iam_path_prefix()
+    name = make_iam_name('name')
+    policy1 = 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
+    policy2 = 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
+
+    # Attach/Detach/List fail on nonexistent RoleName
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.attach_role_policy(RoleName=name, PolicyArn=policy1)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_role_policy(RoleName=name, PolicyArn=policy1)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.list_attached_role_policies(RoleName=name)
+
+    iam_root.create_role(RoleName=name, Path=path, AssumeRolePolicyDocument=assume_role_policy)
+
+    # Detach fails on unattached PolicyArn
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_role_policy(RoleName=name, PolicyArn=policy1)
+
+    iam_root.attach_role_policy(RoleName=name, PolicyArn=policy1)
+    iam_root.attach_role_policy(RoleName=name, PolicyArn=policy1)
+
+    response = iam_root.list_attached_role_policies(RoleName=name)
+    assert len(response['AttachedPolicies']) == 1
+    assert 'AmazonS3FullAccess' == response['AttachedPolicies'][0]['PolicyName']
+    assert policy1 == response['AttachedPolicies'][0]['PolicyArn']
+
+    iam_root.attach_role_policy(RoleName=name, PolicyArn=policy2)
+
+    response = iam_root.list_attached_role_policies(RoleName=name)
+    policies = response['AttachedPolicies']
+    assert len(policies) == 2
+    names = [p['PolicyName'] for p in policies]
+    arns = [p['PolicyArn'] for p in policies]
+    assert 'AmazonS3FullAccess' in names
+    assert policy1 in arns
+    assert 'AmazonS3ReadOnlyAccess' in names
+    assert policy2 in arns
+
+    iam_root.detach_role_policy(RoleName=name, PolicyArn=policy2)
+
+    # Detach fails after Detach
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.detach_role_policy(RoleName=name, PolicyArn=policy2)
+
+    response = iam_root.list_attached_role_policies(RoleName=name)
+    assert len(response['AttachedPolicies']) == 1
+    assert 'AmazonS3FullAccess' == response['AttachedPolicies'][0]['PolicyName']
+    assert policy1 == response['AttachedPolicies'][0]['PolicyArn']
+
+    # DeleteRole fails while policies are still attached
+    with pytest.raises(iam_root.exceptions.DeleteConflictException):
+        iam_root.delete_role(RoleName=name)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_role
+@pytest.mark.role_policy
+def test_account_role_policy_allow(iam_root):
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('MyUser')
+    role_name = make_iam_name('MyRole')
+    session_name = 'MySession'
+
+    user = iam_root.create_user(UserName=user_name, Path=path)['User']
+    user_arn = user['Arn']
+
+    trust_policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 'sts:AssumeRole',
+            'Principal': {'AWS': user_arn}
+            }]
+        })
+    # returns MalformedPolicyDocument until the user arn starts working
+    role = retry_on('MalformedPolicyDocument', 10, iam_root.create_role,
+                    RoleName=role_name, Path=path, AssumeRolePolicyDocument=trust_policy)['Role']
+    role_arn = role['Arn']
+
+    key = iam_root.create_access_key(UserName=user_name)['AccessKey']
+    sts = get_sts_client(aws_access_key_id=key['AccessKeyId'],
+                         aws_secret_access_key=key['SecretAccessKey'])
+
+    # returns InvalidClientTokenId or AccessDenied until the access key starts working
+    response = retry_on(('InvalidClientTokenId', 'AccessDenied'), 10, sts.assume_role,
+                        RoleArn=role_arn, RoleSessionName=session_name)
+    creds = response['Credentials']
+
+    s3 = get_iam_s3client(aws_access_key_id = creds['AccessKeyId'],
+                          aws_secret_access_key = creds['SecretAccessKey'],
+                          aws_session_token = creds['SessionToken'])
+
+    # expect AccessDenied because no identity policy allows s3 actions
+    e = assert_raises(ClientError, s3.list_buckets)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    policy_name = 'AllowListAllMyBuckets'
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:ListAllMyBuckets',
+            'Resource': '*'
+            }]
+        })
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=policy)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, s3.list_buckets)
+
+# alt account user assumes main account role to access main account bucket
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.iam_role
+@pytest.mark.role_policy
+def test_same_account_role_policy_allow(iam_root, iam_alt_root):
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    role_name = make_iam_name('MyRole')
+    session_name = 'MySession'
+    bucket_name = get_new_bucket_name()
+
+    user = iam_alt_root.create_user(UserName=user_name, Path=path)['User']
+    user_arn = user['Arn']
+    key = iam_alt_root.create_access_key(UserName=user_name)['AccessKey']
+
+    s3_main = get_iam_root_client(service_name='s3')
+    s3_main.create_bucket(Bucket=bucket_name)
+
+    trust_policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 'sts:AssumeRole',
+            'Principal': {'AWS': user_arn}
+            }]
+        })
+    # returns MalformedPolicyDocument until the user arn starts working
+    role = retry_on('MalformedPolicyDocument', 10, iam_root.create_role,
+                    RoleName=role_name, Path=path, AssumeRolePolicyDocument=trust_policy)['Role']
+    role_arn = role['Arn']
+
+    sts = get_sts_client(aws_access_key_id=key['AccessKeyId'],
+                         aws_secret_access_key=key['SecretAccessKey'])
+
+    # returns InvalidClientTokenId or AccessDenied until the access key starts working
+    response = retry_on(('InvalidClientTokenId', 'AccessDenied'), 10, sts.assume_role,
+                        RoleArn=role_arn, RoleSessionName=session_name)
+    creds = response['Credentials']
+
+    s3 = get_iam_s3client(aws_access_key_id = creds['AccessKeyId'],
+                          aws_secret_access_key = creds['SecretAccessKey'],
+                          aws_session_token = creds['SessionToken'])
+
+    # expect AccessDenied because no identity policy allows s3 actions
+    e = assert_raises(ClientError, s3.list_objects, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    policy_name = 'AllowListBucket'
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:ListBucket',
+            'Resource': '*'
+            }]
+        })
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=policy)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, s3.list_objects, Bucket=bucket_name)
+
+# alt account user assumes main account role to access alt account bucket
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.iam_role
+@pytest.mark.role_policy
+def test_cross_account_role_policy_allow(iam_root, iam_alt_root):
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    role_name = make_iam_name('MyRole')
+    session_name = 'MySession'
+    bucket_name = get_new_bucket_name()
+
+    user = iam_alt_root.create_user(UserName=user_name, Path=path)['User']
+    user_arn = user['Arn']
+    key = iam_alt_root.create_access_key(UserName=user_name)['AccessKey']
+
+    s3_alt = get_iam_alt_root_client(service_name='s3')
+    s3_alt.create_bucket(Bucket=bucket_name)
+
+    trust_policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 'sts:AssumeRole',
+            'Principal': {'AWS': user_arn}
+            }]
+        })
+    # returns MalformedPolicyDocument until the user arn starts working
+    role = retry_on('MalformedPolicyDocument', 10, iam_root.create_role,
+                    RoleName=role_name, Path=path, AssumeRolePolicyDocument=trust_policy)['Role']
+    role_arn = role['Arn']
+
+    sts = get_sts_client(aws_access_key_id=key['AccessKeyId'],
+                         aws_secret_access_key=key['SecretAccessKey'])
+
+    # returns InvalidClientTokenId or AccessDenied until the access key starts working
+    response = retry_on(('InvalidClientTokenId', 'AccessDenied'), 10, sts.assume_role,
+                        RoleArn=role_arn, RoleSessionName=session_name)
+    creds = response['Credentials']
+
+    s3 = get_iam_s3client(aws_access_key_id = creds['AccessKeyId'],
+                          aws_secret_access_key = creds['SecretAccessKey'],
+                          aws_session_token = creds['SessionToken'])
+
+    # expect AccessDenied because no identity policy allows s3 actions
+    e = assert_raises(ClientError, s3.list_objects, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    policy_name = 'AllowListBucket'
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:ListBucket',
+            'Resource': '*'
+            }]
+        })
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=policy)
+
+    # expect AccessDenied because no resource policy allows the main account
+    e = assert_raises(ClientError, s3.list_objects, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    # add a bucket policy that allows s3:ListBucket for the main account's arn
+    main_arn = iam_root.get_user()['User']['Arn']
+    s3_alt.put_bucket_policy(Bucket=bucket_name, Policy=json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Principal': {'AWS': main_arn},
+            'Action': 's3:ListBucket',
+            'Resource': f'arn:aws:s3:::{bucket_name}'
+            }]
+        }))
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, s3.list_objects, Bucket=bucket_name)
+
+# alt account user assumes main account role to create a bucket
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.iam_role
+@pytest.mark.role_policy
+def test_account_role_policy_allow_create_bucket(iam_root, iam_alt_root):
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    role_name = make_iam_name('MyRole')
+    session_name = 'MySession'
+    bucket_name = get_new_bucket_name()
+
+    user = iam_alt_root.create_user(UserName=user_name, Path=path)['User']
+    user_arn = user['Arn']
+    key = iam_alt_root.create_access_key(UserName=user_name)['AccessKey']
+
+    trust_policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 'sts:AssumeRole',
+            'Principal': {'AWS': user_arn}
+            }]
+        })
+    # returns MalformedPolicyDocument until the user arn starts working
+    role = retry_on('MalformedPolicyDocument', 10, iam_root.create_role,
+                    RoleName=role_name, Path=path, AssumeRolePolicyDocument=trust_policy)['Role']
+    role_arn = role['Arn']
+
+    sts = get_sts_client(aws_access_key_id=key['AccessKeyId'],
+                         aws_secret_access_key=key['SecretAccessKey'])
+
+    # returns InvalidClientTokenId or AccessDenied until the access key starts working
+    response = retry_on(('InvalidClientTokenId', 'AccessDenied'), 10, sts.assume_role,
+                        RoleArn=role_arn, RoleSessionName=session_name)
+    creds = response['Credentials']
+
+    s3 = get_iam_s3client(aws_access_key_id = creds['AccessKeyId'],
+                          aws_secret_access_key = creds['SecretAccessKey'],
+                          aws_session_token = creds['SessionToken'])
+
+    # expect AccessDenied because no identity policy allows s3 actions
+    e = assert_raises(ClientError, s3.create_bucket, Bucket=bucket_name, ObjectOwnership='ObjectWriter', ACL='private')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    policy_name = 'AllowCreateBucket'
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': ['s3:CreateBucket', 's3:PutBucketAcl'],
+            'Resource': '*'
+            }]
+        })
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=policy)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, s3.create_bucket, Bucket=bucket_name, ObjectOwnership='ObjectWriter', ACL='private')
+
+    # verify that the bucket is owned by the role's account
+    s3_main = get_iam_root_client(service_name='s3')
+    response = s3_main.get_bucket_acl(Bucket=bucket_name)
+
+    account_id = get_iam_root_account_id()
+    assert response['Owner']['ID'] == account_id
+    assert response['Grants'][0]['Grantee']['ID'] == account_id
+
+# alt account user assumes main account role to read the role info
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.iam_role
+@pytest.mark.role_policy
+def test_account_role_policy_allow_get_role(iam_root, iam_alt_root):
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    role_name = make_iam_name('MyRole')
+    session_name = 'MySession'
+    bucket_name = get_new_bucket_name()
+
+    user = iam_alt_root.create_user(UserName=user_name, Path=path)['User']
+    user_arn = user['Arn']
+    key = iam_alt_root.create_access_key(UserName=user_name)['AccessKey']
+
+    trust_policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 'sts:AssumeRole',
+            'Principal': {'AWS': user_arn}
+            }]
+        })
+    # returns MalformedPolicyDocument until the user arn starts working
+    role = retry_on('MalformedPolicyDocument', 10, iam_root.create_role,
+                    RoleName=role_name, Path=path, AssumeRolePolicyDocument=trust_policy)['Role']
+    role_arn = role['Arn']
+
+    sts = get_sts_client(aws_access_key_id=key['AccessKeyId'],
+                         aws_secret_access_key=key['SecretAccessKey'])
+
+    # returns InvalidClientTokenId or AccessDenied until the access key starts working
+    response = retry_on(('InvalidClientTokenId', 'AccessDenied'), 10, sts.assume_role,
+                        RoleArn=role_arn, RoleSessionName=session_name)
+    creds = response['Credentials']
+
+    iam = get_iam_root_client(service_name='iam',
+                              aws_access_key_id = creds['AccessKeyId'],
+                              aws_secret_access_key = creds['SecretAccessKey'],
+                              aws_session_token = creds['SessionToken'])
+
+    # expect AccessDenied because no identity policy allows iam actions
+    e = assert_raises(ClientError, iam.get_role, RoleName=role_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    policy_name = 'AllowGetRole'
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 'iam:GetRole',
+            'Resource': '*'
+            }]
+        })
+    iam_root.put_role_policy(RoleName=role_name, PolicyName=policy_name, PolicyDocument=policy)
+
+    # the policy may take a bit to start working. retry until it returns
+    # something other than AccessDenied
+    retry_on('AccessDenied', 10, iam.get_role, RoleName=role_name)
+
+
+# IAM OpenIDConnectProvider apis
+@pytest.mark.iam_account
+def test_account_oidc_provider(iam_root):
+    url_host = get_iam_path_prefix()[1:] + 'example.com'
+    url = 'http://' + url_host
+
+    response = iam_root.create_open_id_connect_provider(
+            ClientIDList=['my-application-id'],
+            ThumbprintList=['3768084dfb3d2b68b7897bf5f565da8efEXAMPLE'],
+            Url=url)
+    arn = response['OpenIDConnectProviderArn']
+    assert arn.endswith(f':oidc-provider/{url_host}')
+
+    response = iam_root.list_open_id_connect_providers()
+    arns = [p['Arn'] for p in response['OpenIDConnectProviderList']]
+    assert arn in arns
+
+    response = iam_root.get_open_id_connect_provider(OpenIDConnectProviderArn=arn)
+    assert url == response['Url']
+    assert ['my-application-id'] == response['ClientIDList']
+    assert ['3768084dfb3d2b68b7897bf5f565da8efEXAMPLE'] == response['ThumbprintList']
+
+    iam_root.delete_open_id_connect_provider(OpenIDConnectProviderArn=arn)
+
+    response = iam_root.list_open_id_connect_providers()
+    arns = [p['Arn'] for p in response['OpenIDConnectProviderList']]
+    assert arn not in arns
+
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.get_open_id_connect_provider(OpenIDConnectProviderArn=arn)
+    with pytest.raises(iam_root.exceptions.NoSuchEntityException):
+        iam_root.delete_open_id_connect_provider(OpenIDConnectProviderArn=arn)
+
+
+@pytest.mark.iam_account
+def test_verify_add_new_client_id_to_oidc(iam_root):
+    url_host = get_iam_path_prefix()[1:] + 'example.com'
+    url = 'http://' + url_host
+
+    response = iam_root.create_open_id_connect_provider(
+                        Url=url,
+                        ClientIDList=[
+                            'app-jee-jsp',
+                        ],
+                        ThumbprintList=[
+                            '3768084dfb3d2b68b7897bf5f565da8efEXAMPLE'
+                    ]
+                    )
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    get_response = iam_root.get_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert len(get_response['ClientIDList']) == 1
+    assert get_response['ClientIDList'][0] == 'app-jee-jsp'
+    assert url == get_response['Url']
+
+    add_response = iam_root.add_client_id_to_open_id_connect_provider(
+    OpenIDConnectProviderArn=response['OpenIDConnectProviderArn'],
+                        ClientID='app-profile-jsp'
+                    )
+    assert add_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    get_response = iam_root.get_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert len(get_response['ClientIDList']) == 2
+    assert get_response['ClientIDList'][0] == 'app-jee-jsp'
+    assert get_response['ClientIDList'][1] == 'app-profile-jsp'
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    del_response = iam_root.delete_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert del_response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_verify_add_existing_client_id_to_oidc(iam_root):
+    url_host = get_iam_path_prefix()[1:] + 'example.com'
+    url = 'http://' + url_host
+
+    response = iam_root.create_open_id_connect_provider(
+                        Url=url,
+                        ClientIDList=[
+                            'app-jee-jsp',
+                            'app-profile-jsp'
+                        ],
+                        ThumbprintList=[
+                            '3768084dfb3d2b68b7897bf5f565da8efEXAMPLE'
+                    ]
+                    )
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    get_response = iam_root.get_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert len(get_response['ClientIDList']) == 2
+    assert get_response['ClientIDList'][0] == 'app-jee-jsp'
+    assert get_response['ClientIDList'][1] == 'app-profile-jsp'
+    add_response = iam_root.add_client_id_to_open_id_connect_provider(
+    OpenIDConnectProviderArn=response['OpenIDConnectProviderArn'],
+                        ClientID='app-profile-jsp'
+                    )
+    assert add_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    get_response = iam_root.get_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert len(get_response['ClientIDList']) == 2
+    assert get_response['ClientIDList'][0] == 'app-jee-jsp'
+    assert get_response['ClientIDList'][1] == 'app-profile-jsp'
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    del_response = iam_root.delete_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert del_response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.iam_account
+def test_verify_remove_client_id_from_oidc(iam_root):
+    url_host = get_iam_path_prefix()[1:] + 'example.com'
+    url = 'http://' + url_host
+
+    response = iam_root.create_open_id_connect_provider(
+        Url=url,
+        ClientIDList=['app-jee-jsp', 'app-profile-jsp'],
+        ThumbprintList=['3768084dfb3d2b68b7897bf5f565da8efEXAMPLE']
+    )
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_provider_arn = response['OpenIDConnectProviderArn']
+
+    get_response = iam_root.get_open_id_connect_provider(
+        OpenIDConnectProviderArn=oidc_provider_arn
+    )
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert len(get_response['ClientIDList']) == 2
+    assert 'app-jee-jsp' in get_response['ClientIDList']
+    assert 'app-profile-jsp' in get_response['ClientIDList']
+
+    remove_response = iam_root.remove_client_id_from_open_id_connect_provider(
+        OpenIDConnectProviderArn=oidc_provider_arn,
+        ClientID='app-profile-jsp'
+    )
+    assert remove_response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    get_response = iam_root.get_open_id_connect_provider(
+        OpenIDConnectProviderArn=oidc_provider_arn
+    )
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert len(get_response['ClientIDList']) == 1
+    assert get_response['ClientIDList'][0] == 'app-jee-jsp'
+    assert 'app-profile-jsp' not in get_response['ClientIDList']
+
+    del_response = iam_root.delete_open_id_connect_provider(
+        OpenIDConnectProviderArn=oidc_provider_arn
+    )
+    assert del_response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_verify_update_thumbprintlist_of_oidc(iam_root):
+    url_host = get_iam_path_prefix()[1:] + 'example.com'
+    url = 'http://' + url_host
+
+    response = iam_root.create_open_id_connect_provider(
+                        Url=url,
+                        ClientIDList=[
+                            'app-jee-jsp',
+                            'app-profile-jsp'
+                        ],
+                        ThumbprintList=[
+                            '3768084dfb3d2b68b7897bf5f565da8efEXAMPLE'
+                    ]
+                    )
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    get_response = iam_root.get_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert len(get_response['ThumbprintList']) == 1
+    assert get_response['ThumbprintList'][0] == '3768084dfb3d2b68b7897bf5f565da8efEXAMPLE'
+    update_response = iam_root.update_open_id_connect_provider_thumbprint(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn'],
+                        ThumbprintList=[
+                            '3768084dfb3d2b68b7897bf5f565da8efSAMPLE1'
+                    ]
+                    )
+    assert update_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    get_response = iam_root.get_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert get_response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert len(get_response['ThumbprintList']) == 1
+    assert get_response['ThumbprintList'][0] == '3768084dfb3d2b68b7897bf5f565da8efSAMPLE1'
+    del_response = iam_root.delete_open_id_connect_provider(
+                        OpenIDConnectProviderArn=response['OpenIDConnectProviderArn']
+                    )
+    assert del_response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+# test cross-account access, adding user policy before the bucket policy
+def _test_cross_account_user_bucket_policy(roots3, alt_root, alt_name, alt_arn):
+    # add a user policy that allows s3 actions
+    alt_root.put_user_policy(UserName=alt_name, PolicyName='AllowStar', PolicyDocument=json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:*',
+            'Resource': '*'
+            }]
+        }))
+
+    key = alt_root.create_access_key(UserName=alt_name)['AccessKey']
+    alts3 = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                             aws_secret_access_key=key['SecretAccessKey'])
+
+    # create a bucket with the root user
+    bucket = get_new_bucket(roots3)
+    try:
+        # the access key may take a bit to start working. retry until it returns
+        # something other than InvalidAccessKeyId
+        e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, alts3.list_objects, Bucket=bucket)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a bucket policy that allows s3:ListBucket for the iam user's arn
+        roots3.put_bucket_policy(Bucket=bucket, Policy=json.dumps({
+            'Version': '2012-10-17',
+            'Statement': [{
+                'Effect': 'Allow',
+                'Principal': {'AWS': alt_arn},
+                'Action': 's3:ListBucket',
+                'Resource': f'arn:aws:s3:::{bucket}'
+                }]
+            }))
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, alts3.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+# test cross-account access, adding bucket policy before the user policy
+def _test_cross_account_bucket_user_policy(roots3, alt_root, alt_name, alt_arn):
+    key = alt_root.create_access_key(UserName=alt_name)['AccessKey']
+    alts3 = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                             aws_secret_access_key=key['SecretAccessKey'])
+
+    # create a bucket with the root user
+    bucket = get_new_bucket(roots3)
+    try:
+        # add a bucket policy that allows s3:ListBucket for the iam user's arn
+        roots3.put_bucket_policy(Bucket=bucket, Policy=json.dumps({
+            'Version': '2012-10-17',
+            'Statement': [{
+                'Effect': 'Allow',
+                'Principal': {'AWS': alt_arn},
+                'Action': 's3:ListBucket',
+                'Resource': f'arn:aws:s3:::{bucket}'
+                }]
+            }))
+
+        # the access key may take a bit to start working. retry until it returns
+        # something other than InvalidAccessKeyId
+        e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, alts3.list_objects, Bucket=bucket)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a user policy that allows s3 actions
+        alt_root.put_user_policy(UserName=alt_name, PolicyName='AllowStar', PolicyDocument=json.dumps({
+            'Version': '2012-10-17',
+            'Statement': [{
+                'Effect': 'Allow',
+                'Action': 's3:*',
+                'Resource': '*'
+                }]
+            }))
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, alts3.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_bucket_user_policy_allow_user_arn(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    response = iam_alt_root.create_user(UserName=user_name, Path=path)
+    user_arn = response['User']['Arn']
+    _test_cross_account_bucket_user_policy(roots3, iam_alt_root, user_name, user_arn)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_user_bucket_policy_allow_user_arn(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    response = iam_alt_root.create_user(UserName=user_name, Path=path)
+    user_arn = response['User']['Arn']
+    _test_cross_account_user_bucket_policy(roots3, iam_alt_root, user_name, user_arn)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_user_bucket_policy_allow_account_arn(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    response = iam_alt_root.create_user(UserName=user_name, Path=path)
+    user_arn = response['User']['Arn']
+    account_arn = user_arn.replace(f':user{path}{user_name}', ':root')
+    _test_cross_account_user_bucket_policy(roots3, iam_alt_root, user_name, account_arn)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_bucket_user_policy_allow_account_arn(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    response = iam_alt_root.create_user(UserName=user_name, Path=path)
+    user_arn = response['User']['Arn']
+    account_arn = user_arn.replace(f':user{path}{user_name}', ':root')
+    _test_cross_account_bucket_user_policy(roots3, iam_alt_root, user_name, account_arn)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_user_bucket_policy_allow_account_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    iam_alt_root.create_user(UserName=user_name, Path=path)
+
+    account_id = get_iam_alt_root_account_id()
+    _test_cross_account_user_bucket_policy(roots3, iam_alt_root, user_name, account_id)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_bucket_user_policy_allow_account_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    iam_alt_root.create_user(UserName=user_name, Path=path)
+
+    account_id = get_iam_alt_root_account_id()
+    _test_cross_account_bucket_user_policy(roots3, iam_alt_root, user_name, account_id)
+
+
+# test cross-account access, adding user policy before the bucket acl
+def _test_cross_account_user_policy_bucket_acl(roots3, alt_root, alt_name, grantee):
+    # add a user policy that allows s3 actions
+    alt_root.put_user_policy(UserName=alt_name, PolicyName='AllowStar', PolicyDocument=json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Action': 's3:*',
+            'Resource': '*'
+            }]
+        }))
+
+    key = alt_root.create_access_key(UserName=alt_name)['AccessKey']
+    alts3 = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                             aws_secret_access_key=key['SecretAccessKey'])
+
+    # create a bucket with the root user
+    bucket = get_new_bucket(roots3)
+    try:
+        # the access key may take a bit to start working. retry until it returns
+        # something other than InvalidAccessKeyId
+        e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, alts3.list_objects, Bucket=bucket)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a bucket acl that grants READ access
+        roots3.put_bucket_acl(Bucket=bucket, GrantRead=grantee)
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, alts3.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+# test cross-account access, adding bucket acl before the user policy
+def _test_cross_account_bucket_acl_user_policy(roots3, alt_root, alt_name, grantee):
+    key = alt_root.create_access_key(UserName=alt_name)['AccessKey']
+    alts3 = get_iam_s3client(aws_access_key_id=key['AccessKeyId'],
+                             aws_secret_access_key=key['SecretAccessKey'])
+
+    # create a bucket with the root user
+    bucket = get_new_bucket(roots3)
+    try:
+        # add a bucket acl that grants READ access
+        roots3.put_bucket_acl(Bucket=bucket, GrantRead=grantee)
+
+        # the access key may take a bit to start working. retry until it returns
+        # something other than InvalidAccessKeyId
+        e = assert_raises(ClientError, retry_on, 'InvalidAccessKeyId', 10, alts3.list_objects, Bucket=bucket)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a user policy that allows s3 actions
+        alt_root.put_user_policy(UserName=alt_name, PolicyName='AllowStar', PolicyDocument=json.dumps({
+            'Version': '2012-10-17',
+            'Statement': [{
+                'Effect': 'Allow',
+                'Action': 's3:*',
+                'Resource': '*'
+                }]
+            }))
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, alts3.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.fails_on_aws # can't grant to individual users
+def test_cross_account_bucket_acl_user_policy_grant_user_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    response = iam_alt_root.create_user(UserName=user_name, Path=path)
+    grantee = 'id=' + response['User']['UserId']
+    _test_cross_account_bucket_acl_user_policy(roots3, iam_alt_root, user_name, grantee)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.fails_on_aws # can't grant to individual users
+def test_cross_account_user_policy_bucket_acl_grant_user_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    response = iam_alt_root.create_user(UserName=user_name, Path=path)
+    grantee = 'id=' + response['User']['UserId']
+    _test_cross_account_user_policy_bucket_acl(roots3, iam_alt_root, user_name, grantee)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_bucket_acl_user_policy_grant_canonical_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    iam_alt_root.create_user(UserName=user_name, Path=path)
+    grantee = 'id=' + get_iam_alt_root_user_id()
+    _test_cross_account_bucket_acl_user_policy(roots3, iam_alt_root, user_name, grantee)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_user_policy_bucket_acl_grant_canonical_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    iam_alt_root.create_user(UserName=user_name, Path=path)
+    grantee = 'id=' + get_iam_alt_root_user_id()
+    _test_cross_account_user_policy_bucket_acl(roots3, iam_alt_root, user_name, grantee)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_bucket_acl_user_policy_grant_account_email(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    iam_alt_root.create_user(UserName=user_name, Path=path)
+    grantee = 'emailAddress=' + get_iam_alt_root_email()
+    _test_cross_account_bucket_acl_user_policy(roots3, iam_alt_root, user_name, grantee)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_user_policy_bucket_acl_grant_account_email(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('AltUser')
+    iam_alt_root.create_user(UserName=user_name, Path=path)
+    grantee = 'emailAddress=' + get_iam_alt_root_email()
+    _test_cross_account_user_policy_bucket_acl(roots3, iam_alt_root, user_name, grantee)
+
+
+# test root cross-account access with bucket policy
+def _test_cross_account_root_bucket_policy(roots3, alts3, alt_arn):
+    # create a bucket with the root user
+    bucket = get_new_bucket(roots3)
+    try:
+        e = assert_raises(ClientError, alts3.list_objects, Bucket=bucket)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a bucket policy that allows s3:ListBucket for the iam user's arn
+        roots3.put_bucket_policy(Bucket=bucket, Policy=json.dumps({
+            'Version': '2012-10-17',
+            'Statement': [{
+                'Effect': 'Allow',
+                'Principal': {'AWS': alt_arn},
+                'Action': 's3:ListBucket',
+                'Resource': f'arn:aws:s3:::{bucket}'
+                }]
+            }))
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, alts3.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_root_bucket_policy_allow_account_arn(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    alts3 = get_iam_alt_root_client(service_name='s3')
+    alt_arn = iam_alt_root.get_user()['User']['Arn']
+    _test_cross_account_root_bucket_policy(roots3, alts3, alt_arn)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_root_bucket_policy_allow_account_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    alts3 = get_iam_alt_root_client(service_name='s3')
+
+    account_id = get_iam_alt_root_account_id()
+    _test_cross_account_root_bucket_policy(roots3, alts3, account_id)
+
+# test root cross-account access with bucket acls
+def _test_cross_account_root_bucket_acl(roots3, alts3, grantee):
+    # create a bucket with the root user
+    bucket = get_new_bucket(roots3)
+    try:
+        e = assert_raises(ClientError, alts3.list_objects, Bucket=bucket)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'AccessDenied'
+
+        # add a bucket acl that grants READ
+        roots3.put_bucket_acl(Bucket=bucket, GrantRead=grantee)
+
+        # verify that the iam user can eventually access it
+        retry_on('AccessDenied', 10, alts3.list_objects, Bucket=bucket)
+    finally:
+        roots3.delete_bucket(Bucket=bucket)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_root_bucket_acl_grant_canonical_id(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    alts3 = get_iam_alt_root_client(service_name='s3')
+    grantee = 'id=' + get_iam_alt_root_user_id()
+    _test_cross_account_root_bucket_acl(roots3, alts3, grantee)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+def test_cross_account_root_bucket_acl_grant_account_email(iam_root, iam_alt_root):
+    roots3 = get_iam_root_client(service_name='s3')
+    alts3 = get_iam_alt_root_client(service_name='s3')
+    grantee = 'emailAddress=' + get_iam_alt_root_email()
+    _test_cross_account_root_bucket_acl(roots3, alts3, grantee)
+
+@pytest.mark.iam_account
+def test_get_account_summary_root(iam_root):
+  summary = iam_root.get_account_summary()['SummaryMap']
+  assert 'Users' in summary
+  assert 'Groups' in summary
+  assert 'UsersQuota' in summary
+  assert 'GroupsQuota' in summary
+  assert 'AccessKeysPerUserQuota' in summary
+
+@pytest.mark.iam_account
+def test_get_account_summary_policy(iam_root):
+  path = get_iam_path_prefix()
+  user_name = make_iam_name('MyUser')
+  iam_root.create_user(UserName=user_name, Path=path)['User']
+
+  policy_name = "AllowIamAction"
+  policy_document = {
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Action": "iam:GetAccountSummary",
+        "Resource": "*"
+      }
+    ]
+  }
+
+  iam_root.put_user_policy(
+    UserName=user_name,
+    PolicyName=policy_name,
+    PolicyDocument=json.dumps(policy_document)
+  )
+  
+  key = iam_root.create_access_key(UserName=user_name)['AccessKey']
+  iam_client = get_iam_client(aws_access_key_id=key['AccessKeyId'],
+                        aws_secret_access_key=key['SecretAccessKey']) 
+
+  summary = iam_client.get_account_summary()['SummaryMap']
+  assert 'Users' in summary
+  assert 'Groups' in summary
+  assert 'UsersQuota' in summary
+  assert 'GroupsQuota' in summary
+  assert 'AccessKeysPerUserQuota' in summary
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_s3.py b/src/test/rgw/s3-tests/s3tests/functional/test_s3.py
new file mode 100644
index 00000000000..9878c248606
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_s3.py
@@ -0,0 +1,20779 @@
+import boto3
+import botocore.session
+import botocore.config
+from botocore.exceptions import ClientError
+from botocore.exceptions import ParamValidationError
+from botocore.handlers import validate_bucket_name
+import isodate
+import email.utils
+import datetime
+import threading
+import re
+import pytz
+from collections import OrderedDict
+import requests
+import json
+import base64
+import hmac
+import hashlib
+import xml.etree.ElementTree as ET
+import time
+import operator
+import pytest
+import os
+import string
+import random
+import socket
+import dateutil.parser
+import ssl
+import pdb
+from collections import namedtuple
+from collections import defaultdict
+from io import BytesIO
+
+from .utils import assert_raises
+from .utils import generate_random
+from .utils import _get_status_and_error_code
+from .utils import _get_status
+
+from .policy import Policy, Statement, make_json_policy
+
+from .iam import iam_root, nuke_role
+
+from . import (
+    configfile,
+    setup_teardown,
+    get_client,
+    get_prefix,
+    get_unauthenticated_client,
+    get_bad_auth_client,
+    get_v2_client,
+    get_new_bucket,
+    get_new_bucket_name,
+    get_new_bucket_resource,
+    get_config_is_secure,
+    get_config_host,
+    get_config_port,
+    get_config_endpoint,
+    get_config_ssl_verify,
+    get_main_aws_access_key,
+    get_main_aws_secret_key,
+    get_main_display_name,
+    get_main_user_id,
+    get_main_email,
+    get_main_api_name,
+    get_alt_aws_access_key,
+    get_alt_aws_secret_key,
+    get_alt_display_name,
+    get_alt_user_id,
+    get_alt_email,
+    get_alt_client,
+    get_iam_root_client,
+    get_iam_root_s3client,
+    get_tenant_client,
+    get_v2_tenant_client,
+    get_tenant_iam_client,
+    get_tenant_name,
+    get_tenant_user_id,
+    get_buckets_list,
+    get_objects_list,
+    get_main_kms_keyid,
+    get_secondary_kms_keyid,
+    get_svc_client,
+    get_cloud_storage_class,
+    get_cloud_retain_head_object,
+    get_allow_read_through,
+    get_cloud_regular_storage_class,
+    get_cloud_target_path,
+    get_cloud_target_storage_class,
+    get_cloud_target_by_bucket,
+    get_cloud_target_by_bucket_prefix,
+    get_cloud_client,
+    nuke_prefixed_buckets,
+    configured_storage_classes,
+    configure,
+    get_lc_debug_interval,
+    get_restore_debug_interval,
+    get_restore_processor_period,
+    get_read_through_days,
+    create_iam_user_s3client,
+    get_iam_client,
+    get_sts_client,
+    get_parameter_name,
+    )
+
+
+def _bucket_is_empty(bucket):
+    is_empty = True
+    for obj in bucket.objects.all():
+        is_empty = False
+        break
+    return is_empty
+
+def test_bucket_list_empty():
+    bucket = get_new_bucket_resource()
+    is_empty = _bucket_is_empty(bucket)
+    assert is_empty == True
+
+@pytest.mark.list_objects_v2
+def test_bucket_list_distinct():
+    bucket1 = get_new_bucket_resource()
+    bucket2 = get_new_bucket_resource()
+    obj = bucket1.put_object(Body='str', Key='asdf')
+    is_empty = _bucket_is_empty(bucket2)
+    assert is_empty == True
+
+def _create_objects(bucket=None, bucket_name=None, keys=[], put_object_args={}):
+    """
+    Populate a (specified or new) bucket with objects with
+    specified names (and contents identical to their names).
+    """
+    if bucket_name is None:
+        bucket_name = get_new_bucket_name()
+    if bucket is None:
+        bucket = get_new_bucket_resource(name=bucket_name)
+
+    for key in keys:
+        obj = bucket.put_object(Body=key, Key=key, **put_object_args)
+
+    return bucket_name
+
+def _get_keys(response):
+    """
+    return lists of strings that are the keys from a client.list_objects() response
+    """
+    keys = []
+    if 'Contents' in response:
+        objects_list = response['Contents']
+        keys = [obj['Key'] for obj in objects_list]
+    return keys
+
+def _get_prefixes(response):
+    """
+    return lists of strings that are prefixes from a client.list_objects() response
+    """
+    prefixes = []
+    if 'CommonPrefixes' in response:
+        prefix_list = response['CommonPrefixes']
+        prefixes = [prefix['Prefix'] for prefix in prefix_list]
+    return prefixes
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_many():
+    bucket_name = _create_objects(keys=['foo', 'bar', 'baz'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, MaxKeys=2)
+    keys = _get_keys(response)
+    assert len(keys) == 2
+    assert keys == ['bar', 'baz']
+    assert response['IsTruncated'] == True
+
+    response = client.list_objects(Bucket=bucket_name, Marker='baz',MaxKeys=2)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+    assert response['IsTruncated'] == False
+    assert keys == ['foo']
+
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_bucket_listv2_many():
+    bucket_name = _create_objects(keys=['foo', 'bar', 'baz'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, MaxKeys=2)
+    keys = _get_keys(response)
+    assert len(keys) == 2
+    assert keys == ['bar', 'baz']
+    assert response['IsTruncated'] == True
+
+    response = client.list_objects_v2(Bucket=bucket_name, StartAfter='baz',MaxKeys=2)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+    assert response['IsTruncated'] == False
+    assert keys == ['foo']
+
+@pytest.mark.list_objects_v2
+def test_basic_key_count():
+    client = get_client()
+    bucket_names = []
+    bucket_name = get_new_bucket_name()
+    client.create_bucket(Bucket=bucket_name)
+    for j in range(5):
+            client.put_object(Bucket=bucket_name, Key=str(j))
+    response1 = client.list_objects_v2(Bucket=bucket_name)
+    assert response1['KeyCount'] == 5
+
+def test_bucket_list_delimiter_basic():
+    bucket_name = _create_objects(keys=['foo/bar', 'foo/bar/xyzzy', 'quux/thud', 'asdf'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='/')
+    assert response['Delimiter'] == '/'
+    keys = _get_keys(response)
+    assert keys == ['asdf']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    assert prefixes == ['foo/', 'quux/']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_basic():
+    bucket_name = _create_objects(keys=['foo/bar', 'foo/bar/xyzzy', 'quux/thud', 'asdf'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='/')
+    assert response['Delimiter'] == '/'
+    keys = _get_keys(response)
+    assert keys == ['asdf']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    assert prefixes == ['foo/', 'quux/']
+    assert response['KeyCount'] == len(prefixes) + len(keys)
+
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_encoding_basic():
+    bucket_name = _create_objects(keys=['foo+1/bar', 'foo/bar/xyzzy', 'quux ab/thud', 'asdf+b'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='/', EncodingType='url')
+    assert response['Delimiter'] == '/'
+    keys = _get_keys(response)
+    assert keys == ['asdf%2Bb']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 3
+    assert prefixes == ['foo%2B1/', 'foo/', 'quux%20ab/']
+
+def test_bucket_list_encoding_basic():
+    bucket_name = _create_objects(keys=['foo+1/bar', 'foo/bar/xyzzy', 'quux ab/thud', 'asdf+b'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='/', EncodingType='url')
+    assert response['Delimiter'] == '/'
+    keys = _get_keys(response)
+    assert keys == ['asdf%2Bb']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 3
+    assert prefixes == ['foo%2B1/', 'foo/', 'quux%20ab/']
+
+
+def validate_bucket_list(bucket_name, prefix, delimiter, marker, max_keys,
+                         is_truncated, check_objs, check_prefixes, next_marker):
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter=delimiter, Marker=marker, MaxKeys=max_keys, Prefix=prefix)
+    assert response['IsTruncated'] == is_truncated
+    if 'NextMarker' not in response:
+        response['NextMarker'] = None
+    assert response['NextMarker'] == next_marker
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+
+    assert len(keys) == len(check_objs)
+    assert len(prefixes) == len(check_prefixes)
+    assert keys == check_objs
+    assert prefixes == check_prefixes
+
+    return response['NextMarker']
+
+def validate_bucket_listv2(bucket_name, prefix, delimiter, continuation_token, max_keys,
+                         is_truncated, check_objs, check_prefixes, last=False):
+    client = get_client()
+
+    params = dict(Bucket=bucket_name, Delimiter=delimiter, MaxKeys=max_keys, Prefix=prefix)
+    if continuation_token is not None:
+        params['ContinuationToken'] = continuation_token
+    else:
+        params['StartAfter'] = ''
+    response = client.list_objects_v2(**params)
+    assert response['IsTruncated'] == is_truncated
+    if 'NextContinuationToken' not in response:
+        response['NextContinuationToken'] = None
+    if last:
+        assert response['NextContinuationToken'] == None
+
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+
+    assert len(keys) == len(check_objs)
+    assert len(prefixes) == len(check_prefixes)
+    assert keys == check_objs
+    assert prefixes == check_prefixes
+
+    return response['NextContinuationToken']
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_delimiter_prefix():
+    bucket_name = _create_objects(keys=['asdf', 'boo/bar', 'boo/baz/xyzzy', 'cquux/thud', 'cquux/bla'])
+
+    delim = '/'
+    marker = ''
+    prefix = ''
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 1, True, ['asdf'], [], 'asdf')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 1, True, [], ['boo/'], 'boo/')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 1, False, [], ['cquux/'], None)
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 2, True, ['asdf'], ['boo/'], 'boo/')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 2, False, [], ['cquux/'], None)
+
+    prefix = 'boo/'
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 1, True, ['boo/bar'], [], 'boo/bar')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 1, False, [], ['boo/baz/'], None)
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 2, False, ['boo/bar'], ['boo/baz/'], None)
+
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_bucket_listv2_delimiter_prefix():
+    bucket_name = _create_objects(keys=['asdf', 'boo/bar', 'boo/baz/xyzzy', 'cquux/thud', 'cquux/bla'])
+
+    delim = '/'
+    continuation_token = ''
+    prefix = ''
+
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, None, 1, True, ['asdf'], [])
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token, 1, True, [], ['boo/'])
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token, 1, False, [], ['cquux/'], last=True)
+
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, None, 2, True, ['asdf'], ['boo/'])
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token, 2, False, [], ['cquux/'], last=True)
+
+    prefix = 'boo/'
+
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, None, 1, True, ['boo/bar'], [])
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token, 1, False, [], ['boo/baz/'], last=True)
+
+    continuation_token = validate_bucket_listv2(bucket_name, prefix, delim, None, 2, False, ['boo/bar'], ['boo/baz/'], last=True)
+
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_prefix_ends_with_delimiter():
+    bucket_name = _create_objects(keys=['asdf/'])
+    validate_bucket_listv2(bucket_name, 'asdf/', '/', None, 1000, False, ['asdf/'], [], last=True)
+
+def test_bucket_list_delimiter_prefix_ends_with_delimiter():
+    bucket_name = _create_objects(keys=['asdf/'])
+    validate_bucket_list(bucket_name, 'asdf/', '/', '', 1000, False, ['asdf/'], [], None)
+
+def test_bucket_list_delimiter_alt():
+    bucket_name = _create_objects(keys=['bar', 'baz', 'cab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='a')
+    assert response['Delimiter'] == 'a'
+
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    assert prefixes == ['ba', 'ca']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_alt():
+    bucket_name = _create_objects(keys=['bar', 'baz', 'cab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='a')
+    assert response['Delimiter'] == 'a'
+
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    assert prefixes == ['ba', 'ca']
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_delimiter_prefix_underscore():
+    bucket_name = _create_objects(keys=['_obj1_','_under1/bar', '_under1/baz/xyzzy', '_under2/thud', '_under2/bla'])
+
+    delim = '/'
+    marker = ''
+    prefix = ''
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 1, True, ['_obj1_'], [], '_obj1_')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 1, True, [], ['_under1/'], '_under1/')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 1, False, [], ['_under2/'], None)
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 2, True, ['_obj1_'], ['_under1/'], '_under1/')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 2, False, [], ['_under2/'], None)
+
+    prefix = '_under1/'
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 1, True, ['_under1/bar'], [], '_under1/bar')
+    marker = validate_bucket_list(bucket_name, prefix, delim, marker, 1, False, [], ['_under1/baz/'], None)
+
+    marker = validate_bucket_list(bucket_name, prefix, delim, '', 2, False, ['_under1/bar'], ['_under1/baz/'], None)
+
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_bucket_listv2_delimiter_prefix_underscore():
+    bucket_name = _create_objects(keys=['_obj1_','_under1/bar', '_under1/baz/xyzzy', '_under2/thud', '_under2/bla'])
+
+    delim = '/'
+    continuation_token = ''
+    prefix = ''
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, None, 1, True, ['_obj1_'], [])
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token , 1, True, [], ['_under1/'])
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token , 1, False, [], ['_under2/'], last=True)
+
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, None, 2, True, ['_obj1_'], ['_under1/'])
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token , 2, False, [], ['_under2/'], last=True)
+
+    prefix = '_under1/'
+
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, None, 1, True, ['_under1/bar'], [])
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, continuation_token , 1, False, [], ['_under1/baz/'], last=True)
+
+    continuation_token  = validate_bucket_listv2(bucket_name, prefix, delim, None, 2, False, ['_under1/bar'], ['_under1/baz/'], last=True)
+
+
+def test_bucket_list_delimiter_percentage():
+    bucket_name = _create_objects(keys=['b%ar', 'b%az', 'c%ab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='%')
+    assert response['Delimiter'] == '%'
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    assert prefixes == ['b%', 'c%']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_percentage():
+    bucket_name = _create_objects(keys=['b%ar', 'b%az', 'c%ab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='%')
+    assert response['Delimiter'] == '%'
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    assert prefixes == ['b%', 'c%']
+
+def test_bucket_list_delimiter_whitespace():
+    bucket_name = _create_objects(keys=['b ar', 'b az', 'c ab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter=' ')
+    assert response['Delimiter'] == ' '
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    assert prefixes == ['b ', 'c ']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_whitespace():
+    bucket_name = _create_objects(keys=['b ar', 'b az', 'c ab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter=' ')
+    assert response['Delimiter'] == ' '
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    assert prefixes == ['b ', 'c ']
+
+def test_bucket_list_delimiter_dot():
+    bucket_name = _create_objects(keys=['b.ar', 'b.az', 'c.ab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='.')
+    assert response['Delimiter'] == '.'
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    assert prefixes == ['b.', 'c.']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_dot():
+    bucket_name = _create_objects(keys=['b.ar', 'b.az', 'c.ab', 'foo'])
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='.')
+    assert response['Delimiter'] == '.'
+    keys = _get_keys(response)
+    # foo contains no 'a' and so is a complete key
+    assert keys == ['foo']
+
+    prefixes = _get_prefixes(response)
+    assert len(prefixes) == 2
+    # bar, baz, and cab should be broken up by the 'a' delimiters
+    assert prefixes == ['b.', 'c.']
+
+def test_bucket_list_delimiter_unreadable():
+    key_names=['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='\x0a')
+    assert response['Delimiter'] == '\x0a'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_unreadable():
+    key_names=['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='\x0a')
+    assert response['Delimiter'] == '\x0a'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+def test_bucket_list_delimiter_empty():
+    key_names = ['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='')
+    # putting an empty value into Delimiter will not return a value in the response
+    assert not 'Delimiter' in response
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_empty():
+    key_names = ['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='')
+    # putting an empty value into Delimiter will not return a value in the response
+    assert not 'Delimiter' in response
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+def test_bucket_list_delimiter_none():
+    key_names = ['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name)
+    # putting an empty value into Delimiter will not return a value in the response
+    assert not 'Delimiter' in response
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_none():
+    key_names = ['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name)
+    # putting an empty value into Delimiter will not return a value in the response
+    assert not 'Delimiter' in response
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_fetchowner_notempty():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, FetchOwner=True)
+    objs_list = response['Contents']
+    assert 'Owner' in objs_list[0]
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_fetchowner_defaultempty():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name)
+    objs_list = response['Contents']
+    assert not 'Owner' in objs_list[0]
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_fetchowner_empty():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, FetchOwner= False)
+    objs_list = response['Contents']
+    assert not 'Owner' in objs_list[0]
+
+def test_bucket_list_delimiter_not_exist():
+    key_names = ['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='/')
+    # putting an empty value into Delimiter will not return a value in the response
+    assert response['Delimiter'] == '/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_delimiter_not_exist():
+    key_names = ['bar', 'baz', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='/')
+    # putting an empty value into Delimiter will not return a value in the response
+    assert response['Delimiter'] == '/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_delimiter_not_skip_special():
+    key_names = ['0/'] + ['0/%s' % i for i in range(1000, 1999)]
+    key_names2 = ['1999', '1999#', '1999+', '2000']
+    key_names += key_names2
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='/')
+    assert response['Delimiter'] == '/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names2
+    assert prefixes == ['0/']
+
+def test_bucket_list_prefix_basic():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Prefix='foo/')
+    assert response['Prefix'] == 'foo/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['foo/bar', 'foo/baz']
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_basic():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix='foo/')
+    assert response['Prefix'] == 'foo/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['foo/bar', 'foo/baz']
+    assert prefixes == []
+
+# just testing that we can do the delimeter and prefix logic on non-slashes
+def test_bucket_list_prefix_alt():
+    key_names = ['bar', 'baz', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Prefix='ba')
+    assert response['Prefix'] == 'ba'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['bar', 'baz']
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_alt():
+    key_names = ['bar', 'baz', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix='ba')
+    assert response['Prefix'] == 'ba'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['bar', 'baz']
+    assert prefixes == []
+
+def test_bucket_list_prefix_empty():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Prefix='')
+    assert response['Prefix'] == ''
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_empty():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix='')
+    assert response['Prefix'] == ''
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+def test_bucket_list_prefix_none():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Prefix='')
+    assert response['Prefix'] == ''
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_none():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix='')
+    assert response['Prefix'] == ''
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == key_names
+    assert prefixes == []
+
+def test_bucket_list_prefix_not_exist():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Prefix='d')
+    assert response['Prefix'] == 'd'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_not_exist():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix='d')
+    assert response['Prefix'] == 'd'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+def test_bucket_list_prefix_unreadable():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Prefix='\x0a')
+    assert response['Prefix'] == '\x0a'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_unreadable():
+    key_names = ['foo/bar', 'foo/baz', 'quux']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix='\x0a')
+    assert response['Prefix'] == '\x0a'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+def test_bucket_list_prefix_delimiter_basic():
+    key_names = ['foo/bar', 'foo/baz/xyzzy', 'quux/thud', 'asdf']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='/', Prefix='foo/')
+    assert response['Prefix'] == 'foo/'
+    assert response['Delimiter'] == '/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['foo/bar']
+    assert prefixes == ['foo/baz/']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_delimiter_basic():
+    key_names = ['foo/bar', 'foo/baz/xyzzy', 'quux/thud', 'asdf']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='/', Prefix='foo/')
+    assert response['Prefix'] == 'foo/'
+    assert response['Delimiter'] == '/'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['foo/bar']
+    assert prefixes == ['foo/baz/']
+
+def test_bucket_list_prefix_delimiter_alt():
+    key_names = ['bar', 'bazar', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='a', Prefix='ba')
+    assert response['Prefix'] == 'ba'
+    assert response['Delimiter'] == 'a'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['bar']
+    assert prefixes == ['baza']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_delimiter_alt():
+    key_names = ['bar', 'bazar', 'cab', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='a', Prefix='ba')
+    assert response['Prefix'] == 'ba'
+    assert response['Delimiter'] == 'a'
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['bar']
+    assert prefixes == ['baza']
+
+def test_bucket_list_prefix_delimiter_prefix_not_exist():
+    key_names = ['b/a/r', 'b/a/c', 'b/a/g', 'g']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='d', Prefix='/')
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_delimiter_prefix_not_exist():
+    key_names = ['b/a/r', 'b/a/c', 'b/a/g', 'g']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='d', Prefix='/')
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+def test_bucket_list_prefix_delimiter_delimiter_not_exist():
+    key_names = ['b/a/c', 'b/a/g', 'b/a/r', 'g']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='z', Prefix='b')
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['b/a/c', 'b/a/g', 'b/a/r']
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_delimiter_delimiter_not_exist():
+    key_names = ['b/a/c', 'b/a/g', 'b/a/r', 'g']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='z', Prefix='b')
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == ['b/a/c', 'b/a/g', 'b/a/r']
+    assert prefixes == []
+
+def test_bucket_list_prefix_delimiter_prefix_delimiter_not_exist():
+    key_names = ['b/a/c', 'b/a/g', 'b/a/r', 'g']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Delimiter='z', Prefix='y')
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_prefix_delimiter_prefix_delimiter_not_exist():
+    key_names = ['b/a/c', 'b/a/g', 'b/a/r', 'g']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, Delimiter='z', Prefix='y')
+
+    keys = _get_keys(response)
+    prefixes = _get_prefixes(response)
+    assert keys == []
+    assert prefixes == []
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_maxkeys_one():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, MaxKeys=1)
+    assert response['IsTruncated'] == True
+
+    keys = _get_keys(response)
+    assert keys == key_names[0:1]
+
+    response = client.list_objects(Bucket=bucket_name, Marker=key_names[0])
+    assert response['IsTruncated'] == False
+
+    keys = _get_keys(response)
+    assert keys == key_names[1:]
+
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_bucket_listv2_maxkeys_one():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, MaxKeys=1)
+    assert response['IsTruncated'] == True
+
+    keys = _get_keys(response)
+    assert keys == key_names[0:1]
+
+    response = client.list_objects_v2(Bucket=bucket_name, StartAfter=key_names[0])
+    assert response['IsTruncated'] == False
+
+    keys = _get_keys(response)
+    assert keys == key_names[1:]
+
+def test_bucket_list_maxkeys_zero():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, MaxKeys=0)
+
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_maxkeys_zero():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, MaxKeys=0)
+
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == []
+
+def test_bucket_list_maxkeys_none():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name)
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == key_names
+    assert response['MaxKeys'] == 1000
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_maxkeys_none():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name)
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == key_names
+    assert response['MaxKeys'] == 1000
+
+def get_http_response_body(**kwargs):
+    global http_response_body
+    http_response_body = kwargs['http_response'].__dict__['_content']
+
+def parseXmlToJson(xml):
+  response = {}
+
+  for child in list(xml):
+    if len(list(child)) > 0:
+      response[child.tag] = parseXmlToJson(child)
+    else:
+      response[child.tag] = child.text or ''
+
+    # one-liner equivalent
+    # response[child.tag] = parseXmlToJson(child) if len(list(child)) > 0 else child.text or ''
+
+  return response
+
+@pytest.mark.fails_on_aws
+def test_account_usage():
+    # boto3.set_stream_logger(name='botocore')
+    client = get_client()
+    # adds the unordered query parameter
+    def add_usage(**kwargs):
+        kwargs['params']['url'] += "?usage"
+    client.meta.events.register('before-call.s3.ListBuckets', add_usage)
+    client.meta.events.register('after-call.s3.ListBuckets', get_http_response_body)
+    client.list_buckets()
+    xml    = ET.fromstring(http_response_body.decode('utf-8'))
+    parsed = parseXmlToJson(xml)
+    summary = parsed['Summary']
+    assert summary['QuotaMaxBytes'] == '-1'
+    assert summary['QuotaMaxBuckets'] == '1000'
+    assert summary['QuotaMaxObjCount'] == '-1'
+    assert summary['QuotaMaxBytesPerBucket'] == '-1'
+    assert summary['QuotaMaxObjCountPerBucket'] == '-1'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_head_bucket_usage():
+    client = get_client()
+    bucket_name = _create_objects(keys=['foo'])
+
+    def add_read_stats_param(request, **kwargs):
+        request.params['read-stats'] = 'true'
+
+    client.meta.events.register('request-created.s3.HeadBucket', add_read_stats_param)
+    client.meta.events.register('after-call.s3.HeadBucket', get_http_response)
+    client.head_bucket(Bucket=bucket_name)
+    hdrs = http_response['headers']
+    assert hdrs['X-RGW-Object-Count'] == '1'
+    assert hdrs['X-RGW-Bytes-Used'] == '3'
+    assert hdrs['X-RGW-Quota-Max-Buckets'] == '1000'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_unordered():
+    # boto3.set_stream_logger(name='botocore')
+    keys_in = ['ado', 'bot', 'cob', 'dog', 'emu', 'fez', 'gnu', 'hex',
+               'abc/ink', 'abc/jet', 'abc/kin', 'abc/lax', 'abc/mux',
+               'def/nim', 'def/owl', 'def/pie', 'def/qed', 'def/rye',
+               'ghi/sew', 'ghi/tor', 'ghi/uke', 'ghi/via', 'ghi/wit',
+               'xix', 'yak', 'zoo']
+    bucket_name = _create_objects(keys=keys_in)
+    client = get_client()
+
+    # adds the unordered query parameter
+    def add_unordered(**kwargs):
+        kwargs['params']['url'] += "&allow-unordered=true"
+    client.meta.events.register('before-call.s3.ListObjects', add_unordered)
+
+    # test simple retrieval
+    response = client.list_objects(Bucket=bucket_name, MaxKeys=1000)
+    unordered_keys_out = _get_keys(response)
+    assert len(keys_in) == len(unordered_keys_out)
+    assert keys_in.sort() == unordered_keys_out.sort()
+
+    # test retrieval with prefix
+    response = client.list_objects(Bucket=bucket_name,
+                                   MaxKeys=1000,
+                                   Prefix="abc/")
+    unordered_keys_out = _get_keys(response)
+    assert 5 == len(unordered_keys_out)
+
+    # test incremental retrieval with marker
+    response = client.list_objects(Bucket=bucket_name, MaxKeys=6)
+    unordered_keys_out = _get_keys(response)
+    assert 6 == len(unordered_keys_out)
+
+    # now get the next bunch
+    response = client.list_objects(Bucket=bucket_name,
+                                   MaxKeys=6,
+                                   Marker=unordered_keys_out[-1])
+    unordered_keys_out2 = _get_keys(response)
+    assert 6 == len(unordered_keys_out2)
+
+    # make sure there's no overlap between the incremental retrievals
+    intersect = set(unordered_keys_out).intersection(unordered_keys_out2)
+    assert 0 == len(intersect)
+
+    # verify that unordered used with delimiter results in error
+    e = assert_raises(ClientError,
+                      client.list_objects, Bucket=bucket_name, Delimiter="/")
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_bucket_listv2_unordered():
+    # boto3.set_stream_logger(name='botocore')
+    keys_in = ['ado', 'bot', 'cob', 'dog', 'emu', 'fez', 'gnu', 'hex',
+               'abc/ink', 'abc/jet', 'abc/kin', 'abc/lax', 'abc/mux',
+               'def/nim', 'def/owl', 'def/pie', 'def/qed', 'def/rye',
+               'ghi/sew', 'ghi/tor', 'ghi/uke', 'ghi/via', 'ghi/wit',
+               'xix', 'yak', 'zoo']
+    bucket_name = _create_objects(keys=keys_in)
+    client = get_client()
+
+    # adds the unordered query parameter
+    def add_unordered(**kwargs):
+        kwargs['params']['url'] += "&allow-unordered=true"
+    client.meta.events.register('before-call.s3.ListObjects', add_unordered)
+
+    # test simple retrieval
+    response = client.list_objects_v2(Bucket=bucket_name, MaxKeys=1000)
+    unordered_keys_out = _get_keys(response)
+    assert len(keys_in) == len(unordered_keys_out)
+    assert keys_in.sort() == unordered_keys_out.sort()
+
+    # test retrieval with prefix
+    response = client.list_objects_v2(Bucket=bucket_name,
+                                   MaxKeys=1000,
+                                   Prefix="abc/")
+    unordered_keys_out = _get_keys(response)
+    assert 5 == len(unordered_keys_out)
+
+    # test incremental retrieval with marker
+    response = client.list_objects_v2(Bucket=bucket_name, MaxKeys=6)
+    unordered_keys_out = _get_keys(response)
+    assert 6 == len(unordered_keys_out)
+
+    # now get the next bunch
+    response = client.list_objects_v2(Bucket=bucket_name,
+                                   MaxKeys=6,
+                                   StartAfter=unordered_keys_out[-1])
+    unordered_keys_out2 = _get_keys(response)
+    assert 6 == len(unordered_keys_out2)
+
+    # make sure there's no overlap between the incremental retrievals
+    intersect = set(unordered_keys_out).intersection(unordered_keys_out2)
+    assert 0 == len(intersect)
+
+    #pdb.set_trace()
+    # verify that unordered used with delimiter results in error
+    e = assert_raises(ClientError,
+                      client.list_objects, Bucket=bucket_name, Delimiter="/")
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+
+def test_bucket_list_maxkeys_invalid():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    # adds invalid max keys to url
+    # before list_objects is called
+    def add_invalid_maxkeys(**kwargs):
+        kwargs['params']['url'] += "&max-keys=blah"
+    client.meta.events.register('before-call.s3.ListObjects', add_invalid_maxkeys)
+
+    e = assert_raises(ClientError, client.list_objects, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+
+
+def test_bucket_list_marker_none():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name)
+    assert response['Marker'] == ''
+
+
+def test_bucket_list_marker_empty():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Marker='')
+    assert response['Marker'] == ''
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == key_names
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_continuationtoken_empty():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, ContinuationToken='')
+    assert response['ContinuationToken'] == ''
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == key_names
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_continuationtoken():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response1 = client.list_objects_v2(Bucket=bucket_name, MaxKeys=1)
+    next_continuation_token = response1['NextContinuationToken']
+
+    response2 = client.list_objects_v2(Bucket=bucket_name, ContinuationToken=next_continuation_token)
+    assert response2['ContinuationToken'] == next_continuation_token
+    assert response2['IsTruncated'] == False
+    key_names2 = ['baz', 'foo', 'quxx']
+    keys = _get_keys(response2)
+    assert keys == key_names2
+
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_bucket_listv2_both_continuationtoken_startafter():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response1 = client.list_objects_v2(Bucket=bucket_name, StartAfter='bar', MaxKeys=1)
+    next_continuation_token = response1['NextContinuationToken']
+
+    response2 = client.list_objects_v2(Bucket=bucket_name, StartAfter='bar', ContinuationToken=next_continuation_token)
+    assert response2['ContinuationToken'] == next_continuation_token
+    assert response2['StartAfter'] == 'bar'
+    assert response2['IsTruncated'] == False
+    key_names2 = ['foo', 'quxx']
+    keys = _get_keys(response2)
+    assert keys == key_names2
+
+def test_bucket_list_marker_unreadable():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Marker='\x0a')
+    assert response['Marker'] == '\x0a'
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == key_names
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_startafter_unreadable():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, StartAfter='\x0a')
+    assert response['StartAfter'] == '\x0a'
+    assert response['IsTruncated'] == False
+    keys = _get_keys(response)
+    assert keys == key_names
+
+def test_bucket_list_marker_not_in_list():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Marker='blah')
+    assert response['Marker'] == 'blah'
+    keys = _get_keys(response)
+    assert keys == [ 'foo','quxx']
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_startafter_not_in_list():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, StartAfter='blah')
+    assert response['StartAfter'] == 'blah'
+    keys = _get_keys(response)
+    assert keys == ['foo', 'quxx']
+
+def test_bucket_list_marker_after_list():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects(Bucket=bucket_name, Marker='zzz')
+    assert response['Marker'] == 'zzz'
+    keys = _get_keys(response)
+    assert response['IsTruncated'] == False
+    assert keys == []
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_startafter_after_list():
+    key_names = ['bar', 'baz', 'foo', 'quxx']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    response = client.list_objects_v2(Bucket=bucket_name, StartAfter='zzz')
+    assert response['StartAfter'] == 'zzz'
+    keys = _get_keys(response)
+    assert response['IsTruncated'] == False
+    assert keys == []
+
+def _compare_dates(datetime1, datetime2):
+    """
+    changes ms from datetime1 to 0, compares it to datetime2
+    """
+    # both times are in datetime format but datetime1 has
+    # microseconds and datetime2 does not
+    datetime1 = datetime1.replace(microsecond=0)
+    assert datetime1 == datetime2
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_return_data():
+    key_names = ['bar', 'baz', 'foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    data = {}
+    for key_name in key_names:
+        obj_response = client.head_object(Bucket=bucket_name, Key=key_name)
+        acl_response = client.get_object_acl(Bucket=bucket_name, Key=key_name)
+        data.update({
+            key_name: {
+                'DisplayName': acl_response['Owner']['DisplayName'],
+                'ID': acl_response['Owner']['ID'],
+                'ETag': obj_response['ETag'],
+                'LastModified': obj_response['LastModified'],
+                'ContentLength': obj_response['ContentLength'],
+                }
+            })
+
+    response  = client.list_objects(Bucket=bucket_name)
+    objs_list = response['Contents']
+    for obj in objs_list:
+        key_name = obj['Key']
+        key_data = data[key_name]
+        assert obj['ETag'] == key_data['ETag']
+        assert obj['Size'] == key_data['ContentLength']
+        assert obj['Owner']['DisplayName'] == key_data['DisplayName']
+        assert obj['Owner']['ID'] == key_data['ID']
+        _compare_dates(obj['LastModified'],key_data['LastModified'])
+
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_list_return_data_versioning():
+    bucket_name = get_new_bucket()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    key_names = ['bar', 'baz', 'foo']
+    bucket_name = _create_objects(bucket_name=bucket_name,keys=key_names)
+
+    client = get_client()
+    data = {}
+
+    for key_name in key_names:
+        obj_response = client.head_object(Bucket=bucket_name, Key=key_name)
+        acl_response = client.get_object_acl(Bucket=bucket_name, Key=key_name)
+        data.update({
+            key_name: {
+                'ID': acl_response['Owner']['ID'],
+                'DisplayName': acl_response['Owner']['DisplayName'],
+                'ETag': obj_response['ETag'],
+                'LastModified': obj_response['LastModified'],
+                'ContentLength': obj_response['ContentLength'],
+                'VersionId': obj_response['VersionId']
+                }
+            })
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    objs_list = response['Versions']
+
+    for obj in objs_list:
+        key_name = obj['Key']
+        key_data = data[key_name]
+        assert obj['Owner']['DisplayName'] == key_data['DisplayName']
+        assert obj['ETag'] == key_data['ETag']
+        assert obj['Size'] == key_data['ContentLength']
+        assert obj['Owner']['ID'] == key_data['ID']
+        assert obj['VersionId'] == key_data['VersionId']
+        _compare_dates(obj['LastModified'],key_data['LastModified'])
+
+def test_bucket_list_objects_anonymous():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+
+    unauthenticated_client = get_unauthenticated_client()
+    unauthenticated_client.list_objects(Bucket=bucket_name)
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_objects_anonymous():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+
+    unauthenticated_client = get_unauthenticated_client()
+    unauthenticated_client.list_objects_v2(Bucket=bucket_name)
+
+def test_bucket_list_objects_anonymous_fail():
+    bucket_name = get_new_bucket()
+
+    unauthenticated_client = get_unauthenticated_client()
+    e = assert_raises(ClientError, unauthenticated_client.list_objects, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.list_objects_v2
+def test_bucket_listv2_objects_anonymous_fail():
+    bucket_name = get_new_bucket()
+
+    unauthenticated_client = get_unauthenticated_client()
+    e = assert_raises(ClientError, unauthenticated_client.list_objects_v2, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+def test_bucket_notexist():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    e = assert_raises(ClientError, client.list_objects, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+@pytest.mark.list_objects_v2
+def test_bucketv2_notexist():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    e = assert_raises(ClientError, client.list_objects_v2, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_bucket_delete_notexist():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    e = assert_raises(ClientError, client.delete_bucket, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_bucket_delete_nonempty():
+    key_names = ['foo']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    e = assert_raises(ClientError, client.delete_bucket, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'BucketNotEmpty'
+
+def _do_set_bucket_canned_acl(client, bucket_name, canned_acl, i, results):
+    try:
+        client.put_bucket_acl(ACL=canned_acl, Bucket=bucket_name)
+        results[i] = True
+    except:
+        results[i] = False
+
+def _do_set_bucket_canned_acl_concurrent(client, bucket_name, canned_acl, num, results):
+    t = []
+    for i in range(num):
+        thr = threading.Thread(target = _do_set_bucket_canned_acl, args=(client, bucket_name, canned_acl, i, results))
+        thr.start()
+        t.append(thr)
+    return t
+
+def _do_wait_completion(t):
+    for thr in t:
+        thr.join()
+
+def test_bucket_concurrent_set_canned_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    num_threads = 50 # boto2 retry defaults to 5 so we need a thread to fail at least 5 times
+                     # this seems like a large enough number to get through retry (if bug
+                     # exists)
+    results = [None] * num_threads
+
+    t = _do_set_bucket_canned_acl_concurrent(client, bucket_name, 'public-read', num_threads, results)
+    _do_wait_completion(t)
+
+    for r in results:
+        assert r == True
+
+def test_object_write_to_nonexist_bucket():
+    key_names = ['foo']
+    bucket_name = 'whatchutalkinboutwillis'
+    client = get_client()
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo', Body='foo')
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+
+def _ev_add_te_header(request, **kwargs):
+    request.headers.add_header('Transfer-Encoding', 'chunked')
+
+def test_object_write_with_chunked_transfer_encoding():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.meta.events.register_first('before-sign.*.*', _ev_add_te_header)
+    response = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+def test_bucket_create_delete():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.delete_bucket(Bucket=bucket_name)
+
+    e = assert_raises(ClientError, client.delete_bucket, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_object_read_not_exist():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='bar')
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+http_response = None
+
+def get_http_response(**kwargs):
+    global http_response
+    http_response = kwargs['http_response'].__dict__
+
+@pytest.mark.fails_on_dbstore
+def test_object_requestid_matches_header_on_error():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # get http response after failed request
+    client.meta.events.register('after-call.s3.GetObject', get_http_response)
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='bar')
+
+    response_body = http_response['_content']
+    resp_body_xml = ET.fromstring(response_body)
+    request_id = resp_body_xml.find('.//RequestId').text
+
+    assert request_id is not None
+    assert request_id == e.response['ResponseMetadata']['RequestId']
+
+def _make_objs_dict(key_names):
+    objs_list = []
+    for key in key_names:
+        obj_dict = {'Key': key}
+        objs_list.append(obj_dict)
+    objs_dict = {'Objects': objs_list}
+    return objs_dict
+
+def test_versioning_concurrent_multi_object_delete():
+    num_objects = 5
+    num_versions_per_object = 3
+    total_num_objects_in_the_bucket = num_objects * num_versions_per_object
+    num_threads = 5
+    bucket_name = get_new_bucket()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key_names = ["key_{:d}".format(x) for x in range(num_objects)]
+    for _ in range(num_versions_per_object):
+        bucket = _create_objects(bucket_name=bucket_name, keys=key_names)
+        assert bucket == bucket_name
+
+    client = get_client()
+    versions = client.list_object_versions(Bucket=bucket_name)['Versions']
+    assert len(versions) == total_num_objects_in_the_bucket
+    objs_dict = {'Objects': [dict((k, v[k]) for k in ["Key", "VersionId"]) for v in versions]}
+    results = [None] * num_threads
+
+    def do_request(n):
+        results[n] = client.delete_objects(Bucket=bucket_name, Delete=objs_dict)
+
+    t = []
+    for i in range(num_threads):
+        thr = threading.Thread(target = do_request, args=[i])
+        thr.start()
+        t.append(thr)
+    _do_wait_completion(t)
+
+    for response in results:
+        assert len(response['Deleted']) == total_num_objects_in_the_bucket
+        assert 'Errors' not in response
+
+    response_list_objects = client.list_objects(Bucket=bucket_name)
+    assert 'Contents' not in response_list_objects
+    response_list_versions = client.list_object_versions(Bucket=bucket_name)
+    assert 'Versions' not in response_list_versions and 'DeleteMarkers' not in response_list_versions
+
+def test_multi_object_delete():
+    key_names = ['key0', 'key1', 'key2']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+    response = client.list_objects(Bucket=bucket_name)
+    assert len(response['Contents']) == 3
+
+    objs_dict = _make_objs_dict(key_names=key_names)
+    response = client.delete_objects(Bucket=bucket_name, Delete=objs_dict)
+
+    assert len(response['Deleted']) == 3
+    assert 'Errors' not in response
+    response = client.list_objects(Bucket=bucket_name)
+    assert 'Contents' not in response
+
+    response = client.delete_objects(Bucket=bucket_name, Delete=objs_dict)
+    assert len(response['Deleted']) == 3
+    assert 'Errors' not in response
+    response = client.list_objects(Bucket=bucket_name)
+    assert 'Contents' not in response
+
+@pytest.mark.list_objects_v2
+def test_expected_bucket_owner():
+  bucket_name = get_new_bucket()
+  client = get_client()
+  client.put_bucket_acl(Bucket=bucket_name, ACL='public-read-write')
+  client.list_objects(Bucket=bucket_name)
+  client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+  unauthenticated_client = get_unauthenticated_client()
+  incorrect_expected_owner = get_main_user_id() + 'foo'
+
+  e = assert_raises(ClientError, unauthenticated_client.list_objects, Bucket=bucket_name, ExpectedBucketOwner=incorrect_expected_owner)
+  status, error_code = _get_status_and_error_code(e.response)
+  assert status == 403
+  assert error_code == 'AccessDenied'
+
+  e = assert_raises(ClientError, unauthenticated_client.put_object, Bucket=bucket_name, Key='bar', Body='coffee', ExpectedBucketOwner=incorrect_expected_owner)
+  status, error_code = _get_status_and_error_code(e.response)
+  assert status == 403
+  assert error_code == 'AccessDenied'
+
+@pytest.mark.list_objects_v2
+def test_multi_objectv2_delete():
+    key_names = ['key0', 'key1', 'key2']
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+    response = client.list_objects_v2(Bucket=bucket_name)
+    assert len(response['Contents']) == 3
+
+    objs_dict = _make_objs_dict(key_names=key_names)
+    response = client.delete_objects(Bucket=bucket_name, Delete=objs_dict)
+
+    assert len(response['Deleted']) == 3
+    assert 'Errors' not in response
+    response = client.list_objects_v2(Bucket=bucket_name)
+    assert 'Contents' not in response
+
+    response = client.delete_objects(Bucket=bucket_name, Delete=objs_dict)
+    assert len(response['Deleted']) == 3
+    assert 'Errors' not in response
+    response = client.list_objects_v2(Bucket=bucket_name)
+    assert 'Contents' not in response
+
+def test_multi_object_delete_key_limit():
+    key_names = [f"key-{i}" for i in range(1001)]
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    paginator = client.get_paginator('list_objects')
+    pages = paginator.paginate(Bucket=bucket_name)
+    numKeys = 0
+    for page in pages:
+        numKeys += len(page['Contents'])
+    assert numKeys == 1001
+
+    objs_dict = _make_objs_dict(key_names=key_names)
+    e = assert_raises(ClientError,client.delete_objects,Bucket=bucket_name,Delete=objs_dict)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+def test_multi_objectv2_delete_key_limit():
+    key_names = [f"key-{i}" for i in range(1001)]
+    bucket_name = _create_objects(keys=key_names)
+    client = get_client()
+
+    paginator = client.get_paginator('list_objects_v2')
+    pages = paginator.paginate(Bucket=bucket_name)
+    numKeys = 0
+    for page in pages:
+        numKeys += len(page['Contents'])
+    assert numKeys == 1001
+
+    objs_dict = _make_objs_dict(key_names=key_names)
+    e = assert_raises(ClientError,client.delete_objects,Bucket=bucket_name,Delete=objs_dict)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+def test_object_head_zero_bytes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='')
+
+    response = client.head_object(Bucket=bucket_name, Key='foo')
+    assert response['ContentLength'] == 0
+
+def test_object_write_check_etag():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    response = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['ETag'] == '"37b51d194a7513e45b56f6524f2d51f2"'
+
+def test_object_write_cache_control():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    cache_control = 'public, max-age=14400'
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar', CacheControl=cache_control)
+
+    response = client.head_object(Bucket=bucket_name, Key='foo')
+    assert response['ResponseMetadata']['HTTPHeaders']['cache-control'] == cache_control
+
+def test_object_write_expires():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar', Expires=expires)
+
+    response = client.head_object(Bucket=bucket_name, Key='foo')
+    _compare_dates(expires, response['Expires'])
+
+def _get_body(response):
+    body = response['Body']
+    got = body.read()
+    if type(got) is bytes:
+        got = got.decode()
+    return got
+
+def test_object_write_read_update_read_delete():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # Write
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    # Read
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+    # Update
+    client.put_object(Bucket=bucket_name, Key='foo', Body='soup')
+    # Read
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'soup'
+    # Delete
+    client.delete_object(Bucket=bucket_name, Key='foo')
+
+def _set_get_metadata(metadata, bucket_name=None):
+    """
+    create a new bucket new or use an existing
+    name to create an object that bucket,
+    set the meta1 property to a specified, value,
+    and then re-read and return that property
+    """
+    if bucket_name is None:
+        bucket_name = get_new_bucket()
+
+    client = get_client()
+    metadata_dict = {'meta1': metadata}
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar', Metadata=metadata_dict)
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    return response['Metadata']['meta1']
+
+def test_object_set_get_metadata_none_to_good():
+    got = _set_get_metadata('mymeta')
+    assert got == 'mymeta'
+
+def test_object_set_get_metadata_none_to_empty():
+    got = _set_get_metadata('')
+    assert got == ''
+
+def test_object_set_get_metadata_overwrite_to_empty():
+    bucket_name = get_new_bucket()
+    got = _set_get_metadata('oldmeta', bucket_name)
+    assert got == 'oldmeta'
+    got = _set_get_metadata('', bucket_name)
+    assert got == ''
+
+# TODO: the decoding of this unicode metadata is not happening properly for unknown reasons
+@pytest.mark.fails_on_rgw
+def test_object_set_get_unicode_metadata():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    def set_unicode_metadata(**kwargs):
+        kwargs['params']['headers']['x-amz-meta-meta1'] = u"Hello World\xe9"
+
+    client.meta.events.register('before-call.s3.PutObject', set_unicode_metadata)
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    got = response['Metadata']['meta1']
+    print(got)
+    print(u"Hello World\xe9")
+    assert got == u"Hello World\xe9"
+
+def _set_get_metadata_unreadable(metadata, bucket_name=None):
+    """
+    set and then read back a meta-data value (which presumably
+    includes some interesting characters), and return a list
+    containing the stored value AND the encoding with which it
+    was returned.
+
+    This should return a 400 bad request because the webserver
+    rejects the request.
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+    metadata_dict = {'meta1': metadata}
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='bar', Metadata=metadata_dict)
+    return e
+
+def test_object_metadata_replaced_on_put():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    metadata_dict = {'meta1': 'bar'}
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar', Metadata=metadata_dict)
+
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    got = response['Metadata']
+    assert got == {}
+
+def test_object_write_file():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data_str = 'bar'
+    data = bytes(data_str, 'utf-8')
+    client.put_object(Bucket=bucket_name, Key='foo', Body=data)
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def _get_post_url(bucket_name):
+    endpoint = get_config_endpoint()
+    return '{endpoint}/{bucket_name}'.format(endpoint=endpoint, bucket_name=bucket_name)
+
+def test_post_object_anonymous_request():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    url = _get_post_url(bucket_name)
+    payload = OrderedDict([("key" , "foo.txt"),("acl" , "public-read"),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_post_object_authenticated_request():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_post_object_authenticated_no_content_type():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key="foo.txt")
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_post_object_authenticated_request_bad_access_key():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , 'foo'),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_set_success_code():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+
+    url = _get_post_url(bucket_name)
+    payload = OrderedDict([("key" , "foo.txt"),("acl" , "public-read"),\
+    ("success_action_status" , "201"),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 201
+    message = ET.fromstring(r.content).find('Key')
+    assert message.text == 'foo.txt'
+
+def test_post_object_set_invalid_success_code():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+
+    url = _get_post_url(bucket_name)
+    payload = OrderedDict([("key" , "foo.txt"),("acl" , "public-read"),\
+    ("success_action_status" , "404"),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    content = r.content.decode()
+    assert content == ''
+
+def test_post_object_upload_larger_than_chunk():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 5*1024*1024]\
+    ]\
+    }
+
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    foo_string = 'foo' * 1024*1024
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', foo_string)])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == foo_string
+
+def test_post_object_set_key_from_filename():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "${filename}"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('foo.txt', 'bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_post_object_ignored_header():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),("x-ignore-foo" , "bar"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+
+def test_post_object_case_insensitive_condition_fields():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bUcKeT": bucket_name},\
+    ["StArTs-WiTh", "$KeY", "foo"],\
+    {"AcL": "private"},\
+    ["StArTs-WiTh", "$CoNtEnT-TyPe", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    foo_string = 'foo' * 1024*1024
+
+    payload = OrderedDict([ ("kEy" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("aCl" , "private"),("signature" , signature),("pOLICy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+
+def test_post_object_escaped_field_values():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", r"\$foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , r"\$foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key=r'\$foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_post_object_success_redirect_action():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+
+    url = _get_post_url(bucket_name)
+    redirect_url = _get_post_url(bucket_name)
+
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["eq", "$success_action_redirect", redirect_url],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),("success_action_redirect" , redirect_url),\
+    ('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 200
+    url = r.url
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    assert url == '{rurl}?bucket={bucket}&key={key}&etag=%22{etag}%22'.format(\
+    rurl = redirect_url, bucket = bucket_name, key = 'foo.txt', etag = response['ETag'].strip('"'))
+
+def test_post_object_invalid_signature():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", r"\$foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())[::-1]
+
+    payload = OrderedDict([ ("key" , r"\$foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_invalid_access_key():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", r"\$foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , r"\$foo.txt"),("AWSAccessKeyId" , aws_access_key_id[::-1]),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_invalid_date_format():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": str(expires),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", r"\$foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , r"\$foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_no_key_specified():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_missing_signature():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", r"\$foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_missing_policy_condition():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    ["starts-with", "$key", r"\$foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_user_specified_header():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ["starts-with", "$x-amz-meta-foo",  "bar"]
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('x-amz-meta-foo' , 'barclamp'),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    assert response['Metadata']['foo'] == 'barclamp'
+
+def test_post_object_request_missing_policy_specified_field():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ["starts-with", "$x-amz-meta-foo",  "bar"]
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_condition_is_case_sensitive():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "CONDITIONS": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_expires_is_case_sensitive():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"EXPIRATION": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_expired_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=-6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key", "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_wrong_bucket():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "${filename}"),('bucket', bucket_name),\
+    ("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('foo.txt', 'bar'))])
+
+    bad_bucket_name = get_new_bucket()
+    url = _get_post_url(bad_bucket_name)
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_invalid_request_field_value():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ["eq", "$x-amz-meta-foo",  ""]
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('x-amz-meta-foo' , 'barclamp'),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 403
+
+def test_post_object_missing_expires_condition():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 1024],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_missing_conditions_list():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ")}
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_upload_size_limit_exceeded():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0, 0],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_missing_content_length_argument():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 0],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_invalid_content_length_argument():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", -1, 0],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_upload_size_below_minimum():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", 512, 1000],\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_post_object_upload_size_rgw_chunk_size_bug():
+    # Test for https://tracker.ceph.com/issues/58627
+    # TODO: if this value is different in Teuthology runs, this would need tuning
+    # https://github.com/ceph/ceph/blob/main/qa/suites/rgw/verify/striping%24/stripe-greater-than-chunk.yaml
+    _rgw_max_chunk_size = 4 * 2**20 # 4MiB
+    min_size = _rgw_max_chunk_size
+    max_size = _rgw_max_chunk_size * 3
+    # [(chunk),(small)]
+    test_payload_size = _rgw_max_chunk_size + 200 # extra bit to push it over the chunk boundary
+    # it should be valid when we run this test!
+    assert test_payload_size > min_size
+    assert test_payload_size < max_size
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", min_size, max_size],\
+    ]\
+    }
+
+    test_payload = 'x' * test_payload_size
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', (test_payload))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+
+def test_post_object_empty_conditions():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    { }\
+    ]\
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+def test_get_object_ifmatch_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    response = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    etag = response['ETag']
+
+    response = client.get_object(Bucket=bucket_name, Key='foo', IfMatch=etag)
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_get_object_ifmatch_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo', IfMatch='"ABCORZ"')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+def test_get_object_ifnonematch_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    response = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    etag = response['ETag']
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo', IfNoneMatch=etag)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 304
+    assert e.response['Error']['Message'] == 'Not Modified'
+    assert e.response['ResponseMetadata']['HTTPHeaders']['etag'] == etag
+
+def test_get_object_ifnonematch_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo', IfNoneMatch='ABCORZ')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def test_get_object_ifmodifiedsince_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo', IfModifiedSince='Sat, 29 Oct 1994 19:43:31 GMT')
+    body = _get_body(response)
+    assert body == 'bar'
+
+@pytest.mark.fails_on_dbstore
+def test_get_object_ifmodifiedsince_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    etag = response['ETag']
+    last_modified = str(response['LastModified'])
+
+    last_modified = last_modified.split('+')[0]
+    mtime = datetime.datetime.strptime(last_modified, '%Y-%m-%d %H:%M:%S')
+
+    after = mtime + datetime.timedelta(seconds=1)
+    after_str = time.strftime("%a, %d %b %Y %H:%M:%S GMT", after.timetuple())
+
+    time.sleep(1)
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo', IfModifiedSince=after_str)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 304
+    assert e.response['Error']['Message'] == 'Not Modified'
+    assert e.response['ResponseMetadata']['HTTPHeaders']['etag'] == etag
+
+@pytest.mark.fails_on_dbstore
+def test_get_object_ifunmodifiedsince_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo', IfUnmodifiedSince='Sat, 29 Oct 1994 19:43:31 GMT')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+def test_get_object_ifunmodifiedsince_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo', IfUnmodifiedSince='Sat, 29 Oct 2100 19:43:31 GMT')
+    body = _get_body(response)
+    assert body == 'bar'
+
+
+@pytest.mark.fails_on_aws
+def test_put_object_ifmatch_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    etag = response['ETag'].replace('"', '')
+
+    # pass in custom header 'If-Match' before PutObject call
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-Match': etag}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    response = client.put_object(Bucket=bucket_name,Key='foo', Body='zar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'zar'
+
+@pytest.mark.fails_on_dbstore
+def test_put_object_ifmatch_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    # pass in custom header 'If-Match' before PutObject call
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-Match': '"ABCORZ"'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo', Body='zar')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+@pytest.mark.fails_on_aws
+def test_put_object_ifmatch_overwrite_existed_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-Match': '*'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    response = client.put_object(Bucket=bucket_name,Key='foo', Body='zar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'zar'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_put_object_ifmatch_nonexisted_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-Match': '*'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo', Body='bar')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+@pytest.mark.fails_on_aws
+def test_put_object_ifnonmatch_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-None-Match': 'ABCORZ'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    response = client.put_object(Bucket=bucket_name,Key='foo', Body='zar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'zar'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_put_object_ifnonmatch_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    etag = response['ETag'].replace('"', '')
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-None-Match': etag}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo', Body='zar')
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+@pytest.mark.fails_on_aws
+def test_put_object_ifnonmatch_nonexisted_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-None-Match': '*'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_put_object_ifnonmatch_overwrite_existed_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-None-Match': '*'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo', Body='zar')
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+def _setup_bucket_object_acl(bucket_acl, object_acl, client=None):
+    """
+    add a foo key, and specified key and bucket acls to
+    a (new or existing) bucket.
+    """
+    if client is None:
+        client = get_client()
+    bucket_name = get_new_bucket_name()
+    client.create_bucket(ACL=bucket_acl, Bucket=bucket_name)
+    client.put_object(ACL=object_acl, Bucket=bucket_name, Key='foo')
+
+    return bucket_name
+
+def _setup_bucket_acl(bucket_acl=None):
+    """
+    set up a new bucket with specified acl
+    """
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL=bucket_acl, Bucket=bucket_name)
+
+    return bucket_name
+
+def test_object_raw_get():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+
+    unauthenticated_client = get_unauthenticated_client()
+    response = unauthenticated_client.get_object(Bucket=bucket_name, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_object_raw_get_bucket_gone():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+
+    client.delete_object(Bucket=bucket_name, Key='foo')
+    client.delete_bucket(Bucket=bucket_name)
+
+    unauthenticated_client = get_unauthenticated_client()
+
+    e = assert_raises(ClientError, unauthenticated_client.get_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_object_delete_key_bucket_gone():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+
+    client.delete_object(Bucket=bucket_name, Key='foo')
+    client.delete_bucket(Bucket=bucket_name)
+
+    unauthenticated_client = get_unauthenticated_client()
+
+    e = assert_raises(ClientError, unauthenticated_client.delete_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_object_raw_get_object_gone():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+
+    client.delete_object(Bucket=bucket_name, Key='foo')
+
+    unauthenticated_client = get_unauthenticated_client()
+
+    e = assert_raises(ClientError, unauthenticated_client.get_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+def test_bucket_head():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = client.head_bucket(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_bucket_head_notexist():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    e = assert_raises(ClientError, client.head_bucket, Bucket=bucket_name)
+
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    # n.b., RGW does not send a response document for this operation,
+    # which seems consistent with
+    # https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html
+    #assert error_code == 'NoSuchKey'
+
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_bucket_head_extended():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    def add_read_stats_param(request, **kwargs):
+        request.params['read-stats'] = 'true'
+    client.meta.events.register('request-created.s3.HeadBucket', add_read_stats_param)
+
+    response = client.head_bucket(Bucket=bucket_name)
+    assert int(response['ResponseMetadata']['HTTPHeaders']['x-rgw-object-count']) == 0
+    assert int(response['ResponseMetadata']['HTTPHeaders']['x-rgw-bytes-used']) == 0
+
+    _create_objects(bucket_name=bucket_name, keys=['foo','bar','baz'])
+    response = client.head_bucket(Bucket=bucket_name)
+
+    assert int(response['ResponseMetadata']['HTTPHeaders']['x-rgw-object-count']) == 3
+    assert int(response['ResponseMetadata']['HTTPHeaders']['x-rgw-bytes-used']) == 9
+
+def test_object_raw_get_bucket_acl():
+    bucket_name = _setup_bucket_object_acl('private', 'public-read')
+
+    unauthenticated_client = get_unauthenticated_client()
+    response = unauthenticated_client.get_object(Bucket=bucket_name, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_object_raw_get_object_acl():
+    bucket_name = _setup_bucket_object_acl('public-read', 'private')
+
+    unauthenticated_client = get_unauthenticated_client()
+    e = assert_raises(ClientError, unauthenticated_client.get_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+def test_object_put_acl_mtime():
+    key = 'foo'
+    bucket_name = get_new_bucket()
+    # Enable versioning
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    client = get_client()
+
+    content = 'foooz'
+    client.put_object(Bucket=bucket_name, Key=key, Body=content)
+    
+    obj_response = client.head_object(Bucket=bucket_name, Key=key)
+    create_mtime = obj_response['LastModified']
+
+    response  = client.list_objects(Bucket=bucket_name)
+    obj_list = response['Contents'][0]
+    _compare_dates(obj_list['LastModified'],create_mtime)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    obj_list = response['Versions'][0]
+    _compare_dates(obj_list['LastModified'],create_mtime)
+
+    # set acl
+    time.sleep(2)
+    client.put_object_acl(ACL='private',Bucket=bucket_name, Key=key)
+    
+    # mtime should match with create mtime
+    obj_response = client.head_object(Bucket=bucket_name, Key=key)
+    _compare_dates(create_mtime,obj_response['LastModified'])
+
+    response  = client.list_objects(Bucket=bucket_name)
+    obj_list = response['Contents'][0]
+    _compare_dates(obj_list['LastModified'],create_mtime)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    obj_list = response['Versions'][0]
+    _compare_dates(obj_list['LastModified'],create_mtime)
+
+def test_object_raw_authenticated():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+
+    client = get_client()
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_object_raw_response_headers():
+    bucket_name = _setup_bucket_object_acl('private', 'private')
+
+    client = get_client()
+
+    response = client.get_object(Bucket=bucket_name, Key='foo', ResponseCacheControl='no-cache', ResponseContentDisposition='bla', ResponseContentEncoding='aaa', ResponseContentLanguage='esperanto', ResponseContentType='foo/bar', ResponseExpires='123')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['ResponseMetadata']['HTTPHeaders']['content-type'] == 'foo/bar'
+    assert response['ResponseMetadata']['HTTPHeaders']['content-disposition'] == 'bla'
+    assert response['ResponseMetadata']['HTTPHeaders']['content-language'] == 'esperanto'
+    assert response['ResponseMetadata']['HTTPHeaders']['content-encoding'] == 'aaa'
+    assert response['ResponseMetadata']['HTTPHeaders']['cache-control'] == 'no-cache'
+
+def test_object_raw_authenticated_bucket_acl():
+    bucket_name = _setup_bucket_object_acl('private', 'public-read')
+
+    client = get_client()
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_object_raw_authenticated_object_acl():
+    bucket_name = _setup_bucket_object_acl('public-read', 'private')
+
+    client = get_client()
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_object_raw_authenticated_bucket_gone():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+
+    client.delete_object(Bucket=bucket_name, Key='foo')
+    client.delete_bucket(Bucket=bucket_name)
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_object_raw_authenticated_object_gone():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+
+    client.delete_object(Bucket=bucket_name, Key='foo')
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+def _test_object_raw_get_x_amz_expires_not_expired(client):
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read', client=client)
+    params = {'Bucket': bucket_name, 'Key': 'foo'}
+
+    url = client.generate_presigned_url(ClientMethod='get_object', Params=params, ExpiresIn=100000, HttpMethod='GET')
+
+    res = requests.options(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 400
+
+    res = requests.get(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 200
+
+def test_object_raw_get_x_amz_expires_not_expired():
+    _test_object_raw_get_x_amz_expires_not_expired(client=get_client())
+
+def test_object_raw_get_x_amz_expires_not_expired_tenant():
+    _test_object_raw_get_x_amz_expires_not_expired(client=get_tenant_client())
+
+def test_object_raw_get_x_amz_expires_out_range_zero():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+    params = {'Bucket': bucket_name, 'Key': 'foo'}
+
+    url = client.generate_presigned_url(ClientMethod='get_object', Params=params, ExpiresIn=0, HttpMethod='GET')
+
+    res = requests.get(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 403
+
+def test_object_raw_get_x_amz_expires_out_max_range():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+    params = {'Bucket': bucket_name, 'Key': 'foo'}
+
+    url = client.generate_presigned_url(ClientMethod='get_object', Params=params, ExpiresIn=609901, HttpMethod='GET')
+
+    res = requests.get(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 403
+
+def test_object_raw_get_x_amz_expires_out_positive_range():
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read')
+    client = get_client()
+    params = {'Bucket': bucket_name, 'Key': 'foo'}
+
+    url = client.generate_presigned_url(ClientMethod='get_object', Params=params, ExpiresIn=-7, HttpMethod='GET')
+
+    res = requests.get(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 403
+
+def test_object_content_encoding_aws_chunked():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'encoding'
+
+    client.put_object(Bucket=bucket, Key=key, ContentEncoding='gzip')
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentEncoding'] == 'gzip'
+
+    client.put_object(Bucket=bucket, Key=key, ContentEncoding='deflate, gzip')
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentEncoding'] == 'deflate, gzip'
+
+    client.put_object(Bucket=bucket, Key=key, ContentEncoding='gzip, aws-chunked')
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentEncoding'] == 'gzip'
+
+    client.put_object(Bucket=bucket, Key=key, ContentEncoding='aws-chunked, gzip')
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentEncoding'] == 'gzip'
+
+    client.put_object(Bucket=bucket, Key=key, ContentEncoding='aws-chunked')
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert 'ContentEncoding' not in response
+
+    client.put_object(Bucket=bucket, Key=key, ContentEncoding='aws-chunked, aws-chunked')
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert 'ContentEncoding' not in response
+
+def test_object_anon_put():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='foo')
+
+    unauthenticated_client = get_unauthenticated_client()
+
+    e = assert_raises(ClientError, unauthenticated_client.put_object, Bucket=bucket_name, Key='foo', Body='foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+def test_object_anon_put_write_access():
+    bucket_name = _setup_bucket_acl('public-read-write')
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo')
+
+    unauthenticated_client = get_unauthenticated_client()
+
+    response = unauthenticated_client.put_object(Bucket=bucket_name, Key='foo', Body='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def test_object_put_authenticated():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = client.put_object(Bucket=bucket_name, Key='foo', Body='foo')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def _test_object_presigned_put_object_with_acl(client=None):
+    if client is None:
+        client = get_client()
+
+    bucket_name = get_new_bucket(client)
+    key = 'foo'
+
+    params = {'Bucket': bucket_name, 'Key': key, 'ACL': 'private'}
+    url = client.generate_presigned_url(ClientMethod='put_object', Params=params, HttpMethod='PUT')
+
+    data = b'hello world'
+    headers = {'x-amz-acl': 'private'}
+    res = requests.put(url, data=data, headers=headers, verify=get_config_ssl_verify())
+    assert res.status_code == 200
+
+    params = {'Bucket': bucket_name, 'Key': key}
+    url = client.generate_presigned_url(ClientMethod='get_object', Params=params, HttpMethod='GET')
+
+    res = requests.get(url, verify=get_config_ssl_verify())
+    assert res.status_code == 200
+    assert res.text == 'hello world'
+
+def test_object_presigned_put_object_with_acl():
+    _test_object_presigned_put_object_with_acl(
+        client=get_client())
+
+def test_object_presigned_put_object_with_acl_tenant():
+    _test_object_presigned_put_object_with_acl(
+        client=get_tenant_client())
+
+def test_object_raw_put_authenticated_expired():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo')
+
+    params = {'Bucket': bucket_name, 'Key': 'foo'}
+    url = client.generate_presigned_url(ClientMethod='put_object', Params=params, ExpiresIn=-1000, HttpMethod='PUT')
+
+    # params wouldn't take a 'Body' parameter so we're passing it in here
+    res = requests.put(url, data="foo", verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 403
+
+def check_bad_bucket_name(bucket_name):
+    """
+    Attempt to create a bucket with a specified name, and confirm
+    that the request fails because of an invalid bucket name.
+    """
+    client = get_client()
+    e = assert_raises(ClientError, client.create_bucket, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidBucketName'
+
+
+# AWS does not enforce all documented bucket restrictions.
+# http://docs.amazonwebservices.com/AmazonS3/2006-03-01/dev/index.html?BucketRestrictions.html
+@pytest.mark.fails_on_aws
+# Breaks DNS with SubdomainCallingFormat
+def test_bucket_create_naming_bad_starts_nonalpha():
+    bucket_name = get_new_bucket_name()
+    check_bad_bucket_name('_' + bucket_name)
+
+def check_invalid_bucketname(invalid_name):
+    """
+    Send a create bucket_request with an invalid bucket name
+    that will bypass the ParamValidationError that would be raised
+    if the invalid bucket name that was passed in normally.
+    This function returns the status and error code from the failure
+    """
+    client = get_client()
+    valid_bucket_name = get_new_bucket_name()
+    def replace_bucketname_from_url(**kwargs):
+        url = kwargs['params']['url']
+        new_url = url.replace(valid_bucket_name, invalid_name)
+        kwargs['params']['url'] = new_url
+    client.meta.events.register('before-call.s3.CreateBucket', replace_bucketname_from_url)
+    e = assert_raises(ClientError, client.create_bucket, Bucket=invalid_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    return (status, error_code)
+
+def test_bucket_create_naming_bad_short_one():
+    check_bad_bucket_name('a')
+
+def test_bucket_create_naming_bad_short_two():
+    check_bad_bucket_name('aa')
+
+def check_good_bucket_name(name, _prefix=None):
+    """
+    Attempt to create a bucket with a specified name
+    and (specified or default) prefix, returning the
+    results of that effort.
+    """
+    # tests using this with the default prefix must *not* rely on
+    # being able to set the initial character, or exceed the max len
+
+    # tests using this with a custom prefix are responsible for doing
+    # their own setup/teardown nukes, with their custom prefix; this
+    # should be very rare
+    if _prefix is None:
+        _prefix = get_prefix()
+    bucket_name = '{prefix}{name}'.format(
+            prefix=_prefix,
+            name=name,
+            )
+    client = get_client()
+    response = client.create_bucket(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def _test_bucket_create_naming_good_long(length):
+    """
+    Attempt to create a bucket whose name (including the
+    prefix) is of a specified length.
+    """
+    # tests using this with the default prefix must *not* rely on
+    # being able to set the initial character, or exceed the max len
+
+    # tests using this with a custom prefix are responsible for doing
+    # their own setup/teardown nukes, with their custom prefix; this
+    # should be very rare
+    prefix = get_new_bucket_name()
+    assert len(prefix) < 63
+    num = length - len(prefix)
+    name=num*'a'
+
+    bucket_name = '{prefix}{name}'.format(
+            prefix=prefix,
+            name=name,
+            )
+    client = get_client()
+    response = client.create_bucket(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_good_long_60():
+    _test_bucket_create_naming_good_long(60)
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_good_long_61():
+    _test_bucket_create_naming_good_long(61)
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_good_long_62():
+    _test_bucket_create_naming_good_long(62)
+
+
+# Breaks DNS with SubdomainCallingFormat
+def test_bucket_create_naming_good_long_63():
+    _test_bucket_create_naming_good_long(63)
+
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_list_long_name():
+    prefix = get_new_bucket_name()
+    length = 61
+    num = length - len(prefix)
+    name=num*'a'
+
+    bucket_name = '{prefix}{name}'.format(
+            prefix=prefix,
+            name=name,
+            )
+    bucket = get_new_bucket_resource(name=bucket_name)
+    is_empty = _bucket_is_empty(bucket)
+    assert is_empty == True
+
+# AWS does not enforce all documented bucket restrictions.
+# http://docs.amazonwebservices.com/AmazonS3/2006-03-01/dev/index.html?BucketRestrictions.html
+@pytest.mark.fails_on_aws
+def test_bucket_create_naming_bad_ip():
+    check_bad_bucket_name('192.168.5.123')
+
+# test_bucket_create_naming_dns_* are valid but not recommended
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_dns_underscore():
+    invalid_bucketname = 'foo_bar'
+    status, error_code = check_invalid_bucketname(invalid_bucketname)
+    assert status == 400
+    assert error_code == 'InvalidBucketName'
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+def test_bucket_create_naming_dns_long():
+    prefix = get_prefix()
+    assert len(prefix) < 50
+    num = 63 - len(prefix)
+    check_good_bucket_name(num * 'a')
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_dns_dash_at_end():
+    invalid_bucketname = 'foo-'
+    status, error_code = check_invalid_bucketname(invalid_bucketname)
+    assert status == 400
+    assert error_code == 'InvalidBucketName'
+
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_dns_dot_dot():
+    invalid_bucketname = 'foo..bar'
+    status, error_code = check_invalid_bucketname(invalid_bucketname)
+    assert status == 400
+    assert error_code == 'InvalidBucketName'
+
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_dns_dot_dash():
+    invalid_bucketname = 'foo.-bar'
+    status, error_code = check_invalid_bucketname(invalid_bucketname)
+    assert status == 400
+    assert error_code == 'InvalidBucketName'
+
+
+# Breaks DNS with SubdomainCallingFormat
+@pytest.mark.fails_on_aws
+# Should now pass on AWS even though it has 'fails_on_aws' attr.
+def test_bucket_create_naming_dns_dash_dot():
+    invalid_bucketname = 'foo-.bar'
+    status, error_code = check_invalid_bucketname(invalid_bucketname)
+    assert status == 400
+    assert error_code == 'InvalidBucketName'
+
+def test_bucket_create_exists():
+    # aws-s3 default region allows recreation of buckets
+    # but all other regions fail with BucketAlreadyOwnedByYou.
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    client.create_bucket(Bucket=bucket_name)
+    try:
+        response = client.create_bucket(Bucket=bucket_name)
+    except ClientError as e:
+        status, error_code = _get_status_and_error_code(e.response)
+        assert e.status == 409
+        assert e.error_code == 'BucketAlreadyOwnedByYou'
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_get_location():
+    location_constraint = get_main_api_name()
+    if not location_constraint:
+        pytest.skip('no api_name configured')
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    client.create_bucket(Bucket=bucket_name, CreateBucketConfiguration={'LocationConstraint': location_constraint})
+
+    response = client.get_bucket_location(Bucket=bucket_name)
+    if location_constraint == "":
+        location_constraint = None
+    assert response['LocationConstraint'] == location_constraint
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_create_exists_nonowner():
+    # Names are shared across a global namespace. As such, no two
+    # users can create a bucket with that same name.
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    alt_client = get_alt_client()
+
+    client.create_bucket(Bucket=bucket_name)
+    e = assert_raises(ClientError, alt_client.create_bucket, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'BucketAlreadyExists'
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_recreate_overwrite_acl():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    client.create_bucket(Bucket=bucket_name, ACL='public-read')
+    e = assert_raises(ClientError, client.create_bucket, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'BucketAlreadyExists'
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_recreate_new_acl():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    client.create_bucket(Bucket=bucket_name)
+    e = assert_raises(ClientError, client.create_bucket, Bucket=bucket_name, ACL='public-read')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'BucketAlreadyExists'
+
+def check_access_denied(fn, *args, **kwargs):
+    e = assert_raises(ClientError, fn, *args, **kwargs)
+    status = _get_status(e.response)
+    assert status == 403
+
+def check_request_timeout(fn, *args, **kwargs):
+    e = assert_raises(ClientError, fn, *args, **kwargs)
+    status = _get_status(e.response)
+    assert status == 400
+
+def check_grants(got, want):
+    """
+    Check that grants list in got matches the dictionaries in want,
+    in any order.
+    """
+    assert len(got) == len(want)
+
+    # There are instances when got does not match due the order of item.
+    if got[0]["Grantee"].get("DisplayName"):
+        got.sort(key=lambda x: x["Grantee"].get("DisplayName"))
+        want.sort(key=lambda x: x["DisplayName"])
+
+    for g, w in zip(got, want):
+        w = dict(w)
+        g = dict(g)
+        assert g.pop('Permission', None) == w['Permission']
+        assert g['Grantee'].pop('DisplayName', None) == w['DisplayName']
+        assert g['Grantee'].pop('ID', None) == w['ID']
+        assert g['Grantee'].pop('Type', None) == w['Type']
+        assert g['Grantee'].pop('URI', None) == w['URI']
+        assert g['Grantee'].pop('EmailAddress', None) == w['EmailAddress']
+        assert g == {'Grantee': {}}
+
+
+def test_bucket_acl_default():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    assert response['Owner']['DisplayName'] == display_name
+    assert response['Owner']['ID'] == user_id
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+@pytest.mark.fails_on_aws
+def test_bucket_acl_canned_during_create():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read', Bucket=bucket_name)
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_bucket_acl_canned():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read', Bucket=bucket_name)
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+    client.put_bucket_acl(ACL='private', Bucket=bucket_name)
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_bucket_acl_canned_publicreadwrite():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='WRITE',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_bucket_acl_canned_authenticatedread():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(ACL='authenticated-read', Bucket=bucket_name)
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AuthenticatedUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_put_bucket_acl_grant_group_read():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grant = {'Grantee': {'Type': 'Group', 'URI': 'http://acs.amazonaws.com/groups/global/AllUsers'}, 'Permission': 'READ'}
+    policy = add_bucket_user_grant(bucket_name, grant)
+
+    client.put_bucket_acl(Bucket=bucket_name, AccessControlPolicy=policy)
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    check_grants(
+        response['Grants'],
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_default():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_canned_during_create():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(ACL='public-read', Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_canned():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # Since it defaults to private, set it public-read first
+    client.put_object(ACL='public-read', Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+    # Then back to private.
+    client.put_object_acl(ACL='private',Bucket=bucket_name, Key='foo')
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+    grants = response['Grants']
+
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_canned_publicreadwrite():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(ACL='public-read-write', Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='WRITE',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_canned_authenticatedread():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(ACL='authenticated-read', Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AuthenticatedUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_canned_bucketownerread():
+    bucket_name = get_new_bucket_name()
+    main_client = get_client()
+    alt_client = get_alt_client()
+
+    main_client.create_bucket(Bucket=bucket_name, ACL='public-read-write')
+
+    alt_client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    bucket_acl_response = main_client.get_bucket_acl(Bucket=bucket_name)
+    bucket_owner_id = bucket_acl_response['Grants'][2]['Grantee']['ID']
+    bucket_owner_display_name = bucket_acl_response['Grants'][2]['Grantee']['DisplayName']
+
+    alt_client.put_object(ACL='bucket-owner-read', Bucket=bucket_name, Key='foo')
+    response = alt_client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    alt_display_name = get_alt_display_name()
+    alt_user_id = get_alt_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='READ',
+                ID=bucket_owner_id,
+                DisplayName=bucket_owner_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def test_object_acl_canned_bucketownerfullcontrol():
+    bucket_name = get_new_bucket_name()
+    main_client = get_client()
+    alt_client = get_alt_client()
+
+    main_client.create_bucket(Bucket=bucket_name, ACL='public-read-write')
+
+    alt_client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    bucket_acl_response = main_client.get_bucket_acl(Bucket=bucket_name)
+    bucket_owner_id = bucket_acl_response['Grants'][2]['Grantee']['ID']
+    bucket_owner_display_name = bucket_acl_response['Grants'][2]['Grantee']['DisplayName']
+
+    alt_client.put_object(ACL='bucket-owner-full-control', Bucket=bucket_name, Key='foo')
+    response = alt_client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    alt_display_name = get_alt_display_name()
+    alt_user_id = get_alt_user_id()
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=bucket_owner_id,
+                DisplayName=bucket_owner_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+@pytest.mark.fails_on_aws
+def test_object_acl_full_control_verify_owner():
+    bucket_name = get_new_bucket_name()
+    main_client = get_client()
+    alt_client = get_alt_client()
+
+    main_client.create_bucket(Bucket=bucket_name, ACL='public-read-write')
+
+    main_client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    alt_user_id = get_alt_user_id()
+    alt_display_name = get_alt_display_name()
+
+    main_user_id = get_main_user_id()
+    main_display_name = get_main_display_name()
+
+    grant = { 'Grants': [{'Grantee': {'ID': alt_user_id, 'Type': 'CanonicalUser' }, 'Permission': 'FULL_CONTROL'}], 'Owner': {'DisplayName': main_display_name, 'ID': main_user_id}}
+
+    main_client.put_object_acl(Bucket=bucket_name, Key='foo', AccessControlPolicy=grant)
+
+    grant = { 'Grants': [{'Grantee': {'ID': alt_user_id, 'Type': 'CanonicalUser' }, 'Permission': 'READ_ACP'}], 'Owner': {'DisplayName': main_display_name, 'ID': main_user_id}}
+
+    alt_client.put_object_acl(Bucket=bucket_name, Key='foo', AccessControlPolicy=grant)
+
+    response = alt_client.get_object_acl(Bucket=bucket_name, Key='foo')
+    assert response['Owner']['ID'] == main_user_id
+
+def add_obj_user_grant(bucket_name, key, grant):
+    """
+    Adds a grant to the existing grants meant to be passed into
+    the AccessControlPolicy argument of put_object_acls for an object
+    owned by the main user, not the alt user
+    A grant is a dictionary in the form of:
+    {u'Grantee': {u'Type': 'type', u'DisplayName': 'name', u'ID': 'id'}, u'Permission': 'PERM'}
+
+    """
+    client = get_client()
+    main_user_id = get_main_user_id()
+    main_display_name = get_main_display_name()
+
+    response = client.get_object_acl(Bucket=bucket_name, Key=key)
+
+    grants = response['Grants']
+    grants.append(grant)
+
+    grant = {'Grants': grants, 'Owner': {'DisplayName': main_display_name, 'ID': main_user_id}}
+
+    return grant
+
+def test_object_acl_full_control_verify_attributes():
+    bucket_name = get_new_bucket_name()
+    main_client = get_client()
+    alt_client = get_alt_client()
+
+    main_client.create_bucket(Bucket=bucket_name, ACL='public-read-write')
+
+    header = {'x-amz-foo': 'bar'}
+    # lambda to add any header
+    add_header = (lambda **kwargs: kwargs['params']['headers'].update(header))
+
+    main_client.meta.events.register('before-call.s3.PutObject', add_header)
+    main_client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = main_client.get_object(Bucket=bucket_name, Key='foo')
+    content_type = response['ContentType']
+    etag = response['ETag']
+
+    alt_user_id = get_alt_user_id()
+
+    grant = {'Grantee': {'ID': alt_user_id, 'Type': 'CanonicalUser' }, 'Permission': 'FULL_CONTROL'}
+
+    grants = add_obj_user_grant(bucket_name, 'foo', grant)
+
+    main_client.put_object_acl(Bucket=bucket_name, Key='foo', AccessControlPolicy=grants)
+
+    response = main_client.get_object(Bucket=bucket_name, Key='foo')
+    assert content_type == response['ContentType']
+    assert etag == response['ETag']
+
+def test_bucket_acl_canned_private_to_private():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = client.put_bucket_acl(Bucket=bucket_name, ACL='private')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def add_bucket_user_grant(bucket_name, grant):
+    """
+    Adds a grant to the existing grants meant to be passed into
+    the AccessControlPolicy argument of put_object_acls for an object
+    owned by the main user, not the alt user
+    A grant is a dictionary in the form of:
+    {u'Grantee': {u'Type': 'type', u'DisplayName': 'name', u'ID': 'id'}, u'Permission': 'PERM'}
+    """
+    client = get_client()
+    main_user_id = get_main_user_id()
+    main_display_name = get_main_display_name()
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    grants = response['Grants']
+    grants.append(grant)
+
+    grant = {'Grants': grants, 'Owner': {'DisplayName': main_display_name, 'ID': main_user_id}}
+
+    return grant
+
+def _check_object_acl(permission):
+    """
+    Sets the permission on an object then checks to see
+    if it was set
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+
+    policy = {}
+    policy['Owner'] = response['Owner']
+    policy['Grants'] = response['Grants']
+    policy['Grants'][0]['Permission'] = permission
+
+    client.put_object_acl(Bucket=bucket_name, Key='foo', AccessControlPolicy=policy)
+
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo')
+    grants = response['Grants']
+
+    main_user_id = get_main_user_id()
+    main_display_name = get_main_display_name()
+
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission=permission,
+                ID=main_user_id,
+                DisplayName=main_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+
+@pytest.mark.fails_on_aws
+def test_object_acl():
+    _check_object_acl('FULL_CONTROL')
+
+@pytest.mark.fails_on_aws
+def test_object_acl_write():
+    _check_object_acl('WRITE')
+
+@pytest.mark.fails_on_aws
+def test_object_acl_writeacp():
+    _check_object_acl('WRITE_ACP')
+
+
+@pytest.mark.fails_on_aws
+def test_object_acl_read():
+    _check_object_acl('READ')
+
+
+@pytest.mark.fails_on_aws
+def test_object_acl_readacp():
+    _check_object_acl('READ_ACP')
+
+
+def _bucket_acl_grant_userid(permission):
+    """
+    create a new bucket, grant a specific user the specified
+    permission, read back the acl and verify correct setting
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    main_user_id = get_main_user_id()
+    main_display_name = get_main_display_name()
+
+    alt_user_id = get_alt_user_id()
+    alt_display_name = get_alt_display_name()
+
+    grant = {'Grantee': {'ID': alt_user_id, 'Type': 'CanonicalUser' }, 'Permission': permission}
+
+    grant = add_bucket_user_grant(bucket_name, grant)
+
+    client.put_bucket_acl(Bucket=bucket_name, AccessControlPolicy=grant)
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission=permission,
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=main_user_id,
+                DisplayName=main_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+    return bucket_name
+
+def _check_bucket_acl_grant_can_read(bucket_name):
+    """
+    verify ability to read the specified bucket
+    """
+    alt_client = get_alt_client()
+    response = alt_client.head_bucket(Bucket=bucket_name)
+
+def _check_bucket_acl_grant_cant_read(bucket_name):
+    """
+    verify inability to read the specified bucket
+    """
+    alt_client = get_alt_client()
+    check_access_denied(alt_client.head_bucket, Bucket=bucket_name)
+
+def _check_bucket_acl_grant_can_readacp(bucket_name):
+    """
+    verify ability to read acls on specified bucket
+    """
+    alt_client = get_alt_client()
+    alt_client.get_bucket_acl(Bucket=bucket_name)
+
+def _check_bucket_acl_grant_cant_readacp(bucket_name):
+    """
+    verify inability to read acls on specified bucket
+    """
+    alt_client = get_alt_client()
+    check_access_denied(alt_client.get_bucket_acl, Bucket=bucket_name)
+
+def _check_bucket_acl_grant_can_write(bucket_name):
+    """
+    verify ability to write the specified bucket
+    """
+    alt_client = get_alt_client()
+    alt_client.put_object(Bucket=bucket_name, Key='foo-write', Body='bar')
+
+def _check_bucket_acl_grant_cant_write(bucket_name):
+
+    """
+    verify inability to write the specified bucket
+    """
+    alt_client = get_alt_client()
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key='foo-write', Body='bar')
+
+def _check_bucket_acl_grant_can_writeacp(bucket_name):
+    """
+    verify ability to set acls on the specified bucket
+    """
+    alt_client = get_alt_client()
+    alt_client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+
+def _check_bucket_acl_grant_cant_writeacp(bucket_name):
+    """
+    verify inability to set acls on the specified bucket
+    """
+    alt_client = get_alt_client()
+    check_access_denied(alt_client.put_bucket_acl,Bucket=bucket_name, ACL='public-read')
+
+@pytest.mark.fails_on_aws
+def test_bucket_acl_grant_userid_fullcontrol():
+    bucket_name = _bucket_acl_grant_userid('FULL_CONTROL')
+
+    # alt user can read
+    _check_bucket_acl_grant_can_read(bucket_name)
+    # can read acl
+    _check_bucket_acl_grant_can_readacp(bucket_name)
+    # can write
+    _check_bucket_acl_grant_can_write(bucket_name)
+    # can write acl
+    _check_bucket_acl_grant_can_writeacp(bucket_name)
+
+    client = get_client()
+
+    bucket_acl_response = client.get_bucket_acl(Bucket=bucket_name)
+    owner_id = bucket_acl_response['Owner']['ID']
+    owner_display_name = bucket_acl_response['Owner']['DisplayName']
+
+    main_display_name = get_main_display_name()
+    main_user_id = get_main_user_id()
+
+    assert owner_id == main_user_id
+    assert owner_display_name == main_display_name
+
+@pytest.mark.fails_on_aws
+def test_bucket_acl_grant_userid_read():
+    bucket_name = _bucket_acl_grant_userid('READ')
+
+    # alt user can read
+    _check_bucket_acl_grant_can_read(bucket_name)
+    # can't read acl
+    _check_bucket_acl_grant_cant_readacp(bucket_name)
+    # can't write
+    _check_bucket_acl_grant_cant_write(bucket_name)
+    # can't write acl
+    _check_bucket_acl_grant_cant_writeacp(bucket_name)
+
+@pytest.mark.fails_on_aws
+def test_bucket_acl_grant_userid_readacp():
+    bucket_name = _bucket_acl_grant_userid('READ_ACP')
+
+    # alt user can't read
+    _check_bucket_acl_grant_cant_read(bucket_name)
+    # can read acl
+    _check_bucket_acl_grant_can_readacp(bucket_name)
+    # can't write
+    _check_bucket_acl_grant_cant_write(bucket_name)
+    # can't write acp
+    #_check_bucket_acl_grant_cant_writeacp_can_readacp(bucket)
+    _check_bucket_acl_grant_cant_writeacp(bucket_name)
+
+@pytest.mark.fails_on_aws
+def test_bucket_acl_grant_userid_write():
+    bucket_name = _bucket_acl_grant_userid('WRITE')
+
+    # alt user can't read
+    _check_bucket_acl_grant_cant_read(bucket_name)
+    # can't read acl
+    _check_bucket_acl_grant_cant_readacp(bucket_name)
+    # can write
+    _check_bucket_acl_grant_can_write(bucket_name)
+    # can't write acl
+    _check_bucket_acl_grant_cant_writeacp(bucket_name)
+
+@pytest.mark.fails_on_aws
+def test_bucket_acl_grant_userid_writeacp():
+    bucket_name = _bucket_acl_grant_userid('WRITE_ACP')
+
+    # alt user can't read
+    _check_bucket_acl_grant_cant_read(bucket_name)
+    # can't read acl
+    _check_bucket_acl_grant_cant_readacp(bucket_name)
+    # can't write
+    _check_bucket_acl_grant_cant_write(bucket_name)
+    # can write acl
+    _check_bucket_acl_grant_can_writeacp(bucket_name)
+
+def test_bucket_acl_grant_nonexist_user():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    bad_user_id = '_foo'
+
+    #response = client.get_bucket_acl(Bucket=bucket_name)
+    grant = {'Grantee': {'ID': bad_user_id, 'Type': 'CanonicalUser' }, 'Permission': 'FULL_CONTROL'}
+
+    grant = add_bucket_user_grant(bucket_name, grant)
+
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket_name, AccessControlPolicy=grant)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+def _get_acl_header(user_id=None, perms=None):
+    all_headers = ["read", "write", "read-acp", "write-acp", "full-control"]
+    headers = []
+
+    if user_id == None:
+        user_id = get_alt_user_id()
+
+    if perms != None:
+        for perm in perms:
+            header = ("x-amz-grant-{perm}".format(perm=perm), "id={uid}".format(uid=user_id))
+            headers.append(header)
+
+    else:
+        for perm in all_headers:
+            header = ("x-amz-grant-{perm}".format(perm=perm), "id={uid}".format(uid=user_id))
+            headers.append(header)
+
+    return headers
+
+@pytest.mark.fails_on_dho
+@pytest.mark.fails_on_aws
+def test_object_header_acl_grants():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    alt_user_id = get_alt_user_id()
+    alt_display_name = get_alt_display_name()
+
+    headers = _get_acl_header()
+
+    def add_headers_before_sign(**kwargs):
+        updated_headers = (kwargs['request'].__dict__['headers'].__dict__['_headers'] + headers)
+        kwargs['request'].__dict__['headers'].__dict__['_headers'] = updated_headers
+
+    client.meta.events.register('before-sign.s3.PutObject', add_headers_before_sign)
+
+    client.put_object(Bucket=bucket_name, Key='foo_key', Body='bar')
+
+    response = client.get_object_acl(Bucket=bucket_name, Key='foo_key')
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='WRITE',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='READ_ACP',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='WRITE_ACP',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+@pytest.mark.fails_on_dho
+@pytest.mark.fails_on_aws
+def test_bucket_header_acl_grants():
+    headers = _get_acl_header()
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+
+    headers = _get_acl_header()
+
+    def add_headers_before_sign(**kwargs):
+        updated_headers = (kwargs['request'].__dict__['headers'].__dict__['_headers'] + headers)
+        kwargs['request'].__dict__['headers'].__dict__['_headers'] = updated_headers
+
+    client.meta.events.register('before-sign.s3.CreateBucket', add_headers_before_sign)
+
+    client.create_bucket(Bucket=bucket_name)
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    grants = response['Grants']
+    alt_user_id = get_alt_user_id()
+    alt_display_name = get_alt_display_name()
+
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='WRITE',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='READ_ACP',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='WRITE_ACP',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+    alt_client = get_alt_client()
+
+    alt_client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    # set bucket acl to public-read-write so that teardown can work
+    alt_client.put_bucket_acl(Bucket=bucket_name, ACL='public-read-write')
+
+
+# This test will fail on DH Objects. DHO allows multiple users with one account, which
+# would violate the uniqueness requirement of a user's email. As such, DHO users are
+# created without an email.
+@pytest.mark.fails_on_aws
+def test_bucket_acl_grant_email():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    alt_user_id = get_alt_user_id()
+    alt_display_name = get_alt_display_name()
+    alt_email_address = get_alt_email()
+
+    main_user_id = get_main_user_id()
+    main_display_name = get_main_display_name()
+
+    grant = {'Grantee': {'EmailAddress': alt_email_address, 'Type': 'AmazonCustomerByEmail' }, 'Permission': 'FULL_CONTROL'}
+
+    grant = add_bucket_user_grant(bucket_name, grant)
+
+    client.put_bucket_acl(Bucket=bucket_name, AccessControlPolicy = grant)
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=alt_user_id,
+                DisplayName=alt_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=main_user_id,
+                DisplayName=main_display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+        ]
+    )
+
+def test_bucket_acl_grant_email_not_exist():
+    # behavior not documented by amazon
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    alt_user_id = get_alt_user_id()
+    alt_display_name = get_alt_display_name()
+    alt_email_address = get_alt_email()
+
+    NONEXISTENT_EMAIL = 'doesnotexist@dreamhost.com.invalid'
+    grant = {'Grantee': {'EmailAddress': NONEXISTENT_EMAIL, 'Type': 'AmazonCustomerByEmail'}, 'Permission': 'FULL_CONTROL'}
+
+    grant = add_bucket_user_grant(bucket_name, grant)
+
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket_name, AccessControlPolicy = grant)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'UnresolvableGrantByEmailAddress'
+
+def test_bucket_acl_revoke_all():
+    # revoke all access, including the owner's access
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    response = client.get_bucket_acl(Bucket=bucket_name)
+    old_grants = response['Grants']
+    policy = {}
+    policy['Owner'] = response['Owner']
+    # clear grants
+    policy['Grants'] = []
+
+    # remove read/write permission for everyone
+    client.put_bucket_acl(Bucket=bucket_name, AccessControlPolicy=policy)
+
+    response = client.get_bucket_acl(Bucket=bucket_name)
+
+    assert len(response['Grants']) == 0
+
+    # set policy back to original so that bucket can be cleaned up
+    policy['Grants'] = old_grants
+    client.put_bucket_acl(Bucket=bucket_name, AccessControlPolicy=policy)
+
+def _setup_access(bucket_acl, object_acl):
+    """
+    Simple test fixture: create a bucket with given ACL, with objects:
+    - a: owning user, given ACL
+    - a2: same object accessed by some other user
+    - b: owning user, default ACL in bucket w/given ACL
+    - b2: same object accessed by a some other user
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key1 = 'foo'
+    key2 = 'bar'
+    newkey = 'new'
+
+    client.put_bucket_acl(Bucket=bucket_name, ACL=bucket_acl)
+    client.put_object(Bucket=bucket_name, Key=key1, Body='foocontent')
+    client.put_object_acl(Bucket=bucket_name, Key=key1, ACL=object_acl)
+    client.put_object(Bucket=bucket_name, Key=key2, Body='barcontent')
+
+    return bucket_name, key1, key2, newkey
+
+def get_bucket_key_names(bucket_name):
+    objs_list = get_objects_list(bucket_name)
+    return frozenset(obj for obj in objs_list)
+
+def list_bucket_storage_class(client, bucket_name):
+    result = defaultdict(list)
+    response  = client.list_object_versions(Bucket=bucket_name)
+    for k in response['Versions']:
+        result[k['StorageClass']].append(k)
+
+    return result
+
+def list_bucket_versions(client, bucket_name):
+    result = defaultdict(list)
+    response  = client.list_object_versions(Bucket=bucket_name)
+    for k in response['Versions']:
+        result[response['Name']].append(k)
+
+    return result
+
+def test_access_bucket_private_object_private():
+    # all the test_access_* tests follow this template
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='private', object_acl='private')
+
+    alt_client = get_alt_client()
+    # acled object read fail
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key1)
+    # default object read fail
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key2)
+    # bucket read fail
+    check_access_denied(alt_client.list_objects, Bucket=bucket_name)
+
+    # acled object write fail
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='barcontent')
+    # NOTE: The above put's causes the connection to go bad, therefore the client can't be used
+    # anymore. This can be solved either by:
+    # 1) putting an empty string ('') in the 'Body' field of those put_object calls
+    # 2) getting a new client hence the creation of alt_client{2,3} for the tests below
+    # TODO: Test it from another host and on AWS, Report this to Amazon, if findings are identical
+
+    alt_client2 = get_alt_client()
+    # default object write fail
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+    # bucket write fail
+    alt_client3 = get_alt_client()
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+@pytest.mark.list_objects_v2
+def test_access_bucket_private_objectv2_private():
+    # all the test_access_* tests follow this template
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='private', object_acl='private')
+
+    alt_client = get_alt_client()
+    # acled object read fail
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key1)
+    # default object read fail
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key2)
+    # bucket read fail
+    check_access_denied(alt_client.list_objects_v2, Bucket=bucket_name)
+
+    # acled object write fail
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='barcontent')
+    # NOTE: The above put's causes the connection to go bad, therefore the client can't be used
+    # anymore. This can be solved either by:
+    # 1) putting an empty string ('') in the 'Body' field of those put_object calls
+    # 2) getting a new client hence the creation of alt_client{2,3} for the tests below
+    # TODO: Test it from another host and on AWS, Report this to Amazon, if findings are identical
+
+    alt_client2 = get_alt_client()
+    # default object write fail
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+    # bucket write fail
+    alt_client3 = get_alt_client()
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_access_bucket_private_object_publicread():
+
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='private', object_acl='public-read')
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    body = _get_body(response)
+
+    # a should be public-read, b gets default (private)
+    assert body == 'foocontent'
+
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='foooverwrite')
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+    check_access_denied(alt_client3.list_objects, Bucket=bucket_name)
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+@pytest.mark.list_objects_v2
+def test_access_bucket_private_objectv2_publicread():
+
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='private', object_acl='public-read')
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    body = _get_body(response)
+
+    # a should be public-read, b gets default (private)
+    assert body == 'foocontent'
+
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='foooverwrite')
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+    check_access_denied(alt_client3.list_objects_v2, Bucket=bucket_name)
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_access_bucket_private_object_publicreadwrite():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='private', object_acl='public-read-write')
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    body = _get_body(response)
+
+    # a should be public-read-only ... because it is in a private bucket
+    # b gets default (private)
+    assert body == 'foocontent'
+
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='foooverwrite')
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+    check_access_denied(alt_client3.list_objects, Bucket=bucket_name)
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+@pytest.mark.list_objects_v2
+def test_access_bucket_private_objectv2_publicreadwrite():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='private', object_acl='public-read-write')
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    body = _get_body(response)
+
+    # a should be public-read-only ... because it is in a private bucket
+    # b gets default (private)
+    assert body == 'foocontent'
+
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='foooverwrite')
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+    check_access_denied(alt_client3.list_objects_v2, Bucket=bucket_name)
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_access_bucket_publicread_object_private():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='public-read', object_acl='private')
+    alt_client = get_alt_client()
+
+    # a should be private, b gets default (private)
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key1)
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='barcontent')
+
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+
+    objs = get_objects_list(bucket=bucket_name, client=alt_client3)
+
+    assert objs == ['bar', 'foo']
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_access_bucket_publicread_object_publicread():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='public-read', object_acl='public-read')
+    alt_client = get_alt_client()
+
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    # a should be public-read, b gets default (private)
+    body = _get_body(response)
+    assert body == 'foocontent'
+
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='foooverwrite')
+
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+
+    objs = get_objects_list(bucket=bucket_name, client=alt_client3)
+
+    assert objs == ['bar', 'foo']
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+
+def test_access_bucket_publicread_object_publicreadwrite():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='public-read', object_acl='public-read-write')
+    alt_client = get_alt_client()
+
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    body = _get_body(response)
+
+    # a should be public-read-only ... because it is in a r/o bucket
+    # b gets default (private)
+    assert body == 'foocontent'
+
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1, Body='foooverwrite')
+
+    alt_client2 = get_alt_client()
+    check_access_denied(alt_client2.get_object, Bucket=bucket_name, Key=key2)
+    check_access_denied(alt_client2.put_object, Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    alt_client3 = get_alt_client()
+
+    objs = get_objects_list(bucket=bucket_name, client=alt_client3)
+
+    assert objs == ['bar', 'foo']
+    check_access_denied(alt_client3.put_object, Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+
+def test_access_bucket_publicreadwrite_object_private():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='public-read-write', object_acl='private')
+    alt_client = get_alt_client()
+
+    # a should be private, b gets default (private)
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key1)
+    alt_client.put_object(Bucket=bucket_name, Key=key1, Body='barcontent')
+
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key2)
+    alt_client.put_object(Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    objs = get_objects_list(bucket=bucket_name, client=alt_client)
+    assert objs == ['bar', 'foo']
+    alt_client.put_object(Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_access_bucket_publicreadwrite_object_publicread():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='public-read-write', object_acl='public-read')
+    alt_client = get_alt_client()
+
+    # a should be public-read, b gets default (private)
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+
+    body = _get_body(response)
+    assert body == 'foocontent'
+    alt_client.put_object(Bucket=bucket_name, Key=key1, Body='barcontent')
+
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key2)
+    alt_client.put_object(Bucket=bucket_name, Key=key2, Body='baroverwrite')
+
+    objs = get_objects_list(bucket=bucket_name, client=alt_client)
+    assert objs == ['bar', 'foo']
+    alt_client.put_object(Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_access_bucket_publicreadwrite_object_publicreadwrite():
+    bucket_name, key1, key2, newkey = _setup_access(bucket_acl='public-read-write', object_acl='public-read-write')
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=bucket_name, Key=key1)
+    body = _get_body(response)
+
+    # a should be public-read-write, b gets default (private)
+    assert body == 'foocontent'
+    alt_client.put_object(Bucket=bucket_name, Key=key1, Body='foooverwrite')
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key=key2)
+    alt_client.put_object(Bucket=bucket_name, Key=key2, Body='baroverwrite')
+    objs = get_objects_list(bucket=bucket_name, client=alt_client)
+    assert objs == ['bar', 'foo']
+    alt_client.put_object(Bucket=bucket_name, Key=newkey, Body='newcontent')
+
+def test_buckets_create_then_list():
+    client = get_client()
+    bucket_names = []
+    for i in range(5):
+        bucket_name = get_new_bucket_name()
+        bucket_names.append(bucket_name)
+
+    for name in bucket_names:
+        client.create_bucket(Bucket=name)
+
+    response = client.list_buckets()
+    bucket_dicts = response['Buckets']
+    buckets_list = []
+
+    buckets_list = get_buckets_list()
+
+    for name in bucket_names:
+        if name not in buckets_list:
+            raise RuntimeError("S3 implementation's GET on Service did not return bucket we created: %r", bucket.name)
+
+def test_buckets_list_ctime():
+    # check that creation times are within a day
+    before = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(days=1)
+
+    client = get_client()
+    buckets = []
+    for i in range(5):
+        name = get_new_bucket_name()
+        client.create_bucket(Bucket=name)
+        buckets.append(name)
+
+    response = client.list_buckets()
+    for bucket in response['Buckets']:
+        if bucket['Name'] in buckets:
+            ctime = bucket['CreationDate']
+            assert before <= ctime, '%r > %r' % (before, ctime)
+
+@pytest.mark.fails_on_aws
+def test_list_buckets_anonymous():
+    # Get a connection with bad authorization, then change it to be our new Anonymous auth mechanism,
+    # emulating standard HTTP access.
+    #
+    # While it may have been possible to use httplib directly, doing it this way takes care of also
+    # allowing us to vary the calling format in testing.
+    unauthenticated_client = get_unauthenticated_client()
+    response = unauthenticated_client.list_buckets()
+    assert len(response['Buckets']) == 0
+
+def test_list_buckets_invalid_auth():
+    bad_auth_client = get_bad_auth_client()
+    e = assert_raises(ClientError, bad_auth_client.list_buckets)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+def test_list_buckets_bad_auth():
+    main_access_key = get_main_aws_access_key()
+    bad_auth_client = get_bad_auth_client(aws_access_key_id=main_access_key)
+    e = assert_raises(ClientError, bad_auth_client.list_buckets)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+@pytest.mark.fails_on_dbstore
+def test_list_buckets_paginated():
+    client = get_client()
+
+    response = client.list_buckets(MaxBuckets=1)
+    assert len(response['Buckets']) == 0
+    assert 'ContinuationToken' not in response
+
+    bucket1 = get_new_bucket()
+
+    response = client.list_buckets(MaxBuckets=1)
+    assert len(response['Buckets']) == 1
+    assert response['Buckets'][0]['Name'] == bucket1
+    assert 'ContinuationToken' not in response
+
+    bucket2 = get_new_bucket()
+
+    response = client.list_buckets(MaxBuckets=1)
+    assert len(response['Buckets']) == 1
+    assert response['Buckets'][0]['Name'] == bucket1
+    continuation = response['ContinuationToken']
+
+    response = client.list_buckets(MaxBuckets=1, ContinuationToken=continuation)
+    assert len(response['Buckets']) == 1
+    assert response['Buckets'][0]['Name'] == bucket2
+    assert 'ContinuationToken' not in response
+
+@pytest.fixture
+def override_prefix_a():
+    nuke_prefixed_buckets(prefix='a'+get_prefix())
+    yield
+    nuke_prefixed_buckets(prefix='a'+get_prefix())
+
+# this test goes outside the user-configure prefix because it needs to
+# control the initial character of the bucket name
+def test_bucket_create_naming_good_starts_alpha(override_prefix_a):
+    check_good_bucket_name('foo', _prefix='a'+get_prefix())
+
+@pytest.fixture
+def override_prefix_0():
+    nuke_prefixed_buckets(prefix='0'+get_prefix())
+    yield
+    nuke_prefixed_buckets(prefix='0'+get_prefix())
+
+# this test goes outside the user-configure prefix because it needs to
+# control the initial character of the bucket name
+def test_bucket_create_naming_good_starts_digit(override_prefix_0):
+    check_good_bucket_name('foo', _prefix='0'+get_prefix())
+
+def test_bucket_create_naming_good_contains_period():
+    check_good_bucket_name('aaa.111')
+
+def test_bucket_create_naming_good_contains_hyphen():
+    check_good_bucket_name('aaa-111')
+
+def test_bucket_recreate_not_overriding():
+    key_names = ['mykey1', 'mykey2']
+    bucket_name = _create_objects(keys=key_names)
+
+    objs_list = get_objects_list(bucket_name)
+    assert key_names == objs_list
+
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+
+    objs_list = get_objects_list(bucket_name)
+    assert key_names == objs_list
+
+@pytest.mark.fails_on_dbstore
+def test_bucket_create_special_key_names():
+    key_names = [
+        ' ',
+        '"',
+        '$',
+        '%',
+        '&',
+        '\'',
+        '<',
+        '>',
+        '_',
+        '_ ',
+        '_ _',
+        '__',
+    ]
+
+    bucket_name = _create_objects(keys=key_names)
+
+    objs_list = get_objects_list(bucket_name)
+    assert key_names == objs_list
+
+    client = get_client()
+
+    for name in key_names:
+        assert name in objs_list
+        response = client.get_object(Bucket=bucket_name, Key=name)
+        body = _get_body(response)
+        assert name == body
+        client.put_object_acl(Bucket=bucket_name, Key=name, ACL='private')
+
+def test_bucket_list_special_prefix():
+    key_names = ['_bla/1', '_bla/2', '_bla/3', '_bla/4', 'abcd']
+    bucket_name = _create_objects(keys=key_names)
+
+    objs_list = get_objects_list(bucket_name)
+
+    assert len(objs_list) == 5
+
+    objs_list = get_objects_list(bucket_name, prefix='_bla/')
+    assert len(objs_list) == 4
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_zero_size():
+    key = 'foo123bar'
+    bucket_name = _create_objects(keys=[key])
+    fp_a = FakeWriteFile(0, '')
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key, Body=fp_a)
+
+    copy_source = {'Bucket': bucket_name, 'Key': key}
+
+    client.copy(copy_source, bucket_name, 'bar321foo')
+    response = client.get_object(Bucket=bucket_name, Key='bar321foo')
+    assert response['ContentLength'] == 0
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_16m():
+    bucket_name = get_new_bucket()
+    key1 = 'obj1'
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=key1, Body=bytearray(16*1024*1024))
+
+    copy_source = {'Bucket': bucket_name, 'Key': key1}
+    key2 = 'obj2'
+    client.copy_object(Bucket=bucket_name, Key=key2, CopySource=copy_source)
+    response = client.get_object(Bucket=bucket_name, Key=key2)
+    assert response['ContentLength'] == 16*1024*1024
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_same_bucket():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo123bar', Body='foo')
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+
+    client.copy(copy_source, bucket_name, 'bar321foo')
+
+    response = client.get_object(Bucket=bucket_name, Key='bar321foo')
+    body = _get_body(response)
+    assert 'foo' == body
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_verify_contenttype():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    content_type = 'text/bla'
+    client.put_object(Bucket=bucket_name, ContentType=content_type, Key='foo123bar', Body='foo')
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+
+    client.copy(copy_source, bucket_name, 'bar321foo')
+
+    response = client.get_object(Bucket=bucket_name, Key='bar321foo')
+    body = _get_body(response)
+    assert 'foo' == body
+    response_content_type = response['ContentType']
+    assert response_content_type == content_type
+
+def test_object_copy_to_itself():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo123bar', Body='foo')
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+
+    e = assert_raises(ClientError, client.copy, copy_source, bucket_name, 'foo123bar')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRequest'
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_to_itself_with_metadata():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo123bar', Body='foo')
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+    metadata = {'foo': 'bar'}
+
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key='foo123bar', Metadata=metadata, MetadataDirective='REPLACE')
+    response = client.get_object(Bucket=bucket_name, Key='foo123bar')
+    assert response['Metadata'] == metadata
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_diff_bucket():
+    bucket_name1 = get_new_bucket()
+    bucket_name2 = get_new_bucket()
+
+    client = get_client()
+    client.put_object(Bucket=bucket_name1, Key='foo123bar', Body='foo')
+
+    copy_source = {'Bucket': bucket_name1, 'Key': 'foo123bar'}
+
+    client.copy(copy_source, bucket_name2, 'bar321foo')
+
+    response = client.get_object(Bucket=bucket_name2, Key='bar321foo')
+    body = _get_body(response)
+    assert 'foo' == body
+
+def test_object_copy_not_owned_bucket():
+    client = get_client()
+    alt_client = get_alt_client()
+    bucket_name1 = get_new_bucket_name()
+    bucket_name2 = get_new_bucket_name()
+    client.create_bucket(Bucket=bucket_name1)
+    alt_client.create_bucket(Bucket=bucket_name2)
+
+    client.put_object(Bucket=bucket_name1, Key='foo123bar', Body='foo')
+
+    copy_source = {'Bucket': bucket_name1, 'Key': 'foo123bar'}
+
+    e = assert_raises(ClientError, alt_client.copy, copy_source, bucket_name2, 'bar321foo')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+def test_object_copy_not_owned_object_bucket():
+    client = get_client()
+    alt_client = get_alt_client()
+    bucket_name = get_new_bucket_name()
+    client.create_bucket(Bucket=bucket_name)
+    client.put_object(Bucket=bucket_name, Key='foo123bar', Body='foo')
+
+    alt_user_id = get_alt_user_id()
+
+    grant = {'Grantee': {'ID': alt_user_id, 'Type': 'CanonicalUser' }, 'Permission': 'FULL_CONTROL'}
+    grants = add_obj_user_grant(bucket_name, 'foo123bar', grant)
+    client.put_object_acl(Bucket=bucket_name, Key='foo123bar', AccessControlPolicy=grants)
+
+    grant = add_bucket_user_grant(bucket_name, grant)
+    client.put_bucket_acl(Bucket=bucket_name, AccessControlPolicy=grant)
+
+    alt_client.get_object(Bucket=bucket_name, Key='foo123bar')
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+    alt_client.copy(copy_source, bucket_name, 'bar321foo')
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_canned_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    alt_client = get_alt_client()
+    client.put_object(Bucket=bucket_name, Key='foo123bar', Body='foo')
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key='bar321foo', ACL='public-read')
+    # check ACL is applied by doing GET from another user
+    alt_client.get_object(Bucket=bucket_name, Key='bar321foo')
+
+
+    metadata={'abc': 'def'}
+    copy_source = {'Bucket': bucket_name, 'Key': 'bar321foo'}
+    client.copy_object(ACL='public-read', Bucket=bucket_name, CopySource=copy_source, Key='foo123bar', Metadata=metadata, MetadataDirective='REPLACE')
+
+    # check ACL is applied by doing GET from another user
+    alt_client.get_object(Bucket=bucket_name, Key='foo123bar')
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_retaining_metadata():
+    for size in [3, 1024 * 1024]:
+        bucket_name = get_new_bucket()
+        client = get_client()
+        content_type = 'audio/ogg'
+
+        metadata = {'key1': 'value1', 'key2': 'value2'}
+        client.put_object(Bucket=bucket_name, Key='foo123bar', Metadata=metadata, ContentType=content_type, Body=bytearray(size))
+
+        copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+        client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key='bar321foo')
+
+        response = client.get_object(Bucket=bucket_name, Key='bar321foo')
+        assert content_type == response['ContentType']
+        assert metadata == response['Metadata']
+        body = _get_body(response)
+        assert size == response['ContentLength']
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_replacing_metadata():
+    for size in [3, 1024 * 1024]:
+        bucket_name = get_new_bucket()
+        client = get_client()
+        content_type = 'audio/ogg'
+
+        metadata = {'key1': 'value1', 'key2': 'value2'}
+        client.put_object(Bucket=bucket_name, Key='foo123bar', Metadata=metadata, ContentType=content_type, Body=bytearray(size))
+
+        metadata = {'key3': 'value3', 'key2': 'value2'}
+        content_type = 'audio/mpeg'
+
+        copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+        client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key='bar321foo', Metadata=metadata, MetadataDirective='REPLACE', ContentType=content_type)
+
+        response = client.get_object(Bucket=bucket_name, Key='bar321foo')
+        assert content_type == response['ContentType']
+        assert metadata == response['Metadata']
+        assert size == response['ContentLength']
+
+def test_object_copy_bucket_not_found():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    copy_source = {'Bucket': bucket_name + "-fake", 'Key': 'foo123bar'}
+    e = assert_raises(ClientError, client.copy, copy_source, bucket_name, 'bar321foo')
+    status = _get_status(e.response)
+    assert status == 404
+
+def test_object_copy_key_not_found():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'foo123bar'}
+    e = assert_raises(ClientError, client.copy, copy_source, bucket_name, 'bar321foo')
+    status = _get_status(e.response)
+    assert status == 404
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_versioned_bucket():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    size = 1*5
+    data = bytearray(size)
+    data_str = data.decode()
+    key1 = 'foo123bar'
+    client.put_object(Bucket=bucket_name, Key=key1, Body=data)
+
+    response = client.get_object(Bucket=bucket_name, Key=key1)
+    version_id = response['VersionId']
+
+    # copy object in the same bucket
+    copy_source = {'Bucket': bucket_name, 'Key': key1, 'VersionId': version_id}
+    key2 = 'bar321foo'
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key=key2)
+    response = client.get_object(Bucket=bucket_name, Key=key2)
+    body = _get_body(response)
+    assert data_str == body
+    assert size == response['ContentLength']
+
+
+    # second copy
+    version_id2 = response['VersionId']
+    copy_source = {'Bucket': bucket_name, 'Key': key2, 'VersionId': version_id2}
+    key3 = 'bar321foo2'
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key=key3)
+    response = client.get_object(Bucket=bucket_name, Key=key3)
+    body = _get_body(response)
+    assert data_str == body
+    assert size == response['ContentLength']
+
+    # copy to another versioned bucket
+    bucket_name2 = get_new_bucket()
+    check_configure_versioning_retry(bucket_name2, "Enabled", "Enabled")
+    copy_source = {'Bucket': bucket_name, 'Key': key1, 'VersionId': version_id}
+    key4 = 'bar321foo3'
+    client.copy_object(Bucket=bucket_name2, CopySource=copy_source, Key=key4)
+    response = client.get_object(Bucket=bucket_name2, Key=key4)
+    body = _get_body(response)
+    assert data_str == body
+    assert size == response['ContentLength']
+
+    # copy to another non versioned bucket
+    bucket_name3 = get_new_bucket()
+    copy_source = {'Bucket': bucket_name, 'Key': key1, 'VersionId': version_id}
+    key5 = 'bar321foo4'
+    client.copy_object(Bucket=bucket_name3, CopySource=copy_source, Key=key5)
+    response = client.get_object(Bucket=bucket_name3, Key=key5)
+    body = _get_body(response)
+    assert data_str == body
+    assert size == response['ContentLength']
+
+    # copy from a non versioned bucket
+    copy_source = {'Bucket': bucket_name3, 'Key': key5}
+    key6 = 'foo123bar2'
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key=key6)
+    response = client.get_object(Bucket=bucket_name, Key=key6)
+    body = _get_body(response)
+    assert data_str == body
+    assert size == response['ContentLength']
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_versioned_url_encoding():
+    bucket = get_new_bucket_resource()
+    check_configure_versioning_retry(bucket.name, "Enabled", "Enabled")
+    src_key = 'foo?bar'
+    src = bucket.put_object(Key=src_key)
+    src.load() # HEAD request tests that the key exists
+
+    # copy object in the same bucket
+    dst_key = 'bar&foo'
+    dst = bucket.Object(dst_key)
+    dst.copy_from(CopySource={'Bucket': src.bucket_name, 'Key': src.key, 'VersionId': src.version_id})
+    dst.load() # HEAD request tests that the key exists
+
+def generate_random(size, part_size=5*1024*1024):
+    """
+    Generate the specified number random data.
+    (actually each MB is a repetition of the first KB)
+    """
+    chunk = 1024
+    allowed = string.ascii_letters
+    for x in range(0, size, part_size):
+        strpart = ''.join([allowed[random.randint(0, len(allowed) - 1)] for _ in range(chunk)])
+        s = ''
+        left = size - x
+        this_part_size = min(left, part_size)
+        for y in range(this_part_size // chunk):
+            s = s + strpart
+        if this_part_size > len(s):
+            s = s + strpart[0:this_part_size - len(s)]
+        yield s
+        if (x == size):
+            return
+
+def _multipart_upload(bucket_name, key, size, part_size=5*1024*1024, client=None, content_type=None, metadata=None, resend_parts=[], tagging=None):
+    """
+    generate a multi-part upload for a random file of specifed size,
+    if requested, generate a list of the parts
+    return the upload descriptor
+    """
+    if client == None:
+        client = get_client()
+
+
+    if content_type == None and metadata == None:
+      if tagging is not None:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key, Tagging=tagging)
+      else:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+    else:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key, Metadata=metadata, ContentType=content_type)
+
+    upload_id = response['UploadId']
+    s = ''
+    parts = []
+    for i, part in enumerate(generate_random(size, part_size)):
+        # part_num is necessary because PartNumber for upload_part and in parts must start at 1 and i starts at 0
+        part_num = i+1
+        s += part
+        response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num, Body=part)
+        parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': part_num})
+        if i in resend_parts:
+            client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num, Body=part)
+
+    return (upload_id, s, parts)
+
+def _multipart_upload_checksum(bucket_name, key, size, part_size=5*1024*1024, client=None, content_type=None, metadata=None, resend_parts=[]):
+    """
+    generate a multi-part upload for a random file of specifed size,
+    if requested, generate a list of the parts
+    return the upload descriptor
+    """
+    if client == None:
+        client = get_client()
+
+
+    if content_type == None and metadata == None:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key, ChecksumAlgorithm='SHA256')
+    else:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key, Metadata=metadata, ContentType=content_type,
+                                                  ChecksumAlgorithm='SHA256')
+
+    upload_id = response['UploadId']
+    s = ''
+    parts = []
+    part_checksums = []
+    for i, part in enumerate(generate_random(size, part_size)):
+        # part_num is necessary because PartNumber for upload_part and in parts must start at 1 and i starts at 0
+        part_num = i+1
+        s += part
+        response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num, Body=part,
+                                      ChecksumAlgorithm='SHA256')
+
+        parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': part_num})
+
+        armored_part_cksum = base64.b64encode(hashlib.sha256(part.encode('utf-8')).digest())
+        part_checksums.append(armored_part_cksum.decode())
+
+        if i in resend_parts:
+            client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num, Body=part,
+                               ChecksumAlgorithm='SHA256')
+
+    return (upload_id, s, parts, part_checksums)
+
+@pytest.mark.fails_on_dbstore
+def test_object_copy_versioning_multipart_upload():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key1 = "srcmultipart"
+    key1_metadata = {'foo': 'bar'}
+    content_type = 'text/bla'
+    objlen = 30 * 1024 * 1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key1, size=objlen, content_type=content_type, metadata=key1_metadata)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key1, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.get_object(Bucket=bucket_name, Key=key1)
+    key1_size = response['ContentLength']
+    version_id = response['VersionId']
+
+    # copy object in the same bucket
+    copy_source = {'Bucket': bucket_name, 'Key': key1, 'VersionId': version_id}
+    key2 = 'dstmultipart'
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key=key2)
+    response = client.get_object(Bucket=bucket_name, Key=key2)
+    version_id2 = response['VersionId']
+    body = _get_body(response)
+    assert data == body
+    assert key1_size == response['ContentLength']
+    assert key1_metadata == response['Metadata']
+    assert content_type == response['ContentType']
+
+    # second copy
+    copy_source = {'Bucket': bucket_name, 'Key': key2, 'VersionId': version_id2}
+    key3 = 'dstmultipart2'
+    client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key=key3)
+    response = client.get_object(Bucket=bucket_name, Key=key3)
+    body = _get_body(response)
+    assert data == body
+    assert key1_size == response['ContentLength']
+    assert key1_metadata == response['Metadata']
+    assert content_type == response['ContentType']
+
+    # copy to another versioned bucket
+    bucket_name2 = get_new_bucket()
+    check_configure_versioning_retry(bucket_name2, "Enabled", "Enabled")
+
+    copy_source = {'Bucket': bucket_name, 'Key': key1, 'VersionId': version_id}
+    key4 = 'dstmultipart3'
+    client.copy_object(Bucket=bucket_name2, CopySource=copy_source, Key=key4)
+    response = client.get_object(Bucket=bucket_name2, Key=key4)
+    body = _get_body(response)
+    assert data == body
+    assert key1_size == response['ContentLength']
+    assert key1_metadata == response['Metadata']
+    assert content_type == response['ContentType']
+
+    # copy to another non versioned bucket
+    bucket_name3 = get_new_bucket()
+    copy_source = {'Bucket': bucket_name, 'Key': key1, 'VersionId': version_id}
+    key5 = 'dstmultipart4'
+    client.copy_object(Bucket=bucket_name3, CopySource=copy_source, Key=key5)
+    response = client.get_object(Bucket=bucket_name3, Key=key5)
+    body = _get_body(response)
+    assert data == body
+    assert key1_size == response['ContentLength']
+    assert key1_metadata == response['Metadata']
+    assert content_type == response['ContentType']
+
+    # copy from a non versioned bucket
+    copy_source = {'Bucket': bucket_name3, 'Key': key5}
+    key6 = 'dstmultipart5'
+    client.copy_object(Bucket=bucket_name3, CopySource=copy_source, Key=key6)
+    response = client.get_object(Bucket=bucket_name3, Key=key6)
+    body = _get_body(response)
+    assert data == body
+    assert key1_size == response['ContentLength']
+    assert key1_metadata == response['Metadata']
+    assert content_type == response['ContentType']
+
+def test_multipart_upload_empty():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key1 = "mymultipart"
+    objlen = 0
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key1, size=objlen)
+    e = assert_raises(ClientError, client.complete_multipart_upload,Bucket=bucket_name, Key=key1, UploadId=upload_id)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_upload_complete_without_create():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    parts = {}
+    upload_opts = {
+        'Bucket': bucket_name,
+        'Key': 'mymultipart',
+        'UploadId': 'abc1234def',
+        'MultipartUpload': {'Parts': [
+            {'ETag': "1234", 'PartNumber': 1}
+        ]}
+    }
+    e = assert_raises(ClientError, client.complete_multipart_upload, **upload_opts)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchUpload'
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_upload_small():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key1 = "mymultipart"
+    objlen = 1
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key1, size=objlen)
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key1, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    response = client.get_object(Bucket=bucket_name, Key=key1)
+    assert response['ContentLength'] == objlen
+    # check extra client.complete_multipart_upload
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key1, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+def _create_key_with_random_content(keyname, size=7*1024*1024, bucket_name=None, client=None):
+    if bucket_name is None:
+        bucket_name = get_new_bucket()
+
+    if client == None:
+        client = get_client()
+
+    data_str = str(next(generate_random(size, size)))
+    data = bytes(data_str, 'utf-8')
+    client.put_object(Bucket=bucket_name, Key=keyname, Body=data)
+
+    return bucket_name
+
+def _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size, client=None, part_size=5*1024*1024, version_id=None):
+
+    if(client == None):
+        client = get_client()
+
+    response = client.create_multipart_upload(Bucket=dest_bucket_name, Key=dest_key)
+    upload_id = response['UploadId']
+
+    if(version_id == None):
+        copy_source = {'Bucket': src_bucket_name, 'Key': src_key}
+    else:
+        copy_source = {'Bucket': src_bucket_name, 'Key': src_key, 'VersionId': version_id}
+
+    parts = []
+
+    i = 0
+    for start_offset in range(0, size, part_size):
+        end_offset = min(start_offset + part_size - 1, size - 1)
+        part_num = i+1
+        copy_source_range = 'bytes={start}-{end}'.format(start=start_offset, end=end_offset)
+        response = client.upload_part_copy(Bucket=dest_bucket_name, Key=dest_key, CopySource=copy_source, PartNumber=part_num, UploadId=upload_id, CopySourceRange=copy_source_range)
+        parts.append({'ETag': response['CopyPartResult']['ETag'], 'PartNumber': part_num})
+        i = i+1
+
+    return (upload_id, parts)
+
+def _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name, version_id=None):
+    client = get_client()
+
+    if(version_id == None):
+        response = client.get_object(Bucket=src_bucket_name, Key=src_key)
+    else:
+        response = client.get_object(Bucket=src_bucket_name, Key=src_key, VersionId=version_id)
+    src_size = response['ContentLength']
+
+    response = client.get_object(Bucket=dest_bucket_name, Key=dest_key)
+    dest_size = response['ContentLength']
+    dest_data = _get_body(response)
+    assert(src_size >= dest_size)
+
+    r = 'bytes={s}-{e}'.format(s=0, e=dest_size-1)
+    if(version_id == None):
+        response = client.get_object(Bucket=src_bucket_name, Key=src_key, Range=r)
+    else:
+        response = client.get_object(Bucket=src_bucket_name, Key=src_key, Range=r, VersionId=version_id)
+    src_data = _get_body(response)
+    assert src_data == dest_data
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_copy_small():
+    src_key = 'foo'
+    src_bucket_name = _create_key_with_random_content(src_key)
+
+    dest_bucket_name = get_new_bucket()
+    dest_key = "mymultipart"
+    size = 1
+    client = get_client()
+
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.get_object(Bucket=dest_bucket_name, Key=dest_key)
+    assert size == response['ContentLength']
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+def test_multipart_copy_invalid_range():
+    client = get_client()
+    src_key = 'source'
+    src_bucket_name = _create_key_with_random_content(src_key, size=5)
+
+    response = client.create_multipart_upload(Bucket=src_bucket_name, Key='dest')
+    upload_id = response['UploadId']
+
+    copy_source = {'Bucket': src_bucket_name, 'Key': src_key}
+    copy_source_range = 'bytes={start}-{end}'.format(start=0, end=21)
+
+    e = assert_raises(ClientError, client.upload_part_copy,Bucket=src_bucket_name, Key='dest', UploadId=upload_id, CopySource=copy_source, CopySourceRange=copy_source_range, PartNumber=1)
+    status, error_code = _get_status_and_error_code(e.response)
+    valid_status = [400, 416]
+    if not status in valid_status:
+       raise AssertionError("Invalid response " + str(status))
+    assert error_code == 'InvalidRange'
+
+
+# TODO: remove fails_on_rgw when https://tracker.ceph.com/issues/40795 is resolved
+@pytest.mark.fails_on_rgw
+def test_multipart_copy_improper_range():
+    client = get_client()
+    src_key = 'source'
+    src_bucket_name = _create_key_with_random_content(src_key, size=5)
+
+    response = client.create_multipart_upload(
+        Bucket=src_bucket_name, Key='dest')
+    upload_id = response['UploadId']
+
+    copy_source = {'Bucket': src_bucket_name, 'Key': src_key}
+    test_ranges = ['{start}-{end}'.format(start=0, end=2),
+                   'bytes={start}'.format(start=0),
+                   'bytes=hello-world',
+                   'bytes=0-bar',
+                   'bytes=hello-',
+                   'bytes=0-2,3-5']
+
+    for test_range in test_ranges:
+        e = assert_raises(ClientError, client.upload_part_copy,
+                          Bucket=src_bucket_name, Key='dest',
+                          UploadId=upload_id,
+                          CopySource=copy_source,
+                          CopySourceRange=test_range,
+                          PartNumber=1)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 400
+        assert error_code == 'InvalidArgument'
+
+
+def test_multipart_copy_without_range():
+    client = get_client()
+    src_key = 'source'
+    src_bucket_name = _create_key_with_random_content(src_key, size=10)
+    dest_bucket_name = get_new_bucket_name()
+    get_new_bucket(name=dest_bucket_name)
+    dest_key = "mymultipartcopy"
+
+    response = client.create_multipart_upload(Bucket=dest_bucket_name, Key=dest_key)
+    upload_id = response['UploadId']
+    parts = []
+
+    copy_source = {'Bucket': src_bucket_name, 'Key': src_key}
+    part_num = 1
+    copy_source_range = 'bytes={start}-{end}'.format(start=0, end=9)
+
+    response = client.upload_part_copy(Bucket=dest_bucket_name, Key=dest_key, CopySource=copy_source, PartNumber=part_num, UploadId=upload_id)
+
+    parts.append({'ETag': response['CopyPartResult']['ETag'], 'PartNumber': part_num})
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.get_object(Bucket=dest_bucket_name, Key=dest_key)
+    assert response['ContentLength'] == 10
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_copy_special_names():
+    src_bucket_name = get_new_bucket()
+
+    dest_bucket_name = get_new_bucket()
+
+    dest_key = "mymultipart"
+    size = 1
+    client = get_client()
+
+    for src_key in (' ', '_', '__', '?versionId'):
+        _create_key_with_random_content(src_key, bucket_name=src_bucket_name)
+        (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+        response = client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+        response = client.get_object(Bucket=dest_bucket_name, Key=dest_key)
+        assert size == response['ContentLength']
+        _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+def _check_content_using_range(key, bucket_name, data, step):
+    client = get_client()
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    size = response['ContentLength']
+
+    for ofs in range(0, size, step):
+        toread = size - ofs
+        if toread > step:
+            toread = step
+        end = ofs + toread - 1
+        r = 'bytes={s}-{e}'.format(s=ofs, e=end)
+        response = client.get_object(Bucket=bucket_name, Key=key, Range=r)
+        assert response['ContentLength'] == toread
+        body = _get_body(response)
+        assert body == data[ofs:end+1]
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_upload():
+    bucket_name = get_new_bucket()
+    key="mymultipart"
+    content_type='text/bla'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    client = get_client()
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, content_type=content_type, metadata=metadata)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    # check extra client.complete_multipart_upload
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert len(response['Contents']) == 1
+    assert response['Contents'][0]['Size'] == objlen
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    assert response['ContentType'] == content_type
+    assert response['Metadata'] == metadata
+    body = _get_body(response)
+    assert len(body) == response['ContentLength']
+    assert body == data
+
+    _check_content_using_range(key, bucket_name, data, 1000000)
+    _check_content_using_range(key, bucket_name, data, 10000000)
+
+def check_versioning(bucket_name, status):
+    client = get_client()
+
+    try:
+        response = client.get_bucket_versioning(Bucket=bucket_name)
+        assert response['Status'] == status
+    except KeyError:
+        assert status == None
+
+# amazon is eventually consistent, retry a bit if failed
+def check_configure_versioning_retry(bucket_name, status, expected_string):
+    client = get_client()
+    client.put_bucket_versioning(Bucket=bucket_name, VersioningConfiguration={'Status': status})
+
+    read_status = None
+
+    for i in range(5):
+        try:
+            response = client.get_bucket_versioning(Bucket=bucket_name)
+            read_status = response['Status']
+        except KeyError:
+            read_status = None
+
+        if (expected_string == read_status):
+            break
+
+        time.sleep(1)
+
+    assert expected_string == read_status
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_copy_versioned():
+    src_bucket_name = get_new_bucket()
+    dest_bucket_name = get_new_bucket()
+
+    dest_key = "mymultipart"
+    check_versioning(src_bucket_name, None)
+
+    src_key = 'foo'
+    check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+
+    size = 15 * 1024 * 1024
+    _create_key_with_random_content(src_key, size=size, bucket_name=src_bucket_name)
+    _create_key_with_random_content(src_key, size=size, bucket_name=src_bucket_name)
+    _create_key_with_random_content(src_key, size=size, bucket_name=src_bucket_name)
+
+    version_id = []
+    client = get_client()
+    response = client.list_object_versions(Bucket=src_bucket_name)
+    for ver in response['Versions']:
+        version_id.append(ver['VersionId'])
+
+    for vid in version_id:
+        (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size, version_id=vid)
+        response = client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+        response = client.get_object(Bucket=dest_bucket_name, Key=dest_key)
+        assert size == response['ContentLength']
+        _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name, version_id=vid)
+
+def _check_upload_multipart_resend(bucket_name, key, objlen, resend_parts):
+    content_type = 'text/bla'
+    metadata = {'foo': 'bar'}
+    client = get_client()
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, content_type=content_type, metadata=metadata, resend_parts=resend_parts)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    assert response['ContentType'] == content_type
+    assert response['Metadata'] == metadata
+    body = _get_body(response)
+    assert len(body) == response['ContentLength']
+    assert body == data
+
+    _check_content_using_range(key, bucket_name, data, 1000000)
+    _check_content_using_range(key, bucket_name, data, 10000000)
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_upload_resend_part():
+    bucket_name = get_new_bucket()
+    key="mymultipart"
+    objlen = 30 * 1024 * 1024
+
+    _check_upload_multipart_resend(bucket_name, key, objlen, [0])
+    _check_upload_multipart_resend(bucket_name, key, objlen, [1])
+    _check_upload_multipart_resend(bucket_name, key, objlen, [2])
+    _check_upload_multipart_resend(bucket_name, key, objlen, [1,2])
+    _check_upload_multipart_resend(bucket_name, key, objlen, [0,1,2,3,4,5])
+
+def test_multipart_upload_multiple_sizes():
+    bucket_name = get_new_bucket()
+    key="mymultipart"
+    client = get_client()
+
+    objlen = 5*1024*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    objlen = 5*1024*1024+100*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    objlen = 5*1024*1024+600*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    objlen = 10*1024*1024+100*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    objlen = 10*1024*1024+600*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    objlen = 10*1024*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_copy_multiple_sizes():
+    src_key = 'foo'
+    src_bucket_name = _create_key_with_random_content(src_key, 12*1024*1024)
+
+    dest_bucket_name = get_new_bucket()
+    dest_key="mymultipart"
+    client = get_client()
+
+    size = 5*1024*1024
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+    size = 5*1024*1024+100*1024
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+    size = 5*1024*1024+600*1024
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+    size = 10*1024*1024+100*1024
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+    size = 10*1024*1024+600*1024
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+    size = 10*1024*1024
+    (upload_id, parts) = _multipart_copy(src_bucket_name, src_key, dest_bucket_name, dest_key, size)
+    client.complete_multipart_upload(Bucket=dest_bucket_name, Key=dest_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    _check_key_content(src_key, src_bucket_name, dest_key, dest_bucket_name)
+
+def test_multipart_upload_size_too_small():
+    bucket_name = get_new_bucket()
+    key="mymultipart"
+    client = get_client()
+
+    size = 100*1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=size, part_size=10*1024)
+    e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'EntityTooSmall'
+
+def gen_rand_string(size, chars=string.ascii_uppercase + string.digits):
+    return ''.join(random.choice(chars) for _ in range(size))
+
+def _do_test_multipart_upload_contents(bucket_name, key, num_parts):
+    payload=gen_rand_string(5)*1024*1024
+    client = get_client()
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+    upload_id = response['UploadId']
+
+    parts = []
+
+    for part_num in range(0, num_parts):
+        part = bytes(payload, 'utf-8')
+        response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num+1, Body=part)
+        parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': part_num+1})
+
+    last_payload = '123'*1024*1024
+    last_part = bytes(last_payload, 'utf-8')
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=num_parts+1, Body=last_part)
+    parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': num_parts+1})
+
+    res = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    assert res['ETag'] != ''
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    test_string = _get_body(response)
+
+    all_payload = payload*num_parts + last_payload
+
+    assert test_string == all_payload
+
+    return all_payload
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_upload_contents():
+    bucket_name = get_new_bucket()
+    _do_test_multipart_upload_contents(bucket_name, 'mymultipart', 3)
+
+def test_multipart_upload_overwrite_existing_object():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'mymultipart'
+    payload='12345'*1024*1024
+    num_parts=2
+    client.put_object(Bucket=bucket_name, Key=key, Body=payload)
+
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+    upload_id = response['UploadId']
+
+    parts = []
+
+    for part_num in range(0, num_parts):
+        response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num+1, Body=payload)
+        parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': part_num+1})
+
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    test_string = _get_body(response)
+
+    assert test_string == payload*num_parts
+
+def test_abort_multipart_upload():
+    bucket_name = get_new_bucket()
+    key="mymultipart"
+    objlen = 10 * 1024 * 1024
+    client = get_client()
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen)
+    client.abort_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id)
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert 'Contents' not in response
+
+def test_abort_multipart_upload_not_found():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key="mymultipart"
+    client.put_object(Bucket=bucket_name, Key=key)
+
+    e = assert_raises(ClientError, client.abort_multipart_upload, Bucket=bucket_name, Key=key, UploadId='56788')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchUpload'
+
+@pytest.mark.fails_on_dbstore
+def test_list_multipart_upload():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key="mymultipart"
+    mb = 1024 * 1024
+
+    upload_ids = []
+    (upload_id1, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=5*mb)
+    upload_ids.append(upload_id1)
+    (upload_id2, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=6*mb)
+    upload_ids.append(upload_id2)
+
+    key2="mymultipart2"
+    (upload_id3, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key2, size=5*mb)
+    upload_ids.append(upload_id3)
+
+    response = client.list_multipart_uploads(Bucket=bucket_name)
+    uploads = response['Uploads']
+    resp_uploadids = []
+
+    for i in range(0, len(uploads)):
+        resp_uploadids.append(uploads[i]['UploadId'])
+
+    for i in range(0, len(upload_ids)):
+        assert True == (upload_ids[i] in resp_uploadids)
+
+    client.abort_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id1)
+    client.abort_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id2)
+    client.abort_multipart_upload(Bucket=bucket_name, Key=key2, UploadId=upload_id3)
+
+@pytest.mark.fails_on_dbstore
+def test_list_multipart_upload_owner():
+    bucket_name = get_new_bucket()
+
+    client1 = get_client()
+    user1 = get_main_user_id()
+    name1 = get_main_display_name()
+
+    client2 = get_alt_client()
+    user2  = get_alt_user_id()
+    name2 = get_alt_display_name()
+
+    # add bucket acl for public read/write access
+    client1.put_bucket_acl(Bucket=bucket_name, ACL='public-read-write')
+
+    key1 = 'multipart1'
+    key2 = 'multipart2'
+    upload1 = client1.create_multipart_upload(Bucket=bucket_name, Key=key1)['UploadId']
+    try:
+        upload2 = client2.create_multipart_upload(Bucket=bucket_name, Key=key2)['UploadId']
+        try:
+            # match fields of an Upload from ListMultipartUploadsResult
+            def match(upload, key, uploadid, userid, username):
+                assert upload['Key'] == key
+                assert upload['UploadId'] == uploadid
+                assert upload['Initiator']['ID'] == userid
+                assert upload['Initiator']['DisplayName'] == username
+                assert upload['Owner']['ID'] == userid
+                assert upload['Owner']['DisplayName'] == username
+
+            # list uploads with client1
+            uploads1 = client1.list_multipart_uploads(Bucket=bucket_name)['Uploads']
+            assert len(uploads1) == 2
+            match(uploads1[0], key1, upload1, user1, name1)
+            match(uploads1[1], key2, upload2, user2, name2)
+
+            # list uploads with client2
+            uploads2 = client2.list_multipart_uploads(Bucket=bucket_name)['Uploads']
+            assert len(uploads2) == 2
+            match(uploads2[0], key1, upload1, user1, name1)
+            match(uploads2[1], key2, upload2, user2, name2)
+        finally:
+            client2.abort_multipart_upload(Bucket=bucket_name, Key=key2, UploadId=upload2)
+    finally:
+        client1.abort_multipart_upload(Bucket=bucket_name, Key=key1, UploadId=upload1)
+
+def test_multipart_upload_missing_part():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key="mymultipart"
+    size = 1
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+    upload_id = response['UploadId']
+
+    parts = []
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=1, Body=bytes('\x00', 'utf-8'))
+    # 'PartNumber should be 1'
+    parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': 9999})
+
+    e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+def test_multipart_upload_incorrect_etag():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key="mymultipart"
+    size = 1
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+    upload_id = response['UploadId']
+
+    parts = []
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=1, Body=bytes('\x00', 'utf-8'))
+    # 'ETag' should be "93b885adfe0da089cdf634904fd59f71"
+    parts.append({'ETag': "ffffffffffffffffffffffffffffffff", 'PartNumber': 1})
+
+    e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_get_part():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "mymultipart"
+
+    part_size = 5*1024*1024
+    part_sizes = 3 * [part_size] + [1*1024*1024]
+    part_count = len(part_sizes)
+    total_size = sum(part_sizes)
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name, key, total_size, part_size, resend_parts=[2])
+
+    # request part before complete
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=1)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    res = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    assert len(parts) == part_count
+
+    for part, size in zip(parts, part_sizes):
+        response = client.head_object(Bucket=bucket_name, Key=key, PartNumber=part['PartNumber'])
+        assert response['PartsCount'] == part_count
+        assert response['ETag'] == res['ETag']
+
+        response = client.get_object(Bucket=bucket_name, Key=key, PartNumber=part['PartNumber'])
+        assert response['PartsCount'] == part_count
+        assert response['ETag'] == res['ETag']
+        assert response['ContentLength'] == size
+        # compare contents
+        for chunk in response['Body'].iter_chunks():
+            assert chunk.decode() == data[0:len(chunk)]
+            data = data[len(chunk):]
+
+    # request PartNumber out of range
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=5)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_multipart_sse_c_get_part():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "mymultipart"
+
+    part_size = 5*1024*1024
+    part_sizes = 3 * [part_size] + [1*1024*1024]
+    part_count = len(part_sizes)
+    total_size = sum(part_sizes)
+
+    enc_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw==',
+    }
+    get_args = {
+        'SSECustomerAlgorithm': 'AES256',
+        'SSECustomerKey': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'SSECustomerKeyMD5': 'DWygnHRtgiJ77HCm+1rvHw==',
+    }
+
+    (upload_id, data, parts) = _multipart_upload_enc(client, bucket_name, key, total_size,
+            part_size, init_headers=enc_headers, part_headers=enc_headers, metadata=None, resend_parts=[2])
+
+    # request part before complete
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=1)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    res = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts}, **get_args)
+    assert len(parts) == part_count
+
+    for part, size in zip(parts, part_sizes):
+        response = client.head_object(Bucket=bucket_name, Key=key, PartNumber=part['PartNumber'], **get_args)
+        assert response['PartsCount'] == part_count
+        assert response['ETag'] == res['ETag']
+
+        response = client.get_object(Bucket=bucket_name, Key=key, PartNumber=part['PartNumber'], **get_args)
+        assert response['PartsCount'] == part_count
+        assert response['ETag'] == res['ETag']
+        assert response['ContentLength'] == size
+        # compare contents
+        for chunk in response['Body'].iter_chunks():
+            assert chunk.decode() == data[0:len(chunk)]
+            data = data[len(chunk):]
+
+    # request PartNumber out of range
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=5)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+@pytest.mark.fails_on_dbstore
+def test_multipart_single_get_part():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "mymultipart"
+
+    part_size = 5*1024*1024
+    part_sizes = [part_size] # just one part
+    part_count = len(part_sizes)
+    total_size = sum(part_sizes)
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name, key, total_size, part_size)
+
+    # request part before complete
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=1)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    res = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    assert len(parts) == part_count
+
+    for part, size in zip(parts, part_sizes):
+        response = client.head_object(Bucket=bucket_name, Key=key, PartNumber=part['PartNumber'])
+        assert response['PartsCount'] == part_count
+        assert response['ETag'] == res['ETag']
+
+        response = client.get_object(Bucket=bucket_name, Key=key, PartNumber=part['PartNumber'])
+        assert response['PartsCount'] == part_count
+        assert response['ETag'] == res['ETag']
+        assert response['ContentLength'] == size
+        # compare contents
+        for chunk in response['Body'].iter_chunks():
+            assert chunk.decode() == data[0:len(chunk)]
+            data = data[len(chunk):]
+
+    # request PartNumber out of range
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=5)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+@pytest.mark.fails_on_dbstore
+def test_non_multipart_get_part():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "singlepart"
+
+    response = client.put_object(Bucket=bucket_name, Key=key, Body='body')
+    etag = response['ETag']
+
+    # request for PartNumber > 1 results in InvalidPart
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=2)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+    # request for PartNumber = 1 gives back the entire object
+    response = client.get_object(Bucket=bucket_name, Key=key, PartNumber=1)
+    assert response['ETag'] == etag
+    assert _get_body(response) == 'body'
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_non_multipart_sse_c_get_part():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "singlepart"
+
+    sse_args = {
+        'SSECustomerAlgorithm': 'AES256',
+        'SSECustomerKey': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'SSECustomerKeyMD5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    response = client.put_object(Bucket=bucket_name, Key=key, Body='body', **sse_args)
+    etag = response['ETag']
+
+    # request for PartNumber > 1 results in InvalidPart
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key, PartNumber=2, **sse_args)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidPart'
+
+    # request for PartNumber = 1 gives back the entire object
+    response = client.get_object(Bucket=bucket_name, Key=key, PartNumber=1, **sse_args)
+    assert response['ETag'] == etag
+    assert _get_body(response) == 'body'
+
+
+def _simple_http_req_100_cont(host, port, is_secure, method, resource):
+    """
+    Send the specified request w/expect 100-continue
+    and await confirmation.
+    """
+    req_str = '{method} {resource} HTTP/1.1\r\nHost: {host}\r\nAccept-Encoding: identity\r\nContent-Length: 123\r\nExpect: 100-continue\r\n\r\n'.format(
+            method=method,
+            resource=resource,
+            host=host,
+            )
+
+    req = bytes(req_str, 'utf-8')
+
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    if is_secure:
+        ctx = ssl.create_default_context()
+        s = ctx.wrap_socket(s, server_hostname=host);
+    s.settimeout(5)
+    s.connect((host, port))
+    s.send(req)
+
+    try:
+        data = s.recv(1024)
+    except socket.error as msg:
+        print('got response: ', msg)
+        print('most likely server doesn\'t support 100-continue')
+
+    s.close()
+    data_str = data.decode()
+    l = data_str.split(' ')
+
+    assert l[0].startswith('HTTP')
+
+    return l[1]
+
+def test_100_continue():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    objname='testobj'
+    resource = '/{bucket}/{obj}'.format(bucket=bucket_name, obj=objname)
+
+    host = get_config_host()
+    port = get_config_port()
+    is_secure = get_config_is_secure()
+
+    #NOTES: this test needs to be tested when is_secure is True
+    status = _simple_http_req_100_cont(host, port, is_secure, 'PUT', resource)
+    assert status == '403'
+
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read-write')
+
+    status = _simple_http_req_100_cont(host, port, is_secure, 'PUT', resource)
+    assert status == '100'
+
+def test_set_cors():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    allowed_methods = ['GET', 'PUT']
+    allowed_origins = ['*.get', '*.put']
+
+    cors_config ={
+        'CORSRules': [
+            {'AllowedMethods': allowed_methods,
+             'AllowedOrigins': allowed_origins,
+            },
+        ]
+    }
+
+    e = assert_raises(ClientError, client.get_bucket_cors, Bucket=bucket_name)
+    status = _get_status(e.response)
+    assert status == 404
+
+    client.put_bucket_cors(Bucket=bucket_name, CORSConfiguration=cors_config)
+    response = client.get_bucket_cors(Bucket=bucket_name)
+    assert response['CORSRules'][0]['AllowedMethods'] == allowed_methods
+    assert response['CORSRules'][0]['AllowedOrigins'] == allowed_origins
+
+    client.delete_bucket_cors(Bucket=bucket_name)
+    e = assert_raises(ClientError, client.get_bucket_cors, Bucket=bucket_name)
+    status = _get_status(e.response)
+    assert status == 404
+
+def _cors_request_and_check(func, url, headers, expect_status, expect_allow_origin, expect_allow_methods):
+    r = func(url, headers=headers, verify=get_config_ssl_verify())
+    assert r.status_code == expect_status
+
+    assert r.headers.get('access-control-allow-origin', None) == expect_allow_origin
+    assert r.headers.get('access-control-allow-methods', None) == expect_allow_methods
+
+def test_cors_origin_response():
+    bucket_name = _setup_bucket_acl(bucket_acl='public-read')
+    client = get_client()
+
+    cors_config ={
+        'CORSRules': [
+            {'AllowedMethods': ['GET'],
+             'AllowedOrigins': ['*suffix'],
+            },
+            {'AllowedMethods': ['GET'],
+             'AllowedOrigins': ['start*end'],
+            },
+            {'AllowedMethods': ['GET'],
+             'AllowedOrigins': ['prefix*'],
+            },
+            {'AllowedMethods': ['PUT'],
+             'AllowedOrigins': ['*.put'],
+            }
+        ]
+    }
+
+    e = assert_raises(ClientError, client.get_bucket_cors, Bucket=bucket_name)
+    status = _get_status(e.response)
+    assert status == 404
+
+    client.put_bucket_cors(Bucket=bucket_name, CORSConfiguration=cors_config)
+
+    time.sleep(3)
+
+    url = _get_post_url(bucket_name)
+
+    _cors_request_and_check(requests.get, url, None, 200, None, None)
+    _cors_request_and_check(requests.get, url, {'Origin': 'foo.suffix'}, 200, 'foo.suffix', 'GET')
+    _cors_request_and_check(requests.get, url, {'Origin': 'foo.bar'}, 200, None, None)
+    _cors_request_and_check(requests.get, url, {'Origin': 'foo.suffix.get'}, 200, None, None)
+    _cors_request_and_check(requests.get, url, {'Origin': 'startend'}, 200, 'startend', 'GET')
+    _cors_request_and_check(requests.get, url, {'Origin': 'start1end'}, 200, 'start1end', 'GET')
+    _cors_request_and_check(requests.get, url, {'Origin': 'start12end'}, 200, 'start12end', 'GET')
+    _cors_request_and_check(requests.get, url, {'Origin': '0start12end'}, 200, None, None)
+    _cors_request_and_check(requests.get, url, {'Origin': 'prefix'}, 200, 'prefix', 'GET')
+    _cors_request_and_check(requests.get, url, {'Origin': 'prefix.suffix'}, 200, 'prefix.suffix', 'GET')
+    _cors_request_and_check(requests.get, url, {'Origin': 'bla.prefix'}, 200, None, None)
+
+    obj_url = '{u}/{o}'.format(u=url, o='bar')
+    _cors_request_and_check(requests.get, obj_url, {'Origin': 'foo.suffix'}, 404, 'foo.suffix', 'GET')
+    _cors_request_and_check(requests.put, obj_url, {'Origin': 'foo.suffix', 'Access-Control-Request-Method': 'GET',
+                                                    'content-length': '0'}, 403, 'foo.suffix', 'GET')
+    _cors_request_and_check(requests.put, obj_url, {'Origin': 'foo.suffix', 'Access-Control-Request-Method': 'PUT',
+                                                    'content-length': '0'}, 403, None, None)
+
+    _cors_request_and_check(requests.put, obj_url, {'Origin': 'foo.suffix', 'Access-Control-Request-Method': 'DELETE',
+                                                    'content-length': '0'}, 403, None, None)
+    _cors_request_and_check(requests.put, obj_url, {'Origin': 'foo.suffix', 'content-length': '0'}, 403, None, None)
+
+    _cors_request_and_check(requests.put, obj_url, {'Origin': 'foo.put', 'content-length': '0'}, 403, 'foo.put', 'PUT')
+
+    _cors_request_and_check(requests.get, obj_url, {'Origin': 'foo.suffix'}, 404, 'foo.suffix', 'GET')
+
+    _cors_request_and_check(requests.options, url, None, 400, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'foo.suffix'}, 400, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'bla'}, 400, None, None)
+    _cors_request_and_check(requests.options, obj_url, {'Origin': 'foo.suffix', 'Access-Control-Request-Method': 'GET',
+                                                    'content-length': '0'}, 200, 'foo.suffix', 'GET')
+    _cors_request_and_check(requests.options, url, {'Origin': 'foo.bar', 'Access-Control-Request-Method': 'GET'}, 403, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'foo.suffix.get', 'Access-Control-Request-Method': 'GET'}, 403, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'startend', 'Access-Control-Request-Method': 'GET'}, 200, 'startend', 'GET')
+    _cors_request_and_check(requests.options, url, {'Origin': 'start1end', 'Access-Control-Request-Method': 'GET'}, 200, 'start1end', 'GET')
+    _cors_request_and_check(requests.options, url, {'Origin': 'start12end', 'Access-Control-Request-Method': 'GET'}, 200, 'start12end', 'GET')
+    _cors_request_and_check(requests.options, url, {'Origin': '0start12end', 'Access-Control-Request-Method': 'GET'}, 403, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'prefix', 'Access-Control-Request-Method': 'GET'}, 200, 'prefix', 'GET')
+    _cors_request_and_check(requests.options, url, {'Origin': 'prefix.suffix', 'Access-Control-Request-Method': 'GET'}, 200, 'prefix.suffix', 'GET')
+    _cors_request_and_check(requests.options, url, {'Origin': 'bla.prefix', 'Access-Control-Request-Method': 'GET'}, 403, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'foo.put', 'Access-Control-Request-Method': 'GET'}, 403, None, None)
+    _cors_request_and_check(requests.options, url, {'Origin': 'foo.put', 'Access-Control-Request-Method': 'PUT'}, 200, 'foo.put', 'PUT')
+
+def test_cors_origin_wildcard():
+    bucket_name = _setup_bucket_acl(bucket_acl='public-read')
+    client = get_client()
+
+    cors_config ={
+        'CORSRules': [
+            {'AllowedMethods': ['GET'],
+             'AllowedOrigins': ['*'],
+            },
+        ]
+    }
+
+    e = assert_raises(ClientError, client.get_bucket_cors, Bucket=bucket_name)
+    status = _get_status(e.response)
+    assert status == 404
+
+    client.put_bucket_cors(Bucket=bucket_name, CORSConfiguration=cors_config)
+
+    time.sleep(3)
+
+    url = _get_post_url(bucket_name)
+
+    _cors_request_and_check(requests.get, url, None, 200, None, None)
+    _cors_request_and_check(requests.get, url, {'Origin': 'example.origin'}, 200, '*', 'GET')
+
+def test_cors_header_option():
+    bucket_name = _setup_bucket_acl(bucket_acl='public-read')
+    client = get_client()
+
+    cors_config ={
+        'CORSRules': [
+            {'AllowedMethods': ['GET'],
+             'AllowedOrigins': ['*'],
+             'ExposeHeaders': ['x-amz-meta-header1'],
+            },
+        ]
+    }
+
+    e = assert_raises(ClientError, client.get_bucket_cors, Bucket=bucket_name)
+    status = _get_status(e.response)
+    assert status == 404
+
+    client.put_bucket_cors(Bucket=bucket_name, CORSConfiguration=cors_config)
+
+    time.sleep(3)
+
+    url = _get_post_url(bucket_name)
+    obj_url = '{u}/{o}'.format(u=url, o='bar')
+
+    _cors_request_and_check(requests.options, obj_url, {'Origin': 'example.origin','Access-Control-Request-Headers':'x-amz-meta-header2','Access-Control-Request-Method':'GET'}, 403, None, None)
+
+def _test_cors_options_presigned_method(client, method, cannedACL=None):
+    bucket_name = _setup_bucket_object_acl('public-read', 'public-read', client=client)
+    params = {'Bucket': bucket_name, 'Key': 'foo'}
+
+    if cannedACL is not None:
+        params['ACL'] = cannedACL
+
+    if method == 'get_object':
+        httpMethod = 'GET'
+    elif method == 'put_object':
+        httpMethod = 'PUT'
+    else:
+        raise ValueError('invalid method')
+
+    url = client.generate_presigned_url(ClientMethod=method, Params=params, ExpiresIn=100000, HttpMethod=httpMethod)
+
+    res = requests.options(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 400
+
+    allowed_methods = [httpMethod]
+    allowed_origins = ['example']
+
+    cors_config ={
+        'CORSRules': [
+            {'AllowedMethods': allowed_methods,
+             'AllowedOrigins': allowed_origins,
+            },
+        ]
+    }
+
+    client.put_bucket_cors(Bucket=bucket_name, CORSConfiguration=cors_config)
+
+    headers = {
+        'Origin': 'example',
+        'Access-Control-Request-Method': httpMethod,
+    }
+    _cors_request_and_check(requests.options, url, headers,
+                            200, 'example', httpMethod)
+
+def test_cors_presigned_get_object():
+    _test_cors_options_presigned_method(
+        client=get_client(),
+        method='get_object',
+    )
+
+def test_cors_presigned_get_object_tenant():
+    _test_cors_options_presigned_method(
+        client=get_tenant_client(),
+        method='get_object',
+    )
+
+@pytest.mark.fails_on_rgw
+def test_cors_presigned_get_object_v2():
+    _test_cors_options_presigned_method(
+        client=get_v2_client(),
+        method='get_object',
+    )
+
+@pytest.mark.fails_on_rgw
+def test_cors_presigned_get_object_tenant_v2():
+    _test_cors_options_presigned_method(
+        client=get_v2_tenant_client(),
+        method='get_object',
+    )
+
+def test_cors_presigned_put_object():
+    _test_cors_options_presigned_method(
+        client=get_client(),
+        method='put_object',
+    )
+
+def test_cors_presigned_put_object_with_acl():
+    _test_cors_options_presigned_method(
+        client=get_client(),
+        method='put_object',
+        cannedACL='private',
+    )
+
+@pytest.mark.fails_on_rgw
+def test_cors_presigned_put_object_v2():
+    _test_cors_options_presigned_method(
+        client=get_v2_client(),
+        method='put_object',
+    )
+
+@pytest.mark.fails_on_rgw
+def test_cors_presigned_put_object_tenant_v2():
+    _test_cors_options_presigned_method(
+        client=get_v2_tenant_client(),
+        method='put_object',
+    )
+
+def test_cors_presigned_put_object_tenant():
+    _test_cors_options_presigned_method(
+        client=get_tenant_client(),
+        method='put_object',
+    )
+
+def test_cors_presigned_put_object_tenant_with_acl():
+    _test_cors_options_presigned_method(
+        client=get_tenant_client(),
+        method='put_object',
+        cannedACL='private',
+    )
+
+@pytest.mark.tagging
+def test_set_bucket_tagging():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    tags={
+        'TagSet': [
+            {
+                'Key': 'Hello',
+                'Value': 'World'
+            },
+        ]
+    }
+
+    e = assert_raises(ClientError, client.get_bucket_tagging, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchTagSet'
+
+    client.put_bucket_tagging(Bucket=bucket_name, Tagging=tags)
+
+    response = client.get_bucket_tagging(Bucket=bucket_name)
+    assert len(response['TagSet']) == 1
+    assert response['TagSet'][0]['Key'] == 'Hello'
+    assert response['TagSet'][0]['Value'] == 'World'
+
+    response = client.delete_bucket_tagging(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    e = assert_raises(ClientError, client.get_bucket_tagging, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchTagSet'
+
+
+class FakeFile(object):
+    """
+    file that simulates seek, tell, and current character
+    """
+    def __init__(self, char='A', interrupt=None):
+        self.offset = 0
+        self.char = bytes(char, 'utf-8')
+        self.interrupt = interrupt
+
+    def seek(self, offset, whence=os.SEEK_SET):
+        if whence == os.SEEK_SET:
+            self.offset = offset
+        elif whence == os.SEEK_END:
+            self.offset = self.size + offset;
+        elif whence == os.SEEK_CUR:
+            self.offset += offset
+
+    def tell(self):
+        return self.offset
+
+class FakeWriteFile(FakeFile):
+    """
+    file that simulates interruptable reads of constant data
+    """
+    def __init__(self, size, char='A', interrupt=None):
+        FakeFile.__init__(self, char, interrupt)
+        self.size = size
+
+    def read(self, size=-1):
+        if size < 0:
+            size = self.size - self.offset
+        count = min(size, self.size - self.offset)
+        self.offset += count
+
+        # Sneaky! do stuff before we return (the last time)
+        if self.interrupt != None and self.offset == self.size and count > 0:
+            self.interrupt()
+
+        return self.char*count
+
+class FakeReadFile(FakeFile):
+    """
+    file that simulates writes, interrupting after the second
+    """
+    def __init__(self, size, char='A', interrupt=None):
+        FakeFile.__init__(self, char, interrupt)
+        self.interrupted = False
+        self.size = 0
+        self.expected_size = size
+
+    def write(self, chars):
+        assert chars == self.char*len(chars)
+        self.offset += len(chars)
+        self.size += len(chars)
+
+        # Sneaky! do stuff on the second seek
+        if not self.interrupted and self.interrupt != None \
+                and self.offset > 0:
+            self.interrupt()
+            self.interrupted = True
+
+    def close(self):
+        assert self.size == self.expected_size
+
+class FakeFileVerifier(object):
+    """
+    file that verifies expected data has been written
+    """
+    def __init__(self, char=None):
+        self.char = char
+        self.size = 0
+
+    def write(self, data):
+        size = len(data)
+        if self.char == None:
+            self.char = data[0]
+        self.size += size
+        assert data.decode() == self.char*size
+
+def _verify_atomic_key_data(bucket_name, key, size=-1, char=None):
+    """
+    Make sure file is of the expected size and (simulated) content
+    """
+    fp_verify = FakeFileVerifier(char)
+    client = get_client()
+    client.download_fileobj(bucket_name, key, fp_verify)
+    if size >= 0:
+        assert fp_verify.size == size
+
+def _test_atomic_read(file_size):
+    """
+    Create a file of A's, use it to set_contents_from_file.
+    Create a file of B's, use it to re-set_contents_from_file.
+    Re-read the contents, and confirm we get B's
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+
+    fp_a = FakeWriteFile(file_size, 'A')
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=fp_a)
+
+    fp_b = FakeWriteFile(file_size, 'B')
+    fp_a2 = FakeReadFile(file_size, 'A',
+        lambda: client.put_object(Bucket=bucket_name, Key='testobj', Body=fp_b)
+        )
+
+    read_client = get_client()
+
+    read_client.download_fileobj(bucket_name, 'testobj', fp_a2)
+    fp_a2.close()
+
+    _verify_atomic_key_data(bucket_name, 'testobj', file_size, 'B')
+
+def test_atomic_read_1mb():
+    _test_atomic_read(1024*1024)
+
+def test_atomic_read_4mb():
+    _test_atomic_read(1024*1024*4)
+
+def test_atomic_read_8mb():
+    _test_atomic_read(1024*1024*8)
+
+def _test_atomic_write(file_size):
+    """
+    Create a file of A's, use it to set_contents_from_file.
+    Verify the contents are all A's.
+    Create a file of B's, use it to re-set_contents_from_file.
+    Before re-set continues, verify content's still A's
+    Re-read the contents, and confirm we get B's
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+    objname = 'testobj'
+
+
+    # create <file_size> file of A's
+    fp_a = FakeWriteFile(file_size, 'A')
+    client.put_object(Bucket=bucket_name, Key=objname, Body=fp_a)
+
+
+    # verify A's
+    _verify_atomic_key_data(bucket_name, objname, file_size, 'A')
+
+    # create <file_size> file of B's
+    # but try to verify the file before we finish writing all the B's
+    fp_b = FakeWriteFile(file_size, 'B',
+        lambda: _verify_atomic_key_data(bucket_name, objname, file_size, 'A')
+        )
+
+    client.put_object(Bucket=bucket_name, Key=objname, Body=fp_b)
+
+    # verify B's
+    _verify_atomic_key_data(bucket_name, objname, file_size, 'B')
+
+def test_atomic_write_1mb():
+    _test_atomic_write(1024*1024)
+
+def test_atomic_write_4mb():
+    _test_atomic_write(1024*1024*4)
+
+def test_atomic_write_8mb():
+    _test_atomic_write(1024*1024*8)
+
+def _test_atomic_dual_write(file_size):
+    """
+    create an object, two sessions writing different contents
+    confirm that it is all one or the other
+    """
+    bucket_name = get_new_bucket()
+    objname = 'testobj'
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key=objname)
+
+    # write <file_size> file of B's
+    # but before we're done, try to write all A's
+    fp_a = FakeWriteFile(file_size, 'A')
+
+    def rewind_put_fp_a():
+        fp_a.seek(0)
+        client.put_object(Bucket=bucket_name, Key=objname, Body=fp_a)
+
+    fp_b = FakeWriteFile(file_size, 'B', rewind_put_fp_a)
+    client.put_object(Bucket=bucket_name, Key=objname, Body=fp_b)
+
+    # verify the file
+    _verify_atomic_key_data(bucket_name, objname, file_size, 'B')
+
+def test_atomic_dual_write_1mb():
+    _test_atomic_dual_write(1024*1024)
+
+def test_atomic_dual_write_4mb():
+    _test_atomic_dual_write(1024*1024*4)
+
+def test_atomic_dual_write_8mb():
+    _test_atomic_dual_write(1024*1024*8)
+
+def _test_atomic_conditional_write(file_size):
+    """
+    Create a file of A's, use it to set_contents_from_file.
+    Verify the contents are all A's.
+    Create a file of B's, use it to re-set_contents_from_file.
+    Before re-set continues, verify content's still A's
+    Re-read the contents, and confirm we get B's
+    """
+    bucket_name = get_new_bucket()
+    objname = 'testobj'
+    client = get_client()
+
+    # create <file_size> file of A's
+    fp_a = FakeWriteFile(file_size, 'A')
+    client.put_object(Bucket=bucket_name, Key=objname, Body=fp_a)
+
+    fp_b = FakeWriteFile(file_size, 'B',
+        lambda: _verify_atomic_key_data(bucket_name, objname, file_size, 'A')
+        )
+
+    # create <file_size> file of B's
+    # but try to verify the file before we finish writing all the B's
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-Match': '*'}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=objname, Body=fp_b)
+
+    # verify B's
+    _verify_atomic_key_data(bucket_name, objname, file_size, 'B')
+
+@pytest.mark.fails_on_aws
+def test_atomic_conditional_write_1mb():
+    _test_atomic_conditional_write(1024*1024)
+
+def _test_atomic_dual_conditional_write(file_size):
+    """
+    create an object, two sessions writing different contents
+    confirm that it is all one or the other
+    """
+    bucket_name = get_new_bucket()
+    objname = 'testobj'
+    client = get_client()
+
+    fp_a = FakeWriteFile(file_size, 'A')
+    response = client.put_object(Bucket=bucket_name, Key=objname, Body=fp_a)
+    _verify_atomic_key_data(bucket_name, objname, file_size, 'A')
+    etag_fp_a = response['ETag'].replace('"', '')
+
+    # write <file_size> file of C's
+    # but before we're done, try to write all B's
+    fp_b = FakeWriteFile(file_size, 'B')
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({'If-Match': etag_fp_a}))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    def rewind_put_fp_b():
+        fp_b.seek(0)
+        client.put_object(Bucket=bucket_name, Key=objname, Body=fp_b)
+
+    fp_c = FakeWriteFile(file_size, 'C', rewind_put_fp_b)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=objname, Body=fp_c)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+    # verify the file
+    _verify_atomic_key_data(bucket_name, objname, file_size, 'B')
+
+@pytest.mark.fails_on_aws
+# TODO: test not passing with SSL, fix this
+@pytest.mark.fails_on_rgw
+def test_atomic_dual_conditional_write_1mb():
+    _test_atomic_dual_conditional_write(1024*1024)
+
+@pytest.mark.fails_on_aws
+# TODO: test not passing with SSL, fix this
+@pytest.mark.fails_on_rgw
+def test_atomic_write_bucket_gone():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    def remove_bucket():
+        client.delete_bucket(Bucket=bucket_name)
+
+    objname = 'foo'
+    fp_a = FakeWriteFile(1024*1024, 'A', remove_bucket)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=objname, Body=fp_a)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchBucket'
+
+def test_atomic_multipart_upload_write():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key='foo')
+    upload_id = response['UploadId']
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+    client.abort_multipart_upload(Bucket=bucket_name, Key='foo', UploadId=upload_id)
+
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    body = _get_body(response)
+    assert body == 'bar'
+
+class Counter:
+    def __init__(self, default_val):
+        self.val = default_val
+
+    def inc(self):
+        self.val = self.val + 1
+
+class ActionOnCount:
+    def __init__(self, trigger_count, action):
+        self.count = 0
+        self.trigger_count = trigger_count
+        self.action = action
+        self.result = 0
+
+    def trigger(self):
+        self.count = self.count + 1
+
+        if self.count == self.trigger_count:
+            self.result = self.action()
+
+def test_multipart_resend_first_finishes_last():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key_name = "mymultipart"
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key_name)
+    upload_id = response['UploadId']
+
+    #file_size = 8*1024*1024
+    file_size = 8
+
+    counter = Counter(0)
+    # upload_part might read multiple times from the object
+    # first time when it calculates md5, second time when it writes data
+    # out. We want to interject only on the last time, but we can't be
+    # sure how many times it's going to read, so let's have a test run
+    # and count the number of reads
+
+    fp_dry_run = FakeWriteFile(file_size, 'C',
+        lambda: counter.inc()
+        )
+
+    parts = []
+
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key_name, PartNumber=1, Body=fp_dry_run)
+
+    parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': 1})
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key_name, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    client.delete_object(Bucket=bucket_name, Key=key_name)
+
+    # clear parts
+    parts[:] = []
+
+    # ok, now for the actual test
+    fp_b = FakeWriteFile(file_size, 'B')
+    def upload_fp_b():
+        response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key_name, Body=fp_b, PartNumber=1)
+        parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': 1})
+
+    action = ActionOnCount(counter.val, lambda: upload_fp_b())
+
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key_name)
+    upload_id = response['UploadId']
+
+    fp_a = FakeWriteFile(file_size, 'A',
+        lambda: action.trigger()
+        )
+
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key_name, PartNumber=1, Body=fp_a)
+
+    parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': 1})
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key_name, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    _verify_atomic_key_data(bucket_name, key_name, file_size, 'A')
+
+@pytest.mark.fails_on_dbstore
+def test_ranged_request_response_code():
+    content = 'testcontent'
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=content)
+    response = client.get_object(Bucket=bucket_name, Key='testobj', Range='bytes=4-7')
+
+    fetched_content = _get_body(response)
+    assert fetched_content == content[4:8]
+    assert response['ResponseMetadata']['HTTPHeaders']['content-range'] == 'bytes 4-7/11'
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 206
+
+def _generate_random_string(size):
+    return ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(size))
+
+@pytest.mark.fails_on_dbstore
+def test_ranged_big_request_response_code():
+    content = _generate_random_string(8*1024*1024)
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=content)
+    response = client.get_object(Bucket=bucket_name, Key='testobj', Range='bytes=3145728-5242880')
+
+    fetched_content = _get_body(response)
+    assert fetched_content == content[3145728:5242881]
+    assert response['ResponseMetadata']['HTTPHeaders']['content-range'] == 'bytes 3145728-5242880/8388608'
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 206
+
+@pytest.mark.fails_on_dbstore
+def test_ranged_request_skip_leading_bytes_response_code():
+    content = 'testcontent'
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=content)
+    response = client.get_object(Bucket=bucket_name, Key='testobj', Range='bytes=4-')
+
+    fetched_content = _get_body(response)
+    assert fetched_content == content[4:]
+    assert response['ResponseMetadata']['HTTPHeaders']['content-range'] == 'bytes 4-10/11'
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 206
+
+@pytest.mark.fails_on_dbstore
+def test_ranged_request_return_trailing_bytes_response_code():
+    content = 'testcontent'
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=content)
+    response = client.get_object(Bucket=bucket_name, Key='testobj', Range='bytes=-7')
+
+    fetched_content = _get_body(response)
+    assert fetched_content == content[-7:]
+    assert response['ResponseMetadata']['HTTPHeaders']['content-range'] == 'bytes 4-10/11'
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 206
+
+def test_ranged_request_invalid_range():
+    content = 'testcontent'
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=content)
+
+    # test invalid range
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='testobj', Range='bytes=40-50')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 416
+    assert error_code == 'InvalidRange'
+
+def test_ranged_request_empty_object():
+    content = ''
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=content)
+
+    # test invalid range
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='testobj', Range='bytes=40-50')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 416
+    assert error_code == 'InvalidRange'
+
+def test_versioning_bucket_create_suspend():
+    bucket_name = get_new_bucket()
+    check_versioning(bucket_name, None)
+
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+
+def check_obj_content(client, bucket_name, key, version_id, content):
+    response = client.get_object(Bucket=bucket_name, Key=key, VersionId=version_id)
+    if content is not None:
+        body = _get_body(response)
+        assert body == content
+    else:
+        assert response['DeleteMarker'] == True
+
+def check_obj_versions(client, bucket_name, key, version_ids, contents):
+    # check to see if objects is pointing at correct version
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    versions = []
+    versions = response['Versions']
+    # obj versions in versions come out created last to first not first to last like version_ids & contents
+    versions.reverse()
+    i = 0
+
+    for version in versions:
+        assert version['VersionId'] == version_ids[i]
+        assert version['Key'] == key
+        check_obj_content(client, bucket_name, key, version['VersionId'], contents[i])
+        i += 1
+
+def create_multiple_versions(client, bucket_name, key, num_versions, version_ids = None, contents = None, check_versions = True):
+    contents = contents or []
+    version_ids = version_ids or []
+
+    for i in range(num_versions):
+        body = 'content-{i}'.format(i=i)
+        response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+        version_id = response['VersionId']
+
+        contents.append(body)
+        version_ids.append(version_id)
+
+#    if check_versions:
+#        check_obj_versions(client, bucket_name, key, version_ids, contents)
+
+    return (version_ids, contents)
+
+def remove_obj_version(client, bucket_name, key, version_ids, contents, index):
+    assert len(version_ids) == len(contents)
+    index = index % len(version_ids)
+    rm_version_id = version_ids.pop(index)
+    rm_content = contents.pop(index)
+
+    check_obj_content(client, bucket_name, key, rm_version_id, rm_content)
+
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=rm_version_id)
+
+    if len(version_ids) != 0:
+        check_obj_versions(client, bucket_name, key, version_ids, contents)
+
+def clean_up_bucket(client, bucket_name, key, version_ids):
+    for version_id in version_ids:
+        client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id)
+
+    client.delete_bucket(Bucket=bucket_name)
+
+def _do_test_create_remove_versions(client, bucket_name, key, num_versions, remove_start_idx, idx_inc):
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+
+    idx = remove_start_idx
+
+    for j in range(num_versions):
+        remove_obj_version(client, bucket_name, key, version_ids, contents, idx)
+        idx += idx_inc
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    if 'Versions' in response:
+        print(response['Versions'])
+
+
+def test_versioning_obj_create_read_remove():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_bucket_versioning(Bucket=bucket_name, VersioningConfiguration={'MFADelete': 'Disabled', 'Status': 'Enabled'})
+    key = 'testobj'
+    num_versions = 5
+
+    _do_test_create_remove_versions(client, bucket_name, key, num_versions, -1, 0)
+    _do_test_create_remove_versions(client, bucket_name, key, num_versions, -1, 0)
+    _do_test_create_remove_versions(client, bucket_name, key, num_versions, 0, 0)
+    _do_test_create_remove_versions(client, bucket_name, key, num_versions, 1, 0)
+    _do_test_create_remove_versions(client, bucket_name, key, num_versions, 4, -1)
+    _do_test_create_remove_versions(client, bucket_name, key, num_versions, 3, 3)
+
+def test_versioning_obj_create_read_remove_head():
+    bucket_name = get_new_bucket()
+
+    client = get_client()
+    client.put_bucket_versioning(Bucket=bucket_name, VersioningConfiguration={'MFADelete': 'Disabled', 'Status': 'Enabled'})
+    key = 'testobj'
+    num_versions = 5
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+
+    # removes old head object, checks new one
+    removed_version_id = version_ids.pop()
+    contents.pop()
+    num_versions = num_versions-1
+
+    response = client.delete_object(Bucket=bucket_name, Key=key, VersionId=removed_version_id)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == contents[-1]
+
+    # add a delete marker
+    response = client.delete_object(Bucket=bucket_name, Key=key)
+    assert response['DeleteMarker'] == True
+
+    delete_marker_version_id = response['VersionId']
+    version_ids.append(delete_marker_version_id)
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert len(response['Versions']) == num_versions
+    assert len(response['DeleteMarkers']) == 1
+    assert response['DeleteMarkers'][0]['VersionId'] == delete_marker_version_id
+
+    clean_up_bucket(client, bucket_name, key, version_ids)
+
+@pytest.mark.fails_on_dbstore
+def test_versioning_stack_delete_merkers():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    create_multiple_versions(client, bucket_name, "test1/a", 1)
+    client.delete_object(Bucket=bucket_name, Key="test1/a")
+    client.delete_object(Bucket=bucket_name, Key="test1/a")
+    client.delete_object(Bucket=bucket_name, Key="test1/a")
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    versions = response['Versions']
+    delete_markers = response['DeleteMarkers']
+    assert len(versions) == 1
+    assert len(delete_markers) == 3
+
+def test_versioning_obj_plain_null_version_removal():
+    bucket_name = get_new_bucket()
+    check_versioning(bucket_name, None)
+
+    client = get_client()
+    key = 'testobjfoo'
+    content = 'fooz'
+    client.put_object(Bucket=bucket_name, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId='null')
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+
+def test_versioning_obj_plain_null_version_overwrite():
+    bucket_name = get_new_bucket()
+    check_versioning(bucket_name, None)
+
+    client = get_client()
+    key = 'testobjfoo'
+    content = 'fooz'
+    client.put_object(Bucket=bucket_name, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    content2 = 'zzz'
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=content2)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == content2
+
+    version_id = response['VersionId']
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == content
+
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId='null')
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+
+def test_versioning_obj_plain_null_version_overwrite_suspended():
+    bucket_name = get_new_bucket()
+    check_versioning(bucket_name, None)
+
+    client = get_client()
+    key = 'testobjbar'
+    content = 'foooz'
+    client.put_object(Bucket=bucket_name, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+
+    content2 = 'zzz'
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=content2)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == content2
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    # original object with 'null' version id still counts as a version
+    assert len(response['Versions']) == 1
+
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId='null')
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchKey'
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+
+def delete_suspended_versioning_obj(client, bucket_name, key, version_ids, contents):
+    client.delete_object(Bucket=bucket_name, Key=key)
+
+    # clear out old null objects in lists since they will get overwritten
+    assert len(version_ids) == len(contents)
+    i = 0
+    for version_id in version_ids:
+        if version_id == 'null':
+            version_ids.pop(i)
+            contents.pop(i)
+        i += 1
+
+    return (version_ids, contents)
+
+def overwrite_suspended_versioning_obj(client, bucket_name, key, version_ids, contents, content):
+    client.put_object(Bucket=bucket_name, Key=key, Body=content)
+
+    # clear out old null objects in lists since they will get overwritten
+    assert len(version_ids) == len(contents)
+    i = 0
+    for version_id in version_ids:
+        if version_id == 'null':
+            version_ids.pop(i)
+            contents.pop(i)
+        i += 1
+
+    # add new content with 'null' version id to the end
+    contents.append(content)
+    version_ids.append('null')
+
+    return (version_ids, contents)
+
+
+def test_versioning_obj_suspend_versions():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'testobj'
+    num_versions = 5
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+
+    delete_suspended_versioning_obj(client, bucket_name, key, version_ids, contents)
+    delete_suspended_versioning_obj(client, bucket_name, key, version_ids, contents)
+
+    overwrite_suspended_versioning_obj(client, bucket_name, key, version_ids, contents, 'null content 1')
+    overwrite_suspended_versioning_obj(client, bucket_name, key, version_ids, contents, 'null content 2')
+    delete_suspended_versioning_obj(client, bucket_name, key, version_ids, contents)
+    overwrite_suspended_versioning_obj(client, bucket_name, key, version_ids, contents, 'null content 3')
+    delete_suspended_versioning_obj(client, bucket_name, key, version_ids, contents)
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, 3, version_ids, contents)
+    num_versions += 3
+
+    for idx in range(num_versions):
+        remove_obj_version(client, bucket_name, key, version_ids, contents, idx)
+
+    assert len(version_ids) == 0
+    assert len(version_ids) == len(contents)
+
+@pytest.mark.fails_on_dbstore
+def test_versioning_obj_suspended_copy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key1 = 'testobj1'
+    num_versions = 1
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key1, num_versions)
+
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+
+    content = 'null content'
+    overwrite_suspended_versioning_obj(client, bucket_name, key1, version_ids, contents, content)
+
+    # copy to another object
+    key2 = 'testobj2'
+    copy_source = {'Bucket': bucket_name, 'Key': key1}
+    client.copy_object(Bucket=bucket_name, Key=key2, CopySource=copy_source)
+
+    # copy to another non-versioned bucket
+    bucket_name2 = get_new_bucket()
+    copy_source = {'Bucket': bucket_name, 'Key': key1}
+    client.copy_object(Bucket=bucket_name2, Key=key1, CopySource=copy_source)
+
+    # delete the source object. keep the 'null' entry in version_ids
+    client.delete_object(Bucket=bucket_name, Key=key1)
+
+    # get the target object
+    response = client.get_object(Bucket=bucket_name, Key=key2)
+    body = _get_body(response)
+    assert body == content
+
+    # get the target object from the other bucket
+    response = client.get_object(Bucket=bucket_name2, Key=key1)
+    body = _get_body(response)
+    assert body == content
+
+    # cleaning up
+    client.delete_object(Bucket=bucket_name, Key=key2)
+    client.delete_object(Bucket=bucket_name, Key=key2, VersionId='null')
+    clean_up_bucket(client, bucket_name, key1, version_ids)
+
+    client.delete_object(Bucket=bucket_name2, Key=key1)
+    client.delete_bucket(Bucket=bucket_name2)
+
+def test_versioning_obj_create_versions_remove_all():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'testobj'
+    num_versions = 10
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+    for idx in range(num_versions):
+        remove_obj_version(client, bucket_name, key, version_ids, contents, idx)
+
+    assert len(version_ids) == 0
+    assert len(version_ids) == len(contents)
+
+def test_versioning_obj_create_versions_remove_special_names():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    keys = ['_testobj', '_', ':', ' ']
+    num_versions = 10
+
+    for key in keys:
+        (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+        for idx in range(num_versions):
+            remove_obj_version(client, bucket_name, key, version_ids, contents, idx)
+
+        assert len(version_ids) == 0
+        assert len(version_ids) == len(contents)
+
+@pytest.mark.fails_on_dbstore
+def test_versioning_obj_create_overwrite_multipart():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'testobj'
+    num_versions = 3
+    contents = []
+    version_ids = []
+
+    for i in range(num_versions):
+        ret =  _do_test_multipart_upload_contents(bucket_name, key, 3)
+        contents.append(ret)
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    for version in response['Versions']:
+        version_ids.append(version['VersionId'])
+
+    version_ids.reverse()
+    check_obj_versions(client, bucket_name, key, version_ids, contents)
+
+    for idx in range(num_versions):
+        remove_obj_version(client, bucket_name, key, version_ids, contents, idx)
+
+    assert len(version_ids) == 0
+    assert len(version_ids) == len(contents)
+
+def test_versioning_obj_list_marker():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'testobj'
+    key2 = 'testobj-1'
+    num_versions = 5
+
+    contents = []
+    version_ids = []
+    contents2 = []
+    version_ids2 = []
+
+    # for key #1
+    for i in range(num_versions):
+        body = 'content-{i}'.format(i=i)
+        response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+        version_id = response['VersionId']
+
+        contents.append(body)
+        version_ids.append(version_id)
+
+    # for key #2
+    for i in range(num_versions):
+        body = 'content-{i}'.format(i=i)
+        response = client.put_object(Bucket=bucket_name, Key=key2, Body=body)
+        version_id = response['VersionId']
+
+        contents2.append(body)
+        version_ids2.append(version_id)
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    versions = response['Versions']
+    # obj versions in versions come out created last to first not first to last like version_ids & contents
+    versions.reverse()
+
+    i = 0
+    # test the last 5 created objects first
+    for i in range(5):
+        version = versions[i]
+        assert version['VersionId'] == version_ids2[i]
+        assert version['Key'] == key2
+        check_obj_content(client, bucket_name, key2, version['VersionId'], contents2[i])
+        i += 1
+
+    # then the first 5
+    for j in range(5):
+        version = versions[i]
+        assert version['VersionId'] == version_ids[j]
+        assert version['Key'] == key
+        check_obj_content(client, bucket_name, key, version['VersionId'], contents[j])
+        i += 1
+
+@pytest.mark.fails_on_dbstore
+def test_versioning_copy_obj_version():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'testobj'
+    num_versions = 3
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+
+    for i in range(num_versions):
+        new_key_name = 'key_{i}'.format(i=i)
+        copy_source = {'Bucket': bucket_name, 'Key': key, 'VersionId': version_ids[i]}
+        client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key=new_key_name)
+        response = client.get_object(Bucket=bucket_name, Key=new_key_name)
+        body = _get_body(response)
+        assert body == contents[i]
+
+    another_bucket_name = get_new_bucket()
+
+    for i in range(num_versions):
+        new_key_name = 'key_{i}'.format(i=i)
+        copy_source = {'Bucket': bucket_name, 'Key': key, 'VersionId': version_ids[i]}
+        client.copy_object(Bucket=another_bucket_name, CopySource=copy_source, Key=new_key_name)
+        response = client.get_object(Bucket=another_bucket_name, Key=new_key_name)
+        body = _get_body(response)
+        assert body == contents[i]
+
+    new_key_name = 'new_key'
+    copy_source = {'Bucket': bucket_name, 'Key': key}
+    client.copy_object(Bucket=another_bucket_name, CopySource=copy_source, Key=new_key_name)
+
+    response = client.get_object(Bucket=another_bucket_name, Key=new_key_name)
+    body = _get_body(response)
+    assert body == contents[-1]
+
+def test_versioning_multi_object_delete():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'key'
+    num_versions = 2
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+    assert len(version_ids) == 2
+
+    # delete both versions
+    objects = [{'Key': key, 'VersionId': v} for v in version_ids]
+    client.delete_objects(Bucket=bucket_name, Delete={'Objects': objects})
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+
+    # now remove again, should all succeed due to idempotency
+    client.delete_objects(Bucket=bucket_name, Delete={'Objects': objects})
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+
+def test_versioning_multi_object_delete_with_marker():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'key'
+    num_versions = 2
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+    assert len(version_ids) == num_versions
+    objects = [{'Key': key, 'VersionId': v} for v in version_ids]
+
+    # create a delete marker
+    response = client.delete_object(Bucket=bucket_name, Key=key)
+    assert response['DeleteMarker']
+    objects += [{'Key': key, 'VersionId': response['VersionId']}]
+
+    # delete all versions
+    client.delete_objects(Bucket=bucket_name, Delete={'Objects': objects})
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+    assert not 'DeleteMarkers' in response
+
+    # now remove again, should all succeed due to idempotency
+    client.delete_objects(Bucket=bucket_name, Delete={'Objects': objects})
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+    assert not 'DeleteMarkers' in response
+
+@pytest.mark.fails_on_dbstore
+def test_versioning_multi_object_delete_with_marker_create():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'key'
+
+    # use delete_objects() to create a delete marker
+    response = client.delete_objects(Bucket=bucket_name, Delete={'Objects': [{'Key': key}]})
+    assert len(response['Deleted']) == 1
+    assert response['Deleted'][0]['DeleteMarker']
+    delete_marker_version_id = response['Deleted'][0]['DeleteMarkerVersionId']
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    delete_markers = response['DeleteMarkers']
+
+    assert len(delete_markers) == 1
+    assert delete_marker_version_id == delete_markers[0]['VersionId']
+    assert key == delete_markers[0]['Key']
+
+def test_versioned_object_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'xyz'
+    num_versions = 3
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+
+    version_id = version_ids[1]
+
+    response = client.get_object_acl(Bucket=bucket_name, Key=key, VersionId=version_id)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    assert response['Owner']['DisplayName'] == display_name
+    assert response['Owner']['ID'] == user_id
+
+    grants = response['Grants']
+    default_policy = [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ]
+
+    check_grants(grants, default_policy)
+
+    client.put_object_acl(ACL='public-read',Bucket=bucket_name, Key=key, VersionId=version_id)
+
+    response = client.get_object_acl(Bucket=bucket_name, Key=key, VersionId=version_id)
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+    client.put_object(Bucket=bucket_name, Key=key)
+
+    response = client.get_object_acl(Bucket=bucket_name, Key=key)
+    grants = response['Grants']
+    check_grants(grants, default_policy)
+
+@pytest.mark.fails_on_dbstore
+def test_versioned_object_acl_no_version_specified():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'xyz'
+    num_versions = 3
+
+    (version_ids, contents) = create_multiple_versions(client, bucket_name, key, num_versions)
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    version_id = response['VersionId']
+
+    response = client.get_object_acl(Bucket=bucket_name, Key=key, VersionId=version_id)
+
+    display_name = get_main_display_name()
+    user_id = get_main_user_id()
+
+    assert response['Owner']['DisplayName'] == display_name
+    assert response['Owner']['ID'] == user_id
+
+    grants = response['Grants']
+    default_policy = [
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ]
+
+    check_grants(grants, default_policy)
+
+    client.put_object_acl(ACL='public-read',Bucket=bucket_name, Key=key)
+
+    response = client.get_object_acl(Bucket=bucket_name, Key=key, VersionId=version_id)
+    grants = response['Grants']
+    check_grants(
+        grants,
+        [
+            dict(
+                Permission='READ',
+                ID=None,
+                DisplayName=None,
+                URI='http://acs.amazonaws.com/groups/global/AllUsers',
+                EmailAddress=None,
+                Type='Group',
+                ),
+            dict(
+                Permission='FULL_CONTROL',
+                ID=user_id,
+                DisplayName=display_name,
+                URI=None,
+                EmailAddress=None,
+                Type='CanonicalUser',
+                ),
+            ],
+        )
+
+def _do_create_object(client, bucket_name, key, i):
+    body = 'data {i}'.format(i=i)
+    client.put_object(Bucket=bucket_name, Key=key, Body=body)
+
+def _do_remove_ver(client, bucket_name, key, version_id):
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id)
+
+def _do_create_versioned_obj_concurrent(client, bucket_name, key, num):
+    t = []
+    for i in range(num):
+        thr = threading.Thread(target = _do_create_object, args=(client, bucket_name, key, i))
+        thr.start()
+        t.append(thr)
+    return t
+
+def _do_clear_versioned_bucket_concurrent(client, bucket_name):
+    t = []
+    response = client.list_object_versions(Bucket=bucket_name)
+    for version in response.get('Versions', []):
+        thr = threading.Thread(target = _do_remove_ver, args=(client, bucket_name, version['Key'], version['VersionId']))
+        thr.start()
+        t.append(thr)
+    return t
+
+def test_versioned_concurrent_object_create_concurrent_remove():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'myobj'
+    num_versions = 5
+
+    for i in range(5):
+        t = _do_create_versioned_obj_concurrent(client, bucket_name, key, num_versions)
+        _do_wait_completion(t)
+
+        response = client.list_object_versions(Bucket=bucket_name)
+        versions = response['Versions']
+
+        assert len(versions) == num_versions
+
+        t = _do_clear_versioned_bucket_concurrent(client, bucket_name)
+        _do_wait_completion(t)
+
+        response = client.list_object_versions(Bucket=bucket_name)
+        assert not 'Versions' in response
+
+def test_versioned_concurrent_object_create_and_remove():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    key = 'myobj'
+    num_versions = 3
+
+    all_threads = []
+
+    for i in range(3):
+
+        t = _do_create_versioned_obj_concurrent(client, bucket_name, key, num_versions)
+        all_threads.append(t)
+
+        t = _do_clear_versioned_bucket_concurrent(client, bucket_name)
+        all_threads.append(t)
+
+    for t in all_threads:
+        _do_wait_completion(t)
+
+    t = _do_clear_versioned_bucket_concurrent(client, bucket_name)
+    _do_wait_completion(t)
+
+    response = client.list_object_versions(Bucket=bucket_name)
+    assert not 'Versions' in response
+
+@pytest.mark.lifecycle
+def test_lifecycle_set():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 1}, 'Prefix': 'test1/', 'Status':'Enabled'},
+           {'ID': 'rule2', 'Expiration': {'Days': 2}, 'Prefix': 'test2/', 'Status':'Disabled'}]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+def test_lifecycle_get():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'test1/', 'Expiration': {'Days': 31}, 'Prefix': 'test1/', 'Status':'Enabled'},
+           {'ID': 'test2/', 'Expiration': {'Days': 120}, 'Prefix': 'test2/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    response = client.get_bucket_lifecycle_configuration(Bucket=bucket_name)
+    assert response['Rules'] == rules
+
+@pytest.mark.lifecycle
+def test_lifecycle_delete():
+    client = get_client()
+    bucket_name = get_new_bucket(client)
+
+    e = assert_raises(ClientError, client.get_bucket_lifecycle_configuration, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchLifecycleConfiguration'
+
+    # returns 204 even if there is no lifecycle config
+    response = client.delete_bucket_lifecycle(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    rules=[{'ID': 'test1/', 'Expiration': {'Days': 31}, 'Prefix': 'test1/', 'Status':'Enabled'},
+           {'ID': 'test2/', 'Expiration': {'Days': 120}, 'Prefix': 'test2/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    client.get_bucket_lifecycle_configuration(Bucket=bucket_name)
+
+    response = client.delete_bucket_lifecycle(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    e = assert_raises(ClientError, client.get_bucket_lifecycle_configuration, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'NoSuchLifecycleConfiguration'
+
+    # returns 204 even if there is no lifecycle config
+    response = client.delete_bucket_lifecycle(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+@pytest.mark.lifecycle
+def test_lifecycle_get_no_id():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    rules=[{'Expiration': {'Days': 31}, 'Prefix': 'test1/', 'Status':'Enabled'},
+           {'Expiration': {'Days': 120}, 'Prefix': 'test2/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    response = client.get_bucket_lifecycle_configuration(Bucket=bucket_name)
+    current_lc = response['Rules']
+
+    Rule = namedtuple('Rule',['prefix','status','days'])
+    rules = {'rule1' : Rule('test1/','Enabled',31),
+             'rule2' : Rule('test2/','Enabled',120)}
+
+    for lc_rule in current_lc:
+        if lc_rule['Prefix'] == rules['rule1'].prefix:
+            assert lc_rule['Expiration']['Days'] == rules['rule1'].days
+            assert lc_rule['Status'] == rules['rule1'].status
+            assert 'ID' in lc_rule
+        elif lc_rule['Prefix'] == rules['rule2'].prefix:
+            assert lc_rule['Expiration']['Days'] == rules['rule2'].days
+            assert lc_rule['Status'] == rules['rule2'].status
+            assert 'ID' in lc_rule
+        else:
+            # neither of the rules we supplied was returned, something wrong
+            print("rules not right")
+            assert False
+
+# The test harness for lifecycle is configured to treat days as 10 second intervals.
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration():
+    bucket_name = _create_objects(keys=['expire1/foo', 'expire1/bar', 'keep2/foo',
+                                        'keep2/bar', 'expire3/foo', 'expire3/bar'])
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 1}, 'Prefix': 'expire1/', 'Status':'Enabled'},
+           {'ID': 'rule2', 'Expiration': {'Days': 5}, 'Prefix': 'expire3/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    response = client.list_objects(Bucket=bucket_name)
+    init_objects = response['Contents']
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(3*lc_interval)
+    response = client.list_objects(Bucket=bucket_name)
+    expire1_objects = response['Contents']
+
+    time.sleep(lc_interval)
+    response = client.list_objects(Bucket=bucket_name)
+    keep2_objects = response['Contents']
+
+    time.sleep(3*lc_interval)
+    response = client.list_objects(Bucket=bucket_name)
+    expire3_objects = response['Contents']
+
+    assert len(init_objects) == 6
+    assert len(expire1_objects) == 4
+    assert len(keep2_objects) == 4
+    assert len(expire3_objects) == 2
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.list_objects_v2
+@pytest.mark.fails_on_dbstore
+def test_lifecyclev2_expiration():
+    bucket_name = _create_objects(keys=['expire1/foo', 'expire1/bar', 'keep2/foo',
+                                        'keep2/bar', 'expire3/foo', 'expire3/bar'])
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 1}, 'Prefix': 'expire1/', 'Status':'Enabled'},
+           {'ID': 'rule2', 'Expiration': {'Days': 5}, 'Prefix': 'expire3/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    response = client.list_objects_v2(Bucket=bucket_name)
+    init_objects = response['Contents']
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(3*lc_interval)
+    response = client.list_objects_v2(Bucket=bucket_name)
+    expire1_objects = response['Contents']
+
+    time.sleep(lc_interval)
+    response = client.list_objects_v2(Bucket=bucket_name)
+    keep2_objects = response['Contents']
+
+    time.sleep(3*lc_interval)
+    response = client.list_objects_v2(Bucket=bucket_name)
+    expire3_objects = response['Contents']
+
+    assert len(init_objects) == 6
+    assert len(expire1_objects) == 4
+    assert len(keep2_objects) == 4
+    assert len(expire3_objects) == 2
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+def test_lifecycle_expiration_versioning_enabled():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    create_multiple_versions(client, bucket_name, "test1/a", 1)
+    client.delete_object(Bucket=bucket_name, Key="test1/a")
+
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 1}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(3*lc_interval)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    versions = response['Versions']
+    delete_markers = response['DeleteMarkers']
+    assert len(versions) == 1
+    assert len(delete_markers) == 1
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+def test_lifecycle_expiration_tags1():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    tom_key = 'days1/tom'
+    tom_tagset = {'TagSet':
+                  [{'Key': 'tom', 'Value': 'sawyer'}]}
+
+    client.put_object(Bucket=bucket_name, Key=tom_key, Body='tom_body')
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key=tom_key,
+                                         Tagging=tom_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lifecycle_config = {
+        'Rules': [
+            {
+                'Expiration': {
+                    'Days': 1,
+                },
+                'ID': 'rule_tag1',
+                'Filter': {
+                    'Prefix': 'days1/',
+                    'Tag': {
+                        'Key': 'tom',
+                        'Value': 'sawyer'
+                    },
+                },
+                'Status': 'Enabled',
+            },
+        ]
+    }
+
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle_config)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(3*lc_interval)
+
+    try:
+        expire_objects = response['Contents']
+    except KeyError:
+        expire_objects = []
+
+    assert len(expire_objects) == 0
+
+# factor out common setup code
+def setup_lifecycle_tags2(client, bucket_name):
+    tom_key = 'days1/tom'
+    tom_tagset = {'TagSet':
+                  [{'Key': 'tom', 'Value': 'sawyer'}]}
+
+    client.put_object(Bucket=bucket_name, Key=tom_key, Body='tom_body')
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key=tom_key,
+                                         Tagging=tom_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    huck_key = 'days1/huck'
+    huck_tagset = {
+        'TagSet':
+        [{'Key': 'tom', 'Value': 'sawyer'},
+         {'Key': 'huck', 'Value': 'finn'}]}
+
+    client.put_object(Bucket=bucket_name, Key=huck_key, Body='huck_body')
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key=huck_key,
+                                         Tagging=huck_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lifecycle_config = {
+        'Rules': [
+            {
+                'Expiration': {
+                    'Days': 1,
+                },
+                'ID': 'rule_tag1',
+                'Filter': {
+                    'Prefix': 'days1/',
+                    'Tag': {
+                        'Key': 'tom',
+                        'Value': 'sawyer'
+                    },
+                    'And': {
+                        'Prefix': 'days1',
+                        'Tags': [
+                            {
+                                'Key': 'huck',
+                                'Value': 'finn'
+                            },
+                        ]
+                    }
+                },
+                'Status': 'Enabled',
+            },
+        ]
+    }
+
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle_config)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    return response
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_tags2():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = setup_lifecycle_tags2(client, bucket_name)
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(3*lc_interval)
+    response = client.list_objects(Bucket=bucket_name)
+    expire1_objects = response['Contents']
+
+    assert len(expire1_objects) == 1
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_versioned_tags2():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # mix in versioning
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    response = setup_lifecycle_tags2(client, bucket_name)
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(3*lc_interval)
+    response = client.list_objects(Bucket=bucket_name)
+    expire1_objects = response['Contents']
+
+    assert len(expire1_objects) == 1
+
+# setup for scenario based on vidushi mishra's in rhbz#1877737
+def setup_lifecycle_noncur_tags(client, bucket_name, days):
+
+    # first create and tag the objects (10 versions of 1)
+    key = "myobject_"
+    tagset = {'TagSet':
+              [{'Key': 'vidushi', 'Value': 'mishra'}]}
+
+    for ix in range(10):
+        body = "%s v%d" % (key, ix)
+        response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+        response = client.put_object_tagging(Bucket=bucket_name, Key=key,
+                                             Tagging=tagset)
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lifecycle_config = {
+        'Rules': [
+            {
+                'NoncurrentVersionExpiration': {
+                    'NoncurrentDays': days,
+                },
+                'ID': 'rule_tag1',
+                'Filter': {
+                    'Prefix': '',
+                    'Tag': {
+                        'Key': 'vidushi',
+                        'Value': 'mishra'
+                    },
+                },
+                'Status': 'Enabled',
+            },
+        ]
+    }
+
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle_config)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    return response
+
+def verify_lifecycle_expiration_noncur_tags(client, bucket_name, secs):
+    time.sleep(secs)
+    try:
+        response  = client.list_object_versions(Bucket=bucket_name)
+        objs_list = response['Versions']
+    except:
+        objs_list = []
+    return len(objs_list)
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_noncur_tags1():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    # create 10 object versions (9 noncurrent) and a tag-filter
+    # noncurrent version expiration at 4 "days"
+    response = setup_lifecycle_noncur_tags(client, bucket_name, 4)
+
+    lc_interval = get_lc_debug_interval()
+
+    num_objs = verify_lifecycle_expiration_noncur_tags(
+        client, bucket_name, 2*lc_interval)
+
+    # at T+20, 10 objects should exist
+    assert num_objs == 10
+
+    num_objs = verify_lifecycle_expiration_noncur_tags(
+        client, bucket_name, 5*lc_interval)
+
+    # at T+60, only the current object version should exist
+    assert num_objs == 1
+
+def wait_interval_list_object_versions(client, bucket_name, secs):
+    time.sleep(secs)
+    try:
+        response  = client.list_object_versions(Bucket=bucket_name)
+        objs_list = response['Versions']
+    except:
+        objs_list = []
+    return len(objs_list)
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_newer_noncurrent():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    # create 10 object versions (9 noncurrent)
+    key = "myobject_"
+
+    for ix in range(10):
+        body = "%s v%d" % (key, ix)
+        response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # add a lifecycle rule which sets newer-noncurrent-versions to 5
+    days = 1
+    lifecycle_config = {
+        'Rules': [
+            {
+                'NoncurrentVersionExpiration': {
+                    'NoncurrentDays': days,
+                    'NewerNoncurrentVersions': 5,
+                },
+                'ID': 'newer_noncurrent1',
+                'Filter': {
+                    'Prefix': '',
+                },
+                'Status': 'Enabled',
+            },
+        ]
+    }
+
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle_config)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lc_interval = get_lc_debug_interval()
+
+    num_objs = wait_interval_list_object_versions(
+        client, bucket_name, 2*lc_interval)
+
+    # at T+20, 6 objects should exist (1 current and (9 - 5) noncurrent)
+    assert num_objs == 6
+
+def get_byte_buffer(nbytes):
+    buf = BytesIO(b"")
+    for x in range(nbytes):
+        buf.write(b"b")
+    buf.seek(0)
+    return buf
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_size_gt():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    # create one object lt and one object gt 2000 bytes
+    key = "myobject_small"
+    body = get_byte_buffer(1000)
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    key = "myobject_big"
+    body = get_byte_buffer(3000)
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # add a lifecycle rule which expires objects greater than 2000 bytes
+    days = 1
+    lifecycle_config = {
+        'Rules': [
+            {
+                'Expiration': {
+                    'Days': days
+                },
+                'ID': 'object_gt1',
+                'Filter': {
+                    'Prefix': '',
+                    'ObjectSizeGreaterThan': 2000
+                },
+                'Status': 'Enabled',
+            },
+        ]
+    }
+
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle_config)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lc_interval = get_lc_debug_interval()
+    time.sleep(10*lc_interval)
+
+    # we should find only the small object present
+    response = client.list_objects(Bucket=bucket_name)
+    objects = response['Contents']
+
+    assert len(objects) == 1
+    assert objects[0]['Key'] == "myobject_small"
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_size_lt():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    # create one object lt and one object gt 2000 bytes
+    key = "myobject_small"
+    body = get_byte_buffer(1000)
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    key = "myobject_big"
+    body = get_byte_buffer(3000)
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # add a lifecycle rule which expires objects greater than 2000 bytes
+    days = 1
+    lifecycle_config = {
+        'Rules': [
+            {
+                'Expiration': {
+                    'Days': days
+                },
+                'ID': 'object_lt1',
+                'Filter': {
+                    'Prefix': '',
+                    'ObjectSizeLessThan': 2000
+                },
+                'Status': 'Enabled',
+            },
+        ]
+    }
+
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle_config)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lc_interval = get_lc_debug_interval()
+    time.sleep(2*lc_interval)
+
+    # we should find only the large object present
+    response = client.list_objects(Bucket=bucket_name)
+    objects = response['Contents']
+
+    assert len(objects) == 1
+    assert objects[0]['Key'] == "myobject_big"
+
+@pytest.mark.lifecycle
+def test_lifecycle_id_too_long():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 256*'a', 'Expiration': {'Days': 2}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+
+    e = assert_raises(ClientError, client.put_bucket_lifecycle_configuration, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.lifecycle
+def test_lifecycle_same_id():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 1}, 'Prefix': 'test1/', 'Status':'Enabled'},
+           {'ID': 'rule1', 'Expiration': {'Days': 2}, 'Prefix': 'test2/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+
+    e = assert_raises(ClientError, client.put_bucket_lifecycle_configuration, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.lifecycle
+def test_lifecycle_invalid_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 2}, 'Prefix': 'test1/', 'Status':'enabled'}]
+    lifecycle = {'Rules': rules}
+
+    e = assert_raises(ClientError, client.put_bucket_lifecycle_configuration, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 2}, 'Prefix': 'test1/', 'Status':'disabled'}]
+    lifecycle = {'Rules': rules}
+
+    e = assert_raises(ClientError, client.put_bucket_lifecycle, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+    rules=[{'ID': 'rule1', 'Expiration': {'Days': 2}, 'Prefix': 'test1/', 'Status':'invalid'}]
+    lifecycle = {'Rules': rules}
+
+    e = assert_raises(ClientError, client.put_bucket_lifecycle_configuration, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_date():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Date': '2017-09-27'}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_invalid_date():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Date': '20200101'}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+
+    e = assert_raises(ClientError, client.put_bucket_lifecycle_configuration, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_date():
+    bucket_name = _create_objects(keys=['past/foo', 'future/bar'])
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Date': '2015-01-01'}, 'Prefix': 'past/', 'Status':'Enabled'},
+           {'ID': 'rule2', 'Expiration': {'Date': '2030-01-01'}, 'Prefix': 'future/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    response = client.list_objects(Bucket=bucket_name)
+    init_objects = response['Contents']
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(3*lc_interval)
+    response = client.list_objects(Bucket=bucket_name)
+    expire_objects = response['Contents']
+
+    assert len(init_objects) == 2
+    assert len(expire_objects) == 1
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+def test_lifecycle_expiration_days0():
+    bucket_name = _create_objects(keys=['days0/foo', 'days0/bar'])
+    client = get_client()
+
+    rules=[{'Expiration': {'Days': 0}, 'ID': 'rule1', 'Prefix': 'days0/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+
+    # days: 0 is legal in a transition rule, but not legal in an
+    # expiration rule
+    response_code = ""
+    try:
+        response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    except botocore.exceptions.ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'InvalidArgument'
+
+
+def setup_lifecycle_expiration(client, bucket_name, rule_id, delta_days,
+                                    rule_prefix):
+    rules=[{'ID': rule_id,
+            'Expiration': {'Days': delta_days}, 'Prefix': rule_prefix,
+            'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    key = rule_prefix + 'foo'
+    body = 'bar'
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=body)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    return response
+
+def check_lifecycle_expiration_header(response, start_time, rule_id,
+                                      delta_days):
+    expr_exists = ('x-amz-expiration' in response['ResponseMetadata']['HTTPHeaders'])
+    if (not expr_exists):
+        return False
+    expr_hdr = response['ResponseMetadata']['HTTPHeaders']['x-amz-expiration']
+
+    m = re.search(r'expiry-date="(.+)", rule-id="(.+)"', expr_hdr)
+
+    expiration = dateutil.parser.parse(m.group(1))
+    days_to_expire = ((expiration.replace(tzinfo=None) - start_time).days == delta_days)
+    rule_eq_id = (m.group(2) == rule_id)
+
+    return  days_to_expire and rule_eq_id
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+def test_lifecycle_expiration_header_put():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    now = datetime.datetime.utcnow()
+    response = setup_lifecycle_expiration(
+        client, bucket_name, 'rule1', 1, 'days1/')
+    assert check_lifecycle_expiration_header(response, now, 'rule1', 1)
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_header_head():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    now = datetime.datetime.utcnow()
+    response = setup_lifecycle_expiration(
+        client, bucket_name, 'rule1', 1, 'days1/')
+
+    key = 'days1/' + 'foo'
+
+    # stat the object, check header
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert check_lifecycle_expiration_header(response, now, 'rule1', 1)
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_header_tags_head():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    lifecycle={
+        "Rules": [
+        {
+            "Filter": {
+                "Tag": {"Key": "key1", "Value": "tag1"}
+            },
+            "Status": "Enabled",
+            "Expiration": {
+                "Days": 1
+            },
+            "ID": "rule1"
+            },
+        ]
+    }
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    key1 = "obj_key1"
+    body1 = "obj_key1_body"
+    tags1={'TagSet': [{'Key': 'key1', 'Value': 'tag1'},
+          {'Key': 'key5','Value': 'tag5'}]}
+    response = client.put_object(Bucket=bucket_name, Key=key1, Body=body1)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key1,Tagging=tags1)
+
+    # stat the object, check header
+    response = client.head_object(Bucket=bucket_name, Key=key1)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert check_lifecycle_expiration_header(response, datetime.datetime.now(None), 'rule1', 1)
+
+    # test that header is not returning when it should not
+    lifecycle={
+        "Rules": [
+        {
+            "Filter": {
+                "Tag": {"Key": "key2", "Value": "tag1"}
+            },
+            "Status": "Enabled",
+            "Expiration": {
+                "Days": 1
+            },
+            "ID": "rule1"
+            },
+        ]
+    }
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    # stat the object, check header
+    response = client.head_object(Bucket=bucket_name, Key=key1)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert check_lifecycle_expiration_header(response, datetime.datetime.now(None), 'rule1', 1) == False
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_expiration_header_and_tags_head():
+    now = datetime.datetime.utcnow()
+    bucket_name = get_new_bucket()
+    client = get_client()
+    lifecycle={
+        "Rules": [
+        {
+            "Filter": {
+                "And": {
+                    "Tags": [
+                        {
+                            "Key": "key1",
+                            "Value": "tag1"
+                        },
+                        {
+                            "Key": "key5",
+                            "Value": "tag6"
+                        }
+                    ]
+                }
+            },
+            "Status": "Enabled",
+            "Expiration": {
+                "Days": 1
+            },
+            "ID": "rule1"
+            },
+        ]
+    }
+    response = client.put_bucket_lifecycle_configuration(
+        Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    key1 = "obj_key1"
+    body1 = "obj_key1_body"
+    tags1={'TagSet': [{'Key': 'key1', 'Value': 'tag1'},
+          {'Key': 'key5','Value': 'tag5'}]}
+    response = client.put_object(Bucket=bucket_name, Key=key1, Body=body1)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key1,Tagging=tags1)
+
+    # stat the object, check header
+    response = client.head_object(Bucket=bucket_name, Key=key1)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert check_lifecycle_expiration_header(response, datetime.datetime.now(None), 'rule1', 1) == False
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_noncurrent():
+    bucket_name = _create_objects(keys=['past/foo', 'future/bar'])
+    client = get_client()
+    rules=[{'ID': 'rule1', 'NoncurrentVersionExpiration': {'NoncurrentDays': 2}, 'Prefix': 'past/', 'Status':'Enabled'},
+           {'ID': 'rule2', 'NoncurrentVersionExpiration': {'NoncurrentDays': 3}, 'Prefix': 'future/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_noncur_expiration():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    create_multiple_versions(client, bucket_name, "test1/a", 3)
+    # not checking the object contents on the second run, because the function doesn't support multiple checks
+    create_multiple_versions(client, bucket_name, "test2/abc", 3, check_versions=False)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    init_versions = response['Versions']
+
+    rules=[{'ID': 'rule1', 'NoncurrentVersionExpiration': {'NoncurrentDays': 2}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(5*lc_interval)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    expire_versions = response['Versions']
+    assert len(init_versions) == 6
+    assert len(expire_versions) == 4
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_deletemarker():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'ExpiredObjectDeleteMarker': True}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_filter():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'ExpiredObjectDeleteMarker': True}, 'Filter': {'Prefix': 'foo'}, 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_empty_filter():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'ExpiredObjectDeleteMarker': True}, 'Filter': {}, 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_deletemarker_expiration():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    create_multiple_versions(client, bucket_name, "test1/a", 1)
+    create_multiple_versions(client, bucket_name, "test2/abc", 1, check_versions=False)
+    client.delete_object(Bucket=bucket_name, Key="test1/a")
+    client.delete_object(Bucket=bucket_name, Key="test2/abc")
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    init_versions = response['Versions']
+    deleted_versions = response['DeleteMarkers']
+    total_init_versions = init_versions + deleted_versions
+
+    rules=[{'ID': 'rule1', 'NoncurrentVersionExpiration': {'NoncurrentDays': 1}, 'Expiration': {'ExpiredObjectDeleteMarker': True}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(7*lc_interval)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    init_versions = response['Versions']
+    deleted_versions = response['DeleteMarkers']
+    total_expire_versions = init_versions + deleted_versions
+
+    assert len(total_init_versions) == 4
+    assert len(total_expire_versions) == 2
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_deletemarker_expiration_with_days_tag():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    create_multiple_versions(client, bucket_name, "test1/a", 1)
+    client.delete_object(Bucket=bucket_name, Key="test1/a")
+
+    rules=[{'ID': 'rule1', 'NoncurrentVersionExpiration': {'NoncurrentDays': 1}, 'Expiration': {'Days': 5}, 'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(2*lc_interval)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    versions = response['Versions'] if ('Versions' in response) else []
+    delete_markers = response['DeleteMarkers'] if ('DeleteMarkers' in response) else []
+
+    assert len(versions) == 0
+    assert len(delete_markers) == 1
+
+    time.sleep(4*lc_interval)
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    delete_markers = response['DeleteMarkers'] if ('DeleteMarkers' in response) else []
+
+    assert len(delete_markers) == 0
+
+@pytest.mark.lifecycle
+def test_lifecycle_set_multipart():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules = [
+        {'ID': 'rule1', 'Prefix': 'test1/', 'Status': 'Enabled',
+         'AbortIncompleteMultipartUpload': {'DaysAfterInitiation': 2}},
+        {'ID': 'rule2', 'Prefix': 'test2/', 'Status': 'Disabled',
+         'AbortIncompleteMultipartUpload': {'DaysAfterInitiation': 3}}
+    ]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_multipart_expiration():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key_names = ['test1/a', 'test2/']
+    upload_ids = []
+
+    for key in key_names:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+        upload_ids.append(response['UploadId'])
+
+    response = client.list_multipart_uploads(Bucket=bucket_name)
+    init_uploads = response['Uploads']
+
+    rules = [
+        {'ID': 'rule1', 'Prefix': 'test1/', 'Status': 'Enabled',
+         'AbortIncompleteMultipartUpload': {'DaysAfterInitiation': 2}},
+    ]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(5*lc_interval)
+
+    response = client.list_multipart_uploads(Bucket=bucket_name)
+    expired_uploads = response['Uploads']
+    assert len(init_uploads) == 2
+    assert len(expired_uploads) == 1
+
+@pytest.mark.lifecycle
+def test_lifecycle_transition_set_invalid_date():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Expiration': {'Date': '2023-09-27'},'Transitions': [{'Date': '20220927','StorageClass': 'GLACIER'}],'Prefix': 'test1/', 'Status':'Enabled'}]
+    lifecycle = {'Rules': rules}
+    e = assert_raises(ClientError, client.put_bucket_lifecycle_configuration, Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+def _test_encryption_sse_customer_write(file_size):
+    """
+    Tests Create a file of A's, use it to set_contents_from_file.
+    Create a file of B's, use it to re-set_contents_from_file.
+    Re-read the contents, and confirm we get B's
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'testobj'
+    data = 'A'*file_size
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == data
+
+# The test harness for lifecycle is configured to treat days as 10 second intervals.
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.fails_on_aws
+def test_lifecycle_transition():
+    sc = configured_storage_classes()
+    if len(sc) < 3:
+        pytest.skip('requires 3 or more storage classes')
+
+    bucket_name = _create_objects(keys=['expire1/foo', 'expire1/bar', 'keep2/foo',
+                                        'keep2/bar', 'expire3/foo', 'expire3/bar'])
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': sc[1]}], 'Prefix': 'expire1/', 'Status': 'Enabled'},
+           {'ID': 'rule2', 'Transitions': [{'Days': 6, 'StorageClass': sc[2]}], 'Prefix': 'expire3/', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    # Get list of all keys
+    response = client.list_objects(Bucket=bucket_name)
+    init_keys = _get_keys(response)
+    assert len(init_keys) == 6
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(4*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire1_keys['STANDARD']) == 4
+    assert len(expire1_keys[sc[1]]) == 2
+    assert len(expire1_keys[sc[2]]) == 0
+
+    # Wait for next expiration cycle
+    time.sleep(lc_interval)
+    keep2_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(keep2_keys['STANDARD']) == 4
+    assert len(keep2_keys[sc[1]]) == 2
+    assert len(keep2_keys[sc[2]]) == 0
+
+    # Wait for final expiration cycle
+    time.sleep(5*lc_interval)
+    expire3_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire3_keys['STANDARD']) == 2
+    assert len(expire3_keys[sc[1]]) == 2
+    assert len(expire3_keys[sc[2]]) == 2
+
+# The test harness for lifecycle is configured to treat days as 10 second intervals.
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.fails_on_aws
+def test_lifecycle_transition_single_rule_multi_trans():
+    sc = configured_storage_classes()
+    if len(sc) < 3:
+        pytest.skip('requires 3 or more storage classes')
+
+    bucket_name = _create_objects(keys=['expire1/foo', 'expire1/bar', 'keep2/foo',
+                                        'keep2/bar', 'expire3/foo', 'expire3/bar'])
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': sc[1]}, {'Days': 7, 'StorageClass': sc[2]}], 'Prefix': 'expire1/', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    # Get list of all keys
+    response = client.list_objects(Bucket=bucket_name)
+    init_keys = _get_keys(response)
+    assert len(init_keys) == 6
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(5*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire1_keys['STANDARD']) == 4
+    assert len(expire1_keys[sc[1]]) == 2
+    assert len(expire1_keys[sc[2]]) == 0
+
+    # Wait for next expiration cycle
+    time.sleep(lc_interval)
+    keep2_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(keep2_keys['STANDARD']) == 4
+    assert len(keep2_keys[sc[1]]) == 2
+    assert len(keep2_keys[sc[2]]) == 0
+
+    # Wait for final expiration cycle
+    time.sleep(6*lc_interval)
+    expire3_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire3_keys['STANDARD']) == 4
+    assert len(expire3_keys[sc[1]]) == 0
+    assert len(expire3_keys[sc[2]]) == 2
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+def test_lifecycle_set_noncurrent_transition():
+    sc = configured_storage_classes()
+    if len(sc) < 3:
+        pytest.skip('requires 3 or more storage classes')
+
+    bucket = get_new_bucket()
+    client = get_client()
+    rules = [
+        {
+            'ID': 'rule1',
+            'Prefix': 'test1/',
+            'Status': 'Enabled',
+            'NoncurrentVersionTransitions': [
+                {
+                    'NoncurrentDays': 2,
+                    'StorageClass': sc[1]
+                },
+                {
+                    'NoncurrentDays': 4,
+                    'StorageClass': sc[2]
+                }
+            ],
+            'NoncurrentVersionExpiration': {
+                'NoncurrentDays': 6
+            }
+        },
+        {'ID': 'rule2', 'Prefix': 'test2/', 'Status': 'Disabled', 'NoncurrentVersionExpiration': {'NoncurrentDays': 3}}
+    ]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.lifecycle_transition
+@pytest.mark.fails_on_aws
+def test_lifecycle_noncur_transition():
+    sc = configured_storage_classes()
+    if len(sc) < 3:
+        pytest.skip('requires 3 or more storage classes')
+
+    bucket = get_new_bucket()
+    client = get_client()
+
+    # before enabling versioning, create a plain entry
+    # which should get transitioned/expired similar to
+    # other non-current versioned entries.
+    key = 'test1/a'
+    content = 'fooz'
+    client.put_object(Bucket=bucket, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+
+    rules = [
+        {
+            'ID': 'rule1',
+            'Prefix': 'test1/',
+            'Status': 'Enabled',
+            'NoncurrentVersionTransitions': [
+                {
+                    'NoncurrentDays': 1,
+                    'StorageClass': sc[1]
+                },
+                {
+                    'NoncurrentDays': 5,
+                    'StorageClass': sc[2]
+                }
+            ],
+            'NoncurrentVersionExpiration': {
+                'NoncurrentDays': 9
+            }
+        }
+    ]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    create_multiple_versions(client, bucket, "test1/a", 2)
+    create_multiple_versions(client, bucket, "test1/b", 3)
+
+    init_keys = list_bucket_storage_class(client, bucket)
+    assert len(init_keys['STANDARD']) == 6
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(4*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 4
+    assert len(expire1_keys[sc[2]]) == 0
+
+    time.sleep(4*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 0
+    assert len(expire1_keys[sc[2]]) == 4
+
+    time.sleep(6*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 0
+    assert len(expire1_keys[sc[2]]) == 0
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.lifecycle_transition
+def test_lifecycle_plain_null_version_current_transition():
+    sc = configured_storage_classes()
+    if len(sc) < 2:
+        pytest.skip('requires 2 or more storage classes')
+
+    target_sc = sc[1]
+    assert target_sc != 'STANDARD'
+
+    bucket = get_new_bucket()
+    check_versioning(bucket, None)
+
+    # create a plain object before enabling versioning;
+    # this will be transitioned as a current version
+    client = get_client()
+    key = 'testobjfoo'
+    content = 'fooz'
+    client.put_object(Bucket=bucket, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+
+    client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration={
+            'Rules': [
+                {
+                    'ID': 'rule1',
+                    'Prefix': 'testobj',
+                    'Status': 'Enabled',
+                    'Transitions': [
+                        {
+                            'Days': 1,
+                            'StorageClass': target_sc
+                        },
+                    ]
+                }
+            ]
+        })
+
+    lc_interval = get_lc_debug_interval()
+    time.sleep(4*lc_interval)
+
+    keys = list_bucket_storage_class(client, bucket)
+    assert len(keys['STANDARD']) == 0
+    assert len(keys[target_sc]) == 1
+
+def verify_object(client, bucket, key, content=None, sc=None):
+    response = client.get_object(Bucket=bucket, Key=key)
+
+    if (sc == None):
+        sc = 'STANDARD'
+
+    if ('StorageClass' in response):
+        assert response['StorageClass'] == sc
+    else: #storage class should be STANDARD
+        assert 'STANDARD' == sc
+
+    if (content != None):
+        body = _get_body(response)
+        assert body == content
+
+def verify_transition(client, bucket, key, sc=None, version=None):
+    if (version != None):
+        response = client.head_object(Bucket=bucket, Key=key, VersionId=version)
+    else:
+        response = client.head_object(Bucket=bucket, Key=key)
+
+    # Iterate over the contents to find the StorageClass
+    if 'StorageClass' in response:
+        assert response['StorageClass'] == sc
+    else: # storage class should be STANDARD
+        assert 'STANDARD' == sc
+
+# The test harness for lifecycle is configured to treat days as 10 second intervals.
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.cloud_transition
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_cloud_transition():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc == None:
+        pytest.skip('no cloud_storage_class configured')
+
+    retain_head_object = get_cloud_retain_head_object()
+    target_path = get_cloud_target_path()
+    target_sc = get_cloud_target_storage_class()
+
+    keys=['expire1/foo', 'expire1/bar', 'keep2/foo', 'keep2/bar']
+    bucket_name = _create_objects(keys=keys)
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}], 'Prefix': 'expire1/', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    # Get list of all keys
+    response = client.list_objects(Bucket=bucket_name)
+    init_keys = _get_keys(response)
+    assert len(init_keys) == 4
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(10*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire1_keys['STANDARD']) == 2
+
+    if (retain_head_object != None and retain_head_object == "true"):
+        assert len(expire1_keys[cloud_sc]) == 2
+    else:
+        assert len(expire1_keys[cloud_sc]) == 0
+
+    time.sleep(2*lc_interval)
+    # Check if objects copied to target path
+    if target_path == None:
+        target_path = "rgwx-default-" + cloud_sc.lower() + "-cloud-bucket"
+    prefix = bucket_name + "/"
+
+    cloud_client = get_cloud_client()
+
+    time.sleep(12*lc_interval)
+    expire1_key1_str = prefix + keys[0]
+    verify_object(cloud_client, target_path, expire1_key1_str, keys[0], target_sc)
+
+    expire1_key2_str = prefix + keys[1]
+    verify_object(cloud_client, target_path, expire1_key2_str, keys[1], target_sc)
+
+    # Now verify the object on source rgw
+    src_key = keys[0]
+    if (retain_head_object != None and retain_head_object == "true"):
+        # verify HEAD response
+        response = client.head_object(Bucket=bucket_name, Key=keys[0])
+        assert 0 == response['ContentLength']
+        assert cloud_sc == response['StorageClass']
+
+        allow_readthrough = get_allow_read_through()
+        if (allow_readthrough == None or allow_readthrough == "false"):
+            # GET should return InvalidObjectState error
+            e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=src_key)
+            status, error_code = _get_status_and_error_code(e.response)
+            assert status == 403
+            assert error_code == 'InvalidObjectState'
+
+            # COPY of object should return InvalidObjectState error
+            copy_source = {'Bucket': bucket_name, 'Key': src_key}
+            e = assert_raises(ClientError, client.copy, CopySource=copy_source, Bucket=bucket_name, Key='copy_obj')
+            status, error_code = _get_status_and_error_code(e.response)
+            assert status == 403
+            assert error_code == 'InvalidObjectState'
+
+        # DELETE should succeed
+        response = client.delete_object(Bucket=bucket_name, Key=src_key)
+        e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=src_key)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 404
+        assert error_code == 'NoSuchKey'
+
+# Similar to 'test_lifecycle_transition' but for cloud transition
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.cloud_transition
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_cloud_multiple_transition():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc == None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    retain_head_object = get_cloud_retain_head_object()
+    target_path = get_cloud_target_path()
+    target_sc = get_cloud_target_storage_class()
+
+    sc1 = get_cloud_regular_storage_class()
+
+    if (sc1 == None):
+        pytest.skip('[s3 cloud] section missing storage_class')
+
+    sc = ['STANDARD', sc1, cloud_sc]
+
+    keys=['expire1/foo', 'expire1/bar', 'keep2/foo', 'keep2/bar']
+    bucket_name = _create_objects(keys=keys)
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': sc1}], 'Prefix': 'expire1/', 'Status': 'Enabled'},
+           {'ID': 'rule2', 'Transitions': [{'Days': 5, 'StorageClass': cloud_sc}], 'Prefix': 'expire1/', 'Status': 'Enabled'},
+           {'ID': 'rule3', 'Expiration': {'Days': 9}, 'Prefix': 'expire1/', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    # Get list of all keys
+    response = client.list_objects(Bucket=bucket_name)
+    init_keys = _get_keys(response)
+    assert len(init_keys) == 4
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(4*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 2
+    assert len(expire1_keys[sc[2]]) == 0
+
+    # Wait for next expiration cycle
+    time.sleep(7*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 0
+
+    if (retain_head_object != None and retain_head_object == "true"):
+        assert len(expire1_keys[sc[2]]) == 2
+    else:
+        assert len(expire1_keys[sc[2]]) == 0
+
+    # Wait for final expiration cycle
+    time.sleep(12*lc_interval)
+    expire3_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire3_keys['STANDARD']) == 2
+    assert len(expire3_keys[sc[1]]) == 0
+    assert len(expire3_keys[sc[2]]) == 0
+
+# Noncurrent objects for cloud transition
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.lifecycle_transition
+@pytest.mark.cloud_transition
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_noncur_cloud_transition():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc == None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    retain_head_object = get_cloud_retain_head_object()
+    target_path = get_cloud_target_path()
+    target_sc = get_cloud_target_storage_class()
+
+    sc1 = get_cloud_regular_storage_class()
+    if (sc1 == None):
+        pytest.skip('[s3 cloud] section missing storage_class')
+
+    sc = ['STANDARD', sc1, cloud_sc]
+
+    bucket = get_new_bucket()
+    client = get_client()
+
+    # before enabling versioning, create a plain entry
+    # which should get transitioned/expired similar to
+    # other non-current versioned entries.
+    key = 'test1/a'
+    content = 'fooz'
+    client.put_object(Bucket=bucket, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+
+    rules = [
+        {
+            'ID': 'rule1',
+            'Prefix': 'test1/',
+            'Status': 'Enabled',
+            'NoncurrentVersionTransitions': [
+                {
+                    'NoncurrentDays': 1,
+                    'StorageClass': sc[1]
+                },
+                {
+                    'NoncurrentDays': 5,
+                    'StorageClass': sc[2]
+                }
+            ],
+        }
+    ]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    keys = ['test1/a', 'test1/b']
+
+    create_multiple_versions(client, bucket, "test1/a", 2)
+    create_multiple_versions(client, bucket, "test1/b", 3)
+
+    init_keys = list_bucket_storage_class(client, bucket)
+    assert len(init_keys['STANDARD']) == 6
+
+    response  = client.list_object_versions(Bucket=bucket)
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(4*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 4
+    assert len(expire1_keys[sc[2]]) == 0
+
+    time.sleep(15*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 2
+    assert len(expire1_keys[sc[1]]) == 0
+
+    if (retain_head_object == None or retain_head_object == "false"):
+        assert len(expire1_keys[sc[2]]) == 0
+    else:
+        assert len(expire1_keys[sc[2]]) == 4
+
+    #check if versioned object exists on cloud endpoint
+    if target_path == None:
+        target_path = "rgwx-default-" + cloud_sc.lower() + "-cloud-bucket"
+    prefix = bucket + "/"
+
+    cloud_client = get_cloud_client()
+
+    time.sleep(lc_interval)
+    result = list_bucket_versions(client, bucket)
+
+    for src_key in keys:
+        for k in result[src_key]: 
+            expire1_key1_str = prefix + 'test1/a' + "-" + k['VersionId']
+            verify_object(cloud_client, target_path, expire1_key1_str, None, target_sc)
+
+# The test harness for lifecycle is configured to treat days as 10 second intervals.
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.cloud_transition
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_cloud_transition_large_obj():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc == None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    retain_head_object = get_cloud_retain_head_object()
+    target_path = get_cloud_target_path()
+    target_sc = get_cloud_target_storage_class()
+
+    bucket = get_new_bucket()
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}], 'Prefix': 'expire1/', 'Status': 'Enabled'}]
+
+    keys = ['keep/multi', 'expire1/multi']
+    size = 9*1024*1024
+    data = 'A'*size
+
+    for k in keys:
+        client.put_object(Bucket=bucket, Body=data, Key=k)
+        verify_object(client, bucket, k, data)
+
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for first expiration (plus fudge to handle the timer window)
+    time.sleep(12*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 1
+
+    
+    if (retain_head_object != None and retain_head_object == "true"):
+        assert len(expire1_keys[cloud_sc]) == 1
+    else:
+        assert len(expire1_keys[cloud_sc]) == 0
+
+    # Check if objects copied to target path
+    if target_path == None:
+        target_path = "rgwx-default-" + cloud_sc.lower() + "-cloud-bucket"
+    prefix = bucket + "/"
+
+    # multipart upload takes time
+    time.sleep(12*lc_interval)
+    cloud_client = get_cloud_client()
+
+    expire1_key1_str = prefix + keys[1]
+    verify_object(cloud_client, target_path, expire1_key1_str, data, target_sc)
+
+# Test for per-bucket cloud transition targeting (target_by_bucket=true)
+# When target_by_bucket is enabled:
+# 1. Each source bucket transitions to a dedicated target bucket
+# 2. Object keys are stored without the source bucket name prefix
+# 3. Target bucket names follow template: rgwx-${zonegroup}-${storage_class}-${bucket}
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.cloud_transition
+@pytest.mark.cloud_restore
+@pytest.mark.target_by_bucket
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_cloud_transition_target_by_bucket():
+    """
+    Test cloud transition with target_by_bucket=true.
+
+    Validates that when target_by_bucket is enabled:
+    1. Objects land in a bucket-specific target (not the shared target_path)
+    2. Object keys do NOT include the source bucket name as a prefix
+    3. Restore can locate and restore objects correctly
+    """
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    target_by_bucket = get_cloud_target_by_bucket()
+    if not target_by_bucket:
+        pytest.skip('[s3 cloud] target_by_bucket not enabled')
+
+    retain_head_object = get_cloud_retain_head_object()
+    target_sc = get_cloud_target_storage_class()
+    target_by_bucket_prefix = get_cloud_target_by_bucket_prefix()
+
+    client = get_client()
+    cloud_client = get_cloud_client()
+    lc_interval = get_lc_debug_interval()
+    restore_period = get_restore_processor_period()
+
+    # Create source bucket with test objects
+    bucket_name = get_new_bucket()
+    keys = ['file1.txt', 'subdir/file2.txt']
+
+    for key in keys:
+        client.put_object(Bucket=bucket_name, Key=key, Body=key)
+
+    # Configure lifecycle rule for cloud transition
+    rules = [{'ID': 'rule1',
+              'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}],
+              'Prefix': '',
+              'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    # Verify initial state
+    response = client.list_objects(Bucket=bucket_name)
+    init_keys = _get_keys(response)
+    assert len(init_keys) == len(keys)
+
+    # Wait for transition to complete
+    time.sleep(15 * lc_interval)
+
+    # Verify objects have transitioned in source bucket
+    expire_keys = list_bucket_storage_class(client, bucket_name)
+    if retain_head_object and retain_head_object.lower() == "true":
+        assert len(expire_keys.get(cloud_sc, [])) == len(keys), \
+            f"Expected {len(keys)} objects in {cloud_sc}, got {len(expire_keys.get(cloud_sc, []))}"
+
+    # Derive expected target bucket name
+    # Default template: rgwx-${zonegroup}-${storage_class}-${bucket}
+    if target_by_bucket_prefix:
+        expected_target = target_by_bucket_prefix.replace('${zonegroup}', 'default')
+        expected_target = expected_target.replace('${storage_class}', cloud_sc.lower())
+        expected_target = expected_target.replace('${bucket}', bucket_name)
+    else:
+        expected_target = f"rgwx-default-{cloud_sc.lower()}-{bucket_name}"
+
+    # Allow time for cloud operations to complete
+    time.sleep(5 * lc_interval)
+
+    # Verify objects in target bucket
+    # With target_by_bucket=true, keys should NOT have bucket_name prefix
+    for key in keys:
+        verify_object(cloud_client, expected_target, key, key, target_sc)
+
+        # Verify the old format (with bucket prefix) is NOT used
+        old_format_key = bucket_name + "/" + key
+        try:
+            cloud_client.head_object(Bucket=expected_target, Key=old_format_key)
+            assert False, f"Found old format key '{old_format_key}' - target_by_bucket not working"
+        except ClientError as e:
+            assert e.response['Error']['Code'] in ('404', 'NoSuchKey'), \
+                f"Unexpected error: {e}"
+
+    # Test restore functionality
+    restore_key = keys[0]
+
+    # Verify object is transitioned before attempting restore
+    verify_transition(client, bucket_name, restore_key, cloud_sc)
+
+    # Delete lifecycle to prevent re-transition after restore
+    client.delete_bucket_lifecycle(Bucket=bucket_name)
+
+    # Restore object temporarily
+    client.restore_object(Bucket=bucket_name, Key=restore_key, RestoreRequest={'Days': 2})
+    time.sleep(3 * restore_period)
+
+    # Verify object is restored temporarily (storage class stays cloud_sc, but content is accessible)
+    verify_transition(client, bucket_name, restore_key, cloud_sc)
+    response = client.head_object(Bucket=bucket_name, Key=restore_key)
+    assert response['ContentLength'] == len(restore_key)
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.cloud_transition
+@pytest.mark.cloud_restore
+@pytest.mark.target_by_bucket
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_lifecycle_cloud_transition_target_by_bucket_multiple_buckets():
+    """
+    Test that target_by_bucket properly isolates objects between buckets.
+    Also tests restore functionality for one of the buckets.
+    """
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    target_by_bucket = get_cloud_target_by_bucket()
+    if not target_by_bucket:
+        pytest.skip('[s3 cloud] target_by_bucket not enabled')
+
+    target_sc = get_cloud_target_storage_class()
+    target_by_bucket_prefix = get_cloud_target_by_bucket_prefix()
+
+    client = get_client()
+    cloud_client = get_cloud_client()
+    lc_interval = get_lc_debug_interval()
+    restore_period = get_restore_processor_period()
+
+    # Create two source buckets
+    bucket_a = get_new_bucket()
+    bucket_b = get_new_bucket()
+
+    key_a = 'only-in-a.txt'
+    key_b = 'only-in-b.txt'
+    client.put_object(Bucket=bucket_a, Key=key_a, Body='content-a')
+    client.put_object(Bucket=bucket_b, Key=key_b, Body='content-b')
+
+    # Configure lifecycle for both buckets
+    rules = [{'ID': 'rule1',
+              'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}],
+              'Prefix': '',
+              'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_a, LifecycleConfiguration=lifecycle)
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_b, LifecycleConfiguration=lifecycle)
+
+    # Wait for transitions
+    time.sleep(20 * lc_interval)
+
+    # Derive expected target bucket names
+    if target_by_bucket_prefix:
+        expected_target_a = target_by_bucket_prefix.replace('${zonegroup}', 'default')
+        expected_target_a = expected_target_a.replace('${storage_class}', cloud_sc.lower())
+        expected_target_a = expected_target_a.replace('${bucket}', bucket_a)
+        expected_target_b = target_by_bucket_prefix.replace('${zonegroup}', 'default')
+        expected_target_b = expected_target_b.replace('${storage_class}', cloud_sc.lower())
+        expected_target_b = expected_target_b.replace('${bucket}', bucket_b)
+    else:
+        expected_target_a = f"rgwx-default-{cloud_sc.lower()}-{bucket_a}"
+        expected_target_b = f"rgwx-default-{cloud_sc.lower()}-{bucket_b}"
+
+    # Verify isolation: target_a should have key_a, NOT key_b
+    verify_object(cloud_client, expected_target_a, key_a, 'content-a', target_sc)
+    try:
+        cloud_client.head_object(Bucket=expected_target_a, Key=key_b)
+        assert False, f"Isolation violation: '{key_b}' found in target_a"
+    except ClientError as e:
+        assert e.response['Error']['Code'] in ('404', 'NoSuchKey'), \
+            f"Unexpected error: {e}"
+
+    # Verify isolation: target_b should have key_b, NOT key_a
+    verify_object(cloud_client, expected_target_b, key_b, 'content-b', target_sc)
+    try:
+        cloud_client.head_object(Bucket=expected_target_b, Key=key_a)
+        assert False, f"Isolation violation: '{key_a}' found in target_b"
+    except ClientError as e:
+        assert e.response['Error']['Code'] in ('404', 'NoSuchKey'), \
+            f"Unexpected error: {e}"
+
+    # Test restore functionality on bucket_a
+    # Verify object is transitioned before attempting restore
+    verify_transition(client, bucket_a, key_a, cloud_sc)
+
+    # Delete lifecycle to prevent re-transition after restore
+    client.delete_bucket_lifecycle(Bucket=bucket_a)
+
+    # Restore object temporarily
+    client.restore_object(Bucket=bucket_a, Key=key_a, RestoreRequest={'Days': 2})
+    time.sleep(3 * restore_period)
+
+    # Verify object is restored temporarily (storage class stays cloud_sc, but content is accessible)
+    verify_transition(client, bucket_a, key_a, cloud_sc)
+    response = client.head_object(Bucket=bucket_a, Key=key_a)
+    assert response['ContentLength'] == len('content-a')
+
+@pytest.mark.cloud_restore
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_restore_object_temporary():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    bucket = get_new_bucket()
+    client = get_client()
+    key = 'test_restore_temp'
+    data = 'temporary restore data'
+
+    # Put object
+    client.put_object(Bucket=bucket, Key=key, Body=data)
+    verify_object(client, bucket, key, data)
+
+    # Transition object to cloud storage class
+    rules = [{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}], 'Prefix': '', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+    restore_interval = get_restore_debug_interval()
+    restore_period = get_restore_processor_period()
+    time.sleep(10 * lc_interval)
+
+    # Verify object is transitioned
+    verify_transition(client, bucket, key, cloud_sc)
+
+    # delete lifecycle to prevent re-transition before restore check
+    response = client.delete_bucket_lifecycle(Bucket=bucket)
+
+    # Restore object temporarily
+    client.restore_object(Bucket=bucket, Key=key, RestoreRequest={'Days': 20})
+    time.sleep(3*restore_period)
+
+    # Verify object is restored temporarily
+    verify_transition(client, bucket, key, cloud_sc)
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentLength'] == len(data)
+
+    # Now re-issue the request with 'Days' set to lower value
+    client.restore_object(Bucket=bucket, Key=key, RestoreRequest={'Days': 2})
+    time.sleep(2*restore_period)
+    # ensure the object is still restored
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentLength'] == len(data)
+
+    # now verify if the object is expired as per the updated days value
+    time.sleep(2 * (restore_interval + lc_interval))
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentLength'] == 0
+
+@pytest.mark.cloud_restore
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_restore_object_permanent():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+    
+    bucket = get_new_bucket()
+    client = get_client()
+    key = 'test_restore_perm'
+    data = 'permanent restore data'
+
+    # Put object
+    client.put_object(Bucket=bucket, Key=key, Body=data)
+    verify_object(client, bucket, key, data)
+
+    # Transition object to cloud storage class
+    rules = [{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}], 'Prefix': '', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+    time.sleep(10 * lc_interval)
+
+    # Verify object is transitioned
+    verify_transition(client, bucket, key, cloud_sc)
+
+    # delete lifecycle to prevent re-transition post permanent restore
+    response = client.delete_bucket_lifecycle(Bucket=bucket)
+
+    restore_period = get_restore_processor_period()
+    # Restore object permanently
+    client.restore_object(Bucket=bucket, Key=key, RestoreRequest={})
+    time.sleep(3*restore_period)
+
+    # Verify object is restored permanently
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert response['ContentLength'] == len(data)
+    verify_transition(client, bucket, key, 'STANDARD')
+
+@pytest.mark.cloud_restore
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_read_through():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    bucket = get_new_bucket()
+    client_config = botocore.config.Config(connect_timeout=100, read_timeout=100)
+    client = get_client(client_config=client_config)
+
+    key = 'test_restore_readthrough'
+    data = 'restore data with readthrough'
+
+     # Put object
+    client.put_object(Bucket=bucket, Key=key, Body=data)
+    verify_object(client, bucket, key, data)
+
+    # Transition object to cloud storage class
+    rules = [{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}], 'Prefix': '', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+    restore_interval = get_restore_debug_interval()
+    restore_period = get_restore_processor_period()
+    time.sleep(10 * lc_interval)
+
+    # Check the storage class after transitioning
+    verify_transition(client, bucket, key, cloud_sc)
+
+    # delete lifecycle to prevent re-transition before restore check
+    response = client.delete_bucket_lifecycle(Bucket=bucket)
+
+    # Restore the object using read_through request
+    allow_readthrough = get_allow_read_through()
+    read_through_days = get_read_through_days()
+    restore_period = get_restore_processor_period()
+
+    if (allow_readthrough != None and allow_readthrough == "true"):
+        try:
+            response = client.get_object(Bucket=bucket, Key=key)
+        except ClientError as e:
+            status, error_code = _get_status_and_error_code(e.response)
+            assert status == 400
+
+        time.sleep(2 * restore_period)
+        response = client.head_object(Bucket=bucket, Key=key)
+
+        assert response['ContentLength'] == len(data)
+        time.sleep(2 * read_through_days * (restore_interval + lc_interval))
+        # verify object expired
+        response = client.head_object(Bucket=bucket, Key=key)
+        assert response['ContentLength'] == 0
+    else:
+        e = assert_raises(ClientError, client.get_object, Bucket=bucket, Key=key)
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 403
+        assert error_code == 'InvalidObjectState'
+
+@pytest.mark.cloud_restore
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_restore_noncur_obj():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc == None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    retain_head_object = get_cloud_retain_head_object()
+    target_path = get_cloud_target_path()
+    target_sc = get_cloud_target_storage_class()
+
+    sc = ['STANDARD', cloud_sc]
+
+    bucket = get_new_bucket()
+    client = get_client()
+
+    # before enabling versioning, create a plain entry
+    # which should get transitioned/expired similar to
+    # other non-current versioned entries.
+    key = 'test1/a'
+    content = 'fooz'
+    client.put_object(Bucket=bucket, Key=key, Body=content)
+
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+
+    rules = [
+        {
+            'ID': 'rule1',
+            'Prefix': 'test1/',
+            'Status': 'Enabled',
+            'NoncurrentVersionTransitions': [
+                {
+                    'NoncurrentDays': 2,
+                    'StorageClass': cloud_sc
+                }
+            ],
+        }
+    ]
+    lifecycle = {'Rules': rules}
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    keys = ['test1/a']
+
+    (version_ids, contents) = create_multiple_versions(client, bucket, "test1/a", 2)
+
+    contents.append(content)
+
+    init_keys = list_bucket_storage_class(client, bucket)
+    print(init_keys)
+    assert len(init_keys['STANDARD']) == 3
+
+    version_ids = []
+    response = client.list_object_versions(Bucket=bucket)
+    for version in response['Versions']:
+        version_ids.append(version['VersionId'])
+
+    lc_interval = get_lc_debug_interval()
+
+    time.sleep(7*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket)
+    assert len(expire1_keys['STANDARD']) == 1
+    assert len(expire1_keys[cloud_sc]) == 2
+
+    restore_interval = get_restore_debug_interval()
+    restore_period = get_restore_processor_period()
+
+    for num in range(1, 2):
+        verify_transition(client, bucket, key, cloud_sc, version_ids[num])
+        # Restore object temporarily
+        client.restore_object(Bucket=bucket, Key=key, VersionId=version_ids[num], RestoreRequest={'Days': 2})
+        time.sleep(2*restore_period)
+
+        # Verify object is restored temporarily
+        response = client.head_object(Bucket=bucket, Key=key, VersionId=version_ids[num])
+        assert response['ContentLength'] == len(contents[num])
+        response  = client.list_object_versions(Bucket=bucket)
+        versions = response['Versions']
+        assert versions[1]['IsLatest'] == False
+
+    time.sleep(2 * (restore_interval + lc_interval))
+
+    #verify object expired
+    for num in range(1, 2):
+        response = client.head_object(Bucket=bucket, Key=key, VersionId=version_ids[num])
+        assert response['ContentLength'] == 0
+
+@pytest.mark.cloud_restore
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_list_objects_restore_status():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    bucket = get_new_bucket()
+    client = get_client()
+    temp_key = 'test_restore_status_temp'
+    perm_key = 'test_restore_status_perm'
+    data = 'restore status listing data'
+
+    client.put_object(Bucket=bucket, Key=temp_key, Body=data)
+    client.put_object(Bucket=bucket, Key=perm_key, Body=data)
+
+    response = client.list_objects_v2(
+        Bucket=bucket,
+        OptionalObjectAttributes=['RestoreStatus'])
+    objs = response['Contents']
+    assert len(objs) == 2
+    for o in objs:
+        assert 'RestoreStatus' not in o
+
+    response = client.list_objects(
+        Bucket=bucket,
+        OptionalObjectAttributes=['RestoreStatus'])
+    objs = response['Contents']
+    assert len(objs) == 2
+    for o in objs:
+        assert 'RestoreStatus' not in o
+
+    rules = [{'ID': 'rule1', 'Transitions': [{'Days': 1, 'StorageClass': cloud_sc}], 'Prefix': '', 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+    restore_period = get_restore_processor_period()
+    time.sleep(10 * lc_interval)
+
+    verify_transition(client, bucket, temp_key, cloud_sc)
+    verify_transition(client, bucket, perm_key, cloud_sc)
+
+    # delete lifecycle to prevent re-transition before restore check
+    client.delete_bucket_lifecycle(Bucket=bucket)
+
+    client.restore_object(Bucket=bucket, Key=temp_key, RestoreRequest={'Days': 20})
+    # permanent restore omits 'Days'
+    client.restore_object(Bucket=bucket, Key=perm_key, RestoreRequest={})
+    time.sleep(3 * restore_period)
+
+    response = client.list_objects_v2(
+        Bucket=bucket,
+        OptionalObjectAttributes=['RestoreStatus'])
+    objs = {o['Key']: o for o in response['Contents']}
+    assert len(objs) == 2
+    assert 'RestoreStatus' in objs[temp_key]
+    assert objs[temp_key]['RestoreStatus']['IsRestoreInProgress'] == False
+    assert 'RestoreExpiryDate' in objs[temp_key]['RestoreStatus']
+    assert 'RestoreStatus' in objs[perm_key]
+    assert objs[perm_key]['RestoreStatus']['IsRestoreInProgress'] == False
+    assert 'RestoreExpiryDate' not in objs[perm_key]['RestoreStatus']
+
+    response = client.list_objects(
+        Bucket=bucket,
+        OptionalObjectAttributes=['RestoreStatus'])
+    objs = {o['Key']: o for o in response['Contents']}
+    assert len(objs) == 2
+    assert 'RestoreStatus' in objs[temp_key]
+    assert objs[temp_key]['RestoreStatus']['IsRestoreInProgress'] == False
+    assert 'RestoreExpiryDate' in objs[temp_key]['RestoreStatus']
+    assert 'RestoreStatus' in objs[perm_key]
+    assert objs[perm_key]['RestoreStatus']['IsRestoreInProgress'] == False
+    assert 'RestoreExpiryDate' not in objs[perm_key]['RestoreStatus']
+
+    # without the header, RestoreStatus should not appear
+    response = client.list_objects_v2(Bucket=bucket)
+    objs = response['Contents']
+    assert len(objs) == 2
+    for o in objs:
+        assert 'RestoreStatus' not in o
+
+@pytest.mark.cloud_restore
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_list_object_versions_restore_status():
+    cloud_sc = get_cloud_storage_class()
+    if cloud_sc is None:
+        pytest.skip('[s3 cloud] section missing cloud_storage_class')
+
+    bucket = get_new_bucket()
+    client = get_client()
+
+    key = 'test1/a'
+    data = 'restore status versioned data'
+
+    # create initial version before enabling versioning
+    client.put_object(Bucket=bucket, Key=key, Body=data)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+
+    # create a new version so the original becomes non-current
+    (version_ids, contents) = create_multiple_versions(client, bucket, key, 1)
+
+    response = client.list_object_versions(
+        Bucket=bucket,
+        OptionalObjectAttributes=['RestoreStatus'])
+    for v in response['Versions']:
+        assert 'RestoreStatus' not in v
+
+    # transition non-current versions to cloud
+    rules = [{
+        'ID': 'rule1',
+        'Prefix': 'test1/',
+        'Status': 'Enabled',
+        'NoncurrentVersionTransitions': [{
+            'NoncurrentDays': 2,
+            'StorageClass': cloud_sc
+        }],
+    }]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+
+    lc_interval = get_lc_debug_interval()
+    restore_period = get_restore_processor_period()
+    time.sleep(7 * lc_interval)
+
+    # find the non-current version
+    response = client.list_object_versions(Bucket=bucket)
+    noncur_id = None
+    for v in response['Versions']:
+        if not v['IsLatest']:
+            noncur_id = v['VersionId']
+            break
+    assert noncur_id is not None
+
+    verify_transition(client, bucket, key, cloud_sc, noncur_id)
+
+    # delete lifecycle to prevent re-transition before restore check
+    client.delete_bucket_lifecycle(Bucket=bucket)
+
+    client.restore_object(Bucket=bucket, Key=key, VersionId=noncur_id, RestoreRequest={'Days': 20})
+    time.sleep(3 * restore_period)
+
+    response = client.list_object_versions(
+        Bucket=bucket,
+        OptionalObjectAttributes=['RestoreStatus'])
+    for v in response['Versions']:
+        if v['VersionId'] == noncur_id:
+            assert 'RestoreStatus' in v
+            assert v['RestoreStatus']['IsRestoreInProgress'] == False
+            assert 'RestoreExpiryDate' in v['RestoreStatus']
+        else:
+            assert 'RestoreStatus' not in v
+
+    response = client.list_object_versions(Bucket=bucket)
+    for v in response['Versions']:
+        assert 'RestoreStatus' not in v
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encrypted_transfer_1b():
+    _test_encryption_sse_customer_write(1)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encrypted_transfer_1kb():
+    _test_encryption_sse_customer_write(1024)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encrypted_transfer_1MB():
+    _test_encryption_sse_customer_write(1024*1024)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encrypted_transfer_13b():
+    _test_encryption_sse_customer_write(13)
+
+
+@pytest.mark.encryption
+def test_encryption_sse_c_method_head():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*1000
+    key = 'testobj'
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    e = assert_raises(ClientError, client.head_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.HeadObject', lf)
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.encryption
+def test_encryption_sse_c_present():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*1000
+    key = 'testobj'
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+def test_encryption_sse_c_other_key():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*100
+    key = 'testobj'
+    sse_client_headers_A = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+    sse_client_headers_B = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': '6b+WOZ1T3cqZMxgThRcXAQBrS5mXKdDUphvpxptl9/4=',
+        'x-amz-server-side-encryption-customer-key-md5': 'arxBvwY2V4SiOne6yppVPQ=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers_A))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers_B))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+def test_encryption_sse_c_invalid_md5():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*100
+    key = 'testobj'
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'AAAAAAAAAAAAAAAAAAAAAA=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key, Body=data)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+def test_encryption_sse_c_no_md5():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*100
+    key = 'testobj'
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key, Body=data)
+
+@pytest.mark.encryption
+def test_encryption_sse_c_no_key():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*100
+    key = 'testobj'
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key, Body=data)
+
+@pytest.mark.encryption
+def test_encryption_key_no_sse_c():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    data = 'A'*100
+    key = 'testobj'
+    sse_client_headers = {
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key, Body=data)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+def _multipart_upload_enc(client, bucket_name, key, size, part_size, init_headers, part_headers, metadata, resend_parts):
+    """
+    generate a multi-part upload for a random file of specifed size,
+    if requested, generate a list of the parts
+    return the upload descriptor
+    """
+    if client == None:
+        client = get_client()
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(init_headers))
+    client.meta.events.register('before-call.s3.CreateMultipartUpload', lf)
+    if metadata == None:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key)
+    else:
+        response = client.create_multipart_upload(Bucket=bucket_name, Key=key, Metadata=metadata)
+
+    upload_id = response['UploadId']
+    s = ''
+    parts = []
+    for i, part in enumerate(generate_random(size, part_size)):
+        # part_num is necessary because PartNumber for upload_part and in parts must start at 1 and i starts at 0
+        part_num = i+1
+        s += part
+        lf = (lambda **kwargs: kwargs['params']['headers'].update(part_headers))
+        client.meta.events.register('before-call.s3.UploadPart', lf)
+        response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num, Body=part)
+        parts.append({'ETag': response['ETag'].strip('"'), 'PartNumber': part_num})
+        if i in resend_parts:
+            lf = (lambda **kwargs: kwargs['params']['headers'].update(part_headers))
+            client.meta.events.register('before-call.s3.UploadPart', lf)
+            client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=part_num, Body=part)
+
+    return (upload_id, s, parts)
+
+def _check_content_using_range_enc(client, bucket_name, key, data, size, step, enc_headers=None):
+    for ofs in range(0, size, step):
+        toread = size - ofs
+        if toread > step:
+            toread = step
+        end = ofs + toread - 1
+        lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+        client.meta.events.register('before-call.s3.GetObject', lf)
+        r = 'bytes={s}-{e}'.format(s=ofs, e=end)
+        response = client.get_object(Bucket=bucket_name, Key=key, Range=r)
+        read_range = response['ContentLength']
+        body = _get_body(response)
+        assert read_range == toread
+        assert body == data[ofs:end+1]
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encryption_sse_c_multipart_upload():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    partlen = 5*1024*1024
+    metadata = {'foo': 'bar'}
+    enc_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        'Content-Type': content_type
+    }
+    resend_parts = []
+
+    (upload_id, data, parts) = _multipart_upload_enc(client, bucket_name, key, objlen,
+            part_size=partlen, init_headers=enc_headers, part_headers=enc_headers, metadata=metadata, resend_parts=resend_parts)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+    client.meta.events.register('before-call.s3.CompleteMultipartUpload', lf)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert len(response['Contents']) == 1
+    assert response['Contents'][0]['Size'] == objlen
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+
+    assert response['Metadata'] == metadata
+    assert response['ResponseMetadata']['HTTPHeaders']['content-type'] == content_type
+
+    body = _get_body(response)
+    assert body == data
+    size = response['ContentLength']
+    assert len(body) == size
+
+    _check_content_using_range_enc(client, bucket_name, key, data, size, 1000000, enc_headers=enc_headers)
+    _check_content_using_range_enc(client, bucket_name, key, data, size, 10000000, enc_headers=enc_headers)
+    for i in range(-1,2):
+        _check_content_using_range_enc(client, bucket_name, key, data, size, partlen + i, enc_headers=enc_headers)
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encryption_sse_c_unaligned_multipart_upload():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    partlen = 1 + 5 * 1024 * 1024 # not a multiple of the 4k encryption block size
+    metadata = {'foo': 'bar'}
+    enc_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        'Content-Type': content_type
+    }
+    resend_parts = []
+
+    (upload_id, data, parts) = _multipart_upload_enc(client, bucket_name, key, objlen,
+            part_size=partlen, init_headers=enc_headers, part_headers=enc_headers, metadata=metadata, resend_parts=resend_parts)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+    client.meta.events.register('before-call.s3.CompleteMultipartUpload', lf)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert len(response['Contents']) == 1
+    assert response['Contents'][0]['Size'] == objlen
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+
+    assert response['Metadata'] == metadata
+    assert response['ResponseMetadata']['HTTPHeaders']['content-type'] == content_type
+
+    body = _get_body(response)
+    assert body == data
+    size = response['ContentLength']
+    assert len(body) == size
+
+    _check_content_using_range_enc(client, bucket_name, key, data, size, 1000000, enc_headers=enc_headers)
+    _check_content_using_range_enc(client, bucket_name, key, data, size, 10000000, enc_headers=enc_headers)
+    for i in range(-1,2):
+        _check_content_using_range_enc(client, bucket_name, key, data, size, partlen + i, enc_headers=enc_headers)
+
+@pytest.mark.encryption
+# TODO: remove this fails_on_rgw when I fix it
+@pytest.mark.fails_on_rgw
+def test_encryption_sse_c_multipart_invalid_chunks_1():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    init_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        'Content-Type': content_type
+    }
+    part_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': '6b+WOZ1T3cqZMxgThRcXAQBrS5mXKdDUphvpxptl9/4=',
+        'x-amz-server-side-encryption-customer-key-md5': 'arxBvwY2V4SiOne6yppVPQ=='
+    }
+    resend_parts = []
+
+    e = assert_raises(ClientError, _multipart_upload_enc, client=client,  bucket_name=bucket_name,
+            key=key, size=objlen, part_size=5*1024*1024, init_headers=init_headers, part_headers=part_headers, metadata=metadata, resend_parts=resend_parts)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+# TODO: remove this fails_on_rgw when I fix it
+@pytest.mark.fails_on_rgw
+def test_encryption_sse_c_multipart_invalid_chunks_2():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    init_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        'Content-Type': content_type
+    }
+    part_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'AAAAAAAAAAAAAAAAAAAAAA=='
+    }
+    resend_parts = []
+
+    e = assert_raises(ClientError, _multipart_upload_enc, client=client,  bucket_name=bucket_name,
+            key=key, size=objlen, part_size=5*1024*1024, init_headers=init_headers, part_headers=part_headers, metadata=metadata, resend_parts=resend_parts)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+def test_encryption_sse_c_multipart_bad_download():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    put_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        'Content-Type': content_type
+    }
+    get_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': '6b+WOZ1T3cqZMxgThRcXAQBrS5mXKdDUphvpxptl9/4=',
+        'x-amz-server-side-encryption-customer-key-md5': 'arxBvwY2V4SiOne6yppVPQ=='
+    }
+    resend_parts = []
+
+    (upload_id, data, parts) = _multipart_upload_enc(client, bucket_name, key, objlen,
+            part_size=5*1024*1024, init_headers=put_headers, part_headers=put_headers, metadata=metadata, resend_parts=resend_parts)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(put_headers))
+    client.meta.events.register('before-call.s3.CompleteMultipartUpload', lf)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert len(response['Contents']) == 1
+    assert response['Contents'][0]['Size'] == objlen
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(put_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+
+    assert response['Metadata'] == metadata
+    assert response['ResponseMetadata']['HTTPHeaders']['content-type'] == content_type
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(get_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encryption_sse_c_post_object_authenticated_request():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["starts-with", "$x-amz-server-side-encryption-customer-algorithm", ""], \
+    ["starts-with", "$x-amz-server-side-encryption-customer-key", ""], \
+    ["starts-with", "$x-amz-server-side-encryption-customer-key-md5", ""], \
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),
+    ('x-amz-server-side-encryption-customer-algorithm', 'AES256'), \
+    ('x-amz-server-side-encryption-customer-key', 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs='), \
+    ('x-amz-server-side-encryption-customer-key-md5', 'DWygnHRtgiJ77HCm+1rvHw=='), \
+    ('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+
+    get_headers = {
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(get_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encryption_sse_c_enforced_with_bucket_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_unencrypted_obj = {
+        "Null" : {
+          "s3:x-amz-server-side-encryption-customer-algorithm": "true"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s = Statement("s3:PutObject", resource, effect="Deny", condition=deny_unencrypted_obj)
+    policy_document = p.add_statement(s).to_json()
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    check_access_denied(client.put_object, Bucket=bucket_name, Key='foo', Body='bar')
+
+    client.put_object(
+        Bucket=bucket_name, Key='foo', Body='bar',
+        SSECustomerAlgorithm='AES256',
+        SSECustomerKey='pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        SSECustomerKeyMD5='DWygnHRtgiJ77HCm+1rvHw=='
+    )
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_encryption_sse_c_deny_algo_with_bucket_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_incorrect_algo = {
+        "StringNotEquals": {
+          "s3:x-amz-server-side-encryption-customer-algorithm": "AES256"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s = Statement("s3:PutObject", resource, effect="Deny", condition=deny_incorrect_algo)
+    policy_document = p.add_statement(s).to_json()
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    check_access_denied(client.put_object, Bucket=bucket_name, Key='foo', SSECustomerAlgorithm='AES192')
+
+    client.put_object(
+        Bucket=bucket_name, Key='foo', Body='bar',
+        SSECustomerAlgorithm='AES256',
+        SSECustomerKey='pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        SSECustomerKeyMD5='DWygnHRtgiJ77HCm+1rvHw=='
+    )
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def _test_sse_kms_customer_write(file_size, key_id = 'testkey-1'):
+    """
+    Tests Create a file of A's, use it to set_contents_from_file.
+    Create a file of B's, use it to re-set_contents_from_file.
+    Re-read the contents, and confirm we get B's
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+    sse_kms_client_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': key_id
+    }
+    data = 'A'*file_size
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key='testobj', Body=data)
+
+    response = client.get_object(Bucket=bucket_name, Key='testobj')
+    body = _get_body(response)
+    assert body == data
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_method_head():
+    kms_keyid = get_main_kms_keyid()
+    bucket_name = get_new_bucket()
+    client = get_client()
+    sse_kms_client_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid
+    }
+    data = 'A'*1000
+    key = 'testobj'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'aws:kms'
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-aws-kms-key-id'] == kms_keyid
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.HeadObject', lf)
+    e = assert_raises(ClientError, client.head_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_present():
+    kms_keyid = get_main_kms_keyid()
+    bucket_name = get_new_bucket()
+    client = get_client()
+    sse_kms_client_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid
+    }
+    data = 'A'*100
+    key = 'testobj'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == data
+
+@pytest.mark.encryption
+def test_sse_kms_no_key():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    sse_kms_client_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+    }
+    data = 'A'*100
+    key = 'testobj'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key, Body=data)
+
+
+@pytest.mark.encryption
+def test_sse_kms_not_declared():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    sse_kms_client_headers = {
+        'x-amz-server-side-encryption-aws-kms-key-id': 'testkey-2'
+    }
+    data = 'A'*100
+    key = 'testobj'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key, Body=data)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_multipart_upload():
+    kms_keyid = get_main_kms_keyid()
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    enc_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid,
+        'Content-Type': content_type
+    }
+    resend_parts = []
+
+    (upload_id, data, parts) = _multipart_upload_enc(client, bucket_name, key, objlen,
+            part_size=5*1024*1024, init_headers=enc_headers, part_headers=enc_headers, metadata=metadata, resend_parts=resend_parts)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+    client.meta.events.register('before-call.s3.CompleteMultipartUpload', lf)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert len(response['Contents']) == 1
+    assert response['Contents'][0]['Size'] == objlen
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(part_headers))
+    client.meta.events.register('before-call.s3.UploadPart', lf)
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+
+    assert response['Metadata'] == metadata
+    assert response['ResponseMetadata']['HTTPHeaders']['content-type'] == content_type
+
+    body = _get_body(response)
+    assert body == data
+    size = response['ContentLength']
+    assert len(body) == size
+
+    _check_content_using_range(key, bucket_name, data, 1000000)
+    _check_content_using_range(key, bucket_name, data, 10000000)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_multipart_invalid_chunks_1():
+    kms_keyid = get_main_kms_keyid()
+    kms_keyid2 = get_secondary_kms_keyid()
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/bla'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    init_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid,
+        'Content-Type': content_type
+    }
+    part_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid2
+    }
+    resend_parts = []
+
+    _multipart_upload_enc(client, bucket_name, key, objlen, part_size=5*1024*1024,
+            init_headers=init_headers, part_headers=part_headers, metadata=metadata,
+            resend_parts=resend_parts)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_multipart_invalid_chunks_2():
+    kms_keyid = get_main_kms_keyid()
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    init_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid,
+        'Content-Type': content_type
+    }
+    part_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': 'testkey-not-present'
+    }
+    resend_parts = []
+
+    _multipart_upload_enc(client, bucket_name, key, objlen, part_size=5*1024*1024,
+            init_headers=init_headers, part_headers=part_headers, metadata=metadata,
+            resend_parts=resend_parts)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_post_object_authenticated_request():
+    kms_keyid = get_main_kms_keyid()
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["starts-with", "$x-amz-server-side-encryption", ""], \
+    ["starts-with", "$x-amz-server-side-encryption-aws-kms-key-id", ""], \
+    ["content-length-range", 0, 1024]\
+    ]\
+    }
+
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),
+    ('x-amz-server-side-encryption', 'aws:kms'), \
+    ('x-amz-server-side-encryption-aws-kms-key-id', kms_keyid), \
+    ('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_transfer_1b():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    _test_sse_kms_customer_write(1, key_id = kms_keyid)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_transfer_1kb():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    _test_sse_kms_customer_write(1024, key_id = kms_keyid)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_transfer_1MB():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    _test_sse_kms_customer_write(1024*1024, key_id = kms_keyid)
+
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_transfer_13b():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    _test_sse_kms_customer_write(13, key_id = kms_keyid)
+
+
+@pytest.mark.encryption
+def test_sse_kms_read_declare():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    sse_kms_client_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': 'testkey-1'
+    }
+    data = 'A'*100
+    key = 'testobj'
+
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_kms_client_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.bucket_policy
+def test_bucket_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    response = alt_client.list_objects(Bucket=bucket_name)
+    assert len(response['Contents']) == 1
+
+@pytest.mark.bucket_policy
+@pytest.mark.list_objects_v2
+def test_bucketv2_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    response = alt_client.list_objects_v2(Bucket=bucket_name)
+    assert len(response['Contents']) == 1
+
+@pytest.mark.bucket_policy
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_bucket_policy_deny_self_denied_policy(iam_root):
+    root_client = get_iam_root_client(service_name="s3")
+    bucket_name = get_new_bucket(root_client)
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Deny",
+        "Principal": "*",
+        "Action": [
+            "s3:PutBucketPolicy",
+            "s3:GetBucketPolicy",
+            "s3:DeleteBucketPolicy",
+        ],
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    root_client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    # non-root account should not be able to get, put or delete bucket policy
+    root_alt_client = create_iam_user_s3client(iam_root)
+    check_access_denied(root_alt_client.get_bucket_policy, Bucket=bucket_name)
+    check_access_denied(root_alt_client.delete_bucket_policy, Bucket=bucket_name)
+    check_access_denied(root_alt_client.put_bucket_policy, Bucket=bucket_name, Policy=policy_document)
+
+    # root account should be able to get, put or delete bucket policy
+    response = root_client.get_bucket_policy(Bucket=bucket_name)
+    assert response['Policy'] == policy_document
+    root_client.delete_bucket_policy(Bucket=bucket_name)
+    root_client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+@pytest.mark.bucket_policy
+@pytest.mark.iam_account
+@pytest.mark.iam_user
+def test_bucket_policy_deny_self_denied_policy_confirm_header(iam_root):
+    root_client = get_iam_root_client(service_name="s3")
+    bucket_name = get_new_bucket(root_client)
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Deny",
+        "Principal": "*",
+        "Action": [
+            "s3:PutBucketPolicy",
+            "s3:GetBucketPolicy",
+            "s3:DeleteBucketPolicy",
+        ],
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    root_client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document, ConfirmRemoveSelfBucketAccess=True)
+
+    # non-root account should not be able to get, put or delete bucket policy
+    root_alt_client = create_iam_user_s3client(iam_root)
+    check_access_denied(root_alt_client.get_bucket_policy, Bucket=bucket_name)
+    check_access_denied(root_alt_client.delete_bucket_policy, Bucket=bucket_name)
+    check_access_denied(root_alt_client.put_bucket_policy, Bucket=bucket_name, Policy=policy_document)
+
+    # root account should not be able to get, put or delete bucket policy
+    check_access_denied(root_client.get_bucket_policy, Bucket=bucket_name)
+    check_access_denied(root_client.delete_bucket_policy, Bucket=bucket_name)
+    check_access_denied(root_client.put_bucket_policy, Bucket=bucket_name, Policy=policy_document)
+
+@pytest.mark.bucket_policy
+def test_bucket_policy_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document =  json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Deny",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_acl(Bucket=bucket_name, ACL='authenticated-read')
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    e = assert_raises(ClientError, alt_client.list_objects, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    client.delete_bucket_policy(Bucket=bucket_name)
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+
+@pytest.mark.bucket_policy
+@pytest.mark.list_objects_v2
+def test_bucketv2_policy_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document =  json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Deny",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_acl(Bucket=bucket_name, ACL='authenticated-read')
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    e = assert_raises(ClientError, alt_client.list_objects_v2, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    client.delete_bucket_policy(Bucket=bucket_name)
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+
+@pytest.mark.bucket_policy
+def test_bucket_policy_different_tenant():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    # use the tenanted client to list the global tenant's bucket
+    tenant_client = get_tenant_client()
+    tenant_client.meta.events.unregister("before-parameter-build.s3", validate_bucket_name)
+    response = tenant_client.list_objects(Bucket=":{}".format(bucket_name))
+
+    assert len(response['Contents']) == 1
+
+@pytest.mark.bucket_policy
+def test_bucket_policy_multipart():
+    client = get_client()
+    alt_client = get_alt_client()
+    bucket_name = get_new_bucket(client)
+    key = 'mpobj'
+
+    # alt user has no permission
+    assert_raises(ClientError, alt_client.create_multipart_upload, Bucket=bucket_name, Key=key)
+
+    # grant permission on bucket ARN but not objects
+    client.put_bucket_policy(Bucket=bucket_name, Policy=json.dumps({
+            "Version": "2012-10-17",
+            "Statement": [{
+                "Effect": "Allow",
+                "Principal": {"AWS": "*"},
+                "Action": "s3:PutObject",
+                "Resource": f"arn:aws:s3:::{bucket_name}"
+            }]
+        }))
+    assert_raises(ClientError, alt_client.create_multipart_upload, Bucket=bucket_name, Key=key)
+
+    # grant permission on object ARN
+    client.put_bucket_policy(Bucket=bucket_name, Policy=json.dumps({
+            "Version": "2012-10-17",
+            "Statement": [{
+                "Effect": "Allow",
+                "Principal": {"AWS": "*"},
+                "Action": "s3:PutObject",
+                "Resource": f"arn:aws:s3:::{bucket_name}/{key}"
+            }]
+        }))
+    alt_client.create_multipart_upload(Bucket=bucket_name, Key=key)
+
+@pytest.mark.bucket_policy
+def test_bucket_policy_tenanted_bucket():
+    tenant_client = get_tenant_client()
+    bucket_name = get_new_bucket(tenant_client)
+    key = 'asdf'
+    tenant_client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    tenant_client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    tenant = get_tenant_name()
+
+    # use the global tenant's client to list the tenanted bucket
+    client = get_client()
+    client.meta.events.unregister("before-parameter-build.s3", validate_bucket_name)
+
+    response = client.list_objects(Bucket="{}:{}".format(tenant, bucket_name))
+    assert len(response['Contents']) == 1
+
+@pytest.mark.bucket_policy
+def test_bucket_policy_another_bucket():
+    bucket_name = get_new_bucket()
+    bucket_name2 = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    key2 = 'abcd'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+    client.put_object(Bucket=bucket_name2, Key=key2, Body='abcd')
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    response = client.get_bucket_policy(Bucket=bucket_name)
+    response_policy = response['Policy']
+
+    client.put_bucket_policy(Bucket=bucket_name2, Policy=response_policy)
+
+    alt_client = get_alt_client()
+    response = alt_client.list_objects(Bucket=bucket_name)
+    assert len(response['Contents']) == 1
+
+    alt_client = get_alt_client()
+    response = alt_client.list_objects(Bucket=bucket_name2)
+    assert len(response['Contents']) == 1
+
+@pytest.mark.bucket_policy
+@pytest.mark.list_objects_v2
+def test_bucketv2_policy_another_bucket():
+    bucket_name = get_new_bucket()
+    bucket_name2 = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    key2 = 'abcd'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+    client.put_object(Bucket=bucket_name2, Key=key2, Body='abcd')
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "arn:aws:s3:::*",
+            "arn:aws:s3:::*/*"
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    response = client.get_bucket_policy(Bucket=bucket_name)
+    response_policy = response['Policy']
+
+    client.put_bucket_policy(Bucket=bucket_name2, Policy=response_policy)
+
+    alt_client = get_alt_client()
+    response = alt_client.list_objects_v2(Bucket=bucket_name)
+    assert len(response['Contents']) == 1
+
+    alt_client = get_alt_client()
+    response = alt_client.list_objects_v2(Bucket=bucket_name2)
+    assert len(response['Contents']) == 1
+
+@pytest.mark.bucket_policy
+# TODO: remove this fails_on_rgw when I fix it
+@pytest.mark.fails_on_rgw
+def test_bucket_policy_set_condition_operator_end_with_IfExists():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'foo'
+    client.put_object(Bucket=bucket_name, Key=key)
+    policy = '''{
+      "Version":"2012-10-17",
+      "Statement": [{
+        "Sid": "Allow Public Access to All Objects",
+        "Effect": "Allow",
+        "Principal": "*",
+        "Action": "s3:GetObject",
+        "Condition": {
+                    "StringLikeIfExists": {
+                        "aws:Referer": "http://www.example.com/*"
+                    }
+                },
+        "Resource": "arn:aws:s3:::%s/*"
+      }
+     ]
+    }''' % bucket_name
+    # boto3.set_stream_logger(name='botocore')
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy)
+
+    request_headers={'referer': 'http://www.example.com/'}
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(request_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    request_headers={'referer': 'http://www.example.com/index.html'}
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(request_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # the 'referer' headers need to be removed for this one
+    #response = client.get_object(Bucket=bucket_name, Key=key)
+    #assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    request_headers={'referer': 'http://example.com'}
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(request_headers))
+    client.meta.events.register('before-call.s3.GetObject', lf)
+
+    # TODO: Compare Requests sent in Boto3, Wireshark, RGW Log for both boto and boto3
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    response =  client.get_bucket_policy(Bucket=bucket_name)
+    print(response)
+
+@pytest.mark.bucket_policy
+def test_set_get_del_bucket_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'asdf'
+    client.put_object(Bucket=bucket_name, Key=key, Body='asdf')
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    response = client.get_bucket_policy(Bucket=bucket_name)
+    response_policy = response['Policy']
+    assert policy_document == response_policy
+
+    client.delete_bucket_policy(Bucket=bucket_name)
+
+    try:
+        response = client.get_bucket_policy(Bucket=bucket_name)
+    except botocore.exceptions.ClientError as e:
+        print (e)
+        assert e.response['Error']['Code'] == 'NoSuchBucketPolicy'
+
+def _create_simple_tagset(count):
+    tagset = []
+    for i in range(count):
+        tagset.append({'Key': str(i), 'Value': str(i)})
+
+    return {'TagSet': tagset}
+
+def _make_random_string(size):
+    return ''.join(random.choice(string.ascii_letters) for _ in range(size))
+
+@pytest.mark.tagging
+def test_set_multipart_tagging():
+  bucket_name = get_new_bucket()
+  client = get_client()
+  tags='Hello=World&foo=bar'
+  key = "mymultipart"
+  objlen = 1
+
+  (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, tagging=tags)
+  response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+  assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+  response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+  assert len(response['TagSet']) == 2
+  assert response['TagSet'][0]['Key'] == 'Hello'
+  assert response['TagSet'][0]['Value'] == 'World'
+  assert response['TagSet'][1]['Key'] == 'foo'
+  assert response['TagSet'][1]['Value'] == 'bar'
+
+  response = client.delete_object_tagging(Bucket=bucket_name, Key=key)
+  assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+  response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+  assert len(response['TagSet']) == 0
+
+@pytest.mark.tagging
+@pytest.mark.fails_on_dbstore
+def test_get_obj_tagging():
+    key = 'testputtags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    input_tagset = _create_simple_tagset(2)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+
+@pytest.mark.tagging
+def test_get_obj_head_tagging():
+    key = 'testputtags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+    count = 2
+
+    input_tagset = _create_simple_tagset(count)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-tagging-count'] == str(count)
+
+@pytest.mark.tagging
+@pytest.mark.fails_on_dbstore
+def test_put_max_tags():
+    key = 'testputmaxtags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    input_tagset = _create_simple_tagset(10)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+@pytest.mark.tagging
+def test_put_excess_tags():
+    key = 'testputmaxtags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    input_tagset = _create_simple_tagset(11)
+    e = assert_raises(ClientError, client.put_object_tagging, Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidTag'
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert len(response['TagSet']) == 0
+
+@pytest.mark.tagging
+def test_put_max_kvsize_tags():
+    key = 'testputmaxkeysize'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    tagset = []
+    for i in range(10):
+        k = _make_random_string(128)
+        v = _make_random_string(256)
+        tagset.append({'Key': k, 'Value': v})
+
+    input_tagset = {'TagSet': tagset}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    for kv_pair in response['TagSet']:
+        assert kv_pair in input_tagset['TagSet']
+
+@pytest.mark.tagging
+def test_put_excess_key_tags():
+    key = 'testputexcesskeytags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    tagset = []
+    for i in range(10):
+        k = _make_random_string(129)
+        v = _make_random_string(256)
+        tagset.append({'Key': k, 'Value': v})
+
+    input_tagset = {'TagSet': tagset}
+
+    e = assert_raises(ClientError, client.put_object_tagging, Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidTag'
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert len(response['TagSet']) == 0
+
+@pytest.mark.tagging
+def test_put_excess_val_tags():
+    key = 'testputexcesskeytags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    tagset = []
+    for i in range(10):
+        k = _make_random_string(128)
+        v = _make_random_string(257)
+        tagset.append({'Key': k, 'Value': v})
+
+    input_tagset = {'TagSet': tagset}
+
+    e = assert_raises(ClientError, client.put_object_tagging, Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidTag'
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert len(response['TagSet']) == 0
+
+@pytest.mark.tagging
+@pytest.mark.fails_on_dbstore
+def test_put_modify_tags():
+    key = 'testputmodifytags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    tagset = []
+    tagset.append({'Key': 'key', 'Value': 'val'})
+    tagset.append({'Key': 'key2', 'Value': 'val2'})
+
+    input_tagset = {'TagSet': tagset}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+    tagset2 = []
+    tagset2.append({'Key': 'key3', 'Value': 'val3'})
+
+    input_tagset2 = {'TagSet': tagset2}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset2)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset2['TagSet']
+
+@pytest.mark.tagging
+@pytest.mark.fails_on_dbstore
+def test_put_delete_tags():
+    key = 'testputmodifytags'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    input_tagset = _create_simple_tagset(2)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+    response = client.delete_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert len(response['TagSet']) == 0
+
+@pytest.mark.tagging
+@pytest.mark.fails_on_dbstore
+def test_post_object_tags_anonymous_request():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    url = _get_post_url(bucket_name)
+    client.create_bucket(ACL='public-read-write', Bucket=bucket_name)
+
+    key_name = "foo.txt"
+    input_tagset = _create_simple_tagset(2)
+    # xml_input_tagset is the same as input_tagset in xml.
+    # There is not a simple way to change input_tagset to xml like there is in the boto2 tetss
+    xml_input_tagset = "<Tagging><TagSet><Tag><Key>0</Key><Value>0</Value></Tag><Tag><Key>1</Key><Value>1</Value></Tag></TagSet></Tagging>"
+
+
+    payload = OrderedDict([
+        ("key" , key_name),
+        ("acl" , "public-read"),
+        ("Content-Type" , "text/plain"),
+        ("tagging", xml_input_tagset),
+        ('file', ('bar')),
+    ])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key=key_name)
+    body = _get_body(response)
+    assert body == 'bar'
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key_name)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+@pytest.mark.tagging
+def test_post_object_tags_authenticated_request():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [
+    {"bucket": bucket_name},
+        ["starts-with", "$key", "foo"],
+        {"acl": "private"},
+        ["starts-with", "$Content-Type", "text/plain"],
+        ["content-length-range", 0, 1024],
+        ["starts-with", "$tagging", ""]
+    ]}
+
+    # xml_input_tagset is the same as `input_tagset = _create_simple_tagset(2)` in xml
+    # There is not a simple way to change input_tagset to xml like there is in the boto2 tetss
+    xml_input_tagset = "<Tagging><TagSet><Tag><Key>0</Key><Value>0</Value></Tag><Tag><Key>1</Key><Value>1</Value></Tag></TagSet></Tagging>"
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([
+        ("key" , "foo.txt"),
+        ("AWSAccessKeyId" , aws_access_key_id),\
+        ("acl" , "private"),("signature" , signature),("policy" , policy),\
+        ("tagging", xml_input_tagset),
+        ("Content-Type" , "text/plain"),
+        ('file', ('bar'))])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    body = _get_body(response)
+    assert body == 'bar'
+
+
+@pytest.mark.tagging
+@pytest.mark.fails_on_dbstore
+def test_put_obj_with_tags():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'testtagobj1'
+    data = 'A'*100
+
+    tagset = []
+    tagset.append({'Key': 'bar', 'Value': ''})
+    tagset.append({'Key': 'foo', 'Value': 'bar'})
+
+    put_obj_tag_headers = {
+        'x-amz-tagging' : 'foo=bar&bar'
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(put_obj_tag_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+    response = client.get_object(Bucket=bucket_name, Key=key)
+    body = _get_body(response)
+    assert body == data
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    response_tagset = response['TagSet']
+    tagset = tagset
+    assert response_tagset == tagset
+
+def _make_arn_resource(path="*"):
+    return "arn:aws:s3:::{}".format(path)
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_get_tags_acl_public():
+    key = 'testputtagsacl'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, key))
+    policy_document = make_json_policy("s3:GetObjectTagging",
+                                       resource)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    input_tagset = _create_simple_tagset(10)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    alt_client = get_alt_client()
+
+    response = alt_client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_put_tags_acl_public():
+    key = 'testputtagsacl'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, key))
+    policy_document = make_json_policy("s3:PutObjectTagging",
+                                       resource)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    input_tagset = _create_simple_tagset(10)
+    alt_client = get_alt_client()
+    response = alt_client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['TagSet'] == input_tagset['TagSet']
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_delete_tags_obj_public():
+    key = 'testputtagsacl'
+    bucket_name = _create_key_with_random_content(key)
+    client = get_client()
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, key))
+    policy_document = make_json_policy("s3:DeleteObjectTagging",
+                                       resource)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    input_tagset = _create_simple_tagset(10)
+    response = client.put_object_tagging(Bucket=bucket_name, Key=key, Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    alt_client = get_alt_client()
+
+    response = alt_client.delete_object_tagging(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = client.get_object_tagging(Bucket=bucket_name, Key=key)
+    assert len(response['TagSet']) == 0
+
+def test_versioning_bucket_atomic_upload_return_version_id():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'bar'
+
+    # for versioning-enabled-bucket, an non-empty version-id should return
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    response = client.put_object(Bucket=bucket_name, Key=key)
+    version_id = response['VersionId']
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    versions = response['Versions']
+    for version in versions:
+        assert version['VersionId'] == version_id
+
+
+    # for versioning-default-bucket, no version-id should return.
+    bucket_name = get_new_bucket()
+    key = 'baz'
+    response = client.put_object(Bucket=bucket_name, Key=key)
+    assert not 'VersionId' in response
+
+    # for versioning-suspended-bucket, no version-id should return.
+    bucket_name = get_new_bucket()
+    key = 'baz'
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+    response = client.put_object(Bucket=bucket_name, Key=key)
+    assert not 'VersionId' in response
+
+def test_versioning_bucket_multipart_upload_return_version_id():
+    content_type='text/bla'
+    objlen = 30 * 1024 * 1024
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'bar'
+    metadata={'foo': 'baz'}
+
+    # for versioning-enabled-bucket, an non-empty version-id should return
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, client=client, content_type=content_type, metadata=metadata)
+
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    version_id = response['VersionId']
+
+    response  = client.list_object_versions(Bucket=bucket_name)
+    versions = response['Versions']
+    for version in versions:
+        assert version['VersionId'] == version_id
+
+    # for versioning-default-bucket, no version-id should return.
+    bucket_name = get_new_bucket()
+    key = 'baz'
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, client=client, content_type=content_type, metadata=metadata)
+
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    assert not 'VersionId' in response
+
+    # for versioning-suspended-bucket, no version-id should return
+    bucket_name = get_new_bucket()
+    key = 'foo'
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, client=client, content_type=content_type, metadata=metadata)
+
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    assert not 'VersionId' in response
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_get_obj_existing_tag():
+    bucket_name = _create_objects(keys=['publictag', 'privatetag', 'invalidtag'])
+    client = get_client()
+
+    tag_conditional = {"StringEquals": {
+        "s3:ExistingObjectTag/security" : "public"
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObject",
+                                       resource,
+                                       conditions=tag_conditional)
+
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    tagset = []
+    tagset.append({'Key': 'security', 'Value': 'public'})
+    tagset.append({'Key': 'foo', 'Value': 'bar'})
+
+    input_tagset = {'TagSet': tagset}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset2 = []
+    tagset2.append({'Key': 'security', 'Value': 'private'})
+
+    input_tagset = {'TagSet': tagset2}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='privatetag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset3 = []
+    tagset3.append({'Key': 'security1', 'Value': 'public'})
+
+    input_tagset = {'TagSet': tagset3}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='invalidtag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=bucket_name, Key='publictag')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    e = assert_raises(ClientError, alt_client.get_object, Bucket=bucket_name, Key='privatetag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    e = assert_raises(ClientError, alt_client.get_object, Bucket=bucket_name, Key='invalidtag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_get_obj_tagging_existing_tag():
+    bucket_name = _create_objects(keys=['publictag', 'privatetag', 'invalidtag'])
+    client = get_client()
+
+    tag_conditional = {"StringEquals": {
+        "s3:ExistingObjectTag/security" : "public"
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObjectTagging",
+                                       resource,
+                                       conditions=tag_conditional)
+
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    tagset = []
+    tagset.append({'Key': 'security', 'Value': 'public'})
+    tagset.append({'Key': 'foo', 'Value': 'bar'})
+
+    input_tagset = {'TagSet': tagset}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset2 = []
+    tagset2.append({'Key': 'security', 'Value': 'private'})
+
+    input_tagset = {'TagSet': tagset2}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='privatetag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset3 = []
+    tagset3.append({'Key': 'security1', 'Value': 'public'})
+
+    input_tagset = {'TagSet': tagset3}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='invalidtag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    alt_client = get_alt_client()
+    response = alt_client.get_object_tagging(Bucket=bucket_name, Key='publictag')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # A get object itself should fail since we allowed only GetObjectTagging
+    e = assert_raises(ClientError, alt_client.get_object, Bucket=bucket_name, Key='publictag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    e = assert_raises(ClientError, alt_client.get_object_tagging, Bucket=bucket_name, Key='privatetag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+
+    e = assert_raises(ClientError, alt_client.get_object_tagging, Bucket=bucket_name, Key='invalidtag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_put_obj_tagging_existing_tag():
+    bucket_name = _create_objects(keys=['publictag', 'privatetag', 'invalidtag'])
+    client = get_client()
+
+    tag_conditional = {"StringEquals": {
+        "s3:ExistingObjectTag/security" : "public"
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:PutObjectTagging",
+                                       resource,
+                                       conditions=tag_conditional)
+
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    tagset = []
+    tagset.append({'Key': 'security', 'Value': 'public'})
+    tagset.append({'Key': 'foo', 'Value': 'bar'})
+
+    input_tagset = {'TagSet': tagset}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset2 = []
+    tagset2.append({'Key': 'security', 'Value': 'private'})
+
+    input_tagset = {'TagSet': tagset2}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='privatetag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    alt_client = get_alt_client()
+    # PUT requests with object tagging are a bit wierd, if you forget to put
+    # the tag which is supposed to be existing anymore well, well subsequent
+    # put requests will fail
+
+    testtagset1 = []
+    testtagset1.append({'Key': 'security', 'Value': 'public'})
+    testtagset1.append({'Key': 'foo', 'Value': 'bar'})
+
+    input_tagset = {'TagSet': testtagset1}
+
+    response = alt_client.put_object_tagging(Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    e = assert_raises(ClientError, alt_client.put_object_tagging, Bucket=bucket_name, Key='privatetag', Tagging=input_tagset)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    testtagset2 = []
+    testtagset2.append({'Key': 'security', 'Value': 'private'})
+
+    input_tagset = {'TagSet': testtagset2}
+
+    response = alt_client.put_object_tagging(Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # Now try putting the original tags again, this should fail
+    input_tagset = {'TagSet': testtagset1}
+
+    e = assert_raises(ClientError, alt_client.put_object_tagging, Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_upload_part_copy():
+    bucket_name = _create_objects(keys=['public/foo', 'public/bar', 'private/foo'])
+    client = get_client()
+
+    src_resource = _make_arn_resource("{}/{}".format(bucket_name, "public/*"))
+    policy_document = make_json_policy("s3:GetObject", src_resource)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    bucket_name2 = get_new_bucket(alt_client)
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'public/foo'}
+
+    # Create a multipart upload
+    response = alt_client.create_multipart_upload(Bucket=bucket_name2, Key='new_foo')
+    upload_id = response['UploadId']
+    # Upload a part
+    response = alt_client.upload_part_copy(Bucket=bucket_name2, Key='new_foo', PartNumber=1, UploadId=upload_id, CopySource=copy_source)
+    # Complete the multipart upload
+    response = alt_client.complete_multipart_upload(
+        Bucket=bucket_name2, Key='new_foo', UploadId=upload_id,
+        MultipartUpload={'Parts': [{'PartNumber': 1, 'ETag': response['CopyPartResult']['ETag']}]},
+    )
+
+    response = alt_client.get_object(Bucket=bucket_name2, Key='new_foo')
+    body = _get_body(response)
+    assert body == 'public/foo'
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'public/bar'}
+    # Create a multipart upload
+    response = alt_client.create_multipart_upload(Bucket=bucket_name2, Key='new_foo2')
+    upload_id = response['UploadId']
+    # Upload a part
+    response = alt_client.upload_part_copy(Bucket=bucket_name2, Key='new_foo2', PartNumber=1, UploadId=upload_id, CopySource=copy_source)
+    # Complete the multipart upload
+    response = alt_client.complete_multipart_upload(
+        Bucket=bucket_name2, Key='new_foo2', UploadId=upload_id,
+        MultipartUpload={'Parts': [{'PartNumber': 1, 'ETag': response['CopyPartResult']['ETag']}]},
+    )
+
+    response = alt_client.get_object(Bucket=bucket_name2, Key='new_foo2')
+    body = _get_body(response)
+    assert body == 'public/bar'
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'private/foo'}
+    # Create a multipart upload
+    response = alt_client.create_multipart_upload(Bucket=bucket_name2, Key='new_foo2')
+    upload_id = response['UploadId']
+    # Upload a part
+    check_access_denied(alt_client.upload_part_copy, Bucket=bucket_name2, Key='new_foo2', PartNumber=1, UploadId=upload_id, CopySource=copy_source)
+    # Abort the multipart upload
+    alt_client.abort_multipart_upload(Bucket=bucket_name2, Key='new_foo2', UploadId=upload_id)
+
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_put_obj_copy_source():
+    bucket_name = _create_objects(keys=['public/foo', 'public/bar', 'private/foo'])
+    client = get_client()
+
+    src_resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObject",
+                                       src_resource)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    bucket_name2 = get_new_bucket()
+
+    tag_conditional = {"StringLike": {
+        "s3:x-amz-copy-source" : bucket_name + "/public/*"
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name2, "*"))
+    policy_document = make_json_policy("s3:PutObject",
+                                       resource,
+                                       conditions=tag_conditional)
+
+    client.put_bucket_policy(Bucket=bucket_name2, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    copy_source = {'Bucket': bucket_name, 'Key': 'public/foo'}
+
+    alt_client.copy_object(Bucket=bucket_name2, CopySource=copy_source, Key='new_foo')
+
+    # This is possible because we are still the owner, see the grants with
+    # policy on how to do this right
+    response = alt_client.get_object(Bucket=bucket_name2, Key='new_foo')
+    body = _get_body(response)
+    assert body == 'public/foo'
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'public/bar'}
+    alt_client.copy_object(Bucket=bucket_name2, CopySource=copy_source, Key='new_foo2')
+
+    response = alt_client.get_object(Bucket=bucket_name2, Key='new_foo2')
+    body = _get_body(response)
+    assert body == 'public/bar'
+
+    copy_source = {'Bucket': bucket_name, 'Key': 'private/foo'}
+    check_access_denied(alt_client.copy_object, Bucket=bucket_name2, CopySource=copy_source, Key='new_foo2')
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_put_obj_copy_source_meta():
+    src_bucket_name = _create_objects(keys=['public/foo', 'public/bar'])
+    client = get_client()
+
+    src_resource = _make_arn_resource("{}/{}".format(src_bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObject",
+                                       src_resource)
+
+    client.put_bucket_policy(Bucket=src_bucket_name, Policy=policy_document)
+
+    bucket_name = get_new_bucket()
+
+    tag_conditional = {"StringEquals": {
+        "s3:x-amz-metadata-directive" : "COPY"
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:PutObject",
+                                       resource,
+                                       conditions=tag_conditional)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({"x-amz-metadata-directive": "COPY"}))
+    alt_client.meta.events.register('before-call.s3.CopyObject', lf)
+
+    copy_source = {'Bucket': src_bucket_name, 'Key': 'public/foo'}
+    alt_client.copy_object(Bucket=bucket_name, CopySource=copy_source, Key='new_foo')
+
+    # This is possible because we are still the owner, see the grants with
+    # policy on how to do this right
+    response = alt_client.get_object(Bucket=bucket_name, Key='new_foo')
+    body = _get_body(response)
+    assert body == 'public/foo'
+
+    # remove the x-amz-metadata-directive header
+    def remove_header(**kwargs):
+        if ("x-amz-metadata-directive" in kwargs['params']['headers']):
+            del kwargs['params']['headers']["x-amz-metadata-directive"]
+
+    alt_client.meta.events.register('before-call.s3.CopyObject', remove_header)
+
+    copy_source = {'Bucket': src_bucket_name, 'Key': 'public/bar'}
+    check_access_denied(alt_client.copy_object, Bucket=bucket_name, CopySource=copy_source, Key='new_foo2', Metadata={"foo": "bar"})
+
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+def test_bucket_policy_put_obj_acl():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # An allow conditional will require atleast the presence of an x-amz-acl
+    # attribute a Deny conditional would negate any requests that try to set a
+    # public-read/write acl
+    conditional = {"StringLike": {
+        "s3:x-amz-acl" : "public*"
+    }}
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    s1 = Statement("s3:PutObject",resource)
+    s2 = Statement("s3:PutObject", resource, effect="Deny", condition=conditional)
+
+    policy_document = p.add_statement(s1).add_statement(s2).to_json()
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    key1 = 'private-key'
+
+    # if we want to be really pedantic, we should check that this doesn't raise
+    # and mark a failure, however if this does raise nosetests would mark this
+    # as an ERROR anyway
+    response = alt_client.put_object(Bucket=bucket_name, Key=key1, Body=key1)
+    #response = alt_client.put_object_acl(Bucket=bucket_name, Key=key1, ACL='private')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    key2 = 'public-key'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({"x-amz-acl": "public-read"}))
+    alt_client.meta.events.register('before-call.s3.PutObject', lf)
+
+    e = assert_raises(ClientError, alt_client.put_object, Bucket=bucket_name, Key=key2, Body=key2)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+
+@pytest.mark.bucket_policy
+def test_bucket_policy_put_obj_grant():
+
+    bucket_name = get_new_bucket()
+    bucket_name2 = get_new_bucket()
+    client = get_client()
+
+    # In normal cases a key owner would be the uploader of a key in first case
+    # we explicitly require that the bucket owner is granted full control over
+    # the object uploaded by any user, the second bucket is where no such
+    # policy is enforced meaning that the uploader still retains ownership
+
+    main_user_id = get_main_user_id()
+    alt_user_id = get_alt_user_id()
+
+    owner_id_str = "id=" + main_user_id
+    s3_conditional = {"StringEquals": {
+        "s3:x-amz-grant-full-control" : owner_id_str
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:PutObject",
+                                       resource,
+                                       conditions=s3_conditional)
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name2, "*"))
+    policy_document2 = make_json_policy("s3:PutObject", resource)
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    client.put_bucket_policy(Bucket=bucket_name2, Policy=policy_document2)
+
+    alt_client = get_alt_client()
+    key1 = 'key1'
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update({"x-amz-grant-full-control" : owner_id_str}))
+    alt_client.meta.events.register('before-call.s3.PutObject', lf)
+
+    response = alt_client.put_object(Bucket=bucket_name, Key=key1, Body=key1)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    def remove_header(**kwargs):
+        if ("x-amz-grant-full-control" in kwargs['params']['headers']):
+            del kwargs['params']['headers']["x-amz-grant-full-control"]
+
+    alt_client.meta.events.register('before-call.s3.PutObject', remove_header)
+
+    key2 = 'key2'
+    response = alt_client.put_object(Bucket=bucket_name2, Key=key2, Body=key2)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    acl1_response = client.get_object_acl(Bucket=bucket_name, Key=key1)
+
+    # user 1 is trying to get acl for the object from user2 where ownership
+    # wasn't transferred
+    check_access_denied(client.get_object_acl, Bucket=bucket_name2, Key=key2)
+
+    acl2_response = alt_client.get_object_acl(Bucket=bucket_name2, Key=key2)
+
+    assert acl1_response['Grants'][0]['Grantee']['ID'] == main_user_id
+    assert acl2_response['Grants'][0]['Grantee']['ID'] == alt_user_id
+
+
+@pytest.mark.encryption
+def test_put_obj_enc_conflict_c_s3():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    key1_str ='testobj'
+
+    sse_client_headers = {
+        'x-amz-server-side-encryption' : 'AES256',
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key1_str)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.encryption
+def test_put_obj_enc_conflict_c_kms():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        kms_keyid = 'fool-me-once'
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    key1_str ='testobj'
+
+    sse_client_headers = {
+        'x-amz-server-side-encryption' : 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid,
+        'x-amz-server-side-encryption-customer-algorithm': 'AES256',
+        'x-amz-server-side-encryption-customer-key': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'x-amz-server-side-encryption-customer-key-md5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key1_str)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.encryption
+def test_put_obj_enc_conflict_s3_kms():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        kms_keyid = 'fool-me-once'
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    key1_str ='testobj'
+
+    sse_client_headers = {
+        'x-amz-server-side-encryption' : 'AES256',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key1_str)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.encryption
+def test_put_obj_enc_conflict_bad_enc_kms():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        kms_keyid = 'fool-me-once'
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    key1_str ='testobj'
+
+    sse_client_headers = {
+        'x-amz-server-side-encryption' : 'aes:kms',	# aes != aws
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key=key1_str)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument'
+
+@pytest.mark.encryption
+@pytest.mark.bucket_policy
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_put_obj_s3_noenc():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_unencrypted_obj = {
+        "Null" : {
+          "s3:x-amz-server-side-encryption": "true"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s = Statement("s3:PutObject", resource, effect="Deny", condition=deny_unencrypted_obj)
+    policy_document = p.add_statement(s).to_json()
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    key1_str ='testobj'
+
+    check_access_denied(client.put_object, Bucket=bucket_name, Key=key1_str, Body=key1_str)
+
+    response = client.put_object(Bucket=bucket_name, Key=key1_str, ServerSideEncryption='AES256')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+
+
+@pytest.mark.encryption
+@pytest.mark.bucket_policy
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_put_obj_s3_incorrect_algo_sse_s3():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_incorrect_algo = {
+        "StringNotEquals": {
+          "s3:x-amz-server-side-encryption": "AES256"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s = Statement("s3:PutObject", resource, effect="Deny", condition=deny_incorrect_algo)
+    policy_document = p.add_statement(s).to_json()
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    key1_str ='testobj'
+
+    check_access_denied(client.put_object, Bucket=bucket_name, Key=key1_str, Body=key1_str, ServerSideEncryption='AES192')
+
+    response = client.put_object(Bucket=bucket_name, Key=key1_str, ServerSideEncryption='AES256')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+
+
+@pytest.mark.encryption
+@pytest.mark.bucket_policy
+@pytest.mark.sse_s3
+def test_bucket_policy_put_obj_s3_kms():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        kms_keyid = 'fool-me-twice'
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_incorrect_algo = {
+        "StringNotEquals": {
+          "s3:x-amz-server-side-encryption": "AES256"
+        }
+    }
+
+    deny_unencrypted_obj = {
+        "Null" : {
+          "s3:x-amz-server-side-encryption": "true"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s1 = Statement("s3:PutObject", resource, effect="Deny", condition=deny_incorrect_algo)
+    s2 = Statement("s3:PutObject", resource, effect="Deny", condition=deny_unencrypted_obj)
+    policy_document = p.add_statement(s1).add_statement(s2).to_json()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    key1_str ='testobj'
+
+    #response = client.get_bucket_policy(Bucket=bucket_name)
+    #print response
+
+    sse_client_headers = {
+        'x-amz-server-side-encryption': 'aws:kms',
+        'x-amz-server-side-encryption-aws-kms-key-id': kms_keyid
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    check_access_denied(client.put_object, Bucket=bucket_name, Key=key1_str, Body=key1_str)
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+@pytest.mark.bucket_policy
+def test_bucket_policy_put_obj_kms_noenc():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_incorrect_algo = {
+        "StringNotEquals": {
+          "s3:x-amz-server-side-encryption": "aws:kms"
+        }
+    }
+
+    deny_unencrypted_obj = {
+        "Null" : {
+          "s3:x-amz-server-side-encryption": "true"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s1 = Statement("s3:PutObject", resource, effect="Deny", condition=deny_incorrect_algo)
+    s2 = Statement("s3:PutObject", resource, effect="Deny", condition=deny_unencrypted_obj)
+    policy_document = p.add_statement(s1).add_statement(s2).to_json()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    key1_str ='testobj'
+    key2_str ='unicorn'
+
+    #response = client.get_bucket_policy(Bucket=bucket_name)
+    #print response
+
+    # must do check_access_denied last - otherwise, pending data
+    #  breaks next call...
+    response = client.put_object(Bucket=bucket_name, Key=key1_str,
+         ServerSideEncryption='aws:kms', SSEKMSKeyId=kms_keyid)
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'aws:kms'
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-aws-kms-key-id'] == kms_keyid
+
+    check_access_denied(client.put_object, Bucket=bucket_name, Key=key2_str, Body=key2_str)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_policy
+def test_bucket_policy_put_obj_kms_s3():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    deny_incorrect_algo = {
+        "StringNotEquals": {
+          "s3:x-amz-server-side-encryption": "aws:kms"
+        }
+    }
+
+    deny_unencrypted_obj = {
+        "Null" : {
+          "s3:x-amz-server-side-encryption": "true"
+        }
+    }
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s1 = Statement("s3:PutObject", resource, effect="Deny", condition=deny_incorrect_algo)
+    s2 = Statement("s3:PutObject", resource, effect="Deny", condition=deny_unencrypted_obj)
+    policy_document = p.add_statement(s1).add_statement(s2).to_json()
+
+    # boto3.set_stream_logger(name='botocore')
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    key1_str ='testobj'
+
+    #response = client.get_bucket_policy(Bucket=bucket_name)
+    #print response
+
+    sse_client_headers = {
+        'x-amz-server-side-encryption' : 'AES256',
+    }
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_client_headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    check_access_denied(client.put_object, Bucket=bucket_name, Key=key1_str, Body=key1_str)
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+# TODO: remove this fails_on_rgw when I fix it
+@pytest.mark.fails_on_rgw
+def test_bucket_policy_put_obj_request_obj_tag():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    tag_conditional = {"StringEquals": {
+        "s3:RequestObjectTag/security" : "public"
+    }}
+
+    p = Policy()
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    s1 = Statement("s3:PutObject", resource, effect="Allow", condition=tag_conditional)
+    policy_document = p.add_statement(s1).to_json()
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    alt_client = get_alt_client()
+    key1_str ='testobj'
+    check_access_denied(alt_client.put_object, Bucket=bucket_name, Key=key1_str, Body=key1_str)
+
+    headers = {"x-amz-tagging" : "security=public"}
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(headers))
+    client.meta.events.register('before-call.s3.PutObject', lf)
+    #TODO: why is this a 400 and not passing
+    alt_client.put_object(Bucket=bucket_name, Key=key1_str, Body=key1_str)
+
+@pytest.mark.tagging
+@pytest.mark.bucket_policy
+@pytest.mark.fails_on_dbstore
+def test_bucket_policy_get_obj_acl_existing_tag():
+    bucket_name = _create_objects(keys=['publictag', 'privatetag', 'invalidtag'])
+    client = get_client()
+
+    tag_conditional = {"StringEquals": {
+        "s3:ExistingObjectTag/security" : "public"
+    }}
+
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObjectAcl",
+                                       resource,
+                                       conditions=tag_conditional)
+
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    tagset = []
+    tagset.append({'Key': 'security', 'Value': 'public'})
+    tagset.append({'Key': 'foo', 'Value': 'bar'})
+
+    input_tagset = {'TagSet': tagset}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='publictag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset2 = []
+    tagset2.append({'Key': 'security', 'Value': 'private'})
+
+    input_tagset = {'TagSet': tagset2}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='privatetag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    tagset3 = []
+    tagset3.append({'Key': 'security1', 'Value': 'public'})
+
+    input_tagset = {'TagSet': tagset3}
+
+    response = client.put_object_tagging(Bucket=bucket_name, Key='invalidtag', Tagging=input_tagset)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    alt_client = get_alt_client()
+    response = alt_client.get_object_acl(Bucket=bucket_name, Key='publictag')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # A get object itself should fail since we allowed only GetObjectTagging
+    e = assert_raises(ClientError, alt_client.get_object, Bucket=bucket_name, Key='publictag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    e = assert_raises(ClientError, alt_client.get_object_tagging, Bucket=bucket_name, Key='privatetag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    e = assert_raises(ClientError, alt_client.get_object_tagging, Bucket=bucket_name, Key='invalidtag')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_lock():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':1
+                }
+            }}
+    response = client.put_object_lock_configuration(
+        Bucket=bucket_name,
+        ObjectLockConfiguration=conf)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'COMPLIANCE',
+                    'Years':1
+                }
+            }}
+    response = client.put_object_lock_configuration(
+        Bucket=bucket_name,
+        ObjectLockConfiguration=conf)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_bucket_versioning(Bucket=bucket_name)
+    assert response['Status'] == 'Enabled'
+
+
+def test_object_lock_put_obj_lock_invalid_bucket():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':1
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'InvalidBucketState'
+
+def test_object_lock_put_obj_lock_enable_after_create():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':1
+                }
+            }}
+
+    # fail if bucket is not versioned
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'InvalidBucketState'
+
+    # fail if versioning is suspended
+    check_configure_versioning_retry(bucket_name, "Suspended", "Suspended")
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'InvalidBucketState'
+
+    # enable object lock if versioning is enabled
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    response = client.put_object_lock_configuration(Bucket=bucket_name, ObjectLockConfiguration=conf)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_lock_with_days_and_years():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':1,
+                    'Years':1
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_lock_invalid_days():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':0
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRetentionPeriod'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_lock_invalid_years():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Years':-1
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRetentionPeriod'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_lock_invalid_mode():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'abc',
+                    'Years':1
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'governance',
+                    'Years':1
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_lock_invalid_status():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Disabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Years':1
+                }
+            }}
+    e = assert_raises(ClientError, client.put_object_lock_configuration, Bucket=bucket_name, ObjectLockConfiguration=conf)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_suspend_versioning():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    e = assert_raises(ClientError, client.put_bucket_versioning, Bucket=bucket_name, VersioningConfiguration={'Status': 'Suspended'})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 409
+    assert error_code == 'InvalidBucketState'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_get_obj_lock():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':1
+                }
+            }}
+    client.put_object_lock_configuration(
+        Bucket=bucket_name,
+        ObjectLockConfiguration=conf)
+    response = client.get_object_lock_configuration(Bucket=bucket_name)
+    assert response['ObjectLockConfiguration'] == conf
+
+
+def test_object_lock_get_obj_lock_invalid_bucket():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    e = assert_raises(ClientError, client.get_object_lock_configuration, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 404
+    assert error_code == 'ObjectLockConfigurationNotFoundError'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2140,1,1,tzinfo=pytz.UTC)}
+    response = client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_object_retention(Bucket=bucket_name, Key=key)
+    assert response['Retention'] == retention
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+
+def test_object_lock_put_obj_retention_invalid_bucket():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    e = assert_raises(ClientError, client.put_object_retention, Bucket=bucket_name, Key=key, Retention=retention)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRequest'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention_invalid_mode():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    retention = {'Mode':'governance', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    e = assert_raises(ClientError, client.put_object_retention, Bucket=bucket_name, Key=key, Retention=retention)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+    retention = {'Mode':'abc', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    e = assert_raises(ClientError, client.put_object_retention, Bucket=bucket_name, Key=key, Retention=retention)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_get_obj_retention():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    response = client.get_object_retention(Bucket=bucket_name, Key=key)
+    assert response['Retention'] == retention
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_get_obj_retention_iso8601():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    date = datetime.datetime.today() + datetime.timedelta(days=365)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate': date}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    client.meta.events.register('after-call.s3.HeadObject', get_http_response)
+    client.head_object(Bucket=bucket_name,VersionId=version_id,Key=key)
+    retain_date = http_response['headers']['x-amz-object-lock-retain-until-date']
+    isodate.parse_datetime(retain_date)
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+def test_object_lock_get_obj_retention_invalid_bucket():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    e = assert_raises(ClientError, client.get_object_retention, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRequest'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention_versionid():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, VersionId=version_id, Retention=retention)
+    response = client.get_object_retention(Bucket=bucket_name, Key=key, VersionId=version_id)
+    assert response['Retention'] == retention
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention_override_default_retention():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    conf = {'ObjectLockEnabled':'Enabled',
+            'Rule': {
+                'DefaultRetention':{
+                    'Mode':'GOVERNANCE',
+                    'Days':1
+                }
+            }}
+    client.put_object_lock_configuration(
+        Bucket=bucket_name,
+        ObjectLockConfiguration=conf)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    response = client.get_object_retention(Bucket=bucket_name, Key=key)
+    assert response['Retention'] == retention
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention_increase_period():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention1 = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention1)
+    retention2 = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,3,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention2)
+    response = client.get_object_retention(Bucket=bucket_name, Key=key)
+    assert response['Retention'] == retention2
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention_shorten_period():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,3,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    e = assert_raises(ClientError, client.put_object_retention, Bucket=bucket_name, Key=key, Retention=retention)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_obj_retention_shorten_period_bypass():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    version_id = response['VersionId']
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,3,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention, BypassGovernanceRetention=True)
+    response = client.get_object_retention(Bucket=bucket_name, Key=key)
+    assert response['Retention'] == retention
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=version_id, BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_delete_object_with_retention():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    response = client.delete_object(Bucket=bucket_name, Key=key, VersionId=response['VersionId'], BypassGovernanceRetention=True)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_delete_multipart_object_with_retention():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+
+    key = 'file1'
+    body = 'abc'
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key, ObjectLockMode='GOVERNANCE',
+                                              ObjectLockRetainUntilDate=datetime.datetime(2030,1,1,tzinfo=pytz.UTC))
+    upload_id = response['UploadId']
+
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=1, Body=body)
+    parts = [{'ETag': response['ETag'].strip('"'), 'PartNumber': 1}]
+
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    response = client.delete_object(Bucket=bucket_name, Key=key, VersionId=response['VersionId'], BypassGovernanceRetention=True)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_delete_object_with_retention_and_marker():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    del_response = client.delete_object(Bucket=bucket_name, Key=key)
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=del_response['VersionId'])
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    response = client.delete_object(Bucket=bucket_name, Key=key, VersionId=response['VersionId'], BypassGovernanceRetention=True)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_multi_delete_object_with_retention():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key1 = 'file1'
+    key2 = 'file2'
+
+    response1 = client.put_object(Bucket=bucket_name, Body='abc', Key=key1)
+    response2 = client.put_object(Bucket=bucket_name, Body='abc', Key=key2)
+
+    versionId1 = response1['VersionId']
+    versionId2 = response2['VersionId']
+
+    # key1 is under retention, but key2 isn't.
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key1, Retention=retention)
+
+    delete_response = client.delete_objects(
+        Bucket=bucket_name,
+        Delete={
+            'Objects': [
+                {
+                    'Key': key1,
+                    'VersionId': versionId1
+                },
+                {
+                    'Key': key2,
+                    'VersionId': versionId2
+                }
+            ]
+        }
+    )
+
+    assert len(delete_response['Deleted']) == 1
+    assert len(delete_response['Errors']) == 1
+    
+    failed_object = delete_response['Errors'][0]
+    assert failed_object['Code'] == 'AccessDenied'
+    assert failed_object['Key'] == key1
+    assert failed_object['VersionId'] == versionId1
+
+    deleted_object = delete_response['Deleted'][0]
+    assert deleted_object['Key'] == key2
+    assert deleted_object['VersionId'] == versionId2
+
+    delete_response = client.delete_objects(
+        Bucket=bucket_name,
+        Delete={
+            'Objects': [
+                {
+                    'Key': key1,
+                    'VersionId': versionId1
+                }
+            ]
+        },
+        BypassGovernanceRetention=True
+    )
+
+    assert( ('Errors' not in delete_response) or (len(delete_response['Errors']) == 0) )
+    assert len(delete_response['Deleted']) == 1
+    deleted_object = delete_response['Deleted'][0]
+    assert deleted_object['Key'] == key1
+    assert deleted_object['VersionId'] == versionId1
+
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_legal_hold():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    legal_hold = {'Status': 'ON'}
+    response = client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold=legal_hold)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status':'OFF'})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+def test_object_lock_put_legal_hold_invalid_bucket():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    legal_hold = {'Status': 'ON'}
+    e = assert_raises(ClientError, client.put_object_legal_hold, Bucket=bucket_name, Key=key, LegalHold=legal_hold)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRequest'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_put_legal_hold_invalid_status():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    legal_hold = {'Status': 'abc'}
+    e = assert_raises(ClientError, client.put_object_legal_hold, Bucket=bucket_name, Key=key, LegalHold=legal_hold)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'MalformedXML'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_get_legal_hold():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    legal_hold = {'Status': 'ON'}
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold=legal_hold)
+    response = client.get_object_legal_hold(Bucket=bucket_name, Key=key)
+    assert response['LegalHold'] == legal_hold
+    legal_hold_off = {'Status': 'OFF'}
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold=legal_hold_off)
+    response = client.get_object_legal_hold(Bucket=bucket_name, Key=key)
+    assert response['LegalHold'] == legal_hold_off
+
+
+def test_object_lock_get_legal_hold_invalid_bucket():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    e = assert_raises(ClientError, client.get_object_legal_hold, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidRequest'
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_delete_object_with_legal_hold_on():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status': 'ON'})
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status':'OFF'})
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_delete_multipart_object_with_legal_hold_on():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+
+    key = 'file1'
+    body = 'abc'
+    response = client.create_multipart_upload(Bucket=bucket_name, Key=key, ObjectLockLegalHoldStatus='ON')
+    upload_id = response['UploadId']
+
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket_name, Key=key, PartNumber=1, Body=body)
+    parts = [{'ETag': response['ETag'].strip('"'), 'PartNumber': 1}]
+
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status':'OFF'})
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_delete_object_with_legal_hold_off():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    response = client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status': 'OFF'})
+    response = client.delete_object(Bucket=bucket_name, Key=key, VersionId=response['VersionId'])
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_get_obj_metadata():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key)
+    legal_hold = {'Status': 'ON'}
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold=legal_hold)
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':datetime.datetime(2030,1,1,tzinfo=pytz.UTC)}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention)
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ObjectLockMode'] == retention['Mode']
+    assert response['ObjectLockRetainUntilDate'] == retention['RetainUntilDate']
+    assert response['ObjectLockLegalHoldStatus'] == legal_hold['Status']
+
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status':'OFF'})
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=response['VersionId'], BypassGovernanceRetention=True)
+
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_uploading_obj():
+    bucket_name = get_new_bucket_name()
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    key = 'file1'
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key, ObjectLockMode='GOVERNANCE',
+                      ObjectLockRetainUntilDate=datetime.datetime(2030,1,1,tzinfo=pytz.UTC), ObjectLockLegalHoldStatus='ON')
+
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ObjectLockMode'] == 'GOVERNANCE'
+    assert response['ObjectLockRetainUntilDate'] == datetime.datetime(2030,1,1,tzinfo=pytz.UTC)
+    assert response['ObjectLockLegalHoldStatus'] == 'ON'
+    client.put_object_legal_hold(Bucket=bucket_name, Key=key, LegalHold={'Status':'OFF'})
+    client.delete_object(Bucket=bucket_name, Key=key, VersionId=response['VersionId'], BypassGovernanceRetention=True)
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_changing_mode_from_governance_with_bypass():
+    bucket_name = get_new_bucket_name()
+    key = 'file1'
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    # upload object with mode=GOVERNANCE
+    retain_until = datetime.datetime.now(pytz.utc) + datetime.timedelta(seconds=10)
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key, ObjectLockMode='GOVERNANCE',
+                      ObjectLockRetainUntilDate=retain_until)
+    # change mode to COMPLIANCE
+    retention = {'Mode':'COMPLIANCE', 'RetainUntilDate':retain_until}
+    client.put_object_retention(Bucket=bucket_name, Key=key, Retention=retention, BypassGovernanceRetention=True)
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_changing_mode_from_governance_without_bypass():
+    bucket_name = get_new_bucket_name()
+    key = 'file1'
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    # upload object with mode=GOVERNANCE
+    retain_until = datetime.datetime.now(pytz.utc) + datetime.timedelta(seconds=10)
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key, ObjectLockMode='GOVERNANCE',
+                      ObjectLockRetainUntilDate=retain_until)
+    # try to change mode to COMPLIANCE
+    retention = {'Mode':'COMPLIANCE', 'RetainUntilDate':retain_until}
+    e = assert_raises(ClientError, client.put_object_retention, Bucket=bucket_name, Key=key, Retention=retention)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.fails_on_dbstore
+def test_object_lock_changing_mode_from_compliance():
+    bucket_name = get_new_bucket_name()
+    key = 'file1'
+    client = get_client()
+    client.create_bucket(Bucket=bucket_name, ObjectLockEnabledForBucket=True)
+    # upload object with mode=COMPLIANCE
+    retain_until = datetime.datetime.now(pytz.utc) + datetime.timedelta(seconds=10)
+    client.put_object(Bucket=bucket_name, Body='abc', Key=key, ObjectLockMode='COMPLIANCE',
+                      ObjectLockRetainUntilDate=retain_until)
+    # try to change mode to GOVERNANCE
+    retention = {'Mode':'GOVERNANCE', 'RetainUntilDate':retain_until}
+    e = assert_raises(ClientError, client.put_object_retention, Bucket=bucket_name, Key=key, Retention=retention)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+@pytest.mark.fails_on_dbstore
+def test_copy_object_ifmatch_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    resp = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    client.copy_object(Bucket=bucket_name, CopySource=bucket_name+'/foo', CopySourceIfMatch=resp['ETag'], Key='bar')
+    response = client.get_object(Bucket=bucket_name, Key='bar')
+    body = _get_body(response)
+    assert body == 'bar'
+
+# TODO: remove fails_on_rgw when https://tracker.ceph.com/issues/40808 is resolved
+@pytest.mark.fails_on_rgw
+def test_copy_object_ifmatch_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    e = assert_raises(ClientError, client.copy_object, Bucket=bucket_name, CopySource=bucket_name+'/foo', CopySourceIfMatch='ABCORZ', Key='bar')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+# TODO: remove fails_on_rgw when https://tracker.ceph.com/issues/40808 is resolved
+@pytest.mark.fails_on_rgw
+def test_copy_object_ifnonematch_good():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    resp = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    e = assert_raises(ClientError, client.copy_object, Bucket=bucket_name, CopySource=bucket_name+'/foo', CopySourceIfNoneMatch=resp['ETag'], Key='bar')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 412
+    assert error_code == 'PreconditionFailed'
+
+@pytest.mark.fails_on_dbstore
+def test_copy_object_ifnonematch_failed():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    resp = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+
+    client.copy_object(Bucket=bucket_name, CopySource=bucket_name+'/foo', CopySourceIfNoneMatch='ABCORZ', Key='bar')
+    response = client.get_object(Bucket=bucket_name, Key='bar')
+    body = _get_body(response)
+    assert body == 'bar'
+
+# TODO: results in a 404 instead of 400 on the RGW
+@pytest.mark.fails_on_rgw
+def test_object_read_unreadable():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    e = assert_raises(ClientError, client.get_object, Bucket=bucket_name, Key='\xae\x8a-')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert e.response['Error']['Message'] == 'Couldn\'t parse the specified URI.'
+
+def test_get_bucket_policy_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == False
+
+def test_get_public_acl_bucket_policy_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == True
+
+def test_get_authpublic_acl_bucket_policy_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    client.put_bucket_acl(Bucket=bucket_name, ACL='authenticated-read')
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == True
+
+
+def test_get_publicpolicy_acl_bucket_policy_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == False
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == True
+
+
+def test_get_nonpublicpolicy_acl_bucket_policy_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == False
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ],
+        "Condition": {
+            "IpAddress":
+            {"aws:SourceIp": "10.0.0.0/32"}
+        }
+        }]
+     })
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == False
+
+
+def test_get_nonpublicpolicy_principal_bucket_policy_status():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "arn:aws:iam::s3tenant1:root"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+            ],
+        }]
+    })
+    
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    resp = client.get_bucket_policy_status(Bucket=bucket_name)
+    assert resp['PolicyStatus']['IsPublic'] == False
+
+
+def test_bucket_policy_allow_notprincipal():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "NotPrincipal": {"AWS": "arn:aws:iam::s3tenant1:root"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ],
+        }]
+     })
+
+    e = assert_raises(ClientError,
+                      client.put_bucket_policy, Bucket=bucket_name, Policy=policy_document)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidArgument' or error_code == 'MalformedPolicy'
+
+
+def test_get_undefined_public_block():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # delete the existing public access block configuration
+    # as AWS creates a default public access block configuration
+    resp = client.delete_public_access_block(Bucket=bucket_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response_code = ""
+    try:
+        resp = client.get_public_access_block(Bucket=bucket_name)
+    except ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'NoSuchPublicAccessBlockConfiguration'
+
+def test_get_public_block_deny_bucket_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': True,
+                   'IgnorePublicAcls': True,
+                   'BlockPublicPolicy': True,
+                   'RestrictPublicBuckets': False}
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+
+    # make sure we can get the public access block
+    resp = client.get_public_access_block(Bucket=bucket_name)
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicAcls'] == access_conf['BlockPublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicPolicy'] == access_conf['BlockPublicPolicy']
+    assert resp['PublicAccessBlockConfiguration']['IgnorePublicAcls'] == access_conf['IgnorePublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['RestrictPublicBuckets'] == access_conf['RestrictPublicBuckets']
+
+    # make bucket policy to deny access
+    resource = _make_arn_resource(bucket_name)
+    policy_document = make_json_policy("s3:GetBucketPublicAccessBlock",
+                                       resource, effect="Deny")
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+    # check if the access is denied
+    e = assert_raises(ClientError, client.get_public_access_block, Bucket=bucket_name)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+def test_put_public_block():
+    #client = get_svc_client(svc='s3control', client_config=Config(s3={'addressing_style': 'path'}))
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': True,
+                   'IgnorePublicAcls': True,
+                   'BlockPublicPolicy': True,
+                   'RestrictPublicBuckets': False}
+
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+
+    resp = client.get_public_access_block(Bucket=bucket_name)
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicAcls'] == access_conf['BlockPublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicPolicy'] == access_conf['BlockPublicPolicy']
+    assert resp['PublicAccessBlockConfiguration']['IgnorePublicAcls'] == access_conf['IgnorePublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['RestrictPublicBuckets'] == access_conf['RestrictPublicBuckets']
+
+
+def test_block_public_put_bucket_acls():
+    #client = get_svc_client(svc='s3control', client_config=Config(s3={'addressing_style': 'path'}))
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': True,
+                   'IgnorePublicAcls': False,
+                   'BlockPublicPolicy': True,
+                   'RestrictPublicBuckets': False}
+
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+
+    resp = client.get_public_access_block(Bucket=bucket_name)
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicAcls'] == access_conf['BlockPublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicPolicy'] == access_conf['BlockPublicPolicy']
+
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket_name,ACL='public-read')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket_name,ACL='public-read-write')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket_name,ACL='authenticated-read')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+
+
+def test_block_public_object_canned_acls():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': True,
+                   'IgnorePublicAcls': False,
+                   'BlockPublicPolicy': False,
+                   'RestrictPublicBuckets': False}
+
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+
+    # resp = client.get_public_access_block(Bucket=bucket_name)
+    # assert resp['PublicAccessBlockConfiguration']['BlockPublicAcls'] == access_conf['BlockPublicAcls']
+    # assert resp['PublicAccessBlockConfiguration']['BlockPublicPolicy'] == access_conf['BlockPublicPolicy']
+
+    #FIXME: use empty body until #42208
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo1', Body='', ACL='public-read')
+    assert 403 == _get_status(e.response)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo2', Body='', ACL='public-read-write')
+    assert 403 == _get_status(e.response)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket_name, Key='foo3', Body='', ACL='authenticated-read')
+    assert 403 == _get_status(e.response)
+
+    client.put_object(Bucket=bucket_name, Key='foo4', Body='', ACL='private')
+
+
+def test_block_public_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': False,
+                   'IgnorePublicAcls': False,
+                   'BlockPublicPolicy': True,
+                   'RestrictPublicBuckets': False}
+
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObject",
+                                       resource)
+
+    check_access_denied(client.put_bucket_policy, Bucket=bucket_name, Policy=policy_document)
+
+
+def test_block_public_policy_with_principal():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': False,
+                   'IgnorePublicAcls': False,
+                   'BlockPublicPolicy': True,
+                   'RestrictPublicBuckets': False}
+    
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObject",
+                                        resource, principal={"AWS": "arn:aws:iam::s3tenant1:root"})
+
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+
+
+@pytest.mark.fails_on_dbstore
+def test_block_public_restrict_public_buckets():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # remove any existing public access block configuration
+    resp = client.delete_public_access_block(Bucket=bucket_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    # upload an object
+    response = client.put_object(Bucket=bucket_name, Key='foo', Body='bar')
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # upload a bucket policy that allows public access
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+    policy_document = make_json_policy("s3:GetObject",
+                                        resource)
+    resp = client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    # check if the object is accessible publicly
+    unauthenticated_client = get_unauthenticated_client()
+    response = unauthenticated_client.get_object(Bucket=bucket_name, Key='foo')
+    assert _get_body(response) == 'bar'
+
+    # put a public access block configuration that restricts public buckets
+    access_conf = {'BlockPublicAcls': False,
+                   'IgnorePublicAcls': False,
+                   'BlockPublicPolicy': False,
+                   'RestrictPublicBuckets': True}
+    resp = client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # check if the object is no longer accessible publicly
+    check_access_denied(unauthenticated_client.get_object, Bucket=bucket_name, Key='foo')
+
+    # check if the object is still accessible by the owner
+    response = client.get_object(Bucket=bucket_name, Key='foo')
+    assert _get_body(response) == 'bar'
+
+
+def test_ignore_public_acls():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    alt_client = get_alt_client()
+
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+    # Public bucket should be accessible
+    alt_client.list_objects(Bucket=bucket_name)
+
+    client.put_object(Bucket=bucket_name,Key='key1',Body='abcde',ACL='public-read')
+    resp=alt_client.get_object(Bucket=bucket_name, Key='key1')
+    assert _get_body(resp) == 'abcde'
+
+    access_conf = {'BlockPublicAcls': False,
+                   'IgnorePublicAcls': True,
+                   'BlockPublicPolicy': False,
+                   'RestrictPublicBuckets': False}
+
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+    resource = _make_arn_resource("{}/{}".format(bucket_name, "*"))
+
+    client.put_bucket_acl(Bucket=bucket_name, ACL='public-read')
+    # IgnorePublicACLs is true, so regardless this should behave as a private bucket
+    check_access_denied(alt_client.list_objects, Bucket=bucket_name)
+    check_access_denied(alt_client.get_object, Bucket=bucket_name, Key='key1')
+
+def test_put_get_delete_public_block():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    access_conf = {'BlockPublicAcls': True,
+                   'IgnorePublicAcls': True,
+                   'BlockPublicPolicy': True,
+                   'RestrictPublicBuckets': False}
+
+    client.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration=access_conf)
+
+    resp = client.get_public_access_block(Bucket=bucket_name)
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicAcls'] == access_conf['BlockPublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['BlockPublicPolicy'] == access_conf['BlockPublicPolicy']
+    assert resp['PublicAccessBlockConfiguration']['IgnorePublicAcls'] == access_conf['IgnorePublicAcls']
+    assert resp['PublicAccessBlockConfiguration']['RestrictPublicBuckets'] == access_conf['RestrictPublicBuckets']
+
+    resp = client.delete_public_access_block(Bucket=bucket_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response_code = ""
+    try:
+        resp = client.get_public_access_block(Bucket=bucket_name)
+    except ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'NoSuchPublicAccessBlockConfiguration'
+
+def test_multipart_upload_on_a_bucket_with_policy():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    resource1 = "arn:aws:s3:::" + bucket_name
+    resource2 = "arn:aws:s3:::" + bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": "*",
+        "Action": "*",
+        "Resource": [
+            resource1,
+            resource2
+          ],
+        }]
+     })
+    key = "foo"
+    objlen=50*1024*1024
+    client.put_bucket_policy(Bucket=bucket_name, Policy=policy_document)
+    (upload_id, data, parts) = _multipart_upload(bucket_name=bucket_name, key=key, size=objlen, client=client)
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def _put_bucket_encryption_s3(client, bucket_name):
+    """
+    enable a default encryption policy on the given bucket
+    """
+    server_side_encryption_conf = {
+        'Rules': [
+            {
+                'ApplyServerSideEncryptionByDefault': {
+                    'SSEAlgorithm': 'AES256'
+                }
+            },
+        ]
+    }
+    response = client.put_bucket_encryption(Bucket=bucket_name, ServerSideEncryptionConfiguration=server_side_encryption_conf)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+def _put_bucket_encryption_kms(client, bucket_name):
+    """
+    enable a default encryption policy on the given bucket
+    """
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        kms_keyid = 'fool-me-again'
+    server_side_encryption_conf = {
+        'Rules': [
+            {
+                'ApplyServerSideEncryptionByDefault': {
+                    'SSEAlgorithm': 'aws:kms',
+                    'KMSMasterKeyID': kms_keyid
+                }
+            },
+        ]
+    }
+    response = client.put_bucket_encryption(Bucket=bucket_name, ServerSideEncryptionConfiguration=server_side_encryption_conf)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+@pytest.mark.sse_s3
+def test_put_bucket_encryption_s3():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_s3(client, bucket_name)
+
+@pytest.mark.encryption
+def test_put_bucket_encryption_kms():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_kms(client, bucket_name)
+
+
+@pytest.mark.sse_s3
+def test_get_bucket_encryption_s3():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response_code = ""
+    try:
+        client.get_bucket_encryption(Bucket=bucket_name)
+    except ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'ServerSideEncryptionConfigurationNotFoundError'
+
+    _put_bucket_encryption_s3(client, bucket_name)
+
+    response = client.get_bucket_encryption(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['ServerSideEncryptionConfiguration']['Rules'][0]['ApplyServerSideEncryptionByDefault']['SSEAlgorithm'] == 'AES256'
+
+
+@pytest.mark.encryption
+def test_get_bucket_encryption_kms():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        kms_keyid = 'fool-me-again'
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response_code = ""
+    try:
+        client.get_bucket_encryption(Bucket=bucket_name)
+    except ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'ServerSideEncryptionConfigurationNotFoundError'
+
+    _put_bucket_encryption_kms(client, bucket_name)
+
+    response = client.get_bucket_encryption(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert response['ServerSideEncryptionConfiguration']['Rules'][0]['ApplyServerSideEncryptionByDefault']['SSEAlgorithm'] == 'aws:kms'
+    assert response['ServerSideEncryptionConfiguration']['Rules'][0]['ApplyServerSideEncryptionByDefault']['KMSMasterKeyID'] == kms_keyid
+
+
+@pytest.mark.sse_s3
+def test_delete_bucket_encryption_s3():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = client.delete_bucket_encryption(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    _put_bucket_encryption_s3(client, bucket_name)
+
+    response = client.delete_bucket_encryption(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response_code = ""
+    try:
+        client.get_bucket_encryption(Bucket=bucket_name)
+    except ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'ServerSideEncryptionConfigurationNotFoundError'
+
+
+@pytest.mark.encryption
+def test_delete_bucket_encryption_kms():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    response = client.delete_bucket_encryption(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    _put_bucket_encryption_kms(client, bucket_name)
+
+    response = client.delete_bucket_encryption(Bucket=bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response_code = ""
+    try:
+        client.get_bucket_encryption(Bucket=bucket_name)
+    except ClientError as e:
+        response_code = e.response['Error']['Code']
+
+    assert response_code == 'ServerSideEncryptionConfigurationNotFoundError'
+
+def _test_sse_s3_default_upload(file_size):
+    """
+    Test enables bucket encryption.
+    Create a file of A's of certain size, and use it to set_contents_from_file.
+    Re-read the contents, and confirm we get same content as input i.e., A's
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_s3(client, bucket_name)
+
+    data = 'A'*file_size
+    response = client.put_object(Bucket=bucket_name, Key='testobj', Body=data)
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+
+    response = client.get_object(Bucket=bucket_name, Key='testobj')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+    body = _get_body(response)
+    assert body == data
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_upload_1b():
+    _test_sse_s3_default_upload(1)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_upload_1kb():
+    _test_sse_s3_default_upload(1024)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_upload_1mb():
+    _test_sse_s3_default_upload(1024*1024)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_upload_8mb():
+    _test_sse_s3_default_upload(8*1024*1024)
+
+def _test_sse_kms_default_upload(file_size):
+    """
+    Test enables bucket encryption.
+    Create a file of A's of certain size, and use it to set_contents_from_file.
+    Re-read the contents, and confirm we get same content as input i.e., A's
+    """
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_kms(client, bucket_name)
+
+    data = 'A'*file_size
+    response = client.put_object(Bucket=bucket_name, Key='testobj', Body=data)
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'aws:kms'
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-aws-kms-key-id'] == kms_keyid
+
+    response = client.get_object(Bucket=bucket_name, Key='testobj')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'aws:kms'
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-aws-kms-key-id'] == kms_keyid
+    body = _get_body(response)
+    assert body == data
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_default_upload_1b():
+    _test_sse_kms_default_upload(1)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_default_upload_1kb():
+    _test_sse_kms_default_upload(1024)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_default_upload_1mb():
+    _test_sse_kms_default_upload(1024*1024)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_default_upload_8mb():
+    _test_sse_kms_default_upload(8*1024*1024)
+
+
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_method_head():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_s3(client, bucket_name)
+
+    data = 'A'*1000
+    key = 'testobj'
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    response = client.head_object(Bucket=bucket_name, Key=key)
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+
+    sse_s3_headers = {
+        'x-amz-server-side-encryption': 'AES256',
+    }
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(sse_s3_headers))
+    client.meta.events.register('before-call.s3.HeadObject', lf)
+    e = assert_raises(ClientError, client.head_object, Bucket=bucket_name, Key=key)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_multipart_upload():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_s3(client, bucket_name)
+
+    key = "multipart_enc"
+    content_type = 'text/plain'
+    objlen = 30 * 1024 * 1024
+    metadata = {'foo': 'bar'}
+    enc_headers = {
+        'Content-Type': content_type
+    }
+    resend_parts = []
+
+    (upload_id, data, parts) = _multipart_upload_enc(client, bucket_name, key, objlen,
+            part_size=5*1024*1024, init_headers=enc_headers, part_headers=enc_headers, metadata=metadata, resend_parts=resend_parts)
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(enc_headers))
+    client.meta.events.register('before-call.s3.CompleteMultipartUpload', lf)
+    client.complete_multipart_upload(Bucket=bucket_name, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    response = client.list_objects_v2(Bucket=bucket_name, Prefix=key)
+    assert len(response['Contents']) == 1
+    assert response['Contents'][0]['Size'] == objlen
+
+    lf = (lambda **kwargs: kwargs['params']['headers'].update(part_headers))
+    client.meta.events.register('before-call.s3.UploadPart', lf)
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+
+    assert response['Metadata'] == metadata
+    assert response['ResponseMetadata']['HTTPHeaders']['content-type'] == content_type
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+
+    body = _get_body(response)
+    assert body == data
+    size = response['ContentLength']
+    assert len(body) == size
+
+    _check_content_using_range(key, bucket_name, data, 1000000)
+    _check_content_using_range(key, bucket_name, data, 10000000)
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_default_post_object_authenticated_request():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_s3(client, bucket_name)
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {
+            "expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "conditions": [
+                {"bucket": bucket_name},
+                ["starts-with", "$key", "foo"],
+                {"acl": "private"},
+                ["starts-with", "$Content-Type", "text/plain"],
+                ["starts-with", "$x-amz-server-side-encryption", ""], 
+                ["content-length-range", 0, 1024]
+            ]
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),
+    ('file', ('bar'))])
+
+    r = requests.post(url, files = payload)
+    assert r.status_code == 204
+
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+    body = _get_body(response)
+    assert body == 'bar'
+
+@pytest.mark.encryption
+@pytest.mark.bucket_encryption
+@pytest.mark.fails_on_dbstore
+def test_sse_kms_default_post_object_authenticated_request():
+    kms_keyid = get_main_kms_keyid()
+    if kms_keyid is None:
+        pytest.skip('[s3 main] section missing kms_keyid')
+    bucket_name = get_new_bucket()
+    client = get_client()
+    _put_bucket_encryption_kms(client, bucket_name)
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {
+            "expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "conditions": [
+                {"bucket": bucket_name},
+                ["starts-with", "$key", "foo"],
+                {"acl": "private"},
+                ["starts-with", "$Content-Type", "text/plain"],
+                ["starts-with", "$x-amz-server-side-encryption", ""], 
+                ["content-length-range", 0, 1024]
+            ]
+    }
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    payload = OrderedDict([ ("key" , "foo.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),
+    ('file', ('bar'))])
+
+    r = requests.post(url, files = payload)
+    assert r.status_code == 204
+
+    response = client.get_object(Bucket=bucket_name, Key='foo.txt')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'aws:kms'
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-aws-kms-key-id'] == kms_keyid
+    body = _get_body(response)
+    assert body == 'bar'
+
+
+def _test_sse_s3_encrypted_upload(file_size):
+    """
+    Test upload of the given size, specifically requesting sse-s3 encryption.
+    """
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    data = 'A'*file_size
+    response = client.put_object(Bucket=bucket_name, Key='testobj', Body=data, ServerSideEncryption='AES256')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+
+    response = client.get_object(Bucket=bucket_name, Key='testobj')
+    assert response['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256'
+    body = _get_body(response)
+    assert body == data
+
+@pytest.mark.encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_encrypted_upload_1b():
+    _test_sse_s3_encrypted_upload(1)
+
+@pytest.mark.encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_encrypted_upload_1kb():
+    _test_sse_s3_encrypted_upload(1024)
+
+@pytest.mark.encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_encrypted_upload_1mb():
+    _test_sse_s3_encrypted_upload(1024*1024)
+
+@pytest.mark.encryption
+@pytest.mark.sse_s3
+@pytest.mark.fails_on_dbstore
+def test_sse_s3_encrypted_upload_8mb():
+    _test_sse_s3_encrypted_upload(8*1024*1024)
+
+def test_get_object_torrent():
+    client = get_client()
+    bucket_name = get_new_bucket()
+    key = 'Avatar.mpg'
+
+    file_size = 7 * 1024 * 1024
+    data = 'A' * file_size
+
+    client.put_object(Bucket=bucket_name, Key=key, Body=data)
+
+    response = None
+    try:
+        response = client.get_object_torrent(Bucket=bucket_name, Key=key)
+        # if successful, verify the torrent contents are different from the body
+        assert data != _get_body(response)
+    except ClientError as e:
+        # accept 404 errors - torrent support may not be configured
+        status, error_code = _get_status_and_error_code(e.response)
+        assert status == 404
+        assert error_code == 'NoSuchKey'
+
+@pytest.mark.checksum
+def test_object_checksum_sha256():
+    bucket = get_new_bucket()
+    client = get_client()
+
+    key = "myobj"
+    size = 1024
+    body = FakeWriteFile(size, 'A')
+    sha256sum = 'arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0='
+    response = client.put_object(Bucket=bucket, Key=key, Body=body, ChecksumAlgorithm='SHA256', ChecksumSHA256=sha256sum)
+    assert sha256sum == response['ChecksumSHA256']
+
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert 'ChecksumSHA256' not in response
+    response = client.head_object(Bucket=bucket, Key=key, ChecksumMode='ENABLED')
+    assert sha256sum == response['ChecksumSHA256']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, Body=body, ChecksumAlgorithm='SHA256', ChecksumSHA256='bad')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'BadDigest'
+
+@pytest.mark.checksum
+def test_object_checksum_crc64nvme():
+    bucket = get_new_bucket()
+    client = get_client()
+
+    key = "myobj"
+    size = 1024
+    body = FakeWriteFile(size, 'A')
+    crc64sum = 'Qeh8oXvGiSo='
+    response = client.put_object(Bucket=bucket, Key=key, Body=body, ChecksumAlgorithm='CRC64NVME', ChecksumCRC64NVME=crc64sum)
+    assert crc64sum == response['ChecksumCRC64NVME']
+
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert 'ChecksumCRC64NVME' not in response
+    response = client.head_object(Bucket=bucket, Key=key, ChecksumMode='ENABLED')
+    assert crc64sum == response['ChecksumCRC64NVME']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, Body=body, ChecksumAlgorithm='CRC64NVME', ChecksumCRC64NVME='bad')
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'BadDigest'
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_checksum_sha256():
+    bucket = get_new_bucket()
+    client = get_client()
+
+    key = "mymultipart"
+    response = client.create_multipart_upload(Bucket=bucket, Key=key, ChecksumAlgorithm='SHA256')
+    assert 'SHA256' == response['ChecksumAlgorithm']
+    upload_id = response['UploadId']
+
+    size = 1024
+    body = FakeWriteFile(size, 'A')
+    part_sha256sum = 'arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0='
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=1, Body=body, ChecksumAlgorithm='SHA256', ChecksumSHA256=part_sha256sum)
+
+    # should reject the bad request checksum
+    e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket, Key=key, UploadId=upload_id, ChecksumSHA256='bad', MultipartUpload={'Parts': [
+        {'ETag': response['ETag'].strip('"'), 'ChecksumSHA256': response['ChecksumSHA256'], 'PartNumber': 1}]})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'BadDigest'
+
+    # XXXX re-trying the complete is failing in RGW due to an internal error that appears not caused
+    # checksums;
+    # 2024-04-25T17:47:47.991-0400 7f78e3a006c0  0 req 4931907640780566174 0.011000143s s3:complete_multipart check_previously_completed() ERROR: get_obj_attrs() returned ret=-2
+    # 2024-04-25T17:47:47.991-0400 7f78e3a006c0  2 req 4931907640780566174 0.011000143s s3:complete_multipart completing
+    # 2024-04-25T17:47:47.991-0400 7f78e3a006c0  1 req 4931907640780566174 0.011000143s s3:complete_multipart ERROR: either op_ret is negative (execute failed) or target_obj is null, op_ret: -2200
+    # -2200 turns into 500, InternalError
+
+    key = "mymultipart2"
+    response = client.create_multipart_upload(Bucket=bucket, Key=key, ChecksumAlgorithm='SHA256')
+    assert 'SHA256' == response['ChecksumAlgorithm']
+    upload_id = response['UploadId']
+
+    body = FakeWriteFile(size, 'A')
+    part_sha256sum = 'arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0='
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=1, Body=body, ChecksumAlgorithm='SHA256', ChecksumSHA256=part_sha256sum)
+
+    # should reject the missing part checksum
+    e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket, Key=key, UploadId=upload_id, ChecksumSHA256='bad', MultipartUpload={'Parts': [
+        {'ETag': response['ETag'].strip('"'), 'PartNumber': 1}]})
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'BadDigest'
+
+    key = "mymultipart3"
+    response = client.create_multipart_upload(Bucket=bucket, Key=key, ChecksumAlgorithm='SHA256')
+    assert 'SHA256' == response['ChecksumAlgorithm']
+    upload_id = response['UploadId']
+
+    body = FakeWriteFile(size, 'A')
+    part_sha256sum = 'arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0='
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=1, Body=body, ChecksumAlgorithm='SHA256', ChecksumSHA256=part_sha256sum)
+
+    composite_sha256sum = 'Ok6Cs5b96ux6+MWQkJO7UBT5sKPBeXBLwvj/hK89smg=-1'
+    response = client.complete_multipart_upload(Bucket=bucket, Key=key, UploadId=upload_id, ChecksumSHA256=composite_sha256sum, MultipartUpload={'Parts': [
+        {'ETag': response['ETag'].strip('"'), 'ChecksumSHA256': response['ChecksumSHA256'], 'PartNumber': 1}]})
+    assert composite_sha256sum == response['ChecksumSHA256']
+
+    response = client.head_object(Bucket=bucket, Key=key)
+    assert 'ChecksumSHA256' not in response
+    response = client.head_object(Bucket=bucket, Key=key, ChecksumMode='ENABLED')
+    assert composite_sha256sum == response['ChecksumSHA256']
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_reupload_checksum_and_etag():
+    bucket = get_new_bucket()
+    client = get_client()
+
+    key = "mymultipart"
+    response = client.create_multipart_upload(Bucket=bucket, Key=key, ChecksumAlgorithm='SHA256')
+    assert 'SHA256' == response['ChecksumAlgorithm']
+    upload_id = response['UploadId']
+
+    size = 5 * 1024 * 1024 # each part but the last must be at least 5M
+
+    # code to compute checksums for these is in unittest_rgw_cksum
+    body1 = FakeWriteFile(size, 'A')
+    body2 = FakeWriteFile(size, 'B')
+    body3 = FakeWriteFile(size, 'C')
+
+    # known MD5/etag and sha256 checksum values
+    part1_sha256sum = '275VF5loJr1YYawit0XSHREhkFXYkkPKGuoK0x9VKxI='
+    part2_sha256sum = 'mrHwOfjTL5Zwfj74F05HOQGLdUb7E5szdCbxgUSq6NM='
+    part3_sha256sum = 'Vw7oB/nKQ5xWb3hNgbyfkvDiivl+U+/Dft48nfJfDow='
+
+    composite_etag = 'b2add96cc9702bbf4efb0ccdfc6b7747-3'
+    composite_sha256sum = 'uWBwpe1dxI4Vw8Gf0X9ynOdw/SS6VBzfWm9giiv1sf4=-3'
+
+    response1 = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=1, Body=body1, ChecksumAlgorithm='SHA256', ChecksumSHA256=part1_sha256sum)
+    response2 = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=2, Body=body2, ChecksumAlgorithm='SHA256', ChecksumSHA256=part2_sha256sum)
+    response3 = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=3, Body=body3, ChecksumAlgorithm='SHA256', ChecksumSHA256=part3_sha256sum)
+
+    res1 = client.complete_multipart_upload(Bucket=bucket, Key=key, UploadId=upload_id, ChecksumSHA256=composite_sha256sum, MultipartUpload={'Parts': [
+        {'ETag': response1['ETag'].strip('"'), 'ChecksumSHA256': response1['ChecksumSHA256'], 'PartNumber': 1},
+        {'ETag': response2['ETag'].strip('"'), 'ChecksumSHA256': response2['ChecksumSHA256'], 'PartNumber': 2},
+        {'ETag': response3['ETag'].strip('"'), 'ChecksumSHA256': response3['ChecksumSHA256'], 'PartNumber': 3}]})
+
+    assert composite_etag == res1['ETag'].strip('"')
+    assert composite_sha256sum == res1['ChecksumSHA256']
+
+    # validate the headers on the (idempotent) attempt to retry completion--they should match for ETag and Checksum (if any)
+    res2 = client.complete_multipart_upload(Bucket=bucket, Key=key, UploadId=upload_id, ChecksumSHA256=composite_sha256sum, MultipartUpload={'Parts': [
+        {'ETag': response1['ETag'].strip('"'), 'ChecksumSHA256': response1['ChecksumSHA256'], 'PartNumber': 1},
+        {'ETag': response2['ETag'].strip('"'), 'ChecksumSHA256': response2['ChecksumSHA256'], 'PartNumber': 2},
+        {'ETag': response3['ETag'].strip('"'), 'ChecksumSHA256': response3['ChecksumSHA256'], 'PartNumber': 3}]})
+
+    # assert just validated final etag and checksum values match
+    assert res1['ETag'] == res2['ETag']
+    assert res1['ChecksumSHA256'] == res2['ChecksumSHA256']
+
+def multipart_checksum_3parts_helper(key=None, checksum_algo=None, checksum_type=None, **kwargs):
+
+    bucket = get_new_bucket()
+    client = get_client()
+
+    response = client.create_multipart_upload(Bucket=bucket, Key=key, ChecksumAlgorithm=checksum_algo, ChecksumType=checksum_type)
+    assert checksum_algo == response['ChecksumAlgorithm']
+    upload_id = response['UploadId']
+
+    cksum_arg_name = "Checksum" + checksum_algo
+
+    upload_args = {cksum_arg_name : kwargs['part1_cksum']}
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=1, Body=kwargs['body1'], ChecksumAlgorithm=checksum_algo, **upload_args)
+    etag1 = response['ETag'].strip('"')
+    cksum1 = response[cksum_arg_name]
+
+    upload_args = {cksum_arg_name : kwargs['part2_cksum']}
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=2, Body=kwargs['body2'], ChecksumAlgorithm=checksum_algo, **upload_args)
+    etag2 = response['ETag'].strip('"')
+    cksum2 = response[cksum_arg_name]
+
+    upload_args = {cksum_arg_name : kwargs['part3_cksum']}
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=3, Body=kwargs['body3'], ChecksumAlgorithm=checksum_algo, **upload_args)
+    etag3 = response['ETag'].strip('"')
+    cksum3 = response[cksum_arg_name]
+
+    upload_args = {cksum_arg_name : kwargs['composite_cksum']}
+    response = client.complete_multipart_upload(Bucket=bucket, Key=key, UploadId=upload_id, MultipartUpload={'Parts': [
+        {'ETag': etag1, cksum_arg_name: cksum1, 'PartNumber': 1},
+        {'ETag': etag2, cksum_arg_name: cksum2, 'PartNumber': 2},
+        {'ETag': etag3, cksum_arg_name: cksum3, 'PartNumber': 3}]},
+        **upload_args)
+
+    assert response['ChecksumType'] == checksum_type
+    assert response[cksum_arg_name] == kwargs['composite_cksum']
+
+    response1 = client.head_object(Bucket=bucket, Key=key)
+    assert cksum_arg_name not in response1
+
+    response2 = client.head_object(Bucket=bucket, Key=key, ChecksumMode='ENABLED')
+    assert response2['ChecksumType'] == checksum_type
+    assert response2[cksum_arg_name] == kwargs['composite_cksum']
+
+    request_attributes = ['Checksum']
+    response3 = client.get_object_attributes(Bucket=bucket, Key=key, \
+                                             ObjectAttributes=request_attributes)
+    assert response3['Checksum']['ChecksumType'] == checksum_type
+    assert response3['Checksum'][cksum_arg_name] == kwargs['composite_cksum']
+
+    response4 = client.get_object(Bucket=bucket, Key=key, PartNumber=1)
+    assert response4['ChecksumType'] == checksum_type
+    assert response4[cksum_arg_name] == kwargs['part1_cksum']
+
+    response5 = client.get_object(Bucket=bucket, Key=key, PartNumber=2)
+    assert response5['ChecksumType'] == checksum_type
+    assert response5[cksum_arg_name] == kwargs['part2_cksum']
+
+    response6 = client.get_object(Bucket=bucket, Key=key, PartNumber=3)
+    assert response6['ChecksumType'] == checksum_type
+    assert response6[cksum_arg_name] == kwargs['part3_cksum']
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_use_cksum_helper_sha256():
+    size = 5 * 1024 * 1024 # each part but the last must be at least 5M
+
+    # code to compute checksums for these is in unittest_rgw_cksum
+    body1 = FakeWriteFile(size, 'A')
+    body2 = FakeWriteFile(size, 'B')
+    body3 = FakeWriteFile(size, 'C')
+
+    upload_args = {
+        "body1" : body1,
+        "part1_cksum" : '275VF5loJr1YYawit0XSHREhkFXYkkPKGuoK0x9VKxI=',
+        "body2" : body2,
+        "part2_cksum" : 'mrHwOfjTL5Zwfj74F05HOQGLdUb7E5szdCbxgUSq6NM=',
+        "body3" : body3,
+        "part3_cksum" : 'Vw7oB/nKQ5xWb3hNgbyfkvDiivl+U+/Dft48nfJfDow=',
+        # the composite OR combined checksum, as appropriate
+        "composite_cksum" : 'uWBwpe1dxI4Vw8Gf0X9ynOdw/SS6VBzfWm9giiv1sf4=-3',
+    }
+
+    res = multipart_checksum_3parts_helper(key="mymultipart3", checksum_algo="SHA256", checksum_type="COMPOSITE", **upload_args)
+    #eof
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_use_cksum_helper_crc64nvme():
+    size = 5 * 1024 * 1024 # each part but the last must be at least 5M
+
+    # code to compute checksums for these is in unittest_rgw_cksum
+    body1 = FakeWriteFile(size, 'A')
+    body2 = FakeWriteFile(size, 'B')
+    body3 = FakeWriteFile(size, 'C')
+
+    upload_args = {
+        "body1" : body1,
+        "part1_cksum" : 'L/E4WYn8v98=',
+        "body2" : body2,
+        "part2_cksum" : 'xW1l19VobYM=',
+        "body3" : body3,
+        "part3_cksum" : 'cK5MnNaWrW4=',
+        # the composite OR combined checksum, as appropriate
+        "composite_cksum" : 'i+6LR0y3eFo=',
+    }
+
+    res = multipart_checksum_3parts_helper(key="mymultipart3", checksum_algo="CRC64NVME", checksum_type="FULL_OBJECT", **upload_args)
+    #eof
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_use_cksum_helper_crc32():
+    size = 5 * 1024 * 1024 # each part but the last must be at least 5M
+
+    # code to compute checksums for these is in unittest_rgw_cksum
+    body1 = FakeWriteFile(size, 'A')
+    body2 = FakeWriteFile(size, 'B')
+    body3 = FakeWriteFile(size, 'C')
+
+    upload_args = {
+        "body1" : body1,
+        "part1_cksum" : 'JRTCyQ==',
+        "body2" : body2,
+        "part2_cksum" : 'QoZTGg==',
+        "body3" : body3,
+        "part3_cksum" : 'YAgjqw==',
+        # the composite OR combined checksum, as appropriate
+        "composite_cksum" : 'WgDhBQ==',
+    }
+
+    res = multipart_checksum_3parts_helper(key="mymultipart3", checksum_algo="CRC32", checksum_type="FULL_OBJECT", **upload_args)
+    #eof
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_use_cksum_helper_crc32c():
+    size = 5 * 1024 * 1024 # each part but the last must be at least 5M
+
+    # code to compute checksums for these is in unittest_rgw_cksum
+    body1 = FakeWriteFile(size, 'A')
+    body2 = FakeWriteFile(size, 'B')
+    body3 = FakeWriteFile(size, 'C')
+
+    upload_args = {
+        "body1" : body1,
+        "part1_cksum" : 'MDaLrw==',
+        "body2" : body2,
+        "part2_cksum" : 'TH4EZg==',
+        "body3" : body3,
+        "part3_cksum" : 'Z7mBIQ==',
+        # the composite OR combined checksum, as appropriate
+        "composite_cksum" : 'xU+Krw==',
+    }
+
+    res = multipart_checksum_3parts_helper(key="mymultipart3", checksum_algo="CRC32C", checksum_type="FULL_OBJECT", **upload_args)
+    #eof
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_multipart_use_cksum_helper_sha1():
+    size = 5 * 1024 * 1024 # each part but the last must be at least 5M
+
+    # code to compute checksums for these is in unittest_rgw_cksum
+    body1 = FakeWriteFile(size, 'A')
+    body2 = FakeWriteFile(size, 'B')
+    body3 = FakeWriteFile(size, 'C')
+
+    upload_args = {
+        "body1" : body1,
+        "part1_cksum" : 'iIaTCGbm+vdVjNqIMF2S0T7ibMk=',
+        "body2" : body2,
+        "part2_cksum" : 'LS/TJ32bAVKEwRu+sE3X7awh/lk=',
+        "body3" : body3,
+        "part3_cksum" : '6DDwovUaHwrKNXDMzOGbuvj9kxI=',
+        # the composite OR combined checksum, as appropriate
+        "composite_cksum" : 'sizjvY4eud3MrcHdZM3cQ/ol39o=-3',
+    }
+
+    res = multipart_checksum_3parts_helper(key="mymultipart3", checksum_algo="SHA1", checksum_type="COMPOSITE", **upload_args)
+    #eof    
+
+@pytest.mark.checksum
+def test_post_object_upload_checksum():
+    megabytes = 1024 * 1024
+    min_size = 0
+    max_size = 5 * megabytes
+    test_payload_size = 2 * megabytes
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    url = _get_post_url(bucket_name)
+    utc = pytz.utc
+    expires = datetime.datetime.now(utc) + datetime.timedelta(seconds=+6000)
+
+    policy_document = {"expiration": expires.strftime("%Y-%m-%dT%H:%M:%SZ"),\
+    "conditions": [\
+    {"bucket": bucket_name},\
+    ["starts-with", "$key", "foo_cksum_test"],\
+    {"acl": "private"},\
+    ["starts-with", "$Content-Type", "text/plain"],\
+    ["content-length-range", min_size, max_size],\
+    ]\
+    }
+
+    test_payload = b'x' * test_payload_size
+
+    json_policy_document = json.JSONEncoder().encode(policy_document)
+    bytes_json_policy_document = bytes(json_policy_document, 'utf-8')
+    policy = base64.b64encode(bytes_json_policy_document)
+    aws_secret_access_key = get_main_aws_secret_key()
+    aws_access_key_id = get_main_aws_access_key()
+
+    signature = base64.b64encode(hmac.new(bytes(aws_secret_access_key, 'utf-8'), policy, hashlib.sha1).digest())
+
+    # good checksum payload (checked via upload from awscli)
+    payload = OrderedDict([ ("key" , "foo_cksum_test.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),\
+    ('x-amz-checksum-sha256', 'aTL9MeXa9HObn6eP93eygxsJlcwdCwCTysgGAZAgE7w='),\
+    ('file', (test_payload)),])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 204
+
+    # bad checksum payload
+    payload = OrderedDict([ ("key" , "foo_cksum_test.txt"),("AWSAccessKeyId" , aws_access_key_id),\
+    ("acl" , "private"),("signature" , signature),("policy" , policy),\
+    ("Content-Type" , "text/plain"),\
+    ('x-amz-checksum-sha256', 'sailorjerry'),\
+    ('file', (test_payload)),])
+
+    r = requests.post(url, files=payload, verify=get_config_ssl_verify())
+    assert r.status_code == 400
+
+
+def _set_log_bucket_policy_tenant(client, log_tenant, log_bucket_name, src_tenant, src_user, src_buckets, log_prefixes):
+    statements = []
+    for j in range(len(src_buckets)):
+        if len(log_prefixes) == 1:
+            prefix = log_prefixes[0]
+        else:
+            prefix = log_prefixes[j]
+        statements.append({
+            "Sid": "S3ServerAccessLogsPolicy",
+            "Effect": "Allow",
+            "Principal": {"Service": "logging.s3.amazonaws.com"},
+            "Action": ["s3:PutObject"],
+            "Resource": "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, prefix),
+            "Condition": {
+                "ArnLike": {"aws:SourceArn": "arn:aws:s3::{}:{}".format(src_tenant, src_buckets[j])},
+                "StringEquals": {
+                    "aws:SourceAccount": src_user
+                    }
+            }
+        })
+
+    policy_document = json.dumps({
+        "Version": "2012-10-17",
+        "Statement": statements
+        })
+
+    result = client.put_bucket_policy(Bucket=log_bucket_name, Policy=policy_document)
+    assert(result['ResponseMetadata']['HTTPStatusCode'] == 204)
+
+
+def _set_log_bucket_policy(client, log_bucket_name, src_buckets, log_prefixes):
+    _set_log_bucket_policy_tenant(client, "", log_bucket_name, "", get_main_user_id(), src_buckets, log_prefixes)
+
+
+def _has_bucket_logging_extension():
+    src_bucket_name = get_new_bucket_name()
+    log_bucket_name = get_new_bucket_name()
+    client = get_client()
+    log_prefix = 'log/'
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': log_prefix, 'LoggingType': 'Journal'}
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+    except ParamValidationError as e:
+        return False
+    except ClientError as e:
+        # should fail on non-existing bucket
+        return True
+
+    return True
+
+
+def _has_target_object_key_format():
+    src_bucket_name = get_new_bucket_name()
+    log_bucket_name = get_new_bucket_name()
+    client = get_client()
+    log_prefix = 'log/'
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': log_prefix, 'TargetObjectKeyFormat': {'SimplePrefix': {}}}
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+    except ParamValidationError as e:
+        return False
+    finally:
+        # should fail on non-existing bucket
+        return True
+
+
+import shlex
+
+def _parse_standard_log_record(record):
+    record = record.replace('[', '"').replace(']', '"')
+    chunks = shlex.split(record)
+    assert len(chunks) == 26
+    return {
+            'BucketOwner':      chunks[0],
+            'BucketName':       chunks[1],
+            'RequestDateTime':  chunks[2],
+            'RemoteIP':         chunks[3],
+            'Requester':        chunks[4],
+            'RequestID':        chunks[5],
+            'Operation':        chunks[6],
+            'Key':              chunks[7],
+            'RequestURI':       chunks[8],
+            'HTTPStatus':       chunks[9],
+            'ErrorCode':        chunks[10],
+            'BytesSent':        chunks[11],
+            'ObjectSize':       chunks[12],
+            'TotalTime':        chunks[13],
+            'TurnAroundTime':   chunks[14],
+            'Referrer':         chunks[15],
+            'UserAgent':        chunks[16],
+            'VersionID':        chunks[17],
+            'HostID':           chunks[18],
+            'SigVersion':       chunks[19],
+            'CipherSuite':      chunks[20],
+            'AuthType':         chunks[21],
+            'HostHeader':       chunks[22],
+            'TLSVersion':       chunks[23],
+            'AccessPointARN':   chunks[24],
+            'ACLRequired':      chunks[25],
+            }
+
+
+def _parse_journal_log_record(record):
+    record = record.replace('[', '"').replace(']', '"')
+    chunks = shlex.split(record)
+    assert len(chunks) == 8
+    return {
+            'BucketOwner':      chunks[0],
+            'BucketName':       chunks[1],
+            'RequestDateTime':  chunks[2],
+            'Operation':        chunks[3],
+            'Key':              chunks[4],
+            'ObjectSize':       chunks[5],
+            'VersionID':        chunks[6],
+            'ETAG':             chunks[7],
+            }
+
+def _parse_log_record(record, record_type):
+    if record_type == 'Standard':
+        return _parse_standard_log_record(record)
+    elif record_type == 'Journal':
+        return _parse_journal_log_record(record)
+    else:
+        assert False, 'unknown log record type'
+
+expected_object_roll_time = 5
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+def _verify_records(records, bucket_name, event_type, src_keys, record_type, expected_count, exact_match=False):
+    keys_found = []
+    all_keys = []
+    for record in iter(records.splitlines()):
+        parsed_record = _parse_log_record(record, record_type)
+        logger.debug('bucket log record: %s', json.dumps(parsed_record, indent=4))
+        if bucket_name in record and event_type in record:
+            all_keys.append(parsed_record['Key'])
+            for key in src_keys:
+                if key in record:
+                    keys_found.append(key)
+                    break
+    logger.info('%d keys found in bucket log: %s', len(all_keys), str(all_keys))
+    logger.info('%d keys from the source bucket: %s', len(src_keys), str(src_keys))
+    if exact_match:
+        return len(keys_found) == expected_count and len(keys_found) == len(all_keys)
+    return len(keys_found) == expected_count
+
+
+def _verify_record_field(records, bucket_name, event_type, object_key, record_type, field_name, expected_value):
+    for record in iter(records.splitlines()):
+        if bucket_name in record and event_type in record and object_key in record:
+            parsed_record = _parse_log_record(record, record_type)
+            logger.info('bucket log record: %s', json.dumps(parsed_record, indent=4))
+            try:
+                value = parsed_record[field_name]
+                return expected_value == value
+            except KeyError:
+                return False
+    return False
+
+
+def randcontent():
+    letters = string.ascii_lowercase
+    length = random.randint(10, 1024)
+    return ''.join(random.choice(letters) for i in range(length))
+
+
+@pytest.mark.bucket_logging
+def test_put_bucket_logging():
+    has_extensions = _has_bucket_logging_extension()
+    has_key_format = _has_target_object_key_format()
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': prefix
+            }
+
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    if has_extensions:
+        logging_enabled['LoggingType'] = 'Standard'
+        logging_enabled['RecordsBatchSize'] = 0
+    if has_key_format:
+        # default value for key prefix is returned
+        logging_enabled['TargetObjectKeyFormat'] = {'SimplePrefix': {}}
+    assert response['LoggingEnabled'] == logging_enabled
+
+    if has_key_format:
+        # with simple target object prefix
+        logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': 'log/',
+            'TargetObjectKeyFormat': {
+                'SimplePrefix': {}
+            }
+        }
+        if has_extensions:
+            logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+        response = client.get_bucket_logging(Bucket=src_bucket_name)
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+        if has_extensions:
+            logging_enabled['LoggingType'] = 'Standard'
+            logging_enabled['RecordsBatchSize'] = 0
+        assert response['LoggingEnabled'] == logging_enabled
+
+        # with partitioned target object prefix
+        logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': 'log/',
+            'TargetObjectKeyFormat': {
+                'PartitionedPrefix': {
+                    'PartitionDateSource': 'DeliveryTime'
+                }
+            }
+        }
+        if has_extensions:
+            logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+        response = client.get_bucket_logging(Bucket=src_bucket_name)
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+        if has_extensions:
+            logging_enabled['LoggingType'] = 'Standard'
+            logging_enabled['RecordsBatchSize'] = 0
+        assert response['LoggingEnabled'] == logging_enabled
+
+    # with target grant (not implemented in RGW)
+    main_display_name = get_main_display_name()
+    main_user_id = get_main_user_id()
+    logging_enabled = {
+        'TargetBucket': log_bucket_name,
+        'TargetPrefix': 'log/',
+        'TargetGrants': [{'Grantee': {'DisplayName': main_display_name, 'ID': main_user_id,'Type': 'CanonicalUser'},'Permission': 'FULL_CONTROL'}] 
+    }
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    if has_extensions:
+        logging_enabled['LoggingType'] = 'Standard'
+        logging_enabled['RecordsBatchSize'] = 0
+    # target grants are not implemented
+    logging_enabled.pop('TargetGrants')
+    if has_key_format:
+        # default value for key prefix is returned
+        logging_enabled['TargetObjectKeyFormat'] = {'SimplePrefix': {}}
+    assert response['LoggingEnabled'] == logging_enabled
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_mtime():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': prefix
+            }
+
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    mtime = response['ResponseMetadata']['HTTPHeaders']['last-modified']
+
+    # wait and set the same conf - mtime should be the same
+    time.sleep(1)
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert mtime == response['ResponseMetadata']['HTTPHeaders']['last-modified']
+
+    # wait and change conf - new mtime should be larger
+    time.sleep(1)
+    prefix = 'another-log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': prefix
+            }
+
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert mtime < response['ResponseMetadata']['HTTPHeaders']['last-modified']
+    mtime = response['ResponseMetadata']['HTTPHeaders']['last-modified']
+
+    # wait and disable/enable conf - new mtime should be larger
+    time.sleep(1)
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert mtime < response['ResponseMetadata']['HTTPHeaders']['last-modified']
+
+
+def _flush_logs(client, src_bucket_name, dummy_key="dummy"):
+    if _has_bucket_logging_extension():
+        result = client.post_bucket_logging(Bucket=src_bucket_name)
+        assert result['ResponseMetadata']['HTTPStatusCode'] == 200
+        return result['FlushedLoggingObject']
+    else:
+        time.sleep(expected_object_roll_time*1.1)
+        client.put_object(Bucket=src_bucket_name, Key=dummy_key, Body='dummy')
+        return None
+
+
+def _verify_logging_key(key_format, key, expected_prefix, expected_dt, expected_src_account, expected_src_region, expected_src_bucket):
+    # NOTE: prefix value has to be terminated with non alphanumeric character
+    # for the regex to work properly
+    if key_format == 'SimplePrefix':
+        #[DestinationPrefix][YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
+        pattern = r'^(.+?)(\d{4})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(.+)$'
+        no_prefix_pattern = r'^(\d{4})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(.+)$'
+    elif key_format == 'PartitionedPrefix':
+        # [DestinationPrefix][SourceAccountId]/[SourceRegion]/[SourceBucket]/[YYYY]/[MM]/[DD]/[YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString]
+        pattern = r'^(.+?)([^/]+)/([^/]+)/([^/]+)/(\d{4})/(\d{2})/(\d{2})/(\d{4})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(.+)$'
+        no_prefix_pattern = r'^([^/]+)/([^/]+)/([^/]+)/(\d{4})/(\d{2})/(\d{2})/(\d{4})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(\d{2})-(.+)$'
+    else:
+        assert False, 'unknown key format: {}'.format(key_format)
+
+    match = re.match(no_prefix_pattern, key)
+    if not match:
+        match = re.match(pattern, key)
+        assert match
+        match_index = 1
+        prefix = match.group(match_index)
+    else:
+        prefix = ''
+        match_index = 0
+
+    _year = None
+    _month = None
+    _day = None
+    assert prefix == expected_prefix
+    if key_format == 'PartitionedPrefix':
+        match_index += 1
+        src_account = match.group(match_index)
+        assert src_account == expected_src_account
+        match_index += 1
+        src_region = match.group(match_index)
+        assert src_region == expected_src_region
+        match_index += 1
+        src_bucket = match.group(match_index)
+        assert src_bucket == expected_src_bucket
+        match_index += 1
+        _year = int(match.group(match_index))
+        match_index += 1
+        _month = int(match.group(match_index))
+        match_index += 1
+        _day = int(match.group(match_index))
+
+    match_index += 1
+    year = int(match.group(match_index))
+    if _year:
+        assert year == _year
+    match_index += 1
+    month = int(match.group(match_index))
+    if _month:
+        assert month == _month
+    match_index += 1
+    day = int(match.group(match_index))
+    if _day:
+        assert day == _day
+    match_index += 1
+    hour = int(match.group(match_index))
+    match_index += 1
+    minute = int(match.group(match_index))
+    match_index += 1
+    second = int(match.group(match_index))
+    match_index += 1
+    unique_string = match.group(match_index)
+    try:
+        dt = datetime.datetime(year, month, day, hour, minute, second)
+        assert abs(dt - expected_dt) <= datetime.timedelta(seconds=5)
+    except ValueError:
+        # Invalid date/time values
+        assert False, 'invalid date/time values in key: {}'.format(key)
+
+
+def _bucket_logging_object_name(key_format, prefix):
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': prefix
+            }
+    if key_format == 'SimplePrefix':
+        logging_enabled['TargetObjectKeyFormat'] = {'SimplePrefix': {}}
+    elif key_format == 'PartitionedPrefix':
+        logging_enabled['TargetObjectKeyFormat'] = {
+                'PartitionedPrefix': {
+                    'PartitionDateSource': 'DeliveryTime'
+                    }
+                }
+    else:
+        assert False, 'unknown key format: %s' % key_format
+
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    user_id = get_main_user_id()
+    timestamp = datetime.datetime.now()
+    _verify_logging_key(key_format, keys[0], prefix, timestamp, user_id, 'default', src_bucket_name)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_simple_key():
+    _bucket_logging_object_name('SimplePrefix', 'log/')
+    _bucket_logging_object_name('SimplePrefix', '')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_partitioned_key():
+    _bucket_logging_object_name('PartitionedPrefix', 'log/')
+    _bucket_logging_object_name('PartitionedPrefix', '')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_bucket_auth_type():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    key = 'my-test-object'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    client.put_object(Bucket=src_bucket_name, Key=key, Body=randcontent())
+    client.put_object_acl(ACL='public-read',Bucket=src_bucket_name, Key=key)
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    keys = _get_keys(response)
+
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # AuthType AuthHeader:
+    response = client.get_object(Bucket=src_bucket_name, Key=key)
+    client.list_objects_v2(Bucket=src_bucket_name)
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+    assert len(log_keys) == 1
+
+    for log_key in log_keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', [key], "Standard", 1)
+        assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "AuthType", "AuthHeader")
+
+
+    #AuthType "-" (unauthenticated)
+    unauthenticated_client = get_unauthenticated_client()
+    unauthenticated_client.get_object(Bucket=src_bucket_name, Key=key)
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+
+    log_key = log_keys[-1]
+    response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', [key], "Standard", 1)
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "AuthType", "-")
+
+    #AuthType "QueryString" (presigned SigV4)
+    params = {'Bucket': src_bucket_name, 'Key': key}
+    url = client.generate_presigned_url(ClientMethod='get_object', Params=params, ExpiresIn=100000, HttpMethod='GET')
+
+    res = requests.options(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 400
+
+    res = requests.get(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 200
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+
+    log_key = log_keys[-1]
+    response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', [key], "Standard", 1)
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "AuthType", "QueryString")
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "SigVersion", "SigV4")
+
+    #AuthType "QueryString" (presigned SigV2)
+    client_v2 = get_v2_client()
+    params = {'Bucket': src_bucket_name, 'Key': key}
+    url = client_v2.generate_presigned_url(ClientMethod='get_object', Params=params, ExpiresIn=100000, HttpMethod='GET')
+
+    res = requests.options(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 400
+
+    res = requests.get(url, verify=get_config_ssl_verify()).__dict__
+    assert res['status_code'] == 200
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+
+    log_key = log_keys[-1]
+    response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', [key], "Standard", 1)
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "AuthType", "QueryString")
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "SigVersion", "SigV2")
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_request_id():
+    """verify that the standard access log RequestID field matches the x-amz-request-id response header"""
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    key = 'my-test-object'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    # enable standard logging
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # capture x-amz-request-id from the put_object response
+    response = client.put_object(Bucket=src_bucket_name, Key=key, Body=randcontent())
+    request_id = response['ResponseMetadata']['HTTPHeaders'].get('x-amz-request-id')
+    assert request_id is not None, 'failed to read x-amz-request-id from response headers'
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+    assert len(log_keys) == 1
+
+    for log_key in log_keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', [key], "Standard", 1)
+        assert _verify_record_field(body, src_bucket_name, 'REST.PUT.OBJECT', key, "Standard", "RequestID", request_id)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_bucket_logging_requester_assumed_role():
+    """verify the standard access log Requester field contains the assumed-role ARN
+    for requests made with STS temporary credentials"""
+    iam_client = get_iam_client()
+    sts_client = get_sts_client()
+    alt_user_id = get_alt_user_id()
+    default_endpoint = get_config_endpoint()
+    role_session_name = get_parameter_name()
+
+    # create an IAM role assumable by the alt user
+    trust_policy = json.dumps({
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Effect": "Allow",
+            "Principal": {"AWS": [f"arn:aws:iam:::user/{alt_user_id}"]},
+            "Action": ["sts:AssumeRole"]
+        }]
+    })
+    role_name = get_parameter_name()
+    role_response = iam_client.create_role(Path='/', RoleName=role_name, AssumeRolePolicyDocument=trust_policy)
+    role_arn = role_response['Role']['Arn']
+
+    try:
+        role_policy = json.dumps({
+            "Version": "2012-10-17",
+            "Statement": [{
+                "Effect": "Allow",
+                "Action": "s3:*",
+                "Resource": "*"
+            }]
+        })
+        iam_client.put_role_policy(RoleName=role_name, PolicyName='S3FullAccess', PolicyDocument=role_policy)
+
+        # assume the role
+        resp = sts_client.assume_role(RoleArn=role_arn, RoleSessionName=role_session_name)
+
+        assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+        creds = resp['Credentials']
+        role_s3 = boto3.client(
+            's3',
+            aws_access_key_id=creds['AccessKeyId'],
+            aws_secret_access_key=creds['SecretAccessKey'],
+            aws_session_token=creds['SessionToken'],
+            endpoint_url=default_endpoint,
+            region_name='')
+
+        src_bucket_name = get_new_bucket_name()
+        log_bucket_name = get_new_bucket_name()
+        role_s3.create_bucket(Bucket=src_bucket_name)
+        role_s3.create_bucket(Bucket=log_bucket_name)
+        prefix = 'log/'
+        _set_log_bucket_policy_tenant(role_s3, "", log_bucket_name, "", alt_user_id, [src_bucket_name], [prefix])
+
+        logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+        role_s3.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={'LoggingEnabled': logging_enabled})
+
+        key = 'my-test-object'
+        role_s3.put_object(Bucket=src_bucket_name, Key=key, Body=randcontent())
+
+        _flush_logs(role_s3, src_bucket_name)
+        response = role_s3.list_objects_v2(Bucket=log_bucket_name)
+        log_keys = _get_keys(response)
+        assert len(log_keys) == 1
+
+        response = role_s3.get_object(Bucket=log_bucket_name, Key=log_keys[0])
+        body = _get_body(response)
+        expected_substring = f'assumed-role/{role_name}/{role_session_name}'
+        found = False
+        for record in body.splitlines():
+            if src_bucket_name not in record or 'REST.PUT.OBJECT' not in record or key not in record:
+                continue
+            parsed = _parse_log_record(record, "Standard")
+            requester = parsed['Requester']
+            assert requester.startswith('arn:aws:sts::'), f"Requester should be an STS ARN, got: {requester}"
+            assert expected_substring in requester, f"Requester missing {expected_substring}, got: {requester}"
+            found = True
+            break
+        assert found, "no PUT log record found for the assumed-role request"
+    finally:
+        nuke_role(iam_client, role_name)
+
+
+def _bucket_logging_key_filter(log_type):
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'LoggingType': log_type,
+            'TargetPrefix': prefix,
+            'ObjectRollTime': expected_object_roll_time,
+            'TargetObjectKeyFormat': {'SimplePrefix': {}},
+            'RecordsBatchSize': 0,
+             'Filter':
+                {
+                    'Key': {
+                        'FilterRules': [
+                            {'Name': 'prefix', 'Value': 'test/'},
+                            {'Name': 'suffix', 'Value': '.txt'}
+                        ]
+                    }
+                }
+            }
+
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    if log_type == 'Journal':
+        assert response['LoggingEnabled'] == logging_enabled
+    elif log_type == 'Standard':
+        print('TODO')
+    else:
+        assert False, 'unknown log type: %s' % log_type
+
+    names = []
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        if log_type == 'Standard':
+            # standard log records are not filtered
+            names.append(name)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    for j in range(num_keys):
+        name = 'test/'+'myobject'+str(j)+'.txt'
+        names.append(name)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    expected_count = len(names)
+
+    flushed_obj = _flush_logs(client, src_bucket_name, dummy_key="test/dummy.txt")
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    for key in keys:
+        if flushed_obj is not None:
+            assert key == flushed_obj
+        assert key.startswith('log/')
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', names, log_type, expected_count, exact_match=True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_bucket_acl_required():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    key = 'my-test-object'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    client.put_object(Bucket=src_bucket_name, Key=key, Body=randcontent())
+    client.put_bucket_acl(ACL='public-read',Bucket=src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    keys = _get_keys(response)
+
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    #This will require ACLs
+    alt_client = get_alt_client()
+    response = alt_client.list_objects_v2(Bucket=src_bucket_name)
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+    assert len(log_keys) == 1
+
+    for log_key in log_keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, 'REST.GET.BUCKET', ["-"], "Standard", 1)
+        assert _verify_record_field(body, src_bucket_name, 'REST.GET.BUCKET', "-", "Standard", "ACLRequired", "Yes")
+
+    #Set a bucket policy that will allow access without requiring ACLs
+    resource1 = "arn:aws:s3:::" + src_bucket_name
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:ListBucket",
+        "Resource": [
+            "{}".format(resource1),
+          ]
+        }]
+     })
+
+    response = client.put_bucket_policy(Bucket=src_bucket_name, Policy=policy_document)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = alt_client.list_objects_v2(Bucket=src_bucket_name)
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+
+    log_key = log_keys[-1]
+    response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.GET.BUCKET', ["-"], "Standard", 1)
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.BUCKET', "-", "Standard", "ACLRequired", "-")
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_object_acl_required():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    key = 'my-test-object'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    client.put_object(Bucket=src_bucket_name, Key=key, Body=randcontent())
+    client.put_object_acl(ACL='public-read',Bucket=src_bucket_name, Key=key)
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    keys = _get_keys(response)
+
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    #This will require ACLs
+    alt_client = get_alt_client()
+    response = alt_client.get_object(Bucket=src_bucket_name, Key=key)
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+    assert len(log_keys) == 1
+
+    for log_key in log_keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', [key], "Standard", 1)
+        assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "ACLRequired", "Yes")
+
+    #Set a bucket policy that will allow access to the object without requiring ACLs
+    resource1 = "arn:aws:s3:::" + src_bucket_name
+    resource2 = "arn:aws:s3:::" + src_bucket_name + "/*"
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "*"},
+        "Action": "s3:GetObject",
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+
+    response = client.put_bucket_policy(Bucket=src_bucket_name, Policy=policy_document)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    response = alt_client.get_object(Bucket=src_bucket_name, Key=key)
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+
+    log_key = log_keys[-1]
+    response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', [key], "Standard", 1)
+    assert _verify_record_field(body, src_bucket_name, 'REST.GET.OBJECT', key, "Standard", "ACLRequired", "-")
+
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_key_filter_s():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_key_filter('Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_key_filter_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_key_filter('Journal')
+
+
+def _post_bucket_logging(client, src_bucket_name, flushed_objs):
+    result = client.post_bucket_logging(Bucket=src_bucket_name)
+    assert result['ResponseMetadata']['HTTPStatusCode'] == 200
+    flushed_objs[src_bucket_name] = result['FlushedLoggingObject']
+
+
+def _bucket_logging_flush(logging_type, single_prefix, concurrency, num_keys):
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+
+    num_buckets = 5
+    buckets = []
+    log_prefixes = []
+    longer_time = expected_object_roll_time*10
+    for j in range(num_buckets):
+        src_bucket_name = get_new_bucket_name()
+        src_bucket = get_new_bucket_resource(name=src_bucket_name)
+        buckets.append(src_bucket_name)
+        if single_prefix:
+            log_prefixes.append('log/')
+        else:
+            log_prefixes.append(src_bucket_name+'/')
+
+    _set_log_bucket_policy(client, log_bucket_name, buckets, log_prefixes)
+
+    for j in range(num_buckets):
+        logging_enabled = {'TargetBucket': log_bucket_name,
+                           'ObjectRollTime': longer_time,
+                           'LoggingType': logging_type,
+                           'TargetPrefix': log_prefixes[j]
+                           }
+
+        response = client.put_bucket_logging(Bucket=buckets[j], BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    src_names = []
+    for j in range(num_keys):
+        src_names.append('myobject'+str(j))
+
+    for src_bucket_name in buckets:
+        for name in src_names:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+            client.delete_object(Bucket=src_bucket_name, Key=name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 0
+
+    t = []
+    flushed_objs = {}
+    for src_bucket_name in buckets:
+        if concurrency:
+            thr = threading.Thread(target = _post_bucket_logging,
+                                   args=(client, src_bucket_name, flushed_objs))
+            thr.start()
+            t.append(thr)
+        else:
+            result = client.post_bucket_logging(Bucket=src_bucket_name)
+            assert result['ResponseMetadata']['HTTPStatusCode'] == 200
+            flushed_objs[src_bucket_name] = result['FlushedLoggingObject']
+        if single_prefix:
+            break
+
+    _do_wait_completion(t)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+
+    if single_prefix:
+        assert len(keys) == 1
+        assert len(flushed_objs) == 1
+    else:
+        assert len(keys) == num_buckets
+        assert len(flushed_objs) >= num_buckets
+
+    for key in keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body = _get_body(response)
+        found = False
+        for j in range(num_buckets):
+            prefix = log_prefixes[j]
+            if key.startswith(prefix):
+                flushed_obj = flushed_objs.get(buckets[j])
+                if flushed_obj is not None:
+                    assert key == flushed_obj
+                found = True
+                assert _verify_records(body, buckets[j], 'REST.PUT.OBJECT', src_names, logging_type, num_keys)
+                assert _verify_records(body, buckets[j], 'REST.DELETE.OBJECT', src_names, logging_type, num_keys)
+        assert found
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_flush_empty():
+    # testing empty commits
+    _bucket_logging_flush('Journal', False, False, 0)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_flush_j():
+    _bucket_logging_flush('Journal', False, False, 10)
+    _bucket_logging_flush('Journal', False, False, 100)
+    # testing empty commits after some activity
+    _bucket_logging_flush('Journal', False, False, 0)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_flush_s():
+    _bucket_logging_flush('Standard', False, False, 10)
+    _bucket_logging_flush('Standard', False, False, 100)
+    # no empty commits in "standard" mode
+    # the POST command itself will be logged
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_flush_j_single():
+    _bucket_logging_flush('Journal', True, False, 10)
+    _bucket_logging_flush('Journal', True, False, 100)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_flush_s_single():
+    _bucket_logging_flush('Standard', True, False, 10)
+    _bucket_logging_flush('Standard', True, False, 100)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_concurrent_flush_j():
+    _bucket_logging_flush('Journal', False, True, 10)
+    _bucket_logging_flush('Journal', False, True, 100)
+    _bucket_logging_flush('Journal', False, True, 0)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_concurrent_flush_s():
+    _bucket_logging_flush('Standard', False, True, 10)
+    _bucket_logging_flush('Standard', False, True, 100)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_concurrent_flush_j_single():
+    _bucket_logging_flush('Journal', True, True, 10)
+    _bucket_logging_flush('Journal', True, True, 100)
+    _bucket_logging_flush('Journal', True, True, 0)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_concurrent_flush_s_single():
+    _bucket_logging_flush('Standard', True, True, 10)
+    _bucket_logging_flush('Standard', True, True, 100)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_put_and_flush():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client_config = botocore.config.Config(max_pool_connections=100)
+    client = get_client(client_config=client_config)
+
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [log_prefix])
+
+    logging_enabled = {'TargetBucket': log_bucket_name,
+                       'LoggingType': 'Journal',
+                       'TargetPrefix': log_prefix
+                       }
+
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 300
+    flush_rate = 10
+    put_threads = []
+    flush_threads = []
+    src_names = []
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        src_names.append(name)
+        put_thr = threading.Thread(target=client.put_object,
+                                      kwargs={'Bucket': src_bucket_name,
+                                              'Key': name,
+                                              'Body': randcontent()})
+        put_thr.start()
+        put_threads.append(put_thr)
+
+        if j % flush_rate == 0:
+            flush_thr = threading.Thread(target = client.post_bucket_logging,
+                                         kwargs={'Bucket': src_bucket_name})
+            flush_thr.start()
+            flush_threads.append(flush_thr)
+
+    _do_wait_completion(put_threads)
+    _do_wait_completion(flush_threads)
+
+    # making sure everything is flushed synchronously
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+
+    body = ''
+    prev_key = ''
+    for key in keys:
+        logger.info('bucket log record: %s', key)
+        assert key > prev_key
+        prev_key = key
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_names, 'Journal', num_keys)
+
+
+@pytest.mark.bucket_logging
+def test_put_bucket_logging_errors():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name1 = get_new_bucket_name()
+    log_bucket1 = get_new_bucket_resource(name=log_bucket_name1)
+    client = get_client()
+    prefix = 'log/'
+
+    # invalid source bucket
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name+'kaboom', BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name1, 'TargetPrefix': prefix},
+        })
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'NoSuchBucket'
+
+    # invalid log bucket
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name1+'kaboom', 'TargetPrefix': prefix},
+        })
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'NoSuchKey'
+
+    # log bucket has bucket logging
+    log_bucket_name2 = get_new_bucket_name()
+    log_bucket2 = get_new_bucket_resource(name=log_bucket_name2)
+    _set_log_bucket_policy(client, log_bucket_name1, [log_bucket_name2], [prefix])
+    response = client.put_bucket_logging(Bucket=log_bucket_name2, BucketLoggingStatus={
+        'LoggingEnabled': {'TargetBucket': log_bucket_name1, 'TargetPrefix': prefix},
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _set_log_bucket_policy(client, log_bucket_name2, [src_bucket_name], [prefix])
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name2, 'TargetPrefix': prefix},
+        })
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'InvalidArgument'
+
+    # invalid partition prefix
+    if _has_target_object_key_format():
+        logging_enabled = {
+            'TargetBucket': log_bucket_name1,
+            'TargetPrefix': prefix,
+            'TargetObjectKeyFormat': {
+                'PartitionedPrefix': {
+                    'PartitionDateSource': 'kaboom'
+                }
+            }
+        }
+        try:
+            _set_log_bucket_policy(client, log_bucket_name1, [src_bucket_name], [prefix])
+            response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+                'LoggingEnabled': logging_enabled,
+            })
+            assert False, 'expected failure'
+        except ClientError as e:
+            assert e.response['Error']['Code'] == 'MalformedXML'
+
+    # log bucket is the same as source bucket
+    _set_log_bucket_policy(client, src_bucket_name, [src_bucket_name], [prefix])
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': src_bucket_name, 'TargetPrefix': prefix},
+        })
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'InvalidArgument'
+
+    # log bucket is encrypted
+    _put_bucket_encryption_s3(client, log_bucket_name1)
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name1, 'TargetPrefix': prefix},
+        })
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'InvalidArgument'
+
+    # "requester pays" is set on log bucket
+    log_bucket_name3 = get_new_bucket_name()
+    log_bucket3 = get_new_bucket_resource(name=log_bucket_name3)
+    _set_log_bucket_policy(client, log_bucket_name3, [src_bucket_name], [prefix])
+    response = client.put_bucket_request_payment(Bucket=log_bucket_name3,
+                                                 RequestPaymentConfiguration={'Payer': 'Requester'})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name3, 'TargetPrefix': prefix},
+        })
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'InvalidArgument'
+
+    # invalid log type
+    if _has_bucket_logging_extension():
+        try:
+            response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+                'LoggingEnabled': {'TargetBucket': log_bucket_name1, 'TargetPrefix': prefix, 'LoggingType': 'kaboom'},
+            })
+            assert False, 'expected failure'
+        except ClientError as e:
+            assert e.response['Error']['Code'] == 'MalformedXML'
+
+
+def _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix):
+    try:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'AccessDenied'
+
+
+@pytest.mark.bucket_logging
+def test_bucket_logging_owner():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    alt_client = get_alt_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    # set policy to allow all action on source bucket
+    policy_document = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": "*",
+        "Action": ["s3:PutBucketLogging"],
+        }]
+     })
+
+    response = client.put_bucket_policy(Bucket=src_bucket_name, Policy=policy_document)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    # try set bucket logging from another user
+    _verify_access_denied(alt_client, src_bucket_name, log_bucket_name, prefix)
+
+    # set bucket logging from the bucket owner user
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # try remove bucket logging from another user
+    try:
+        response = alt_client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={})
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'AccessDenied'
+
+
+def _set_bucket_policy(client, log_bucket_name, policy):
+    policy_document = json.dumps(policy)
+    response = client.put_bucket_policy(Bucket=log_bucket_name, Policy=policy_document)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+
+@pytest.mark.bucket_logging
+def test_put_bucket_logging_permissions():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    log_tenant = ""
+    src_tenant = ""
+    src_user = get_main_user_id()
+
+    # missing log bucket policy
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+
+    policy = {
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Sid": "S3ServerAccessLogsPolicy",
+            "Effect": "Allow",
+            "Principal": {"Service": "logging.s3.amazonaws.com"},
+            "Action": ["s3:PutObject"],
+            "Resource": "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, prefix),
+            "Condition": {
+                "ArnLike": {"aws:SourceArn": "arn:aws:s3::{}:{}".format(src_tenant, src_bucket_name)},
+                "StringEquals": {
+                    "aws:SourceAccount": "{}${}".format(src_tenant, src_user) if src_tenant else src_user
+                    }
+            }
+        }]
+    }
+
+    # missing service principal
+    policy['Statement'][0]['Principal'] = {"AWS": "*"}
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+
+    # invalid service principal
+    policy['Statement'][0]['Principal'] = {"Service": "logging.s3.amazonaws.com"+"kaboom"}
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+    # set valid principal
+    policy['Statement'][0]['Principal'] = {"Service": "logging.s3.amazonaws.com"}
+
+    # invalid action
+    policy['Statement'][0]['Action'] = ["s3:GetObject"]
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+    # set valid action
+    policy['Statement'][0]['Action'] = ["s3:PutObject"]
+
+    # invalid resource
+    policy['Statement'][0]['Resource'] = "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, "kaboom")
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+    # set valid resource
+    policy['Statement'][0]['Resource'] = "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, prefix)
+
+    # invalid source bucket
+    policy['Statement'][0]['Condition']['ArnLike']['aws:SourceArn'] = "arn:aws:s3::{}:{}".format(src_tenant, "kaboom")
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+    policy['Statement'][0]['Condition']['ArnLike']['aws:SourceArn'] = "arn:aws:s3::{}:{}".format("kaboom", src_bucket)
+    # set valid source bucket
+    policy['Statement'][0]['Condition']['ArnLike']['aws:SourceArn'] = "arn:aws:s3::{}:{}".format(src_tenant, src_bucket)
+
+    # invalid source account
+    src_user = "kaboom"
+    policy['Statement'][0]['Condition']['StringEquals']['aws:SourceAccount'] = "{}${}".format(src_tenant, src_user) if src_tenant else src_user
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+    src_user = get_main_user_id()
+    src_tenant = "kaboom"
+    policy['Statement'][0]['Condition']['StringEquals']['aws:SourceAccount'] = "{}${}".format(src_tenant, src_user) if src_tenant else src_user
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(client, src_bucket_name, log_bucket_name, prefix)
+
+
+def _put_bucket_logging_policy_wildcard(add_objects):
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    alt_client = get_alt_client()
+    alt_src_bucket_name = get_new_bucket_name()
+    alt_src_bucket = get_new_bucket(client=alt_client, name=alt_src_bucket_name)
+    prefix = 'log/'
+    log_tenant = ""
+    src_tenant = ""
+    src_user = get_main_user_id()
+    alt_user = get_alt_user_id()
+
+    policy = {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "S3ServerAccessLogsPolicy",
+                "Effect": "Allow",
+                "Principal": {"Service": "logging.s3.amazonaws.com"},
+                "Action": ["s3:PutObject"],
+                "Resource": "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, prefix),
+                "Condition": {
+                    "ArnLike": {"aws:SourceArn": "arn:aws:s3::{}:{}".format(src_tenant, src_bucket_name)},
+                    "StringLike": {
+                        "aws:SourceAccount": "{}${}".format(src_tenant, src_user) if src_tenant else src_user
+                        }
+                }
+            },
+            {
+                "Sid": "S3ServerAccessLogsPolicy",
+                "Effect": "Allow",
+                "Principal": {"Service": "logging.s3.amazonaws.com"},
+                "Action": ["s3:PutObject"],
+                "Resource": "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, prefix),
+                "Condition": {
+                    "ArnLike": {"aws:SourceArn": "arn:aws:s3::{}:{}".format(src_tenant, alt_src_bucket_name)},
+                    "StringLike": {
+                        "aws:SourceAccount": "{}${}".format(src_tenant, src_user) if src_tenant else alt_user
+                        }
+                }
+            }
+        ]
+    }
+
+    # verify policy is ok
+    _set_bucket_policy(client, log_bucket_name, policy)
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = alt_client.put_bucket_logging(Bucket=alt_src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # remove the 2nd statement from the policy
+    # and make sure it fails
+    policy['Statement'].pop()
+    _set_bucket_policy(client, log_bucket_name, policy)
+    _verify_access_denied(alt_client, alt_src_bucket_name, log_bucket_name, prefix)
+
+    # use wildcards account/bucket
+    policy['Statement'][0]['Condition']['StringLike']['aws:SourceAccount'] = "*"
+    policy['Statement'][0]['Condition']['ArnLike']['aws:SourceArn'] = "arn:aws:s3::{}:*".format(src_tenant)
+    _set_bucket_policy(client, log_bucket_name, policy)
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = alt_client.put_bucket_logging(Bucket=alt_src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    if not add_objects:
+        return
+
+    # put objects when policy is ok
+    num_keys = 5
+    src_keys = []
+    for j in range(num_keys):
+        name = 'myobject_1_'+str(j)
+        src_keys.append(name)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        name = 'myobject_2_'+str(j)
+        src_keys.append(name)
+        alt_client.put_object(Bucket=alt_src_bucket_name, Key=name, Body=randcontent())
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+    for key in keys:
+        assert key.startswith('log/')
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body = _get_body(response)
+        assert _verify_records(body, " ", 'REST.PUT.OBJECT', src_keys, "Standard", num_keys*2)
+
+    # non wildcard source account policy
+    policy['Statement'][0]['Condition']['StringLike']['aws:SourceAccount'] = "{}${}".format(src_tenant, src_user) if src_tenant else src_user
+    _set_bucket_policy(client, log_bucket_name, policy)
+    for j in range(num_keys):
+        name = 'myobject_2_'+str(j)
+        src_keys.append(name)
+        alt_client.put_object(Bucket=alt_src_bucket_name, Key=name, Body=randcontent())
+    try:
+        _flush_logs(alt_client, alt_src_bucket_name)
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'AccessDenied'
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    # no new keys were added
+    assert len(keys) == 1
+
+
+@pytest.mark.bucket_logging
+def test_put_bucket_logging_policy_wildcard():
+    _put_bucket_logging_policy_wildcard(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_put_bucket_logging_policy_wildcard_objects():
+    _put_bucket_logging_policy_wildcard(True)
+
+
+def _bucket_logging_permission_change(logging_type):
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    log_tenant = ""
+    src_tenant = ""
+    src_user = get_main_user_id()
+
+    policy = {
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Sid": "S3ServerAccessLogsPolicy",
+            "Effect": "Allow",
+            "Principal": {"Service": "logging.s3.amazonaws.com"},
+            "Action": ["s3:PutObject"],
+            "Resource": "arn:aws:s3::{}:{}/{}".format(log_tenant, log_bucket_name, prefix),
+            "Condition": {
+                "ArnLike": {"aws:SourceArn": "arn:aws:s3::{}:{}".format(src_tenant, src_bucket_name)},
+                "StringEquals": {
+                    "aws:SourceAccount": "{}${}".format(src_tenant, src_user) if src_tenant else src_user
+                    }
+            }
+        }]
+    }
+
+    policy_document = json.dumps(policy)
+    response = client.put_bucket_policy(Bucket=log_bucket_name, Policy=policy_document)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    if logging_type == 'Journal':
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix, 'LoggingType': logging_type}})
+    else:
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    # put objects when policy is ok
+    num_keys = 5
+    good_src_keys = []
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        good_src_keys.append(name)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+    # change policy to invalid source bucket
+    policy['Statement'][0]['Condition']['ArnLike']['aws:SourceArn'] = "arn:aws:s3::{}:{}".format(src_tenant, "kaboom")
+    _set_bucket_policy(client, log_bucket_name, policy)
+
+    bad_src_keys = []
+    # put objects when policy should reject them
+    for j in range(num_keys, num_keys*2):
+        name = 'myobject'+str(j)
+        bad_src_keys.append(name)
+        if logging_type == 'Standard':
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        else:
+            try:
+                client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+                assert False, 'expected failure'
+            except ClientError as e:
+                assert e.response['Error']['Code'] == 'AccessDenied'
+                assert e.response['Error']['Message'].startswith('Logging bucket')
+
+    try:
+        _flush_logs(client, src_bucket_name)
+        assert False, 'expected failure'
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'AccessDenied'
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 0
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_permission_change_s():
+    _bucket_logging_permission_change('Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_permission_change_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_permission_change('Journal')
+
+
+def _bucket_logging_objects(src_client, src_bucket_name, log_client, log_bucket_name, log_type, op_name):
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        src_client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    expected_count = num_keys
+
+    response = src_client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+
+    flushed_obj = _flush_logs(src_client, src_bucket_name)
+
+    response = log_client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    for key in keys:
+        if flushed_obj is not None:
+            assert key == flushed_obj
+        assert key.startswith('log/')
+        response = log_client.get_object(Bucket=log_bucket_name, Key=key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, op_name, src_keys, log_type, expected_count)
+
+
+def _put_bucket_logging_tenant(log_type):
+    # src is on default tenant and log is on a different tenant
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    tenant_client = get_tenant_client()
+    log_bucket = get_new_bucket(client=tenant_client, name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    log_tenant = get_tenant_name()
+    _set_log_bucket_policy_tenant(tenant_client, log_tenant, log_bucket_name, "", get_main_user_id(), [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_tenant+':'+log_bucket_name, 'TargetPrefix': prefix}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, tenant_client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+    # src is on default tenant and log is on a different tenant with the same name
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = src_bucket_name
+    tenant_client = get_tenant_client()
+    log_bucket = get_new_bucket(client=tenant_client, name=log_bucket_name)
+    client = get_client()
+    tenant_name = get_tenant_name()
+    _set_log_bucket_policy_tenant(tenant_client, tenant_name, log_bucket_name, "", get_main_user_id(),  [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': tenant_name+':'+log_bucket_name, 'TargetPrefix': prefix}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, tenant_client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+
+    try:
+        # src is on default tenant and log is on a different tenant
+        # log bucket name not set correctly
+        src_bucket_name = get_new_bucket_name()
+        src_bucket = get_new_bucket_resource(name=src_bucket_name)
+        log_bucket_name = get_new_bucket_name()
+        log_client = get_tenant_client()
+        log_bucket = get_new_bucket(client=log_client, name=log_bucket_name)
+        client = get_client()
+        _set_log_bucket_policy_tenant(log_client, get_tenant_name(), log_bucket_name, "", get_main_user_id(), [src_bucket_name], [prefix])
+        logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+        if log_type == 'Journal':
+            logging_enabled['LoggingType'] = 'Journal'
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'NoSuchKey'
+    else:
+        assert False, 'expected failure'
+
+    # src and log are on the same tenant
+    # log bucket name is set with tenant
+    client = get_tenant_client()
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket(client=client, name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket(client=client, name=log_bucket_name)
+    tenant_name = get_tenant_name()
+    _set_log_bucket_policy_tenant(client, tenant_name, log_bucket_name, tenant_name, get_tenant_user_id(), [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': tenant_name+':'+log_bucket_name, 'TargetPrefix': prefix}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+    # src and log are on the same tenant
+    # log bucket name is set without tenant
+    client = get_tenant_client()
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket(client=client, name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket(client=client, name=log_bucket_name)
+    tenant_name = get_tenant_name()
+    _set_log_bucket_policy_tenant(client, tenant_name, log_bucket_name, tenant_name, get_tenant_user_id(), [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+    # src is on tenant and log is on the default tenant
+    # log bucket name is set with explicit default tenant
+    client = get_tenant_client()
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket(client=client, name=src_bucket_name)
+    log_client = get_client()
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket(client=log_client, name=log_bucket_name)
+    _set_log_bucket_policy_tenant(log_client, "", log_bucket_name, get_tenant_name(), get_tenant_user_id(), [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': ':'+log_bucket_name, 'TargetPrefix': 'log/'}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, log_client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+    try:
+        # src is on tenant and log is on the default tenant
+        client = get_tenant_client()
+        src_bucket_name = get_new_bucket_name()
+        src_bucket = get_new_bucket(client=client, name=src_bucket_name)
+        log_bucket_name = get_new_bucket_name()
+        log_client = get_client()
+        log_bucket = get_new_bucket(client=log_client, name=log_bucket_name)
+        _set_log_bucket_policy_tenant(log_client, "", log_bucket_name, get_tenant_name(), get_tenant_user_id(), [src_bucket_name], [prefix])
+        logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': 'log/'}
+        if log_type == 'Journal':
+            logging_enabled['LoggingType'] = 'Journal'
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+    except ClientError as e:
+        assert e.response['Error']['Code'] == 'NoSuchKey'
+    else:
+        assert False, 'expected failure'
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_put_bucket_logging_tenant_s():
+    _put_bucket_logging_tenant('Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_put_bucket_logging_tenant_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _put_bucket_logging_tenant('Journal')
+
+
+def _put_bucket_logging_account(log_type):
+    # src is default user and log is in an account user
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_client = get_iam_root_s3client()
+    log_bucket = get_new_bucket(client=log_client, name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy_tenant(log_client, "", log_bucket_name, "", get_main_user_id(), [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, log_client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+    # src and log are in an iam account
+    client = get_iam_root_s3client()
+    iam_client = get_iam_root_client()
+    iam_user = iam_client.get_user()['User']['Arn'].split(':')[-2]  # Get the IAM user name from ARN
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket(client=client, name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket(client=client, name=log_bucket_name)
+    _set_log_bucket_policy_tenant(client, "", log_bucket_name, "", iam_user, [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+    # src is in an iam account and log is the default user
+    client = get_iam_root_s3client()
+    iam_client = get_iam_root_client()
+    iam_user = iam_client.get_user()['User']['Arn'].split(':')[-2]  # Get the IAM user name from ARN
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket(client=client, name=src_bucket_name)
+    log_client = get_client()
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket(client=log_client, name=log_bucket_name)
+    _set_log_bucket_policy_tenant(log_client, "", log_bucket_name, "", iam_user, [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': 'log/'}
+    if log_type == 'Journal':
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    _bucket_logging_objects(client, src_bucket_name, log_client, log_bucket_name, log_type, 'REST.PUT.OBJECT')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_put_bucket_logging_account_s():
+    _put_bucket_logging_account('Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_put_bucket_logging_account_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _put_bucket_logging_account('Journal')
+
+
+@pytest.mark.bucket_logging
+def test_rm_bucket_logging():
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={})
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    assert not 'LoggingEnabled' in response
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_put_bucket_logging_extensions():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name,
+                       'TargetPrefix': prefix,
+                       'LoggingType': 'Standard',
+                       'ObjectRollTime': expected_object_roll_time,
+                       'RecordsBatchSize': 0
+                       }
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.get_bucket_logging(Bucket=src_bucket_name)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    logging_enabled['TargetObjectKeyFormat'] = {'SimplePrefix': {}}
+    assert response['LoggingEnabled'] == logging_enabled
+
+
+def _bucket_logging_put_objects(versioned):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        if versioned:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    if versioned:
+        expected_count = 2*num_keys
+    else:
+        expected_count = num_keys
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+
+    flushed_obj = _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    record_type = 'Standard' if not has_extensions else 'Journal'
+
+    for key in keys:
+        if flushed_obj is not None:
+            assert key == flushed_obj
+        assert key.startswith('log/')
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body = _get_body(response)
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, record_type, expected_count)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_put_objects():
+    _bucket_logging_put_objects(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_put_objects_versioned():
+    _bucket_logging_put_objects(True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_put_concurrency():
+    src_bucket_name = get_new_bucket()
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client(client_config=botocore.config.Config(max_pool_connections=50))
+    has_extensions = _has_bucket_logging_extension()
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 50
+    t = []
+    for i in range(num_keys):
+        name = 'myobject'+str(i)
+        thr = threading.Thread(target = client.put_object,
+                               kwargs={'Bucket': src_bucket_name, 'Key': name, 'Body': randcontent()})
+        thr.start()
+        t.append(thr)
+    _do_wait_completion(t)
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+    if not has_extensions:
+        time.sleep(expected_object_roll_time*1.1)
+    t = []
+    for i in range(num_keys):
+        if has_extensions:
+            thr = threading.Thread(target = client.post_bucket_logging,
+                                   kwargs={'Bucket': src_bucket_name})
+        else:
+            thr = threading.Thread(target = client.put_object,
+                                   kwargs={'Bucket': src_bucket_name, 'Key': 'dummy', 'Body': 'dummy'})
+        thr.start()
+        t.append(thr)
+    _do_wait_completion(t)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+
+    record_type = 'Standard' if not has_extensions else 'Journal'
+
+    body = ""
+    for key in keys:
+        assert key.startswith('log/')
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, record_type, num_keys)
+
+
+def _bucket_logging_delete_objects(versioned):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        if versioned:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+    for key in src_keys:
+        if versioned:
+            response = client.head_object(Bucket=src_bucket_name, Key=key)
+            client.delete_object(Bucket=src_bucket_name, Key=key, VersionId=response['VersionId'])
+        client.delete_object(Bucket=src_bucket_name, Key=key)
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    if versioned:
+        expected_count = 2*num_keys
+    else:
+        expected_count = num_keys
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    record_type = 'Standard' if not has_extensions else 'Journal'
+    assert _verify_records(body, src_bucket_name, 'REST.DELETE.OBJECT', src_keys, record_type, expected_count)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_delete_objects():
+    _bucket_logging_delete_objects(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_delete_objects_versioned():
+    _bucket_logging_delete_objects(True)
+
+
+@pytest.mark.bucket_logging
+def _bucket_logging_get_objects(versioned):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        if versioned:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Standard'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+    for key in src_keys:
+        if versioned:
+            response = client.head_object(Bucket=src_bucket_name, Key=key)
+            client.get_object(Bucket=src_bucket_name, Key=key, VersionId=response['VersionId'])
+        client.get_object(Bucket=src_bucket_name, Key=key)
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    if versioned:
+        expected_count = 2*num_keys
+    else:
+        expected_count = num_keys
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.GET.OBJECT', src_keys, 'Standard', expected_count)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_get_objects():
+    _bucket_logging_get_objects(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_get_objects_versioned():
+    _bucket_logging_get_objects(True)
+
+
+@pytest.mark.bucket_logging
+def _bucket_logging_copy_objects(versioned, another_bucket):
+    src_bucket_name = get_new_bucket()
+    if another_bucket:
+        dst_bucket_name = get_new_bucket()
+    else:
+        dst_bucket_name = src_bucket_name
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        if versioned:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name, dst_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    if another_bucket:
+        response = client.put_bucket_logging(Bucket=dst_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+    dst_keys = []
+    for key in src_keys:
+        dst_keys.append('copy_of_'+key)
+        if another_bucket:
+            client.copy_object(Bucket=dst_bucket_name, Key='copy_of_'+key, CopySource={'Bucket': src_bucket_name, 'Key': key})
+        else:
+            client.copy_object(Bucket=src_bucket_name, Key='copy_of_'+key, CopySource={'Bucket': src_bucket_name, 'Key': key})
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    record_type = 'Standard' if not has_extensions else 'Journal'
+    assert _verify_records(body, dst_bucket_name, 'REST.PUT.OBJECT', dst_keys, record_type, num_keys)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_copy_objects():
+    _bucket_logging_copy_objects(False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_copy_objects_versioned():
+    _bucket_logging_copy_objects(True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_copy_objects_bucket():
+    _bucket_logging_copy_objects(False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_copy_objects_bucket_versioned():
+    _bucket_logging_copy_objects(True, True)
+
+
+@pytest.mark.bucket_logging
+def _bucket_logging_head_objects(versioned):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Standard'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+    for key in src_keys:
+        if versioned:
+            response = client.head_object(Bucket=src_bucket_name, Key=key)
+            client.head_object(Bucket=src_bucket_name, Key=key, VersionId=response['VersionId'])
+        else:
+            client.head_object(Bucket=src_bucket_name, Key=key)
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    if versioned:
+        expected_count = 2*num_keys
+    else:
+        expected_count = num_keys
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.HEAD.OBJECT', src_keys, 'Standard', expected_count)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_head_objects():
+    _bucket_logging_head_objects(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_head_objects_versioned():
+    _bucket_logging_head_objects(True)
+
+
+@pytest.mark.bucket_logging
+def _bucket_logging_mpu(versioned, record_type):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if record_type == 'Journal':
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    src_key = "myobject"
+    objlen = 30 * 1024 * 1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=src_bucket_name, key=src_key, size=objlen)
+    client.complete_multipart_upload(Bucket=src_bucket_name, Key=src_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    if versioned:
+        (upload_id, data, parts) = _multipart_upload(bucket_name=src_bucket_name, key=src_key, size=objlen)
+        client.complete_multipart_upload(Bucket=src_bucket_name, Key=src_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    if versioned:
+        expected_count = 4 if not record_type == 'Journal' else 2
+    else:
+        expected_count = 2 if not record_type == 'Journal' else 1
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.POST.UPLOAD', [src_key, src_key], record_type, expected_count)
+    if record_type == 'Standard':
+        if versioned:
+            expected_count = 12
+        else:
+            expected_count = 6
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.PART', [src_key, src_key], record_type, expected_count)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_mpu_s():
+    _bucket_logging_mpu(False, 'Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_mpu_versioned_s():
+    _bucket_logging_mpu(True, 'Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_mpu_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_mpu(False, 'Journal')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_mpu_versioned_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_mpu(True, 'Journal')
+
+@pytest.mark.bucket_logging
+def _bucket_logging_mpu_copy(versioned):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    src_key = "myobject"
+    objlen = 30 * 1024 * 1024
+    (upload_id, data, parts) = _multipart_upload(bucket_name=src_bucket_name, key=src_key, size=objlen)
+    client.complete_multipart_upload(Bucket=src_bucket_name, Key=src_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    if versioned:
+        (upload_id, data, parts) = _multipart_upload(bucket_name=src_bucket_name, key=src_key, size=objlen)
+        client.complete_multipart_upload(Bucket=src_bucket_name, Key=src_key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    client.copy_object(Bucket=src_bucket_name, Key='copy_of_'+src_key, CopySource={'Bucket': src_bucket_name, 'Key': src_key})
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    record_type = 'Standard' if not has_extensions else 'Journal'
+    assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', ['copy_of_'+src_key], record_type, 1)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_mpu_copy():
+    _bucket_logging_mpu_copy(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_mpu_copy_versioned():
+    _bucket_logging_mpu_copy(True)
+
+
+def _bucket_logging_multi_delete(versioned):
+    src_bucket_name = get_new_bucket()
+    if versioned:
+        check_configure_versioning_retry(src_bucket_name, "Enabled", "Enabled")
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        if versioned:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    # minimal configuration
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix}
+    if has_extensions:
+        logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        logging_enabled['LoggingType'] = 'Journal'
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+    if versioned:
+        response = client.list_object_versions(Bucket=src_bucket_name)
+        objs_list = []
+        for version in response['Versions']:
+            obj_dict = {'Key': version['Key'], 'VersionId': version['VersionId']}
+            objs_list.append(obj_dict)
+        objs_dict = {'Objects': objs_list}
+        client.delete_objects(Bucket=src_bucket_name, Delete=objs_dict)
+    else:
+        objs_dict = _make_objs_dict(key_names=src_keys)
+        client.delete_objects(Bucket=src_bucket_name, Delete=objs_dict)
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    if versioned:
+        expected_count = 2*num_keys
+    else:
+        expected_count = num_keys
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    record_type = 'Standard' if not has_extensions else 'Journal'
+    assert _verify_records(body, src_bucket_name, "REST.POST.DELETE_MULTI_OBJECT", src_keys, record_type, expected_count)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_multi_delete():
+    _bucket_logging_multi_delete(False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_multi_delete_versioned():
+    _bucket_logging_multi_delete(True)
+
+
+def _bucket_logging_type(logging_type):
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    logging_enabled = {
+            'TargetBucket': log_bucket_name,
+            'TargetPrefix': prefix,
+            'ObjectRollTime': expected_object_roll_time,
+            'LoggingType': logging_type
+            }
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        client.head_object(Bucket=src_bucket_name, Key=name)
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    if logging_type == 'Journal':
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, 'Journal', num_keys)
+        assert _verify_records(body, src_bucket_name, 'REST.HEAD.OBJECT', src_keys, 'Journal', num_keys) == False
+    elif logging_type == 'Standard':
+        assert _verify_records(body, src_bucket_name, 'REST.HEAD.OBJECT', src_keys, 'Standard', num_keys)
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, 'Standard', num_keys)
+    else:
+        assert False, 'invalid logging type:'+logging_type
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_event_type_j():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_type('Journal')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_event_type_s():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    _bucket_logging_type('Standard')
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_roll_time():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    roll_time = 10
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix, 'ObjectRollTime': roll_time}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 5
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+
+    time.sleep(roll_time/2)
+    client.put_object(Bucket=src_bucket_name, Key='myobject', Body=randcontent())
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 0
+
+    time.sleep(roll_time/2)
+    client.put_object(Bucket=src_bucket_name, Key='myobject', Body=randcontent())
+
+    # It can take up to 10s for the bucket logging manager to detect a new commit list
+    time.sleep(11)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    key = keys[0]
+    assert key.startswith('log/')
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, 'Standard', num_keys)
+    client.delete_object(Bucket=log_bucket_name, Key=key)
+
+    num_keys = 25
+    for j in range(num_keys):
+        name = 'myobject'+str(j)
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+        time.sleep(1)
+
+    response = client.list_objects_v2(Bucket=src_bucket_name)
+    src_keys = _get_keys(response)
+
+    time.sleep(roll_time)
+    client.put_object(Bucket=src_bucket_name, Key='myobject', Body=randcontent())
+    time.sleep(5)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) > 1
+
+    body = ''
+    for key in keys:
+        assert key.startswith('log/')
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+    assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, 'Standard', num_keys+1)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_multiple_prefixes():
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_buckets = 5
+    log_prefixes = []
+    buckets = []
+    bucket_name_prefix = get_new_bucket_name()
+    for j in range(num_buckets):
+        src_bucket_name = bucket_name_prefix+str(j)
+        src_bucket = get_new_bucket_resource(name=src_bucket_name)
+        log_prefixes.append(src_bucket_name+'/')
+        buckets.append(src_bucket_name)
+
+    _set_log_bucket_policy(client, log_bucket_name, buckets, log_prefixes)
+
+    for j in range(num_buckets):
+        logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': log_prefixes[j]}
+        if has_extensions:
+            logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        response = client.put_bucket_logging(Bucket=buckets[j], BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 5
+    for src_bucket_name in buckets:
+        for j in range(num_keys):
+            name = 'myobject'+str(j)
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    for src_bucket_name in buckets:
+        _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) >= num_buckets
+
+    for key in keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body = _get_body(response)
+        found = False
+        for src_bucket_name in buckets:
+            if key.startswith(src_bucket_name):
+                found = True
+                response = client.list_objects_v2(Bucket=src_bucket_name)
+                src_keys = _get_keys(response)
+                assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, 'Standard', num_keys)
+        assert found
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_without_logging_rollover
+def test_bucket_logging_single_prefix():
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+    has_extensions = _has_bucket_logging_extension()
+
+    num_buckets = 5
+    buckets = []
+    prefix = 'log/'
+    bucket_name_prefix = get_new_bucket_name()
+    for j in range(num_buckets):
+        src_bucket_name = bucket_name_prefix+str(j)
+        src_bucket = get_new_bucket_resource(name=src_bucket_name)
+        buckets.append(src_bucket_name)
+
+    _set_log_bucket_policy(client, log_bucket_name, buckets, [prefix])
+
+    for j in range(num_buckets):
+        # minimal configuration
+        logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': 'log/'}
+        if has_extensions:
+            logging_enabled['ObjectRollTime'] = expected_object_roll_time
+        response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 5
+    bucket_ind = 0
+    for src_bucket_name in buckets:
+        bucket_ind += 1
+        for j in range(num_keys):
+            name = 'myobject'+str(bucket_ind)+str(j)
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    _flush_logs(client, src_bucket_name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+
+    key = keys[0]
+    response = client.get_object(Bucket=log_bucket_name, Key=key)
+    body = _get_body(response)
+    found = False
+    for src_bucket_name in buckets:
+        response = client.list_objects_v2(Bucket=src_bucket_name)
+        src_keys = _get_keys(response)
+        found = _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_keys, 'Standard', num_keys)
+    assert found
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.fails_on_aws
+def test_bucket_logging_object_meta():
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    client = get_client()
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = client.create_bucket(Bucket=src_bucket_name, ObjectLockEnabledForBucket=True)
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+
+    prefix = 'log/'
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+    logging_enabled = {'TargetBucket': log_bucket_name, 'TargetPrefix': prefix, 'LoggingType': 'Journal'}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    name = 'myobject'
+    response = client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+    version_id = response['VersionId']
+    # PutObjectAcl
+    client.put_object_acl(ACL='public-read-write', Bucket=src_bucket_name, Key=name, VersionId=version_id)
+    # PutObjectTagging
+    client.put_object_tagging(Bucket=src_bucket_name, Key=name, VersionId=version_id,
+                              Tagging={'TagSet': [{'Key': 'tag1', 'Value': 'value1'}, {'Key': 'tag2', 'Value': 'value2'}]})
+    # DeleteObjectTagging
+    client.delete_object_tagging(Bucket=src_bucket_name, Key=name, VersionId=version_id)
+    # PutObjectLegalHold
+    client.put_object_legal_hold(Bucket=src_bucket_name, Key=name, LegalHold={'Status': 'ON'})
+    # PutObjectRetention
+    client.put_object_retention(Bucket=src_bucket_name, Key=name, Retention={'Mode': 'GOVERNANCE', 'RetainUntilDate': datetime.datetime.now() + datetime.timedelta(days=60)})
+
+    _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    log_keys = _get_keys(response)
+    assert len(log_keys) == 1
+    log_key = log_keys[0]
+    expected_op_list = ['REST.PUT.OBJECT', 'REST.PUT.ACL', 'REST.PUT.LEGAL_HOLD', 'REST.PUT.RETENTION', 'REST.PUT.OBJECT_TAGGING', 'REST.DELETE.OBJECT_TAGGING']
+    op_list = []
+    response = client.get_object(Bucket=log_bucket_name, Key=log_key)
+    body = _get_body(response)
+    for record in iter(body.splitlines()):
+        parsed_record = _parse_log_record(record, 'Journal')
+        logger.info('bucket log record: %s', json.dumps(parsed_record, indent=4))
+        op_list.append(parsed_record['Operation'])
+        version = parsed_record['VersionID']
+        if version != '-':
+            assert version == version_id
+
+    assert sorted(expected_op_list) == sorted(op_list)
+
+    # allow cleanup
+    client.put_object_legal_hold(Bucket=src_bucket_name, Key=name, LegalHold={'Status': 'OFF'})
+    client.delete_object(Bucket=src_bucket_name, Key=name, VersionId=version_id, BypassGovernanceRetention=True)
+
+def _verify_flushed_on_put(result):
+    if _has_bucket_logging_extension():
+        assert result['ResponseMetadata']['HTTPStatusCode'] == 200
+        return result['FlushedLoggingObject']
+
+
+def _bucket_logging_cleanup(cleanup_type, logging_type, single_prefix, concurrency):
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+
+    num_buckets = 5
+    buckets = []
+    log_prefixes = []
+    longer_time = expected_object_roll_time*10
+    for j in range(num_buckets):
+        src_bucket_name = get_new_bucket_name()
+        src_bucket = get_new_bucket_resource(name=src_bucket_name)
+        buckets.append(src_bucket_name)
+        if single_prefix:
+            log_prefixes.append('log/')
+        else:
+            log_prefixes.append(src_bucket_name+'/')
+
+    _set_log_bucket_policy(client, log_bucket_name, buckets, log_prefixes)
+
+    for j in range(num_buckets):
+        logging_enabled = {'TargetBucket': log_bucket_name,
+                           'ObjectRollTime': longer_time,
+                           'LoggingType': logging_type,
+                           'TargetPrefix': log_prefixes[j]}
+        response = client.put_bucket_logging(Bucket=buckets[j], BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 10
+    src_names = []
+    for j in range(num_keys):
+        src_names.append('myobject'+str(j))
+
+    for src_bucket_name in buckets:
+        for name in src_names:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+            client.delete_object(Bucket=src_bucket_name, Key=name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 0
+
+    t = []
+    flushed_obj = None
+    updated_longer_time = expected_object_roll_time*20
+    first_time = True
+    for src_bucket_name in buckets:
+        if not single_prefix:
+            logging_enabled['TargetPrefix'] = src_bucket_name+'/'
+        if cleanup_type == 'deletion':
+            #  cleanup based on bucket deletion
+            if concurrency:
+                thr = threading.Thread(target = client.delete_bucket,
+                                       kwargs={'Bucket': src_bucket_name})
+                thr.start()
+                t.append(thr)
+            else:
+                client.delete_bucket(Bucket=src_bucket_name)
+        elif cleanup_type == 'disabling':
+            # cleanup based on disabling bucket logging
+            if concurrency:
+                thr = threading.Thread(target = client.put_bucket_logging,
+                                       kwargs={'Bucket': src_bucket_name, 'BucketLoggingStatus': {}})
+                thr.start()
+                t.append(thr)
+            else:
+                result = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={})
+                if first_time:
+                    flushed_obj = _verify_flushed_on_put(result)
+                    if single_prefix:
+                        first_time = False
+        elif cleanup_type == 'updating':
+            # cleanup based on updating bucket logging parameters
+            logging_enabled['ObjectRollTime'] = updated_longer_time
+            if concurrency:
+                thr = threading.Thread(target = client.put_bucket_logging,
+                                       kwargs={'Bucket': src_bucket_name, 'BucketLoggingStatus': {'LoggingEnabled': logging_enabled}})
+                thr.start()
+                t.append(thr)
+            else:
+                result = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+                    'LoggingEnabled': logging_enabled,
+                })
+                flushed_obj = _verify_flushed_on_put(result)
+        elif cleanup_type == 'notupdating':
+            # no concurrecy testing
+            client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+                'LoggingEnabled': logging_enabled,
+            })
+        elif cleanup_type != 'target':
+            assert False, 'invalid cleanup type: ' + cleanup_type
+
+    _do_wait_completion(t)
+
+    if cleanup_type == 'target':
+        # delete the log bucket and then create it to make sure that no pending objects remained
+        # no concurrecy testing
+        client.delete_bucket(Bucket=log_bucket_name)
+        log_bucket = get_new_bucket_resource(name=log_bucket_name)
+        _set_log_bucket_policy(client, log_bucket_name, buckets, log_prefixes)
+        old_names = src_names
+        src_names = []
+        for j in range(num_keys):
+            src_names.append('after_deletion_myobject'+str(j))
+        for src_bucket_name in buckets:
+            for name in src_names:
+                client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+                client.delete_object(Bucket=src_bucket_name, Key=name)
+        response = client.list_objects_v2(Bucket=log_bucket_name)
+        keys = _get_keys(response)
+        assert len(keys) == 0
+        # flsuh any new pending objects
+        for src_bucket_name in buckets:
+            client.post_bucket_logging(Bucket=src_bucket_name)
+        # make sure that only the new objects are logged
+        exact_match = True
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+
+    if flushed_obj:
+        assert flushed_obj in keys
+
+    if cleanup_type == 'notupdating':
+        # no cleanup expected
+        assert len(keys) == 0
+        return
+
+    if concurrency:
+        assert len(keys) >= 1 and len(keys) <= num_buckets
+    else:
+        if single_prefix and logging_type == 'Journal' and cleanup_type not in ['target', 'updating']:
+            assert len(keys) == 1
+        else:
+            assert len(keys) == num_buckets
+
+    prefixes = []
+    for src_bucket_name in buckets:
+        if single_prefix:
+            prefix = 'log/'
+        else:
+            prefix = src_bucket_name+'/'
+        prefixes.append(prefix)
+
+    body = ""
+    for key in keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+        found = False
+        for prefix in prefixes:
+            if key.startswith(prefix):
+                found = True
+        assert found, 'log key does not match any expected prefix: ' + key + ' expected prefixes: ' + str(prefixes)
+
+    exact_match = True
+    for src_bucket_name in buckets:
+        assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_names, logging_type, num_keys, exact_match)
+        assert _verify_records(body, src_bucket_name, 'REST.DELETE.OBJECT', src_names, logging_type, num_keys, exact_match)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_deletion_j():
+    _bucket_logging_cleanup('deletion', 'Journal', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_deletion_j_single():
+    _bucket_logging_cleanup('deletion', 'Journal', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_disabling_j():
+    _bucket_logging_cleanup('disabling', 'Journal', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_disabling_j_single():
+    _bucket_logging_cleanup('disabling', 'Journal', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_updating_j():
+    _bucket_logging_cleanup('updating', 'Journal', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_updating_j_single():
+    _bucket_logging_cleanup('updating', 'Journal', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_notupdating_j():
+    _bucket_logging_cleanup('notupdating', 'Journal', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_notupdating_j_single():
+    _bucket_logging_cleanup('notupdating', 'Journal', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_deletion_s():
+    _bucket_logging_cleanup('deletion', 'Standard', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_deletion_s_single():
+    _bucket_logging_cleanup('deletion', 'Standard', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_disabling_s():
+    _bucket_logging_cleanup('disabling', 'Standard', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_disabling_s_single():
+    _bucket_logging_cleanup('disabling', 'Standard', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_updating_s():
+    _bucket_logging_cleanup('updating', 'Standard', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_updating_s_single():
+    _bucket_logging_cleanup('updating', 'Standard', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_notupdating_s():
+    _bucket_logging_cleanup('notupdating', 'Standard', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_notupdating_s_single():
+    _bucket_logging_cleanup('notupdating', 'Standard', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_target_cleanup_j():
+    _bucket_logging_cleanup('target', 'Journal', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_target_cleanup_j_single():
+    _bucket_logging_cleanup('target', 'Journal', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_target_cleanup_s():
+    _bucket_logging_cleanup('target', 'Standard', False, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_target_cleanup_s_single():
+    _bucket_logging_cleanup('target', 'Standard', True, False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_concurrent_deletion_j():
+    _bucket_logging_cleanup('deletion', 'Journal', False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_concurrent_deletion_j_single():
+    _bucket_logging_cleanup('deletion', 'Journal', True, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_disabling_j():
+    _bucket_logging_cleanup('disabling', 'Journal', False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_disabling_j_single():
+    _bucket_logging_cleanup('disabling', 'Journal', True, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_updating_j():
+    _bucket_logging_cleanup('updating', 'Journal', False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_updating_j_single():
+    _bucket_logging_cleanup('updating', 'Journal', True, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_concurrent_deletion_s():
+    _bucket_logging_cleanup('deletion', 'Standard', False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_bucket_concurrent_deletion_s_single():
+    _bucket_logging_cleanup('deletion', 'Standard', True, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_disabling_s():
+    _bucket_logging_cleanup('disabling', 'Standard', False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_disabling_s_single():
+    _bucket_logging_cleanup('disabling', 'Standard', True, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_updating_s():
+    _bucket_logging_cleanup('updating', 'Standard', False, True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_cleanup_concurrent_updating_s_single():
+    _bucket_logging_cleanup('updating', 'Standard', True, True)
+
+
+def _bucket_logging_partial_cleanup(cleanup_type, logging_type, concurrency):
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+
+    num_buckets = 3
+    buckets = []
+    log_prefixes = []
+    longer_time = expected_object_roll_time*10
+    for j in range(num_buckets):
+        src_bucket_name = get_new_bucket_name()
+        src_bucket = get_new_bucket_resource(name=src_bucket_name)
+        buckets.append(src_bucket_name)
+        log_prefixes.append('log/')
+
+    _set_log_bucket_policy(client, log_bucket_name, buckets, log_prefixes)
+
+    for j in range(num_buckets):
+        logging_enabled = {'TargetBucket': log_bucket_name,
+                           'ObjectRollTime': longer_time,
+                           'LoggingType': logging_type,
+                           'TargetPrefix': log_prefixes[j]}
+        response = client.put_bucket_logging(Bucket=buckets[j], BucketLoggingStatus={
+            'LoggingEnabled': logging_enabled,
+        })
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 3
+    src_names = []
+    for j in range(num_keys):
+        src_names.append('myobject'+str(j))
+
+    for src_bucket_name in buckets:
+        for name in src_names:
+            client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+            client.delete_object(Bucket=src_bucket_name, Key=name)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 0
+
+    t = []
+    flushed_obj = None
+    updated_longer_time = expected_object_roll_time*20
+    first_time = True
+    for j in range(num_buckets-1):
+        src_bucket_name = buckets[j]
+        if cleanup_type == 'deletion':
+            #  cleanup based on bucket deletion
+            if concurrency:
+                thr = threading.Thread(target = client.delete_bucket,
+                                       kwargs={'Bucket': src_bucket_name})
+                thr.start()
+                t.append(thr)
+            else:
+                client.delete_bucket(Bucket=src_bucket_name)
+        elif cleanup_type == 'disabling':
+            # cleanup based on disabling bucket logging
+            if concurrency:
+                thr = threading.Thread(target = client.put_bucket_logging,
+                                       kwargs={'Bucket': src_bucket_name, 'BucketLoggingStatus': {}})
+                thr.start()
+                t.append(thr)
+            else:
+                result = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={})
+                if first_time:
+                    flushed_obj = _verify_flushed_on_put(result)
+                    first_time = False
+        elif cleanup_type == 'updating':
+            # cleanup based on updating bucket logging parameters
+            logging_enabled['ObjectRollTime'] = updated_longer_time
+            if concurrency:
+                thr = threading.Thread(target = client.put_bucket_logging,
+                                       kwargs={'Bucket': src_bucket_name, 'BucketLoggingStatus': {'LoggingEnabled': logging_enabled}})
+                thr.start()
+                t.append(thr)
+            else:
+                result = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+                    'LoggingEnabled': logging_enabled,
+                })
+                flushed_obj = _verify_flushed_on_put(result)
+        else:
+            assert False, 'invalid cleanup type: ' + cleanup_type
+
+    last_bucket_name = buckets[num_buckets-1]
+    for name in src_names:
+        client.put_object(Bucket=last_bucket_name, Key=name, Body=randcontent())
+        client.delete_object(Bucket=last_bucket_name, Key=name)
+
+    _do_wait_completion(t)
+
+    _flush_logs(client, last_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+
+    if flushed_obj:
+        assert flushed_obj in keys
+
+    if concurrency:
+        assert len(keys) >= 1 and len(keys) <= num_buckets
+    elif cleanup_type == 'updating':
+        assert len(keys) == num_buckets
+    elif logging_type == 'Standard':
+        # 1st deleted/disabled source write the bucket_deletion/put_bucket_logging record
+        assert len(keys) == num_buckets
+    else:
+        assert len(keys) == num_buckets - 1
+
+
+    prefixes = []
+    for src_bucket_name in buckets:
+        prefix = 'log/'
+        prefixes.append(prefix)
+
+    body = ""
+    for key in keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+        found = False
+        for prefix in prefixes:
+            if key.startswith(prefix):
+                found = True
+        assert found, 'log key does not match any expected prefix: ' + key + ' expected prefixes: ' + str(prefixes)
+
+    exact_match = True
+    for src_bucket_name in buckets:
+        _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_names, logging_type, num_keys, exact_match)
+        _verify_records(body, src_bucket_name, 'REST.DELETE.OBJECT', src_names, logging_type, num_keys, exact_match)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_concurrent_updating_s():
+    _bucket_logging_partial_cleanup('updating', 'Standard', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_concurrent_disabling_s():
+    _bucket_logging_partial_cleanup('disabling', 'Standard', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_concurrent_deletion_s():
+    _bucket_logging_partial_cleanup('deletion', 'Standard', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_concurrent_updating_j():
+    _bucket_logging_partial_cleanup('updating', 'Journal', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_concurrent_disabling_j():
+    _bucket_logging_partial_cleanup('disabling', 'Journal', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_concurrent_deletion_j():
+    _bucket_logging_partial_cleanup('deletion', 'Journal', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_updating_s():
+    _bucket_logging_partial_cleanup('updating', 'Standard', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_disabling_s():
+    _bucket_logging_partial_cleanup('disabling', 'Standard', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_deletion_s():
+    _bucket_logging_partial_cleanup('deletion', 'Standard', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_updating_j():
+    _bucket_logging_partial_cleanup('updating', 'Journal', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_disabling_j():
+    _bucket_logging_partial_cleanup('disabling', 'Journal', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_part_cleanup_deletion_j():
+    _bucket_logging_partial_cleanup('deletion', 'Journal', False)
+
+
+def _bucket_logging_conf_update(logging_type, update_value, concurrency):
+    if not _has_bucket_logging_extension():
+        pytest.skip('ceph extension to bucket logging not supported at client')
+    log_bucket_name = get_new_bucket_name()
+    log_bucket = get_new_bucket_resource(name=log_bucket_name)
+    client = get_client()
+
+    prefix = 'log/'
+    longer_time = expected_object_roll_time*10
+    src_bucket_name = get_new_bucket_name()
+    src_bucket = get_new_bucket_resource(name=src_bucket_name)
+
+    _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+
+    logging_enabled = {'TargetBucket': log_bucket_name,
+                       'ObjectRollTime': longer_time,
+                       'LoggingType': logging_type,
+                       'TargetPrefix': prefix}
+    response = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+    # conf update without any log records
+    if update_value == "roll_time":
+        logging_enabled['ObjectRollTime'] = longer_time*2
+    elif update_value == "prefix":
+        prefix = 'newlog1/'
+        _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+        logging_enabled['TargetPrefix'] = prefix
+    else:
+        assert False, 'invalid update value: ' + update_value
+
+    result = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    num_keys = 100
+    src_names = []
+    for j in range(num_keys):
+        src_names.append('myobject'+str(j))
+
+    def put_object_with_exception_handling(bucket, key, body):
+        try:
+            client.put_object(Bucket=bucket, Key=key, Body=body)
+        except Exception as e:
+            logger.warning(f'put_object failed for {key}: {e}')
+
+    t = []
+    for name in src_names:
+        if concurrency:
+            thr = threading.Thread(target=put_object_with_exception_handling,
+                                   args=(src_bucket_name, name, randcontent()))
+            thr.start()
+            t.append(thr)
+        else:
+            try:
+                client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+            except Exception as e:
+                logger.warning(f'put_object failed for {name}: {e}')
+
+    if update_value == "roll_time":
+        logging_enabled['ObjectRollTime'] = longer_time*3
+    elif update_value == "prefix":
+        prefix = 'newlog2/'
+        _set_log_bucket_policy(client, log_bucket_name, [src_bucket_name], [prefix])
+        logging_enabled['TargetPrefix'] = prefix
+    else:
+        assert False, 'invalid update value: ' + update_value
+    result = client.put_bucket_logging(Bucket=src_bucket_name, BucketLoggingStatus={
+        'LoggingEnabled': logging_enabled,
+    })
+
+    flushed_obj = _verify_flushed_on_put(result)
+    logger.info('flushed log object after conf update: %s', flushed_obj)
+
+    # perform conf update while puts are ongoing
+    _do_wait_completion(t)
+
+    expected_count = num_keys
+    expected_log_objs = 2
+    if concurrency:
+        # some records may be written after the conf change
+        _flush_logs(client, src_bucket_name)
+        expected_log_objs = 3
+        if update_value == 'prefix' and logging_type == 'Journal':
+            # when changing prefix in concurrency mode
+            # some put operations may fail, so the list of source objects
+            # needs to be taken fro mthe bucket
+            response = client.list_objects_v2(Bucket=src_bucket_name)
+            src_names = _get_keys(response)
+            expected_count = len(src_names)
+
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    # one empty log object due to the initial conf change
+    # and one with the log records due to the 2nd conf change
+    # and one flushed object at the end
+    assert len(keys) == expected_log_objs
+    assert flushed_obj in keys
+
+    exact_match = True
+    body = ""
+    for key in keys:
+        logger.info('processing log object: %s', key)
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+        # delete the key that we already processed
+        client.delete_object(Bucket=log_bucket_name, Key=key)
+
+    ok = _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_names, logging_type, expected_count, exact_match)
+    if not (concurrency and update_value == 'prefix' and logging_type == 'Standard'):
+        # we can have silent failures when changing the prefix in concurrency mode with standard logging
+        assert ok
+
+    # make sure that logging still works after conf change
+    src_names = []
+    for j in range(num_keys):
+        src_names.append('anotherobject'+str(j))
+    for name in src_names:
+        client.put_object(Bucket=src_bucket_name, Key=name, Body=randcontent())
+
+    flushed_obj = _flush_logs(client, src_bucket_name)
+    response = client.list_objects_v2(Bucket=log_bucket_name)
+    keys = _get_keys(response)
+    assert len(keys) == 1
+    assert flushed_obj in keys
+
+    body = ""
+    for key in keys:
+        response = client.get_object(Bucket=log_bucket_name, Key=key)
+        body += _get_body(response)
+
+    assert _verify_records(body, src_bucket_name, 'REST.PUT.OBJECT', src_names, logging_type, num_keys, exact_match)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_updating_roll_s():
+    _bucket_logging_conf_update('Standard', 'roll_time', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_updating_roll_j():
+    _bucket_logging_conf_update('Journal', 'roll_time', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_updating_pfx_s():
+    _bucket_logging_conf_update('Standard', 'prefix', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_updating_pfx_j():
+    _bucket_logging_conf_update('Journal', 'prefix', False)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_concurrent_updating_roll_s():
+    _bucket_logging_conf_update('Standard', 'roll_time', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_concurrent_updating_roll_j():
+    _bucket_logging_conf_update('Journal', 'roll_time', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_concurrent_updating_pfx_s():
+    _bucket_logging_conf_update('Standard', 'prefix', True)
+
+
+@pytest.mark.bucket_logging
+@pytest.mark.bucket_logging_cleanup
+@pytest.mark.fails_on_aws
+def test_bucket_logging_conf_concurrent_updating_pfx_j():
+    _bucket_logging_conf_update('Journal', 'prefix', True)
+
+
+def check_parts_count(parts, expected):
+    # AWS docs disagree on the name of this element
+    if 'TotalPartsCount' in parts:
+        assert parts['TotalPartsCount'] == expected
+    else:
+        assert parts['PartsCount'] == expected
+
+@pytest.mark.checksum
+@pytest.mark.fails_on_dbstore
+def test_get_multipart_checksum_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    #pdb.set_trace()
+    key = "multipart_checksum"
+    key_metadata = {'foo': 'bar'}
+    content_type = 'text/plain'
+    objlen = 64 * 1024 * 1024
+
+    (upload_id, data, parts, checksums) = \
+    _multipart_upload_checksum(bucket_name=bucket_name, key=key, size=objlen,
+                               content_type=content_type, metadata=key_metadata)
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key,
+                                                UploadId=upload_id,
+                                                MultipartUpload={'Parts': parts})
+    upload_checksum = response['ChecksumSHA256']
+
+    response = client.get_object(Bucket=bucket_name, Key=key)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key, \
+                                            ObjectAttributes=request_attributes)
+
+    # check overall object
+    nparts = len(parts)
+    assert response['ObjectSize'] == objlen
+    assert response['Checksum']['ChecksumSHA256'] == upload_checksum
+    check_parts_count(response['ObjectParts'], nparts)
+
+    # check the parts
+    partno = 1
+    for obj_part in response['ObjectParts']['Parts']:
+        assert obj_part['PartNumber'] == partno
+        if partno < len(parts):
+            assert obj_part['Size'] == 5 * 1024 * 1024
+        else:
+            assert obj_part['Size'] == objlen - ((nparts-1) * (5 * 1024 * 1024))
+        assert obj_part['ChecksumSHA256'] == checksums[partno - 1]
+        partno += 1
+
+@pytest.mark.fails_on_dbstore
+def test_get_multipart_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key = "multipart"
+    part_size = 5*1024*1024
+    objlen = 30*1024*1024
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name, key, objlen, part_size)
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key,
+                                                UploadId=upload_id,
+                                                MultipartUpload={'Parts': parts})
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key, \
+                                            ObjectAttributes=request_attributes)
+
+    # check overall object
+    nparts = len(parts)
+    assert response['ObjectSize'] == objlen
+    check_parts_count(response['ObjectParts'], len(parts))
+    assert response['ObjectParts']['IsTruncated'] == False
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+
+    # check the parts
+    partno = 1
+    for obj_part in response['ObjectParts']['Parts']:
+        assert obj_part['PartNumber'] == partno
+        assert obj_part['Size'] == part_size
+        assert 'ChecksumSHA256' not in obj_part
+        partno += 1
+
+@pytest.mark.fails_on_dbstore
+def test_get_paginated_multipart_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key = "multipart"
+    part_size = 5*1024*1024
+    objlen = 30*1024*1024
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name, key, objlen, part_size)
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key,
+                                                UploadId=upload_id,
+                                                MultipartUpload={'Parts': parts})
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=request_attributes,
+                                            MaxParts=1, PartNumberMarker=3)
+
+    # check overall object
+    assert response['ObjectSize'] == objlen
+    check_parts_count(response['ObjectParts'], len(parts))
+    assert response['ObjectParts']['MaxParts'] == 1
+    assert response['ObjectParts']['PartNumberMarker'] == 3
+    assert response['ObjectParts']['IsTruncated'] == True
+    assert response['ObjectParts']['NextPartNumberMarker'] == 4
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+
+    # check the part
+    assert len(response['ObjectParts']['Parts']) == 1
+    obj_part = response['ObjectParts']['Parts'][0]
+    assert obj_part['PartNumber'] == 4
+    assert obj_part['Size'] == part_size
+    assert 'ChecksumSHA256' not in obj_part
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=request_attributes,
+                                            MaxParts=10, PartNumberMarker=4)
+
+    # check overall object
+    assert response['ObjectSize'] == objlen
+    check_parts_count(response['ObjectParts'], len(parts))
+    assert response['ObjectParts']['MaxParts'] == 10
+    assert response['ObjectParts']['IsTruncated'] == False
+    assert response['ObjectParts']['PartNumberMarker'] == 4
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+
+    # check the parts
+    assert len(response['ObjectParts']['Parts']) == 2
+    partno = 5
+    for obj_part in response['ObjectParts']['Parts']:
+        assert obj_part['PartNumber'] == partno
+        assert obj_part['Size'] == part_size
+        assert 'ChecksumSHA256' not in obj_part
+        partno += 1
+
+@pytest.mark.fails_on_dbstore
+def test_get_single_multipart_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key = "multipart"
+    part_size = 5*1024*1024
+    part_sizes = [part_size] # just one part
+    part_count = len(part_sizes)
+    total_size = sum(part_sizes)
+
+    (upload_id, data, parts) = _multipart_upload(bucket_name, key, total_size, part_size)
+    response = client.complete_multipart_upload(Bucket=bucket_name, Key=key,
+                                                UploadId=upload_id,
+                                                MultipartUpload={'Parts': parts})
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=request_attributes)
+
+    assert response['ObjectSize'] == total_size
+    check_parts_count(response['ObjectParts'], 1)
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+
+    assert len(response['ObjectParts']['Parts']) == 1
+    obj_part = response['ObjectParts']['Parts'][0]
+    assert obj_part['PartNumber'] == 1
+    assert obj_part['Size'] == part_size
+    assert 'ChecksumSHA256' not in obj_part
+
+def test_get_checksum_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    key = "myobj"
+    size = 1024
+    body = FakeWriteFile(size, 'A')
+    sha256sum = 'arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0='
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=body, ChecksumAlgorithm='SHA256', ChecksumSHA256=sha256sum)
+    assert sha256sum == response['ChecksumSHA256']
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=request_attributes)
+
+    assert response['ObjectSize'] == size
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+    assert response['Checksum']['ChecksumSHA256'] == sha256sum
+    assert 'ObjectParts' not in response
+
+def test_get_versioned_object_attributes():
+    bucket_name = get_new_bucket()
+    check_configure_versioning_retry(bucket_name, "Enabled", "Enabled")
+    client = get_client()
+    key = "obj"
+    objlen = 3
+
+    response = client.put_object(Bucket=bucket_name, Key=key, Body='foo')
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+    version = response['VersionId']
+    assert len(version)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=request_attributes)
+
+    assert 'DeleteMarker' not in response
+    assert response['VersionId'] == version
+
+    assert response['ObjectSize'] == 3
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+    assert 'ObjectParts' not in response
+
+    # write a new current version
+    client.put_object(Bucket=bucket_name, Key=key, Body='foo')
+
+    # ask for the original version again
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key, VersionId=version,
+                                            ObjectAttributes=request_attributes)
+
+    assert 'DeleteMarker' not in response
+    assert response['VersionId'] == version
+
+    assert response['ObjectSize'] == 3
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+    assert 'ObjectParts' not in response
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+def test_get_sse_c_encrypted_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = 'obj'
+    objlen = 1000
+    data = 'A'*objlen
+    sse_args = {
+        'SSECustomerAlgorithm': 'AES256',
+        'SSECustomerKey': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+        'SSECustomerKeyMD5': 'DWygnHRtgiJ77HCm+1rvHw=='
+    }
+    attrs = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+
+    response = client.put_object(Bucket=bucket_name, Key=key, Body=data, **sse_args)
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+
+    # GetObjectAttributes fails without sse-c headers
+    e = assert_raises(ClientError, client.get_object_attributes,
+                      Bucket=bucket_name, Key=key, ObjectAttributes=attrs)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+
+    # and succeeds sse-c headers
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=attrs, **sse_args)
+
+    assert 'DeleteMarker' not in response
+    assert 'VersionId' not in response
+
+    assert response['ObjectSize'] == objlen
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+    assert 'ObjectParts' not in response
+
+@pytest.mark.fails_on_dbstore
+def test_get_object_attributes():
+    bucket_name = get_new_bucket()
+    client = get_client()
+    key = "obj"
+    objlen = 3
+
+    response = client.put_object(Bucket=bucket_name, Key=key, Body='foo')
+    etag = response['ETag'].strip('"')
+    assert len(etag)
+
+    request_attributes = ['ETag', 'Checksum', 'ObjectParts', 'StorageClass', 'ObjectSize']
+    response = client.get_object_attributes(Bucket=bucket_name, Key=key,
+                                            ObjectAttributes=request_attributes)
+
+    assert 'DeleteMarker' not in response
+    assert 'VersionId' not in response
+
+    assert response['ObjectSize'] == 3
+    assert response['ETag'] == etag
+    assert response['StorageClass'] == 'STANDARD'
+    assert 'ObjectParts' not in response
+
+
+def test_upload_part_copy_percent_encoded_key():
+    
+    s3_client = get_client()
+    bucket_name = get_new_bucket()
+    key = "anyfile.txt"
+    encoded_key = "anyfilename%25.txt"
+    raw_key = "anyfilename%.txt"
+
+    ## PutObject: the copy source
+    s3_client.put_object(
+        Bucket=bucket_name,
+        Key=encoded_key,
+        Body=b"foo",
+        ContentType="text/plain"
+    )
+
+    # Upload the target object (initial state)
+    s3_client.put_object(
+        Bucket=bucket_name,
+        Key=key,
+        Body=b"foo",
+        ContentType="text/plain"
+    )
+
+    # Initiate multipart upload
+    mp_response = s3_client.create_multipart_upload(
+        Bucket=bucket_name,
+        Key=key
+    )
+    upload_id = mp_response["UploadId"]
+
+    # The following operation is expected to fail
+    with pytest.raises(s3_client.exceptions.ClientError) as exc_info:
+        s3_client.upload_part_copy(
+            Bucket=bucket_name,
+            Key=key,
+            PartNumber=1,
+            UploadId=upload_id,
+            CopySource={'Bucket': bucket_name, 'Key': raw_key}
+        )
+
+    # Download the object and verify content
+    final_obj = s3_client.get_object(Bucket=bucket_name, Key=key)
+    content = final_obj['Body'].read()
+    assert content == b"foo"
+
+def check_delete_marker(client, bucket, key, status):
+    dm_header_val = 'none'
+
+    try:
+        res = client.head_object(Bucket=bucket, Key=key)
+    except ClientError as e:
+        response_headers = e.response['ResponseMetadata']['HTTPHeaders']
+        dm_header_val = response_headers['x-amz-delete-marker']
+
+    assert dm_header_val == status
+
+@pytest.mark.delete_marker
+@pytest.mark.fails_on_dbstore
+def test_delete_marker_nonversioned():
+    bucket = get_new_bucket()
+    client = get_client()
+    key = "frodo.txt"
+    body = "body version %s" % (key)
+    # no versioning case
+    res = client.put_object(Bucket=bucket, Key=key, Body=body)
+    res = client.delete_object(Bucket=bucket, Key=key)
+    check_delete_marker(client, bucket, key, 'false')
+
+@pytest.mark.delete_marker
+@pytest.mark.fails_on_dbstore
+def test_delete_marker_versioned():
+    bucket = get_new_bucket()
+    client = get_client()
+    key = "bilbo.txt"
+    body = "body version %s" % (key)
+    # versioning case
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    res = client.put_object(Bucket=bucket, Key=key, Body=body)
+    res = client.delete_object(Bucket=bucket, Key=key)
+    check_delete_marker(client, bucket, key, 'true')
+
+@pytest.mark.delete_marker
+@pytest.mark.fails_on_dbstore
+def test_delete_marker_suspended():
+    bucket = get_new_bucket()
+    client = get_client()
+    key = "ringo.txt"
+    body = "body version %s" % (key)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    res = client.put_object(Bucket=bucket, Key=key, Body=body)
+    check_configure_versioning_retry(bucket, "Suspended", "Suspended")
+    res = client.delete_object(Bucket=bucket, Key=key)
+    check_delete_marker(client, bucket, key, 'true')
+
+@pytest.mark.delete_marker
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_expiration
+@pytest.mark.fails_on_dbstore
+def test_delete_marker_expiration():
+    bucket = get_new_bucket()
+    client = get_client()
+    key = "nugent.ted"
+    body = "body version %s" % (key)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    res = client.put_object(Bucket=bucket, Key=key, Body=body)
+    res = client.delete_object(Bucket=bucket, Key=key)
+    # object should be a delete marker
+    check_delete_marker(client, bucket, key, 'true')
+
+    # to observe delete marker expiration, we must expire any existing
+    # noncurrent version, as these inhibit delete marker expiration
+    lifecycle = {
+        'Rules': [{'Expiration': {'ExpiredObjectDeleteMarker': True}, 'ID': 'dm-1-days', 'Prefix': '', 'Status': 'Enabled'}, {'ID': 'noncur-1-days', 'Prefix': '', 'Status': 'Enabled', 'NoncurrentVersionExpiration': {'NoncurrentDays': 1}}]
+    }
+    response = client.put_bucket_lifecycle_configuration(Bucket=bucket, LifecycleConfiguration=lifecycle)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    lc_interval = get_lc_debug_interval()
+    time.sleep(6*lc_interval)
+
+    # delete marker should have expired
+    check_delete_marker(client, bucket, key, 'false')
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_put_object_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    etag = client.put_object(Bucket=bucket, Key=key, IfNoneMatch='*')['ETag']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfNoneMatch='*')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfNoneMatch=etag)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    response = client.put_object(Bucket=bucket, Key=key, IfNoneMatch='badetag')
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+    client.put_object(Bucket=bucket, Key=key, IfMatch=etag)
+
+    client.delete_object(Bucket=bucket, Key=key)
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='*')
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+
+    response = client.put_object(Bucket=bucket, Key=key, IfNoneMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    response = client.put_object(Bucket=bucket, Key=key, IfMatch='*')
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    response = client.put_object(Bucket=bucket, Key=key, IfMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+def prepare_multipart_upload(client, bucket, key, body):
+    upload_id = client.create_multipart_upload(Bucket=bucket, Key=key)['UploadId']
+    response = client.upload_part(UploadId=upload_id, Bucket=bucket, Key=key, PartNumber=1, Body=body)
+    parts = [{'ETag': response['ETag'].strip('"'), 'PartNumber': 1}]
+    return upload_id, parts
+
+def successful_conditional_multipart_upload(client, bucket, key, body='abc', IfMatch=None, IfNoneMatch=None):
+    upload_id, parts = prepare_multipart_upload(client, bucket, key, body)
+    if IfMatch:
+        response = client.complete_multipart_upload(Bucket=bucket, Key=key, IfMatch=IfMatch, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    elif IfNoneMatch :
+        response = client.complete_multipart_upload(Bucket=bucket, Key=key, IfNoneMatch=IfNoneMatch, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    else :
+        response = client.complete_multipart_upload(Bucket=bucket, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    return response
+
+def failing_conditional_multipart_upload(expected_failure, client, bucket, key, body='abc', IfMatch=None, IfNoneMatch=None):
+    upload_id, parts = prepare_multipart_upload(client, bucket, key, body)
+    if IfMatch:
+        e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket, Key=key, IfMatch=IfMatch, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    elif IfNoneMatch:
+        e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket, Key=key, IfNoneMatch=IfNoneMatch, UploadId=upload_id, MultipartUpload={'Parts': parts})
+    else :
+        e = assert_raises(ClientError, client.complete_multipart_upload, Bucket=bucket, Key=key, UploadId=upload_id, MultipartUpload={'Parts': parts})
+
+    assert expected_failure == _get_status_and_error_code(e.response)
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_multipart_put_object_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    response = successful_conditional_multipart_upload(client, bucket, key, IfNoneMatch='*')
+    etag = response['ETag']
+
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfNoneMatch='*')
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfNoneMatch=etag)
+
+    response = successful_conditional_multipart_upload(client, bucket, key, IfNoneMatch='badetag')
+    etag = response['ETag']
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+    response = successful_conditional_multipart_upload(client, bucket, key, IfMatch=etag)
+    etag = response['ETag']
+
+    client.delete_object(Bucket=bucket, Key=key)
+
+    failing_conditional_multipart_upload((404, 'NoSuchKey'), client, bucket, key, IfMatch='*')
+    failing_conditional_multipart_upload((404, 'NoSuchKey'), client, bucket, key, IfMatch='badetag')
+
+    response = successful_conditional_multipart_upload(client, bucket, key, IfNoneMatch=etag)
+    etag = response['ETag']
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    response = successful_conditional_multipart_upload(client, bucket, key, IfMatch='*')
+    etag = response['ETag']
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfMatch='badetag')
+    response = successful_conditional_multipart_upload(client, bucket, key, IfMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_put_current_object_if_none_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+    data1 = 'data1'
+    data2 = 'data2'
+
+    response = client.put_object(Bucket=bucket, Key=key, Body=data1, IfNoneMatch='*')
+    etag = response['ETag']
+
+    response = client.put_object(Bucket=bucket, Key=key, Body=data2)
+    etag2 = response['ETag']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfNoneMatch='*')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfNoneMatch=etag2)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    # we can't specify a version, so we only check against current object
+    response = client.put_object(Bucket=bucket, Key=key, IfNoneMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    response = client.put_object(Bucket=bucket, Key=key, IfNoneMatch='badetag')
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+    client.delete_object(Bucket=bucket, Key=key)
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_multipart_put_current_object_if_none_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+    data1 = 'data1'
+    data2 = 'data2'
+
+    response = successful_conditional_multipart_upload(client, bucket, key, data1, IfNoneMatch='*')
+    etag = response['ETag']
+
+    response = successful_conditional_multipart_upload(client, bucket, key, data2)
+    etag2 = response['ETag']
+
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfNoneMatch='*')
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfNoneMatch=etag2)
+
+    # we can't specify a version, so we only check against current object
+    response = successful_conditional_multipart_upload(client, bucket, key, IfNoneMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    response = successful_conditional_multipart_upload(client, bucket, key, IfNoneMatch='badetag')
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+    client.delete_object(Bucket=bucket, Key=key)
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_put_current_object_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+    data1 = 'data1'
+    data2 = 'data2'
+    etag = 'deadbeef'
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='*')
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+
+    response = client.put_object(Bucket=bucket, Key=key, Body=data1, IfNoneMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    etag = response['ETag']
+    versionId = response['VersionId']
+    response = client.put_object(Bucket=bucket, Key=key, Body=data2, IfMatch='*')
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    etag2 = response['ETag']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch=etag)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    response = client.put_object(Bucket=bucket, Key=key, IfMatch=etag2)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_multipart_put_current_object_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+    data1 = 'data1'
+    data2 = 'data2'
+    etag = 'deadbeef'
+
+    failing_conditional_multipart_upload((404, 'NoSuchKey'), client, bucket, key, IfMatch='*')
+    failing_conditional_multipart_upload((404, 'NoSuchKey'), client, bucket, key, IfMatch='badetag')
+
+    response = successful_conditional_multipart_upload(client, bucket, key, data1, IfNoneMatch=etag)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    etag = response['ETag']
+    versionId = response['VersionId']
+    response = successful_conditional_multipart_upload(client, bucket, key, data2, IfMatch='*')
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+    etag2 = response['ETag']
+
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfMatch='badetag')
+    failing_conditional_multipart_upload((412, 'PreconditionFailed'), client, bucket, key, IfMatch=etag)
+    response = successful_conditional_multipart_upload(client, bucket, key, IfMatch=etag2)
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_put_object_current_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    etag = client.put_object(Bucket=bucket, Key=key, IfNoneMatch='*')['ETag']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfNoneMatch='*')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfNoneMatch=etag)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    client.put_object(Bucket=bucket, Key=key, IfMatch=etag)
+
+    response = client.delete_object(Bucket=bucket, Key=key)
+    assert response['DeleteMarker']
+
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='*')
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+
+    client.put_object(Bucket=bucket, Key=key, IfNoneMatch=etag)
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    etag = client.put_object(Bucket=bucket, Key=key)['ETag']
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    client.delete_object(Bucket=bucket, Key=key, IfMatch=etag)
+
+    # -ENOENT doesn't raise error in delete op
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatch='*')
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatch='badetag')
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+
+    # recreate to test IfMatch='*'
+    client.put_object(Bucket=bucket, Key=key)
+    client.delete_object(Bucket=bucket, Key=key, IfMatch='*')
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_current_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    # -ENOENT doesn't raise error in delete op
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatch='*')
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatch='badetag')
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+
+    response = client.put_object(Bucket=bucket, Key=key)
+    version = response['VersionId']
+    etag = response['ETag']
+
+    # on current version
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatch=etag)
+    assert response['DeleteMarker']
+
+    # -ENOENT doesn't raise error in delete op
+    client.delete_object(Bucket=bucket, Key=key, IfMatch='*')
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatch='badetag')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    # remove delete marker to retest IfMatch='*'
+    client.delete_object(Bucket=bucket, Key=key, VersionId=version)
+    client.delete_object(Bucket=bucket, Key=key, IfMatch='*')
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_version_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    response = client.put_object(Bucket=bucket, Key=key)
+    version = response['VersionId']
+    etag = response['ETag']
+
+    # on specific version
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, VersionId=version, IfMatch='badetag')
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    response = client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatch=etag)
+    assert 'DeleteMarker' not in response
+
+    # -ENOENT doesn't raise error in delete op
+    client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatch='*')
+    client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatch='badetag')
+
+    # recreate to test IfMatch='*'
+    response = client.put_object(Bucket=bucket, Key=key)
+    version = response['VersionId']
+    client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatch='*')
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_if_match_last_modified_time():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    badmtime = datetime.datetime(2015, 1, 1)
+
+    client.put_object(Bucket=bucket, Key=key)
+    mtime = client.head_object(Bucket=bucket, Key=key)['LastModified']
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatchLastModifiedTime=badmtime)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    client.delete_object(Bucket=bucket, Key=key, IfMatchLastModifiedTime=mtime)
+
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatchLastModifiedTime=badmtime)
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_current_if_match_last_modified_time():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    badmtime = datetime.datetime(2015, 1, 1)
+
+    client.put_object(Bucket=bucket, Key=key)
+    mtime = client.head_object(Bucket=bucket, Key=key)['LastModified']
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatchLastModifiedTime=badmtime)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatchLastModifiedTime=mtime)
+    assert response['DeleteMarker']
+
+    # object is marked as deleted but still exists
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatchLastModifiedTime=badmtime)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_version_if_match_last_modified_time():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    badmtime = datetime.datetime(2015, 1, 1)
+
+    version = client.put_object(Bucket=bucket, Key=key)['VersionId']
+    mtime = client.head_object(Bucket=bucket, Key=key, VersionId=version)['LastModified']
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, VersionId=version, IfMatchLastModifiedTime=badmtime)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    response = client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatchLastModifiedTime=mtime)
+    assert 'DeleteMarker' not in response
+
+    response = client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatchLastModifiedTime=badmtime)
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_if_match_size():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    size = 0
+    badsize = 9999
+
+    client.put_object(Bucket=bucket, Key=key)
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatchSize=badsize)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    client.delete_object(Bucket=bucket, Key=key, IfMatchSize=size)
+
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatchSize=badsize)
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_current_if_match_size():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    size = 0
+    badsize = 9999
+
+    client.put_object(Bucket=bucket, Key=key)
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatchSize=badsize)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    response = client.delete_object(Bucket=bucket, Key=key, IfMatchSize=size)
+    assert 'DeleteMarker' in response
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, IfMatchSize=badsize)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_object_version_if_match_size():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    size = 0
+    badsize = 9999
+
+    version = client.put_object(Bucket=bucket, Key=key)['VersionId']
+
+    e = assert_raises(ClientError, client.delete_object, Bucket=bucket, Key=key, VersionId=version, IfMatchSize=badsize)
+    assert (412, 'PreconditionFailed') == _get_status_and_error_code(e.response)
+
+    response = client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatchSize=size)
+    assert 'DeleteMarker' not in response
+
+    response = client.delete_object(Bucket=bucket, Key=key, VersionId=version, IfMatchSize=badsize)
+    assert 204 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    etag = client.put_object(Bucket=bucket, Key=key)['ETag']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'ETag': 'badetag'}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'ETag': etag}]})
+    assert key == response['Deleted'][0]['Key'] # success
+
+    # -ENOENT doesn't raise error in delete op
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'ETag': 'badetag'}]})
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_current_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    etag = client.put_object(Bucket=bucket, Key=key)['ETag']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'ETag': 'badetag'}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'ETag': etag}]})
+    assert key == response['Deleted'][0]['Key'] # success
+    assert response['Deleted'][0]['DeleteMarker']
+
+    # object is marked as deleted but still exists
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'ETag': 'badetag'}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_version_if_match():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    response = client.put_object(Bucket=bucket, Key=key)
+    etag = response['ETag']
+    version = response['VersionId']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'ETag': 'badetag'}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'ETag': etag}]})
+    assert key == response['Deleted'][0]['Key'] # success
+    assert 'DeleteMarker' not in response['Deleted'][0]
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'ETag': 'badetag'}]})
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_if_match_last_modified_time():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    badmtime = datetime.datetime(2015, 1, 1)
+
+    client.put_object(Bucket=bucket, Key=key)
+    mtime = client.head_object(Bucket=bucket, Key=key)['LastModified']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'LastModifiedTime': badmtime}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'LastModifiedTime': mtime}]})
+    assert key == response['Deleted'][0]['Key'] # success
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'LastModifiedTime': badmtime}]})
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_current_if_match_last_modified_time():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    badmtime = datetime.datetime(2015, 1, 1)
+
+    client.put_object(Bucket=bucket, Key=key)
+    mtime = client.head_object(Bucket=bucket, Key=key)['LastModified']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'LastModifiedTime': badmtime}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'LastModifiedTime': mtime}]})
+    assert key == response['Deleted'][0]['Key'] # success
+    assert response['Deleted'][0]['DeleteMarker']
+
+    # object exists, but marked as deleted
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'LastModifiedTime': badmtime}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_version_if_match_last_modified_time():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    badmtime = datetime.datetime(2015, 1, 1)
+
+    version = client.put_object(Bucket=bucket, Key=key)['VersionId']
+    mtime = client.head_object(Bucket=bucket, Key=key, VersionId=version)['LastModified']
+
+    # create a different version as current
+    client.put_object(Bucket=bucket, Key=key)
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'LastModifiedTime': badmtime}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'LastModifiedTime': mtime}]})
+    assert key == response['Deleted'][0]['Key'] # success
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'LastModifiedTime': badmtime}]})
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_if_match_size():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    key = 'obj'
+
+    size = 0
+    badsize = 9999
+
+    client.put_object(Bucket=bucket, Key=key)
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'Size': badsize}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'Size': size}]})
+    assert key == response['Deleted'][0]['Key'] # success
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'Size': badsize}]})
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_current_if_match_size():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    size = 0
+    badsize = 9999
+
+    client.put_object(Bucket=bucket, Key=key)
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'Size': badsize}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'Size': size}]})
+    assert key == response['Deleted'][0]['Key'] # success
+    assert response['Deleted'][0]['DeleteMarker']
+
+    # object exists, but marked as deleted
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'Size': badsize}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+@pytest.mark.fails_on_aws # only supported for directory buckets
+@pytest.mark.conditional_write
+@pytest.mark.fails_on_dbstore
+def test_delete_objects_version_if_match_size():
+    client = get_client()
+    bucket = get_new_bucket(client)
+    check_configure_versioning_retry(bucket, "Enabled", "Enabled")
+    key = 'obj'
+
+    size = 0
+    badsize = 9999
+
+    version = client.put_object(Bucket=bucket, Key=key)['VersionId']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'Size': badsize}]})
+    assert 'PreconditionFailed' == response['Errors'][0]['Code']
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'Size': size}]})
+    assert key == response['Deleted'][0]['Key'] # success
+
+    response = client.delete_objects(Bucket=bucket, Delete={'Objects': [{'Key': key, 'VersionId': version, 'Size': badsize}]})
+    assert 200 == response['ResponseMetadata']['HTTPStatusCode']
+
+def public_bucket_policy(bucket):
+    return json.dumps({
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Effect": "Allow",
+            "Principal": {"AWS": "*"},
+            "Action": "*",
+            "Resource": [
+                f"arn:aws:s3:::{bucket}",
+                f"arn:aws:s3:::{bucket}/*"
+            ]
+        }]
+    })
+
+def get_object_acl_owner(client, bucket, key):
+    response = client.get_object_acl(Bucket=bucket, Key=key)
+    return response['Owner']['ID'], response['Owner']['DisplayName']
+
+def get_multipart_acl_owner(client, bucket, key, upload_id):
+    response = client.list_parts(Bucket=bucket, Key=key, UploadId=upload_id)
+    return response['Owner']['ID'], response['Owner']['DisplayName']
+
+def _test_object_ownership_bucket_owner_enforced(client, bucket, bucket_owner):
+    # put_object() succeeds without ACL
+    client.put_object(Bucket=bucket, Key='put-object-no-acl')
+    assert bucket_owner == get_object_acl_owner(client, bucket, 'put-object-no-acl')
+    # put_object() succeeds with ACL=bucket-owner-full-control
+    client.put_object(Bucket=bucket, Key='put-object-bucket-owner-full-control', ACL='bucket-owner-full-control')
+    assert bucket_owner == get_object_acl_owner(client, bucket, 'put-object-bucket-owner-full-control')
+    # put_object() fails with other ACL
+    e = assert_raises(ClientError, client.put_object, Bucket=bucket, Key='put-object-private', ACL='private')
+    assert (400, 'AccessControlListNotSupported') == _get_status_and_error_code(e.response)
+
+    # create_multipart_upload() succeeds without ACL
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-no-acl')
+    assert bucket_owner == get_multipart_acl_owner(client, bucket, 'create-multipart-upload-no-acl', response['UploadId'])
+    # create_multipart_upload() succeeds with ACL=bucket-owner-full-control
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-bucket-owner-full-control', ACL='bucket-owner-full-control')
+    assert bucket_owner == get_multipart_acl_owner(client, bucket, 'create-multipart-upload-bucket-owner-full-control', response['UploadId'])
+    # create_multipart_upload() fails with other ACL
+    e = assert_raises(ClientError, client.create_multipart_upload, Bucket=bucket, Key='create-multipart-upload-private', ACL='private')
+    assert (400, 'AccessControlListNotSupported') == _get_status_and_error_code(e.response)
+
+    # copy_object() succeeds without ACL
+    client.copy_object(Bucket=bucket, Key='copy-object-no-acl', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'})
+    assert bucket_owner == get_object_acl_owner(client, bucket, 'copy-object-no-acl')
+    # copy_object() succeeds with ACL=bucket-owner-full-control
+    client.copy_object(Bucket=bucket, Key='copy-object-bucket-owner-full-control', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'}, ACL='bucket-owner-full-control')
+    assert bucket_owner == get_object_acl_owner(client, bucket, 'copy-object-bucket-owner-full-control')
+    # copy_object() fails with other ACL
+    e = assert_raises(ClientError, client.copy_object, Bucket=bucket, Key='copy-object-private', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'}, ACL='private')
+    assert (400, 'AccessControlListNotSupported') == _get_status_and_error_code(e.response)
+
+    # put_bucket_acl() fails
+    e = assert_raises(ClientError, client.put_bucket_acl, Bucket=bucket, ACL='private')
+    assert (400, 'AccessControlListNotSupported') == _get_status_and_error_code(e.response)
+    # put_object_acl() fails
+    e = assert_raises(ClientError, client.put_object_acl, Bucket=bucket, Key='put-object-no-acl', ACL='private')
+    assert (400, 'AccessControlListNotSupported') == _get_status_and_error_code(e.response)
+
+def _test_object_ownership_bucket_owner_preferred(client, bucket, bucket_owner):
+    # put_object() without ACL owned by client
+    client.put_object(Bucket=bucket, Key='put-object-no-acl')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'put-object-no-acl')
+    # put_object() with ACL=bucket-owner-full-control owned by bucket owner
+    client.put_object(Bucket=bucket, Key='put-object-bucket-owner-full-control', ACL='bucket-owner-full-control')
+    assert bucket_owner == get_object_acl_owner(client, bucket, 'put-object-bucket-owner-full-control')
+    # put_object() with other ACL owned by client
+    client.put_object(Bucket=bucket, Key='put-object-private', ACL='private')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'put-object-private')
+
+    # create_multipart_upload() without ACL owned by client
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-no-acl')
+    assert bucket_owner != get_multipart_acl_owner(client, bucket, 'create-multipart-upload-no-acl', response['UploadId'])
+    # create_multipart_upload() with ACL=bucket-owner-full-control owned by bucket owner
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-bucket-owner-full-control', ACL='bucket-owner-full-control')
+    assert bucket_owner == get_multipart_acl_owner(client, bucket, 'create-multipart-upload-bucket-owner-full-control', response['UploadId'])
+    # create_multipart_upload() with other ACL owned by client
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-private', ACL='private')
+    assert bucket_owner != get_multipart_acl_owner(client, bucket, 'create-multipart-upload-private', response['UploadId'])
+
+    # copy_object() without ACL owned by client
+    client.copy_object(Bucket=bucket, Key='copy-object-no-acl', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'})
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'copy-object-no-acl')
+    # copy_object() with ACL=bucket-owner-full-control owned by bucket owner
+    client.copy_object(Bucket=bucket, Key='copy-object-bucket-owner-full-control', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'}, ACL='bucket-owner-full-control')
+    assert bucket_owner == get_object_acl_owner(client, bucket, 'copy-object-bucket-owner-full-control')
+    # copy_object() with other ACL owned by client
+    client.copy_object(Bucket=bucket, Key='copy-object-private', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'}, ACL='private')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'copy-object-private')
+
+    # put_bucket_acl() and put_object_acl() succeed
+    client.put_bucket_acl(Bucket=bucket, ACL='private')
+    client.put_object_acl(Bucket=bucket, Key='put-object-no-acl', ACL='private')
+
+def _test_object_ownership_object_writer(client, bucket, bucket_owner):
+    # put_object() without ACL owned by client
+    client.put_object(Bucket=bucket, Key='put-object-no-acl')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'put-object-no-acl')
+    # put_object() with ACL=bucket-owner-full-control owned by client
+    client.put_object(Bucket=bucket, Key='put-object-bucket-owner-full-control', ACL='bucket-owner-full-control')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'put-object-bucket-owner-full-control')
+    # put_object() with other ACL owned by client
+    client.put_object(Bucket=bucket, Key='put-object-private', ACL='private')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'put-object-private')
+
+    # create_multipart_upload() without ACL owned by client
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-no-acl')
+    assert bucket_owner != get_multipart_acl_owner(client, bucket, 'create-multipart-upload-no-acl', response['UploadId'])
+    # create_multipart_upload() with ACL=bucket-owner-full-control owned by client
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-bucket-owner-full-control', ACL='bucket-owner-full-control')
+    assert bucket_owner != get_multipart_acl_owner(client, bucket, 'create-multipart-upload-bucket-owner-full-control', response['UploadId'])
+    # create_multipart_upload() with other ACL owned by client
+    response = client.create_multipart_upload(Bucket=bucket, Key='create-multipart-upload-private', ACL='private')
+    assert bucket_owner != get_multipart_acl_owner(client, bucket, 'create-multipart-upload-private', response['UploadId'])
+
+    # copy_object() without ACL owned by client
+    client.copy_object(Bucket=bucket, Key='copy-object-no-acl', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'})
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'copy-object-no-acl')
+    # copy_object() with ACL=bucket-owner-full-control owned by client
+    client.copy_object(Bucket=bucket, Key='copy-object-bucket-owner-full-control', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'}, ACL='bucket-owner-full-control')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'copy-object-bucket-owner-full-control')
+    # copy_object() with other ACL owned by client
+    client.copy_object(Bucket=bucket, Key='copy-object-private', CopySource={'Bucket': bucket, 'Key': 'put-object-no-acl'}, ACL='private')
+    assert bucket_owner != get_object_acl_owner(client, bucket, 'copy-object-private')
+
+    # put_bucket_acl() and put_object_acl() succeed
+    client.put_bucket_acl(Bucket=bucket, ACL='private')
+    client.put_object_acl(Bucket=bucket, Key='put-object-no-acl', ACL='private')
+
+def get_bucket_ownership(client, bucket):
+    response = client.get_bucket_ownership_controls(Bucket=bucket)
+    assert 1 == len(response['OwnershipControls']['Rules'])
+    return response['OwnershipControls']['Rules'][0]['ObjectOwnership']
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_aws # aws defaults to BucketOwnerEnforced
+def test_create_bucket_no_ownership_controls():
+    client = get_client()
+    bucket = get_new_bucket()
+    e = assert_raises(ClientError, client.get_bucket_ownership_controls, Bucket=bucket)
+    assert (404, 'OwnershipControlsNotFoundError') == _get_status_and_error_code(e.response)
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_dbstore
+def test_create_bucket_bucket_owner_enforced():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket_name()
+    client.create_bucket(Bucket=bucket, ObjectOwnership='BucketOwnerEnforced')
+    assert 'BucketOwnerEnforced' == get_bucket_ownership(client, bucket)
+    # add public bucket policy and test with 'alt' user
+    client.put_bucket_policy(Bucket=bucket, Policy=public_bucket_policy(bucket))
+    _test_object_ownership_bucket_owner_enforced(get_alt_client(), bucket, bucket_owner)
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_dbstore
+def test_create_bucket_bucket_owner_preferred():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket_name()
+    client.create_bucket(Bucket=bucket, ObjectOwnership='BucketOwnerPreferred')
+    assert 'BucketOwnerPreferred' == get_bucket_ownership(client, bucket)
+    # add public bucket policy and test with 'alt' user
+    client.put_bucket_policy(Bucket=bucket, Policy=public_bucket_policy(bucket))
+    _test_object_ownership_bucket_owner_preferred(get_alt_client(), bucket, bucket_owner)
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_dbstore
+def test_create_bucket_object_writer():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket_name()
+    client.create_bucket(Bucket=bucket, ObjectOwnership='ObjectWriter')
+    assert 'ObjectWriter' == get_bucket_ownership(client, bucket)
+    # add public bucket policy and test with 'alt' user
+    client.put_bucket_policy(Bucket=bucket, Policy=public_bucket_policy(bucket))
+    _test_object_ownership_object_writer(get_alt_client(), bucket, bucket_owner)
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_dbstore
+def test_put_bucket_ownership_bucket_owner_enforced():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket_name()
+    ownership = {'Rules': [{'ObjectOwnership': 'BucketOwnerEnforced'}]}
+
+    # expect PutBucketOwnershipControls to fail with public-read ACL
+    client.create_bucket(Bucket=bucket, ACL='public-read')
+    e = assert_raises(ClientError, client.put_bucket_ownership_controls,
+                      Bucket=bucket, OwnershipControls=ownership)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 400
+    assert error_code == 'InvalidBucketAclWithObjectOwnership'
+
+    # expect success with default private ACL
+    client.put_bucket_acl(Bucket=bucket, ACL='private')
+    client.put_bucket_ownership_controls(Bucket=bucket, OwnershipControls=ownership)
+    assert 'BucketOwnerEnforced' == get_bucket_ownership(client, bucket)
+
+    # add public bucket policy and test with 'alt' user
+    client.put_bucket_policy(Bucket=bucket, Policy=public_bucket_policy(bucket))
+    _test_object_ownership_bucket_owner_enforced(get_alt_client(), bucket, bucket_owner)
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_dbstore
+def test_put_bucket_ownership_bucket_owner_preferred():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket(client)
+    ownership = {'Rules': [{'ObjectOwnership': 'BucketOwnerPreferred'}]}
+    client.put_bucket_ownership_controls(Bucket=bucket, OwnershipControls=ownership)
+    assert 'BucketOwnerPreferred' == get_bucket_ownership(client, bucket)
+    # add public bucket policy and test with 'alt' user
+    client.put_bucket_policy(Bucket=bucket, Policy=public_bucket_policy(bucket))
+    _test_object_ownership_bucket_owner_preferred(get_alt_client(), bucket, bucket_owner)
+
+@pytest.mark.object_ownership
+@pytest.mark.fails_on_dbstore
+def test_put_bucket_ownership_object_writer():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket(client)
+    ownership = {'Rules': [{'ObjectOwnership': 'ObjectWriter'}]}
+    client.put_bucket_ownership_controls(Bucket=bucket, OwnershipControls=ownership)
+    assert 'ObjectWriter' == get_bucket_ownership(client, bucket)
+    # add public bucket policy and test with 'alt' user
+    client.put_bucket_policy(Bucket=bucket, Policy=public_bucket_policy(bucket))
+    _test_object_ownership_object_writer(get_alt_client(), bucket, bucket_owner)
+
+@pytest.mark.object_ownership
+def test_bucket_create_delete_bucket_ownership():
+    client = get_client()
+    bucket_owner = (get_main_user_id(), get_main_display_name())
+    bucket = get_new_bucket(client)
+    ownership = {'Rules': [{'ObjectOwnership': 'BucketOwnerEnforced'}]}
+    client.put_bucket_ownership_controls(Bucket=bucket, OwnershipControls=ownership)
+    assert 'BucketOwnerEnforced' == get_bucket_ownership(client, bucket)
+
+    client.delete_bucket_ownership_controls(Bucket=bucket)
+
+    e = assert_raises(ClientError, client.get_bucket_ownership_controls, Bucket=bucket)
+    assert (404, 'OwnershipControlsNotFoundError') == _get_status_and_error_code(e.response)
+
+    client.delete_bucket_ownership_controls(Bucket=bucket)
+
+def test_head_object_404_with_policy_prefix():
+    client = get_client()
+    bucket = get_new_bucket(client)
+
+    policy = json.dumps({
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Effect": "Allow",
+            "Principal": {"AWS": "*"},
+            "Action": "s3:ListBucket",
+            "Resource": f"arn:aws:s3:::{bucket}",
+            "Condition": {
+                "StringLike": {
+                    "s3:prefix": "public/*"
+                }
+            }
+        }]
+    })
+    client.put_bucket_policy(Bucket=bucket, Policy=policy)
+
+    alt_client = get_alt_client()
+    # expect 404 NoSuchKey for names that match the s3:prefix
+    e = assert_raises(ClientError, alt_client.head_object, Bucket=bucket, Key='public/object')
+    assert 404 == _get_status(e.response)
+    # expect 403 Forbidden for names that don't match
+    e = assert_raises(ClientError, alt_client.head_object, Bucket=bucket, Key='private/object')
+    assert 403 == _get_status(e.response)
+
+#########################
+# COPY ENCRYPTION TESTS #
+#########################
+_copy_enc_source_modes = {
+    'unencrypted': {
+        'marks': [pytest.mark.fails_on_aws],
+    },
+    'sse-s3': {
+        'args': {'ServerSideEncryption': 'AES256'},
+        'assert': lambda r: r['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256',
+        'marks': [pytest.mark.sse_s3],
+    },
+    'sse-c': {
+        'args': {
+            'SSECustomerAlgorithm': 'AES256',
+            'SSECustomerKey': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+            'SSECustomerKeyMD5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        },
+        'get_args': {
+            'SSECustomerAlgorithm': 'AES256',
+            'SSECustomerKey': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+            'SSECustomerKeyMD5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        },
+        'source_copy_args': {
+            'CopySourceSSECustomerAlgorithm': 'AES256',
+            'CopySourceSSECustomerKey': 'pO3upElrwuEXSoFwCfnZPdSsmt/xWeFa0N9KgDijwVs=',
+            'CopySourceSSECustomerKeyMD5': 'DWygnHRtgiJ77HCm+1rvHw==',
+        },
+    },
+    'sse-kms': {
+        'args': {
+            'ServerSideEncryption': 'aws:kms',
+            'SSEKMSKeyId': lambda: get_main_kms_keyid()
+        },
+    }
+}
+_copy_enc_dest_modes = {
+    'unencrypted': {
+        'marks': [pytest.mark.fails_on_aws],
+    },
+    'sse-s3': {
+        'args': {'ServerSideEncryption': 'AES256'},
+        'assert': lambda r: r['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'AES256',
+        'marks': [pytest.mark.sse_s3],
+    },
+    'sse-c': {
+        'args': {
+            'SSECustomerAlgorithm': 'AES256',
+            'SSECustomerKey': '6b+WOZ1T3cqZMxgThRcXAQBrS5mXKdDUphvpxptl9/4=',
+            'SSECustomerKeyMD5': 'arxBvwY2V4SiOne6yppVPQ=='
+        },
+        'get_args': {
+            'SSECustomerAlgorithm': 'AES256',
+            'SSECustomerKey': '6b+WOZ1T3cqZMxgThRcXAQBrS5mXKdDUphvpxptl9/4=',
+            'SSECustomerKeyMD5': 'arxBvwY2V4SiOne6yppVPQ=='
+        },
+        'assert': lambda r: (
+            r['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-customer-algorithm'] == 'AES256' and
+            r['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-customer-key-md5'] == 'arxBvwY2V4SiOne6yppVPQ=='
+        )
+    },
+    'sse-kms': {
+        'args': {
+            'ServerSideEncryption': 'aws:kms',
+            'SSEKMSKeyId': lambda: get_secondary_kms_keyid()
+        },
+        'assert': lambda r: (
+            r['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption'] == 'aws:kms' and
+            r['ResponseMetadata']['HTTPHeaders']['x-amz-server-side-encryption-aws-kms-key-id'] == get_secondary_kms_keyid()
+        )
+    }
+}
+
+def _test_copy_enc(file_size, source_mode_key, dest_mode_key, source_sc=None, dest_sc=None):
+    source_args = _copy_enc_source_modes[source_mode_key]
+    dest_args = _copy_enc_dest_modes[dest_mode_key]
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # upload original file with source encryption
+    data = 'A'*file_size
+    args = {key: value() if callable(value) else value for key, value in source_args.get('args', {}).items()}
+    if source_sc:
+        args['StorageClass'] = source_sc
+    response = client.put_object(Bucket=bucket_name, Key='testobj', Body=data, **args)
+    assert source_args.get('assert', lambda r: True)(response)
+
+    # copy the object to a new key, with destination encryption
+    dest_bucket_name = get_new_bucket()
+    copy_args = {key: value() if callable(value) else value for key, value in dest_args.get('args', {}).items()}
+    copy_args.update(source_args.get('source_copy_args', {}))
+    if dest_sc:
+        copy_args['StorageClass'] = dest_sc
+    response = client.copy_object(Bucket=dest_bucket_name, Key='testobj2', CopySource={'Bucket': bucket_name, 'Key': 'testobj'}, **copy_args)
+    assert dest_args.get('assert', lambda r: True)(response)
+
+    # verify the copy is encrypted
+    get_args = dest_args.get('get_args', {})
+    response = client.get_object(Bucket=dest_bucket_name, Key='testobj2', **get_args)
+    assert dest_args.get('assert', lambda r: True)(response)
+    body = _get_body(response)
+    assert body == data
+
+def _test_copy_part_enc(file_size, source_mode_key, dest_mode_key, source_sc=None, dest_sc=None):
+    source_args = _copy_enc_source_modes[source_mode_key]
+    dest_args = _copy_enc_dest_modes[dest_mode_key]
+
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # upload original file with source encryption
+    data = 'A'*file_size
+    args = {key: value() if callable(value) else value for key, value in source_args.get('args', {}).items()}
+    if source_sc:
+        args['StorageClass'] = source_sc
+    response = client.put_object(Bucket=bucket_name, Key='testobj', Body=data, **args)
+    assert source_args.get('assert', lambda r: True)(response)
+
+    # create a multipart upload with source encryption
+    dest_bucket_name = get_new_bucket()
+    upload_args = {key: value() if callable(value) else value for key, value in dest_args.get('args', {}).items()}
+    if dest_sc:
+        upload_args['StorageClass'] = dest_sc
+    response = client.create_multipart_upload(Bucket=dest_bucket_name, Key='testobj2', **upload_args)
+    assert dest_args.get('assert', lambda r: True)(response)
+    upload_id = response['UploadId']
+    assert len(upload_id)
+
+    parts = []
+
+    # copy the object as the part
+    copy_args = {key: value() if callable(value) else value for key, value in source_args.get('source_copy_args', {}).items()}
+
+    # verify sse-c headers
+    if dest_mode_key == 'sse-c':
+        # make sure api is verifying the SSE-C headers
+        e = assert_raises(ClientError, client.upload_part_copy,
+                            Bucket=dest_bucket_name, Key='testobj2',
+                            PartNumber=1, UploadId=upload_id,
+                            CopySource={'Bucket': bucket_name, 'Key': 'testobj'},
+                            **copy_args)
+        status, _ = _get_status_and_error_code(e.response)
+        assert status == 400
+
+        # and use the source key to copy the part
+        source_sse_c_args = _copy_enc_source_modes['sse-c']['source_copy_args']
+        wrong_copy_args = copy_args.copy()
+        wrong_copy_args.update(source_sse_c_args)
+        wrong_copy_args.pop('StorageClass', None)  # StorageClass is not allowed in copy part
+        e = assert_raises(ClientError, client.upload_part_copy,
+                            Bucket=dest_bucket_name, Key='testobj2',
+                            PartNumber=1, UploadId=upload_id,
+                            CopySource={'Bucket': bucket_name, 'Key': 'testobj'},
+                            **wrong_copy_args)
+        status, _ = _get_status_and_error_code(e.response)
+        assert status == 400
+
+    if dest_mode_key == 'sse-c':
+        copy_args.update(upload_args)
+    if dest_sc:
+        copy_args.pop('StorageClass', None)  # StorageClass is not allowed in copy part
+    response = client.upload_part_copy(
+        Bucket=dest_bucket_name,
+        Key='testobj2',
+        PartNumber=1,
+        UploadId=upload_id,
+        CopySource={'Bucket': bucket_name, 'Key': 'testobj'},
+        **copy_args
+    )
+    assert dest_args.get('assert', lambda r: True)(response)
+    parts.append({
+        'ETag': response['CopyPartResult']['ETag'],
+        'PartNumber': 1
+    })
+
+    # add another temporary part to the upload
+    complete_args = {}
+
+    # verify sse-c headers
+    if dest_mode_key == 'sse-c':
+        # make sure api is verifying the SSE-C headers
+        e = assert_raises(ClientError, client.upload_part,
+                            Bucket=dest_bucket_name, Key='testobj2',
+                            PartNumber=2, UploadId=upload_id,
+                            Body='B'*file_size,
+                            **complete_args)
+        status, _ = _get_status_and_error_code(e.response)
+        assert status == 400
+
+        # and use the source key to upload the part
+        source_sse_c_args = _copy_enc_source_modes['sse-c']['args']
+        wrong_upload_args = complete_args.copy()
+        wrong_upload_args.update(source_sse_c_args)
+        wrong_upload_args.pop('StorageClass', None)  # StorageClass is not allowed in upload part
+        e = assert_raises(ClientError, client.upload_part,
+                            Bucket=dest_bucket_name, Key='testobj2',
+                            PartNumber=2, UploadId=upload_id,
+                            Body='B'*file_size,
+                            **wrong_upload_args)
+        status, _ = _get_status_and_error_code(e.response)
+        assert status == 400
+
+    if dest_mode_key == 'sse-c':
+        complete_args.update(upload_args)
+    if dest_sc:
+        complete_args.pop('StorageClass', None)  # StorageClass is not allowed in complete multipart upload
+    temp_part = client.upload_part(
+        Bucket=dest_bucket_name,
+        Key='testobj2',
+        PartNumber=2,
+        UploadId=upload_id,
+        Body='B'*file_size,
+        **complete_args
+    )
+    assert dest_args.get('assert', lambda r: True)(temp_part)
+    parts.append({
+        'ETag': temp_part['ETag'],
+        'PartNumber': 2
+    })
+
+    if dest_mode_key == 'sse-c':
+        # make sure api is verifying the SSE-C headers
+        e = assert_raises(ClientError, client.complete_multipart_upload,
+                          Bucket=dest_bucket_name, Key='testobj2',
+                          UploadId=upload_id, MultipartUpload={'Parts': parts})
+        status, _ = _get_status_and_error_code(e.response)
+        assert status == 400
+
+        # and the key would be the same as the one used in upload part
+        # use the source key to complete the upload
+        # this is not allowed, so we expect an error
+        source_sse_c_args = _copy_enc_source_modes['sse-c']['args']
+        e = assert_raises(ClientError, client.complete_multipart_upload,
+                          Bucket=dest_bucket_name, Key='testobj2',
+                          UploadId=upload_id, MultipartUpload={'Parts': parts},
+                          **source_sse_c_args)
+        status, _ = _get_status_and_error_code(e.response)
+        assert status == 400
+
+    # complete the multipart upload
+    response = client.complete_multipart_upload(
+        Bucket=dest_bucket_name,
+        Key='testobj2',
+        UploadId=upload_id,
+        MultipartUpload={'Parts': parts},
+        **complete_args
+    )
+    assert dest_args.get('assert', lambda r: True)(response)
+
+    # verify the copy is encrypted
+    get_args = dest_args.get('get_args', {})
+    response = client.get_object(Bucket=dest_bucket_name, Key='testobj2', **get_args)
+    assert dest_args.get('assert', lambda r: True)(response)
+    body = _get_body(response)
+    assert body == (data + 'B'*file_size)
+
+def generate_copy_part_enc_params():
+    configure()
+    sc = configured_storage_classes()
+    
+    obj_sizes = [8*1024*1024] # min multipart is 5MB
+    params = []
+    for source_key in _copy_enc_source_modes.keys():
+        for dest_key in _copy_enc_dest_modes.keys():
+            source_marks = _copy_enc_source_modes[source_key].get('marks', [])
+            dest_marks = _copy_enc_dest_modes[dest_key].get('marks', [])
+            for source_sc in sc:
+                for dest_sc in sc:
+                    additional_marks = []
+                    if source_sc != 'STANDARD' or dest_sc != 'STANDARD':
+                        # storage classes are not supported on AWS
+                        additional_marks.append(pytest.mark.fails_on_aws)
+                    for obj_size in obj_sizes:
+                        param = pytest.param(
+                            source_key,
+                            dest_key,
+                            source_sc,
+                            dest_sc,
+                            obj_size,
+                            marks=[*source_marks, *dest_marks, *additional_marks]
+                        )
+                        params.append(param)
+    return params
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+@pytest.mark.parametrize(
+    "source_mode_key, dest_mode_key, source_storage_class, dest_storage_class, obj_size",
+    generate_copy_part_enc_params()
+)
+def test_copy_part_enc(source_mode_key, dest_mode_key, source_storage_class, dest_storage_class, obj_size):
+    print(
+        f"Testing copy part from {source_mode_key} to {dest_mode_key} with storage class "
+        f"{source_storage_class} -> {dest_storage_class} and object size {obj_size}"
+    )
+    _test_copy_part_enc(obj_size, source_mode_key, dest_mode_key, source_storage_class, dest_storage_class)
+
+def generate_copy_enc_params():
+    configure()
+    sc = configured_storage_classes()
+
+    obj_sizes = [1, 1024, 1024*1024, 8*1024*1024]
+
+    params = []
+    for source_key in _copy_enc_source_modes.keys():
+        for dest_key in _copy_enc_dest_modes.keys():
+            source_marks = _copy_enc_source_modes[source_key].get('marks', [])
+            dest_marks = _copy_enc_dest_modes[dest_key].get('marks', [])
+
+            for source_sc in sc:
+                for dest_sc in sc:
+                    additional_marks = []
+                    if source_sc != 'STANDARD' or dest_sc != 'STANDARD':
+                        additional_marks.extend([
+                            pytest.mark.fails_on_aws, # storage classes are not supported on AWS
+                            pytest.mark.storage_class,
+                        ])
+                    for obj_size in obj_sizes:
+                        param = pytest.param(
+                            source_key,
+                            dest_key,
+                            source_sc,
+                            dest_sc,
+                            obj_size,
+                            marks=[*source_marks, *dest_marks, *additional_marks]
+                        )
+                        params.append(param)
+    return params
+
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+@pytest.mark.parametrize(
+    "source_mode_key, dest_mode_key, source_storage_class, dest_storage_class, obj_size",
+    generate_copy_enc_params()
+)
+def test_copy_enc(source_mode_key, dest_mode_key, source_storage_class, dest_storage_class, obj_size):
+    print(
+        f"Testing copy from {source_mode_key} to {dest_mode_key} with storage class "
+        f"{source_storage_class} -> {dest_storage_class} and object size {obj_size}"
+    )
+    _test_copy_enc(obj_size, source_mode_key, dest_mode_key, source_storage_class, dest_storage_class)
+
+def generate_lifecycle_transition_params():
+    configure()
+    sc = configured_storage_classes()
+    if len(sc) < 2:
+        return []
+
+    params = []
+    for source_key in _copy_enc_source_modes.keys():
+        source_marks = _copy_enc_source_modes[source_key].get('marks', [])
+
+        for source_sc in sc:
+            for dest_sc in sc:
+                if source_sc == dest_sc:
+                    continue
+
+                params.append(pytest.param(
+                    source_key,
+                    source_sc,
+                    dest_sc,
+                    marks=source_marks
+                ))
+
+    return params
+
+def _test_lifecycle_transition(source_mode_key, source_sc=None, dest_sc=None):
+    source_args = _copy_enc_source_modes[source_mode_key]
+    args = {key: value() if callable(value) else value for key, value in source_args.get('args', {}).items()}
+    if source_sc:
+        args['StorageClass'] = source_sc
+
+    bucket_name = _create_objects(keys=['expire1/foo', 'expire1/bar'], put_object_args=args)
+    client = get_client()
+    rules=[{'ID': 'rule1', 'Prefix': '', 'Transitions': [{'Days': 1, 'StorageClass': dest_sc}], 'Status': 'Enabled'}]
+    lifecycle = {'Rules': rules}
+    client.put_bucket_lifecycle_configuration(Bucket=bucket_name, LifecycleConfiguration=lifecycle)
+
+    # Get list of all keys
+    response = client.list_objects(Bucket=bucket_name)
+    init_keys = _get_keys(response)
+    assert len(init_keys) == 2
+
+    lc_interval = get_lc_debug_interval()
+
+    # Wait for expiration
+    time.sleep(4*lc_interval)
+    expire1_keys = list_bucket_storage_class(client, bucket_name)
+    assert len(expire1_keys[source_sc]) == 0
+    assert len(expire1_keys[dest_sc]) == 2
+
+    # retrieve the objects
+    get_args = source_args.get('get_args', {})
+    for key in init_keys:
+        response = client.get_object(Bucket=bucket_name, Key=key, **get_args)
+        body = _get_body(response)
+        assert body == key
+
+@pytest.mark.lifecycle
+@pytest.mark.lifecycle_transition
+@pytest.mark.fails_on_aws
+@pytest.mark.encryption
+@pytest.mark.fails_on_dbstore
+@pytest.mark.parametrize(
+    "source_mode_key, source_storage_class, dest_storage_class",
+    generate_lifecycle_transition_params()
+)
+def test_lifecycle_transition_encrypted(source_mode_key, source_storage_class, dest_storage_class):
+    if len(configured_storage_classes()) < 2:
+        pytest.skip('need at least two storage classes to test lifecycle transition')
+
+    print(
+        f"Testing lifecycle transition of {source_mode_key} with storage class {source_storage_class} -> {dest_storage_class}"
+    )
+    _test_lifecycle_transition(source_mode_key, source_storage_class, dest_storage_class)
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_s3control.py b/src/test/rgw/s3-tests/s3tests/functional/test_s3control.py
new file mode 100644
index 00000000000..afc3ebce2c8
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_s3control.py
@@ -0,0 +1,90 @@
+import boto3
+from botocore.exceptions import ClientError
+import json
+import pytest
+
+from . import (
+    configfile,
+    setup_teardown,
+    get_iam_root_client,
+    get_iam_root_account_id,
+    get_new_bucket_name,
+    )
+from .utils import (
+    assert_raises,
+    _get_status_and_error_code,
+    )
+
+@pytest.mark.s3control
+def test_account_public_access_block():
+    s3control = get_iam_root_client(service_name='s3control', region_name='us-east-1')
+    account_id = get_iam_root_account_id()
+
+    # delete default configuration if it exists
+    response = s3control.delete_public_access_block(AccountId=account_id)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+    # re-delete should still return 204
+    response = s3control.delete_public_access_block(AccountId=account_id)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    # get returns 404
+    e = assert_raises(ClientError, s3control.get_public_access_block, AccountId=account_id)
+    assert (404, 'NoSuchPublicAccessBlockConfiguration') == _get_status_and_error_code(e.response)
+
+    s3control.put_public_access_block(
+            AccountId=account_id,
+            PublicAccessBlockConfiguration={
+                'BlockPublicAcls': True,
+                'IgnorePublicAcls': False,
+                'BlockPublicPolicy': False,
+                'RestrictPublicBuckets': False
+            })
+    try:
+        response = s3control.get_public_access_block(AccountId=account_id)
+        assert response['PublicAccessBlockConfiguration']['BlockPublicAcls']
+        assert not response['PublicAccessBlockConfiguration']['IgnorePublicAcls']
+        assert not response['PublicAccessBlockConfiguration']['BlockPublicPolicy']
+        assert not response['PublicAccessBlockConfiguration']['RestrictPublicBuckets']
+
+        s3 = get_iam_root_client(service_name='s3')
+        bucket = get_new_bucket_name()
+
+        # reject CreateBucket with public acls
+        e = assert_raises(ClientError, s3.create_bucket, Bucket=bucket, ACL='public-read')
+        assert (403, 'AccessDenied') == _get_status_and_error_code(e.response)
+
+        s3.create_bucket(Bucket=bucket)
+        try:
+            # reject PutBucketAcl with public acls
+            e = assert_raises(ClientError, s3.put_bucket_acl, Bucket=bucket, ACL='public-read')
+            assert (403, 'AccessDenied') == _get_status_and_error_code(e.response)
+
+            # test interaction with bucket-level configuration
+            s3.put_public_access_block(
+                    Bucket=bucket,
+                    PublicAccessBlockConfiguration={
+                        'BlockPublicAcls': False,
+                        'IgnorePublicAcls': False,
+                        'BlockPublicPolicy': True,
+                        'RestrictPublicBuckets': False
+                    })
+            public_policy = json.dumps({
+                "Version": "2012-10-17",
+                "Statement": [{
+                    "Effect": "Allow",
+                    "Principal": {"AWS": "*"},
+                    "Action": "*",
+                    "Resource": [
+                        f"arn:aws:s3:::{bucket}",
+                        f"arn:aws:s3:::{bucket}/*"
+                    ]
+                }]
+            })
+            # reject PutBucketPolicy with public policy based on bucket config
+            e = assert_raises(ClientError, s3.put_bucket_policy,
+                              Bucket=bucket, Policy=public_policy)
+            assert (403, 'AccessDenied') == _get_status_and_error_code(e.response)
+        finally:
+            s3.delete_bucket(Bucket=bucket)
+    finally:
+        s3control.delete_public_access_block(AccountId=account_id)
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_s3select.py b/src/test/rgw/s3-tests/s3tests/functional/test_s3select.py
new file mode 100644
index 00000000000..1c0587adf89
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_s3select.py
@@ -0,0 +1,1685 @@
+import pytest
+import random
+import string
+import re
+import json
+from botocore.exceptions import ClientError
+from botocore.exceptions import EventStreamError
+
+import uuid
+import warnings
+import traceback
+
+from . import (
+    configfile,
+    setup_teardown,
+    get_client,
+    get_new_bucket_name
+    )
+
+import logging
+logging.basicConfig(level=logging.INFO)
+
+import collections
+collections.Callable = collections.abc.Callable
+
+region_name = ''
+
+# recurssion function for generating arithmetical expression 
+def random_expr(depth):
+    # depth is the complexity of expression 
+    if depth==1 :
+        return str(int(random.random() * 100) + 1)+".0"
+    return '(' + random_expr(depth-1) + random.choice(['+','-','*','/']) + random_expr(depth-1) + ')'
+
+
+def generate_s3select_where_clause(bucket_name,obj_name):
+
+    a=random_expr(4)
+    b=random_expr(4)
+    s=random.choice([ '<','>','=','<=','>=','!=' ])
+
+    try:
+        eval( a )
+        eval( b )
+    except ZeroDivisionError:
+        return
+
+    # generate s3select statement using generated randome expression
+    # upon count(0)>0 it means true for the where clause expression
+    # the python-engine {eval( conditional expression )} should return same boolean result.
+    s3select_stmt =  "select count(0) from s3object where " + a + s + b + ";"
+
+    res = remove_xml_tags_from_result( run_s3select(bucket_name,obj_name,s3select_stmt) ).replace(",","")
+
+    if  s == '=':
+        s = '=='
+
+    s3select_assert_result(int(res)>0 , eval( a + s + b ))
+
+def generate_s3select_expression_projection(bucket_name,obj_name):
+
+        # generate s3select statement using generated randome expression
+        # statement return an arithmetical result for the generated expression.
+        # the same expression is evaluated by python-engine, result should be close enough(Epsilon)
+        
+        e = random_expr( 4 )
+
+        try:
+            eval( e )
+        except ZeroDivisionError:
+            return
+
+        if eval( e ) == 0:
+            return
+
+        res = remove_xml_tags_from_result( run_s3select(bucket_name,obj_name,"select " + e + " from s3object;",) ).replace(",","")
+
+        # accuracy level 
+        epsilon = float(0.00001) 
+
+        # both results should be close (epsilon)
+        assert(  abs(float(res.split("\n")[0]) - eval(e)) < epsilon )
+
+@pytest.mark.s3select
+def get_random_string():
+
+    return uuid.uuid4().hex[:6].upper()
+
+@pytest.mark.s3select
+def test_generate_where_clause():
+
+    # create small csv file for testing the random expressions
+    single_line_csv = create_random_csv_object(1,1)
+    bucket_name = get_new_bucket_name()
+    obj_name = get_random_string() #"single_line_csv.csv"
+    upload_object(bucket_name,obj_name,single_line_csv)
+       
+    for _ in range(100): 
+        generate_s3select_where_clause(bucket_name,obj_name)
+
+
+@pytest.mark.s3select
+def test_generate_projection():
+
+    # create small csv file for testing the random expressions
+    single_line_csv = create_random_csv_object(1,1)
+    bucket_name = get_new_bucket_name()
+    obj_name = get_random_string() #"single_line_csv.csv"
+    upload_object(bucket_name,obj_name,single_line_csv)
+       
+    for _ in range(100): 
+        generate_s3select_expression_projection(bucket_name,obj_name)
+
+def s3select_assert_result(a,b):
+    if type(a) == str:
+        a_strip = a.strip()
+        b_strip = b.strip()
+        if a=="" and b=="":
+            warnings.warn(UserWarning("{}".format("both results are empty, it may indicates a wrong input, please check the test input")))
+            ## print the calling function that created the empty result.
+            stack = traceback.extract_stack(limit=2)
+            formatted_stack = traceback.format_list(stack)[0]
+            warnings.warn(UserWarning("{}".format(formatted_stack)))
+            return True
+        assert a_strip != ""
+        assert b_strip != ""
+    else:
+        if a=="" and b=="":
+            warnings.warn(UserWarning("{}".format("both results are empty, it may indicates a wrong input, please check the test input")))
+            ## print the calling function that created the empty result.
+            stack = traceback.extract_stack(limit=2)
+            formatted_stack = traceback.format_list(stack)[0]
+            warnings.warn(UserWarning("{}".format(formatted_stack)))
+            return True
+        assert a != ""
+        assert b != ""
+    assert True
+
+def create_csv_object_for_datetime(rows,columns):
+        result = ""
+        for _ in range(rows):
+            row = ""
+            for _ in range(columns):
+                row = row + "{}{:02d}{:02d}T{:02d}{:02d}{:02d}Z,".format(random.randint(0,100)+1900,random.randint(1,12),random.randint(1,28),random.randint(0,23),random.randint(0,59),random.randint(0,59),)
+            result += row + "\n"
+
+        return result
+
+def create_random_csv_object(rows,columns,col_delim=",",record_delim="\n",csv_schema=""):
+        result = ""
+        if len(csv_schema)>0 :
+            result = csv_schema + record_delim
+
+        for _ in range(rows):
+            row = ""
+            for _ in range(columns):
+                row = row + "{}{}".format(random.randint(0,1000),col_delim)
+            result += row + record_delim
+
+        return result
+
+def create_random_csv_object_string(rows,columns,col_delim=",",record_delim="\n",csv_schema=""):
+        result = ""
+        if len(csv_schema)>0 :
+            result = csv_schema + record_delim
+
+        for _ in range(rows):
+            row = ""
+            for _ in range(columns):
+                if random.randint(0,9) == 5:
+                    row = row + "{}{}".format(''.join(random.choice(string.ascii_letters) for m in range(10)) + "aeiou",col_delim)
+                else:
+                    row = row + "{}{}".format(''.join("cbcd" + random.choice(string.ascii_letters) for m in range(10)) + "vwxyzzvwxyz" ,col_delim)
+                
+            result += row + record_delim
+
+        return result
+
+def create_random_csv_object_trim(rows,columns,col_delim=",",record_delim="\n",csv_schema=""):
+        result = ""
+        if len(csv_schema)>0 :
+            result = csv_schema + record_delim
+
+        for _ in range(rows):
+            row = ""
+            for _ in range(columns):
+                if random.randint(0,5) == 2:
+                    row = row + "{}{}".format(''.join("   aeiou    ") ,col_delim)
+                else:
+                    row = row + "{}{}".format(''.join("abcd") ,col_delim)
+
+
+                
+            result += row + record_delim
+
+        return result
+
+def create_random_csv_object_escape(rows,columns,col_delim=",",record_delim="\n",csv_schema=""):
+        result = ""
+        if len(csv_schema)>0 :
+            result = csv_schema + record_delim
+
+        for _ in range(rows):
+            row = ""
+            for _ in range(columns):
+                if random.randint(0,9) == 5:
+                    row = row + "{}{}".format(''.join("_ar") ,col_delim)
+                else:
+                    row = row + "{}{}".format(''.join("aeio_")  ,col_delim)
+                
+            result += row + record_delim
+
+        return result
+
+def create_random_csv_object_null(rows,columns,col_delim=",",record_delim="\n",csv_schema=""):
+        result = ""
+        if len(csv_schema)>0 :
+            result = csv_schema + record_delim
+
+        for _ in range(rows):
+            row = ""
+            for _ in range(columns):
+                if random.randint(0,5) == 2:
+                    row = row + "{}{}".format(''.join("") ,col_delim)
+                else:
+                    row = row + "{}{}".format(''.join("abc") ,col_delim)
+                
+            result += row + record_delim
+
+        return result
+
+def create_random_json_object(rows,columns,col_delim=",",record_delim="\n",csv_schema=""):
+        result = "{\"root\" : ["
+        result += record_delim
+        if len(csv_schema)>0 :
+            result = csv_schema + record_delim
+
+        for _ in range(rows):
+            row = ""
+            num = 0
+            row += "{"
+            for _ in range(columns):
+                num += 1
+                row = row + "\"c" + str(num) + "\"" + ": " "{}{}".format(random.randint(0,1000),col_delim)
+            row = row[:-1]
+            row += "}"
+            row += ","
+            result += row + record_delim
+        
+        result = result[:-2]  
+        result += record_delim
+        result += "]" + "}"
+
+        return result
+
+def csv_to_json(obj, field_split=",",row_split="\n",csv_schema=""):
+    result = "{\"root\" : ["
+    result += row_split
+    if len(csv_schema)>0 :
+        result = csv_schema + row_split
+    
+    for rec in obj.split(row_split):
+        row = ""
+        num = 0
+        row += "{"
+        for col in rec.split(field_split):
+            if col == "":
+                break
+            num += 1
+            row = row + "\"c" + str(num) + "\"" + ": " "{}{}".format(col,field_split)
+        row = row[:-1]
+        row += "}"
+        row += ","
+        result += row + row_split
+        
+    result = result[:-5]  
+    result += row_split
+    result += "]" + "}"
+
+    return result
+
+def upload_object(bucket_name,new_key,obj):
+
+        client = get_client()
+        client.create_bucket(Bucket=bucket_name)
+        client.put_object(Bucket=bucket_name, Key=new_key, Body=obj)
+
+        # validate uploaded object
+        c2 = get_client()
+        response = c2.get_object(Bucket=bucket_name, Key=new_key)
+        assert response['Body'].read().decode('utf-8') == obj, 's3select error[ downloaded object not equal to uploaded objecy'
+
+def run_s3select(bucket,key,query,column_delim=",",row_delim="\n",quot_char='"',esc_char='\\',csv_header_info="NONE", progress = False):
+
+    s3 = get_client()
+    result = ""
+    result_status = {}
+
+    try:
+        r = s3.select_object_content(
+        Bucket=bucket,
+        Key=key,
+        ExpressionType='SQL',
+        InputSerialization = {"CSV": {"RecordDelimiter" : row_delim, "FieldDelimiter" : column_delim,"QuoteEscapeCharacter": esc_char, "QuoteCharacter": quot_char, "FileHeaderInfo": csv_header_info}, "CompressionType": "NONE"},
+        OutputSerialization = {"CSV": {}},
+        Expression=query,
+        RequestProgress = {"Enabled": progress})
+
+    except ClientError as c:
+        result += str(c)
+        return result
+
+    if progress == False:
+
+        try:
+            for event in r['Payload']:
+                if 'Records' in event:
+                    records = event['Records']['Payload'].decode('utf-8')
+                    result += records
+
+        except EventStreamError as c:
+            result = str(c)
+            return result
+        
+    else:
+            result = []
+            max_progress_scanned = 0
+            for event in r['Payload']:
+                if 'Records' in event:
+                    records = event['Records']
+                    result.append(records.copy())
+                if 'Progress' in event:
+                    if(event['Progress']['Details']['BytesScanned'] > max_progress_scanned):
+                        max_progress_scanned = event['Progress']['Details']['BytesScanned']
+                        result_status['Progress'] = event['Progress']
+
+                if 'Stats' in event:
+                    result_status['Stats'] = event['Stats']
+                if 'End' in event:
+                    result_status['End'] = event['End']
+
+
+    if progress == False:
+        return result
+    else:
+        return result,result_status
+
+def run_s3select_output(bucket,key,query, quot_field, op_column_delim = ",", op_row_delim = "\n",  column_delim=",", op_quot_char = '"', op_esc_char = '\\', row_delim="\n",quot_char='"',esc_char='\\',csv_header_info="NONE"):
+
+    s3 = get_client()
+
+    r = s3.select_object_content(
+        Bucket=bucket,
+        Key=key,
+        ExpressionType='SQL',
+        InputSerialization = {"CSV": {"RecordDelimiter" : row_delim, "FieldDelimiter" : column_delim,"QuoteEscapeCharacter": esc_char, "QuoteCharacter": quot_char, "FileHeaderInfo": csv_header_info}, "CompressionType": "NONE"},
+        OutputSerialization = {"CSV": {"RecordDelimiter" : op_row_delim, "FieldDelimiter" : op_column_delim, "QuoteCharacter" : op_quot_char, "QuoteEscapeCharacter" : op_esc_char, "QuoteFields" : quot_field}},
+        Expression=query,)
+    
+    result = ""
+    for event in r['Payload']:
+        if 'Records' in event:
+            records = event['Records']['Payload'].decode('utf-8')
+            result += records
+    
+    return result
+
+def run_s3select_json(bucket,key,query, op_row_delim = "\n"):
+
+    s3 = get_client()
+
+    r = s3.select_object_content(
+        Bucket=bucket,
+        Key=key,
+        ExpressionType='SQL',
+        InputSerialization = {"JSON": {"Type": "DOCUMENT"}},
+        OutputSerialization = {"JSON": {}},
+        Expression=query,)
+    #Record delimiter optional in output serialization
+    
+    result = ""
+    for event in r['Payload']:
+        if 'Records' in event:
+            records = event['Records']['Payload'].decode('utf-8')
+            result += records
+    
+    return result
+
+def remove_xml_tags_from_result(obj):
+    result = ""
+    for rec in obj.split("\n"):
+        if(rec.find("Payload")>0 or rec.find("Records")>0):
+            continue
+        result += rec + "\n" # remove by split
+
+    result_strip= result.strip()
+    x = bool(re.search("^failure.*$", result_strip))
+    if x:
+        logging.info(result)
+    assert x == False
+
+    return result
+
+def create_list_of_int(column_pos,obj,field_split=",",row_split="\n"):
+    
+    list_of_int = [] 
+    for rec in obj.split(row_split):
+        col_num = 1
+        if ( len(rec) == 0):
+            continue
+        for col in rec.split(field_split):
+            if (col_num == column_pos):
+                list_of_int.append(int(col))
+            col_num+=1
+
+    return list_of_int
+
+@pytest.mark.s3select
+def test_count_operation():
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+    num_of_rows = 1234
+    obj_to_load = create_random_csv_object(num_of_rows,10)
+    upload_object(bucket_name,csv_obj_name,obj_to_load)
+    res = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object;") ).replace(",","")
+
+    s3select_assert_result( num_of_rows, int( res ))
+
+@pytest.mark.s3select
+def test_count_json_operation():
+    json_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    num_of_rows = 1
+    obj_to_load = create_random_json_object(num_of_rows,10)
+    upload_object(bucket_name,json_obj_name,obj_to_load)
+    res = remove_xml_tags_from_result(run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*];"))
+    s3select_assert_result( 1,  int(res))
+
+    res = remove_xml_tags_from_result(run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root;"))
+    s3select_assert_result( 1,  int(res))
+
+    obj_to_load = create_random_json_object(3,10)
+    upload_object(bucket_name,json_obj_name,obj_to_load)
+    res = remove_xml_tags_from_result(run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root;"))
+    s3select_assert_result( 3,  int(res))
+
+@pytest.mark.s3select
+def test_json_column_sum_min_max():
+    csv_obj = create_random_csv_object(10000,10)
+
+    json_obj = csv_to_json(csv_obj);
+
+    json_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,json_obj_name,json_obj)
+    
+    json_obj_name_2 = get_random_string()
+    bucket_name_2 = "testbuck2"
+    upload_object(bucket_name_2,json_obj_name_2,json_obj)
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select min(_1.c1) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 1 , csv_obj )
+    res_target = min( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select min(_1.c4) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 4 , csv_obj )
+    res_target = min( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select avg(_1.c6) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 6 , csv_obj )
+    res_target = float(sum(list_int ))/10000
+
+    s3select_assert_result( float(res_s3select), float(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select max(_1.c4) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 4 , csv_obj )
+    res_target = max( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select max(_1.c7) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 7 , csv_obj )
+    res_target = max( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select sum(_1.c4) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 4 , csv_obj )
+    res_target = sum( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select sum(_1.c7) from s3object[*].root;")  ).replace(",","")
+    list_int = create_list_of_int( 7 , csv_obj )
+    res_target = sum( list_int )
+
+    s3select_assert_result(  int(res_s3select) , int(res_target) )
+
+    # the following queries, validates on *random* input an *accurate* relation between condition result,sum operation and count operation.
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name_2,json_obj_name_2,"select count(0),sum(_1.c1),sum(_1.c2) from s3object[*].root where (_1.c1-_1.c2) = 2;" ) )
+    count,sum1,sum2 = res_s3select.split(",")
+
+    s3select_assert_result( int(count)*2 , int(sum1)-int(sum2 ) )
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0),sum(_1.c1),sum(_1.c2) from s3object[*].root where (_1.c1-_1.c2) = 4;" ) ) 
+    count,sum1,sum2 = res_s3select.split(",")
+
+    s3select_assert_result( int(count)*4 , int(sum1)-int(sum2) )
+
+@pytest.mark.s3select
+def test_json_nullif_expressions():
+
+    json_obj = create_random_json_object(10000,10)
+
+    json_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,json_obj_name,json_obj)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root where nullif(_1.c1,_1.c2) is null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root where _1.c1 = _1.c2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select (nullif(_1.c1,_1.c2) is null) from s3object[*].root ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select (_1.c1 = _1.c2) from s3object[*].root  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root where not nullif(_1.c1,_1.c2) is null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root where _1.c1 != _1.c2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select (nullif(_1.c1,_1.c2) is not null) from s3object[*].root ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select (_1.c1 != _1.c2) from s3object[*].root  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root where  nullif(_1.c1,_1.c2) = _1.c1 ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select_json(bucket_name,json_obj_name,"select count(0) from s3object[*].root where _1.c1 != _1.c2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+
+@pytest.mark.s3select
+def test_column_sum_min_max():
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+    
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+    
+    csv_obj_name_2 = get_random_string()
+    bucket_name_2 = "testbuck2"
+    upload_object(bucket_name_2,csv_obj_name_2,csv_obj)
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select min(int(_1)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 1 , csv_obj )
+    res_target = min( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select min(int(_4)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 4 , csv_obj )
+    res_target = min( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select avg(int(_6)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 6 , csv_obj )
+    res_target = float(sum(list_int ))/10000
+
+    s3select_assert_result( float(res_s3select), float(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select max(int(_4)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 4 , csv_obj )
+    res_target = max( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select max(int(_7)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 7 , csv_obj )
+    res_target = max( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select sum(int(_4)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 4 , csv_obj )
+    res_target = sum( list_int )
+
+    s3select_assert_result( int(res_s3select), int(res_target))
+    
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select sum(int(_7)) from s3object;")  ).replace(",","")
+    list_int = create_list_of_int( 7 , csv_obj )
+    res_target = sum( list_int )
+
+    s3select_assert_result(  int(res_s3select) , int(res_target) )
+
+    # the following queries, validates on *random* input an *accurate* relation between condition result,sum operation and count operation.
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name_2,csv_obj_name_2,"select count(0),sum(int(_1)),sum(int(_2)) from s3object where (int(_1)-int(_2)) = 2;" ) )
+    count,sum1,sum2 = res_s3select.split(",")
+
+    s3select_assert_result( int(count)*2 , int(sum1)-int(sum2 ) )
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0),sum(int(_1)),sum(int(_2)) from s3object where (int(_1)-int(_2)) = 4;" ) ) 
+    count,sum1,sum2 = res_s3select.split(",")
+
+    s3select_assert_result( int(count)*4 , int(sum1)-int(sum2) )
+
+@pytest.mark.s3select
+def test_nullif_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where nullif(_1,_2) is null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where _1 = _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select (nullif(_1,_2) is null) from s3object ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select (_1 = _2) from s3object  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where not nullif(_1,_2) is null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where _1 != _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select (nullif(_1,_2) is not null) from s3object ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select (_1 != _2) from s3object  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where  nullif(_1,_2) = _1 ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where _1 != _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    csv_obj = create_random_csv_object_null(10000,10)
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(*) from s3object where nullif(_1,null) is null;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(*) from s3object where _1 is null;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select (nullif(_1,null) is null) from s3object;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select (_1 is null) from s3object;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+@pytest.mark.s3select
+def test_nulliftrue_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where (nullif(_1,_2) is null) = true ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where _1 = _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where not (nullif(_1,_2) is null) = true ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where _1 != _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where (nullif(_1,_2) = _1 = true) ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object where _1 != _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_nullif, res_s3select)
+
+@pytest.mark.s3select
+def test_is_not_null_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_null = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(*) from s3object where nullif(_1,_2) is not null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(*) from s3object where _1 != _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_null, res_s3select)
+
+    res_s3select_null = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(*) from s3object where (nullif(_1,_1) and _1 = _2) is not null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(*) from s3object where _1 != _2  ;")  ).replace("\n","")
+
+    s3select_assert_result( res_s3select_null, res_s3select)
+
+@pytest.mark.s3select
+def test_lowerupper_expressions():
+
+    csv_obj = create_random_csv_object(1,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select lower("AB12cd$$") from s3object ;')  ).replace("\n","")
+
+    s3select_assert_result( res_s3select, "ab12cd$$")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select upper("ab12CD$$") from s3object ;')  ).replace("\n","")
+
+    s3select_assert_result( res_s3select, "AB12CD$$")
+
+@pytest.mark.s3select
+def test_in_expressions():
+
+    # purpose of test: engine is process correctly several projections containing aggregation-functions
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) in(1);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) = 1;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_1) in(1)) from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_1) = 1) from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) in(1,0);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) = 1 or int(_1) = 0;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_1) in(1,0)) from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_1) = 1 or int(_1) = 0) from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where int(_2) in(1,0,2);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where int(_2) = 1 or int(_2) = 0 or int(_2) = 2;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_2) in(1,0,2)) from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_2) = 1 or int(_2) = 0 or int(_2) = 2) from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where int(_2)*2 in(int(_3)*2,int(_4)*3,int(_5)*5);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where int(_2)*2 = int(_3)*2 or int(_2)*2 = int(_4)*3 or int(_2)*2 = int(_5)*5;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_2)*2 in(int(_3)*2,int(_4)*3,int(_5)*5)) from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_2)*2 = int(_3)*2 or int(_2)*2 = int(_4)*3 or int(_2)*2 = int(_5)*5) from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where character_length(_1) = 2 and substring(_1,2,1) in ("3");')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where _1 like "_3";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (character_length(_1) = 2 and substring(_1,2,1) in ("3")) from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (_1 like "_3") from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+@pytest.mark.s3select
+def test_true_false_in_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    ## 1,2 must exist in first/second column (to avoid empty results)
+    csv_obj = csv_obj + "1,2,,,,,,,,,,\n"
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where (int(_1) in(1)) = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) = 1;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where (int(_1) in(1,0)) = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) = 1 or int(_1) = 0;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where (int(_2) in(1,0,2)) = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where int(_2) = 1 or int(_2) = 0 or int(_2) = 2;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where (int(_2)*2 in(int(_3)*2,int(_4)*3,int(_5)*5)) = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from s3object where int(_2)*2 = int(_3)*2 or int(_2)*2 = int(_4)*3 or int(_2)*2 = int(_5)*5;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where (character_length(_1) = 2) = true and (substring(_1,2,1) in ("3")) = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where _1 like "_3";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (int(_1) in (1,2,0)) as a1 from s3object where a1 = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select \"true\"from s3object where (int(_1) in (1,0,2)) ;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_in, res_s3select )  
+
+@pytest.mark.s3select
+def test_like_expressions():
+
+    csv_obj = create_random_csv_object_string(1000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _1 like "%aeio%";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,11,4) = "aeio" ;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select  (_1 like "%aeio%") from s3object ;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select (substring(_1,11,4) = "aeio") from s3object ;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _1 like "cbcd%";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,1,4) = "cbcd";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _1 like "%aeio%" like;')).replace("\n","")
+
+    find_like = res_s3select_like.find("UnsupportedSyntax")
+
+    assert int(find_like) >= 0
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (_1 like "cbcd%") from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select (substring(_1,1,4) = "cbcd") from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _3 like "%y[y-z]";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_3,char_length(_3),1) between "y" and "z" and substring(_3,char_length(_3)-1,1) = "y";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (_3 like "%y[y-z]") from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select (substring(_3,char_length(_3),1) between "y" and "z" and substring(_3,char_length(_3)-1,1) = "y") from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _2 like "%yz";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_2,char_length(_2),1) = "z" and substring(_2,char_length(_2)-1,1) = "y";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (_2 like "%yz") from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select (substring(_2,char_length(_2),1) = "z" and substring(_2,char_length(_2)-1,1) = "y") from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _3 like "c%z";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_3,char_length(_3),1) = "z" and substring(_3,1,1) = "c";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (_3 like "c%z") from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select (substring(_3,char_length(_3),1) = "z" and substring(_3,1,1) = "c") from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _2 like "%xy_";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_2,char_length(_2)-1,1) = "y" and substring(_2,char_length(_2)-2,1) = "x";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select (_2 like "%xy_") from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select (substring(_2,char_length(_2)-1,1) = "y" and substring(_2,char_length(_2)-2,1) = "x") from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+@pytest.mark.s3select
+def test_truefalselike_expressions():
+
+    csv_obj = create_random_csv_object_string(1000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where (_1 like "%aeio%") = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,11,4) = "aeio" ;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where (_1 like "cbcd%") = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,1,4) = "cbcd";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where (_3 like "%y[y-z]") = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where (substring(_3,char_length(_3),1) between "y" and "z") = true and (substring(_3,char_length(_3)-1,1) = "y") = true;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where (_2 like "%yz") = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where (substring(_2,char_length(_2),1) = "z") = true and (substring(_2,char_length(_2)-1,1) = "y") = true;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where (_3 like "c%z") = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where (substring(_3,char_length(_3),1) = "z") = true and (substring(_3,1,1) = "c") = true;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+    res_s3select_like = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where (_2 like "%xy_") = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where (substring(_2,char_length(_2)-1,1) = "y") = true and (substring(_2,char_length(_2)-2,1) = "x") = true;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_like, res_s3select )
+
+@pytest.mark.s3select
+def test_nullif_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from stdin where nullif(_1,_2) is null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from stdin where _1 = _2  ;")  ).replace("\n","")
+
+    assert res_s3select_nullif == res_s3select
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from stdin where not nullif(_1,_2) is null ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from stdin where _1 != _2  ;")  ).replace("\n","")
+
+    assert res_s3select_nullif == res_s3select
+
+    res_s3select_nullif = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from stdin where  nullif(_1,_2) = _1 ;")  ).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select count(0) from stdin where _1 != _2  ;")  ).replace("\n","")
+
+    assert res_s3select_nullif == res_s3select
+
+@pytest.mark.s3select
+def test_lowerupper_expressions():
+
+    csv_obj = create_random_csv_object(1,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select lower("AB12cd$$") from stdin ;')  ).replace("\n","")
+
+    assert res_s3select == "ab12cd$$"
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select upper("ab12CD$$") from stdin ;')  ).replace("\n","")
+
+    assert res_s3select == "AB12CD$$"
+
+@pytest.mark.s3select
+def test_in_expressions():
+
+    # purpose of test: engine is process correctly several projections containing aggregation-functions 
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from stdin where int(_1) in(1);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from stdin where int(_1) = 1;')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from stdin where int(_1) in(1,0);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from stdin where int(_1) = 1 or int(_1) = 0;')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from stdin where int(_2) in(1,0,2);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from stdin where int(_2) = 1 or int(_2) = 0 or int(_2) = 2;')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from stdin where int(_2)*2 in(int(_3)*2,int(_4)*3,int(_5)*5);')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_2) from stdin where int(_2)*2 = int(_3)*2 or int(_2)*2 = int(_4)*3 or int(_2)*2 = int(_5)*5;')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from stdin where character_length(_1) = 2 and substring(_1,2,1) in ("3");')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from stdin where _1 like "_3";')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+@pytest.mark.s3select
+def test_like_expressions():
+
+    csv_obj = create_random_csv_object_string(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _1 like "%aeio%";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from stdin where substring(_1,11,4) = "aeio" ;')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _1 like "cbcd%";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from stdin where substring(_1,1,4) = "cbcd";')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _3 like "%y[y-z]";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from stdin where substring(_3,character_length(_3),1) between "y" and "z" and substring(_3,character_length(_3)-1,1) = "y";')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _2 like "%yz";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from stdin where substring(_2,character_length(_2),1) = "z" and substring(_2,character_length(_2)-1,1) = "y";')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _3 like "c%z";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from stdin where substring(_3,character_length(_3),1) = "z" and substring(_3,1,1) = "c";')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from stdin where _2 like "%xy_";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from stdin where substring(_2,character_length(_2)-1,1) = "y" and substring(_2,character_length(_2)-2,1) = "x";')).replace("\n","")
+
+    assert res_s3select_in == res_s3select 
+
+
+@pytest.mark.s3select
+def test_complex_expressions():
+
+    # purpose of test: engine is process correctly several projections containing aggregation-functions 
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select min(int(_1)),max(int(_2)),min(int(_3))+1 from s3object;")).replace("\n","")
+
+    min_1 = min ( create_list_of_int( 1 , csv_obj ) )
+    max_2 = max ( create_list_of_int( 2 , csv_obj ) )
+    min_3 = min ( create_list_of_int( 3 , csv_obj ) ) + 1
+
+    __res = "{},{},{}".format(min_1,max_2,min_3)
+    
+    # assert is according to radom-csv function 
+    s3select_assert_result( res_s3select, __res )
+
+    # purpose of test that all where conditions create the same group of values, thus same result
+    res_s3select_substring = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select min(int(_2)),max(int(_2)) from s3object where substring(_2,1,1) = "1" and char_length(_2) = 3;')).replace("\n","")
+
+    res_s3select_between_numbers = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select min(int(_2)),max(int(_2)) from s3object where int(_2)>=100 and int(_2)<200;')).replace("\n","")
+
+    res_s3select_eq_modolu = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select min(int(_2)),max(int(_2)) from s3object where int(_2)/100 = 1 and character_length(_2) = 3;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_substring, res_s3select_between_numbers)
+
+    s3select_assert_result( res_s3select_between_numbers, res_s3select_eq_modolu)
+    
+@pytest.mark.s3select
+def test_alias():
+
+    # purpose: test is comparing result of exactly the same queries , one with alias the other without.
+    # this test is setting alias on 3 projections, the third projection is using other projection alias, also the where clause is using aliases
+    # the test validate that where-clause and projections are executing aliases correctly, bare in mind that each alias has its own cache,
+    # and that cache need to be invalidate per new row. 
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select int(_1) as a1, int(_2) as a2 , (a1+a2) as a3 from s3object where a3>100 and a3<300;")  ).replace(",","")
+
+    res_s3select_no_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select int(_1),int(_2),int(_1)+int(_2) from s3object where (int(_1)+int(_2))>100 and (int(_1)+int(_2))<300;")  ).replace(",","")
+
+    s3select_assert_result( res_s3select_alias, res_s3select_no_alias)
+
+
+@pytest.mark.s3select
+def test_alias_cyclic_refernce():
+
+    number_of_rows = 10000
+    
+    # purpose of test is to validate the s3select-engine is able to detect a cyclic reference to alias.
+    csv_obj = create_random_csv_object(number_of_rows,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select int(_1) as a1,int(_2) as a2, a1+a4 as a3, a5+a1 as a4, int(_3)+a3 as a5 from s3object;")  )
+
+    find_res = res_s3select_alias.find("number of calls exceed maximum size, probably a cyclic reference to alias")
+    
+    assert int(find_res) >= 0 
+
+@pytest.mark.s3select
+def test_datetime():
+
+    # purpose of test is to validate date-time functionality is correct,
+    # by creating same groups with different functions (nested-calls) ,which later produce the same result 
+
+    csv_obj = create_csv_object_for_datetime(10000,1)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_date_time = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where extract(year from to_timestamp(_1)) > 1950 and extract(year from to_timestamp(_1)) < 1960;')  )
+
+    res_s3select_substring = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where int(substring(_1,1,4))>1950 and int(substring(_1,1,4))<1960;')  )
+
+    s3select_assert_result( res_s3select_date_time, res_s3select_substring)
+
+    res_s3select_date_time_to_string = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select cast(to_string(to_timestamp(_1), \'x\') as int) from  s3object;')  )
+
+    res_s3select_date_time_extract = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select extract(timezone_hour from to_timestamp(_1)) from  s3object;')  )
+
+    s3select_assert_result( res_s3select_date_time_to_string, res_s3select_date_time_extract )
+
+    res_s3select_date_time_to_timestamp = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select extract(month from to_timestamp(_1)) from s3object where extract(month from to_timestamp(_1)) = 5;')  )
+
+    res_s3select_substring = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select cast(substring(_1, 5, 2) as int) from s3object where _1 like \'____05%\';')  )
+
+    s3select_assert_result( res_s3select_date_time_to_timestamp, res_s3select_substring)
+
+@pytest.mark.s3select
+def test_true_false_datetime():
+
+    # purpose of test is to validate date-time functionality is correct,
+    # by creating same groups with different functions (nested-calls) ,which later produce the same result 
+
+    csv_obj = create_csv_object_for_datetime(10000,1)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_date_time = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where (extract(year from to_timestamp(_1)) > 1950) = true and (extract(year from to_timestamp(_1)) < 1960) = true;')  )
+
+    res_s3select_substring = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where int(substring(_1,1,4))>1950 and int(substring(_1,1,4))<1960;')  )
+
+    s3select_assert_result( res_s3select_date_time, res_s3select_substring)
+
+    res_s3select_date_time = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where  (date_diff(month,to_timestamp(_1),date_add(month,2,to_timestamp(_1)) ) = 2) = true;')  )
+
+    res_s3select_count = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object;')  )
+
+    s3select_assert_result( res_s3select_date_time, res_s3select_count)
+
+    res_s3select_date_time = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where (date_diff(year,to_timestamp(_1),date_add(day, 366 ,to_timestamp(_1))) = 1) = true ;')  )
+
+    s3select_assert_result( res_s3select_date_time, res_s3select_count)
+
+    # validate that utcnow is integrate correctly with other date-time functions 
+    res_s3select_date_time_utcnow = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(0) from  s3object where (date_diff(hour,utcnow(),date_add(day,1,utcnow())) = 24) = true ;')  )
+
+    s3select_assert_result( res_s3select_date_time_utcnow, res_s3select_count)
+
+@pytest.mark.s3select
+def test_csv_parser():
+
+    # purpuse: test default csv values(, \n " \ ), return value may contain meta-char 
+    # NOTE: should note that default meta-char for s3select are also for python, thus for one example double \ is mandatory
+
+    csv_obj = r',first,,,second,third="c31,c32,c33",forth="1,2,3,4",fifth=my_string=\"any_value\" \, my_other_string=\"aaaa\,bbb\" ,' + "\n"
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    # return value contain comma{,}
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _6 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'third=c31,c32,c33')
+
+    # return value contain comma{,}
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _7 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'forth=1,2,3,4')
+
+    # return value contain comma{,}{"}, escape-rule{\} by-pass quote{"} , the escape{\} is removed.
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _8 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'fifth=my_string="any_value" , my_other_string="aaaa,bbb" ')
+
+    # return NULL as first token
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _1 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'null')
+
+    # return NULL in the middle of line
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _3 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'null')
+
+    # return NULL in the middle of line (successive)
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _4 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'null')
+
+    # return NULL at the end line
+    res_s3select_alias = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _9 from s3object;")  ).replace("\n","")
+    s3select_assert_result( res_s3select_alias, 'null')
+
+@pytest.mark.s3select
+def test_csv_definition():
+
+    number_of_rows = 10000
+
+    #create object with pipe-sign as field separator and tab as row delimiter.
+    csv_obj = create_random_csv_object(number_of_rows,10,"|","\t")
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+   
+    # purpose of tests is to parse correctly input with different csv defintions  
+    res = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select count(0) from s3object;","|","\t") ).replace(",","")
+
+    s3select_assert_result( number_of_rows, int(res))
+    
+    # assert is according to radom-csv function 
+    # purpose of test is validate that tokens are processed correctly
+    res_s3select = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select min(int(_1)),max(int(_2)),min(int(_3))+1 from s3object;","|","\t") ).replace("\n","")
+
+    min_1 = min ( create_list_of_int( 1 , csv_obj , "|","\t") )
+    max_2 = max ( create_list_of_int( 2 , csv_obj , "|","\t") )
+    min_3 = min ( create_list_of_int( 3 , csv_obj , "|","\t") ) + 1
+
+    __res = "{},{},{}".format(min_1,max_2,min_3)
+    s3select_assert_result( res_s3select, __res )
+
+
+@pytest.mark.s3select
+def test_schema_definition():
+
+    number_of_rows = 10000
+
+    # purpose of test is to validate functionality using csv header info
+    csv_obj = create_random_csv_object(number_of_rows,10,csv_schema="c1,c2,c3,c4,c5,c6,c7,c8,c9,c10")
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    # ignoring the schema on first line and retrieve using generic column number
+    res_ignore = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select _1,_3 from s3object;",csv_header_info="IGNORE") ).replace("\n","")
+
+    # using the scheme on first line, query is using the attach schema
+    res_use = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select c1,c3 from s3object;",csv_header_info="USE") ).replace("\n","")
+    # result of both queries should be the same
+    s3select_assert_result( res_ignore, res_use)
+
+    # using column-name not exist in schema
+    res_multiple_defintion = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select c1,c10,int(c11) from s3object;",csv_header_info="USE") ).replace("\n","")
+
+    assert ((res_multiple_defintion.find("alias {c11} or column not exist in schema")) >= 0)
+
+    #find_processing_error = res_multiple_defintion.find("ProcessingTimeError")
+    assert ((res_multiple_defintion.find("ProcessingTimeError")) >= 0)
+
+    # alias-name is identical to column-name
+    res_multiple_defintion = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select int(c1)+int(c2) as c4,c4 from s3object;",csv_header_info="USE") ).replace("\n","")
+
+    assert ((res_multiple_defintion.find("multiple definition of column {c4} as schema-column and alias"))  >= 0)
+
+@pytest.mark.s3select
+def test_when_then_else_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select case when cast(_1 as int)>100 and cast(_1 as int)<200 then "(100-200)" when cast(_1 as int)>200 and cast(_1 as int)<300 then "(200-300)" else "NONE" end from s3object;')  ).replace("\n","")
+
+    count1 = res_s3select.count("(100-200)")  
+
+    count2 = res_s3select.count("(200-300)") 
+
+    count3 = res_s3select.count("NONE")
+
+    res = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where  cast(_1 as int)>100 and cast(_1 as int)<200  ;')  ).replace("\n","")
+
+    res1 = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where  cast(_1 as int)>200 and cast(_1 as int)<300  ;')  ).replace("\n","")
+    
+    res2 = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where  cast(_1 as int)<=100 or cast(_1 as int)>=300 or cast(_1 as int)=200  ;')  ).replace("\n","")
+
+    s3select_assert_result( str(count1) , res)
+
+    s3select_assert_result( str(count2) , res1)
+
+    s3select_assert_result( str(count3) , res2)
+
+@pytest.mark.s3select
+def test_coalesce_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where char_length(_3)>2 and char_length(_4)>2 and cast(substring(_3,1,2) as int) = cast(substring(_4,1,2) as int);')  ).replace("\n","")  
+
+    res_null = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where cast(_3 as int)>99 and cast(_4 as int)>99 and coalesce(nullif(cast(substring(_3,1,2) as int),cast(substring(_4,1,2) as int)),7) = 7;' ) ).replace("\n","") 
+
+    s3select_assert_result( res_s3select, res_null)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select coalesce(nullif(_5,_5),nullif(_1,_1),_2) from s3object;')  ).replace("\n","") 
+
+    res_coalesce = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select coalesce(_2) from s3object;')  ).replace("\n","")   
+
+    s3select_assert_result( res_s3select, res_coalesce)
+
+
+@pytest.mark.s3select
+def test_cast_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where cast(_3 as int)>999;')  ).replace("\n","")  
+
+    res = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where char_length(_3)>3;')  ).replace("\n","") 
+
+    s3select_assert_result( res_s3select, res)
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where cast(_3 as int)>99 and cast(_3 as int)<1000;')  ).replace("\n","")  
+
+    res = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where char_length(_3)=3;')  ).replace("\n","") 
+
+    s3select_assert_result( res_s3select, res)
+
+@pytest.mark.s3select
+def test_version():
+
+    return
+    number_of_rows = 1
+
+    # purpose of test is to validate functionality using csv header info
+    csv_obj = create_random_csv_object(number_of_rows,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_version = remove_xml_tags_from_result( run_s3select(bucket_name,csv_obj_name,"select version() from s3object;") ).replace("\n","")
+
+    s3select_assert_result( res_version, "41.a," )
+
+@pytest.mark.s3select
+def test_trim_expressions():
+
+    csv_obj = create_random_csv_object_trim(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(_1) = "aeiou";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1 from 4 for 5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(both from _1) = "aeiou";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(trailing from _1) = "   aeiou";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(leading from _1) = "aeiou    ";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(trim(leading from _1)) = "aeiou";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+@pytest.mark.s3select
+def test_truefalse_trim_expressions():
+
+    csv_obj = create_random_csv_object_trim(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(_1) = "aeiou" = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1 from 4 for 5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(both from _1) = "aeiou" = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(trailing from _1) = "   aeiou" = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(leading from _1) = "aeiou    " = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+    res_s3select_trim = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where trim(trim(leading from _1)) = "aeiou" = true;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,4,5) = "aeiou";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_trim, res_s3select )
+
+@pytest.mark.s3select
+def test_escape_expressions():
+
+    csv_obj = create_random_csv_object_escape(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_escape = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _1 like "%_ar" escape "%";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,char_length(_1),1) = "r" and substring(_1,char_length(_1)-1,1) = "a" and substring(_1,char_length(_1)-2,1) = "_";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_escape, res_s3select )
+
+    res_s3select_escape = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where _1 like "%aeio$_" escape "$";')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where substring(_1,1,5) = "aeio_";')).replace("\n","")
+
+    s3select_assert_result( res_s3select_escape, res_s3select )
+
+@pytest.mark.s3select
+def test_case_value_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_case = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select case cast(_1 as int) when cast(_2 as int) then "case_1_1" else "case_2_2" end from s3object;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select case when cast(_1 as int) = cast(_2 as int) then "case_1_1" else "case_2_2" end from s3object;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_case, res_s3select )
+
+@pytest.mark.s3select
+def test_bool_cast_expressions():
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_cast = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select count(*) from s3object where cast(int(_1) as bool) = true ;')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name, 'select count(*) from s3object where cast(_1 as int) != 0 ;')).replace("\n","")
+
+    s3select_assert_result( res_s3select_cast, res_s3select )
+
+@pytest.mark.s3select
+def test_progress_expressions():
+
+    csv_obj = create_random_csv_object(1000000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    obj_size = len(csv_obj.encode('utf-8'))
+
+    result_status = {}
+    result_size = 0
+
+    res_s3select_response,result_status = run_s3select(bucket_name,csv_obj_name,"select sum(int(_1)) from s3object;",progress = True)
+
+    for rec in res_s3select_response:
+        result_size += len(rec['Payload'])
+
+    records_payload_size = result_size
+   
+    # To do: Validate bytes processed after supporting compressed data
+    s3select_assert_result(obj_size, result_status['Progress']['Details']['BytesScanned'])
+    s3select_assert_result(records_payload_size, result_status['Progress']['Details']['BytesReturned'])
+
+    # stats response payload validation
+    s3select_assert_result(obj_size, result_status['Stats']['Details']['BytesScanned'])
+    s3select_assert_result(records_payload_size, result_status['Stats']['Details']['BytesReturned'])
+
+    # end response
+    s3select_assert_result({}, result_status['End'])
+
+@pytest.mark.s3select
+def test_output_serial_expressions():
+    return # TODO fix test
+
+    csv_obj = create_random_csv_object(10000,10)
+
+    csv_obj_name = get_random_string()
+    bucket_name = get_new_bucket_name()
+
+    upload_object(bucket_name,csv_obj_name,csv_obj)
+
+    res_s3select_1 = remove_xml_tags_from_result(  run_s3select_output(bucket_name,csv_obj_name,"select _1, _2 from s3object where nullif(_1,_2) is null ;", "ALWAYS")  ).replace("\n",",").replace(",","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,"select _1, _2 from s3object where _1 = _2 ;")  ).replace("\n",",")
+
+    res_s3select_list = res_s3select.split(',')
+
+    res_s3select_list.pop()
+
+    res_s3select_final = (''.join('"' + item + '"' for item in res_s3select_list))
+
+    s3select_assert_result( '""'+res_s3select_1+'""', res_s3select_final)
+
+
+    res_s3select_in = remove_xml_tags_from_result(  run_s3select_output(bucket_name,csv_obj_name,'select int(_1) from s3object where (int(_1) in(int(_2)));', "ASNEEDED", '$', '#')).replace("\n","#") ## TODO why \n appears in output?
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) = int(_2);')).replace("\n","#")
+    
+    res_s3select_list = res_s3select.split('#')
+
+    res_s3select_list.pop()
+
+    res_s3select_final = (''.join(item + '#' for item in res_s3select_list))
+
+
+    s3select_assert_result(res_s3select_in , res_s3select_final )
+
+
+    res_s3select_quot = remove_xml_tags_from_result(  run_s3select_output(bucket_name,csv_obj_name,'select int(_1) from s3object where (int(_1) in(int(_2)));', "ALWAYS", '$', '#')).replace("\n","")
+
+    res_s3select = remove_xml_tags_from_result(  run_s3select(bucket_name,csv_obj_name,'select int(_1) from s3object where int(_1) = int(_2);')).replace("\n","#")
+    res_s3select_list = res_s3select.split('#')
+
+    res_s3select_list.pop()
+
+    res_s3select_final = (''.join('"' + item + '"' + '#' for item in res_s3select_list))
+
+    s3select_assert_result( '""#'+res_s3select_quot+'""#', res_s3select_final )
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_sns.py b/src/test/rgw/s3-tests/s3tests/functional/test_sns.py
new file mode 100644
index 00000000000..c63b68411ab
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_sns.py
@@ -0,0 +1,186 @@
+import json
+import pytest
+from botocore.exceptions import ClientError
+from . import (
+    configfile,
+    get_iam_path_prefix,
+    get_iam_root_client,
+    get_iam_alt_root_client,
+    get_new_bucket_name,
+    get_prefix,
+    make_iam_name,
+    nuke_prefixed_buckets,
+)
+from .iam import iam_root, iam_alt_root
+from .utils import assert_raises, _get_status_and_error_code
+
+def get_new_topic_name():
+    return get_new_bucket_name()
+
+def nuke_topics(client, prefix):
+    p = client.get_paginator('list_topics')
+    for response in p.paginate():
+        for topic in response['Topics']:
+            arn = topic['TopicArn']
+            if prefix not in arn:
+                pass
+            try:
+                client.delete_topic(TopicArn=arn)
+            except:
+                pass
+
+@pytest.fixture
+def sns(iam_root):
+    client = get_iam_root_client(service_name='sns')
+    yield client
+    nuke_topics(client, get_prefix())
+
+@pytest.fixture
+def sns_alt(iam_alt_root):
+    client = get_iam_alt_root_client(service_name='sns')
+    yield client
+    nuke_topics(client, get_prefix())
+
+@pytest.fixture
+def s3(iam_root):
+    # clear region_name to work around Invalid region: region was not a valid DNS name.
+    client = get_iam_root_client(service_name='s3', region_name=None)
+    yield client
+    nuke_prefixed_buckets(get_prefix(), client)
+
+@pytest.fixture
+def s3_alt(iam_alt_root):
+    # clear region_name to work around Invalid region: region was not a valid DNS name.
+    client = get_iam_alt_root_client(service_name='s3', region_name=None)
+    yield client
+    nuke_prefixed_buckets(get_prefix(), client)
+
+
+@pytest.mark.iam_account
+@pytest.mark.sns
+def test_account_topic(sns):
+    name = get_new_topic_name()
+
+    response = sns.create_topic(Name=name)
+    arn = response['TopicArn']
+    assert arn.startswith('arn:aws:sns:')
+    assert arn.endswith(f':{name}')
+
+    response = sns.list_topics()
+    assert arn in [p['TopicArn'] for p in response['Topics']]
+
+    sns.set_topic_attributes(TopicArn=arn, AttributeName='Policy', AttributeValue='')
+
+    response = sns.get_topic_attributes(TopicArn=arn)
+    assert 'Attributes' in response
+
+    sns.delete_topic(TopicArn=arn)
+
+    response = sns.list_topics()
+    assert arn not in [p['TopicArn'] for p in response['Topics']]
+
+    with pytest.raises(sns.exceptions.NotFoundException):
+        sns.get_topic_attributes(TopicArn=arn)
+    sns.delete_topic(TopicArn=arn)
+
+@pytest.mark.iam_account
+@pytest.mark.sns
+def test_cross_account_topic(sns, sns_alt):
+    name = get_new_topic_name()
+    arn = sns.create_topic(Name=name)['TopicArn']
+
+    # not authorized to any alt user apis
+    with pytest.raises(sns.exceptions.AuthorizationErrorException):
+        sns_alt.get_topic_attributes(TopicArn=arn)
+    with pytest.raises(sns.exceptions.AuthorizationErrorException):
+        sns_alt.set_topic_attributes(TopicArn=arn, AttributeName='Policy', AttributeValue='')
+    with pytest.raises(sns.exceptions.AuthorizationErrorException):
+        sns_alt.delete_topic(TopicArn=arn)
+
+    # delete returns success
+    sns.delete_topic(TopicArn=arn)
+
+    response = sns_alt.list_topics()
+    assert arn not in [p['TopicArn'] for p in response['Topics']]
+
+@pytest.mark.iam_account
+@pytest.mark.sns
+def test_account_user_policy_list_topics(iam_root):
+    path = get_iam_path_prefix()
+    user_name = make_iam_name('User')
+
+    user = iam_root.create_user(UserName=user_name, Path=path)['User']
+    user_arn = user['Arn']
+    key = iam_root.create_access_key(UserName=user_name)['AccessKey']
+
+    sns = get_iam_root_client(service_name='sns',
+                              aws_access_key_id=key['AccessKeyId'],
+                              aws_secret_access_key=key['SecretAccessKey'])
+
+    # expect AccessDenied for lack of identity policy
+    e = assert_raises(ClientError, sns.list_topics)
+
+    iam_root.attach_user_policy(UserName=user_name, PolicyArn='arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess')
+
+    sns.list_topics()
+
+@pytest.mark.iam_account
+@pytest.mark.sns
+def test_account_topic_publish(sns, s3):
+    name = get_new_topic_name()
+
+    response = sns.create_topic(Name=name)
+    topic_arn = response['TopicArn']
+
+    bucket = get_new_bucket_name()
+    s3.create_bucket(Bucket=bucket)
+
+    config = {'TopicConfigurations': [{
+        'Id': 'id',
+        'TopicArn': topic_arn,
+        'Events': [ 's3:ObjectCreated:*' ],
+        }]}
+    s3.put_bucket_notification_configuration(
+            Bucket=bucket, NotificationConfiguration=config)
+
+@pytest.mark.iam_account
+@pytest.mark.iam_cross_account
+@pytest.mark.sns
+def test_cross_account_topic_publish(sns, s3_alt, iam_alt_root):
+    name = get_new_topic_name()
+
+    response = sns.create_topic(Name=name)
+    topic_arn = response['TopicArn']
+
+    bucket = get_new_bucket_name()
+    s3_alt.create_bucket(Bucket=bucket)
+
+    config = {'TopicConfigurations': [{
+        'Id': 'id',
+        'TopicArn': topic_arn,
+        'Events': [ 's3:ObjectCreated:*' ],
+        }]}
+
+    # expect AccessDenies because no resource policy allows cross-account access
+    e = assert_raises(ClientError, s3_alt.put_bucket_notification_configuration,
+                      Bucket=bucket, NotificationConfiguration=config)
+    status, error_code = _get_status_and_error_code(e.response)
+    assert status == 403
+    assert error_code == 'AccessDenied'
+
+    # add topic policy to allow the alt user
+    alt_principal = iam_alt_root.get_user()['User']['Arn']
+    policy = json.dumps({
+        'Version': '2012-10-17',
+        'Statement': [{
+            'Effect': 'Allow',
+            'Principal': {'AWS': alt_principal},
+            'Action': 'sns:Publish',
+            'Resource': topic_arn
+            }]
+        })
+    sns.set_topic_attributes(TopicArn=topic_arn, AttributeName='Policy',
+                             AttributeValue=policy)
+
+    s3_alt.put_bucket_notification_configuration(
+            Bucket=bucket, NotificationConfiguration=config)
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_sts.py b/src/test/rgw/s3-tests/s3tests/functional/test_sts.py
new file mode 100644
index 00000000000..485ab401247
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_sts.py
@@ -0,0 +1,2073 @@
+import boto3
+import botocore.session
+from botocore.exceptions import ClientError
+from botocore.exceptions import ParamValidationError
+import pytest
+import isodate
+import email.utils
+import datetime
+import threading
+import re
+import pytz
+from collections import OrderedDict
+import requests
+import json
+import base64
+import hmac
+import hashlib
+import xml.etree.ElementTree as ET
+import time
+import operator
+import os
+import string
+import random
+import socket
+import ssl
+import logging
+from collections import namedtuple
+
+from email.header import decode_header
+
+from . import(
+    configfile,
+    setup_teardown,
+    get_iam_client,
+    get_sts_client,
+    get_client,
+    get_alt_user_id,
+    get_config_endpoint,
+    get_new_bucket_name,
+    get_parameter_name,
+    get_main_aws_access_key,
+    get_main_aws_secret_key,
+    get_thumbprint,
+    get_aud,
+    get_token,
+    get_realm_name,
+    check_webidentity,
+    get_iam_access_key,
+    get_iam_secret_key,
+    get_sub,
+    get_azp,
+    get_user_token
+    )
+
+log = logging.getLogger(__name__)
+
+def create_role(iam_client,path,rolename,policy_document,description,sessionduration,permissionboundary,tag_list=None):
+    role_err=None
+    role_response = None
+    if rolename is None:
+        rolename=get_parameter_name()
+    if tag_list is None:
+        tag_list = []
+    try:
+        role_response = iam_client.create_role(Path=path,RoleName=rolename,AssumeRolePolicyDocument=policy_document,Tags=tag_list)
+    except ClientError as e:
+    	role_err = e.response['Code']
+    return (role_err,role_response,rolename)
+
+def put_role_policy(iam_client,rolename,policyname,role_policy):
+    role_err=None
+    role_response = None
+    if policyname is None:
+        policyname=get_parameter_name() 
+    try:
+        role_response = iam_client.put_role_policy(RoleName=rolename,PolicyName=policyname,PolicyDocument=role_policy)
+    except ClientError as e:
+    	role_err = e.response['Code']
+    return (role_err,role_response)
+
+def put_user_policy(iam_client,username,policyname,policy_document):
+    role_err=None
+    role_response = None
+    if policyname is None:
+        policyname=get_parameter_name()
+    try:
+        role_response = iam_client.put_user_policy(UserName=username,PolicyName=policyname,PolicyDocument=policy_document)
+    except ClientError as e:
+        role_err = e.response['Code']
+    return (role_err,role_response,policyname)
+
+def get_s3_client_using_iam_creds():
+    iam_access_key = get_iam_access_key()
+    iam_secret_key = get_iam_secret_key()
+    default_endpoint = get_config_endpoint()
+
+    s3_client_iam_creds = boto3.client('s3',
+                              aws_access_key_id = iam_access_key,
+                              aws_secret_access_key = iam_secret_key,
+                              endpoint_url=default_endpoint,
+                              region_name='',
+                          )
+
+    return s3_client_iam_creds
+
+def create_oidc_provider(iam_client, url, clientidlist, thumbprintlist):
+    oidc_arn = None
+    oidc_error = None
+    clientids = []
+    if clientidlist is None:
+        clientidlist=clientids
+    try:
+        oidc_response = iam_client.create_open_id_connect_provider(
+            Url=url,
+            ClientIDList=clientidlist,
+            ThumbprintList=thumbprintlist,
+        )
+        oidc_arn = oidc_response['OpenIDConnectProviderArn']
+        print (oidc_arn)
+    except ClientError as e:
+        oidc_error = e.response['Code']
+        print (oidc_error)
+        try:
+            oidc_error = None
+            print (url)
+            if url.startswith('http://'):
+                url = url[len('http://'):]
+            elif url.startswith('https://'):
+                url = url[len('https://'):]
+            elif url.startswith('www.'):
+                url = url[len('www.'):]
+            oidc_arn = 'arn:aws:iam:::oidc-provider/{}'.format(url)
+            print (url)
+            print (oidc_arn)
+            oidc_response = iam_client.get_open_id_connect_provider(OpenIDConnectProviderArn=oidc_arn)
+        except ClientError as e:
+            oidc_arn = None
+    return (oidc_arn, oidc_error)
+
+def get_s3_resource_using_iam_creds():
+    iam_access_key = get_iam_access_key()
+    iam_secret_key = get_iam_secret_key()
+    default_endpoint = get_config_endpoint()
+
+    s3_res_iam_creds = boto3.resource('s3',
+                              aws_access_key_id = iam_access_key,
+                              aws_secret_access_key = iam_secret_key,
+                              endpoint_url=default_endpoint,
+                              region_name='',
+                          )
+
+    return s3_res_iam_creds
+
+@pytest.mark.test_of_sts
+@pytest.mark.fails_on_dbstore
+def test_get_session_token():
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    sts_user_id=get_alt_user_id()
+    default_endpoint=get_config_endpoint()
+    
+    user_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Action\":\"s3:*\",\"Resource\":[\"*\"],\"Condition\":{\"BoolIfExists\":{\"sts:authentication\":\"false\"}}},{\"Effect\":\"Allow\",\"Action\":\"sts:GetSessionToken\",\"Resource\":\"*\",\"Condition\":{\"BoolIfExists\":{\"sts:authentication\":\"false\"}}}]}"
+    (resp_err,resp,policy_name)=put_user_policy(iam_client,sts_user_id,None,user_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+    
+    response=sts_client.get_session_token()
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    
+    s3_client=boto3.client('s3',
+                aws_access_key_id = response['Credentials']['AccessKeyId'],
+		aws_secret_access_key = response['Credentials']['SecretAccessKey'],
+                aws_session_token = response['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='',
+		)
+    bucket_name = get_new_bucket_name()
+    try:
+        s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+        assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+        finish=s3_client.delete_bucket(Bucket=bucket_name)
+    finally: # clean up user policy even if create_bucket/delete_bucket fails
+        iam_client.delete_user_policy(UserName=sts_user_id,PolicyName=policy_name)
+
+@pytest.mark.test_of_sts
+@pytest.mark.fails_on_dbstore
+def test_assume_role_allow():
+    iam_client=get_iam_client()    
+    sts_client=get_sts_client()
+    sts_user_id=get_alt_user_id()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"arn:aws:iam:::user/"+sts_user_id+"\"]},\"Action\":[\"sts:AssumeRole\"]}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    if role_response:
+        assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    else:
+        assert False, role_error
+    
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    if response:
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    else:
+        assert False, role_err
+    
+    resp=sts_client.assume_role(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+    
+    s3_client = boto3.client('s3',
+		aws_access_key_id = resp['Credentials']['AccessKeyId'],
+		aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+		aws_session_token = resp['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='',
+		)
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+@pytest.mark.test_of_sts
+@pytest.mark.fails_on_dbstore
+def test_assume_role_deny():
+    s3bucket_error=None
+    iam_client=get_iam_client()    
+    sts_client=get_sts_client()
+    sts_user_id=get_alt_user_id()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"arn:aws:iam:::user/"+sts_user_id+"\"]},\"Action\":[\"sts:AssumeRole\"]}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    if role_response:
+        assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    else:
+        assert False, role_error
+    
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Deny\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    if response:
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    else:
+        assert False, role_err
+    
+    resp=sts_client.assume_role(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+    
+    s3_client = boto3.client('s3',
+		aws_access_key_id = resp['Credentials']['AccessKeyId'],
+		aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+		aws_session_token = resp['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='',
+		)
+    bucket_name = get_new_bucket_name()
+    try:
+        s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    except ClientError as e:
+        s3bucket_error = e.response.get("Error", {}).get("Code")
+    assert s3bucket_error == 'AccessDenied'
+
+@pytest.mark.test_of_sts
+@pytest.mark.fails_on_dbstore
+def test_assume_role_creds_expiry():
+    iam_client=get_iam_client()    
+    sts_client=get_sts_client()
+    sts_user_id=get_alt_user_id()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"arn:aws:iam:::user/"+sts_user_id+"\"]},\"Action\":[\"sts:AssumeRole\"]}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    if role_response:
+        assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    else:
+        assert False, role_error
+    
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    if response:
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    else:
+        assert False, role_err
+    
+    resp=sts_client.assume_role(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,DurationSeconds=900)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+    time.sleep(900)
+    
+    s3_client = boto3.client('s3',
+		aws_access_key_id = resp['Credentials']['AccessKeyId'],
+		aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+		aws_session_token = resp['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='',
+		)
+    bucket_name = get_new_bucket_name()
+    try:
+        s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    except ClientError as e:
+        s3bucket_error = e.response.get("Error", {}).get("Code")
+        http_status_code = e.response.get("ResponseMetadata", {}).get("HTTPStatusCode")
+    assert s3bucket_error == 'ExpiredToken'
+    assert http_status_code == 400
+
+@pytest.mark.test_of_sts
+@pytest.mark.fails_on_dbstore
+def test_assume_role_deny_head_nonexistent():
+    # create a bucket with the normal s3 client
+    bucket_name = get_new_bucket_name()
+    get_client().create_bucket(Bucket=bucket_name)
+
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    sts_user_id=get_alt_user_id()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+
+    policy_document = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/'+sts_user_id+'"]},"Action":["sts:AssumeRole"]}]}'
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    if role_response:
+        assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name
+    else:
+        assert False, role_error
+
+    # allow GetObject but deny ListBucket
+    role_policy = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":"s3:GetObject","Principal":"*","Resource":"arn:aws:s3:::*"}}'
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    if response:
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    else:
+        assert False, role_err
+
+    resp=sts_client.assume_role(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+		aws_access_key_id = resp['Credentials']['AccessKeyId'],
+		aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+		aws_session_token = resp['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='')
+    status=200
+    try:
+        s3_client.head_object(Bucket=bucket_name, Key='nonexistent')
+    except ClientError as e:
+        status = e.response['ResponseMetadata']['HTTPStatusCode']
+    assert status == 403
+
+@pytest.mark.test_of_sts
+@pytest.mark.fails_on_dbstore
+def test_assume_role_allow_head_nonexistent():
+    # create a bucket with the normal s3 client
+    bucket_name = get_new_bucket_name()
+    get_client().create_bucket(Bucket=bucket_name)
+
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    sts_user_id=get_alt_user_id()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+
+    policy_document = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/'+sts_user_id+'"]},"Action":["sts:AssumeRole"]}]}'
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    if role_response:
+        assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name
+    else:
+        assert False, role_error
+
+    # allow GetObject and ListBucket
+    role_policy = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Principal":"*","Resource":"arn:aws:s3:::*"}}'
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    if response:
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    else:
+        assert False, role_err
+
+    resp=sts_client.assume_role(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+		aws_access_key_id = resp['Credentials']['AccessKeyId'],
+		aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+		aws_session_token = resp['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='')
+    status=200
+    try:
+        s3_client.head_object(Bucket=bucket_name, Key='nonexistent')
+    except ClientError as e:
+        status = e.response['ResponseMetadata']['HTTPStatusCode']
+    assert status == 404
+
+
+@pytest.mark.webidentity_test
+@pytest.mark.token_claims_trust_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity():
+    check_webidentity()
+    iam_client=get_iam_client()    
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+    
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+    
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    if response:
+        assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+    else:
+        assert False, role_err
+    
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+    
+    s3_client = boto3.client('s3',
+		aws_access_key_id = resp['Credentials']['AccessKeyId'],
+		aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+		aws_session_token = resp['Credentials']['SessionToken'],
+		endpoint_url=default_endpoint,
+		region_name='',
+		)
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+    
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+'''
+@pytest.mark.webidentity_test
+def test_assume_role_with_web_identity_invalid_webtoken():
+    resp_error=None
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=""
+    try:
+        resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken='abcdef')
+    except InvalidIdentityTokenException as e:
+        log.debug('{}'.format(resp))
+        log.debug('{}'.format(e.response.get("Error", {}).get("Code")))
+        log.debug('{}'.format(e))
+        resp_error = e.response.get("Error", {}).get("Code")
+    assert resp_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+'''
+
+#######################
+# Session Policy Tests
+#######################
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_check_on_different_buckets():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"arn:aws:s3:::test2\",\"arn:aws:s3:::test2/*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\",\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+
+    bucket_name_1 = 'test1'
+    try:
+        s3bucket = s3_client.create_bucket(Bucket=bucket_name_1)
+    except ClientError as e:
+        s3bucket_error = e.response.get("Error", {}).get("Code")
+    assert s3bucket_error == 'AccessDenied'
+
+    bucket_name_2 = 'test2'
+    try:
+        s3bucket = s3_client.create_bucket(Bucket=bucket_name_2)
+    except ClientError as e:
+        s3bucket_error = e.response.get("Error", {}).get("Code")
+    assert s3bucket_error == 'AccessDenied'
+
+    bucket_body = 'please-write-something'
+    #body.encode(encoding='utf_8')
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'NoSuchBucket'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_check_on_same_bucket():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_iam_creds = get_s3_client_using_iam_creds()
+
+    bucket_name_1 = 'test1'
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\",\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_check_put_obj_denial():
+    check_webidentity()
+    iam_client=get_iam_client()
+    iam_access_key=get_iam_access_key()
+    iam_secret_key=get_iam_secret_key()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_iam_creds = get_s3_client_using_iam_creds()
+
+    bucket_name_1 = 'test1'
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_swapping_role_policy_and_session_policy():
+    check_webidentity()
+    iam_client=get_iam_client()
+    iam_access_key=get_iam_access_key()
+    iam_secret_key=get_iam_secret_key()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\",\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_iam_creds = get_s3_client_using_iam_creds()
+
+    bucket_name_1 = 'test1'
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_check_different_op_permissions():
+    check_webidentity()
+    iam_client=get_iam_client()
+    iam_access_key=get_iam_access_key()
+    iam_secret_key=get_iam_secret_key()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_iam_creds = get_s3_client_using_iam_creds()
+
+    bucket_name_1 = 'test1'
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_check_with_deny_effect():
+    check_webidentity()
+    iam_client=get_iam_client()
+    iam_access_key=get_iam_access_key()
+    iam_secret_key=get_iam_secret_key()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Deny\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_iam_creds = get_s3_client_using_iam_creds()
+
+    bucket_name_1 = 'test1'
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_check_with_deny_on_same_op():
+    check_webidentity()
+    iam_client=get_iam_client()
+    iam_access_key=get_iam_access_key()
+    iam_secret_key=get_iam_secret_key()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy_new = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy_new)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client_iam_creds = get_s3_client_using_iam_creds()
+
+    bucket_name_1 = 'test1'
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Deny\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_bucket_policy_role_arn():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3client_iamcreds = get_s3_client_using_iam_creds()
+    bucket_name_1 = 'test1'
+    s3bucket = s3client_iamcreds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resource1 = "arn:aws:s3:::" + bucket_name_1
+    resource2 = "arn:aws:s3:::" + bucket_name_1 + "/*"
+    rolearn = "arn:aws:iam:::role/" + general_role_name
+    bucket_policy = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "{}".format(rolearn)},
+        "Action": ["s3:GetObject","s3:PutObject"],
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+    s3client_iamcreds.put_bucket_policy(Bucket=bucket_name_1, Policy=bucket_policy)
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    try:
+        obj = s3_client.get_object(Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3object_error = e.response.get("Error", {}).get("Code")
+    assert s3object_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_bucket_policy_session_arn():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3client_iamcreds = get_s3_client_using_iam_creds()
+    bucket_name_1 = 'test1'
+    s3bucket = s3client_iamcreds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resource1 = "arn:aws:s3:::" + bucket_name_1
+    resource2 = "arn:aws:s3:::" + bucket_name_1 + "/*"
+    rolesessionarn = "arn:aws:iam:::assumed-role/" + general_role_name + "/" + role_session_name
+    bucket_policy = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "{}".format(rolesessionarn)},
+        "Action": ["s3:GetObject","s3:PutObject"],
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+    })
+    s3client_iamcreds.put_bucket_policy(Bucket=bucket_name_1, Policy=bucket_policy)
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+
+    s3_get_obj = s3_client.get_object(Bucket=bucket_name_1, Key="test-1.txt")
+    assert s3_get_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_copy_object():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3client_iamcreds = get_s3_client_using_iam_creds()
+    bucket_name_1 = 'test1'
+    s3bucket = s3client_iamcreds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resource1 = "arn:aws:s3:::" + bucket_name_1
+    resource2 = "arn:aws:s3:::" + bucket_name_1 + "/*"
+    rolesessionarn = "arn:aws:iam:::assumed-role/" + general_role_name + "/" + role_session_name
+    print (rolesessionarn)
+    bucket_policy = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Allow",
+        "Principal": {"AWS": "{}".format(rolesessionarn)},
+        "Action": ["s3:GetObject","s3:PutObject"],
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+     })
+    s3client_iamcreds.put_bucket_policy(Bucket=bucket_name_1, Policy=bucket_policy)
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    copy_source = {
+    'Bucket': bucket_name_1,
+    'Key': 'test-1.txt'
+    }
+
+    s3_client.copy(copy_source, bucket_name_1, "test-2.txt")
+
+    s3_get_obj = s3_client.get_object(Bucket=bucket_name_1, Key="test-2.txt")
+    assert s3_get_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_no_bucket_role_policy():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    s3client_iamcreds = get_s3_client_using_iam_creds()
+    bucket_name_1 = 'test1'
+    s3bucket = s3client_iamcreds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\",\"s3:GetObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3putobj_error = e.response.get("Error", {}).get("Code")
+    assert s3putobj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.session_policy
+@pytest.mark.fails_on_dbstore
+def test_session_policy_bucket_policy_deny():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    aud=get_aud()
+    token=get_token()
+    realm=get_realm_name()
+
+    url = 'http://localhost:8080/auth/realms/{}'.format(realm)
+    thumbprintlist = [thumbprint]
+    (oidc_arn,oidc_error) = create_oidc_provider(iam_client, url, None, thumbprintlist)
+    if oidc_error is not None:
+        raise RuntimeError('Unable to create/get openid connect provider {}'.format(oidc_error))
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_arn+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":app_id\":\""+aud+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":[\"*\"]}}"
+
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3client_iamcreds = get_s3_client_using_iam_creds()
+    bucket_name_1 = 'test1'
+    s3bucket = s3client_iamcreds.create_bucket(Bucket=bucket_name_1)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resource1 = "arn:aws:s3:::" + bucket_name_1
+    resource2 = "arn:aws:s3:::" + bucket_name_1 + "/*"
+    rolesessionarn = "arn:aws:iam:::assumed-role/" + general_role_name + "/" + role_session_name
+    bucket_policy = json.dumps(
+    {
+        "Version": "2012-10-17",
+        "Statement": [{
+        "Effect": "Deny",
+        "Principal": {"AWS": "{}".format(rolesessionarn)},
+        "Action": ["s3:GetObject","s3:PutObject"],
+        "Resource": [
+            "{}".format(resource1),
+            "{}".format(resource2)
+          ]
+        }]
+    })
+    s3client_iamcreds.put_bucket_policy(Bucket=bucket_name_1, Policy=bucket_policy)
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+                aws_access_key_id = resp['Credentials']['AccessKeyId'],
+                aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+                aws_session_token = resp['Credentials']['SessionToken'],
+                endpoint_url=default_endpoint,
+                region_name='',
+                )
+    bucket_body = 'this is a test file'
+
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
+    except ClientError as e:
+        s3putobj_error = e.response.get("Error", {}).get("Code")
+    assert s3putobj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_arn
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.token_claims_trust_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_with_sub():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    sub=get_sub()
+    token=get_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":sub\":\""+sub+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.token_claims_trust_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_with_azp():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    azp=get_azp()
+    token=get_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"localhost:8080/auth/realms/"+realm+":azp\":\""+azp+"\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_request_tag_trust_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_with_request_tag():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_principal_tag_role_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_with_principal_tag():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"aws:PrincipalTag/Department\":\"Engineering\"}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_principal_tag_role_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_for_all_values():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"ForAllValues:StringEquals\":{\"aws:PrincipalTag/Department\":[\"Engineering\",\"Marketing\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_principal_tag_role_policy_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_for_all_values_deny():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    #ForAllValues: The condition returns true if every key value in the request matches at least one value in the policy
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"ForAllValues:StringEquals\":{\"aws:PrincipalTag/Department\":[\"Engineering\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    try:
+        s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    except ClientError as e:
+        s3bucket_error = e.response.get("Error", {}).get("Code")
+    assert s3bucket_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_tag_keys_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_tag_keys_trust_policy():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:TagKeys\":\"Department\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"ForAnyValue:StringEquals\":{\"aws:PrincipalTag/Department\":[\"Engineering\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_tag_keys_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_tag_keys_role_policy():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"aws:TagKeys\":[\"Department\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+    bkt = s3_client.delete_bucket(Bucket=bucket_name)
+    assert bkt['ResponseMetadata']['HTTPStatusCode'] == 204
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_resource_tags_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_resource_tag():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    s3_res_iam_creds = get_s3_resource_using_iam_creds()
+
+    s3_client_iam_creds = s3_res_iam_creds.meta.client
+
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    bucket_tagging = s3_res_iam_creds.BucketTagging(bucket_name)
+    Set_Tag = bucket_tagging.put(Tagging={'TagSet':[{'Key':'Department', 'Value': 'Engineering'},{'Key':'Department', 'Value': 'Marketing'}]})
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"s3:ResourceTag/Department\":[\"Engineering\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_resource_tags_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_resource_tag_deny():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    s3_res_iam_creds = get_s3_resource_using_iam_creds()
+
+    s3_client_iam_creds = s3_res_iam_creds.meta.client
+
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"s3:ResourceTag/Department\":[\"Engineering\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_resource_tags_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_wrong_resource_tag_deny():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    s3_res_iam_creds = get_s3_resource_using_iam_creds()
+
+    s3_client_iam_creds = s3_res_iam_creds.meta.client
+
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    bucket_tagging = s3_res_iam_creds.BucketTagging(bucket_name)
+    Set_Tag = bucket_tagging.put(Tagging={'TagSet':[{'Key':'Department', 'Value': 'WrongResourcetag'}]})
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"s3:ResourceTag/Department\":[\"Engineering\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+
+    bucket_body = 'this is a test file'
+    try:
+        s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name, Key="test-1.txt")
+    except ClientError as e:
+        s3_put_obj_error = e.response.get("Error", {}).get("Code")
+    assert s3_put_obj_error == 'AccessDenied'
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_resource_tags_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_resource_tag_princ_tag():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    s3_res_iam_creds = get_s3_resource_using_iam_creds()
+
+    s3_client_iam_creds = s3_res_iam_creds.meta.client
+
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    bucket_tagging = s3_res_iam_creds.BucketTagging(bucket_name)
+    Set_Tag = bucket_tagging.put(Tagging={'TagSet':[{'Key':'Department', 'Value': 'Engineering'}]})
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"s3:ResourceTag/Department\":[\"${aws:PrincipalTag/Department}\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+
+    bucket_body = 'this is a test file'
+    tags = 'Department=Engineering&Department=Marketing'
+    key = "test-1.txt"
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name, Key=key, Tagging=tags)
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_get_obj = s3_client.get_object(Bucket=bucket_name, Key=key)
+    assert s3_get_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_resource_tags_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_resource_tag_copy_obj():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    s3_res_iam_creds = get_s3_resource_using_iam_creds()
+
+    s3_client_iam_creds = s3_res_iam_creds.meta.client
+
+    #create two buckets and add same tags to both
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    bucket_tagging = s3_res_iam_creds.BucketTagging(bucket_name)
+    Set_Tag = bucket_tagging.put(Tagging={'TagSet':[{'Key':'Department', 'Value': 'Engineering'}]})
+
+    copy_bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=copy_bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    bucket_tagging = s3_res_iam_creds.BucketTagging(copy_bucket_name)
+    Set_Tag = bucket_tagging.put(Tagging={'TagSet':[{'Key':'Department', 'Value': 'Engineering'}]})
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"aws:RequestTag/Department\":\"Engineering\"}}}]}"
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"s3:ResourceTag/Department\":[\"${aws:PrincipalTag/Department}\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+
+    bucket_body = 'this is a test file'
+    tags = 'Department=Engineering'
+    key = "test-1.txt"
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name, Key=key, Tagging=tags)
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    #copy to same bucket
+    copy_source = {
+    'Bucket': bucket_name,
+    'Key': 'test-1.txt'
+    }
+
+    s3_client.copy(copy_source, bucket_name, "test-2.txt")
+
+    s3_get_obj = s3_client.get_object(Bucket=bucket_name, Key="test-2.txt")
+    assert s3_get_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    #copy to another bucket
+    copy_source = {
+    'Bucket': bucket_name,
+    'Key': 'test-1.txt'
+    }
+
+    s3_client.copy(copy_source, copy_bucket_name, "test-1.txt")
+
+    s3_get_obj = s3_client.get_object(Bucket=copy_bucket_name, Key="test-1.txt")
+    assert s3_get_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
+
+@pytest.mark.webidentity_test
+@pytest.mark.abac_test
+@pytest.mark.token_role_tags_test
+@pytest.mark.fails_on_dbstore
+def test_assume_role_with_web_identity_role_resource_tag():
+    check_webidentity()
+    iam_client=get_iam_client()
+    sts_client=get_sts_client()
+    default_endpoint=get_config_endpoint()
+    role_session_name=get_parameter_name()
+    thumbprint=get_thumbprint()
+    user_token=get_user_token()
+    realm=get_realm_name()
+
+    s3_res_iam_creds = get_s3_resource_using_iam_creds()
+
+    s3_client_iam_creds = s3_res_iam_creds.meta.client
+
+    bucket_name = get_new_bucket_name()
+    s3bucket = s3_client_iam_creds.create_bucket(Bucket=bucket_name)
+    assert s3bucket['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    bucket_tagging = s3_res_iam_creds.BucketTagging(bucket_name)
+    Set_Tag = bucket_tagging.put(Tagging={'TagSet':[{'Key':'Department', 'Value': 'Engineering'},{'Key':'Department', 'Value': 'Marketing'}]})
+
+    oidc_response = iam_client.create_open_id_connect_provider(
+    Url='http://localhost:8080/auth/realms/{}'.format(realm),
+    ThumbprintList=[
+        thumbprint,
+    ],
+    )
+
+    #iam:ResourceTag refers to the tag attached to role, hence the role is allowed to be assumed only when it has a tag matching the policy.
+    policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\""+oidc_response["OpenIDConnectProviderArn"]+"\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\",\"sts:TagSession\"],\"Condition\":{\"StringEquals\":{\"iam:ResourceTag/Department\":\"Engineering\"}}}]}"
+    tags_list = [
+            {'Key':'Department','Value':'Engineering'},
+            {'Key':'Department','Value':'Marketing'}
+        ]
+
+    (role_error,role_response,general_role_name)=create_role(iam_client,'/',None,policy_document,None,None,None,tags_list)
+    assert role_response['Role']['Arn'] == 'arn:aws:iam:::role/'+general_role_name+''
+
+    role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\",\"Condition\":{\"StringEquals\":{\"s3:ResourceTag/Department\":[\"Engineering\"]}}}}"
+    (role_err,response)=put_role_policy(iam_client,general_role_name,None,role_policy)
+    assert response['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=user_token)
+    assert resp['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    s3_client = boto3.client('s3',
+        aws_access_key_id = resp['Credentials']['AccessKeyId'],
+        aws_secret_access_key = resp['Credentials']['SecretAccessKey'],
+        aws_session_token = resp['Credentials']['SessionToken'],
+        endpoint_url=default_endpoint,
+        region_name='',
+        )
+
+    bucket_body = 'this is a test file'
+    s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name, Key="test-1.txt")
+    assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
+
+    oidc_remove=iam_client.delete_open_id_connect_provider(
+    OpenIDConnectProviderArn=oidc_response["OpenIDConnectProviderArn"]
+    )
diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_utils.py b/src/test/rgw/s3-tests/s3tests/functional/test_utils.py
new file mode 100644
index 00000000000..c0dd3980670
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_utils.py
@@ -0,0 +1,9 @@
+from . import utils
+
+def test_generate():
+    FIVE_MB = 5 * 1024 * 1024
+    assert len(''.join(utils.generate_random(0))) == 0
+    assert len(''.join(utils.generate_random(1))) == 1
+    assert len(''.join(utils.generate_random(FIVE_MB - 1))) == FIVE_MB - 1
+    assert len(''.join(utils.generate_random(FIVE_MB))) == FIVE_MB
+    assert len(''.join(utils.generate_random(FIVE_MB + 1))) == FIVE_MB + 1
diff --git a/src/test/rgw/s3-tests/s3tests/functional/utils.py b/src/test/rgw/s3-tests/s3tests/functional/utils.py
new file mode 100644
index 00000000000..ab84c1651ba
--- /dev/null
+++ b/src/test/rgw/s3-tests/s3tests/functional/utils.py
@@ -0,0 +1,47 @@
+import random
+import requests
+import string
+import time
+
+def assert_raises(excClass, callableObj, *args, **kwargs):
+    """
+    Like unittest.TestCase.assertRaises, but returns the exception.
+    """
+    try:
+        callableObj(*args, **kwargs)
+    except excClass as e:
+        return e
+    else:
+        if hasattr(excClass, '__name__'):
+            excName = excClass.__name__
+        else:
+            excName = str(excClass)
+        raise AssertionError("%s not raised" % excName)
+
+def generate_random(size, part_size=5*1024*1024):
+    """
+    Generate the specified number random data.
+    (actually each MB is a repetition of the first KB)
+    """
+    chunk = 1024
+    allowed = string.ascii_letters
+    for x in range(0, size, part_size):
+        strpart = ''.join([allowed[random.randint(0, len(allowed) - 1)] for _ in range(chunk)])
+        s = ''
+        left = size - x
+        this_part_size = min(left, part_size)
+        for y in range(this_part_size // chunk):
+            s = s + strpart
+        s = s + strpart[:(this_part_size % chunk)]
+        yield s
+        if (x == size):
+            return
+
+def _get_status(response):
+    status = response['ResponseMetadata']['HTTPStatusCode']
+    return status
+
+def _get_status_and_error_code(response):
+    status = response['ResponseMetadata']['HTTPStatusCode']
+    error_code = response['Error']['Code']
+    return status, error_code
diff --git a/src/test/rgw/s3-tests/setup.py b/src/test/rgw/s3-tests/setup.py
new file mode 100644
index 00000000000..d3c7e7bf2ec
--- /dev/null
+++ b/src/test/rgw/s3-tests/setup.py
@@ -0,0 +1,22 @@
+#!/usr/bin/python
+from setuptools import setup, find_packages
+
+setup(
+    name='s3tests',
+    version='0.0.1',
+    packages=find_packages(),
+
+    author='Tommi Virtanen',
+    author_email='tommi.virtanen@dreamhost.com',
+    description='Unofficial Amazon AWS S3 compatibility tests',
+    license='MIT',
+    keywords='s3 web testing',
+
+    install_requires=[
+        'boto3 >=1.0.0',
+        'PyYAML',
+        'munch >=2.0.0',
+        'gevent >=1.0',
+        'isodate >=0.4.4',
+        ],
+    )
diff --git a/src/test/rgw/s3-tests/tox.ini b/src/test/rgw/s3-tests/tox.ini
new file mode 100644
index 00000000000..e4a30e5b3f0
--- /dev/null
+++ b/src/test/rgw/s3-tests/tox.ini
@@ -0,0 +1,9 @@
+[tox]
+envlist = py
+
+[testenv]
+deps = -rrequirements.txt
+passenv =
+  S3TEST_CONF
+  S3_USE_SIGV4
+commands = pytest {posargs}

From d0c88cb53c6848e9bcd7c4ea90f21f1aa6912242 Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Mon, 29 Sep 2025 17:11:09 -0400
Subject: [PATCH 358/596] qa/rgw: Run s3-tests from within the Ceph repo

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 qa/rgw/s3tests-branch.yaml                    |  4 ---
 .../rgw/lifecycle/s3tests-branch.yaml         |  1 -
 .../rgw/multifs/s3tests-branch.yaml           |  1 -
 .../crimson-rados/rgw/sts/s3tests-branch.yaml |  1 -
 .../rgw/bucket-logging/s3tests-branch.yaml    |  1 -
 .../rgw/cloud-transition/s3tests-branch.yaml  |  1 -
 qa/suites/rgw/crypt/s3tests-branch.yaml       |  1 -
 qa/suites/rgw/dbstore/s3tests-branch.yaml     |  1 -
 qa/suites/rgw/lifecycle/s3tests-branch.yaml   |  1 -
 qa/suites/rgw/multifs/s3tests-branch.yaml     |  1 -
 qa/suites/rgw/s3control/s3tests-branch.yaml   |  1 -
 qa/suites/rgw/sts/s3tests-branch.yaml         |  1 -
 qa/suites/rgw/tempest/s3tests-branch.yaml     |  1 -
 qa/suites/rgw/thrash/s3tests-branch.yaml      |  1 -
 qa/suites/rgw/verify/s3tests-branch.yaml      |  1 -
 qa/suites/rgw/website/s3tests-branch.yaml     |  1 -
 qa/tasks/s3tests.py                           | 26 +++++++++----------
 17 files changed, 12 insertions(+), 33 deletions(-)
 delete mode 100644 qa/rgw/s3tests-branch.yaml
 delete mode 120000 qa/suites/crimson-rados/rgw/lifecycle/s3tests-branch.yaml
 delete mode 120000 qa/suites/crimson-rados/rgw/multifs/s3tests-branch.yaml
 delete mode 120000 qa/suites/crimson-rados/rgw/sts/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/bucket-logging/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/cloud-transition/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/crypt/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/dbstore/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/lifecycle/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/multifs/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/s3control/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/sts/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/tempest/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/thrash/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/verify/s3tests-branch.yaml
 delete mode 120000 qa/suites/rgw/website/s3tests-branch.yaml

diff --git a/qa/rgw/s3tests-branch.yaml b/qa/rgw/s3tests-branch.yaml
deleted file mode 100644
index 8710ce35893..00000000000
--- a/qa/rgw/s3tests-branch.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-overrides:
-  s3tests:
-     force-branch: ceph-master
-     # git_remote: https://github.com/ceph/
diff --git a/qa/suites/crimson-rados/rgw/lifecycle/s3tests-branch.yaml b/qa/suites/crimson-rados/rgw/lifecycle/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/crimson-rados/rgw/lifecycle/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/crimson-rados/rgw/multifs/s3tests-branch.yaml b/qa/suites/crimson-rados/rgw/multifs/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/crimson-rados/rgw/multifs/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/crimson-rados/rgw/sts/s3tests-branch.yaml b/qa/suites/crimson-rados/rgw/sts/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/crimson-rados/rgw/sts/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/bucket-logging/s3tests-branch.yaml b/qa/suites/rgw/bucket-logging/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/bucket-logging/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/cloud-transition/s3tests-branch.yaml b/qa/suites/rgw/cloud-transition/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/cloud-transition/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/crypt/s3tests-branch.yaml b/qa/suites/rgw/crypt/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/crypt/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/dbstore/s3tests-branch.yaml b/qa/suites/rgw/dbstore/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/dbstore/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/lifecycle/s3tests-branch.yaml b/qa/suites/rgw/lifecycle/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/lifecycle/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/multifs/s3tests-branch.yaml b/qa/suites/rgw/multifs/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/multifs/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/s3control/s3tests-branch.yaml b/qa/suites/rgw/s3control/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/s3control/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/sts/s3tests-branch.yaml b/qa/suites/rgw/sts/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/sts/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/tempest/s3tests-branch.yaml b/qa/suites/rgw/tempest/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/tempest/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/thrash/s3tests-branch.yaml b/qa/suites/rgw/thrash/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/thrash/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/verify/s3tests-branch.yaml b/qa/suites/rgw/verify/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/verify/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/suites/rgw/website/s3tests-branch.yaml b/qa/suites/rgw/website/s3tests-branch.yaml
deleted file mode 120000
index bdcaca48ae0..00000000000
--- a/qa/suites/rgw/website/s3tests-branch.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/rgw/s3tests-branch.yaml
\ No newline at end of file
diff --git a/qa/tasks/s3tests.py b/qa/tasks/s3tests.py
index 3a9db1d543c..45e36f2bc22 100644
--- a/qa/tasks/s3tests.py
+++ b/qa/tasks/s3tests.py
@@ -32,31 +32,29 @@ def download(ctx, config):
     assert isinstance(config, dict)
     log.info('Downloading s3-tests...')
     testdir = teuthology.get_testdir(ctx)
+    s3tests_branch = ctx.config.get('suite_branch') or ctx.config.get('branch')
+    s3tests_repo = ctx.config.get('suite_repo') or teuth_config.get_ceph_qa_suite_git_url()
+    s3tests_sha1 = ctx.config.get('suite_sha1')
+    if not s3tests_branch:
+        raise ValueError(
+            "Could not determine what branch to use for ceph suite.")
     for (client, client_config) in config.items():
-        s3tests_branch = client_config.get('force-branch', None)
-        if not s3tests_branch:
-            raise ValueError(
-                "Could not determine what branch to use for s3-tests. Please add 'force-branch: {s3-tests branch name}' to the .yaml config for this s3tests task.")
-
         log.info("Using branch '%s' for s3tests", s3tests_branch)
-        sha1 = client_config.get('sha1')
-        git_remote = client_config.get('git_remote', teuth_config.ceph_git_base_url)
         ctx.cluster.only(client).run(
             args=[
-                'git', 'clone',
-                '-b', s3tests_branch,
-                git_remote + 's3-tests.git',
-                '{tdir}/s3-tests-{client}'.format(tdir=testdir, client=client),
+                'git', 'clone', '-b', s3tests_branch,
+                s3tests_repo, '{tdir}/s3-tests-{client}'.format(tdir=testdir, client=client),
                 ],
             )
-        if sha1 is not None:
+        if s3tests_sha1 is not None:
             ctx.cluster.only(client).run(
                 args=[
                     'cd', '{tdir}/s3-tests-{client}'.format(tdir=testdir, client=client),
                     run.Raw('&&'),
-                    'git', 'reset', '--hard', sha1,
+                    'git', 'reset', '--hard', s3tests_sha1,
                     ],
                 )
+
         if client_config.get('boto3_extensions'):
             ctx.cluster.only(client).run(
                     args=['mkdir',
@@ -464,7 +462,7 @@ def run_tests(ctx, config):
         client_config = client_config or {}
         (remote,) = ctx.cluster.only(client).remotes.keys()
         args = [
-            'cd', '{tdir}/s3-tests-{client}'.format(tdir=testdir, client=client), run.Raw('&&'),
+            'cd', '{tdir}/s3-tests-{client}/src/test/rgw/s3-tests'.format(tdir=testdir, client=client), run.Raw('&&'),
             'S3TEST_CONF={tdir}/archive/s3-tests.{client}.conf'.format(tdir=testdir, client=client),
             'BOTO_CONFIG={tdir}/boto-{client}.cfg'.format(tdir=testdir, client=client)
             ]

From 5bc34f8ed84aa2f205ccfe04fff9e3ec5ced8727 Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Wed, 17 Jun 2026 14:33:45 -0400
Subject: [PATCH 359/596] qa/rgw: Remove 'force-branch' from s3tests configs

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 qa/suites/smoke/basic/tasks/test/rgw_ec_s3tests.yaml | 1 -
 qa/suites/smoke/basic/tasks/test/rgw_s3tests.yaml    | 1 -
 qa/suites/teuthology/rgw/tasks/s3tests-fastcgi.yaml  | 1 -
 qa/suites/teuthology/rgw/tasks/s3tests-fcgi.yaml     | 1 -
 qa/suites/teuthology/rgw/tasks/s3tests.yaml          | 1 -
 5 files changed, 5 deletions(-)

diff --git a/qa/suites/smoke/basic/tasks/test/rgw_ec_s3tests.yaml b/qa/suites/smoke/basic/tasks/test/rgw_ec_s3tests.yaml
index 8f824838cb1..3214fd9009b 100644
--- a/qa/suites/smoke/basic/tasks/test/rgw_ec_s3tests.yaml
+++ b/qa/suites/smoke/basic/tasks/test/rgw_ec_s3tests.yaml
@@ -10,7 +10,6 @@ tasks:
 - tox: [client.0]
 - s3tests:
     client.0:
-      force-branch: ceph-master
       rgw_server: client.0
 overrides:
   ceph:
diff --git a/qa/suites/smoke/basic/tasks/test/rgw_s3tests.yaml b/qa/suites/smoke/basic/tasks/test/rgw_s3tests.yaml
index 65f7ec16b51..e8c4296dc86 100644
--- a/qa/suites/smoke/basic/tasks/test/rgw_s3tests.yaml
+++ b/qa/suites/smoke/basic/tasks/test/rgw_s3tests.yaml
@@ -7,7 +7,6 @@ tasks:
 - tox: [client.0]
 - s3tests:
     client.0:
-      force-branch: ceph-master
       unit_test_scan: True
       rgw_server: client.0
 overrides:
diff --git a/qa/suites/teuthology/rgw/tasks/s3tests-fastcgi.yaml b/qa/suites/teuthology/rgw/tasks/s3tests-fastcgi.yaml
index d76121fad10..08ceb25c357 100644
--- a/qa/suites/teuthology/rgw/tasks/s3tests-fastcgi.yaml
+++ b/qa/suites/teuthology/rgw/tasks/s3tests-fastcgi.yaml
@@ -11,7 +11,6 @@ tasks:
 - s3tests:
     client.0:
       rgw_server: client.0
-      force-branch: ceph-master
 overrides:
   ceph:
     fs: xfs
diff --git a/qa/suites/teuthology/rgw/tasks/s3tests-fcgi.yaml b/qa/suites/teuthology/rgw/tasks/s3tests-fcgi.yaml
index 8228501ca4b..1746b5bbe73 100644
--- a/qa/suites/teuthology/rgw/tasks/s3tests-fcgi.yaml
+++ b/qa/suites/teuthology/rgw/tasks/s3tests-fcgi.yaml
@@ -12,7 +12,6 @@ tasks:
 - s3tests:
     client.0:
       rgw_server: client.0
-      force-branch: ceph-master
 overrides:
   ceph:
     fs: xfs
diff --git a/qa/suites/teuthology/rgw/tasks/s3tests.yaml b/qa/suites/teuthology/rgw/tasks/s3tests.yaml
index ee8e9d5b5dc..beaffbbde45 100644
--- a/qa/suites/teuthology/rgw/tasks/s3tests.yaml
+++ b/qa/suites/teuthology/rgw/tasks/s3tests.yaml
@@ -11,7 +11,6 @@ tasks:
 - s3tests:
     client.0:
       rgw_server: client.0
-      force-branch: ceph-master
 overrides:
   ceph:
     fs: xfs

From 640bea831a921bd10d119a75ef973a14b4bed20f Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 23 Jun 2026 01:38:54 +0800
Subject: [PATCH 360/596] test/encoding: disable LeakSanitizer in readable.sh
 and check-generated.sh

readable.sh forks two short-lived ceph-dencoder processes per corpus
object(tens of thousands of processes overall). With ASAN's
LeakSanitizer enabled each process runs a whole-heap leak check at exit
that dominates runtime (~10s vs ~1s per process, measured on riscv64).
This test only validates encode/decode behaviour, not leaks, so disable
leak detection while keeping ASAN's other checks active.

check-generated.sh forks ceph-dencoder the same way, so apply the same
fix there.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/encoding/check-generated.sh | 6 ++++++
 src/test/encoding/readable.sh        | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/src/test/encoding/check-generated.sh b/src/test/encoding/check-generated.sh
index c297d415273..42e70eed463 100755
--- a/src/test/encoding/check-generated.sh
+++ b/src/test/encoding/check-generated.sh
@@ -4,6 +4,12 @@ set -e
 source $(dirname $0)/../detect-build-env-vars.sh
 source $CEPH_ROOT/qa/standalone/ceph-helpers.sh
 
+if ldd $(command -v ceph-dencoder) 2>/dev/null | grep -q libasan; then
+  # Per-object leak checks dominate runtime here (~10s vs ~1s each on riscv64)
+  # and this test only checks encode/decode, so disable them; keep other checks.
+  export ASAN_OPTIONS="${ASAN_OPTIONS:+$ASAN_OPTIONS:}detect_leaks=0"
+fi
+
 dir=$1
 
 test_selected_type() {
diff --git a/src/test/encoding/readable.sh b/src/test/encoding/readable.sh
index dcf53d2c8ae..607657355bf 100755
--- a/src/test/encoding/readable.sh
+++ b/src/test/encoding/readable.sh
@@ -34,6 +34,10 @@ if ldd $(command -v $CEPH_DENCODER) 2>/dev/null | grep -q libasan; then
   else
     echo "ASAN build detected but 'setarch -R' is unavailable; running ceph-dencoder without ASLR disable"
   fi
+
+  # Per-object leak checks dominate runtime here (~10s vs ~1s each on riscv64)
+  # and this test only checks encode/decode, so disable them; keep other checks.
+  export ASAN_OPTIONS="${ASAN_OPTIONS:+$ASAN_OPTIONS:}detect_leaks=0"
 fi
 
 myversion=$($CEPH_DENCODER version)

From 9dd7fd0b0a78871f7f71c89a061490f3ffc97605 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 15:43:28 +0800
Subject: [PATCH 361/596] mgr/dashboard: skip the table when an nvmeof cli
 result has no columns

The dashboard leaves prettytable unpinned.  prettytable commit 2574492 ("Apply
some Pylint rules (PLR)", #436) rewrote _stringify_row()'s row_height as
`max(_get_size(c)[1] for c in row)`, which raises ValueError("max() iterable
argument is empty") on a row with no cells.  The change is undocumented and
shipped in 3.18.0; get_string() trips on it when a table has a row but no
columns.

AnnotatedDataTextOutputFormatter builds such a table for an empty result, or
one whose only field is status or error_message, so NvmeofCLICommand.call()
returns -EINVAL and the command fails.  This broke run-tox-mgr-dashboard-py3
once the tox virtualenv picked up prettytable 3.18.0.

Return an empty string when there are no columns instead of formatting a
degenerate table.

Fixes: https://tracker.ceph.com/issues/77589
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/pybind/mgr/dashboard/services/nvmeof_cli.py  |  4 ++++
 .../mgr/dashboard/tests/test_nvmeof_cli.py       | 16 ++--------------
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/src/pybind/mgr/dashboard/services/nvmeof_cli.py b/src/pybind/mgr/dashboard/services/nvmeof_cli.py
index a56e5cde968..5f454c3c24e 100644
--- a/src/pybind/mgr/dashboard/services/nvmeof_cli.py
+++ b/src/pybind/mgr/dashboard/services/nvmeof_cli.py
@@ -204,6 +204,8 @@ class AnnotatedDataTextOutputFormatter(OutputFormatter):
 
     def _get_list_text_output(self, data):
         columns = list(dict.fromkeys([key for obj in data for key in obj.keys()]))
+        if not columns:
+            return ''
         table = self._create_table(columns)
         for d in data:
             table.add_row(self._get_row(columns, d))
@@ -211,6 +213,8 @@ class AnnotatedDataTextOutputFormatter(OutputFormatter):
 
     def _get_object_text_output(self, data):
         columns = [k for k in data.keys() if k not in ["status", "error_message"]]
+        if not columns:
+            return ''
         table = self._create_table(columns)
         table.add_row(self._get_row(columns, data))
         return table.get_string()
diff --git a/src/pybind/mgr/dashboard/tests/test_nvmeof_cli.py b/src/pybind/mgr/dashboard/tests/test_nvmeof_cli.py
index bc75950059a..690103969df 100644
--- a/src/pybind/mgr/dashboard/tests/test_nvmeof_cli.py
+++ b/src/pybind/mgr/dashboard/tests/test_nvmeof_cli.py
@@ -117,13 +117,7 @@ class TestNvmeofCLICommand:
         result = NvmeofCLICommand.COMMANDS[sample_command].call(MagicMock(), {})
         assert isinstance(result, HandleCommandResult)
         assert result.retval == 0
-        assert result.stdout == (
-            "++\n"
-            "||\n"
-            "++\n"
-            "\n"
-            "++"
-        )
+        assert result.stdout == ''
         assert result.stderr == ''
         base_call_return_none_mock.assert_called_once()
 
@@ -788,13 +782,7 @@ class TestNvmeofCLICommandSuccessMessage:
         )
         assert res.retval == 0
         assert res.stderr == ""
-        assert res.stdout == (
-            "++\n"
-            "||\n"
-            "++\n"
-            "\n"
-            "++"
-        )
+        assert res.stdout == ''
 
         del NvmeofCLICommand.COMMANDS[test_cmd]
         assert test_cmd not in NvmeofCLICommand.COMMANDS

From 51d8c5c489ba3e664209fb3316f8d6e03e257e28 Mon Sep 17 00:00:00 2001
From: Alex Ainscow <aainscow@uk.ibm.com>
Date: Tue, 9 Jun 2026 15:45:25 +0100
Subject: [PATCH 362/596] osd/ECTransaction: fix truncate+write planning for EC
 shard sizes

There are multiple problems fixed here, which are caused by operations
which perform a truncate-then-write in a single transaction.

NOTE: The only known scenario for these operations are CLS-sparsify operations.
I recommend backporting these changes to Tentacle, however, as they are
regressions in the RADOS API which can lead to data corruption.

PROBLEM: Cache not invalidated correctly:
If projected_size >= orig_size, the invalidate_cache flag is not set in the plan
This means there is potentially data in the RMW extent cache, which
may cause data corruption in subsequent writes (although not the write
being made). No actual use case for this operation is known, so it may not be as serious as
it sounds.

FIX: Invalidate cache on any truncate or "delete_first"

PROBLEM: Parity writes permitted with truncates:
Currently parity delta writes do not support operations which may have
truncates. However, if the object ended up the same size as pre-truncate, a
parity delta write may have been attemtped. This may lead to data corruption.

FIX: Block parity writes in this case.
NOTE: It is not worth the development effort to support PDW in this scenario, as
performance benefit would be minimal overall.

PROBLEM: RMW Reads can occur beyond first truncate point.
Such reads reflect the pre-truncate data (which is incorrect) and be
preserved, even if the invalidate cache flag is set (since the cache is
invalidated before the reads). This can lead to similar corruption as
the earlier "cache not invalidated"

FIX: trim the read to the lower truncate size.

PROBLEM:
When performing a truncate, the parity shards may need to be updated to
reflect truncates on other shards. These truncate writes in the plan were
overriding, rather than adding to, other writes in the op.  The result was
a potentially truncated coding shard.  This leads to assertions on reads.

FIX: Replace = with insert()

PROBLEM: Some shards not set to correct size on truncate-then-write
If projected_size is smaller or equal to the original size, then the
code which attempts to correctly size a shard will not run.  However if
an operation performs a truncate then a partial write and does not
write to a particular shard AND the shard ends up smaller, then this
can lead to an incorrectly sized shard. This leads to assertion on reads.

FIX: Execute the shard-resize code on all truncates.

AI assistance was mainly used to write unit test. However, I cannot rule out a
contribution to the simple fixes found in this commit, so out of caution,
I place the Assisted-by tag.

Fixes: https://tracker.ceph.com/issues/77276

Signed-off-by: Alex Ainscow <aainscow@uk.ibm.com>
Assisted-by: IBM-Bob:ClaudeSonnet/GPT
---
 src/osd/ECTransaction.cc | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/osd/ECTransaction.cc b/src/osd/ECTransaction.cc
index 8368a219040..ed6551b711a 100644
--- a/src/osd/ECTransaction.cc
+++ b/src/osd/ECTransaction.cc
@@ -149,7 +149,7 @@ ECTransaction::WritePlanObj::WritePlanObj(
    * 2. ALL delete operations (do NOT use is_delete() here!!!)
    * 3. Truncates that reduce size.
    */
-  invalidates_cache = op.has_source(&source) || op.delete_first || projected_size < orig_size;
+  invalidates_cache = op.has_source(&source) || op.delete_first || (op.truncate && op.truncate->first < orig_size);
 
   op.buffer_updates.to_interval_set(unaligned_ro_writes);
 
@@ -215,7 +215,7 @@ ECTransaction::WritePlanObj::WritePlanObj(
 
       /* Here we decide if we want to do a conventional write or a parity delta write. */
       if (sinfo.supports_parity_delta_writes() && !object_in_cache &&
-          orig_size == projected_size && !reads.empty()) {
+          orig_size == projected_size && !reads.empty() && !op.truncate) {
 
         shard_id_set read_shards = reads.get_shard_id_set();
         shard_id_set pdw_read_shards = pdw_reads.get_shard_id_set();
@@ -267,6 +267,15 @@ ECTransaction::WritePlanObj::WritePlanObj(
    * read the existing data on the partial stripe.
    */
   if (op.truncate && op.truncate->first < orig_size) {
+    if (to_read) {
+      ECUtil::shard_extent_set_t truncate_mask(sinfo.get_k_plus_m());
+      sinfo.ro_range_to_shard_extent_set(0, op.truncate->first, truncate_mask);
+      
+      to_read->intersection_of(truncate_mask);
+      if (to_read->empty()) {
+          to_read = std::nullopt;
+      }
+    }
     ECUtil::shard_extent_set_t truncate_read(sinfo.get_k_plus_m());
     uint64_t prev_stripe = sinfo.ro_offset_to_prev_stripe_ro_offset(op.truncate->first);
     uint64_t next_align = ECUtil::align_next(op.truncate->first);
@@ -294,7 +303,7 @@ ECTransaction::WritePlanObj::WritePlanObj(
 
       // We only need to update the parity buffer for the write
       for (auto && shard : sinfo.get_parity_shards()) {
-        will_write[shard] = truncate_write;
+        will_write[shard].insert(truncate_write);
       }
     }
   }
@@ -1000,7 +1009,7 @@ void ECTransaction::Generate::appends_and_clone_ranges() {
   ECUtil::shard_extent_set_t cloneable_range(sinfo.get_k_plus_m());
   sinfo.ro_size_to_read_mask(clone_max, cloneable_range);
 
-  if (plan.orig_size < plan.projected_size) {
+  if (op.delete_first || op.truncate || plan.orig_size < plan.projected_size) {
     ECUtil::shard_extent_set_t projected_cloneable_range(sinfo.get_k_plus_m());
     sinfo.ro_size_to_read_mask(plan.projected_size,projected_cloneable_range);
 

From 6062ff880bccf402c29710cbae8df4d760629b6a Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 23 Jun 2026 10:18:29 +0100
Subject: [PATCH 363/596] doc/install: restore cephadm Octopus version floor
 note

Reverts the removal of the minimum version bullet per review feedback.
The Rook version line and ceph-ansible block removals are kept as-is.
---
 doc/install/index.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/install/index.rst b/doc/install/index.rst
index 5be6dda1ffa..5a94577a316 100644
--- a/doc/install/index.rst
+++ b/doc/install/index.rst
@@ -12,6 +12,7 @@ Recommended methods
 :ref:`Cephadm <cephadm_deploying_new_cluster>` is a tool that can be used to
 install and manage a Ceph cluster.
 
+* cephadm supports only Octopus and newer releases.
 * cephadm is fully integrated with the orchestration API and fully supports the
   CLI and dashboard features that are used to manage cluster deployment.
 * cephadm requires container support (in the form of Podman or Docker) and

From 72265c88005a172dd75e8b0a7749a646178a688e Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 23 Jun 2026 10:34:33 +0100
Subject: [PATCH 364/596] doc/rados/operations: refine cache-tiering
 deprecation note per review

Reduce the note to point existing users to the removal procedure, add a
ref target for the removal section, and rephrase the dm-cache mention to
reflect community adoption without implying official endorsement.
---
 doc/rados/operations/cache-tiering.rst | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/doc/rados/operations/cache-tiering.rst b/doc/rados/operations/cache-tiering.rst
index a1f8e49a933..b3df1c3d418 100644
--- a/doc/rados/operations/cache-tiering.rst
+++ b/doc/rados/operations/cache-tiering.rst
@@ -7,11 +7,11 @@
    notice. **Do not deploy new cache tiers.** Migrate existing cache
    tier deployments as soon as possible.
 
-.. note:: The following documentation is retained for reference for existing
-   deployments only. For new deployments, use erasure-coded pools or fast
-   storage pools directly. As a community-supported block-level caching
-   alternative, consider ``dm-cache`` (the Linux kernel's device-mapper cache
-   target).
+.. note:: This documentation is retained for existing deployments only.
+   If you need to remove a cache tier, see :ref:`cache-tiering-removal`.
+   Some community members have adopted ``dm-cache`` (the Linux kernel's
+   device-mapper cache target) as a block-level caching alternative, though
+   this is not an officially supported or endorsed configuration.
 
 A cache tier provides Ceph clients with better I/O performance for a subset of
 the data stored in a backing storage tier. Cache tiering involves creating a
@@ -452,10 +452,12 @@ For example, to evict objects after 30 minutes, execute the following:
    ceph osd pool set hot-storage cache_min_evict_age 1800
 
 
+.. _cache-tiering-removal:
+
 Removing a Cache Tier
 =====================
 
-Removing a cache tier differs depending on whether it is a writeback 
+Removing a cache tier differs depending on whether it is a writeback
 cache or a read-only cache.
 
 

From b2ecec6b3a0b854c393232ed785c3953f87f7201 Mon Sep 17 00:00:00 2001
From: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
Date: Tue, 23 Jun 2026 11:23:14 +0100
Subject: [PATCH 365/596] doc/cephfs: clarify deprecated commands and remove
 obsolete upgrade path

Several CephFS pages described deprecated commands and features without
clear status or replacements, and one page documented an upgrade path that
predates every supported release.

* cephfs-mirroring: correct the peer_add deprecation note to reference the
  actual replacement command, peer_bootstrap create, and link the Bootstrap
  Peers section
* kernel-features, experimental-features: state that inline data has been
  deprecated since the Octopus release and that enabling it triggers a
  health warning
* upgrading: remove the "Upgrading pre-Firefly file systems past Jewel"
  section; the tmap_upgrade command it referenced was removed in Kraken

Fixes: https://tracker.ceph.com/issues/77188
Signed-off-by: Emmanuel Ameh <eameh@contractor.linuxfoundation.org>
---
 doc/cephfs/cephfs-mirroring.rst      |  5 ++--
 doc/cephfs/experimental-features.rst |  4 ++--
 doc/cephfs/kernel-features.rst       |  6 ++---
 doc/cephfs/upgrading.rst             | 34 ----------------------------
 4 files changed, 8 insertions(+), 41 deletions(-)

diff --git a/doc/cephfs/cephfs-mirroring.rst b/doc/cephfs/cephfs-mirroring.rst
index cbd51081dfc..850c8fb972e 100644
--- a/doc/cephfs/cephfs-mirroring.rst
+++ b/doc/cephfs/cephfs-mirroring.rst
@@ -173,8 +173,9 @@ and the user key. However, bootstrapping a peer is the recommended way to add a
 peer.
 
 .. note:: Only a single peer is currently supported.
-          The ``peer_add`` command is deprecated and will be removed in a future release.
-          Use the ``peer_bootstrap`` command instead.
+          The ``peer_add`` command is deprecated and will be removed in a future
+          release. Use the ``peer_bootstrap create`` command instead. See the
+          :ref:`Bootstrap Peers<cephfs_mirroring_bootstrap_peers>` section.
 
 To remove a peer, run a command of the following form:
 
diff --git a/doc/cephfs/experimental-features.rst b/doc/cephfs/experimental-features.rst
index f5f7ebba672..00a53aaba59 100644
--- a/doc/cephfs/experimental-features.rst
+++ b/doc/cephfs/experimental-features.rst
@@ -24,8 +24,8 @@ failures within it are unlikely to make non-inlined data inaccessible.
 Inline data has always been off by default and requires setting
 the ``inline_data`` flag.
 
-Inline data has been declared deprecated for the Octopus release, and will
-likely be removed altogether in a future release.
+Inline data has been deprecated since the Octopus release. Enabling it triggers
+a health warning, and the feature will be removed altogether in a future release.
 
 Mantle: Programmable Metadata Load Balancer
 -------------------------------------------
diff --git a/doc/cephfs/kernel-features.rst b/doc/cephfs/kernel-features.rst
index 6dc66374d6f..83c0a2f244b 100644
--- a/doc/cephfs/kernel-features.rst
+++ b/doc/cephfs/kernel-features.rst
@@ -8,9 +8,9 @@ in the kernel driver.
 
 Inline data
 -----------
-Inline data was introduced by the Firefly release. This feature is being
-deprecated in mainline CephFS, and may be removed from a future kernel
-release.
+Inline data was introduced by the Firefly release. This feature has been
+deprecated since the Octopus release: enabling it triggers a health warning,
+and it will be removed in a future release.
 
 Linux kernel clients >= 3.19 can read inline data and convert existing
 inline data to RADOS objects when file data is modified. At present,
diff --git a/doc/cephfs/upgrading.rst b/doc/cephfs/upgrading.rst
index 0396bd5c1a3..7ca59200d23 100644
--- a/doc/cephfs/upgrading.rst
+++ b/doc/cephfs/upgrading.rst
@@ -54,37 +54,3 @@ command. Older versions of Ceph require you to stop these daemons manually.
     ceph fs set <fs_name> max_mds <old_max_mds>
     ceph fs set <fs_name> allow_standby_replay <old_allow_standby_replay>
 
-
-Upgrading pre-Firefly file systems past Jewel
-=============================================
-
-.. tip::
-
-    This advice only applies to users with file systems
-    created using versions of Ceph older than *Firefly* (0.80).
-    Users creating new file systems may disregard this advice.
-
-Pre-firefly versions of Ceph used a now-deprecated format
-for storing CephFS directory objects, called TMAPs.  Support
-for reading these in RADOS will be removed after the Jewel
-release of Ceph, so for upgrading CephFS users it is important
-to ensure that any old directory objects have been converted.
-
-After installing Jewel on all your MDS and OSD servers, and restarting
-the services, run the following command:
-
-::
-    
-    cephfs-data-scan tmap_upgrade <metadata pool name>
-
-This only needs to be run once, and it is not necessary to
-stop any other services while it runs.  The command may take some
-time to execute, as it iterates over all objects in your metadata
-pool.  It is safe to continue using your file system as normal while
-it executes.  If the command aborts for any reason, it is safe
-to simply run it again.
-
-If you are upgrading a pre-Firefly CephFS file system to a newer Ceph version
-than Jewel, you must first upgrade to Jewel and run the ``tmap_upgrade``
-command before completing your upgrade to the latest version.
-

From 77764dbe66e7ef86b69d8d280852f0fe68676458 Mon Sep 17 00:00:00 2001
From: Gil Bregman <gbregman@il.ibm.com>
Date: Mon, 22 Jun 2026 12:06:00 +0300
Subject: [PATCH 366/596] mgr/cephadm: Add degraded namespace flag to NVMEoF
 spec file Fixes: https://tracker.ceph.com/issues/77556

Signed-off-by: Gil Bregman <gbregman@il.ibm.com>
---
 .../mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 | 1 +
 src/pybind/mgr/cephadm/tests/services/test_nvmeof.py          | 3 +++
 src/python-common/ceph/deployment/service_spec.py             | 4 ++++
 3 files changed, 8 insertions(+)

diff --git a/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2 b/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2
index e0743d95c64..78e32864b1b 100644
--- a/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2
+++ b/src/pybind/mgr/cephadm/templates/services/nvmeof/ceph-nvmeof.conf.j2
@@ -53,6 +53,7 @@ force_tls = {{ spec.force_tls }}
 # This is a development flag, do not change it
 max_message_length_in_mb = {{ spec.max_message_length_in_mb }}
 io_stats_enabled = {{ spec.io_stats_enabled }}
+degrade_namespace_on_kmip_error = {{ spec.degrade_namespace_on_kmip_error }}
 
 [gateway-logs]
 log_level = {{ spec.log_level }}
diff --git a/src/pybind/mgr/cephadm/tests/services/test_nvmeof.py b/src/pybind/mgr/cephadm/tests/services/test_nvmeof.py
index 88a1cc1458c..efbce7cee66 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_nvmeof.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_nvmeof.py
@@ -150,6 +150,7 @@ force_tls = False
 # This is a development flag, do not change it
 max_message_length_in_mb = 4
 io_stats_enabled = True
+degrade_namespace_on_kmip_error = True
 
 [gateway-logs]
 log_level = INFO
@@ -400,6 +401,7 @@ force_tls = False
 # This is a development flag, do not change it
 max_message_length_in_mb = 4
 io_stats_enabled = True
+degrade_namespace_on_kmip_error = True
 
 [gateway-logs]
 log_level = INFO
@@ -592,6 +594,7 @@ force_tls = False
 # This is a development flag, do not change it
 max_message_length_in_mb = 4
 io_stats_enabled = True
+degrade_namespace_on_kmip_error = True
 
 [gateway-logs]
 log_level = INFO
diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 8e183f2414b..bf2429b8b68 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -1897,6 +1897,7 @@ class NvmeofServiceSpec(ServiceSpec):
                  force_tls: Optional[bool] = False,
                  max_message_length_in_mb: Optional[int] = 4,
                  io_stats_enabled: Optional[bool] = True,
+                 degrade_namespace_on_kmip_error: Optional[bool] = True,
                  server_key: Optional[str] = None,
                  server_cert: Optional[str] = None,
                  client_key: Optional[str] = None,
@@ -2056,6 +2057,8 @@ class NvmeofServiceSpec(ServiceSpec):
         self.max_message_length_in_mb = max_message_length_in_mb
         #: ``io_stats_enabled`` enables controller IO statistics
         self.io_stats_enabled = io_stats_enabled
+        #: ``degrade_namespace_on_kmip_error`` on a KMIP key error in update, create a degraded ns
+        self.degrade_namespace_on_kmip_error = degrade_namespace_on_kmip_error
         #: ``allowed_consecutive_spdk_ping_failures`` # of ping failures before aborting gateway
         self.allowed_consecutive_spdk_ping_failures = allowed_consecutive_spdk_ping_failures
         #: ``spdk_ping_interval_in_seconds`` sleep interval in seconds between SPDK pings
@@ -2305,6 +2308,7 @@ class NvmeofServiceSpec(ServiceSpec):
         verify_boolean(self.force_tls, "Force TLS")
         verify_positive_int(self.max_message_length_in_mb, "Max protocol message length")
         verify_boolean(self.io_stats_enabled, "Enable IO statistics")
+        verify_boolean(self.degrade_namespace_on_kmip_error, "Degrade namespace on KMIP error")
         verify_non_negative_number(self.monitor_timeout, "Monitor timeout")
         verify_non_negative_int(self.port, "Port")
         verify_non_negative_int(self.discovery_port, "Discovery port")

From 57e0250f5738dcea3adf4193d82f00b90c52c136 Mon Sep 17 00:00:00 2001
From: Matthew Heler <matthew.heler@hotmail.com>
Date: Fri, 5 Jun 2026 10:48:32 -0500
Subject: [PATCH 367/596] rgw: fix AES-256-GCM key/IV reuse on multipart part
 re-upload

Re-uploading the same part number in a GCM multipart upload encrypted the new
data under the same key and IV as the first upload, since the IV is
part_number||chunk_index and the part key came from the part number alone. GCM
requires a unique IV per key; reusing one to encrypt different data weakens its
confidentiality and integrity guarantees.

Generate a random 16-byte salt on each UploadPart and fold it into the part key,
HMAC(ObjectKey, BE32(part) || salt), so every upload gets a fresh key. The salt
rides RGWUploadPartInfo, and complete stores the selected part's salt in
RGW_ATTR_CRYPT_PART_NUMS, which now holds (part, salt) pairs. GET reads it back
to re-derive the key, and an empty salt reproduces the old derivation so unsalted
parts still decrypt.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
---
 src/rgw/driver/rados/rgw_putobj_processor.cc |  8 ++
 src/rgw/driver/rados/rgw_rados.cc            | 14 ++-
 src/rgw/driver/rados/rgw_sal_rados.cc        | 19 ++--
 src/rgw/driver/rados/rgw_sal_rados.h         |  1 +
 src/rgw/rgw_basic_types.h                    |  9 +-
 src/rgw/rgw_common.h                         |  1 +
 src/rgw/rgw_crypt.cc                         | 99 +++++++++++---------
 src/rgw/rgw_crypt.h                          | 11 ++-
 src/rgw/rgw_multi.cc                         |  1 +
 src/rgw/rgw_op.cc                            | 40 +++++---
 src/rgw/rgw_rest_s3.cc                       | 25 ++++-
 src/rgw/rgw_sal.h                            |  3 +
 src/rgw/rgw_sal_filter.h                     |  2 +
 src/test/rgw/test_rgw_crypto.cc              | 41 ++++++++
 14 files changed, 193 insertions(+), 81 deletions(-)

diff --git a/src/rgw/driver/rados/rgw_putobj_processor.cc b/src/rgw/driver/rados/rgw_putobj_processor.cc
index ee194eb7533..3292e1c4e97 100644
--- a/src/rgw/driver/rados/rgw_putobj_processor.cc
+++ b/src/rgw/driver/rados/rgw_putobj_processor.cc
@@ -563,6 +563,13 @@ int MultipartObjectProcessor::complete(
   obj_op.meta.if_match = if_match;
   obj_op.meta.if_nomatch = if_nomatch;
 
+  // Move the transient GCM salt onto the part info and drop it from attrs (never on the head).
+  std::string part_salt;
+  if (auto i = attrs.find(RGW_ATTR_CRYPT_PART_SALT); i != attrs.end()) {
+    part_salt = i->second.to_str();
+    attrs.erase(i);
+  }
+
   r = obj_op.write_meta(actual_size, accounted_size, attrs, rctx,
                         writer.get_trace(), flags & rgw::sal::FLAG_LOG_OP);
   if (r < 0)
@@ -586,6 +593,7 @@ int MultipartObjectProcessor::complete(
   info.accounted_size = accounted_size;
   info.modified = real_clock::now();
   info.manifest = manifest;
+  info.crypt_salt = std::move(part_salt);
 
   bool compressed;
   r = rgw_compression_info_from_attrset(attrs, compressed, info.cs_info);
diff --git a/src/rgw/driver/rados/rgw_rados.cc b/src/rgw/driver/rados/rgw_rados.cc
index 4e78e18c2b7..5907e907534 100644
--- a/src/rgw/driver/rados/rgw_rados.cc
+++ b/src/rgw/driver/rados/rgw_rados.cc
@@ -7969,16 +7969,14 @@ int RGWRados::Object::Read::prepare(optional_yield y, const DoutPrefixProvider *
     }
 
     for (auto& iter : src_attrset) {
-      /**
-       * Skip object-level encryption attributes when reading individual parts.
-       * These attrs describe the complete multipart object, not this part:
-       *   - ORIGINAL_SIZE: would cause Content-Length mismatch
-       *   - PARTS: contains sizes of all parts, not applicable to single part
-       *   - PART_NUMS: maps part indices to S3 part numbers for the full object
+      /*
+       * Skip object-level crypt attrs (ORIGINAL_SIZE, PARTS) that describe the
+       * whole object and would break a single-part read. PART_NUMS passes
+       * through; it carries the per-part (num, salt) needed to derive this
+       * part's key.
        */
       if (iter.first == RGW_ATTR_CRYPT_ORIGINAL_SIZE ||
-          iter.first == RGW_ATTR_CRYPT_PARTS ||
-          iter.first == RGW_ATTR_CRYPT_PART_NUMS) {
+          iter.first == RGW_ATTR_CRYPT_PARTS) {
         ldpp_dout(dpp, 4) << "skip crypt attr for part read: " << iter.first << dendl;
         continue;
       }
diff --git a/src/rgw/driver/rados/rgw_sal_rados.cc b/src/rgw/driver/rados/rgw_sal_rados.cc
index 3825d25aced..a4a3987d6c2 100644
--- a/src/rgw/driver/rados/rgw_sal_rados.cc
+++ b/src/rgw/driver/rados/rgw_sal_rados.cc
@@ -4290,6 +4290,8 @@ int RadosMultipartUpload::complete(const DoutPrefixProvider *dpp,
     std::string crypt_mode = mode_iter->second.to_str();
     is_aead = is_aead_mode(crypt_mode);
   }
+  // AEAD: (S3 part number, GCM salt) per selected part, in manifest-segment order.
+  std::vector<std::pair<uint32_t, std::string>> part_keys;
 
   do {
     ret = list_parts(dpp, cct, max_parts, marker, &marker, &truncated, y);
@@ -4409,6 +4411,7 @@ int RadosMultipartUpload::complete(const DoutPrefixProvider *dpp,
 
       // Track plaintext size for AEAD encryption
       if (is_aead) {
+        part_keys.push_back({obj_part.num, obj_part.crypt_salt});
         if (part_compressed) {
           // For compressed parts, use the uncompressed size directly
           plaintext_ofs += obj_part.accounted_size;
@@ -4460,17 +4463,13 @@ int RadosMultipartUpload::complete(const DoutPrefixProvider *dpp,
     bl.append(std::to_string(plaintext_ofs));
     attrs[RGW_ATTR_CRYPT_ORIGINAL_SIZE] = std::move(bl);
 
-    // Store actual S3 part numbers for correct IV/key derivation during decrypt
-    std::vector<uint32_t> part_nums;
-    part_nums.reserve(part_etags.size());
-    for (const auto& part : part_etags) {
-      part_nums.push_back(static_cast<uint32_t>(part.first));
-    }
-    bufferlist part_nums_bl;
+    // Store (S3 part number, GCM salt) pairs (collected in selection order
+    // above) for correct key derivation during decrypt.
+    bufferlist part_keys_bl;
     using ceph::encode;
-    encode(part_nums, part_nums_bl);
-    attrs[RGW_ATTR_CRYPT_PART_NUMS] = std::move(part_nums_bl);
-    ldpp_dout(dpp, 20) << "Stored CRYPT_PART_NUMS with " << part_nums.size()
+    encode(part_keys, part_keys_bl);
+    attrs[RGW_ATTR_CRYPT_PART_NUMS] = std::move(part_keys_bl);
+    ldpp_dout(dpp, 20) << "Stored CRYPT_PART_NUMS with " << part_keys.size()
                        << " parts" << dendl;
   }
 
diff --git a/src/rgw/driver/rados/rgw_sal_rados.h b/src/rgw/driver/rados/rgw_sal_rados.h
index 22b0d1d7e5a..ff0eae39894 100644
--- a/src/rgw/driver/rados/rgw_sal_rados.h
+++ b/src/rgw/driver/rados/rgw_sal_rados.h
@@ -866,6 +866,7 @@ public:
   virtual const ACLOwner& get_owner() const override { return owner; }
   virtual ceph::real_time& get_mtime() override { return mtime; }
   virtual std::unique_ptr<rgw::sal::Object> get_meta_obj() override;
+  virtual bool supports_crypt_part_salts() const override { return true; }
   virtual int init(const DoutPrefixProvider* dpp, optional_yield y, ACLOwner& owner, rgw_placement_rule& dest_placement, rgw::sal::Attrs& attrs) override;
   virtual int list_parts(const DoutPrefixProvider* dpp, CephContext* cct,
 			 int num_parts, int marker,
diff --git a/src/rgw/rgw_basic_types.h b/src/rgw/rgw_basic_types.h
index 9a50ff3aba0..99ea71db34d 100644
--- a/src/rgw/rgw_basic_types.h
+++ b/src/rgw/rgw_basic_types.h
@@ -278,6 +278,7 @@ struct RGWUploadPartInfo {
   RGWObjManifest manifest;
   RGWCompressionInfo cs_info;
   std::optional<rgw::cksum::Cksum> cksum;
+  std::string crypt_salt;  // per-UploadPart GCM salt (non-secret HMAC input)
 
   // Previous part obj prefixes. Recorded here for later cleanup.
   std::set<std::string> past_prefixes; 
@@ -285,7 +286,7 @@ struct RGWUploadPartInfo {
   RGWUploadPartInfo() : num(0), size(0) {}
 
   void encode(bufferlist& bl) const {
-    ENCODE_START(6, 2, bl);
+    ENCODE_START(7, 2, bl);
     encode(num, bl);
     encode(size, bl);
     encode(etag, bl);
@@ -295,10 +296,11 @@ struct RGWUploadPartInfo {
     encode(accounted_size, bl);
     encode(past_prefixes, bl);
     encode(cksum, bl);
+    encode(crypt_salt, bl);
     ENCODE_FINISH(bl);
   }
   void decode(bufferlist::const_iterator& bl) {
-    DECODE_START_LEGACY_COMPAT_LEN(6, 2, 2, bl);
+    DECODE_START_LEGACY_COMPAT_LEN(7, 2, 2, bl);
     decode(num, bl);
     decode(size, bl);
     decode(etag, bl);
@@ -317,6 +319,9 @@ struct RGWUploadPartInfo {
     if (struct_v >= 6) {
       decode(cksum, bl);
     }
+    if (struct_v >= 7) {
+      decode(crypt_salt, bl);
+    }
     DECODE_FINISH(bl);
   }
   void dump(Formatter *f) const;
diff --git a/src/rgw/rgw_common.h b/src/rgw/rgw_common.h
index 14843124c66..bd7851b1786 100644
--- a/src/rgw/rgw_common.h
+++ b/src/rgw/rgw_common.h
@@ -192,6 +192,7 @@ using ceph::crypto::MD5;
 #define RGW_ATTR_CRYPT_DATAKEY  RGW_ATTR_CRYPT_PREFIX "datakey"
 #define RGW_ATTR_CRYPT_PARTS    RGW_ATTR_CRYPT_PREFIX "part-lengths"
 #define RGW_ATTR_CRYPT_PART_NUMS RGW_ATTR_CRYPT_PREFIX "part-numbers"
+#define RGW_ATTR_CRYPT_PART_SALT  RGW_ATTR_CRYPT_PREFIX "part-salt"
 #define RGW_ATTR_CRYPT_SALT     RGW_ATTR_CRYPT_PREFIX "salt"
 #define RGW_ATTR_CRYPT_ORIGINAL_SIZE RGW_ATTR_CRYPT_PREFIX "original-size"
 #define RGW_ATTR_CRYPT_PREFETCH_ALIGN RGW_ATTR_CRYPT_PREFIX "prefetch-align"
diff --git a/src/rgw/rgw_crypt.cc b/src/rgw/rgw_crypt.cc
index e572779af3a..37eb0f02a6b 100644
--- a/src/rgw/rgw_crypt.cc
+++ b/src/rgw/rgw_crypt.cc
@@ -674,6 +674,7 @@ private:
   uint8_t salt[AES_256_GCM_SALT_SIZE];
   bool salt_initialized = false;
   uint32_t part_number_ = 0;  // For multipart: ensures unique IVs across parts
+  bool part_salt_applied_ = false;
   std::once_flag gcm_accel_init_once;
   CryptoAccelRef gcm_accel;
 
@@ -731,27 +732,22 @@ public:
     return salt_initialized;
   }
 
-  /**
-   * Set part number for multipart IV derivation and key derivation (SSE-C).
-   * Must be called before encrypt/decrypt for multipart uploads.
-   *
-   * For SSE-C mode (has_base_key=true): also re-derives the part-specific key
-   * from base_key, enabling correct decryption when switching between parts
-   * during multipart GET operations.
+  /*
+   * For a multipart part, re-derive the part key from base_key with the salt.
+   * has_base_key holds for all GCM modes.
    */
-  void set_part_number(uint32_t part_number) override {
+  void set_part_number(uint32_t part_number,
+                       std::string_view part_salt = {}) override {
     this->part_number_ = part_number;
+    this->part_salt_applied_ = !part_salt.empty();
 
-    // For SSE-C mode, also derive the correct part key
     if (has_base_key && part_number > 0) {
-      // Restore base key, then derive part key
       memcpy(this->key, this->base_key, AES_256_KEYSIZE);
-      derive_part_key(part_number);
+      derive_part_key(part_number, part_salt);
     } else if (has_base_key && part_number == 0) {
       // Part 0 means single-part or init - use base key directly
       memcpy(this->key, this->base_key, AES_256_KEYSIZE);
     }
-    // For non-SSE-C modes (has_base_key=false), only IV derivation uses part_number
   }
 
   /**
@@ -845,16 +841,12 @@ public:
     return true;
   }
 
-  /**
-   * Derive part-specific key for multipart uploads.
-   * This prevents part reordering/swapping attacks.
-   *
-   * Formula: PartKey = HMAC-SHA256(ObjectKey, part_number)
-   *
-   * @param part_number Part number (1-based, as per S3 multipart API)
-   * @return true on success
+  /*
+   * PartKey = HMAC-SHA256(ObjectKey, BE32(part_number) || part_salt).
+   * Binds the key to the part number, and with a non-empty salt to the upload
+   * so re-uploading a part can't reuse (key, IV).
    */
-  bool derive_part_key(uint32_t part_number) {
+  bool derive_part_key(uint32_t part_number, std::string_view part_salt = {}) {
     // Encode part number as big-endian 4 bytes
     uint8_t part_bytes[4];
     part_bytes[0] = (part_number >> 24) & 0xFF;
@@ -867,6 +859,9 @@ public:
     try {
       ceph::crypto::HMACSHA256 hmac(this->key, AES_256_KEYSIZE);
       hmac.Update(part_bytes, 4);
+      if (!part_salt.empty()) {
+        hmac.Update(reinterpret_cast<const uint8_t*>(part_salt.data()), part_salt.size());
+      }
       hmac.Final(derived);
     } catch (const ceph::crypto::DigestException& e) {
       ldpp_dout(dpp, 0) << "ERROR: derive_part_key: HMAC failed: " << e.what() << dendl;
@@ -1067,6 +1062,18 @@ public:
   {
     output.clear();
 
+    // write-path nonce-uniqueness guards: fresh per-part salt + chunk-aligned offset
+    if (part_number_ > 0 && !part_salt_applied_) {
+      ldpp_dout(dpp, 0) << "GCM: multipart part " << part_number_
+                        << " missing per-part salt; refusing to encrypt" << dendl;
+      return false;
+    }
+    if (stream_offset % static_cast<off_t>(CHUNK_SIZE) != 0) {
+      ldpp_dout(dpp, 0) << "GCM: stream_offset " << stream_offset
+                        << " not chunk-aligned (" << CHUNK_SIZE << ")" << dendl;
+      return false;
+    }
+
     // Calculate output size: each CHUNK_SIZE plaintext becomes CHUNK_SIZE + GCM_TAG_SIZE
     size_t num_full_chunks = size / CHUNK_SIZE;
     size_t remainder = size % CHUNK_SIZE;
@@ -1397,7 +1404,7 @@ RGWGetObj_BlockDecrypt::RGWGetObj_BlockDecrypt(const DoutPrefixProvider *dpp,
                                                RGWGetObj_Filter* next,
                                                std::unique_ptr<BlockCrypt> crypt,
                                                std::vector<size_t> parts_len,
-                                               std::vector<uint32_t> part_nums,
+                                               std::vector<std::pair<uint32_t, std::string>> part_keys,
                                                off_t encrypted_total_size,
                                                bool has_compression,
                                                optional_yield y)
@@ -1415,38 +1422,38 @@ RGWGetObj_BlockDecrypt::RGWGetObj_BlockDecrypt(const DoutPrefixProvider *dpp,
     cache(),
     y(y),
     parts_len(std::move(parts_len)),
-    part_nums(std::move(part_nums)),
+    part_keys(std::move(part_keys)),
     current_part_num(0)
 {
   block_size = this->crypt->get_block_size();
   encrypted_block_size = this->crypt->get_encrypted_block_size();
 
   /**
-   * Sanity check: when BOTH part_nums and parts_len are populated, they must
+   * Sanity check: when BOTH part_keys and parts_len are populated, they must
    * match in size. A mismatch indicates data corruption or a bug.
    *
    * When parts_len is empty (e.g., GET ?partNumber=N where CRYPT_PARTS is
    * intentionally skipped and the part object has no manifest), we can only
-   * trust a single fallback part number.
+   * trust a single fallback part.
    */
-  if (!this->part_nums.empty() && !this->parts_len.empty() &&
-      this->part_nums.size() != this->parts_len.size()) {
-    ldpp_dout(dpp, 0) << "ERROR: part_nums.size()=" << this->part_nums.size()
+  if (!this->part_keys.empty() && !this->parts_len.empty() &&
+      this->part_keys.size() != this->parts_len.size()) {
+    ldpp_dout(dpp, 0) << "ERROR: part_keys.size()=" << this->part_keys.size()
                       << " != parts_len.size()=" << this->parts_len.size()
                       << " - possible data corruption" << dendl;
-    this->part_nums.clear();
+    this->part_keys.clear();
   }
-  if (this->parts_len.empty() && this->part_nums.size() > 1) {
-    ldpp_dout(dpp, 0) << "ERROR: part_nums.size()=" << this->part_nums.size()
+  if (this->parts_len.empty() && this->part_keys.size() > 1) {
+    ldpp_dout(dpp, 0) << "ERROR: part_keys.size()=" << this->part_keys.size()
                       << " but parts_len is empty - cannot map part boundaries"
                       << dendl;
-    this->part_nums.clear();
+    this->part_keys.clear();
   }
 
   // Initialize with first part's key if multipart
-  if (!this->part_nums.empty()) {
-    current_part_num = this->part_nums[0];
-    this->crypt->set_part_number(current_part_num);
+  if (!this->part_keys.empty()) {
+    current_part_num = this->part_keys[0].first;
+    this->crypt->set_part_number(current_part_num, this->part_keys[0].second);
   }
 }
 
@@ -1551,15 +1558,17 @@ int RGWGetObj_BlockDecrypt::process(bufferlist& in, size_t part_ofs, size_t size
 int RGWGetObj_BlockDecrypt::process_part_boundaries(size_t& plain_part_ofs_out) {
   size_t enc_part_ofs = enc_ofs;
   size_t plain_part_ofs = ofs;
-  const bool is_multipart = !part_nums.empty();
+  const bool is_multipart = !part_keys.empty();
   uint32_t part_idx = 0;
   int res = 0;
 
   for (size_t part : parts_len) {
-    // Get actual S3 part number from attribute (not calculated!)
+    // Get actual S3 part number + salt from the attribute (not calculated!)
     uint32_t this_part_num = 0;
-    if (is_multipart && part_idx < part_nums.size()) {
-      this_part_num = part_nums[part_idx];
+    std::string_view this_salt;
+    if (is_multipart && part_idx < part_keys.size()) {
+      this_part_num = part_keys[part_idx].first;
+      this_salt = part_keys[part_idx].second;
     }
 
     if (enc_part_ofs >= part) {
@@ -1571,7 +1580,7 @@ int RGWGetObj_BlockDecrypt::process_part_boundaries(size_t& plain_part_ofs_out)
       // Ensure cipher has correct part number
       if (is_multipart && current_part_num != this_part_num) {
         current_part_num = this_part_num;
-        crypt->set_part_number(current_part_num);
+        crypt->set_part_number(current_part_num, this_salt);
       }
 
       // Data crosses part boundary - process up to boundary
@@ -1584,12 +1593,14 @@ int RGWGetObj_BlockDecrypt::process_part_boundaries(size_t& plain_part_ofs_out)
       // Move to next part
       part_idx++;
       uint32_t next_part_num = 0;
-      if (is_multipart && part_idx < part_nums.size()) {
-        next_part_num = part_nums[part_idx];
+      std::string_view next_salt;
+      if (is_multipart && part_idx < part_keys.size()) {
+        next_part_num = part_keys[part_idx].first;
+        next_salt = part_keys[part_idx].second;
       }
       if (is_multipart && part_idx < parts_len.size() && current_part_num != next_part_num) {
         current_part_num = next_part_num;
-        crypt->set_part_number(current_part_num);
+        crypt->set_part_number(current_part_num, next_salt);
       }
 
       enc_part_ofs = 0;
@@ -1598,7 +1609,7 @@ int RGWGetObj_BlockDecrypt::process_part_boundaries(size_t& plain_part_ofs_out)
       // Ensure cipher has correct part number
       if (is_multipart && current_part_num != this_part_num) {
         current_part_num = this_part_num;
-        crypt->set_part_number(current_part_num);
+        crypt->set_part_number(current_part_num, this_salt);
       }
       break;
     }
diff --git a/src/rgw/rgw_crypt.h b/src/rgw/rgw_crypt.h
index 386ad462ea0..7d54b0abf00 100644
--- a/src/rgw/rgw_crypt.h
+++ b/src/rgw/rgw_crypt.h
@@ -101,15 +101,18 @@ public:
 
   /**
    * Set the part number for multipart object decryption.
-   * AEAD modes use this for per-part IV derivation.
+   * AEAD modes use this for per-part IV derivation, and for GCM also fold the
+   * optional per-UploadPart salt into part-key derivation.
    * Default is no-op; CBC derives IVs from block offsets instead.
    */
-  virtual void set_part_number(uint32_t part_number) {}
+  virtual void set_part_number(uint32_t part_number,
+                               std::string_view part_salt = {}) {}
 };
 
 static const size_t AES_256_KEYSIZE = 256 / 8;
 static const size_t AES_256_GCM_IV_SIZE = 96 / 8;  // 12 bytes, GCM standard
 static const size_t AES_256_GCM_SALT_SIZE = 32;  // 256-bit random salt for HMAC-based key derivation
+static constexpr size_t AES_256_GCM_PART_SALT_SIZE = 16;  // per-UploadPart entropy folded into part-key derivation
 
 /**
  * AEAD chunk size constants used for size calculations across RGW.
@@ -266,7 +269,7 @@ class RGWGetObj_BlockDecrypt : public RGWGetObj_Filter {
   size_t encrypted_block_size; /**< snapshot of \ref BlockCrypt.get_encrypted_block_size() (includes auth tag for GCM) */
   optional_yield y;
   std::vector<size_t> parts_len; /**< size of parts of multipart object, parsed from manifest */
-  std::vector<uint32_t> part_nums; /**< actual S3 part numbers for multipart (e.g., [1,3,5]) */
+  std::vector<std::pair<uint32_t, std::string>> part_keys; /**< per part: (S3 part number, GCM salt) */
   uint32_t current_part_num = 0; /**< current part number (1-based, 0 means single-part object) */
 
   int process(bufferlist& cipher, size_t part_ofs, size_t size);
@@ -289,7 +292,7 @@ public:
                          RGWGetObj_Filter* next,
                          std::unique_ptr<BlockCrypt> crypt,
                          std::vector<size_t> parts_len,
-                         std::vector<uint32_t> part_nums,
+                         std::vector<std::pair<uint32_t, std::string>> part_keys,
                          off_t encrypted_total_size,
                          bool has_compression,
                          optional_yield y);
diff --git a/src/rgw/rgw_multi.cc b/src/rgw/rgw_multi.cc
index 9abda447ea4..d7155dd6259 100644
--- a/src/rgw/rgw_multi.cc
+++ b/src/rgw/rgw_multi.cc
@@ -100,5 +100,6 @@ void RGWUploadPartInfo::dump(Formatter *f) const
   utime_t ut(modified);
   encode_json("modified", ut, f);
   encode_json("past_prefixes", past_prefixes, f);
+  encode_json("crypt_salt", crypt_salt, f);
 }
 
diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 4a00c1112fe..bfcb0ea6df1 100644
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -10370,27 +10370,43 @@ int get_decrypt_filter(
   // correctly decrypt across part boundaries
   std::vector<size_t> parts_len;
 
-  // Read actual S3 part numbers from attribute (set by CompleteMultipartUpload)
-  std::vector<uint32_t> part_nums;
+  // Read (S3 part number, GCM salt) pairs from the attribute (set by Complete).
+  std::vector<std::pair<uint32_t, std::string>> part_keys;
   if (auto it = attrs.find(RGW_ATTR_CRYPT_PART_NUMS); it != attrs.end()) {
     try {
       auto p = it->second.cbegin();
       using ceph::decode;
-      decode(part_nums, p);
+      decode(part_keys, p);
     } catch (const buffer::error&) {
       ldpp_dout(s, 1) << "failed to decode RGW_ATTR_CRYPT_PART_NUMS" << dendl;
-      // Continue with empty part_nums - will fail for multipart, ok for single-part
+      // Continue with empty part_keys - will fail for multipart, ok for single-part
     }
   }
 
-  /**
-   * Fallback for GET ?partNumber=N (single part read).
-   * When reading an individual part, the CRYPT_PART_NUMS attribute is skipped
-   * (see rgw_rados.cc skip list), so we use the requested part_num to ensure
-   * correct key derivation and IV generation.
+  /*
+   * GET ?partNumber=N receives the full pair vector; reduce it to the requested
+   * part so the salt/key derivation is correct and the vector matches the
+   * single-part manifest.
    */
-  if (part_nums.empty() && part_num > 0) {
-    part_nums.push_back(part_num);
+  if (part_num > 0 && !part_keys.empty()) {
+    size_t idx = part_keys.size();
+    for (size_t k = 0; k < part_keys.size(); k++) {
+      if (part_keys[k].first == static_cast<uint32_t>(part_num)) { idx = k; break; }
+    }
+    if (idx == part_keys.size()) {
+      return -ERR_INVALID_PART;
+    }
+    auto sel = std::move(part_keys[idx]);
+    part_keys.clear();
+    part_keys.push_back(std::move(sel));
+  }
+
+  /*
+   * No CRYPT_PART_NUMS attr but a part was requested: derive from part_num with
+   * an empty salt.
+   */
+  if (part_keys.empty() && part_num > 0) {
+    part_keys.push_back({static_cast<uint32_t>(part_num), {}});
   }
 
   // for replicated objects, the original part lengths are preserved in an xattr
@@ -10442,7 +10458,7 @@ int get_decrypt_filter(
   const bool has_compression = attrs.count(RGW_ATTR_COMPRESSION);
   *filter = std::make_unique<RGWGetObj_BlockDecrypt>(
       s, s->cct, cb, std::move(block_crypt),
-      std::move(parts_len), std::move(part_nums), encrypted_total_size,
+      std::move(parts_len), std::move(part_keys), encrypted_total_size,
       has_compression, s->yield);
   return 0;
 }
diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index e0d1fc47e79..7dc6320c447 100644
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -2958,6 +2958,10 @@ int RGWPutObj_ObjStore_S3::get_params(optional_yield y)
       ldpp_dout(s, 10) << "bad part number: " << multipart_part_str << ": " << err << dendl;
       return -EINVAL;
     }
+    if (multipart_part_num < 1 || multipart_part_num > 10000) {
+      ldpp_dout(s, 10) << "part number out of range: " << multipart_part_num << dendl;
+      return -EINVAL;
+    }
   } else if (!multipart_upload_id.empty()) {
     ldpp_dout(s, 10) << "part number with no multipart upload id" << dendl;
     return -EINVAL;
@@ -3117,8 +3121,27 @@ int RGWPutObj_ObjStore_S3::get_encrypt_filter(
       res = rgw_s3_prepare_decrypt(s, s->yield, obj->get_attrs(),
                                    &block_crypt, &crypt_http_responses, copy_source,
                                    multipart_part_num);
-      if (res == 0 && block_crypt != nullptr)
+      if (res == 0 && block_crypt != nullptr) {
+        /*
+         * AEAD UploadPart: fold fresh per-UploadPart entropy into the part key so
+         * re-uploading the same part can't reuse (key, IV). Refuse the upload if
+         * the backend can't persist per-part salts rather than silently falling
+         * back to a deterministic part key.
+         */
+        if (is_aead_mode(get_str_attribute(obj->get_attrs(), RGW_ATTR_CRYPT_MODE))) {
+          if (!upload->supports_crypt_part_salts()) {
+            ldpp_dout(this, 0) << "ERROR: AEAD multipart upload requires a supported backend" << dendl;
+            return -ERR_NOT_IMPLEMENTED;
+          }
+          std::string part_salt(AES_256_GCM_PART_SALT_SIZE, '\0');
+          s->cct->random()->get_bytes(part_salt.data(), part_salt.size());
+          block_crypt->set_part_number(multipart_part_num, part_salt);
+          // string_view selects the raw-bytes set_attr overload, not the local
+          // length-prefixing one; the writer reads it back via to_str().
+          set_attr(this->attrs, RGW_ATTR_CRYPT_PART_SALT, std::string_view(part_salt));
+        }
         filter->reset(new RGWPutObj_BlockEncrypt(s, s->cct, cb, std::move(block_crypt), s->yield));
+      }
     }
     /* it is ok, to not have encryption at all */
   }
diff --git a/src/rgw/rgw_sal.h b/src/rgw/rgw_sal.h
index 92e084ee34a..74d4b100a30 100644
--- a/src/rgw/rgw_sal.h
+++ b/src/rgw/rgw_sal.h
@@ -1543,6 +1543,9 @@ public:
   /** Get the Object that represents this upload */
   virtual std::unique_ptr<rgw::sal::Object> get_meta_obj() = 0;
 
+  /** True if this store persists per-part GCM salts; gates AEAD UploadPart salt emission. */
+  virtual bool supports_crypt_part_salts() const { return false; }
+
   /** Initialize this upload */
   virtual int init(const DoutPrefixProvider* dpp, optional_yield y, ACLOwner& owner, rgw_placement_rule& dest_placement, rgw::sal::Attrs& attrs) = 0;
   /** List all the parts of this upload, filling the parts cache */
diff --git a/src/rgw/rgw_sal_filter.h b/src/rgw/rgw_sal_filter.h
index c50b4cdeead..ecb55a98ee5 100644
--- a/src/rgw/rgw_sal_filter.h
+++ b/src/rgw/rgw_sal_filter.h
@@ -966,6 +966,8 @@ public:
 
   virtual std::unique_ptr<rgw::sal::Object> get_meta_obj() override;
 
+  virtual bool supports_crypt_part_salts() const override { return next->supports_crypt_part_salts(); }
+
   virtual int init(const DoutPrefixProvider* dpp, optional_yield y, ACLOwner& owner, rgw_placement_rule& dest_placement, rgw::sal::Attrs& attrs) override;
   virtual int list_parts(const DoutPrefixProvider* dpp, CephContext* cct,
 			 int num_parts, int marker,
diff --git a/src/test/rgw/test_rgw_crypto.cc b/src/test/rgw/test_rgw_crypto.cc
index f7cecb00b30..1b09963cc07 100644
--- a/src/test/rgw/test_rgw_crypto.cc
+++ b/src/test/rgw/test_rgw_crypto.cc
@@ -1202,16 +1202,19 @@ TEST(TestRGWCrypto, verify_AES_256_GCM_key_derivation)
 
   // Test 3: Different part numbers produce different derived keys
   {
+    const std::string part_salt(AES_256_GCM_PART_SALT_SIZE, 'p');
     auto aes1(AES_256_GCM_create(&no_dpp, g_ceph_context, &user_key[0], 32));
     std::string salt = AES_256_GCM_get_salt(aes1.get());
     ASSERT_TRUE(AES_256_GCM_derive_object_key(aes1.get(), user_key, 32,
                                                "bucket", "object", 1));
+    aes1->set_part_number(1, part_salt);
 
     auto aes2(AES_256_GCM_create(&no_dpp, g_ceph_context, &user_key[0], 32,
                                   reinterpret_cast<const uint8_t*>(salt.c_str()),
                                   salt.size()));
     ASSERT_TRUE(AES_256_GCM_derive_object_key(aes2.get(), user_key, 32,
                                                "bucket", "object", 2));
+    aes2->set_part_number(2, part_salt);
 
     bufferlist input;
     input.append(plaintext);
@@ -1245,6 +1248,44 @@ TEST(TestRGWCrypto, verify_AES_256_GCM_key_derivation)
   }
 }
 
+TEST(TestRGWCrypto, verify_AES_256_GCM_part_salt_key_isolation)
+{
+  NoDoutPrefix no_dpp(g_ceph_context, ceph_subsys_rgw);
+  uint8_t user_key[32];
+  for (size_t i = 0; i < sizeof(user_key); i++) user_key[i] = i;
+
+  const std::string osalt(AES_256_GCM_SALT_SIZE, 'o');
+  const std::string a(AES_256_GCM_PART_SALT_SIZE, 'a');
+  const std::string b(AES_256_GCM_PART_SALT_SIZE, 'b');
+  const uint8_t* os = reinterpret_cast<const uint8_t*>(osalt.data());
+  bufferlist in;
+  in.append("same part number, different salt");
+
+  auto mk = [&](const std::string& s) {
+    auto e = AES_256_GCM_create(&no_dpp, g_ceph_context, &user_key[0], 32, os, osalt.size());
+    EXPECT_NE(e.get(), nullptr);
+    EXPECT_TRUE(AES_256_GCM_derive_object_key(e.get(), user_key, 32, "bucket", "object", 1));
+    e->set_part_number(1, s);
+    return e;
+  };
+
+  // Same object key, same part number, different salt -> different ciphertext.
+  // This is false on the pre-fix binary (same part number -> same key+IV).
+  bufferlist ca, cb;
+  ASSERT_TRUE(mk(a)->encrypt(in, 0, in.length(), ca, 0, null_yield));
+  ASSERT_TRUE(mk(b)->encrypt(in, 0, in.length(), cb, 0, null_yield));
+  ASSERT_NE(std::string_view(ca.c_str(), ca.length()),
+            std::string_view(cb.c_str(), cb.length()));
+
+  // Correct salt round-trips; wrong salt fails the GCM tag.
+  bufferlist pa;
+  ASSERT_TRUE(mk(a)->decrypt(ca, 0, ca.length(), pa, 0, null_yield));
+  ASSERT_EQ(std::string_view(in.c_str(), in.length()),
+            std::string_view(pa.c_str(), pa.length()));
+  bufferlist bad;
+  ASSERT_FALSE(mk(b)->decrypt(ca, 0, ca.length(), bad, 0, null_yield));
+}
+
 TEST(TestRGWCrypto, verify_AES_256_GCM_chunk_reorder_detection)
 {
   // Verify that swapping chunk positions is detected via AAD

From 3a81a126089e201bcc0ddfcd800705d43f7d3b45 Mon Sep 17 00:00:00 2001
From: "Matthew N. Heler" <matthew.heler@hotmail.com>
Date: Mon, 8 Jun 2026 21:13:50 -0500
Subject: [PATCH 368/596] rgw: restore constant-time GCM tag comparison in
 ISA-L path

a8ed43bfc05 replaced ct_memeq with memcmp in the ISA-L GCM accelerator,
making tag verification and the key-cache compare non-constant-time.
Restore ct_memeq for both; the OpenSSL and EVP paths already compare in
constant time.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>
---
 src/crypto/isa-l/isal_crypto_accel.cc | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/crypto/isa-l/isal_crypto_accel.cc b/src/crypto/isa-l/isal_crypto_accel.cc
index 77049964812..3e815be16e0 100644
--- a/src/crypto/isa-l/isal_crypto_accel.cc
+++ b/src/crypto/isa-l/isal_crypto_accel.cc
@@ -48,6 +48,19 @@ bool ISALCryptoAccel::cbc_decrypt(unsigned char* out, const unsigned char* in, s
   return true;
 }
 
+/*
+ * Constant-time byte comparison to prevent timing attacks on tag verification.
+ * Always compares all bytes regardless of differences found.
+ */
+static inline bool ct_memeq(const unsigned char* a, const unsigned char* b, size_t len)
+{
+  volatile unsigned char diff = 0;
+  for (size_t i = 0; i < len; ++i) {
+    diff |= static_cast<unsigned char>(a[i] ^ b[i]);
+  }
+  return diff == 0;
+}
+
 /*
  * Thread-local GCM key cache to avoid re-running aes_gcm_pre_256() for
  * repeated keys. Key material is securely wiped on thread exit.
@@ -69,7 +82,7 @@ static inline const gcm_key_data* get_cached_gcm_key(const unsigned char* key)
   if (!cache)
     cache = std::make_unique<gcm_key_cache_t>();
 
-  if (memcmp(cache->last_key, key, CryptoAccel::AES_256_KEYSIZE) != 0) {
+  if (!ct_memeq(cache->last_key, key, CryptoAccel::AES_256_KEYSIZE)) {
     aes_gcm_pre_256(key, &cache->cached_gkey);
     memcpy(cache->last_key, key, CryptoAccel::AES_256_KEYSIZE);
   }
@@ -127,7 +140,7 @@ bool ISALCryptoAccel::gcm_decrypt(unsigned char* out, const unsigned char* in, s
                   static_cast<uint64_t>(aad_len),
                   computed_tag, AES_GCM_TAGSIZE);
 
-  if (memcmp(computed_tag, tag, AES_GCM_TAGSIZE) != 0) {
+  if (!ct_memeq(computed_tag, &tag[0], AES_GCM_TAGSIZE)) {
     memset(out, 0, size);  // Clear output on auth failure
     return false;
   }

From d0bf1d4987e74f8ee07405dcde2ceb1042ef47d5 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 20:14:10 +0800
Subject: [PATCH 369/596] Revert "script/run-make: enable ASan"

in 8ac962c6, we enabled ASan in script/run-make, which is part of
our CI workflow to build the tree. The goal was to enable us to identify
memory related issues early, but this introduced two kinds of problems:

- it's observed that some tests take around 4x time to complete in
  comparison to the test time without ASan enabled
- api and dashboard e2e tests are failing because the ASan supppression
  rules are not populated to them

This reverts commit 8ac962c698df959da1866d41b04d69c806bb72c0.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/script/run-make.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/script/run-make.sh b/src/script/run-make.sh
index e990a827de5..30ca35ce274 100755
--- a/src/script/run-make.sh
+++ b/src/script/run-make.sh
@@ -143,7 +143,6 @@ EOM
     local cxx_compiler="${discovered_cxx_compiler}"
     local c_compiler="${discovered_c_compiler}"
     local cmake_opts
-    cmake_opts+=" -DWITH_ASAN=ON"
     cmake_opts+=" -DCMAKE_CXX_COMPILER=$cxx_compiler -DCMAKE_C_COMPILER=$c_compiler"
     cmake_opts+=" -DENABLE_GIT_VERSION=OFF"
     cmake_opts+=" -DWITH_GTEST_PARALLEL=ON"

From 9f59332b35259773783bbd38e4f92fa1520d6cbf Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 18 May 2026 02:31:58 +0530
Subject: [PATCH 370/596] tools/cephfs_mirror: Adds capability to persist
 metrics

Adds the capability to persist mirroring metrics.
The metrics are persisted in the omap of the cephfs-mirror
object. Metrics are persisted asynchronously.

Each mirrored directory path stores the corresponding
metrics as the value of a unique omap key representing
the mirrored directory. The omap key is as below.

sync_stat/<fsname>/<peer_uuid>/<mirrored_dir_path>

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/FSMirror.cc     |   3 +-
 src/tools/cephfs_mirror/PeerReplayer.cc | 212 +++++++++++++++++++++++-
 src/tools/cephfs_mirror/PeerReplayer.h  |  11 +-
 src/tools/cephfs_mirror/aio_utils.h     |  10 ++
 4 files changed, 229 insertions(+), 7 deletions(-)

diff --git a/src/tools/cephfs_mirror/FSMirror.cc b/src/tools/cephfs_mirror/FSMirror.cc
index 4158361e7b9..ac19f158694 100644
--- a/src/tools/cephfs_mirror/FSMirror.cc
+++ b/src/tools/cephfs_mirror/FSMirror.cc
@@ -421,7 +421,8 @@ void FSMirror::add_peer(const Peer &peer) {
   }
 
   auto replayer = std::make_unique<PeerReplayer>(
-    m_cct, this, m_cluster, m_filesystem, peer, m_directories, m_mount, m_service_daemon);
+    m_cct, this, m_cluster, m_filesystem, peer, m_directories,
+    std::make_shared<librados::IoCtx>(m_ioctx), m_mount, m_service_daemon);
   int r = init_replayer(replayer.get());
   if (r < 0) {
     m_service_daemon->add_or_update_peer_attribute(m_filesystem.fscid, peer,
diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 6b370df3c5c..6645374969c 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -10,6 +10,7 @@
 #include <boost/scope_exit.hpp>
 
 #include "common/admin_socket.h"
+#include "common/Clock.h"
 #include "common/ceph_context.h"
 #include "common/debug.h"
 #include "common/errno.h"
@@ -20,6 +21,7 @@
 #include "FSMirror.h"
 #include "PeerReplayer.h"
 #include "Utils.h"
+#include "aio_utils.h"
 
 #include "json_spirit/json_spirit.h"
 
@@ -117,6 +119,23 @@ std::string peer_config_key(const std::string &fs_name, const std::string &uuid)
   return PEER_CONFIG_KEY_PREFIX + "/" + fs_name + "/" + uuid;
 }
 
+double monotime_to_double(monotime t) {
+  return sec_duration(t.time_since_epoch()).count();
+}
+
+struct C_PersistSyncStatAio : Context {
+  std::string dir_root;
+
+  explicit C_PersistSyncStatAio(std::string dir_root_)
+    : dir_root(std::move(dir_root_)) {}
+
+  void finish(int r) override {
+    if (r < 0) {
+      generic_derr << "cephfs::mirror: aio persist sync stats failed for dir_root="
+                     << dir_root << ": " << cpp_strerror(r) << dendl;
+    }
+  }
+};
 class PeerAdminSocketCommand {
 public:
   virtual ~PeerAdminSocketCommand() {
@@ -201,10 +220,11 @@ private:
 PeerReplayer::PeerReplayer(CephContext *cct, FSMirror *fs_mirror,
                            RadosRef local_cluster, const Filesystem &filesystem,
                            const Peer &peer, const std::set<std::string, std::less<>> &directories,
-                           MountRef mount, ServiceDaemon *service_daemon)
+                           IoCtxRef local_ioctx, MountRef mount, ServiceDaemon *service_daemon)
   : m_cct(cct),
     m_fs_mirror(fs_mirror),
     m_local_cluster(local_cluster),
+    m_local_ioctx(local_ioctx),
     m_filesystem(filesystem),
     m_peer(peer),
     m_directories(directories.begin(), directories.end()),
@@ -273,10 +293,6 @@ uint64_t percent_basis_points(uint64_t num, uint64_t den) {
   return static_cast<uint64_t>((static_cast<double>(num) * 10000.0) / den);
 }
 
-double monotime_to_double(monotime t) {
-  return sec_duration(t.time_since_epoch()).count();
-}
-
 void PeerReplayer::create_directory_perf_counters(const std::string &dir_root) {
   ceph_assert(m_directory_perf_counters.find(dir_root) ==
               m_directory_perf_counters.end());
@@ -727,6 +743,192 @@ void PeerReplayer::remove_directory(string_view dir_root) {
   m_cond.notify_all();
 }
 
+std::string PeerReplayer::peer_sync_stat_omap_key(std::string_view dir_root) const {
+  // dir_root is usually absolute (e.g. "/d0"); avoid ".../uuid//d0" from an extra slash.
+  std::string d(dir_root);
+  while (!d.empty() && d.front() == '/') {
+    d.erase(0, 1);
+  }
+  return PEER_SYNC_STAT_KEY_PREFIX + "/" + m_filesystem.fs_name + "/" + m_peer.uuid
+         + "/" + d;
+}
+
+void PeerReplayer::add_live_sync_metrics_to_persist(json_spirit::mObject &obj,
+                                                    SnapSyncStat &sync_stat) {
+  if (sync_stat.current_syncing_snap) {
+    json_spirit::mObject snap;
+    snap["id"] =
+      json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.current_syncing_snap->first));
+    snap["name"] = json_spirit::mValue(sync_stat.current_syncing_snap->second);
+    snap["sync-mode"] = json_spirit::mValue(sync_stat.snapdiff ? "delta" : "full");
+
+    double read_bps = sync_stat.read_time_sec > 0 ?
+        sync_stat.bytes_read / sync_stat.read_time_sec : 0;
+    double write_bps = sync_stat.write_time_sec > 0 ?
+        sync_stat.bytes_written / sync_stat.write_time_sec : 0;
+    snap["avg_read_throughput_bytes"] =
+      json_spirit::mValue(format_bytes(read_bps) + "/s");
+    snap["avg_write_throughput_bytes"] =
+      json_spirit::mValue(format_bytes(write_bps) + "/s");
+
+    json_spirit::mObject crawl;
+    if (sync_stat.crawl_finished) {
+      crawl["state"] = json_spirit::mValue("completed");
+      crawl["duration"] = json_spirit::mValue(format_time(sync_stat.crawl_duration));
+    } else {
+      crawl["state"] = json_spirit::mValue("in-progress");
+      auto cur_time = clock::now();
+      sec_duration crawl_duration_till_now =
+        sec_duration(cur_time - sync_stat.crawl_start_time);
+      crawl["duration"] =
+        json_spirit::mValue(format_time(crawl_duration_till_now.count()));
+    }
+    snap["crawl"] = json_spirit::mValue(crawl);
+
+    if (sync_stat.datasync_queue_wait_duration ||
+        sync_stat.datasync_queue_wait_start_time) {
+      json_spirit::mObject datasync_queue_wait;
+      if (sync_stat.datasync_queue_wait_duration) {
+        datasync_queue_wait["state"] = json_spirit::mValue("completed");
+        datasync_queue_wait["duration"] =
+          json_spirit::mValue(format_time(*sync_stat.datasync_queue_wait_duration));
+      } else {
+        datasync_queue_wait["state"] = json_spirit::mValue("waiting");
+        auto cur_time = clock::now();
+        sec_duration dq_wait =
+          sec_duration(cur_time - *sync_stat.datasync_queue_wait_start_time);
+        datasync_queue_wait["duration"] =
+          json_spirit::mValue(format_time(dq_wait.count()));
+      }
+      snap["datasync_queue_wait"] = json_spirit::mValue(datasync_queue_wait);
+    }
+
+    json_spirit::mObject bytes;
+    bytes["sync_bytes"] = json_spirit::mValue(format_bytes(sync_stat.sync_bytes));
+    bytes["total_bytes"] = json_spirit::mValue(format_bytes(sync_stat.total_bytes));
+    if (sync_stat.total_bytes > 0) {
+      double sync_pct =
+        (static_cast<double>(sync_stat.sync_bytes) * 100.0) / sync_stat.total_bytes;
+      std::ostringstream os;
+      os << std::fixed << std::setprecision(2) << sync_pct << "%";
+      bytes["sync_percent"] = json_spirit::mValue(os.str());
+    }
+    snap["bytes"] = json_spirit::mValue(bytes);
+
+    json_spirit::mObject files;
+    files["sync_files"] =
+      json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.sync_files));
+    files["total_files"] =
+      json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.total_files));
+    if (sync_stat.total_files > 0) {
+      double sync_file_pct =
+        (static_cast<double>(sync_stat.sync_files) * 100.0) / sync_stat.total_files;
+      std::ostringstream os;
+      os << std::fixed << std::setprecision(2) << sync_file_pct << "%";
+      files["sync_percent"] = json_spirit::mValue(os.str());
+    }
+    snap["files"] = json_spirit::mValue(files);
+
+    double eta = compute_eta(sync_stat);
+    if (eta == -1.0) {
+      snap["eta"] = json_spirit::mValue("calculating...");
+    } else {
+      snap["eta"] = json_spirit::mValue(format_time(eta));
+    }
+
+    obj["state"] = json_spirit::mValue("syncing");
+    obj["current_syncing_snap"] = json_spirit::mValue(snap);
+  } else if (sync_stat.failed) {
+    obj["state"] = json_spirit::mValue("failed");
+    if (sync_stat.last_failed_reason) {
+      obj["failure_reason"] = json_spirit::mValue(*sync_stat.last_failed_reason);
+    }
+  } else {
+    obj["state"] = json_spirit::mValue("idle");
+  }
+}
+
+void PeerReplayer::add_last_sync_metrics_to_persist(json_spirit::mObject &obj,
+                                                    SnapSyncStat &sync_stat) {
+  if (sync_stat.last_synced_snap) {
+    json_spirit::mObject snap;
+    snap["id"] =
+      json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.last_synced_snap->first));
+    snap["name"] = json_spirit::mValue(sync_stat.last_synced_snap->second);
+    if (sync_stat.last_sync_crawl_duration) {
+      snap["crawl_duration"] = json_spirit::mValue(*sync_stat.last_sync_crawl_duration);
+    }
+    if (sync_stat.last_sync_datasync_queue_wait_duration) {
+      snap["datasync_queue_wait_duration"] =
+        json_spirit::mValue(*sync_stat.last_sync_datasync_queue_wait_duration);
+    }
+    if (sync_stat.last_sync_duration) {
+      snap["sync_duration"] = json_spirit::mValue(*sync_stat.last_sync_duration);
+    }
+    if (!clock::is_zero(sync_stat.last_synced)) {
+      snap["sync_time_stamp"] =
+        json_spirit::mValue(monotime_to_double(sync_stat.last_synced));
+    }
+    if (sync_stat.last_sync_bytes) {
+      snap["sync_bytes"] =
+        json_spirit::mValue(static_cast<boost::uint64_t>(*sync_stat.last_sync_bytes));
+    }
+    if (sync_stat.last_sync_files) {
+      snap["sync_files"] =
+        json_spirit::mValue(static_cast<boost::uint64_t>(*sync_stat.last_sync_files));
+    }
+    obj["last_synced_snap"] = json_spirit::mValue(snap);
+  }
+
+  obj["snaps_synced"] =
+    json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.synced_snap_count));
+  obj["snaps_deleted"] =
+    json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.deleted_snap_count));
+  obj["snaps_renamed"] =
+    json_spirit::mValue(static_cast<boost::uint64_t>(sync_stat.renamed_snap_count));
+}
+
+void PeerReplayer::persist_dir_sync_stat(const std::string &dir_root) {
+  ceph_assert(m_local_ioctx);
+
+  SnapSyncStat sync_stat;
+  {
+    std::scoped_lock locker(m_lock);
+    auto it = m_snap_sync_stats.find(dir_root);
+    if (it == m_snap_sync_stats.end()) {
+      return;
+    }
+    sync_stat = it->second;
+  }
+
+  json_spirit::mObject obj;
+  add_live_sync_metrics_to_persist(obj, sync_stat);
+  add_last_sync_metrics_to_persist(obj, sync_stat);
+  obj["metrics_updated_at"] =
+    json_spirit::mValue(static_cast<double>(ceph_clock_now()));
+  obj["_instance_id"] =
+    json_spirit::mValue(stringify(m_local_ioctx->get_instance_id()));
+
+  bufferlist bl;
+  bl.append(json_spirit::write(json_spirit::mValue(obj)));
+  std::map<std::string, bufferlist> kv{{peer_sync_stat_omap_key(dir_root), bl}};
+
+  librados::ObjectWriteOperation write_op;
+  write_op.omap_set(kv);
+
+  Context *ctx = new C_PersistSyncStatAio(dir_root);
+  librados::AioCompletion *aio_comp = create_rados_callback(ctx);
+  int r = m_local_ioctx->aio_operate(CEPHFS_MIRROR_OBJECT, aio_comp, &write_op);
+  if (r < 0) {
+    delete ctx;
+    derr << ": failed to submit aio persist sync stats for dir_root=" << dir_root
+         << ": " << cpp_strerror(r) << dendl;
+    aio_comp->release();
+    return;
+  }
+  aio_comp->release();
+}
+
 void PeerReplayer::enqueue_syncm(const std::shared_ptr<SyncMechanism>& item) {
   dout(20) << ": Enqueue syncm object=" << item << dendl;
   std::lock_guard lock(smq_lock);
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 8d8d9f42119..08c214b2925 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -9,6 +9,7 @@
 #include "mds/FSMap.h"
 #include "ServiceDaemon.h"
 #include "Types.h"
+#include "json_spirit/json_spirit.h"
 
 #include <stack>
 #include <boost/optional.hpp>
@@ -24,7 +25,7 @@ public:
   PeerReplayer(CephContext *cct, FSMirror *fs_mirror,
                RadosRef local_cluster, const Filesystem &filesystem,
                const Peer &peer, const std::set<std::string, std::less<>> &directories,
-               MountRef mount, ServiceDaemon *service_daemon);
+               IoCtxRef local_ioctx, MountRef mount, ServiceDaemon *service_daemon);
   ~PeerReplayer();
 
   // initialize replayer for a peer
@@ -50,6 +51,7 @@ private:
 
   inline static const std::string SERVICE_DAEMON_FAILED_DIR_COUNT_KEY = "failure_count";
   inline static const std::string SERVICE_DAEMON_RECOVERED_DIR_COUNT_KEY = "recovery_count";
+  inline static const std::string PEER_SYNC_STAT_KEY_PREFIX = "sync_stat";
 
   using Snapshot = std::pair<std::string, uint64_t>;
 
@@ -647,6 +649,7 @@ private:
   CephContext *m_cct;
   FSMirror *m_fs_mirror;
   RadosRef m_local_cluster;
+  IoCtxRef m_local_ioctx;
   Filesystem m_filesystem;
   Peer m_peer;
   // probably need to be encapsulated when supporting cancelations
@@ -712,6 +715,12 @@ private:
                          DirRegistry *registry);
   void unlock_directory(const std::string &dir_root, const DirRegistry &registry);
   int sync_snaps(const std::string &dir_root, std::unique_lock<ceph::mutex> &locker);
+  void persist_dir_sync_stat(const std::string &dir_root);
+  void add_live_sync_metrics_to_persist(json_spirit::mObject &obj,
+                                        SnapSyncStat &sync_stat);
+  void add_last_sync_metrics_to_persist(json_spirit::mObject &obj,
+                                        SnapSyncStat &sync_stat);
+  std::string peer_sync_stat_omap_key(std::string_view dir_root) const;
 
 
   int build_snap_map(const std::string &dir_root, std::map<uint64_t, std::string> *snap_map,
diff --git a/src/tools/cephfs_mirror/aio_utils.h b/src/tools/cephfs_mirror/aio_utils.h
index 1aa40ef912c..c95a83a6491 100644
--- a/src/tools/cephfs_mirror/aio_utils.h
+++ b/src/tools/cephfs_mirror/aio_utils.h
@@ -4,11 +4,21 @@
 #ifndef CEPHFS_MIRROR_AIO_UTILS_H
 #define CEPHFS_MIRROR_AIO_UTILS_H
 
+#include "include/Context.h"
 #include "include/rados/librados.hpp"
 
 namespace cephfs {
 namespace mirror {
 
+inline void rados_ctx_callback(rados_completion_t c, void *arg) {
+  Context *on_finish = reinterpret_cast<Context *>(arg);
+  on_finish->complete(rados_aio_get_return_value(c));
+}
+
+inline librados::AioCompletion *create_rados_callback(Context *on_finish) {
+  return librados::Rados::aio_create_completion(on_finish, rados_ctx_callback);
+}
+
 template <typename T, void(T::*MF)(int)>
 void rados_callback(rados_completion_t c, void *arg) {
   T *obj = reinterpret_cast<T*>(arg);

From c5dd50967036529c819ecdad7bb86705a15f61c6 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sat, 20 Jun 2026 11:03:49 +0530
Subject: [PATCH 371/596] tools/cephfs_mirror: Persist metrics to omap

Persist snapshot mirroring metrics to the cephfs_mirror object omap
for the mgr/mirroring module to support status command.

The tick thread only keeps omap up to date for in-progress syncs on
registered directories. Persist explicitly when stats change so omap
is updated before a directory unregisters:

 - snap delete/rename propagation (inc_deleted_snap / inc_renamed_snap)
 - after each successful snap sync (following set_last_synced_stat)
 - after sync_snaps failure (following _inc_failed_count)
 - after sync_perms failure (following _inc_failed_count)

Without the explicit call sites, omap can keep stale live or idle state
after sync completes or fails because directories leave m_registered
before the next tick.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 6645374969c..06206e5c8cc 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -1166,6 +1166,7 @@ int PeerReplayer::propagate_snap_deletes(const std::string &dir_root,
       return r;
     }
     inc_deleted_snap(dir_root);
+    persist_dir_sync_stat(dir_root);
     if (m_perf_counters) {
       m_perf_counters->inc(l_cephfs_mirror_peer_replayer_snaps_deleted);
     }
@@ -1192,6 +1193,7 @@ int PeerReplayer::propagate_snap_renames(
       return r;
     }
     inc_renamed_snap(dir_root);
+    persist_dir_sync_stat(dir_root);
     if (m_perf_counters) {
       m_perf_counters->inc(l_cephfs_mirror_peer_replayer_snaps_renamed);
     }
@@ -2849,6 +2851,7 @@ int PeerReplayer::do_sync_snaps(const std::string &dir_root) {
     }
 
     set_last_synced_stat(dir_root, it->first, it->second, duration);
+    persist_dir_sync_stat(dir_root);
     if (--snaps_per_cycle == 0) {
       break;
     }
@@ -2878,6 +2881,11 @@ int PeerReplayer::sync_snaps(const std::string &dir_root,
     update_directory_current_sync_perf_counters(dir_perf,
                                                 m_snap_sync_stats.at(dir_root));
   }
+  if (r < 0) {
+    locker.unlock();
+    persist_dir_sync_stat(dir_root);
+    locker.lock();
+  }
   return r;
 }
 
@@ -2898,6 +2906,18 @@ void PeerReplayer::run_tick() {
     for (const auto &kv : m_registered) {
       refresh_directory_current_sync_perf_counters(kv.first);
     }
+
+    // persist sync stats to omap for registered directories
+    std::vector<std::string> dirs;
+    dirs.reserve(m_registered.size());
+    for (const auto &kv : m_registered) {
+      dirs.push_back(kv.first);
+    }
+    locker.unlock();
+    for (const auto &dir_root : dirs) {
+      persist_dir_sync_stat(dir_root);
+    }
+    locker.lock();
   }
 }
 
@@ -2947,6 +2967,9 @@ void PeerReplayer::run(SnapshotReplayerThread *replayer) {
               update_directory_current_sync_perf_counters(
                 dir_perf, m_snap_sync_stats.at(*dir_root));
             }
+            locker.unlock();
+            persist_dir_sync_stat(*dir_root);
+            locker.lock();
             if (m_perf_counters) {
               m_perf_counters->inc(l_cephfs_mirror_peer_replayer_snap_sync_failures);
             }

From 4b907eaf08869ef472b391774c421a68361a1f0a Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sat, 20 Jun 2026 11:51:42 +0530
Subject: [PATCH 372/596] tools/cephfs_mirror: Load persisted mirror metrics
 from omap

Load last_synced_snap metadata from the cephfs_mirror object omap on
PeerReplayer initialization and when a mirrored directory is added.
Live current_syncing_snap metrics are not restored; they are rebuilt
when synchronization starts.

When the daemon restarts after a snapshot was synced on the remote but
metrics were not yet written to omap, loaded metadata may belong to an
older snapshot.  Add reconcile_last_synced_snap() to compare against
the remote snap map, clear stale last-sync fields, and update
last_synced_snap id/name in memory.

Treat snaps_synced, snaps_deleted, and snaps_renamed as per-session
counters.  Do not load them from omap; they start at zero for each
daemon session and are still reported via the admin socket.  Persist
omap metrics unconditionally after reconcile so the mgr picks up the
new instance id and cleared session counters on restart.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 282 ++++++++++++++++++++++--
 src/tools/cephfs_mirror/PeerReplayer.h  |  37 +++-
 2 files changed, 294 insertions(+), 25 deletions(-)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 06206e5c8cc..aafc6eba298 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -89,6 +89,9 @@ namespace {
 
 const std::string PEER_CONFIG_KEY_PREFIX = "cephfs/mirror/peer";
 
+// Matches the mgr mirroring omap read batch size (dir_map/load.py MAX_RETURN).
+constexpr size_t SYNC_STAT_OMAP_LOAD_BATCH_SIZE = 256;
+
 std::string snapshot_dir_path(CephContext *cct, const std::string &path) {
   return path + "/" + cct->_conf->client_snapdir;
 }
@@ -119,10 +122,26 @@ std::string peer_config_key(const std::string &fs_name, const std::string &uuid)
   return PEER_CONFIG_KEY_PREFIX + "/" + fs_name + "/" + uuid;
 }
 
+bool get_json_value(const json_spirit::mObject& obj,
+                    const std::string& key,
+                    json_spirit::mValue *val) {
+  auto it = obj.find(key);
+  if (it != obj.end()) {
+    *val = it->second;
+    return true;
+  }
+  return false;
+}
+
 double monotime_to_double(monotime t) {
   return sec_duration(t.time_since_epoch()).count();
 }
 
+monotime monotime_from_double(double seconds) {
+  auto d = std::chrono::duration_cast<clock::duration>(sec_duration(seconds));
+  return monotime(d);
+}
+
 struct C_PersistSyncStatAio : Context {
   std::string dir_root;
 
@@ -136,6 +155,21 @@ struct C_PersistSyncStatAio : Context {
     }
   }
 };
+
+struct C_RemovePersistedSyncStatAio : Context {
+  std::string dir_root;
+
+  explicit C_RemovePersistedSyncStatAio(std::string dir_root_)
+    : dir_root(std::move(dir_root_)) {}
+
+  void finish(int r) override {
+    if (r < 0 && r != -ENOENT) {
+      generic_derr << "cephfs::mirror: aio remove persisted sync stats failed for dir_root="
+                     << dir_root << ": " << cpp_strerror(r) << dendl;
+    }
+  }
+};
+
 class PeerAdminSocketCommand {
 public:
   virtual ~PeerAdminSocketCommand() {
@@ -559,6 +593,7 @@ int PeerReplayer::init() {
   for (auto &dir_root : m_directories) {
     m_snap_sync_stats.emplace(dir_root, SnapSyncStat());
   }
+  load_persisted_dir_sync_stats();
   for (auto &dir_root : m_directories) {
     create_directory_perf_counters(dir_root);
     auto *dir_perf = find_directory_perf_counters(dir_root);
@@ -703,14 +738,18 @@ void PeerReplayer::add_directory(string_view dir_root) {
   dout(20) << ": dir_root=" << dir_root << dendl;
   auto _dir_root = std::string(dir_root);
 
-  std::scoped_lock locker(m_lock);
-  if (std::find(m_directories.begin(), m_directories.end(), _dir_root) !=
-      m_directories.end()) {
-    dout(10) << ": dir_root=" << _dir_root << " already in replay list" << dendl;
-    return;
+  {
+    std::scoped_lock locker(m_lock);
+    if (std::find(m_directories.begin(), m_directories.end(), _dir_root) !=
+        m_directories.end()) {
+      dout(10) << ": dir_root=" << _dir_root << " already in replay list" << dendl;
+      return;
+    }
+    m_directories.emplace_back(_dir_root);
+    m_snap_sync_stats.emplace(_dir_root, SnapSyncStat());
   }
-  m_directories.emplace_back(_dir_root);
-  m_snap_sync_stats.emplace(_dir_root, SnapSyncStat());
+  load_persisted_dir_sync_stat(_dir_root);
+  std::scoped_lock locker(m_lock);
   if (m_directory_perf_counters.find(_dir_root) ==
       m_directory_perf_counters.end()) {
     create_directory_perf_counters(_dir_root);
@@ -723,24 +762,44 @@ void PeerReplayer::add_directory(string_view dir_root) {
   m_cond.notify_all();
 }
 
-void PeerReplayer::remove_directory(string_view dir_root) {
-  dout(20) << ": dir_root=" << dir_root << dendl;
+void PeerReplayer::remove_directory(string_view dir_root, bool purging) {
+  dout(20) << ": dir_root=" << dir_root << ", purging=" << purging << dendl;
   auto _dir_root = std::string(dir_root);
+  bool persist_idle = false;
 
-  std::scoped_lock locker(m_lock);
-  auto it = std::find(m_directories.begin(), m_directories.end(), _dir_root);
-  if (it != m_directories.end()) {
-    m_directories.erase(it);
+  {
+    std::scoped_lock locker(m_lock);
+    auto it = std::find(m_directories.begin(), m_directories.end(), _dir_root);
+    if (it != m_directories.end()) {
+      m_directories.erase(it);
+    }
+
+    auto it1 = m_registered.find(_dir_root);
+    if (it1 == m_registered.end()) {
+      if (purging) {
+        remove_persisted_dir_sync_stat(_dir_root);
+      }
+      remove_directory_perf_counters(_dir_root);
+      m_snap_sync_stats.erase(_dir_root);
+    } else {
+      it1->second.canceled = true;
+      if (purging) {
+        m_purging_directories.insert(_dir_root);
+      } else {
+        auto &sync_stat = m_snap_sync_stats.at(_dir_root);
+        sync_stat.current_syncing_snap = boost::none;
+        if (auto *dir_perf = find_directory_perf_counters(_dir_root)) {
+          update_directory_current_sync_perf_counters(dir_perf, sync_stat);
+        }
+        persist_idle = true;
+      }
+    }
+    m_cond.notify_all();
   }
 
-  auto it1 = m_registered.find(_dir_root);
-  if (it1 == m_registered.end()) {
-    remove_directory_perf_counters(_dir_root);
-    m_snap_sync_stats.erase(_dir_root);
-  } else {
-    it1->second.canceled = true;
+  if (persist_idle) {
+    persist_dir_sync_stat(_dir_root);
   }
-  m_cond.notify_all();
 }
 
 std::string PeerReplayer::peer_sync_stat_omap_key(std::string_view dir_root) const {
@@ -753,6 +812,167 @@ std::string PeerReplayer::peer_sync_stat_omap_key(std::string_view dir_root) con
          + "/" + d;
 }
 
+void PeerReplayer::apply_persisted_dir_sync_stat(SnapSyncStat &sync_stat,
+                                                 const bufferlist &bl) {
+  json_spirit::mValue root;
+  if (!json_spirit::read(bl.to_str(), root) || root.type() != json_spirit::obj_type) {
+    return;
+  }
+
+  auto &obj = root.get_obj();
+  json_spirit::mValue v;
+
+  if (get_json_value(obj, "last_synced_snap", &v) && v.type() == json_spirit::obj_type) {
+    auto &last_synced_snap = v.get_obj();
+    if (get_json_value(last_synced_snap, "id", &v)) {
+      uint64_t snap_id = v.get_uint64();
+      if (get_json_value(last_synced_snap, "name", &v)) {
+        sync_stat.last_synced_snap = std::make_pair(snap_id, v.get_str());
+      }
+    }
+    if (get_json_value(last_synced_snap, "crawl_duration", &v)) {
+      sync_stat.last_sync_crawl_duration = v.get_real();
+    }
+    if (get_json_value(last_synced_snap, "datasync_queue_wait_duration", &v)) {
+      sync_stat.last_sync_datasync_queue_wait_duration = v.get_real();
+    }
+    if (get_json_value(last_synced_snap, "sync_duration", &v)) {
+      sync_stat.last_sync_duration = v.get_real();
+    }
+    if (get_json_value(last_synced_snap, "sync_time_stamp", &v)) {
+      sync_stat.last_synced = monotime_from_double(v.get_real());
+    }
+    if (get_json_value(last_synced_snap, "sync_bytes", &v)) {
+      sync_stat.last_sync_bytes = v.get_uint64();
+    }
+    if (get_json_value(last_synced_snap, "sync_files", &v)) {
+      sync_stat.last_sync_files = v.get_uint64();
+    }
+  }
+}
+
+void PeerReplayer::load_persisted_dir_sync_stat(const std::string &dir_root) {
+  ceph_assert(m_local_ioctx);
+
+  const std::string key = peer_sync_stat_omap_key(dir_root);
+  std::set<std::string> keys{key};
+  std::map<std::string, bufferlist> vals;
+  // Sync call is fine since it's called once during add_directory
+  int r = m_local_ioctx->omap_get_vals_by_keys(CEPHFS_MIRROR_OBJECT, keys, &vals);
+  if (r == -ENOENT) {
+    return;
+  }
+  if (r < 0) {
+    derr << ": failed to read persisted sync stat for dir_root=" << dir_root
+         << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+
+  auto vit = vals.find(key);
+  if (vit == vals.end()) {
+    return;
+  }
+
+  std::scoped_lock locker(m_lock);
+  auto st_it = m_snap_sync_stats.find(dir_root);
+  if (st_it == m_snap_sync_stats.end()) {
+    return;
+  }
+  apply_persisted_dir_sync_stat(st_it->second, vit->second);
+}
+
+void PeerReplayer::load_persisted_dir_sync_stats() {
+  ceph_assert(m_local_ioctx);
+  if (m_directories.empty()) {
+    return;
+  }
+
+  std::vector<std::string> omap_keys;
+  omap_keys.reserve(m_directories.size());
+  std::map<std::string, std::string> key_to_dir;
+  for (const auto &dir_root : m_directories) {
+    const std::string key = peer_sync_stat_omap_key(dir_root);
+    omap_keys.push_back(key);
+    key_to_dir[key] = dir_root;
+  }
+
+  std::map<std::string, bufferlist> all_vals;
+
+  auto fetch_keys = [&](const std::set<std::string> &keys) -> int {
+    if (keys.empty()) {
+      return 0;
+    }
+    std::map<std::string, bufferlist> vals;
+    // Sync call is fine since the stats are loaded once during startup
+    int r = m_local_ioctx->omap_get_vals_by_keys(CEPHFS_MIRROR_OBJECT, keys, &vals);
+    if (r == -ENOENT) {
+      return 0;
+    }
+    if (r < 0) {
+      return r;
+    }
+    all_vals.merge(std::move(vals));
+    return 0;
+  };
+
+  if (m_directories.size() <= SYNC_STAT_OMAP_LOAD_BATCH_SIZE) {
+    std::set<std::string> keys(omap_keys.begin(), omap_keys.end());
+    int r = fetch_keys(keys);
+    if (r < 0) {
+      derr << ": failed to read persisted sync stats: " << cpp_strerror(r) << dendl;
+      return;
+    }
+  } else {
+    for (size_t i = 0; i < omap_keys.size(); i += SYNC_STAT_OMAP_LOAD_BATCH_SIZE) {
+      std::set<std::string> keys;
+      const size_t end = std::min(i + SYNC_STAT_OMAP_LOAD_BATCH_SIZE, omap_keys.size());
+      for (size_t j = i; j < end; ++j) {
+        keys.insert(omap_keys[j]);
+      }
+      int r = fetch_keys(keys);
+      if (r < 0) {
+        derr << ": failed to read persisted sync stats: " << cpp_strerror(r) << dendl;
+        return;
+      }
+    }
+  }
+
+  std::scoped_lock locker(m_lock);
+  for (auto &[key, bl] : all_vals) {
+    auto kit = key_to_dir.find(key);
+    if (kit == key_to_dir.end()) {
+      continue;
+    }
+    auto st_it = m_snap_sync_stats.find(kit->second);
+    if (st_it == m_snap_sync_stats.end()) {
+      continue;
+    }
+    apply_persisted_dir_sync_stat(st_it->second, bl);
+  }
+}
+
+void PeerReplayer::remove_persisted_dir_sync_stat(const std::string &dir_root) {
+  ceph_assert(m_local_ioctx);
+
+  const std::string key = peer_sync_stat_omap_key(dir_root);
+  dout(5) << ": removing persisted sync stat omap key=" << key
+          << " for dir_root=" << dir_root << dendl;
+  librados::ObjectWriteOperation write_op;
+  write_op.omap_rm_keys({key});
+
+  Context *ctx = new C_RemovePersistedSyncStatAio(dir_root);
+  librados::AioCompletion *aio_comp = create_rados_callback(ctx);
+  int r = m_local_ioctx->aio_operate(CEPHFS_MIRROR_OBJECT, aio_comp, &write_op);
+  if (r < 0) {
+    delete ctx;
+    derr << ": failed to submit aio remove persisted sync stats for dir_root="
+         << dir_root << ": " << cpp_strerror(r) << dendl;
+    aio_comp->release();
+    return;
+  }
+  aio_comp->release();
+}
+
 void PeerReplayer::add_live_sync_metrics_to_persist(json_spirit::mObject &obj,
                                                     SnapSyncStat &sync_stat) {
   if (sync_stat.current_syncing_snap) {
@@ -980,7 +1200,8 @@ int PeerReplayer::register_directory(const std::string &dir_root,
   return 0;
 }
 
-void PeerReplayer::unregister_directory(const std::string &dir_root) {
+void PeerReplayer::unregister_directory(const std::string &dir_root,
+                                        std::unique_lock<ceph::mutex> &locker) {
   dout(20) << ": dir_root=" << dir_root << dendl;
 
   auto it = m_registered.find(dir_root);
@@ -989,6 +1210,18 @@ void PeerReplayer::unregister_directory(const std::string &dir_root) {
   unlock_directory(it->first, it->second);
   m_registered.erase(it);
   if (std::find(m_directories.begin(), m_directories.end(), dir_root) == m_directories.end()) {
+    if (m_purging_directories.erase(dir_root)) {
+      remove_persisted_dir_sync_stat(dir_root);
+    } else {
+      auto &sync_stat = m_snap_sync_stats.at(dir_root);
+      sync_stat.current_syncing_snap = boost::none;
+      if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+        update_directory_current_sync_perf_counters(dir_perf, sync_stat);
+      }
+      locker.unlock();
+      persist_dir_sync_stat(dir_root);
+      locker.lock();
+    }
     remove_directory_perf_counters(dir_root);
     m_snap_sync_stats.erase(dir_root);
   }
@@ -2799,8 +3032,11 @@ int PeerReplayer::do_sync_snaps(const std::string &dir_root) {
     auto last = remote_snap_map.rbegin();
     last_snap_id = last->first;
     last_snap_name = last->second;
-    set_last_synced_snap(dir_root, last_snap_id, last_snap_name);
+
+    reconcile_last_synced_snap(dir_root, last_snap_id, last_snap_name);
   }
+  // Session counters reset on restart; persist unconditionally to clear stale state.
+  persist_dir_sync_stat(dir_root);
 
   dout(5) << ": last snap-id transferred=" << last_snap_id << dendl;
   auto it = local_snap_map.upper_bound(last_snap_id);
@@ -2974,7 +3210,7 @@ void PeerReplayer::run(SnapshotReplayerThread *replayer) {
               m_perf_counters->inc(l_cephfs_mirror_peer_replayer_snap_sync_failures);
             }
           }
-          unregister_directory(*dir_root);
+          unregister_directory(*dir_root, locker);
         }
       }
 
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 08c214b2925..7339df9e7bf 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -11,6 +11,7 @@
 #include "Types.h"
 #include "json_spirit/json_spirit.h"
 
+#include <set>
 #include <stack>
 #include <boost/optional.hpp>
 
@@ -38,7 +39,7 @@ public:
   void add_directory(std::string_view dir_root);
 
   // remove a directory from queue
-  void remove_directory(std::string_view dir_root);
+  void remove_directory(std::string_view dir_root, bool purging = false);
 
   // admin socket helpers
   void peer_status(Formatter *f);
@@ -458,6 +459,32 @@ private:
     sync_stat.last_failed_reason = boost::none;
   }
 
+  void _reset_last_synced_snap_stat(const std::string &dir_root) {
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    sync_stat.last_synced = clock::zero();
+    sync_stat.last_sync_duration.reset();
+    sync_stat.last_sync_crawl_duration.reset();
+    sync_stat.last_sync_datasync_queue_wait_duration.reset();
+    sync_stat.last_sync_bytes.reset();
+    sync_stat.last_sync_files.reset();
+  }
+
+  void reconcile_last_synced_snap(const std::string &dir_root, uint64_t snap_id,
+                                  const std::string &snap_name) {
+    std::scoped_lock locker(m_lock);
+    auto &sync_stat = m_snap_sync_stats.at(dir_root);
+    if (sync_stat.last_synced_snap &&
+        sync_stat.last_synced_snap->first == snap_id &&
+        sync_stat.last_synced_snap->second == snap_name) {
+      return;
+    }
+    _reset_last_synced_snap_stat(dir_root);
+    _set_last_synced_snap(dir_root, snap_id, snap_name);
+    if (auto *dir_perf = find_directory_perf_counters(dir_root)) {
+      update_directory_last_sync_perf_counters(dir_perf, sync_stat);
+    }
+  }
+
   void _reset_sync_stat(const std::string &dir_root) {
     auto &sync_stat = m_snap_sync_stats.at(dir_root);
     sync_stat.sync_bytes = 0;
@@ -656,6 +683,7 @@ private:
   std::map<std::string, DirRegistry> m_registered;
   std::vector<std::string> m_directories;
   std::map<std::string, SnapSyncStat> m_snap_sync_stats;
+  std::set<std::string> m_purging_directories;
   MountRef m_local_mount;
   ServiceDaemon *m_service_daemon;
   PeerReplayerAdminSocketHook *m_asok_hook = nullptr;
@@ -710,11 +738,16 @@ private:
 
   boost::optional<std::string> pick_directory();
   int register_directory(const std::string &dir_root, SnapshotReplayerThread *replayer);
-  void unregister_directory(const std::string &dir_root);
+  void unregister_directory(const std::string &dir_root,
+                            std::unique_lock<ceph::mutex> &locker);
   int try_lock_directory(const std::string &dir_root, SnapshotReplayerThread *replayer,
                          DirRegistry *registry);
   void unlock_directory(const std::string &dir_root, const DirRegistry &registry);
   int sync_snaps(const std::string &dir_root, std::unique_lock<ceph::mutex> &locker);
+  void load_persisted_dir_sync_stats();
+  void load_persisted_dir_sync_stat(const std::string &dir_root);
+  void apply_persisted_dir_sync_stat(SnapSyncStat &sync_stat, const bufferlist &bl);
+  void remove_persisted_dir_sync_stat(const std::string &dir_root);
   void persist_dir_sync_stat(const std::string &dir_root);
   void add_live_sync_metrics_to_persist(json_spirit::mObject &obj,
                                         SnapSyncStat &sync_stat);

From 51a8348dfd681dfd446c347a82e581f2ed52a4c6 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sat, 20 Jun 2026 13:28:56 +0530
Subject: [PATCH 373/596] tools/cephfs_mirror: Remove persisted dir stats

When a directory is removed from mirroring, the persisted directory
stats need to be removed.  This patch handles the cleanup.

Omap keys must not be removed when mirrored directories are reshuffled
across cephfs-mirror daemons.  The mgr release notify now carries a
purging flag (set only during permanent removal, not reshuffle), and
the daemon removes persisted stats only when purging is true.  On
reshuffle with an in-progress sync, clear live current_syncing_snap
state and persist idle metrics so the acquiring daemon does not inherit
stale syncing omap entries.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/snapshot_mirror.py | 14 +++++++++-----
 src/tools/cephfs_mirror/FSMirror.cc            |  6 +++---
 src/tools/cephfs_mirror/FSMirror.h             |  6 +++---
 src/tools/cephfs_mirror/InstanceWatcher.cc     |  6 ++++--
 src/tools/cephfs_mirror/InstanceWatcher.h      |  2 +-
 5 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 884146109a4..237b12a945a 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -181,10 +181,12 @@ class FSPolicy:
             return json.dumps({'dir_path': dir_path,
                                'mode': 'acquire'
                                })
-        def release_message(dir_path):
-            return json.dumps({'dir_path': dir_path,
-                               'mode': 'release'
-                               })
+        def release_message(dir_path, purging=False):
+            msg = {'dir_path': dir_path,
+                   'mode': 'release'}
+            if purging:
+                msg['purging'] = True
+            return json.dumps(msg)
         with self.lock:
             if not self.dir_paths or self.stopping.is_set():
                 return
@@ -211,7 +213,9 @@ class FSPolicy:
                 elif action_type == ActionType.ACQUIRE:
                     notifies[dir_path] = (lookup_info['instance_id'], acquire_message(dir_path))
                 elif action_type == ActionType.RELEASE:
-                    notifies[dir_path] = (lookup_info['instance_id'], release_message(dir_path))
+                    notifies[dir_path] = (lookup_info['instance_id'],
+                                          release_message(dir_path,
+                                                          lookup_info['purging']))
             if update_map or removals:
                 self.update_mapping(update_map, removals, callback=self.continue_action)
             for dir_path, message in notifies.items():
diff --git a/src/tools/cephfs_mirror/FSMirror.cc b/src/tools/cephfs_mirror/FSMirror.cc
index ac19f158694..9b88fd55b86 100644
--- a/src/tools/cephfs_mirror/FSMirror.cc
+++ b/src/tools/cephfs_mirror/FSMirror.cc
@@ -390,8 +390,8 @@ void FSMirror::handle_acquire_directory(string_view dir_path) {
   }
 }
 
-void FSMirror::handle_release_directory(string_view dir_path) {
-  dout(5) << ": dir_path=" << dir_path << dendl;
+void FSMirror::handle_release_directory(string_view dir_path, bool purging) {
+  dout(5) << ": dir_path=" << dir_path << ", purging=" << purging << dendl;
 
   {
     std::scoped_lock locker(m_lock);
@@ -402,7 +402,7 @@ void FSMirror::handle_release_directory(string_view dir_path) {
                                                    m_directories.size());
       for (auto &[peer, peer_replayer] : m_peer_replayers) {
         dout(10) << ": peer=" << peer << dendl;
-        peer_replayer->remove_directory(dir_path);
+        peer_replayer->remove_directory(dir_path, purging);
       }
     }
     if (m_perf_counters) {
diff --git a/src/tools/cephfs_mirror/FSMirror.h b/src/tools/cephfs_mirror/FSMirror.h
index 594049baa6b..7757373c3fa 100644
--- a/src/tools/cephfs_mirror/FSMirror.h
+++ b/src/tools/cephfs_mirror/FSMirror.h
@@ -117,8 +117,8 @@ private:
       fs_mirror->handle_acquire_directory(dir_path);
     }
 
-    void release_directory(std::string_view dir_path) override {
-      fs_mirror->handle_release_directory(dir_path);
+    void release_directory(std::string_view dir_path, bool purging) override {
+      fs_mirror->handle_release_directory(dir_path, purging);
     }
 
   };
@@ -189,7 +189,7 @@ private:
   void handle_shutdown_instance_watcher(int r);
 
   void handle_acquire_directory(std::string_view dir_path);
-  void handle_release_directory(std::string_view dir_path);
+  void handle_release_directory(std::string_view dir_path, bool purging);
 };
 
 } // namespace mirror
diff --git a/src/tools/cephfs_mirror/InstanceWatcher.cc b/src/tools/cephfs_mirror/InstanceWatcher.cc
index 8cd7214b553..b8be5762497 100644
--- a/src/tools/cephfs_mirror/InstanceWatcher.cc
+++ b/src/tools/cephfs_mirror/InstanceWatcher.cc
@@ -87,21 +87,23 @@ void InstanceWatcher::handle_notify(uint64_t notify_id, uint64_t handle,
 
   std::string dir_path;
   std::string mode;
+  bool purging = false;
   try {
     JSONDecoder jd(bl);
     JSONDecoder::decode_json("dir_path", dir_path, &jd.parser, true);
     JSONDecoder::decode_json("mode", mode, &jd.parser, true);
+    JSONDecoder::decode_json("purging", purging, &jd.parser, false);
   } catch (const JSONDecoder::err &e) {
     derr << ": failed to decode notify json: " << e.what() << dendl;
   }
 
   dout(20) << ": notifier_id=" << notifier_id << ", dir_path=" << dir_path
-           << ", mode=" << mode << dendl;
+           << ", mode=" << mode << ", purging=" << purging << dendl;
 
   if (mode == "acquire") {
     m_listener.acquire_directory(dir_path);
   } else if (mode == "release") {
-    m_listener.release_directory(dir_path);
+    m_listener.release_directory(dir_path, purging);
   } else {
     derr << ": unknown mode" << dendl;
   }
diff --git a/src/tools/cephfs_mirror/InstanceWatcher.h b/src/tools/cephfs_mirror/InstanceWatcher.h
index 5a48085d28c..fd939a1af81 100644
--- a/src/tools/cephfs_mirror/InstanceWatcher.h
+++ b/src/tools/cephfs_mirror/InstanceWatcher.h
@@ -27,7 +27,7 @@ public:
     }
 
     virtual void acquire_directory(std::string_view dir_path) = 0;
-    virtual void release_directory(std::string_view dir_path) = 0;
+    virtual void release_directory(std::string_view dir_path, bool purging) = 0;
   };
 
   static InstanceWatcher *create(librados::IoCtx &ioctx,

From 33c572242ba78924df3e65f9fec23f2aefe81c66 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Wed, 29 Apr 2026 14:49:15 +0530
Subject: [PATCH 374/596] mgr/mirroring: Add new interface to expose mirroring
 metrics

Add the following new interface to expose mirroring metrics

ceph fs snapshot mirror status <fsname> [<mirrored_dir_path>] [--peer_uuid=<peer_uuid>]

The cmd loads the persisted directory sync metrics from the
cephfs_mirror object's omap. Metrics are grouped by mirrored
directory and peer.

When --peer_uuid is specified, only metrics for that peer are
returned. peer_uuid is a named CLI argument (_end_positional_) so
peer-only filtering does not require a mirrored directory path.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 .../mgr/mirroring/fs/metrics/__init__.py      |  0
 src/pybind/mgr/mirroring/fs/metrics/load.py   | 96 +++++++++++++++++++
 .../mgr/mirroring/fs/snapshot_mirror.py       | 75 +++++++++++----
 src/pybind/mgr/mirroring/fs/utils.py          | 36 +++++++
 src/pybind/mgr/mirroring/module.py            | 10 ++
 5 files changed, 198 insertions(+), 19 deletions(-)
 create mode 100644 src/pybind/mgr/mirroring/fs/metrics/__init__.py
 create mode 100644 src/pybind/mgr/mirroring/fs/metrics/load.py

diff --git a/src/pybind/mgr/mirroring/fs/metrics/__init__.py b/src/pybind/mgr/mirroring/fs/metrics/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/mirroring/fs/metrics/load.py b/src/pybind/mgr/mirroring/fs/metrics/load.py
new file mode 100644
index 00000000000..8eff6a5c819
--- /dev/null
+++ b/src/pybind/mgr/mirroring/fs/metrics/load.py
@@ -0,0 +1,96 @@
+import errno
+import json
+import logging
+from typing import Any, Dict
+
+import rados
+
+from ..dir_map.load import MAX_RETURN
+from ..exception import MirrorException
+from ..utils import (
+    MIRROR_OBJECT_NAME,
+    SYNC_STAT_KEY_PREFIX,
+    decode_sync_stat_val,
+    get_metadata_pool,
+    parse_sync_stat_omap_key,
+)
+
+log = logging.getLogger(__name__)
+
+
+def nest_sync_stat_in_metrics(metrics, dir_path, peer_uuid, stat):
+    metrics.setdefault(dir_path, {}).setdefault('peer', {})[peer_uuid] = stat
+
+
+def load_sync_stat_by_keys(ioctx, keys):
+    stats: Dict[str, Any] = {}
+    if not keys:
+        return stats
+    try:
+        with rados.ReadOpCtx() as read_op:
+            it, ret = ioctx.get_omap_vals_by_keys(read_op, keys)
+            if ret != 0:
+                log.error('failed to read sync stat omap keys')
+                raise MirrorException(-errno.EINVAL,
+                                      'failed to read sync stat omap keys')
+            ioctx.operate_read_op(read_op, MIRROR_OBJECT_NAME)
+            for key, val in it:
+                try:
+                    stats[key] = decode_sync_stat_val(val)
+                except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                    log.warning(f'failed to decode sync stat for key {key}: {e}')
+    except rados.Error as e:
+        log.error(f'failed to read sync stat omap keys: {e}')
+        raise MirrorException(-e.errno, 'failed to read sync stat omap keys')
+    return stats
+
+
+def open_metadata_ioctx(rados_inst, fs_map, filesystem):
+    metadata_pool_id = get_metadata_pool(filesystem, fs_map)
+    if not metadata_pool_id:
+        raise MirrorException(-errno.EINVAL,
+                              f'cannot find metadata pool for filesystem {filesystem}')
+    try:
+        return rados_inst.open_ioctx2(metadata_pool_id)
+    except rados.Error as e:
+        log.error(f'failed to open metadata pool for {filesystem}: {e}')
+        raise MirrorException(-e.errno,
+                              f'failed to open metadata pool for {filesystem}')
+
+
+def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None):
+    metrics: Dict[str, Any] = {}
+    prefix = f'{SYNC_STAT_KEY_PREFIX}/{filesystem}/'
+    if peer_uuid:
+        prefix += f'{peer_uuid}/'
+    try:
+        with rados.ReadOpCtx() as read_op:
+            start = ""
+            while True:
+                it, ret = ioctx.get_omap_vals(read_op, start, prefix, MAX_RETURN)
+                if ret != 0:
+                    log.error('failed to read sync stat omap')
+                    raise MirrorException(-errno.EINVAL,
+                                          'failed to read sync stat omap')
+                ioctx.operate_read_op(read_op, MIRROR_OBJECT_NAME)
+                omap_vals = dict(it)
+                if not omap_vals:
+                    break
+                for key, val in omap_vals.items():
+                    parsed = parse_sync_stat_omap_key(key, filesystem)
+                    if not parsed:
+                        continue
+                    peer, dir_path = parsed
+                    if peer_uuid and peer != peer_uuid:
+                        continue
+                    try:
+                        stat = decode_sync_stat_val(val)
+                    except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                        log.warning(f'failed to decode sync stat for key {key}: {e}')
+                        continue
+                    nest_sync_stat_in_metrics(metrics, dir_path, peer, stat)
+                start = omap_vals.popitem()[0]
+    except rados.Error as e:
+        log.error(f'failed to read sync stat omap: {e}')
+        raise MirrorException(-e.errno, 'failed to read sync stat omap')
+    return metrics
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 237b12a945a..e25a0b19458 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -19,7 +19,10 @@ from mgr_module import NotifyType
 from .blocklist import blocklist
 from .notify import Notifier, InstanceWatcher
 from .utils import INSTANCE_ID_PREFIX, MIRROR_OBJECT_NAME, Finisher, \
-    AsyncOpTracker, connect_to_filesystem, disconnect_from_filesystem
+    AsyncOpTracker, get_metadata_pool, norm_path, connect_to_filesystem, \
+    disconnect_from_filesystem, sync_stat_omap_key
+from .metrics import load as metrics_load
+from .metrics.load import nest_sync_stat_in_metrics
 from .exception import MirrorException
 from .dir_map.create import create_mirror_object
 from .dir_map.load import load_dir_map, load_instances
@@ -313,13 +316,6 @@ class FSSnapshotMirror:
         except ValueError:
             raise MirrorException(-errno.EINVAL, f'invalid cluster spec {spec}')
 
-    @staticmethod
-    def get_metadata_pool(filesystem, fs_map):
-        for fs in fs_map['filesystems']:
-            if fs['mdsmap']['fs_name'] == filesystem:
-                return fs['mdsmap']['metadata_pool']
-        return None
-
     @staticmethod
     def get_filesystem_id(filesystem, fs_map):
         for fs in fs_map['filesystems']:
@@ -483,7 +479,7 @@ class FSSnapshotMirror:
             disconnect_from_filesystem(cluster_name, remote_fs_name, remote_cluster, remote_fs)
 
     def init_pool_policy(self, filesystem):
-        metadata_pool_id = FSSnapshotMirror.get_metadata_pool(filesystem, self.fs_map)
+        metadata_pool_id = get_metadata_pool(filesystem, self.fs_map)
         if not metadata_pool_id:
             log.error(f'cannot find metadata pool-id for filesystem {filesystem}')
             raise Exception(-errno.EINVAL)
@@ -522,7 +518,7 @@ class FSSnapshotMirror:
         log.info(f'enabling mirror for filesystem {filesystem}')
         with self.lock:
             try:
-                metadata_pool_id = FSSnapshotMirror.get_metadata_pool(filesystem, self.fs_map)
+                metadata_pool_id = get_metadata_pool(filesystem, self.fs_map)
                 if not metadata_pool_id:
                     log.error(f'cannot find metadata pool-id for filesystem {filesystem}')
                     raise Exception(-errno.EINVAL)
@@ -690,12 +686,6 @@ class FSSnapshotMirror:
         remote_cluster_spec = f'{client_name}@{cluster_name}'
         return self.peer_add(filesystem, remote_cluster_spec, remote_fs_name, token_dct)
 
-    @staticmethod
-    def norm_path(dir_path):
-        if not os.path.isabs(dir_path):
-            raise MirrorException(-errno.EINVAL, f'{dir_path} should be an absolute path')
-        return os.path.normpath(dir_path)
-
     def add_dir(self, filesystem, dir_path):
         try:
             with self.lock:
@@ -704,7 +694,7 @@ class FSSnapshotMirror:
                 fspolicy = self.pool_policy.get(filesystem, None)
                 if not fspolicy:
                     raise MirrorException(-errno.EINVAL, f'filesystem {filesystem} is not mirrored')
-                dir_path = FSSnapshotMirror.norm_path(dir_path)
+                dir_path = norm_path(dir_path)
                 log.debug(f'path normalized to {dir_path}')
                 fspolicy.add_dir(dir_path)
                 return 0, json.dumps({}), ''
@@ -721,7 +711,7 @@ class FSSnapshotMirror:
                 fspolicy = self.pool_policy.get(filesystem, None)
                 if not fspolicy:
                     raise MirrorException(-errno.EINVAL, f'filesystem {filesystem} is not mirrored')
-                dir_path = FSSnapshotMirror.norm_path(dir_path)
+                dir_path = norm_path(dir_path)
                 fspolicy.remove_dir(dir_path)
                 return 0, json.dumps({}), ''
         except MirrorException as me:
@@ -751,7 +741,7 @@ class FSSnapshotMirror:
                 fspolicy = self.pool_policy.get(filesystem, None)
                 if not fspolicy:
                     raise MirrorException(-errno.EINVAL, f'filesystem {filesystem} is not mirrored')
-                dir_path = FSSnapshotMirror.norm_path(dir_path)
+                dir_path = norm_path(dir_path)
                 return fspolicy.status(dir_path)
         except MirrorException as me:
             return me.args[0], '', me.args[1]
@@ -768,6 +758,53 @@ class FSSnapshotMirror:
         except MirrorException as me:
             return me.args[0], '', me.args[1]
 
+    def metrics_status(self, filesystem, mirrored_dir_path, peer_uuid):
+        """Return persisted mirror directory snapshot metrics as JSON"""
+        try:
+            with self.lock:
+                if not self.filesystem_exist(filesystem):
+                    raise MirrorException(-errno.ENOENT,
+                                          f'filesystem {filesystem} does not exist')
+                fspolicy = self.pool_policy.get(filesystem, None)
+                if not fspolicy:
+                    raise MirrorException(-errno.EINVAL,
+                                          f'filesystem {filesystem} is not mirrored')
+                if mirrored_dir_path:
+                    dir_path = norm_path(mirrored_dir_path)
+                    if not fspolicy.policy.lookup(dir_path):
+                        raise MirrorException(-errno.ENOENT,
+                                              f'directory {dir_path} is not mirrored')
+                peers = self.get_filesystem_peers(filesystem)
+                if not peers:
+                    return 0, json.dumps({}), ''
+
+                if peer_uuid:
+                    if peer_uuid not in peers:
+                        raise MirrorException(-errno.ENOENT,
+                                              f'peer {peer_uuid} not found for '
+                                              f'filesystem {filesystem}')
+                    peers = {peer_uuid: peers[peer_uuid]}
+
+                ioctx = metrics_load.open_metadata_ioctx(
+                    self.rados, self.fs_map, filesystem)
+                if mirrored_dir_path:
+                    dir_path = norm_path(mirrored_dir_path)
+                    keys = [sync_stat_omap_key(filesystem, peer, dir_path)
+                            for peer in peers]
+                    omap_stats = metrics_load.load_sync_stat_by_keys(ioctx, keys)
+                    metrics = {}
+                    for peer in peers:
+                        omap_key = sync_stat_omap_key(filesystem, peer, dir_path)
+                        if omap_key in omap_stats:
+                            nest_sync_stat_in_metrics(metrics, dir_path, peer,
+                                                      omap_stats[omap_key])
+                else:
+                    metrics = metrics_load.load_sync_stat_metrics(
+                        ioctx, filesystem, peer_uuid)
+                return 0, json.dumps(metrics, indent=4), ''
+        except MirrorException as me:
+            return me.args[0], '', me.args[1]
+
     def daemon_status(self, format='json'):
         try:
             with self.lock:
diff --git a/src/pybind/mgr/mirroring/fs/utils.py b/src/pybind/mgr/mirroring/fs/utils.py
index 5e1d0537356..a67e6c06a7f 100644
--- a/src/pybind/mgr/mirroring/fs/utils.py
+++ b/src/pybind/mgr/mirroring/fs/utils.py
@@ -1,5 +1,7 @@
 import errno
+import json
 import logging
+import os
 import threading
 
 import rados
@@ -12,9 +14,43 @@ MIRROR_OBJECT_NAME = MIRROR_OBJECT_PREFIX
 
 INSTANCE_ID_PREFIX = "instance_"
 DIRECTORY_MAP_PREFIX = "dir_map_"
+SYNC_STAT_KEY_PREFIX = "sync_stat"
 
 log = logging.getLogger(__name__)
 
+
+def get_metadata_pool(filesystem, fs_map):
+    for fs in fs_map['filesystems']:
+        if fs['mdsmap']['fs_name'] == filesystem:
+            return fs['mdsmap']['metadata_pool']
+    return None
+
+
+def norm_path(dir_path):
+    if not os.path.isabs(dir_path):
+        raise MirrorException(-errno.EINVAL, f'{dir_path} should be an absolute path')
+    return os.path.normpath(dir_path)
+
+
+def sync_stat_omap_key(filesystem, peer_uuid, dir_path):
+    return (f'{SYNC_STAT_KEY_PREFIX}/{filesystem}/{peer_uuid}/'
+            f'{dir_path.lstrip("/")}')
+
+
+def parse_sync_stat_omap_key(key, filesystem):
+    prefix = f'{SYNC_STAT_KEY_PREFIX}/{filesystem}/'
+    if not key.startswith(prefix):
+        return None
+    suffix = key[len(prefix):]
+    peer_uuid, sep, dir_rel = suffix.partition('/')
+    if not peer_uuid or not sep:
+        return None
+    return peer_uuid, os.path.normpath('/' + dir_rel)
+
+
+def decode_sync_stat_val(val):
+    return json.loads(val.decode('utf-8'))
+
 def connect_to_cluster(client_name, cluster_name, conf_dct, desc=''):
     try:
         log.debug(f'connecting to {desc} cluster: {client_name}/{cluster_name}')
diff --git a/src/pybind/mgr/mirroring/module.py b/src/pybind/mgr/mirroring/module.py
index 4a9813c6df9..1321e27f749 100644
--- a/src/pybind/mgr/mirroring/module.py
+++ b/src/pybind/mgr/mirroring/module.py
@@ -116,3 +116,13 @@ class Module(MgrModule):
                                       format: str = 'json'):
         """Get mirror daemon status"""
         return self.fs_snapshot_mirror.daemon_status(format)
+
+    @MirroringCLICommand.Read('fs snapshot mirror status')
+    def snapshot_mirror_status(self,
+                               fs_name: str,
+                               mirrored_dir_path: Optional[str] = None,
+                               _end_positional_: int = 0,
+                               peer_uuid: Optional[str] = None):
+        """Get snapshot mirror metrics for a filesystem (optional mirrored directory and peer)"""
+        return self.fs_snapshot_mirror.metrics_status(fs_name, mirrored_dir_path,
+                                                      peer_uuid)

From 4c19167719caeab7de059bb1ba983e3f16afb5b3 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Mon, 1 Jun 2026 14:59:31 +0530
Subject: [PATCH 375/596] mgr/mirroring: Reorder and format metrics output

Reorder and format status output to match the output of asok
interface peer_status command. Return metrics under
metrics/<dir>/peer/<uuid> to match the asok peer_status layout,
including {"metrics": {}} when no peers are configured.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/metrics/format.py | 113 ++++++++++++++++++
 src/pybind/mgr/mirroring/fs/metrics/load.py   |   9 +-
 .../mgr/mirroring/fs/snapshot_mirror.py       |  13 +-
 3 files changed, 125 insertions(+), 10 deletions(-)
 create mode 100644 src/pybind/mgr/mirroring/fs/metrics/format.py

diff --git a/src/pybind/mgr/mirroring/fs/metrics/format.py b/src/pybind/mgr/mirroring/fs/metrics/format.py
new file mode 100644
index 00000000000..b208151c167
--- /dev/null
+++ b/src/pybind/mgr/mirroring/fs/metrics/format.py
@@ -0,0 +1,113 @@
+# Matches the format_time function used in peer_status
+def _format_time(total_seconds_d):
+    total_seconds = int(round(total_seconds_d))
+    days = total_seconds // 86400
+    total_seconds %= 86400
+    hours = total_seconds // 3600
+    total_seconds %= 3600
+    minutes = total_seconds // 60
+    seconds = total_seconds % 60
+    if days > 0:
+        return (f'{days}d {hours:02d}h {minutes:02d}m {seconds:02d}s')
+    if hours > 0:
+        return f'{hours}h {minutes:02d}m {seconds:02d}s'
+    if minutes > 0:
+        return f'{minutes}m {seconds:02d}s'
+    return f'{seconds}s'
+
+
+# Matches the format_bytes function used in peer_status
+def _format_bytes(bytes_val):
+    kib = 1024.0
+    mib = kib * 1024.0
+    gib = mib * 1024.0
+    tib = gib * 1024.0
+    pib = tib * 1024.0
+    if bytes_val >= pib:
+        return f'{bytes_val / pib:.2f} PiB'
+    if bytes_val >= tib:
+        return f'{bytes_val / tib:.2f} TiB'
+    if bytes_val >= gib:
+        return f'{bytes_val / gib:.2f} GiB'
+    if bytes_val >= mib:
+        return f'{bytes_val / mib:.2f} MiB'
+    if bytes_val >= kib:
+        return f'{bytes_val / kib:.2f} KiB'
+    return f'{bytes_val:.2f} B'
+
+
+def _order_dict(d, keys):
+    ordered = {}
+    for key in keys:
+        if key in d:
+            ordered[key] = d[key]
+    for key, val in d.items():
+        if key not in ordered:
+            ordered[key] = val
+    return ordered
+
+
+def _order_current_syncing_snap(snap):
+    if not isinstance(snap, dict):
+        return snap
+    snap = dict(snap)
+    crawl = snap.get('crawl')
+    if isinstance(crawl, dict):
+        snap['crawl'] = _order_dict(crawl, ('state', 'duration'))
+    dq_wait = snap.get('datasync_queue_wait')
+    if isinstance(dq_wait, dict):
+        snap['datasync_queue_wait'] = _order_dict(dq_wait, ('state', 'duration'))
+    bytes_obj = snap.get('bytes')
+    if isinstance(bytes_obj, dict):
+        snap['bytes'] = _order_dict(
+            bytes_obj, ('sync_bytes', 'total_bytes', 'sync_percent'))
+    files_obj = snap.get('files')
+    if isinstance(files_obj, dict):
+        snap['files'] = _order_dict(
+            files_obj, ('sync_files', 'total_files', 'sync_percent'))
+    return _order_dict(
+        snap, ('id', 'name', 'sync-mode', 'avg_read_throughput_bytes',
+               'avg_write_throughput_bytes', 'crawl', 'datasync_queue_wait',
+               'bytes', 'files', 'eta'))
+
+
+def format_peer_status_metrics(metrics, dir_path, peer_uuid, stat):
+    metrics.setdefault(dir_path, {}).setdefault('peer', {})[peer_uuid] = stat
+
+
+# to match the output of peer_status
+def format_and_order_sync_stat_for_display(stat):
+    if not isinstance(stat, dict):
+        return stat
+
+    out = dict(stat)
+    last_synced_snap = out.get('last_synced_snap')
+    if isinstance(last_synced_snap, dict):
+        snap = dict(last_synced_snap)
+        for key in ('crawl_duration', 'datasync_queue_wait_duration',
+                    'sync_duration'):
+            val = snap.get(key)
+            if isinstance(val, (int, float)):
+                snap[key] = _format_time(val)
+        sync_bytes = snap.get('sync_bytes')
+        if isinstance(sync_bytes, (int, float)):
+            snap['sync_bytes'] = _format_bytes(sync_bytes)
+        sync_time_stamp = snap.get('sync_time_stamp')
+        if isinstance(sync_time_stamp, (int, float)):
+            snap['sync_time_stamp'] = f'{sync_time_stamp:.6f}s'
+        out['last_synced_snap'] = _order_dict(
+            snap, ('id', 'name', 'crawl_duration',
+                   'datasync_queue_wait_duration', 'sync_duration',
+                   'sync_time_stamp', 'sync_bytes', 'sync_files'))
+
+    current_syncing_snap = out.get('current_syncing_snap')
+    if isinstance(current_syncing_snap, dict):
+        out['current_syncing_snap'] = _order_current_syncing_snap(
+            current_syncing_snap)
+
+    out.pop('_instance_id', None)
+
+    return _order_dict(
+        out, ('state', 'failure_reason', 'current_syncing_snap',
+              'last_synced_snap', 'snaps_synced', 'snaps_deleted',
+              'snaps_renamed', 'metrics_updated_at'))
diff --git a/src/pybind/mgr/mirroring/fs/metrics/load.py b/src/pybind/mgr/mirroring/fs/metrics/load.py
index 8eff6a5c819..f5aed3a28a5 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/load.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/load.py
@@ -14,14 +14,11 @@ from ..utils import (
     get_metadata_pool,
     parse_sync_stat_omap_key,
 )
+from .format import format_and_order_sync_stat_for_display, format_peer_status_metrics
 
 log = logging.getLogger(__name__)
 
 
-def nest_sync_stat_in_metrics(metrics, dir_path, peer_uuid, stat):
-    metrics.setdefault(dir_path, {}).setdefault('peer', {})[peer_uuid] = stat
-
-
 def load_sync_stat_by_keys(ioctx, keys):
     stats: Dict[str, Any] = {}
     if not keys:
@@ -88,7 +85,9 @@ def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None):
                     except (json.JSONDecodeError, UnicodeDecodeError) as e:
                         log.warning(f'failed to decode sync stat for key {key}: {e}')
                         continue
-                    nest_sync_stat_in_metrics(metrics, dir_path, peer, stat)
+                    format_peer_status_metrics(
+                        metrics, dir_path, peer,
+                        format_and_order_sync_stat_for_display(stat))
                 start = omap_vals.popitem()[0]
     except rados.Error as e:
         log.error(f'failed to read sync stat omap: {e}')
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index e25a0b19458..1504b8831ef 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -22,7 +22,8 @@ from .utils import INSTANCE_ID_PREFIX, MIRROR_OBJECT_NAME, Finisher, \
     AsyncOpTracker, get_metadata_pool, norm_path, connect_to_filesystem, \
     disconnect_from_filesystem, sync_stat_omap_key
 from .metrics import load as metrics_load
-from .metrics.load import nest_sync_stat_in_metrics
+from .metrics.format import format_and_order_sync_stat_for_display, \
+    format_peer_status_metrics
 from .exception import MirrorException
 from .dir_map.create import create_mirror_object
 from .dir_map.load import load_dir_map, load_instances
@@ -776,7 +777,7 @@ class FSSnapshotMirror:
                                               f'directory {dir_path} is not mirrored')
                 peers = self.get_filesystem_peers(filesystem)
                 if not peers:
-                    return 0, json.dumps({}), ''
+                    return 0, json.dumps({'metrics': {}}, indent=4), ''
 
                 if peer_uuid:
                     if peer_uuid not in peers:
@@ -796,12 +797,14 @@ class FSSnapshotMirror:
                     for peer in peers:
                         omap_key = sync_stat_omap_key(filesystem, peer, dir_path)
                         if omap_key in omap_stats:
-                            nest_sync_stat_in_metrics(metrics, dir_path, peer,
-                                                      omap_stats[omap_key])
+                            format_peer_status_metrics(
+                                metrics, dir_path, peer,
+                                format_and_order_sync_stat_for_display(
+                                    omap_stats[omap_key]))
                 else:
                     metrics = metrics_load.load_sync_stat_metrics(
                         ioctx, filesystem, peer_uuid)
-                return 0, json.dumps(metrics, indent=4), ''
+                return 0, json.dumps({'metrics': metrics}, indent=4), ''
         except MirrorException as me:
             return me.args[0], '', me.args[1]
 

From 8647c2ee79649b002c23bfb88757955640f886ce Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 16 Jun 2026 16:12:41 +0530
Subject: [PATCH 376/596] mgr/mirroring: cache fs snapshot mirror status omap
 metrics

Add a short-lived in-memory cache for metrics returned by
"ceph fs snapshot mirror status", which reads persisted sync stats
from the cephfs_mirror object omap. Omap walks are relatively
expensive; caching reduces repeated reads when the CLI or multiple
clients poll at short intervals.

Two TTL-bucketed LRU caches (CACHE_TTL_SECS) are used instead of one
unified cache. The complete cache always holds every mirrored
directory and peer for a filesystem; the partial cache holds one
directory. A single directory-granularity cache cannot prove it has
all directories, so full-scan queries rely on the complete cache
contract.

Cache implementation (lru_cache_timeout decorator backed by
_TimedLRUCache, not functools.lru_cache):

- lru_cache has no TTL and no peek-on-hit API. Single-directory
  queries must read the complete cache without loading on miss;
  lru_cache.cache is also unavailable on Python 3.14+.

- complete (sync_stat_complete_cache): full omap prefix scan via
  load_sync_stat_metrics. Cache key: (time_token, filesystem).
  COMPLETE_CACHE_MAX limits filesystem entries per TTL window.

- partial (sync_stat_partial_cache): per-directory omap key load via
  fetch_sync_stat_metrics. Cache key: (time_token, filesystem,
  dir_path, peer_ids). PARTIAL_CACHE_MAX limits directory entries.

Bind cache_peek/cache_info/cache_clear via a CachedMethod descriptor
so TTL lookups receive (self, ...); otherwise single-dir status fails
with 'str' object has no attribute 'mgr'.

Serve logic (under the existing lock):

- status <fs> [--peer_uuid=<uuid>]: load complete cache on miss;
  filter by peer when requested.

- status <fs> <dir>: peek complete cache (no load on miss); if the
  entry contains the directory and peers, serve from complete.
  Otherwise load partial cache (omap on miss).

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/metrics/cache.py  | 202 ++++++++++++++++++
 src/pybind/mgr/mirroring/fs/metrics/load.py   |  21 ++
 .../mgr/mirroring/fs/snapshot_mirror.py       | 126 +++++++++--
 3 files changed, 326 insertions(+), 23 deletions(-)
 create mode 100644 src/pybind/mgr/mirroring/fs/metrics/cache.py

diff --git a/src/pybind/mgr/mirroring/fs/metrics/cache.py b/src/pybind/mgr/mirroring/fs/metrics/cache.py
new file mode 100644
index 00000000000..0fcfdbd7e45
--- /dev/null
+++ b/src/pybind/mgr/mirroring/fs/metrics/cache.py
@@ -0,0 +1,202 @@
+from collections import OrderedDict, namedtuple
+from functools import wraps
+from typing import Any, Callable, Dict
+
+import time
+
+from ..utils import norm_path
+from .format import format_and_order_sync_stat_for_display, format_peer_status_metrics
+
+# Two caches are used instead of one unified cache:
+#
+# - Complete cache holds a full omap snapshot (all dirs, all peers) per
+#   filesystem. A hit guarantees the entry is complete, so full-scan queries
+#   ('status <fs>', 'status <fs> <peer>') can be served without doubt.
+#
+# - Partial cache holds per-directory omap loads. Single-dir queries
+#   ('status <fs> <dir>') peek the complete cache first; on miss they use
+#   partial cache to avoid a full omap scan.
+#
+# A single cache keyed at directory granularity cannot cleanly answer "do I
+# have every directory?" — partial entries may be present while others are
+# missing, so serving a full scan from cache would require extra bookkeeping
+# to prove completeness. Splitting complete vs partial makes that contract
+# explicit: complete = all dirs; partial = one dir.
+
+# LRU max entries for complete-cache lookups (one entry per filesystem per TTL
+# window; each entry holds all dirs and all peers for that filesystem).
+# Cache key: (time_token, filesystem).
+COMPLETE_CACHE_MAX = 8
+# LRU max entries for partial-cache lookups (per-directory omap batch load).
+# Cache key: (time_token, filesystem, dir_path, peer_ids).
+PARTIAL_CACHE_MAX = 32
+
+CacheInfo = namedtuple('CacheInfo', ['hits', 'misses', 'maxsize', 'currsize'])
+
+
+# functools.lru_cache is not sufficient here for two reasons:
+#
+# 1. TTL: entries must expire after snapshot_mirror_metrics_cache_ttl. lru_cache
+#    has no TTL, so we bucket keys with a time_token derived from monotonic time.
+#
+# 2. cache_peek: single-directory status queries must read the complete cache
+#    without loading on miss (otherwise a cold complete cache would trigger a
+#    full omap scan). lru_cache has no peek API; calling the wrapper always
+#    invokes the loader on miss. Inspecting lru_cache.cache for a hit-only
+#    lookup is also not viable: that attribute is not part of the public API and
+#    is unavailable on Python 3.14+ (_lru_cache_wrapper has no .cache).
+#
+# _TimedLRUCache therefore implements TTL-bucketed LRU storage plus peek().
+class _TimedLRUCache:
+    def __init__(self, func, maxsize):
+        self.func = func
+        self.maxsize = maxsize
+        self.store = OrderedDict()
+        self.hits = 0
+        self.misses = 0
+
+    def _key(self, time_token, args):
+        # time_token buckets entries by snapshot_mirror_metrics_cache_ttl; args are
+        # the decorated method's positional arguments (e.g. filesystem, or
+        # filesystem+dir+peers).
+        return (time_token,) + args
+
+    def get(self, time_token, args, load=True):
+        key = self._key(time_token, args)
+        if key in self.store:
+            self.hits += 1
+            self.store.move_to_end(key)
+            return self.store[key]
+        if not load:
+            return None
+        self.misses += 1
+        val = self.func(*args)
+        self.store[key] = val
+        while len(self.store) > self.maxsize:
+            self.store.popitem(last=False)
+        return val
+
+    def peek(self, time_token, args):
+        return self.get(time_token, args, load=False)
+
+    def clear(self):
+        self.store.clear()
+        self.hits = 0
+        self.misses = 0
+
+    def info(self):
+        return CacheInfo(self.hits, self.misses, self.maxsize, len(self.store))
+
+
+def _resolve_ttl(ttl_getter, args, kwargs):
+    try:
+        return ttl_getter(*args, **kwargs)
+    except TypeError:
+        return ttl_getter()
+
+
+def lru_cache_timeout(ttl_getter: Callable[..., int], maxsize: int = 128):
+    def decorator(func):
+        cache = _TimedLRUCache(func, maxsize)
+
+        # BoundCached is returned from CachedMethod.__get__ so cache_peek,
+        # cache_info, and cache_clear are bound to the instance. Attaching
+        # those helpers to a plain wrapper function would drop self (e.g.
+        # self.sync_stat_complete_cache.cache_peek(fs) would pass only fs),
+        # breaking ttl_getter lambdas that use self.mgr.
+        class BoundCached:
+            def __init__(self, instance):
+                self._instance = instance
+
+            def _full_args(self, *args):
+                return (self._instance,) + args
+
+            def __call__(self, *args, **kwargs):
+                full = self._full_args(*args)
+                ttl = _resolve_ttl(ttl_getter, full, kwargs)
+                if not ttl:
+                    return func(*full, **kwargs)
+                time_token = int(time.monotonic() / ttl)
+                return cache.get(time_token, full)
+
+            def cache_peek(self, *args, **kwargs):
+                full = self._full_args(*args)
+                ttl = _resolve_ttl(ttl_getter, full, kwargs)
+                if not ttl:
+                    return None
+                time_token = int(time.monotonic() / ttl)
+                return cache.peek(time_token, full)
+
+            def cache_clear(self):
+                cache.clear()
+
+            def cache_info(self):
+                return cache.info()
+
+        # Descriptor: self.method(...) and self.method.cache_peek(...) share
+        # the same BoundCached instance and cache keys.
+        class CachedMethod:
+            def __get__(self, obj, owner=None):
+                if obj is None:
+                    return self
+                return BoundCached(obj)
+
+            def __call__(self, *args, **kwargs):
+                ttl = _resolve_ttl(ttl_getter, args, kwargs)
+                if not ttl:
+                    return func(*args, **kwargs)
+                time_token = int(time.monotonic() / ttl)
+                return cache.get(time_token, args)
+
+        cached = CachedMethod()
+        wraps(func)(cached)
+        return cached
+    return decorator
+
+
+def _peer_stats_for_dir(metrics, dir_path):
+    return metrics.get(dir_path, {}).get('peer', {})
+
+
+def _requested_peers_have_stats(metrics, peers, dir_path):
+    peer_stats = _peer_stats_for_dir(metrics, dir_path)
+    return all(peer in peer_stats for peer in peers)
+
+
+def metrics_for_dir_and_peers(metrics, dir_path, peers):
+    result: Dict[str, Any] = {}
+    peer_stats = _peer_stats_for_dir(metrics, dir_path)
+    for peer in peers:
+        if peer in peer_stats:
+            format_peer_status_metrics(
+                result, dir_path, peer,
+                format_and_order_sync_stat_for_display(peer_stats[peer]))
+    return result
+
+
+def metrics_for_peer(metrics, peer_uuid):
+    result: Dict[str, Any] = {}
+    for dir_path, dir_entry in metrics.items():
+        peer_stats = dir_entry.get('peer', {})
+        if peer_uuid in peer_stats:
+            format_peer_status_metrics(
+                result, dir_path, peer_uuid,
+                format_and_order_sync_stat_for_display(peer_stats[peer_uuid]))
+    return result
+
+
+def try_get_from_complete(metrics, mirrored_dir_path, peer_uuid, peers):
+    """Filter complete cache (all dirs, all peers) for the CLI request.
+
+    The complete cache always holds every peer and directory. peer_uuid and
+    peers select the subset to return; they do not affect what is loaded.
+    """
+    if mirrored_dir_path:
+        dir_path = norm_path(mirrored_dir_path)
+        if _requested_peers_have_stats(metrics, peers, dir_path):
+            return metrics_for_dir_and_peers(metrics, dir_path, peers)
+        return None
+
+    if peer_uuid is None:
+        return dict(metrics)
+    return metrics_for_peer(metrics, peer_uuid)
diff --git a/src/pybind/mgr/mirroring/fs/metrics/load.py b/src/pybind/mgr/mirroring/fs/metrics/load.py
index f5aed3a28a5..d157b36b7c2 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/load.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/load.py
@@ -12,7 +12,9 @@ from ..utils import (
     SYNC_STAT_KEY_PREFIX,
     decode_sync_stat_val,
     get_metadata_pool,
+    norm_path,
     parse_sync_stat_omap_key,
+    sync_stat_omap_key,
 )
 from .format import format_and_order_sync_stat_for_display, format_peer_status_metrics
 
@@ -93,3 +95,22 @@ def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None):
         log.error(f'failed to read sync stat omap: {e}')
         raise MirrorException(-e.errno, 'failed to read sync stat omap')
     return metrics
+
+
+def fetch_sync_stat_metrics(ioctx, filesystem, peers, mirrored_dir_path, peer_uuid):
+    if mirrored_dir_path:
+        dir_path = norm_path(mirrored_dir_path)
+        keys = [sync_stat_omap_key(filesystem, peer, dir_path) for peer in peers]
+        omap_stats = load_sync_stat_by_keys(ioctx, keys)
+        metrics: Dict[str, Any] = {}
+        for peer in peers:
+            omap_key = sync_stat_omap_key(filesystem, peer, dir_path)
+            stat = omap_stats.get(omap_key)
+            if stat is not None:
+                format_peer_status_metrics(
+                    metrics, dir_path, peer,
+                    format_and_order_sync_stat_for_display(stat))
+        return metrics, False, dir_path
+
+    metrics = load_sync_stat_metrics(ioctx, filesystem, peer_uuid)
+    return metrics, True, None
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 1504b8831ef..2b1fa76425e 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -20,10 +20,11 @@ from .blocklist import blocklist
 from .notify import Notifier, InstanceWatcher
 from .utils import INSTANCE_ID_PREFIX, MIRROR_OBJECT_NAME, Finisher, \
     AsyncOpTracker, get_metadata_pool, norm_path, connect_to_filesystem, \
-    disconnect_from_filesystem, sync_stat_omap_key
+    disconnect_from_filesystem
+from .metrics.cache import (
+    CACHE_TTL_SECS, COMPLETE_CACHE_MAX, lru_cache_timeout, PARTIAL_CACHE_MAX,
+    metrics_for_dir_and_peers, try_get_from_complete)
 from .metrics import load as metrics_load
-from .metrics.format import format_and_order_sync_stat_for_display, \
-    format_peer_status_metrics
 from .exception import MirrorException
 from .dir_map.create import create_mirror_object
 from .dir_map.load import load_dir_map, load_instances
@@ -759,8 +760,52 @@ class FSSnapshotMirror:
         except MirrorException as me:
             return me.args[0], '', me.args[1]
 
+    @lru_cache_timeout(
+        lambda self, *_args, **_kwargs: CACHE_TTL_SECS,
+        COMPLETE_CACHE_MAX)
+    def sync_stat_complete_cache(self, filesystem):
+        """Load all directories and all peers for a filesystem from omap.
+
+        Cache key: (time_token, filesystem). Each entry stores the full omap
+        snapshot for that filesystem (all dirs, all peers). A hit means every
+        directory is present, so full-scan queries can be served safely.
+        Used for 'status <fs>' and 'status <fs> --peer_uuid=<uuid>'; peer
+        filtering is applied when serving.
+        """
+        log.debug('sync stat metrics for filesystem %s loaded from omap (complete)',
+                  filesystem)
+        ioctx = metrics_load.open_metadata_ioctx(
+            self.rados, self.fs_map, filesystem)
+        return metrics_load.load_sync_stat_metrics(ioctx, filesystem)
+
+    @lru_cache_timeout(
+        lambda self, *_args, **_kwargs: CACHE_TTL_SECS,
+        PARTIAL_CACHE_MAX)
+    def sync_stat_partial_cache(self, filesystem, dir_path, peer_ids):
+        """Load sync-stat omap keys for one directory and a peer set.
+
+        Cache key: (time_token, filesystem, dir_path, peer_ids). Used as a
+        fallback for 'status <fs> <dir>' when the complete cache is cold or
+        does not contain the requested directory.
+        """
+        peer_scope = (next(iter(peer_ids)) if len(peer_ids) == 1 else '*')
+        log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                  'loaded from omap',
+                  filesystem, dir_path, peer_scope)
+        peers = {peer_id: None for peer_id in peer_ids}
+        ioctx = metrics_load.open_metadata_ioctx(
+            self.rados, self.fs_map, filesystem)
+        metrics, _, _ = metrics_load.fetch_sync_stat_metrics(
+            ioctx, filesystem, peers, dir_path, None)
+        return metrics
+
     def metrics_status(self, filesystem, mirrored_dir_path, peer_uuid):
-        """Return persisted mirror directory snapshot metrics as JSON"""
+        """Return persisted mirror directory snapshot metrics as JSON.
+
+        Uses two caches (see metrics/cache.py): complete for full-scan queries
+        where a hit proves all dirs are present; partial for single-dir
+        queries when the complete cache is cold or lacks that directory.
+        """
         try:
             with self.lock:
                 if not self.filesystem_exist(filesystem):
@@ -775,35 +820,70 @@ class FSSnapshotMirror:
                     if not fspolicy.policy.lookup(dir_path):
                         raise MirrorException(-errno.ENOENT,
                                               f'directory {dir_path} is not mirrored')
-                peers = self.get_filesystem_peers(filesystem)
-                if not peers:
+                all_peers = self.get_filesystem_peers(filesystem)
+                if not all_peers:
                     return 0, json.dumps({'metrics': {}}, indent=4), ''
 
                 if peer_uuid:
-                    if peer_uuid not in peers:
+                    if peer_uuid not in all_peers:
                         raise MirrorException(-errno.ENOENT,
                                               f'peer {peer_uuid} not found for '
                                               f'filesystem {filesystem}')
-                    peers = {peer_uuid: peers[peer_uuid]}
+                    requested_peers = {peer_uuid: all_peers[peer_uuid]}
+                else:
+                    requested_peers = all_peers
 
-                ioctx = metrics_load.open_metadata_ioctx(
-                    self.rados, self.fs_map, filesystem)
                 if mirrored_dir_path:
                     dir_path = norm_path(mirrored_dir_path)
-                    keys = [sync_stat_omap_key(filesystem, peer, dir_path)
-                            for peer in peers]
-                    omap_stats = metrics_load.load_sync_stat_by_keys(ioctx, keys)
-                    metrics = {}
-                    for peer in peers:
-                        omap_key = sync_stat_omap_key(filesystem, peer, dir_path)
-                        if omap_key in omap_stats:
-                            format_peer_status_metrics(
-                                metrics, dir_path, peer,
-                                format_and_order_sync_stat_for_display(
-                                    omap_stats[omap_key]))
+                    # Single-dir query: peek complete cache (key: filesystem
+                    # only); on miss fall back to partial cache (key:
+                    # filesystem, dir_path, peer_ids).
+                    complete_metrics = self.sync_stat_complete_cache.cache_peek(
+                        filesystem)
+                    if complete_metrics is not None:
+                        metrics = try_get_from_complete(
+                            complete_metrics, mirrored_dir_path, peer_uuid,
+                            requested_peers)
+                        if metrics is not None:
+                            log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                                      'served from complete cache',
+                                      filesystem, dir_path, peer_uuid or '*')
+                            return 0, json.dumps({'metrics': metrics}, indent=4), ''
+
+                    partial_info_before = self.sync_stat_partial_cache.cache_info()
+                    raw_metrics = self.sync_stat_partial_cache(
+                        filesystem, dir_path, frozenset(requested_peers))
+                    if (self.sync_stat_partial_cache.cache_info().hits >
+                            partial_info_before.hits):
+                        log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                                  'served from partial cache',
+                                  filesystem, dir_path, peer_uuid or '*')
+                    else:
+                        log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                                  'loaded from omap',
+                                  filesystem, dir_path, peer_uuid or '*')
+                    metrics = metrics_for_dir_and_peers(
+                        raw_metrics, dir_path, requested_peers)
+                    return 0, json.dumps({'metrics': metrics}, indent=4), ''
+
+                # Full-scan query: load complete cache on miss (key: filesystem
+                # only); peer filtering is applied when serving.
+                complete_info_before = self.sync_stat_complete_cache.cache_info()
+                complete_metrics = self.sync_stat_complete_cache(filesystem)
+                complete_hit = (self.sync_stat_complete_cache.cache_info().hits >
+                                complete_info_before.hits)
+                metrics = try_get_from_complete(
+                    complete_metrics, mirrored_dir_path, peer_uuid, requested_peers)
+                if complete_hit:
+                    log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                              'served from complete cache',
+                              filesystem, mirrored_dir_path or '*',
+                              peer_uuid or '*')
                 else:
-                    metrics = metrics_load.load_sync_stat_metrics(
-                        ioctx, filesystem, peer_uuid)
+                    log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                              'loaded from omap',
+                              filesystem, mirrored_dir_path or '*',
+                              peer_uuid or '*')
                 return 0, json.dumps({'metrics': metrics}, indent=4), ''
         except MirrorException as me:
             return me.args[0], '', me.args[1]

From 15e998b865b99b3091054321cf0fdf6df9f327ab Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sun, 21 Jun 2026 22:58:38 +0530
Subject: [PATCH 377/596] mgr/mirroring: detect stale snapshot mirror sync
 metrics in omap

Persisted metrics in the cephfs_mirror omap can outlive the writing
daemon when cephfs-mirror stops or a directory is reshuffled to another
instance; mgr would keep reporting stale progress until the owning
daemon writes again.

Extend format_and_order_sync_stat_for_display() to compare persisted
_instance_id against InstanceWatcher live instances (via
FSPolicy.get_live_instance_ids()) and the directory's tracked instance
(via Policy.get_tracked_instance_id()). Mark metrics stale when the
persisted writer is no longer live (any state), or when it does not
match the tracked instance while persisted state is not "idle". Show
state "stale" with current_syncing_snap omitted.

Pass policy and live instance ids through load_sync_stat_metrics() and
fetch_sync_stat_metrics(), and into sync_stat_complete_cache and
sync_stat_partial_cache loaders. Cache hits serve already-formatted
(stale-marked) entries until TTL expiry without re-checking instance
liveness.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/dir_map/policy.py |  6 ++++
 src/pybind/mgr/mirroring/fs/metrics/format.py | 36 +++++++++++++++++--
 src/pybind/mgr/mirroring/fs/metrics/load.py   | 15 +++++---
 .../mgr/mirroring/fs/snapshot_mirror.py       | 16 +++++++--
 4 files changed, 64 insertions(+), 9 deletions(-)

diff --git a/src/pybind/mgr/mirroring/fs/dir_map/policy.py b/src/pybind/mgr/mirroring/fs/dir_map/policy.py
index aef90b55fe5..da61bec940b 100644
--- a/src/pybind/mgr/mirroring/fs/dir_map/policy.py
+++ b/src/pybind/mgr/mirroring/fs/dir_map/policy.py
@@ -105,6 +105,12 @@ class Policy:
                         'purging': dir_state.purging}
             return None
 
+    def get_tracked_instance_id(self, dir_path):
+        lookup = self.lookup(dir_path)
+        if not lookup:
+            return None
+        return lookup.get('instance_id')
+
     def map(self, dir_path, dir_state):
         log.debug(f'mapping {dir_path}')
         min_instance_id = None
diff --git a/src/pybind/mgr/mirroring/fs/metrics/format.py b/src/pybind/mgr/mirroring/fs/metrics/format.py
index b208151c167..87fc6c4a86a 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/format.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/format.py
@@ -75,12 +75,44 @@ def format_peer_status_metrics(metrics, dir_path, peer_uuid, stat):
     metrics.setdefault(dir_path, {}).setdefault('peer', {})[peer_uuid] = stat
 
 
+def _mark_sync_stat_stale(stat):
+    out = dict(stat)
+    out.pop('current_syncing_snap', None)
+    out['state'] = 'stale'
+    return out
+
+
+def _apply_stale_sync_metrics(stat, policy=None, dir_path=None,
+                              live_instance_ids=None):
+    if not isinstance(stat, dict) or policy is None or dir_path is None:
+        return stat
+
+    persisted_instance_id = stat.get('_instance_id')
+    if persisted_instance_id is None:
+        return stat
+
+    persisted_id = str(persisted_instance_id)
+    if (live_instance_ids is not None and
+            persisted_id not in live_instance_ids):
+        return _mark_sync_stat_stale(stat)
+
+    tracked_id = policy.get_tracked_instance_id(dir_path)
+    if tracked_id is not None:
+        tracked_id = str(tracked_id)
+    if (tracked_id != persisted_id and
+            stat.get('state') != 'idle'):
+        return _mark_sync_stat_stale(stat)
+    return stat
+
+
 # to match the output of peer_status
-def format_and_order_sync_stat_for_display(stat):
+def format_and_order_sync_stat_for_display(stat, policy=None, dir_path=None,
+                                           live_instance_ids=None):
     if not isinstance(stat, dict):
         return stat
 
-    out = dict(stat)
+    out = dict(_apply_stale_sync_metrics(
+        stat, policy, dir_path, live_instance_ids))
     last_synced_snap = out.get('last_synced_snap')
     if isinstance(last_synced_snap, dict):
         snap = dict(last_synced_snap)
diff --git a/src/pybind/mgr/mirroring/fs/metrics/load.py b/src/pybind/mgr/mirroring/fs/metrics/load.py
index d157b36b7c2..dc7682fa707 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/load.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/load.py
@@ -57,7 +57,8 @@ def open_metadata_ioctx(rados_inst, fs_map, filesystem):
                               f'failed to open metadata pool for {filesystem}')
 
 
-def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None):
+def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None, policy=None,
+                           live_instance_ids=None):
     metrics: Dict[str, Any] = {}
     prefix = f'{SYNC_STAT_KEY_PREFIX}/{filesystem}/'
     if peer_uuid:
@@ -89,7 +90,8 @@ def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None):
                         continue
                     format_peer_status_metrics(
                         metrics, dir_path, peer,
-                        format_and_order_sync_stat_for_display(stat))
+                        format_and_order_sync_stat_for_display(
+                            stat, policy, dir_path, live_instance_ids))
                 start = omap_vals.popitem()[0]
     except rados.Error as e:
         log.error(f'failed to read sync stat omap: {e}')
@@ -97,7 +99,8 @@ def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None):
     return metrics
 
 
-def fetch_sync_stat_metrics(ioctx, filesystem, peers, mirrored_dir_path, peer_uuid):
+def fetch_sync_stat_metrics(ioctx, filesystem, peers, mirrored_dir_path,
+                            peer_uuid, policy=None, live_instance_ids=None):
     if mirrored_dir_path:
         dir_path = norm_path(mirrored_dir_path)
         keys = [sync_stat_omap_key(filesystem, peer, dir_path) for peer in peers]
@@ -109,8 +112,10 @@ def fetch_sync_stat_metrics(ioctx, filesystem, peers, mirrored_dir_path, peer_uu
             if stat is not None:
                 format_peer_status_metrics(
                     metrics, dir_path, peer,
-                    format_and_order_sync_stat_for_display(stat))
+                    format_and_order_sync_stat_for_display(
+                        stat, policy, dir_path, live_instance_ids))
         return metrics, False, dir_path
 
-    metrics = load_sync_stat_metrics(ioctx, filesystem, peer_uuid)
+    metrics = load_sync_stat_metrics(
+        ioctx, filesystem, peer_uuid, policy, live_instance_ids)
     return metrics, True, None
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 2b1fa76425e..5c6a1230d31 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -66,6 +66,13 @@ class FSPolicy:
     def schedule_action(self, dir_paths):
         self.dir_paths.extend(dir_paths)
 
+    def get_live_instance_ids(self):
+        watcher = self.instance_watcher
+        if watcher is None:
+            return None
+        with watcher.lock:
+            return frozenset(str(instance_id) for instance_id in watcher.instances)
+
     def init(self, dir_mapping, instances):
         with self.lock:
             self.policy.init(dir_mapping)
@@ -774,9 +781,12 @@ class FSSnapshotMirror:
         """
         log.debug('sync stat metrics for filesystem %s loaded from omap (complete)',
                   filesystem)
+        fspolicy = self.pool_policy[filesystem]
         ioctx = metrics_load.open_metadata_ioctx(
             self.rados, self.fs_map, filesystem)
-        return metrics_load.load_sync_stat_metrics(ioctx, filesystem)
+        return metrics_load.load_sync_stat_metrics(
+            ioctx, filesystem, None, fspolicy.policy,
+            fspolicy.get_live_instance_ids())
 
     @lru_cache_timeout(
         lambda self, *_args, **_kwargs: CACHE_TTL_SECS,
@@ -793,10 +803,12 @@ class FSSnapshotMirror:
                   'loaded from omap',
                   filesystem, dir_path, peer_scope)
         peers = {peer_id: None for peer_id in peer_ids}
+        fspolicy = self.pool_policy[filesystem]
         ioctx = metrics_load.open_metadata_ioctx(
             self.rados, self.fs_map, filesystem)
         metrics, _, _ = metrics_load.fetch_sync_stat_metrics(
-            ioctx, filesystem, peers, dir_path, None)
+            ioctx, filesystem, peers, dir_path, None,
+            fspolicy.policy, fspolicy.get_live_instance_ids())
         return metrics
 
     def metrics_status(self, filesystem, mirrored_dir_path, peer_uuid):

From c24b8d3cc2fb36ea77276598a2d1c2f90b1304ec Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sun, 21 Jun 2026 23:05:30 +0530
Subject: [PATCH 378/596] mgr/mirroring: Show default stats on newly added
 dir_root

When the directory is added for mirroring and the snapshot
is not taken yet, the peer_status show the following default
metrics.

{
  'state': 'idle',
  'snaps_synced': 0,
  'snaps_deleted': 0,
  'snaps_renamed': 0,
}

The mgr interface should also match that.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/metrics/format.py |  9 +++++
 src/pybind/mgr/mirroring/fs/metrics/load.py   | 40 +++++++++++++++----
 .../mgr/mirroring/fs/snapshot_mirror.py       |  3 +-
 3 files changed, 43 insertions(+), 9 deletions(-)

diff --git a/src/pybind/mgr/mirroring/fs/metrics/format.py b/src/pybind/mgr/mirroring/fs/metrics/format.py
index 87fc6c4a86a..943eeb14e2c 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/format.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/format.py
@@ -1,3 +1,12 @@
+def default_sync_stat_metrics():
+    return {
+        'state': 'idle',
+        'snaps_synced': 0,
+        'snaps_deleted': 0,
+        'snaps_renamed': 0,
+    }
+
+
 # Matches the format_time function used in peer_status
 def _format_time(total_seconds_d):
     total_seconds = int(round(total_seconds_d))
diff --git a/src/pybind/mgr/mirroring/fs/metrics/load.py b/src/pybind/mgr/mirroring/fs/metrics/load.py
index dc7682fa707..8b2ae3641ae 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/load.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/load.py
@@ -16,7 +16,11 @@ from ..utils import (
     parse_sync_stat_omap_key,
     sync_stat_omap_key,
 )
-from .format import format_and_order_sync_stat_for_display, format_peer_status_metrics
+from .format import (
+    default_sync_stat_metrics,
+    format_and_order_sync_stat_for_display,
+    format_peer_status_metrics,
+)
 
 log = logging.getLogger(__name__)
 
@@ -57,8 +61,23 @@ def open_metadata_ioctx(rados_inst, fs_map, filesystem):
                               f'failed to open metadata pool for {filesystem}')
 
 
+def _fill_missing_sync_stat_defaults(metrics, dir_paths, peers, policy,
+                                     live_instance_ids, peer_uuid=None):
+    default_stat = default_sync_stat_metrics()
+    for dir_path in dir_paths:
+        for peer in peers:
+            if peer_uuid is not None and peer != peer_uuid:
+                continue
+            if metrics.get(dir_path, {}).get('peer', {}).get(peer) is not None:
+                continue
+            format_peer_status_metrics(
+                metrics, dir_path, peer,
+                format_and_order_sync_stat_for_display(
+                    default_stat, policy, dir_path, live_instance_ids))
+
+
 def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None, policy=None,
-                           live_instance_ids=None):
+                           live_instance_ids=None, peers=None):
     metrics: Dict[str, Any] = {}
     prefix = f'{SYNC_STAT_KEY_PREFIX}/{filesystem}/'
     if peer_uuid:
@@ -96,6 +115,11 @@ def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None, policy=None,
     except rados.Error as e:
         log.error(f'failed to read sync stat omap: {e}')
         raise MirrorException(-e.errno, 'failed to read sync stat omap')
+    if policy is not None and peers:
+        with policy.lock:
+            dir_paths = list(policy.dir_states.keys())
+        _fill_missing_sync_stat_defaults(
+            metrics, dir_paths, peers, policy, live_instance_ids, peer_uuid)
     return metrics
 
 
@@ -106,14 +130,14 @@ def fetch_sync_stat_metrics(ioctx, filesystem, peers, mirrored_dir_path,
         keys = [sync_stat_omap_key(filesystem, peer, dir_path) for peer in peers]
         omap_stats = load_sync_stat_by_keys(ioctx, keys)
         metrics: Dict[str, Any] = {}
+        default_stat = default_sync_stat_metrics()
         for peer in peers:
             omap_key = sync_stat_omap_key(filesystem, peer, dir_path)
-            stat = omap_stats.get(omap_key)
-            if stat is not None:
-                format_peer_status_metrics(
-                    metrics, dir_path, peer,
-                    format_and_order_sync_stat_for_display(
-                        stat, policy, dir_path, live_instance_ids))
+            stat = omap_stats.get(omap_key, default_stat)
+            format_peer_status_metrics(
+                metrics, dir_path, peer,
+                format_and_order_sync_stat_for_display(
+                    stat, policy, dir_path, live_instance_ids))
         return metrics, False, dir_path
 
     metrics = load_sync_stat_metrics(
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 5c6a1230d31..ec7e838af52 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -786,7 +786,8 @@ class FSSnapshotMirror:
             self.rados, self.fs_map, filesystem)
         return metrics_load.load_sync_stat_metrics(
             ioctx, filesystem, None, fspolicy.policy,
-            fspolicy.get_live_instance_ids())
+            fspolicy.get_live_instance_ids(),
+            self.get_filesystem_peers(filesystem))
 
     @lru_cache_timeout(
         lambda self, *_args, **_kwargs: CACHE_TTL_SECS,

From a7325bafb9ab29f17f45e4c14db56a86632d0ff1 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sun, 21 Jun 2026 23:18:15 +0530
Subject: [PATCH 379/596] mgr/mirroring: handle missing cephfs_mirror object in
 metrics status

When snapshot mirroring is not enabled for a filesystem, the
cephfs_mirror RADOS object does not exist and "ceph fs snapshot mirror
status" fails reading sync stat omap. Map rados ENOENT to a clear
MirrorException so the CLI reports that snapshot mirroring must be
enabled instead of a generic omap read failure or an uncaught exception.

Also catch unexpected errors in metrics_status like other mirror CLI
handlers, so the mgr module does not crash on failure. Return
-errno.EINVAL from the generic error path instead of the exception
message as exit code.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/metrics/load.py   | 20 +++++++++++++++----
 .../mgr/mirroring/fs/snapshot_mirror.py       |  3 +++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/pybind/mgr/mirroring/fs/metrics/load.py b/src/pybind/mgr/mirroring/fs/metrics/load.py
index 8b2ae3641ae..3b7a275f5ce 100644
--- a/src/pybind/mgr/mirroring/fs/metrics/load.py
+++ b/src/pybind/mgr/mirroring/fs/metrics/load.py
@@ -24,6 +24,20 @@ from .format import (
 
 log = logging.getLogger(__name__)
 
+MIRROR_OBJECT_NOT_FOUND_MSG = (
+    'cephfs_mirror object not found; enable snapshot mirroring with '
+    '"ceph fs snapshot mirror enable <fs_name>"')
+
+
+def _raise_on_sync_stat_read_error(err):
+    if isinstance(err, rados.Error) and err.errno == errno.ENOENT:
+        raise MirrorException(-errno.ENOENT, MIRROR_OBJECT_NOT_FOUND_MSG)
+    if isinstance(err, rados.Error):
+        log.error(f'failed to read sync stat omap: {err}')
+        err_no = err.errno if err.errno is not None else errno.EINVAL
+        raise MirrorException(-err_no, 'failed to read sync stat omap')
+    raise err
+
 
 def load_sync_stat_by_keys(ioctx, keys):
     stats: Dict[str, Any] = {}
@@ -43,8 +57,7 @@ def load_sync_stat_by_keys(ioctx, keys):
                 except (json.JSONDecodeError, UnicodeDecodeError) as e:
                     log.warning(f'failed to decode sync stat for key {key}: {e}')
     except rados.Error as e:
-        log.error(f'failed to read sync stat omap keys: {e}')
-        raise MirrorException(-e.errno, 'failed to read sync stat omap keys')
+        _raise_on_sync_stat_read_error(e)
     return stats
 
 
@@ -113,8 +126,7 @@ def load_sync_stat_metrics(ioctx, filesystem, peer_uuid=None, policy=None,
                             stat, policy, dir_path, live_instance_ids))
                 start = omap_vals.popitem()[0]
     except rados.Error as e:
-        log.error(f'failed to read sync stat omap: {e}')
-        raise MirrorException(-e.errno, 'failed to read sync stat omap')
+        _raise_on_sync_stat_read_error(e)
     if policy is not None and peers:
         with policy.lock:
             dir_paths = list(policy.dir_states.keys())
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index ec7e838af52..dc7f45c32c2 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -900,6 +900,9 @@ class FSSnapshotMirror:
                 return 0, json.dumps({'metrics': metrics}, indent=4), ''
         except MirrorException as me:
             return me.args[0], '', me.args[1]
+        except Exception as e:
+            log.error(f'failed to get snapshot mirror metrics: {e}')
+            return -errno.EINVAL, '', 'failed to get snapshot mirror metrics'
 
     def daemon_status(self, format='json'):
         try:

From e36faf8bcca5afd6ab4454751fb1d6e84a1bed5f Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sun, 21 Jun 2026 23:20:28 +0530
Subject: [PATCH 380/596] mgr/mirroring: make snapshot mirror metrics cache TTL
 configurable

Add snapshot_mirror_metrics_cache_ttl as a runtime mgr/mirroring module
option (default 15 seconds) instead of a hard-coded CACHE_TTL_SECS.
Both complete and partial lru_cache_timeout wrappers read the value
when caching omap metrics so operators can tune cache freshness without
code changes.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 src/pybind/mgr/mirroring/fs/snapshot_mirror.py |  8 +++++---
 src/pybind/mgr/mirroring/module.py             | 10 +++++++++-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index dc7f45c32c2..12279d6e84f 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -22,7 +22,7 @@ from .utils import INSTANCE_ID_PREFIX, MIRROR_OBJECT_NAME, Finisher, \
     AsyncOpTracker, get_metadata_pool, norm_path, connect_to_filesystem, \
     disconnect_from_filesystem
 from .metrics.cache import (
-    CACHE_TTL_SECS, COMPLETE_CACHE_MAX, lru_cache_timeout, PARTIAL_CACHE_MAX,
+    COMPLETE_CACHE_MAX, lru_cache_timeout, PARTIAL_CACHE_MAX,
     metrics_for_dir_and_peers, try_get_from_complete)
 from .metrics import load as metrics_load
 from .exception import MirrorException
@@ -768,7 +768,8 @@ class FSSnapshotMirror:
             return me.args[0], '', me.args[1]
 
     @lru_cache_timeout(
-        lambda self, *_args, **_kwargs: CACHE_TTL_SECS,
+        lambda self, *_args, **_kwargs: self.mgr.get_module_option(
+            'snapshot_mirror_metrics_cache_ttl'),
         COMPLETE_CACHE_MAX)
     def sync_stat_complete_cache(self, filesystem):
         """Load all directories and all peers for a filesystem from omap.
@@ -790,7 +791,8 @@ class FSSnapshotMirror:
             self.get_filesystem_peers(filesystem))
 
     @lru_cache_timeout(
-        lambda self, *_args, **_kwargs: CACHE_TTL_SECS,
+        lambda self, *_args, **_kwargs: self.mgr.get_module_option(
+            'snapshot_mirror_metrics_cache_ttl'),
         PARTIAL_CACHE_MAX)
     def sync_stat_partial_cache(self, filesystem, dir_path, peer_ids):
         """Load sync-stat omap keys for one directory and a peer set.
diff --git a/src/pybind/mgr/mirroring/module.py b/src/pybind/mgr/mirroring/module.py
index 1321e27f749..37a8cb63747 100644
--- a/src/pybind/mgr/mirroring/module.py
+++ b/src/pybind/mgr/mirroring/module.py
@@ -8,7 +8,15 @@ from .fs.snapshot_mirror import FSSnapshotMirror
 
 class Module(MgrModule):
     CLICommand = MirroringCLICommand
-    MODULE_OPTIONS: List[Option] = []
+    MODULE_OPTIONS: List[Option] = [
+        Option(
+            'snapshot_mirror_metrics_cache_ttl',
+            type='secs',
+            default=15,
+            desc='TTL for cached fs snapshot mirror status omap metrics',
+            runtime=True,
+        ),
+    ]
     NOTIFY_TYPES = [NotifyType.fs_map]
 
     def __init__(self, *args, **kwargs):

From 01dd9506f2c62a75841184ac9aa75cf72bf57b5b Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sun, 21 Jun 2026 23:22:29 +0530
Subject: [PATCH 381/596] mgr/mirroring: make snapshot mirror metrics cache
 optional

Add snapshot_mirror_metrics_cache_enabled (default true). When disabled,
metrics_status reads omap directly and skips complete and partial caches.
When enabled, behavior is unchanged.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 .../mgr/mirroring/fs/snapshot_mirror.py       | 29 +++++++++++++++++++
 src/pybind/mgr/mirroring/module.py            |  7 +++++
 2 files changed, 36 insertions(+)

diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 12279d6e84f..0d88613e2d6 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -767,6 +767,9 @@ class FSSnapshotMirror:
         except MirrorException as me:
             return me.args[0], '', me.args[1]
 
+    def _metrics_cache_enabled(self):
+        return self.mgr.get_module_option('snapshot_mirror_metrics_cache_enabled')
+
     @lru_cache_timeout(
         lambda self, *_args, **_kwargs: self.mgr.get_module_option(
             'snapshot_mirror_metrics_cache_ttl'),
@@ -814,6 +817,22 @@ class FSSnapshotMirror:
             fspolicy.policy, fspolicy.get_live_instance_ids())
         return metrics
 
+    def _load_sync_stat_metrics_from_omap(self, filesystem, mirrored_dir_path,
+                                          peer_uuid, peers, fspolicy):
+        ioctx = metrics_load.open_metadata_ioctx(
+            self.rados, self.fs_map, filesystem)
+        if mirrored_dir_path:
+            dir_path = norm_path(mirrored_dir_path)
+            metrics, _, _ = metrics_load.fetch_sync_stat_metrics(
+                ioctx, filesystem, peers, mirrored_dir_path, peer_uuid,
+                fspolicy.policy, fspolicy.get_live_instance_ids())
+            return metrics_for_dir_and_peers(metrics, dir_path, peers)
+        complete_metrics = metrics_load.load_sync_stat_metrics(
+            ioctx, filesystem, None, fspolicy.policy,
+            fspolicy.get_live_instance_ids(), peers)
+        return try_get_from_complete(
+            complete_metrics, mirrored_dir_path, peer_uuid, peers)
+
     def metrics_status(self, filesystem, mirrored_dir_path, peer_uuid):
         """Return persisted mirror directory snapshot metrics as JSON.
 
@@ -848,6 +867,16 @@ class FSSnapshotMirror:
                 else:
                     requested_peers = all_peers
 
+                if not self._metrics_cache_enabled():
+                    log.debug('sync stat metrics for filesystem %s (dir=%s, peer=%s) '
+                              'cache disabled; loading from omap',
+                              filesystem, mirrored_dir_path or '*',
+                              peer_uuid or '*')
+                    metrics = self._load_sync_stat_metrics_from_omap(
+                        filesystem, mirrored_dir_path, peer_uuid,
+                        requested_peers, fspolicy)
+                    return 0, json.dumps({'metrics': metrics}, indent=4), ''
+
                 if mirrored_dir_path:
                     dir_path = norm_path(mirrored_dir_path)
                     # Single-dir query: peek complete cache (key: filesystem
diff --git a/src/pybind/mgr/mirroring/module.py b/src/pybind/mgr/mirroring/module.py
index 37a8cb63747..3fbe145864e 100644
--- a/src/pybind/mgr/mirroring/module.py
+++ b/src/pybind/mgr/mirroring/module.py
@@ -9,6 +9,13 @@ from .fs.snapshot_mirror import FSSnapshotMirror
 class Module(MgrModule):
     CLICommand = MirroringCLICommand
     MODULE_OPTIONS: List[Option] = [
+        Option(
+            'snapshot_mirror_metrics_cache_enabled',
+            type='bool',
+            default=True,
+            desc='Cache fs snapshot mirror status omap metrics',
+            runtime=True,
+        ),
         Option(
             'snapshot_mirror_metrics_cache_ttl',
             type='secs',

From 87638c8be49918a8c794a1212f4122f2aa55f1c7 Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Sun, 21 Jun 2026 23:29:43 +0530
Subject: [PATCH 382/596] doc/cephfs: Document fs snapshot mirror status mgr
 command

Describe the mirroring module command that reads persisted omap
metrics, including syntax, output layout, stale detection, caching,
and comparison with the admin socket peer status interface.

Document --peer_uuid as a named argument for peer-only and
directory/peer filtering.

Also update PendingReleaseNotes

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 PendingReleaseNotes             |   7 +
 doc/cephfs/cephfs-mirroring.rst | 313 +++++++++++++++++++++++++++++++-
 doc/dev/cephfs-mirroring.rst    |  44 ++++-
 3 files changed, 355 insertions(+), 9 deletions(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index dc7544745e0..348fa282cc6 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -188,6 +188,13 @@
   ``fs mirror peer status`` fields (directory state, current sync, last sync, and
   snap summary) and are labeled by peer UUID and mirrored directory path. See
   https://tracker.ceph.com/issues/73457
+* CephFS Mirroring: The mirroring module provides ``ceph fs snapshot mirror status``,
+  a Ceph CLI command similar to the ``fs mirror peer status`` admin socket interface
+  for viewing per-directory snapshot sync metrics. The output layout matches
+  ``fs mirror peer status`` for core sync fields and additionally includes
+  ``metrics_updated_at`` (time of the last omap write). Optional filters by
+  mirrored directory path and peer UUID are supported. For more information,
+  see https://tracker.ceph.com/issues/76686
 * RBD: Mirror snapshot creation and trash purge schedules are now automatically
   staggered when no explicit "start-time" is specified. This reduces scheduling
   spikes and distributes work more evenly over time.
diff --git a/doc/cephfs/cephfs-mirroring.rst b/doc/cephfs/cephfs-mirroring.rst
index b10184112b4..36671f0e182 100644
--- a/doc/cephfs/cephfs-mirroring.rst
+++ b/doc/cephfs/cephfs-mirroring.rst
@@ -229,8 +229,8 @@ subdirectories or ancestor directories is disallowed::
   Error EINVAL: /d0/d1/d2/d3 is a subtree of tracked path /d0/d1/d2
 
 The :ref:`Mirroring Status<cephfs_mirroring_mirroring_status>` section contains
-information about the commands for checking the directory mapping (to mirror
-daemons) and for checking the directory distribution. 
+information about checking directory synchronization metrics, directory mapping
+(to mirror daemons), and directory distribution.
 
 .. _cephfs_mirroring_bootstrap_peers:
 
@@ -307,8 +307,300 @@ CephFS mirroring module provides ``mirror daemon status`` interface to check mir
 
 An entry per mirror daemon instance is displayed along with information such as configured
 peers and basic stats. The peer information includes the remote file system name (``fs_name``),
-cluster's Monitor addresses (``mon_host``) and cluster FSID (``fsid``). For more detailed
-stats, use the admin socket interface as detailed below.
+cluster's Monitor addresses (``mon_host``) and cluster FSID (``fsid``).
+
+.. _cephfs_mirroring_sync_metric_fields:
+
+Snapshot sync metric fields
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Both ``ceph fs snapshot mirror status`` and ``fs mirror peer status`` report the
+same core per-directory sync fields. The ``cephfs-mirror`` daemon writes these
+fields (and omap metadata described below) to the metadata pool omap (on the
+``cephfs_mirror`` RADOS object) so that the mirroring Manager module can read
+them and serve ``ceph fs snapshot mirror status`` without requiring access to a
+mirror daemon host or admin socket. On daemon restart, only a subset of fields
+is loaded back into daemon memory; the rest are rebuilt or reset for the new
+session.
+
+``ceph fs snapshot mirror status`` additionally exposes ``metrics_updated_at``,
+the wall-clock time of the last omap write for that directory and peer. This
+field is not present in ``fs mirror peer status``, which reads live in-memory
+state from the daemon and does not need a separate persist timestamp. In the
+mgr command it helps operators judge how fresh omap-backed metrics are, given
+the omap persist interval (``cephfs_mirror_tick_interval``) and Manager response
+caching (``snapshot_mirror_metrics_cache_enabled`` and
+``snapshot_mirror_metrics_cache_ttl``).
+
+**Per-session counters**
+
+``snaps_synced``, ``snaps_deleted``, and ``snaps_renamed`` are written to omap
+but count activity in the **current daemon session** only. They are not loaded
+from omap when a ``cephfs-mirror`` daemon starts or when a directory is reassigned
+to another mirror daemon instance. Counters therefore reset to zero in daemon
+memory on restart and on directory reshuffle (in multi-daemon deployments). The
+admin socket reflects this immediately; omap may still hold the previous session's
+values until the new owning daemon writes an updated entry.
+
+**Omap persistence and restore on restart**
+
+.. list-table::
+   :widths: 30 20 25 25
+   :header-rows: 1
+
+   * - Field
+     - Written to omap
+     - Loaded on daemon restart
+     - Notes
+   * - ``last_synced_snap`` (and its subfields)
+     - Yes
+     - Yes
+     - Survives daemon restart; reconciled against the remote snap map on load
+   * - ``current_syncing_snap``
+     - Yes (while syncing)
+     - No
+     - Rebuilt when synchronization resumes
+   * - ``snaps_synced``, ``snaps_deleted``, ``snaps_renamed``
+     - Yes
+     - No
+     - Written to omap but per-session; not loaded on restart (see above)
+   * - ``state``, ``failure_reason``
+     - Yes
+     - No
+     - Reflect the last writer's view until omap is updated again
+   * - ``_instance_id``
+     - Yes
+     - No
+     - Internal; used by the Manager for stale detection and omitted from CLI output
+   * - ``metrics_updated_at``
+     - Yes
+     - No
+     - Wall-clock time of the last omap write; exposed only by
+       ``ceph fs snapshot mirror status`` (not ``fs mirror peer status``)
+
+**Omap cleanup**
+
+When a directory is removed from mirroring, the ``cephfs-mirror`` daemon deletes
+the corresponding omap entry from the ``cephfs_mirror`` object.
+
+.. _cephfs_mirroring_mgr_snapshot_status:
+
+Directory snapshot sync metrics
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The mirroring module provides the ``fs snapshot mirror status`` command to query
+per-directory snapshot synchronization metrics for a mirrored file system. This is
+the recommended way to inspect mirroring progress from the Ceph CLI without using
+the ``cephfs-mirror`` admin socket.
+
+Unlike ``fs mirror peer status``, which reads in-memory state from a running mirror
+daemon on the local host, this command is implemented in the mirroring Manager
+module and reads metrics that ``cephfs-mirror`` has written to the metadata pool
+omap. That persistence is what makes cluster-wide status available from any node
+that can run ``ceph`` commands. While a sync is in progress, the daemon updates
+these omap entries periodically (see ``cephfs_mirror_tick_interval``).
+The Manager formats the omap data and returns JSON in the same nested structure
+as the admin socket ``fs mirror peer status`` command, including
+``metrics_updated_at`` when metrics are read from omap.
+
+**Syntax**
+
+.. prompt:: bash $
+
+   ceph fs snapshot mirror status <fs_name> [<mirrored_dir_path>] [--peer_uuid=<peer_uuid>]
+
+``<fs_name>``
+  File system on the primary cluster for which mirroring is enabled.
+
+``<mirrored_dir_path>`` (optional)
+  Absolute path of a directory configured for mirroring (for example ``/d0``).
+  When omitted, metrics for all mirrored directories (subject to
+  ``--peer_uuid``) are returned.
+
+``--peer_uuid=<peer_uuid>`` (optional)
+  UUID of a mirror peer (from ``ceph fs snapshot mirror peer_list``). When
+  omitted, metrics for all configured peers are returned. When both
+  ``<mirrored_dir_path>`` and ``--peer_uuid`` are specified, only that
+  directory/peer pair is reported.
+
+Examples::
+
+  # All directories and peers
+  $ ceph fs snapshot mirror status cephfs
+
+  # One mirrored directory, all peers
+  $ ceph fs snapshot mirror status cephfs /d0
+
+  # All directories for one peer
+  $ ceph fs snapshot mirror status cephfs --peer_uuid=a2dc7784-e7a1-4723-b103-03ee8d8768f8
+
+  # One directory and one peer
+  $ ceph fs snapshot mirror status cephfs /d0 --peer_uuid=a2dc7784-e7a1-4723-b103-03ee8d8768f8
+
+**Output format**
+
+The command returns a JSON object with a top-level ``metrics`` key. Per-directory
+statistics are nested under ``metrics/<mirrored-dir-path>/peer/<peer-uuid>`` so the
+same directory path can be reported for multiple peers without key collisions.
+
+When mirroring is enabled but no peers are configured, the command succeeds and
+returns an empty metrics object::
+
+  $ ceph fs snapshot mirror status cephfs
+  {
+      "metrics": {}
+  }
+
+When a directory has been added for mirroring but no snapshot has been synchronized
+yet, the Manager reports the same default idle statistics as the admin socket
+interface (``state`` is ``idle`` with zero snap counters and no ``last_synced_snap``).
+Full-file-system queries include every directory in the mirror policy, using these
+defaults for any directory or peer that does not yet have an omap entry.
+
+A minimal idle example (one directory, one peer)::
+
+  $ ceph fs snapshot mirror status cephfs /d0
+  {
+      "metrics": {
+          "/d0": {
+              "peer": {
+                  "a2dc7784-e7a1-4723-b103-03ee8d8768f8": {
+                      "state": "idle",
+                      "snaps_synced": 0,
+                      "snaps_deleted": 0,
+                      "snaps_renamed": 0
+                  }
+              }
+          }
+      }
+  }
+
+After snapshots are synchronized, fields such as ``last_synced_snap``,
+``current_syncing_snap``, ``snaps_synced``, ``snaps_deleted``, and ``snaps_renamed``
+match the admin socket output while the owning daemon is actively persisting omap
+updates. The mgr command also includes ``metrics_updated_at`` (see above).
+Durations and byte counts are formatted for display (for example ``33s``,
+``149.94 MiB``). See :ref:`Snapshot sync metric fields<cephfs_mirroring_sync_metric_fields>`
+for persistence and per-session counter behavior.
+
+**Directory states**
+
+A directory can be in one of the following states (under each peer):
+
+- ``idle``: The directory is not currently being synchronized.
+- ``syncing``: The directory is currently being synchronized. The
+  ``current_syncing_snap`` object describes in-progress snapshot sync (see field
+  tables below).
+- ``stale``: Reported by the Manager when persisted omap data is no longer owned
+  by a live mirror daemon instance (see :ref:`Stale progress detection<cephfs_mirroring_stale_metrics>`).
+  ``current_syncing_snap`` is omitted.
+- ``failed``: The directory has hit the upper limit of consecutive synchronization
+  failures. A ``failure_reason`` string may be present.
+
+.. _cephfs_mirroring_stale_metrics:
+
+**Stale progress detection**
+
+Each omap entry records an internal ``_instance_id`` (the RADOS client instance
+of the ``cephfs-mirror`` daemon that last wrote the entry). The Manager compares
+this value against the set of live mirror daemon instances and against the instance
+currently assigned to the directory in the mirroring module's directory map:
+
+- If the persisted ``_instance_id`` is **not** among the live mirror instances,
+  the entry is reported as ``stale`` (regardless of the persisted ``state``).
+- If the directory's tracked instance differs from the persisted ``_instance_id``
+  and the persisted ``state`` is not ``idle``, the entry is reported as ``stale``
+  (for example after a directory is reshuffled to another daemon mid-sync).
+
+In both cases ``current_syncing_snap`` is omitted from the output. The ``stale``
+state is reported only by ``ceph fs snapshot mirror status``, which can read omap
+even when no mirror daemon is running. The admin socket requires an active
+``cephfs-mirror`` daemon; ``ceph --admin-daemon`` commands fail when the mirror
+daemon is not running.
+
+**After a daemon restart**
+
+Immediately after a ``cephfs-mirror`` restart, omap may still contain metrics
+written by the previous session (including a stale ``_instance_id``). The Manager
+may report ``stale`` until the new daemon instance writes an updated omap entry.
+Per-session counters in omap can likewise reflect the previous session until the
+new daemon persists; the admin socket on the restarted daemon already shows zero
+for those counters. See :ref:`Snapshot sync metric fields<cephfs_mirroring_sync_metric_fields>`.
+
+**Caching**
+
+To reduce load on the metadata pool, the Manager keeps two short-lived in-memory
+caches of formatted metrics returned by ``fs snapshot mirror status``:
+
+- **Complete cache** — one entry per file system with all mirrored directories
+  and peers (a full omap snapshot). Used for ``ceph fs snapshot mirror status
+  <fs_name>`` and for optional ``--peer_uuid`` filtering.
+- **Partial cache** — per-directory omap reads keyed by file system, directory
+  path, and peer set. Single-directory queries (``<fs_name> <mirrored_dir_path>``)
+  peek the complete cache first; on miss they use the partial cache so a cold
+  complete cache does not trigger a full omap scan.
+
+Caching is enabled by default (``snapshot_mirror_metrics_cache_enabled``). When
+disabled, each query reads omap directly. When enabled, the default time-to-live
+is 15 seconds (``snapshot_mirror_metrics_cache_ttl``) for both caches. Repeated
+queries within the TTL may be served without reading omap again. After the cache
+expires, the next query reloads metrics from omap.
+
+**Comparison with the admin socket**
+
+.. list-table::
+   :widths: 50 50
+   :header-rows: 1
+
+   * - ``ceph fs snapshot mirror status``
+     - ``fs mirror peer status`` (admin socket)
+   * - Invoked via the Ceph CLI through the Manager
+     - Invoked with ``ceph --admin-daemon`` on a mirror daemon host
+   * - Reads metrics persisted in the metadata pool omap
+     - Reads in-memory state from the mirror daemon
+   * - ``last_synced_snap`` survives daemon restart (from omap)
+     - ``last_synced_snap`` restored from omap on daemon start
+   * - Per-session counters may lag omap until the owning daemon re-persists
+     - Per-session counters reset to zero on daemon restart
+   * - Can report ``stale`` when the omap writer is no longer live
+     - Requires a running mirror daemon (unavailable when none is active)
+   * - Includes ``metrics_updated_at`` (time of last omap write)
+     - Not present; reads live in-memory state only
+   * - Optional filters by mirrored directory path and peer UUID
+     - Reports all mirrored directories for the given peer
+
+For interactive debugging on a specific mirror daemon host, the admin socket
+remains useful. For operators and monitoring integrations that prefer a standard
+``ceph`` subcommand, use ``fs snapshot mirror status``.
+
+**Configuration**
+
+- ``cephfs_mirror_tick_interval`` (``cephfs-mirror`` daemon,
+  default: ``5`` seconds) — tick interval for periodic mirroring work,
+  including how often live sync progress is written to omap while a snapshot
+  is synchronizing.
+
+- ``snapshot_mirror_metrics_cache_enabled`` (``mgr/mirroring`` module, default:
+  ``true``) — whether the Manager caches ``fs snapshot mirror status`` responses.
+  When ``false``, each query reads omap directly::
+
+     ceph config set mgr mgr/mirroring/snapshot_mirror_metrics_cache_enabled false
+
+- ``snapshot_mirror_metrics_cache_ttl`` (``mgr/mirroring`` module, default:
+  ``15`` seconds) — when caching is enabled, how long the Manager caches
+  formatted ``fs snapshot mirror status`` responses before reading omap again::
+
+     ceph config set mgr mgr/mirroring/snapshot_mirror_metrics_cache_ttl 15
+
+**Errors**
+
+The command fails with a non-zero exit code and an error message when:
+
+- ``<fs_name>`` does not exist
+- Mirroring is not enabled for the file system
+- ``<mirrored_dir_path>`` is not an absolute path, is not configured for mirroring,
+  or is not found in the mirror policy
+- ``<peer_uuid>`` is not configured for the file system
 
 CephFS mirror daemons provide admin socket commands for querying mirror status. To check
 available commands for mirror status use::
@@ -463,14 +755,21 @@ Monotonic clock time in seconds (since daemon startup) when the snapshot sync fi
 printed with sub-second precision and an ``s`` suffix (for example, ``274900.558797s``). This
 is not a wall-clock or epoch timestamp.
 
-Synchronization stats including ``snaps_synced``, ``snaps_deleted`` and ``snaps_renamed`` are reset
-on daemon restart and/or when a directory is reassigned to another mirror daemon (when
-multiple mirror daemons are deployed).
+``snaps_synced``, ``snaps_deleted``, and ``snaps_renamed`` are
+:ref:`per-session counters<cephfs_mirroring_sync_metric_fields>`: they count
+activity in the current ``cephfs-mirror`` daemon session only and are not restored
+from omap on restart. They reset to zero on daemon restart and when a directory is
+reassigned to another mirror daemon (in multi-daemon deployments).
 
 A directory can be in one of the following states:
 
 - ``idle``: The directory is currently not being synchronized.
 - ``syncing``: The directory is currently being synchronized.
+- ``stale``: Reported only by ``ceph fs snapshot mirror status`` when persisted
+  omap data is no longer owned by a live mirror daemon instance (see
+  :ref:`Stale progress detection<cephfs_mirroring_stale_metrics>`). The admin
+  socket does not use this state; ``fs mirror peer status`` requires a running
+  ``cephfs-mirror`` daemon and fails when none is active.
 - ``failed``: The directory has hit upper limit of consecutive failures.
 
 When a directory is currently being synchronized, the mirror daemon marks it as ``syncing`` and
diff --git a/doc/dev/cephfs-mirroring.rst b/doc/dev/cephfs-mirroring.rst
index 9cba6cce34c..368aafc367f 100644
--- a/doc/dev/cephfs-mirroring.rst
+++ b/doc/dev/cephfs-mirroring.rst
@@ -326,8 +326,48 @@ For example:
   ]
 
 One entry per mirror-daemon instance is displayed, along with information
-including configured peers and basic statistics. For more detailed statistics,
-use the admin socket interface as detailed below.
+including configured peers and basic statistics.
+
+**Directory snapshot sync metrics (mgr)**
+
+The mirroring module implements ``ceph fs snapshot mirror status``. The
+``cephfs-mirror`` daemon persists per-directory sync statistics to the
+``cephfs_mirror`` object omap in the metadata pool so the Manager can expose
+them through the Ceph CLI without an admin socket on a mirror daemon host. The
+``metrics_status`` handler reads that omap, applies stale detection and default
+idle metrics for newly mirrored directories, and returns JSON in the same nested
+``metrics/<dir>/peer/<uuid>`` format as ``fs mirror peer status``. When
+``snapshot_mirror_metrics_cache_enabled`` is true (default TTL 15 seconds via
+``snapshot_mirror_metrics_cache_ttl``), responses are served from a complete
+cache (full file system snapshot) and, for single-directory queries, a partial
+per-directory cache that avoids full omap scans on complete-cache miss. When
+caching is disabled, each query reads omap directly. Omap entries are marked
+``stale`` when the persisted ``_instance_id`` is not among live mirror instances
+or does not match the directory's tracked instance while persisted state is not
+``idle``.
+
+Each omap value includes metadata fields written by ``cephfs-mirror``:
+
+- ``_instance_id`` — RADOS client instance of the writer; used for stale
+  detection and stripped from CLI output.
+- ``metrics_updated_at`` — wall-clock time of the last omap write. Exposed in
+  ``ceph fs snapshot mirror status`` output only; omitted from admin socket
+  ``fs mirror peer status``, which reads live in-memory state and does not
+  need a separate persist timestamp. Operators use this field to judge how
+  fresh omap-backed metrics are, given ``cephfs_mirror_tick_interval`` omap
+  persist cadence and Manager caching (``snapshot_mirror_metrics_cache_enabled``
+  and ``snapshot_mirror_metrics_cache_ttl``).
+
+Omap entries are removed when a directory is removed from mirroring. All metric
+fields are written to omap; on daemon restart only ``last_synced_snap`` metadata
+is loaded back. Per-session counters (``snaps_synced``, ``snaps_deleted``,
+``snaps_renamed``) are persisted but not loaded and therefore start at zero each
+session.
+
+See :ref:`Directory snapshot sync metrics<cephfs_mirroring_mgr_snapshot_status>`
+and :ref:`Snapshot sync metric fields<cephfs_mirroring_sync_metric_fields>` in
+:doc:`/cephfs/cephfs-mirroring` for command syntax, examples, and operator
+guidance.
 
 CephFS mirror daemons provide admin socket commands for querying mirror status.
 To list the available commands for ``mirror status``, run the following

From b80828fbadf285029239725d9cb175812aadf07a Mon Sep 17 00:00:00 2001
From: Kotresh HR <khiremat@redhat.com>
Date: Tue, 23 Jun 2026 20:43:18 +0530
Subject: [PATCH 383/596] qa: Add mgr snapshot mirror status tests

Add teuthology coverage for `ceph fs snapshot mirror status`:
parity with asok peer_status, default idle metrics, stale omap
handling, error paths, filter scopes, daemon restart, and cache TTL.

Reuse existing peer_dir_status and metrics assertion helpers.
Adjust stale test wait for InstanceWatcher timeout and set a
short cache TTL in the cache test. Pass peer_uuid via --peer_uuid=
in the test helper for peer-only scope queries.

Fixes: https://tracker.ceph.com/issues/76686
Signed-off-by: Kotresh HR <khiremat@redhat.com>
---
 qa/tasks/cephfs/test_mirroring.py | 677 ++++++++++++++++++++++++++++++
 1 file changed, 677 insertions(+)

diff --git a/qa/tasks/cephfs/test_mirroring.py b/qa/tasks/cephfs/test_mirroring.py
index ad4642c4e7d..0dd1285b178 100644
--- a/qa/tasks/cephfs/test_mirroring.py
+++ b/qa/tasks/cephfs/test_mirroring.py
@@ -5,6 +5,7 @@ import base64
 import errno
 import logging
 import random
+import signal
 import time
 import functools
 
@@ -14,6 +15,7 @@ from collections import deque
 from tasks.cephfs.cephfs_test_case import CephFSTestCase
 from teuthology.exceptions import CommandFailedError
 from teuthology.contextutil import safe_while
+from teuthology.orchestra import run
 
 log = logging.getLogger(__name__)
 
@@ -70,6 +72,8 @@ class TestMirroring(CephFSTestCase):
     PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_FS = "cephfs_mirror_mirrored_filesystems"
     PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER = "cephfs_mirror_peers"
     PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_DIRECTORY = "cephfs_mirror_directory"
+    MGR_METRICS_CACHE_TTL = 3
+    MIRROR_TICK_INTERVAL = 1
 
     def setUp(self):
         super(TestMirroring, self).setUp()
@@ -79,6 +83,60 @@ class TestMirroring(CephFSTestCase):
         self.secondary_fs_id = self.backup_fs.id
         self.enable_mirroring_module()
         self.config_set('client.mirror', 'cephfs_mirror_directory_scan_interval', 1)
+        self.config_set('client.mirror', 'cephfs_mirror_tick_interval',
+                          self.MIRROR_TICK_INTERVAL)
+        self.config_set('mgr', 'mgr/mirroring/snapshot_mirror_metrics_cache_ttl',
+                          self.MGR_METRICS_CACHE_TTL)
+        self.enable_mgr_metrics_cache()
+
+    def disable_mgr_metrics_cache(self):
+        self.config_set('mgr', 'mgr/mirroring/snapshot_mirror_metrics_cache_enabled',
+                        False)
+
+    def enable_mgr_metrics_cache(self):
+        self.config_set('mgr', 'mgr/mirroring/snapshot_mirror_metrics_cache_enabled',
+                        True)
+
+    def assert_mgr_mirror_status_scopes(self, fs_name, dir_path, peer_uuid,
+                                        expected_dirs, asok_res):
+        full_res = self.mgr_mirror_status(fs_name)
+        self.assertEqual(set(full_res['metrics'].keys()), set(expected_dirs))
+
+        peer_res = self.mgr_mirror_status(fs_name, peer_uuid=peer_uuid)
+        self.assertEqual(set(peer_res['metrics'].keys()), set(expected_dirs))
+        for path in expected_dirs:
+            self.assertEqual(
+                set(peer_res['metrics'][path]['peer'].keys()), {peer_uuid})
+
+        dir_res = self.mgr_mirror_status(fs_name, dir_path)
+        self.assertEqual(set(dir_res['metrics'].keys()), {dir_path})
+
+        dir_peer_res = self.mgr_mirror_status(fs_name, dir_path, peer_uuid)
+        self.assertEqual(set(dir_peer_res['metrics'].keys()), {dir_path})
+        self.assertEqual(
+            set(dir_peer_res['metrics'][dir_path]['peer'].keys()), {peer_uuid})
+
+        for path in expected_dirs:
+            for res in (full_res, peer_res):
+                mgr_stat = self.peer_dir_status(res, path, peer_uuid)
+                asok_stat = self.peer_dir_status(asok_res, path, peer_uuid)
+                self.assert_mgr_dir_stat_matches_asok(mgr_stat, asok_stat)
+
+        for res in (dir_res, dir_peer_res):
+            mgr_stat = self.peer_dir_status(res, dir_path, peer_uuid)
+            asok_stat = self.peer_dir_status(asok_res, dir_path, peer_uuid)
+            self.assert_mgr_dir_stat_matches_asok(mgr_stat, asok_stat)
+
+    @retry_assert(timeout=120, interval=1)
+    def check_mgr_snapshot_mirror_status_scopes_match_asok(
+            self, fs_name, fs_id, dir_path, peer_uuid, expected_dirs,
+            expected_state=None):
+        asok_res = self.peer_status(fs_name, fs_id, peer_uuid)
+        asok_stat = self.peer_dir_status(asok_res, dir_path, peer_uuid)
+        if expected_state is not None:
+            self.assertEqual(asok_stat['state'], expected_state)
+        self.assert_mgr_mirror_status_scopes(
+            fs_name, dir_path, peer_uuid, expected_dirs, asok_res)
 
     def tearDown(self):
         self.disable_mirroring_module()
@@ -362,6 +420,172 @@ class TestMirroring(CephFSTestCase):
         self.assertTrue(
             snap['eta'] == 'calculating...' or bool(re.search(r'\d', snap['eta'])))
 
+    def mgr_mirror_status(self, fs_name, mirrored_dir_path=None, peer_uuid=None):
+        args = ["fs", "snapshot", "mirror", "status", fs_name]
+        if mirrored_dir_path is not None:
+            args.append(mirrored_dir_path)
+        if peer_uuid is not None:
+            args.append(f'--peer_uuid={peer_uuid}')
+        return json.loads(self.get_ceph_cmd_stdout(*args))
+
+    def peer_status(self, fs_name, fs_id, peer_uuid):
+        return self.mirror_daemon_command(
+            f'peer status for fs: {fs_name}',
+            'fs', 'mirror', 'peer', 'status',
+            f'{fs_name}@{fs_id}', peer_uuid)
+
+    def dir_status_from_mgr(self, fs_name, dir_name, peer_uuid,
+                            mirrored_dir_path=None):
+        res = self.mgr_mirror_status(
+            fs_name, mirrored_dir_path or dir_name, peer_uuid)
+        return self.peer_dir_status(res, dir_name, peer_uuid)
+
+    def dir_status_from_asok(self, fs_name, fs_id, dir_name, peer_uuid):
+        res = self.peer_status(fs_name, fs_id, peer_uuid)
+        return self.peer_dir_status(res, dir_name, peer_uuid)
+
+    def assert_default_idle_dir_stat(self, dir_stat):
+        self.assertEqual(dir_stat['state'], 'idle')
+        self.assertEqual(dir_stat['snaps_synced'], 0)
+        self.assertEqual(dir_stat['snaps_deleted'], 0)
+        self.assertEqual(dir_stat['snaps_renamed'], 0)
+        self.assertNotIn('last_synced_snap', dir_stat)
+
+    def assert_mgr_dir_stat_matches_asok(self, mgr_stat, asok_stat):
+        self.assertEqual(mgr_stat['state'], asok_stat['state'])
+        for key in ('snaps_synced', 'snaps_deleted', 'snaps_renamed'):
+            self.assertEqual(mgr_stat.get(key), asok_stat.get(key))
+        if 'failure_reason' in asok_stat:
+            self.assertEqual(mgr_stat.get('failure_reason'), asok_stat['failure_reason'])
+        if 'last_synced_snap' in asok_stat:
+            self.assertIn('last_synced_snap', mgr_stat)
+            self.assertEqual(mgr_stat['last_synced_snap']['name'],
+                             asok_stat['last_synced_snap']['name'])
+            self.assert_last_synced_snap_metrics(mgr_stat['last_synced_snap'])
+        if 'current_syncing_snap' in asok_stat:
+            self.assertIn('current_syncing_snap', mgr_stat)
+            mgr_snap = mgr_stat['current_syncing_snap']
+            asok_snap = asok_stat['current_syncing_snap']
+            self.assertEqual(mgr_snap['name'], asok_snap['name'])
+            self.assert_syncing_snap_metrics(
+                mgr_snap, sync_mode=asok_snap.get('sync-mode'))
+
+    @retry_assert(timeout=120, interval=1)
+    def check_mgr_dir_stat_matches_asok(self, fs_name, fs_id, dir_name, peer_uuid,
+                                      mirrored_dir_path=None):
+        mgr_stat = self.dir_status_from_mgr(
+            fs_name, dir_name, peer_uuid, mirrored_dir_path)
+        asok_stat = self.dir_status_from_asok(fs_name, fs_id, dir_name, peer_uuid)
+        try:
+            self.assert_mgr_dir_stat_matches_asok(mgr_stat, asok_stat)
+        except RETRY_EXCEPTIONS as e:
+            e.mgr_stat = mgr_stat
+            e.asok_stat = asok_stat
+            raise
+
+    def wait_for_mirror_daemon_stop(self, pid):
+        with safe_while(sleep=1, tries=60,
+                        action='wait for mirror daemon stop') as proceed:
+            while proceed():
+                try:
+                    cur_pid = self.get_mirror_daemon_pid()
+                except CommandFailedError:
+                    return
+                if cur_pid != pid:
+                    return
+                p = self.mount_a.run_shell(['kill', '-0', cur_pid],
+                                           check_status=False)
+                if p.returncode != 0:
+                    return
+
+    def restart_mirror_daemon(self):
+        # daemon.start() always calls restart(), which skips stop() once proc
+        # is cleared.  Stop the real cephfs-mirror via its pid file first so
+        # the new instance can take the pidfile lock.
+        daemons = list(self.ctx.daemons.iter_daemons_of_role('cephfs-mirror'))
+        self.assertEqual(len(daemons), 1,
+                         'expected a single cephfs-mirror daemon')
+        daemon = daemons[0]
+        rados_inst_before = self.get_mirror_rados_addr(
+            self.primary_fs_name, self.primary_fs_id)
+        pid = self.get_mirror_daemon_pid()
+
+        log.debug(f'SIGTERM to cephfs-mirror pid {pid}')
+        if daemon.running():
+            try:
+                daemon.signal(signal.SIGTERM, silent=True)
+            except Exception as e:
+                log.debug(f'failed to signal cephfs-mirror via teuthology: {e}')
+        self.mount_a.run_shell(['kill', '-TERM', pid])
+        self.wait_for_mirror_daemon_stop(pid)
+
+        if daemon.running():
+            try:
+                run.wait([daemon.proc], timeout=10)
+            except CommandFailedError:
+                pass
+        daemon.reset()
+
+        log.debug('starting cephfs-mirror')
+        daemon.start()
+
+        time.sleep(60)
+        with safe_while(sleep=2, tries=30,
+                        action='wait for mirror daemon restart') as proceed:
+            while proceed():
+                try:
+                    rados_inst = self.get_mirror_rados_addr(
+                        self.primary_fs_name, self.primary_fs_id)
+                    if rados_inst and rados_inst != rados_inst_before:
+                        break
+                except CommandFailedError:
+                    pass
+
+    def wait_for_mirror_daemon_recovery(self, fs_name, fs_id, dir_name, peer_uuid):
+        # A new rados_inst alone does not mean mirroring is ready: wait until the
+        # peer is configured, the snap dir is registered, and asok reports it.
+        with safe_while(sleep=2, tries=60,
+                        action='wait for mirror daemon recovery') as proceed:
+            while proceed():
+                if not self.get_mirror_rados_addr(fs_name, fs_id):
+                    continue
+                try:
+                    mirror_res = self.mirror_daemon_command(
+                        f'mirror status for fs: {fs_name}',
+                        'fs', 'mirror', 'status', f'{fs_name}@{fs_id}')
+                except CommandFailedError:
+                    continue
+                if peer_uuid not in mirror_res.get('peers', {}):
+                    continue
+                if mirror_res.get('snap_dirs', {}).get('dir_count', 0) < 1:
+                    continue
+                try:
+                    peer_res = self.peer_status(fs_name, fs_id, peer_uuid)
+                    self.peer_dir_status(peer_res, dir_name, peer_uuid)
+                except RETRY_EXCEPTIONS:
+                    continue
+                return
+
+    @retry_assert(timeout=120, interval=1)
+    def check_mgr_and_asok_session_counters_zero(self, fs_name, fs_id, dir_name,
+                                                 peer_uuid):
+        mgr_stat = self.dir_status_from_mgr(fs_name, dir_name, peer_uuid)
+        asok_stat = self.dir_status_from_asok(fs_name, fs_id, dir_name, peer_uuid)
+        self.assertEqual(mgr_stat['state'], 'idle')
+        self.assertEqual(asok_stat['state'], 'idle')
+        for key in ('snaps_synced', 'snaps_deleted', 'snaps_renamed'):
+            self.assertEqual(mgr_stat.get(key), 0, msg=f'mgr {key}')
+            self.assertEqual(asok_stat.get(key), 0, msg=f'asok {key}')
+        self.assertEqual(mgr_stat['last_synced_snap']['name'],
+                         asok_stat['last_synced_snap']['name'])
+
+    @retry_assert(timeout=90, interval=5)
+    def check_mgr_dir_stat_stale(self, fs_name, dir_name, peer_uuid):
+        mgr_stat = self.dir_status_from_mgr(fs_name, dir_name, peer_uuid)
+        self.assertEqual(mgr_stat['state'], 'stale',
+                         msg=f'unexpected mgr stat: {mgr_stat}')
+        self.assertNotIn('current_syncing_snap', mgr_stat)
+
     @retry_assert(timeout=120, interval=1)
     def check_peer_syncing_progress_metrics(self, fs_name, fs_id, peer_spec, dir_name,
                                             snap_name, sync_mode=None):
@@ -2175,6 +2399,459 @@ class TestMirroring(CephFSTestCase):
         self.config_set('client.mirror', 'cephfs_mirror_distribute_datasync_threads', 'true')
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
 
+    def test_mgr_snapshot_mirror_status_matches_asok_idle(self):
+        """Mgr snapshot mirror status matches asok peer status after sync."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_status_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 50, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap_name = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap_name}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap_name, 1)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        self.check_mgr_dir_stat_matches_asok(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_uuid)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_matches_asok_syncing(self):
+        """Mgr snapshot mirror status matches asok peer status during sync."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_sync_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 8000, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap_name = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap_name}'])
+        self.check_peer_syncing_progress_metrics(
+            self.primary_fs_name, self.primary_fs_id, peer_spec, f'/{dir_name}',
+            snap_name, sync_mode='full')
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        self.check_mgr_dir_stat_matches_asok(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_uuid)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_default_idle_new_dir(self):
+        """Mgr status reports default idle metrics for a newly added directory."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_default_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        mgr_stat = self.dir_status_from_mgr(
+            self.primary_fs_name, f'/{dir_name}', peer_uuid)
+        self.assert_default_idle_dir_stat(mgr_stat)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_stale_after_daemon_stop(self):
+        """Mgr status marks frozen omap syncing progress as stale."""
+        self.setup_mount_b(mds_perm='rw')
+        self.mount_a.run_shell(["mkdir", "d0"])
+        for i in range(8):
+            self.mount_a.write_n_mb(os.path.join('d0', f'file.{i}'), 1024)
+
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, '/d0')
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        self.mount_a.run_shell(["mkdir", "d0/.snap/snap0"])
+        self.check_peer_snap_in_progress(self.primary_fs_name, self.primary_fs_id,
+                                         peer_spec, '/d0', 'snap0')
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        # Wait for live metrics to reach omap before freezing the daemon.
+        # Stale detection requires a persisted _instance_id; without an omap
+        # write the mgr reports default idle metrics instead of stale.
+        mgr_syncing = False
+        with safe_while(sleep=2, tries=30,
+                        action='wait for omap syncing metrics') as proceed:
+            while proceed():
+                mgr_stat = self.dir_status_from_mgr(
+                    self.primary_fs_name, '/d0', peer_uuid)
+                if mgr_stat.get('state') == 'syncing':
+                    mgr_syncing = True
+                    break
+        self.assertTrue(
+            mgr_syncing,
+            'mgr never reported syncing before SIGSTOP; '
+            f'last mgr stat: {mgr_stat}')
+
+        pid = self.get_mirror_daemon_pid()
+        log.debug(f'SIGSTOP to cephfs-mirror pid {pid}')
+        self.mount_a.run_shell(['kill', '-SIGSTOP', pid])
+        try:
+            # InstanceWatcher INSTANCE_TIMEOUT is 30s; allow extra time for
+            # the mgr notify loop to age out the frozen instance.
+            time.sleep(40)
+            self.check_mgr_dir_stat_stale(
+                self.primary_fs_name, '/d0', peer_uuid)
+        finally:
+            log.debug('SIGCONT to cephfs-mirror')
+            self.mount_a.run_shell(['kill', '-SIGCONT', pid])
+
+        # wait for restart mirror on blocklist
+        time.sleep(60)
+        with safe_while(sleep=2, tries=20,
+                        action='wait for mirror daemon recovery after SIGSTOP') as proceed:
+            while proceed():
+                if not self.get_mirror_rados_addr(self.primary_fs_name,
+                                                   self.primary_fs_id):
+                    continue
+                res = self.mirror_daemon_command(
+                    f'mirror status for fs: {self.primary_fs_name}',
+                    'fs', 'mirror', 'status',
+                    f'{self.primary_fs_name}@{self.primary_fs_id}')
+                if 'snap_dirs' in res:
+                    break
+
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, '/d0')
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_no_peers(self):
+        """Mgr status returns empty metrics when no peers are configured."""
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        res = self.mgr_mirror_status(self.primary_fs_name)
+        self.assertEqual(res, {'metrics': {}})
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_errors(self):
+        """Mgr status returns expected errors for invalid inputs."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_err_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        try:
+            self.get_ceph_cmd_stdout("fs", "snapshot", "mirror", "status",
+                                     "nonexistent_fs_name")
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.ENOENT:
+                raise RuntimeError(-errno.ENOENT,
+                                   'incorrect error for unknown filesystem')
+        else:
+            raise RuntimeError(-errno.ENOENT, 'expected unknown filesystem to fail')
+
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+        self.peer_remove(self.primary_fs_name, self.primary_fs_id, peer_spec)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        try:
+            self.get_ceph_cmd_stdout("fs", "snapshot", "mirror", "status",
+                                     self.primary_fs_name)
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.EINVAL:
+                raise RuntimeError(-errno.EINVAL,
+                                   'incorrect error for non-mirrored filesystem')
+        else:
+            raise RuntimeError(-errno.EINVAL, 'expected non-mirrored fs to fail')
+
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        try:
+            self.get_ceph_cmd_stdout("fs", "snapshot", "mirror", "status",
+                                     self.primary_fs_name, '/not_mirrored')
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.ENOENT:
+                raise RuntimeError(-errno.ENOENT,
+                                   'incorrect error for unknown directory')
+        else:
+            raise RuntimeError(-errno.ENOENT, 'expected unknown directory to fail')
+
+        try:
+            self.get_ceph_cmd_stdout(
+                "fs", "snapshot", "mirror", "status",
+                self.primary_fs_name, f'/{dir_name}',
+                '--peer_uuid=00000000-0000-0000-0000-000000000000')
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.ENOENT:
+                raise RuntimeError(-errno.ENOENT,
+                                   'incorrect error for unknown peer')
+        else:
+            raise RuntimeError(-errno.ENOENT, 'expected unknown peer to fail')
+
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_filter_scopes(self):
+        """Mgr status filters by filesystem, directory, and peer scope."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        for dir_name in ('mgr_f0', 'mgr_f1'):
+            self.mount_a.run_shell(['mkdir', dir_name])
+            self.mount_a.create_n_files(f'{dir_name}/file', 50, sync=True)
+            self.add_directory(self.primary_fs_name, self.primary_fs_id,
+                              f'/{dir_name}')
+            self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/snap0'])
+
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, '/mgr_f0', 'snap0', 1)
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, '/mgr_f1', 'snap0', 1)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        full_res = self.mgr_mirror_status(self.primary_fs_name)
+        self.assertIn('/mgr_f0', full_res['metrics'])
+        self.assertIn('/mgr_f1', full_res['metrics'])
+
+        dir_res = self.mgr_mirror_status(self.primary_fs_name, '/mgr_f0')
+        self.assertEqual(set(dir_res['metrics'].keys()), {'/mgr_f0'})
+
+        peer_res = self.mgr_mirror_status(
+            self.primary_fs_name, '/mgr_f0', peer_uuid)
+        self.assertEqual(set(peer_res['metrics'].keys()), {'/mgr_f0'})
+        self.assertIn(peer_uuid, peer_res['metrics']['/mgr_f0']['peer'])
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_survives_daemon_restart(self):
+        """Mgr status keeps persisted last_synced_snap and resets session counters after restart."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_restart_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 3000, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap0 = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap0}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap0, 1)
+
+        for i in range(5):
+            self.mount_a.write_n_mb(os.path.join(dir_name, f'more_file.{i}'), 1)
+
+        snap1 = 'snap1'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap1}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap1, 2)
+
+        self.mount_a.run_shell(['rmdir', f'{dir_name}/.snap/{snap0}'])
+        self.check_peer_status_deleted_snap(self.primary_fs_name, self.primary_fs_id,
+                                            peer_spec, f'/{dir_name}', 1)
+        snap_list = self.mount_b.ls(path=f'{dir_name}/.snap')
+        self.assertNotIn(snap0, snap_list)
+
+        snap2 = 'snap2'
+        self.mount_a.run_shell(['mv', f'{dir_name}/.snap/{snap1}',
+                                f'{dir_name}/.snap/{snap2}'])
+        self.check_peer_status_renamed_snap(self.primary_fs_name, self.primary_fs_id,
+                                            peer_spec, f'/{dir_name}', 1)
+        snap_list = self.mount_b.ls(path=f'{dir_name}/.snap')
+        self.assertNotIn(snap1, snap_list)
+        self.assertIn(snap2, snap_list)
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap2, 2)
+
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        before = self.dir_status_from_mgr(
+            self.primary_fs_name, f'/{dir_name}', peer_uuid)
+        self.assertEqual(before['snaps_synced'], 2)
+        self.assertEqual(before['snaps_deleted'], 1)
+        self.assertEqual(before['snaps_renamed'], 1)
+        self.assertEqual(before['last_synced_snap']['name'], snap2)
+
+        self.restart_mirror_daemon()
+        self.wait_for_mirror_daemon_recovery(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_uuid)
+        self.check_mgr_and_asok_session_counters_zero(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_uuid)
+
+        after = self.dir_status_from_mgr(
+            self.primary_fs_name, f'/{dir_name}', peer_uuid)
+        self.assertEqual(after['last_synced_snap']['name'],
+                         before['last_synced_snap']['name'])
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_after_directory_remove(self):
+        """Mgr status for a removed directory returns ENOENT."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_rm_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        try:
+            self.mgr_mirror_status(self.primary_fs_name, f'/{dir_name}')
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.ENOENT:
+                raise RuntimeError(-errno.ENOENT,
+                                   'incorrect error for removed directory')
+        else:
+            raise RuntimeError(-errno.ENOENT, 'expected removed directory to fail')
+
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_failed_state(self):
+        """Mgr status reports failed state like asok peer status."""
+        self.setup_mount_b(mds_perm='rwps')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'd0'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap_name = "snap_a"
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap_name}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap_name, 1)
+
+        remote_snap_path = f'{dir_name}/.snap/snap_b'
+        self.mount_b.run_shell(['sudo', 'mkdir', remote_snap_path], omit_sudo=False)
+
+        self.verify_failed_directory(self.primary_fs_name, self.primary_fs_id,
+                                     peer_spec, f'/{dir_name}')
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        self.check_mgr_dir_stat_matches_asok(
+            self.primary_fs_name, self.primary_fs_id, f'/{dir_name}', peer_uuid)
+
+        self.mount_b.run_shell(['sudo', 'rmdir', remote_snap_path], omit_sudo=False)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_cache(self):
+        """Repeated mgr status calls hit the metrics cache within TTL."""
+        self.setup_mount_b(mds_perm='rw')
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        peer_spec = "client.mirror_remote@ceph"
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+
+        dir_name = 'mgr_cache_dir'
+        self.mount_a.run_shell(['mkdir', dir_name])
+        self.mount_a.create_n_files(f'{dir_name}/file', 50, sync=True)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, f'/{dir_name}')
+
+        snap0 = 'snap0'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap0}'])
+        self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                    peer_spec, f'/{dir_name}', snap0, 1)
+
+        res1 = self.mgr_mirror_status(self.primary_fs_name)
+        res2 = self.mgr_mirror_status(self.primary_fs_name)
+        self.assertEqual(res1, res2)
+
+        snap1 = 'snap1'
+        self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/{snap1}'])
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, f'/{dir_name}', snap1, 2)
+
+        time.sleep(self.MGR_METRICS_CACHE_TTL + 1)
+        res3 = self.mgr_mirror_status(self.primary_fs_name)
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        self.assertEqual(
+            res3['metrics'][f'/{dir_name}']['peer'][peer_uuid]['snaps_synced'], 2)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    def test_mgr_snapshot_mirror_status_cache_disabled(self):
+        """Mgr snapshot mirror status reads omap for all scopes when cache is disabled."""
+        self.disable_mgr_metrics_cache()
+        try:
+            self.setup_mount_b(mds_perm='rw')
+            self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+            peer_spec = "client.mirror_remote@ceph"
+            self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                          self.secondary_fs_name)
+
+            dirs = []
+            for dir_name in ('mgr_nc0', 'mgr_nc1'):
+                self.mount_a.run_shell(['mkdir', dir_name])
+                self.mount_a.create_n_files(f'{dir_name}/file', 50, sync=True)
+                self.add_directory(self.primary_fs_name, self.primary_fs_id,
+                                   f'/{dir_name}')
+                self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/snap0'])
+                dirs.append(f'/{dir_name}')
+
+            peer_uuid = self.get_peer_uuid(peer_spec)
+            for dir_path in dirs:
+                self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                            peer_spec, dir_path, 'snap0', 1)
+
+            self.check_mgr_snapshot_mirror_status_scopes_match_asok(
+                self.primary_fs_name, self.primary_fs_id, dirs[0], peer_uuid,
+                dirs)
+
+            self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        finally:
+            self.enable_mgr_metrics_cache()
+
+    def test_mgr_snapshot_mirror_status_cache_disabled_syncing(self):
+        """Mgr snapshot mirror status reads omap during sync when cache is disabled."""
+        self.disable_mgr_metrics_cache()
+        try:
+            self.setup_mount_b(mds_perm='rw')
+            self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+            peer_spec = "client.mirror_remote@ceph"
+            self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                          self.secondary_fs_name)
+
+            idle_dir = 'mgr_nc_idle'
+            self.mount_a.run_shell(['mkdir', idle_dir])
+            self.mount_a.create_n_files(f'{idle_dir}/file', 50, sync=True)
+            self.add_directory(self.primary_fs_name, self.primary_fs_id,
+                               f'/{idle_dir}')
+            self.mount_a.run_shell(['mkdir', f'{idle_dir}/.snap/snap0'])
+            self.check_peer_status_idle(self.primary_fs_name, self.primary_fs_id,
+                                        peer_spec, f'/{idle_dir}', 'snap0', 1)
+
+            sync_dir = 'mgr_nc_sync'
+            self.mount_a.run_shell(['mkdir', sync_dir])
+            self.mount_a.create_n_files(f'{sync_dir}/file', 10000, sync=True)
+            self.add_directory(self.primary_fs_name, self.primary_fs_id,
+                               f'/{sync_dir}')
+            snap_name = 'snap0'
+            self.mount_a.run_shell(['mkdir', f'{sync_dir}/.snap/{snap_name}'])
+            self.check_peer_syncing_progress_metrics(
+                self.primary_fs_name, self.primary_fs_id, peer_spec,
+                f'/{sync_dir}', snap_name, sync_mode='full')
+
+            peer_uuid = self.get_peer_uuid(peer_spec)
+            dirs = [f'/{idle_dir}', f'/{sync_dir}']
+            self.check_mgr_snapshot_mirror_status_scopes_match_asok(
+                self.primary_fs_name, self.primary_fs_id, f'/{sync_dir}',
+                peer_uuid, dirs, expected_state='syncing')
+            self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        finally:
+            self.enable_mgr_metrics_cache()
+
     def test_cephfs_mirror_duplicate_acquire_notify(self):
         """Duplicate acquire notifies must not leave a ghost replayer directory.
 

From 212eb0bc04db50f38f468ec7bcff149a1ca745b4 Mon Sep 17 00:00:00 2001
From: David Galloway <david.galloway@ibm.com>
Date: Tue, 23 Jun 2026 10:11:34 -0400
Subject: [PATCH 384/596] .github/workflows/releng-audit.yaml: Check main for
 upstream commit

This check was failing to correctly identify whether backported commits
had actually been cherry-picked because it was checking the target branch
instead of the main branch.  This change checks out the main branch
to look for the upstream cherry-picked commit.

Signed-off-by: David Galloway <david.galloway@ibm.com>
---
 .github/workflows/releng-audit.yaml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/releng-audit.yaml b/.github/workflows/releng-audit.yaml
index 4a4ab014986..a574d7e076d 100644
--- a/.github/workflows/releng-audit.yaml
+++ b/.github/workflows/releng-audit.yaml
@@ -258,7 +258,14 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          
+
+      - name: Fetch main for parity check
+        if: steps.router.outputs.run_audit == 'true'
+        # checkout only fetches the PR's base branch (e.g. squid/tentacle/umbrella).
+        # The parity check needs the main ref to walk the commit history graph and find the upstream
+        # merge commit for each cherry-pick, so fetch it explicitly as origin/main.
+        run: git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+
       - name: Setup Python
         if: steps.router.outputs.run_audit == 'true'
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

From 2c9b73894b4525fb2fcb7abf33da4250fde92fe8 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 16:14:19 +0800
Subject: [PATCH 385/596] cmake: factor the ASan/LSan test options into cache
 variables

add_ceph_test() spelled out the suppression-file paths and sanitizer flags
inline.  bin/ceph needs the same options, so lift them into CEPH_ASAN_OPTIONS
and CEPH_LSAN_OPTIONS and have add_ceph_test() consume those.  The environment
the tests run with is unchanged.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 CMakeLists.txt                  | 7 +++++++
 cmake/modules/AddCephTest.cmake | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index f2abb516b65..0fcdf9664bc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -724,6 +724,13 @@ endif(LINUX)
 option(WITH_ASAN "build with ASAN" OFF)
 if(WITH_ASAN)
   list(APPEND sanitizers "address")
+  # Shared ASan/LSan runtime options: the in-tree suppression files plus the
+  # flags our tests need.  Consumed by add_ceph_test() and baked into bin/ceph
+  # so both ignore the same still-reachable third-party leaks.
+  set(CEPH_ASAN_OPTIONS "suppressions=${CMAKE_SOURCE_DIR}/qa/asan.supp,detect_odr_violation=0"
+      CACHE INTERNAL "ASAN_OPTIONS for ceph tests and the ceph CLI")
+  set(CEPH_LSAN_OPTIONS "suppressions=${CMAKE_SOURCE_DIR}/qa/lsan.supp,print_suppressions=0"
+      CACHE INTERNAL "LSAN_OPTIONS for ceph tests and the ceph CLI")
 endif()
 
 option(WITH_ASAN_LEAK "explicitly enable ASAN leak detection" OFF)
diff --git a/cmake/modules/AddCephTest.cmake b/cmake/modules/AddCephTest.cmake
index 49562e569b0..a96ea2231af 100644
--- a/cmake/modules/AddCephTest.cmake
+++ b/cmake/modules/AddCephTest.cmake
@@ -33,8 +33,8 @@ function(add_ceph_test test_name test_path)
     set_property(TEST ${test_name}
       APPEND
       PROPERTY ENVIRONMENT
-      ASAN_OPTIONS=suppressions=${CMAKE_SOURCE_DIR}/qa/asan.supp,detect_odr_violation=0
-      LSAN_OPTIONS=suppressions=${CMAKE_SOURCE_DIR}/qa/lsan.supp,print_suppressions=0)
+      ASAN_OPTIONS=${CEPH_ASAN_OPTIONS}
+      LSAN_OPTIONS=${CEPH_LSAN_OPTIONS})
   endif()
   set_property(TEST ${test_name}
     PROPERTY TIMEOUT ${CEPH_TEST_TIMEOUT})

From 55ac10180cd3a1bb202c8132c4caca30404bb6f8 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 16:14:19 +0800
Subject: [PATCH 386/596] ceph.in: load asan/lsan suppressions on WITH_ASAN
 builds

bin/ceph from a WITH_ASAN build aborts at exit, with LeakSanitizer reporting
CPython and Cython module-init allocations as leaks:

  ==2577940==ERROR: LeakSanitizer: detected memory leaks
  Direct leak ... in PyObject_Malloc (/usr/bin/python3.12+...)
    #4 __pyx_pymod_exec_rados rados_processed.c
  SUMMARY: AddressSanitizer: 32113 byte(s) leaked in 30 allocation(s).

These are interpreter globals that live for the process lifetime.  qa/lsan.supp
already suppresses them, but bin/ceph never loaded it: vstart.sh sets
LSAN_OPTIONS for the daemons it spawns, while a bin/ceph invoked separately
(ceph-api runs ./bin/ceph fsid once vstart.sh returns) inherits none and exits
non-zero.  It stayed hidden until radosgw-admin stopped crashing in vstart and
the run reached that call.

ceph.in already re-execs with the ASan runtime preloaded under WITH_ASAN.  Set
ASAN_OPTIONS and LSAN_OPTIONS first, from the CEPH_ASAN_OPTIONS and
CEPH_LSAN_OPTIONS that CMake also feeds add_ceph_test(), so the re-exec'd
interpreter starts with the suppressions loaded.  Use setdefault so a value
from the caller still wins.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/ceph.in | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/ceph.in b/src/ceph.in
index 4694da29db5..069888422c0 100755
--- a/src/ceph.in
+++ b/src/ceph.in
@@ -140,6 +140,13 @@ if os.path.exists(os.path.join(MYPDIR, "CMakeCache.txt")) \
         pythonlib_path = os.path.join(lib_path,
                                       "cython_modules",
                                       get_pythonlib_dir())
+        if with_asan:
+            # respawn_in_path() below re-execs with the ASan runtime preloaded.
+            # Load the same suppression options add_ceph_test() uses (configured
+            # by CMake) first, so the re-exec'd interpreter does not report
+            # CPython/Cython module-init allocations as leaks at exit.
+            os.environ.setdefault("ASAN_OPTIONS", "@CEPH_ASAN_OPTIONS@")
+            os.environ.setdefault("LSAN_OPTIONS", "@CEPH_LSAN_OPTIONS@")
         respawn_in_path(lib_path, pybind_path, pythonlib_path,
                         asan_lib_path if with_asan else None)
 

From 320a3a0529c7154918321c02e85d57674fb9bfce Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 16:14:19 +0800
Subject: [PATCH 387/596] qa/lsan.supp: suppress CPython 3.12/3.13 interpreter
 leaks

The python binaries on some CI images and dev boxes ship stripped, so the
allocator frames in an interpreter-shutdown leak come through unsymbolised
(/usr/bin/python3.13+0x...) and the function-name matches above cannot apply.
leak:python3.10 already handled this for 3.10, and a stale comment claimed 3.12
does not leak.

Add leak:python3.12 and leak:python3.13, mirroring the 3.10 entry, so the
interpreter globals are suppressed whatever CPython the build uses.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 qa/lsan.supp | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/qa/lsan.supp b/qa/lsan.supp
index e1a20fdccd8..df0897fc96e 100644
--- a/qa/lsan.supp
+++ b/qa/lsan.supp
@@ -29,15 +29,14 @@ leak:^PyUnicode_New
 leak:^PyMem_Malloc
 leak:^PyDict_Copy
 leak:^_PyObject_GC_NewVar
-# Catch unsymbolised interpreter frames in both the standalone
-# /usr/bin/python3.10 binary (used by the bin/ceph wrapper) and the
-# /lib/.../libpython3.10.so.1.0 embedded by C++ unittests such as
-# unittest_mgr_pyformatter / unittest_mgr_pyutil.  Not all CPython
-# 3.10 internal helpers are exported in .dynsym, so function-name
-# matches above don't cover everything; this substring-matches the
-# module path in the stack frame.  Remove when CI moves to >= 3.12.
+# Catch unsymbolised interpreter frames in the standalone python binary used by
+# the bin/ceph wrapper and in the libpython embedded by C++ unittests such as
+# unittest_mgr_pyformatter / unittest_mgr_pyutil.  Not all CPython internal
+# helpers are exported in .dynsym, so the function-name matches above don't
+# cover everything; this substring-matches the module path in the stack frame.
 leak:python3.10
-# python3.12 doesn't leak anything
+leak:python3.12
+leak:python3.13
 # python3.13
 leak:^PyModule_ExecDef
 

From f45a1bfc93596f17370ee38ce241ae8123d81e8e Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Tue, 23 Jun 2026 19:00:22 +0530
Subject: [PATCH 388/596] mgr/dashboard: fix bind address regression from
 CherryPy isolation

The CherryPy isolation refactor (PR #67227) accidentally changed the
dashboard bind address from wildcard (*:8443) to mon_ip:8443. The
get_mgr_ip() replacement was originally only for URI generation, but
the refactor passed the mutated address to CherryPyMgr.mount() as the
actual socket bind address.

This breaks the management gateway when its VIP is not on the same
interface as mon_ip, as the dashboard becomes unreachable on other
interfaces.

Preserve the original wildcard address for binding and only use
get_mgr_ip() for the advertised URI. Add regression test to prevent
future confusion between bind_addr and server_addr.

Fixes: https://tracker.ceph.com/issues/77491

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 src/pybind/mgr/dashboard/module.py            |  3 +-
 .../mgr/dashboard/tests/test_settings.py      | 29 +++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/pybind/mgr/dashboard/module.py b/src/pybind/mgr/dashboard/module.py
index fffa768575b..7b7bb3b77de 100644
--- a/src/pybind/mgr/dashboard/module.py
+++ b/src/pybind/mgr/dashboard/module.py
@@ -209,6 +209,7 @@ class CherryPyConfig(object):
         self._url_prefix = prepare_url_prefix(self.get_module_option(  # type: ignore
             'url_prefix', default=''))
 
+        bind_addr = server_addr
         if server_addr in ['::', '0.0.0.0']:
             server_addr = self.get_mgr_ip()  # type: ignore
         base_url = build_url(
@@ -217,7 +218,7 @@ class CherryPyConfig(object):
             port=server_port,
         )
         uri = f'{base_url}{self.url_prefix}/'
-        return uri, (server_addr, server_port), ssl_info, config
+        return uri, (bind_addr, server_port), ssl_info, config
 
     def await_configuration(self):
         """
diff --git a/src/pybind/mgr/dashboard/tests/test_settings.py b/src/pybind/mgr/dashboard/tests/test_settings.py
index d6c94b6b0b8..17dad550400 100644
--- a/src/pybind/mgr/dashboard/tests/test_settings.py
+++ b/src/pybind/mgr/dashboard/tests/test_settings.py
@@ -2,11 +2,13 @@
 
 import errno
 import unittest
+from unittest.mock import MagicMock
 
 from mgr_module import ERROR_MSG_EMPTY_INPUT_FILE
 
 from .. import settings
 from ..controllers.settings import Settings as SettingsController
+from ..module import CherryPyConfig
 from ..settings import Settings, handle_option_command
 from ..tests import ControllerTestCase, KVStoreMockMixin
 
@@ -125,6 +127,33 @@ class SettingsTest(unittest.TestCase, KVStoreMockMixin):
         self.assertEqual(str(ctx.exception),
                          "type object 'Options' has no attribute 'NON_EXISTENT_OPTION'")
 
+    def _setup_cherrypy_config(self, server_addr, server_port):
+        obj = CherryPyConfig()
+        config_map = {
+            'server_addr': server_addr,
+            'ssl': False,
+            'server_port': server_port
+        }
+        obj.get_localized_module_option = MagicMock(
+            side_effect=lambda key, default=None: config_map.get(key, default))
+        obj.get_mgr_ip = MagicMock(return_value='192.168.1.10')
+        obj.get_module_option = MagicMock(return_value='')
+        obj.get_mgr_id = MagicMock(return_value='test')
+        obj.module_name = 'dashboard'
+        obj.log = MagicMock()
+        obj.update_cherrypy_config = MagicMock()
+        return obj
+
+    def test_wildcard_bind_addr_preserved(self):
+        obj = self._setup_cherrypy_config('::', 8080)
+        _, bind_addr, _, _ = obj._configure()  # pylint: disable=protected-access
+        self.assertEqual(bind_addr, ('::', 8080))
+
+    def test_wildcard_bind_addr_preserved_ipv4(self):
+        obj = self._setup_cherrypy_config('0.0.0.0', 8443)
+        _, bind_addr, _, _ = obj._configure()  # pylint: disable=protected-access
+        self.assertEqual(bind_addr, ('0.0.0.0', 8443))
+
 
 class SettingsControllerTest(ControllerTestCase, KVStoreMockMixin):
     @classmethod

From cf695e6c81c3793056f08d6d7dd955d209e8e22b Mon Sep 17 00:00:00 2001
From: Laura Flores <lflores@ibm.com>
Date: Fri, 10 Apr 2026 16:41:47 -0500
Subject: [PATCH 389/596] qa/suites/upgrade: add POOL_FULL variations to
 ignorelist

Fixes: https://tracker.ceph.com/issues/75414
Signed-off-by: Laura Flores <lflores@ibm.com>
---
 qa/suites/upgrade/squid-x/parallel/0-start.yaml             | 3 +++
 qa/suites/upgrade/squid-x/stress-split/1-start.yaml         | 3 +++
 qa/suites/upgrade/telemetry-upgrade/squid-x/1-tasks.yaml    | 3 +++
 qa/suites/upgrade/telemetry-upgrade/tentacle-x/1-tasks.yaml | 3 +++
 qa/suites/upgrade/tentacle-x/parallel/0-start.yaml          | 3 +++
 qa/suites/upgrade/tentacle-x/stress-split/1-start.yaml      | 3 +++
 6 files changed, 18 insertions(+)

diff --git a/qa/suites/upgrade/squid-x/parallel/0-start.yaml b/qa/suites/upgrade/squid-x/parallel/0-start.yaml
index 111f6989b6b..108db8213b3 100644
--- a/qa/suites/upgrade/squid-x/parallel/0-start.yaml
+++ b/qa/suites/upgrade/squid-x/parallel/0-start.yaml
@@ -58,3 +58,6 @@ overrides:
       - OBJECT_UNFOUND
       - pg .* is stuck peering
       - OSD_HOST_DOWN
+      - POOL_FULL
+      - pool full
+      - pool\(s\) full
diff --git a/qa/suites/upgrade/squid-x/stress-split/1-start.yaml b/qa/suites/upgrade/squid-x/stress-split/1-start.yaml
index 59a29f39b0e..f777f007a06 100644
--- a/qa/suites/upgrade/squid-x/stress-split/1-start.yaml
+++ b/qa/suites/upgrade/squid-x/stress-split/1-start.yaml
@@ -36,6 +36,9 @@ overrides:
       - CEPHADM_FAILED_DAEMON
       - failed cephadm daemon
       - osd.* is in unknown state
+      - POOL_FULL
+      - pool full
+      - pool\(s\) full
 tasks:
 - install:
     branch: squid
diff --git a/qa/suites/upgrade/telemetry-upgrade/squid-x/1-tasks.yaml b/qa/suites/upgrade/telemetry-upgrade/squid-x/1-tasks.yaml
index e210c12e3d9..0033e9765da 100644
--- a/qa/suites/upgrade/telemetry-upgrade/squid-x/1-tasks.yaml
+++ b/qa/suites/upgrade/telemetry-upgrade/squid-x/1-tasks.yaml
@@ -26,6 +26,9 @@ overrides:
       - osd down
       - OBJECT_UNFOUND
       - OSD_HOST_DOWN
+      - POOL_FULL
+      - pool full
+      - pool\(s\) full
 tasks:
 - install:
     branch: squid
diff --git a/qa/suites/upgrade/telemetry-upgrade/tentacle-x/1-tasks.yaml b/qa/suites/upgrade/telemetry-upgrade/tentacle-x/1-tasks.yaml
index 65c0d5aa3c8..9ce22e5df08 100644
--- a/qa/suites/upgrade/telemetry-upgrade/tentacle-x/1-tasks.yaml
+++ b/qa/suites/upgrade/telemetry-upgrade/tentacle-x/1-tasks.yaml
@@ -26,6 +26,9 @@ overrides:
       - osd down
       - OBJECT_UNFOUND
       - OSD_HOST_DOWN
+      - POOL_FULL
+      - pool full
+      - pool\(s\) full
 tasks:
 - install:
     branch: tentacle
diff --git a/qa/suites/upgrade/tentacle-x/parallel/0-start.yaml b/qa/suites/upgrade/tentacle-x/parallel/0-start.yaml
index 68945102eef..415a09e8db0 100644
--- a/qa/suites/upgrade/tentacle-x/parallel/0-start.yaml
+++ b/qa/suites/upgrade/tentacle-x/parallel/0-start.yaml
@@ -59,3 +59,6 @@ overrides:
       - OBJECT_UNFOUND
       - PG_DEGRADED
       - OSD_HOST_DOWN
+      - POOL_FULL
+      - pool full
+      - pool\(s\) full
diff --git a/qa/suites/upgrade/tentacle-x/stress-split/1-start.yaml b/qa/suites/upgrade/tentacle-x/stress-split/1-start.yaml
index 9d8a4fbda7d..694f25019b7 100644
--- a/qa/suites/upgrade/tentacle-x/stress-split/1-start.yaml
+++ b/qa/suites/upgrade/tentacle-x/stress-split/1-start.yaml
@@ -36,6 +36,9 @@ overrides:
       - CEPHADM_FAILED_DAEMON
       - failed cephadm daemon
       - osd.* is in unknown state
+      - POOL_FULL
+      - pool full
+      - pool\(s\) full
 tasks:
 - install:
     branch: tentacle

From a1afaa6529ce6e4a980a9634c8c8c4ceb201cb42 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 15:46:05 +0800
Subject: [PATCH 390/596] cmake/boost: build libboost_context with
 BOOST_USE_ASAN

The ceph-api job failed under ASan: radosgw-admin aborted at startup with a
heap-buffer-overflow in boost.context's fiber resume().

  ==1155842==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8
    #0 boost::context::detail::fiber_activation_record::resume() fiber_ucontext.hpp:153
    #10 RGWSI_Notify::do_start(optional_yield, DoutPrefixProvider const*) svc_notify.cc:261
  0x... is located 8 bytes after 1048-byte region allocated by
    boost::context::detail::fiber_activation_record_initializer()

fiber_activation_record carries three extra members (fake_stack, stack_bottom,
stack_size) only when BOOST_USE_ASAN is defined.  Under WITH_ASAN we build
boost.context with context-impl=ucontext and give consumers BOOST_USE_ASAN and
BOOST_USE_UCONTEXT through Boost::context's INTERFACE_COMPILE_DEFINITIONS, but
we never pass BOOST_USE_ASAN to b2.  So libboost_context, which compiles
fiber_activation_record_initializer() and allocates the record, uses the
smaller no-ASan layout, while consumers that include the header (here rgw's
RGWSI_Notify::do_start via boost::asio::spawn) compile resume() with the larger
layout and read stack_bottom/stack_size past the allocation.

Pass define=BOOST_USE_ASAN to b2 so the library and its consumers agree on the
struct layout.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 CMakeLists.txt                 | 7 +------
 cmake/modules/BuildBoost.cmake | 6 ++++--
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index f2abb516b65..cb422fd759c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -825,12 +825,7 @@ else()
     # Boost.Context is built ucontext-only here (context-impl=ucontext); define
     # the matching backend tree-wide so every Boost.Context/Coroutine2 consumer
     # agrees on it, instead of relying on per-target propagation that is easy to miss.
-    # Except riscv64: its ASan mis-handles ucontext, so it keeps fcontext.
-    if(CMAKE_SYSTEM_PROCESSOR MATCHES "riscv")
-      add_compile_definitions(BOOST_USE_ASAN)
-    else()
-      add_compile_definitions(BOOST_USE_ASAN BOOST_USE_UCONTEXT)
-    endif()
+    add_compile_definitions(BOOST_USE_ASAN BOOST_USE_UCONTEXT)
   endif()
 endif()
 include_directories(BEFORE SYSTEM ${Boost_INCLUDE_DIRS})
diff --git a/cmake/modules/BuildBoost.cmake b/cmake/modules/BuildBoost.cmake
index 6f409dcdce1..6a00c6be2c0 100644
--- a/cmake/modules/BuildBoost.cmake
+++ b/cmake/modules/BuildBoost.cmake
@@ -146,9 +146,11 @@ function(do_build_boost root_dir version)
   endif()
   set(b2_targets headers stage)
   set(b2_install_targets install)
-  # Except riscv64: its ASan mis-handles ucontext, so it keeps fcontext.
-  if(WITH_ASAN AND NOT (CMAKE_SYSTEM_PROCESSOR MATCHES "riscv"))
+  if(WITH_ASAN)
     list(APPEND b2 context-impl=ucontext)
+    # build the library with the BOOST_USE_ASAN consumers get from Boost::context,
+    # so fiber_activation_record has one layout (else heap-buffer-overflow)
+    list(APPEND b2 define=BOOST_USE_ASAN)
     # `context-impl` is declared in libs/context/build/Jamfile.v2; the headers/stage
     # and install targets never load it, so b2 aborts with `unknown feature
     # "<context-impl>"`. Name the context project as a target so its Jamfile loads

From a33b19eb68f920afbf0522d9de3b8002e3f1d649 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 24 Jun 2026 07:11:24 +0800
Subject: [PATCH 391/596] script: fix invalid escape sequences

Python 3.12 warns on invalid escape sequences in non-raw strings:
```
  ceph-release-notes:45: SyntaxWarning: invalid escape sequence '\d'
  cpatch.py:465: SyntaxWarning: invalid escape sequence '\;'
```

In `cpatch.py`, use raw strings for the two Dockerfile RUN lines so
their find -exec ... \; keeps the literal backslash-semicolon.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/script/cpatch.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/script/cpatch.py b/src/script/cpatch.py
index 5e33e9b2c13..b891c8c70ea 100755
--- a/src/script/cpatch.py
+++ b/src/script/cpatch.py
@@ -462,12 +462,12 @@ class Builder:
         if os.path.isdir(self._workdir / "tmp_bin"):
             # For every binary file that was copied to the tmp_bin directory by the jobs above, search for the existing file in the container and replace it.
             dlines.append("ADD tmp_bin /tmpbin")
-            dlines.append("RUN for i in tmpbin/*; do find /usr/bin /usr/sbin -name $(basename $i) -exec mv -f $i '{}' \;; echo $(basename $i); done && rm -rf tmpbin")
+            dlines.append(r"RUN for i in tmpbin/*; do find /usr/bin /usr/sbin -name $(basename $i) -exec mv -f $i '{}' \;; echo $(basename $i); done && rm -rf tmpbin")
 
         if os.path.isdir(self._workdir / "tmp_lib"):
             # For every library file that was copied to the tmp_lib directory by the jobs above, search for the existing file in the container and replace it.
             dlines.append("ADD tmp_lib /tmplib")
-            dlines.append("RUN for i in tmplib/*; do find /usr/lib64 -name $(basename $i) -exec mv -f $i '{}' \;; echo $(basename $i); done && rm -rf tmplib")
+            dlines.append(r"RUN for i in tmplib/*; do find /usr/lib64 -name $(basename $i) -exec mv -f $i '{}' \;; echo $(basename $i); done && rm -rf tmplib")
 
         if os.path.isdir(self._workdir / "tmp_bin"):
             # by default locally built binaries assume /usr/local

From 095cff07beab9dc98c982a46358ef1a728900126 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Tue, 23 Jun 2026 08:13:37 +0800
Subject: [PATCH 392/596] crimson/common: use the value_map passed to
 dump_metric_value_map()

dump_metric_value_map() takes a value_map by const reference but ignored it
and iterated seastar::scollectd::get_value_map() instead.  Both callers already
fetch the map and pass it in, so the map was fetched twice per call and the
argument was dead.

Iterate vmap.  The output is unchanged, since the callers pass get_value_map(),
but the parameter now means what it says and the redundant fetch is gone.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/common/metrics_helpers.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crimson/common/metrics_helpers.h b/src/crimson/common/metrics_helpers.h
index bd63404c102..199d5c79da8 100644
--- a/src/crimson/common/metrics_helpers.h
+++ b/src/crimson/common/metrics_helpers.h
@@ -80,7 +80,7 @@ void dump_metric_value_map(
   F &&filter)
 {
   assert(f);
-  for (const auto& [full_name, metric_family]: seastar::scollectd::get_value_map()) {
+  for (const auto& [full_name, metric_family]: vmap) {
     if (!std::invoke(filter, full_name)) {
       continue;
     }

From deabf21144054ada7e6eb64d35c38adc44db130a Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Wed, 10 Jun 2026 12:51:14 +0200
Subject: [PATCH 393/596] node-proxy: add temperatures and fan speed

This adds the temperatures category and fan speed information.

Fixes: https://tracker.ceph.com/issues/77408

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 doc/hardware-monitoring/index.rst             |  2 ++
 src/ceph-node-proxy/ceph_node_proxy/api.py    |  6 ++++
 .../ceph_node_proxy/baseredfishsystem.py      | 28 ++++++++++++++++++-
 .../ceph_node_proxy/basesystem.py             |  3 ++
 .../ceph_node_proxy/protocols.py              |  2 ++
 .../ceph_node_proxy/redfish.py                | 15 +++++++++-
 .../tests/test_baseredfishsystem.py           | 16 +++++++++++
 src/pybind/mgr/cephadm/agent.py               | 10 +++++++
 .../mgr/cephadm/tests/node_proxy_data.py      |  2 +-
 .../mgr/cephadm/tests/test_node_proxy.py      | 12 ++++++++
 .../src/app/shared/enum/hardware.enum.ts      |  3 +-
 src/pybind/mgr/dashboard/services/hardware.py |  2 +-
 src/pybind/mgr/orchestrator/module.py         |  8 ++++--
 13 files changed, 101 insertions(+), 8 deletions(-)

diff --git a/doc/hardware-monitoring/index.rst b/doc/hardware-monitoring/index.rst
index de94f6ee6aa..033b89aa610 100644
--- a/doc/hardware-monitoring/index.rst
+++ b/doc/hardware-monitoring/index.rst
@@ -88,6 +88,7 @@ Supported categories are:
 * network
 * power
 * fans
+* temperatures
 * firmwares
 * criticals
 
@@ -187,6 +188,7 @@ For Developers
 .. automethod:: NodeProxyEndpoint.power
 .. automethod:: NodeProxyEndpoint.processors
 .. automethod:: NodeProxyEndpoint.fans
+.. automethod:: NodeProxyEndpoint.temperatures
 .. automethod:: NodeProxyEndpoint.firmwares
 .. automethod:: NodeProxyEndpoint.led
 
diff --git a/src/ceph-node-proxy/ceph_node_proxy/api.py b/src/ceph-node-proxy/ceph_node_proxy/api.py
index 0bb700820f0..e51a1a33977 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/api.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/api.py
@@ -110,6 +110,12 @@ class API(Server):
     def fans(self) -> Dict[str, Any]:
         return {"fans": self.backend.get_fans()}
 
+    @cherrypy.expose
+    @cherrypy.tools.allow(methods=["GET"])
+    @cherrypy.tools.json_out()
+    def temperatures(self) -> Dict[str, Any]:
+        return {"temperatures": self.backend.get_temperatures()}
+
     @cherrypy.expose
     @cherrypy.tools.allow(methods=["GET"])
     @cherrypy.tools.json_out()
diff --git a/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py b/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
index 4c4051951f1..15b513da6f0 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
@@ -33,7 +33,20 @@ class BaseRedfishSystem(BaseSystem):
         "Status",
     ]
     POWER_FIELDS: List[str] = ["Name", "Model", "Manufacturer", "Status"]
-    FANS_FIELDS: List[str] = ["Name", "PhysicalContext", "Status"]
+    FANS_FIELDS: List[str] = [
+        "Name",
+        "PhysicalContext",
+        "Reading",
+        "ReadingUnits",
+        "Status",
+    ]
+    TEMPERATURES_FIELDS: List[str] = [
+        "Name",
+        "PhysicalContext",
+        "Reading",
+        "ReadingUnits",
+        "Status",
+    ]
     FIRMWARES_FIELDS: List[str] = [
         "Name",
         "Description",
@@ -63,6 +76,11 @@ class BaseRedfishSystem(BaseSystem):
         "fans": [
             ComponentUpdateSpec("chassis", "Thermal", FANS_FIELDS, "Fans"),
         ],
+        "temperatures": [
+            ComponentUpdateSpec(
+                "chassis", "Thermal", TEMPERATURES_FIELDS, "Temperatures"
+            ),
+        ],
         "firmwares": [
             ComponentUpdateSpec(
                 "update_service", "FirmwareInventory", FIRMWARES_FIELDS, None
@@ -102,6 +120,7 @@ class BaseRedfishSystem(BaseSystem):
                 "memory",
                 "power",
                 "fans",
+                "temperatures",
                 "network",
                 "processors",
                 "storage",
@@ -209,6 +228,7 @@ class BaseRedfishSystem(BaseSystem):
                 "memory": self.get_memory(),
                 "power": self.get_power(),
                 "fans": self.get_fans(),
+                "temperatures": self.get_temperatures(),
             },
             "firmwares": self.get_firmwares(),
         }
@@ -251,6 +271,9 @@ class BaseRedfishSystem(BaseSystem):
     def get_fans(self) -> Dict[str, Dict[str, Dict]]:
         return dict(self._sys.get("fans", {}))
 
+    def get_temperatures(self) -> Dict[str, Dict[str, Dict]]:
+        return dict(self._sys.get("temperatures", {}))
+
     def get_component_spec_overrides(self) -> Dict[str, Dict[str, Any]]:
         return {}
 
@@ -361,6 +384,9 @@ class BaseRedfishSystem(BaseSystem):
     def _update_fans(self) -> None:
         self._run_update("fans")
 
+    def _update_temperatures(self) -> None:
+        self._run_update("temperatures")
+
     def _update_firmwares(self) -> None:
         self._run_update("firmwares")
 
diff --git a/src/ceph-node-proxy/ceph_node_proxy/basesystem.py b/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
index 3d02a7d4fad..025638b5cde 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
@@ -36,6 +36,9 @@ class BaseSystem(BaseThread):
     def get_fans(self) -> Dict[str, Dict[str, Dict]]:
         raise NotImplementedError()
 
+    def get_temperatures(self) -> Dict[str, Dict[str, Dict]]:
+        raise NotImplementedError()
+
     def get_power(self) -> Dict[str, Dict[str, Dict]]:
         raise NotImplementedError()
 
diff --git a/src/ceph-node-proxy/ceph_node_proxy/protocols.py b/src/ceph-node-proxy/ceph_node_proxy/protocols.py
index e8b91d76051..2b322e8ed7e 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/protocols.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/protocols.py
@@ -16,6 +16,8 @@ class SystemBackend(Protocol):
 
     def get_fans(self) -> Dict[str, Any]: ...
 
+    def get_temperatures(self) -> Dict[str, Any]: ...
+
     def get_firmwares(self) -> Dict[str, Any]: ...
 
     def get_led(self) -> Dict[str, Any]: ...
diff --git a/src/ceph-node-proxy/ceph_node_proxy/redfish.py b/src/ceph-node-proxy/ceph_node_proxy/redfish.py
index d51bf48d104..bbf17dad71e 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/redfish.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/redfish.py
@@ -231,6 +231,14 @@ class Endpoint:
         )
 
 
+def is_absent_member(item: Dict[str, Any]) -> bool:
+    status = item.get("Status")
+    if not isinstance(status, dict):
+        return False
+    state = status.get("State")
+    return isinstance(state, str) and state.lower() == "absent"
+
+
 def build_data(
     data: Dict[str, Any],
     fields: List[str],
@@ -247,6 +255,10 @@ def build_data(
             except KeyError:
                 log.debug(f"Could not find field: {field} in data: {d}")
                 out[to_snake_case(field)] = None
+        if out.get("reading") is None and "ReadingCelsius" in d:
+            out["reading"] = d["ReadingCelsius"]
+            if out.get("reading_units") is None:
+                out["reading_units"] = "Cel"
         return out
 
     try:
@@ -256,8 +268,9 @@ def build_data(
             data_items = [{"MemberId": k, **v} for k, v in data.items()]
         log.debug(f"build_data: data_items count={len(data_items)}")
         for d in data_items:
+            if is_absent_member(d):
+                continue
             member_id = d.get("MemberId")
-            result[member_id] = {}
             result[member_id] = process_data(member_id, fields, d)
     except (KeyError, TypeError, AttributeError) as e:
         log.error(f"Can't build data: {e}")
diff --git a/src/ceph-node-proxy/tests/test_baseredfishsystem.py b/src/ceph-node-proxy/tests/test_baseredfishsystem.py
index adac813a54c..2939081935c 100644
--- a/src/ceph-node-proxy/tests/test_baseredfishsystem.py
+++ b/src/ceph-node-proxy/tests/test_baseredfishsystem.py
@@ -48,6 +48,7 @@ class TestBaseRedfishSystemInit:
         assert "storage" in system.component_list
         assert "firmwares" in system.component_list
         assert "fans" in system.component_list
+        assert "temperatures" in system.component_list
 
     def test_init_update_funcs_populated(self, system):
         # Should have one callable per component that has _update_<name>
@@ -106,6 +107,9 @@ class TestBaseRedfishSystemGetters:
     def test_get_fans_empty(self, system):
         assert system.get_fans() == {}
 
+    def test_get_temperatures_empty(self, system):
+        assert system.get_temperatures() == {}
+
     def test_get_firmwares_empty(self, system):
         assert system.get_firmwares() == {}
 
@@ -122,6 +126,7 @@ class TestBaseRedfishSystemGetSystem:
         system._sys["storage"] = {}
         system._sys["power"] = {}
         system._sys["fans"] = {}
+        system._sys["temperatures"] = {}
         system._sys["firmwares"] = {}
         result = system.get_system()
         assert "host" in result
@@ -134,6 +139,7 @@ class TestBaseRedfishSystemGetSystem:
         assert result["status"]["storage"] == {}
         assert result["status"]["power"] == {}
         assert result["status"]["fans"] == {}
+        assert result["status"]["temperatures"] == {}
         assert "firmwares" in result
 
 
@@ -170,6 +176,15 @@ class TestBaseRedfishSystemGetSpecs:
         assert specs[0].collection == "chassis"
         assert specs[0].path == "Thermal"
         assert specs[0].attribute == "Fans"
+        assert "Reading" in specs[0].fields
+
+    def test_get_specs_temperatures(self, system):
+        specs = system.get_specs("temperatures")
+        assert len(specs) == 1
+        assert specs[0].collection == "chassis"
+        assert specs[0].path == "Thermal"
+        assert specs[0].attribute == "Temperatures"
+        assert "Reading" in specs[0].fields
 
     def test_get_component_spec_overrides_empty(self, system):
         assert system.get_component_spec_overrides() == {}
@@ -232,6 +247,7 @@ class TestBaseRedfishSystemComponentSpecs:
         assert "memory" in BaseRedfishSystem.COMPONENT_SPECS
         assert "power" in BaseRedfishSystem.COMPONENT_SPECS
         assert "fans" in BaseRedfishSystem.COMPONENT_SPECS
+        assert "temperatures" in BaseRedfishSystem.COMPONENT_SPECS
         assert "firmwares" in BaseRedfishSystem.COMPONENT_SPECS
 
     def test_field_lists_non_empty(self):
diff --git a/src/pybind/mgr/cephadm/agent.py b/src/pybind/mgr/cephadm/agent.py
index d767f1b24b5..166d9ba48c0 100644
--- a/src/pybind/mgr/cephadm/agent.py
+++ b/src/pybind/mgr/cephadm/agent.py
@@ -612,6 +612,16 @@ class NodeProxyEndpoint:
             raise cherrypy.HTTPError(404, f"{kw.get('hostname')} not found.")
         return results
 
+    @cherrypy.expose
+    @cherrypy.tools.allow(methods=['GET'])
+    @cherrypy.tools.json_out()
+    def temperatures(self, **kw: Any) -> Dict[str, Any]:
+        try:
+            results = self.mgr.node_proxy_cache.common('temperatures', **kw)
+        except (KeyError, OrchestratorError):
+            raise cherrypy.HTTPError(404, f"{kw.get('hostname')} not found.")
+        return results
+
     @cherrypy.expose
     @cherrypy.tools.allow(methods=['GET'])
     @cherrypy.tools.json_out()
diff --git a/src/pybind/mgr/cephadm/tests/node_proxy_data.py b/src/pybind/mgr/cephadm/tests/node_proxy_data.py
index fa768f1d4c6..6f103dbeba1 100644
--- a/src/pybind/mgr/cephadm/tests/node_proxy_data.py
+++ b/src/pybind/mgr/cephadm/tests/node_proxy_data.py
@@ -1,3 +1,3 @@
 full_set_with_critical = {'host': 'host01', 'sn': '12345', 'status': {'storage': {'1': {'disk.bay.0:enclosure.internal.0-1:raid.integrated.1-1': {'description': 'Solid State Disk 0:1:0', 'entity': 'RAID.Integrated.1-1', 'capacity_bytes': 959656755200, 'model': 'KPM5XVUG960G', 'protocol': 'SAS', 'serial_number': '8080A1CRTP5F', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 0, 'locationtype': 'Slot'}}}, 'disk.bay.9:enclosure.internal.0-1': {'description': 'PCIe SSD in Slot 9 in Bay 1', 'entity': 'CPU.1', 'capacity_bytes': 1600321314816, 'model': 'Dell Express Flash NVMe P4610 1.6TB SFF', 'protocol': 'PCIe', 'serial_number': 'PHLN035305MN1P6AGN', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 9, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 20, 'total_threads': 40, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'nic.slot.1-1-1': {'description': 'NIC in Slot 1 Port 1 Partition 1', 'name': 'System Ethernet Interface', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'StandbyOffline'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 31237, 'status': {'health': 'Critical', 'state': 'Enabled'}}}}}, 'firmwares': {}}
 mgr_inventory_cache = {'host01': {'hostname': 'host01', 'addr': '10.10.10.11', 'labels': ['_admin'], 'status': '', 'oob': {'hostname': '10.10.10.11', 'username': 'root', 'password': 'ceph123'}}, 'host02': {'hostname': 'host02', 'addr': '10.10.10.12', 'labels': [], 'status': '', 'oob': {'hostname': '10.10.10.12', 'username': 'root', 'password': 'ceph123'}}}
-full_set = {'host01': {'host': 'host01', 'sn': 'FR8Y5X3', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmwares': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'host02': {'host': 'host02', 'sn': 'FR8Y5X4', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmwares': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}
+full_set = {'host01': {'host': 'host01', 'sn': 'FR8Y5X3', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmwares': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'host02': {'host': 'host02', 'sn': 'FR8Y5X4', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmwares': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}
diff --git a/src/pybind/mgr/cephadm/tests/test_node_proxy.py b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
index 75fe7d6fab9..dd6593fd273 100644
--- a/src/pybind/mgr/cephadm/tests/test_node_proxy.py
+++ b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
@@ -319,6 +319,18 @@ class TestNodeProxyEndpoint(helper.CPWebCase):
         self.getPage("/host03/fans", method="GET")
         self.assertStatus('404 Not Found')
 
+    def test_temperatures_with_valid_hostname(self):
+        self.getPage("/host02/temperatures", method="GET")
+        self.assertStatus('200 OK')
+
+    def test_temperatures_no_hostname(self):
+        self.getPage("/temperatures", method="GET")
+        self.assertStatus('200 OK')
+
+    def test_temperatures_with_invalid_hostname(self):
+        self.getPage("/host03/temperatures", method="GET")
+        self.assertStatus('404 Not Found')
+
     def test_firmwares_with_valid_hostname(self):
         self.getPage("/host02/firmwares", method="GET")
         self.assertStatus('200 OK')
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/hardware.enum.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/hardware.enum.ts
index 7956dfa5d7c..ae115d05001 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/hardware.enum.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/hardware.enum.ts
@@ -4,5 +4,6 @@ export enum HardwareNameMapping {
   processors = 'CPU',
   network = 'Network',
   power = 'Power supply',
-  fans = 'Fan module'
+  fans = 'Fan module',
+  temperatures = 'Temperature'
 }
diff --git a/src/pybind/mgr/dashboard/services/hardware.py b/src/pybind/mgr/dashboard/services/hardware.py
index 31054ab4cc7..2aa89f422a3 100644
--- a/src/pybind/mgr/dashboard/services/hardware.py
+++ b/src/pybind/mgr/dashboard/services/hardware.py
@@ -75,7 +75,7 @@ class HardwareService(object):
     @staticmethod
     def validate_categories(categories: Optional[List[str]]) -> List[str]:
         categories_list = ['memory', 'storage', 'processors',
-                           'network', 'power', 'fans']
+                           'network', 'power', 'fans', 'temperatures']
 
         if isinstance(categories, str):
             categories = [categories]
diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index 8a1cbea42fc..abb5f205435 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -534,7 +534,8 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             'processors': ['HOST', 'SYS_ID', 'NAME', 'MODEL', 'CORES', 'THREADS', 'STATUS', 'STATE'],
             'network': ['HOST', 'SYS_ID', 'NAME', 'SPEED', 'STATUS', 'STATE'],
             'power': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'MODEL', 'MANUFACTURER', 'STATUS', 'STATE'],
-            'fans': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'STATUS', 'STATE']
+            'fans': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'READING', 'UNITS', 'STATUS', 'STATE'],
+            'temperatures': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'READING', 'UNITS', 'STATUS', 'STATE'],
         }
 
         if category not in table_heading_mapping.keys():
@@ -619,7 +620,8 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             'processors': ('model', 'total_cores', 'total_threads', 'health', 'state'),
             'network': ('name', 'speed_mbps', 'health', 'state'),
             'power': ('name', 'model', 'manufacturer', 'health', 'state'),
-            'fans': ('name', 'health', 'state')
+            'fans': ('name', 'reading', 'reading_units', 'health', 'state'),
+            'temperatures': ('name', 'reading', 'reading_units', 'health', 'state'),
         }
 
         fields = mapping.get(category, ())
@@ -634,7 +636,7 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
                             row.append(v['status'][field])
                         else:
                             row.append('')
-                    if category in ('power', 'fans', 'processors'):
+                    if category in ('power', 'fans', 'temperatures', 'processors'):
                         table.add_row((host, sys_id,) + (k,) + tuple(row))
                     else:
                         table.add_row((host, sys_id,) + tuple(row))

From 9b3bfd171afe6714cb23dc0fe55bacad671a94dc Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Wed, 10 Jun 2026 12:51:47 +0200
Subject: [PATCH 394/596] node-proxy: override with atollon specific

This adds AtollonSystem for AMI/Atollon BMCs:
- memory Id mapping,
- storage description fixes,
- StorageControllers based drive enrichment

It also wires vendor selection through cephadm (hw_monitoring_vendor)
and show slot/firmware in hardware status storage output.

Fixes: https://tracker.ceph.com/issues/77408

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 .../ceph_node_proxy/atollon.py                | 118 ++++++++++++-
 .../ceph_node_proxy/bootstrap.py              |   7 +-
 src/ceph-node-proxy/ceph_node_proxy/config.py |   3 +
 src/ceph-node-proxy/ceph_node_proxy/main.py   |   1 +
 src/ceph-node-proxy/tests/test_atollon.py     | 165 ++++++++++++++++++
 src/ceph-node-proxy/tests/test_config.py      |  61 +++++++
 src/ceph-node-proxy/tests/test_redfish.py     |  63 +++++++
 src/pybind/mgr/cephadm/module.py              |   7 +
 src/pybind/mgr/cephadm/services/node_proxy.py |   1 +
 src/pybind/mgr/orchestrator/module.py         |   4 +-
 10 files changed, 425 insertions(+), 5 deletions(-)
 create mode 100644 src/ceph-node-proxy/tests/test_atollon.py
 create mode 100644 src/ceph-node-proxy/tests/test_config.py
 create mode 100644 src/ceph-node-proxy/tests/test_redfish.py

diff --git a/src/ceph-node-proxy/ceph_node_proxy/atollon.py b/src/ceph-node-proxy/ceph_node_proxy/atollon.py
index f870d455d18..32aa249b4be 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/atollon.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/atollon.py
@@ -1,10 +1,126 @@
-from typing import Any
+import re
+from typing import Any, Dict, Optional
 
 from ceph_node_proxy.baseredfishsystem import BaseRedfishSystem
 from ceph_node_proxy.util import get_logger
 
+INVALID_SERIALS = ("unknown", "not available", "n/a", "")
+
 
 class AtollonSystem(BaseRedfishSystem):
     def __init__(self, **kw: Any) -> None:
         super().__init__(**kw)
         self.log = get_logger(__name__)
+
+    def get_component_spec_overrides(self) -> Dict[str, Dict[str, Any]]:
+        return {
+            "memory": {
+                "fields": [
+                    "Id" if field == "Description" else field
+                    for field in BaseRedfishSystem.MEMORY_FIELDS
+                ],
+            },
+        }
+
+    def _update_memory(self) -> None:
+        super()._update_memory()
+        for members in self._sys.get("memory", {}).values():
+            for member_data in members.values():
+                member_id = member_data.get("id")
+                if member_id is not None and member_data.get("description") is None:
+                    member_data["description"] = member_id
+
+    def _update_storage(self) -> None:
+        super()._update_storage()
+        self.fix_storage_descriptions()
+        self.enrich_storage_from_controllers()
+
+    def fix_storage_descriptions(self) -> None:
+        for members in self._sys.get("storage", {}).values():
+            for drive_id, drive_data in members.items():
+                description = drive_data.get("description")
+                if description is not None and description != "unknown":
+                    continue
+                endpoint = drive_data.get("redfish_endpoint", "")
+                if isinstance(endpoint, str) and endpoint:
+                    drive_data["description"] = endpoint.rstrip("/").split("/")[-1]
+                else:
+                    drive_data["description"] = drive_id
+
+    def enrich_storage_from_controllers(self) -> None:
+        for member in self.endpoints["systems"].get_members_names():
+            drives = self._sys.get("storage", {}).get(member)
+            if not drives:
+                continue
+            storage_units = self.endpoints["systems"][member]["Storage"].get_members_data()
+            for entity, storage_unit in storage_units.items():
+                controllers = storage_unit.get("StorageControllers") or []
+                by_serial: Dict[str, Dict[str, Any]] = {}
+                by_member_id: Dict[str, Dict[str, Any]] = {}
+                for controller in controllers:
+                    member_id = controller.get("MemberId")
+                    if member_id is not None:
+                        by_member_id[str(member_id)] = controller
+                    serial = controller.get("SerialNumber")
+                    if isinstance(serial, str) and serial.lower() not in INVALID_SERIALS:
+                        by_serial[serial] = controller
+                for drive_key, drive_data in drives.items():
+                    if drive_data.get("entity") != entity:
+                        continue
+                    controller = self.match_storage_controller(
+                        drive_key, drive_data, by_serial, by_member_id
+                    )
+                    if controller is not None:
+                        self.apply_storage_controller(drive_data, controller)
+
+    def match_storage_controller(
+        self,
+        drive_key: str,
+        drive_data: Dict[str, Any],
+        by_serial: Dict[str, Dict[str, Any]],
+        by_member_id: Dict[str, Dict[str, Any]],
+    ) -> Optional[Dict[str, Any]]:
+        serial = drive_data.get("serial_number")
+        if isinstance(serial, str) and serial.lower() not in INVALID_SERIALS:
+            controller = by_serial.get(serial)
+            if controller is not None:
+                return controller
+        description = drive_data.get("description")
+        device_index = self.parse_drive_device_index(drive_key, description)
+        if device_index is not None:
+            return by_member_id.get(device_index)
+        return None
+
+    def parse_drive_device_index(
+        self, drive_key: str, description: Any
+    ) -> Optional[str]:
+        for text in (description, drive_key):
+            if not isinstance(text, str):
+                continue
+            match = re.search(r"Device(\d+)", text, re.IGNORECASE)
+            if match:
+                return match.group(1)
+        return None
+
+    def apply_storage_controller(
+        self, drive_data: Dict[str, Any], controller: Dict[str, Any]
+    ) -> None:
+        firmware_version = controller.get("FirmwareVersion")
+        if firmware_version is not None:
+            drive_data["firmware_version"] = firmware_version
+        member_id = controller.get("MemberId")
+        if member_id is not None:
+            drive_data["slot"] = member_id
+            if drive_data.get("physical_location") in (None, "unknown"):
+                slot_value: Any = (
+                    int(member_id) if str(member_id).isdigit() else member_id
+                )
+                drive_data["physical_location"] = {
+                    "partlocation": {
+                        "locationordinalvalue": slot_value,
+                        "locationtype": "Slot",
+                    }
+                }
+        speed_gbps = controller.get("SpeedGbps")
+        if speed_gbps is not None:
+            drive_data["speed_gbps"] = speed_gbps
diff --git a/src/ceph-node-proxy/ceph_node_proxy/bootstrap.py b/src/ceph-node-proxy/ceph_node_proxy/bootstrap.py
index 352d9c562b0..0e85718c5c0 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/bootstrap.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/bootstrap.py
@@ -1,7 +1,7 @@
 from typing import TYPE_CHECKING
 
 from ceph_node_proxy.config import CephadmConfig, get_node_proxy_config
-from ceph_node_proxy.util import DEFAULTS, write_tmp_file
+from ceph_node_proxy.util import DEFAULTS, _deep_merge, write_tmp_file
 
 if TYPE_CHECKING:
     from ceph_node_proxy.main import NodeProxyManager
@@ -18,9 +18,12 @@ def create_node_proxy_manager(cephadm_config: CephadmConfig) -> "NodeProxyManage
         cephadm_config.root_cert_pem,
         prefix_name="cephadm-endpoint-root-cert-",
     )
+    defaults = DEFAULTS
+    if cephadm_config.system:
+        defaults = _deep_merge(DEFAULTS, {"system": cephadm_config.system})
     config = get_node_proxy_config(
         path=cephadm_config.node_proxy_config_path,
-        defaults=DEFAULTS,
+        defaults=defaults,
     )
 
     manager = NodeProxyManager(
diff --git a/src/ceph-node-proxy/ceph_node_proxy/config.py b/src/ceph-node-proxy/ceph_node_proxy/config.py
index 50bb3a89996..c331e70e3cc 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/config.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/config.py
@@ -30,6 +30,7 @@ class CephadmConfig:
     listener_key: str
     name: str
     node_proxy_config_path: str
+    system: Dict[str, Any]
 
     @classmethod
     def from_dict(cls, data: Dict[str, Any]) -> CephadmConfig:
@@ -41,6 +42,7 @@ class CephadmConfig:
             "NODE_PROXY_CONFIG", "/etc/ceph/node-proxy.yml"
         )
         assert node_proxy_config_path is not None
+        system = data.get("system")
         return cls(
             target_ip=data["target_ip"],
             target_port=data["target_port"],
@@ -50,6 +52,7 @@ class CephadmConfig:
             listener_key=data["listener.key"],
             name=data["name"],
             node_proxy_config_path=node_proxy_config_path,
+            system=system if isinstance(system, dict) else {},
         )
 
 
diff --git a/src/ceph-node-proxy/ceph_node_proxy/main.py b/src/ceph-node-proxy/ceph_node_proxy/main.py
index a7869a4119c..6f0ab0b593d 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/main.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/main.py
@@ -104,6 +104,7 @@ class NodeProxyManager:
             raise SystemExit(1)
         try:
             vendor = self.config.get("system", {}).get("vendor", "generic")
+            self.log.info("Using Redfish vendor: %s", vendor)
             system_cls = get_system_class(vendor)
             self.system = system_cls(
                 host=oob_details["host"],
diff --git a/src/ceph-node-proxy/tests/test_atollon.py b/src/ceph-node-proxy/tests/test_atollon.py
new file mode 100644
index 00000000000..7c4b9a179e1
--- /dev/null
+++ b/src/ceph-node-proxy/tests/test_atollon.py
@@ -0,0 +1,165 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from ceph_node_proxy.atollon import AtollonSystem
+from ceph_node_proxy.baseredfishsystem import BaseRedfishSystem
+
+
+@pytest.fixture
+def atollon_system():
+    with (
+        patch("ceph_node_proxy.baseredfishsystem.RedFishClient", return_value=MagicMock()),
+        patch("ceph_node_proxy.baseredfishsystem.EndpointMgr", return_value=MagicMock()),
+    ):
+        return AtollonSystem(
+            host="testhost",
+            port="443",
+            username="user",
+            password="secret",
+            config={},
+        )
+
+
+class TestAtollonSystemMemoryOverrides:
+    def test_get_specs_memory_uses_id_instead_of_description(self, atollon_system):
+        specs = atollon_system.get_specs("memory")
+        assert len(specs) == 1
+        assert "Id" in specs[0].fields
+        assert "Description" not in specs[0].fields
+        assert "MemoryDeviceType" in specs[0].fields
+
+    def test_update_memory_maps_id_to_description(self, atollon_system):
+        atollon_system._sys["memory"] = {
+            "1": {
+                "dimm0": {
+                    "id": "dimm0",
+                    "memory_device_type": "DDR4",
+                    "capacity_mib": 16384,
+                    "status": {"health": "OK", "state": "Enabled"},
+                },
+            },
+        }
+
+        with patch.object(BaseRedfishSystem, "_update_memory") as mock_super:
+            mock_super.side_effect = lambda: None
+            atollon_system._update_memory()
+
+        assert atollon_system._sys["memory"]["1"]["dimm0"]["description"] == "dimm0"
+
+
+class TestAtollonSystemStorageOverrides:
+    def test_update_storage_replaces_unknown_description(self, atollon_system):
+        atollon_system._sys["storage"] = {
+            "Self": {
+                "nvme_device0_nsid1": {
+                    "description": "unknown",
+                    "model": "Micron_2550_MTFDKBK512TGE",
+                    "capacity_bytes": 512110190592,
+                    "protocol": "NVMe",
+                    "serial_number": "24424BAA3C40",
+                    "status": {"health": "OK", "state": "Enabled"},
+                    "redfish_endpoint": (
+                        "/redfish/v1/Systems/Self/Storage/StorageUnit_0/"
+                        "Drives/NVMe_Device0_NSID1"
+                    ),
+                    "entity": "StorageUnit_0",
+                },
+            },
+        }
+
+        with patch.object(BaseRedfishSystem, "_update_storage") as mock_super:
+            mock_super.side_effect = lambda: None
+            atollon_system.fix_storage_descriptions()
+
+        drive = atollon_system._sys["storage"]["Self"]["nvme_device0_nsid1"]
+        assert drive["description"] == "NVMe_Device0_NSID1"
+
+    def test_enrich_storage_from_controllers_by_serial(self, atollon_system):
+        atollon_system._sys["storage"] = {
+            "Self": {
+                "nvme_device0_nsid1": {
+                    "description": "NVMe_Device0_NSID1",
+                    "model": "Micron_2550_MTFDKBK512TGE",
+                    "serial_number": "24424BAA3C40",
+                    "entity": "StorageUnit_0",
+                    "physical_location": "unknown",
+                },
+            },
+        }
+        mock_storage = MagicMock()
+        mock_storage.get_members_data.return_value = {
+            "StorageUnit_0": {
+                "StorageControllers": [
+                    {
+                        "MemberId": "0",
+                        "SerialNumber": "24424BAA3C40",
+                        "FirmwareVersion": "V6MA001",
+                        "SpeedGbps": 63.02,
+                    },
+                ],
+            },
+        }
+        member_endpoint = MagicMock()
+        member_endpoint.__getitem__ = MagicMock(
+            side_effect=lambda key: mock_storage if key == "Storage" else MagicMock()
+        )
+        systems_endpoint = MagicMock()
+        systems_endpoint.get_members_names.return_value = ["Self"]
+        systems_endpoint.__getitem__ = MagicMock(
+            side_effect=lambda key: member_endpoint if key == "Self" else MagicMock()
+        )
+        atollon_system.endpoints = MagicMock()
+        atollon_system.endpoints.__getitem__ = MagicMock(
+            side_effect=lambda key: systems_endpoint if key == "systems" else MagicMock()
+        )
+
+        atollon_system.enrich_storage_from_controllers()
+
+        drive = atollon_system._sys["storage"]["Self"]["nvme_device0_nsid1"]
+        assert drive["firmware_version"] == "V6MA001"
+        assert drive["slot"] == "0"
+        assert drive["speed_gbps"] == 63.02
+        assert drive["physical_location"]["partlocation"]["locationordinalvalue"] == 0
+
+    def test_enrich_storage_from_controllers_by_device_index(self, atollon_system):
+        atollon_system._sys["storage"] = {
+            "Self": {
+                "nvme_device2_nsid1": {
+                    "description": "NVMe_Device2_NSID1",
+                    "serial_number": "unknown",
+                    "entity": "StorageUnit_0",
+                },
+            },
+        }
+        mock_storage = MagicMock()
+        mock_storage.get_members_data.return_value = {
+            "StorageUnit_0": {
+                "StorageControllers": [
+                    {
+                        "MemberId": "2",
+                        "SerialNumber": "03NK797YS344D57S056",
+                        "FirmwareVersion": "000A5305",
+                    },
+                ],
+            },
+        }
+        member_endpoint = MagicMock()
+        member_endpoint.__getitem__ = MagicMock(
+            side_effect=lambda key: mock_storage if key == "Storage" else MagicMock()
+        )
+        systems_endpoint = MagicMock()
+        systems_endpoint.get_members_names.return_value = ["Self"]
+        systems_endpoint.__getitem__ = MagicMock(
+            side_effect=lambda key: member_endpoint if key == "Self" else MagicMock()
+        )
+        atollon_system.endpoints = MagicMock()
+        atollon_system.endpoints.__getitem__ = MagicMock(
+            side_effect=lambda key: systems_endpoint if key == "systems" else MagicMock()
+        )
+
+        atollon_system.enrich_storage_from_controllers()
+
+        drive = atollon_system._sys["storage"]["Self"]["nvme_device2_nsid1"]
+        assert drive["firmware_version"] == "000A5305"
+        assert drive["slot"] == "2"
diff --git a/src/ceph-node-proxy/tests/test_config.py b/src/ceph-node-proxy/tests/test_config.py
new file mode 100644
index 00000000000..3fa307f08c8
--- /dev/null
+++ b/src/ceph-node-proxy/tests/test_config.py
@@ -0,0 +1,61 @@
+import json
+import tempfile
+from pathlib import Path
+
+from ceph_node_proxy.config import CephadmConfig, get_node_proxy_config, load_cephadm_config
+from ceph_node_proxy.util import DEFAULTS, _deep_merge
+
+
+def test_cephadm_config_parses_system_vendor() -> None:
+    data = {
+        "target_ip": "10.0.0.1",
+        "target_port": "8443",
+        "keyring": "secret",
+        "root_cert.pem": "ca",
+        "listener.crt": "crt",
+        "listener.key": "key",
+        "name": "node-proxy.host01",
+        "system": {"vendor": "atollon"},
+    }
+    config = CephadmConfig.from_dict(data)
+    assert config.system == {"vendor": "atollon"}
+
+
+def test_load_cephadm_config_from_file() -> None:
+    payload = {
+        "target_ip": "10.0.0.1",
+        "target_port": "8443",
+        "keyring": "secret",
+        "root_cert.pem": "ca",
+        "listener.crt": "crt",
+        "listener.key": "key",
+        "name": "node-proxy.host01",
+        "system": {"vendor": "atollon"},
+    }
+    with tempfile.TemporaryDirectory() as tmpdir:
+        path = Path(tmpdir) / "node-proxy.json"
+        path.write_text(json.dumps(payload))
+        config = load_cephadm_config(str(path))
+        assert config.system["vendor"] == "atollon"
+
+
+def test_cephadm_system_vendor_merged_into_node_proxy_config() -> None:
+    cephadm_config = CephadmConfig.from_dict(
+        {
+            "target_ip": "10.0.0.1",
+            "target_port": "8443",
+            "keyring": "secret",
+            "root_cert.pem": "ca",
+            "listener.crt": "crt",
+            "listener.key": "key",
+            "name": "node-proxy.host01",
+            "system": {"vendor": "atollon"},
+        }
+    )
+    defaults = _deep_merge(DEFAULTS, {"system": cephadm_config.system})
+    with tempfile.TemporaryDirectory() as tmpdir:
+        config = get_node_proxy_config(
+            path=str(Path(tmpdir) / "missing.yml"),
+            defaults=defaults,
+        )
+        assert config.get("system", {}).get("vendor") == "atollon"
diff --git a/src/ceph-node-proxy/tests/test_redfish.py b/src/ceph-node-proxy/tests/test_redfish.py
new file mode 100644
index 00000000000..bb1a2d39d86
--- /dev/null
+++ b/src/ceph-node-proxy/tests/test_redfish.py
@@ -0,0 +1,63 @@
+from unittest.mock import MagicMock
+
+from ceph_node_proxy.redfish import build_data
+
+
+def test_build_data_thermal_fans_and_temperatures() -> None:
+    thermal = {
+        "Fans": [
+            {
+                "MemberId": "0",
+                "Name": "FAN1_TACH_IN",
+                "PhysicalContext": "Fan",
+                "Reading": 23835,
+                "ReadingUnits": "RPM",
+                "Status": {"Health": "OK", "State": "Enabled"},
+            }
+        ],
+        "Temperatures": [
+            {
+                "MemberId": "0",
+                "Name": "C1_DCSCM_TEMP",
+                "PhysicalContext": "Intake",
+                "ReadingCelsius": 31,
+                "Status": {"Health": "OK", "State": "Enabled"},
+            }
+        ],
+    }
+    log = MagicMock()
+    fields = ["Name", "PhysicalContext", "Reading", "ReadingUnits", "Status"]
+
+    fans = build_data(thermal, fields, log, attribute="Fans")
+    assert fans["0"]["reading"] == 23835
+    assert fans["0"]["reading_units"] == "RPM"
+
+    temps = build_data(thermal, fields, log, attribute="Temperatures")
+    assert temps["0"]["reading"] == 31
+    assert temps["0"]["reading_units"] == "Cel"
+
+
+def test_build_data_skips_absent_members() -> None:
+    thermal = {
+        "Temperatures": [
+            {
+                "MemberId": "0",
+                "Name": "C1_DCSCM_TEMP",
+                "PhysicalContext": "Intake",
+                "ReadingCelsius": 31,
+                "Status": {"Health": "OK", "State": "Enabled"},
+            },
+            {
+                "MemberId": "1",
+                "Name": "C1_DIMMB_TEMP",
+                "PhysicalContext": "Intake",
+                "Status": {"State": "Absent"},
+            },
+        ],
+    }
+    log = MagicMock()
+    fields = ["Name", "PhysicalContext", "Reading", "ReadingUnits", "Status"]
+
+    temps = build_data(thermal, fields, log, attribute="Temperatures")
+    assert list(temps.keys()) == ["0"]
+    assert temps["0"]["name"] == "C1_DCSCM_TEMP"
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 96cb2aee2d0..3bd1bbfb73d 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -400,6 +400,12 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             default=False,
             desc='Whether the hardware monitoring daemon be deployed on every host?'
         ),
+        Option(
+            'hw_monitoring_vendor',
+            type='str',
+            default='generic',
+            desc='Redfish vendor implementation for node-proxy (generic, dell, atollon).'
+        ),
         Option(
             'max_osd_draining_count',
             type='int',
@@ -621,6 +627,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
             self.agent_down_multiplier = 0.0
             self.agent_starting_port = 0
             self.hw_monitoring = False
+            self.hw_monitoring_vendor = 'generic'
             self.service_discovery_port = 0
             self.secure_monitoring_stack = False
             self.apply_spec_fails: List[Tuple[str, str]] = []
diff --git a/src/pybind/mgr/cephadm/services/node_proxy.py b/src/pybind/mgr/cephadm/services/node_proxy.py
index 9b9de4e6e13..908d8fad3c6 100644
--- a/src/pybind/mgr/cephadm/services/node_proxy.py
+++ b/src/pybind/mgr/cephadm/services/node_proxy.py
@@ -68,6 +68,7 @@ class NodeProxy(CephService):
             'root_cert.pem': self.mgr.cert_mgr.get_root_ca(),
             'listener.crt': tls_pair.cert,
             'listener.key': tls_pair.key,
+            'system': {'vendor': self.mgr.hw_monitoring_vendor},
         }
         config = {'node-proxy.json': json.dumps(cfg)}
 
diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index abb5f205435..0930d3f267b 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -530,7 +530,7 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             'firmwares': ['HOST', 'COMPONENT', 'NAME', 'DATE', 'VERSION', 'STATUS'],
             'criticals': ['HOST', 'SYS_ID', 'COMPONENT', 'NAME', 'STATUS', 'STATE'],
             'memory': ['HOST', 'SYS_ID', 'NAME', 'STATUS', 'STATE'],
-            'storage': ['HOST', 'SYS_ID', 'NAME', 'MODEL', 'SIZE', 'PROTOCOL', 'SN', 'STATUS', 'STATE'],
+            'storage': ['HOST', 'SYS_ID', 'NAME', 'MODEL', 'SIZE', 'PROTOCOL', 'SN', 'SLOT', 'FW', 'STATUS', 'STATE'],
             'processors': ['HOST', 'SYS_ID', 'NAME', 'MODEL', 'CORES', 'THREADS', 'STATUS', 'STATE'],
             'network': ['HOST', 'SYS_ID', 'NAME', 'SPEED', 'STATUS', 'STATE'],
             'power': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'MODEL', 'MANUFACTURER', 'STATUS', 'STATE'],
@@ -616,7 +616,7 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             return json.dumps(data)
         mapping = {
             'memory': ('description', 'health', 'state'),
-            'storage': ('description', 'model', 'capacity_bytes', 'protocol', 'serial_number', 'health', 'state'),
+            'storage': ('description', 'model', 'capacity_bytes', 'protocol', 'serial_number', 'slot', 'firmware_version', 'health', 'state'),
             'processors': ('model', 'total_cores', 'total_threads', 'health', 'state'),
             'network': ('name', 'speed_mbps', 'health', 'state'),
             'power': ('name', 'model', 'manufacturer', 'health', 'state'),

From 1cd4b32d72a4a14cbd797187e791e038422f4fc3 Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Mon, 15 Jun 2026 15:18:48 +0200
Subject: [PATCH 395/596] node-proxy: rename firmwares to firmware with legacy
 aliases

Let's use 'firmware' as the standard name in node-proxy, cephadm,
and orch hardware status.

We still accept 'firmwares' as a deprecated alias and read legacy
cache payloads transparently for backward compatibility.

Fixes: https://tracker.ceph.com/issues/77410

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 doc/hardware-monitoring/index.rst             |  6 ++---
 src/ceph-node-proxy/ceph_node_proxy/api.py    |  8 ++++++-
 .../ceph_node_proxy/baseredfishsystem.py      | 18 +++++++--------
 .../ceph_node_proxy/basesystem.py             |  2 +-
 .../ceph_node_proxy/protocols.py              |  2 +-
 .../tests/test_baseredfishsystem.py           | 12 +++++-----
 src/pybind/mgr/cephadm/agent.py               | 12 +++++++---
 src/pybind/mgr/cephadm/inventory.py           | 12 +++++++---
 src/pybind/mgr/cephadm/module.py              |  6 ++++-
 .../mgr/cephadm/tests/node_proxy_data.py      |  4 ++--
 .../mgr/cephadm/tests/test_node_proxy.py      | 22 +++++++++++--------
 src/pybind/mgr/orchestrator/_interface.py     | 10 ++++++++-
 src/pybind/mgr/orchestrator/module.py         | 13 ++++++-----
 13 files changed, 82 insertions(+), 45 deletions(-)

diff --git a/doc/hardware-monitoring/index.rst b/doc/hardware-monitoring/index.rst
index 033b89aa610..900a9129456 100644
--- a/doc/hardware-monitoring/index.rst
+++ b/doc/hardware-monitoring/index.rst
@@ -89,7 +89,7 @@ Supported categories are:
 * power
 * fans
 * temperatures
-* firmwares
+* firmware
 * criticals
 
 
@@ -144,7 +144,7 @@ ________________
 
 .. prompt:: bash # auto
 
-  # ceph orch hardware status node-10 --category firmwares
+  # ceph orch hardware status node-10 --category firmware
   +------------+----------------------------------------------------------------------------+--------------------------------------------------------------+----------------------+-------------+--------+
   |    HOST    |                                 COMPONENT                                  |                             NAME                             |         DATE         |   VERSION   | STATUS |
   +------------+----------------------------------------------------------------------------+--------------------------------------------------------------+----------------------+-------------+--------+
@@ -189,6 +189,6 @@ For Developers
 .. automethod:: NodeProxyEndpoint.processors
 .. automethod:: NodeProxyEndpoint.fans
 .. automethod:: NodeProxyEndpoint.temperatures
-.. automethod:: NodeProxyEndpoint.firmwares
+.. automethod:: NodeProxyEndpoint.firmware
 .. automethod:: NodeProxyEndpoint.led
 
diff --git a/src/ceph-node-proxy/ceph_node_proxy/api.py b/src/ceph-node-proxy/ceph_node_proxy/api.py
index e51a1a33977..563ac88c8f7 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/api.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/api.py
@@ -116,11 +116,17 @@ class API(Server):
     def temperatures(self) -> Dict[str, Any]:
         return {"temperatures": self.backend.get_temperatures()}
 
+    @cherrypy.expose
+    @cherrypy.tools.allow(methods=["GET"])
+    @cherrypy.tools.json_out()
+    def firmware(self) -> Dict[str, Any]:
+        return {"firmware": self.backend.get_firmware()}
+
     @cherrypy.expose
     @cherrypy.tools.allow(methods=["GET"])
     @cherrypy.tools.json_out()
     def firmwares(self) -> Dict[str, Any]:
-        return {"firmwares": self.backend.get_firmwares()}
+        return {"firmwares": self.backend.get_firmware()}
 
     def _cp_dispatch(self, vpath: List[str]) -> "API":
         if vpath[0] == "led" and len(vpath) > 1:  # /led/{type}/{id}
diff --git a/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py b/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
index 15b513da6f0..3da5a0f9398 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
@@ -47,7 +47,7 @@ class BaseRedfishSystem(BaseSystem):
         "ReadingUnits",
         "Status",
     ]
-    FIRMWARES_FIELDS: List[str] = [
+    FIRMWARE_FIELDS: List[str] = [
         "Name",
         "Description",
         "ReleaseDate",
@@ -81,9 +81,9 @@ class BaseRedfishSystem(BaseSystem):
                 "chassis", "Thermal", TEMPERATURES_FIELDS, "Temperatures"
             ),
         ],
-        "firmwares": [
+        "firmware": [
             ComponentUpdateSpec(
-                "update_service", "FirmwareInventory", FIRMWARES_FIELDS, None
+                "update_service", "FirmwareInventory", FIRMWARE_FIELDS, None
             ),
         ],
     }
@@ -124,7 +124,7 @@ class BaseRedfishSystem(BaseSystem):
                 "network",
                 "processors",
                 "storage",
-                "firmwares",
+                "firmware",
             ],
         )
         self.update_funcs: List[Callable] = []
@@ -230,7 +230,7 @@ class BaseRedfishSystem(BaseSystem):
                 "fans": self.get_fans(),
                 "temperatures": self.get_temperatures(),
             },
-            "firmwares": self.get_firmwares(),
+            "firmware": self.get_firmware(),
         }
         return result
 
@@ -262,8 +262,8 @@ class BaseRedfishSystem(BaseSystem):
     def get_storage(self) -> Dict[str, Dict[str, Dict]]:
         return dict(self._sys.get("storage", {}))
 
-    def get_firmwares(self) -> Dict[str, Dict[str, Dict]]:
-        return dict(self._sys.get("firmwares", {}))
+    def get_firmware(self) -> Dict[str, Dict[str, Dict]]:
+        return dict(self._sys.get("firmware", {}))
 
     def get_power(self) -> Dict[str, Dict[str, Dict]]:
         return dict(self._sys.get("power", {}))
@@ -387,8 +387,8 @@ class BaseRedfishSystem(BaseSystem):
     def _update_temperatures(self) -> None:
         self._run_update("temperatures")
 
-    def _update_firmwares(self) -> None:
-        self._run_update("firmwares")
+    def _update_firmware(self) -> None:
+        self._run_update("firmware")
 
     def device_led_on(self, device: str) -> int:
         raise NotImplementedError()
diff --git a/src/ceph-node-proxy/ceph_node_proxy/basesystem.py b/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
index 025638b5cde..aecc0e137c0 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
@@ -48,7 +48,7 @@ class BaseSystem(BaseThread):
     def get_storage(self) -> Dict[str, Dict[str, Dict]]:
         raise NotImplementedError()
 
-    def get_firmwares(self) -> Dict[str, Dict[str, Dict]]:
+    def get_firmware(self) -> Dict[str, Dict[str, Dict]]:
         raise NotImplementedError()
 
     def get_sn(self) -> str:
diff --git a/src/ceph-node-proxy/ceph_node_proxy/protocols.py b/src/ceph-node-proxy/ceph_node_proxy/protocols.py
index 2b322e8ed7e..e82d425bea5 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/protocols.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/protocols.py
@@ -18,7 +18,7 @@ class SystemBackend(Protocol):
 
     def get_temperatures(self) -> Dict[str, Any]: ...
 
-    def get_firmwares(self) -> Dict[str, Any]: ...
+    def get_firmware(self) -> Dict[str, Any]: ...
 
     def get_led(self) -> Dict[str, Any]: ...
 
diff --git a/src/ceph-node-proxy/tests/test_baseredfishsystem.py b/src/ceph-node-proxy/tests/test_baseredfishsystem.py
index 2939081935c..28a90521406 100644
--- a/src/ceph-node-proxy/tests/test_baseredfishsystem.py
+++ b/src/ceph-node-proxy/tests/test_baseredfishsystem.py
@@ -46,7 +46,7 @@ class TestBaseRedfishSystemInit:
         assert "network" in system.component_list
         assert "processors" in system.component_list
         assert "storage" in system.component_list
-        assert "firmwares" in system.component_list
+        assert "firmware" in system.component_list
         assert "fans" in system.component_list
         assert "temperatures" in system.component_list
 
@@ -110,8 +110,8 @@ class TestBaseRedfishSystemGetters:
     def test_get_temperatures_empty(self, system):
         assert system.get_temperatures() == {}
 
-    def test_get_firmwares_empty(self, system):
-        assert system.get_firmwares() == {}
+    def test_get_firmware_empty(self, system):
+        assert system.get_firmware() == {}
 
     def test_get_status_empty(self, system):
         assert system.get_status() == {}
@@ -127,7 +127,7 @@ class TestBaseRedfishSystemGetSystem:
         system._sys["power"] = {}
         system._sys["fans"] = {}
         system._sys["temperatures"] = {}
-        system._sys["firmwares"] = {}
+        system._sys["firmware"] = {}
         result = system.get_system()
         assert "host" in result
         assert "sn" in result
@@ -140,7 +140,7 @@ class TestBaseRedfishSystemGetSystem:
         assert result["status"]["power"] == {}
         assert result["status"]["fans"] == {}
         assert result["status"]["temperatures"] == {}
-        assert "firmwares" in result
+        assert "firmware" in result
 
 
 class TestBaseRedfishSystemGetSpecs:
@@ -248,7 +248,7 @@ class TestBaseRedfishSystemComponentSpecs:
         assert "power" in BaseRedfishSystem.COMPONENT_SPECS
         assert "fans" in BaseRedfishSystem.COMPONENT_SPECS
         assert "temperatures" in BaseRedfishSystem.COMPONENT_SPECS
-        assert "firmwares" in BaseRedfishSystem.COMPONENT_SPECS
+        assert "firmware" in BaseRedfishSystem.COMPONENT_SPECS
 
     def test_field_lists_non_empty(self):
         assert len(BaseRedfishSystem.NETWORK_FIELDS) > 0
diff --git a/src/pybind/mgr/cephadm/agent.py b/src/pybind/mgr/cephadm/agent.py
index 166d9ba48c0..a7405c969a2 100644
--- a/src/pybind/mgr/cephadm/agent.py
+++ b/src/pybind/mgr/cephadm/agent.py
@@ -206,7 +206,7 @@ class NodeProxyEndpoint:
         for sys_id in data.keys():
             for member in data[sys_id].keys():
                 member_data = data[sys_id][member]
-                if member == 'firmwares':
+                if member in ('firmware', 'firmwares'):
                     continue
                 _status = self._get_health_value(member_data)
                 if _status and _status != 'ok':
@@ -626,11 +626,17 @@ class NodeProxyEndpoint:
     @cherrypy.tools.allow(methods=['GET'])
     @cherrypy.tools.json_out()
     def firmwares(self, **kw: Any) -> Dict[str, Any]:
+        return self.firmware(**kw)
+
+    @cherrypy.expose
+    @cherrypy.tools.allow(methods=['GET'])
+    @cherrypy.tools.json_out()
+    def firmware(self, **kw: Any) -> Dict[str, Any]:
         """
         Handles GET request to retrieve firmware information.
 
         This function is exposed to handle GET requests and fetches firmware data using
-        the 'firmwares' method from the NodeProxyCache class.
+        the 'firmware' method from the NodeProxyCache class.
 
         :param kw: Keyword arguments for the request.
         :type kw: dict
@@ -641,7 +647,7 @@ class NodeProxyEndpoint:
         :raises cherrypy.HTTPError 404: If the passed hostname is not found.
         """
         try:
-            results = self.mgr.node_proxy_cache.firmwares(**kw)
+            results = self.mgr.node_proxy_cache.firmware(**kw)
         except (KeyError, OrchestratorError):
             raise cherrypy.HTTPError(404, f"{kw.get('hostname')} not found.")
         return results
diff --git a/src/pybind/mgr/cephadm/inventory.py b/src/pybind/mgr/cephadm/inventory.py
index 3f6f75df5ac..7e396401e38 100644
--- a/src/pybind/mgr/cephadm/inventory.py
+++ b/src/pybind/mgr/cephadm/inventory.py
@@ -1636,6 +1636,12 @@ class NodeProxyCache:
         self.oob: Dict[str, Any] = {}
         self.keyrings: Dict[str, str] = {}
 
+    @staticmethod
+    def _host_firmware(host_data: Dict[str, Any]) -> Any:
+        if 'firmware' in host_data:
+            return host_data['firmware']
+        return host_data.get('firmwares', {})
+
     def load(self) -> None:
         _oob = self.mgr.get_store(f'{NODE_PROXY_CACHE_PREFIX}/oob', '{}')
         self.oob = json.loads(_oob)
@@ -1755,7 +1761,7 @@ class NodeProxyCache:
                 _result[host]['status'][component] = state
             _result[host]['sn'] = data['sn']
             _result[host]['host'] = data['host']
-            _result[host]['status']['firmwares'] = data['firmwares']
+            _result[host]['status']['firmware'] = self._host_firmware(data)
         return _result
 
     def common(self, endpoint: str, **kw: Any) -> Dict[str, Any]:
@@ -1783,7 +1789,7 @@ class NodeProxyCache:
                 raise KeyError(f'Invalid host {host} or component {endpoint}.')
         return _result
 
-    def firmwares(self, **kw: Any) -> Dict[str, Any]:
+    def firmware(self, **kw: Any) -> Dict[str, Any]:
         """
         Retrieves firmware information for a specific hostname or all hosts.
 
@@ -1798,7 +1804,7 @@ class NodeProxyCache:
         :rtype: Dict[str, Any]
         """
         hosts = self._resolve_hosts(**kw)
-        return {host: self.data[host]['firmwares'] for host in hosts}
+        return {host: self._host_firmware(self.data[host]) for host in hosts}
 
     def get_critical_from_host(self, hostname: str) -> Dict[str, Any]:
         if hostname not in self.data:
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 3bd1bbfb73d..7edfe244d70 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -2300,9 +2300,13 @@ Then run the following:
     def node_proxy_summary(self, hostname: Optional[str] = None) -> Dict[str, Any]:
         return self.node_proxy_cache.summary(hostname=hostname)
 
+    @handle_orch_error
+    def node_proxy_firmware(self, hostname: Optional[str] = None) -> Dict[str, Any]:
+        return self.node_proxy_cache.firmware(hostname=hostname)
+
     @handle_orch_error
     def node_proxy_firmwares(self, hostname: Optional[str] = None) -> Dict[str, Any]:
-        return self.node_proxy_cache.firmwares(hostname=hostname)
+        return self.node_proxy_cache.firmware(hostname=hostname)
 
     @handle_orch_error
     def node_proxy_criticals(self, hostname: Optional[str] = None) -> Dict[str, Any]:
diff --git a/src/pybind/mgr/cephadm/tests/node_proxy_data.py b/src/pybind/mgr/cephadm/tests/node_proxy_data.py
index 6f103dbeba1..3c01582d756 100644
--- a/src/pybind/mgr/cephadm/tests/node_proxy_data.py
+++ b/src/pybind/mgr/cephadm/tests/node_proxy_data.py
@@ -1,3 +1,3 @@
-full_set_with_critical = {'host': 'host01', 'sn': '12345', 'status': {'storage': {'1': {'disk.bay.0:enclosure.internal.0-1:raid.integrated.1-1': {'description': 'Solid State Disk 0:1:0', 'entity': 'RAID.Integrated.1-1', 'capacity_bytes': 959656755200, 'model': 'KPM5XVUG960G', 'protocol': 'SAS', 'serial_number': '8080A1CRTP5F', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 0, 'locationtype': 'Slot'}}}, 'disk.bay.9:enclosure.internal.0-1': {'description': 'PCIe SSD in Slot 9 in Bay 1', 'entity': 'CPU.1', 'capacity_bytes': 1600321314816, 'model': 'Dell Express Flash NVMe P4610 1.6TB SFF', 'protocol': 'PCIe', 'serial_number': 'PHLN035305MN1P6AGN', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 9, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 20, 'total_threads': 40, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'nic.slot.1-1-1': {'description': 'NIC in Slot 1 Port 1 Partition 1', 'name': 'System Ethernet Interface', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'StandbyOffline'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 31237, 'status': {'health': 'Critical', 'state': 'Enabled'}}}}}, 'firmwares': {}}
+full_set_with_critical = {'host': 'host01', 'sn': '12345', 'status': {'storage': {'1': {'disk.bay.0:enclosure.internal.0-1:raid.integrated.1-1': {'description': 'Solid State Disk 0:1:0', 'entity': 'RAID.Integrated.1-1', 'capacity_bytes': 959656755200, 'model': 'KPM5XVUG960G', 'protocol': 'SAS', 'serial_number': '8080A1CRTP5F', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 0, 'locationtype': 'Slot'}}}, 'disk.bay.9:enclosure.internal.0-1': {'description': 'PCIe SSD in Slot 9 in Bay 1', 'entity': 'CPU.1', 'capacity_bytes': 1600321314816, 'model': 'Dell Express Flash NVMe P4610 1.6TB SFF', 'protocol': 'PCIe', 'serial_number': 'PHLN035305MN1P6AGN', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 9, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 20, 'total_threads': 40, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'nic.slot.1-1-1': {'description': 'NIC in Slot 1 Port 1 Partition 1', 'name': 'System Ethernet Interface', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'StandbyOffline'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 31237, 'status': {'health': 'Critical', 'state': 'Enabled'}}}}}, 'firmware': {}}
 mgr_inventory_cache = {'host01': {'hostname': 'host01', 'addr': '10.10.10.11', 'labels': ['_admin'], 'status': '', 'oob': {'hostname': '10.10.10.11', 'username': 'root', 'password': 'ceph123'}}, 'host02': {'hostname': 'host02', 'addr': '10.10.10.12', 'labels': [], 'status': '', 'oob': {'hostname': '10.10.10.12', 'username': 'root', 'password': 'ceph123'}}}
-full_set = {'host01': {'host': 'host01', 'sn': 'FR8Y5X3', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmwares': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'host02': {'host': 'host02', 'sn': 'FR8Y5X4', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmwares': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}
+full_set = {'host01': {'host': 'host01', 'sn': 'FR8Y5X3', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmware': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'host02': {'host': 'host02', 'sn': 'FR8Y5X4', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmware': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}
diff --git a/src/pybind/mgr/cephadm/tests/test_node_proxy.py b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
index dd6593fd273..ba311b19421 100644
--- a/src/pybind/mgr/cephadm/tests/test_node_proxy.py
+++ b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
@@ -331,14 +331,18 @@ class TestNodeProxyEndpoint(helper.CPWebCase):
         self.getPage("/host03/temperatures", method="GET")
         self.assertStatus('404 Not Found')
 
-    def test_firmwares_with_valid_hostname(self):
+    def test_firmware_with_valid_hostname(self):
+        self.getPage("/host02/firmware", method="GET")
+        self.assertStatus('200 OK')
+
+    def test_firmware_no_hostname(self):
+        self.getPage("/firmware", method="GET")
+        self.assertStatus('200 OK')
+
+    def test_firmware_with_invalid_hostname(self):
+        self.getPage("/host03/firmware", method="GET")
+        self.assertStatus('404 Not Found')
+
+    def test_firmwares_legacy_endpoint(self):
         self.getPage("/host02/firmwares", method="GET")
         self.assertStatus('200 OK')
-
-    def test_firmwares_no_hostname(self):
-        self.getPage("/firmwares", method="GET")
-        self.assertStatus('200 OK')
-
-    def test_firmwares_with_invalid_hostname(self):
-        self.getPage("/host03/firmwares", method="GET")
-        self.assertStatus('404 Not Found')
diff --git a/src/pybind/mgr/orchestrator/_interface.py b/src/pybind/mgr/orchestrator/_interface.py
index a17d20f0961..1266b84df55 100644
--- a/src/pybind/mgr/orchestrator/_interface.py
+++ b/src/pybind/mgr/orchestrator/_interface.py
@@ -367,9 +367,17 @@ class Orchestrator(object):
         """
         raise NotImplementedError()
 
+    def node_proxy_firmware(self, hostname: Optional[str] = None) -> OrchResult[Dict[str, Any]]:
+        """
+        Return node-proxy firmware report
+
+        :param hostname: hostname
+        """
+        raise NotImplementedError()
+
     def node_proxy_firmwares(self, hostname: Optional[str] = None) -> OrchResult[Dict[str, Any]]:
         """
-        Return node-proxy firmwares report
+        Return node-proxy firmware report (deprecated alias)
 
         :param hostname: hostname
         """
diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index 0930d3f267b..c6024549618 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -527,7 +527,7 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
         table_heading_mapping = {
             'summary': ['HOST', 'SN', 'STORAGE', 'CPU', 'NET', 'MEMORY', 'POWER', 'FANS'],
             'fullreport': [],
-            'firmwares': ['HOST', 'COMPONENT', 'NAME', 'DATE', 'VERSION', 'STATUS'],
+            'firmware': ['HOST', 'COMPONENT', 'NAME', 'DATE', 'VERSION', 'STATUS'],
             'criticals': ['HOST', 'SYS_ID', 'COMPONENT', 'NAME', 'STATUS', 'STATE'],
             'memory': ['HOST', 'SYS_ID', 'NAME', 'STATUS', 'STATE'],
             'storage': ['HOST', 'SYS_ID', 'NAME', 'MODEL', 'SIZE', 'PROTOCOL', 'SN', 'SLOT', 'FW', 'STATUS', 'STATE'],
@@ -538,6 +538,9 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             'temperatures': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'READING', 'UNITS', 'STATUS', 'STATE'],
         }
 
+        if category == 'firmwares':
+            category = 'firmware'
+
         if category not in table_heading_mapping.keys():
             return HandleCommandResult(stdout=f"'{category}' is not a valid category.")
 
@@ -567,8 +570,8 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
                 completion = self.node_proxy_fullreport(hostname=hostname)
                 fullreport: Dict[str, Any] = raise_if_exception(completion)
                 output = json.dumps(fullreport)
-        elif category == 'firmwares':
-            output = 'Missing host name' if hostname is None else self._firmwares_table(hostname, table, format)
+        elif category == 'firmware':
+            output = 'Missing host name' if hostname is None else self._firmware_table(hostname, table, format)
         elif category == 'criticals':
             output = self._criticals_table(hostname, table, format)
         else:
@@ -576,8 +579,8 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
 
         return HandleCommandResult(stdout=output)
 
-    def _firmwares_table(self, hostname: Optional[str], table: PrettyTable, format: Format) -> str:
-        completion = self.node_proxy_firmwares(hostname=hostname)
+    def _firmware_table(self, hostname: Optional[str], table: PrettyTable, format: Format) -> str:
+        completion = self.node_proxy_firmware(hostname=hostname)
         data = raise_if_exception(completion)
         # data = self.node_proxy_firmware(hostname=hostname)
         if format == Format.json:

From e982412a7a1f1ec6fc2fe70d11e839365b50aa91 Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Thu, 18 Jun 2026 16:54:38 +0200
Subject: [PATCH 396/596] node-proxy: expose FCM stats

Collect FCM stats locally from NVMe drives (vendor log page 0xCA)
and expose them via node-proxy, the cephadm agent, and
`ceph orch hardware status --category fcm`.

Introduce a node backend that aggregates Redfish data with
node-local collectors, since FCM metrics are not available
from the BMC.

Fixes: https://tracker.ceph.com/issues/77521

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 src/ceph-node-proxy/ceph_node_proxy/api.py    |   6 +
 .../ceph_node_proxy/atollon.py                |   8 +-
 .../ceph_node_proxy/baseredfishsystem.py      |  20 +-
 .../ceph_node_proxy/basesystem.py             |   3 +
 .../ceph_node_proxy/fcm_stats.py              | 284 ++++++++++++++++++
 .../ceph_node_proxy/local_collectors.py       |  66 ++++
 src/ceph-node-proxy/ceph_node_proxy/main.py   |   6 +-
 .../ceph_node_proxy/node_backend.py           | 143 +++++++++
 .../ceph_node_proxy/protocols.py              |   2 +
 .../ceph_node_proxy/registry.py               |  71 ++++-
 src/ceph-node-proxy/tests/test_atollon.py     |  54 ++--
 .../tests/test_baseredfishsystem.py           |   4 +
 src/ceph-node-proxy/tests/test_fcm_stats.py   | 196 ++++++++++++
 .../tests/test_local_collectors.py            |  52 ++++
 .../tests/test_node_backend.py                | 107 +++++++
 src/pybind/mgr/cephadm/agent.py               |  10 +
 .../mgr/cephadm/tests/node_proxy_data.py      |   2 +-
 .../mgr/cephadm/tests/test_node_proxy.py      |  12 +
 src/pybind/mgr/orchestrator/module.py         |   5 +
 19 files changed, 996 insertions(+), 55 deletions(-)
 create mode 100644 src/ceph-node-proxy/ceph_node_proxy/fcm_stats.py
 create mode 100644 src/ceph-node-proxy/ceph_node_proxy/local_collectors.py
 create mode 100644 src/ceph-node-proxy/ceph_node_proxy/node_backend.py
 create mode 100644 src/ceph-node-proxy/tests/test_fcm_stats.py
 create mode 100644 src/ceph-node-proxy/tests/test_local_collectors.py
 create mode 100644 src/ceph-node-proxy/tests/test_node_backend.py

diff --git a/src/ceph-node-proxy/ceph_node_proxy/api.py b/src/ceph-node-proxy/ceph_node_proxy/api.py
index 563ac88c8f7..7df31540afd 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/api.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/api.py
@@ -98,6 +98,12 @@ class API(Server):
     def storage(self) -> Dict[str, Any]:
         return {"storage": self.backend.get_storage()}
 
+    @cherrypy.expose
+    @cherrypy.tools.allow(methods=["GET"])
+    @cherrypy.tools.json_out()
+    def fcm(self) -> Dict[str, Any]:
+        return {"fcm": self.backend.get_fcm()}
+
     @cherrypy.expose
     @cherrypy.tools.allow(methods=["GET"])
     @cherrypy.tools.json_out()
diff --git a/src/ceph-node-proxy/ceph_node_proxy/atollon.py b/src/ceph-node-proxy/ceph_node_proxy/atollon.py
index 32aa249b4be..c440535ffb2 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/atollon.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/atollon.py
@@ -7,7 +7,9 @@ from ceph_node_proxy.util import get_logger
 INVALID_SERIALS = ("unknown", "not available", "n/a", "")
 
 
-class AtollonSystem(BaseRedfishSystem):
+class AtollonRedfishProvider(BaseRedfishSystem):
+    """Redfish provider for Atollon BMC quirks."""
+
     def __init__(self, **kw: Any) -> None:
         super().__init__(**kw)
         self.log = get_logger(__name__)
@@ -124,3 +126,7 @@ class AtollonSystem(BaseRedfishSystem):
         speed_gbps = controller.get("SpeedGbps")
         if speed_gbps is not None:
             drive_data["speed_gbps"] = speed_gbps
+
+
+# Backward-compatible alias for entry points and external imports.
+AtollonSystem = AtollonRedfishProvider
diff --git a/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py b/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
index 3da5a0f9398..3d9b0ab97e8 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/baseredfishsystem.py
@@ -139,6 +139,16 @@ class BaseRedfishSystem(BaseSystem):
             "refresh_interval", DEFAULTS["system"]["refresh_interval"]
         )
 
+    def initialize_redfish_session(self) -> None:
+        self.client.login()
+        self.endpoints.init()
+
+    def run_update_cycle(self) -> None:
+        self._update_system()
+        self._update_sn()
+        with concurrent.futures.ThreadPoolExecutor() as executor:
+            executor.map(lambda f: f(), self.update_funcs)
+
     def update(
         self,
         collection: str,
@@ -160,8 +170,7 @@ class BaseRedfishSystem(BaseSystem):
 
     def main(self) -> None:
         self.stop = False
-        self.client.login()
-        self.endpoints.init()
+        self.initialize_redfish_session()
 
         while not self.stop:
             self.log.debug("waiting for a lock in the update loop.")
@@ -169,12 +178,7 @@ class BaseRedfishSystem(BaseSystem):
                 if not self.pending_shutdown:
                     self.log.debug("lock acquired in the update loop.")
                     try:
-                        self._update_system()
-                        self._update_sn()
-
-                        with concurrent.futures.ThreadPoolExecutor() as executor:
-                            executor.map(lambda f: f(), self.update_funcs)
-
+                        self.run_update_cycle()
                         self.data_ready = True
                     except RuntimeError as e:
                         self.stop = True
diff --git a/src/ceph-node-proxy/ceph_node_proxy/basesystem.py b/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
index aecc0e137c0..405b9d3c1d9 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/basesystem.py
@@ -48,6 +48,9 @@ class BaseSystem(BaseThread):
     def get_storage(self) -> Dict[str, Dict[str, Dict]]:
         raise NotImplementedError()
 
+    def get_fcm(self) -> Dict[str, Dict[str, Dict]]:
+        return {}
+
     def get_firmware(self) -> Dict[str, Dict[str, Dict]]:
         raise NotImplementedError()
 
diff --git a/src/ceph-node-proxy/ceph_node_proxy/fcm_stats.py b/src/ceph-node-proxy/ceph_node_proxy/fcm_stats.py
new file mode 100644
index 00000000000..9e235760ba9
--- /dev/null
+++ b/src/ceph-node-proxy/ceph_node_proxy/fcm_stats.py
@@ -0,0 +1,284 @@
+import ctypes
+import fcntl
+import glob
+import os
+import struct
+from typing import Optional, TypedDict
+
+from ceph_node_proxy.util import get_logger
+
+SYSFS_BLOCK = "/sys/block"
+
+NVME_ADMIN_OPC_GET_LOG_PAGE = 0x02
+NVME_NSID_ALL = 0xFFFFFFFF
+FCM_LOG_PAGE_ID = 0xCA
+FCM_LOG_PAGE_LEN = 32
+FCM_LOG_PAGE_OFFSET = 280
+FCM_RATIO_DISPLAY_MIN_LOG_UTIL_PERCENT = 0.05
+
+_IOC_NRBITS = 8
+_IOC_TYPEBITS = 8
+_IOC_SIZEBITS = 14
+_IOC_DIRBITS = 2
+_IOC_NRSHIFT = 0
+_IOC_TYPESHIFT = _IOC_NRSHIFT + _IOC_NRBITS
+_IOC_SIZESHIFT = _IOC_TYPESHIFT + _IOC_TYPEBITS
+_IOC_DIRSHIFT = _IOC_SIZESHIFT + _IOC_SIZEBITS
+
+
+def ioc(dir_: int, type_: str, nr: int, size: int) -> int:
+    return (
+        (dir_ << _IOC_DIRSHIFT)
+        | (ord(type_) << _IOC_TYPESHIFT)
+        | (nr << _IOC_NRSHIFT)
+        | (size << _IOC_SIZESHIFT)
+    )
+
+
+class _NvmePassthruCmd64(ctypes.Structure):
+    _fields_ = [
+        ("opcode", ctypes.c_uint8),
+        ("flags", ctypes.c_uint8),
+        ("rsvd1", ctypes.c_uint16),
+        ("nsid", ctypes.c_uint32),
+        ("cdw2", ctypes.c_uint32),
+        ("cdw3", ctypes.c_uint32),
+        ("metadata", ctypes.c_uint64),
+        ("addr", ctypes.c_uint64),
+        ("metadata_len", ctypes.c_uint32),
+        ("data_len", ctypes.c_uint32),
+        ("cdw10", ctypes.c_uint32),
+        ("cdw11", ctypes.c_uint32),
+        ("cdw12", ctypes.c_uint32),
+        ("cdw13", ctypes.c_uint32),
+        ("cdw14", ctypes.c_uint32),
+        ("cdw15", ctypes.c_uint32),
+        ("timeout_ms", ctypes.c_uint32),
+        ("rsvd2", ctypes.c_uint32),
+        ("result", ctypes.c_uint64),
+    ]
+
+
+NVME_IOCTL_ADMIN64_CMD = ioc(
+    3, "N", 0x47, ctypes.sizeof(_NvmePassthruCmd64)
+)
+
+logger = get_logger(__name__)
+
+
+class FCMStatsData(TypedDict):
+    device: str
+    model: str
+    serial_number: str
+    valid: bool
+    phy_size_bytes: int
+    phy_util_bytes: int
+    log_size_bytes: int
+    log_util_bytes: int
+    phy_util_percent: float
+    log_util_percent: float
+    compression_ratio: float
+    compression_ratio_str: str
+    savings_bytes: int
+    compression_ratio_display: str
+    savings_display: str
+    phy_usage_display: str
+    log_usage_display: str
+    status: dict[str, str]
+
+
+def read_sysfs(path: str) -> str:
+    try:
+        with open(path, encoding="utf-8") as handle:
+            return handle.read().strip()
+    except OSError:
+        return ""
+
+
+def read_sysfs_block(device: str, attribute: str) -> str:
+    return read_sysfs(os.path.join(SYSFS_BLOCK, device, attribute))
+
+
+def list_nvme_namespace_names() -> list[str]:
+    return sorted(
+        os.path.basename(path)
+        for path in glob.glob(f"{SYSFS_BLOCK}/nvme*")
+        if "c" not in os.path.basename(path)
+    )
+
+
+def is_fcm_device(device: str) -> bool:
+    model = read_sysfs_block(device, "device/model")
+    return "FCM" in model
+
+
+def query_nvme_log_page(device: str) -> Optional[bytes]:
+    device_path = f"/dev/{device}"
+    numd = (FCM_LOG_PAGE_LEN // 4) - 1
+    numdl = numd & 0xFFFF
+    numdu = (numd >> 16) & 0xFFFF
+
+    buffer = (ctypes.c_uint8 * FCM_LOG_PAGE_LEN)()
+    command = _NvmePassthruCmd64()
+    command.opcode = NVME_ADMIN_OPC_GET_LOG_PAGE
+    command.nsid = NVME_NSID_ALL
+    command.addr = ctypes.addressof(buffer)
+    command.data_len = FCM_LOG_PAGE_LEN
+    command.cdw10 = FCM_LOG_PAGE_ID | (numdl << 16)
+    command.cdw11 = numdu
+    command.cdw12 = FCM_LOG_PAGE_OFFSET & 0xFFFFFFFF
+    command.cdw13 = (FCM_LOG_PAGE_OFFSET >> 32) & 0xFFFFFFFF
+
+    fd = os.open(device_path, os.O_RDONLY)
+    try:
+        fcntl.ioctl(fd, NVME_IOCTL_ADMIN64_CMD, command)
+    except OSError as exc:
+        logger.debug(
+            "NVMe log page 0xCA query failed for device %s: %s",
+            device,
+            exc,
+        )
+        return None
+    finally:
+        os.close(fd)
+
+    if command.result:
+        logger.debug(
+            "NVMe log page 0xCA returned non-zero status 0x%x for device %s",
+            command.result,
+            device,
+        )
+        return None
+
+    return bytes(buffer)
+
+
+def compression_ratio_str(ratio: float) -> str:
+    ratio_text = f"{ratio:.1f}"
+    if ratio_text.endswith("0"):
+        return f"{int(ratio)}:1"
+    return f"{ratio_text}:1"
+
+
+def human_readable(capacity: int, dec_places: int = 1) -> str:
+    suffixes = ["b", "KB", "MB", "GB", "TB", "PB"]
+    size = float(capacity)
+    unit = suffixes[0]
+    for unit in suffixes:
+        if size < 1000:
+            break
+        size /= 1000
+    return f"{size:.{dec_places}f} {unit}"
+
+
+def fcm_usage_display(util_bytes: int, util_percent: float) -> str:
+    return f"{human_readable(util_bytes)}({int(util_percent)}%)"
+
+
+def empty_fcm_display_fields() -> dict[str, str]:
+    return {
+        "compression_ratio_display": "",
+        "savings_display": "",
+        "phy_usage_display": "",
+        "log_usage_display": "",
+    }
+
+
+def apply_fcm_display_fields(stats: FCMStatsData) -> FCMStatsData:
+    display = empty_fcm_display_fields()
+    if not stats["valid"]:
+        return {**stats, **display}
+
+    display["savings_display"] = human_readable(stats["savings_bytes"])
+    display["phy_usage_display"] = fcm_usage_display(
+        stats["phy_util_bytes"], stats["phy_util_percent"]
+    )
+    display["log_usage_display"] = fcm_usage_display(
+        stats["log_util_bytes"], stats["log_util_percent"]
+    )
+    if stats["log_util_percent"] > FCM_RATIO_DISPLAY_MIN_LOG_UTIL_PERCENT:
+        display["compression_ratio_display"] = stats["compression_ratio_str"]
+    return {**stats, **display}
+
+
+def read_fcm_stats(device: str) -> FCMStatsData:
+    model = read_sysfs_block(device, "device/model")
+    serial_number = read_sysfs_block(device, "device/serial")
+    invalid = apply_fcm_display_fields({
+        "device": device,
+        "model": model,
+        "serial_number": serial_number,
+        "valid": False,
+        "phy_size_bytes": 0,
+        "phy_util_bytes": 0,
+        "log_size_bytes": 0,
+        "log_util_bytes": 0,
+        "phy_util_percent": 0.0,
+        "log_util_percent": 0.0,
+        "compression_ratio": 0.0,
+        "compression_ratio_str": "",
+        "savings_bytes": 0,
+        "status": {"health": "Unknown", "state": "Unavailable"},
+        "compression_ratio_display": "",
+        "savings_display": "",
+        "phy_usage_display": "",
+        "log_usage_display": "",
+    })
+
+    raw_bytes = query_nvme_log_page(device)
+    if raw_bytes is None:
+        return invalid
+
+    try:
+        phy_size_bytes = struct.unpack("<Q", raw_bytes[:8])[0]
+        phy_util_bytes = struct.unpack("<Q", raw_bytes[8:16])[0]
+        log_size_bytes = struct.unpack("<Q", raw_bytes[16:24])[0]
+        log_util_bytes = struct.unpack("<Q", raw_bytes[24:32])[0]
+    except struct.error as exc:
+        logger.error(
+            "Problem unpacking usage stats from log page 0xCA for device %s: %s",
+            device,
+            exc,
+        )
+        return invalid
+
+    phy_util_percent = (
+        (phy_util_bytes / phy_size_bytes) * 100 if phy_size_bytes else 0.0
+    )
+    log_util_percent = (
+        (log_util_bytes / log_size_bytes) * 100 if log_size_bytes else 0.0
+    )
+    compression_ratio = (
+        log_util_bytes / phy_util_bytes if phy_util_bytes else 0.0
+    )
+    savings_bytes = log_util_bytes - phy_util_bytes
+
+    return apply_fcm_display_fields({
+        "device": device,
+        "model": model,
+        "serial_number": serial_number,
+        "valid": True,
+        "phy_size_bytes": phy_size_bytes,
+        "phy_util_bytes": phy_util_bytes,
+        "log_size_bytes": log_size_bytes,
+        "log_util_bytes": log_util_bytes,
+        "phy_util_percent": phy_util_percent,
+        "log_util_percent": log_util_percent,
+        "compression_ratio": compression_ratio,
+        "compression_ratio_str": compression_ratio_str(compression_ratio),
+        "savings_bytes": savings_bytes,
+        "status": {"health": "OK", "state": "Enabled"},
+        "compression_ratio_display": "",
+        "savings_display": "",
+        "phy_usage_display": "",
+        "log_usage_display": "",
+    })
+
+
+def collect_fcm_stats() -> dict[str, FCMStatsData]:
+    stats: dict[str, FCMStatsData] = {}
+    for device in list_nvme_namespace_names():
+        if not is_fcm_device(device):
+            continue
+        stats[device] = read_fcm_stats(device)
+    return stats
diff --git a/src/ceph-node-proxy/ceph_node_proxy/local_collectors.py b/src/ceph-node-proxy/ceph_node_proxy/local_collectors.py
new file mode 100644
index 00000000000..1be1b231544
--- /dev/null
+++ b/src/ceph-node-proxy/ceph_node_proxy/local_collectors.py
@@ -0,0 +1,66 @@
+from abc import ABC, abstractmethod
+from typing import Any, Dict
+
+from ceph_node_proxy.fcm_stats import collect_fcm_stats
+
+
+class LocalCollector(ABC):
+    """Collects node-local hardware metrics outside of Redfish."""
+
+    @property
+    @abstractmethod
+    def name(self) -> str:
+        """Category name exposed in node-proxy reports."""
+
+    @abstractmethod
+    def update(self) -> None:
+        """Refresh collector data from the local OS."""
+
+    @abstractmethod
+    def get_data(self) -> Dict[str, Any]:
+        """Return the latest collected data."""
+
+    def flush(self) -> None:
+        """Clear cached collector data."""
+
+
+class LocalCollectorRunner:
+    def __init__(self, collectors: list[LocalCollector]) -> None:
+        self._collectors = collectors
+
+    def update(self) -> None:
+        for collector in self._collectors:
+            collector.update()
+
+    def flush(self) -> None:
+        for collector in self._collectors:
+            collector.flush()
+
+    def categories(self) -> list[str]:
+        return [collector.name for collector in self._collectors]
+
+    def get_category(self, name: str) -> Dict[str, Any]:
+        for collector in self._collectors:
+            if collector.name == name:
+                return collector.get_data()
+        return {}
+
+
+class FCMCollector(LocalCollector):
+    """Collect FCM stats via NVMe ioctls."""
+
+    def __init__(self) -> None:
+        self._data: Dict[str, Any] = {}
+
+    @property
+    def name(self) -> str:
+        return "fcm"
+
+    def update(self) -> None:
+        self._data = {"local": collect_fcm_stats()}
+
+    def get_data(self) -> Dict[str, Any]:
+        return dict(self._data)
+
+    def flush(self) -> None:
+        self._data = {}
diff --git a/src/ceph-node-proxy/ceph_node_proxy/main.py b/src/ceph-node-proxy/ceph_node_proxy/main.py
index 6f0ab0b593d..775626af216 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/main.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/main.py
@@ -11,7 +11,7 @@ from urllib.error import HTTPError
 from ceph_node_proxy.api import NodeProxyApi
 from ceph_node_proxy.bootstrap import create_node_proxy_manager
 from ceph_node_proxy.config import load_cephadm_config
-from ceph_node_proxy.registry import get_system_class
+from ceph_node_proxy.registry import create_node_backend
 from ceph_node_proxy.reporter import Reporter
 from ceph_node_proxy.util import DEFAULTS, Config, get_logger, http_req
 
@@ -105,8 +105,8 @@ class NodeProxyManager:
         try:
             vendor = self.config.get("system", {}).get("vendor", "generic")
             self.log.info("Using Redfish vendor: %s", vendor)
-            system_cls = get_system_class(vendor)
-            self.system = system_cls(
+            self.system = create_node_backend(
+                vendor,
                 host=oob_details["host"],
                 port=oob_details["port"],
                 username=oob_details["username"],
diff --git a/src/ceph-node-proxy/ceph_node_proxy/node_backend.py b/src/ceph-node-proxy/ceph_node_proxy/node_backend.py
new file mode 100644
index 00000000000..e7549e5913e
--- /dev/null
+++ b/src/ceph-node-proxy/ceph_node_proxy/node_backend.py
@@ -0,0 +1,143 @@
+from time import sleep
+from typing import Any, Dict
+
+from ceph_node_proxy.baseredfishsystem import BaseRedfishSystem
+from ceph_node_proxy.basesystem import BaseSystem
+from ceph_node_proxy.local_collectors import LocalCollectorRunner
+from ceph_node_proxy.util import get_logger
+
+
+class NodeBackend(BaseSystem):
+    def __init__(
+        self,
+        redfish: BaseRedfishSystem,
+        local_collectors: LocalCollectorRunner,
+    ) -> None:
+        super().__init__(config=redfish.config)
+        self.redfish = redfish
+        self._local = local_collectors
+        self.data_ready = False
+        self.previous_data: Dict[str, Any] = {}
+        self.log = get_logger(__name__)
+
+    @property
+    def client(self) -> Any:
+        return self.redfish.client
+
+    def main(self) -> None:
+        self.stop = False
+        self.redfish.stop = False
+        self.redfish.initialize_redfish_session()
+
+        while not self.stop:
+            self.log.debug("waiting for a lock in the update loop.")
+            with self.lock:
+                if not self.pending_shutdown:
+                    self.log.debug("lock acquired in the update loop.")
+                    try:
+                        self.redfish.run_update_cycle()
+                        self._local.update()
+                        self.data_ready = True
+                    except RuntimeError as exc:
+                        self.stop = True
+                        self.redfish.stop = True
+                        self.log.error(
+                            "Error detected, trying to gracefully log out from "
+                            "redfish api.\n%s",
+                            exc,
+                        )
+                        self.redfish.client.logout()
+                        raise
+                    sleep(self.redfish.refresh_interval)
+            self.log.debug("lock released in the update loop.")
+        self.log.debug("exiting update loop.")
+        raise SystemExit(0)
+
+    def flush(self) -> None:
+        self.log.debug("Acquiring lock to flush data.")
+        self.lock.acquire()
+        self.log.debug("Lock acquired, flushing data.")
+        self.redfish.flush()
+        self._local.flush()
+        self.previous_data = {}
+        self.data_ready = False
+        self.log.info("Data flushed.")
+        self.lock.release()
+
+    def get_system(self) -> Dict[str, Any]:
+        result = self.redfish.get_system()
+        for category in self._local.categories():
+            result["status"][category] = self._local.get_category(category)
+        return result
+
+    def get_local_category(self, name: str) -> Dict[str, Any]:
+        return self._local.get_category(name)
+
+    def get_fcm(self) -> Dict[str, Any]:
+        return self.get_local_category("fcm")
+
+    def get_status(self) -> Dict[str, Dict[str, Dict]]:
+        return dict(self.redfish.get_status())
+
+    def get_memory(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_memory()
+
+    def get_processors(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_processors()
+
+    def get_network(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_network()
+
+    def get_storage(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_storage()
+
+    def get_firmware(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_firmware()
+
+    def get_power(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_power()
+
+    def get_fans(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_fans()
+
+    def get_temperatures(self) -> Dict[str, Dict[str, Dict]]:
+        return self.redfish.get_temperatures()
+
+    def get_sn(self) -> str:
+        return self.redfish.get_sn()
+
+    def get_led(self) -> Dict[str, Any]:
+        return self.redfish.get_led()
+
+    def set_led(self, data: Dict[str, str]) -> int:
+        return self.redfish.set_led(data)
+
+    def get_chassis_led(self) -> Dict[str, Any]:
+        return self.redfish.get_chassis_led()
+
+    def set_chassis_led(self, data: Dict[str, str]) -> int:
+        return self.redfish.set_chassis_led(data)
+
+    def device_led_on(self, device: str) -> int:
+        return self.redfish.device_led_on(device)
+
+    def device_led_off(self, device: str) -> int:
+        return self.redfish.device_led_off(device)
+
+    def get_device_led(self, device: str) -> Dict[str, Any]:
+        return self.redfish.get_device_led(device)
+
+    def set_device_led(self, device: str, data: Dict[str, bool]) -> int:
+        return self.redfish.set_device_led(device, data)
+
+    def chassis_led_on(self) -> int:
+        return self.redfish.chassis_led_on()
+
+    def chassis_led_off(self) -> int:
+        return self.redfish.chassis_led_off()
+
+    def shutdown_host(self, force: bool = False) -> int:
+        return self.redfish.shutdown_host(force=force)
+
+    def powercycle(self) -> int:
+        return self.redfish.powercycle()
diff --git a/src/ceph-node-proxy/ceph_node_proxy/protocols.py b/src/ceph-node-proxy/ceph_node_proxy/protocols.py
index e82d425bea5..85f76b48360 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/protocols.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/protocols.py
@@ -10,6 +10,8 @@ class SystemBackend(Protocol):
 
     def get_storage(self) -> Dict[str, Any]: ...
 
+    def get_fcm(self) -> Dict[str, Any]: ...
+
     def get_processors(self) -> Dict[str, Any]: ...
 
     def get_power(self) -> Dict[str, Any]: ...
diff --git a/src/ceph-node-proxy/ceph_node_proxy/registry.py b/src/ceph-node-proxy/ceph_node_proxy/registry.py
index 6c9436bd2f9..22eecb64658 100644
--- a/src/ceph-node-proxy/ceph_node_proxy/registry.py
+++ b/src/ceph-node-proxy/ceph_node_proxy/registry.py
@@ -1,43 +1,84 @@
-from typing import Dict, Type
+from typing import Dict, List, Type
 
-# Built-in implementations
-from ceph_node_proxy.atollon import AtollonSystem
+from ceph_node_proxy.atollon import AtollonRedfishProvider
 from ceph_node_proxy.baseredfishsystem import BaseRedfishSystem
+from ceph_node_proxy.local_collectors import FCMCollector, LocalCollector, LocalCollectorRunner
+from ceph_node_proxy.node_backend import NodeBackend
 from ceph_node_proxy.redfishdellsystem import RedfishDellSystem
-from ceph_node_proxy.util import get_logger
+from ceph_node_proxy.util import Config, get_logger
 
-REDFISH_SYSTEM_CLASSES: Dict[str, Type[BaseRedfishSystem]] = {
+REDFISH_PROVIDER_CLASSES: Dict[str, Type[BaseRedfishSystem]] = {
     "generic": BaseRedfishSystem,
     "dell": RedfishDellSystem,
-    "atollon": AtollonSystem,
+    "atollon": AtollonRedfishProvider,
+}
+
+LOCAL_COLLECTOR_CLASSES_BY_VENDOR: Dict[str, List[Type[LocalCollector]]] = {
+    "atollon": [FCMCollector],
 }
 
 logger = get_logger(__name__)
 
 
-def _load_entry_point_systems() -> None:
+def _load_entry_point_redfish_providers() -> None:
     try:
         import pkg_resources  # type: ignore[import-not-found]
 
     except ImportError:
         logger.debug(
-            "pkg_resources not available; only built-in Redfish systems will be used."
+            "pkg_resources not available; only built-in Redfish providers will be used."
         )
         return
 
     for ep in pkg_resources.iter_entry_points("ceph_node_proxy.systems"):
         try:
-            REDFISH_SYSTEM_CLASSES[ep.name] = ep.load()
-        except (ImportError, AttributeError, ModuleNotFoundError) as e:
+            REDFISH_PROVIDER_CLASSES[ep.name] = ep.load()
+        except (ImportError, AttributeError, ModuleNotFoundError) as exc:
             logger.warning(
-                "Failed to load Redfish system entry point %s: %s", ep.name, e
+                "Failed to load Redfish provider entry point %s: %s", ep.name, exc
             )
 
 
+def get_redfish_provider_class(vendor: str) -> Type[BaseRedfishSystem]:
+    """Return the Redfish provider class for the given vendor."""
+    return REDFISH_PROVIDER_CLASSES.get(vendor, BaseRedfishSystem)
+
+
 def get_system_class(vendor: str) -> Type[BaseRedfishSystem]:
-    """Return the Redfish system class for the given vendor.
-    Falls back to generic."""
-    return REDFISH_SYSTEM_CLASSES.get(vendor, BaseRedfishSystem)
+    """Deprecated alias for get_redfish_provider_class."""
+    return get_redfish_provider_class(vendor)
 
 
-_load_entry_point_systems()
+def create_local_collector_runner(vendor: str) -> LocalCollectorRunner:
+    """Build the local collector runner configured for a vendor."""
+    collector_classes = LOCAL_COLLECTOR_CLASSES_BY_VENDOR.get(vendor, [])
+    collectors = [collector_cls() for collector_cls in collector_classes]
+    return LocalCollectorRunner(collectors)
+
+
+def create_node_backend(
+    vendor: str,
+    *,
+    host: str,
+    port: str,
+    username: str,
+    password: str,
+    config: Config,
+) -> NodeBackend:
+    """Create the node backend facade for a vendor."""
+    provider_cls = get_redfish_provider_class(vendor)
+    redfish = provider_cls(
+        host=host,
+        port=port,
+        username=username,
+        password=password,
+        config=config,
+    )
+    local_collectors = create_local_collector_runner(vendor)
+    return NodeBackend(redfish, local_collectors)
+
+
+_load_entry_point_redfish_providers()
+
+# Backward-compatible alias used by older imports and entry point docs.
+REDFISH_SYSTEM_CLASSES = REDFISH_PROVIDER_CLASSES
diff --git a/src/ceph-node-proxy/tests/test_atollon.py b/src/ceph-node-proxy/tests/test_atollon.py
index 7c4b9a179e1..c2b1fea3df4 100644
--- a/src/ceph-node-proxy/tests/test_atollon.py
+++ b/src/ceph-node-proxy/tests/test_atollon.py
@@ -2,17 +2,17 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
-from ceph_node_proxy.atollon import AtollonSystem
+from ceph_node_proxy.atollon import AtollonRedfishProvider
 from ceph_node_proxy.baseredfishsystem import BaseRedfishSystem
 
 
 @pytest.fixture
-def atollon_system():
+def atollon_redfish():
     with (
         patch("ceph_node_proxy.baseredfishsystem.RedFishClient", return_value=MagicMock()),
         patch("ceph_node_proxy.baseredfishsystem.EndpointMgr", return_value=MagicMock()),
     ):
-        return AtollonSystem(
+        return AtollonRedfishProvider(
             host="testhost",
             port="443",
             username="user",
@@ -21,16 +21,16 @@ def atollon_system():
         )
 
 
-class TestAtollonSystemMemoryOverrides:
-    def test_get_specs_memory_uses_id_instead_of_description(self, atollon_system):
-        specs = atollon_system.get_specs("memory")
+class TestAtollonRedfishProviderMemoryOverrides:
+    def test_get_specs_memory_uses_id_instead_of_description(self, atollon_redfish):
+        specs = atollon_redfish.get_specs("memory")
         assert len(specs) == 1
         assert "Id" in specs[0].fields
         assert "Description" not in specs[0].fields
         assert "MemoryDeviceType" in specs[0].fields
 
-    def test_update_memory_maps_id_to_description(self, atollon_system):
-        atollon_system._sys["memory"] = {
+    def test_update_memory_maps_id_to_description(self, atollon_redfish):
+        atollon_redfish._sys["memory"] = {
             "1": {
                 "dimm0": {
                     "id": "dimm0",
@@ -43,14 +43,14 @@ class TestAtollonSystemMemoryOverrides:
 
         with patch.object(BaseRedfishSystem, "_update_memory") as mock_super:
             mock_super.side_effect = lambda: None
-            atollon_system._update_memory()
+            atollon_redfish._update_memory()
 
-        assert atollon_system._sys["memory"]["1"]["dimm0"]["description"] == "dimm0"
+        assert atollon_redfish._sys["memory"]["1"]["dimm0"]["description"] == "dimm0"
 
 
-class TestAtollonSystemStorageOverrides:
-    def test_update_storage_replaces_unknown_description(self, atollon_system):
-        atollon_system._sys["storage"] = {
+class TestAtollonRedfishProviderStorageOverrides:
+    def test_update_storage_replaces_unknown_description(self, atollon_redfish):
+        atollon_redfish._sys["storage"] = {
             "Self": {
                 "nvme_device0_nsid1": {
                     "description": "unknown",
@@ -70,13 +70,13 @@ class TestAtollonSystemStorageOverrides:
 
         with patch.object(BaseRedfishSystem, "_update_storage") as mock_super:
             mock_super.side_effect = lambda: None
-            atollon_system.fix_storage_descriptions()
+            atollon_redfish.fix_storage_descriptions()
 
-        drive = atollon_system._sys["storage"]["Self"]["nvme_device0_nsid1"]
+        drive = atollon_redfish._sys["storage"]["Self"]["nvme_device0_nsid1"]
         assert drive["description"] == "NVMe_Device0_NSID1"
 
-    def test_enrich_storage_from_controllers_by_serial(self, atollon_system):
-        atollon_system._sys["storage"] = {
+    def test_enrich_storage_from_controllers_by_serial(self, atollon_redfish):
+        atollon_redfish._sys["storage"] = {
             "Self": {
                 "nvme_device0_nsid1": {
                     "description": "NVMe_Device0_NSID1",
@@ -109,21 +109,21 @@ class TestAtollonSystemStorageOverrides:
         systems_endpoint.__getitem__ = MagicMock(
             side_effect=lambda key: member_endpoint if key == "Self" else MagicMock()
         )
-        atollon_system.endpoints = MagicMock()
-        atollon_system.endpoints.__getitem__ = MagicMock(
+        atollon_redfish.endpoints = MagicMock()
+        atollon_redfish.endpoints.__getitem__ = MagicMock(
             side_effect=lambda key: systems_endpoint if key == "systems" else MagicMock()
         )
 
-        atollon_system.enrich_storage_from_controllers()
+        atollon_redfish.enrich_storage_from_controllers()
 
-        drive = atollon_system._sys["storage"]["Self"]["nvme_device0_nsid1"]
+        drive = atollon_redfish._sys["storage"]["Self"]["nvme_device0_nsid1"]
         assert drive["firmware_version"] == "V6MA001"
         assert drive["slot"] == "0"
         assert drive["speed_gbps"] == 63.02
         assert drive["physical_location"]["partlocation"]["locationordinalvalue"] == 0
 
-    def test_enrich_storage_from_controllers_by_device_index(self, atollon_system):
-        atollon_system._sys["storage"] = {
+    def test_enrich_storage_from_controllers_by_device_index(self, atollon_redfish):
+        atollon_redfish._sys["storage"] = {
             "Self": {
                 "nvme_device2_nsid1": {
                     "description": "NVMe_Device2_NSID1",
@@ -153,13 +153,13 @@ class TestAtollonSystemStorageOverrides:
         systems_endpoint.__getitem__ = MagicMock(
             side_effect=lambda key: member_endpoint if key == "Self" else MagicMock()
         )
-        atollon_system.endpoints = MagicMock()
-        atollon_system.endpoints.__getitem__ = MagicMock(
+        atollon_redfish.endpoints = MagicMock()
+        atollon_redfish.endpoints.__getitem__ = MagicMock(
             side_effect=lambda key: systems_endpoint if key == "systems" else MagicMock()
         )
 
-        atollon_system.enrich_storage_from_controllers()
+        atollon_redfish.enrich_storage_from_controllers()
 
-        drive = atollon_system._sys["storage"]["Self"]["nvme_device2_nsid1"]
+        drive = atollon_redfish._sys["storage"]["Self"]["nvme_device2_nsid1"]
         assert drive["firmware_version"] == "000A5305"
         assert drive["slot"] == "2"
diff --git a/src/ceph-node-proxy/tests/test_baseredfishsystem.py b/src/ceph-node-proxy/tests/test_baseredfishsystem.py
index 28a90521406..05102ca1445 100644
--- a/src/ceph-node-proxy/tests/test_baseredfishsystem.py
+++ b/src/ceph-node-proxy/tests/test_baseredfishsystem.py
@@ -140,8 +140,12 @@ class TestBaseRedfishSystemGetSystem:
         assert result["status"]["power"] == {}
         assert result["status"]["fans"] == {}
         assert result["status"]["temperatures"] == {}
+        assert "fcm" not in result["status"]
         assert "firmware" in result
 
+    def test_get_fcm_empty(self, system):
+        assert system.get_fcm() == {}
+
 
 class TestBaseRedfishSystemGetSpecs:
 
diff --git a/src/ceph-node-proxy/tests/test_fcm_stats.py b/src/ceph-node-proxy/tests/test_fcm_stats.py
new file mode 100644
index 00000000000..686cb948de8
--- /dev/null
+++ b/src/ceph-node-proxy/tests/test_fcm_stats.py
@@ -0,0 +1,196 @@
+import struct
+from unittest.mock import patch
+
+from ceph_node_proxy.fcm_stats import (
+    apply_fcm_display_fields,
+    collect_fcm_stats,
+    fcm_usage_display,
+    is_fcm_device,
+    read_fcm_stats,
+)
+
+
+class TestFCMStatsHelpers:
+    def test_is_fcm_device_true(self):
+        with patch(
+            "ceph_node_proxy.fcm_stats.read_sysfs_block",
+            return_value="IBM FCM5 3.2TB",
+        ):
+            assert is_fcm_device("nvme2n1") is True
+
+    def test_is_fcm_device_false(self):
+        with patch(
+            "ceph_node_proxy.fcm_stats.read_sysfs_block",
+            return_value="Micron_2550_MTFDKBK512TGE",
+        ):
+            assert is_fcm_device("nvme0n1") is False
+
+
+class TestReadFCMStats:
+    def _sample_log_page(self) -> bytes:
+        return struct.pack(
+            "<QQQQ",
+            3_200_000_000_000,
+            1_600_000_000_000,
+            6_400_000_000_000,
+            3_200_000_000_000,
+        )
+
+    def test_read_fcm_stats_success(self):
+        with (
+            patch(
+                "ceph_node_proxy.fcm_stats.read_sysfs_block",
+                side_effect=lambda device, attr: {
+                    "device/model": "IBM FCM5 3.2TB",
+                    "device/serial": "03NK797YS344D57S056",
+                }[attr],
+            ),
+            patch(
+                "ceph_node_proxy.fcm_stats.query_nvme_log_page",
+                return_value=self._sample_log_page(),
+            ),
+        ):
+            stats = read_fcm_stats("nvme2n1")
+
+        assert stats["valid"] is True
+        assert stats["device"] == "nvme2n1"
+        assert stats["compression_ratio"] == 2.0
+        assert stats["compression_ratio_str"] == "2:1"
+        assert stats["savings_bytes"] == 1_600_000_000_000
+        assert stats["compression_ratio_display"] == "2:1"
+        assert stats["savings_display"] == "1.6 TB"
+        assert stats["phy_usage_display"].endswith("(50%)")
+        assert stats["log_usage_display"].endswith("(50%)")
+        assert stats["status"]["health"] == "OK"
+
+    def test_read_fcm_stats_ioctl_failure(self):
+        with (
+            patch(
+                "ceph_node_proxy.fcm_stats.read_sysfs_block",
+                side_effect=lambda device, attr: {
+                    "device/model": "IBM FCM5 3.2TB",
+                    "device/serial": "03NK797YS344D57S056",
+                }[attr],
+            ),
+            patch(
+                "ceph_node_proxy.fcm_stats.query_nvme_log_page",
+                return_value=None,
+            ),
+        ):
+            stats = read_fcm_stats("nvme2n1")
+
+        assert stats["valid"] is False
+        assert stats["compression_ratio_str"] == ""
+        assert stats["compression_ratio_display"] == ""
+        assert stats["phy_usage_display"] == ""
+        assert stats["status"]["health"] == "Unknown"
+
+
+class TestFCMDisplayFields:
+    def test_fcm_usage_display_shows_human_bytes_and_int_percent(self):
+        usage = fcm_usage_display(15833446, 0.00027025391332477435)
+        assert usage.endswith("(0%)")
+        assert "MB" in usage
+
+    def test_apply_fcm_display_fields_hides_ratio_when_logical_usage_is_low(self):
+        stats = apply_fcm_display_fields({
+            "device": "nvme2n1",
+            "model": "FCM5",
+            "serial_number": "SN1",
+            "valid": True,
+            "phy_size_bytes": 0,
+            "phy_util_bytes": 0,
+            "log_size_bytes": 0,
+            "log_util_bytes": 0,
+            "phy_util_percent": 0.0,
+            "log_util_percent": 0.0,
+            "compression_ratio": 0.0,
+            "compression_ratio_str": "0:1",
+            "savings_bytes": 0,
+            "compression_ratio_display": "",
+            "savings_display": "",
+            "phy_usage_display": "",
+            "log_usage_display": "",
+            "status": {"health": "OK", "state": "Enabled"},
+        })
+        assert stats["compression_ratio_display"] == ""
+        assert stats["log_usage_display"].endswith("(0%)")
+
+    def test_apply_fcm_display_fields_shows_ratio_and_formatted_values(self):
+        stats = apply_fcm_display_fields({
+            "device": "nvme5n1",
+            "model": "FCM5",
+            "serial_number": "SN2",
+            "valid": True,
+            "phy_size_bytes": 1,
+            "phy_util_bytes": 15833446,
+            "log_size_bytes": 1,
+            "log_util_bytes": 16032506,
+            "phy_util_percent": 0.00027025391332477435,
+            "log_util_percent": 1.0,
+            "compression_ratio": 1.0,
+            "compression_ratio_str": "1:1",
+            "savings_bytes": 199060,
+            "compression_ratio_display": "",
+            "savings_display": "",
+            "phy_usage_display": "",
+            "log_usage_display": "",
+            "status": {"health": "OK", "state": "Enabled"},
+        })
+        assert stats["compression_ratio_display"] == "1:1"
+        assert stats["savings_display"] == "199.1 KB"
+        assert stats["phy_usage_display"].endswith("(0%)")
+        assert stats["log_usage_display"].endswith("(1%)")
+
+    def test_apply_fcm_display_fields_clears_metrics_when_invalid(self):
+        stats = apply_fcm_display_fields({
+            "device": "nvme0n1",
+            "model": "FCM5",
+            "serial_number": "SN3",
+            "valid": False,
+            "phy_size_bytes": 0,
+            "phy_util_bytes": 0,
+            "log_size_bytes": 0,
+            "log_util_bytes": 0,
+            "phy_util_percent": 0.0,
+            "log_util_percent": 0.0,
+            "compression_ratio": 0.0,
+            "compression_ratio_str": "",
+            "savings_bytes": 0,
+            "compression_ratio_display": "",
+            "savings_display": "",
+            "phy_usage_display": "",
+            "log_usage_display": "",
+            "status": {"health": "Unknown", "state": "Unavailable"},
+        })
+        assert stats["compression_ratio_display"] == ""
+        assert stats["savings_display"] == ""
+        assert stats["phy_usage_display"] == ""
+        assert stats["log_usage_display"] == ""
+
+
+class TestCollectFCMStats:
+    def test_collect_fcm_stats_only_fcm_devices(self):
+        with (
+            patch(
+                "ceph_node_proxy.fcm_stats.list_nvme_namespace_names",
+                return_value=["nvme0n1", "nvme2n1"],
+            ),
+            patch(
+                "ceph_node_proxy.fcm_stats.is_fcm_device",
+                side_effect=lambda device: device == "nvme2n1",
+            ),
+            patch(
+                "ceph_node_proxy.fcm_stats.read_fcm_stats",
+                side_effect=lambda device: {
+                    "device": device,
+                    "valid": True,
+                    "compression_ratio": 2.0,
+                    "compression_ratio_str": "2:1",
+                },
+            ),
+        ):
+            stats = collect_fcm_stats()
+
+        assert set(stats.keys()) == {"nvme2n1"}
+        assert stats["nvme2n1"]["compression_ratio_str"] == "2:1"
diff --git a/src/ceph-node-proxy/tests/test_local_collectors.py b/src/ceph-node-proxy/tests/test_local_collectors.py
new file mode 100644
index 00000000000..312d92c2209
--- /dev/null
+++ b/src/ceph-node-proxy/tests/test_local_collectors.py
@@ -0,0 +1,52 @@
+from unittest.mock import patch
+
+from ceph_node_proxy.local_collectors import FCMCollector, LocalCollectorRunner
+
+
+class TestFCMCollector:
+    def test_name(self):
+        assert FCMCollector().name == "fcm"
+
+    def test_update_and_get_data(self):
+        sample_stats = {
+            "nvme2n1": {
+                "device": "nvme2n1",
+                "valid": True,
+                "compression_ratio": 2.5,
+                "compression_ratio_str": "2.5:1",
+            },
+        }
+        collector = FCMCollector()
+        with patch(
+            "ceph_node_proxy.local_collectors.collect_fcm_stats",
+            return_value=sample_stats,
+        ):
+            collector.update()
+
+        assert collector.get_data() == {"local": sample_stats}
+
+    def test_flush_clears_data(self):
+        collector = FCMCollector()
+        collector._data = {"local": {"nvme2n1": {"valid": True}}}
+        collector.flush()
+        assert collector.get_data() == {}
+
+
+class TestLocalCollectorRunner:
+    def test_runner_update_and_get_category(self):
+        sample_stats = {"nvme2n1": {"valid": True}}
+        runner = LocalCollectorRunner([FCMCollector()])
+        with patch(
+            "ceph_node_proxy.local_collectors.collect_fcm_stats",
+            return_value=sample_stats,
+        ):
+            runner.update()
+
+        assert runner.get_category("fcm") == {"local": sample_stats}
+        assert runner.get_category("missing") == {}
+
+    def test_runner_flush(self):
+        runner = LocalCollectorRunner([FCMCollector()])
+        runner._collectors[0]._data = {"local": {"nvme2n1": {"valid": True}}}
+        runner.flush()
+        assert runner.get_category("fcm") == {}
diff --git a/src/ceph-node-proxy/tests/test_node_backend.py b/src/ceph-node-proxy/tests/test_node_backend.py
new file mode 100644
index 00000000000..92e768607a0
--- /dev/null
+++ b/src/ceph-node-proxy/tests/test_node_backend.py
@@ -0,0 +1,107 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from ceph_node_proxy.local_collectors import FCMCollector, LocalCollectorRunner
+from ceph_node_proxy.node_backend import NodeBackend
+from ceph_node_proxy.registry import create_local_collector_runner, create_node_backend
+
+
+@pytest.fixture
+def mock_redfish():
+    redfish = MagicMock()
+    redfish.config = {}
+    redfish.refresh_interval = 1
+    redfish.get_system.return_value = {
+        "host": "node01",
+        "sn": "SN123",
+        "status": {
+            "storage": {},
+            "processors": {},
+            "network": {},
+            "memory": {},
+            "power": {},
+            "fans": {},
+            "temperatures": {},
+        },
+        "firmware": {},
+    }
+    return redfish
+
+
+class TestLocalCollectorRunnerRegistry:
+    def test_atollon_vendor_includes_fcm_collector(self):
+        runner = create_local_collector_runner("atollon")
+        assert runner.categories() == ["fcm"]
+
+    def test_generic_vendor_has_no_collectors(self):
+        runner = create_local_collector_runner("generic")
+        assert runner.categories() == []
+
+
+class TestNodeBackend:
+    def test_get_fcm_delegates_to_local_runner(self, mock_redfish):
+        runner = LocalCollectorRunner([FCMCollector()])
+        backend = NodeBackend(mock_redfish, runner)
+        sample_stats = {
+            "nvme2n1": {
+                "device": "nvme2n1",
+                "valid": True,
+                "compression_ratio": 2.5,
+                "compression_ratio_str": "2.5:1",
+            },
+        }
+        with patch(
+            "ceph_node_proxy.local_collectors.collect_fcm_stats",
+            return_value=sample_stats,
+        ):
+            runner.update()
+
+        assert backend.get_fcm() == {"local": sample_stats}
+
+    def test_get_system_merges_redfish_and_local_categories(self, mock_redfish):
+        runner = LocalCollectorRunner([FCMCollector()])
+        backend = NodeBackend(mock_redfish, runner)
+        sample_stats = {"nvme2n1": {"valid": True, "compression_ratio": 2.0}}
+        with patch(
+            "ceph_node_proxy.local_collectors.collect_fcm_stats",
+            return_value=sample_stats,
+        ):
+            runner.update()
+
+        result = backend.get_system()
+        assert result["status"]["fcm"] == {"local": sample_stats}
+        assert "storage" in result["status"]
+        mock_redfish.get_system.assert_called_once()
+
+    def test_flush_clears_local_collectors(self, mock_redfish):
+        runner = LocalCollectorRunner([FCMCollector()])
+        backend = NodeBackend(mock_redfish, runner)
+        runner.update()
+        backend.flush()
+        assert backend.get_fcm() == {}
+        mock_redfish.flush.assert_called_once()
+
+    def test_delegates_storage_to_redfish(self, mock_redfish):
+        mock_redfish.get_storage.return_value = {"Self": {"drive1": {}}}
+        backend = NodeBackend(mock_redfish, LocalCollectorRunner([]))
+        assert backend.get_storage() == {"Self": {"drive1": {}}}
+
+
+class TestCreateNodeBackend:
+    def test_create_node_backend_atollon(self):
+        with patch("ceph_node_proxy.registry.get_redfish_provider_class") as mock_provider:
+            mock_redfish = MagicMock()
+            mock_provider.return_value.return_value = mock_redfish
+            backend = create_node_backend(
+                "atollon",
+                host="bmc",
+                port="443",
+                username="user",
+                password="secret",
+                config=MagicMock(),
+            )
+
+        assert isinstance(backend, NodeBackend)
+        assert backend.redfish is mock_redfish
+        assert backend._local.categories() == ["fcm"]
diff --git a/src/pybind/mgr/cephadm/agent.py b/src/pybind/mgr/cephadm/agent.py
index a7405c969a2..2956e38c2a3 100644
--- a/src/pybind/mgr/cephadm/agent.py
+++ b/src/pybind/mgr/cephadm/agent.py
@@ -622,6 +622,16 @@ class NodeProxyEndpoint:
             raise cherrypy.HTTPError(404, f"{kw.get('hostname')} not found.")
         return results
 
+    @cherrypy.expose
+    @cherrypy.tools.allow(methods=['GET'])
+    @cherrypy.tools.json_out()
+    def fcm(self, **kw: Any) -> Dict[str, Any]:
+        try:
+            results = self.mgr.node_proxy_cache.common('fcm', **kw)
+        except (KeyError, OrchestratorError):
+            raise cherrypy.HTTPError(404, f"{kw.get('hostname')} not found.")
+        return results
+
     @cherrypy.expose
     @cherrypy.tools.allow(methods=['GET'])
     @cherrypy.tools.json_out()
diff --git a/src/pybind/mgr/cephadm/tests/node_proxy_data.py b/src/pybind/mgr/cephadm/tests/node_proxy_data.py
index 3c01582d756..8e4230fe15f 100644
--- a/src/pybind/mgr/cephadm/tests/node_proxy_data.py
+++ b/src/pybind/mgr/cephadm/tests/node_proxy_data.py
@@ -1,3 +1,3 @@
 full_set_with_critical = {'host': 'host01', 'sn': '12345', 'status': {'storage': {'1': {'disk.bay.0:enclosure.internal.0-1:raid.integrated.1-1': {'description': 'Solid State Disk 0:1:0', 'entity': 'RAID.Integrated.1-1', 'capacity_bytes': 959656755200, 'model': 'KPM5XVUG960G', 'protocol': 'SAS', 'serial_number': '8080A1CRTP5F', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 0, 'locationtype': 'Slot'}}}, 'disk.bay.9:enclosure.internal.0-1': {'description': 'PCIe SSD in Slot 9 in Bay 1', 'entity': 'CPU.1', 'capacity_bytes': 1600321314816, 'model': 'Dell Express Flash NVMe P4610 1.6TB SFF', 'protocol': 'PCIe', 'serial_number': 'PHLN035305MN1P6AGN', 'status': {'health': 'Critical', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 9, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 20, 'total_threads': 40, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'nic.slot.1-1-1': {'description': 'NIC in Slot 1 Port 1 Partition 1', 'name': 'System Ethernet Interface', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'StandbyOffline'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 31237, 'status': {'health': 'Critical', 'state': 'Enabled'}}}}}, 'firmware': {}}
 mgr_inventory_cache = {'host01': {'hostname': 'host01', 'addr': '10.10.10.11', 'labels': ['_admin'], 'status': '', 'oob': {'hostname': '10.10.10.11', 'username': 'root', 'password': 'ceph123'}}, 'host02': {'hostname': 'host02', 'addr': '10.10.10.12', 'labels': [], 'status': '', 'oob': {'hostname': '10.10.10.12', 'username': 'root', 'password': 'ceph123'}}}
-full_set = {'host01': {'host': 'host01', 'sn': 'FR8Y5X3', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmware': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'host02': {'host': 'host02', 'sn': 'FR8Y5X4', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmware': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}
+full_set = {'host01': {'host': 'host01', 'sn': 'FR8Y5X3', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fcm': {'local': {'nvme2n1': {'device': 'nvme2n1', 'model': 'IBM FCM5 3.2TB', 'serial_number': '03NK797YS344D57S056', 'valid': True, 'compression_ratio': 2.5, 'compression_ratio_str': '2.5:1', 'savings_bytes': 1000000, 'phy_util_percent': 50.0, 'log_util_percent': 25.0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmware': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'host02': {'host': 'host02', 'sn': 'FR8Y5X4', 'status': {'storage': {'1': {'disk.bay.8:enclosure.internal.0-1:nonraid.slot.2-1': {'description': 'Disk 8 in Backplane 1 of Storage Controller in Slot 2', 'entity': 'NonRAID.Slot.2-1', 'capacity_bytes': 20000588955136, 'model': 'ST20000NM008D-3D', 'protocol': 'SATA', 'serial_number': 'ZVT99QLL', 'status': {'health': 'OK', 'healthrollup': 'OK', 'state': 'Enabled'}, 'physical_location': {'partlocation': {'locationordinalvalue': 8, 'locationtype': 'Slot'}}}}}, 'processors': {'1': {'cpu.socket.2': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}, 'cpu.socket.1': {'description': 'Represents the properties of a Processor attached to this System', 'total_cores': 16, 'total_threads': 32, 'processor_type': 'CPU', 'model': 'Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz', 'status': {'health': 'OK', 'state': 'Enabled'}, 'manufacturer': 'Intel'}}}, 'network': {'1': {'oslogicalnetwork.2': {'description': 'eno8303', 'name': 'eno8303', 'speed_mbps': 0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'memory': {'1': {'dimm.socket.a1': {'description': 'DIMM A1', 'memory_device_type': 'DDR4', 'capacity_mi_b': 16384, 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'power': {'1': {'0': {'name': 'PS1 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}, '1': {'name': 'PS2 Status', 'model': 'PWR SPLY,800W,RDNT,LTON', 'manufacturer': 'DELL', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fans': {'1': {'0': {'name': 'System Board Fan1A', 'physical_context': 'SystemBoard', 'reading': 4800, 'reading_units': 'RPM', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'temperatures': {'1': {'0': {'name': 'System Board Inlet Temp', 'physical_context': 'Intake', 'reading': 24, 'reading_units': 'Cel', 'status': {'health': 'OK', 'state': 'Enabled'}}}}, 'fcm': {'local': {'nvme2n1': {'device': 'nvme2n1', 'model': 'IBM FCM5 3.2TB', 'serial_number': '03NK797YS344D57S056', 'valid': True, 'compression_ratio': 2.5, 'compression_ratio_str': '2.5:1', 'savings_bytes': 1000000, 'phy_util_percent': 50.0, 'log_util_percent': 25.0, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}, 'firmware': {'installed-28897-6.10.30.20__usc.embedded.1:lc.embedded.1': {'name': 'Lifecycle Controller', 'description': 'Represents Firmware Inventory', 'release_date': '00:00:00Z', 'version': '6.10.30.20', 'updateable': True, 'status': {'health': 'OK', 'state': 'Enabled'}}}}}
diff --git a/src/pybind/mgr/cephadm/tests/test_node_proxy.py b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
index ba311b19421..e053e10e920 100644
--- a/src/pybind/mgr/cephadm/tests/test_node_proxy.py
+++ b/src/pybind/mgr/cephadm/tests/test_node_proxy.py
@@ -331,6 +331,18 @@ class TestNodeProxyEndpoint(helper.CPWebCase):
         self.getPage("/host03/temperatures", method="GET")
         self.assertStatus('404 Not Found')
 
+    def test_fcm_with_valid_hostname(self):
+        self.getPage("/host02/fcm", method="GET")
+        self.assertStatus('200 OK')
+
+    def test_fcm_no_hostname(self):
+        self.getPage("/fcm", method="GET")
+        self.assertStatus('200 OK')
+
+    def test_fcm_with_invalid_hostname(self):
+        self.getPage("/host03/fcm", method="GET")
+        self.assertStatus('404 Not Found')
+
     def test_firmware_with_valid_hostname(self):
         self.getPage("/host02/firmware", method="GET")
         self.assertStatus('200 OK')
diff --git a/src/pybind/mgr/orchestrator/module.py b/src/pybind/mgr/orchestrator/module.py
index c6024549618..f9d5a4b9237 100644
--- a/src/pybind/mgr/orchestrator/module.py
+++ b/src/pybind/mgr/orchestrator/module.py
@@ -536,6 +536,8 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             'power': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'MODEL', 'MANUFACTURER', 'STATUS', 'STATE'],
             'fans': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'READING', 'UNITS', 'STATUS', 'STATE'],
             'temperatures': ['HOST', 'CHASSIS_ID', 'ID', 'NAME', 'READING', 'UNITS', 'STATUS', 'STATE'],
+            'fcm': ['HOST', 'SOURCE', 'DEVICE', 'MODEL', 'SN', 'RATIO', 'SAVINGS',
+                    'PHYS USED', 'LOG USED', 'VALID', 'STATUS', 'STATE'],
         }
 
         if category == 'firmwares':
@@ -625,6 +627,9 @@ class OrchestratorCli(OrchestratorClientMixin, MgrModule):
             'power': ('name', 'model', 'manufacturer', 'health', 'state'),
             'fans': ('name', 'reading', 'reading_units', 'health', 'state'),
             'temperatures': ('name', 'reading', 'reading_units', 'health', 'state'),
+            'fcm': ('device', 'model', 'serial_number', 'compression_ratio_display',
+                    'savings_display', 'phy_usage_display', 'log_usage_display',
+                    'valid', 'health', 'state'),
         }
 
         fields = mapping.get(category, ())

From 3a9a837ef7c220aa04ab0f4d124f5a2d372a0bac Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 23 Jun 2026 18:18:25 +0800
Subject: [PATCH 397/596] test/bufferlist: avoid BenchDeref iterator overrun
 past end

Drive the deref loop by get_remaining() >= step instead of comparing to
end(), so a total length that is not a multiple of step no longer lets
`iter += step` run past the end and throw "End of buffer".

The original counts were always a multiple of step, so the overrun only
showed up once the following commit shrinks the rounds under ASan -- a
false alarm rather than a real regression, which is why it went unnoticed
until now.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/bufferlist.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/bufferlist.cc b/src/test/bufferlist.cc
index ba83f532934..41b47c61029 100644
--- a/src/test/bufferlist.cc
+++ b/src/test/bufferlist.cc
@@ -823,7 +823,7 @@ static void bench_bufferlistiter_deref(const size_t step,
 
   utime_t start = ceph_clock_now();
   bufferlist::iterator iter = bl.begin();
-  while (iter != bl.end()) {
+  while (iter.get_remaining() >= step) {
     iter += step;
   }
   utime_t end = ceph_clock_now();

From e16e6398b1e05bb3d98750dffa1989f5ad32d158 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 23 Jun 2026 14:16:38 +0800
Subject: [PATCH 398/596] test/bufferlist: shrink benchmark iterations under
 ASan

The pure-timing *_bench/BenchAlloc loops repeat a stateless path millions of
times. Under ASan that adds no memory-error coverage but inflates the run from
minutes to hours, so cut the iteration counts when built with ASan.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/bufferlist.cc | 82 ++++++++++++++++++++++++------------------
 1 file changed, 48 insertions(+), 34 deletions(-)

diff --git a/src/test/bufferlist.cc b/src/test/bufferlist.cc
index 41b47c61029..629ab3e21d0 100644
--- a/src/test/bufferlist.cc
+++ b/src/test/bufferlist.cc
@@ -47,6 +47,18 @@
 #define MAX_TEST 1000000
 #define FILENAME "bufferlist"
 
+#ifndef __has_feature
+#define __has_feature(x) 0
+#endif
+#if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
+static constexpr bool bench_under_asan = true;
+#else
+static constexpr bool bench_under_asan = false;
+#endif
+static constexpr size_t asan_bench_rounds(size_t full) {
+  return bench_under_asan ? (full < 2 ? full : 2) : full;
+}
+
 using namespace std;
 
 static char cmd[128];
@@ -140,12 +152,13 @@ void bench_buffer_alloc(int size, int num)
 }
 
 TEST(Buffer, BenchAlloc) {
-  bench_buffer_alloc(16384, 1000000);
-  bench_buffer_alloc(4096, 1000000);
-  bench_buffer_alloc(1024, 1000000);
-  bench_buffer_alloc(256, 1000000);
-  bench_buffer_alloc(32, 1000000);
-  bench_buffer_alloc(4, 1000000);
+  const int n = asan_bench_rounds(1000000);
+  bench_buffer_alloc(16384, n);
+  bench_buffer_alloc(4096, n);
+  bench_buffer_alloc(1024, n);
+  bench_buffer_alloc(256, n);
+  bench_buffer_alloc(32, n);
+  bench_buffer_alloc(4, n);
 }
 
 TEST(BufferRaw, ostream) {
@@ -544,7 +557,7 @@ TEST(BufferPtr, copy_out_bench) {
   for (int s=1; s<=8; s*=2) {
     utime_t start = ceph_clock_now();
     int buflen = 1048576;
-    int count = 1000;
+    int count = asan_bench_rounds(1000);
     uint64_t v;
     for (int i=0; i<count; ++i) {
       bufferptr bp(buflen);
@@ -583,7 +596,7 @@ TEST(BufferPtr, copy_in_bench) {
   for (int s=1; s<=8; s*=2) {
     utime_t start = ceph_clock_now();
     int buflen = 1048576;
-    int count = 1000;
+    int count = asan_bench_rounds(1000);
     for (int i=0; i<count; ++i) {
       bufferptr bp(buflen);
       for (int64_t j=0; j<buflen; j += s) {
@@ -627,7 +640,7 @@ TEST(BufferPtr, append_bench) {
   for (int s=4; s<=16384; s*=4) {
     utime_t start = ceph_clock_now();
     int buflen = 1048576;
-    int count = 4000;
+    int count = asan_bench_rounds(4000);
     for (int i=0; i<count; ++i) {
       bufferptr bp(buflen);
       bp.set_length(0);
@@ -833,15 +846,15 @@ static void bench_bufferlistiter_deref(const size_t step,
 }
 
 TEST(BufferListIterator, BenchDeref) {
-  bench_bufferlistiter_deref(1, 1, 4096000);
-  bench_bufferlistiter_deref(1, 10, 409600);
-  bench_bufferlistiter_deref(1, 100, 40960);
-  bench_bufferlistiter_deref(1, 1000, 4096);
+  bench_bufferlistiter_deref(1, 1, asan_bench_rounds(4096000));
+  bench_bufferlistiter_deref(1, 10, asan_bench_rounds(409600));
+  bench_bufferlistiter_deref(1, 100, asan_bench_rounds(40960));
+  bench_bufferlistiter_deref(1, 1000, asan_bench_rounds(4096));
 
-  bench_bufferlistiter_deref(4, 1, 1024000);
-  bench_bufferlistiter_deref(4, 10, 102400);
-  bench_bufferlistiter_deref(4, 100, 10240);
-  bench_bufferlistiter_deref(4, 1000, 1024);
+  bench_bufferlistiter_deref(4, 1, asan_bench_rounds(1024000));
+  bench_bufferlistiter_deref(4, 10, asan_bench_rounds(102400));
+  bench_bufferlistiter_deref(4, 100, asan_bench_rounds(10240));
+  bench_bufferlistiter_deref(4, 1000, asan_bench_rounds(1024));
 }
 
 TEST(BufferListIterator, advance) {
@@ -1356,17 +1369,18 @@ void bench_bufferlist_alloc(int size, int num, int per)
 }
 
 TEST(BufferList, BenchAlloc) {
-  bench_bufferlist_alloc(32768, 100000, 16);
-  bench_bufferlist_alloc(25000, 100000, 16);
-  bench_bufferlist_alloc(16384, 100000, 16);
-  bench_bufferlist_alloc(10000, 100000, 16);
-  bench_bufferlist_alloc(8192, 100000, 16);
-  bench_bufferlist_alloc(6000, 100000, 16);
-  bench_bufferlist_alloc(4096, 100000, 16);
-  bench_bufferlist_alloc(1024, 100000, 16);
-  bench_bufferlist_alloc(256, 100000, 16);
-  bench_bufferlist_alloc(32, 100000, 16);
-  bench_bufferlist_alloc(4, 100000, 16);
+  const int n = asan_bench_rounds(100000);
+  bench_bufferlist_alloc(32768, n, 16);
+  bench_bufferlist_alloc(25000, n, 16);
+  bench_bufferlist_alloc(16384, n, 16);
+  bench_bufferlist_alloc(10000, n, 16);
+  bench_bufferlist_alloc(8192, n, 16);
+  bench_bufferlist_alloc(6000, n, 16);
+  bench_bufferlist_alloc(4096, n, 16);
+  bench_bufferlist_alloc(1024, n, 16);
+  bench_bufferlist_alloc(256, n, 16);
+  bench_bufferlist_alloc(32, n, 16);
+  bench_bufferlist_alloc(4, n, 16);
 }
 
 /*
@@ -1391,7 +1405,7 @@ TEST(BufferList, append_bench_with_size_hint) {
   for (size_t step = 4; step <= 16384; step *= 4) {
     const utime_t start = ceph_clock_now();
 
-    constexpr size_t rounds = 4000;
+    constexpr size_t rounds = asan_bench_rounds(4000);
     for (size_t r = 0; r < rounds; ++r) {
       ceph::bufferlist bl(std::size(src));
       for (auto iter = std::begin(src);
@@ -1408,7 +1422,7 @@ TEST(BufferList, append_bench_with_size_hint) {
 
 TEST(BufferList, append_bench_with_size_hint2) {
   std::array<char, 1048576> src = { 0, };
-  constexpr size_t rounds = 4000;
+  constexpr size_t rounds = asan_bench_rounds(4000);
   constexpr int conc_bl = 400;
   std::vector<ceph::bufferlist*> bls(conc_bl);
 
@@ -1439,7 +1453,7 @@ TEST(BufferList, append_bench) {
   std::array<char, 1048576> src = { 0, };
   for (size_t step = 4; step <= 16384; step *= 4) {
     const utime_t start = ceph_clock_now();
-    constexpr size_t rounds = 4000;
+    constexpr size_t rounds = asan_bench_rounds(4000);
     for (size_t r = 0; r < rounds; ++r) {
       ceph::bufferlist bl;
       for (auto iter = std::begin(src);
@@ -1456,7 +1470,7 @@ TEST(BufferList, append_bench) {
 
 TEST(BufferList, append_bench2) {
   std::array<char, 1048576> src = { 0, };
-  constexpr size_t rounds = 4000;
+  constexpr size_t rounds = asan_bench_rounds(4000);
   constexpr int conc_bl = 400;
   std::vector<ceph::bufferlist*> bls(conc_bl);
 
@@ -1488,7 +1502,7 @@ TEST(BufferList, append_hole_bench) {
 
   for (size_t step = 512; step <= 65536; step *= 2) {
     const utime_t start = ceph_clock_now();
-    constexpr size_t rounds = 80000;
+    constexpr size_t rounds = asan_bench_rounds(80000);
     for (size_t r = 0; r < rounds; ++r) {
       ceph::bufferlist bl;
       while (bl.length() < targeted_bl_size) {
@@ -1503,7 +1517,7 @@ TEST(BufferList, append_hole_bench) {
 
 TEST(BufferList, append_hole_bench2) {
   constexpr size_t targeted_bl_size = 1048576;
-  constexpr size_t rounds = 80000;
+  constexpr size_t rounds = asan_bench_rounds(80000);
   constexpr int conc_bl = 400;
   std::vector<ceph::bufferlist*> bls(conc_bl);
 

From 946c23055c20fa8e194f810eb984f9ec083b9cb3 Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Tue, 23 Jun 2026 14:36:22 +0200
Subject: [PATCH 399/596] cephadm: fix staggered upgrade

Do not mark an upgrade complete until daemons in the filtered scope
match the target image. Limited (--limit) upgrades still complete
when remaining_count reaches zero.

Fixes: https://tracker.ceph.com/issues/62959

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 src/pybind/mgr/cephadm/tests/test_upgrade.py | 118 +++++++++++++++++++
 src/pybind/mgr/cephadm/upgrade.py            |  52 ++++++++
 2 files changed, 170 insertions(+)

diff --git a/src/pybind/mgr/cephadm/tests/test_upgrade.py b/src/pybind/mgr/cephadm/tests/test_upgrade.py
index 98ca31c0600..dd28c5fd25f 100644
--- a/src/pybind/mgr/cephadm/tests/test_upgrade.py
+++ b/src/pybind/mgr/cephadm/tests/test_upgrade.py
@@ -1052,3 +1052,121 @@ def test_staggered_upgrade_validation(
     else:
         cephadm_module.upgrade._validate_upgrade_filters(
             'new_image_name', daemon_types, hosts, services)
+
+
+@mock.patch("cephadm.module.HostCache.get_daemons")
+def test_filtered_scope_up_to_date(
+    get_daemons: mock.MagicMock,
+    cephadm_module: CephadmOrchestrator,
+) -> None:
+    target_digest = 'new_image@repo_digest'
+    old_digest = 'old_image@repo_digest'
+
+    cephadm_module.upgrade.upgrade_state = UpgradeState(
+        'target_image',
+        '0',
+        target_digests=[target_digest],
+        daemon_types=['mon'],
+        hosts=['trial031'],
+    )
+
+    get_daemons.return_value = [
+        DaemonDescription(
+            daemon_type='mon',
+            daemon_id='a',
+            hostname='trial031',
+            container_image_digests=[target_digest],
+        ),
+        DaemonDescription(
+            daemon_type='mon',
+            daemon_id='c',
+            hostname='trial031',
+            container_image_digests=[old_digest],
+        ),
+    ]
+
+    assert not cephadm_module.upgrade._filtered_scope_up_to_date(
+        [target_digest], 'target_image',
+    )
+
+    get_daemons.return_value[1].container_image_digests = [target_digest]
+    assert cephadm_module.upgrade._filtered_scope_up_to_date(
+        [target_digest], 'target_image',
+    )
+
+
+@mock.patch.object(CephadmUpgrade, '_mark_upgrade_complete')
+@mock.patch.object(CephadmUpgrade, '_filtered_scope_up_to_date', return_value=False)
+@mock.patch.object(CephadmUpgrade, '_handle_need_upgrade_self')
+@mock.patch.object(CephadmUpgrade, '_to_upgrade', return_value=(True, []))
+@mock.patch.object(
+    CephadmUpgrade, '_detect_need_upgrade', return_value=(False, [], [], 0),
+)
+@mock.patch.object(CephadmUpgrade, '_set_container_images')
+@mock.patch.object(CephadmUpgrade, '_complete_osd_upgrade')
+@mock.patch.object(CephadmUpgrade, '_complete_mds_upgrade')
+@mock.patch.object(CephadmUpgrade, '_update_upgrade_progress')
+@mock.patch.object(CephadmUpgrade, 'get_distinct_container_image_settings', return_value={})
+@mock.patch("cephadm.module.CephadmOrchestrator.lookup_release_name", return_value='tentacle')
+@mock.patch("cephadm.module.CephadmOrchestrator.check_mon_command", return_value=(0, '{}', ''))
+@mock.patch("cephadm.module.CephadmOrchestrator.set_container_image")
+@mock.patch("cephadm.module.CephadmOrchestrator.get_active_mgr_digests")
+@mock.patch("cephadm.module.CephadmOrchestrator.get", return_value={
+    'min_mon_release': 19,
+    'require_osd_release': 'tentacle',
+    'have_local_config_map': True,
+})
+@mock.patch(
+    "cephadm.module.CephadmOrchestrator.version",
+    new_callable=mock.PropertyMock,
+    return_value='ceph version 19.3.0-0 (hash)',
+)
+@mock.patch("cephadm.module.HostCache.get_daemons")
+def test_do_upgrade_limit_exhausted_marks_complete_without_scope_check(
+    get_daemons: mock.MagicMock,
+    _version: mock.MagicMock,
+    _get: mock.MagicMock,
+    get_active_mgr_digests: mock.MagicMock,
+    _set_container_image: mock.MagicMock,
+    _check_mon_command: mock.MagicMock,
+    _lookup_release_name: mock.MagicMock,
+    _get_distinct_container_image_settings: mock.MagicMock,
+    _update_upgrade_progress: mock.MagicMock,
+    _complete_mds_upgrade: mock.MagicMock,
+    _complete_osd_upgrade: mock.MagicMock,
+    _set_container_images: mock.MagicMock,
+    _detect_need_upgrade: mock.MagicMock,
+    _to_upgrade: mock.MagicMock,
+    _handle_need_upgrade_self: mock.MagicMock,
+    filtered_scope: mock.MagicMock,
+    mark_complete: mock.MagicMock,
+    cephadm_module: CephadmOrchestrator,
+) -> None:
+    target_digest = 'new_image@repo_digest'
+    old_digest = 'old_image@repo_digest'
+    get_active_mgr_digests.return_value = [target_digest]
+    get_daemons.return_value = [
+        DaemonDescription(
+            daemon_type='osd',
+            daemon_id=str(i),
+            hostname='host1',
+            container_image_digests=[target_digest] if i < 2 else [old_digest],
+        )
+        for i in range(8)
+    ]
+
+    cephadm_module.upgrade.upgrade_state = UpgradeState(
+        'target_image',
+        '0',
+        target_id='image_id',
+        target_digests=[target_digest],
+        target_version='19.3.0-0',
+        daemon_types=['osd'],
+        total_count=2,
+        remaining_count=0,
+    )
+
+    cephadm_module.upgrade._do_upgrade()
+
+    mark_complete.assert_called_once()
+    filtered_scope.assert_not_called()
diff --git a/src/pybind/mgr/cephadm/upgrade.py b/src/pybind/mgr/cephadm/upgrade.py
index 5d8a120c207..5d3d81dfc30 100644
--- a/src/pybind/mgr/cephadm/upgrade.py
+++ b/src/pybind/mgr/cephadm/upgrade.py
@@ -1692,6 +1692,46 @@ class CephadmUpgrade:
             self.upgrade_state.fs_original_allow_standby_replay = {}
             self._save_upgrade_state()
 
+    def _filtered_scope_up_to_date(
+        self,
+        target_digests: Optional[List[str]],
+        target_name: str,
+    ) -> bool:
+        assert self.upgrade_state is not None
+        if target_digests is None:
+            target_digests = []
+
+        if self.mgr.use_agent:
+            hosts: Set[str] = set()
+            if self.upgrade_state.hosts is not None:
+                hosts.update(self.upgrade_state.hosts)
+            for d in self._get_filtered_daemons():
+                if d.hostname is not None:
+                    hosts.add(d.hostname)
+            for hostname in hosts:
+                if not self.mgr.cache.host_metadata_up_to_date(hostname):
+                    logger.info(
+                        'Upgrade: Waiting for host %s metadata before completing',
+                        hostname,
+                    )
+                    self.mgr.agent_helpers._request_ack_all_not_up_to_date()
+                    return False
+
+        for d in self._get_filtered_daemons():
+            if d.daemon_type not in CEPH_IMAGE_TYPES:
+                continue
+            if (
+                (self.mgr.use_repo_digest and d.matches_digests(target_digests))
+                or (not self.mgr.use_repo_digest and d.matches_image_name(target_name))
+            ):
+                continue
+            logger.info(
+                'Upgrade: Waiting for %s to match target image before completing',
+                d.name(),
+            )
+            return False
+        return True
+
     def _mark_upgrade_complete(self) -> None:
         if not self.upgrade_state:
             logger.debug('_mark_upgrade_complete upgrade already marked complete, exiting')
@@ -1948,5 +1988,17 @@ class CephadmUpgrade:
                 'who': name_to_config_section(daemon_type),
             })
 
+        # Limited (--limit) upgrades end when the batch quota is exhausted,
+        # even if other daemons in the filter still need the target image.
+        if (
+            self.upgrade_state.remaining_count is not None
+            and self.upgrade_state.remaining_count <= 0
+        ):
+            self._mark_upgrade_complete()
+            return
+        if not self._filtered_scope_up_to_date(
+            target_digests, self.upgrade_state._target_name,
+        ):
+            return
         self._mark_upgrade_complete()
         return

From aa9247a36cfc26b791ce10efab0e1eae7624faae Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Fri, 5 Jun 2026 17:01:25 +0800
Subject: [PATCH 400/596] crimson/os/seastore/journal: change
 CircularBoundedJournal::replay() to use coroutine

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 .../journal/circular_bounded_journal.cc       | 156 ++++++++----------
 1 file changed, 71 insertions(+), 85 deletions(-)

diff --git a/src/crimson/os/seastore/journal/circular_bounded_journal.cc b/src/crimson/os/seastore/journal/circular_bounded_journal.cc
index 9ab7d629f59..62e6c175aed 100644
--- a/src/crimson/os/seastore/journal/circular_bounded_journal.cc
+++ b/src/crimson/os/seastore/journal/circular_bounded_journal.cc
@@ -332,94 +332,80 @@ Journal::replay_ret CircularBoundedJournal::replay(
   /*
    * read records from last applied record prior to written_to, and replay
    */
+  auto d_handler = std::move(delta_handler);
   LOG_PREFIX(CircularBoundedJournal::replay);
-  return cjs.read_header(
-  ).handle_error(
+  auto p = co_await cjs.read_header().handle_error(
     open_for_mount_ertr::pass_further{},
-    crimson::ct_error::assert_all(
-      "Invalid error read_header"
-  )).safe_then([this, FNAME, delta_handler=std::move(delta_handler)](auto p)
-    mutable {
-    auto &[head, bl] = *p;
-    cjs.set_cbj_header(head);
-    DEBUG("header : {}", cjs.get_cbj_header());
-    cjs.set_initialized(true);
-    return seastar::do_with(
-      std::move(delta_handler),
-      std::map<paddr_t, journal_seq_t>(),
-      std::map<paddr_t, std::pair<CachedExtentRef, uint32_t>>(),
-      [this](auto &d_handler, auto &map, auto &crc_info) {
-      auto build_paddr_seq_map = [&map](
-        const auto &offsets,
-        const auto &e,
-	sea_time_point modify_time)
-      {
-	if (e.type == extent_types_t::ALLOC_INFO) {
-	  alloc_delta_t alloc_delta;
-	  decode(alloc_delta, e.bl);
-	  if (alloc_delta.op == alloc_delta_t::op_types_t::CLEAR) {
-	    for (auto &alloc_blk : alloc_delta.alloc_blk_ranges) {
-	      map[alloc_blk.paddr] = offsets.write_result.start_seq;
-	    }
-	  }
-	}
-	return replay_ertr::make_ready_future<bool>(true);
-      };
-      auto tail = get_dirty_tail() <= get_alloc_tail() ?
-	get_dirty_tail() : get_alloc_tail();
-      set_written_to(tail);
-      // The first pass to build the paddr->journal_seq_t map 
-      // from extent allocations
-      return scan_valid_record_delta(std::move(build_paddr_seq_map), tail
-      ).safe_then([this, &map, &d_handler, tail, &crc_info]() {
-	auto call_d_handler_if_valid = [this, &map, &d_handler, &crc_info](
-	  const auto &offsets,
-	  const auto &e,
-	  sea_time_point modify_time)
-	{
-	  if (map.find(e.paddr) == map.end() ||
-	      map[e.paddr] <= offsets.write_result.start_seq) {
-	    return d_handler(
-	      offsets,
-	      e,
-	      get_dirty_tail(),
-	      get_alloc_tail(),
-	      modify_time
-	    ).safe_then([&e, &crc_info](auto ret) {
-	      auto [applied, ext] = ret;
-	      if (applied && ext && can_inplace_rewrite(
-		  ext->get_type())) {
-		crc_info[ext->get_paddr()] =
-		  std::make_pair(ext, e.final_crc);
-	      }
-	      return replay_ertr::make_ready_future<bool>(applied);
-	    });
-	  }
-	  return replay_ertr::make_ready_future<bool>(true);
-	};
-	// The second pass to replay deltas
-	return scan_valid_record_delta(std::move(call_d_handler_if_valid), tail
-	).safe_then([&crc_info]() {
-	  for (auto p : crc_info) {
-	    ceph_assert_always(p.second.first->get_last_committed_crc() == p.second.second);	
-	  }
-	  crc_info.clear();
-	  return replay_ertr::now();
-	});
-      });
-    }).safe_then([this]() {
-      // make sure that committed_to is JOURNAL_SEQ_NULL if jounal is the initial state
-      if (get_written_to() != 
-	  journal_seq_t{0,
-	    convert_abs_addr_to_paddr(get_records_start(),
-	    get_device_id())}) {
-	record_submitter.update_committed_to(get_written_to());
+    crimson::ct_error::assert_all("Invalid error read_header"));
+  auto &[head, bl] = *p;
+  cjs.set_cbj_header(head);
+  DEBUG("header : {}", cjs.get_cbj_header());
+  cjs.set_initialized(true);
+  std::map<paddr_t, journal_seq_t> map;
+  std::map<paddr_t, std::pair<CachedExtentRef, uint32_t>> crc_info;
+  auto build_paddr_seq_map = [&map](
+    const auto &offsets,
+    const auto &e,
+    sea_time_point modify_time)
+  {
+    if (e.type == extent_types_t::ALLOC_INFO) {
+      alloc_delta_t alloc_delta;
+      decode(alloc_delta, e.bl);
+      if (alloc_delta.op == alloc_delta_t::op_types_t::CLEAR) {
+        for (auto &alloc_blk : alloc_delta.alloc_blk_ranges) {
+          map[alloc_blk.paddr] = offsets.write_result.start_seq;
+        }
       }
-      trimmer.update_journal_tails(
-	get_dirty_tail(),
-	get_alloc_tail());
-    });
-  });
+    }
+    return replay_ertr::make_ready_future<bool>(true);
+  };
+  auto tail = get_dirty_tail() <= get_alloc_tail() ?
+    get_dirty_tail() : get_alloc_tail();
+  set_written_to(tail);
+  // The first pass to build the paddr->journal_seq_t map 
+  // from extent allocations
+  co_await scan_valid_record_delta(std::move(build_paddr_seq_map), tail);
+  auto call_d_handler_if_valid = [this, &map, &d_handler, &crc_info](
+    const auto &offsets,
+    const auto &e,
+    sea_time_point modify_time)
+  {
+    if (map.find(e.paddr) == map.end() ||
+        map[e.paddr] <= offsets.write_result.start_seq) {
+      return d_handler(
+        offsets,
+        e,
+        get_dirty_tail(),
+        get_alloc_tail(),
+        modify_time
+      ).safe_then([&e, &crc_info](auto ret) {
+        auto [applied, ext] = ret;
+        if (applied && ext && can_inplace_rewrite(
+            ext->get_type())) {
+          crc_info[ext->get_paddr()] =
+            std::make_pair(ext, e.final_crc);
+        }
+        return replay_ertr::make_ready_future<bool>(applied);
+      });
+    }
+    return replay_ertr::make_ready_future<bool>(true);
+  };
+  // The second pass to replay deltas
+  co_await scan_valid_record_delta(std::move(call_d_handler_if_valid), tail);
+  for (auto p : crc_info) {
+    ceph_assert_always(p.second.first->get_last_committed_crc() == p.second.second);	
+  }
+  crc_info.clear();
+  // make sure that committed_to is JOURNAL_SEQ_NULL if jounal is the initial state
+  if (get_written_to() != 
+      journal_seq_t{0,
+        convert_abs_addr_to_paddr(get_records_start(),
+        get_device_id())}) {
+    record_submitter.update_committed_to(get_written_to());
+  }
+  trimmer.update_journal_tails(
+    get_dirty_tail(),
+    get_alloc_tail());
 }
 
 void CircularBoundedJournal::register_metrics()

From bf0e7afecbab833e015710daaef5e4e7343bfe74 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Sun, 21 Jun 2026 19:59:46 +0800
Subject: [PATCH 401/596] 
 crimson/os/seastore/random_block_manager/avlallocator: avoid directly
 modifying avl_set elements

Fixes: https://tracker.ceph.com/issues/77549
Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 .../random_block_manager/avlallocator.cc      | 55 +++++++++++--------
 1 file changed, 31 insertions(+), 24 deletions(-)

diff --git a/src/crimson/os/seastore/random_block_manager/avlallocator.cc b/src/crimson/os/seastore/random_block_manager/avlallocator.cc
index 3f8df06f9d6..e23b2a76426 100644
--- a/src/crimson/os/seastore/random_block_manager/avlallocator.cc
+++ b/src/crimson/os/seastore/random_block_manager/avlallocator.cc
@@ -46,30 +46,32 @@ void AvlAllocator::_remove_from_tree(rbm_abs_addr start, rbm_abs_addr size)
   bool left_over = (rs->start != start);
   bool right_over = (rs->end != end);
 
+  auto range = extent_range_t{rs->start, rs->end};
   _extent_size_tree_rm(*rs);
+  auto insert_pos = extent_tree.erase_and_dispose(rs, dispose_rs{});
 
   if (left_over && right_over) {
-    auto old_right_end = rs->end;
-    auto insert_pos = rs;
-    ceph_assert(insert_pos != extent_tree.end());
-    ++insert_pos;
-    rs->end = start;
+    auto prange = new extent_range_t(range);
+    auto old_right_end = prange->end;
+    prange->end = start;
 
     auto r = new extent_range_t{end, old_right_end};
-    extent_tree.insert_before(insert_pos, *r);
-    extent_size_tree.insert(*r);
-    available_size += r->length();
-    _extent_size_tree_try_insert(*rs);
+    insert_pos = extent_tree.insert_before(insert_pos, *r);
+    extent_tree.insert_before(insert_pos, *prange);
+    _extent_size_tree_try_insert(*r);
+    _extent_size_tree_try_insert(*prange);
   } else if (left_over) {
+    auto prange = new extent_range_t(range);
     assert(is_aligned(start, block_size));
-    rs->end = start;
-    _extent_size_tree_try_insert(*rs);
+    prange->end = start;
+    extent_tree.insert_before(insert_pos, *prange);
+    _extent_size_tree_try_insert(*prange);
   } else if (right_over) {
+    auto prange = new extent_range_t(range);
     assert(is_aligned(end, block_size));
-    rs->start = end;
-    _extent_size_tree_try_insert(*rs);
-  } else {
-    extent_tree.erase_and_dispose(rs, dispose_rs{});
+    prange->start = end;
+    extent_tree.insert_before(insert_pos, *prange);
+    _extent_size_tree_try_insert(*prange);
   }
 }
 
@@ -135,24 +137,29 @@ void AvlAllocator::_add_to_tree(rbm_abs_addr start, rbm_abs_addr size)
   bool merge_after = (rs_after != extent_tree.end() && rs_after->start == end);
 
   if (merge_before && merge_after) {
+    auto range = new extent_range_t{rs_before->start, rs_after->end};
     _extent_size_tree_rm(*rs_before);
     _extent_size_tree_rm(*rs_after);
-    rs_after->start = rs_before->start;
-    extent_tree.erase_and_dispose(rs_before, dispose_rs{});
-    _extent_size_tree_try_insert(*rs_after);
+    rs_after = extent_tree.erase_and_dispose(rs_before, dispose_rs{});
+    auto insert_pos = extent_tree.erase_and_dispose(rs_after, dispose_rs{});
+    _extent_size_tree_try_insert(*range);
+    extent_tree.insert_before(insert_pos, *range);
   } else if (merge_before) {
+    auto range = new extent_range_t{rs_before->start, end};
     _extent_size_tree_rm(*rs_before);
-    rs_before->end = end;
-    _extent_size_tree_try_insert(*rs_before);
+    _extent_size_tree_try_insert(*range);
+    auto insert_pos = extent_tree.erase_and_dispose(rs_before, dispose_rs{});
+    extent_tree.insert_before(insert_pos, *range);
   } else if (merge_after) {
+    auto range = new extent_range_t{start, rs_after->end};
     _extent_size_tree_rm(*rs_after);
-    rs_after->start = start;
-    _extent_size_tree_try_insert(*rs_after);
+    _extent_size_tree_try_insert(*range);
+    auto insert_pos = extent_tree.erase_and_dispose(rs_after, dispose_rs{});
+    extent_tree.insert_before(insert_pos, *range);
   } else {
     auto r = new extent_range_t{start, end};
     extent_tree.insert(*r);
-    extent_size_tree.insert(*r);
-    available_size += r->length();
+    _extent_size_tree_try_insert(*r);
   }
 }
 

From bdbfa8a15a04a9d0fc22e6059967dffcf4e2c276 Mon Sep 17 00:00:00 2001
From: Abhishek Desai <abhishek.desai1@ibm.com>
Date: Wed, 10 Jun 2026 16:13:16 +0530
Subject: [PATCH 402/596] mgr/dashboard : Fix feedback module enablement fixes
 : https://tracker.ceph.com/issues/75734 Signed-off-by: Abhishek Desai
 <abhishek.desai1@ibm.com>

---
 qa/tasks/mgr/dashboard/test_feedback.py       |  2 +-
 .../mgr/dashboard/controllers/mgr_modules.py  | 22 +++++++--
 .../mgr-module-list.component.spec.ts         |  2 +-
 .../shared/feedback/feedback.component.html   | 49 +++++++++----------
 .../feedback/feedback.component.spec.ts       | 41 +++++++++++++++-
 .../shared/feedback/feedback.component.ts     | 22 +++++++--
 .../src/app/shared/api/feedback.service.ts    | 11 ++++-
 .../app/shared/api/mgr-module.service.spec.ts | 17 ++++++-
 .../src/app/shared/api/mgr-module.service.ts  | 14 ++++--
 src/pybind/mgr/dashboard/openapi.yaml         | 15 +++++-
 10 files changed, 152 insertions(+), 43 deletions(-)

diff --git a/qa/tasks/mgr/dashboard/test_feedback.py b/qa/tasks/mgr/dashboard/test_feedback.py
index a395adf4865..39d736ea08c 100644
--- a/qa/tasks/mgr/dashboard/test_feedback.py
+++ b/qa/tasks/mgr/dashboard/test_feedback.py
@@ -6,7 +6,7 @@ class FeedbackTest(MgrModuleTestCase):
     @classmethod
     def setUpClass(cls):
         super().setUpClass()
-        cls._ceph_cmd(['mgr', 'module', 'enable', 'feedback'], wait=3)
+        cls._ceph_cmd(['mgr', 'module', 'enable', 'feedback', '--force'], wait=3)
         # Point the feedback module at an unreachable host so the test
         # does not depend on tracker.ceph.com being available. Any
         # create_issue call will fail fast with a ConnectionError
diff --git a/src/pybind/mgr/dashboard/controllers/mgr_modules.py b/src/pybind/mgr/dashboard/controllers/mgr_modules.py
index 57bb9b5ffb8..249c111e00c 100644
--- a/src/pybind/mgr/dashboard/controllers/mgr_modules.py
+++ b/src/pybind/mgr/dashboard/controllers/mgr_modules.py
@@ -1,11 +1,13 @@
 # -*- coding: utf-8 -*-
 
+from typing import Optional
+
 from .. import mgr
 from ..security import Scope
 from ..services.ceph_service import CephService
 from ..services.exception import handle_send_command_error
 from ..tools import find_object_in_list, str_to_bool
-from . import APIDoc, APIRouter, EndpointDoc, RESTController, allow_empty_body
+from . import APIDoc, APIRouter, EndpointDoc, Param, RESTController, allow_empty_body
 
 MGR_MODULE_SCHEMA = ([{
     "name": (str, "Module Name"),
@@ -94,15 +96,27 @@ class MgrModules(RESTController):
     @RESTController.Resource('POST')
     @handle_send_command_error('mgr_modules')
     @allow_empty_body
-    def enable(self, module_name):
+    @EndpointDoc("Enable Mgr module",
+                 parameters={
+                     'force': Param(
+                         bool,
+                         'Force enablement when not all mgr daemons support the module',
+                         True,
+                         False)
+                 })
+    def enable(self, module_name, force: Optional[bool] = False):
         """
         Enable the specified Ceph Mgr module.
         :param module_name: The name of the Ceph Mgr module.
         :type module_name: str
+        :param force: Force enablement when not all mgr daemons support the module.
+        :type force: bool
         """
         assert self._is_module_managed(module_name)
-        CephService.send_command(
-            'mon', 'mgr module enable', module=module_name)
+        cmd_kwargs = {'module': module_name}
+        if force:
+            cmd_kwargs['force'] = True
+        CephService.send_command('mon', 'mgr module enable', **cmd_kwargs)
 
     @RESTController.Resource('POST')
     @handle_send_command_error('mgr_modules')
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.spec.ts
index 68fad64f689..ffe59f37e37 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.spec.ts
@@ -146,7 +146,7 @@ describe('MgrModuleListComponent', () => {
       tick(mgrModuleService.REFRESH_INTERVAL);
       tick(mgrModuleService.REFRESH_INTERVAL);
       tick(mgrModuleService.REFRESH_INTERVAL);
-      expect(mgrModuleService.enable).toHaveBeenCalledWith('foo');
+      expect(mgrModuleService.enable).toHaveBeenCalledWith('foo', false);
       expect(mgrModuleService.list).toHaveBeenCalledTimes(2);
       expect(component.table.refreshBtn).toHaveBeenCalled();
     }));
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html
index 50a1804f35d..270f88c8443 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html
@@ -17,13 +17,13 @@
       class="modal-wrapper"
     >
       @if (!isFeedbackEnabled) {
-      <cd-alert-panel type="error"
+      <cd-alert-panel type="info"
                       spacingClass="mb-3"
-                      actionName="Enable"
+                      actionName="Enable feedback"
                       class="align-items-center"
                       (action)="enableFeedbackModule()"
                       i18n-actionName>
-        In order to report an issue, Feedback module must be enabled.
+        Enable the feedback service to report issues.
       </cd-alert-panel>
       }
       <!-- api_key -->
@@ -31,14 +31,13 @@
       <div class="form-item">
         <cds-password-label
           labelInputID="api_key"
-          label="Ceph Tracker API Key"
-          cdRequiredField="Ceph Tracker API Key"
           [invalid]="!feedbackForm.controls.api_key.valid && feedbackForm.controls.api_key.dirty"
           [invalidText]="apiKeyError"
           [helperText]="apiKeyHelperTpl"
           [disabled]="!isFeedbackEnabled"
           i18n
         >
+          API key
           <input
             cdsPassword
             id="api_key"
@@ -50,18 +49,19 @@
         <ng-template #apiKeyError>
           @if (feedbackForm.showError('api_key', formDir, 'required')) {
           <span class="invalid-feedback"
-                i18n> Ceph Tracker API key is required. </span>
+                i18n>API key is required.</span>
           } @if (feedbackForm.showError('api_key', formDir, 'invalidApiKey')) {
           <span class="invalid-feedback"
-                i18n> Ceph Tracker API key is invalid. </span>
+                i18n>API key is invalid.</span>
           }
         </ng-template>
 
         <ng-template #apiKeyHelperTpl>
-          You can obtain your API key from
-          <a href="https://tracker.ceph.com/my/account"
-             target="_blank">https://tracker.ceph.com/my/account
-          </a>
+          <ng-container i18n>
+            Enter your Ceph Tracker API key. You can find your API key in your
+            <a href="https://tracker.ceph.com/my/account"
+               target="_blank">Ceph Tracker account</a>.
+          </ng-container>
         </ng-template>
       </div>
       }
@@ -72,12 +72,10 @@
           label="Project name"
           id="project"
           formControlName="project"
-          cdRequiredField="Project name"
           [invalid]="!feedbackForm.controls.project.valid && feedbackForm.controls.project.dirty"
           [invalidText]="projectError"
           i18n
         >
-          <option value="">--- Select a project ---</option>
           @for (project of projects; track project) {
           <option [value]="project">{{ project }}</option>
           }
@@ -90,25 +88,24 @@
         </ng-template>
       </div>
 
-      <!-- tracker -->
+      <!-- issue type -->
       <div class="form-item cds-select-label">
         <cds-select
-          label="Tracker"
+          label="Issue type"
           id="tracker"
           formControlName="tracker"
-          cdRequiredField="Tracker"
           [invalid]="!feedbackForm.controls.tracker.valid && feedbackForm.controls.tracker.dirty"
           [invalidText]="trackerError"
           i18n
-        > Tracker
-          @for (trackerName of tracker; track trackerName) {
-          <option [value]="trackerName">{{ trackerName }}</option>
+        >
+          @for (issueType of issueTypes; track issueType.value) {
+          <option [value]="issueType.value">{{ issueType.label }}</option>
           }
         </cds-select>
 
         <ng-template #trackerError>
           @if (feedbackForm.showError('tracker', formDir, 'required')) {
-          <span i18n>Tracker name is required.</span>
+          <span i18n>Issue type is required.</span>
           }
         </ng-template>
       </div>
@@ -116,25 +113,25 @@
       <!-- subject -->
       <div class="form-item">
         <cds-text-label
-          cdRequiredField="Subject"
           [invalid]="!feedbackForm.controls.subject.valid && feedbackForm.controls.subject.dirty"
           [invalidText]="subjectError"
           [disabled]="!isFeedbackEnabled"
           i18n
         >
-          Subject
+          Issue title
           <input
             cdsText
             id="subject"
             type="text"
             formControlName="subject"
-            placeholder="Add issue title"
+            placeholder="Enter a short summary of the issue"
+            i18n-placeholder
           />
         </cds-text-label>
 
         <ng-template #subjectError>
           @if (feedbackForm.showError('subject', formDir, 'required')) {
-          <span i18n>Subject is required.</span>
+          <span i18n>Issue title is required.</span>
           }
         </ng-template>
       </div>
@@ -142,7 +139,6 @@
       <!-- description -->
       <div class="form-item">
         <cds-text-label
-          cdRequiredField="Description"
           [invalid]="!feedbackForm.controls.description.valid && feedbackForm.controls.description.dirty"
           [invalidText]="descriptionError"
           [disabled]="!isFeedbackEnabled"
@@ -154,7 +150,8 @@
             id="description"
             type="text"
             formControlName="description"
-            placeholder="Explain your issue"
+            placeholder="Describe the issue and include steps to reproduce it, if applicable"
+            i18n-placeholder
           />
         </cds-text-label>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.spec.ts
index c5e27b99054..d8faa782a76 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.spec.ts
@@ -5,9 +5,10 @@ import { RouterTestingModule } from '@angular/router/testing';
 
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap';
 
-import { throwError } from 'rxjs';
+import { throwError, of as observableOf } from 'rxjs';
 
 import { FeedbackService } from '~/app/shared/api/feedback.service';
+import { MgrModuleService } from '~/app/shared/api/mgr-module.service';
 import { ComponentsModule } from '~/app/shared/components/components.module';
 import { configureTestBed, FormHelper } from '~/testing/unit-test-helper';
 import { FeedbackComponent } from './feedback.component';
@@ -18,6 +19,7 @@ describe('FeedbackComponent', () => {
   let component: FeedbackComponent;
   let fixture: ComponentFixture<FeedbackComponent>;
   let feedbackService: FeedbackService;
+  let mgrModuleService: MgrModuleService;
   let formHelper: FormHelper;
 
   configureTestBed({
@@ -37,6 +39,7 @@ describe('FeedbackComponent', () => {
     fixture = TestBed.createComponent(FeedbackComponent);
     component = fixture.componentInstance;
     feedbackService = TestBed.inject(FeedbackService);
+    mgrModuleService = TestBed.inject(MgrModuleService);
     fixture.detectChanges();
   });
 
@@ -73,4 +76,40 @@ describe('FeedbackComponent', () => {
 
     formHelper.expectError('api_key', 'invalidApiKey');
   });
+
+  it('should enable feedback module with force', () => {
+    spyOn(mgrModuleService, 'updateModuleState');
+    spyOn(mgrModuleService.updateCompleted$, 'subscribe').and.callThrough();
+
+    component.enableFeedbackModule();
+
+    expect(mgrModuleService.updateModuleState).toHaveBeenCalledWith(
+      'feedback',
+      false,
+      null,
+      null,
+      'Enabled Feedback Module',
+      false,
+      undefined,
+      true
+    );
+    expect(mgrModuleService.updateCompleted$.subscribe).toHaveBeenCalled();
+  });
+
+  it('should refresh feedback state after module enablement', () => {
+    spyOn(feedbackService, 'isKeyExist').and.returnValues(
+      throwError({ status: 404 }),
+      observableOf(true)
+    );
+    spyOn(mgrModuleService, 'updateModuleState');
+
+    component.ngOnInit();
+    expect(component.isFeedbackEnabled).toEqual(false);
+
+    component.enableFeedbackModule();
+    mgrModuleService.updateCompleted$.next();
+
+    expect(component.isFeedbackEnabled).toEqual(true);
+    expect(component.feedbackForm.enabled).toEqual(true);
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.ts
index 40509cbe797..655358050ec 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.ts
@@ -28,7 +28,10 @@ export class FeedbackComponent extends CdForm implements OnInit, OnDestroy {
     'ceph_volume',
     'core_ceph'
   ];
-  tracker: string[] = ['bug', 'feature'];
+  issueTypes = [
+    { value: 'bug', label: $localize`Bug` },
+    { value: 'feature', label: $localize`Feature request` }
+  ];
   api_key: string;
   keySub: Subscription;
   submit: string;
@@ -48,8 +51,15 @@ export class FeedbackComponent extends CdForm implements OnInit, OnDestroy {
 
   ngOnInit() {
     this.createForm();
+    this.loadFeedbackState();
+  }
+
+  private loadFeedbackState() {
+    this.keySub?.unsubscribe();
     this.keySub = this.feedbackService.isKeyExist().subscribe({
       next: (data: boolean) => {
+        this.isFeedbackEnabled = true;
+        this.feedbackForm.enable();
         this.isAPIKeySet = data;
         if (this.isAPIKeySet) {
           this.feedbackForm.get('api_key').clearValidators();
@@ -64,8 +74,8 @@ export class FeedbackComponent extends CdForm implements OnInit, OnDestroy {
 
   private createForm() {
     this.feedbackForm = new CdFormGroup({
-      project: new UntypedFormControl('', Validators.required),
-      tracker: new UntypedFormControl(this.tracker[0], Validators.required),
+      project: new UntypedFormControl(this.projects[0], Validators.required),
+      tracker: new UntypedFormControl(this.issueTypes[0].value, Validators.required),
       subject: new UntypedFormControl('', Validators.required),
       description: new UntypedFormControl('', Validators.required),
       api_key: new UntypedFormControl('', Validators.required)
@@ -110,7 +120,13 @@ export class FeedbackComponent extends CdForm implements OnInit, OnDestroy {
       null,
       null,
       'Enabled Feedback Module',
+      false,
+      undefined,
       true
     );
+    const subscription = this.mgrModuleService.updateCompleted$.subscribe(() => {
+      subscription.unsubscribe();
+      this.loadFeedbackState();
+    });
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/feedback.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/feedback.service.ts
index c450bbe076f..b3ea2ffc15b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/feedback.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/feedback.service.ts
@@ -2,6 +2,8 @@ import { HttpClient } from '@angular/common/http';
 import { Injectable } from '@angular/core';
 
 import * as _ from 'lodash';
+import { throwError as observableThrowError } from 'rxjs';
+import { catchError } from 'rxjs/operators';
 
 @Injectable({
   providedIn: 'root'
@@ -11,7 +13,14 @@ export class FeedbackService {
   baseUIURL = 'api/feedback';
 
   isKeyExist() {
-    return this.http.get('ui-api/feedback/api_key/exist');
+    return this.http.get('ui-api/feedback/api_key/exist').pipe(
+      catchError((error) => {
+        if (_.isFunction(error.preventDefault)) {
+          error.preventDefault();
+        }
+        return observableThrowError(() => error);
+      })
+    );
   }
 
   createIssue(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.spec.ts
index 0f65e6ebc0f..00ed2fe4c39 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.spec.ts
@@ -61,6 +61,21 @@ describe('MgrModuleService', () => {
     service.enable('foo').subscribe();
     const req = httpTesting.expectOne('api/mgr/module/foo/enable');
     expect(req.request.method).toBe('POST');
+    expect(req.request.body).toBeNull();
+  });
+
+  it('should call enable with force for whitelisted modules', () => {
+    service.enable('feedback').subscribe();
+    const req = httpTesting.expectOne('api/mgr/module/feedback/enable');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.body).toEqual({ force: true });
+  });
+
+  it('should call enable with explicit force', () => {
+    service.enable('foo', true).subscribe();
+    const req = httpTesting.expectOne('api/mgr/module/foo/enable');
+    expect(req.request.method).toBe('POST');
+    expect(req.request.body).toEqual({ force: true });
   });
 
   it('should call disable', () => {
@@ -106,7 +121,7 @@ describe('MgrModuleService', () => {
       tick(service.REFRESH_INTERVAL);
       tick(service.REFRESH_INTERVAL);
       tick(service.REFRESH_INTERVAL);
-      expect(service.enable).toHaveBeenCalledWith('foo');
+      expect(service.enable).toHaveBeenCalledWith('foo', false);
       expect(service.list).toHaveBeenCalledTimes(2);
       expect(notificationService.suspendToasties).toHaveBeenCalledTimes(2);
       expect(blockUIService.start).toHaveBeenCalled();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.ts
index 7826523b5d0..53a508b01f3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/mgr-module.service.ts
@@ -13,6 +13,9 @@ import { SummaryService } from '../services/summary.service';
 
 const GLOBAL = 'global';
 
+/** Modules that require --force when not all mgr daemons support them. */
+const FORCE_ENABLE_MODULES = new Set(['feedback']);
+
 @Injectable({
   providedIn: 'root'
 })
@@ -60,9 +63,11 @@ export class MgrModuleService {
   /**
    * Enable the Ceph Mgr module.
    * @param {string} module The name of the mgr module.
+   * @param {boolean} force Force enablement when not all mgr daemons support the module.
    */
-  enable(module: string) {
-    return this.http.post(`${this.url}/${module}/enable`, null);
+  enable(module: string, force: boolean = false) {
+    const useForce = force || FORCE_ENABLE_MODULES.has(module);
+    return this.http.post(`${this.url}/${module}/enable`, useForce ? { force: true } : null);
   }
 
   /**
@@ -92,9 +97,10 @@ export class MgrModuleService {
     navigateTo: string = '',
     notificationText?: string,
     navigateByUrl?: boolean,
-    reconnectingMessage: string = $localize`Reconnecting, please wait ...`
+    reconnectingMessage: string = $localize`Reconnecting, please wait ...`,
+    force: boolean = false
   ): void {
-    const moduleToggle$ = enabled ? this.disable(module) : this.enable(module);
+    const moduleToggle$ = enabled ? this.disable(module) : this.enable(module, force);
 
     moduleToggle$.subscribe({
       next: () => {
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index 28d785dfaeb..83f0ca14911 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -10435,13 +10435,25 @@ paths:
     post:
       description: "\n        Enable the specified Ceph Mgr module.\n        :param\
         \ module_name: The name of the Ceph Mgr module.\n        :type module_name:\
-        \ str\n        "
+        \ str\n        :param force: Force enablement when not all mgr daemons support\
+        \ the module.\n        :type force: bool\n        "
       parameters:
       - in: path
         name: module_name
         required: true
         schema:
           type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                force:
+                  default: false
+                  description: Force enablement when not all mgr daemons support the
+                    module
+                  type: boolean
+              type: object
       responses:
         '201':
           content:
@@ -10472,6 +10484,7 @@ paths:
             trace.
       security:
       - jwt: []
+      summary: Enable Mgr module
       tags:
       - MgrModule
   /api/mgr/module/{module_name}/options:

From cfd916b1b4190c1d961efcc700feba9164e9dd87 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xxhdx1985126@gmail.com>
Date: Sun, 21 Jun 2026 20:53:48 +0800
Subject: [PATCH 403/596] osd: speed up upmap underfull fallback

According to our tests, this commit can speed up pg upmap calculations
by orders of magnitude

Performance analysis:
Suppose:
R = number of pg_upmap_items (the full candidate pool, after to_skip/only_pools filtering)
M = how many OSDs the deviation_osd loop visits before it breaks (less or equal to underfull count)
U = the number of distinct from OSDs in the upmap items. U is less or equal to number of OSDs, and should be less than R x k
k = mapping pairs per candidate (usually 1, small)

Time complexity of OSDMap::calc_pg_upmaps():
Before the commit: O(M * R)
After the commit: O(R * k + M * log(U)) ~= O(R + M *log(U))

Performant evaluation:
Existing upmap items    Underfull OSDs  Old path        New path        Speedup
50000                   1000            6.51s           0.047s          137x
100000                  1000            12.05s          0.086s          140x
200000                  2000            63.93s          0.281s          227x

Fixes: https://tracker.ceph.com/issues/77563
Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
Assisted-by: Codex:GPT-5.5
---
 src/osd/OSDMap.cc | 58 +++++++++++++++++++++++++++--------------------
 src/osd/OSDMap.h  |  3 ++-
 2 files changed, 36 insertions(+), 25 deletions(-)

diff --git a/src/osd/OSDMap.cc b/src/osd/OSDMap.cc
index 59daa0a156f..7579e054c8e 100644
--- a/src/osd/OSDMap.cc
+++ b/src/osd/OSDMap.cc
@@ -5981,28 +5981,32 @@ int OSDMap::calc_pg_upmaps(
     ceph_assert(!(to_unmap.size() || to_upmap.size()));
     ldout(cct, 10) << " failed to find any changes for overfull osds"
                    << dendl;
-    for (auto& [deviation, osd] : deviation_osd) {
-      if (std::find(underfull.begin(), underfull.end(), osd) ==
-                    underfull.end())
-        break;
-      float target = osd_weight[osd] * pgs_per_weight;
-      ceph_assert(target > 0);
-      if (fabsf(deviation) < max_deviation) {
-        // respect max_deviation too
-        ldout(cct, 10) << " osd." << osd
-                       << " target " << target
-                       << " deviation " << deviation
-                       << " -> absolute " << fabsf(deviation)
-                       << " < max " << max_deviation
-                       << dendl;
-        break;
-      }
-      // look for remaps we can un-remap
-      candidates_t candidates = build_candidates(cct, tmp_osd_map, to_skip,
-      						 only_pools, aggressive, p_seed);
-      if (try_drop_remap_underfull(cct, candidates, osd, temp_pgs_by_osd,
-          to_unmap, to_upmap)) {
-	goto test_change;
+    {
+      const auto candidates_by_osd = build_candidates_by_osd(
+        cct, tmp_osd_map, to_skip, only_pools, aggressive, p_seed);
+      for (auto& [deviation, osd] : deviation_osd) {
+        if (std::find(underfull.begin(), underfull.end(), osd) ==
+                      underfull.end())
+          break;
+        float target = osd_weight[osd] * pgs_per_weight;
+        ceph_assert(target > 0);
+        if (fabsf(deviation) < max_deviation) {
+          // respect max_deviation too
+          ldout(cct, 10) << " osd." << osd
+                         << " target " << target
+                         << " deviation " << deviation
+                         << " -> absolute " << fabsf(deviation)
+                         << " < max " << max_deviation
+                         << dendl;
+          break;
+        }
+        // look for remaps we can un-remap
+        auto candidates = candidates_by_osd.find(osd);
+        if (candidates != candidates_by_osd.end() &&
+            try_drop_remap_underfull(cct, candidates->second, osd,
+                                     temp_pgs_by_osd, to_unmap, to_upmap)) {
+	  goto test_change;
+        }
       }
     }
 
@@ -6527,7 +6531,7 @@ int OSDMap::find_best_remap (
   return best_pos;
 }
 
-OSDMap::candidates_t OSDMap::build_candidates(
+OSDMap::candidates_by_osd_t OSDMap::build_candidates_by_osd(
   CephContext *cct,
   const OSDMap& tmp_osd_map,
   const set<pg_t> to_skip,
@@ -6551,7 +6555,13 @@ OSDMap::candidates_t OSDMap::build_candidates(
     // shuffle candidates so they all get equal (in)attention
     std::shuffle(candidates.begin(), candidates.end(), get_random_engine(cct, p_seed));
   }
-  return candidates;
+  candidates_by_osd_t candidates_by_osd;
+  for (auto& candidate : candidates) {
+    for (auto& mapping : candidate.second) {
+      candidates_by_osd[mapping.first].push_back(candidate);
+    }
+  }
+  return candidates_by_osd;
 }
 
 // return -1 if all PGs are OK, else the first PG which includes only zero PA OSDs
diff --git a/src/osd/OSDMap.h b/src/osd/OSDMap.h
index 202475ab16e..0faaad96d38 100644
--- a/src/osd/OSDMap.h
+++ b/src/osd/OSDMap.h
@@ -1638,6 +1638,7 @@ private: // Bunch of internal functions used only by calc_pg_upmaps (result of c
 
 typedef std::vector<std::pair<pg_t, mempool::osdmap::vector<std::pair<int, int>>>>
   candidates_t;
+typedef std::map<int, candidates_t> candidates_by_osd_t;
 
 bool try_drop_remap_underfull(
     CephContext *cct,
@@ -1669,7 +1670,7 @@ bool try_drop_remap_underfull(
     const std::map<int,float> osd_deviation
   );
 
-  candidates_t build_candidates(
+  candidates_by_osd_t build_candidates_by_osd(
     CephContext *cct,
     const OSDMap& tmp_osd_map,
     const std::set<pg_t> to_skip,

From cb2321f7fa6821d6d96a790f403a65410e095654 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Wed, 24 Jun 2026 15:31:11 +0800
Subject: [PATCH 404/596] osd/OSDMap: fix the pgs_per_weight calculation error
 when multiple pools are being balanced

Before this commit, When multiple pools are being balanced,
pgs_per_weight only considers the last pool, which is wrong.

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/osd/OSDMap.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/osd/OSDMap.cc b/src/osd/OSDMap.cc
index 7579e054c8e..a82cb3cea68 100644
--- a/src/osd/OSDMap.cc
+++ b/src/osd/OSDMap.cc
@@ -6197,7 +6197,7 @@ float OSDMap::build_pool_pgs_info (
     }
     total_pgs += pdata.get_size() * pdata.get_pg_num();
 
-    osds_weight_total = get_osds_weight(cct, tmp_osd_map, pid, osds_weight);
+    osds_weight_total += get_osds_weight(cct, tmp_osd_map, pid, osds_weight);
   }
   for (auto& [oid, oweight] : osds_weight) {
     int pgs = 0;

From 78e74e8d71513e06f19d9ec8a667f3cd5bebd07f Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Mon, 22 Jun 2026 20:47:39 +0800
Subject: [PATCH 405/596] crimson/os/seastore/lba: non-existing LBACursors are
 strictly forbidden to refresh

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/os/seastore/lba/lba_btree_node.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/crimson/os/seastore/lba/lba_btree_node.cc b/src/crimson/os/seastore/lba/lba_btree_node.cc
index 5f64cba2217..bc6c5f38e3d 100644
--- a/src/crimson/os/seastore/lba/lba_btree_node.cc
+++ b/src/crimson/os/seastore/lba/lba_btree_node.cc
@@ -135,6 +135,7 @@ base_iertr::future<> LBACursor::refresh()
 
   modifications = leaf->modifications;
   iter = leaf->lower_bound(get_laddr());
+  assert(iter == leaf->end() || iter.get_key() == get_laddr());
   assert(is_viewable());
 }
 

From d22252b6b5a1948543bf69f6ce6a34b7a4f70104 Mon Sep 17 00:00:00 2001
From: Mark Kogan <mkogan@redhat.com>
Date: Tue, 30 Apr 2024 17:22:29 +0300
Subject: [PATCH 406/596] rgw: reduce default thread pool size

Fixes: https://tracker.ceph.com/issues/65656

Signed-off-by: Mark Kogan <mkogan@redhat.com>
---
 PendingReleaseNotes            | 4 ++++
 src/common/options/rgw.yaml.in | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 348fa282cc6..b3dc29c681b 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -59,6 +59,10 @@
 * RGW: Fixed bucket notification events so the 'x_amz_request_id' in NotificationEvent now matches the 'x_amz_request_id' returned by the corresponding S3 operation.
 * RGW: The rgw_gc_max_deferred and rgw_gc_max_deferred_entries_size options have been removed, as they did not do anything.
   - Updated the default for rgw_gc_max_queue_size to account for the extra space from removing rgw_gc_max_deferred_entries_size.
+* RGW: The default value of ``rgw_thread_pool_size`` has been reduced from 512 to 128.
+  Benchmarks showed that the lower thread count improves throughput and reduces latency
+  on NVMe and HDD based environments. Users with specific workload requirements can
+  tune this value; see also ``rgw_max_concurrent_requests``.
 
 
 * DASHBOARD: A new Overview landing page provides an at-a-glance cluster summary
diff --git a/src/common/options/rgw.yaml.in b/src/common/options/rgw.yaml.in
index 5f321fcaff6..b9f78b95ddc 100644
--- a/src/common/options/rgw.yaml.in
+++ b/src/common/options/rgw.yaml.in
@@ -1282,9 +1282,11 @@ options:
     is, RGW will be able to deal with more concurrent requests at the cost of more
     resource utilization.
   fmt_desc: The size of the thread pool.
-  default: 512
+  default: 128
   services:
   - rgw
+  see_also:
+  - rgw_max_concurrent_requests
   with_legacy: true
 - name: rgw_num_control_oids
   type: int
@@ -3884,6 +3886,7 @@ options:
   - rgw
   see_also:
   - rgw_frontends
+  - rgw_thread_pool_size
 - name: rgw_scheduler_type
   type: str
   level: advanced

From d3df37a61ba6bccdd1b88effb060680bea5d1a40 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 24 Jun 2026 18:10:41 +0800
Subject: [PATCH 407/596] crimson/osd: mark ThrottleReleaser [[nodiscard]]

OperationThrottler::get_throttle() returns a ThrottleReleaser guard whose
destructor calls release_throttle(), the mClock RequestCompletion that
decrements in_progress.  The guard has to be held for the whole operation: a
caller that discards it at acquisition releases the slot in the same step, so
the operation never counts against max_in_progress and the throttle does
nothing.

Mark the type [[nodiscard]] so the compiler flags a discarded co_await of
get_throttle().

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/osd/osd_operation.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/crimson/osd/osd_operation.h b/src/crimson/osd/osd_operation.h
index 000cf4057ef..e41cc1abf52 100644
--- a/src/crimson/osd/osd_operation.h
+++ b/src/crimson/osd/osd_operation.h
@@ -376,7 +376,11 @@ public:
     return !max_in_progress || in_progress < max_in_progress;
   }
 
-  class ThrottleReleaser {
+  // The returned guard's destructor is the mClock RequestCompletion
+  // (release_throttle), so it must be held for the throttled operation's whole
+  // lifetime.  Dropping it at acquisition frees the slot immediately and the
+  // operation never counts against max_in_progress.
+  class [[nodiscard("discarding the guard releases the throttle slot immediately")]] ThrottleReleaser {
     OperationThrottler *parent = nullptr;
   public:
     ThrottleReleaser(OperationThrottler *parent) : parent(parent) {}

From 5c6e98176dd26f241f40de47f56eb771cc139c84 Mon Sep 17 00:00:00 2001
From: Matthew N Heler <matthew.heler@hotmail.com>
Date: Fri, 19 Jun 2026 18:10:03 -0500
Subject: [PATCH 408/596] mgr: filter root logger fallback

Make the mgr root logger fallback follow debug_mgr and preserve the
original logger name, so third-party DEBUG logs are not emitted by
default or mislabeled as mgr logs.

Signed-off-by: Matthew N Heler <matthew.heler@hotmail.com>
---
 src/pybind/mgr/mgr_module.py | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/src/pybind/mgr/mgr_module.py b/src/pybind/mgr/mgr_module.py
index 192eefbf96e..d7af7a86724 100644
--- a/src/pybind/mgr/mgr_module.py
+++ b/src/pybind/mgr/mgr_module.py
@@ -704,9 +704,8 @@ class MgrRootHandler(CPlusPlusHandler):
             "[mgr %(levelname)-4s %(name)s] %(message)s"
         ))
 
-    def emit(self, record: logging.LogRecord) -> None:
-        record.name = "mgr"
-        super().emit(record)
+    def set_module(self, module_inst: 'MgrModuleLoggingMixin') -> None:
+        self._module = module_inst
 
 
 class ClusterLogHandler(logging.Handler):
@@ -744,6 +743,7 @@ class FileHandler(logging.FileHandler):
 
 class MgrModuleLoggingMixin(object):
     module_name: str
+    _root_log_handler: Optional[MgrRootHandler] = None
 
     def _configure_logging(self,
                            mgr_level: str,
@@ -766,9 +766,20 @@ class MgrModuleLoggingMixin(object):
         self.log_to_cluster = log_to_cluster
 
         root = logging.getLogger()
-        if not any(isinstance(h, MgrRootHandler) for h in root.handlers):
-            root.addHandler(MgrRootHandler(self))
-            root.setLevel(logging.NOTSET)
+        root_handler = None
+        for handler in root.handlers:
+            if isinstance(handler, MgrRootHandler):
+                root_handler = handler
+                break
+        if root_handler is None:
+            root_handler = MgrRootHandler(self)
+            root.addHandler(root_handler)
+        else:
+            root_handler.set_module(self)
+        self._root_log_handler = root_handler
+        # Module loggers rely on handler thresholds, so keep root permissive
+        # and apply the mgr fallback threshold on MgrRootHandler itself.
+        root.setLevel(logging.NOTSET)
 
         self._module_logger.addHandler(self._mgr_log_handler)
         if log_to_file:
@@ -796,6 +807,8 @@ class MgrModuleLoggingMixin(object):
                        module_level: str,
                        cluster_level: str) -> None:
         self._cluster_log_handler.setLevel(cluster_level.upper())
+        if self._root_log_handler is not None:
+            self._root_log_handler.setLevel(self._ceph_log_level_to_python(mgr_level))
 
         module_level = module_level.upper() if module_level else ''
         if not self._module_level:

From 1262deedb2d5c796eecf5ba3ae7f6204b0be09a6 Mon Sep 17 00:00:00 2001
From: Abhishek Desai <abhishek.desai1@ibm.com>
Date: Mon, 25 May 2026 00:19:39 +0530
Subject: [PATCH 409/596] mgr/dashboard : Carbonize configuration form fixes :
 https://tracker.ceph.com/issues/76778 Signed-off-by: Abhishek Desai
 <abhishek.desai1@ibm.com>

---
 .../controllers/cluster_configuration.py      |  12 +-
 .../cypress/e2e/cluster/configuration.po.ts   |  24 +-
 .../configuration-form.component.html         | 381 +++++++++++-------
 .../configuration-form.component.scss         |  12 -
 .../configuration-form.component.ts           |  10 +-
 5 files changed, 276 insertions(+), 163 deletions(-)

diff --git a/src/pybind/mgr/dashboard/controllers/cluster_configuration.py b/src/pybind/mgr/dashboard/controllers/cluster_configuration.py
index eeda4289eb8..6a9c278579b 100644
--- a/src/pybind/mgr/dashboard/controllers/cluster_configuration.py
+++ b/src/pybind/mgr/dashboard/controllers/cluster_configuration.py
@@ -54,7 +54,7 @@ class ClusterConfiguration(RESTController):
         module_options = cephadm_module_config.get('module_options', {})
 
         for option_name, opt in module_options.items():
-            current_value = mgr.get_module_option_ex(
+            mgr_value = mgr.get_module_option_ex(
                 'cephadm', option_name, opt.get('default_value'))
 
             option = dict(opt)
@@ -64,11 +64,19 @@ class ClusterConfiguration(RESTController):
             option['enum_values'] = option.pop('enum_allowed', [])
             option['services'] = ['mgr']
             option['can_update_at_runtime'] = True
-            option['value'] = [{'section': 'mgr', 'value': current_value}]
+            option['value'] = []
             option['source'] = 'mgr_module'
+            option['_mgr_value'] = mgr_value
 
             cephadm_options.append(option)
 
+        self._append_config_option_values(cephadm_options)
+
+        for option in cephadm_options:
+            mgr_value = option.pop('_mgr_value')
+            if not any(v['section'] == 'mgr' for v in option.get('value', [])):
+                option['value'].append({'section': 'mgr', 'value': mgr_value})
+
         return cephadm_options
 
     def _append_config_option_values(self, options):
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/configuration.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/configuration.po.ts
index 920d118be87..6c2b4496528 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/configuration.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/configuration.po.ts
@@ -5,6 +5,14 @@ export class ConfigurationPageHelper extends PageHelper {
     index: { url: '#/configuration', id: 'cd-configuration' }
   };
 
+  private waitForEditForm(name: string) {
+    cy.contains('h3', `Edit ${name}`).should('be.visible');
+  }
+
+  private getSectionInput(section: string) {
+    return cy.get(`input#${section}`);
+  }
+
   /**
    * Clears out all the values in a config to reset before and after testing
    * Does not work for configs with checkbox only, possible future PR
@@ -14,16 +22,16 @@ export class ConfigurationPageHelper extends PageHelper {
     const valList = ['global', 'mon', 'mgr', 'osd', 'mds', 'client']; // Editable values
     this.getFirstTableCell(name).click();
     cy.contains('button', 'Edit').click();
-    // Waits for the data to load
-    cy.contains('.card-header', `Edit ${name}`);
+    this.waitForEditForm(name);
 
     for (const i of valList) {
-      cy.get(`#${i}`).clear();
+      this.getSectionInput(i).clear({ force: true }).blur({ force: true });
     }
     // Clicks save button and checks that values are not present for the selected config
     cy.get('[data-testid=submitBtn]').click();
 
-    cy.wait(3 * 1000);
+    cy.url().should('include', '#/configuration');
+    cy.get(this.pages.index.id);
 
     this.clearFilter();
 
@@ -54,18 +62,18 @@ export class ConfigurationPageHelper extends PageHelper {
     this.getFirstTableCell(name).click();
     cy.contains('button', 'Edit').click();
 
-    // Waits for data to load
-    cy.contains('.card-header', `Edit ${name}`);
+    this.waitForEditForm(name);
 
     values.forEach((valtuple) => {
       // Finds desired value based off given list
-      cy.get(`#${valtuple[0]}`).type(valtuple[1]); // of values and inserts the given number for the value
+      this.getSectionInput(valtuple[0]).type(valtuple[1]);
     });
 
     // Clicks save button then waits until the desired config is visible, clicks it,
     // then checks that each desired value appears with the desired number
     cy.get('[data-testid=submitBtn]').click();
-    cy.wait(3 * 1000);
+    cy.url().should('include', '#/configuration');
+    cy.get(this.pages.index.id);
 
     // Enter config setting name into filter box
     this.searchTable(name, 100);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
index 13080dd7b2e..4c802c8fd07 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
@@ -1,164 +1,269 @@
-<div class="cd-col-form"
-     *cdFormLoading="loading">
-  <form name="configForm"
-        #formDir="ngForm"
-        [formGroup]="configForm"
-        novalidate>
-    <div class="card">
-      <div class="card-header">
-        <ng-container i18>Edit</ng-container> {{ configForm.getValue('name') }}
-      </div>
-
-      <div class="card-body">
-        <!-- Name -->
-        <div class="form-group row">
-          <label i18n
-                 class="cd-col-form-label">Name</label>
-          <div class="cd-col-form-input">
-            <input class="form-control"
-                   type="text"
-                   id="name"
-                   formControlName="name"
-                   readonly>
-          </div>
+<ng-container *cdFormLoading="loading">
+  <form
+    [formGroup]="configForm"
+    novalidate
+  >
+    <div
+      cdsGrid
+      [useCssGrid]="true"
+      [narrow]="true"
+      [fullWidth]="true"
+    >
+      <div
+        cdsCol
+        [columnNumbers]="{ sm: 4, md: 8 }"
+      >
+        <div
+          cdsRow
+          class="form-heading"
+        >
+          <h3 i18n>Edit {{ configForm.getValue('name') }}</h3>
         </div>
 
-        <!-- Description -->
-        <div class="form-group row"
-             *ngIf="configForm.getValue('desc')">
-          <label i18n
-                 class="cd-col-form-label">Description</label>
-          <div class="cd-col-form-input">
-            <textarea class="form-control resize-vertical"
-                      id="desc"
-                      formControlName="desc"
-                      readonly>
-            </textarea>
-          </div>
+        <!-- Name -->
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-text-label
+            labelInputID="name"
+            i18n
+          >
+            Name
+            <input
+              cdsText
+              type="text"
+              id="name"
+              formControlName="name"
+              readonly
+            />
+          </cds-text-label>
         </div>
 
         <!-- Long description -->
-        <div class="form-group row"
-             *ngIf="configForm.getValue('long_desc')">
-          <label i18n
-                 class="cd-col-form-label">Long description</label>
-          <div class="cd-col-form-input">
-            <textarea class="form-control resize-vertical"
-                      id="long_desc"
-                      formControlName="long_desc"
-                      readonly>
-            </textarea>
-          </div>
+        @if (response?.long_desc) {
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <label
+            class="cds--label"
+            i18n
+          >Description</label>
+          <p class="cds--type-body-01 mb-0">{{ response.long_desc }}</p>
         </div>
+        }
 
         <!-- Default -->
-        <div class="form-group row"
-             *ngIf="configForm.getValue('default') !== ''">
-          <label i18n
-                 class="cd-col-form-label">Default</label>
-          <div class="cd-col-form-input">
-            <input class="form-control"
-                   type="text"
-                   id="default"
-                   formControlName="default"
-                   readonly>
-          </div>
+        @if (configForm.getValue('default') !== '') {
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-text-label
+            labelInputID="default"
+            i18n
+          >
+            Default
+            <input
+              cdsText
+              type="text"
+              id="default"
+              formControlName="default"
+              readonly
+            />
+          </cds-text-label>
         </div>
+        }
 
         <!-- Daemon default -->
-        <div class="form-group row"
-             *ngIf="configForm.getValue('daemon_default') !== ''">
-          <label i18n
-                 class="cd-col-form-label">Daemon default</label>
-          <div class="cd-col-form-input">
-            <input class="form-control"
-                   type="text"
-                   id="daemon_default"
-                   formControlName="daemon_default"
-                   readonly>
-          </div>
+        @if (configForm.getValue('daemon_default') !== '') {
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-text-label
+            labelInputID="daemon_default"
+            i18n
+          >
+            Daemon default
+            <input
+              cdsText
+              type="text"
+              id="daemon_default"
+              formControlName="daemon_default"
+              readonly
+            />
+          </cds-text-label>
         </div>
+        }
 
         <!-- Services -->
-        <div class="form-group row"
-             *ngIf="configForm.getValue('services').length > 0">
-          <label i18n
-                 class="cd-col-form-label">Services</label>
-          <div class="cd-col-form-input">
-            <span *ngFor="let service of configForm.getValue('services')"
-                  class="form-component-badge">
-              <cds-tag [size]="'md'"
-                       class="tag-dark">
-                {{ service }}
-              </cds-tag>
-            </span>
+        @if (configForm.getValue('services')?.length > 0) {
+        <div
+          cdsRow
+          class="form-item form-item-append align-items-center"
+        >
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 2, md: 2, lg: 2 }"
+          >
+            <label
+              class="cds--label mb-0"
+              i18n
+            >Services</label>
+          </div>
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 6, md: 6, lg: 6 }"
+          >
+            @for (service of configForm.getValue('services'); track service) {
+            <cds-tag
+              [size]="'md'"
+              class="tag-dark me-2"
+            >
+              {{ service }}
+            </cds-tag>
+            }
           </div>
         </div>
+        }
 
         <!-- Values -->
         <div formGroupName="values">
-          <h3 i18n
-              class="cd-header">Values</h3>
-          <ng-container *ngFor="let section of availSections">
-            <div class="form-group row"
-                 *ngIf="type === 'bool'">
-              <label class="cd-col-form-label"
-                     [for]="section">{{ section }}
-              </label>
-              <div class="cd-col-form-input">
-                <select id="pool"
-                        name="pool"
-                        class="form-select"
-                        [formControlName]="section">
-                  <option [ngValue]="null"
-                          i18n>-- Default --</option>
-                  <option [ngValue]="true"
-                          i18n>true</option>
-                  <option [ngValue]="false"
-                          i18n>false</option>
-                </select>
-              </div>
-            </div>
+          <div
+            cdsRow
+            class="form-heading"
+          >
+            <h3 i18n>Values</h3>
+          </div>
 
-            <div class="form-group row"
-                 *ngIf="type !== 'bool'">
-              <label class="cd-col-form-label"
-                     [for]="section">{{ section }}
-              </label>
-              <div class="cd-col-form-input">
-                <input class="form-control"
-                       [type]="inputType"
-                       [id]="section"
-                       [placeholder]="humanReadableType"
-                       [formControlName]="section"
-                       [step]="getStep(type, configForm.getValue(section))">
-                <span class="invalid-feedback"
-                      *ngIf="configForm.showError(section, formDir, 'pattern')">
-                  {{ patternHelpText }}
-                </span>
-                <span class="invalid-feedback"
-                      *ngIf="configForm.showError(section, formDir, 'invalidUuid')">
-                  {{ patternHelpText }}
-                </span>
-                <span class="invalid-feedback"
-                      *ngIf="configForm.showError(section, formDir, 'max')"
-                      i18n>The entered value is too high! It must not be greater than {{ maxValue }}.</span>
-                <span class="invalid-feedback"
-                      *ngIf="configForm.showError(section, formDir, 'min')"
-                      i18n>The entered value is too low! It must not be lower than {{ minValue }}.</span>
-              </div>
+          @for (section of availSections; track section) {
+            @if (type === 'bool') {
+            <div
+              cdsRow
+              class="form-item"
+            >
+              <cds-select
+                [formControlName]="section"
+                [label]="section"
+                [id]="section"
+                [labelInputID]="section"
+                cdValidate
+                #sectionValidate="cdValidate"
+                [invalid]="sectionValidate.isInvalid"
+                [invalidText]="sectionErrors"
+              >
+                <option
+                  [ngValue]="null"
+                  i18n
+                >-- Default --</option>
+                <option
+                  [ngValue]="true"
+                  i18n
+                >true</option>
+                <option
+                  [ngValue]="false"
+                  i18n
+                >false</option>
+              </cds-select>
+              <ng-template #sectionErrors>
+                <ng-container
+                  *ngTemplateOutlet="validationErrors; context: { control: configForm.get(section) }"
+                ></ng-container>
+              </ng-template>
             </div>
-          </ng-container>
+            }
+
+            @if (type !== 'bool' && inputType === 'number') {
+            <div
+              cdsRow
+              class="form-item"
+            >
+              <cds-number
+                [formControlName]="section"
+                [label]="section"
+                [id]="section"
+                [step]="getStep(type, configForm.getValue(section))"
+                [min]="minValue"
+                [max]="maxValue"
+                cdValidate
+                #sectionValidate="cdValidate"
+                [invalid]="sectionValidate.isInvalid"
+                [invalidText]="sectionErrors"
+              >
+              </cds-number>
+              <ng-template #sectionErrors>
+                <ng-container
+                  *ngTemplateOutlet="validationErrors; context: { control: configForm.get(section) }"
+                ></ng-container>
+              </ng-template>
+            </div>
+            }
+
+            @if (type !== 'bool' && inputType !== 'number') {
+            <div
+              cdsRow
+              class="form-item"
+            >
+              <cds-text-label
+                [labelInputID]="section"
+                [invalid]="sectionValidate.isInvalid"
+                [invalidText]="sectionErrors"
+              >
+                {{ section }}
+                <input
+                  cdsText
+                  cdValidate
+                  #sectionValidate="cdValidate"
+                  [type]="inputType"
+                  [id]="section"
+                  [formControlName]="section"
+                  [invalid]="sectionValidate.isInvalid"
+                />
+              </cds-text-label>
+              <ng-template #sectionErrors>
+                <ng-container
+                  *ngTemplateOutlet="validationErrors; context: { control: configForm.get(section) }"
+                ></ng-container>
+              </ng-template>
+            </div>
+            }
+          }
+        </div>
+
+        <div cdsRow>
+          <cd-form-button-panel
+            (submitActionEvent)="forceUpdate ? openCriticalConfirmModal() : submit()"
+            [form]="configForm"
+            [submitText]="actionLabels.UPDATE"
+            wrappingClass="text-right form-button"
+          ></cd-form-button-panel>
         </div>
-      </div>
-      <!-- Footer -->
-      <div class="card-footer">
-        <cd-form-button-panel (submitActionEvent)="forceUpdate ? openCriticalConfirmModal() : submit()"
-                              [form]="configForm"
-                              [submitText]="actionLabels.UPDATE"
-                              wrappingClass="text-right"></cd-form-button-panel>
       </div>
     </div>
   </form>
-</div>
+</ng-container>
 
+<ng-template
+  #validationErrors
+  let-control="control"
+>
+  @if (control?.invalid && (control.dirty || control.touched)) {
+    @if (control.hasError('min')) {
+    <span
+      class="invalid-feedback"
+      i18n
+    >The entered value is too low! It must not be lower than {{ minValue }}.</span>
+    }
+    @if (control.hasError('max')) {
+    <span
+      class="invalid-feedback"
+      i18n
+    >The entered value is too high! It must not be greater than {{ maxValue }}.</span>
+    }
+    @if (control.hasError('pattern') || control.hasError('invalidUuid')) {
+    <span class="invalid-feedback">{{ patternHelpText }}</span>
+    }
+  }
+</ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.scss
index ed2945d1d56..e69de29bb2d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.scss
@@ -1,12 +0,0 @@
-.form-component-badge {
-  display: block;
-  height: 34px;
-
-  span {
-    margin-top: 7px;
-  }
-}
-
-.resize-vertical {
-  resize: vertical;
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.ts
index f4a0557795a..c98f93dc93b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.ts
@@ -141,8 +141,12 @@ export class ConfigurationFormComponent extends CdForm implements OnInit {
 
     this.availSections.forEach((section) => {
       const sectionValue = this.configForm.getValue(section);
-      if (sectionValue !== null) {
+      const hadValue = this.response?.value?.some((v) => v.section === section);
+
+      if (sectionValue !== null && sectionValue !== undefined && sectionValue !== '') {
         values.push({ section: section, value: sectionValue });
+      } else if (hadValue) {
+        values.push({ section: section, value: '' });
       }
     });
 
@@ -188,8 +192,8 @@ export class ConfigurationFormComponent extends CdForm implements OnInit {
           this.configForm.setErrors({ cdSubmitButton: true });
         }
       );
+    } else {
+      this.router.navigate(['/configuration']);
     }
-
-    this.router.navigate(['/configuration']);
   }
 }

From d843b01385ece3362238cf9017ce417a1081f3dd Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 14 Jun 2026 20:43:50 +0800
Subject: [PATCH 410/596] test/encoding: run readable.sh with a sliding window
 of jobs

The old scheduler spawned nproc jobs, then waited for the whole batch to
finish before starting the next, so cores that finished early sat idle
waiting on the slowest type in the batch. Keep a sliding window instead:
once the window is full, reap a single finished job before spawning the
next, which keeps the cores busy when per-type runtimes vary widely.

While here, pass vdir/arversion into test_object explicitly instead of
reading the loop globals, and give each job its own result file instead
of reusing slot-numbered files that the sliding window would otherwise
hand out to overlapping jobs.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/encoding/readable.sh | 93 +++++++++++++----------------------
 1 file changed, 35 insertions(+), 58 deletions(-)

diff --git a/src/test/encoding/readable.sh b/src/test/encoding/readable.sh
index 115d6d7b6f1..1a6fc3e6496 100755
--- a/src/test/encoding/readable.sh
+++ b/src/test/encoding/readable.sh
@@ -14,7 +14,6 @@ fi
 
 failed=0
 numtests=0
-pids=""
 
 if [ -x ./ceph-dencoder ]; then
   CEPH_DENCODER=./ceph-dencoder
@@ -36,7 +35,6 @@ if [ -z "$myversion" ]; then
   exit 1
 fi
 DEBUG=0
-WAITALL_DELAY=.1
 debug() { if [ "$DEBUG" -gt 0 ]; then echo "DEBUG: $*" >&2; fi }
 
 version_le() {
@@ -67,7 +65,9 @@ versions_span() {
 
 test_object() {
     local type=$1
-    local output_file=$2
+    local vdir=$2
+    local arversion=$3
+    local output_file=$4
     local failed=0
     local numtests=0
 
@@ -134,6 +134,8 @@ test_object() {
             else
               echo "skipping forward incompat $type version $arversion, decoder >= $forward_version incompatible with objects < $forward_version (current decoder is $myversion)"
             fi
+            echo "failed=$failed" > $output_file
+            echo "numtests=$numtests" >> $output_file
             rm -f $tmp1 $tmp2
             return
           fi
@@ -146,6 +148,8 @@ test_object() {
         # Use sort -V for proper version comparison (handles 19.5 vs 19.10 correctly)
         if version_lt "$myversion" "$backward_incompat"; then
           echo "skipping backward incompat $type version $arversion, requires decoder >= $backward_incompat, current decoder is $myversion"
+          echo "failed=$failed" > $output_file
+          echo "numtests=$numtests" >> $output_file
           rm -f $tmp1 $tmp2
           return
         fi
@@ -240,52 +244,10 @@ test_object() {
     echo "numtests=$numtests" >> $output_file
 }
 
-waitall() { # PID...
-   ## Wait for children to exit and indicate whether all exited with 0 status.
-   local errors=0
-   while :; do
-     debug "Processes remaining: $*"
-     for pid in "$@"; do
-       shift
-       if kill -0 "$pid" 2>/dev/null; then
-         debug "$pid is still alive."
-         set -- "$@" "$pid"
-       elif wait "$pid"; then
-         debug "$pid exited with zero exit status."
-       else
-         debug "$pid exited with non-zero exit status."
-         errors=$(($errors + 1))
-       fi
-     done
-     [ $# -eq 0 ] && break
-     sleep ${WAITALL_DELAY:-1}
-    done
-   [ $errors -eq 0 ]
-}
-
 ######
 # MAIN
 ######
 
-do_join() {
-        waitall $pids
-        pids=""
-        # Reading the output of jobs to compute failed & numtests
-        # Tests are run in parallel but sum should be done sequentialy to avoid
-        # races between threads
-        while [ "$running_jobs" -ge 0 ]; do
-            if [ -f $output_file.$running_jobs ]; then
-                read_failed=$(grep "^failed=" $output_file.$running_jobs | cut -d "=" -f 2)
-                read_numtests=$(grep "^numtests=" $output_file.$running_jobs | cut -d "=" -f 2)
-                rm -f $output_file.$running_jobs
-                failed=$(($failed + $read_failed))
-                numtests=$(($numtests + $read_numtests))
-            fi
-            running_jobs=$(($running_jobs - 1))
-        done
-        running_jobs=0
-}
-
 # Determine the number of parallel jobs to run.  Default to the number of
 # logical processors, or $MAX_PARALLEL_JOBS if set.
 if [ $(uname) == FreeBSD -o $(uname) == Darwin ]; then
@@ -295,33 +257,48 @@ else
 fi
 max_parallel_jobs=${MAX_PARALLEL_JOBS:-${NPROC}}
 
-output_file=$(mktemp /tmp/output_file-XXXXXXXXX)
+# Sliding window of up to $max_parallel_jobs jobs, each writing its tally to its
+# own $resultdir file; when full, reap one finished job before spawning the next.
+resultdir=$(mktemp -d /tmp/readable-results-XXXXXXXXX)
+trap 'rm -rf "$resultdir"' EXIT
 running_jobs=0
+jobid=0
 
 for arversion in $(ls $dir/archive | sort -V); do
   vdir="$dir/archive/$arversion"
-  #echo $vdir
 
   if [ ! -d "$vdir/objects" ]; then
     continue;
   fi
 
   for type in $(ls $vdir/objects); do
-    test_object $type $output_file.$running_jobs &
-    pids="$pids $!"
-    running_jobs=$(($running_jobs + 1))
-
-    # Once we spawned enough jobs, let's wait them to complete
-    # Every spawned job have almost the same execution time so
-    # it's not a big deal having them not ending at the same time
-    if [ "$running_jobs" -eq "$max_parallel_jobs" ]; then
-	do_join
+    if [ "$running_jobs" -ge "$max_parallel_jobs" ]; then
+      wait -n || true
+      running_jobs=$(($running_jobs - 1))
     fi
-    rm -f ${output_file}*
+    test_object "$type" "$vdir" "$arversion" "$resultdir/$jobid" &
+    running_jobs=$(($running_jobs + 1))
+    jobid=$(($jobid + 1))
   done
 done
 
-do_join
+# wait for the remaining in-flight jobs
+wait
+
+# Sum results sequentially. A missing result file means the job died before
+# recording its tally, so count it as a failure rather than skipping it.
+for ((i = 0; i < jobid; i++)); do
+  f="$resultdir/$i"
+  if [ ! -f "$f" ]; then
+    echo "**** result file for job $i is missing; the job likely died before recording its result ****"
+    failed=$(($failed + 1))
+    continue
+  fi
+  read_failed=$(grep "^failed=" "$f" | cut -d "=" -f 2)
+  read_numtests=$(grep "^numtests=" "$f" | cut -d "=" -f 2)
+  failed=$(($failed + $read_failed))
+  numtests=$(($numtests + $read_numtests))
+done
 
 if [ $failed -gt 0 ]; then
   echo "FAILED $failed / $numtests tests."

From 0077cb990dd6ea11fbed86be6e7449d8f035e2d0 Mon Sep 17 00:00:00 2001
From: Avan Thakkar <athakkar@redhat.com>
Date: Wed, 24 Jun 2026 16:45:51 +0530
Subject: [PATCH 411/596] mgr: fix MgrModuleRecoverDB to honor its retry budget
 on db cleanup failure

Both close_db() and open_db() during retry were unguarded, so a failure
in either escaped the decorator immediately instead of retrying up to
MAX_DBCLEANUP_RETRIES.

Wrapped both in the same try/except, and logged the
failed attempt.

Fixes: https://tracker.ceph.com/issues/77635
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/mgr_module.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/mgr_module.py b/src/pybind/mgr/mgr_module.py
index 192eefbf96e..3ba6cb3277c 100644
--- a/src/pybind/mgr/mgr_module.py
+++ b/src/pybind/mgr/mgr_module.py
@@ -619,8 +619,13 @@ def MgrModuleRecoverDB(func: Callable) -> Callable:
                 if retries > MAX_DBCLEANUP_RETRIES:
                     raise
                 self.log.debug("attempting reopen of database")
-                self.close_db()
-                self.open_db()
+                try:
+                    self.close_db()
+                    self.open_db()
+                except sqlite3.DatabaseError as e2:
+                    self.log.warning(
+                        f"reopen attempt {retries}/{MAX_DBCLEANUP_RETRIES} failed: {e2}"
+                    )
                 # allow retry of func(...)
     check.__signature__ = inspect.signature(func)  # type: ignore[attr-defined]
     return check

From e9bf02b72b047d2c8c9ec7ff611fdec96b7cc995 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Thu, 11 Jun 2026 12:32:34 +0000
Subject: [PATCH 412/596] crimson/osd: return ENOENT from EC getxattr for
 non-existent objects

PGBackend::getxattr() for EC pools reads from the attr_cache and
returns ENODATA when an attr is not found, without distinguishing
between "object exists but attr not set" and "object doesn't exist".
This causes cls methods like cls_refcount_get() to proceed as if the
object exists, enter the EC RMW pipeline, and hang.

Add an os.exists check in the EC path so non-existent objects return
ENOENT, matching the behavior of the replicated path which goes to
the object store and gets ENOENT directly.

Fixes: https://tracker.ceph.com/issues/77335
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 src/crimson/osd/pg_backend.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/crimson/osd/pg_backend.cc b/src/crimson/osd/pg_backend.cc
index 6a2e57d0992..0c31e28f333 100644
--- a/src/crimson/osd/pg_backend.cc
+++ b/src/crimson/osd/pg_backend.cc
@@ -1170,6 +1170,10 @@ PGBackend::get_attr_ierrorator::future<> PGBackend::getxattr(
     logger().debug("getxattr on obj={} for attr={}", os.oi.soid, name);
     return crimson::ct_error::enodata::make();
   };
+  if (is_erasure() && !os.exists) {
+    logger().debug("getxattr: object {} does not exist (erasure)", os.oi.soid);
+    return crimson::ct_error::enoent::make();
+  }
   return get_attr_maybe_from_cache().safe_then_interruptible(
     [&delta_stats, &osd_op] (ceph::bufferlist&& val) {
     osd_op.outdata = std::move(val);

From 06eeede4cbf935d3bfabdb45d98b11b2f1ac87ec Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Thu, 18 Jun 2026 17:34:37 +0000
Subject: [PATCH 413/596] cls/rgw: clarify RGWObjCategory::Shadow comment

The Shadow enum value (2) is never assigned anywhere in the codebase.
Update the comment to clearly state it is unused and reserved for
backward compatibility, since the value is serialized as a raw uint8_t
in bucket index entries and may exist in on-disk data.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/cls/rgw/cls_rgw_types.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/cls/rgw/cls_rgw_types.h b/src/cls/rgw/cls_rgw_types.h
index caea0407061..2e0fe2fed59 100644
--- a/src/cls/rgw/cls_rgw_types.h
+++ b/src/cls/rgw/cls_rgw_types.h
@@ -189,8 +189,7 @@ enum class RGWObjCategory : uint8_t {
 
   Main      = 1,  // b-i entries for standard objs
 
-  Shadow    = 2,  // presumably intended for multipart shadow
-                  // uploads; not currently used in the codebase
+  Shadow    = 2,  // unused, reserved for backward compatibility
 
   MultiMeta = 3,  // b-i entries for multipart upload metadata objs
 

From 93e763cee9b1f0a6089b44d35a56092ef7f9b040 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Thu, 18 Jun 2026 17:55:45 +0000
Subject: [PATCH 414/596] rgw: add RGWObjCategory::MultiPart for multipart
 upload part heads

Multipart upload part head objects are bucket-indexed with
RGWObjCategory::Main, making them indistinguishable from completed
objects in bucket stats. This is causing radosgw-admin bucket stats and
the RGW-extension X-RGW-Object-Count header on HEAD Bucket
(?read-stats=true) to report inflated object counts when in-progress
or abandoned multipart uploads exists.

So, this commit adds a new Object Category: RGWObjCategory::MultiPart
(value 5) and assigns it in MultipartObjectProcessor::complete() so
part heads are now tracked under a separate "rgw.multipart" category.

The X-RGW-Object-Count header, which reads only RGWObjCategory::Main,
now excludes in-progress parts. This is more correct as AWS S3 HEAD Bucket
does not expose any object count for incomplete uploads (the header itself
seems to be an RGW extension, not part of the S3 specification).

Quota enforcement, stats aggregation, and part cleanup are all
category-agnostic so should require no changes.

Also, updated the test_cls_rgw_stats simulator to use
the new category for multipart part entries.

Fixes: https://tracker.ceph.com/issues/77509
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/cls/rgw/cls_rgw_types.cc                 | 1 +
 src/cls/rgw/cls_rgw_types.h                  | 2 ++
 src/rgw/driver/rados/rgw_putobj_processor.cc | 1 +
 src/test/cls_rgw/test_cls_rgw_stats.cc       | 2 +-
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/cls/rgw/cls_rgw_types.cc b/src/cls/rgw/cls_rgw_types.cc
index 7f8835bd938..5ef9633a84e 100644
--- a/src/cls/rgw/cls_rgw_types.cc
+++ b/src/cls/rgw/cls_rgw_types.cc
@@ -140,6 +140,7 @@ std::string_view to_string(RGWObjCategory c)
     case RGWObjCategory::Shadow: return "rgw.shadow";
     case RGWObjCategory::MultiMeta: return "rgw.multimeta";
     case RGWObjCategory::CloudTiered: return "rgw.cloudtiered";
+    case RGWObjCategory::MultiPart: return "rgw.multipart";
     default: return "unknown";
   }
 }
diff --git a/src/cls/rgw/cls_rgw_types.h b/src/cls/rgw/cls_rgw_types.h
index 2e0fe2fed59..bbab3306cb1 100644
--- a/src/cls/rgw/cls_rgw_types.h
+++ b/src/cls/rgw/cls_rgw_types.h
@@ -194,6 +194,8 @@ enum class RGWObjCategory : uint8_t {
   MultiMeta = 3,  // b-i entries for multipart upload metadata objs
 
   CloudTiered = 4, // b-i entries which are tiered to external cloud
+
+  MultiPart = 5,   // b-i entries for multipart upload part head objs
 };
 
 std::string_view to_string(RGWObjCategory c);
diff --git a/src/rgw/driver/rados/rgw_putobj_processor.cc b/src/rgw/driver/rados/rgw_putobj_processor.cc
index 3292e1c4e97..9eee7a5faf3 100644
--- a/src/rgw/driver/rados/rgw_putobj_processor.cc
+++ b/src/rgw/driver/rados/rgw_putobj_processor.cc
@@ -557,6 +557,7 @@ int MultipartObjectProcessor::complete(
   obj_op.meta.mtime = mtime;
   obj_op.meta.owner = owner;
   obj_op.meta.bucket_owner = bucket_info.owner;
+  obj_op.meta.category = RGWObjCategory::MultiPart;
   obj_op.meta.delete_at = delete_at;
   obj_op.meta.zones_trace = zones_trace;
   obj_op.meta.modify_tail = true;
diff --git a/src/test/cls_rgw/test_cls_rgw_stats.cc b/src/test/cls_rgw/test_cls_rgw_stats.cc
index 1c12367ec03..26ba529259e 100644
--- a/src/test/cls_rgw/test_cls_rgw_stats.cc
+++ b/src/test/cls_rgw/test_cls_rgw_stats.cc
@@ -552,7 +552,7 @@ void simulator::complete_multipart(const operation& op)
           << " size=" << part_size << dendl;
     } else {
       rgw_bucket_dir_entry_meta meta;
-      meta.category = op.meta.category;
+      meta.category = RGWObjCategory::MultiPart;
       meta.size = meta.accounted_size = part_size;
 
       int r = index_complete(ioctx, oid, part_key, op.tag, op.type,

From 29099f910cd09915b9e887d9560a9961e8b3cd3d Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Thu, 18 Jun 2026 18:18:44 +0000
Subject: [PATCH 415/596] qa/rgw: add integration test for multipart part
 category in bucket stats

Test that multipart upload part heads are tracked under the
rgw.multipart category in radosgw-admin bucket stats, separate from
completed objects (rgw.main).

- Incomplete upload: rgw.main=0, rgw.multipart=X, rgw.multimeta=1
- CompleteMultipart: parts cleaned up, assembled object in rgw.main
- AbortMultipart: parts cleaned up, rgw.multipart returns to 0
- ListObjects returns 0 during incomplete upload

Also add quota enforcement testcase for multipart part category

- Verify that multipart upload parts tracked under RGWObjCategory::MultiPart
  still count against both bucket and user quotas.

Tests: https://tracker.ceph.com/issues/77509
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 .../rgw/test_rgw_multipart_category.py        | 224 ++++++++++++++++++
 1 file changed, 224 insertions(+)
 create mode 100644 qa/workunits/rgw/test_rgw_multipart_category.py

diff --git a/qa/workunits/rgw/test_rgw_multipart_category.py b/qa/workunits/rgw/test_rgw_multipart_category.py
new file mode 100644
index 00000000000..dd0c3d7828f
--- /dev/null
+++ b/qa/workunits/rgw/test_rgw_multipart_category.py
@@ -0,0 +1,224 @@
+#!/usr/bin/env python3
+
+import logging as log
+import json
+from common import exec_cmd, create_user, boto_connect
+from botocore.config import Config
+from botocore.exceptions import ClientError
+
+"""
+Tests that multipart upload part heads are tracked under the
+rgw.multipart category in bucket stats, separate from completed
+objects (rgw.main), and that quota enforcement still counts them.
+"""
+
+USER = 'mpart-cat-tester'
+DISPLAY_NAME = 'Multipart Category Testing'
+ACCESS_KEY = 'MPARTCAT1TESTKEY00001'
+SECRET_KEY = 'mpartcat1testsecretkey000000001'
+
+PART_SIZE = 5 * 1024 * 1024  # 5 MiB (S3 minimum part size)
+
+
+def get_bucket_stats(bucket_name):
+    out = exec_cmd(f'radosgw-admin bucket stats --bucket {bucket_name}')
+    return json.loads(out)
+
+
+def get_category(stats, category):
+    return stats['usage'].get(category, {})
+
+
+def assert_category(stats, category, num_objects, label=''):
+    cat = get_category(stats, category)
+    actual = cat.get('num_objects', 0)
+    assert actual == num_objects, \
+        f'{label}: expected {category}.num_objects={num_objects}, got {actual}'
+
+
+def cleanup_bucket(connection, bucket_name):
+    try:
+        s3client = connection.meta.client
+        response = s3client.list_multipart_uploads(Bucket=bucket_name)
+        for upload in response.get('Uploads', []):
+            s3client.abort_multipart_upload(
+                Bucket=bucket_name, Key=upload['Key'],
+                UploadId=upload['UploadId'])
+        connection.Bucket(bucket_name).objects.all().delete()
+        connection.Bucket(bucket_name).delete()
+    except Exception:
+        pass
+
+
+def test_category_tracking(connection):
+    """Verify multipart parts appear under rgw.multipart, not rgw.main."""
+    bucket_name = 'mpart-cat-bucket'
+    cleanup_bucket(connection, bucket_name)
+    connection.create_bucket(Bucket=bucket_name)
+    s3client = connection.meta.client
+
+    # TESTCASE 'empty bucket has no stats'
+    log.debug('TEST: empty bucket has no stats\n')
+    stats = get_bucket_stats(bucket_name)
+    assert_category(stats, 'rgw.main', 0, 'empty bucket')
+
+    # TESTCASE 'incomplete multipart parts appear under rgw.multipart'
+    log.debug('TEST: incomplete multipart parts appear under rgw.multipart\n')
+    part_body = b'x' * PART_SIZE
+
+    response = s3client.create_multipart_upload(Bucket=bucket_name, Key='incomplete-obj')
+    upload_id = response['UploadId']
+
+    for part_num in (1, 2):
+        s3client.upload_part(
+            Bucket=bucket_name, Key='incomplete-obj',
+            UploadId=upload_id, PartNumber=part_num, Body=part_body)
+
+    stats = get_bucket_stats(bucket_name)
+    assert_category(stats, 'rgw.main', 0, 'after upload parts')
+    assert_category(stats, 'rgw.multipart', 2, 'after upload parts')
+    assert_category(stats, 'rgw.multimeta', 1, 'after upload parts')
+
+    response = s3client.list_objects_v2(Bucket=bucket_name)
+    assert response['KeyCount'] == 0, f'expected 0 listed objects, got {response["KeyCount"]}'
+
+    # TESTCASE 'complete multipart moves parts to rgw.main'
+    log.debug('TEST: complete multipart moves parts to rgw.main\n')
+    parts_list = s3client.list_parts(
+        Bucket=bucket_name, Key='incomplete-obj', UploadId=upload_id)
+    parts = [{'ETag': p['ETag'], 'PartNumber': p['PartNumber']}
+             for p in parts_list['Parts']]
+
+    s3client.complete_multipart_upload(
+        Bucket=bucket_name, Key='incomplete-obj',
+        UploadId=upload_id,
+        MultipartUpload={'Parts': parts})
+
+    stats = get_bucket_stats(bucket_name)
+    assert_category(stats, 'rgw.main', 1, 'after complete')
+    assert_category(stats, 'rgw.multipart', 0, 'after complete')
+    assert_category(stats, 'rgw.multimeta', 0, 'after complete')
+
+    # TESTCASE 'abort multipart cleans up rgw.multipart entries'
+    log.debug('TEST: abort multipart cleans up rgw.multipart entries\n')
+    response = s3client.create_multipart_upload(
+        Bucket=bucket_name, Key='aborted-obj')
+    upload_id2 = response['UploadId']
+
+    s3client.upload_part(
+        Bucket=bucket_name, Key='aborted-obj',
+        UploadId=upload_id2, PartNumber=1, Body=part_body)
+
+    stats = get_bucket_stats(bucket_name)
+    assert_category(stats, 'rgw.main', 1, 'before abort')
+    assert_category(stats, 'rgw.multipart', 1, 'before abort')
+    assert_category(stats, 'rgw.multimeta', 1, 'before abort')
+
+    s3client.abort_multipart_upload(Bucket=bucket_name, Key='aborted-obj', UploadId=upload_id2)
+
+    stats = get_bucket_stats(bucket_name)
+    assert_category(stats, 'rgw.main', 1, 'after abort')
+    assert_category(stats, 'rgw.multipart', 0, 'after abort')
+    assert_category(stats, 'rgw.multimeta', 0, 'after abort')
+
+    cleanup_bucket(connection, bucket_name)
+    log.debug('test_category_tracking PASSED\n')
+
+
+def test_quota_enforcement(connection):
+    """Verify multipart parts count against bucket and user quotas."""
+    bucket1 = 'mpart-quota-1'
+    bucket2 = 'mpart-quota-2'
+    s3client = connection.meta.client
+    part_body = b'x' * PART_SIZE
+
+    cleanup_bucket(connection, bucket1)
+    cleanup_bucket(connection, bucket2)
+
+    # bucket quota: 15 MB (3 x 5MB parts), user quota: 25 MB (5 x 5MB parts)
+    exec_cmd(f'radosgw-admin quota set --quota-scope=bucket --uid={USER} --max-size=15728640')
+    exec_cmd(f'radosgw-admin quota set --quota-scope=user --uid={USER} --max-size=26214400')
+    exec_cmd(f'radosgw-admin quota enable --quota-scope=bucket --uid={USER}')
+    exec_cmd(f'radosgw-admin quota enable --quota-scope=user --uid={USER}')
+
+    try:
+        connection.create_bucket(Bucket=bucket1)
+        connection.create_bucket(Bucket=bucket2)
+
+        # TESTCASE 'bucket quota: 4th part exceeds 15 MB bucket limit'
+        log.debug('TEST: bucket quota rejects part that exceeds limit\n')
+        mpu1 = s3client.create_multipart_upload(Bucket=bucket1, Key='obj1')
+        uid1 = mpu1['UploadId']
+
+        for i in range(1, 4):
+            s3client.upload_part(Bucket=bucket1, Key='obj1', UploadId=uid1,
+                                 PartNumber=i, Body=part_body)
+
+        try:
+            s3client.upload_part(Bucket=bucket1, Key='obj1', UploadId=uid1,
+                                 PartNumber=4, Body=part_body)
+            assert False, 'part 4 should have been rejected by bucket quota'
+        except ClientError as e:
+            assert e.response['Error']['Code'] == 'QuotaExceeded', \
+                f'expected QuotaExceeded, got {e.response["Error"]["Code"]}'
+
+        response = s3client.list_objects_v2(Bucket=bucket1)
+        assert response['KeyCount'] == 0, 'bucket1 should have no completed objects'
+
+        stats = get_bucket_stats(bucket1)
+        assert_category(stats, 'rgw.main', 0, 'bucket1 quota')
+        assert_category(stats, 'rgw.multipart', 3, 'bucket1 quota')
+
+        # TESTCASE 'user quota: 3rd part in bucket2 exceeds 25 MB user limit'
+        log.debug('TEST: user quota rejects part that exceeds limit\n')
+        mpu2 = s3client.create_multipart_upload(Bucket=bucket2, Key='obj2')
+        uid2 = mpu2['UploadId']
+
+        # 15 MB already used in bucket1; user quota is 25 MB
+        for i in range(1, 3):
+            s3client.upload_part(Bucket=bucket2, Key='obj2', UploadId=uid2,
+                                 PartNumber=i, Body=part_body)
+
+        try:
+            s3client.upload_part(Bucket=bucket2, Key='obj2', UploadId=uid2,
+                                 PartNumber=3, Body=part_body)
+            assert False, 'part 3 should have been rejected by user quota'
+        except ClientError as e:
+            assert e.response['Error']['Code'] == 'QuotaExceeded', \
+                f'expected QuotaExceeded, got {e.response["Error"]["Code"]}'
+
+        response = s3client.list_objects_v2(Bucket=bucket2)
+        assert response['KeyCount'] == 0, 'bucket2 should have no completed objects'
+
+        stats = get_bucket_stats(bucket2)
+        assert_category(stats, 'rgw.main', 0, 'bucket2 quota')
+        assert_category(stats, 'rgw.multipart', 2, 'bucket2 quota')
+
+    finally:
+        cleanup_bucket(connection, bucket1)
+        cleanup_bucket(connection, bucket2)
+        exec_cmd(f'radosgw-admin quota disable --quota-scope=bucket --uid={USER}')
+        exec_cmd(f'radosgw-admin quota disable --quota-scope=user --uid={USER}')
+
+    log.debug('test_quota_enforcement PASSED\n')
+
+
+def main():
+    create_user(USER, DISPLAY_NAME, ACCESS_KEY, SECRET_KEY)
+
+    # ensure quotas are disabled before category tracking tests
+    exec_cmd(f'radosgw-admin quota disable --quota-scope=bucket --uid={USER}')
+    exec_cmd(f'radosgw-admin quota disable --quota-scope=user --uid={USER}')
+
+    connection = boto_connect(ACCESS_KEY, SECRET_KEY, Config(retries={
+        'total_max_attempts': 1,
+    }))
+
+    test_category_tracking(connection)
+    test_quota_enforcement(connection)
+
+    log.debug('All multipart category tests passed\n')
+
+
+if __name__ == '__main__':
+    main()

From c429d2d15da53c614fdbf099588a14546416d221 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 24 Jun 2026 16:49:40 +0000
Subject: [PATCH 416/596] rgw/s3-tests: test HEAD bucket object count excludes
 incomplete multipart parts

Add test_head_bucket_usage_multipart_incomplete to verify that
X-RGW-Object-Count (returned by HEAD Bucket with ?read-stats=true)
does not count in-progress multipart upload parts as completed
objects.

After uploading 2 parts without completing, HEAD bucket should
report 0 objects and ListObjectsV2 should return 0 keys.

Tests: https://tracker.ceph.com/issues/77509
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 .../s3-tests/s3tests/functional/test_s3.py    | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/src/test/rgw/s3-tests/s3tests/functional/test_s3.py b/src/test/rgw/s3-tests/s3tests/functional/test_s3.py
index 9878c248606..6dd04d5a2ad 100644
--- a/src/test/rgw/s3-tests/s3tests/functional/test_s3.py
+++ b/src/test/rgw/s3-tests/s3tests/functional/test_s3.py
@@ -1127,6 +1127,40 @@ def test_head_bucket_usage():
     assert hdrs['X-RGW-Bytes-Used'] == '3'
     assert hdrs['X-RGW-Quota-Max-Buckets'] == '1000'
 
+@pytest.mark.fails_on_aws
+@pytest.mark.fails_on_dbstore
+def test_head_bucket_usage_multipart_incomplete():
+    bucket_name = get_new_bucket()
+    client = get_client()
+
+    # initiate a multipart upload and upload 2 parts without completing
+    response = client.create_multipart_upload(Bucket=bucket_name, Key='mpu-obj')
+    upload_id = response['UploadId']
+    part_body = 'x' * (5 * 1024 * 1024)
+    for part_num in (1, 2):
+        client.upload_part(Bucket=bucket_name, Key='mpu-obj',
+                           UploadId=upload_id, PartNumber=part_num,
+                           Body=part_body)
+
+    # HEAD bucket with read-stats should show 0 objects: incomplete
+    # multipart parts are not counted as user-visible objects.
+    def add_read_stats_param(request, **kwargs):
+        request.params['read-stats'] = 'true'
+
+    client.meta.events.register('request-created.s3.HeadBucket', add_read_stats_param)
+    client.meta.events.register('after-call.s3.HeadBucket', get_http_response)
+    client.head_bucket(Bucket=bucket_name)
+    hdrs = http_response['headers']
+    assert hdrs['X-RGW-Object-Count'] == '0'
+
+    # ListObjects should also return nothing
+    response = client.list_objects_v2(Bucket=bucket_name)
+    assert response['KeyCount'] == 0
+
+    # cleanup
+    client.abort_multipart_upload(Bucket=bucket_name, Key='mpu-obj',
+                                  UploadId=upload_id)
+
 @pytest.mark.fails_on_aws
 @pytest.mark.fails_on_dbstore
 def test_bucket_list_unordered():

From 78b5f05d00d1e55bd212f3b994048432fbba7d3c Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Thu, 18 Jun 2026 18:22:17 +0000
Subject: [PATCH 417/596] doc: add PendingReleaseNotes entry for the new rgw
 multipart category

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 PendingReleaseNotes | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 348fa282cc6..e1b1da5eb46 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -1037,3 +1037,13 @@ can be configured using the `rgw` option `rgw_bucket_persistent_notif_num_shards
   https://docs.ceph.com/en/latest/radosgw/notifications/
 
 Relevant tracker: https://tracker.ceph.com/issues/71677
+
+* RGW: Multipart upload part heads are now tracked under a new
+  ``rgw.multipart`` category in bucket stats, separate from completed
+  objects (``rgw.main``). This makes ``radosgw-admin bucket stats``
+  and the ``X-RGW-Object-Count`` header on HEAD Bucket more accurate:
+  in-progress or abandoned multipart parts no longer inflate the
+  object count. Existing in-progress uploads retain the old category
+  until they complete or abort.
+
+  Relevant tracker: https://tracker.ceph.com/issues/77509

From 9061bc4a4448d23b3f9f9bb1d00717a07a2d95d3 Mon Sep 17 00:00:00 2001
From: Adam Kupczyk <akupczyk@ibm.com>
Date: Fri, 19 Jun 2026 15:02:16 +0200
Subject: [PATCH 418/596] doc/rados/bluestore: ExtBlkDev, FCM plugin

Add new page about 2 topics:
- EXTBLKDEV
- FCM plugin

Signed-off-by: Adam Kupczyk <akupczyk@ibm.com>
---
 doc/rados/bluestore/fcm-plugin.rst | 303 +++++++++++++++++++++++++++++
 doc/rados/configuration/index.rst  |   1 +
 2 files changed, 304 insertions(+)
 create mode 100644 doc/rados/bluestore/fcm-plugin.rst

diff --git a/doc/rados/bluestore/fcm-plugin.rst b/doc/rados/bluestore/fcm-plugin.rst
new file mode 100644
index 00000000000..52076be7604
--- /dev/null
+++ b/doc/rados/bluestore/fcm-plugin.rst
@@ -0,0 +1,303 @@
+=======================
+ EXTBLKDEV, FCM plugin
+=======================
+
+.. index:: bluestore; extblkdev
+
+ExtBlkDev
+=========
+
+With Pacific release Ceph was extended to handle thinly-provisioned and compressing drives.
+The extension is made in form of loadable plugins that are part of Ceph codebase: ``src/extblkdev``.
+
+At startup OSD checks if specific plugins are enabled, as controlled by:
+
+.. confval:: osd_extblkdev_plugins
+
+To let OSD load and check for presence of FCM devices set:
+
+.. code-block::
+
+  osd_extblkdev_plugins = fcm
+
+
+Mode of operation
+-----------------
+
+Thin-provisioned and compressing drives have different capacity for data than what is advertised
+as addressable logical space. It means that a compressing drive might advertise its size as 10TB,
+but in reality only operate on 2TB of physical NAND.
+ExtBlkDev plugins provide an additional information channel between devices and BlueStore,
+giving Ceph report current disk logical / physical, used / available states.
+
+This information is critical for OSDs: they might otherwise try to write more data to the device
+than it can store, which will critically fail when it is really REALLY full.
+Without current and accurate drive usage the configurables are useless:
+
+.. confval:: mon_osd_full_ratio
+
+.. confval:: mon_osd_nearfull_ratio
+
+The ExtBlkDev extension is implemented on ``BlockDevice`` level, common for ``Main``, ``DB``, and ``WAL`` devices.
+However, BlueStore only uses it in context of ``Main`` device.
+For the ``DB`` and ``WAL`` devices, the plugin is detected and loaded, but BlueStore does not interact with it.
+
+Plugin persistence
+------------------
+
+.. note::
+
+  The examples below are derived from an actual deployment of the FCM plugin.
+
+Having the proper plugin loaded is critical to OSD operation.
+
+.. prompt:: # bash
+
+  ceph osd df
+
+.. code-block::
+
+  ID  CLASS  WEIGHT    REWEIGHT  SIZE     RAW USE  DATA     OMAP     META    AVAIL    %USE   VAR   PGS   STATUS
+   0    ssd  5.07739    1.00000   31 TiB  4.3 TiB  4.2 TiB   11 KiB  12 GiB   26 TiB  13.92  0.77   129      up
+   1    ssd  5.07739    1.00000   31 TiB  4.3 TiB  4.2 TiB   12 KiB  12 GiB   26 TiB  13.93  0.77   128      up
+   2    ssd  5.07739    1.00000   31 TiB  4.3 TiB  4.2 TiB   12 KiB  12 GiB   26 TiB  13.93  0.77   129      up
+   3    ssd  5.07739    1.00000   31 TiB  4.2 TiB  4.2 TiB   12 KiB  12 GiB   26 TiB  13.90  0.77   128      up
+   4    ssd  5.07739    1.00000  5.1 TiB  2.2 TiB  4.2 TiB   12 KiB  12 GiB  2.9 TiB  43.08  2.38   128      up
+   5    ssd  5.07739    1.00000  5.1 TiB  2.2 TiB  4.3 TiB   12 KiB  12 GiB  2.9 TiB  43.25  2.39   128      up
+   6    ssd  5.07739    1.00000  5.1 TiB  2.2 TiB  4.2 TiB   12 KiB  12 GiB  2.9 TiB  43.06  2.38   128      up
+   7    ssd  5.07739    1.00000  5.1 TiB  2.2 TiB  4.3 TiB   14 KiB  12 GiB  2.9 TiB  43.44  2.40   129      up
+                          TOTAL  143 TiB   26 TiB   34 TiB  101 KiB  94 GiB  117 TiB  18.09        1027        
+  MIN/MAX VAR: 0.77/2.40  STDDEV: 18.00
+
+In the above case OSDs 0-3 run without the plugin; OSDs 4-7 have the plugin loaded and active.
+All eight OSDs participate in a single 6+2 erasure coded pool and therefore carry equivalent utilization.
+With EC6+2 this is moot, but for other pool types the balancer will prioritize OSDs 0-3 which seem to be mostly empty
+trying to offload seemingly overburdened OSDs 4-7. 
+
+Tentacle provides a new configurable that signals BlueStore to expect that an ExtBlkDev plugin will be in use.
+
+.. confval:: bluestore_use_ebd
+
+The ExtBlkDev infrastructure adds new category of health warnings:
+
+.. code-block::
+
+  HEALTH_WARN 8 OSD(s) reporting problems with ExtBlkDev plugin;
+  [WRN] EXTBLKDEV: 8 OSD(s) reporting problems with ExtBlkDev plugin
+
+
+With the ``bluestore_use_ebd`` set to ``true``, two EXTBLKDEV health warnings may appear:
+
+  1) "plugin 'fcm' not loaded"
+
+  2) "plugin 'fcm' used on mkfs, but now uses plugin 'disabled'"
+
+
+Having the configuration option set to ``true`` does not require that a plugin is used. 
+If a plugin is not found during OSD creation, this is still a proper and acceptable state.
+However, once a plugin is detected during the OSD's creation, its usage becomes mandatory.
+Should plugin presence be required for specific OSD, one can check for it:
+
+.. prompt:: bash #
+
+  ceph osd metadata osd.2
+
+.. code-block::
+
+  ...
+  "bluestore_bdev_fcm": "true",
+  ...
+
+or
+
+.. prompt:: bash #
+
+  ceph-bluestore-tool --path dev/osd4/ show-label
+
+.. code-block::
+
+  ...
+  "extblkdev": "fcm",
+  ...
+
+The first check is somewhat weaker than the second.
+In a specific error case that the plugin was detected and memorized at OSD creation,
+but is not loaded, one will not see the value in OSD metadata. Instead a health warning appears.
+The second check never fails. It simply stores the setting in BlueStore label metadata.
+
+.. _fix-use-ebd:
+
+A fix
+-----
+
+If ``bluestore_use_ebd=true`` was not set when OSDs were created on devices that should run with a plugin,
+it may be set after the fact with a command of the following form:
+
+.. prompt:: bash #
+
+  ceph-bluestore-tool --dev dev/osd4/block -k extblkdev -v fcm set-label-key
+
+.. _fcm-plugin:
+
+FCM plugin
+==========
+
+Ceph releases beginning with Tentacle provide a plugin to operate with FlashCoreModule devices (FCMs).
+Like all ExtBlkDev plugins, it reports true disk usage to BlueStore, effectively overriding
+BlueStore reported metrics of used and available device space.
+FCM reported metrics are in physical NAND size, not in logical space size.
+
+In addition the plugin reports fixed stats via OSD metadata:
+
+.. prompt:: bash #
+
+  ceph osd metadata osd.2
+
+.. code-block::
+
+  ...
+  "bluestore_bdev_fcm_device_logical_size": "33599931809792",
+  "bluestore_bdev_fcm_device_physical_size": "5582606303232",
+  "bluestore_bdev_fcm_partition_logical_size": "33599931809792",
+  "bluestore_bdev_fcm_partition_physical_size": "5582606303232",
+  ...
+
+And dynamic current state via performance counters:
+
+.. prompt:: bash #
+
+  ceph tell osd.6 perf dump extblkdev
+
+.. code-block::
+
+  {
+    "extblkdev": {
+        "fcm": 0,  <- value is irrelevant, it is the name that counts
+        "dev_phy_size": 5582606303232,
+        "dev_log_size": 33599931809792,
+        "dev_phy_util": 2403758935846,
+        "dev_log_util": 4714543366144,
+        "part_phy_size": 5582606303232,
+        "part_log_size": 33599931809792,
+        "part_phy_avail": 3178847367386,
+        "part_log_avail": 28885388443648
+    }
+  }
+
+The FCM plugin provides three new health warnings in the EXTBLKDEV class.
+
+  1) "failed accessing FCM utilization log" :ref:`fcm-permissions`
+
+  2) "bdev_enable_discard not enabled - free space will leak" :ref:`fcm-discard`
+
+  3) "multivolume fcm will not work properly" :ref:`fcm-multivolume`
+
+
+.. _fcm-permissions:
+
+FCM permissions
+---------------
+
+The FCM plugin talks to the NVMe controller within each storage device.
+In Linux, this is a privileged operation, tied to the `cap_sys_admin` privilege.
+To get the privilege do either:
+
+  a) Run Ceph OSD as root.
+
+  b) Grant ``setcap "cap_sys_admin=p" ceph-osd``
+     and run with ``ceph-osd --set-keepcaps=true`` .
+
+.. _fcm-discard:
+
+FCM discard
+-----------
+
+FCM devices implement compression; their physical NAND capacity is much smaller than their logical device size.
+Conventional SSDs storing data that is no longer used by BlueStore experience may experience suboptimal performance.
+With FCMs, orphaned data represents a direct loss of available capacity. To prevent this problem, one should always set:
+
+.. code-block::
+
+  bdev_enable_discard = true
+
+.. _fcm-multivolume:
+
+FCM multivolume
+---------------
+
+BlueStore works well when there is a one-to-one mapping between FCM devices to BlueStore block devices.
+
+Splitting an FCM device in half by partitioning does not create any boundary for the controller.
+Filling one partition will affect available space in the other partition.
+Two partitions together will have the total logical capacity exactly the same, but available physical NAND will be counted twice.
+This will most likely confuse both balancers and operators.
+
+  NOTE: The FCM plugin does not detect this condition.
+
+Combining multiple FCM devices using the device mapper, LVM, or Linux MD software RAID is not recommended. When doing so,
+BlueStore has no visibility of the topology of the backing block devices and cannot know to address storage by specific logical device offsets.
+For regular drives it does not matter; when the physical:logical ratio is 1:1 BlueStore will eventually run out of logical space on first drive
+and without even noticing start consuming the second drive.
+With FCMs, and any other compressing drives, it is no longer the case. When BlueStore is not running out of logical space on first drive,
+it will keep asking the drive to accomodate more data. The second drive has it, but first does not.
+BlueStore will eventually fail to allocate space and fail with a hard ``-ENOSPC`` error.
+
+Trying to run BlueStore with compound block device when one of them is an FCM will raise the warning.
+An OSD cannot operate long-term in this way. It must be redeployed.
+
+
+
+Redeploy and discard
+--------------------
+
+When one redeploys an FCM OSD without first formatting or issuing a whole-device discard operation,
+BlueStore will be logically empty, but the underlying device will still hold the burden of previously held data.
+
+.. code-block::
+
+  ID  CLASS  WEIGHT   REWEIGHT  SIZE     RAW USE  DATA     OMAP     META     AVAIL    %USE   VAR   PGS  STATUS
+   0    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  956 KiB   24 KiB   26 MiB  2.9 TiB  43.16  1.00    1      up
+   1    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  376 KiB   20 KiB   26 MiB  2.9 TiB  43.14  1.00    0      up
+   2    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  956 KiB   20 KiB   26 MiB  2.9 TiB  43.15  1.00    1      up
+   3    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  376 KiB   16 KiB   26 MiB  2.9 TiB  43.05  1.00    0      up
+   4    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  376 KiB   14 KiB   26 MiB  2.9 TiB  43.08  1.00    0      up
+   5    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  376 KiB   11 KiB   26 MiB  2.9 TiB  43.24  1.00    0      up
+   6    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  376 KiB    7 KiB   26 MiB  2.9 TiB  43.05  1.00    0      up
+   7    ssd  5.07739   1.00000  5.1 TiB  2.2 TiB  956 KiB    6 KiB   26 MiB  2.9 TiB  43.44  1.01    1      up
+                         TOTAL   41 TiB   18 TiB  4.6 MiB  121 KiB  210 MiB   23 TiB  43.17          3        
+  MIN/MAX VAR: 1.00/1.01  STDDEV: 0.12
+
+Solution:
+
+  a) ``nvme format`` before deploying
+  b) Set ``bluestore_discard_on_mkfs=true`` (Umbrella+).
+
+
+CRUSH weight
+------------
+
+This section describes :ref:`fix-use-ebd` when using the FCM plugin :ref:`fcm-plugin`.
+
+When an OSD is properly deployed on an FCM, the WEIGHT and SIZE values reflect the physical NAND capacity:
+
+.. code-block::
+
+  ID  CLASS  WEIGHT   REWEIGHT  SIZE     RAW USE  DATA     OMAP     META     AVAIL    %USE  VAR   PGS  STATUS
+   0    ssd  5.07739   1.00000  5.1 TiB   12 MiB  944 KiB   21 KiB   26 MiB  5.1 TiB     0  1.00    1      up
+
+When an OSD is deployed without the active FCM plugin, the WEIGHT and SIZE reflect logical advertised values:
+
+.. code-block::
+
+  ID  CLASS  WEIGHT    REWEIGHT  SIZE     RAW USE  DATA     OMAP     META     AVAIL    %USE  VAR   PGS  STATUS
+   0    ssd  30.55899   1.00000   31 TiB   27 MiB  908 KiB   16 KiB   26 MiB   31 TiB     0  1.01    1      up
+
+When a plugin is active for the underlying device, the result is that the SIZE
+is the proper physical NAND capacity, but the CRUSH weight is still locked to original value at deployment:
+
+.. code-block::
+
+  ID  CLASS  WEIGHT    REWEIGHT  SIZE     RAW USE  DATA     OMAP    META     AVAIL    %USE  VAR   PGS  STATUS
+   0    ssd  30.55899   1.00000  5.1 TiB   28 KiB  1.0 MiB   7 KiB   27 MiB  5.1 TiB     0  1.42    1      up
+
+The CRUSH weight of such OSDs must be adjusted.
diff --git a/doc/rados/configuration/index.rst b/doc/rados/configuration/index.rst
index 0367b449416..985858a8e62 100644
--- a/doc/rados/configuration/index.rst
+++ b/doc/rados/configuration/index.rst
@@ -23,6 +23,7 @@ For general object store configuration, refer to the following:
    BlueStore RocksDB cache <../bluestore/rocksdb-config>
    BlueFS Spillover Cleaner <../bluestore/bluefs-spillover-cleaner>
    Fast Crash Recovery for file-stored allocations <../bluestore/fast-onode-scan>
+   ExtBlkDev, FCM plugin <../bluestore/fcm-plugin>
    ceph-conf
 
 

From 5a77c4fd359e485501256fa3b21272fb06e8f0af Mon Sep 17 00:00:00 2001
From: Miki Patel <miki.patel132@gmail.com>
Date: Tue, 21 Apr 2026 17:23:29 +0530
Subject: [PATCH 419/596] rbd-mirror: Remove old non-primary demoted image
 snapshots on the local cluster

When an image is demoted on primary cluster and later promoted again,
a non-primary demoted image snapshot is created on the peer (secondary)
cluster. Each such promote/demote cycle on same cluster results in an
additional non-primary demoted snapshot being created on peer.
As a result, repeated promote/demote cycles on the same cluster can
lead to accumulation of stale non-primary demoted snapshots on the
secondary cluster. These snapshots are not removed immediately because
cleanup is only triggered when peer (secondary) is promoted and then
demoted.

The proposed changes ensures that such snapshots are proactively identified
and removed, preventing unbounded buildup. Also added test coverage to
verify cleanup behavior.

Fixes: https://tracker.ceph.com/issues/76155

Signed-off-by: Miki Patel <miki.patel132@gmail.com>
---
 qa/workunits/rbd/rbd_mirror.sh                | 29 +++++++
 .../snapshot/test_mock_Replayer.cc            | 81 +++++++++++++++++++
 .../image_replayer/snapshot/Replayer.cc       |  7 +-
 3 files changed, 115 insertions(+), 2 deletions(-)

diff --git a/qa/workunits/rbd/rbd_mirror.sh b/qa/workunits/rbd/rbd_mirror.sh
index 99166f169ba..b19005c9d36 100755
--- a/qa/workunits/rbd/rbd_mirror.sh
+++ b/qa/workunits/rbd/rbd_mirror.sh
@@ -355,6 +355,35 @@ if [ "${RBD_MIRROR_MODE}" = "snapshot" ]; then
   test "$(count_mirror_snaps ${CLUSTER2} ${POOL} ${image})" -le 3
 fi
 
+if [ "${RBD_MIRROR_MODE}" = "snapshot" ]; then
+  testlog "TEST: demote and promote on same cluster in loop"
+  for i in `seq 1 20`; do
+    last_demote_snap_id=''
+    demote_image ${CLUSTER2} ${POOL} ${image}
+    wait_for_image_replay_stopped ${CLUSTER1} ${POOL} ${image}
+    wait_for_status_in_pool_dir ${CLUSTER1} ${POOL} ${image} 'up+unknown'
+    wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+unknown'
+    get_newest_complete_mirror_snapshot_id ${CLUSTER2} ${POOL} ${image} last_demote_snap_id
+    wait_for_non_primary_snap_present ${CLUSTER1} ${POOL} ${image} ${last_demote_snap_id}
+
+    promote_image ${CLUSTER2} ${POOL} ${image}
+    wait_for_image_replay_started ${CLUSTER1} ${POOL} ${image}
+    wait_for_status_in_pool_dir ${CLUSTER2} ${POOL} ${image} 'up+stopped'
+    wait_for_status_in_pool_dir ${CLUSTER1} ${POOL} ${image} 'up+replaying'
+    # check non-primary demote snapshot is removed
+    wait_for_non_primary_snap_not_present ${CLUSTER1} ${POOL} ${image} ${last_demote_snap_id}
+  done
+  # expected snapshots on CLUSTER1: non-primary
+  SNAPS=$(get_snaps_json ${CLUSTER1} ${POOL} ${image})
+  jq -e 'length == 1' <<< ${SNAPS}
+  jq -e '.[0].namespace["type"] == "mirror" and .[0].namespace["state"] == "non-primary"' <<< ${SNAPS}
+  # expected snapshots on CLUSTER2: primary demoted, primary
+  SNAPS=$(get_snaps_json ${CLUSTER2} ${POOL} ${image})
+  jq -e 'length == 2' <<< ${SNAPS}
+  jq -e '.[0].namespace["type"] == "mirror" and .[0].namespace["state"] == "demoted" and (.[0]["name"] | startswith(".mirror.primary"))' <<< ${SNAPS}
+  jq -e '.[1].namespace["type"] == "mirror" and .[1].namespace["state"] == "primary"' <<< ${SNAPS}
+fi
+
 testlog "TEST: force promote"
 force_promote_image=test_force_promote
 create_image_and_enable_mirror ${CLUSTER2} ${POOL} ${force_promote_image} ${RBD_MIRROR_MODE}
diff --git a/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc b/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc
index a2dabf2e0ae..07f7a4b168c 100644
--- a/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc
+++ b/src/test/rbd_mirror/image_replayer/snapshot/test_mock_Replayer.cc
@@ -3511,6 +3511,87 @@ TEST_F(TestMockImageReplayerSnapshotReplayer, ApplyImageStateErrorPendingShutdow
   ASSERT_EQ(0, shutdown_ctx.wait());
 }
 
+TEST_F(TestMockImageReplayerSnapshotReplayer, PruneObsoleteNonPrimaryDemotedSnapshot) {
+  librbd::MockTestImageCtx mock_local_image_ctx{*m_local_image_ctx};
+  librbd::MockTestImageCtx mock_remote_image_ctx{*m_remote_image_ctx};
+
+  MockThreads mock_threads(m_threads);
+  expect_work_queue_repeatedly(mock_threads);
+
+  MockReplayerListener mock_replayer_listener;
+  expect_notification(mock_threads, mock_replayer_listener);
+
+  InSequence seq;
+
+  MockInstanceWatcher mock_instance_watcher;
+  MockImageMeta mock_image_meta;
+  MockStateBuilder mock_state_builder(mock_local_image_ctx,
+                                      mock_remote_image_ctx,
+                                      mock_image_meta);
+  MockReplayer mock_replayer{&mock_threads, &mock_instance_watcher,
+                             "local mirror uuid", "local mirror peer uuid",
+                             &m_pool_meta_cache, &mock_state_builder,
+                             &mock_replayer_listener};
+  m_pool_meta_cache.set_remote_pool_meta(
+    m_remote_fsid, m_remote_io_ctx.get_id(),
+    {"remote mirror uuid", "remote mirror peer uuid"});
+
+  librbd::UpdateWatchCtx* update_watch_ctx = nullptr;
+  ASSERT_EQ(0, init_entry_replayer(mock_replayer, mock_threads,
+                                   mock_local_image_ctx,
+                                   mock_remote_image_ctx,
+                                   mock_replayer_listener,
+                                   mock_image_meta,
+                                   &update_watch_ctx));
+
+  // Remote: PRIMARY_DEMOTED snap1 + PRIMARY snap2
+  mock_remote_image_ctx.snap_info = {
+    {1U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
+       cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY_DEMOTED,
+       {}, "", CEPH_NOSNAP, true, 0, {}},
+     0, {}, 0, 0, {}}},
+    {2U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
+       cls::rbd::MIRROR_SNAPSHOT_STATE_PRIMARY,
+       {"remote mirror peer uuid"}, "", CEPH_NOSNAP, true, 0, {}},
+     0, {}, 0, 0, {}}}};
+
+  // Local: NON_PRIMARY_DEMOTED snap1 + NON_PRIMARY snap2 (already synced)
+  mock_local_image_ctx.snap_info = {
+    {11U, librbd::SnapInfo{"snap1", cls::rbd::MirrorSnapshotNamespace{
+       cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY_DEMOTED,
+       {"local mirror peer uuid"}, "remote mirror uuid", 1, true, 0, {}},
+     0, {}, 0, 0, {}}},
+    {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
+       cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY,
+       {}, "remote mirror uuid", 2, true, 0, {}},
+     0, {}, 0, 0, {}}}};
+
+  expect_load_image_meta(mock_image_meta, false, 0);
+  expect_is_refresh_required(mock_remote_image_ctx, false);
+  expect_is_refresh_required(mock_local_image_ctx, false);
+  expect_prune_mirror_snapshot(mock_local_image_ctx, 11, 0);
+
+  // idle
+  expect_load_image_meta(mock_image_meta, false, 0);
+  expect_is_refresh_required(mock_remote_image_ctx, false);
+  expect_is_refresh_required(mock_local_image_ctx, true);
+  expect_refresh(
+    mock_local_image_ctx, {
+      {12U, librbd::SnapInfo{"snap2", cls::rbd::MirrorSnapshotNamespace{
+         cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY,
+         {}, "remote mirror uuid", 2, true, 0, {}},
+       0, {}, 0, 0, {}}},
+    }, 0);
+
+  // wake-up replayer
+  update_watch_ctx->handle_notify();
+  ASSERT_EQ(0, wait_for_notification(1));
+
+  ASSERT_EQ(0, shut_down_entry_replayer(mock_replayer, mock_threads,
+                                        mock_local_image_ctx,
+                                        mock_remote_image_ctx));
+}
+
 } // namespace snapshot
 } // namespace image_replayer
 } // namespace mirror
diff --git a/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc b/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc
index b85edfc105d..10167185d4a 100644
--- a/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc
+++ b/src/tools/rbd_mirror/image_replayer/snapshot/Replayer.cc
@@ -517,8 +517,11 @@ void Replayer<I>::scan_local_mirror_snapshots(
         // if remote has new snapshots, we would sync from here
         m_local_snap_id_start = local_snap_id;
         ceph_assert(m_local_snap_id_end == CEPH_NOSNAP);
-
-        if (mirror_ns->mirror_peer_uuids.empty()) {
+        const auto& peer_uuids = mirror_ns->mirror_peer_uuids;
+        if (peer_uuids.empty() ||
+            (mirror_ns->state == cls::rbd::MIRROR_SNAPSHOT_STATE_NON_PRIMARY_DEMOTED &&
+             peer_uuids.size() == 1 &&
+             peer_uuids.count(m_local_mirror_peer_uuid) == 1)) {
           // no other peer will attempt to sync to this snapshot so store as
           // a candidate for removal
           prune_snap_ids.insert(local_snap_id);

From 222a39366d27aaadf2c96a33b8a29275f233afab Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 24 Jun 2026 01:48:05 +0000
Subject: [PATCH 420/596] rgw/beast: (non-functional) refactor Connection and
 ConnectionList to header

Just like rgw_asio_frontend_timer.h, factor out the Connection struct and
ConnectionList class from the anonymous namespace in rgw_asio_frontend.cc
to a new header rgw_asio_frontend_connection.h (under namespace rgw::asio).

This is especially needed to get better coverage thru unittesting.

This is non-functional: no logic changes, the types, methods, and behavior
are identical as before. The frontend .cc uses type aliases to maintain the
same unqualified names.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_asio_frontend.cc           | 61 +++--------------------
 src/rgw/rgw_asio_frontend_connection.h | 68 ++++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 55 deletions(-)
 create mode 100644 src/rgw/rgw_asio_frontend_connection.h

diff --git a/src/rgw/rgw_asio_frontend.cc b/src/rgw/rgw_asio_frontend.cc
index 694eb88c544..8148001ef3c 100644
--- a/src/rgw/rgw_asio_frontend.cc
+++ b/src/rgw/rgw_asio_frontend.cc
@@ -44,6 +44,7 @@
 
 #include "rgw_zone.h"
 
+#include "rgw_asio_frontend_connection.h"
 #include "rgw_asio_frontend_timer.h"
 #include "rgw_dmclock_async_scheduler.h"
 
@@ -57,13 +58,11 @@ namespace http = boost::beast::http;
 namespace ssl = boost::asio::ssl;
 #endif
 
-struct Connection;
-
 using timeout_timer = rgw::basic_timeout_timer<ceph::coarse_mono_clock,
-      boost::asio::any_io_executor, Connection>;
+      boost::asio::any_io_executor, rgw::asio::Connection>;
 
-static constexpr size_t parse_buffer_size = 65536;
-using parse_buffer = boost::beast::flat_static_buffer<parse_buffer_size>;
+static constexpr size_t parse_buffer_size = rgw::asio::parse_buffer_size;
+using parse_buffer = rgw::asio::parse_buffer;
 
 // use mmap/mprotect to allocate 512k coroutine stacks
 auto make_stack_allocator() {
@@ -407,56 +406,8 @@ void handle_connection(boost::asio::io_context& context,
   }
 }
 
-// timeout support requires that connections are reference-counted, because the
-// timeout_handler can outlive the coroutine
-struct Connection : boost::intrusive::list_base_hook<>,
-                    boost::intrusive_ref_counter<Connection>
-{
-  tcp::socket socket;
-  parse_buffer buffer;
-
-  explicit Connection(tcp::socket&& socket) noexcept
-      : socket(std::move(socket)) {}
-
-  void close(boost::system::error_code& ec) {
-    socket.close(ec);
-  }
-
-  tcp::socket& get_socket() { return socket; }
-};
-
-class ConnectionList {
-  using List = boost::intrusive::list<Connection>;
-  List connections;
-  std::mutex mutex;
-
-  void remove(Connection& c) {
-    std::lock_guard lock{mutex};
-    if (c.is_linked()) {
-      connections.erase(List::s_iterator_to(c));
-    }
-  }
- public:
-  class Guard {
-    ConnectionList *list;
-    Connection *conn;
-   public:
-    Guard(ConnectionList *list, Connection *conn) : list(list), conn(conn) {}
-    ~Guard() { list->remove(*conn); }
-  };
-  [[nodiscard]] Guard add(Connection& conn) {
-    std::lock_guard lock{mutex};
-    connections.push_back(conn);
-    return Guard{this, &conn};
-  }
-  void close(boost::system::error_code& ec) {
-    std::lock_guard lock{mutex};
-    for (auto& conn : connections) {
-      conn.socket.close(ec);
-    }
-    connections.clear();
-  }
-};
+using rgw::asio::Connection;
+using rgw::asio::ConnectionList;
 
 namespace dmc = rgw::dmclock;
 class AsioFrontend {
diff --git a/src/rgw/rgw_asio_frontend_connection.h b/src/rgw/rgw_asio_frontend_connection.h
new file mode 100644
index 00000000000..56d5e233d0b
--- /dev/null
+++ b/src/rgw/rgw_asio_frontend_connection.h
@@ -0,0 +1,68 @@
+#pragma once
+
+#include <mutex>
+
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/beast/core/flat_static_buffer.hpp>
+#include <boost/intrusive/list.hpp>
+#include <boost/smart_ptr/intrusive_ref_counter.hpp>
+
+namespace rgw::asio {
+
+using tcp = boost::asio::ip::tcp;
+
+static constexpr size_t parse_buffer_size = 65536;
+using parse_buffer = boost::beast::flat_static_buffer<parse_buffer_size>;
+
+// timeout support requires that connections are reference-counted, because the
+// timeout_handler can outlive the coroutine
+struct Connection : boost::intrusive::list_base_hook<>,
+                    boost::intrusive_ref_counter<Connection>
+{
+  tcp::socket socket;
+  parse_buffer buffer;
+
+  explicit Connection(tcp::socket&& socket) noexcept
+      : socket(std::move(socket)) {}
+
+  void close(boost::system::error_code& ec) {
+    socket.close(ec);
+  }
+
+  tcp::socket& get_socket() { return socket; }
+};
+
+class ConnectionList {
+  using List = boost::intrusive::list<Connection>;
+  List connections;
+  std::mutex mutex;
+
+  void remove(Connection& c) {
+    std::lock_guard lock{mutex};
+    if (c.is_linked()) {
+      connections.erase(List::s_iterator_to(c));
+    }
+  }
+ public:
+  class Guard {
+    ConnectionList *list;
+    Connection *conn;
+   public:
+    Guard(ConnectionList *list, Connection *conn) : list(list), conn(conn) {}
+    ~Guard() { list->remove(*conn); }
+  };
+  [[nodiscard]] Guard add(Connection& conn) {
+    std::lock_guard lock{mutex};
+    connections.push_back(conn);
+    return Guard{this, &conn};
+  }
+  void close(boost::system::error_code& ec) {
+    std::lock_guard lock{mutex};
+    for (auto& conn : connections) {
+      conn.socket.close(ec);
+    }
+    connections.clear();
+  }
+};
+
+} // namespace rgw::asio

From 15915c85e1a36528c659e32d3f863030212576c1 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 24 Jun 2026 02:35:17 +0000
Subject: [PATCH 421/596] rgw/beast: fix shutdown crash in
 ConnectionList::close()

ConnectionList::close() is called from the main thread during
AsioFrontend::stop(), but io_context pool threads may still have
pending async_write operations on those sockets. The old code called
socket.close() which is a boost::asio thread-safety violation:

  - it NULLifies descriptor_data in the epoll reactor which causes
    concurrent start_op calls to dereference NULL (SIGSEGV), or
  - it deregisters the fd from epoll, orphaning pending operations so
    their completion handlers would never fire (hang)

Fix by using socket.cancel() + native ::shutdown():
- cancel() dequeues pending operations from the reactor's
  per-descriptor queue and adds completions with
  operation_aborted. This should handle writes blocked in epoll.
- shutdown(fd, SHUT_RDWR) disables the transport so any
  strand-queued writes that haven't entered epoll yet will fail
  with EPIPE on the next send() attempt

Also remove connections.clear() since coroutines exited via I/O error
and their RAII Guard removes them from the list on destruction.

This follows the same principle as the fix for
https://tracker.ceph.com/issues/58670 which handles the same scenario
in timeout_handler path.

Bottomlime, socket operations must not be performed from outside the owning
strand.

Fixes: https://tracker.ceph.com/issues/77658
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_asio_frontend_connection.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/rgw/rgw_asio_frontend_connection.h b/src/rgw/rgw_asio_frontend_connection.h
index 56d5e233d0b..18e46269bb8 100644
--- a/src/rgw/rgw_asio_frontend_connection.h
+++ b/src/rgw/rgw_asio_frontend_connection.h
@@ -59,9 +59,12 @@ class ConnectionList {
   void close(boost::system::error_code& ec) {
     std::lock_guard lock{mutex};
     for (auto& conn : connections) {
-      conn.socket.close(ec);
+      // cancel pending reactor operations which delivers operation_aborted
+      // to completion handlers and then shutdown the transport so any
+      // subsequent I/O attempts fail immediately.
+      conn.socket.cancel(ec);
+      conn.socket.shutdown(tcp::socket::shutdown_both, ec);
     }
-    connections.clear();
   }
 };
 

From 179b873e9bf2826a5db9fef50e76c2bef3d47438 Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 24 Jun 2026 14:34:04 +0000
Subject: [PATCH 422/596] rgw/beast: (non-functional change) add size method to
 ConnectionList

This is meant to be used in unittesting.

Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/rgw/rgw_asio_frontend_connection.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_asio_frontend_connection.h b/src/rgw/rgw_asio_frontend_connection.h
index 18e46269bb8..d06ef98849a 100644
--- a/src/rgw/rgw_asio_frontend_connection.h
+++ b/src/rgw/rgw_asio_frontend_connection.h
@@ -35,7 +35,7 @@ struct Connection : boost::intrusive::list_base_hook<>,
 class ConnectionList {
   using List = boost::intrusive::list<Connection>;
   List connections;
-  std::mutex mutex;
+  mutable std::mutex mutex;
 
   void remove(Connection& c) {
     std::lock_guard lock{mutex};
@@ -56,6 +56,10 @@ class ConnectionList {
     connections.push_back(conn);
     return Guard{this, &conn};
   }
+  size_t size() const {
+    std::lock_guard lock{mutex};
+    return connections.size();
+  }
   void close(boost::system::error_code& ec) {
     std::lock_guard lock{mutex};
     for (auto& conn : connections) {

From 19748f1767b85b44c17acca7318957118e196fdf Mon Sep 17 00:00:00 2001
From: Oguzhan Ozmen <oozmen@bloomberg.net>
Date: Wed, 24 Jun 2026 02:36:06 +0000
Subject: [PATCH 423/596] test/rgw/beast: add unit test for ConnectionList
 shutdown behavior

Tests: https://tracker.ceph.com/issues/77658
Signed-off-by: Oguzhan Ozmen <oozmen@bloomberg.net>
---
 src/test/rgw/CMakeLists.txt                   |  4 +
 .../rgw/test_rgw_asio_frontend_connection.cc  | 91 +++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 src/test/rgw/test_rgw_asio_frontend_connection.cc

diff --git a/src/test/rgw/CMakeLists.txt b/src/test/rgw/CMakeLists.txt
index 6d8bdf58067..588504af867 100644
--- a/src/test/rgw/CMakeLists.txt
+++ b/src/test/rgw/CMakeLists.txt
@@ -481,6 +481,10 @@ add_executable(unittest_rgw_async_utils test_rgw_async_utils.cc)
 add_ceph_unittest(unittest_rgw_async_utils)
 target_link_libraries(unittest_rgw_async_utils ${rgw_libs} ${UNITTEST_LIBS})
 
+add_executable(unittest_rgw_asio_frontend_connection test_rgw_asio_frontend_connection.cc)
+add_ceph_unittest(unittest_rgw_asio_frontend_connection)
+target_link_libraries(unittest_rgw_asio_frontend_connection ${rgw_libs} ${UNITTEST_LIBS})
+
 add_executable(unittest_rgw_tag test_rgw_tag.cc)
 add_ceph_unittest(unittest_rgw_tag)
 target_link_libraries(unittest_rgw_tag ${rgw_libs} ${UNITTEST_LIBS})
diff --git a/src/test/rgw/test_rgw_asio_frontend_connection.cc b/src/test/rgw/test_rgw_asio_frontend_connection.cc
new file mode 100644
index 00000000000..079723f586d
--- /dev/null
+++ b/src/test/rgw/test_rgw_asio_frontend_connection.cc
@@ -0,0 +1,91 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab ft=cpp
+
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright contributors to the Ceph project
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation. See file COPYING.
+ *
+ */
+
+#include "rgw/rgw_asio_frontend_connection.h"
+
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/ip/tcp.hpp>
+#include <boost/asio/write.hpp>
+#include <boost/intrusive_ptr.hpp>
+
+#include <gtest/gtest.h>
+
+namespace asio = boost::asio;
+using tcp = asio::ip::tcp;
+using rgw::asio::Connection;
+using rgw::asio::ConnectionList;
+
+// Testcases for ConnectionList::close() shutdown behavior.
+//
+// Verifies that close() uses socket.cancel() + ::shutdown() rather than
+// socket.close(). Calling socket.close() from outside the socket's strand
+// is a boost::asio thread-safety violation that can SIGSEGV or orphaned
+// pending operations.
+
+// Verify that ConnectionList::close() does NOT close the sockets (fd stays
+// valid, is_open() remains true) but does shut down the transport (writes
+// fail). This ensures we never call socket.close() from outside the strand.
+TEST(BeastFrontendShutdown, CloseShutdownsButDoesNotCloseSocket)
+{
+  asio::io_context ioctx;
+  ConnectionList connections;
+
+  tcp::acceptor acceptor(ioctx, tcp::endpoint(tcp::v4(), 0));
+  acceptor.listen(3);
+
+  tcp::socket c0(ioctx), c1(ioctx), c2(ioctx);
+  c0.connect(acceptor.local_endpoint());
+  auto s0 = acceptor.accept();
+  c1.connect(acceptor.local_endpoint());
+  auto s1 = acceptor.accept();
+  c2.connect(acceptor.local_endpoint());
+  auto s2 = acceptor.accept();
+
+  boost::intrusive_ptr<Connection> conns[] = {
+    new Connection(std::move(s0)),
+    new Connection(std::move(s1)),
+    new Connection(std::move(s2)),
+  };
+
+  {
+    auto g0 = connections.add(*conns[0]);
+    auto g1 = connections.add(*conns[1]);
+    auto g2 = connections.add(*conns[2]);
+
+    ASSERT_EQ(3u, connections.size());
+
+    boost::system::error_code ec;
+    connections.close(ec);
+
+    // After close(): sockets must still be "open" from boost::asio's
+    // perspective (fd not released, descriptor_data not zeroed).
+    // socket.close() would have set is_open()=false and fd=-1, which is the
+    // thread-safety violation that causes SIGSEGV.
+    for (auto& conn : conns) {
+      EXPECT_TRUE(conn->socket.is_open());
+      EXPECT_GE(conn->socket.native_handle(), 0);
+    }
+
+    // But the transport is shut down — writes must fail
+    for (auto& conn : conns) {
+      char buf[] = "test";
+      asio::write(conn->socket, asio::buffer(buf), ec);
+      EXPECT_TRUE(ec.failed())
+          << "Write should fail after shutdown";
+    }
+  } // guards destroyed here — connections removed from list
+
+  EXPECT_EQ(0u, connections.size());
+}

From cab98604fadb8bdc30d27188c44b313e12568d97 Mon Sep 17 00:00:00 2001
From: Nitzan Mordechai <nmordech@ibm.com>
Date: Tue, 23 Jun 2026 10:23:54 +0000
Subject: [PATCH 424/596] mon/config: trim whitespace in config target

When set\get\rm config values with leading or trailing spaces,
those spaces need to be removed before we are trying to get\set\rm
those keys.
add trim code before each approch and also for exist keys in config.

Fixes: https://tracker.ceph.com/issues/77598
Signed-off-by: Nitzan Mordechai <nmordech@ibm.com>
---
 qa/workunits/mon/config.sh      | 17 +++++++++
 src/mon/ConfigMap.cc            |  2 ++
 src/mon/ConfigMonitor.cc        |  2 ++
 src/test/mon/test_config_map.cc | 61 +++++++++++++++++++++++++++++++++
 4 files changed, 82 insertions(+)

diff --git a/qa/workunits/mon/config.sh b/qa/workunits/mon/config.sh
index 10cbe5630e9..d6c2d850f41 100755
--- a/qa/workunits/mon/config.sh
+++ b/qa/workunits/mon/config.sh
@@ -73,6 +73,23 @@ ceph config rm client.foo debug_asok
 ceph config set client.foo debug_asok 66
 ceph config rm client.foo 'debug asok'
 
+# whitespace in who/section (e.g. "osd.0  " with stray trailing spaces)
+ceph config set 'osd.0  ' debug_asok 44
+ceph config get osd.0 debug_asok | grep 44
+while ! ceph tell osd.0 config get debug_asok | grep 44
+do
+    sleep 1
+done
+ceph config rm osd.0 debug_asok
+while ceph tell osd.0 config get debug_asok | grep 44
+do
+    sleep 1
+done
+
+ceph config set '  osd.0' debug_asok 55
+ceph config get osd.0 debug_asok | grep 55
+ceph config rm osd.0 debug_asok
+
 # help
 ceph config help debug_asok | grep debug_asok
 
diff --git a/src/mon/ConfigMap.cc b/src/mon/ConfigMap.cc
index bfd837727d1..45111a21562 100644
--- a/src/mon/ConfigMap.cc
+++ b/src/mon/ConfigMap.cc
@@ -6,6 +6,7 @@
 #include "common/entity_name.h"
 
 #include <boost/algorithm/string/split.hpp>
+#include <boost/algorithm/string/trim.hpp>
 
 #define dout_subsys ceph_subsys_mon
 #undef dout_prefix
@@ -207,6 +208,7 @@ bool ConfigMap::parse_mask(
   boost::split(split, who, [](char c){ return c == '/'; });
   for (unsigned j = 0; j < split.size(); ++j) {
     auto& i = split[j];
+    boost::algorithm::trim(i);
     if (i == "global") {
       *section = "global";
       continue;
diff --git a/src/mon/ConfigMonitor.cc b/src/mon/ConfigMonitor.cc
index e377008240e..62f38cd96bd 100644
--- a/src/mon/ConfigMonitor.cc
+++ b/src/mon/ConfigMonitor.cc
@@ -19,6 +19,7 @@
 #include "crush/CrushWrapper.h"
 
 #include <boost/algorithm/string/predicate.hpp>
+#include <boost/algorithm/string/trim.hpp>
 
 #define dout_subsys ceph_subsys_mon
 #undef dout_prefix
@@ -296,6 +297,7 @@ bool ConfigMonitor::preprocess_command(MonOpRequestRef op)
   } else if (prefix == "config get") {
     string who, name;
     cmd_getval(cmdmap, "who", who);
+    boost::algorithm::trim(who);
 
     EntityName entity;
     if (!entity.from_str(who) &&
diff --git a/src/test/mon/test_config_map.cc b/src/test/mon/test_config_map.cc
index eef42de6bd1..f5ab05cc216 100644
--- a/src/test/mon/test_config_map.cc
+++ b/src/test/mon/test_config_map.cc
@@ -53,6 +53,67 @@ TEST(ConfigMap, parse_key)
   }
 }
 
+TEST(ConfigMap, parse_mask)
+{
+  {
+    std::string section;
+    OptionMask mask;
+    ASSERT_TRUE(ConfigMap::parse_mask("osd.2", &section, &mask));
+    ASSERT_EQ("osd.2", section);
+  }
+  {
+    std::string section;
+    OptionMask mask;
+    ASSERT_TRUE(ConfigMap::parse_mask("osd.2  ", &section, &mask));
+    ASSERT_EQ("osd.2", section);
+  }
+  {
+    std::string section;
+    OptionMask mask;
+    ASSERT_TRUE(ConfigMap::parse_mask("  osd.2", &section, &mask));
+    ASSERT_EQ("osd.2", section);
+  }
+  {
+    std::string section;
+    OptionMask mask;
+    ASSERT_TRUE(ConfigMap::parse_mask(" global ", &section, &mask));
+    ASSERT_EQ("global", section);
+  }
+}
+
+TEST(ConfigMap, add_option_who_whitespace)
+{
+  ConfigMap cm;
+  boost::intrusive_ptr<CephContext> cct{new CephContext(CEPH_ENTITY_TYPE_CLIENT), false};
+  auto crush = std::make_unique<CrushWrapper>();
+  crush->finalize();
+
+  int r = cm.add_option(
+    cct.get(), "debug_ms", "osd.2  ", "1/1",
+    [&](const std::string& name) {
+      return nullptr;
+    });
+  ASSERT_EQ(0, r);
+  ASSERT_EQ(1, cm.by_id.size());
+  ASSERT_EQ(1, cm.by_id["osd.2"].options.size());
+
+  EntityName n;
+  n.set(CEPH_ENTITY_TYPE_OSD, "2");
+  auto c = cm.generate_entity_map(n, {}, crush.get(), "none", nullptr);
+  ASSERT_EQ(1, c.size());
+  ASSERT_EQ("1/1", c["debug_ms"]);
+
+  r = cm.add_option(
+    cct.get(), "foo", "osd.2", "clean",
+    [&](const std::string& name) {
+      return nullptr;
+    });
+  ASSERT_EQ(0, r);
+
+  ASSERT_EQ(1, cm.by_id.size());
+  ASSERT_EQ(2, cm.by_id["osd.2"].options.size());
+}
+
 TEST(ConfigMap, add_option)
 {
   ConfigMap cm;

From 1a0ee9b11dd6f1a54eeff9240519613ce368d596 Mon Sep 17 00:00:00 2001
From: Jaya Prakash <jayaprakash@ibm.com>
Date: Tue, 16 Jun 2026 16:24:41 +0000
Subject: [PATCH 425/596] os/bluestore: add per-instance new allocator perf
 counters

Fixes: https://tracker.ceph.com/issues/76936

Signed-off-by: Jaya Prakash <jayaprakash@ibm.com>
---
 src/os/bluestore/AllocatorBase.cc | 28 ++++++++++++++++++++++++++++
 src/os/bluestore/AllocatorBase.h  | 29 +++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)

diff --git a/src/os/bluestore/AllocatorBase.cc b/src/os/bluestore/AllocatorBase.cc
index 62d78974e27..a7c068dcfeb 100644
--- a/src/os/bluestore/AllocatorBase.cc
+++ b/src/os/bluestore/AllocatorBase.cc
@@ -207,3 +207,31 @@ void AllocatorBase::FreeStateHistogram::foreach(
     ++i;
   }
 }
+void AllocatorPerf::_init_logger(std::string_view name) {
+  PerfCountersBuilder b(cct,
+                        "bluestore-alloc-" + std::string(name),
+                        l_bluestore_allocator_first,
+                        l_bluestore_allocator_last);
+
+  b.add_time_avg(l_bluestore_allocator_alloc_process_lat,
+    "alloc_process_lat",
+    "Allocator processing latency",
+    "apl",
+    PerfCountersBuilder::PRIO_USEFUL);
+  b.add_time_avg(l_bluestore_allocator_lock_wait_lat,
+    "lock_wait_lat",
+    "Allocator lock wait latency",
+    "lwl",
+    PerfCountersBuilder::PRIO_USEFUL);
+
+  logger = b.create_perf_counters();
+
+  cct->get_perfcounters_collection()->add(logger);
+}
+void AllocatorPerf::_shutdown_logger() {
+  if (logger) {
+    cct->get_perfcounters_collection()->remove(logger);
+    delete logger;
+    logger = nullptr;
+  }
+}
diff --git a/src/os/bluestore/AllocatorBase.h b/src/os/bluestore/AllocatorBase.h
index eedf766dc80..dc567c3c2c9 100644
--- a/src/os/bluestore/AllocatorBase.h
+++ b/src/os/bluestore/AllocatorBase.h
@@ -19,6 +19,15 @@
 #include "bluestore_types.h"
 #include "common/ceph_mutex.h"
 #include "Allocator.h"
+#include "common/perf_counters.h"
+#include "common/perf_counters_collection.h"
+
+enum {
+  l_bluestore_allocator_first = 732300,
+  l_bluestore_allocator_alloc_process_lat,
+  l_bluestore_allocator_lock_wait_lat,
+  l_bluestore_allocator_last
+};
 
 class AllocatorBase : public Allocator {
 protected:
@@ -295,4 +304,24 @@ private:
   SocketHook* asok_hook = nullptr;
 };
 
+class AllocatorPerf {
+private:
+  CephContext* cct = nullptr;
+protected:
+  PerfCounters *logger = nullptr;
+public:
+  AllocatorPerf() = delete;
+  AllocatorPerf(CephContext* cct, std::string_view name)
+    : cct(cct)
+  {
+    _init_logger(name);
+  }
+  ~AllocatorPerf() {
+    _shutdown_logger();
+  }
+private:
+  void _init_logger(std::string_view name);
+  void _shutdown_logger();
+};
+
 #endif

From 3c1dacfb5acddfe5c582dec9803d8138997f58ee Mon Sep 17 00:00:00 2001
From: Jaya Prakash <jayaprakash@ibm.com>
Date: Tue, 16 Jun 2026 16:26:33 +0000
Subject: [PATCH 426/596] os/bluestore: measure allocator lock wait and
 processing latency

Fixes: https://tracker.ceph.com/issues/76936

Signed-off-by: Jaya Prakash <jayaprakash@ibm.com>
---
 src/os/bluestore/AvlAllocator.cc        | 17 ++++++++++++++++-
 src/os/bluestore/AvlAllocator.h         |  2 +-
 src/os/bluestore/Btree2Allocator.cc     | 17 ++++++++++++++++-
 src/os/bluestore/Btree2Allocator.h      |  2 +-
 src/os/bluestore/BtreeAllocator.cc      | 17 ++++++++++++++++-
 src/os/bluestore/BtreeAllocator.h       |  2 +-
 src/os/bluestore/HybridAllocator_impl.h | 10 ++++++++++
 src/os/bluestore/StupidAllocator.cc     | 13 +++++++++++++
 src/os/bluestore/StupidAllocator.h      |  2 +-
 9 files changed, 75 insertions(+), 7 deletions(-)

diff --git a/src/os/bluestore/AvlAllocator.cc b/src/os/bluestore/AvlAllocator.cc
index b6a0325b5eb..13d08a08821 100644
--- a/src/os/bluestore/AvlAllocator.cc
+++ b/src/os/bluestore/AvlAllocator.cc
@@ -368,6 +368,7 @@ AvlAllocator::AvlAllocator(CephContext* cct,
                            uint64_t max_mem,
                            std::string_view name) :
   AllocatorBase(name, device_size, block_size),
+  AllocatorPerf(cct, name),
   cct(cct),
   range_size_alloc_threshold(
     cct->_conf.get_val<uint64_t>("bluestore_avl_alloc_bf_threshold")),
@@ -421,8 +422,22 @@ int64_t AvlAllocator::allocate(
       max_alloc_size >= cap) {
     max_alloc_size = p2align(uint64_t(cap), (uint64_t)block_size);
   }
+  auto lock_wait_start = mono_clock::now();
+
   std::lock_guard l(lock);
-  return _allocate(want, unit, max_alloc_size, hint, extents);
+
+  auto lock_acquired = mono_clock::now();
+
+  auto ret = _allocate(want, unit, max_alloc_size, hint, extents);
+
+  logger->tinc_with_max(
+      l_bluestore_allocator_alloc_process_lat,
+      mono_clock::now() - lock_acquired);
+  logger->tinc_with_max(
+      l_bluestore_allocator_lock_wait_lat,
+      lock_acquired - lock_wait_start);
+
+  return ret;
 }
 
 void AvlAllocator::release(const release_set_t& release_set) {
diff --git a/src/os/bluestore/AvlAllocator.h b/src/os/bluestore/AvlAllocator.h
index b0a9fdd0cfb..c2c86acb204 100644
--- a/src/os/bluestore/AvlAllocator.h
+++ b/src/os/bluestore/AvlAllocator.h
@@ -50,7 +50,7 @@ struct range_seg_t {
   boost::intrusive::avl_set_member_hook<> size_hook;
 };
 
-class AvlAllocator : public AllocatorBase {
+class AvlAllocator : public AllocatorBase, public AllocatorPerf {
   struct dispose_rs {
     void operator()(range_seg_t* p)
     {
diff --git a/src/os/bluestore/Btree2Allocator.cc b/src/os/bluestore/Btree2Allocator.cc
index 2775c7347f6..7531f059852 100644
--- a/src/os/bluestore/Btree2Allocator.cc
+++ b/src/os/bluestore/Btree2Allocator.cc
@@ -24,6 +24,7 @@ Btree2Allocator::Btree2Allocator(CephContext* _cct,
   bool with_cache,
   std::string_view name) :
     AllocatorBase(name, device_size, block_size),
+    AllocatorPerf(_cct, name),
     myTraits(RANGE_SIZE_BUCKET_COUNT),
     cct(_cct),
     range_count_cap(max_mem / sizeof(range_seg_t))
@@ -90,8 +91,22 @@ int64_t Btree2Allocator::allocate(
     extents->emplace_back(cached_chunk_offs, want);
     return want;
   }
+  auto lock_wait_start = mono_clock::now();
+
   std::lock_guard l(lock);
-  return _allocate(want, unit, max_alloc_size, hint, extents);
+
+  auto lock_acquired = mono_clock::now();
+
+  auto ret = _allocate(want, unit, max_alloc_size, hint, extents);
+
+  logger->tinc_with_max(
+      l_bluestore_allocator_alloc_process_lat,
+      mono_clock::now() - lock_acquired);
+  logger->tinc_with_max(
+      l_bluestore_allocator_lock_wait_lat,
+      lock_acquired - lock_wait_start);
+
+  return ret;
 }
 
 void Btree2Allocator::release(const release_set_t& release_set)
diff --git a/src/os/bluestore/Btree2Allocator.h b/src/os/bluestore/Btree2Allocator.h
index 5aa5b5bee5c..6e6a54405b5 100644
--- a/src/os/bluestore/Btree2Allocator.h
+++ b/src/os/bluestore/Btree2Allocator.h
@@ -20,7 +20,7 @@
  *
  *
  */
-class Btree2Allocator : public AllocatorBase {
+class Btree2Allocator : public AllocatorBase, public AllocatorPerf {
   enum {
     RANGE_SIZE_BUCKET_COUNT = 14,
   };
diff --git a/src/os/bluestore/BtreeAllocator.cc b/src/os/bluestore/BtreeAllocator.cc
index 5a7ecc4ad10..629c7a07349 100644
--- a/src/os/bluestore/BtreeAllocator.cc
+++ b/src/os/bluestore/BtreeAllocator.cc
@@ -354,6 +354,7 @@ BtreeAllocator::BtreeAllocator(CephContext* cct,
 			       uint64_t max_mem,
 			       std::string_view name) :
   AllocatorBase(name, device_size, block_size),
+  AllocatorPerf(cct, name),
   range_size_alloc_threshold(
     cct->_conf.get_val<uint64_t>("bluestore_avl_alloc_bf_threshold")),
   range_size_alloc_free_pct(
@@ -397,8 +398,22 @@ int64_t BtreeAllocator::allocate(
       max_alloc_size >= cap) {
     max_alloc_size = p2align(uint64_t(cap), (uint64_t)block_size);
   }
+  auto lock_wait_start = mono_clock::now();
+
   std::lock_guard l(lock);
-  return _allocate(want, unit, max_alloc_size, hint, extents);
+
+  auto lock_acquired = mono_clock::now();
+
+  auto ret = _allocate(want, unit, max_alloc_size, hint, extents);
+
+  logger->tinc_with_max(
+      l_bluestore_allocator_alloc_process_lat,
+      mono_clock::now() - lock_acquired);
+  logger->tinc_with_max(
+      l_bluestore_allocator_lock_wait_lat,
+      lock_acquired - lock_wait_start);
+
+  return ret;
 }
 
 void BtreeAllocator::release(const interval_set<uint64_t>& release_set) {
diff --git a/src/os/bluestore/BtreeAllocator.h b/src/os/bluestore/BtreeAllocator.h
index d4328169bdd..897c06ec372 100644
--- a/src/os/bluestore/BtreeAllocator.h
+++ b/src/os/bluestore/BtreeAllocator.h
@@ -11,7 +11,7 @@
 #include "os/bluestore/bluestore_types.h"
 #include "include/mempool.h"
 
-class BtreeAllocator : public AllocatorBase {
+class BtreeAllocator : public AllocatorBase, public AllocatorPerf {
   struct range_seg_t {
     uint64_t start;   ///< starting offset of this segment
     uint64_t end;     ///< ending offset (non-inclusive)
diff --git a/src/os/bluestore/HybridAllocator_impl.h b/src/os/bluestore/HybridAllocator_impl.h
index 590ee49bb3e..6d1053abae4 100644
--- a/src/os/bluestore/HybridAllocator_impl.h
+++ b/src/os/bluestore/HybridAllocator_impl.h
@@ -35,8 +35,12 @@ int64_t HybridAllocatorBase<T>::allocate(
     max_alloc_size = p2align(uint64_t(cap), (uint64_t)T::get_block_size());
   }
 
+  auto lock_wait_start = mono_clock::now();
+
   std::lock_guard l(T::get_lock());
 
+  auto lock_acquired = mono_clock::now();
+
   // try bitmap first to avoid unneeded contiguous extents split if
   // desired amount is less than shortes range in AVL or Btree2
   bool primary_first = !(bmap_alloc &&
@@ -63,6 +67,12 @@ int64_t HybridAllocatorBase<T>::allocate(
       ceph_assert(orig_size == extents->size());
     }
   }
+  this->logger->tinc_with_max(
+      l_bluestore_allocator_alloc_process_lat,
+      mono_clock::now() - lock_acquired);
+  this->logger->tinc_with_max(
+      l_bluestore_allocator_lock_wait_lat,
+      lock_acquired - lock_wait_start);
   return res ? res : -ENOSPC;
 }
 
diff --git a/src/os/bluestore/StupidAllocator.cc b/src/os/bluestore/StupidAllocator.cc
index 1533cf29870..4b908cb7f5e 100644
--- a/src/os/bluestore/StupidAllocator.cc
+++ b/src/os/bluestore/StupidAllocator.cc
@@ -15,6 +15,7 @@ StupidAllocator::StupidAllocator(CephContext* cct,
                                  int64_t _block_size,
                                  std::string_view name)
   : AllocatorBase(name, capacity, _block_size),
+    AllocatorPerf(cct, name),
     cct(cct), num_free(0),
     free(10)
 {
@@ -56,7 +57,12 @@ int64_t StupidAllocator::allocate_int(
   uint64_t want_size, uint64_t alloc_unit, int64_t hint,
   uint64_t *offset, uint32_t *length)
 {
+  auto lock_wait_start = mono_clock::now();
+
   std::lock_guard l(lock);
+
+  auto lock_acquired = mono_clock::now();
+
   ldout(cct, 10) << __func__ << " want_size 0x" << std::hex << want_size
 	   	 << " alloc_unit 0x" << alloc_unit
 	   	 << " hint 0x" << hint << std::dec
@@ -164,6 +170,13 @@ int64_t StupidAllocator::allocate_int(
   num_free -= *length;
   ceph_assert(num_free >= 0);
   last_alloc = *offset + *length;
+
+  logger->tinc_with_max(
+      l_bluestore_allocator_alloc_process_lat,
+      mono_clock::now() - lock_acquired);
+  logger->tinc_with_max(
+      l_bluestore_allocator_lock_wait_lat,
+      lock_acquired - lock_wait_start);
   return 0;
 }
 
diff --git a/src/os/bluestore/StupidAllocator.h b/src/os/bluestore/StupidAllocator.h
index fe75e90bd9d..3f0af4efdb5 100644
--- a/src/os/bluestore/StupidAllocator.h
+++ b/src/os/bluestore/StupidAllocator.h
@@ -14,7 +14,7 @@
 #include "include/mempool.h"
 #include "common/ceph_mutex.h"
 
-class StupidAllocator : public AllocatorBase {
+class StupidAllocator : public AllocatorBase, public AllocatorPerf {
   CephContext* cct;
   ceph::mutex lock = ceph::make_mutex("StupidAllocator::lock");
 

From 1004a24ecaf344545522c577206215a7b8857716 Mon Sep 17 00:00:00 2001
From: Jaya Prakash <jayaprakash@ibm.com>
Date: Wed, 17 Jun 2026 12:47:38 +0000
Subject: [PATCH 427/596] os/bluestore: measure Bitmap allocator lock wait and
 processing latency

Fixes: https://tracker.ceph.com/issues/76936

Signed-off-by: Jaya Prakash <jayaprakash@ibm.com>
---
 src/os/bluestore/BitmapAllocator.cc           |  1 +
 src/os/bluestore/fastbmap_allocator_impl.h    | 25 ++++++++++++++++++-
 .../objectstore/fastbmap_allocator_test.cc    |  2 ++
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/os/bluestore/BitmapAllocator.cc b/src/os/bluestore/BitmapAllocator.cc
index 3ab43bea344..ec53216cf98 100644
--- a/src/os/bluestore/BitmapAllocator.cc
+++ b/src/os/bluestore/BitmapAllocator.cc
@@ -14,6 +14,7 @@ BitmapAllocator::BitmapAllocator(CephContext* _cct,
 					 int64_t alloc_unit,
 					 std::string_view name) :
     AllocatorBase(name, capacity, alloc_unit),
+    AllocatorLevel02<AllocatorLevel01Loose>(_cct, name),
     cct(_cct)
 {
   ldout(cct, 10) << __func__ << " 0x" << std::hex << capacity << "/"
diff --git a/src/os/bluestore/fastbmap_allocator_impl.h b/src/os/bluestore/fastbmap_allocator_impl.h
index fbf3fda0b32..2ae809ec431 100644
--- a/src/os/bluestore/fastbmap_allocator_impl.h
+++ b/src/os/bluestore/fastbmap_allocator_impl.h
@@ -15,6 +15,7 @@
 #include <vector>
 #include <algorithm>
 #include <mutex>
+#include <string_view>
 
 typedef uint64_t slot_t;
 
@@ -36,6 +37,7 @@ typedef std::vector<slot_t> slot_vector_t;
 #include "include/ceph_assert.h"
 #include "common/likely.h"
 #include "os/bluestore/bluestore_types.h"
+#include "AllocatorBase.h"
 #include "include/mempool.h"
 #include "common/ceph_mutex.h"
 
@@ -524,9 +526,13 @@ public:
 };
 
 template <class L1>
-class AllocatorLevel02 : public AllocatorLevel
+class AllocatorLevel02 : public AllocatorLevel, public AllocatorPerf
 {
 public:
+  AllocatorLevel02(CephContext* cct, std::string_view name)
+    : AllocatorPerf(cct, name)
+  {}
+
   uint64_t debug_get_free(uint64_t pos0 = 0, uint64_t pos1 = 0)
   {
     std::lock_guard l(lock);
@@ -720,9 +726,19 @@ protected:
 
     uint64_t l1_w = slots_per_slotset * l1._children_per_slot();
 
+    auto lock_wait_start = mono_clock::now();
+
     std::lock_guard l(lock);
 
+    auto lock_acquired = mono_clock::now();
+
     if (available < min_length) {
+      logger->tinc_with_max(
+        l_bluestore_allocator_alloc_process_lat,
+        mono_clock::now() - lock_acquired);
+      logger->tinc_with_max(
+        l_bluestore_allocator_lock_wait_lat,
+        lock_acquired - lock_wait_start);
       return;
     }
     if (hint != -1) {
@@ -783,6 +799,13 @@ protected:
     auto allocated_here = *allocated - prev_allocated;
     ceph_assert(available >= allocated_here);
     available -= allocated_here;
+
+    logger->tinc_with_max(
+      l_bluestore_allocator_alloc_process_lat,
+      mono_clock::now() - lock_acquired);
+    logger->tinc_with_max(
+      l_bluestore_allocator_lock_wait_lat,
+      lock_acquired - lock_wait_start);
   }
 
 #ifndef NON_CEPH_BUILD
diff --git a/src/test/objectstore/fastbmap_allocator_test.cc b/src/test/objectstore/fastbmap_allocator_test.cc
index 83babab567f..7cd8d6adb81 100644
--- a/src/test/objectstore/fastbmap_allocator_test.cc
+++ b/src/test/objectstore/fastbmap_allocator_test.cc
@@ -27,6 +27,8 @@ public:
 class TestAllocatorLevel02 : public AllocatorLevel02<AllocatorLevel01Loose>
 {
 public:
+  TestAllocatorLevel02()
+    : AllocatorLevel02(g_ceph_context, "bitmap-test") {}
   void init(uint64_t capacity, uint64_t alloc_unit)
   {
     _init(capacity, alloc_unit);

From 948de224df12b8b383460b86ba520b191dc275bc Mon Sep 17 00:00:00 2001
From: Nitzan Mordechai <nmordech@ibm.com>
Date: Mon, 8 Jun 2026 05:18:55 +0000
Subject: [PATCH 428/596] mgr: fix dispatch throttle bottleneck causing OSD
 connection timeouts

The mgr dispatch throttle (ms_dispatch_throttle_bytes, default 100MB)
was far smaller than the OSD throttle (mgr_osd_bytes, 512MB),
making the dispatch queue the effective bottleneck on large clusters.

When the dispatch queue fills, OSD connections stall waiting for
throttle space. These connections time out and reconnect, causing
connection churn and heap growth from repeated connection setup/teardown.
The MGR also falls behind on PG stats processing, leading to unknown
and inactive PGs.

Add mgr_dispatch_throttle_bytes (default 1GB) and a
Messenger::set_dispatch_throttle_size() API to configure it at init time.
The new default is sized to accommodate the sum of all per-type policy
throttles, ensuring the dispatch queue is never the bottleneck.

Fixes: https://tracker.ceph.com/issues/66310
Signed-off-by: Nitzan Mordechai <nmordech@ibm.com>
---
 doc/mgr/administrator.rst      |  4 ++--
 src/common/options/mgr.yaml.in | 18 +++++++++++++++++-
 src/mgr/DaemonServer.cc        |  2 ++
 src/msg/Messenger.h            |  7 +++++++
 src/msg/async/AsyncMessenger.h |  4 ++++
 5 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/doc/mgr/administrator.rst b/doc/mgr/administrator.rst
index 6d60e897b58..5b24ba60c70 100644
--- a/doc/mgr/administrator.rst
+++ b/doc/mgr/administrator.rst
@@ -161,9 +161,9 @@ The Manager automatically adjusts :confval:`mgr_stats_period` based on message q
 depth to prevent overload during high cluster activity. This feature is enabled by
 default and can be controlled with the following settings:
 
-- :confval:`mgr_stats_period_autotune` (boolean, default: true): Enable or disable
+- :confval:`mgr_stats_period_autotune` : Enable or disable
   automatic tuning of the stats period.
-- :confval:`mgr_stats_period_autotune_queue_threshold` (integer, default: 100):
+- :confval:`mgr_stats_period_autotune_queue_threshold` :
   The message queue depth threshold that triggers an increase in the stats period.
 
 When the queue depth exceeds this threshold, the stats period is increased to
diff --git a/src/common/options/mgr.yaml.in b/src/common/options/mgr.yaml.in
index b9fa2a9b0c3..4c3e65229df 100644
--- a/src/common/options/mgr.yaml.in
+++ b/src/common/options/mgr.yaml.in
@@ -56,12 +56,28 @@ options:
   long_desc: When mgr_stats_period_autotune is enabled, the Manager will increase
     the stats reporting period if the incoming message queue exceeds this threshold.
     Higher values make the system less sensitive to temporary queue spikes but may
-    allow longer periods of Manager overload.
+    allow longer periods of Manager overload. Should be well below the smallest
+    of mgr_mon_messages, mgr_mds_messages, and mgr_osd_messages so the autotune
+    fires before any per-connection throttle saturates.
   default: 100
   services:
   - mgr
   see_also:
   - mgr_stats_period
+- name: mgr_dispatch_throttle_bytes
+  type: size
+  level: advanced
+  desc: Limit total size of messages waiting in the mgr dispatch queue
+  long_desc: Sets the maximum total bytes of messages queued in the mgr dispatch
+    throttle. Overrides ms_dispatch_throttle_bytes for the mgr process. Should be
+    set to at least the sum of all per-type byte throttles (mgr_osd_bytes +
+    mgr_mds_bytes + mgr_client_bytes) to avoid the dispatch queue becoming a
+    bottleneck before per-connection throttles engage.
+  default: 1_G
+  services:
+  - mgr
+  see_also:
+  - ms_dispatch_throttle_bytes
 - name: mgr_client_bytes
   type: size
   level: dev
diff --git a/src/mgr/DaemonServer.cc b/src/mgr/DaemonServer.cc
index a7ddac0868d..822b508cbd9 100644
--- a/src/mgr/DaemonServer.cc
+++ b/src/mgr/DaemonServer.cc
@@ -176,6 +176,8 @@ int DaemonServer::init(uint64_t gid, entity_addrvec_t client_addrs)
 			   entity_name_t::MGR(gid),
 			   "mgr",
 			   Messenger::get_random_nonce());
+  msgr->set_dispatch_throttle_size(
+      g_conf().get_val<Option::size_t>("mgr_dispatch_throttle_bytes"));
   msgr->set_default_policy(Messenger::Policy::stateless_server(0));
   // throttle policy
   msgr->set_policy(entity_name_t::TYPE_OSD,
diff --git a/src/msg/Messenger.h b/src/msg/Messenger.h
index 8dc49e2483c..88c84ea9069 100644
--- a/src/msg/Messenger.h
+++ b/src/msg/Messenger.h
@@ -373,6 +373,13 @@ public:
    * you must not destroy them before you destroy the Messenger.
    */
   virtual void set_policy_throttlers(int type, Throttle *bytes, Throttle *msgs=NULL) = 0;
+  /**
+   * set the maximum size of the dispatch queue throttle
+   *
+   * This is an init-time function and must be called *before* calling
+   * start().
+   */
+  virtual void set_dispatch_throttle_size(uint64_t size) {}
   /**
    * set the default send priority
    *
diff --git a/src/msg/async/AsyncMessenger.h b/src/msg/async/AsyncMessenger.h
index 3edbe00dcad..53ba370c4ef 100644
--- a/src/msg/async/AsyncMessenger.h
+++ b/src/msg/async/AsyncMessenger.h
@@ -125,6 +125,10 @@ public:
   double get_dispatch_queue_max_age(utime_t now) const override {
     return dispatch_queue.get_max_age(now);
   }
+
+  void set_dispatch_throttle_size(uint64_t size) override {
+    dispatch_queue.dispatch_throttler.reset_max(size);
+  }
   /** @} Accessors */
 
   /**

From 1874a4410c01abc43a544fc658dd147a7dd31def Mon Sep 17 00:00:00 2001
From: Gil Bregman <gbregman@il.ibm.com>
Date: Thu, 25 Jun 2026 17:33:21 +0300
Subject: [PATCH 429/596] nvmeof: Change the NVMEOF image version to 1.9 Fixes:
 https://tracker.ceph.com/issues/77709

Signed-off-by: Gil Bregman <gbregman@il.ibm.com>
---
 src/python-common/ceph/cephadm/images.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/python-common/ceph/cephadm/images.py b/src/python-common/ceph/cephadm/images.py
index 1c1e5b54a02..86c3f3d6365 100644
--- a/src/python-common/ceph/cephadm/images.py
+++ b/src/python-common/ceph/cephadm/images.py
@@ -39,7 +39,7 @@ class DefaultImages(Enum):
     GRAFANA = _create_image('quay.io/ceph/grafana:12.3.1', 'grafana')
     HAPROXY = _create_image('quay.io/ceph/haproxy:2.3', 'haproxy')
     KEEPALIVED = _create_image('quay.io/ceph/keepalived:2.2.4', 'keepalived')
-    NVMEOF = _create_image('quay.io/ceph/nvmeof:1.8', 'nvmeof')
+    NVMEOF = _create_image('quay.io/ceph/nvmeof:1.9', 'nvmeof')
     SNMP_GATEWAY = _create_image(
         'docker.io/maxwo/snmp-notifier:v1.2.1', 'snmp_gateway'
     )

From 6da208dec17c6f325f5d2711d7ca2dd3a34f7d86 Mon Sep 17 00:00:00 2001
From: Shweta Sodani <ssodani@redhat.com>
Date: Mon, 20 Apr 2026 14:33:15 +0530
Subject: [PATCH 430/596] mgr/smb: Add RGWStorage resource class and update
 Share to support RGW

- Add RGWStorage component class for RGW bucket storage backend
- Include fields: bucket, user_id, access_key_id, secret_access_key
- Add password conversion support for credentials
- Update Share class to accept optional rgw field and added convert
  defination
- Update Share validation to support both cephfs and rgw backends
- Ensure exactly one storage backend (cephfs or rgw) is specified

This is the first step in implementing RGW storage support for SMB
shares, similar to the existing NFS RGW export functionality.

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/smb/resources.py | 69 +++++++++++++++++++++++++++++++--
 1 file changed, 66 insertions(+), 3 deletions(-)

diff --git a/src/pybind/mgr/smb/resources.py b/src/pybind/mgr/smb/resources.py
index 2956703e68e..118a40fa813 100644
--- a/src/pybind/mgr/smb/resources.py
+++ b/src/pybind/mgr/smb/resources.py
@@ -400,6 +400,44 @@ class LoginAccessEntry(_RBase):
         validation.check_access_name(self.name)
 
 
+@resourcelib.component()
+class RGWStorage(_RBase):
+    """Description of where in an RGW bucket a share is located."""
+
+    bucket: str
+    user_id: Optional[str] = None
+    access_key_id: Optional[str] = None
+    secret_access_key: Optional[str] = None
+
+    def validate(self) -> None:
+        if not self.bucket:
+            raise ValueError('bucket requires a value')
+
+    def convert(self, operation: ConversionOp) -> Self:
+        """Convert password fields based on the operation."""
+        return self.__class__(
+            bucket=self.bucket,
+            user_id=self.user_id,
+            access_key_id=(
+                _password_convert(self.access_key_id, operation)
+                if self.access_key_id
+                else None
+            ),
+            secret_access_key=(
+                _password_convert(self.secret_access_key, operation)
+                if self.secret_access_key
+                else None
+            ),
+        )
+
+    @resourcelib.customize
+    def _customize_resource(rc: resourcelib.Resource) -> resourcelib.Resource:
+        rc.user_id.quiet = True
+        rc.access_key_id.quiet = True
+        rc.secret_access_key.quiet = True
+        return rc
+
+
 @resourcelib.component()
 class HostAccessEntry(_RBase):
     access: HostAccess
@@ -461,6 +499,7 @@ class Share(_RBase):
     comment: Optional[str] = None
     max_connections: Optional[int] = None
     cephfs: Optional[CephFSStorage] = None
+    rgw: Optional[RGWStorage] = None
     custom_smb_share_options: Optional[Dict[str, str]] = None
     login_control: Optional[List[LoginAccessEntry]] = None
     restrict_access: bool = False
@@ -481,9 +520,14 @@ class Share(_RBase):
         validation.check_share_name(self.name)
         if self.intent != Intent.PRESENT:
             raise ValueError('Share must have present intent')
-        # currently only cephfs is supported
-        if self.cephfs is None:
-            raise ValueError('a cephfs configuration is required')
+        # Ensure exactly one storage backend is specified
+        storage_count = len([b for b in (self.cephfs, self.rgw) if b])
+        if storage_count == 0:
+            raise ValueError(
+                'a storage configuration is required (cephfs or rgw)'
+            )
+        if storage_count > 1:
+            raise ValueError('only one storage backend can be specified')
         if self.max_connections is not None and self.max_connections < 0:
             raise ValueError(
                 'max_connections must be 0 or a non-negative integer'
@@ -501,6 +545,25 @@ class Share(_RBase):
         """Return the .cephfs storage object or raise ValueError if None."""
         return checked(self.cephfs)
 
+    def convert(self, operation: ConversionOp) -> Self:
+        """Convert password fields in nested storage components."""
+        return self.__class__(
+            cluster_id=self.cluster_id,
+            share_id=self.share_id,
+            intent=self.intent,
+            name=self.name,
+            readonly=self.readonly,
+            browseable=self.browseable,
+            comment=self.comment,
+            max_connections=self.max_connections,
+            cephfs=self.cephfs.convert(operation) if self.cephfs else None,
+            rgw=self.rgw.convert(operation) if self.rgw else None,
+            custom_smb_share_options=self.custom_smb_share_options,
+            login_control=self.login_control,
+            restrict_access=self.restrict_access,
+            hosts_access=self.hosts_access,
+        )
+
     @resourcelib.customize
     def _customize_resource(rc: resourcelib.Resource) -> resourcelib.Resource:
         rc.restrict_access.quiet = True

From 9b4fbb3f2264ba94aac0d7c56bdefa54a36a9e26 Mon Sep 17 00:00:00 2001
From: Shweta Sodani <ssodani@redhat.com>
Date: Mon, 20 Apr 2026 14:37:54 +0530
Subject: [PATCH 431/596] mgr/smb: Add RGW credential management utilities

- Add rgw.py module for RGW integration
- Implement fetch_rgw_credentials() to get user credentials from radosgw-admin
- Implement validate_rgw_bucket() to check bucket existence
- Handle bucket owner lookup when user_id not provided
- Add proper error handling and logging

This provides the foundation for RGW authentication in SMB shares,
similar to the NFS RGW export implementation.

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/smb/rgw.py | 153 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 153 insertions(+)
 create mode 100644 src/pybind/mgr/smb/rgw.py

diff --git a/src/pybind/mgr/smb/rgw.py b/src/pybind/mgr/smb/rgw.py
new file mode 100644
index 00000000000..a722a8afe1d
--- /dev/null
+++ b/src/pybind/mgr/smb/rgw.py
@@ -0,0 +1,153 @@
+"""Utilities for RGW integration with SMB."""
+
+from typing import Protocol, Tuple, runtime_checkable
+
+import json
+import logging
+
+log = logging.getLogger(__name__)
+
+
+@runtime_checkable
+class ToolExecer(Protocol):
+    """Protocol for executing tools (e.g., radosgw-admin)."""
+
+    def tool_exec(self, cmd: list[str]) -> Tuple[int, str, str]:
+        """Execute a tool and return (return_code, stdout, stderr)."""
+        ...
+
+
+def _fetch_bucket_stats(executor: ToolExecer, bucket: str) -> dict:
+    """
+    Fetch RGW bucket statistics.
+    Args:
+        executor: Any object with tool_exec() method
+        bucket: The RGW bucket name
+    Returns:
+        Parsed JSON bucket stats dictionary
+    Raises:
+        ValueError: If bucket stats cannot be fetched or parsed
+    """
+    log.debug(f"Fetching stats for bucket {bucket}")
+    ret, out, err = executor.tool_exec(
+        ['radosgw-admin', 'bucket', 'stats', '--bucket', bucket]
+    )
+    if ret:
+        raise ValueError(f'Failed to fetch stats for bucket {bucket}: {err}')
+
+    try:
+        return json.loads(out)
+    except json.JSONDecodeError as e:
+        raise ValueError(f'Failed to parse bucket stats for {bucket}: {e}')
+
+
+def _get_rgw_owner(executor: ToolExecer, bucket: str) -> str:
+    """
+    Fetch RGW user bucket owner.
+    Args:
+        executor: Any object with tool_exec() method
+        bucket: The RGW bucket name
+    Returns:
+        user_id: RGW user ID that owns bucket.
+    Raises:
+        ValueError: If bucket owner cannot be determined
+    """
+
+    try:
+        stats = _fetch_bucket_stats(executor, bucket)
+        user_id = stats.get('owner', '')
+        if not user_id:
+            raise ValueError(f'No owner found for bucket {bucket}')
+
+        log.debug(f"Bucket {bucket} is owned by user {user_id}")
+        return user_id
+
+    except ValueError:
+        raise
+
+
+def _get_rgw_creds(executor: ToolExecer, user_id: str) -> Tuple[str, str]:
+    """
+    Fetch RGW user credentials.
+    Args:
+        executor: Any object with tool_exec() method
+        user_id: The RGW user ID
+    Returns:
+        Tuple of (access_key_id, secret_access_key)
+    Raises:
+        ValueError: If credentials cannot be fetched
+    """
+    log.debug(f"Fetching credentials for user {user_id}")
+    ret, out, err = executor.tool_exec(
+        ['radosgw-admin', 'user', 'info', '--uid', user_id]
+    )
+    if ret:
+        raise ValueError(
+            f'Failed to fetch credentials for user {user_id}: {err}'
+        )
+
+    try:
+        j = json.loads(out)
+        keys = j.get('keys', [])
+        if not keys:
+            raise ValueError(f'No keys found for user {user_id}')
+
+        access_key = keys[0].get('access_key', '')
+        secret_key = keys[0].get('secret_key', '')
+
+        if not access_key or not secret_key:
+            raise ValueError(
+                f'Invalid credentials for user {user_id}: '
+                f'access_key={bool(access_key)}, secret_key={bool(secret_key)}'
+            )
+
+        log.debug(f"Successfully fetched credentials for user {user_id}")
+        return access_key, secret_key
+
+    except (json.JSONDecodeError, KeyError, IndexError) as e:
+        raise ValueError(f'Failed to parse user info for {user_id}: {e}')
+
+
+def fetch_rgw_credentials(
+    executor: ToolExecer,
+    bucket: str,
+    user_id: str = '',
+) -> Tuple[str, str, str]:
+    """
+    Fetch RGW user credentials for a bucket.
+
+    Args:
+        executor: Any object with tool_exec() method
+        bucket: The RGW bucket name
+        user_id: Optional RGW user ID. If not provided, fetches bucket owner.
+
+    Returns:
+        Tuple of (user_id, access_key_id, secret_access_key)
+
+    Raises:
+        ValueError: If bucket owner cannot be determined or credentials not found
+    """
+    if not user_id:
+        user_id = _get_rgw_owner(executor, bucket)
+
+    access_key, secret_key = _get_rgw_creds(executor, user_id)
+    return user_id, access_key, secret_key
+
+
+def validate_rgw_bucket(executor: ToolExecer, bucket: str) -> bool:
+    """
+    Validate that an RGW bucket exists.
+    Args:
+        executor: Any object with tool_exec() method
+        bucket: The RGW bucket name
+    Returns:
+        True if bucket exists, False otherwise
+    """
+    log.debug(f"Validating bucket {bucket}")
+    try:
+        stats = _fetch_bucket_stats(executor, bucket)
+        # If we can parse the output and it has an owner, bucket exists
+        return bool(stats.get('owner'))
+    except ValueError as e:
+        log.debug(f"Bucket {bucket} validation failed: {e}")
+        return False

From 6a3f3103a8a7498a41c8a90e27952d7e483da11b Mon Sep 17 00:00:00 2001
From: Shweta Sodani <ssodani@redhat.com>
Date: Mon, 20 Apr 2026 14:44:01 +0530
Subject: [PATCH 432/596] mgr/smb: Add CLI command for RGW share creation

- Add 'smb share create rgw' CLI command
- Import rgw module for credential management
- Fetch RGW credentials using radosgw-admin
- Create Share resource with RGWStorage backend
- Handle errors from credential fetching

This enables users to create SMB shares backed by RGW buckets,
similar to 'nfs export create rgw' functionality.

Example usage:
  ceph smb share create rgw mysmb share1 mybucket

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/smb/module.py | 44 ++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/src/pybind/mgr/smb/module.py b/src/pybind/mgr/smb/module.py
index 9badbe57460..185d1b1718d 100644
--- a/src/pybind/mgr/smb/module.py
+++ b/src/pybind/mgr/smb/module.py
@@ -25,6 +25,7 @@ from . import (
     rados_store,
     resources,
     results,
+    rgw,
     sqlite_store,
     utils,
 )
@@ -101,6 +102,7 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             authorizer=authorizer,
             orch=self._orch_backend(enable_orch=uo),
             earmark_resolver=earmark_resolver,
+            tool_execer=self,
         )
 
     def _backend_store(self, store_conf: str = '') -> ConfigStore:
@@ -615,6 +617,48 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             if cid == cluster_id
         ]
 
+    @SMBCLICommand('share create rgw', perm='rw')
+    def share_create_rgw(
+        self,
+        cluster_id: str,
+        share_id: str,
+        bucket: str,
+        share_name: str = '',
+        user_id: str = '',
+        readonly: bool = False,
+    ) -> results.Result:
+        """Create an SMB share backed by RGW"""
+        try:
+            # Pass 'self' which conforms to ToolExecer protocol
+            (
+                fetched_user_id,
+                access_key,
+                secret_key,
+            ) = rgw.fetch_rgw_credentials(self, bucket, user_id)
+
+            share = resources.Share(
+                cluster_id=cluster_id,
+                share_id=share_id,
+                name=share_name or share_id,
+                readonly=readonly,
+                rgw=resources.RGWStorage(
+                    bucket=bucket,
+                    user_id=fetched_user_id,
+                    access_key_id=access_key,
+                    secret_access_key=secret_key,
+                ),
+            )
+            return self._apply_res([share], create_only=True).one()
+        except ValueError as e:
+            # Create a minimal share resource for error reporting
+            error_share = resources.Share(
+                cluster_id=cluster_id,
+                share_id=share_id,
+                name=share_name or share_id,
+                rgw=resources.RGWStorage(bucket='error'),
+            )
+            return results.ErrorResult(error_share, msg=str(e))
+
     @SMBCLICommand('share create', perm='rw')
     def share_create(
         self,

From d317e318592922f803de41b16929f6c7483ebcce Mon Sep 17 00:00:00 2001
From: Shweta Sodani <ssodani@redhat.com>
Date: Mon, 20 Apr 2026 14:47:35 +0530
Subject: [PATCH 433/596] mgr/smb: Update handler to process RGW shares, added
 validation and error handling

- Add _generate_rgw_share() function for RGW share configuration
- Skip CephFS authorization for RGW shares in cluster assembly
- Configure Samba VFS with RGW-specific parameters:
  - rgw_bucket, rgw_user_id, rgw_access_key, rgw_secret_key
- Validate bucket accessibility using radosgw-admin
- Ensure proper error handling in share creation flow

This enables the handler to generate proper Samba configuration for
RGW-backed shares along with validation and error handling.

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/smb/external.py |   5 +
 src/pybind/mgr/smb/handler.py  | 215 ++++++++++++++++++++++++++++++---
 src/pybind/mgr/smb/staging.py  |  62 +++++++++-
 3 files changed, 262 insertions(+), 20 deletions(-)

diff --git a/src/pybind/mgr/smb/external.py b/src/pybind/mgr/smb/external.py
index 412efbb4c0c..8937411e28d 100644
--- a/src/pybind/mgr/smb/external.py
+++ b/src/pybind/mgr/smb/external.py
@@ -49,6 +49,11 @@ def spec_backup_key(cluster_id: str) -> EntryKey:
     return (cluster_id, 'spec.smb')
 
 
+def rgw_credentials_key(cluster_id: str, share_id: str) -> EntryKey:
+    """Return key identifying RGW credentials for a share in an external store."""
+    return (cluster_id, f'rgw-creds.{share_id}.json')
+
+
 def tls_credential_key(
     cluster_id: str, tls_credential_id: str, cred_type: str
 ) -> EntryKey:
diff --git a/src/pybind/mgr/smb/handler.py b/src/pybind/mgr/smb/handler.py
index 10364024181..dc72afa880d 100644
--- a/src/pybind/mgr/smb/handler.py
+++ b/src/pybind/mgr/smb/handler.py
@@ -27,7 +27,7 @@ from ceph.deployment.service_spec import (
 )
 from ceph.fs.earmarking import EarmarkTopScope
 
-from . import config_store, external, resources
+from . import config_store, external, resources, rgw
 from .enums import (
     AuthMode,
     CephFSStorageProvider,
@@ -318,6 +318,7 @@ class ClusterConfigHandler:
         authorizer: Optional[AccessAuthorizer] = None,
         orch: Optional[OrchSubmitter] = None,
         earmark_resolver: Optional[EarmarkResolver] = None,
+        tool_execer: 'rgw.ToolExecer',
     ) -> None:
         self.internal_store = internal_store
         self.public_store = public_store
@@ -332,6 +333,7 @@ class ClusterConfigHandler:
         if earmark_resolver is None:
             earmark_resolver = cast(EarmarkResolver, _FakeEarmarkResolver())
         self._earmark_resolver = earmark_resolver
+        self._tool_execer = tool_execer
         log.info(
             'Initialized new ClusterConfigHandler with'
             f' internal store {self.internal_store!r},'
@@ -351,7 +353,7 @@ class ClusterConfigHandler:
         """
         log.debug('applying changes to internal data store')
         results = ResultGroup()
-        staging = Staging(self.internal_store)
+        staging = Staging(self.internal_store, self._tool_execer)
         try:
             incoming = order_resources(inputs)
             for resource in incoming:
@@ -639,18 +641,43 @@ class ClusterConfigHandler:
         assert isinstance(cluster, resources.Cluster)
         # vols: hold the cephfs volumes our shares touch. some operations are
         # disabled/skipped unless we touch volumes.
-        vols = {share.checked_cephfs.volume for share in change_group.shares}
+        vols = {
+            share.checked_cephfs.volume
+            for share in change_group.shares
+            if share.cephfs is not None
+        }
+        # rgw_buckets: hold the RGW buckets our shares touch
+        rgw_buckets = {
+            share.rgw.bucket
+            for share in change_group.shares
+            if share.rgw is not None
+        }
         # save the various object types
         previous_info = _swap_pending_cluster_info(
             self.public_store,
             change_group,
-            orch_needed=bool(vols and self._orch),
+            orch_needed=bool((vols or rgw_buckets) and self._orch),
         )
         _save_pending_join_auths(self.priv_store, change_group)
         _save_pending_users_and_groups(self.priv_store, change_group)
         _save_pending_tls_credentials(self.priv_store, change_group)
+        _save_pending_rgw_credentials(self.priv_store, change_group)
+        rgw_credential_entries = {
+            share.share_id: change_group.cache[
+                external.rgw_credentials_key(
+                    change_group.cluster.cluster_id, share.share_id
+                )
+            ]
+            for share in change_group.shares
+            if share.rgw is not None
+            and share.rgw.access_key_id
+            and share.rgw.secret_access_key
+        }
         cluster_conf = _ClusterConf.assemble(
-            change_group, self._path_resolver, self._authorizer
+            change_group,
+            self._path_resolver,
+            self._authorizer,
+            rgw_credential_entries,
         )
         _save_pending_config(self.public_store, cluster_conf)
         # remove any stray objects
@@ -689,6 +716,17 @@ class ClusterConfigHandler:
             ]
             for tc in change_group.tls_credentials
         }
+        rgw_credential_entries = {
+            share.share_id: change_group.cache[
+                external.rgw_credentials_key(
+                    cluster.cluster_id, share.share_id
+                )
+            ]
+            for share in change_group.shares
+            if share.rgw is not None
+            and share.rgw.access_key_id
+            and share.rgw.secret_access_key
+        }
         ext_ceph_cluster = None
         if change_group.ext_ceph_clusters:
             assert len(change_group.ext_ceph_clusters) == 1
@@ -713,9 +751,31 @@ class ClusterConfigHandler:
         # via orch.  This differs from NFS because ganesha embeds the cephx
         # keys directly in each export definition block while samba needs the
         # ceph keyring to load keys.
+        # For RGW shares, we don't need CephFS volumes but still need orchestration.
         previous_orch = previous_info.get('orch_needed', False)
-        if self._orch and (vols or previous_orch):
+        if self._orch and (vols or rgw_buckets or previous_orch):
+            log.debug(
+                'Submitting SMB service spec for cluster %s: '
+                'shares=%d (cephfs_vols=%d, rgw_buckets=%d), '
+                'previous_orch=%s',
+                cluster.cluster_id,
+                len(change_group.shares),
+                len(vols),
+                len(rgw_buckets),
+                previous_orch,
+            )
             self._orch.submit_smb_spec(smb_spec)
+        else:
+            log.debug(
+                'Skipping SMB service orchestration for cluster %s: '
+                'orch_enabled=%s, shares=%d, cephfs_vols=%d, rgw_buckets=%d, previous_orch=%s',
+                cluster.cluster_id,
+                bool(self._orch),
+                len(change_group.shares),
+                len(vols),
+                len(rgw_buckets),
+                previous_orch,
+            )
 
     def _remove_cluster(self, cluster_id: str) -> None:
         log.info('Removing cluster: %s', cluster_id)
@@ -770,6 +830,8 @@ class _ShareConf:
     resolver: PathResolver
     cephx_entity: str
     ceph_cluster: str
+    rgw_access_key_uri: Optional[str] = None
+    rgw_secret_key_uri: Optional[str] = None
 
 
 @dataclasses.dataclass(frozen=True)
@@ -785,6 +847,7 @@ class _ClusterConf:
         change_group: ClusterChangeGroup,
         default_resolver: PathResolver,
         authorizer: AccessAuthorizer,
+        rgw_credential_entries: Dict[str, ConfigEntry],
     ) -> Self:
         extcc = None
         assert isinstance(change_group.cluster, resources.Cluster)
@@ -802,25 +865,36 @@ class _ClusterConf:
             ceph_cluster = 'exo'
             cephx_entity = checked(extcc.cluster).cephfs_user.name
         elif change_group.shares:
-            log.debug('local ceph cluster with shares')
-            cephx_entity = _cephx_data_entity(change_group.cluster)
-            # ensure an entity exists with access to the volumes
-            for share in change_group.shares:
-                authorizer.authorize_entity(
-                    share.checked_cephfs.volume, cephx_entity
+            # Check if we have any CephFS shares that need CephX auth
+            has_cephfs_shares = any(
+                s.cephfs is not None for s in change_group.shares
+            )
+            if has_cephfs_shares:
+                log.debug('local ceph cluster with CephFS shares')
+                cephx_entity = _cephx_data_entity(change_group.cluster)
+                # ensure an entity exists with access to the volumes (CephFS only)
+                for share in change_group.shares:
+                    if share.cephfs:
+                        authorizer.authorize_entity(
+                            share.checked_cephfs.volume, cephx_entity
+                        )
+                cephadm_data_entity = cephx_entity
+            else:
+                log.debug(
+                    'local ceph cluster with RGW shares only (no CephX auth needed)'
                 )
-            cephadm_data_entity = cephx_entity
         else:
             log.debug('local cluster without shares: skipping ceph auth')
         return cls(
             change_group.cluster,
             [
-                _ShareConf(
+                _make_share_conf(
                     s,
                     change_group.cluster,
                     resolver,
                     cephx_entity,
                     ceph_cluster,
+                    rgw_credential_entries,
                 )
                 for s in change_group.shares
             ],
@@ -829,6 +903,80 @@ class _ClusterConf:
         )
 
 
+def _make_share_conf(
+    s: resources.Share,
+    cluster: resources.Cluster,
+    resolver: PathResolver,
+    cephx_entity: str,
+    ceph_cluster: str,
+    rgw_credential_entries: Dict[str, ConfigEntry],
+) -> _ShareConf:
+    creds_entry = rgw_credential_entries.get(s.share_id)
+    # Get the URI from the ConfigEntry object, not from the data
+    access_key_uri = (
+        f'URI:{creds_entry.uri}:access_key_id' if creds_entry else None
+    )
+    secret_key_uri = (
+        f'URI:{creds_entry.uri}:secret_access_key' if creds_entry else None
+    )
+    return _ShareConf(
+        s,
+        cluster,
+        resolver,
+        cephx_entity,
+        ceph_cluster,
+        rgw_access_key_uri=access_key_uri,
+        rgw_secret_key_uri=secret_key_uri,
+    )
+
+
+def _generate_rgw_share(
+    conf: _ShareConf,
+) -> Dict[str, Dict[str, str]]:
+    """Generate Samba configuration for an RGW-backed share."""
+    share = conf.resource
+    rgw = share.rgw
+    assert rgw is not None, "RGW storage configuration missing"
+
+    # Use URI-based credential references (already formatted in _make_share_conf)
+    access_key_uri = conf.rgw_access_key_uri or ''
+    secret_key_uri = conf.rgw_secret_key_uri or ''
+
+    cfg = {
+        # smb.conf options
+        'options': {
+            'path': '/',
+            'vfs objects': 'ceph_rgw',
+            'ceph_rgw:config_file': '/etc/ceph/ceph.conf',
+            'ceph_rgw:keyring_file': '/etc/ceph/ceph.client.admin.keyring',
+            'ceph_rgw:bucket': rgw.bucket,
+            'ceph_rgw:user_id': rgw.user_id or '',
+            'ceph_rgw:access_key': access_key_uri,
+            'ceph_rgw:secret_access_key': secret_key_uri,
+            'ceph_rgw:debug': 'off',
+            'read only': ynbool(share.readonly),
+            'browseable': ynbool(share.browseable),
+            'kernel share modes': 'no',
+            'smbd profiling share': 'yes',
+        }
+    }
+
+    if share.comment is not None:
+        cfg['options']['comment'] = share.comment
+    if share.max_connections is not None:
+        cfg['options']['max connections'] = str(share.max_connections)
+
+    # extend share with user+group login access lists
+    _generate_share_login_control(share, cfg)
+    _generate_share_hosts_access(share, cfg)
+    # extend share with custom options
+    custom_opts = share.cleaned_custom_smb_share_options
+    if custom_opts:
+        cfg['options'].update(custom_opts)
+        cfg['options']['x:ceph:has_custom_options'] = 'yes'
+    return cfg
+
+
 def _generate_share(conf: _ShareConf) -> Dict[str, Dict[str, str]]:
     share = conf.resource
     cephx_entity = conf.cephx_entity
@@ -1009,7 +1157,12 @@ def _generate_config(conf: _ClusterConf) -> Dict[str, Any]:
     _set_debug_level(cluster_global_opts, conf)
 
     share_configs = {
-        share.resource.name: _generate_share(share) for share in conf.shares
+        share.resource.name: (
+            _generate_rgw_share(share)
+            if share.resource.rgw
+            else _generate_share(share)
+        )
+        for share in conf.shares
     }
 
     instance_features = []
@@ -1309,6 +1462,31 @@ def _save_pending_tls_credentials(
         change_group.cache_updated_entry(tc_entry)
 
 
+def _save_pending_rgw_credentials(
+    store: ConfigStore,
+    change_group: ClusterChangeGroup,
+) -> None:
+    """Save RGW credentials for shares in the priv store."""
+    cluster = change_group.cluster
+    assert isinstance(cluster, resources.Cluster)
+
+    # Save credentials for each RGW share
+    for share in change_group.shares:
+        if share.rgw is not None:
+            # Only save if credentials are present
+            if share.rgw.access_key_id and share.rgw.secret_access_key:
+                ext_key = external.rgw_credentials_key(
+                    cluster.cluster_id, share.share_id
+                )
+                creds_entry = store[ext_key]
+                creds_data = {
+                    'access_key_id': share.rgw.access_key_id,
+                    'secret_access_key': share.rgw.secret_access_key,
+                }
+                creds_entry.set(creds_data)
+                change_group.cache_updated_entry(creds_entry)
+
+
 def _save_pending_config(
     store: ConfigStore,
     cluster_conf: _ClusterConf,
@@ -1350,11 +1528,12 @@ def _store_transaction(store: ConfigStore) -> Iterator[None]:
 
 
 def _has_proxied_vfs(change_group: ClusterChangeGroup) -> bool:
-    """Return true if any shares in the change group use the new vfs module
-    with the proxied cephfs library.
+    """Return true if any CephFS-backed shares in the change group use the
+    new vfs module with the proxied cephfs library.
     """
     return any(
-        s.checked_cephfs.provider.expand()
+        s.cephfs is not None
+        and s.checked_cephfs.provider.expand()
         == CephFSStorageProvider.SAMBA_VFS_PROXIED
         for s in change_group.shares
     )
diff --git a/src/pybind/mgr/smb/staging.py b/src/pybind/mgr/smb/staging.py
index eda1c02b01a..aceb776cbfe 100644
--- a/src/pybind/mgr/smb/staging.py
+++ b/src/pybind/mgr/smb/staging.py
@@ -15,7 +15,7 @@ import operator
 
 from ceph.fs.earmarking import EarmarkTopScope
 
-from . import config_store, resources
+from . import config_store, resources, rgw
 from .enums import (
     AuthMode,
     ConfigNS,
@@ -54,8 +54,9 @@ class Staging:
     the destination store.
     """
 
-    def __init__(self, store: ConfigStore) -> None:
+    def __init__(self, store: ConfigStore, tool_exec: rgw.ToolExecer) -> None:
         self.destination_store = store
+        self._tool_execer = tool_exec
         self.incoming: Dict[EntryKey, SMBResource] = {}
         self.deleted: Dict[EntryKey, SMBResource] = {}
         self._store_keycache: Set[EntryKey] = set()
@@ -358,6 +359,63 @@ def _check_share_resource(
             msg="no matching cluster id",
             status={"cluster_id": share.cluster_id},
         )
+
+    # Handle RGW shares - validate bucket existence and auto-fetch credentials
+    if share.rgw is not None:
+        # Validate bucket exists
+        if not rgw.validate_rgw_bucket(
+            staging._tool_execer, share.rgw.bucket
+        ):
+            raise ErrorResult(
+                share,
+                msg=f"RGW bucket '{share.rgw.bucket}' does not exist or is not accessible",
+            )
+
+        # Auto-fetch credentials if not provided
+        if (
+            not share.rgw.user_id
+            or not share.rgw.access_key_id
+            or not share.rgw.secret_access_key
+        ):
+            try:
+                log.debug(
+                    f"Auto-fetching RGW credentials for bucket {share.rgw.bucket}"
+                )
+                (
+                    fetched_user_id,
+                    access_key,
+                    secret_key,
+                ) = rgw.fetch_rgw_credentials(
+                    staging._tool_execer,
+                    share.rgw.bucket,
+                    share.rgw.user_id or '',
+                )
+                # Update the share's RGW storage with fetched credentials
+                share.rgw = resources.RGWStorage(
+                    bucket=share.rgw.bucket,
+                    user_id=fetched_user_id,
+                    access_key_id=access_key,
+                    secret_access_key=secret_key,
+                )
+                log.debug(
+                    f"Successfully fetched credentials for user {fetched_user_id}"
+                )
+            except ValueError as e:
+                raise ErrorResult(
+                    share,
+                    msg=f"Failed to fetch RGW credentials: {str(e)}",
+                )
+
+        name_used_by = _share_name_in_use(staging, share)
+        if name_used_by:
+            raise ErrorResult(
+                share,
+                msg="share name already in use",
+                status={"conflicting_share_id": name_used_by},
+            )
+        return
+
+    # Handle CephFS shares
     assert share.cephfs is not None
     try:
         volpath = path_resolver.resolve_exists(

From 9a80169005e2f8401b979f03dcaf07f7db903792 Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Tue, 26 May 2026 19:57:42 +0530
Subject: [PATCH 434/596] mgr/smb: Add test coverage for RGW share
 functionality

Add test cases for RGW-backed SMB shares

Key changes:
- RGWStorage creation, validation, and serialization
- Edge cases: None values, mutual exclusion

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 .../mgr/cephadm/tests/services/test_smb.py    |   2 +
 src/pybind/mgr/smb/tests/test_handler.py      |  10 +
 src/pybind/mgr/smb/tests/test_resources.py    | 305 +++++++++++
 src/pybind/mgr/smb/tests/test_rgw_shares.py   | 508 ++++++++++++++++++
 4 files changed, 825 insertions(+)
 create mode 100644 src/pybind/mgr/smb/tests/test_rgw_shares.py

diff --git a/src/pybind/mgr/cephadm/tests/services/test_smb.py b/src/pybind/mgr/cephadm/tests/services/test_smb.py
index 2add9e5fe6e..6c942096392 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_smb.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_smb.py
@@ -55,6 +55,7 @@ class TestSMB:
                 'cluster_id': 'foxtrot',
                 'features': [],
                 'config_uri': 'rados://.smb/foxtrot/config.json',
+                'extra_config_uris': ['rados:mon-config-key:smb/config/foxtrot/config.smb.rgw'],
                 'config': '',
                 'keyring': '[client.smb.config.tango.briskly]\nkey = None\n',
                 'config_auth_entity': 'client.smb.config.tango.briskly',
@@ -125,6 +126,7 @@ class TestSMB:
                 'cluster_id': 'foxtrot',
                 'features': ['domain'],
                 'config_uri': 'rados://.smb/foxtrot/config2.json',
+                'extra_config_uris': ['rados:mon-config-key:smb/config/foxtrot/config.smb.rgw'],
                 'join_sources': [
                     'rados://.smb/foxtrot/join1.json',
                     'rados:mon-config-key:smb/config/foxtrot/join2.json',
diff --git a/src/pybind/mgr/smb/tests/test_handler.py b/src/pybind/mgr/smb/tests/test_handler.py
index 868958999f2..eb470cdc414 100644
--- a/src/pybind/mgr/smb/tests/test_handler.py
+++ b/src/pybind/mgr/smb/tests/test_handler.py
@@ -4,6 +4,14 @@ import smb
 from smb.handler import _FakeEarmarkResolver
 
 
+class _FakeToolExecer:
+    """Mock tool executor for testing."""
+
+    def tool_exec(self, cmd: list[str]) -> tuple[int, str, str]:
+        """Mock tool_exec that returns success."""
+        return (0, '{}', '')
+
+
 def _cluster(**kwargs):
     if 'clustering' not in kwargs:
         kwargs['clustering'] = smb.enums.SMBClustering.NEVER
@@ -25,6 +33,8 @@ def thandler():
         # into a single store. Do that to simplify testing a bit.
         public_store=ext_store,
         priv_store=ext_store,
+        mon_cmd_issuer=None,
+        tool_execer=_FakeToolExecer(),
     )
 
 
diff --git a/src/pybind/mgr/smb/tests/test_resources.py b/src/pybind/mgr/smb/tests/test_resources.py
index a9987b2a7ce..dcbca7f0ac6 100644
--- a/src/pybind/mgr/smb/tests/test_resources.py
+++ b/src/pybind/mgr/smb/tests/test_resources.py
@@ -1283,3 +1283,308 @@ def test_share_qos_remove_individual_limit():
     assert updated_cephfs.qos.write_iops_limit == 200  # Preserved
     assert updated_cephfs.qos.read_bw_limit == "10M"  # Preserved
     assert updated_cephfs.qos.write_bw_limit == "20M"  # Preserved
+
+
+def test_rgw_storage_basic():
+    """Test basic RGWStorage creation and validation."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.share
+cluster_id: rgwcluster
+share_id: rgwshare
+name: RGW Share
+rgw:
+    bucket: my-bucket
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+
+    share = loaded[0]
+    assert isinstance(share.rgw, smb.resources.RGWStorage)
+    assert share.rgw.bucket == 'my-bucket'
+    assert share.rgw.user_id is None
+    assert share.rgw.credential_ref is None
+
+
+def test_rgw_storage_with_credentials():
+    """Test RGWStorage with credential_ref."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.share
+cluster_id: rgwcluster
+share_id: rgwshare
+name: RGW Share
+rgw:
+    bucket: my-bucket
+    user_id: testuser
+    credential_ref: testuser
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+
+    share = loaded[0]
+    assert share.rgw.bucket == 'my-bucket'
+    assert share.rgw.user_id == 'testuser'
+    assert share.rgw.credential_ref == 'testuser'
+
+
+def test_rgw_storage_missing_bucket():
+    """Test validation error when bucket is missing."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.share
+cluster_id: rgwcluster
+share_id: rgwshare
+name: RGW Share
+rgw:
+    bucket: ""
+"""
+    data = yaml.safe_load_all(yaml_str)
+    with pytest.raises(ValueError, match='bucket requires a value'):
+        smb.resources.load(data)
+
+
+def test_rgw_storage_convert_mask():
+    """Test RGWStorage conversion - credentials now in RGWCredential."""
+    storage = smb.resources.RGWStorage(
+        bucket='my-bucket',
+        user_id='testuser',
+        credential_ref='testuser',
+    )
+
+    masked = storage.convert(
+        (smb.enums.PasswordFilter.NONE, smb.enums.PasswordFilter.HIDDEN)
+    )
+    assert masked.bucket == 'my-bucket'
+    assert masked.user_id == 'testuser'
+    assert masked.credential_ref == 'testuser'
+
+
+def test_rgw_storage_convert_none_credentials():
+    """Test conversion when credential_ref is None."""
+    storage = smb.resources.RGWStorage(
+        bucket='my-bucket',
+    )
+
+    encoded = storage.convert(
+        (smb.enums.PasswordFilter.NONE, smb.enums.PasswordFilter.BASE64)
+    )
+    assert encoded.credential_ref is None
+
+    masked = storage.convert(
+        (smb.enums.PasswordFilter.NONE, smb.enums.PasswordFilter.HIDDEN)
+    )
+    assert masked.credential_ref is None
+
+
+def test_rgw_storage_to_simplified():
+    """Test RGWStorage serialization to simplified format."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.share
+cluster_id: rgwcluster
+share_id: rgwshare
+name: RGW Share
+rgw:
+    bucket: my-bucket
+    user_id: testuser
+    credential_ref: testuser
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+
+    share = loaded[0]
+    simplified = share.to_simplified()
+
+    assert 'rgw' in simplified
+    assert simplified['rgw']['bucket'] == 'my-bucket'
+    assert simplified['rgw']['user_id'] == 'testuser'
+    # Credentials are now referenced via credential_ref
+    assert simplified['rgw']['credential_ref'] == 'testuser'
+
+
+def test_rgw_storage_invalid_credentials():
+    """Test RGWStorage with invalid credential_ref."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.share
+cluster_id: rgwcluster
+share_id: rgwshare
+name: RGW Share
+rgw:
+    bucket: my-bucket
+    credential_ref: "invalid-ref-with-spaces"
+"""
+    data = yaml.safe_load_all(yaml_str)
+    # Note: Credential validation happens during staging, not at load time
+    # This test documents that RGWStorage accepts any credential_ref string
+    loaded = smb.resources.load(data)
+    assert loaded
+    assert loaded[0].rgw.credential_ref == "invalid-ref-with-spaces"
+
+
+def test_share_with_rgw_and_cephfs_mutual_exclusion():
+    """Test that share cannot have both rgw and cephfs."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.share
+cluster_id: testcluster
+share_id: testshare
+name: Invalid Share
+cephfs:
+    volume: cephfs
+    path: /
+rgw:
+    bucket: my-bucket
+    path: /
+"""
+    data = yaml.safe_load_all(yaml_str)
+    with pytest.raises(ValueError, match='only one storage backend'):
+        smb.resources.load(data)
+
+
+def test_rgw_credential_basic():
+    """Test basic RGWCredential creation and validation."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.rgw.credential
+rgw_credential_id: rgwcred1
+user_id: s3user
+access_key_id: AKIAIOSFODNN7EXAMPLE
+secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+
+    cred = loaded[0]
+    assert isinstance(cred, smb.resources.RGWCredential)
+    assert cred.rgw_credential_id == 'rgwcred1'
+    assert cred.user_id == 's3user'
+    assert cred.access_key_id == 'AKIAIOSFODNN7EXAMPLE'
+    assert (
+        cred.secret_access_key == 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+    )
+    assert cred.intent == smb.enums.Intent.PRESENT
+
+
+def test_rgw_credential_missing_required_fields():
+    """Test that RGWCredential requires user_id, access_key_id, and secret_access_key."""
+    import yaml
+
+    # Missing user_id
+    yaml_str = """
+resource_type: ceph.smb.rgw.credential
+rgw_credential_id: rgwcred1
+access_key_id: AKIAIOSFODNN7EXAMPLE
+secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+"""
+    data = yaml.safe_load_all(yaml_str)
+    with pytest.raises(Exception):  # Will fail during construction
+        smb.resources.load(data)
+
+    # Missing access_key_id
+    yaml_str = """
+resource_type: ceph.smb.rgw.credential
+rgw_credential_id: rgwcred1
+user_id: s3user
+secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+"""
+    data = yaml.safe_load_all(yaml_str)
+    with pytest.raises(Exception):  # Will fail during construction
+        smb.resources.load(data)
+
+    # Missing secret_access_key
+    yaml_str = """
+resource_type: ceph.smb.rgw.credential
+rgw_credential_id: rgwcred1
+user_id: s3user
+access_key_id: AKIAIOSFODNN7EXAMPLE
+"""
+    data = yaml.safe_load_all(yaml_str)
+    with pytest.raises(Exception):  # Will fail during construction
+        smb.resources.load(data)
+
+
+def test_rgw_credential_password_conversion():
+    """Test RGWCredential password field conversion."""
+    cred = smb.resources.RGWCredential(
+        rgw_credential_id='test_cred',
+        user_id='testuser',
+        access_key_id='AKIATEST',
+        secret_access_key='secretkey123',
+    )
+
+    # Test masking (NONE -> HIDDEN)
+    masked = cred.convert(
+        (smb.enums.PasswordFilter.NONE, smb.enums.PasswordFilter.HIDDEN)
+    )
+    assert masked.access_key_id == '****************'
+    assert masked.secret_access_key == '****************'
+    assert masked.user_id == 'testuser'  # user_id should not be masked
+
+    # Test base64 encoding (NONE -> BASE64)
+    encoded = cred.convert(
+        (smb.enums.PasswordFilter.NONE, smb.enums.PasswordFilter.BASE64)
+    )
+    assert encoded.access_key_id != 'AKIATEST'
+    assert encoded.secret_access_key != 'secretkey123'
+    assert encoded.user_id == 'testuser'
+
+    # Test base64 decoding (BASE64 -> NONE)
+    decoded = encoded.convert(
+        (smb.enums.PasswordFilter.BASE64, smb.enums.PasswordFilter.NONE)
+    )
+    assert decoded.access_key_id == 'AKIATEST'
+    assert decoded.secret_access_key == 'secretkey123'
+
+
+def test_rgw_credential_with_linked_cluster():
+    """Test RGWCredential with linked_to_cluster."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.rgw.credential
+rgw_credential_id: rgwcred1
+user_id: s3user
+access_key_id: AKIAIOSFODNN7EXAMPLE
+secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+linked_to_cluster: mysmb
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+
+    cred = loaded[0]
+    assert cred.linked_to_cluster == 'mysmb'
+
+
+def test_rgw_credential_removed():
+    """Test RGWCredential with removed intent."""
+    import yaml
+
+    yaml_str = """
+resource_type: ceph.smb.rgw.credential
+rgw_credential_id: rgwcred1
+user_id: placeholder
+access_key_id: placeholder
+secret_access_key: placeholder
+intent: removed
+"""
+    data = yaml.safe_load_all(yaml_str)
+    loaded = smb.resources.load(data)
+    assert loaded
+
+    cred = loaded[0]
+    assert cred.intent == smb.enums.Intent.REMOVED
+    assert cred.rgw_credential_id == 'rgwcred1'
diff --git a/src/pybind/mgr/smb/tests/test_rgw_shares.py b/src/pybind/mgr/smb/tests/test_rgw_shares.py
new file mode 100644
index 00000000000..2983e81c57d
--- /dev/null
+++ b/src/pybind/mgr/smb/tests/test_rgw_shares.py
@@ -0,0 +1,508 @@
+import json
+
+import pytest
+
+import smb
+import smb.external
+
+
+class _FakeToolExecer:
+    """Mock tool executor for testing RGW operations."""
+
+    def tool_exec(self, cmd: list[str]) -> tuple[int, str, str]:
+        """Mock tool_exec that returns success for RGW commands."""
+        # Check if this is a radosgw-admin bucket stats command
+        if 'radosgw-admin' in cmd and 'bucket' in cmd and 'stats' in cmd:
+            # Return mock bucket stats with owner field
+            bucket_stats = json.dumps(
+                {'owner': 'testuser', 'bucket': 'my-bucket', 'usage': {}}
+            )
+            return (0, bucket_stats, '')
+        # Check if this is a radosgw-admin user info command
+        if 'radosgw-admin' in cmd and 'user' in cmd and 'info' in cmd:
+            # Return mock user info with credentials
+            user_info = json.dumps(
+                {
+                    'user_id': 'testuser',
+                    'keys': [
+                        {
+                            'access_key': 'AUTO_FETCHED_ACCESS_KEY',
+                            'secret_key': 'AUTO_FETCHED_SECRET_KEY',
+                        }
+                    ],
+                }
+            )
+            return (0, user_info, '')
+        # Default response for other commands
+        return (0, '{}', '')
+
+
+def _cluster(**kwargs):
+    """Helper to create cluster with default clustering setting."""
+    if 'clustering' not in kwargs:
+        kwargs['clustering'] = smb.enums.SMBClustering.NEVER
+    return smb.resources.Cluster(**kwargs)
+
+
+@pytest.fixture
+def thandler():
+    """Fixture for RGW tests with RGW-aware tool executor."""
+    ext_store = smb.config_store.MemConfigStore()
+    return smb.handler.ClusterConfigHandler(
+        internal_store=smb.config_store.MemConfigStore(),
+        public_store=ext_store,
+        priv_store=ext_store,
+        mon_cmd_issuer=None,
+        tool_execer=_FakeToolExecer(),
+    )
+
+
+def test_internal_apply_cluster_and_rgw_share(thandler):
+    """Test creating a cluster with an RGW share."""
+    cluster = _cluster(
+        cluster_id='rgwtest',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id='rgwtest',
+        share_id='rgwshare1',
+        name='RGW Share One',
+        rgw=smb.resources.RGWStorage(
+            bucket='my-bucket',
+            user_id='testuser',
+        ),
+    )
+    rg = thandler.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+    assert ('clusters', 'rgwtest') in thandler.internal_store.data
+    assert ('shares', 'rgwtest.rgwshare1') in thandler.internal_store.data
+    # Check that credential was auto-created
+    assert ('rgw_creds', 'testuser') in thandler.internal_store.data
+
+    shares = thandler.share_ids()
+    assert len(shares) == 1
+    assert ('rgwtest', 'rgwshare1') in shares
+
+    # Verify share uses credential_ref
+    share_data = thandler.internal_store.data[('shares', 'rgwtest.rgwshare1')]
+    assert share_data['rgw']['credential_ref'] == 'testuser'
+
+
+def test_apply_rgw_share_with_credentials(thandler):
+    """Test applying an RGW share with full credentials."""
+    cluster = _cluster(
+        cluster_id='rgwcluster',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id='rgwcluster',
+        share_id='s3share',
+        name='S3 Share',
+        rgw=smb.resources.RGWStorage(
+            bucket='test-bucket',
+            user_id='rgwuser',
+        ),
+    )
+    rg = thandler.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    # Verify credential was auto-created with fetched credentials
+    assert ('rgw_creds', 'rgwuser') in thandler.internal_store.data
+    cred_dict = thandler.internal_store.data[('rgw_creds', 'rgwuser')]
+    assert cred_dict['user_id'] == 'rgwuser'
+    assert cred_dict['access_key_id'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert cred_dict['secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+
+    # Verify share uses credential_ref
+    share_dict = thandler.internal_store.data[
+        ('shares', 'rgwcluster.s3share')
+    ]
+    assert share_dict['rgw']['bucket'] == 'test-bucket'
+    assert share_dict['rgw']['credential_ref'] == 'rgwuser'
+
+
+def test_rgw_share_auto_fetch_credentials(thandler):
+    """Test RGW share with auto-fetched credentials (bucket only provided)."""
+    cluster = _cluster(
+        cluster_id='autofetch',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id='autofetch',
+        share_id='autoshare',
+        name='Auto Fetch Share',
+        rgw=smb.resources.RGWStorage(
+            bucket='my-bucket',
+        ),
+    )
+    rg = thandler.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    # Verify credential was auto-created with fetched credentials
+    assert ('rgw_creds', 'testuser') in thandler.internal_store.data
+    cred_dict = thandler.internal_store.data[('rgw_creds', 'testuser')]
+    assert cred_dict['user_id'] == 'testuser'
+    assert cred_dict['access_key_id'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert cred_dict['secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+
+    # Verify share uses credential_ref
+    share_dict = thandler.internal_store.data[
+        ('shares', 'autofetch.autoshare')
+    ]
+    assert share_dict['rgw']['bucket'] == 'my-bucket'
+    assert share_dict['rgw']['credential_ref'] == 'testuser'
+
+
+def test_rgw_share_remove(thandler):
+    """Test removing an RGW share."""
+    # First create a cluster and RGW share
+    cluster = _cluster(
+        cluster_id='rgwtest',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id='rgwtest',
+        share_id='rgwshare1',
+        name='RGW Share One',
+        rgw=smb.resources.RGWStorage(
+            bucket='my-bucket',
+            user_id='testuser',
+        ),
+    )
+    rg = thandler.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    # Now remove the share
+    rmshare = smb.resources.RemovedShare(
+        cluster_id='rgwtest',
+        share_id='rgwshare1',
+    )
+    rg = thandler.apply([rmshare])
+    assert rg.success, rg.to_simplified()
+
+    shares = thandler.share_ids()
+    assert len(shares) == 0
+    assert ('shares', 'rgwtest.rgwshare1') not in thandler.internal_store.data
+
+
+def test_rgw_share_minimal_config(thandler):
+    """Test RGW share with minimal configuration (bucket only)."""
+    cluster = _cluster(
+        cluster_id='minimalrgw',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id='minimalrgw',
+        share_id='minimal',
+        name='Minimal RGW Share',
+        rgw=smb.resources.RGWStorage(
+            bucket='my-bucket',
+        ),
+    )
+    rg = thandler.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    # Verify credential was auto-created with fetched credentials
+    assert ('rgw_creds', 'testuser') in thandler.internal_store.data
+    cred_dict = thandler.internal_store.data[('rgw_creds', 'testuser')]
+    assert cred_dict['user_id'] == 'testuser'
+    assert cred_dict['access_key_id'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert cred_dict['secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+
+    # Verify share uses credential_ref
+    share_dict = thandler.internal_store.data[
+        ('shares', 'minimalrgw.minimal')
+    ]
+    assert share_dict['rgw']['bucket'] == 'my-bucket'
+    assert share_dict['rgw']['credential_ref'] == 'testuser'
+
+
+def test_multiple_rgw_shares_same_cluster(thandler):
+    """Test creating multiple RGW shares in the same cluster."""
+    cluster = _cluster(
+        cluster_id='multirgw',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share1 = smb.resources.Share(
+        cluster_id='multirgw',
+        share_id='share1',
+        name='RGW Share 1',
+        rgw=smb.resources.RGWStorage(
+            bucket='bucket1',
+            user_id='user1',
+        ),
+    )
+    share2 = smb.resources.Share(
+        cluster_id='multirgw',
+        share_id='share2',
+        name='RGW Share 2',
+        rgw=smb.resources.RGWStorage(
+            bucket='bucket2',
+            user_id='user2',
+        ),
+    )
+    rg = thandler.apply([cluster, share1, share2])
+    assert rg.success, rg.to_simplified()
+
+    shares = thandler.share_ids()
+    assert len(shares) == 2
+    assert ('multirgw', 'share1') in shares
+    assert ('multirgw', 'share2') in shares
+
+    # Verify credentials were auto-created for both users
+    assert ('rgw_creds', 'user1') in thandler.internal_store.data
+    assert ('rgw_creds', 'user2') in thandler.internal_store.data
+
+    # Verify both shares use credential_ref
+    share1_dict = thandler.internal_store.data[('shares', 'multirgw.share1')]
+    share2_dict = thandler.internal_store.data[('shares', 'multirgw.share2')]
+    assert share1_dict['rgw']['bucket'] == 'bucket1'
+    assert share1_dict['rgw']['credential_ref'] == 'user1'
+    assert share2_dict['rgw']['bucket'] == 'bucket2'
+    assert share2_dict['rgw']['credential_ref'] == 'user2'
+
+
+def test_rgw_credential_reuse_same_user(thandler):
+    """Test that multiple shares with same user_id reuse the same credential."""
+    cluster = _cluster(
+        cluster_id='reusetest',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share1 = smb.resources.Share(
+        cluster_id='reusetest',
+        share_id='share1',
+        name='RGW Share 1',
+        rgw=smb.resources.RGWStorage(
+            bucket='bucket1',
+            user_id='shareduser',
+        ),
+    )
+    share2 = smb.resources.Share(
+        cluster_id='reusetest',
+        share_id='share2',
+        name='RGW Share 2',
+        rgw=smb.resources.RGWStorage(
+            bucket='bucket2',
+            user_id='shareduser',
+        ),
+    )
+    rg = thandler.apply([cluster, share1, share2])
+    assert rg.success, rg.to_simplified()
+
+    # Verify only ONE credential was created for the shared user
+    rgw_creds = [
+        k for k in thandler.internal_store.data.keys() if k[0] == 'rgw_creds'
+    ]
+    assert len(rgw_creds) == 1
+    assert ('rgw_creds', 'shareduser') in thandler.internal_store.data
+
+    # Verify both shares reference the same credential
+    share1_dict = thandler.internal_store.data[('shares', 'reusetest.share1')]
+    share2_dict = thandler.internal_store.data[('shares', 'reusetest.share2')]
+    assert share1_dict['rgw']['credential_ref'] == 'shareduser'
+    assert share2_dict['rgw']['credential_ref'] == 'shareduser'
+
+
+# ---- priv-store credential isolation tests ----
+# These tests use SEPARATE public and private stores so each can be
+# independently inspected.  The real credential values must
+# only ever appear in the private store (via a config:merge stub), never in
+# the public RADOS config.
+
+
+@pytest.fixture
+def split_handler():
+    """Handler with separate public and private stores."""
+    pub = smb.config_store.MemConfigStore()
+    priv = smb.config_store.MemConfigStore()
+    h = smb.handler.ClusterConfigHandler(
+        internal_store=smb.config_store.MemConfigStore(),
+        public_store=pub,
+        priv_store=priv,
+        tool_execer=_FakeToolExecer(),
+    )
+    return h, pub, priv
+
+
+def _rgw_cluster_and_share(cluster_id, share_id, share_name, **rgw_kwargs):
+    cluster = _cluster(
+        cluster_id=cluster_id,
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id=cluster_id,
+        share_id=share_id,
+        name=share_name,
+        rgw=smb.resources.RGWStorage(**rgw_kwargs),
+    )
+    return cluster, share
+
+
+def test_rgw_credentials_absent_from_public_config(split_handler):
+    """Credential values must be empty strings in the public RADOS config."""
+    h, pub, priv = split_handler
+    cluster, share = _rgw_cluster_and_share(
+        'c1',
+        's1',
+        'mybucket',
+        bucket='mybucket',
+        user_id='testuser',
+    )
+    rg = h.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    # Verify credential was auto-created
+    assert ('rgw_creds', 'testuser') in h.internal_store.data
+
+    pub_cfg = pub['c1', 'config.smb'].get()
+    opts = pub_cfg['shares']['mybucket']['options']
+    assert opts['ceph_rgw:access_key'] == ''
+    assert opts['ceph_rgw:secret_access_key'] == ''
+
+
+def test_rgw_credential_stub_written_to_priv_store(split_handler):
+    """Private store must hold config:merge stub with real credential values."""
+    h, pub, priv = split_handler
+    cluster, share = _rgw_cluster_and_share(
+        'c1',
+        's1',
+        'mybucket',
+        bucket='mybucket',
+        user_id='testuser',
+    )
+    rg = h.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    # Verify credential was auto-created with fetched credentials
+    assert ('rgw_creds', 'testuser') in h.internal_store.data
+    cred_dict = h.internal_store.data[('rgw_creds', 'testuser')]
+    assert cred_dict['access_key_id'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert cred_dict['secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+
+    stub = priv['c1', 'config.smb.rgw'].get()
+    assert stub['samba-container-config'] == 'v0'
+    assert 'config:merge' in stub
+    opts = stub['config:merge']['shares']['mybucket']['options']
+    assert opts['ceph_rgw:access_key'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert opts['ceph_rgw:secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+
+
+def test_no_priv_store_entry_for_non_rgw_cluster(split_handler):
+    """A cluster with no RGW shares must not write a credential stub."""
+    h, pub, priv = split_handler
+    cluster = _cluster(
+        cluster_id='cephfs1',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share = smb.resources.Share(
+        cluster_id='cephfs1',
+        share_id='fsshare',
+        name='FS Share',
+        cephfs=smb.resources.CephFSStorage(
+            volume='cephfs',
+            path='/',
+        ),
+    )
+    rg = h.apply([cluster, share])
+    assert rg.success, rg.to_simplified()
+
+    stub_entry = priv['cephfs1', 'config.smb.rgw']
+    assert not stub_entry.exists()
+
+
+def test_multi_share_stub_covers_all_rgw_shares(split_handler):
+    """Credential stub must contain entries for every RGW share."""
+    h, pub, priv = split_handler
+    cluster = _cluster(
+        cluster_id='multi',
+        auth_mode=smb.enums.AuthMode.USER,
+        user_group_settings=[
+            smb.resources.UserGroupSource(
+                source_type=smb.resources.UserGroupSourceType.EMPTY,
+            ),
+        ],
+    )
+    share1 = smb.resources.Share(
+        cluster_id='multi',
+        share_id='s1',
+        name='bucket1',
+        rgw=smb.resources.RGWStorage(
+            bucket='bucket1',
+            user_id='u1',
+        ),
+    )
+    share2 = smb.resources.Share(
+        cluster_id='multi',
+        share_id='s2',
+        name='bucket2',
+        rgw=smb.resources.RGWStorage(
+            bucket='bucket2',
+            user_id='u2',
+        ),
+    )
+    rg = h.apply([cluster, share1, share2])
+    assert rg.success, rg.to_simplified()
+
+    # Verify credentials were auto-created for both users with fetched credentials
+    assert ('rgw_creds', 'u1') in h.internal_store.data
+    assert ('rgw_creds', 'u2') in h.internal_store.data
+    cred1 = h.internal_store.data[('rgw_creds', 'u1')]
+    cred2 = h.internal_store.data[('rgw_creds', 'u2')]
+    assert cred1['access_key_id'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert cred1['secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+    assert cred2['access_key_id'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert cred2['secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+
+    stub = priv['multi', 'config.smb.rgw'].get()
+    merge_shares = stub['config:merge']['shares']
+    b1opts = merge_shares['bucket1']['options']
+    b2opts = merge_shares['bucket2']['options']
+    assert b1opts['ceph_rgw:access_key'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert b1opts['ceph_rgw:secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'
+    assert b2opts['ceph_rgw:access_key'] == 'AUTO_FETCHED_ACCESS_KEY'
+    assert b2opts['ceph_rgw:secret_access_key'] == 'AUTO_FETCHED_SECRET_KEY'

From 847dc5cc8c099fed82f1228e95051b4a30c4a4da Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Wed, 27 May 2026 13:32:27 +0530
Subject: [PATCH 435/596] doc/mgr/smb: document new options for smb share
 create rgw

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 doc/mgr/smb.rst | 124 +++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 122 insertions(+), 2 deletions(-)

diff --git a/doc/mgr/smb.rst b/doc/mgr/smb.rst
index 6cf26482a58..4a3411fa5fe 100644
--- a/doc/mgr/smb.rst
+++ b/doc/mgr/smb.rst
@@ -382,6 +382,51 @@ Create a read-only share at a custom path in the CephFS volume:
         --path=/qbranch/top/secret/plans --readonly
 
 
+Create RGW Share
+++++++++++++++++
+
+.. prompt:: bash #
+
+   ceph smb share create rgw <cluster_id> <share_id> <bucket> [--share-name=<share_name>] [--user-id=<user_id>] [--readonly]
+
+Create a new SMB share, hosted by the named cluster, that maps to a RADOS
+Gateway (RGW) bucket. This allows S3-compatible object storage to be accessed
+via the SMB protocol.
+
+Options:
+
+cluster_id
+    A short string uniquely identifying the cluster
+share_id
+    A short string uniquely identifying the share
+bucket
+    The name of the RGW bucket to be shared
+share_name
+    Optional. The public name of the share, visible to clients. If not provided
+    the ``share_id`` will be used automatically
+user_id
+    Optional. The RGW user ID that owns the bucket. If not provided, the system
+    will attempt to determine the bucket owner automatically
+readonly
+    Creates a read-only share
+
+Examples
+~~~~~~~~
+
+Create a share for an RGW bucket:
+
+.. prompt:: bash #
+
+    ceph smb share create rgw test1 photos my-photos-bucket
+
+Create a share with a custom name and specific user:
+
+.. prompt:: bash #
+
+    ceph smb share create rgw test1 photos my-photos-bucket \
+        --share-name="Photo Archive" --user-id=s3user
+
+
 .. _qos-parameters:
 
 QoS Parameters
@@ -1099,7 +1144,8 @@ max_connections
     connections to a specific share. The default value is 0 and it indicates
     that there is no limit on the number of connections
 cephfs
-    Required object. Fields:
+    Object. Configures CephFS-backed storage for the share. Either a ``cephfs``
+    or ``rgw`` object must be specified, but not both. Fields:
 
     volume
         Required string. Name of the cephfs volume to use
@@ -1169,6 +1215,18 @@ cephfs
         name
             String. A value indicating what FSCrypt key to fetch. The specific
             value of the name depends on the scope being used.
+rgw
+    Object. Configures RADOS Gateway (RGW) backed storage for the share. Either
+    a ``cephfs`` or ``rgw`` object must be specified, but not both. This allows
+    S3-compatible object storage to be accessed via the SMB protocol. Fields:
+
+    bucket
+        Required string. The name of the RGW bucket to be shared.
+    user_id
+        Optional string. The RGW user ID that owns the bucket. If not provided,
+        the system will automatically determine the bucket owner and fetch the
+        necessary credentials.
+
 restrict_access
     Optional boolean, defaulting to false. If true the share will only permit
     access by users explicitly listed in ``login_control``.
@@ -1216,7 +1274,32 @@ custom_smb_share_options
     things in ways that the Ceph team can not help with. This special key will
     automatically be removed from the list of options passed to Samba.
 
-The following is an example of a share with QoS settings including burst
+The following is an example of an RGW-backed share with minimal configuration
+(credentials auto-fetched):
+
+.. code-block:: yaml
+
+    resource_type: ceph.smb.share
+    cluster_id: tango
+    share_id: s3share
+    name: "S3 Storage"
+    rgw:
+      bucket: my-bucket
+
+Another example of an RGW-backed share with explicit user_id:
+
+.. code-block:: yaml
+
+    resource_type: ceph.smb.share
+    cluster_id: tango
+    share_id: s3share
+    name: "S3 Storage"
+    rgw:
+      bucket: my-bucket
+      user_id: s3user
+
+
+The following is an example of a CephFS share with QoS settings including burst
 multipliers and human-readable bandwidth limits:
 
 .. code-block:: yaml
@@ -1366,6 +1449,43 @@ Example:
         groups: []
 
 
+RGW Credential Resource
+------------------------
+
+An RGW credential resource stores RADOS Gateway (RGW) access credentials that can be used by RGW-backed shares to authenticate with the object storage system.
+
+A RGW credential resource supports the following fields:
+
+resource_type
+    A literal string ``ceph.smb.rgw.credential``
+rgw_credential_id
+    A short string identifying the RGW credential resource.
+intent
+    One of ``present`` or ``removed``. If not provided, ``present`` is assumed.
+    If ``removed`` all following fields are optional
+user_id
+    Required string. The RGW user ID that owns the credentials
+access_key
+    Required string. The RGW access key for authentication
+secret_key
+    Required string. The RGW secret key for authentication
+linked_to_cluster:
+    Optional. A string containing a cluster ID. If set, the resource may only
+    be used with the linked cluster and will automatically be removed when the
+    linked cluster is removed.
+
+
+Example:
+
+.. code-block:: yaml
+
+    resource_type: ceph.smb.rgw.credential
+    rgw_credential_id: s3user 
+    user_id: s3user
+    access_key: AKIAIOSFODNN7EXAMPLE
+    secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+
+
 TLS Credential Resource
 ------------------------
 

From 8916aa85f73a6d3dabc62bfce4e029bff7e9322d Mon Sep 17 00:00:00 2001
From: Avan Thakkar <athakkar@redhat.com>
Date: Thu, 11 Jun 2026 15:25:33 +0530
Subject: [PATCH 436/596] mgr/smb: add RGW credentials resource and store in
 priv_stor

Refactored RGW credential management to use dedicated RGWCredential
resources instead of embedding credentials directly in Share resources.
This will help to reuse the same credential across multiple shares using
same user.

RGW credentials must not appear in the public RADOS store, which any
client with pool caps can read. Instead, write a config:merge stub
containing only the credential fields to the private mon config-key
store, and pass its URI to the container alongside the primary config
URI via extra_config_uris.

- Public config: ceph_rgw:access_key / secret_access_key are empty strings
- Private stub: stored under smb/config/<cluster_id>/config.smb.rgw,
  contains only the real credential values via config:merge
- extra_config_uris: new Config field carrying supplementary URIs
  appended to SAMBACC_CONFIG after the primary config_uri

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/cephadm/cephadmlib/daemons/smb.py  |   4 +
 src/pybind/mgr/cephadm/services/smb.py |  19 ++
 src/pybind/mgr/smb/enums.py            |   1 +
 src/pybind/mgr/smb/external.py         |   6 +-
 src/pybind/mgr/smb/handler.py          | 301 +++++++++++++++----------
 src/pybind/mgr/smb/internal.py         |  18 ++
 src/pybind/mgr/smb/module.py           |  17 +-
 src/pybind/mgr/smb/resources.py        |  63 ++++--
 src/pybind/mgr/smb/rgw_auth.py         |  50 ++++
 src/pybind/mgr/smb/sqlite_store.py     |  23 ++
 src/pybind/mgr/smb/staging.py          | 180 ++++++++++++---
 11 files changed, 510 insertions(+), 172 deletions(-)
 create mode 100644 src/pybind/mgr/smb/rgw_auth.py

diff --git a/src/cephadm/cephadmlib/daemons/smb.py b/src/cephadm/cephadmlib/daemons/smb.py
index 3026d6530b7..684cbbe495f 100644
--- a/src/cephadm/cephadmlib/daemons/smb.py
+++ b/src/cephadm/cephadmlib/daemons/smb.py
@@ -245,6 +245,7 @@ class Config:
     debug_delay: int = 0
     join_sources: List[str] = dataclasses.field(default_factory=list)
     user_sources: List[str] = dataclasses.field(default_factory=list)
+    extra_config_uris: List[str] = dataclasses.field(default_factory=list)
     custom_dns: List[str] = dataclasses.field(default_factory=list)
     smb_port: int = 0
     ctdb_port: int = 0
@@ -267,6 +268,7 @@ class Config:
 
     def config_uris(self) -> List[str]:
         uris = [self.source_config]
+        uris.extend(self.extra_config_uris or [])
         uris.extend(self.user_sources or [])
         if self.clustered:
             # When clustered, we inject certain clustering related config vars
@@ -702,6 +704,7 @@ class SMB(ContainerDaemonForm):
         source_config = configs.get('config_uri', '')
         join_sources = configs.get('join_sources', [])
         user_sources = configs.get('user_sources', [])
+        extra_config_uris = configs.get('extra_config_uris', [])
         custom_dns = configs.get('custom_dns', [])
         instance_features = configs.get('features', [])
         files = data_utils.dict_get(configs, 'files', {})
@@ -768,6 +771,7 @@ class SMB(ContainerDaemonForm):
             source_config=source_config,
             join_sources=join_sources,
             user_sources=user_sources,
+            extra_config_uris=extra_config_uris,
             custom_dns=custom_dns,
             # major features
             domain_member=Features.DOMAIN.value in instance_features,
diff --git a/src/pybind/mgr/cephadm/services/smb.py b/src/pybind/mgr/cephadm/services/smb.py
index d6f31c8312a..f63730221eb 100644
--- a/src/pybind/mgr/cephadm/services/smb.py
+++ b/src/pybind/mgr/cephadm/services/smb.py
@@ -206,6 +206,16 @@ class SMBService(CephService):
             ca_cert=ssl_params.ssl_ca_cert or '',
         )
 
+    def _rgw_creds_uri(self, cluster_id: str) -> Optional[str]:
+        from smb.external import rgw_config_key as _smb_rgw_config_key
+        from smb.mon_store import MonKeyConfigStore
+        _rgw_entry = MonKeyConfigStore(self.mgr)[
+            _smb_rgw_config_key(cluster_id)
+        ]
+        if _rgw_entry.exists():
+            return _rgw_entry.uri
+        return None
+
     def generate_config(
         self, daemon_spec: CephadmDaemonDeploySpec
     ) -> Tuple[Dict[str, Any], List[str]]:
@@ -220,6 +230,14 @@ class SMBService(CephService):
         config_blobs['cluster_id'] = smb_spec.cluster_id
         config_blobs['features'] = smb_spec.features
         config_blobs['config_uri'] = smb_spec.config_uri
+        # For RGW clusters, append the private-store config as an extra URI
+        # loaded after the public config.  sambacc's config:merge is a general
+        # merge mechanism; here the mgr populates it with only the RGW
+        # credential fields, keeping the public config the primary source of
+        # truth.
+        rgw_creds_uri = self._rgw_creds_uri(smb_spec.cluster_id)
+        if rgw_creds_uri:
+            config_blobs['extra_config_uris'] = [rgw_creds_uri]
         _add_cfg(config_blobs, 'join_sources', smb_spec.join_sources)
         _add_cfg(config_blobs, 'user_sources', smb_spec.user_sources)
         _add_cfg(config_blobs, 'custom_dns', smb_spec.custom_dns)
@@ -228,6 +246,7 @@ class SMBService(CephService):
         cluster_public_addrs = smb_spec.strict_cluster_ip_specs()
         _add_cfg(config_blobs, 'cluster_public_addrs', cluster_public_addrs)
         ceph_users = smb_spec.include_ceph_users or []
+
         config_blobs.update(
             self._ceph_config_and_keyring_for(
                 smb_spec, daemon_spec.daemon_id, ceph_users
diff --git a/src/pybind/mgr/smb/enums.py b/src/pybind/mgr/smb/enums.py
index fac7ba54bbf..5b1850c9128 100644
--- a/src/pybind/mgr/smb/enums.py
+++ b/src/pybind/mgr/smb/enums.py
@@ -80,6 +80,7 @@ class ConfigNS(_StrEnum):
     USERS_AND_GROUPS = 'users_and_groups'
     JOIN_AUTHS = 'join_auths'
     TLS_CREDENTIALS = 'tls_creds'
+    RGW_CREDENTIALS = 'rgw_creds'
     EXTERNAL_CEPH_CLUSTERS = 'ext_ceph_clusters'
 
 
diff --git a/src/pybind/mgr/smb/external.py b/src/pybind/mgr/smb/external.py
index 8937411e28d..3eb5bb6b8ab 100644
--- a/src/pybind/mgr/smb/external.py
+++ b/src/pybind/mgr/smb/external.py
@@ -49,9 +49,9 @@ def spec_backup_key(cluster_id: str) -> EntryKey:
     return (cluster_id, 'spec.smb')
 
 
-def rgw_credentials_key(cluster_id: str, share_id: str) -> EntryKey:
-    """Return key identifying RGW credentials for a share in an external store."""
-    return (cluster_id, f'rgw-creds.{share_id}.json')
+def rgw_config_key(cluster_id: str) -> EntryKey:
+    """Return key for the RGW credential stub in the private store."""
+    return (cluster_id, 'config.smb.rgw')
 
 
 def tls_credential_key(
diff --git a/src/pybind/mgr/smb/handler.py b/src/pybind/mgr/smb/handler.py
index dc72afa880d..a6270243ba9 100644
--- a/src/pybind/mgr/smb/handler.py
+++ b/src/pybind/mgr/smb/handler.py
@@ -45,6 +45,7 @@ from .internal import (
     CommonResourceEntry,
     ExternalCephClusterEntry,
     JoinAuthEntry,
+    RGWCredentialEntry,
     ShareEntry,
     TLSCredentialEntry,
     UsersAndGroupsEntry,
@@ -55,6 +56,7 @@ from .proto import (
     ConfigEntry,
     ConfigStore,
     EarmarkResolver,
+    MonCommandIssuer,
     OrchSubmitter,
     PathResolver,
     Self,
@@ -62,11 +64,13 @@ from .proto import (
 )
 from .resources import SMBResource
 from .results import ErrorResult, Result, ResultGroup
+from .rgw_auth import RGWAuthorizer
 from .staging import (
     Staging,
     auth_refs,
     cross_check_resource,
     ext_cluster_refs,
+    rgw_credential_refs,
     tls_refs,
     ug_refs,
 )
@@ -99,6 +103,7 @@ class ClusterChangeGroup:
         join_auths: List[resources.JoinAuth],
         users_and_groups: List[resources.UsersAndGroups],
         tls_credentials: List[resources.TLSCredential],
+        rgw_credentials: List[resources.RGWCredential],
         ext_ceph_clusters: List[resources.ExternalCephCluster],
     ):
         self.cluster = cluster
@@ -106,6 +111,7 @@ class ClusterChangeGroup:
         self.join_auths = join_auths
         self.users_and_groups = users_and_groups
         self.tls_credentials = tls_credentials
+        self.rgw_credentials = rgw_credentials
         self.ext_ceph_clusters = ext_ceph_clusters
         # a cache for modified entries
         self.cache = config_store.EntryCache()
@@ -180,6 +186,15 @@ class _FakeAuthorizer:
         pass
 
 
+class _FakeMonCommandIssuer:
+    """A stub MonCommandIssuer for unit testing."""
+
+    def mon_command(
+        self, cmd_dict: dict, inbuf: Optional[str] = None
+    ) -> Tuple[int, str, str]:
+        return (0, '', '')
+
+
 class _Matcher:
     _match_resources = (
         resources.Cluster,
@@ -187,6 +202,7 @@ class _Matcher:
         resources.JoinAuth,
         resources.UsersAndGroups,
         resources.TLSCredential,
+        resources.RGWCredential,
         resources.ExternalCephCluster,
     )
 
@@ -316,6 +332,7 @@ class ClusterConfigHandler:
         priv_store: ConfigStore,
         path_resolver: Optional[PathResolver] = None,
         authorizer: Optional[AccessAuthorizer] = None,
+        mon_cmd_issuer: Optional[MonCommandIssuer] = None,
         orch: Optional[OrchSubmitter] = None,
         earmark_resolver: Optional[EarmarkResolver] = None,
         tool_execer: 'rgw.ToolExecer',
@@ -329,6 +346,9 @@ class ClusterConfigHandler:
         if authorizer is None:
             authorizer = _FakeAuthorizer()
         self._authorizer: AccessAuthorizer = authorizer
+        if mon_cmd_issuer is None:
+            mon_cmd_issuer = _FakeMonCommandIssuer()
+        self._mon_cmd_issuer: MonCommandIssuer = mon_cmd_issuer
         self._orch = orch  # if None, disables updating the spec via orch
         if earmark_resolver is None:
             earmark_resolver = cast(EarmarkResolver, _FakeEarmarkResolver())
@@ -405,6 +425,9 @@ class ClusterConfigHandler:
     def user_and_group_ids(self) -> List[str]:
         return list(UsersAndGroupsEntry.ids(self.internal_store))
 
+    def rgw_credential_ids(self) -> List[str]:
+        return list(RGWCredentialEntry.ids(self.internal_store))
+
     def all_resources(self) -> List[SMBResource]:
         with _store_transaction(self.internal_store):
             return self._search_resources(_Matcher())
@@ -536,13 +559,14 @@ class ClusterConfigHandler:
                 removed_cluster_ids.add(cluster_id)
                 continue
             present_cluster_ids.add(cluster_id)
+            cluster_shares = [
+                self._share_entry(cid, shid).get_share()
+                for cid, shid in share_ids
+                if cid == cluster_id
+            ]
             change_group = ClusterChangeGroup(
                 cluster,
-                [
-                    self._share_entry(cid, shid).get_share()
-                    for cid, shid in share_ids
-                    if cid == cluster_id
-                ],
+                cluster_shares,
                 [
                     self._join_auth_entry(_id).get_join_auth()
                     for _id in auth_refs(cluster)
@@ -557,6 +581,12 @@ class ClusterConfigHandler:
                     ).get_tls_credential()
                     for _id in tls_refs(cluster)
                 ],
+                [
+                    RGWCredentialEntry.from_store(
+                        self.internal_store, _id
+                    ).get_rgw_credential()
+                    for _id in rgw_credential_refs(cluster_shares)
+                ],
                 [
                     ExternalCephClusterEntry.from_store(
                         self.internal_store, _id
@@ -597,6 +627,7 @@ class ClusterConfigHandler:
         chg_join_ids: Set[str] = set()
         chg_ug_ids: Set[str] = set()
         chg_tls_ids: Set[str] = set()
+        chg_rgw_cred_ids: Set[str] = set()
         chg_extc_ids: Set[str] = set()
         for result in updated:
             state = (result.status or {}).get('state', None)
@@ -618,13 +649,21 @@ class ClusterConfigHandler:
                 chg_ug_ids.add(result.src.users_groups_id)
             elif isinstance(result.src, resources.TLSCredential):
                 chg_tls_ids.add(result.src.tls_credential_id)
+            elif isinstance(result.src, resources.RGWCredential):
+                chg_rgw_cred_ids.add(result.src.rgw_credential_id)
             elif isinstance(result.src, resources.ExternalCephCluster):
                 chg_extc_ids.add(result.src.external_ceph_cluster_id)
 
         # TODO: here's a lazy bit. if any join auths or users/groups changed we
         # will regen all clusters because these can be shared by >1 cluster.
         # In future, make this only pick clusters using the named resources.
-        if chg_join_ids or chg_ug_ids or chg_tls_ids or chg_extc_ids:
+        if (
+            chg_join_ids
+            or chg_ug_ids
+            or chg_tls_ids
+            or chg_extc_ids
+            or chg_rgw_cred_ids
+        ):
             chg_cluster_ids.update(ClusterEntry.ids(self.internal_store))
         return chg_cluster_ids
 
@@ -661,25 +700,16 @@ class ClusterConfigHandler:
         _save_pending_join_auths(self.priv_store, change_group)
         _save_pending_users_and_groups(self.priv_store, change_group)
         _save_pending_tls_credentials(self.priv_store, change_group)
-        _save_pending_rgw_credentials(self.priv_store, change_group)
-        rgw_credential_entries = {
-            share.share_id: change_group.cache[
-                external.rgw_credentials_key(
-                    change_group.cluster.cluster_id, share.share_id
-                )
-            ]
-            for share in change_group.shares
-            if share.rgw is not None
-            and share.rgw.access_key_id
-            and share.rgw.secret_access_key
-        }
+        # Create RGW authorizer for this cluster configuration
+        rgw_authorizer = RGWAuthorizer(self._mon_cmd_issuer)
         cluster_conf = _ClusterConf.assemble(
             change_group,
             self._path_resolver,
             self._authorizer,
-            rgw_credential_entries,
+            rgw_authorizer,
         )
         _save_pending_config(self.public_store, cluster_conf)
+        _save_pending_rgw_config(self.priv_store, cluster_conf)
         # remove any stray objects
         external.rm_other_in_ns(
             self.priv_store,
@@ -716,17 +746,6 @@ class ClusterConfigHandler:
             ]
             for tc in change_group.tls_credentials
         }
-        rgw_credential_entries = {
-            share.share_id: change_group.cache[
-                external.rgw_credentials_key(
-                    cluster.cluster_id, share.share_id
-                )
-            ]
-            for share in change_group.shares
-            if share.rgw is not None
-            and share.rgw.access_key_id
-            and share.rgw.secret_access_key
-        }
         ext_ceph_cluster = None
         if change_group.ext_ceph_clusters:
             assert len(change_group.ext_ceph_clusters) == 1
@@ -738,7 +757,7 @@ class ClusterConfigHandler:
             join_source_entries=join_source_entries,
             user_source_entries=user_source_entries,
             tls_credential_entries=tls_credential_entries,
-            data_entity=cluster_conf.data_entity,
+            user_entities=cluster_conf.user_entities,
             needs_proxy=_has_proxied_vfs(change_group),
             ext_ceph_cluster=ext_ceph_cluster,
             ssl_certificates=ssl_certificates,
@@ -830,8 +849,7 @@ class _ShareConf:
     resolver: PathResolver
     cephx_entity: str
     ceph_cluster: str
-    rgw_access_key_uri: Optional[str] = None
-    rgw_secret_key_uri: Optional[str] = None
+    rgw_entity: str = ''
 
 
 @dataclasses.dataclass(frozen=True)
@@ -839,7 +857,7 @@ class _ClusterConf:
     resource: resources.Cluster
     shares: Iterable[_ShareConf]
     change_group: ClusterChangeGroup
-    data_entity: str
+    user_entities: List[str]
 
     @classmethod
     def assemble(
@@ -847,7 +865,7 @@ class _ClusterConf:
         change_group: ClusterChangeGroup,
         default_resolver: PathResolver,
         authorizer: AccessAuthorizer,
-        rgw_credential_entries: Dict[str, ConfigEntry],
+        rgw_authorizer: RGWAuthorizer,
     ) -> Self:
         extcc = None
         assert isinstance(change_group.cluster, resources.Cluster)
@@ -857,102 +875,99 @@ class _ClusterConf:
 
         resolver = default_resolver
         cephx_entity = ''  # default to no entity for data access
-        cephadm_data_entity = ''  # passed to cephadm service spec
+        cephfs_entity = ''  # CephFS-specific entity
+        rgw_entity = ''  # RGW-specific entity
+        cephadm_data_entities: List[
+            str
+        ] = []  # passed to cephadm service spec
         ceph_cluster = ''  # empty string means local cluster
         if extcc:
             log.debug('external ceph cluster')
             resolver = ExoResolver(change_group.cluster)
             ceph_cluster = 'exo'
             cephx_entity = checked(extcc.cluster).cephfs_user.name
+            cephfs_entity = cephx_entity
+            cephadm_data_entities = [cephx_entity]
         elif change_group.shares:
             # Check if we have any CephFS shares that need CephX auth
             has_cephfs_shares = any(
                 s.cephfs is not None for s in change_group.shares
             )
+            has_rgw_shares = any(
+                s.rgw is not None for s in change_group.shares
+            )
             if has_cephfs_shares:
                 log.debug('local ceph cluster with CephFS shares')
-                cephx_entity = _cephx_data_entity(change_group.cluster)
+                cephfs_entity = _cephx_data_entity(change_group.cluster)
                 # ensure an entity exists with access to the volumes (CephFS only)
                 for share in change_group.shares:
                     if share.cephfs:
                         authorizer.authorize_entity(
-                            share.checked_cephfs.volume, cephx_entity
+                            share.checked_cephfs.volume, cephfs_entity
                         )
-                cephadm_data_entity = cephx_entity
-            else:
-                log.debug(
-                    'local ceph cluster with RGW shares only (no CephX auth needed)'
-                )
+                cephx_entity = cephfs_entity
+                cephadm_data_entities.append(cephfs_entity)
+            if has_rgw_shares:
+                log.debug('local ceph cluster with RGW shares')
+                # RGW shares need a CephX entity for RADOS access
+                rgw_entity = _cephx_rgw_entity(change_group.cluster)
+                # Authorize the entity using the provided RGW authorizer
+                rgw_authorizer.authorize_entity(rgw_entity)
+                cephadm_data_entities.append(rgw_entity)
         else:
             log.debug('local cluster without shares: skipping ceph auth')
         return cls(
             change_group.cluster,
             [
-                _make_share_conf(
+                _ShareConf(
                     s,
                     change_group.cluster,
                     resolver,
-                    cephx_entity,
+                    cephfs_entity,
                     ceph_cluster,
-                    rgw_credential_entries,
+                    rgw_entity=rgw_entity,
                 )
                 for s in change_group.shares
             ],
             change_group,
-            cephadm_data_entity,
+            cephadm_data_entities,
         )
 
 
-def _make_share_conf(
-    s: resources.Share,
-    cluster: resources.Cluster,
-    resolver: PathResolver,
-    cephx_entity: str,
-    ceph_cluster: str,
-    rgw_credential_entries: Dict[str, ConfigEntry],
-) -> _ShareConf:
-    creds_entry = rgw_credential_entries.get(s.share_id)
-    # Get the URI from the ConfigEntry object, not from the data
-    access_key_uri = (
-        f'URI:{creds_entry.uri}:access_key_id' if creds_entry else None
-    )
-    secret_key_uri = (
-        f'URI:{creds_entry.uri}:secret_access_key' if creds_entry else None
-    )
-    return _ShareConf(
-        s,
-        cluster,
-        resolver,
-        cephx_entity,
-        ceph_cluster,
-        rgw_access_key_uri=access_key_uri,
-        rgw_secret_key_uri=secret_key_uri,
-    )
-
-
 def _generate_rgw_share(
     conf: _ShareConf,
+    cred_map: Dict[str, resources.RGWCredential],
 ) -> Dict[str, Dict[str, str]]:
     """Generate Samba configuration for an RGW-backed share."""
     share = conf.resource
     rgw = share.rgw
     assert rgw is not None, "RGW storage configuration missing"
 
-    # Use URI-based credential references (already formatted in _make_share_conf)
-    access_key_uri = conf.rgw_access_key_uri or ''
-    secret_key_uri = conf.rgw_secret_key_uri or ''
+    # Get user_id from credential (credential_ref is guaranteed by validation)
+    assert rgw.credential_ref is not None
+    cred = cred_map.get(rgw.credential_ref)
+    if cred is None:
+        log.error(
+            "share %r references missing RGW credential %r",
+            share.name,
+            rgw.credential_ref,
+        )
+        user_id = ""
+    else:
+        user_id = cred.user_id or ""
 
     cfg = {
         # smb.conf options
         'options': {
             'path': '/',
             'vfs objects': 'ceph_rgw',
-            'ceph_rgw:config_file': '/etc/ceph/ceph.conf',
-            'ceph_rgw:keyring_file': '/etc/ceph/ceph.client.admin.keyring',
             'ceph_rgw:bucket': rgw.bucket,
-            'ceph_rgw:user_id': rgw.user_id or '',
-            'ceph_rgw:access_key': access_key_uri,
-            'ceph_rgw:secret_access_key': secret_key_uri,
+            'ceph_rgw:user_id': user_id,
+            # Credential values are left empty here; they are injected at
+            # deploy time via a config:merge stub in the private store so
+            # they never appear in the public RADOS config.
+            'ceph_rgw:access_key': '',
+            'ceph_rgw:secret_access_key': '',
             'ceph_rgw:debug': 'off',
             'read only': ynbool(share.readonly),
             'browseable': ynbool(share.browseable),
@@ -977,12 +992,7 @@ def _generate_rgw_share(
     return cfg
 
 
-def _generate_share(conf: _ShareConf) -> Dict[str, Dict[str, str]]:
-    share = conf.resource
-    cephx_entity = conf.cephx_entity
-    cephfs = share.checked_cephfs
-    assert cephfs.provider.is_vfs(), "not a vfs provider"
-    assert cephx_entity, "cephx entity name missing"
+def cephx_stripped_entity(cephx_entity: str) -> str:
     # very annoyingly, samba's ceph module absolutely must NOT have the
     # "client." bit in front. JJM has been tripped up by this multiple times -
     # seemingly every time this module is touched.
@@ -990,6 +1000,16 @@ def _generate_share(conf: _ShareConf) -> Dict[str, Dict[str, str]]:
     plen = len(_prefix)
     if cephx_entity.startswith(_prefix):
         cephx_entity = cephx_entity[plen:]
+    return cephx_entity
+
+
+def _generate_share(conf: _ShareConf) -> Dict[str, Dict[str, str]]:
+    share = conf.resource
+    cephx_entity = conf.cephx_entity
+    cephfs = share.checked_cephfs
+    assert cephfs.provider.is_vfs(), "not a vfs provider"
+    assert cephx_entity, "cephx entity name missing"
+    cephx_entity = cephx_stripped_entity(cephx_entity)
     path = conf.resolver.resolve(
         cephfs.volume,
         cephfs.subvolumegroup,
@@ -1156,9 +1176,30 @@ def _generate_config(conf: _ClusterConf) -> Dict[str, Any]:
     cluster_global_opts['smb ports'] = str(_smb_port(cluster))
     _set_debug_level(cluster_global_opts, conf)
 
+    # Check if cluster has RGW shares and add global RGW options
+    has_rgw_shares = any(share.resource.rgw for share in conf.shares)
+    if has_rgw_shares:
+        # Get pre-calculated stripped RGW entity from first RGW share
+        rgw_entity = next(
+            (share.rgw_entity for share in conf.shares if share.resource.rgw),
+            '',
+        )
+        if rgw_entity:
+            cluster_global_opts[
+                'ceph_rgw:config_file'
+            ] = '/etc/ceph/ceph.conf'
+            cluster_global_opts['ceph_rgw:keyring_file'] = '/etc/ceph/keyring'
+            cluster_global_opts['ceph_rgw:id'] = cephx_stripped_entity(
+                rgw_entity
+            )
+
+    cred_map = {
+        c.rgw_credential_id: c for c in conf.change_group.rgw_credentials
+    }
+
     share_configs = {
         share.resource.name: (
-            _generate_rgw_share(share)
+            _generate_rgw_share(share, cred_map)
             if share.resource.rgw
             else _generate_share(share)
         )
@@ -1215,7 +1256,7 @@ def _generate_smb_service_spec(
     join_source_entries: List[ConfigEntry],
     user_source_entries: List[ConfigEntry],
     tls_credential_entries: Dict[str, ConfigEntry],
-    data_entity: str = '',
+    user_entities: List[str],
     needs_proxy: bool = False,
     ext_ceph_cluster: Optional[resources.ExternalCephCluster],
     ssl_certificates: Dict[str, SSLParameters],
@@ -1250,9 +1291,6 @@ def _generate_smb_service_spec(
     user_sources: List[str] = []
     for entry in user_source_entries:
         user_sources.append(entry.uri)
-    user_entities: Optional[List[str]] = None
-    if data_entity:
-        user_entities = [data_entity]
 
     rc_cert = rc_key = rc_ca_cert = None
     if cluster.is_feature_enabled(_REMOTE_CONTROL):
@@ -1462,31 +1500,6 @@ def _save_pending_tls_credentials(
         change_group.cache_updated_entry(tc_entry)
 
 
-def _save_pending_rgw_credentials(
-    store: ConfigStore,
-    change_group: ClusterChangeGroup,
-) -> None:
-    """Save RGW credentials for shares in the priv store."""
-    cluster = change_group.cluster
-    assert isinstance(cluster, resources.Cluster)
-
-    # Save credentials for each RGW share
-    for share in change_group.shares:
-        if share.rgw is not None:
-            # Only save if credentials are present
-            if share.rgw.access_key_id and share.rgw.secret_access_key:
-                ext_key = external.rgw_credentials_key(
-                    cluster.cluster_id, share.share_id
-                )
-                creds_entry = store[ext_key]
-                creds_data = {
-                    'access_key_id': share.rgw.access_key_id,
-                    'secret_access_key': share.rgw.secret_access_key,
-                }
-                creds_entry.set(creds_data)
-                change_group.cache_updated_entry(creds_entry)
-
-
 def _save_pending_config(
     store: ConfigStore,
     cluster_conf: _ClusterConf,
@@ -1498,6 +1511,49 @@ def _save_pending_config(
     cluster_conf.change_group.cache_updated_entry(centry)
 
 
+def _save_pending_rgw_config(
+    store: ConfigStore,
+    cluster_conf: _ClusterConf,
+) -> None:
+    """Save an RGW credential stub to the private store for RGW clusters.
+
+    Writes a stub using sambacc's config:merge mechanism, which merges the
+    provided JSON on top of the primary config at load time.  The mgr
+    populates the stub with only the RGW credential fields here; everything else
+    stays in the public RADOS config.  The stub URI is passed to the container
+    via extra_config_uris so credentials never appear in the public pool.
+    """
+    cluster_id = cluster_conf.resource.cluster_id
+    rgw_shares = [s for s in cluster_conf.shares if s.resource.rgw]
+    if not rgw_shares:
+        return
+    cred_map = {
+        c.rgw_credential_id: c
+        for c in cluster_conf.change_group.rgw_credentials
+    }
+    merge_shares: Dict[str, Any] = {}
+    for sc in rgw_shares:
+        rgw = sc.resource.rgw
+        assert rgw is not None
+        assert rgw.credential_ref is not None
+        cred = cred_map[rgw.credential_ref]
+        access_key = cred.access_key_id or ''
+        secret_key = cred.secret_access_key or ''
+        merge_shares[sc.resource.name] = {
+            'options': {
+                'ceph_rgw:access_key': access_key,
+                'ceph_rgw:secret_access_key': secret_key,
+            }
+        }
+    stub = {
+        'samba-container-config': 'v0',
+        'config:merge': {'shares': merge_shares},
+    }
+    centry = store[external.rgw_config_key(cluster_id)]
+    centry.set(stub)
+    cluster_conf.change_group.cache_updated_entry(centry)
+
+
 def _save_pending_spec_backup(
     store: ConfigStore, change_group: ClusterChangeGroup, smb_spec: SMBSpec
 ) -> None:
@@ -1515,6 +1571,15 @@ def _cephx_data_entity(cluster: resources.Cluster) -> str:
     return f'client.smb.fs.cluster.{cluster.cluster_id}'
 
 
+def _cephx_rgw_entity(cluster: resources.Cluster) -> str:
+    """Generate a name for the cephx key that a cluster (smbd) will
+    use for RGW data access.
+    """
+    if cluster.external_ceph_cluster:
+        return ''
+    return f'client.smb.rgw.cluster.{cluster.cluster_id}'
+
+
 @contextlib.contextmanager
 def _store_transaction(store: ConfigStore) -> Iterator[None]:
     transaction = getattr(store, 'transaction', None)
diff --git a/src/pybind/mgr/smb/internal.py b/src/pybind/mgr/smb/internal.py
index a954ebc782d..8b16826ea25 100644
--- a/src/pybind/mgr/smb/internal.py
+++ b/src/pybind/mgr/smb/internal.py
@@ -223,6 +223,23 @@ class TLSCredentialEntry(CommonResourceEntry):
         return self.get_resource_type(resources.TLSCredential)
 
 
+class RGWCredentialEntry(CommonResourceEntry):
+    """RGWCredentialEntry resource getter/setter for the smb internal data
+    store(s).
+    """
+
+    namespace = ConfigNS.RGW_CREDENTIALS
+    _for_resource = resources.RGWCredential
+
+    @classmethod
+    def to_key(cls, resource: SMBResource) -> ResourceKey:
+        assert isinstance(resource, cls._for_resource)
+        return ResourceIDKey(resource.rgw_credential_id)
+
+    def get_rgw_credential(self) -> resources.RGWCredential:
+        return self.get_resource_type(resources.RGWCredential)
+
+
 class ExternalCephClusterEntry(CommonResourceEntry):
     """ExternalCephCluster resource getter/setter for internal store."""
 
@@ -251,6 +268,7 @@ def map_resource_entry(
         resources.JoinAuth: JoinAuthEntry,
         resources.UsersAndGroups: UsersAndGroupsEntry,
         resources.TLSCredential: TLSCredentialEntry,
+        resources.RGWCredential: RGWCredentialEntry,
         resources.ExternalCephCluster: ExternalCephClusterEntry,
     }
     try:
diff --git a/src/pybind/mgr/smb/module.py b/src/pybind/mgr/smb/module.py
index 185d1b1718d..5392a12621b 100644
--- a/src/pybind/mgr/smb/module.py
+++ b/src/pybind/mgr/smb/module.py
@@ -100,6 +100,7 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             public_store=self._public_store,
             path_resolver=path_resolver,
             authorizer=authorizer,
+            mon_cmd_issuer=self,
             orch=self._orch_backend(enable_orch=uo),
             earmark_resolver=earmark_resolver,
             tool_execer=self,
@@ -630,12 +631,12 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
         """Create an SMB share backed by RGW"""
         try:
             # Pass 'self' which conforms to ToolExecer protocol
-            (
-                fetched_user_id,
-                access_key,
-                secret_key,
-            ) = rgw.fetch_rgw_credentials(self, bucket, user_id)
+            fetched_user_id = rgw.fetch_rgw_credentials(
+                self, bucket, user_id
+            )[0]
 
+            # Create share with user credentials
+            # The staging layer will auto-create the credential if needed
             share = resources.Share(
                 cluster_id=cluster_id,
                 share_id=share_id,
@@ -644,11 +645,11 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
                 rgw=resources.RGWStorage(
                     bucket=bucket,
                     user_id=fetched_user_id,
-                    access_key_id=access_key,
-                    secret_access_key=secret_key,
                 ),
             )
-            return self._apply_res([share], create_only=True).one()
+
+            # Apply share resource (staging may create credential too)
+            return self._apply_res([share], create_only=True).squash(share)
         except ValueError as e:
             # Create a minimal share resource for error reporting
             error_share = resources.Share(
diff --git a/src/pybind/mgr/smb/resources.py b/src/pybind/mgr/smb/resources.py
index 118a40fa813..66d2e7585f5 100644
--- a/src/pybind/mgr/smb/resources.py
+++ b/src/pybind/mgr/smb/resources.py
@@ -406,8 +406,7 @@ class RGWStorage(_RBase):
 
     bucket: str
     user_id: Optional[str] = None
-    access_key_id: Optional[str] = None
-    secret_access_key: Optional[str] = None
+    credential_ref: Optional[str] = None
 
     def validate(self) -> None:
         if not self.bucket:
@@ -418,23 +417,12 @@ class RGWStorage(_RBase):
         return self.__class__(
             bucket=self.bucket,
             user_id=self.user_id,
-            access_key_id=(
-                _password_convert(self.access_key_id, operation)
-                if self.access_key_id
-                else None
-            ),
-            secret_access_key=(
-                _password_convert(self.secret_access_key, operation)
-                if self.secret_access_key
-                else None
-            ),
+            credential_ref=self.credential_ref,
         )
 
     @resourcelib.customize
     def _customize_resource(rc: resourcelib.Resource) -> resourcelib.Resource:
         rc.user_id.quiet = True
-        rc.access_key_id.quiet = True
-        rc.secret_access_key.quiet = True
         return rc
 
 
@@ -1199,6 +1187,52 @@ class TLSCredential(_RBase):
         return self
 
 
+@resourcelib.resource('ceph.smb.rgw.credential')
+class RGWCredential(_RBase):
+    """Contains RGW user credentials that can be referenced by multiple
+    SMB shares backed by RGW buckets.
+    """
+
+    rgw_credential_id: str
+    user_id: str
+    access_key_id: str
+    secret_access_key: str
+    intent: Intent = Intent.PRESENT
+    linked_to_cluster: Optional[str] = None
+
+    def validate(self) -> None:
+        if not self.rgw_credential_id:
+            raise ValueError('rgw_credential_id requires a value')
+        validation.check_id(self.rgw_credential_id)
+        if self.linked_to_cluster is not None:
+            validation.check_id(self.linked_to_cluster)
+        if self.intent is Intent.PRESENT:
+            if not self.user_id:
+                raise ValueError('user_id must be specified')
+            if not self.access_key_id:
+                raise ValueError('access_key_id must be specified')
+            if not self.secret_access_key:
+                raise ValueError('secret_access_key must be specified')
+
+    @resourcelib.customize
+    def _customize_resource(rc: resourcelib.Resource) -> resourcelib.Resource:
+        rc.linked_to_cluster.quiet = True
+        rc.on_construction_error(InvalidResourceError.wrap)
+        return rc
+
+    def convert(self, operation: ConversionOp) -> Self:
+        return self.__class__(
+            rgw_credential_id=self.rgw_credential_id,
+            intent=self.intent,
+            user_id=self.user_id,
+            access_key_id=_password_convert(self.access_key_id, operation),
+            secret_access_key=_password_convert(
+                self.secret_access_key, operation
+            ),
+            linked_to_cluster=self.linked_to_cluster,
+        )
+
+
 @resourcelib.component()
 class CephUserKey(_RBase):
     """A Ceph User Key name and value pair."""
@@ -1243,6 +1277,7 @@ SMBResource = Union[
     Share,
     UsersAndGroups,
     TLSCredential,
+    RGWCredential,
     ExternalCephCluster,
 ]
 
diff --git a/src/pybind/mgr/smb/rgw_auth.py b/src/pybind/mgr/smb/rgw_auth.py
new file mode 100644
index 00000000000..14929f17765
--- /dev/null
+++ b/src/pybind/mgr/smb/rgw_auth.py
@@ -0,0 +1,50 @@
+"""RGW authorization utilities for SMB."""
+
+from typing import List, Optional
+
+import logging
+
+from .proto import MonCommandIssuer
+
+log = logging.getLogger(__name__)
+
+
+class RGWAuthorizationGrantError(ValueError):
+    pass
+
+
+class RGWAuthorizer:
+    """Using the rados APIs provided by the ceph mgr, authorize cephx users for
+    RGW access via RADOS.
+    """
+
+    def __init__(self, mc: MonCommandIssuer) -> None:
+        self._mc = mc
+
+    def authorize_entity(
+        self, entity: str, caps: Optional[List[str]] = None
+    ) -> None:
+        """Create or update a CephX entity with RGW access capabilities."""
+
+        assert entity.startswith('client.')
+
+        # Default caps for RGW access via RADOS
+        # These allow the SMB daemon to access RGW data through RADOS
+        if not caps:
+            caps = [
+                'mon',
+                'allow r',
+                'osd',
+                'allow rwx tag rgw *=*',
+            ]
+
+        cmd = {
+            'prefix': 'auth get-or-create',
+            'entity': entity,
+            'caps': caps,
+        }
+        log.info('Requesting RGW authorization: %r', cmd)
+        ret, _, status = self._mc.mon_command(cmd)
+        if ret != 0:
+            raise RGWAuthorizationGrantError(status)
+        log.info('RGW authorization request success: %r', status)
diff --git a/src/pybind/mgr/smb/sqlite_store.py b/src/pybind/mgr/smb/sqlite_store.py
index 0f01aa5f5b0..39e2de03e5e 100644
--- a/src/pybind/mgr/smb/sqlite_store.py
+++ b/src/pybind/mgr/smb/sqlite_store.py
@@ -535,6 +535,22 @@ class MirrorExternalCephCluster(Mirror):
         return filtered
 
 
+class MirrorRGWCredentials(Mirror):
+    """Mirroring configuration for objects in the rgw_credentials namespace."""
+
+    def __init__(self, store: ConfigStore) -> None:
+        super().__init__('rgw_credentials', store)
+
+    def filter_object(self, obj: Simplified) -> Simplified:
+        """Filter rgw_credential for sqlite3 store."""
+        filtered = copy.deepcopy(obj)
+        if filtered.get('access_key_id'):
+            filtered.pop('access_key_id', None)
+        if filtered.get('secret_access_key'):
+            filtered.pop('secret_access_key', None)
+        return filtered
+
+
 def _tables(
     *,
     specialize: bool = True,
@@ -556,6 +572,7 @@ def _tables(
         SimpleTable('join_auths', 'join_auths'),
         SimpleTable('users_and_groups', 'users_and_groups'),
         SimpleTable('tls_creds', 'tls_creds'),
+        SimpleTable('rgw_creds', 'rgw_creds'),
         SimpleTable('ext_ceph_clusters', 'ext_ceph_clusters'),
     ]
 
@@ -582,6 +599,10 @@ def _mirror_external_ceph_clusters(
     return (opts or {}).get('mirror_external_ceph_clusters') != 'no'
 
 
+def _mirror_rgw_credentials(opts: Optional[Dict[str, str]] = None) -> bool:
+    return (opts or {}).get('mirror_rgw_credentials') != 'no'
+
+
 def mgr_sqlite3_db(
     mgr: Any, opts: Optional[Dict[str, str]] = None
 ) -> SqliteStore:
@@ -611,6 +632,8 @@ def mgr_sqlite3_db_with_mirroring(
         mirrors.append(MirrorTLSCredentials(mirror_store))
     if _mirror_external_ceph_clusters(opts):
         mirrors.append(MirrorExternalCephCluster(mirror_store))
+    if _mirror_rgw_credentials(opts):
+        mirrors.append(MirrorRGWCredentials(mirror_store))
     return SqliteMirroringStore(mgr, tables, mirrors)
 
 
diff --git a/src/pybind/mgr/smb/staging.py b/src/pybind/mgr/smb/staging.py
index aceb776cbfe..87f96890a66 100644
--- a/src/pybind/mgr/smb/staging.py
+++ b/src/pybind/mgr/smb/staging.py
@@ -30,6 +30,7 @@ from .internal import (
     ClusterEntry,
     JoinAuthEntry,
     ResourceEntry,
+    RGWCredentialEntry,
     ShareEntry,
     TLSCredentialEntry,
     UsersAndGroupsEntry,
@@ -127,6 +128,18 @@ class Staging:
             self.destination_store, ug_id
         ).get_users_and_groups()
 
+    def get_rgw_credential(
+        self, rgw_credential_id: str
+    ) -> resources.RGWCredential:
+        ekey = (str(RGWCredentialEntry.namespace), rgw_credential_id)
+        if ekey in self.incoming:
+            res = self.incoming[ekey]
+            assert isinstance(res, resources.RGWCredential)
+            return res
+        return RGWCredentialEntry.from_store(
+            self.destination_store, rgw_credential_id
+        ).get_rgw_credential()
+
     def save(self) -> ResultGroup:
         results = ResultGroup()
         for res in self.deleted.values():
@@ -167,6 +180,7 @@ class Staging:
         self._prune(cids, JoinAuthEntry, resources.JoinAuth)
         self._prune(cids, UsersAndGroupsEntry, resources.UsersAndGroups)
         self._prune(cids, TLSCredentialEntry, resources.TLSCredential)
+        self._prune(cids, RGWCredentialEntry, resources.RGWCredential)
 
 
 def auth_refs(cluster: resources.Cluster) -> Collection[str]:
@@ -360,27 +374,12 @@ def _check_share_resource(
             status={"cluster_id": share.cluster_id},
         )
 
-    # Handle RGW shares - validate bucket existence and auto-fetch credentials
+    # Handle RGW shares
     if share.rgw is not None:
-        # Validate bucket exists
-        if not rgw.validate_rgw_bucket(
-            staging._tool_execer, share.rgw.bucket
-        ):
-            raise ErrorResult(
-                share,
-                msg=f"RGW bucket '{share.rgw.bucket}' does not exist or is not accessible",
-            )
-
-        # Auto-fetch credentials if not provided
-        if (
-            not share.rgw.user_id
-            or not share.rgw.access_key_id
-            or not share.rgw.secret_access_key
-        ):
+        # If credential_ref is not provided, auto-create credential
+        if not share.rgw.credential_ref:
+            # Fetch credentials from RGW
             try:
-                log.debug(
-                    f"Auto-fetching RGW credentials for bucket {share.rgw.bucket}"
-                )
                 (
                     fetched_user_id,
                     access_key,
@@ -390,22 +389,81 @@ def _check_share_resource(
                     share.rgw.bucket,
                     share.rgw.user_id or '',
                 )
-                # Update the share's RGW storage with fetched credentials
-                share.rgw = resources.RGWStorage(
-                    bucket=share.rgw.bucket,
-                    user_id=fetched_user_id,
-                    access_key_id=access_key,
-                    secret_access_key=secret_key,
-                )
-                log.debug(
-                    f"Successfully fetched credentials for user {fetched_user_id}"
-                )
             except ValueError as e:
                 raise ErrorResult(
                     share,
                     msg=f"Failed to fetch RGW credentials: {str(e)}",
                 )
 
+            # Create credential resource automatically
+            # Use user_id as credential_id (linked to cluster via linked_to_cluster field)
+            credential_id = fetched_user_id
+
+            # Check if credential already exists
+            try:
+                cred = staging.get_rgw_credential(credential_id)
+                # Credential exists, validate it's linked to correct cluster
+                if (
+                    cred.linked_to_cluster
+                    and cred.linked_to_cluster != share.cluster_id
+                ):
+                    raise ErrorResult(
+                        share,
+                        msg='RGW credential is linked to a different cluster',
+                        status={
+                            'credential_ref': credential_id,
+                            'other_cluster_id': cred.linked_to_cluster,
+                        },
+                    )
+            except KeyError:
+                # Credential doesn't exist, create it
+                cred = resources.RGWCredential(
+                    rgw_credential_id=credential_id,
+                    user_id=fetched_user_id,
+                    access_key_id=access_key,
+                    secret_access_key=secret_key,
+                    linked_to_cluster=share.cluster_id,
+                )
+                # Stage the credential
+                staging.stage(cred)
+
+            # Update share to use credential_ref
+            share.rgw = resources.RGWStorage(
+                bucket=share.rgw.bucket,
+                credential_ref=credential_id,
+            )
+        else:
+            # Validate existing credential_ref
+            try:
+                cred = staging.get_rgw_credential(share.rgw.credential_ref)
+            except KeyError:
+                raise ErrorResult(
+                    share,
+                    msg=f"RGW credential '{share.rgw.credential_ref}' not found",
+                    status={"credential_ref": share.rgw.credential_ref},
+                )
+
+            if (
+                cred.linked_to_cluster
+                and cred.linked_to_cluster != share.cluster_id
+            ):
+                raise ErrorResult(
+                    share,
+                    msg='RGW credential is linked to a different cluster',
+                    status={
+                        'credential_ref': share.rgw.credential_ref,
+                        'other_cluster_id': cred.linked_to_cluster,
+                    },
+                )
+        # Validate bucket exists
+        if not rgw.validate_rgw_bucket(
+            staging._tool_execer, share.rgw.bucket
+        ):
+            raise ErrorResult(
+                share,
+                msg=f"RGW bucket '{share.rgw.bucket}' does not exist or is not accessible",
+            )
+
         name_used_by = _share_name_in_use(staging, share)
         if name_used_by:
             raise ErrorResult(
@@ -677,6 +735,59 @@ def _check_tls_credential_present(
             )
 
 
+@cross_check_resource.register
+def _check_rgw_credential_resource(
+    resource: resources.RGWCredential, staging: Staging, **_kw: Any
+) -> None:
+    """Check that the RGW credential resource can be updated."""
+    if resource.intent == Intent.PRESENT:
+        return _check_rgw_credential_present(resource, staging)
+    return _check_rgw_credential_removed(resource, staging)
+
+
+def _check_rgw_credential_removed(
+    rgw_cred: resources.RGWCredential, staging: Staging
+) -> None:
+    refs_in_use: Dict[str, List[str]] = {}
+    for cid, sid in ShareEntry.ids(staging):
+        try:
+            share = ShareEntry.from_store(
+                staging.destination_store, cid, sid
+            ).get_share()
+        except KeyError:
+            continue
+        if (
+            share.rgw
+            and share.rgw.credential_ref == rgw_cred.rgw_credential_id
+        ):
+            refs_in_use.setdefault(rgw_cred.rgw_credential_id, []).append(
+                f'{cid}.{sid}'
+            )
+    if rgw_cred.rgw_credential_id in refs_in_use:
+        raise ErrorResult(
+            rgw_cred,
+            msg='RGW credential resource in use by shares',
+            status={
+                'shares': refs_in_use[rgw_cred.rgw_credential_id],
+            },
+        )
+
+
+def _check_rgw_credential_present(
+    rgw_cred: resources.RGWCredential, staging: Staging
+) -> None:
+    if rgw_cred.linked_to_cluster:
+        cids = set(ClusterEntry.ids(staging))
+        if rgw_cred.linked_to_cluster not in cids:
+            raise ErrorResult(
+                rgw_cred,
+                msg='linked_to_cluster id not valid',
+                status={
+                    'unknown_id': rgw_cred.linked_to_cluster,
+                },
+            )
+
+
 @cross_check_resource.register
 def _check_external_ceph_cluster_resource(
     ext_cluster: resources.ExternalCephCluster, staging: Staging, **_: Any
@@ -753,6 +864,17 @@ def tls_refs(cluster: resources.Cluster) -> Collection[str]:
     return _remotectl_tls_refs(cluster) | _keybridge_tls_refs(cluster)
 
 
+def rgw_credential_refs(
+    shares: List[resources.Share],
+) -> Collection[str]:
+    """Return all credential_ref IDs used by RGW-backed shares."""
+    return {
+        share.rgw.credential_ref
+        for share in shares
+        if share.rgw is not None and share.rgw.credential_ref
+    }
+
+
 def _keybridge_ids(
     cluster: resources.Cluster,
 ) -> Dict[str, resources.KeyBridgeScopeIdentity]:

From b992ef63d1f0bbdd07c7ffa4380575473b4e8080 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Tue, 14 Apr 2026 18:13:59 +0200
Subject: [PATCH 437/596] tools: add missing includes

Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 src/tools/ceph-dencoder/denc_registry.h | 1 +
 src/tools/ceph_monstore_tool.cc         | 1 +
 src/tools/cephfs/Dumper.cc              | 1 +
 src/tools/cephfs/MDSUtility.cc          | 1 +
 src/tools/cephfs/Resetter.cc            | 1 +
 src/tools/cephfs_mirror/PeerReplayer.h  | 7 +++++++
 src/tools/cephfs_mirror/Types.cc        | 2 ++
 src/tools/cephfs_mirror/Types.h         | 4 +++-
 src/tools/monmaptool.cc                 | 1 +
 src/tools/rbd_mirror/ImageReplayer.cc   | 1 +
 10 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/tools/ceph-dencoder/denc_registry.h b/src/tools/ceph-dencoder/denc_registry.h
index 6b152a4b234..1b6496ab3a4 100644
--- a/src/tools/ceph-dencoder/denc_registry.h
+++ b/src/tools/ceph-dencoder/denc_registry.h
@@ -9,6 +9,7 @@
 #include <string_view>
 
 #include "include/buffer_fwd.h"
+#include "global/global_context.h" // for g_ceph_context
 #include "msg/Message.h"
 
 namespace ceph {
diff --git a/src/tools/ceph_monstore_tool.cc b/src/tools/ceph_monstore_tool.cc
index 31ed80882d3..a84639aedd7 100644
--- a/src/tools/ceph_monstore_tool.cc
+++ b/src/tools/ceph_monstore_tool.cc
@@ -37,6 +37,7 @@
 #include "osd/OSDMap.h"
 #include "crush/CrushCompiler.h"
 #include "mon/CreatingPGs.h"
+#include "mon/mon_types.h" // for CEPH_MON_ONDISK_MAGIC
 
 namespace po = boost::program_options;
 
diff --git a/src/tools/cephfs/Dumper.cc b/src/tools/cephfs/Dumper.cc
index cf4dbf2d876..ce823050dd0 100644
--- a/src/tools/cephfs/Dumper.cc
+++ b/src/tools/cephfs/Dumper.cc
@@ -17,6 +17,7 @@
 
 #include "include/compat.h"
 #include "include/fs_types.h"
+#include "common/Cond.h"
 #include "common/debug.h"
 #include "common/entity_name.h"
 #include "common/errno.h"
diff --git a/src/tools/cephfs/MDSUtility.cc b/src/tools/cephfs/MDSUtility.cc
index 2790d3e1fab..62acb065994 100644
--- a/src/tools/cephfs/MDSUtility.cc
+++ b/src/tools/cephfs/MDSUtility.cc
@@ -14,6 +14,7 @@
 
 #include "MDSUtility.h"
 #include "mon/MonClient.h"
+#include "common/Cond.h"
 #include "common/debug.h"
 
 #define dout_context g_ceph_context
diff --git a/src/tools/cephfs/Resetter.cc b/src/tools/cephfs/Resetter.cc
index 3d51dbe8a8a..46ea8e86be9 100644
--- a/src/tools/cephfs/Resetter.cc
+++ b/src/tools/cephfs/Resetter.cc
@@ -16,6 +16,7 @@
 #include "Resetter.h"
 
 #include <memory>
+#include "common/Cond.h"
 #include "common/debug.h"
 #include "common/errno.h"
 #include "osdc/Journaler.h"
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 7339df9e7bf..60cd81239df 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -11,8 +11,15 @@
 #include "Types.h"
 #include "json_spirit/json_spirit.h"
 
+#include <deque>
+#include <functional>
+#include <map>
+#include <queue>
 #include <set>
 #include <stack>
+#include <string>
+#include <vector>
+
 #include <boost/optional.hpp>
 
 namespace cephfs {
diff --git a/src/tools/cephfs_mirror/Types.cc b/src/tools/cephfs_mirror/Types.cc
index 651e3632b6e..ffc8ed0de38 100644
--- a/src/tools/cephfs_mirror/Types.cc
+++ b/src/tools/cephfs_mirror/Types.cc
@@ -3,6 +3,8 @@
 
 #include "Types.h"
 
+#include <iostream>
+
 namespace cephfs {
 namespace mirror {
 
diff --git a/src/tools/cephfs_mirror/Types.h b/src/tools/cephfs_mirror/Types.h
index 8c6fda4efa7..5f51e69cd2f 100644
--- a/src/tools/cephfs_mirror/Types.h
+++ b/src/tools/cephfs_mirror/Types.h
@@ -4,8 +4,10 @@
 #ifndef CEPHFS_MIRROR_TYPES_H
 #define CEPHFS_MIRROR_TYPES_H
 
+#include <map>
 #include <set>
-#include <iostream>
+#include <iosfwd>
+#include <string>
 #include <string_view>
 #include <variant>
 
diff --git a/src/tools/monmaptool.cc b/src/tools/monmaptool.cc
index 8e56b7c4fe7..069869bd5c1 100644
--- a/src/tools/monmaptool.cc
+++ b/src/tools/monmaptool.cc
@@ -23,6 +23,7 @@
 #include "global/global_init.h"
 #include "include/str_list.h"
 #include "mon/MonMap.h"
+#include "mon/mon_types.h" // for ceph::features::mon::*
 
 using std::cerr;
 using std::cout;
diff --git a/src/tools/rbd_mirror/ImageReplayer.cc b/src/tools/rbd_mirror/ImageReplayer.cc
index 9aee9a96b4d..56a91712202 100644
--- a/src/tools/rbd_mirror/ImageReplayer.cc
+++ b/src/tools/rbd_mirror/ImageReplayer.cc
@@ -4,6 +4,7 @@
 #include "include/compat.h"
 #include "common/Formatter.h"
 #include "common/admin_socket.h"
+#include "common/Cond.h"
 #include "common/debug.h"
 #include "common/errno.h"
 #include "include/stringify.h"

From 8ae44f6a3753bf5a1681887bb41705f313c47ff9 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Fri, 26 Jun 2026 08:44:35 +0800
Subject: [PATCH 438/596] mgr: fix PyObject leak in the remote() pickle calls

dispatch_remote() and ceph_dispatch_remote() invoke pickle.loads/dumps via
PyObject_CallMethodObjArgs(pmodule, PyUnicode_FromString("loads"), ...). The
method-name string created by PyUnicode_FromString is a new reference that
CallMethodObjArgs does not steal, and it was never released, so every cross
-module remote() call leaked three PyUnicode objects on the active mgr.

Use PyObject_CallMethod(pmodule, "loads", "(O)", arg), which takes the method
name as a C string and manages it internally, so there is nothing to leak.
The "(O)" format wraps the argument in a one-tuple so it reaches the callee as
a single object. A bare "O" passes the argument through directly, and when it
is a tuple (as remote()'s *args always is, including the empty tuple from a
no-argument call) PyObject_CallMethod unpacks it and calls dumps() with the
wrong arguments, e.g. dumps() with none.

Fixes: https://tracker.ceph.com/issues/77724
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/mgr/ActivePyModule.cc | 18 +++---------------
 src/mgr/BaseMgrModule.cc  | 18 +++---------------
 2 files changed, 6 insertions(+), 30 deletions(-)

diff --git a/src/mgr/ActivePyModule.cc b/src/mgr/ActivePyModule.cc
index a01233ac5dc..24e91082278 100644
--- a/src/mgr/ActivePyModule.cc
+++ b/src/mgr/ActivePyModule.cc
@@ -155,11 +155,7 @@ std::optional<std::vector<std::byte>> ActivePyModule::dispatch_remote(
 
   auto pmodule = py_module->pPickleModule;
   auto pickled_args_bytes = py_bytes_from_span(pickled_args);
-  auto args = PyObject_CallMethodObjArgs(
-    pmodule,
-    PyUnicode_FromString("loads"),
-    pickled_args_bytes,
-    nullptr);
+  auto args = PyObject_CallMethod(pmodule, "loads", "(O)", pickled_args_bytes);
   Py_DECREF(pickled_args_bytes);
   if (args == nullptr) {
     std::string caller = "ActivePyModule::dispatch_remote "s + method;
@@ -169,11 +165,7 @@ std::optional<std::vector<std::byte>> ActivePyModule::dispatch_remote(
   }
 
   auto pickled_kwargs_bytes = py_bytes_from_span(pickled_kwargs);
-  auto kwargs = PyObject_CallMethodObjArgs(
-    pmodule,
-    PyUnicode_FromString("loads"),
-    pickled_kwargs_bytes,
-    nullptr);
+  auto kwargs = PyObject_CallMethod(pmodule, "loads", "(O)", pickled_kwargs_bytes);
   Py_DECREF(pickled_kwargs_bytes);
   if (kwargs == nullptr) {
     std::string caller = "ActivePyModule::dispatch_remote "s + method;
@@ -208,11 +200,7 @@ std::optional<std::vector<std::byte>> ActivePyModule::dispatch_remote(
   }
   dout(20) << "Success calling '" << method << "'" << dendl;
 
-  auto pickled_ret = PyObject_CallMethodObjArgs(
-    pmodule,
-    PyUnicode_FromString("dumps"),
-    ret,
-    nullptr);
+  auto pickled_ret = PyObject_CallMethod(pmodule, "dumps", "(O)", ret);
   Py_DECREF(ret);
   if (pickled_ret == nullptr) {
     std::string caller = "ActivePyModule::dispatch_remote "s + method;
diff --git a/src/mgr/BaseMgrModule.cc b/src/mgr/BaseMgrModule.cc
index 8e34159aec7..11459d87938 100644
--- a/src/mgr/BaseMgrModule.cc
+++ b/src/mgr/BaseMgrModule.cc
@@ -871,11 +871,7 @@ ceph_dispatch_remote(BaseMgrModule *self, PyObject *args)
   }
 
   auto pmodule = self->this_module->py_module->pPickleModule;
-  auto pickled_args = PyObject_CallMethodObjArgs(
-    pmodule,
-    PyUnicode_FromString("dumps"),
-    remote_args,
-    nullptr);
+  auto pickled_args = PyObject_CallMethod(pmodule, "dumps", "(O)", remote_args);
   if (pickled_args == nullptr) {
     std::string caller = "ceph_dispatch_remote "s + " " + method;
     std::string err = handle_pyerror(true, other_module, caller);
@@ -885,11 +881,7 @@ ceph_dispatch_remote(BaseMgrModule *self, PyObject *args)
   }
   std::span<std::byte const> pickled_args_span = py_bytes_as_span(pickled_args);
 
-  auto pickled_kwargs = PyObject_CallMethodObjArgs(
-    pmodule,
-    PyUnicode_FromString("dumps"),
-    remote_kwargs,
-    nullptr);
+  auto pickled_kwargs = PyObject_CallMethod(pmodule, "dumps", "(O)", remote_kwargs);
   if (pickled_kwargs == nullptr) {
     std::string caller = "ceph_dispatch_remote "s + " " + method;
     std::string err = handle_pyerror(true, other_module, caller);
@@ -940,11 +932,7 @@ ceph_dispatch_remote(BaseMgrModule *self, PyObject *args)
   }
 
   auto pickled_ret_bytes = py_bytes_from_vec(*maybe_pickled_ret);
-  auto ret = PyObject_CallMethodObjArgs(
-    pmodule,
-    PyUnicode_FromString("loads"),
-    pickled_ret_bytes,
-    nullptr);
+  auto ret = PyObject_CallMethod(pmodule, "loads", "(O)", pickled_ret_bytes);
   if (ret == nullptr) {
     std::string caller = "ceph_dispatch_remote "s + " " + method;
     std::string err = handle_pyerror(true, other_module, caller);

From 216d468a1ad16b67feede2a932ee015556e5ca69 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Thu, 25 Jun 2026 19:50:36 +0800
Subject: [PATCH 439/596] cmake: build fio from upstream 3.42

fio-3.42 is the latest stable release. We switched to the ceph/fio fork in
10baab3fc8293b8c30ca90a4acd76f70d011f1b5 to pick up a clang build fix; that
fix has since landed upstream, so switch back. This also gives riscv64
proper arch support (arch-riscv64.h, added in fio-3.36), which the fork's
fio-3.27-cxx lacks.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 cmake/modules/BuildFIO.cmake | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmake/modules/BuildFIO.cmake b/cmake/modules/BuildFIO.cmake
index 453d8ca2fba..61c445628f5 100644
--- a/cmake/modules/BuildFIO.cmake
+++ b/cmake/modules/BuildFIO.cmake
@@ -30,10 +30,10 @@ function(build_fio)
   file(MAKE_DIRECTORY ${source_dir})
   ExternalProject_Add(fio_ext
     UPDATE_COMMAND "" # this disables rebuild on each run
-    GIT_REPOSITORY "https://github.com/ceph/fio.git"
+    GIT_REPOSITORY "https://github.com/axboe/fio.git"
     GIT_CONFIG advice.detachedHead=false
     GIT_SHALLOW 1
-    GIT_TAG "fio-3.27-cxx"
+    GIT_TAG "fio-3.42"
     SOURCE_DIR ${source_dir}
     BUILD_IN_SOURCE 1
     CONFIGURE_COMMAND <SOURCE_DIR>/configure

From 90e0541ec230b5ac758de9693299ade108f74c9e Mon Sep 17 00:00:00 2001
From: pujashahu <pujashahu@li-3d22414c-327d-11b2-a85c-a49077722390.ibm.com>
Date: Fri, 12 Jun 2026 00:19:40 +0530
Subject: [PATCH 440/596] =?UTF-8?q?mgr/dashboard:=20NVMe-oF=20=E2=80=93=20?=
 =?UTF-8?q?Updated=20subtitle=20text=20on=20the=20Create=20Gateway=20page?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes :https://tracker.ceph.com/issues/77361

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../mgr/dashboard/frontend/src/app/ceph/block/block.module.ts | 2 +-
 .../block/nvmeof-group-form/nvmeof-group-form.component.html  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index cb9b96abcd8..b0852ec9b6b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -366,7 +366,7 @@ const routes: Routes = [
               breadcrumbs: ActionLabels.CREATE,
               pageHeader: {
                 title: $localize`Create Gateway Group`,
-                description: $localize`A logical group of gateways that hosts will connect to.`
+                description: $localize`A logical group of NVMe gateways that hosts connect to for load-balanced access.`
               }
             }
           },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 27a5de86421..a5fba7df131 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -10,7 +10,7 @@
     <div cdsCol
          [columnNumbers]="{sm: 4, md: 8}">
       <div cdsRow
-           class="form-heading form-item">
+           class="form-heading form-item cds-mt-5">
       <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
       </div>
       <div cdsRow
@@ -21,7 +21,6 @@
             i18n
             i18n-helperText
             helperText="A unique name to identify this gateway group."
-            cdRequiredField="Gateway group name"
             [invalid]="groupName.isInvalid">
             Gateway group name
             <input
@@ -32,6 +31,7 @@
               #groupName="cdValidate"
               autofocus
               formControlName="groupName"
+              cdRequiredField="Gateway group name"
               [invalid]="groupName.isInvalid"
             />
           </cds-text-label>

From 4c790d72da61bd4331bb5845ae42a6f1d0454ad1 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Mon, 15 Jun 2026 23:47:32 +0530
Subject: [PATCH 441/596] mgr/dashboard : Implement dependent resource handling
 for gateway Deletion

Fixes: https://tracker.ceph.com/issues/77403

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../src/app/ceph/block/block.module.ts        |  4 +-
 ...ay-group-delete-guard-modal.component.html | 31 ++++++++++
 ...ay-group-delete-guard-modal.component.scss |  0
 ...group-delete-guard-modal.component.spec.ts | 55 ++++++++++++++++
 ...eway-group-delete-guard-modal.component.ts | 29 +++++++++
 .../nvmeof-gateway-group.component.html       |  1 +
 .../nvmeof-gateway-group.component.spec.ts    | 62 ++++++++++++++++++-
 .../nvmeof-gateway-group.component.ts         | 35 +++++++++--
 8 files changed, 209 insertions(+), 8 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index cb9b96abcd8..442c79a1d3d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -105,6 +105,7 @@ import { NvmeSubsystemViewBreadcrumbResolver } from './nvme-subsystem-view/nvme-
 import { NvmeSubsystemViewComponent } from './nvme-subsystem-view/nvme-subsystem-view.component';
 import { NvmeofSubsystemPerformanceComponent } from './nvmeof-subsystem-performance/nvmeof-subsystem-performance.component';
 import { NvmeofTabsComponent } from './nvmeof-tabs/nvmeof-tabs.component';
+import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component';
 
 @NgModule({
   imports: [
@@ -194,7 +195,8 @@ import { NvmeofTabsComponent } from './nvmeof-tabs/nvmeof-tabs.component';
     NvmeofSubsystemsStepFourComponent,
     NvmeofSubsystemOverviewComponent,
     NvmeofSubsystemPerformanceComponent,
-    NvmeofTabsComponent
+    NvmeofTabsComponent,
+    NvmeofGatewayGroupDeleteGuardModalComponent
   ],
 
   exports: [RbdConfigurationListComponent, RbdConfigurationFormComponent]
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
new file mode 100644
index 00000000000..433265ed544
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
@@ -0,0 +1,31 @@
+<cds-modal size="sm"
+           [open]="open"
+           (overlaySelected)="closeModal()">
+  <cds-modal-header (closeSelect)="closeModal()">
+    <h2 cdsModalHeaderLabel
+        modal-primary-focus
+        i18n>Manage {{ gatewayName }}</h2>
+    <span class="cds--type-heading-03"
+        cdsModalHeaderHeading
+        i18n>Can't delete {{ gatewayName }}</span>
+  </cds-modal-header>
+  <section cdsModalContent>
+    <p class="cds--type-body-01 cds--mb-05"
+       i18n>
+      This resource has connected items that must be deleted first. Delete the connected items, and try again.
+    </p>
+    <p class="cds--type-label-01 cds--mb-04"
+       i18n>View connected items:</p>
+    <div>
+      @for (sub of connectedSubsystems; track sub.nqn) {
+      <div class="cds--mb-04">
+        <a class="cds--link cds--type-body-01"
+           (click)="navigateToSubsystem(sub.nqn)">
+          <span class="cds--mr-03">{{ sub.nqn }}</span>
+          <cd-icon type="launch"></cd-icon>
+        </a>
+      </div>
+      }
+    </div>
+  </section>
+</cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.scss
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.spec.ts
new file mode 100644
index 00000000000..ff7ab9076b4
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.spec.ts
@@ -0,0 +1,55 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { Router } from '@angular/router';
+import { RouterTestingModule } from '@angular/router/testing';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
+import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group-delete-guard-modal.component';
+
+describe('NvmeofGatewayGroupDeleteGuardModalComponent', () => {
+  let component: NvmeofGatewayGroupDeleteGuardModalComponent;
+  let fixture: ComponentFixture<NvmeofGatewayGroupDeleteGuardModalComponent>;
+  let router: Router;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [RouterTestingModule],
+      declarations: [NvmeofGatewayGroupDeleteGuardModalComponent],
+      providers: [
+        { provide: 'gatewayName', useValue: 'gateway-dev' },
+        {
+          provide: 'connectedSubsystems',
+          useValue: [{ nqn: 'subsystem-1' }, { nqn: 'subsystem-2' }]
+        }
+      ],
+      schemas: [NO_ERRORS_SCHEMA]
+    }).compileComponents();
+  });
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(NvmeofGatewayGroupDeleteGuardModalComponent);
+    component = fixture.componentInstance;
+    router = TestBed.inject(Router);
+    jest.spyOn(router, 'navigate').mockImplementation();
+    fixture.detectChanges();
+  });
+
+  it('should create the modal component', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should load dynamic inputs', () => {
+    expect(component.gatewayName).toBe('gateway-dev');
+    expect(component.connectedSubsystems).toEqual([{ nqn: 'subsystem-1' }, { nqn: 'subsystem-2' }]);
+  });
+
+  it('should navigate to subsystem detail page and close modal', () => {
+    const closeSpy = jest.spyOn(component, 'closeModal').mockImplementation();
+
+    component.navigateToSubsystem('subsystem-1');
+
+    expect(router.navigate).toHaveBeenCalledWith(
+      ['/block/nvmeof/subsystems', 'subsystem-1', 'overview'],
+      { queryParams: { group: 'gateway-dev' } }
+    );
+    expect(closeSpy).toHaveBeenCalled();
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.ts
new file mode 100644
index 00000000000..86cfd478a44
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.ts
@@ -0,0 +1,29 @@
+import { Component, Inject, Optional } from '@angular/core';
+import { Router } from '@angular/router';
+import { BaseModal } from 'carbon-components-angular';
+
+interface ConnectedSubsystem {
+  nqn: string;
+}
+
+@Component({
+  selector: 'cd-nvmeof-gateway-group-delete-guard-modal',
+  templateUrl: './nvmeof-gateway-group-delete-guard-modal.component.html',
+  standalone: false
+})
+export class NvmeofGatewayGroupDeleteGuardModalComponent extends BaseModal {
+  constructor(
+    private router: Router,
+    @Optional() @Inject('gatewayName') public gatewayName: string,
+    @Optional() @Inject('connectedSubsystems') public connectedSubsystems: ConnectedSubsystem[] = []
+  ) {
+    super();
+  }
+
+  navigateToSubsystem(nqn: string): void {
+    this.router.navigate(['/block/nvmeof/subsystems', nqn, 'overview'], {
+      queryParams: { group: this.gatewayName }
+    });
+    this.closeModal();
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 7f48a42cbf6..eae963ce641 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -56,6 +56,7 @@
     }
   </div>
 </ng-template>
+
 <ng-template #deleteTpl
              let-groupName="groupName"
              let-subsystemCount="subsystemCount">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
index 9ea34f16bd5..69fad9acbfd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
@@ -1,10 +1,15 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
 import { NvmeofGatewayGroupComponent } from './nvmeof-gateway-group.component';
-import { GridModule, TabsModule } from 'carbon-components-angular';
+import { GridModule, TabsModule, ModalModule } from 'carbon-components-angular';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { of } from 'rxjs';
 import { HttpClientModule } from '@angular/common/http';
 import { SharedModule } from '~/app/shared/shared.module';
+import { Router } from '@angular/router';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
+import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
+import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group-delete-guard-modal.component';
 
 describe('NvmeofGatewayGroupComponent', () => {
   let component: NvmeofGatewayGroupComponent;
@@ -18,9 +23,20 @@ describe('NvmeofGatewayGroupComponent', () => {
     };
 
     await TestBed.configureTestingModule({
-      imports: [HttpClientModule, SharedModule, TabsModule, GridModule],
+      imports: [HttpClientModule, SharedModule, TabsModule, GridModule, ModalModule],
       declarations: [NvmeofGatewayGroupComponent],
-      providers: [{ provide: NvmeofService, useValue: nvmeofServiceSpy }]
+      providers: [
+        { provide: NvmeofService, useValue: nvmeofServiceSpy },
+        {
+          provide: Router,
+          useValue: { navigate: jest.fn() }
+        },
+        {
+          provide: ModalCdsService,
+          useValue: { show: jest.fn() }
+        }
+      ],
+      schemas: [NO_ERRORS_SCHEMA]
     }).compileComponents();
 
     fixture = TestBed.createComponent(NvmeofGatewayGroupComponent);
@@ -242,4 +258,44 @@ describe('NvmeofGatewayGroupComponent', () => {
       done();
     });
   });
+
+  describe('Delete Flow with/without Subsystems', () => {
+    let mockGroup: any;
+
+    beforeEach(() => {
+      mockGroup = {
+        service_name: 'nvmeof.rbd.default',
+        spec: { group: 'default' },
+        subSystemCount: 0
+      };
+      component.selection.first = jest.fn().mockReturnValue(mockGroup);
+    });
+
+    it('should show can-not-delete modal if subsystems exist', () => {
+      const mockSubsystems = [{ nqn: 'subsystem-1' }, { nqn: 'subsystem-2' }];
+      nvmeofService.listSubsystems.mockReturnValue(of(mockSubsystems));
+      const modalService = TestBed.inject(ModalCdsService);
+
+      component.deleteGatewayGroupModal();
+
+      expect(nvmeofService.listSubsystems).toHaveBeenCalledWith('default');
+      expect(modalService.show).toHaveBeenCalledWith(NvmeofGatewayGroupDeleteGuardModalComponent, {
+        gatewayName: 'default',
+        connectedSubsystems: [{ nqn: 'subsystem-1' }, { nqn: 'subsystem-2' }]
+      });
+    });
+
+    it('should show delete confirmation modal if no subsystems exist', () => {
+      nvmeofService.listSubsystems.mockReturnValue(of([]));
+      const modalService = TestBed.inject(ModalCdsService);
+
+      component.deleteGatewayGroupModal();
+
+      expect(nvmeofService.listSubsystems).toHaveBeenCalledWith('default');
+      expect(modalService.show).toHaveBeenCalledWith(
+        DeleteConfirmationModalComponent,
+        expect.any(Object)
+      );
+    });
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index 3ccef418bd0..933a085a1ff 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -13,7 +13,7 @@ import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 import { Permission } from '~/app/shared/models/permissions';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { Icons, IconSize } from '~/app/shared/enum/icons.enum';
-import { NvmeofGatewayGroup } from '~/app/shared/models/nvmeof';
+import { NvmeofGatewayGroup, NvmeofSubsystem } from '~/app/shared/models/nvmeof';
 import { CephServiceSpec } from '~/app/shared/models/service.interface';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
@@ -24,6 +24,7 @@ import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impa
 import { NotificationService } from '~/app/shared/services/notification.service';
 import { NotificationType } from '~/app/shared/enum/notification-type.enum';
 import { URLBuilderService } from '~/app/shared/services/url-builder.service';
+import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group-delete-guard-modal.component';
 
 const BASE_URL = 'block/nvmeof/gateways';
 
@@ -194,16 +195,42 @@ export class NvmeofGatewayGroupComponent implements OnInit {
       spec: { group }
     } = selectedGroup;
 
-    const disableForm = selectedGroup.subSystemCount > 0 || !group;
+    if (!group) {
+      return;
+    }
 
+    // Fetch actual subsystem list to decide which modal to show
+    this.nvmeofService
+      .listSubsystems(group)
+      .pipe(catchError(() => of([])))
+      .subscribe((subsystems: NvmeofSubsystem[]) => {
+        let subsList: NvmeofSubsystem[] = [];
+        if (subsystems) {
+          const rawList = Array.isArray(subsystems) ? subsystems : [subsystems];
+          subsList = rawList.filter((subsystem: NvmeofSubsystem) => subsystem && subsystem.nqn);
+        }
+
+        if (subsList.length > 0) {
+          this.modalService.show(NvmeofGatewayGroupDeleteGuardModalComponent, {
+            gatewayName: group,
+            connectedSubsystems: subsList.map((subsystem: NvmeofSubsystem) => ({
+              nqn: subsystem.nqn
+            }))
+          });
+        } else {
+          // No subsystems — show the regular delete confirmation modal
+          this.showDeleteConfirmationModal(selectedGroup, serviceName);
+        }
+      });
+  }
+
+  private showDeleteConfirmationModal(selectedGroup: CephServiceSpec, serviceName: string) {
     this.modalService.show(DeleteConfirmationModalComponent, {
       impact: DeletionImpact.high,
       itemDescription: $localize`gateway group`,
       bodyTemplate: this.deleteTpl,
       itemNames: [selectedGroup.spec.group],
       bodyContext: {
-        disableForm,
-        subsystemCount: selectedGroup.subSystemCount,
         deletionMessage: $localize`Deleting <strong>${selectedGroup.spec.group}</strong> will remove all associated subsystems and may disrupt traffic routing for services relying on it. This action cannot be undone.`
       },
       submitActionObservable: () => {

From 1c65a8afa54d3f5200cc5776c4ce3ce237a19e3c Mon Sep 17 00:00:00 2001
From: pujashahu <pujashahu@li-3d22414c-327d-11b2-a85c-a49077722390.ibm.com>
Date: Thu, 11 Jun 2026 23:35:20 +0530
Subject: [PATCH 442/596] mgr/dashboard: NVME- Remove block pool from create
 gateway page

Adds unit test for creating gateway service with encryption when enabled.

Fixes: https://tracker.ceph.com/issues/77359

Signed-off-by: pujashahu <pshahu@redhat.com>
---
 .../nvmeof-group-form.component.html          |  34 +-----
 .../nvmeof-group-form.component.spec.ts       | 101 ++++++------------
 .../nvmeof-group-form.component.ts            |  33 +-----
 .../service-form/service-form.component.html  |  39 -------
 .../service-form.component.spec.ts            |  49 ++-------
 .../service-form/service-form.component.ts    |  21 +---
 6 files changed, 41 insertions(+), 236 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 27a5de86421..4be2ead948b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -50,39 +50,7 @@
 
         </div>
       </div>
-      <!-- Pool -->
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-select
-            label="Block pool"
-            helperText="An RBD application-enabled pool in which the gateway configuration can be managed."
-            labelInputID="pool"
-            id="pool"
-            formControlName="pool"
-            cdRequiredField="Block pool"
-            [invalid]="groupForm.controls.pool.invalid && groupForm.controls.pool.dirty"
-            [invalidText]="poolError"
-            i18n-label
-            i18n-helperText
-          >
-            <option *ngIf="poolsLoading"
-                    [ngValue]="null"
-                    i18n>Loading...</option>
-            <option *ngIf="!poolsLoading && pools.length === 0"
-                    [ngValue]="null"
-                    i18n>-- No block pools available --</option>
-            <option *ngFor="let pool of pools"
-                    [value]="pool.pool_name">{{ pool.pool_name }}</option>
-          </cds-select>
-          <ng-template #poolError>
-            <span class="invalid-feedback"
-                  *ngIf="groupForm.showError('pool', formDir, 'required')"
-                  i18n>This field is required.</span>
-          </ng-template>
-        </div>
-      </div>
-
+      
       <!-- CDS Checkbox -->
       <div cdsRow
            class="form-item">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
index 9af7f2ff76f..5b60872cd1b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
@@ -1,7 +1,7 @@
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { ReactiveFormsModule } from '@angular/forms';
 import { RouterTestingModule } from '@angular/router/testing';
-import { ComponentFixture, TestBed, fakeAsync, tick } from '@angular/core/testing';
+import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { Router } from '@angular/router';
 import { CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';
 
@@ -14,7 +14,6 @@ import { SharedModule } from '~/app/shared/shared.module';
 
 import { NvmeofGroupFormComponent } from './nvmeof-group-form.component';
 import { CheckboxModule, GridModule, InputModule, SelectModule } from 'carbon-components-angular';
-import { PoolService } from '~/app/shared/api/pool.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
 import { FormHelper } from '~/testing/unit-test-helper';
@@ -24,17 +23,10 @@ describe('NvmeofGroupFormComponent', () => {
   let fixture: ComponentFixture<NvmeofGroupFormComponent>;
   let form: CdFormGroup;
   let formHelper: FormHelper;
-  let poolService: PoolService;
   let taskWrapperService: TaskWrapperService;
   let cephServiceService: CephServiceService;
   let router: Router;
 
-  const mockPools = [
-    { pool_name: 'rbd', application_metadata: ['rbd'] },
-    { pool_name: 'rbd', application_metadata: ['rbd'] },
-    { pool_name: 'pool2', application_metadata: ['rgw'] }
-  ];
-
   beforeEach(async () => {
     await TestBed.configureTestingModule({
       declarations: [NvmeofGroupFormComponent],
@@ -55,13 +47,10 @@ describe('NvmeofGroupFormComponent', () => {
 
     fixture = TestBed.createComponent(NvmeofGroupFormComponent);
     component = fixture.componentInstance;
-    poolService = TestBed.inject(PoolService);
     taskWrapperService = TestBed.inject(TaskWrapperService);
     cephServiceService = TestBed.inject(CephServiceService);
     router = TestBed.inject(Router);
 
-    spyOn(poolService, 'list').and.returnValue(Promise.resolve(mockPools));
-
     component.ngOnInit();
     form = component.groupForm;
     formHelper = new FormHelper(form);
@@ -75,6 +64,7 @@ describe('NvmeofGroupFormComponent', () => {
   it('should initialize form with empty fields', () => {
     expect(form.controls.groupName.value).toBeNull();
     expect(form.controls.unmanaged.value).toBe(false);
+    expect(form.controls.enableEncryption.value).toBe(false);
   });
 
   it('should set action to CREATE on init', () => {
@@ -91,57 +81,15 @@ describe('NvmeofGroupFormComponent', () => {
       formHelper.expectError('groupName', 'required');
     });
 
-    it('should require pool', () => {
-      formHelper.setValue('pool', null);
-      formHelper.expectError('pool', 'required');
-    });
-
-    it('should be valid when groupName and pool are set', () => {
+    it('should be valid when groupName is set', () => {
       formHelper.setValue('groupName', 'test-group');
-      formHelper.setValue('pool', 'rbd');
-      expect(form.valid).toBe(true);
+      expect(form.controls.groupName.valid).toBe(true);
     });
-  });
 
-  describe('loadPools', () => {
-    it('should load pools and filter by rbd application metadata', fakeAsync(() => {
-      component.loadPools();
-      tick();
-      expect(component.pools.length).toBe(2);
-      expect(component.pools.map((p) => p.pool_name)).toEqual(['rbd', 'rbd']);
-    }));
-
-    it('should set default pool to rbd if available', fakeAsync(() => {
-      component.groupForm.get('pool').setValue(null);
-      component.loadPools();
-      tick();
-      expect(component.groupForm.get('pool').value).toBe('rbd');
-    }));
-
-    it('should set first pool if rbd is not available', fakeAsync(() => {
-      component.groupForm.get('pool').setValue(null);
-      const poolsWithoutRbd = [{ pool_name: 'custom-pool', application_metadata: ['rbd'] }];
-      (poolService.list as jasmine.Spy).and.returnValue(Promise.resolve(poolsWithoutRbd));
-      component.loadPools();
-      tick();
-      expect(component.groupForm.get('pool').value).toBe('custom-pool');
-    }));
-
-    it('should handle empty pools', fakeAsync(() => {
-      (poolService.list as jasmine.Spy).and.returnValue(Promise.resolve([]));
-      component.loadPools();
-      tick();
-      expect(component.pools.length).toBe(0);
-      expect(component.poolsLoading).toBe(false);
-    }));
-
-    it('should handle pool loading error', fakeAsync(() => {
-      (poolService.list as jasmine.Spy).and.returnValue(Promise.reject('error'));
-      component.loadPools();
-      tick();
-      expect(component.pools).toEqual([]);
-      expect(component.poolsLoading).toBe(false);
-    }));
+    it('should validate groupName for invalid characters', () => {
+      formHelper.setValue('groupName', 'test@group');
+      formHelper.expectError('groupName', 'invalidChars');
+    });
   });
 
   describe('onSubmit', () => {
@@ -158,7 +106,6 @@ describe('NvmeofGroupFormComponent', () => {
       } as any;
 
       component.groupForm.get('groupName').setValue('test-group');
-      component.groupForm.get('pool').setValue('rbd');
       component.onSubmit();
 
       expect(cephServiceService.create).not.toHaveBeenCalled();
@@ -170,16 +117,14 @@ describe('NvmeofGroupFormComponent', () => {
         getSelectedHostnames: (): string[] => ['host1', 'host2']
       } as any;
 
-      component.groupForm.get('groupName').setValue('defalut');
-      component.groupForm.get('pool').setValue('rbd');
+      component.groupForm.get('groupName').setValue('default');
       component.groupForm.get('unmanaged').setValue(false);
       component.onSubmit();
 
       expect(cephServiceService.create).toHaveBeenCalledWith({
         service_type: 'nvmeof',
-        service_id: 'rbd.defalut',
-        pool: 'rbd',
-        group: 'defalut',
+        service_id: 'default',
+        group: 'default',
         placement: {
           hosts: ['host1', 'host2']
         },
@@ -194,15 +139,32 @@ describe('NvmeofGroupFormComponent', () => {
       } as any;
 
       component.groupForm.get('groupName').setValue('unmanaged-group');
-      component.groupForm.get('pool').setValue('rbd');
       component.groupForm.get('unmanaged').setValue(true);
       component.onSubmit();
 
       expect(cephServiceService.create).toHaveBeenCalledWith(
         jasmine.objectContaining({
           unmanaged: true,
-          group: 'unmanaged-group',
-          pool: 'rbd'
+          group: 'unmanaged-group'
+        })
+      );
+    });
+
+    it('should create service with encryption when enabled', () => {
+      component.gatewayNodeComponent = {
+        getSelectedHosts: (): any[] => [{ hostname: 'host1' }],
+        getSelectedHostnames: (): string[] => ['host1']
+      } as any;
+
+      component.groupForm.get('groupName').setValue('encrypted-group');
+      component.groupForm.get('enableEncryption').setValue(true);
+      component.groupForm.get('encryptionConfig').setValue('encryption-key-123');
+      component.onSubmit();
+
+      expect(cephServiceService.create).toHaveBeenCalledWith(
+        jasmine.objectContaining({
+          group: 'encrypted-group',
+          encryption_key: 'encryption-key-123'
         })
       );
     });
@@ -214,7 +176,6 @@ describe('NvmeofGroupFormComponent', () => {
       } as any;
 
       component.groupForm.get('groupName').setValue('test-group');
-      component.groupForm.get('pool').setValue('rbd');
       component.onSubmit();
 
       expect(router.navigateByUrl).toHaveBeenCalledWith('/block/nvmeof/gateways');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index 533025735bc..c1fb56b251e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -6,8 +6,6 @@ import { CdFormGroup } from '~/app/shared/forms/cd-form-group';
 
 import { Permission } from '~/app/shared/models/permissions';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
-import { PoolService } from '~/app/shared/api/pool.service';
-import { Pool } from '../../pool/pool';
 import { NvmeofGatewayNodeComponent } from '../nvmeof-gateway-node/nvmeof-gateway-node.component';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
@@ -30,15 +28,12 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   action: string;
   resource: string;
   group: string;
-  pools: Pool[] = [];
-  poolsLoading = false;
   pageURL: string;
   hasAvailableNodes = true;
 
   constructor(
     private authStorageService: AuthStorageService,
     public actionLabels: ActionLabelsI18n,
-    private poolService: PoolService,
     private taskWrapperService: TaskWrapperService,
     private cephServiceService: CephServiceService,
     private nvmeofService: NvmeofService,
@@ -52,7 +47,6 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   ngOnInit() {
     this.action = this.actionLabels.CREATE;
     this.createForm();
-    this.loadPools();
   }
 
   createForm() {
@@ -68,9 +62,6 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
         ],
         [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)]
       ),
-      pool: new UntypedFormControl('rbd', {
-        validators: [Validators.required]
-      }),
       unmanaged: new UntypedFormControl(false),
       enableEncryption: new UntypedFormControl(false),
       encryptionConfig: new UntypedFormControl(null)
@@ -118,27 +109,6 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     return false;
   }
 
-  loadPools() {
-    this.poolsLoading = true;
-    this.poolService.list().then(
-      (pools: Pool[]) => {
-        this.pools = (pools || []).filter(
-          (pool: Pool) => pool.application_metadata && pool.application_metadata.includes('rbd')
-        );
-        this.poolsLoading = false;
-        if (this.pools.length >= 1) {
-          const allPoolNames = this.pools.map((pool) => pool.pool_name);
-          const poolName = allPoolNames.includes('rbd') ? 'rbd' : this.pools[0].pool_name;
-          this.groupForm.patchValue({ pool: poolName });
-        }
-      },
-      () => {
-        this.pools = [];
-        this.poolsLoading = false;
-      }
-    );
-  }
-
   onSubmit() {
     if (this.groupForm.invalid) {
       return;
@@ -156,12 +126,11 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       return;
     }
     let taskUrl = `service/${URLVerbs.CREATE}`;
-    const serviceName = `${formValues.pool}.${formValues.groupName}`;
+    const serviceName = `${formValues.groupName}`;
 
     const serviceSpec: Record<string, any> = {
       service_type: 'nvmeof',
       service_id: serviceName,
-      pool: formValues.pool,
       group: formValues.groupName,
       placement: {
         hosts: selectedHostnames
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index c77c36abc14..0e7ecb82f24 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -111,45 +111,6 @@
       </div>
       }
 
-      <!-- NVMe/TCP -->
-      <!-- Block Pool -->
-      @if (serviceForm.controls.service_type.value === 'nvmeof') {
-      <div class="form-item">
-        <cds-select id="pool"
-                    formControlName="pool"
-                    label="Block Pool"
-                    cdRequiredField="Block Pool"
-                    helperText="An RBD application-enabled pool in which the gateway configuration can be managed."
-                    i18n-helperText
-                    [invalid]="serviceForm.controls.pool.invalid && serviceForm.controls.pool.dirty"
-                    [invalidText]="requiredFieldPool"
-                    (change)="setNvmeServiceId()">
-          @if (rbdPools === null) {
-          <option [ngValue]="null"
-                  i18n>Loading...</option>
-          }
-          @if (rbdPools && rbdPools.length === 0) {
-          <option [ngValue]="null"
-                  i18n>-- No block pools available --</option>
-          }
-          @if (rbdPools && rbdPools.length > 0) {
-          <option [ngValue]="null"
-                  i18n>-- Select a pool --</option>
-          }
-          @for (pool of rbdPools; track pool) {
-          <option [value]="pool.pool_name">{{ pool.pool_name }}</option>
-          }
-        </cds-select>
-        <ng-template #requiredFieldPool>
-
-          @if (serviceForm.showError('pool', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      }
-
       <!-- Group Name -->
       @if (serviceForm.controls.service_type.value === 'nvmeof') {
       <div class="form-item">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
index 915c320bacc..a1c2590e20f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
@@ -511,50 +511,29 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
       it('should set default values correctly onInit', () => {
         expect(form.get('service_type').value).toBe('nvmeof');
         expect(form.get('group').value).toBe('default');
-        expect(form.get('pool').value).toBe('rbd');
-        expect(form.get('service_id').value).toBe('rbd.default');
+        expect(form.get('service_id').value).toBe('default');
       });
 
       it('should reflect correct values on group change', () => {
-        // Initially the group value should be 'default'
         expect(component.serviceForm.get('group')?.value).toBe('default');
         const groupInput = fixture.debugElement.query(By.css('#group')).nativeElement;
-        // Simulate input value change
         groupInput.value = 'foo';
-        // Trigger the input event
         groupInput.dispatchEvent(new Event('input'));
-        // Trigger the change event
         groupInput.dispatchEvent(new Event('change'));
         fixture.detectChanges();
-        // Verify values after change
         expect(form.get('group').value).toBe('foo');
-        expect(form.get('service_id').value).toBe('rbd.foo');
+        expect(form.get('service_id').value).toBe('foo');
       });
 
-      it('should reflect correct values on pool change', () => {
-        // Initially the pool value should be 'rbd'
-        expect(component.serviceForm.get('pool')?.value).toBe('rbd');
-        const poolInput = fixture.debugElement.query(By.css('#pool')).nativeElement;
-        // Simulate input value change
-        form.get('pool').setValue('pool-2');
-        // Trigger the input event
-        poolInput.dispatchEvent(new Event('input'));
-        // Trigger the change event
-        poolInput.dispatchEvent(new Event('change'));
-        fixture.detectChanges();
-        // Verify values after change
-        expect(form.get('pool').value).toBe('pool-2');
-        expect(form.get('service_id').value).toBe('pool-2.default');
+      it('should hide pool selector in create mode', () => {
+        const poolEl = fixture.debugElement.query(By.css('#pool'));
+        expect(poolEl).toBeNull();
       });
 
       it('should throw error when there is no service id', () => {
         formHelper.expectErrorChange('service_id', '', 'required');
       });
 
-      it('should throw error when there is no pool', () => {
-        formHelper.expectErrorChange('pool', '', 'required');
-      });
-
       it('should throw error when there is no group', () => {
         formHelper.expectErrorChange('group', '', 'required');
       });
@@ -583,10 +562,9 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         component.onSubmit();
         expect(cephServiceService.create).toHaveBeenCalledWith({
           service_type: 'nvmeof',
-          service_id: 'rbd.default',
+          service_id: 'default',
           placement: {},
           unmanaged: false,
-          pool: 'rbd',
           group: 'default',
           enable_auth: false
         });
@@ -602,10 +580,9 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         component.onSubmit();
         expect(cephServiceService.create).toHaveBeenCalledWith({
           service_type: 'nvmeof',
-          service_id: 'rbd.default',
+          service_id: 'default',
           placement: {},
           unmanaged: false,
-          pool: 'rbd',
           group: 'default',
           enable_auth: true,
           root_ca_cert: 'root_ca_cert',
@@ -840,15 +817,6 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         expect(serviceId.disabled).toBeTruthy();
       });
 
-      it('should not edit pools for nvmeof service', () => {
-        component.serviceType = 'nvmeof';
-        formHelper.setValue('service_type', 'nvmeof');
-        component.ngOnInit();
-        fixture.detectChanges();
-        const poolId = fixture.componentInstance.serviceForm.get('pool');
-        expect(poolId.disabled).toBeTruthy();
-      });
-
       it('should not edit groups for nvmeof service', () => {
         component.serviceType = 'nvmeof';
         formHelper.setValue('service_type', 'nvmeof');
@@ -862,16 +830,13 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         spyOn(cephServiceService, 'update').and.stub();
         component.serviceType = 'nvmeof';
         formHelper.setValue('service_type', 'nvmeof');
-        formHelper.setValue('pool', 'rbd');
         formHelper.setValue('group', 'default');
-        // mTLS disabled
         formHelper.setValue('enable_mtls', false);
         component.onSubmit();
         expect(cephServiceService.update).toHaveBeenCalledWith({
           service_type: 'nvmeof',
           placement: {},
           unmanaged: false,
-          pool: 'rbd',
           group: 'default',
           enable_auth: false
         });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index fb5f36af337..86a074fef8c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -222,9 +222,6 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         [
           CdValidators.requiredIf({
             service_type: 'iscsi'
-          }),
-          CdValidators.requiredIf({
-            service_type: 'nvmeof'
           })
         ]
       ],
@@ -782,7 +779,6 @@ export class ServiceFormComponent extends CdForm implements OnInit {
               }
               break;
             case 'nvmeof':
-              this.serviceForm.get('pool').setValue(response[0].spec.pool);
               this.serviceForm.get('group').setValue(response[0].spec.group);
               this.serviceForm.get('enable_mtls').setValue(response[0].spec?.enable_auth);
               this.serviceForm.get('root_ca_cert').setValue(response[0].spec?.root_ca_cert);
@@ -1155,26 +1151,14 @@ export class ServiceFormComponent extends CdForm implements OnInit {
   }
 
   setNvmeServiceId() {
-    const pool = this.serviceForm.get('pool').value;
     const group = this.serviceForm.get('group').value;
-    if (pool && group) {
-      this.serviceForm.get('service_id').setValue(`${pool}.${group}`);
-    } else if (pool) {
-      this.serviceForm.get('service_id').setValue(pool);
-    } else if (group) {
+    if (group) {
       this.serviceForm.get('service_id').setValue(group);
     } else {
       this.serviceForm.get('service_id').setValue(null);
     }
   }
 
-  setNvmeDefaultPool() {
-    const defaultPool =
-      this.rbdPools?.find((p: Pool) => p.pool_name === 'rbd')?.pool_name ||
-      this.rbdPools?.[0].pool_name;
-    this.serviceForm.get('pool').setValue(defaultPool);
-  }
-
   requiresServiceId(serviceType: string) {
     return ['mds', 'rgw', 'nfs', 'iscsi', 'nvmeof', 'smb', 'ingress'].includes(serviceType);
   }
@@ -1182,7 +1166,6 @@ export class ServiceFormComponent extends CdForm implements OnInit {
   setServiceId(serviceId: string): void {
     const requiresServiceId: boolean = this.requiresServiceId(serviceId);
     if (requiresServiceId && serviceId === 'nvmeof') {
-      this.setNvmeDefaultPool();
       this.setNvmeServiceId();
     } else if (requiresServiceId) {
       this.serviceForm.get('service_id').setValue(null);
@@ -1231,7 +1214,6 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         this.serviceForm.get('backend_service').disable();
         break;
       case 'nvmeof':
-        this.serviceForm.get('pool').disable();
         this.serviceForm.get('group').disable();
         break;
     }
@@ -1344,7 +1326,6 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         break;
 
       case 'nvmeof':
-        serviceSpec['pool'] = values['pool'];
         serviceSpec['group'] = values['group'];
         serviceSpec['enable_auth'] = values['enable_mtls'];
         if (values['enable_mtls']) {

From 13e7fd758a5d505cadfb65ba2d9a8c9c30524b40 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Thu, 25 Jun 2026 21:34:27 +0200
Subject: [PATCH 443/596] rgw: add missing include

Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 src/rgw/rgw_cors.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/rgw/rgw_cors.h b/src/rgw/rgw_cors.h
index 9b4fd0ee7ec..c39f3cbb577 100644
--- a/src/rgw/rgw_cors.h
+++ b/src/rgw/rgw_cors.h
@@ -18,6 +18,7 @@
 #include <map>
 #include <string>
 #include <include/types.h>
+#include "include/encoding.h" // for WRITE_CLASS_ENCODER()
 #include "include/str_list.h"
 
 #define RGW_CORS_GET    0x1
@@ -35,6 +36,8 @@
 
 #define CORS_MAX_AGE_INVALID ((uint32_t)-1)
 
+namespace ceph { class Formatter; }
+
 class RGWCORSRule
 {
 protected:
@@ -90,7 +93,7 @@ public:
   void format_exp_headers(std::string& s);
   void erase_origin_if_present(std::string& origin, bool *rule_empty);
   void dump_origins();
-  void dump(Formatter *f) const;
+  void dump(ceph::Formatter *f) const;
   bool is_header_allowed(const char *hdr, size_t len);
   bool matches_method(const char *req_meth);
   bool matches_preflight_headers(const char *req_hdrs);
@@ -118,7 +121,7 @@ class RGWCORSConfiguration
     decode(rules, bl);
     DECODE_FINISH(bl);
   }
-  void dump(Formatter *f) const;
+  void dump(ceph::Formatter *f) const;
   std::list<RGWCORSRule>& get_rules() {
     return rules;
   }

From c82a83fc96036bacccebff19834c3b584a870e2e Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Fri, 26 Jun 2026 12:56:27 +0200
Subject: [PATCH 444/596] script/ptl-tool: fix redmine_linkage_correct case in
 _get_active_issues()

If redmine_linkage_correct is True, _get_active_issues() is supposed to
ignore issues with "Multiple Source PRs" category.  However that doesn't
happen because the category string is compared against (category, text)
pair.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 src/script/ptl-tool.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/script/ptl-tool.py b/src/script/ptl-tool.py
index 762069ca3b5..c7ac3d928e8 100755
--- a/src/script/ptl-tool.py
+++ b/src/script/ptl-tool.py
@@ -207,7 +207,7 @@ class AuditReport:
 
     def _get_active_issues(self):
         if self.redmine_linkage_correct:
-            return [i for i in self.issues if i != "Multiple Source PRs"]
+            return [(cat, text) for cat, text in self.issues if cat != "Multiple Source PRs"]
         return self.issues
 
     def has_errors(self) -> bool:

From d890779f7523cff9af4c740ea2a5ddb83910d993 Mon Sep 17 00:00:00 2001
From: pujashahu <pujashahu@li-3d22414c-327d-11b2-a85c-a49077722390.ibm.com>
Date: Thu, 11 Jun 2026 15:59:51 +0530
Subject: [PATCH 445/596] mgr/dashboard: Add auto-fetch listeners option in
 subsystem page

Fixes: https://tracker.ceph.com/issues/77083

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../nvmeof-subsystem-step-1.component.html    |  54 +++++++-
 .../nvmeof-subsystem-step-1.component.spec.ts |   9 +-
 .../nvmeof-subsystem-step-1.component.ts      |  24 +++-
 .../nvmeof-subsystems-form.component.spec.ts  |  94 ++++++++++++++
 .../nvmeof-subsystems-form.component.ts       | 115 +++++++++++-------
 .../src/app/shared/api/nvmeof.service.ts      |   7 +-
 .../frontend/src/app/shared/models/nvmeof.ts  |   2 +
 7 files changed, 251 insertions(+), 54 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
index a811c593088..aab200d7a1c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
@@ -53,10 +53,59 @@
         </cds-text-label>
       </div>
       }
+      <div cdsRow
+           class="form-item">
+        <fieldset class="cds--fieldset">
+          <legend class="cds--label" 
+                  i18n>Listeners</legend>
+          <p class="cds--form__helper-text" i18n>Determine where and how hosts can connect to the subsystem over the network.</p>
+          <cds-radio-group
+            formControlName="listenerMode"
+            orientation="horizontal">
+            <cds-radio
+              [value]="LISTENER_MODE.AUTO_FETCH">
+              <span i18n>Auto-fetch</span>
+            </cds-radio>
+            <cds-radio
+              [value]="LISTENER_MODE.MANUAL">
+              <span i18n>Add manually</span>
+            </cds-radio>
+          </cds-radio-group>
+        </fieldset>
+      </div>
+      @if (listenerMode === LISTENER_MODE.AUTO_FETCH) {
+      <div cdsRow
+           class="form-item">
+        <cds-text-label
+          i18n
+          [invalid]="subnetMaskRef.isInvalid"
+          [invalidText]="subnetMaskInvalidText"
+          helperText="Listeners from this subnet-masks will be use."
+          i18n-helperText>
+          Subnet-mask
+          <input cdsText
+                 cdValidate
+                 #subnetMaskRef="cdValidate"
+                 type="text"
+                 placeholder="e.g. 255.0.0.0"
+                 i18n-placeholder
+                 id="subnetMask"
+                 name="subnetMask"
+                 formControlName="subnetMask"
+                 [invalid]="subnetMaskRef.isInvalid">
+        </cds-text-label>
+        <ng-template #subnetMaskInvalidText>
+          <span i18n>This field is required.</span>
+        </ng-template>
+      </div>
+      }
+      @if (listenerMode === LISTENER_MODE.MANUAL) {
       <div cdsRow
            class="form-item">
         <cds-combo-box i18n
-                       [invalid]="formGroup.get('listeners').invalid && (formGroup.get('listeners').dirty || formGroup.get('listeners').touched)"
+                       cdValidate
+                       #listenersRef="cdValidate"
+                       [invalid]="listenersRef.isInvalid"
                        [invalidText]="listenersInvalidText"
                        [label]="listenersLabel"
                        [helperText]="listenersHelperText"
@@ -79,7 +128,7 @@
           </div>
         }
         <ng-template #listenersLabel>
-          <span i18n>Listeners</span>
+          <span i18n>Select listeners</span>
         </ng-template>
         <ng-template #listenersHelperText>
           <span i18n>Select listeners for this subsystem.</span>
@@ -88,6 +137,7 @@
           <span i18n>This field is required.</span>
         </ng-template>
       </div>
+      }
     </div>
   </div>
 </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.spec.ts
index 70db8540580..237a76cb3d1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.spec.ts
@@ -2,6 +2,7 @@ import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { ReactiveFormsModule } from '@angular/forms';
 import { RouterTestingModule } from '@angular/router/testing';
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
 
 import { NgbActiveModal, NgbTypeaheadModule } from '@ng-bootstrap/ng-bootstrap';
 
@@ -10,7 +11,7 @@ import { SharedModule } from '~/app/shared/shared.module';
 import { NvmeofSubsystemsStepOneComponent } from './nvmeof-subsystem-step-1.component';
 import { FormHelper } from '~/testing/unit-test-helper';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
-import { ComboBoxModule, GridModule, InputModule } from 'carbon-components-angular';
+import { ComboBoxModule, GridModule, InputModule, RadioModule } from 'carbon-components-angular';
 
 import { of } from 'rxjs';
 
@@ -35,9 +36,11 @@ describe('NvmeofSubsystemsStepOneComponent', () => {
         NgbTypeaheadModule,
         InputModule,
         GridModule,
-        ComboBoxModule
+        ComboBoxModule,
+        RadioModule
       ],
-      providers: [NgbActiveModal]
+      providers: [NgbActiveModal],
+      schemas: [NO_ERRORS_SCHEMA]
     }).compileComponents();
   });
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts
index 866717ef4a5..8894178b9d6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts
@@ -33,6 +33,11 @@ export class NvmeofSubsystemsStepOneComponent implements OnInit, TearsheetStep {
   };
 
   hosts: ListenerItem[] = [];
+  LISTENER_MODE = {
+    AUTO_FETCH: 'auto-fetch',
+    MANUAL: 'manual'
+  };
+  listenerMode: string = this.LISTENER_MODE.AUTO_FETCH;
 
   constructor(
     public actionLabels: ActionLabelsI18n,
@@ -76,9 +81,18 @@ export class NvmeofSubsystemsStepOneComponent implements OnInit, TearsheetStep {
   }
 
   createForm() {
+    const subnetMaskValidators = [
+      CdValidators.composeIf({ listenerMode: this.LISTENER_MODE.AUTO_FETCH }, [Validators.required])
+    ];
+    const listenersValidators = [
+      CdValidators.composeIf({ listenerMode: this.LISTENER_MODE.MANUAL }, [Validators.required])
+    ];
+
     if (this.listenersOnly) {
       this.formGroup = new CdFormGroup({
-        listeners: new UntypedFormControl([])
+        listenerMode: new UntypedFormControl(this.LISTENER_MODE.AUTO_FETCH),
+        subnetMask: new UntypedFormControl('', subnetMaskValidators),
+        listeners: new UntypedFormControl([], listenersValidators)
       });
     } else {
       this.formGroup = new CdFormGroup({
@@ -101,9 +115,15 @@ export class NvmeofSubsystemsStepOneComponent implements OnInit, TearsheetStep {
             )
           ]
         }),
-        listeners: new UntypedFormControl([])
+        listenerMode: new UntypedFormControl(this.LISTENER_MODE.AUTO_FETCH),
+        subnetMask: new UntypedFormControl('', subnetMaskValidators),
+        listeners: new UntypedFormControl([], listenersValidators)
       });
     }
+
+    this.formGroup.get('listenerMode').valueChanges.subscribe((mode: string) => {
+      this.listenerMode = mode;
+    });
   }
 
   removeListener(index: number) {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.spec.ts
index dc98d870f4d..4f65eaa1f3e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.spec.ts
@@ -92,6 +92,7 @@ describe('NvmeofSubsystemsFormComponent', () => {
       nvmeofService = TestBed.inject(NvmeofService);
       spyOn(nvmeofService, 'createSubsystem').and.returnValue(of({}));
       spyOn(nvmeofService, 'addSubsystemInitiators').and.returnValue(of({}));
+      spyOn(nvmeofService, 'createListeners').and.returnValue(of({}));
     });
 
     it('should be creating request correctly', () => {
@@ -105,6 +106,99 @@ describe('NvmeofSubsystemsFormComponent', () => {
       });
     });
 
+    it('should include network_mask in createSubsystem request when listenerMode is auto-fetch and subnetMask is set', () => {
+      const payload: SubsystemPayload = {
+        nqn: 'test-nqn',
+        gw_group: mockGroupName,
+        addedHosts: [],
+        hostType: HOST_TYPE.ALL,
+        subsystemDchapKey: '',
+        listeners: [],
+        authType: AUTHENTICATION.Unidirectional,
+        hostDchapKeyList: [],
+        listenerMode: 'auto-fetch',
+        subnetMask: '192.168.1.0/24'
+      };
+
+      component.group = mockGroupName;
+      component.onSubmit(payload);
+
+      expect(nvmeofService.createSubsystem).toHaveBeenCalledWith({
+        nqn: 'test-nqn',
+        gw_group: mockGroupName,
+        dhchap_key: '',
+        network_mask: ['192.168.1.0/24']
+      });
+    });
+
+    it('should not include network_mask in createSubsystem request when listenerMode is manual', () => {
+      const payload: SubsystemPayload = {
+        nqn: 'test-nqn',
+        gw_group: mockGroupName,
+        addedHosts: [],
+        hostType: HOST_TYPE.ALL,
+        subsystemDchapKey: '',
+        listeners: [],
+        authType: AUTHENTICATION.Unidirectional,
+        hostDchapKeyList: [],
+        listenerMode: 'manual',
+        subnetMask: '192.168.1.0/24'
+      };
+
+      component.group = mockGroupName;
+      component.onSubmit(payload);
+
+      expect(nvmeofService.createSubsystem).toHaveBeenCalledWith({
+        nqn: 'test-nqn',
+        gw_group: mockGroupName,
+        dhchap_key: ''
+      });
+    });
+
+    it('should call createListeners when listenerMode is manual and listeners are provided', () => {
+      const listeners = [{ content: 'host1', addr: '10.0.0.1' }];
+      const payload: SubsystemPayload = {
+        nqn: 'test-nqn',
+        gw_group: mockGroupName,
+        addedHosts: [],
+        hostType: HOST_TYPE.ALL,
+        subsystemDchapKey: '',
+        listeners,
+        authType: AUTHENTICATION.Unidirectional,
+        hostDchapKeyList: [],
+        listenerMode: 'manual'
+      };
+
+      component.group = mockGroupName;
+      component.onSubmit(payload);
+
+      expect(nvmeofService.createListeners).toHaveBeenCalledWith(
+        'test-nqn.default',
+        mockGroupName,
+        listeners
+      );
+    });
+
+    it('should not call createListeners when listenerMode is auto-fetch', () => {
+      const payload: SubsystemPayload = {
+        nqn: 'test-nqn',
+        gw_group: mockGroupName,
+        addedHosts: [],
+        hostType: HOST_TYPE.ALL,
+        subsystemDchapKey: '',
+        listeners: [{ content: 'host1', addr: '10.0.0.1' }],
+        authType: AUTHENTICATION.Unidirectional,
+        hostDchapKeyList: [],
+        listenerMode: 'auto-fetch',
+        subnetMask: '10.0.0.0/24'
+      };
+
+      component.group = mockGroupName;
+      component.onSubmit(payload);
+
+      expect(nvmeofService.createListeners).not.toHaveBeenCalled();
+    });
+
     it('should add initiators with wildcard when hostType is ALL', () => {
       const payload: SubsystemPayload = {
         nqn: 'test-nqn',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.ts
index b3d46425568..88178fb0c8c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.ts
@@ -30,10 +30,26 @@ export type SubsystemPayload = {
   listeners: ListenerItem[];
   authType: AUTHENTICATION.Bidirectional | AUTHENTICATION.Unidirectional;
   hostDchapKeyList: Array<{ dhchap_key: string; host_nqn: string }>;
+  listenerMode?: string;
+  subnetMask?: string;
 };
 
 type StepResult = { step: string; success: boolean; error?: string };
 
+type CreateSubsystemRequest = {
+  nqn: string;
+  gw_group: string;
+  dhchap_key: string;
+  network_mask?: string[];
+};
+
+type SequentialStep = { step: string; call: () => Observable<unknown> };
+
+const LISTENER_MODE = {
+  AUTO_FETCH: 'auto-fetch',
+  MANUAL: 'manual'
+};
+
 const STEP_LABELS = {
   DETAILS: 'Subsystem details',
   HOSTS: 'Host access control',
@@ -159,62 +175,69 @@ export class NvmeofSubsystemsFormComponent implements OnInit {
       hosts: payload.hostType === HOST_TYPE.SPECIFIC ? payload.hostDchapKeyList : [],
       gw_group: this.group
     };
-    this.nvmeofService
-      .createSubsystem({
-        nqn: payload.nqn,
-        gw_group: this.group,
-        dhchap_key: payload.subsystemDchapKey
-      })
-      .subscribe({
-        next: () => {
-          stepResults.push({ step: this.steps[0].label, success: true });
-          const sequentialSteps: { step: string; call: () => Observable<any> }[] = [];
 
-          if (payload.listeners && payload.listeners.length > 0) {
-            sequentialSteps.push({
-              step: $localize`Listeners`,
-              call: () =>
-                this.nvmeofService.createListeners(
-                  `${payload.nqn}.${this.group}`,
-                  this.group,
-                  payload.listeners
-                )
-            });
-          }
+    // Prepare subsystem creation request
+    const createSubsystemRequest: CreateSubsystemRequest = {
+      nqn: payload.nqn,
+      gw_group: this.group,
+      dhchap_key: payload.subsystemDchapKey
+    };
 
+    if (payload.listenerMode === LISTENER_MODE.AUTO_FETCH && payload.subnetMask) {
+      createSubsystemRequest.network_mask = [payload.subnetMask];
+    }
+
+    this.nvmeofService.createSubsystem(createSubsystemRequest).subscribe({
+      next: () => {
+        stepResults.push({ step: this.steps[0].label, success: true });
+        const sequentialSteps: SequentialStep[] = [];
+
+        if (
+          payload.listenerMode !== LISTENER_MODE.AUTO_FETCH &&
+          payload.listeners &&
+          payload.listeners.length > 0
+        ) {
           sequentialSteps.push({
-            step: this.steps[1].label,
+            step: $localize`Listeners`,
             call: () =>
-              this.nvmeofService.addSubsystemInitiators(
+              this.nvmeofService.createListeners(
                 `${payload.nqn}.${this.group}`,
-                initiatorRequest
+                this.group,
+                payload.listeners
               )
           });
-
-          this.runSequentialSteps(sequentialSteps, stepResults).subscribe({
-            complete: () => this.showFinalNotification(stepResults)
-          });
-        },
-        error: (err) => {
-          err.preventDefault();
-          const errorMsg = err?.error?.detail || $localize`Subsystem creation failed`;
-          this.notificationService.show(
-            NotificationType.error,
-            $localize`Subsystem creation failed`,
-            errorMsg
-          );
-          this.isSubmitLoading = false;
-          this.router.navigate(['block/nvmeof/subsystems'], {
-            queryParams: { group: this.group }
-          });
         }
-      });
+
+        sequentialSteps.push({
+          step: this.steps[1].label,
+          call: () =>
+            this.nvmeofService.addSubsystemInitiators(
+              `${payload.nqn}.${this.group}`,
+              initiatorRequest
+            )
+        });
+
+        this.runSequentialSteps(sequentialSteps, stepResults).subscribe({
+          complete: () => this.showFinalNotification(stepResults)
+        });
+      },
+      error: (err) => {
+        err.preventDefault();
+        const errorMsg = err?.error?.detail || $localize`Subsystem creation failed`;
+        this.notificationService.show(
+          NotificationType.error,
+          $localize`Subsystem creation failed`,
+          errorMsg
+        );
+        this.isSubmitLoading = false;
+        this.router.navigate(['block/nvmeof/subsystems'], {
+          queryParams: { group: this.group }
+        });
+      }
+    });
   }
 
-  private runSequentialSteps(
-    steps: { step: string; call: () => Observable<any> }[],
-    stepResults: StepResult[]
-  ): Observable<void> {
+  private runSequentialSteps(steps: SequentialStep[], stepResults: StepResult[]): Observable<void> {
     return from(steps).pipe(
       concatMap((step) =>
         step.call().pipe(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
index 3b2b57dbf35..77c31a6553d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
@@ -192,7 +192,12 @@ export class NvmeofService {
     return this.http.get(`${API_PATH}/subsystem/${subsystemNQN}?gw_group=${group}`);
   }
 
-  createSubsystem(request: { nqn: string; gw_group: string; dhchap_key: string }) {
+  createSubsystem(request: {
+    nqn: string;
+    gw_group: string;
+    dhchap_key: string;
+    network_mask?: string[];
+  }) {
     return this.http.post(`${API_PATH}/subsystem`, request, { observe: 'response' });
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
index 11d7edab3b0..7d401ad5d08 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
@@ -169,4 +169,6 @@ export type AuthStepType = {
 export type DetailsStepType = {
   nqn: string;
   listeners: Array<string>;
+  listenerMode?: string;
+  subnetMask?: string;
 };

From d83f5dcdb905bd7b1de0ffaba951c7b6d491f467 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Wed, 17 Jun 2026 18:37:24 +0530
Subject: [PATCH 446/596] mgr/dashboard: "Any" initiator entry appears in the
 Initiator table after selecting "All Hosts Allowed" during subsystem creation

Fixes: https://tracker.ceph.com/issues/77467

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../src/app/ceph/block/block.module.ts        |  2 +-
 .../nvmeof-gateway-node.component.ts          |  2 +-
 .../nvmeof-gateway-subsystem.component.ts     |  2 +-
 .../nvmeof-initiators-list.component.html     | 47 ++++++++++---------
 .../nvmeof-initiators-list.component.spec.ts  |  5 +-
 .../nvmeof-initiators-list.component.ts       | 22 ++++++---
 .../nvmeof-subsystems.component.ts            |  2 +-
 .../src/app/shared/enum/nvmeof.enum.ts        | 10 ----
 .../frontend/src/app/shared/models/nvmeof.ts  | 12 +++++
 9 files changed, 62 insertions(+), 42 deletions(-)
 delete mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/enum/nvmeof.enum.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index b0852ec9b6b..cadf130be26 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -97,7 +97,7 @@ import { NvmeofGatewaySubsystemComponent } from './nvmeof-gateway-subsystem/nvme
 import { NvmeofNamespaceExpandModalComponent } from './nvmeof-namespace-expand-modal/nvmeof-namespace-expand-modal.component';
 import { NvmeGatewayViewComponent } from './nvme-gateway-view/nvme-gateway-view.component';
 import { NvmeGatewayViewBreadcrumbResolver } from './nvme-gateway-view/nvme-gateway-view-breadcrumb.resolver';
-import { NvmeofGatewayNodeMode } from '~/app/shared/enum/nvmeof.enum';
+import { NvmeofGatewayNodeMode } from '~/app/shared/models/nvmeof';
 import { NvmeofGatewayNodeAddModalComponent } from './nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component';
 import { NvmeofSubsystemNamespacesListComponent } from './nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component';
 import { NvmeofSubsystemOverviewComponent } from './nvmeof-subsystem-overview/nvmeof-subsystem-overview.component';
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
index 32549d1a828..2de89e3a478 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
@@ -17,7 +17,6 @@ import _ from 'lodash';
 import { TableComponent } from '~/app/shared/datatable/table/table.component';
 import { HostStatus } from '~/app/shared/enum/host-status.enum';
 import { Icons } from '~/app/shared/enum/icons.enum';
-import { NvmeofGatewayNodeMode } from '~/app/shared/enum/nvmeof.enum';
 import { CdTableAction } from '~/app/shared/models/cd-table-action';
 import { CdTableColumn } from '~/app/shared/models/cd-table-column';
 import { CdTableFetchDataContext } from '~/app/shared/models/cd-table-fetch-data-context';
@@ -26,6 +25,7 @@ import { OrchestratorStatus } from '~/app/shared/models/orchestrator.interface';
 import { Permission } from '~/app/shared/models/permissions';
 
 import { Host } from '~/app/shared/models/host.interface';
+import { NvmeofGatewayNodeMode } from '~/app/shared/models/nvmeof';
 import { CephServiceSpec, CephServiceSpecUpdate } from '~/app/shared/models/service.interface';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts
index ef6575e47ea..de6732de69e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts
@@ -7,13 +7,13 @@ import {
   NvmeofSubsystem,
   NvmeofSubsystemData,
   NvmeofSubsystemInitiator,
+  NvmeofSubsystemAuthType,
   getSubsystemAuthStatus
 } from '~/app/shared/models/nvmeof';
 import { CdTableColumn } from '~/app/shared/models/cd-table-column';
 import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 
 import { ICON_TYPE, EMPTY_STATE_IMAGE } from '~/app/shared/enum/icons.enum';
-import { NvmeofSubsystemAuthType } from '~/app/shared/enum/nvmeof.enum';
 
 @Component({
   selector: 'cd-nvmeof-gateway-subsystem',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
index 97a520db0c6..8c924ce0152 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
@@ -1,27 +1,21 @@
-<cd-alert-panel
-  *ngIf="hasAllHostsAllowed()"
-  type="info"
-  [showTitle]="false">
-  <div cdsStack="horizontal"
-       gap="2">
+@if (hasAllHostsAllowed()) {
+  <cd-alert-panel
+    class="cds-mb-4"
+    type="warning"
+    [showTitle]="false">
     <div cdsStack="vertical"
-         gap="2">
-      <strong i18n>Host access: All hosts allowed</strong>
-      <p
-        class="cds-mb-0 cds-mt-1"
-        i18n
-      >
+         gap="1">
+      <strong class="cds-mb-1"
+              i18n>All hosts allowed</strong>
+      <p class="cds-mb-0"
+         i18n>
         Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
       </p>
     </div>
-    <a cdsLink
-       class="text-nowrap cds-ml-3 text-muted"
-       (click)="editHostAccess()"
-       i18n>Edit host access</a>
-  </div>
-</cd-alert-panel>
+  </cd-alert-panel>
+}
 
-<cd-table [data]="hasAllHostsAllowed() ? [] : initiators"
+<cd-table [data]="initiators"
           columnMode="flex"
           (fetchData)="listInitiators()"
           [columns]="initiatorColumns"
@@ -35,9 +29,20 @@
     </cd-table-actions>
   </div>
 </cd-table>
-<ng-template #dhchapTpl>
+
+<ng-template #hostNqnTpl
+             let-row="data.row">
+  {{ getDisplayedHostNqn(row.nqn) }}
+</ng-template>
+
+<ng-template #dhchapTpl
+             let-row="data.row">
   <div cdsStack="horizontal"
        gap="4">
-    {{ authStatus !== authType.NO_AUTH ? 'Yes' : 'No' }}
+    @if (row.nqn === allowAllHost) {
+      {{ '-' }}
+    } @else {
+      {{ authStatus !== authType.NO_AUTH ? yesLabel : noLabel }}
+    }
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
index 2b42b8c339d..05d956256cb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
@@ -9,12 +9,13 @@ import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ModalService } from '~/app/shared/services/modal.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
+import { ALLOW_ALL_HOST } from '~/app/shared/models/nvmeof';
 
 import { NvmeofInitiatorsListComponent } from './nvmeof-initiators-list.component';
 
 const mockInitiators = [
   {
-    nqn: '*',
+    nqn: ALLOW_ALL_HOST,
     use_dhchap: false
   }
 ];
@@ -79,6 +80,8 @@ describe('NvmeofInitiatorsListComponent', () => {
     expect(component.initiators).toEqual(mockInitiators);
     expect(component.subsystem).toEqual(mockSubsystem);
     expect(component.authStatus).toBe('No authentication');
+    expect(component.initiatorColumns.length).toBe(2);
+    expect(component.getDisplayedHostNqn(ALLOW_ALL_HOST)).toBe('Any');
   }));
 
   it('should update authStatus when initiator has dhchap_key', fakeAsync(() => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
index e4f4bb14fb2..4aa5fccb460 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
@@ -12,10 +12,11 @@ import { FinishedTask } from '~/app/shared/models/finished-task';
 import {
   NvmeofSubsystem,
   NvmeofSubsystemInitiator,
+  ALLOW_ALL_HOST,
+  NvmeofSubsystemAuthType,
   getSubsystemAuthStatus
 } from '~/app/shared/models/nvmeof';
 import { Permission } from '~/app/shared/models/permissions';
-import { NvmeofSubsystemAuthType } from '~/app/shared/enum/nvmeof.enum';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
@@ -35,6 +36,8 @@ export class NvmeofInitiatorsListComponent implements OnInit {
 
   @ViewChild('dhchapTpl', { static: true })
   dhchapTpl: TemplateRef<any>;
+  @ViewChild('hostNqnTpl', { static: true })
+  hostNqnTpl: TemplateRef<any>;
 
   initiatorColumns: CdTableColumn[];
   tableActions: CdTableAction[];
@@ -44,6 +47,9 @@ export class NvmeofInitiatorsListComponent implements OnInit {
   subsystem: NvmeofSubsystem;
   authStatus: string;
   authType = NvmeofSubsystemAuthType;
+  allowAllHost = ALLOW_ALL_HOST;
+  yesLabel = $localize`Yes`;
+  noLabel = $localize`No`;
 
   constructor(
     public actionLabels: ActionLabelsI18n,
@@ -78,7 +84,8 @@ export class NvmeofInitiatorsListComponent implements OnInit {
     this.initiatorColumns = [
       {
         name: $localize`Host NQN`,
-        prop: 'nqn'
+        prop: 'nqn',
+        cellTemplate: this.hostNqnTpl
       },
       {
         name: $localize`DHCHAP key`,
@@ -96,8 +103,7 @@ export class NvmeofInitiatorsListComponent implements OnInit {
             queryParams: { group: this.group },
             relativeTo: this.route.parent
           }),
-        canBePrimary: (selection: CdTableSelection) => !selection.hasSelection,
-        disable: () => this.hasAllHostsAllowed()
+        canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
       },
       {
         name: $localize`Edit host key`,
@@ -137,11 +143,11 @@ export class NvmeofInitiatorsListComponent implements OnInit {
   }
 
   getAllowAllHostIndex() {
-    return this.selection.selected.findIndex((selected) => selected.nqn === '*');
+    return this.selection.selected.findIndex((selected) => selected.nqn === ALLOW_ALL_HOST);
   }
 
   hasAllHostsAllowed(): boolean {
-    return this.initiators.some((initiator) => initiator.nqn === '*');
+    return this.initiators.some((initiator) => initiator.nqn === ALLOW_ALL_HOST);
   }
 
   updateSelection(selection: CdTableSelection) {
@@ -175,6 +181,10 @@ export class NvmeofInitiatorsListComponent implements OnInit {
     return this.selection.selected.map((selected) => selected.nqn);
   }
 
+  getDisplayedHostNqn(hostNqn: string): string {
+    return hostNqn === ALLOW_ALL_HOST ? $localize`Any` : hostNqn;
+  }
+
   removeInitiatorModal() {
     const hostNQNs = this.getSelectedNQNs();
     const allowAllHostIndex = this.getAllowAllHostIndex();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
index 71c954d34ae..85590b314b5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
@@ -5,6 +5,7 @@ import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 import {
   NvmeofSubsystem,
   NvmeofSubsystemInitiator,
+  NvmeofSubsystemAuthType,
   getSubsystemAuthStatus
 } from '~/app/shared/models/nvmeof';
 import { Permissions } from '~/app/shared/models/permissions';
@@ -14,7 +15,6 @@ import { CdTableFetchDataContext } from '~/app/shared/models/cd-table-fetch-data
 import { CdTableAction } from '~/app/shared/models/cd-table-action';
 
 import { Icons } from '~/app/shared/enum/icons.enum';
-import { NvmeofSubsystemAuthType } from '~/app/shared/enum/nvmeof.enum';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/nvmeof.enum.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/nvmeof.enum.ts
deleted file mode 100644
index 816613dc595..00000000000
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/enum/nvmeof.enum.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-export enum NvmeofSubsystemAuthType {
-  NO_AUTH = 'No authentication',
-  UNIDIRECTIONAL = 'Unidirectional',
-  BIDIRECTIONAL = 'Bi-directional'
-}
-
-export enum NvmeofGatewayNodeMode {
-  SELECTOR = 'selector',
-  DETAILS = 'details'
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
index 11d7edab3b0..ccc43e72499 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
@@ -72,12 +72,24 @@ export interface NvmeofGatewayGroup extends CephServiceSpec {
   nodeCount: number;
 }
 
+export enum NvmeofSubsystemAuthType {
+  NO_AUTH = 'No authentication',
+  UNIDIRECTIONAL = 'Unidirectional',
+  BIDIRECTIONAL = 'Bi-directional'
+}
+
+export enum NvmeofGatewayNodeMode {
+  SELECTOR = 'selector',
+  DETAILS = 'details'
+}
+
 export enum AUTHENTICATION {
   Unidirectional = 'unidirectional',
   Bidirectional = 'bidirectional',
   None = 'none'
 }
 
+export const ALLOW_ALL_HOST = '*';
 export const NO_AUTH = 'No authentication';
 
 export const HOST_TYPE = {

From e59ab346663ca7cf9c81f064e6f91c0dcb2b370e Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sat, 27 Jun 2026 07:00:33 +0800
Subject: [PATCH 447/596] qa/suites/rados/mgr: ignorelist
 MGR_INFLUX_DB_LIST_FAILED in module_selftest

module_selftest fails on a cluster log warning that is not ignorelisted:

  cluster [WRN] Health check failed: Failed to list/create InfluxDB database (MGR_INFLUX_DB_LIST_FAILED)

module_selftest is the only job that enables the influx module, and no suite
provisions an InfluxDB server, so once enabled the module cannot reach a backend
and raises a health warning: MGR_INFLUX_NO_SERVER when no hostname is set,
MGR_INFLUX_DB_LIST_FAILED from serve() once one is.  test_influx sets a hostname,
so it hits the latter.

This surfaced only after the test image started shipping the influxdb python
module.  Until then can_run() returned false, the module never enabled, and the
sole log line was "influxdb python module not found", which is already
ignorelisted.  self_test() cannot run without enabling the module, so ignorelist
the warning it raises.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 qa/suites/rados/mgr/tasks/4-units/module_selftest.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qa/suites/rados/mgr/tasks/4-units/module_selftest.yaml b/qa/suites/rados/mgr/tasks/4-units/module_selftest.yaml
index e2a2ca03cc9..a4075512944 100644
--- a/qa/suites/rados/mgr/tasks/4-units/module_selftest.yaml
+++ b/qa/suites/rados/mgr/tasks/4-units/module_selftest.yaml
@@ -6,6 +6,7 @@ overrides:
       - objects misplaced
       - Synthetic exception in serve
       - influxdb python module not found
+      - Failed to list/create InfluxDB database \(MGR_INFLUX_DB_LIST_FAILED\)
       - foo bar
       - Failed to open Telegraf
       - evicting unresponsive client

From a62a982aac660dfa151b5ad33e30592db5800915 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sun, 10 May 2026 03:04:13 +0000
Subject: [PATCH 448/596] docs: balancer: Elaborate what "average" means.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The wording "average" so far suggested a simple mean count, which it isn't.

It is important to document this, so that the user can follow
why the balancer is active or not.

Source for the logic (deviation computation and threshold check)
in `src/osd/OSDMap.cc`:

`calc_deviations()` - computes per-OSD deviation:

    float target = osd_weight.at(oid) * pgs_per_weight;
    float deviation = (float)opgs.size() - target;

Where `pgs_per_weight` is computed in `calc_pg_upmaps()`:

    float pgs_per_weight = total_pgs / osd_weight_total;

This also has the early threshold + early return:

    if (cur_max_deviation <= max_deviation) {
        ldout(cct, 10) << __func__ << " distribution is almost perfect" << dendl;
        return 0;
    }

`fill_overfull_underfull()` classifies OSDs using `max_deviation`:

    if (odev > max_deviation) {
        overfull.insert(oid);        // deviation > +5 -> source candidate
    }
    if (odev < -(int)max_deviation) {
        underfull.push_back(oid);    // deviation < -5 -> target candidate
    }

Signed-off-by: Niklas Hambüchen <mail@nh2.me>
---
 doc/rados/operations/balancer.rst | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/doc/rados/operations/balancer.rst b/doc/rados/operations/balancer.rst
index 9d92a81e2a2..a797f9be205 100644
--- a/doc/rados/operations/balancer.rst
+++ b/doc/rados/operations/balancer.rst
@@ -63,9 +63,22 @@ at the potential cost of greater impact on client operations.
 There is a separate setting ``upmap_max_deviation`` for how uniform the
 distribution of PGs must be for the module to consider the cluster adequately
 balanced.  At the time of writing (June 2025), this value defaults to ``5``,
-which means that if a given OSD's PG replicas vary by five or fewer above or
-below the cluster's average, it will be considered sufficiently balanced.
+which means that if a given OSD's PG shard count deviates by five or fewer
+from its weight-proportional target, it will be considered sufficiently
+balanced.
 
+More precisely, the balancer computes a per-OSD target shard count as::
+
+   target = osd_weight * (total_shards / total_weight)
+
+where ``osd_weight`` is the OSD's CRUSH weight times its reweight
+(the ``REWEIGHT`` value from ``ceph osd df``), ``total_shards`` is
+``pool_size * pg_num`` summed over all balanced pools,
+and ``total_weight`` is the sum of those per-OSD weights.
+The deviation is then ``actual_shard_count - target``.
+If no OSD's absolute deviation exceeds
+``upmap_max_deviation``, the balancer considers the distribution
+sufficiently balanced and makes no changes.
 
 This value of PG replicas/shards (as distinct from logical PGs) is reported
 by the ``ceph osd df`` command under the ``PGS`` column and the variance

From 8f83ec546aa16c3e06f1a2b1cbf4c8f657771f55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sun, 10 May 2026 03:35:52 +0000
Subject: [PATCH 449/596] docs: balancer: Explain limitations of PG shard count
 balancing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Niklas Hambüchen <mail@nh2.me>
---
 doc/rados/operations/balancer.rst | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/doc/rados/operations/balancer.rst b/doc/rados/operations/balancer.rst
index a797f9be205..bfd37a10aa4 100644
--- a/doc/rados/operations/balancer.rst
+++ b/doc/rados/operations/balancer.rst
@@ -39,6 +39,22 @@ combines the upmap balancer with the read balancer so that both writes
 and reads are optimized. ``read`` mode can be used when only read optimization
 is desired. For more details, see :ref:`read_balancer`.
 
+Limitation: count-based balancing vs. size-based balancing
+----------------------------------------------------------
+
+Ceph's built-in balancer optimizes only by **PG shard count**, not by the
+actual size of the data stored in each PG.
+
+This can result in clusters whose OSDs are balanced by PG shard count,
+but very imbalanced by stored Bytes.
+At the pool level, this can cause a pool's ``%USED`` (from ``ceph df``)
+to be much higher than the cluster's ``%RAW USED``, because the
+pool's fullest OSD (which determines the pool's available space) may be
+disproportionately loaded with large PGs.
+
+Size-aware community balancers exist (for example,
+`jj-balancer <https://github.com/TheJJ/ceph-balancer>`_).
+
 Throttling
 ----------
 

From 8e66072ec58666b9b504fb93b9ebd9daa42de6ab Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Sun, 21 Jun 2026 11:48:01 +0800
Subject: [PATCH 450/596] crimson/osd/pg_backend: mark the omaps of the object
 dirty when removing omap keys

Fixes: https://tracker.ceph.com/issues/77548
Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 src/crimson/osd/ops_executer.cc | 4 ++--
 src/crimson/osd/pg_backend.cc   | 9 +++++----
 src/crimson/osd/pg_backend.h    | 4 +++-
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/crimson/osd/ops_executer.cc b/src/crimson/osd/ops_executer.cc
index 343b93b2dbc..5be20cc90e5 100644
--- a/src/crimson/osd/ops_executer.cc
+++ b/src/crimson/osd/ops_executer.cc
@@ -806,8 +806,8 @@ OpsExecuter::do_execute_op(OSDOp& osd_op)
     if (!pg.get_pgpool().info.supports_omap()) {
       return crimson::ct_error::operation_not_supported::make();
     }*/
-    return do_write_op([&osd_op](auto& backend, auto& os, auto& txn) {
-      return backend.omap_remove_key(os, osd_op, txn);
+    return do_write_op([&osd_op, this](auto& backend, auto& os, auto& txn) {
+      return backend.omap_remove_key(os, osd_op, txn, *osd_op_params, delta_stats);
     });
   case CEPH_OSD_OP_OMAPCLEAR:
     return do_write_op([this, &osd_op](auto& backend, auto& os, auto& txn) {
diff --git a/src/crimson/osd/pg_backend.cc b/src/crimson/osd/pg_backend.cc
index 0c31e28f333..77b8dffdf01 100644
--- a/src/crimson/osd/pg_backend.cc
+++ b/src/crimson/osd/pg_backend.cc
@@ -1756,7 +1756,9 @@ PGBackend::interruptible_future<> PGBackend::omap_remove_range(
 PGBackend::interruptible_future<> PGBackend::omap_remove_key(
   ObjectState& os,
   const OSDOp& osd_op,
-  ceph::os::Transaction& txn)
+  ceph::os::Transaction& txn,
+  osd_op_params_t &osd_op_params,
+  object_stat_sum_t &delta_stats)
 {
   ceph::bufferlist to_rm_bl;
   try {
@@ -1766,9 +1768,8 @@ PGBackend::interruptible_future<> PGBackend::omap_remove_key(
     throw crimson::osd::invalid_argument{};
   }
   txn.omap_rmkeys(coll->get_cid(), ghobject_t{os.oi.soid}, to_rm_bl);
-  // TODO:
-  // ctx->clean_regions.mark_omap_dirty();
-  // ctx->delta_stats.num_wr++;
+  osd_op_params.clean_regions.mark_omap_dirty();
+  delta_stats.num_wr++;
   os.oi.clear_omap_digest();
   return seastar::now();
 }
diff --git a/src/crimson/osd/pg_backend.h b/src/crimson/osd/pg_backend.h
index ceecc354dce..e612a611c2d 100644
--- a/src/crimson/osd/pg_backend.h
+++ b/src/crimson/osd/pg_backend.h
@@ -404,7 +404,9 @@ public:
   interruptible_future<> omap_remove_key(
     ObjectState& os,
     const OSDOp& osd_op,
-    ceph::os::Transaction& trans);
+    ceph::os::Transaction& trans,
+    osd_op_params_t &osd_op_params,
+    object_stat_sum_t &delta_stats);
   using omap_clear_ertr = crimson::errorator<crimson::ct_error::enoent>;
   using omap_clear_iertr =
     ::crimson::interruptible::interruptible_errorator<

From 1966b0c91755ab018dd9b43bfbdf72f9405f4761 Mon Sep 17 00:00:00 2001
From: Yael Azulay <yaelazulay@redhat.com>
Date: Thu, 21 May 2026 14:38:28 +0300
Subject: [PATCH 451/596] cephadm: keep mgr ports in sync when modules are
 enabled/disabled

ceph orch ps  - was showing stale or incorrect port information for `mgr` daemons after enabling or disabling mgr modules (e.g., dashboard, prometheus).
This fix ensures the displayed ports always reflect the actual active module endpoints.

Code Fixes:
-----------
Changes in src/pybind/mgr/cephadm/services/cephadmservice.py:
- Extract and refactor _get_mgr_service_ports:
	The logic for reading active mgr module ports was inline inside prepare_create, using check_mon_command({'prefix': 'mgr services'}). It was extracted into a static helper method and refactored to read directly from mgr.get('mgr_map')['services'] instead -- which is faster and consistent with how get_dependencies reads the same data. The method is now shared by both prepare_create (existing use) and get_dependencies (new use).

- Extract `_get_mgr_service_ports`:
	The logic for reading active mgr module ports from `mgr_map['services']` was inline inside `prepare_create`. It was extracted into a static helper method so it can be reused by both `prepare_create` (existing use) and `get_dependencies` (new use). Returns the port numbers currently registered by active mgr modules (e.g., `[8443, 9283]`).

-  Override `get_dependencies` in `MgrService`:
	The base class returns `[]` for all Ceph daemons. The serve loop compares `get_dependencies()` output against `last_deps` (saved after the previous reconfig). If they differ, a reconfig is triggered. By overriding this method in `MgrService`, we make the serve loop aware of mgr port changes. Returns a sorted list such as `['port:8443', 'port:9283', 'sd_port:8765']`.

- Override `generate_config` in `MgrService`:
	After a reconfig completes, the result of `generate_config` is saved as `last_deps`. The inherited implementation returns `[]` as deps. If `[]` is saved but `get_dependencies` returns `['port:8443', 'sd_port:8765']`, they would always differ, causing an infinite reconfig loop. This override ensures that what is saved as `last_deps` matches what `get_dependencies` will return in the next iteration.

Changes in `src/pybind/mgr/cephadm/serve.py`:

- Update mgr cache on reconfig:
	The existing logic skipped the cache update for all Ceph daemon reconfigs. A new `elif` branch for mgr reconfigs fetches the existing cached `DaemonDescription`, updates only its `ports` field, and saves it back. This makes `ceph orch ps` reflect the correct ports immediately after a reconfig, without showing a misleading "starting" status.

Changes in `src/cephadm/cephadm.py`:

- Update `unit.meta` on reconfig:
	`unit.meta` is a per-daemon file on the host that stores metadata including ports.  It is read periodically by `cephadm ls` and fed back into the orchestrator cache. Previously it was only written on initial deployment, so every periodic cache refresh would overwrite the corrected ports with stale data from `unit.meta`. This change updates the `ports` field in `unit.meta` during reconfig, ensuring the cache refresh confirms the correct state rather than reverting it.

Changes to src/pybind/mgr/cephadm/tests/services/test_mgr.py:

- Updated _prepare helper:
	The original mocked check_mon_command to feed services data to prepare_create. Since our _get_mgr_service_ports now reads from mgr.get('mgr_map') instead of check_mon_command, the mock was replaced with mock_store_set('_ceph_get', 'mgr_map', ...) which sets the data in the right place.

- Added test_get_dependencies_changes_when_module_enabled:
   A new test that verifies get_dependencies returns different dep strings before and after a module is enabled. This directly tests the core sync mechanism -- the serve loop compares get_dependencies output against last_deps to detect port changes and trigger a reconfig.

to run new tests:
cd src/pybind/mgr
tox -e py3 -- cephadm/tests/services/test_mgr.py -v

Fixes: https://tracker.ceph.com/issues/76565
Signed-off-by: Yael Azulay <yazulay@redhat.com>
---
 src/cephadm/cephadm.py                        | 13 +++++++
 src/pybind/mgr/cephadm/serve.py               |  8 +++++
 .../mgr/cephadm/services/cephadmservice.py    | 36 +++++++++++++------
 .../mgr/cephadm/tests/services/test_mgr.py    | 33 ++++++++++++++---
 4 files changed, 74 insertions(+), 16 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index c822efa3f6c..f85dc929711 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -1189,6 +1189,19 @@ def deploy_daemon(
                 )
             else:
                 raise RuntimeError('attempting to deploy a daemon without a container image')
+    else:
+        # On reconfig, update unit.meta so that port metadata
+        # stays current without requiring a full redeploy.
+        meta_path = os.path.join(data_dir, 'unit.meta')
+        ports = [e.port for e in endpoints] if endpoints else []
+        try:
+            update_meta_file(meta_path, {'ports': ports})
+        except FileNotFoundError:
+            logger.warning(f'unit.meta not found at {meta_path}, skipping port update')
+        except Exception as e:
+            logger.warning(
+                f'failed to update unit.meta at {meta_path}, skipping port update: {e}'
+            )
 
     if not os.path.exists(data_dir + '/unit.created'):
         with write_new(data_dir + '/unit.created', owner=(uid, gid)) as f:
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 8f1af9b18b0..4b4b60a09b8 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1543,6 +1543,14 @@ class CephadmServe:
                             sd.update_pending_daemon_config(True)
                         self.mgr.cache.add_daemon(daemon_spec.host, sd)
                     self.mgr.cache.invalidate_host_daemons(daemon_spec.host)
+                elif reconfig and daemon_spec.daemon_type == 'mgr':
+                    cache_host = daemon_spec.host
+                    if not code and self.mgr.cache.has_daemon(daemon_spec.name()):
+                        existing_dd = self.mgr.cache.get_daemon(daemon_spec.name())
+                        existing_dd.ports = daemon_spec.ports
+                        cache_host = existing_dd.hostname or daemon_spec.host
+                        self.mgr.cache.add_daemon(cache_host, existing_dd)
+                    self.mgr.cache.invalidate_host_daemons(cache_host)
 
                 if daemon_spec.daemon_type != 'agent':
                     self.mgr.cache.update_daemon_config_deps(
diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index 649474c3be5..2a3591f9834 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -1231,6 +1231,30 @@ class MgrService(CephService):
             # are not a concern.
             return True
 
+    @staticmethod
+    def _get_mgr_service_ports(mgr: "CephadmOrchestrator") -> List[int]:
+        """Return the list of ports from the mgr map services."""
+        ports: List[int] = []
+        mgr_map = mgr.get('mgr_map')
+        for end_point in mgr_map.get('services', {}).values():
+            port = re.search(r'\:(\d+)\/', end_point)
+            if port:
+                ports.append(int(port.group(1)))
+        return ports
+
+    @classmethod
+    def get_dependencies(cls, mgr: "CephadmOrchestrator",
+                         spec: Optional[ServiceSpec] = None,
+                         daemon_type: Optional[str] = None) -> List[str]:
+        return sorted(
+            [f'port:{p}' for p in cls._get_mgr_service_ports(mgr)]
+            + [f'sd_port:{mgr.service_discovery_port}']
+        )
+
+    def generate_config(self, daemon_spec: CephadmDaemonDeploySpec) -> Tuple[Dict[str, Any], List[str]]:
+        config, _ = super().generate_config(daemon_spec)
+        return config, self.get_dependencies(self.mgr)
+
     def prepare_create(self, daemon_spec: CephadmDaemonDeploySpec) -> CephadmDaemonDeploySpec:
         """
         Create a new manager instance on a host.
@@ -1250,17 +1274,7 @@ class MgrService(CephService):
         # user has decided to use different dashboard ports in each server
         # If this is the case then the dashboard port opened will be only the used
         # as default.
-        ports = []
-        ret, mgr_services, err = self.mgr.check_mon_command({
-            'prefix': 'mgr services',
-        })
-        if mgr_services:
-            mgr_endpoints = json.loads(mgr_services)
-            for end_point in mgr_endpoints.values():
-                port = re.search(r'\:\d+\/', end_point)
-                if port:
-                    ports.append(int(port[0][1:-1]))
-
+        ports = self._get_mgr_service_ports(self.mgr)
         # Always replace ports (do not append onto a list rehydrated from the
         # persisted host cache). When ``mgr services`` is empty, ``ports`` is
         # empty and we must not retain old entries + append service discovery
diff --git a/src/pybind/mgr/cephadm/tests/services/test_mgr.py b/src/pybind/mgr/cephadm/tests/services/test_mgr.py
index 591a79ecc72..6a01a9aee68 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_mgr.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_mgr.py
@@ -1,3 +1,4 @@
+import json
 from unittest import mock
 
 from cephadm.module import CephadmOrchestrator
@@ -13,8 +14,8 @@ class TestMgrService:
                  carried_over_ports: list) -> CephadmDaemonDeploySpec:
         """Build a daemon_spec that mimics rehydration from the persisted
         DaemonDescription (which copies `ports=dd.ports`), then call
-        MgrService.prepare_create with `mgr services` returning the supplied
-        payload.
+        MgrService.prepare_create with mgr_map returning the supplied
+        services payload.
         """
         svc = MgrService(cephadm_module)
         daemon_spec = CephadmDaemonDeploySpec(
@@ -24,9 +25,9 @@ class TestMgrService:
             daemon_type='mgr',
             ports=list(carried_over_ports),
         )
-        with mock.patch.object(cephadm_module, 'check_mon_command',
-                               return_value=(0, mgr_services_payload, '')), \
-             mock.patch.object(svc, 'get_keyring_with_caps',
+        services = json.loads(mgr_services_payload) if mgr_services_payload else {}
+        cephadm_module.mock_store_set('_ceph_get', 'mgr_map', {'services': services})
+        with mock.patch.object(svc, 'get_keyring_with_caps',
                                return_value='[mgr.ceph-1.xyz]\n\tkey = X\n'), \
              mock.patch.object(svc, 'generate_config',
                                return_value=({}, [])):
@@ -65,3 +66,25 @@ class TestMgrService:
             carried,
         )
         assert out.ports == [9283, cephadm_module.service_discovery_port]
+
+    def test_get_dependencies_changes_when_module_enabled(
+            self, cephadm_module: CephadmOrchestrator):
+        # Verify that get_dependencies reflects the current active modules.
+        # This is the mechanism that causes the serve loop to detect port
+        # changes and trigger a reconfig when modules are enabled/disabled.
+
+        # Before: no modules enabled
+        cephadm_module.mock_store_set('_ceph_get', 'mgr_map', {'services': {}})
+        deps_before = MgrService.get_dependencies(cephadm_module)
+        assert deps_before == [f'sd_port:{cephadm_module.service_discovery_port}']
+
+        # After: prometheus enabled
+        cephadm_module.mock_store_set('_ceph_get', 'mgr_map', {
+            'services': {'prometheus': 'http://192.0.2.10:9283/'}
+        })
+        deps_after = MgrService.get_dependencies(cephadm_module)
+        assert deps_after == ['port:9283', f'sd_port:{cephadm_module.service_discovery_port}']
+
+        # The difference between deps_before and deps_after is what the serve
+        # loop detects -- this is what triggers the reconfig
+        assert deps_before != deps_after

From e55244161992640e2e4a487b1cbaa702f2cebf43 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Sun, 28 Jun 2026 14:42:07 +0000
Subject: [PATCH 452/596] build: add Mold linker compatibility

Mold handles several linker features differently from ld.bfd:

- --exclude-libs,ALL hides .symver-aliased symbols (e.g. rados_*)
  even when the version script lists them as global. Detect Mold
  (via USING_MOLD_LINKER) and disable --exclude-libs; version
  scripts already control symbol visibility.

- Duplicate symbols across static archives are treated as errors.
  Merge crimson-alien-common into crimson-alienstore as a single
  archive. For crimson-osd, link crimson-alienstore before
  crimson-common with --allow-multiple-definition so the alien
  thread's non-crimson definitions win (Mold picks first definition).

- Python/Cython extension builds (via Distutils.cmake) invoked the
  system default linker. Pass -fuse-ld= via MOLD_FUSE_LD_FLAG so
  extensions link with the configured linker.

- Add rados_* and _rados_* to librados.map global section for Mold
  compatibility with .symver aliases.

Co-authored-by: Mark Kogan <mkogan@redhat.com>
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 cmake/modules/CephChecks.cmake           |  9 ++++++
 cmake/modules/Distutils.cmake            | 12 +++++--
 src/crimson/os/alienstore/CMakeLists.txt | 23 +++++++++-----
 src/crimson/osd/CMakeLists.txt           | 40 ++++++++++++++++++------
 src/librados/librados.map                |  2 ++
 5 files changed, 66 insertions(+), 20 deletions(-)

diff --git a/cmake/modules/CephChecks.cmake b/cmake/modules/CephChecks.cmake
index 4da4dfad5bf..9506a4db220 100644
--- a/cmake/modules/CephChecks.cmake
+++ b/cmake/modules/CephChecks.cmake
@@ -202,3 +202,12 @@ try_compile(HAVE_LINK_EXCLUDE_LIBS
   ${CMAKE_CURRENT_BINARY_DIR}
   SOURCES ${CMAKE_CURRENT_LIST_DIR}/CephCheck_link.c
   LINK_LIBRARIES "-Wl,--exclude-libs,ALL")
+
+# Mold linker applies --exclude-libs after version script processing,
+# which hides .symver-aliased symbols (e.g. rados_*) even when the
+# version script lists them as global.  Disable --exclude-libs for Mold;
+# version scripts already control symbol visibility.
+if(HAVE_LINK_EXCLUDE_LIBS AND USING_MOLD_LINKER)
+  message(STATUS "Mold linker -- disabling --exclude-libs (incompatible with .symver)")
+  set(HAVE_LINK_EXCLUDE_LIBS FALSE CACHE INTERNAL "" FORCE)
+endif()
diff --git a/cmake/modules/Distutils.cmake b/cmake/modules/Distutils.cmake
index 37b2efa7457..9d5dd33fcef 100644
--- a/cmake/modules/Distutils.cmake
+++ b/cmake/modules/Distutils.cmake
@@ -72,7 +72,11 @@ function(distutils_add_cython_module target name src)
   list(APPEND PY_CPPFLAGS -D'__Pyx_check_single_interpreter\(ARG\)=ARG\#\#0')
   set(PY_CC ${compiler_launcher} ${CMAKE_C_COMPILER} ${c_compiler_arg1})
   set(PY_CXX ${compiler_launcher} ${CMAKE_CXX_COMPILER} ${cxx_compiler_arg1})
-  set(PY_LDSHARED ${link_launcher} ${CMAKE_C_COMPILER} ${c_compiler_arg1} "-shared")
+  if(USING_MOLD_LINKER)
+    set(PY_LDSHARED ${link_launcher} ${CMAKE_C_COMPILER} ${c_compiler_arg1} "-shared" "${MOLD_FUSE_LD_FLAG}")
+  else()
+    set(PY_LDSHARED ${link_launcher} ${CMAKE_C_COMPILER} ${c_compiler_arg1} "-shared")
+  endif()
   string(REPLACE " " ";" PY_LDFLAGS "${CMAKE_SHARED_LINKER_FLAGS}")
   list(APPEND PY_LDFLAGS -L${CMAKE_LIBRARY_OUTPUT_DIRECTORY})
 
@@ -117,7 +121,11 @@ function(distutils_install_cython_module name)
   get_property(compiler_launcher GLOBAL PROPERTY RULE_LAUNCH_COMPILE)
   get_property(link_launcher GLOBAL PROPERTY RULE_LAUNCH_LINK)
   set(PY_CC "${compiler_launcher} ${CMAKE_C_COMPILER}")
-  set(PY_LDSHARED "${link_launcher} ${CMAKE_C_COMPILER} -shared")
+  if(USING_MOLD_LINKER)
+    set(PY_LDSHARED "${link_launcher} ${CMAKE_C_COMPILER} -shared ${MOLD_FUSE_LD_FLAG}")
+  else()
+    set(PY_LDSHARED "${link_launcher} ${CMAKE_C_COMPILER} -shared")
+  endif()
   set(PY_LDFLAGS "${CMAKE_SHARED_LINKER_FLAGS} -L${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
   cmake_parse_arguments(DU "DISABLE_VTA" "" "" ${ARGN})
   if(DU_DISABLE_VTA AND HAS_VTA)
diff --git a/src/crimson/os/alienstore/CMakeLists.txt b/src/crimson/os/alienstore/CMakeLists.txt
index 6a227cfdb87..0c87e1505e5 100644
--- a/src/crimson/os/alienstore/CMakeLists.txt
+++ b/src/crimson/os/alienstore/CMakeLists.txt
@@ -30,11 +30,6 @@ if(WITH_CEPH_DEBUG_MUTEX)
     ${PROJECT_SOURCE_DIR}/src/common/condition_variable_debug.cc
     ${PROJECT_SOURCE_DIR}/src/common/shared_mutex_debug.cc)
 endif()
-add_library(crimson-alien-common STATIC
-  ${crimson_alien_common_srcs})
-if(WITH_BREAKPAD)
-  target_link_libraries(crimson-alien-common Breakpad::client)
-endif()
 
 set(alien_store_srcs
   alien_store.cc
@@ -65,20 +60,32 @@ set(alien_store_srcs
   ${PROJECT_SOURCE_DIR}/src/os/bluestore/OnodeScan.cc
   ${PROJECT_SOURCE_DIR}/src/os/memstore/MemStore.cc)
 
+# Merge alienstore + alien-common into a single archive.  The common sources
+# are compiled without WITH_CRIMSON and duplicate symbols in crimson-common.
+# ld.bfd resolves these by archive order; Mold treats them as errors.
+# After building, localize the duplicate symbols so they resolve internally
+# within this archive (for the alien/bluestore thread) while crimson-osd's
+# own references resolve from crimson-common (for seastar threads).
 add_library(crimson-alienstore STATIC
-  ${alien_store_srcs})
+  ${alien_store_srcs}
+  ${crimson_alien_common_srcs})
 if(WITH_LTTNG)
   add_dependencies(crimson-alienstore bluestore-tp)
 endif()
+if(WITH_BREAKPAD)
+  target_link_libraries(crimson-alienstore PRIVATE Breakpad::client)
+endif()
 
-# For crimson-alienstore WITH_CRIMSON is not defined
 target_link_libraries(crimson-alienstore
   PRIVATE
     seastar
     ${FMT_LIB}
     kv
     heap_profiler
-    crimson-alien-common
     ${BLKID_LIBRARIES}
     ${UDEV_LIBRARIES}
     blk)
+
+# Mold duplicate-symbol handling is done at the crimson-osd link step
+# (see src/crimson/osd/CMakeLists.txt) by ordering crimson-alienstore
+# before crimson-common with --allow-multiple-definition.
diff --git a/src/crimson/osd/CMakeLists.txt b/src/crimson/osd/CMakeLists.txt
index 7e06215a6eb..a15adf049cc 100644
--- a/src/crimson/osd/CMakeLists.txt
+++ b/src/crimson/osd/CMakeLists.txt
@@ -70,16 +70,36 @@ if(HAS_VTA)
   set_source_files_properties(main.cc
     PROPERTIES COMPILE_FLAGS -fno-var-tracking-assignments)
 endif()
-target_link_libraries(crimson-osd
-  legacy-option-headers
-  crimson-admin
-  crimson-common
-  crimson-os
-  crimson
-  erasure_code
-  ${FMT_LIB}
-  Boost::MPL
-  dmclock::dmclock)
+if(USING_MOLD_LINKER AND WITH_BLUESTORE)
+  # With Mold, duplicate symbols between crimson-alienstore and crimson-common
+  # must be resolved in favor of crimson-alienstore (compiled without
+  # WITH_CRIMSON) so the alien thread uses the classic code paths.
+  # Link crimson-alienstore BEFORE crimson-common so its definitions win
+  # with --allow-multiple-definition (Mold picks first definition).
+  target_link_libraries(crimson-osd
+    legacy-option-headers
+    crimson-admin
+    crimson-alienstore
+    crimson-common
+    crimson-os
+    crimson
+    erasure_code
+    ${FMT_LIB}
+    Boost::MPL
+    dmclock::dmclock)
+  target_link_options(crimson-osd PRIVATE -Wl,--allow-multiple-definition)
+else()
+  target_link_libraries(crimson-osd
+    legacy-option-headers
+    crimson-admin
+    crimson-common
+    crimson-os
+    crimson
+    erasure_code
+    ${FMT_LIB}
+    Boost::MPL
+    dmclock::dmclock)
+endif()
 set_target_properties(crimson-osd PROPERTIES
   POSITION_INDEPENDENT_CODE ${EXE_LINKER_USE_PIE})
 install(TARGETS crimson-osd DESTINATION bin)
diff --git a/src/librados/librados.map b/src/librados/librados.map
index 279a0ba0691..96dd5072d94 100644
--- a/src/librados/librados.map
+++ b/src/librados/librados.map
@@ -1,5 +1,7 @@
 LIBRADOS_PRIVATE {
 	global:
+		rados_*;
+		_rados_*;
 		extern "C++" {
 			"guard variable for boost::asio::detail::call_stack<boost::asio::detail::strand_executor_service::strand_impl, unsigned char>::top_";
 			"guard variable for boost::asio::detail::call_stack<boost::asio::detail::strand_service::strand_impl, unsigned char>::top_";

From ebc18499afd52ff43614cbf3c1f10c4713707d0f Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Sun, 28 Jun 2026 14:42:23 +0000
Subject: [PATCH 453/596] cmake: add WITH_MOLD option for Mold linker support

Add a WITH_MOLD cmake option that auto-configures the build for
the Mold linker. When enabled, cmake finds mold, sets CMAKE_LINKER,
injects -fuse-ld=mold into all linker flag variables, and sets
USING_MOLD_LINKER which gates the Mold-specific workarounds added
in the previous commit.

Usage: cmake -DWITH_MOLD=ON ...

Assisted-by: Claude <claude.ai>
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 CMakeLists.txt | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index c02a5021ccc..b173c638cd0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -75,6 +75,20 @@ if(MINGW)
   link_directories(${MINGW_LINK_DIRECTORIES})
 endif()
 
+option(WITH_MOLD "Use the Mold linker" OFF)
+if(WITH_MOLD)
+  find_program(_mold_path mold REQUIRED)
+  message(STATUS "Mold linker: ${_mold_path}")
+  set(CMAKE_LINKER ${_mold_path} CACHE FILEPATH "Linker" FORCE)
+  set(MOLD_FUSE_LD_FLAG "-fuse-ld=mold" CACHE INTERNAL "")
+  foreach(_flags CMAKE_EXE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS)
+    if(NOT "${${_flags}}" MATCHES "fuse-ld=")
+      string(APPEND ${_flags} " ${MOLD_FUSE_LD_FLAG}")
+    endif()
+  endforeach()
+  set(USING_MOLD_LINKER TRUE CACHE INTERNAL "")
+endif()
+
 option(WITH_CCACHE "Build with ccache.")
 if(WITH_CCACHE)
   if(CMAKE_C_COMPILER_LAUNCHER OR CMAKE_CXX_COMPILER_LAUNCHER)

From 68ec2a1b3fc20074615aad422b3b5642651b4ee6 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 29 Jun 2026 09:19:02 +0800
Subject: [PATCH 454/596] crimson/test: stop the messenger-thrash config on
 every exit path

test_messenger_thrash put sharded_conf().stop() in the success
continuation, so an exception from the tests skipped it and left the
static sharded<ConfigProxy> holding live instances. its destructor then
asserts. a tester hit this when the run went OOM at --memory 256M:

  ERROR [shard 0:main] test - Test failed: got exception
    ceph::buffer::v15_2_0::bad_alloc (Bad allocation [buffer:1])
  /ceph/src/seastar/include/seastar/core/sharded.hh:573:
    seastar::sharded<Service>::~sharded()
    [with Service = crimson::common::ConfigProxy]:
    Assertion `_instances.empty()' failed.
  terminate called without an active exception

run the body in seastar::async and stop the config through
seastar::deferred_stop, as crimson/osd/main.cc already does. the guard
is constructed only after start() succeeds, and its destructor stops the
config on any exit path, so a failing test exits cleanly instead of
aborting.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/test/crimson/test_messenger_thrash.cc | 39 ++++++++++-------------
 1 file changed, 17 insertions(+), 22 deletions(-)

diff --git a/src/test/crimson/test_messenger_thrash.cc b/src/test/crimson/test_messenger_thrash.cc
index ebc4a383ab2..36af35739ce 100644
--- a/src/test/crimson/test_messenger_thrash.cc
+++ b/src/test/crimson/test_messenger_thrash.cc
@@ -10,7 +10,9 @@
 #include <seastar/core/future-util.hh>
 #include <seastar/core/reactor.hh>
 #include <seastar/core/sleep.hh>
+#include <seastar/core/thread.hh>
 #include <seastar/core/with_timeout.hh>
+#include <seastar/util/closeable.hh>
 
 #include "common/ceph_argparse.h"
 #include "messages/MPing.h"
@@ -636,31 +638,24 @@ seastar::future<int> do_test(seastar::app_template& app)
                                               CEPH_ENTITY_TYPE_CLIENT,
                                               &cluster,
                                               &conf_file_list);
-  return crimson::common::sharded_conf().start(
-    init_params.name, cluster
-  ).then([] {
-    return local_conf().start();
-  }).then([conf_file_list] {
-    return local_conf().parse_config_files(conf_file_list);
-  }).then([&app] {
-    auto&& config = app.configuration();
-    verbose = config["verbose"].as<bool>();
-      return test_stress(thrash_params_t{8, 32, 50, 120})
-    .then([] {
-      return test_injection(thrash_params_t{16, 32, 50, 120});
-    }).then([] {
+  return seastar::async([init_params, cluster, conf_file_list, &app] {
+    try {
+      crimson::common::sharded_conf().start(init_params.name, cluster).get();
+      local_conf().start().get();
+      auto stop_conf = seastar::deferred_stop(crimson::common::sharded_conf());
+      local_conf().parse_config_files(conf_file_list).get();
+      verbose = app.configuration()["verbose"].as<bool>();
+      test_stress(thrash_params_t{8, 32, 50, 120}).get();
+      test_injection(thrash_params_t{16, 32, 50, 120}).get();
       logger().info("All tests succeeded");
       // Seastar has bugs to have events undispatched during shutdown,
       // which will result in memory leak and thus fail LeakSanitizer.
-      return seastar::sleep(100ms);
-    });
-  }).then([] {
-    return crimson::common::sharded_conf().stop();
-  }).then([] {
-    return 0;
-  }).handle_exception([] (auto eptr) {
-    logger().error("Test failed: got exception {}", eptr);
-    return 1;
+      seastar::sleep(100ms).get();
+      return 0;
+    } catch (...) {
+      logger().error("Test failed: got exception {}", std::current_exception());
+      return 1;
+    }
   });
 }
 

From 1ccb7561823812430d8e780ae277cbca619d81b3 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 29 Jun 2026 09:36:12 +0800
Subject: [PATCH 455/596] qa/cephfs: fix invalid escape sequence SyntaxWarnings

python 3.12 warns on unrecognized escape sequences in string literals.
fuse_mount's admin-socket pyscript and mount's nft payload carry regex
and shell escapes (\., \d, \;) that are meant literally, so make those
strings raw. filesystem's get_mds_addr docstring had a stray \/ in the
example address, which is just a slash, so drop the backslash.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 qa/tasks/cephfs/filesystem.py | 2 +-
 qa/tasks/cephfs/fuse_mount.py | 4 ++--
 qa/tasks/cephfs/mount.py      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/qa/tasks/cephfs/filesystem.py b/qa/tasks/cephfs/filesystem.py
index 0ff5a28475c..9c48134d0bf 100644
--- a/qa/tasks/cephfs/filesystem.py
+++ b/qa/tasks/cephfs/filesystem.py
@@ -192,7 +192,7 @@ class FSStatus(RunCephCmd):
 
     def get_mds_addr(self, name):
         """
-        Return the instance addr as a string, like "10.214.133.138:6807\/10825"
+        Return the instance addr as a string, like "10.214.133.138:6807/10825"
         """
         info = self.get_mds(name)
         if info:
diff --git a/qa/tasks/cephfs/fuse_mount.py b/qa/tasks/cephfs/fuse_mount.py
index 9df5accd696..35e2644c8c5 100644
--- a/qa/tasks/cephfs/fuse_mount.py
+++ b/qa/tasks/cephfs/fuse_mount.py
@@ -432,7 +432,7 @@ class FuseMountBase(CephFSMountBase):
         return ""
 
     def find_admin_socket(self):
-        pyscript = """
+        pyscript = r"""
 import glob
 import re
 import os
@@ -449,7 +449,7 @@ def _find_admin_socket(client_name):
             return files[0]
 
         for f in files:
-                pid = re.match(".*\.(\d+)\.asok$", f).group(1)
+                pid = re.match(r".*\.(\d+)\.asok$", f).group(1)
                 if os.path.exists("/proc/{{0}}".format(pid)):
                     with open("/proc/{{0}}/cmdline".format(pid), 'r') as proc_f:
                         contents = proc_f.read()
diff --git a/qa/tasks/cephfs/mount.py b/qa/tasks/cephfs/mount.py
index 26b848b477a..2f083caddce 100644
--- a/qa/tasks/cephfs/mount.py
+++ b/qa/tasks/cephfs/mount.py
@@ -306,7 +306,7 @@ class CephFSMountBase(object):
             # Setup the NAT
             gw = self._default_gateway()
 
-            self.run_shell_payload(f"""
+            self.run_shell_payload(rf"""
                 set -e
 
                 if command -v iptables >/dev/null 2>&1 && sudo iptables -t nat -A POSTROUTING -s {self.ceph_brx_net} -o {gw} -j MASQUERADE 2>/dev/null; then

From 69cd81f14718e62d8c8c71900813086beed415f4 Mon Sep 17 00:00:00 2001
From: Xuehan Xu <xuxuehan@qianxin.com>
Date: Fri, 5 Jun 2026 17:19:13 +0800
Subject: [PATCH 456/596] crimson/os/seastore/journal/circular_bounded_journal:
 find the real journal tail on startup

Recover the correct journal tail during replay by scanning
JOURNAL_TAIL records instead of relying solely on the on-disk
header, which may be stale if a crash occurs between record
write and header update.

The journal header is stored *separately* from the (append-only)
journal and is not updated atomically with journal writes,
so it may lag behind after a crash.
Treat the journal as the source of truth and rebuild the tail from persisted records.

Replay is reorganized into three passes:
1) discover latest journal tail
2) rebuild allocation map
3) replay deltas

Signed-off-by: Xuehan Xu <xuxuehan@qianxin.com>
---
 .../journal/circular_bounded_journal.cc       | 26 +++++++++++++++----
 .../seastore/journal/circular_journal_space.h | 17 ++++++++++++
 2 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/src/crimson/os/seastore/journal/circular_bounded_journal.cc b/src/crimson/os/seastore/journal/circular_bounded_journal.cc
index 62e6c175aed..4bb31172fd4 100644
--- a/src/crimson/os/seastore/journal/circular_bounded_journal.cc
+++ b/src/crimson/os/seastore/journal/circular_bounded_journal.cc
@@ -343,6 +343,25 @@ Journal::replay_ret CircularBoundedJournal::replay(
   cjs.set_initialized(true);
   std::map<paddr_t, journal_seq_t> map;
   std::map<paddr_t, std::pair<CachedExtentRef, uint32_t>> crc_info;
+  auto tail = get_dirty_tail() <= get_alloc_tail() ?
+    get_dirty_tail() : get_alloc_tail();
+  set_written_to(tail);
+  // the first pass to find the real journal tail.
+  auto find_tail = [this](
+    const auto&,
+    const auto &e,
+    sea_time_point) {
+    if (e.type == extent_types_t::JOURNAL_TAIL) {
+      journal_tail_delta_t tails;
+      decode(tails, e.bl);
+      cjs.update_journal_tail_on_startup(
+        tails.dirty_tail, tails.alloc_tail);
+    }
+    return replay_ertr::make_ready_future<bool>(true);
+  };
+  co_await scan_valid_record_delta(std::move(find_tail), tail);
+  tail = get_dirty_tail() <= get_alloc_tail() ?
+    get_dirty_tail() : get_alloc_tail();
   auto build_paddr_seq_map = [&map](
     const auto &offsets,
     const auto &e,
@@ -359,10 +378,7 @@ Journal::replay_ret CircularBoundedJournal::replay(
     }
     return replay_ertr::make_ready_future<bool>(true);
   };
-  auto tail = get_dirty_tail() <= get_alloc_tail() ?
-    get_dirty_tail() : get_alloc_tail();
-  set_written_to(tail);
-  // The first pass to build the paddr->journal_seq_t map 
+  // The second pass to build the paddr->journal_seq_t map
   // from extent allocations
   co_await scan_valid_record_delta(std::move(build_paddr_seq_map), tail);
   auto call_d_handler_if_valid = [this, &map, &d_handler, &crc_info](
@@ -390,7 +406,7 @@ Journal::replay_ret CircularBoundedJournal::replay(
     }
     return replay_ertr::make_ready_future<bool>(true);
   };
-  // The second pass to replay deltas
+  // The third pass to replay deltas
   co_await scan_valid_record_delta(std::move(call_d_handler_if_valid), tail);
   for (auto p : crc_info) {
     ceph_assert_always(p.second.first->get_last_committed_crc() == p.second.second);	
diff --git a/src/crimson/os/seastore/journal/circular_journal_space.h b/src/crimson/os/seastore/journal/circular_journal_space.h
index 049b276b19a..3a3ad2f483b 100644
--- a/src/crimson/os/seastore/journal/circular_journal_space.h
+++ b/src/crimson/os/seastore/journal/circular_journal_space.h
@@ -220,6 +220,23 @@ class CircularJournalSpace : public JournalAllocator {
     return device->read(offset, bptr);
   }
 
+  void update_journal_tail_on_startup(
+    journal_seq_t dirty,
+    journal_seq_t alloc) {
+    LOG_PREFIX(CircularJournalSpace);
+    SUBDEBUG(seastore_journal,
+      "update tail during replay: dirty={} alloc={}",
+      dirty, alloc);
+    if (dirty > header.dirty_tail ||
+        header.dirty_tail == JOURNAL_SEQ_NULL) {
+      header.dirty_tail = dirty;
+    }
+    if (alloc >= header.alloc_tail ||
+        header.alloc_tail == JOURNAL_SEQ_NULL) {
+      header.alloc_tail = alloc;
+    }
+  }
+
   seastar::future<> update_journal_tail(
     journal_seq_t dirty,
     journal_seq_t alloc) {

From c0e9ddabe5efdf91e29365ce7a8ad6d82455c1bb Mon Sep 17 00:00:00 2001
From: Naman Munet <naman.munet@ibm.com>
Date: Wed, 24 Jun 2026 19:33:54 +0530
Subject: [PATCH 457/596] mgr/dashboard: persist table selection across server
 side page changes

Fixes: https://tracker.ceph.com/issues/77651

Signed-off-by: Naman Munet <naman.munet@ibm.com>
---
 .../shared/datatable/table/table.component.ts | 53 +++++++++++++++----
 1 file changed, 44 insertions(+), 9 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
index a261212f324..39386aba981 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
@@ -1265,43 +1265,78 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
    * or some selected items may have been removed.
    */
   updateSelected() {
-    if (!this.selection?.selected?.length) return;
+    // In server-side mode, if data is empty or not yet loaded, preserve existing selection
+    // This prevents clearing selection during page transitions when data is being fetched
+    if (this.serverSide && (!this.data || this.data.length === 0)) {
+      return;
+    }
+
+    const itemsFoundOnCurrentPage = new Set();
+    const itemsFromOtherPages = new Set();
 
-    const newSelected = new Set();
     this.selection.selected.forEach((selectedItem) => {
+      let foundOnCurrentPage = false;
       for (const row of this.data) {
         if (selectedItem[this.identifier] === row[this.identifier]) {
-          newSelected.add(row);
+          itemsFoundOnCurrentPage.add(row);
+          foundOnCurrentPage = true;
+          break;
         }
       }
+      // For server-side pagination, preserve items not on current page
+      if (!foundOnCurrentPage && this.serverSide) {
+        itemsFromOtherPages.add(selectedItem);
+      }
     });
 
-    const newSelectedArray = Array.from(newSelected.values());
+    const selectedItemsOnCurrentPage = Array.from(itemsFoundOnCurrentPage.values());
+    const selectedItemsOnOtherPages = Array.from(itemsFromOtherPages.values());
 
-    if (newSelectedArray.length === 0) {
+    // For server-side pagination, if no items found on current page but we have
+    // items from other pages, preserve them
+    if (
+      selectedItemsOnCurrentPage.length === 0 &&
+      selectedItemsOnOtherPages.length > 0 &&
+      this.serverSide
+    ) {
+      // No items on current page are selected, but we have selections from other pages
+      // Keep the selection with items from other pages
+      this.selection.selected = selectedItemsOnOtherPages;
+      if (this.updateSelectionOnRefresh !== 'never') {
+        this.updateSelection.emit(_.clone(this.selection));
+      }
+      return;
+    }
+
+    if (selectedItemsOnCurrentPage.length === 0) {
       this.selection.selected = [];
       this.updateSelection.emit(_.clone(this.selection));
       return;
     }
 
-    newSelectedArray.forEach((selection: any) => {
+    selectedItemsOnCurrentPage.forEach((selectedItem: any) => {
       const rowIndex = this.model.data.findIndex(
         (row: TableItem[]) =>
-          _.get(row, [0, 'selected', this.identifier]) === selection[this.identifier]
+          _.get(row, [0, 'selected', this.identifier]) === selectedItem[this.identifier]
       );
       if (rowIndex > -1) {
         this.model.selectRow(rowIndex, true);
       }
     });
 
+    // For server-side pagination, combine found items with items from other pages
+    const finalSelection = this.serverSide
+      ? [...selectedItemsOnCurrentPage, ...selectedItemsOnOtherPages]
+      : selectedItemsOnCurrentPage;
+
     if (
       this.updateSelectionOnRefresh === 'onChange' &&
-      _.isEqual(this.selection.selected, newSelectedArray)
+      _.isEqual(this.selection.selected, finalSelection)
     ) {
       return;
     }
 
-    this.selection.selected = newSelectedArray;
+    this.selection.selected = finalSelection;
 
     if (this.updateSelectionOnRefresh !== 'never') {
       this.updateSelection.emit(_.clone(this.selection));

From 0a528685d598bc43e4124a6bd039bd768ed50374 Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Mon, 29 Jun 2026 14:20:22 +0200
Subject: [PATCH 458/596] mgr/cephadm: bump Python version path mapped in kcli
 dev env

Bump Python version path mapped in kcli dev env from 3.9 to 3.12

Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 src/cephadm/cephadmlib/daemons/ceph.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cephadm/cephadmlib/daemons/ceph.py b/src/cephadm/cephadmlib/daemons/ceph.py
index 0663f1d47a3..7fc83f007ef 100644
--- a/src/cephadm/cephadmlib/daemons/ceph.py
+++ b/src/cephadm/cephadmlib/daemons/ceph.py
@@ -600,13 +600,13 @@ def get_ceph_mounts_for_type(
                 mounts[cephadm_binary] = '/usr/sbin/cephadm'
                 mounts[
                     ceph_folder + '/src/ceph-volume/ceph_volume'
-                ] = '/usr/lib/python3.9/site-packages/ceph_volume'
+                ] = '/usr/lib/python3.12/site-packages/ceph_volume'
                 mounts[
                     ceph_folder + '/src/pybind/mgr'
                 ] = '/usr/share/ceph/mgr'
                 mounts[
                     ceph_folder + '/src/python-common/ceph'
-                ] = '/usr/lib/python3.9/site-packages/ceph'
+                ] = '/usr/lib/python3.12/site-packages/ceph'
                 mounts[
                     ceph_folder + '/monitoring/ceph-mixin/dashboards_out'
                 ] = '/etc/grafana/dashboards/ceph-dashboard'

From ce787df56bf8e2017e8fd6c1a3d04b33de429fb7 Mon Sep 17 00:00:00 2001
From: Nithya Balachandran <nithya.balachandran@ibm.com>
Date: Sun, 14 Jun 2026 12:43:43 +0000
Subject: [PATCH 459/596] rgw/posix: fix delete markers

Creates 0 byte files for delete markers for versioned buckets.

Signed-off-by: Nithya Balachandran <nithya.balachandran@ibm.com>
---
 src/rgw/driver/posix/rgw_sal_posix.cc | 165 ++++++++++++++++++++------
 src/rgw/driver/posix/rgw_sal_posix.h  |  16 ++-
 2 files changed, 136 insertions(+), 45 deletions(-)

diff --git a/src/rgw/driver/posix/rgw_sal_posix.cc b/src/rgw/driver/posix/rgw_sal_posix.cc
index 92710d01669..3a0704bb7d2 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.cc
+++ b/src/rgw/driver/posix/rgw_sal_posix.cc
@@ -36,6 +36,7 @@ const std::string ATTR_PREFIX = "user.X-RGW-";
 #define RGW_POSIX_ATTR_OWNER "POSIX-Owner"
 #define RGW_POSIX_ATTR_OBJECT_TYPE "POSIX-Object-Type"
 #define RGW_POSIX_ATTR_MANIFEST "POSIX-Manifest"
+#define RGW_POSIX_ATTR_VERSION "POSIX-version"
 const std::string mp_ns = "multipart";
 const std::string MP_OBJ_PART_PFX = "part-";
 const std::string MP_OBJ_HEAD_NAME = MP_OBJ_PART_PFX + "00000";
@@ -454,6 +455,9 @@ int FSEnt::fill_cache(const DoutPrefixProvider *dpp, optional_yield y, fill_cach
       if (flags & FSEnt::FLAG_CURRENT) {
 	  bde.flags |= rgw_bucket_dir_entry::FLAG_CURRENT;
       }
+      if (flags & FSEnt::FLAG_DELETE_MARKER) {
+        bde.flags |= rgw_bucket_dir_entry::FLAG_DELETE_MARKER;
+      }
       break;
     case ObjectType::MULTIPART:
     case ObjectType::DIRECTORY:
@@ -672,7 +676,7 @@ int File::copy(const DoutPrefixProvider *dpp, optional_yield y,
     std::unique_ptr<FSEnt> del;
     ret = dst_dir->get_ent(dpp, y, dst_name, std::string(), del);
     if (ret >= 0) {
-      ret = del->remove(dpp, y, /*delete_children=*/true);
+      ret = del->remove(dpp, y, /*delete_children=*/true, nullptr);
       if (ret < 0) {
         ldpp_dout(dpp, 0) << "ERROR: could not remove dest " << dst_name
                           << dendl;
@@ -709,7 +713,7 @@ int File::copy(const DoutPrefixProvider *dpp, optional_yield y,
   return 0;
 }
 
-int File::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children)
+int File::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result)
 {
   if (!exists()) {
     return 0;
@@ -852,7 +856,7 @@ int Directory::stat(const DoutPrefixProvider* dpp, bool force)
   return 0;
 }
 
-int Directory::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children)
+int Directory::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result)
 {
   return delete_directory(parent->get_fd(), fname.c_str(), delete_children, dpp);
 }
@@ -988,7 +992,7 @@ int Directory::copy(const DoutPrefixProvider *dpp, optional_yield y,
     std::unique_ptr<FSEnt> del;
     ret = dst_dir->get_ent(dpp, y, dst_name, std::string(), del);
     if (ret >= 0) {
-      ret = del->remove(dpp, y, /*delete_children=*/true);
+      ret = del->remove(dpp, y, /*delete_children=*/true, nullptr);
       if (ret < 0) {
         ldpp_dout(dpp, 0) << "ERROR: could not remove dest " << dst_name
                           << dendl;
@@ -1295,9 +1299,9 @@ int MPDirectory::link_temp_file(const DoutPrefixProvider *dpp, optional_yield y,
   return rename(dpp, y, parent, savename);
 }
 
-int MPDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children)
+int MPDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result)
 {
-  return Directory::remove(dpp, y, /*delete_children=*/true);
+  return Directory::remove(dpp, y, /*delete_children=*/true, result);
 }
 
 int MPDirectory::stat(const DoutPrefixProvider* dpp, bool force)
@@ -1461,7 +1465,7 @@ int VersionedDirectory::set_cur_version_ent(const DoutPrefixProvider* dpp, FSEnt
   std::unique_ptr<FSEnt> del;
   int ret = get_ent(dpp, null_yield, get_name(), std::string(), del);
   if (ret >= 0) {
-    ret = del->remove(dpp, null_yield, /*delete_children=*/true);
+    ret = del->remove(dpp, null_yield, /*delete_children=*/true, nullptr);
     if (ret < 0) {
       ldpp_dout(dpp, 0) << "ERROR: could not remove cur_version " << get_name()
                         << dendl;
@@ -1520,9 +1524,6 @@ int VersionedDirectory::stat(const DoutPrefixProvider* dpp, bool force)
   cur_version = sl->get_target()->clone_base();
   ret = cur_version->open(dpp);
   if (ret < 0) {
-    /* If target doesn't exist, it's a delete marker */
-    cur_version.reset();
-    stx.stx_size = 0;
     return 0;
   }
   ret = cur_version->stat(dpp);
@@ -1530,6 +1531,19 @@ int VersionedDirectory::stat(const DoutPrefixProvider* dpp, bool force)
     return ret;
   stx.stx_size = cur_version->get_stx().stx_size;
 
+  if (cur_version->get_stx().stx_size == 0) {
+    //Possibly a delete marker
+    Attrs attrs;
+    ret = cur_version->read_attrs(dpp, null_yield, attrs);
+    if (ret < 0) {
+      return ret;
+    }
+    bufferlist bl;
+    if (rgw::sal::get_attr(attrs, RGW_POSIX_ATTR_VERSION, bl)) {
+    //  cur_version.reset();
+    }
+  }
+
   return 0;
 }
 
@@ -1603,7 +1617,7 @@ int VersionedDirectory::copy(const DoutPrefixProvider *dpp, optional_yield y,
     std::unique_ptr<FSEnt> del;
     ret = dst_dir->get_ent(dpp, y, basename, std::string(), del);
     if (ret >= 0) {
-      ret = del->remove(dpp, y, /*delete_children=*/true);
+      ret = del->remove(dpp, y, /*delete_children=*/true, nullptr);
       if (ret < 0) {
         ldpp_dout(dpp, 0) << "ERROR: could not remove dest " << basename
                           << dendl;
@@ -1666,7 +1680,46 @@ int VersionedDirectory::copy(const DoutPrefixProvider *dpp, optional_yield y,
   return ret;
 }
 
-int VersionedDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children)
+int VersionedDirectory::add_delete_marker(const DoutPrefixProvider* dpp,
+                                          optional_yield y,
+                                          std::unique_ptr<File>& marker,
+                                          std::string& name)
+{
+  //TODO: Create a tmp file
+  int ret = marker->create(dpp, /*existed=*/nullptr, /*temp_file=*/false);
+  if (ret < 0) {
+    return ret;
+  }
+
+ // XXX: Hack to set the owner on the delete marker
+  Attrs v_attrs;
+  Attrs attrs;
+
+  ret = get_x_attrs(y, dpp, get_fd(), v_attrs, get_name());
+  if (ret < 0) {
+    return ret;
+  }
+
+  bufferlist owner_bl;
+  if (rgw::sal::get_attr(v_attrs, RGW_POSIX_ATTR_OWNER, owner_bl)) {
+    attrs[RGW_POSIX_ATTR_OWNER] = std::move(owner_bl);
+  }
+  buffer::list bl;
+  uint16_t flags = 0;
+  flags |= rgw_bucket_dir_entry::FLAG_DELETE_MARKER;
+  ceph::encode(flags, bl);
+  attrs[RGW_POSIX_ATTR_VERSION] = std::move(bl);
+  ret = marker->write_attrs(dpp, y, attrs, nullptr);
+  if (ret < 0) {
+    //TODO: Delete the marker file
+    return ret;
+  }
+
+  return 0;
+}
+
+int VersionedDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y,
+                               bool delete_children, DeleteResult* result)
 {
   std::string tgtname;
   bool newlink = false;
@@ -1683,18 +1736,31 @@ int VersionedDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y,
 
     if (ret == 0) {
       /* We're empty, nuke us */
-      return Directory::remove(dpp, y, /*delete_children=*/true);
+      return Directory::remove(dpp, y, /*delete_children=*/true, result);
     }
 
     /* Add a delete marker */
+    std::unique_ptr<File> f;
     rgw_obj_key key = decode_obj_key(get_name());
     key.instance = gen_rand_instance_name();
     tgtname = get_key_fname(key, /*use_version=*/true);
-    newlink = true;
-    ret = remove_symlink(dpp, y);
+
+    result->delete_marker = true;
+    result->version_id = key.instance;
+
+    f = std::make_unique<File>(tgtname, this, ctx);
+    ret = add_delete_marker(dpp, y, f, tgtname);
     if (ret < 0) {
       return ret;
     }
+
+    newlink = true;
+    ret = set_cur_version_ent(dpp, f.get());
+    if (ret < 0) {
+      return ret;
+    }
+    cur_version = std::move(f);
+    return 0;
   } else {
     /* Delete specific version */
     rgw_obj_key key = decode_obj_key(get_name());
@@ -1707,25 +1773,22 @@ int VersionedDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y,
       ret = f->stat(dpp);
       if (ret < 0)
         return ret;
-      ret = f->remove(dpp, y, /*delete_children=*/true);
-      if (ret < 0)
+      Attrs attrs;
+      ret = f->read_attrs(dpp, y, attrs);
+      if (ret < 0) {
         return ret;
-    } else if (ret == -ENOENT) {
-      /* See if we're removing a delete marker */
-      std::unique_ptr<Symlink> sl =
-          std::make_unique<Symlink>(get_name(), this, ctx);
-      ret = sl->stat(dpp);
-      if (ret == 0) {
-        if (name != sl->get_target()->get_name()) {
-	  /* Symlink didn't match, don't change anything */
-	  return 0;
-	}
       }
-      /* FALLTHROUGH */
+      bufferlist bl;
+      if (get_attr(attrs, RGW_POSIX_ATTR_VERSION, bl)) {
+       result->delete_marker = true;
+      }
+      ret = f->remove(dpp, y, /*delete_children=*/true, nullptr);
+      if (ret < 0)
+       return ret;
+      result->version_id = instance_id;
     } else {
       return ret;
     }
-
     /* Possibly move symlink */
     ret = remove_symlink(dpp, y, name);
     if (ret < 0) {
@@ -1749,16 +1812,23 @@ int VersionedDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y,
     if (tgtname.empty()) {
       /* We're empty, nuke us */
       exist = false;
-      return Directory::remove(dpp, y, /*delete_children=*/true);
+      return Directory::remove(dpp, y, /*delete_children=*/true, result);
     }
   }
-
   if (newlink) {
     exist = true;
-    std::unique_ptr<Symlink> sl =
-        std::make_unique<Symlink>(get_name(), this, tgtname, ctx);
-    return sl->create(dpp, /*existed=*/nullptr, /*temp_file=*/false);
+    std::unique_ptr<FSEnt> f;
+    ret = get_ent(dpp, y, tgtname, std::string(), f);
+    if (ret < 0) {
+      return ret;
+    }
+    ret = set_cur_version_ent(dpp, f.get());
+    if (ret < 0) {
+      return ret;
+    }
+    cur_version = std::move(f);
   }
+
   return 0;
 }
 
@@ -1789,6 +1859,19 @@ int VersionedDirectory::fill_cache(const DoutPrefixProvider *dpp, optional_yield
         FSEnt::FLAG_CURRENT :
         FSEnt::FLAG_NONE;
 
+      // Delete markers are zero byte files
+      if (ent->get_stx().stx_size == 0) {
+        Attrs attrs;
+        bufferlist bl;
+        ret = ent->read_attrs(dpp, y, attrs);
+        if (ret < 0) {
+          return ret;
+        }
+        if (get_attr(attrs, RGW_POSIX_ATTR_VERSION, bl)) {
+          fill_flags |= FSEnt::FLAG_DELETE_MARKER;
+        }
+      }
+
       ret = ent->fill_cache(dpp, y, cb, fill_flags);
       if (ret < 0)
         return ret;
@@ -1834,7 +1917,7 @@ int VersionedDirectory::remove_symlink(const DoutPrefixProvider *dpp, optional_y
       return -ENOKEY;
   }
 
-  ret = sl->remove(dpp, y, /*delete_children=*/false);
+  ret = sl->remove(dpp, y, /*delete_children=*/false, nullptr);
   if (ret < 0) {
     return ret;
   }
@@ -2768,7 +2851,7 @@ int POSIXBucket::remove(const DoutPrefixProvider* dpp,
 			bool delete_children,
 			optional_yield y)
 {
-  int ret = dir->remove(dpp, y, delete_children);
+  int ret = dir->remove(dpp, y, delete_children, nullptr);
   if (ret < 0) {
     return ret;
   }
@@ -3137,8 +3220,7 @@ int POSIXObject::delete_object(const DoutPrefixProvider* dpp,
       }
       return ret;
   }
-
-  ret = ent->remove(dpp, y, /*delete_children=*/false);
+  ret = ent->remove(dpp, y, /*delete_children=*/false, &del_result);
 
   cls_rgw_obj_key key;
   get_key().get_index_key(&key);
@@ -3964,7 +4046,12 @@ int POSIXObject::POSIXReadOp::get_attr(const DoutPrefixProvider* dpp, const char
 int POSIXObject::POSIXDeleteOp::delete_obj(const DoutPrefixProvider* dpp,
 					   optional_yield y, uint32_t flags)
 {
-  return source->delete_object(dpp, y, flags, nullptr, nullptr);
+  int ret = source->delete_object(dpp, y, flags, nullptr, nullptr);
+  if (ret < 0) {
+    return ret;
+  }
+  result = source->get_result();
+  return 0;
 }
 
 int POSIXObject::copy(const DoutPrefixProvider *dpp, optional_yield y,
diff --git a/src/rgw/driver/posix/rgw_sal_posix.h b/src/rgw/driver/posix/rgw_sal_posix.h
index 7779991ee82..b3caeade70e 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.h
+++ b/src/rgw/driver/posix/rgw_sal_posix.h
@@ -29,7 +29,7 @@ namespace rgw { namespace sal {
 class POSIXDriver;
 class POSIXBucket;
 class POSIXObject;
-
+using DeleteResult = rgw::sal::Object::DeleteOp::Result;
 using BucketCache = file::listing::BucketCache<POSIXDriver, POSIXBucket>;
 
 /* integration w/bucket listing cache */
@@ -110,6 +110,7 @@ protected:
 public:
   static constexpr uint32_t FLAG_NONE =      0x0;
   static constexpr uint32_t FLAG_CURRENT =   0x2;
+  static constexpr uint32_t FLAG_DELETE_MARKER =   0x4;
 
   FSEnt(std::string _name, Directory* _parent, CephContext* _ctx) : fname(_name), parent(_parent), ctx(_ctx) {}
   FSEnt(std::string _name, Directory* _parent, struct statx& _stx, CephContext* _ctx) : fname(_name), parent(_parent), exist(true), stx(_stx), stat_done(true), ctx(_ctx) {}
@@ -135,7 +136,7 @@ public:
   virtual int open(const DoutPrefixProvider *dpp) = 0;
   virtual int close() = 0;
   virtual int stat(const DoutPrefixProvider *dpp, bool force = false);
-  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children) = 0;
+  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result) = 0;
   virtual int write(int64_t ofs, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) = 0;
   virtual int read(int64_t ofs, int64_t end, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) = 0;
   virtual int write_attrs(const DoutPrefixProvider* dpp, optional_yield y, Attrs& attrs, Attrs* extra_attrs);
@@ -166,7 +167,7 @@ public:
   virtual int open(const DoutPrefixProvider *dpp) override;
   virtual int close() override;
   virtual int stat(const DoutPrefixProvider *dpp, bool force = false) override;
-  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children) override;
+  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result) override;
   virtual int write(int64_t ofs, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) override;
   virtual int read(int64_t ofs, int64_t end, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) override;
   virtual int copy(const DoutPrefixProvider *dpp, optional_yield y, Directory* dst_dir, const std::string& name) override;
@@ -198,7 +199,7 @@ public:
   virtual int open(const DoutPrefixProvider *dpp) override;
   virtual int close() override;
   virtual int stat(const DoutPrefixProvider *dpp, bool force = false) override;
-  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children) override;
+  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result) override;
   template <typename F>
     int for_each(const DoutPrefixProvider* dpp, const F& func);
   virtual int rename(const DoutPrefixProvider* dpp, optional_yield y, Directory* dst_dir, std::string dst_name);
@@ -275,7 +276,7 @@ public:
   virtual int create(const DoutPrefixProvider *dpp, bool* existed = nullptr, bool temp_file = false) override;
   virtual int read(int64_t ofs, int64_t end, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) override;
   virtual int link_temp_file(const DoutPrefixProvider* dpp, optional_yield y, std::string target_fname) override;
-  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children) override;
+  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result) override;
   virtual int stat(const DoutPrefixProvider *dpp, bool force = false) override;
   std::unique_ptr<File> get_part_file(int partnum);
   virtual std::unique_ptr<FSEnt> clone_base() override {
@@ -331,11 +332,12 @@ public:
   virtual int write(int64_t ofs, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) override;
   virtual int read(int64_t ofs, int64_t end, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y) override;
   virtual int link_temp_file(const DoutPrefixProvider* dpp, optional_yield y, std::string target_fname) override;
-  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children) override;
+  virtual int remove(const DoutPrefixProvider* dpp, optional_yield y, bool delete_children, DeleteResult* result) override;
   virtual std::string get_cur_version() override;
   std::string get_new_instance();
   int remove_symlink(const DoutPrefixProvider *dpp, optional_yield y, std::string match = "");
   int add_file(const DoutPrefixProvider *dpp, std::unique_ptr<FSEnt>&& file, bool* existed = nullptr, bool temp_file = false);
+  int add_delete_marker(const DoutPrefixProvider* dpp, optional_yield y, std::unique_ptr<File>& marker, std::string& name);
   FSEnt* get_cur_version_ent() { return cur_version.get(); };
   int set_cur_version_ent(const DoutPrefixProvider *dpp, FSEnt* file);
   virtual std::unique_ptr<FSEnt> clone_base() override {
@@ -998,6 +1000,7 @@ private:
   RGWAccessControlPolicy acls;
   std::unique_ptr<FSEnt> ent;
   std::map<std::string, int64_t> parts;
+  DeleteResult del_result;
 
 public:
   struct POSIXReadOp : ReadOp {
@@ -1149,6 +1152,7 @@ public:
   int stat(const DoutPrefixProvider *dpp);
   int make_ent(ObjectType type);
   bool versioned() { return bucket->versioned(); }
+  DeleteResult get_result() {return del_result;}
 
 protected:
   int read(int64_t ofs, int64_t end, bufferlist& bl, const DoutPrefixProvider* dpp, optional_yield y);

From 2e892f3c5ce718e6410ce84ce33eab671225f6e8 Mon Sep 17 00:00:00 2001
From: Ali Masarwa <amasarwa@redhat.com>
Date: Mon, 22 Jun 2026 13:58:47 +0300
Subject: [PATCH 460/596] rgw/posix: fix delete markers

Signed-off-by: Ali Masarwa <amasarwa@redhat.com>
---
 src/rgw/driver/posix/rgw_sal_posix.cc | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/rgw/driver/posix/rgw_sal_posix.cc b/src/rgw/driver/posix/rgw_sal_posix.cc
index 3a0704bb7d2..a7c097f82fe 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.cc
+++ b/src/rgw/driver/posix/rgw_sal_posix.cc
@@ -1685,18 +1685,20 @@ int VersionedDirectory::add_delete_marker(const DoutPrefixProvider* dpp,
                                           std::unique_ptr<File>& marker,
                                           std::string& name)
 {
-  //TODO: Create a tmp file
-  int ret = marker->create(dpp, /*existed=*/nullptr, /*temp_file=*/false);
+  // Create as temporary file first
+  int ret = marker->create(dpp, /*existed=*/nullptr, /*temp_file=*/true);
   if (ret < 0) {
     return ret;
   }
 
- // XXX: Hack to set the owner on the delete marker
+  // XXX: Hack to set the owner on the delete marker
   Attrs v_attrs;
   Attrs attrs;
 
   ret = get_x_attrs(y, dpp, get_fd(), v_attrs, get_name());
   if (ret < 0) {
+    // removing the temporary files before returning failure
+    marker->remove(dpp, y, /*delete_children=*/false, nullptr);
     return ret;
   }
 
@@ -1704,14 +1706,26 @@ int VersionedDirectory::add_delete_marker(const DoutPrefixProvider* dpp,
   if (rgw::sal::get_attr(v_attrs, RGW_POSIX_ATTR_OWNER, owner_bl)) {
     attrs[RGW_POSIX_ATTR_OWNER] = std::move(owner_bl);
   }
+
   buffer::list bl;
   uint16_t flags = 0;
   flags |= rgw_bucket_dir_entry::FLAG_DELETE_MARKER;
   ceph::encode(flags, bl);
   attrs[RGW_POSIX_ATTR_VERSION] = std::move(bl);
+
+  // Write attributes before linking
   ret = marker->write_attrs(dpp, y, attrs, nullptr);
   if (ret < 0) {
-    //TODO: Delete the marker file
+    // removing the temporary files before returning failure
+    marker->remove(dpp, y, /*delete_children=*/false, nullptr);
+    return ret;
+  }
+
+  // Link temp file to final name atomically
+  ret = marker->link_temp_file(dpp, y, name);
+  if (ret < 0) {
+    // removing the temporary files before returning failure
+    marker->remove(dpp, y, /*delete_children=*/false, nullptr);
     return ret;
   }
 
@@ -1782,7 +1796,7 @@ int VersionedDirectory::remove(const DoutPrefixProvider* dpp, optional_yield y,
       if (get_attr(attrs, RGW_POSIX_ATTR_VERSION, bl)) {
        result->delete_marker = true;
       }
-      ret = f->remove(dpp, y, /*delete_children=*/true, nullptr);
+      ret = f->remove(dpp, y, /*delete_children=*/true, result);
       if (ret < 0)
        return ret;
       result->version_id = instance_id;

From d46aea099ef134fda8f26737d517ddc78886c76f Mon Sep 17 00:00:00 2001
From: Alex Ainscow <aainscow@uk.ibm.com>
Date: Sun, 3 May 2026 17:46:00 +0100
Subject: [PATCH 461/596] test/osd: Add scrub to osd test fixtures

Add scrubbing functionality to the OSD test fixtures to enable testing
of scrub behavior on erasure-coded pools. This implementation uses as
much of the scrub backend as possible, but avoids using pg_scrubber or
the interaction with peering due to the complexity of the dependency on
PG.

Changes:
- Add scrub_object() method to PGBackendTestFixture for testing scrub
  functionality on EC pools
- Add create_random_buffer() utility for generating random test data
- Add corrupt_shard_data() method to intentionally corrupt shard data
  for testing scrub detection
- Add MockScrubBeListener, MockPgScrubBeListener, MockSnapMapReader, and
  MockLoggerSinkSet mock classes to support scrub testing
- Add three new test cases: ScrubClean, ScrubDetectsCorruption, and
  ScrubPartialWrite to verify scrub behavior with clean data, corrupted
  data, and partial writes

Signed-off-by: Alex Ainscow <aainscow@uk.ibm.com>

# Conflicts:
#	src/test/osd/TestECFailoverWithPeering.cc
---
 src/test/osd/PGBackendTestFixture.cc      | 165 ++++++++++++++++++
 src/test/osd/PGBackendTestFixture.h       |  51 +++++-
 src/test/osd/ScrubTestFixture.h           | 195 ++++++++++++++++++++++
 src/test/osd/TestBackendBasics.cc         |   2 +
 src/test/osd/TestECFailoverWithPeering.cc | 119 ++++++++++++-
 5 files changed, 530 insertions(+), 2 deletions(-)
 create mode 100644 src/test/osd/ScrubTestFixture.h

diff --git a/src/test/osd/PGBackendTestFixture.cc b/src/test/osd/PGBackendTestFixture.cc
index a3c26585be7..72b565f908e 100644
--- a/src/test/osd/PGBackendTestFixture.cc
+++ b/src/test/osd/PGBackendTestFixture.cc
@@ -25,6 +25,12 @@
 #include "messages/MOSDPGPush.h"
 #include "messages/MOSDPGPushReply.h"
 
+void PGBackendTestFixture::initialize_scrub_infra()
+{
+  scrub_listener = TestScrubBackend::create_scrub_listener(spgid, osdmap);
+  snap_reader = TestScrubBackend::create_snap_reader();
+}
+
 void PGBackendTestFixture::setup_ec_pool()
 {
   CephContext *cct = g_ceph_context;
@@ -904,3 +910,162 @@ object_info_t PGBackendTestFixture::read_shard_object_info(
   oi.decode(p);
   return oi;
 }
+
+
+bool PGBackendTestFixture::scrub_object(const std::string& obj_name)
+{
+  hobject_t hoid = make_test_object(obj_name);
+
+  int total_shards = k + m;
+  std::map<pg_shard_t, ScrubMap> scrub_maps;
+
+  for (int shard = 0; shard < total_shards; ++shard) {
+    pg_shard_t pg_shard(shard, shard_id_t(shard));
+    ScrubMap& smap = scrub_maps[pg_shard];
+
+    auto backend_it = backends.find(shard);
+    if (backend_it == backends.end()) {
+      std::cerr << "ERROR: Backend for shard " << shard << " does not exist" << std::endl;
+      return true;
+    }
+    PGBackend* backend = backend_it->second.get();
+    if (!backend) {
+      std::cerr << "ERROR: Backend pointer for shard " << shard << " is null" << std::endl;
+      return true;
+    }
+
+    ScrubMapBuilder pos;
+    pos.ls.push_back(hoid);
+    pos.pos = 0;
+    pos.deep = true;
+
+    const Scrub::ScrubCounterSet& counters = Scrub::io_counters_ec;
+
+    int r = backend->be_scan_list(counters, smap, pos);
+    while (r == -EINPROGRESS) {
+      r = backend->be_scan_list(counters, smap, pos);
+    }
+
+    if (r != 0) {
+      std::cerr << "ERROR: be_scan_list failed for shard " << shard << ": " << cpp_strerror(r) << std::endl;
+      return true;
+    }
+
+    if (!smap.objects.contains(hoid)) {
+      std::cerr << "ERROR: Object not in scrub map for shard " << shard << std::endl;
+      return true;
+    }
+  }
+
+  if (!scrub_listener || !snap_reader) {
+    initialize_scrub_infra();
+  }
+
+  ceph_assert(scrub_listener);
+  ceph_assert(snap_reader);
+
+  MockPGBackendListener* primary_listener = get_primary_listener();
+  if (!primary_listener) {
+    std::cerr << "ERROR: No primary listener found" << std::endl;
+    return true;
+  }
+  int primary_shard = primary_listener->pg_whoami.osd;
+
+  PGBackend* primary_backend = get_primary_backend();
+  if (!primary_backend) {
+    std::cerr << "ERROR: No primary backend found" << std::endl;
+    return true;
+  }
+
+  const pg_pool_t* pool_info = osdmap->get_pg_pool(pool_id);
+  ceph_assert(pool_info != nullptr);
+
+  MockPgScrubBeListener pg_scrub_listener(primary_backend);
+  pg_scrub_listener.pool = std::make_shared<PGPool>(
+    osdmap, pool_id, *pool_info, "test_pool");
+  pg_scrub_listener.primary = primary_shard;
+  pg_scrub_listener.info.pgid = spgid;
+
+  std::set<pg_shard_t> acting_set;
+  for (int i = 0; i < k + m; ++i) {
+    acting_set.insert(pg_shard_t(i, shard_id_t(i)));
+  }
+
+  TestScrubBackend scrub_backend(*scrub_listener, pg_scrub_listener,
+                                 pg_shard_t(primary_shard, shard_id_t(primary_shard)),
+                                 false, scrub_level_t::deep, acting_set);
+
+  scrub_backend.new_chunk();
+
+  for (const auto& [pg_shard, smap] : scrub_maps) {
+    scrub_backend.insert_faked_smap(pg_shard, smap);
+  }
+
+  auto result = scrub_backend.scrub_compare_maps(false, *snap_reader);
+
+  return !result.inconsistent_objs.empty();
+}
+
+
+bufferlist PGBackendTestFixture::create_random_buffer(size_t size)
+{
+  bufferlist bl;
+
+  if (size == 0) {
+    return bl;
+  }
+
+  ceph::buffer::ptr bp(size);
+
+  std::random_device rd;
+  std::mt19937 gen(rd());
+  std::uniform_int_distribution<unsigned char> dis(0, 255);
+
+  for (size_t i = 0; i < size; ++i) {
+    bp[i] = dis(gen);
+  }
+
+  bl.append(std::move(bp));
+  return bl;
+}
+
+void PGBackendTestFixture::corrupt_shard_data(const hobject_t& obj, pg_shard_t shard)
+{
+  auto ch_it = chs.find(shard.osd);
+  if (ch_it == chs.end()) {
+    std::cerr << "ERROR: No collection handle for shard " << shard.osd << std::endl;
+    return;
+  }
+
+  ghobject_t ghoid(obj, ghobject_t::NO_GEN, shard.shard);
+
+  struct stat st;
+  int r = store->stat(ch_it->second, ghoid, &st);
+  if (r < 0) {
+    std::cerr << "ERROR: Failed to stat object on shard " << shard.osd
+              << ": " << cpp_strerror(r) << std::endl;
+    return;
+  }
+
+  uint64_t size = st.st_size;
+  if (size == 0) {
+    std::cerr << "WARNING: Object has zero size on shard " << shard.osd << std::endl;
+    return;
+  }
+
+  bufferlist zero_bl;
+  zero_bl.append_zero(size);
+
+  ObjectStore::Transaction t;
+  t.write(ch_it->second->cid, ghoid, 0, size, zero_bl);
+
+  r = store->queue_transaction(ch_it->second, std::move(t));
+  if (r < 0) {
+    std::cerr << "ERROR: Failed to corrupt object on shard " << shard.osd
+              << ": " << cpp_strerror(r) << std::endl;
+    return;
+  }
+
+  std::cout << "Corrupted shard " << shard.osd << " data for object " << obj
+            << " (wrote " << size << " bytes of zeros)" << std::endl;
+}
diff --git a/src/test/osd/PGBackendTestFixture.h b/src/test/osd/PGBackendTestFixture.h
index 0e728f3f38c..cb7bfc155ea 100644
--- a/src/test/osd/PGBackendTestFixture.h
+++ b/src/test/osd/PGBackendTestFixture.h
@@ -40,6 +40,9 @@
 #include "os/ObjectStore.h"
 #include "erasure-code/ErasureCodePlugin.h"
 #include "test/osd/OSDMapTestHelpers.h"
+#include "test/osd/ScrubTestFixture.h"
+#include "osd/scrubber/scrub_backend.h"
+#include "osd/scrubber/pg_scrubber.h"
 
 // Unified test fixture for EC and Replicated backend tests with ObjectStore.
 // Uses PoolType to branch between EC (ECSwitch) and Replicated (ReplicatedBackend).
@@ -86,7 +89,9 @@ protected:
   
   // OpTracker for wrapping messages in OpRequestRef
   std::shared_ptr<OpTracker> op_tracker;
-  
+  // Scrub infrastructure - initialized once and reused across scrub operations
+  std::unique_ptr<MockScrubBeListener> scrub_listener;
+  std::unique_ptr<MockSnapMapReader> snap_reader;
   ceph::ErasureCodeInterfaceRef ec_impl;
   std::map<int, std::unique_ptr<ECExtentCache::LRU>> lrus;
   int k = 4;  // data chunks
@@ -214,6 +219,9 @@ private:
   void setup_replicated_pool();
   void cleanup_data_dir();
 
+protected:
+  void initialize_scrub_infra();
+
 public:
   const pg_pool_t& get_pool() const {
     const pg_pool_t* pool = OSDMapTestHelpers::get_pool(osdmap, pool_id);
@@ -505,5 +513,46 @@ public:
     const std::string& obj_name,
     int shard);
 
+  /**
+   * Scrub an object and verify it has no corruption.
+   *
+   * This utility method:
+   * 1. Builds scrub maps for all shards using be_scan_list()
+   * 2. Creates a ScrubBackend with mock listeners
+   * 3. Calls scrub_compare_maps() to check for inconsistencies
+   * 4. Returns true if corruption was detected, false otherwise
+   *
+   * The scrub infrastructure (mock listeners) is initialized once in SetUp()
+   * and reused across all scrub operations for efficiency.
+   *
+   * @param obj_name Name of the object to scrub
+   * @return true if corruption detected, false if object is consistent
+   */
+  bool scrub_object(const std::string& obj_name);
+
+  /**
+   * Corrupt the data for a specific shard of an object.
+   *
+   * This utility method directly writes zeros to the stored data for a given
+   * shard, simulating data corruption at the storage level. This is useful
+   * for testing scrub detection of corrupted data.
+   *
+   * @param obj The hobject_t identifying the object to corrupt
+   * @param shard The pg_shard_t identifying which shard to corrupt
+   */
+  void corrupt_shard_data(const hobject_t& obj, pg_shard_t shard);
+
+  /**
+   * Create a bufferlist filled with random data.
+   *
+   * This utility method generates a buffer of the specified size filled with
+   * random bytes. Useful for testing scenarios where random data is needed
+   * to avoid patterns that might mask bugs (e.g., XOR patterns in EC).
+   *
+   * @param size Size of the buffer to create in bytes
+   * @return A bufferlist containing random data
+   */
+  bufferlist create_random_buffer(size_t size);
+
 };
 
diff --git a/src/test/osd/ScrubTestFixture.h b/src/test/osd/ScrubTestFixture.h
new file mode 100644
index 00000000000..2fb3768a928
--- /dev/null
+++ b/src/test/osd/ScrubTestFixture.h
@@ -0,0 +1,195 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab
+
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2026 IBM
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+ */
+
+#pragma once
+
+#include <memory>
+#include <set>
+
+#include "include/expected.hpp"
+#include "osd/scrubber/scrub_backend.h"
+#include "osd/scrubber/pg_scrubber.h"
+#include "osd/PGBackend.h"
+#include "osd/PeeringState.h"
+#include "osd/osd_types.h"
+#include "test/osd/scrubber_generators.h"
+#include "global/global_context.h"
+
+// Type alias for compatibility with existing code
+using MockLoggerSinkSet = ScrubGenerator::MockLog;
+
+/**
+ * MockScrubBeListener - Mock implementation of ScrubBeListener for testing
+ *
+ * Provides minimal implementation of the ScrubBeListener interface for
+ * testing scrub backend functionality.
+ */
+class MockScrubBeListener : public ScrubBeListener {
+ public:
+  MockScrubBeListener()
+      : pg_whoami(0, shard_id_t::NO_SHARD),
+        primary_shard(0, shard_id_t::NO_SHARD) {}
+
+  MockScrubBeListener(pg_shard_t whoami, pg_shard_t primary)
+      : pg_whoami(whoami), primary_shard(primary) {}
+
+  std::ostream& gen_prefix(std::ostream& out) const override {
+    return out << "scrub: ";
+  }
+  CephContext* get_pg_cct() const override { return g_ceph_context; }
+  LoggerSinkSet& get_logger() const override { return logger; }
+  bool is_primary() const override { return pg_whoami == primary_shard; }
+  spg_t get_pgid() const override { return pgid; }
+  const OSDMapRef& get_osdmap() const override { return osdmap; }
+  void add_to_stats(const object_stat_sum_t&) override {}
+  void submit_digest_fixes(const digests_fixes_t&) override {}
+
+  pg_shard_t pg_whoami;       // This shard's identity
+  pg_shard_t primary_shard;   // The primary shard's identity
+  spg_t pgid;
+  OSDMapRef osdmap;
+  mutable MockLoggerSinkSet logger;
+};
+
+/**
+ * MockPgScrubBeListener - Mock implementation of Scrub::PgScrubBeListener for testing
+ *
+ * Provides EC-aware implementation of the PgScrubBeListener interface for
+ * testing scrub backend functionality with erasure-coded pools.
+ *
+ * Key features:
+ * - Delegates EC operations (encode/decode) to real ECBackend for correctness
+ * - Implements logical_to_ondisk_size() for proper EC shard size calculation
+ * - Delegates get_is_nonprimary_shard() to handle multi-zone EC pools correctly
+ */
+class MockPgScrubBeListener : public Scrub::PgScrubBeListener {
+ public:
+  MockPgScrubBeListener(PGBackend* be = nullptr) : backend(be) {}
+
+  const PGPool& get_pgpool() const override { return *pool; }
+
+  pg_shard_t get_primary() const override {
+    return pg_shard_t(primary, shard_id_t(primary));
+  }
+
+  void force_object_missing(ScrubberPasskey,
+                            const std::set<pg_shard_t>& peer,
+                            const hobject_t& oid,
+                            eversion_t version) override {}
+
+  const pg_info_t& get_pg_info(ScrubberPasskey) const override { return info; }
+
+  uint64_t logical_to_ondisk_size(uint64_t logical_size, shard_id_t shard_id,
+                                  bool object_is_legacy_ec) const override {
+    return backend->be_get_ondisk_size(logical_size, shard_id_t(shard_id),
+                                       object_is_legacy_ec);
+  }
+
+  bool ec_can_decode(const shard_id_set& available_shards) const override {
+    return backend->ec_can_decode(available_shards);
+  }
+
+  shard_id_map<bufferlist> ec_encode_acting_set(const bufferlist& bl) const override {
+    return backend->ec_encode_acting_set(bl);
+  }
+
+  shard_id_map<bufferlist> ec_decode_acting_set(
+      const shard_id_map<bufferlist>& shard_map,
+      int chunk_size) const override {
+    return backend->ec_decode_acting_set(shard_map, chunk_size);
+  }
+
+  bool get_ec_supports_crc_encode_decode() const override {
+    return backend->get_ec_supports_crc_encode_decode();
+  }
+
+  ECUtil::stripe_info_t get_ec_sinfo() const override {
+    return backend->ec_get_sinfo();
+  }
+
+  bool is_waiting_for_unreadable_object() const override { return false; }
+
+  bool get_is_nonprimary_shard(const pg_shard_t& shard) const override {
+    return backend->get_is_nonprimary_shard(shard.shard);
+  }
+
+  bool get_is_hinfo_required() const override {
+    return backend->get_is_hinfo_required();
+  }
+
+  bool get_is_ec_optimized() const override {
+    return backend->get_is_ec_optimized();
+  }
+
+  std::shared_ptr<PGPool> pool;
+  int primary;
+  pg_info_t info;
+  PGBackend* backend;
+};
+
+/**
+ * MockSnapMapReader - Mock implementation of Scrub::SnapMapReaderI for testing
+ *
+ * Provides minimal implementation that returns empty snapshot sets,
+ * suitable for testing scrub functionality without snapshot complexity.
+ */
+class MockSnapMapReader : public Scrub::SnapMapReaderI {
+ public:
+  tl::expected<std::set<snapid_t>, result_t> get_snaps(
+      const hobject_t&) const override {
+    return std::set<snapid_t>{};
+  }
+  tl::expected<std::set<snapid_t>, result_t> get_snaps_check_consistency(
+      const hobject_t&) const override {
+    return std::set<snapid_t>{};
+  }
+};
+
+// Test helper to access ScrubBackend internals
+class TestScrubBackend : public ScrubBackend {
+public:
+  TestScrubBackend(ScrubBeListener& scrubber,
+                   Scrub::PgScrubBeListener& pg,
+                   pg_shard_t i_am,
+                   bool repair,
+                   scrub_level_t shallow_or_deep,
+                   const std::set<pg_shard_t>& acting)
+      : ScrubBackend(scrubber, pg, i_am, repair, shallow_or_deep, acting)
+  {}
+
+  void insert_faked_smap(pg_shard_t shard, const ScrubMap& smap) {
+    ceph_assert(this_chunk.has_value());
+    this_chunk->received_maps[shard] = smap;
+  }
+
+  // Factory method to create MockScrubBeListener with proper initialization
+  static std::unique_ptr<MockScrubBeListener> create_scrub_listener(
+      const spg_t& pgid,
+      const OSDMapRef& osdmap)
+  {
+    auto listener = std::make_unique<MockScrubBeListener>();
+    listener->pgid = pgid;
+    listener->osdmap = osdmap;
+    return listener;
+  }
+
+  // Factory method to create MockSnapMapReader
+  static std::unique_ptr<MockSnapMapReader> create_snap_reader()
+  {
+    return std::make_unique<MockSnapMapReader>();
+  }
+};
+
+// Made with Bob
diff --git a/src/test/osd/TestBackendBasics.cc b/src/test/osd/TestBackendBasics.cc
index 8e544c46a5f..36d367fa076 100644
--- a/src/test/osd/TestBackendBasics.cc
+++ b/src/test/osd/TestBackendBasics.cc
@@ -79,6 +79,7 @@ public:
 
   void SetUp() override {
     PGBackendTestFixture::SetUp();
+    initialize_scrub_infra();
   }
 
   /**
@@ -474,6 +475,7 @@ public:
 
   void SetUp() override {
     PGBackendTestFixture::SetUp();
+    initialize_scrub_infra();
   }
 
   void simulate_osd_failure(int failed_osd, int new_primary_instance)
diff --git a/src/test/osd/TestECFailoverWithPeering.cc b/src/test/osd/TestECFailoverWithPeering.cc
index 9a9cd0f24c9..c9aab2adcf3 100644
--- a/src/test/osd/TestECFailoverWithPeering.cc
+++ b/src/test/osd/TestECFailoverWithPeering.cc
@@ -16,7 +16,6 @@
 #include <gtest/gtest.h>
 #include "test/osd/ECPeeringTestFixture.h"
 #include "test/osd/TestCommon.h"
-#include "osd/ECSwitch.h"
 
 using namespace std;
 
@@ -843,6 +842,124 @@ TEST_P(
   set_config("osd_async_recovery_min_cost", "100");
 }
 
+TEST_P(TestECFailoverWithPeering, ScrubClean) {
+  ASSERT_TRUE(all_shards_active()) << "Initial peering must complete";
+
+  const std::string obj_name = "test_scrub_corruption";
+  uint64_t object_size = k * stripe_unit;
+
+  bufferlist bl = create_random_buffer(object_size);
+  std::string test_data(bl.c_str(), bl.length());
+
+  std::cout << "Writing full-stripe object (" << object_size << " bytes of random data)" << std::endl;
+  create_and_write_verify(obj_name, test_data);
+
+  std::cout << "Scrubbing object to verify data integrity" << std::endl;
+  bool corruption_detected = scrub_object(obj_name);
+
+  ASSERT_FALSE(corruption_detected)
+    << "scrub_object() should NOT detect corruption when data is valid";
+
+  std::cout << "=== ScrubDetectsCorruption test completed successfully ===" << std::endl;
+}
+
+TEST_P(TestECFailoverWithPeering, ScrubDetectsCorruption) {
+  ASSERT_TRUE(all_shards_active()) << "Initial peering must complete";
+
+  const uint64_t object_size = k * stripe_unit;
+  const std::vector<int> shard_offsets = {/*0, 1, */k};
+  const bool supports_crc = ec_plugin == "isa";
+
+  for (int zone = 0; zone < 1; ++zone) {
+    for (int shard_offset : shard_offsets) {
+      const int absolute_shard = shard_offset;
+      const std::string obj_name =
+        "test_obj_zone_" + std::to_string(zone) +
+        "_shard_" + std::to_string(shard_offset);
+
+      bufferlist bl = create_random_buffer(object_size);
+      std::string test_data(bl.c_str(), bl.length());
+
+      std::cout << "\n=== ScrubDetectsCorruption: testing zone " << zone
+                << ", shard offset " << shard_offset
+                << " (absolute shard " << absolute_shard << ") ===" << std::endl;
+
+      std::cout << "Writing object " << obj_name << " (" << object_size
+                << " bytes of random data)" << std::endl;
+      create_and_write_verify(obj_name, test_data);
+
+      std::cout << "Corrupting object " << obj_name
+                << " for zone iteration " << zone
+                << " on relative shard " << shard_offset
+                << " using absolute shard " << absolute_shard << std::endl;
+      hobject_t hoid = make_test_object(obj_name);
+      corrupt_shard_data(hoid,
+                         pg_shard_t(absolute_shard, shard_id_t(absolute_shard)));
+
+      std::cout << "Scrubbing object " << obj_name
+                << " to verify corruption detection for zone iteration " << zone
+                << ", shard offset " << shard_offset << std::endl;
+      bool corruption_detected = scrub_object(obj_name);
+
+      std::cout << "Zone iteration " << zone
+                << " corruption result for shard offset " << shard_offset
+                << ": " << (corruption_detected ? "detected" : "not detected")
+                << " (absolute shard " << absolute_shard
+                << ", supports_crc=" << (supports_crc ? "true" : "false")
+                << ")" << std::endl;
+
+      if (supports_crc) {
+        EXPECT_TRUE(corruption_detected)
+          << "scrub_object() should detect corruption for object " << obj_name
+          << " during zone iteration " << zone
+          << ", shard offset " << shard_offset
+          << " (absolute shard " << absolute_shard << ")";
+      } else {
+        EXPECT_FALSE(corruption_detected)
+            << "scrub_object() should not report corruption for object "
+            << obj_name << " when CRC-based detection is unsupported"
+            << " during zone iteration " << zone << ", shard offset "
+            << shard_offset << " (absolute shard " << absolute_shard << ")";
+      }
+    }
+  }
+
+  std::cout << "=== ScrubDetectsCorruption test completed successfully ===" << std::endl;
+}
+
+TEST_P(TestECFailoverWithPeering, ScrubPartialWrite) {
+  ASSERT_TRUE(all_shards_active()) << "Initial peering must complete";
+
+  const std::string obj_name = "test_scrub_partial_write";
+
+  uint64_t partial_size = stripe_unit / 2;
+
+  std::cout << "Creating partial write object with size " << partial_size
+            << " bytes (stripe_unit=" << stripe_unit << ", full stripe would be "
+            << (k * stripe_unit) << " bytes)" << std::endl;
+
+  bufferlist bl = create_random_buffer(partial_size);
+  std::string test_data(bl.c_str(), bl.length());
+
+  std::cout << "Writing partial object (" << partial_size << " bytes)" << std::endl;
+  create_and_write_verify(obj_name, test_data);
+
+  write(obj_name, 0, test_data, test_data.size());
+
+  // NOTE: Partial writes may expose scrub issues with EC pools
+  std::cout << "Scrubbing partial write object to test scrub behavior" << std::endl;
+  bool corruption_detected = scrub_object(obj_name);
+
+  std::cout << "Scrub result for partial write: "
+            << (corruption_detected ? "corruption detected" : "no corruption detected")
+            << std::endl;
+
+  EXPECT_FALSE(corruption_detected)
+    << "scrub_object() should NOT detect corruption on valid partial write";
+
+  std::cout << "=== ScrubPartialWrite test completed ===" << std::endl;
+}
+
 // ---------------------------------------------------------------------------
 // Instantiate TestECFailoverWithPeering with EC configurations
 // ---------------------------------------------------------------------------

From 832d6122e98cdff77e2ab2831c2f1c92ea74274d Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 29 Jun 2026 20:50:20 -0700
Subject: [PATCH 462/596] blk/aio: fix mismatched parenthesis in POSIX AIO
 submit path

The condition `if ((cur->n_aiocb == 1) {` has an unbalanced
parenthesis and fails to compile. This code is only built on the
HAVE_POSIXAIO (BSD) path, so the breakage is normally hidden.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/blk/aio/aio.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/blk/aio/aio.cc b/src/blk/aio/aio.cc
index 6ade779b4c1..eeb93fbc87a 100644
--- a/src/blk/aio/aio.cc
+++ b/src/blk/aio/aio.cc
@@ -48,7 +48,7 @@ int aio_queue_t::submit_batch(aio_iter begin, aio_iter end,
     }
 #elif defined(HAVE_POSIXAIO)
     cur->priv = priv;
-    if ((cur->n_aiocb == 1) {
+    if (cur->n_aiocb == 1) {
       // TODO: consider batching multiple reads together with lio_listio
       cur->aio.aiocb.aio_sigevent.sigev_notify = SIGEV_KEVENT;
       cur->aio.aiocb.aio_sigevent.sigev_notify_kqueue = ctx;

From ceff64b3a9200957da8586ede99aa855d547c52f Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 29 Jun 2026 20:53:26 -0700
Subject: [PATCH 463/596] blk/spdk: call spdk_env_opts_init() before setting
 pci options

spdk_env_opts_init() reinitializes the whole spdk_env_opts struct,
overwriting pci_allowed/pci_whitelist and num_pci_addr that were set
just above it. As a result the local PCI device restriction never took
effect. Initialize opts first, then fill in the PCI address fields.

Fixes: https://tracker.ceph.com/issues/77802
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/blk/spdk/NVMEDevice.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/blk/spdk/NVMEDevice.cc b/src/blk/spdk/NVMEDevice.cc
index dea2312156c..885aa765b45 100644
--- a/src/blk/spdk/NVMEDevice.cc
+++ b/src/blk/spdk/NVMEDevice.cc
@@ -593,6 +593,8 @@ int NVMEManager::try_get(const spdk_nvme_transport_id& trid, SharedDriverData **
         struct spdk_pci_addr addr;
         int r;
 
+        spdk_env_opts_init(&opts);
+
         bool local_pci_device = false;
         int rc = spdk_pci_addr_parse(&addr, trid.traddr);
         if (!rc) {
@@ -605,7 +607,6 @@ int NVMEManager::try_get(const spdk_nvme_transport_id& trid, SharedDriverData **
           opts.num_pci_addr = 1;
         }
 
-	spdk_env_opts_init(&opts);
         opts.name = "nvme-device-manager";
         opts.core_mask = coremask_arg.c_str();
 #if SPDK_VERSION >= SPDK_VERSION_NUM(21, 1, 0)

From 3201a3d130e3b0d4498454db1db36c26f00d745a Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sat, 13 Jun 2026 12:45:03 +0800
Subject: [PATCH 464/596] crimson/seastore: skip LBA-leaf crc check for
 in-place delta-overwrite extents

on a cold read, check_full_extent_integrity() compares the crc of the read
content against the crc stored in the LBA leaf (pin_crc). this aborts on a
RANDOM_BLOCK data extent that was overwritten via delta-based overwrite:

  abort(extent checksum inconsistent)
   4# Cache::check_full_extent_integrity()
   5# Cache::_read_extent()::{lambda}
   7# Cache::replay_delta()  (or _read_pin on the live IO path)

the leaf crc is not a valid reference for these extents. delta overwrite
mutates the extent in place to avoid touching the LBA tree, so
update_lba_mappings() skips the leaf for is_exist_mutation_pending() extents
and the pre-mutation crc stays there. the new content lands on disk later and
out-of-band, when the cleaner rewrites the modified region in place
(RandomBlockOolWriter::do_write). that write is not atomic with the leaf, so a
cold read can pick up new content against an old leaf crc.

updating the leaf crc on overwrite is not the fix. it brings back the LBA-tree
mutation (and the txn conflicts and hot-path crc) that delta overwrite exists
to avoid, and it still does not make the leaf reliable: the data write and the
leaf update happen separately, so publishing leaf=new while disk still holds
old just moves the mismatch.

so stop trusting the leaf for these extents. their content is verified at
replay, where replay_delta() applies the deltas and
CircularBoundedJournal::replay() asserts last_committed_crc == delta.final_crc.
and the content on disk is always current: modified_region accumulates every
change via union_insert and is cleared only when the in-place rewrite commits,
so do_write writes the latest content; only the leaf crc lags.

drop the leaf-crc check on read for RANDOM_BLOCK in-place-rewritable (data)
extents, but only when delta-based overwrite is enabled. with it off (the
default), overwrites go through remapping, the leaf crc stays valid, and the
check still runs for every other extent. last_committed_crc is computed
regardless, so the delta-chain check is unaffected.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/crimson/os/seastore/cache.cc |  3 +++
 src/crimson/os/seastore/cache.h  | 31 +++++++++++++++++++++++--------
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/src/crimson/os/seastore/cache.cc b/src/crimson/os/seastore/cache.cc
index be90decca48..9500ffdbc61 100644
--- a/src/crimson/os/seastore/cache.cc
+++ b/src/crimson/os/seastore/cache.cc
@@ -33,6 +33,9 @@ Cache::Cache(
   ExtentPlacementManager &epm,
   store_index_t store_index)
   : epm(epm),
+    delta_based_overwrite_enabled(
+      crimson::common::get_conf<Option::size_t>(
+        "seastore_data_delta_based_overwrite") > 0),
     pinboard(create_extent_pinboard(
       crimson::common::get_conf<Option::size_t>(
        "seastore_cachepin_size_pershard")))
diff --git a/src/crimson/os/seastore/cache.h b/src/crimson/os/seastore/cache.h
index 24aebba12f2..c878ad6d51f 100644
--- a/src/crimson/os/seastore/cache.h
+++ b/src/crimson/os/seastore/cache.h
@@ -1731,6 +1731,9 @@ private:
   }
 
   ExtentPlacementManager& epm;
+  // when delta-based overwrite is enabled, RANDOM_BLOCK data extents may be
+  // mutated in place, leaving their LBA-leaf crc stale; see _read_extent().
+  const bool delta_based_overwrite_enabled;
   RootBlockRef root;               ///< ref to current root
   ExtentIndex extents_index;             ///< set of live extents
 
@@ -2062,14 +2065,26 @@ void stage_visibility_handoff(Transaction& t,
               offset, length, *extent);
 
             if (pin_crc != CRC_NULL) {
-              SUBDEBUG(seastore_cache, "read extent 0x{:x}~0x{:x} veryfing integrity -- {}",
-                offset, length, *extent);
-              // We must check the integrity here prior to complete_io.
-              // Previously, concurrent transaction could have checked
-              // crc of non matching extent data.
-              // See: https://tracker.ceph.com/issues/73790
-              assert(extent->is_fully_loaded());
-              check_full_extent_integrity(extent->last_committed_crc, pin_crc);
+              // a RANDOM_BLOCK data extent that delta-based overwrite may have
+              // mutated in place has a stale LBA-leaf crc: its content and its
+              // leaf crc are updated through separate, non-atomic paths, so a
+              // cold read can see the new content against the old leaf crc.
+              // such extents are verified via the delta chain instead (see
+              // replay_delta()), so skip the leaf-crc check for them.
+              bool inplace_delta_overwrite =
+                delta_based_overwrite_enabled &&
+                extent->get_paddr().is_absolute_random_block() &&
+                can_inplace_rewrite(extent->get_type());
+              if (!inplace_delta_overwrite) {
+                SUBDEBUG(seastore_cache, "read extent 0x{:x}~0x{:x} verifying integrity -- {}",
+                  offset, length, *extent);
+                // We must check the integrity here prior to complete_io.
+                // Previously, concurrent transaction could have checked
+                // crc of non matching extent data.
+                // See: https://tracker.ceph.com/issues/73790
+                assert(extent->is_fully_loaded());
+                check_full_extent_integrity(extent->last_committed_crc, pin_crc);
+              }
             }
           } else {
             extent->last_committed_crc = CRC_NULL;

From 68dc3eb81ed9cfcb93999fbbc4d8619994b014e3 Mon Sep 17 00:00:00 2001
From: Mohit Agrawal <moagrawa@redhat.com>
Date: Fri, 12 Jun 2026 07:29:18 +0530
Subject: [PATCH 465/596] core: Handle OP_TOUCH_TEMP in BlueStore without any
 guard(WITH_CRIMSON)

During backfill recovery on Crimson OSD replica, Bluestore
aborts with _txc_add_transaction error ENOENT on operation
due to OP_TOUCH_TEMP. OP_TOUCH_TEMP is guarded by #ifdef WITH_CRIMSON
but WITH_CRIMSON is not defined when BlueStore is compiled.

OP_TOUCH_TEMP is a crimson specific op to manage temporary
objects and the op is not used by classic osd. It is a plain
integer constant defined in the shared transaction layer so
adding it to the common code path in Transaction.h and BlueStore.cc
requires no additional includes or compile time guards.Handling
it unconditonally is therefore safe for all Objectstore backends.

Solution: Handle OP_TOUCH_TEMP without any guard

Fixes: https://tracker.ceph.com/issues/75957
Signed-off-by: Mohit Agrawal <moagrawa@redhat.com>
---
 src/os/Transaction.cc         | 2 --
 src/os/Transaction.h          | 7 +------
 src/os/bluestore/BlueStore.cc | 4 ----
 3 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/src/os/Transaction.cc b/src/os/Transaction.cc
index 960dfd30191..21539e91171 100644
--- a/src/os/Transaction.cc
+++ b/src/os/Transaction.cc
@@ -87,7 +87,6 @@ void Transaction::dump(ceph::Formatter *f)
       }
       break;
 
-#ifdef WITH_CRIMSON
     case Transaction::OP_TOUCH_TEMP:
       {
         coll_t cid = i.get_cid(op->cid);
@@ -99,7 +98,6 @@ void Transaction::dump(ceph::Formatter *f)
         f->dump_stream("oid") << dest_oid;
       }
       break;
-#endif
 
     case Transaction::OP_WRITE:
       {
diff --git a/src/os/Transaction.h b/src/os/Transaction.h
index d4c3623addd..220e701f45d 100644
--- a/src/os/Transaction.h
+++ b/src/os/Transaction.h
@@ -153,9 +153,7 @@ public:
     OP_COLL_SET_BITS = 42, // cid, bits
 
     OP_MERGE_COLLECTION = 43, // cid, destination
-#ifdef WITH_CRIMSON
     OP_TOUCH_TEMP = 44, // cid, temp_oid, target_oid
-#endif
   };
 
   // Transaction hint type
@@ -442,9 +440,7 @@ public:
       op->oid = om[op->oid];
       break;
 
-#ifdef WITH_CRIMSON
     case OP_TOUCH_TEMP:
-#endif
     case OP_CLONERANGE2:
     case OP_CLONE:
       ceph_assert(op->cid < cm.size());
@@ -862,7 +858,6 @@ public:
     _op->oid = _get_object_id(oid);
     data.ops = data.ops + 1;
   }
-#ifdef WITH_CRIMSON
   /**
    * touch_temp
    *
@@ -884,7 +879,7 @@ public:
     _op->dest_oid = _get_object_id(target_oid);
     data.ops = data.ops + 1;
   }
-#endif
+
   /**
    * Write data to an offset within an object. If the object is too
    * small, it is expanded as needed.  It is possible to specify an
diff --git a/src/os/bluestore/BlueStore.cc b/src/os/bluestore/BlueStore.cc
index bbfd74a2175..1720efc3d5b 100644
--- a/src/os/bluestore/BlueStore.cc
+++ b/src/os/bluestore/BlueStore.cc
@@ -16226,9 +16226,7 @@ void BlueStore::_txc_add_transaction(TransContext *txc, Transaction *t)
     // these operations implicity create the object
     bool create = false;
     if (op->op == Transaction::OP_TOUCH ||
-#ifdef WITH_CRIMSON
         op->op == Transaction::OP_TOUCH_TEMP ||
-#endif
 	op->op == Transaction::OP_CREATE ||
 	op->op == Transaction::OP_WRITE ||
 	op->op == Transaction::OP_ZERO) {
@@ -16252,9 +16250,7 @@ void BlueStore::_txc_add_transaction(TransContext *txc, Transaction *t)
     switch (op->op) {
     case Transaction::OP_CREATE:
     case Transaction::OP_TOUCH:
-#ifdef WITH_CRIMSON
     case Transaction::OP_TOUCH_TEMP:
-#endif
       r = _touch(txc, c, o);
       break;
 

From fcac016ae429dd8d64f00fe3639582b547cc7e64 Mon Sep 17 00:00:00 2001
From: pujaoshahu <pshahu@redhat.com>
Date: Thu, 2 Apr 2026 16:54:06 +0530
Subject: [PATCH 466/596] mgr/dashboard: Add option should be enabled even if
 allow all host access is enabled in nvme/tcp

Fixes: https://tracker.ceph.com/issues/75509
Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../nvmeof-initiators-form.component.html     |   1 +
 .../nvmeof-initiators-form.component.spec.ts  |  20 ++-
 .../nvmeof-initiators-form.component.ts       |  16 ++-
 .../nvmeof-initiators-list.component.html     |  58 ++++----
 .../nvmeof-initiators-list.component.spec.ts  | 126 ++++++++++++++++--
 .../nvmeof-initiators-list.component.ts       |  81 ++++++++---
 .../nvmeof-namespaces-list.component.spec.ts  |  52 +++++++-
 .../nvmeof-subsystem-step-2.component.html    |   1 +
 .../nvmeof-subsystem-step-2.component.ts      |   2 +-
 .../nvmeof-subsystems.component.spec.ts       |  35 +++++
 10 files changed, 331 insertions(+), 61 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html
index 4b2df6992c5..a4c8a8a1a35 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html
@@ -13,6 +13,7 @@
       #tearsheetStep
                modal-primary-focus
       [group]="group"
+      [allowAllHosts]="allowAllHosts"
       [existingHosts]="existingHosts"></cd-nvmeof-subsystem-step-two>
   </cd-tearsheet-step>
   @if(showAuthStep) {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts
index e7f8f1f7251..388592eaea4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts
@@ -2,7 +2,7 @@ import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { ReactiveFormsModule } from '@angular/forms';
 import { RouterTestingModule } from '@angular/router/testing';
 import { ComponentFixture, TestBed } from '@angular/core/testing';
-import { ActivatedRoute } from '@angular/router';
+import { ActivatedRoute, convertToParamMap, Router } from '@angular/router';
 import { NO_ERRORS_SCHEMA } from '@angular/core';
 import { of } from 'rxjs';
 
@@ -31,7 +31,7 @@ describe('NvmeofInitiatorsFormComponent', () => {
         {
           provide: ActivatedRoute,
           useValue: {
-            queryParams: of({ group: 'test-group' }),
+            queryParamMap: of(convertToParamMap({ group: 'test-group' })),
             params: of({ subsystem_nqn: 'nqn.test' }),
             parent: {
               params: of({ subsystem_nqn: 'nqn.test' })
@@ -59,6 +59,22 @@ describe('NvmeofInitiatorsFormComponent', () => {
     expect(component).toBeTruthy();
   });
 
+  it('should set allowAllHosts to true when disableAllowAll is not set', () => {
+    const router = TestBed.inject(Router);
+    spyOn(router, 'getCurrentNavigation').and.returnValue(null);
+    component.ngOnInit();
+    expect(component.allowAllHosts).toBe(true);
+  });
+
+  it('should set allowAllHosts to false when disableAllowAll is true in navigation state', () => {
+    const router = TestBed.inject(Router);
+    spyOn(router, 'getCurrentNavigation').and.returnValue({
+      extras: { state: { disableAllowAll: true } }
+    } as any);
+    component.ngOnInit();
+    expect(component.allowAllHosts).toBe(false);
+  });
+
   it('should initialize with two steps (Host access control + Authentication optional)', () => {
     expect(component.steps.length).toBe(2);
     expect(component.steps[0].label).toBe('Host access control');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
index d25ffa1368a..d3cb2308f39 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
@@ -9,7 +9,7 @@ import {
   NvmeofSubsystemInitiator
 } from '~/app/shared/models/nvmeof';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
-import { ActivatedRoute, Router } from '@angular/router';
+import { ActivatedRoute, Params, Router } from '@angular/router';
 import { TearsheetComponent } from '~/app/shared/components/tearsheet/tearsheet.component';
 
 type InitiatorsFormPayload = Pick<HostStepType, 'hostType' | 'addedHosts'> &
@@ -32,6 +32,7 @@ export class NvmeofInitiatorsFormComponent implements OnInit {
   isSubmitLoading = false;
   existingHosts: string[] = [];
   showAuthStep = true;
+  allowAllHosts = true;
   stepTwoValue: HostStepType = null;
 
   @ViewChild(TearsheetComponent) tearsheet!: TearsheetComponent;
@@ -50,15 +51,16 @@ export class NvmeofInitiatorsFormComponent implements OnInit {
   ) {}
 
   ngOnInit() {
-    this.route.queryParams.subscribe((params) => {
-      this.group = params?.['group'];
+    this.route.queryParamMap.subscribe((params) => {
+      this.group = params.get('group');
     });
-    this.route.parent.params.subscribe((params: any) => {
+    this.allowAllHosts = !this.getDisableAllowAllState();
+    this.route.parent.params.subscribe((params: Params) => {
       if (params.subsystem_nqn) {
         this.subsystemNQN = params.subsystem_nqn;
       }
     });
-    this.route.params.subscribe((params: any) => {
+    this.route.params.subscribe((params: Params) => {
       if (!this.subsystemNQN && params.subsystem_nqn) {
         this.subsystemNQN = params.subsystem_nqn;
       }
@@ -67,6 +69,10 @@ export class NvmeofInitiatorsFormComponent implements OnInit {
     this.rebuildSteps();
   }
 
+  private getDisableAllowAllState(): boolean {
+    return this.router.getCurrentNavigation()?.extras?.state?.['disableAllowAll'] === true;
+  }
+
   rebuildSteps() {
     const steps: Step[] = [{ label: STEP_LABELS.HOSTS, invalid: false }];
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
index 8c924ce0152..0988d0563d5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
@@ -1,35 +1,43 @@
-@if (hasAllHostsAllowed()) {
+@if (allowAllHosts) {
   <cd-alert-panel
     class="cds-mb-4"
-    type="warning"
+    type="info"
     [showTitle]="false">
-    <div cdsStack="vertical"
-         gap="1">
-      <strong class="cds-mb-1"
-              i18n>All hosts allowed</strong>
-      <p class="cds-mb-0"
-         i18n>
-        Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
-      </p>
+    <div cdsStack="horizontal"
+         gap="2">
+      <div cdsStack="vertical"
+           gap="2">
+        <strong i18n>Host access: All hosts allowed</strong>
+        <p
+          class="cds-mb-0 cds-mt-1"
+          i18n
+        >
+          Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
+        </p>
+      </div>
+      <a cdsLink
+         class="cds-ml-3"
+         (click)="openAddInitiatorForm(true)"
+         i18n>Edit host access</a>
     </div>
   </cd-alert-panel>
+} @else {
+  <cd-table [data]="initiators"
+            columnMode="flex"
+            (fetchData)="listInitiators()"
+            [columns]="initiatorColumns"
+            selectionType="multiClick"
+            (updateSelection)="updateSelection($event)">
+    <div class="table-actions">
+      <cd-table-actions [permission]="permission"
+                        [selection]="selection"
+                        class="btn-group"
+                        [tableActions]="tableActions">
+      </cd-table-actions>
+    </div>
+  </cd-table>
 }
 
-<cd-table [data]="initiators"
-          columnMode="flex"
-          (fetchData)="listInitiators()"
-          [columns]="initiatorColumns"
-          selectionType="multiClick"
-          (updateSelection)="updateSelection($event)">
-  <div class="table-actions">
-    <cd-table-actions [permission]="permission"
-                      [selection]="selection"
-                      class="btn-group"
-                      [tableActions]="tableActions">
-    </cd-table-actions>
-  </div>
-</cd-table>
-
 <ng-template #hostNqnTpl
              let-row="data.row">
   {{ getDisplayedHostNqn(row.nqn) }}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
index 05d956256cb..0f72f0225b6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
@@ -1,13 +1,14 @@
 import { ComponentFixture, TestBed, fakeAsync, tick } from '@angular/core/testing';
 import { HttpClientModule } from '@angular/common/http';
+import { ActivatedRoute, NavigationEnd, Router } from '@angular/router';
 import { RouterTestingModule } from '@angular/router/testing';
 
-import { of } from 'rxjs';
+import { of, Subject } from 'rxjs';
 
 import { SharedModule } from '~/app/shared/shared.module';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
-import { ModalService } from '~/app/shared/services/modal.service';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { ALLOW_ALL_HOST } from '~/app/shared/models/nvmeof';
 
@@ -15,7 +16,7 @@ import { NvmeofInitiatorsListComponent } from './nvmeof-initiators-list.componen
 
 const mockInitiators = [
   {
-    nqn: ALLOW_ALL_HOST,
+    nqn: 'nqn.2016-06.io.spdk:host1',
     use_dhchap: false
   }
 ];
@@ -23,7 +24,8 @@ const mockInitiators = [
 const mockSubsystem = {
   nqn: 'nqn.2016-06.io.spdk:cnode1',
   serial_number: '12345',
-  has_dhchap_key: false
+  has_dhchap_key: false,
+  allow_any_host: false
 };
 
 class MockNvmeOfService {
@@ -41,26 +43,51 @@ class MockAuthStorageService {
   }
 }
 
-class MockModalService {}
+class MockModalCdsService {}
 
 class MockTaskWrapperService {}
 
 describe('NvmeofInitiatorsListComponent', () => {
   let component: NvmeofInitiatorsListComponent;
   let fixture: ComponentFixture<NvmeofInitiatorsListComponent>;
+  let nvmeofService: NvmeofService;
+  let routeParams$: Subject<any>;
+  let queryParams$: Subject<any>;
+  let routerEvents$: Subject<any>;
 
   beforeEach(async () => {
+    routeParams$ = new Subject<any>();
+    queryParams$ = new Subject<any>();
+    routerEvents$ = new Subject<any>();
+
     await TestBed.configureTestingModule({
       declarations: [NvmeofInitiatorsListComponent],
       imports: [HttpClientModule, RouterTestingModule, SharedModule],
       providers: [
         { provide: NvmeofService, useClass: MockNvmeOfService },
         { provide: AuthStorageService, useClass: MockAuthStorageService },
-        { provide: ModalService, useClass: MockModalService },
-        { provide: TaskWrapperService, useClass: MockTaskWrapperService }
+        { provide: ModalCdsService, useClass: MockModalCdsService },
+        { provide: TaskWrapperService, useClass: MockTaskWrapperService },
+        {
+          provide: ActivatedRoute,
+          useValue: {
+            parent: { params: routeParams$.asObservable() },
+            queryParams: queryParams$.asObservable()
+          }
+        },
+        {
+          provide: Router,
+          useValue: {
+            events: routerEvents$.asObservable(),
+            navigate: jasmine.createSpy('navigate')
+          }
+        }
       ]
     }).compileComponents();
+  });
 
+  beforeEach(() => {
+    nvmeofService = TestBed.inject(NvmeofService);
     fixture = TestBed.createComponent(NvmeofInitiatorsListComponent);
     component = fixture.componentInstance;
     component.subsystemNQN = 'nqn.2016-06.io.spdk:cnode1';
@@ -84,9 +111,23 @@ describe('NvmeofInitiatorsListComponent', () => {
     expect(component.getDisplayedHostNqn(ALLOW_ALL_HOST)).toBe('Any');
   }));
 
+  it('should default allowAllHosts to false', () => {
+    expect(component.allowAllHosts).toBe(false);
+  });
+
+  it('should set allowAllHosts to true when subsystem allows any host and no initiators', fakeAsync(() => {
+    const allowAllSubsystem = { ...mockSubsystem, allow_any_host: true };
+    spyOn(nvmeofService, 'getInitiators').and.returnValue(of([]));
+    spyOn(nvmeofService, 'getSubsystem').and.returnValue(of(allowAllSubsystem));
+    component.listInitiators();
+    component.getSubsystem();
+    tick();
+    expect(component.allowAllHosts).toBe(true);
+  }));
+
   it('should update authStatus when initiator has dhchap_key', fakeAsync(() => {
     const initiatorsWithKey = [{ nqn: 'nqn1', use_dhchap: true }];
-    spyOn(TestBed.inject(NvmeofService), 'getInitiators').and.returnValue(of(initiatorsWithKey));
+    spyOn(nvmeofService, 'getInitiators').and.returnValue(of(initiatorsWithKey));
     component.listInitiators();
     tick();
     expect(component.authStatus).toBe('Unidirectional');
@@ -96,9 +137,76 @@ describe('NvmeofInitiatorsListComponent', () => {
     const initiatorsWithKey = [{ nqn: 'nqn1', use_dhchap: true }];
     component.initiators = initiatorsWithKey;
     const subsystemWithKey = { ...mockSubsystem, has_dhchap_key: true };
-    spyOn(TestBed.inject(NvmeofService), 'getSubsystem').and.returnValue(of(subsystemWithKey));
+    spyOn(nvmeofService, 'getSubsystem').and.returnValue(of(subsystemWithKey));
     component.getSubsystem();
     tick();
     expect(component.authStatus).toBe('Bi-directional');
   }));
+
+  it('should fetch only when both route and query params are available', () => {
+    const newFixture = TestBed.createComponent(NvmeofInitiatorsListComponent);
+    const newComponent = newFixture.componentInstance;
+    newComponent.subsystemNQN = undefined;
+    newComponent.group = undefined;
+    const listInitiatorsSpy = spyOn(newComponent, 'listInitiators');
+    const getSubsystemSpy = spyOn(newComponent, 'getSubsystem');
+
+    newComponent.ngOnInit();
+
+    routeParams$.next({ subsystem_nqn: 'nqn.from.route' });
+    expect(listInitiatorsSpy).not.toHaveBeenCalled();
+    expect(getSubsystemSpy).not.toHaveBeenCalled();
+
+    queryParams$.next({ group: 'group-from-query' });
+    expect(listInitiatorsSpy).toHaveBeenCalledTimes(1);
+    expect(getSubsystemSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should refresh on non-modal navigation changes', () => {
+    const newFixture = TestBed.createComponent(NvmeofInitiatorsListComponent);
+    const newComponent = newFixture.componentInstance;
+    newComponent.subsystemNQN = 'nqn.2016-06.io.spdk:cnode1';
+    newComponent.group = 'group1';
+    const listInitiatorsSpy = spyOn(newComponent, 'listInitiators');
+    const getSubsystemSpy = spyOn(newComponent, 'getSubsystem');
+
+    newComponent.ngOnInit();
+    routerEvents$.next(new NavigationEnd(1, '/nvmeof/(modal:add)', '/nvmeof/(modal:add)'));
+    expect(listInitiatorsSpy).toHaveBeenCalledTimes(1);
+    expect(getSubsystemSpy).toHaveBeenCalledTimes(1);
+
+    routerEvents$.next(new NavigationEnd(2, '/nvmeof/subsystem', '/nvmeof/subsystem'));
+    expect(listInitiatorsSpy).toHaveBeenCalledTimes(2);
+    expect(getSubsystemSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('should filter ALLOW_ALL_HOST from array response', fakeAsync(() => {
+    spyOn(nvmeofService, 'getInitiators').and.returnValue(
+      of([
+        { nqn: ALLOW_ALL_HOST, use_dhchap: false },
+        { nqn: 'nqn.2016-06.io.spdk:host2', use_dhchap: false }
+      ])
+    );
+
+    component.listInitiators();
+    tick();
+
+    expect(component.initiators).toEqual([{ nqn: 'nqn.2016-06.io.spdk:host2', use_dhchap: false }]);
+  }));
+
+  it('should support hosts-wrapper response from getInitiators', fakeAsync(() => {
+    spyOn(nvmeofService, 'getInitiators').and.returnValue(
+      of({
+        hosts: [
+          { nqn: ALLOW_ALL_HOST, use_dhchap: false },
+          { nqn: 'nqn.2016-06.io.spdk:host3', use_dhchap: true }
+        ]
+      })
+    );
+
+    component.listInitiators();
+    tick();
+
+    expect(component.initiators).toEqual([{ nqn: 'nqn.2016-06.io.spdk:host3', use_dhchap: true }]);
+  }));
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
index 4aa5fccb460..7f4461e96e0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
@@ -1,5 +1,7 @@
-import { Component, Input, OnInit, TemplateRef, ViewChild } from '@angular/core';
-import { ActivatedRoute, Router } from '@angular/router';
+import { Component, Input, OnDestroy, OnInit, TemplateRef, ViewChild } from '@angular/core';
+import { ActivatedRoute, NavigationEnd, Router } from '@angular/router';
+import { Subscription } from 'rxjs';
+import { filter } from 'rxjs/operators';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
 import { ActionLabelsI18n, URLVerbs } from '~/app/shared/constants/app.constants';
@@ -28,7 +30,7 @@ import { NvmeofEditHostKeyModalComponent } from '../nvmeof-edit-host-key-modal/n
   styleUrls: ['./nvmeof-initiators-list.component.scss'],
   standalone: false
 })
-export class NvmeofInitiatorsListComponent implements OnInit {
+export class NvmeofInitiatorsListComponent implements OnInit, OnDestroy {
   @Input()
   subsystemNQN: string;
   @Input()
@@ -50,6 +52,9 @@ export class NvmeofInitiatorsListComponent implements OnInit {
   allowAllHost = ALLOW_ALL_HOST;
   yesLabel = $localize`Yes`;
   noLabel = $localize`No`;
+  allowAllHosts = false;
+
+  private subscriptions = new Subscription();
 
   constructor(
     public actionLabels: ActionLabelsI18n,
@@ -78,9 +83,23 @@ export class NvmeofInitiatorsListComponent implements OnInit {
         this.fetchIfReady();
       });
     } else {
+      this.listInitiators();
       this.getSubsystem();
     }
 
+    this.subscriptions.add(
+      this.router.events
+        .pipe(
+          filter(
+            (event): event is NavigationEnd =>
+              event instanceof NavigationEnd && !event.urlAfterRedirects.includes('(modal:')
+          )
+        )
+        .subscribe(() => {
+          this.fetchIfReady();
+        })
+    );
+
     this.initiatorColumns = [
       {
         name: $localize`Host NQN`,
@@ -98,12 +117,9 @@ export class NvmeofInitiatorsListComponent implements OnInit {
         name: this.actionLabels.ADD,
         permission: 'create',
         icon: Icons.add,
-        click: () =>
-          this.router.navigate([{ outlets: { modal: [URLVerbs.ADD, 'initiator'] } }], {
-            queryParams: { group: this.group },
-            relativeTo: this.route.parent
-          }),
-        canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
+        click: () => this.openAddInitiatorForm(),
+        canBePrimary: (selection: CdTableSelection) => !selection.hasSelection,
+        disable: () => this.hasAllHostsAllowed()
       },
       {
         name: $localize`Edit host key`,
@@ -124,6 +140,10 @@ export class NvmeofInitiatorsListComponent implements OnInit {
     ];
   }
 
+  ngOnDestroy() {
+    this.subscriptions.unsubscribe();
+  }
+
   private fetchIfReady() {
     if (this.subsystemNQN && this.group) {
       this.listInitiators();
@@ -131,15 +151,31 @@ export class NvmeofInitiatorsListComponent implements OnInit {
     }
   }
 
+  openAddInitiatorForm(disableAllowAll = false) {
+    this.router.navigate([{ outlets: { modal: [URLVerbs.ADD, 'initiator'] } }], {
+      queryParams: { group: this.group },
+      state: { disableAllowAll },
+      relativeTo: this.route.parent
+    });
+  }
+
   editHostKeyModal() {
     const selected = this.selection.selected[0];
     if (!selected) return;
-    this.modalService.show(NvmeofEditHostKeyModalComponent, {
+    const modalRef = this.modalService.show(NvmeofEditHostKeyModalComponent, {
       subsystemNQN: this.subsystemNQN,
       hostNQN: selected.nqn,
       group: this.group,
       dhchapKey: selected.dhchap_key || ''
     });
+    if (modalRef?.closeChange) {
+      this.subscriptions.add(
+        modalRef.closeChange.subscribe(() => {
+          this.listInitiators();
+          this.getSubsystem();
+        })
+      );
+    }
   }
 
   getAllowAllHostIndex() {
@@ -147,7 +183,7 @@ export class NvmeofInitiatorsListComponent implements OnInit {
   }
 
   hasAllHostsAllowed(): boolean {
-    return this.initiators.some((initiator) => initiator.nqn === ALLOW_ALL_HOST);
+    return !!this.subsystem?.allow_any_host && this.initiators.length === 0;
   }
 
   updateSelection(selection: CdTableSelection) {
@@ -159,19 +195,22 @@ export class NvmeofInitiatorsListComponent implements OnInit {
       .getInitiators(this.subsystemNQN, this.group)
       .subscribe((response: NvmeofSubsystemInitiator[] | { hosts: NvmeofSubsystemInitiator[] }) => {
         const initiators = Array.isArray(response) ? response : response?.hosts || [];
-        this.initiators = initiators;
+        this.initiators = initiators.filter((i) => i.nqn !== ALLOW_ALL_HOST);
         this.updateAuthStatus();
       });
   }
 
   getSubsystem() {
-    this.nvmeofService.getSubsystem(this.subsystemNQN, this.group).subscribe((subsystem: any) => {
-      this.subsystem = subsystem;
-      this.updateAuthStatus();
-    });
+    this.nvmeofService
+      .getSubsystem(this.subsystemNQN, this.group)
+      .subscribe((subsystem: NvmeofSubsystem) => {
+        this.subsystem = subsystem;
+        this.updateAuthStatus();
+      });
   }
 
   updateAuthStatus() {
+    this.allowAllHosts = this.hasAllHostsAllowed();
     if (this.subsystem && this.initiators) {
       this.authStatus = getSubsystemAuthStatus(this.subsystem, this.initiators);
     }
@@ -195,7 +234,7 @@ export class NvmeofInitiatorsListComponent implements OnInit {
       itemNames = [...hostNQNs, $localize`Allow any host(*)`];
     }
     const hostName = itemNames[0];
-    this.modalService.show(DeleteConfirmationModalComponent, {
+    const deleteModalRef = this.modalService.show(DeleteConfirmationModalComponent, {
       itemDescription: $localize`host`,
       impact: DeletionImpact.high,
       itemNames,
@@ -215,5 +254,13 @@ export class NvmeofInitiatorsListComponent implements OnInit {
           })
         })
     });
+    if (deleteModalRef?.closeChange) {
+      this.subscriptions.add(
+        deleteModalRef.closeChange.subscribe(() => {
+          this.listInitiators();
+          this.getSubsystem();
+        })
+      );
+    }
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
index 6ac05c63b69..a259edf2bc4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
@@ -31,8 +31,11 @@ const mockNamespaces = [
 ];
 
 class MockNvmeOfService {
+  gatewayGroupsResponse: any = [[{ id: 'g1' }]];
+  namespacesResponse: any = { namespaces: mockNamespaces };
+
   listGatewayGroups() {
-    return of([[{ id: 'g1' }]]);
+    return of(this.gatewayGroupsResponse);
   }
 
   formatGwGroupsList(_response: any) {
@@ -40,7 +43,7 @@ class MockNvmeOfService {
   }
 
   listNamespaces(_group?: string) {
-    return of({ namespaces: mockNamespaces });
+    return of(this.namespacesResponse);
   }
 }
 
@@ -61,6 +64,7 @@ describe('NvmeofNamespacesListComponent', () => {
   let fixture: ComponentFixture<NvmeofNamespacesListComponent>;
 
   let modalService: MockModalCdsService;
+  let nvmeofService: MockNvmeOfService;
 
   beforeEach(async () => {
     await TestBed.configureTestingModule({
@@ -81,6 +85,7 @@ describe('NvmeofNamespacesListComponent', () => {
     component.subsystemNQN = 'nqn.2001-07.com.ceph:1721040751436';
     fixture.detectChanges();
     modalService = TestBed.inject(ModalCdsService) as any;
+    nvmeofService = TestBed.inject(NvmeofService) as any;
   });
 
   it('should create', () => {
@@ -117,4 +122,47 @@ describe('NvmeofNamespacesListComponent', () => {
     expect(args.itemDescription).toBeDefined();
     expect(typeof args.submitActionObservable).toBe('function');
   });
+
+  it('should deduplicate namespaces by nsid and subsystem nqn', (done) => {
+    component.group = 'g1';
+    nvmeofService.namespacesResponse = {
+      namespaces: [
+        { nsid: 1, ns_subsystem_nqn: 'sub1' },
+        { nsid: 1, ns_subsystem_nqn: 'sub1' },
+        { nsid: 1, ns_subsystem_nqn: 'sub2' }
+      ]
+    };
+
+    component.namespaces$.pipe(take(1)).subscribe((namespaces) => {
+      expect(namespaces).toEqual([
+        { nsid: 1, ns_subsystem_nqn: 'sub1', unique_id: '1_sub1' },
+        { nsid: 1, ns_subsystem_nqn: 'sub2', unique_id: '1_sub2' }
+      ]);
+      done();
+    });
+
+    component.listNamespaces();
+  });
+
+  it('should default to first group and keep default placeholder when groups exist', () => {
+    component.group = null;
+    component.gwGroups = [{ content: 'g1', selected: false }] as any;
+
+    component.updateGroupSelectionState();
+
+    expect(component.group).toBe('g1');
+    expect(component.gwGroupsEmpty).toBe(false);
+    expect(component.gwGroupPlaceholder).toBe('Enter group name');
+  });
+
+  it('should set error placeholder and call preventDefault on group fetch failure', () => {
+    const preventDefault = jasmine.createSpy('preventDefault');
+
+    component.handleGatewayGroupsError({ preventDefault });
+
+    expect(component.gwGroups).toEqual([]);
+    expect(component.gwGroupsEmpty).toBe(true);
+    expect(component.gwGroupPlaceholder).toBe('Unable to fetch Gateway groups');
+    expect(preventDefault).toHaveBeenCalled();
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
index a733709627f..b06f9548b76 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
@@ -23,6 +23,7 @@
           orientation="vertical">
           <cds-radio
             [value]="HOST_TYPE.ALL"
+            [disabled]="!allowAllHosts"
             class="cds-mb-2"
             i18n>Allow all hosts</cds-radio>
           <span class="cds--form__helper-text cds-mb-3"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts
index 70cfbd75a31..3829ed3d201 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts
@@ -20,6 +20,7 @@ import { TearsheetStep } from '~/app/shared/models/tearsheet-step';
 export class NvmeofSubsystemsStepTwoComponent implements OnInit, TearsheetStep {
   @Input() group!: string;
   @Input() existingHosts: string[] = [];
+  @Input() allowAllHosts = true;
   @ViewChild('rightInfluencer', { static: true })
   rightInfluencer?: TemplateRef<any>;
   formGroup: CdFormGroup;
@@ -36,7 +37,6 @@ export class NvmeofSubsystemsStepTwoComponent implements OnInit, TearsheetStep {
   csvDropText: string = $localize`Drag and drop files here or click to upload`;
   NQN_REGEX = /^nqn\.(19|20)\d\d-(0[1-9]|1[0-2])\.\D{2,3}(\.[A-Za-z0-9-]+)+(:[A-Za-z0-9-\.]+(:[A-Za-z0-9-\.]+)*)$/;
   NQN_REGEX_UUID = /^nqn\.2014-08\.org\.nvmexpress:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
-  ALLOW_ALL_HOST = '*';
   uploadedHosts = new Set<string>();
 
   constructor(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
index a3532ec1e12..3b061f2bf00 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
@@ -133,4 +133,39 @@ describe('NvmeofSubsystemsComponent', () => {
   it('should set first group as default initially', () => {
     expect(component.group).toBe(mockGroups[0][0].spec.group);
   });
+
+  it('should mark only current group as selected', () => {
+    component.group = 'foo';
+    component.gwGroups = [{ content: 'default' }, { content: 'foo' }] as any;
+
+    component.updateGroupSelectionState();
+
+    expect(component.gwGroups).toEqual([
+      { content: 'default', selected: false },
+      { content: 'foo', selected: true }
+    ]);
+  });
+
+  it('should clear selected group and refresh subsystem list', () => {
+    component.group = 'default';
+    const getSubsystemsSpy = spyOn(component, 'getSubsystems');
+
+    component.onGroupClear();
+
+    expect(component.group).toBeNull();
+    expect(getSubsystemsSpy).toHaveBeenCalled();
+  });
+
+  it('should set error placeholder and prevent default on groups load error', () => {
+    const preventDefault = jasmine.createSpy('preventDefault');
+    component.context = { error: jasmine.createSpy('error') } as any;
+
+    component.handleGatewayGroupsError({ preventDefault });
+
+    expect(component.gwGroups).toEqual([]);
+    expect(component.gwGroupsEmpty).toBe(true);
+    expect(component.gwGroupPlaceholder).toBe('Unable to fetch Gateway groups');
+    expect(preventDefault).toHaveBeenCalled();
+    expect(component.context.error).toHaveBeenCalled();
+  });
 });

From 720a3b7c3d35988e1b481f86e9562e7855e38e8c Mon Sep 17 00:00:00 2001
From: Ali Masarwa <amasarwa@redhat.com>
Date: Mon, 29 Jun 2026 14:09:04 +0300
Subject: [PATCH 467/596] rgw/posix: reading a detele marker returns -ENOENT

Signed-off-by: Ali Masarwa <amasarwa@redhat.com>
---
 src/rgw/driver/posix/rgw_sal_posix.cc | 11 +++++++++--
 src/rgw/driver/posix/rgw_sal_posix.h  |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/rgw/driver/posix/rgw_sal_posix.cc b/src/rgw/driver/posix/rgw_sal_posix.cc
index a7c097f82fe..01ce60f7210 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.cc
+++ b/src/rgw/driver/posix/rgw_sal_posix.cc
@@ -1540,7 +1540,14 @@ int VersionedDirectory::stat(const DoutPrefixProvider* dpp, bool force)
     }
     bufferlist bl;
     if (rgw::sal::get_attr(attrs, RGW_POSIX_ATTR_VERSION, bl)) {
-    //  cur_version.reset();
+      uint16_t flags = 0;
+      ceph::decode(flags, bl);
+      if (flags & rgw_bucket_dir_entry::FLAG_DELETE_MARKER) {
+        ldpp_dout(dpp, 0) << "ERROR: a delete marker, returning ENOENT "
+                          << get_name() << dendl;
+        cur_version.reset();
+        return -ENOENT;
+      }
     }
   }
 
@@ -1683,7 +1690,7 @@ int VersionedDirectory::copy(const DoutPrefixProvider *dpp, optional_yield y,
 int VersionedDirectory::add_delete_marker(const DoutPrefixProvider* dpp,
                                           optional_yield y,
                                           std::unique_ptr<File>& marker,
-                                          std::string& name)
+                                          const std::string &name)
 {
   // Create as temporary file first
   int ret = marker->create(dpp, /*existed=*/nullptr, /*temp_file=*/true);
diff --git a/src/rgw/driver/posix/rgw_sal_posix.h b/src/rgw/driver/posix/rgw_sal_posix.h
index b3caeade70e..b0656eaf2b9 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.h
+++ b/src/rgw/driver/posix/rgw_sal_posix.h
@@ -337,7 +337,7 @@ public:
   std::string get_new_instance();
   int remove_symlink(const DoutPrefixProvider *dpp, optional_yield y, std::string match = "");
   int add_file(const DoutPrefixProvider *dpp, std::unique_ptr<FSEnt>&& file, bool* existed = nullptr, bool temp_file = false);
-  int add_delete_marker(const DoutPrefixProvider* dpp, optional_yield y, std::unique_ptr<File>& marker, std::string& name);
+  int add_delete_marker(const DoutPrefixProvider* dpp, optional_yield y, std::unique_ptr<File>& marker, const std::string &name);
   FSEnt* get_cur_version_ent() { return cur_version.get(); };
   int set_cur_version_ent(const DoutPrefixProvider *dpp, FSEnt* file);
   virtual std::unique_ptr<FSEnt> clone_base() override {

From 6182e67ea44159e54bdf8c3af6f7648b562bebdd Mon Sep 17 00:00:00 2001
From: pujashahu <pujashahu@li-3d22414c-327d-11b2-a85c-a49077722390.ibm.com>
Date: Wed, 3 Jun 2026 00:05:45 +0530
Subject: [PATCH 468/596] mgr/dashboard: NVMe Onboarding Setup Cards

Fixes: https://tracker.ceph.com/issues/77067

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../src/app/ceph/block/block.module.ts        |   7 +-
 ...nvmeof-gateway-group-filter.component.html |  22 ++
 ...nvmeof-gateway-group-filter.component.scss |   0
 ...eof-gateway-group-filter.component.spec.ts | 111 ++++++
 .../nvmeof-gateway-group-filter.component.ts  | 115 ++++++
 .../nvmeof-gateway-group.component.html       |   2 -
 .../nvmeof-gateway-group.component.spec.ts    |  47 ++-
 .../nvmeof-gateway-group.component.ts         |  50 ++-
 .../nvmeof-gateway.component.ts               |   2 -
 .../nvmeof-namespaces-list.component.html     |  27 +-
 .../nvmeof-namespaces-list.component.spec.ts  |  17 +-
 .../nvmeof-namespaces-list.component.ts       | 106 ++----
 .../nvmeof-setup-cards.component.html         |  57 +++
 .../nvmeof-setup-cards.component.scss         |   0
 .../nvmeof-setup-cards.component.spec.ts      | 160 +++++++++
 .../nvmeof-setup-cards.component.ts           |  53 +++
 .../ceph/block/nvmeof-state.service.spec.ts   | 187 ++++++++++
 .../app/ceph/block/nvmeof-state.service.ts    |  95 +++++
 ...ubsystem-namespaces-list.component.spec.ts |  11 +-
 ...eof-subsystem-namespaces-list.component.ts |  31 +-
 .../nvmeof-subsystems.component.html          |  26 +-
 .../nvmeof-subsystems.component.spec.ts       | 125 ++++---
 .../nvmeof-subsystems.component.ts            |  95 +----
 .../nvmeof-tabs/nvmeof-tabs.component.html    |  76 ++--
 .../nvmeof-tabs/nvmeof-tabs.component.spec.ts | 332 +++++++++++++++++-
 .../nvmeof-tabs/nvmeof-tabs.component.ts      |  84 ++++-
 .../src/app/shared/api/nvmeof.service.ts      |  64 +++-
 .../setup-step-card.component.html            |  20 ++
 .../setup-step-card.component.scss            |  24 ++
 .../setup-step-card.component.spec.ts         | 134 +++++++
 .../setup-step-card.component.ts              |  33 ++
 .../datatable/table/table.component.html      |  15 +-
 32 files changed, 1779 insertions(+), 349 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index 3c5c8d9e7cc..135ec9134b4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -106,6 +106,8 @@ import { NvmeSubsystemViewComponent } from './nvme-subsystem-view/nvme-subsystem
 import { NvmeofSubsystemPerformanceComponent } from './nvmeof-subsystem-performance/nvmeof-subsystem-performance.component';
 import { NvmeofTabsComponent } from './nvmeof-tabs/nvmeof-tabs.component';
 import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component';
+import { NvmeofSetupCardsComponent } from './nvmeof-setup-cards/nvmeof-setup-cards.component';
+import { NvmeofGatewayGroupFilterComponent } from './nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component';
 
 @NgModule({
   imports: [
@@ -142,7 +144,9 @@ import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-gr
     ContainedListModule,
     SideNavModule,
     LayoutModule,
-    ThemeModule
+    ThemeModule,
+    NvmeofSetupCardsComponent,
+    NvmeofGatewayGroupFilterComponent
   ],
   declarations: [
     RbdListComponent,
@@ -337,6 +341,7 @@ const routes: Routes = [
   {
     path: 'nvmeof',
     canActivate: [ModuleStatusGuardService],
+    component: NvmeofTabsComponent,
     data: {
       breadcrumbs: true,
       text: 'NVMe/TCP',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
new file mode 100644
index 00000000000..d3b43ababa9
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
@@ -0,0 +1,22 @@
+<div cdsGrid
+     [useCssGrid]="true"
+     [narrow]="true"
+     [fullWidth]="true">
+<div cdsCol
+     [columnNumbers]="{sm: 4, md: 8}">
+  <div class="form-item"
+       cdsRow>
+    <cds-combo-box
+        type="single"
+        label="Selected Gateway Group"
+        i18n-label
+        [placeholder]="placeholder"
+        [items]="items"
+        (selected)="onSelected($event)"
+        (clear)="onClear()"
+        [disabled]="disabled">
+      <cds-dropdown-list></cds-dropdown-list>
+    </cds-combo-box>
+  </div>
+</div>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
new file mode 100644
index 00000000000..aef321896f5
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
@@ -0,0 +1,111 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { ActivatedRoute, Router } from '@angular/router';
+import { of, throwError } from 'rxjs';
+
+import { NvmeofGatewayGroupFilterComponent } from './nvmeof-gateway-group-filter.component';
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
+
+const MOCK_GROUPS_RESPONSE = [
+  [
+    { spec: { group: 'grp1' }, service_name: 'nvmeof.grp1' },
+    { spec: { group: 'grp2' }, service_name: 'nvmeof.grp2' }
+  ]
+];
+
+describe('NvmeofGatewayGroupFilterComponent', () => {
+  let fixture: ComponentFixture<NvmeofGatewayGroupFilterComponent>;
+  let component: NvmeofGatewayGroupFilterComponent;
+  let nvmeofService: Partial<NvmeofService>;
+  let routerSpy: Partial<Router>;
+  let activatedRoute: Partial<ActivatedRoute>;
+
+  beforeEach(async () => {
+    nvmeofService = {
+      listGatewayGroups: jest.fn().mockReturnValue(of(MOCK_GROUPS_RESPONSE)),
+      formatGwGroupsList: jest.fn().mockReturnValue([{ content: 'grp1' }, { content: 'grp2' }])
+    };
+
+    routerSpy = {
+      navigate: jest.fn().mockResolvedValue(true)
+    };
+
+    activatedRoute = {
+      snapshot: {
+        queryParams: {}
+      } as any
+    };
+
+    await TestBed.configureTestingModule({
+      imports: [NvmeofGatewayGroupFilterComponent],
+      providers: [
+        { provide: NvmeofService, useValue: nvmeofService },
+        { provide: Router, useValue: routerSpy },
+        { provide: ActivatedRoute, useValue: activatedRoute }
+      ]
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(NvmeofGatewayGroupFilterComponent);
+    component = fixture.componentInstance;
+  });
+
+  it('should create', () => {
+    fixture.detectChanges();
+    expect(component).toBeTruthy();
+  });
+
+  it('should load gateway groups on init', () => {
+    fixture.detectChanges();
+    expect(nvmeofService.listGatewayGroups).toHaveBeenCalled();
+    expect(component.items.length).toBe(2);
+  });
+
+  it('should default to the first group when no group is in the URL', () => {
+    fixture.detectChanges();
+    expect(routerSpy.navigate).toHaveBeenCalledWith(
+      [],
+      expect.objectContaining({ queryParams: { group: 'grp1' } })
+    );
+  });
+
+  it('should mark the URL group as selected when a group is already in the URL', () => {
+    (activatedRoute as any).snapshot.queryParams = { group: 'grp2' };
+    fixture.detectChanges();
+    const selected = component.items.find((i) => i.selected);
+    expect(selected?.content).toBe('grp2');
+  });
+
+  it('should emit groupChange when a group is selected', () => {
+    fixture.detectChanges();
+    const emitSpy = jest.spyOn(component.groupChange, 'emit');
+    component.onSelected({ content: 'grp2' });
+    expect(emitSpy).toHaveBeenCalledWith('grp2');
+  });
+
+  it('should emit null groupChange when cleared', () => {
+    fixture.detectChanges();
+    const emitSpy = jest.spyOn(component.groupChange, 'emit');
+    component.onClear();
+    expect(emitSpy).toHaveBeenCalledWith(null);
+  });
+
+  it('should disable and set placeholder when no groups are available', () => {
+    (nvmeofService.listGatewayGroups as jest.Mock).mockReturnValue(of([[]]));
+    fixture.detectChanges();
+    expect(component.disabled).toBe(true);
+    expect(component.placeholder).toBe('No groups available');
+  });
+
+  it('should disable and set error placeholder on API error', () => {
+    const err = new Error('network error');
+    (nvmeofService.listGatewayGroups as jest.Mock).mockReturnValue(throwError(() => err));
+    fixture.detectChanges();
+    expect(component.disabled).toBe(true);
+    expect(component.placeholder).toBe('Unable to fetch Gateway groups');
+  });
+
+  it('should render a cds-combo-box', () => {
+    fixture.detectChanges();
+    const combo = fixture.nativeElement.querySelector('cds-combo-box');
+    expect(combo).toBeTruthy();
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts
new file mode 100644
index 00000000000..39dd35faa3a
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts
@@ -0,0 +1,115 @@
+import { Component, EventEmitter, OnDestroy, OnInit, Output } from '@angular/core';
+import { ActivatedRoute, Router, RouterModule } from '@angular/router';
+import { Subject } from 'rxjs';
+import { takeUntil } from 'rxjs/operators';
+import { ComboBoxModule, GridModule, LayoutModule } from 'carbon-components-angular';
+import { NvmeofService, GroupsComboboxItem } from '~/app/shared/api/nvmeof.service';
+import { CephServiceSpec } from '~/app/shared/models/service.interface';
+
+const DEFAULT_PLACEHOLDER = $localize`Enter group name`;
+
+@Component({
+  selector: 'cd-nvmeof-gateway-group-filter',
+  templateUrl: './nvmeof-gateway-group-filter.component.html',
+  styleUrls: ['./nvmeof-gateway-group-filter.component.scss'],
+  standalone: true,
+  imports: [ComboBoxModule, GridModule, LayoutModule, RouterModule]
+})
+export class NvmeofGatewayGroupFilterComponent implements OnInit, OnDestroy {
+  @Output() groupChange = new EventEmitter<string | null>();
+
+  items: GroupsComboboxItem[] = [];
+  disabled = false;
+  placeholder = DEFAULT_PLACEHOLDER;
+
+  private destroy$ = new Subject<void>();
+
+  constructor(
+    private nvmeofService: NvmeofService,
+    private route: ActivatedRoute,
+    private router: Router
+  ) {}
+
+  ngOnInit(): void {
+    this.loadGatewayGroups();
+  }
+
+  ngOnDestroy(): void {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
+
+  onSelected(item: GroupsComboboxItem): void {
+    this.syncQueryParam(item.content);
+  }
+
+  onClear(): void {
+    this.syncQueryParam(null);
+  }
+
+  private loadGatewayGroups(): void {
+    this.nvmeofService
+      .listGatewayGroups()
+      .pipe(takeUntil(this.destroy$))
+      .subscribe({
+        next: (response: CephServiceSpec[][]) => this.onGroupsLoaded(response),
+        error: (error: any) => this.onGroupsError(error)
+      });
+  }
+
+  private onGroupsLoaded(response: CephServiceSpec[][]): void {
+    if (response?.[0]?.length) {
+      this.items = this.nvmeofService.formatGwGroupsList(response);
+    } else {
+      this.items = [];
+    }
+    this.syncSelectionState();
+  }
+
+  private onGroupsError(error: any): void {
+    this.items = [];
+    this.disabled = true;
+    this.placeholder = $localize`Unable to fetch Gateway groups`;
+    if (error?.preventDefault) {
+      error.preventDefault();
+    }
+    this.groupChange.emit(null);
+  }
+
+  private syncSelectionState(): void {
+    if (this.items.length) {
+      this.disabled = false;
+      this.placeholder = DEFAULT_PLACEHOLDER;
+      const urlGroup = this.route.snapshot.queryParams['group']?.trim() || null;
+      if (!urlGroup) {
+        this.syncQueryParam(this.items[0].content);
+      } else {
+        this.items = this.items.map((g) => ({ ...g, selected: g.content === urlGroup }));
+        this.groupChange.emit(urlGroup);
+      }
+    } else {
+      this.disabled = true;
+      this.placeholder = $localize`No groups available`;
+      this.groupChange.emit(null);
+    }
+  }
+
+  private syncQueryParam(group: string | null): void {
+    const currentGroup = this.route.snapshot.queryParams['group']?.trim() || null;
+    if (currentGroup === group) {
+      // URL already correct — still emit so the parent gets the current value on init
+      this.items = this.items.map((g) => ({ ...g, selected: g.content === group }));
+      this.groupChange.emit(group);
+      return;
+    }
+
+    this.router.navigate([], {
+      relativeTo: this.route,
+      queryParams: { group: group || null },
+      queryParamsHandling: 'merge',
+      replaceUrl: true
+    });
+    this.items = this.items.map((g) => ({ ...g, selected: g.content === group }));
+    this.groupChange.emit(group);
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index eae963ce641..40ffb638bfa 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,5 +1,3 @@
-<cd-nvmeof-tabs></cd-nvmeof-tabs>
-
 <ng-container *ngIf="gatewayGroup$ | async as gateways">
   <cd-table
     #table
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
index 69fad9acbfd..fe2100fc90b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
@@ -3,13 +3,15 @@ import { NO_ERRORS_SCHEMA } from '@angular/core';
 import { NvmeofGatewayGroupComponent } from './nvmeof-gateway-group.component';
 import { GridModule, TabsModule, ModalModule } from 'carbon-components-angular';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
-import { of } from 'rxjs';
+import { Observable, of, Subject } from 'rxjs';
 import { HttpClientModule } from '@angular/common/http';
 import { SharedModule } from '~/app/shared/shared.module';
 import { Router } from '@angular/router';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
 import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group-delete-guard-modal.component';
+import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
+import { NvmeofStateService } from '../nvmeof-state.service';
 
 describe('NvmeofGatewayGroupComponent', () => {
   let component: NvmeofGatewayGroupComponent;
@@ -22,6 +24,11 @@ describe('NvmeofGatewayGroupComponent', () => {
       listSubsystems: jest.fn().mockReturnValue(of([]))
     };
 
+    const nvmeofStateServiceMock = {
+      refresh$: new Subject<void>(),
+      requestRefresh: jest.fn()
+    };
+
     await TestBed.configureTestingModule({
       imports: [HttpClientModule, SharedModule, TabsModule, GridModule, ModalModule],
       declarations: [NvmeofGatewayGroupComponent],
@@ -34,7 +41,8 @@ describe('NvmeofGatewayGroupComponent', () => {
         {
           provide: ModalCdsService,
           useValue: { show: jest.fn() }
-        }
+        },
+        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
       ],
       schemas: [NO_ERRORS_SCHEMA]
     }).compileComponents();
@@ -298,4 +306,39 @@ describe('NvmeofGatewayGroupComponent', () => {
       );
     });
   });
+
+  it('should refresh table and setup state after gateway group delete completes', () => {
+    const modalService = TestBed.inject(ModalCdsService);
+    const taskWrapperService = TestBed.inject(TaskWrapperService);
+    const nvmeofStateService = TestBed.inject(NvmeofStateService);
+
+    jest.spyOn(modalService, 'show').mockImplementation(() => undefined);
+    jest.spyOn(taskWrapperService, 'wrapTaskAroundCall').mockReturnValue(
+      new Observable((observer) => {
+        observer.complete();
+      })
+    );
+
+    const refreshBtnSpy = jest.fn();
+    component.table = { refreshBtn: refreshBtnSpy } as any;
+    const requestRefreshSpy = jest.spyOn(nvmeofStateService, 'requestRefresh');
+
+    component.selection = {
+      first: () => ({
+        service_name: 'nvmeof.rbd.default',
+        spec: { group: 'default' },
+        subSystemCount: 0
+      }),
+      hasSelection: true
+    } as any;
+
+    component.deleteGatewayGroupModal();
+
+    const submitActionObservable = (modalService.show as jest.Mock).mock.calls[0][1]
+      .submitActionObservable;
+    submitActionObservable().subscribe();
+
+    expect(refreshBtnSpy).toHaveBeenCalled();
+    expect(requestRefreshSpy).toHaveBeenCalled();
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index 933a085a1ff..5d622a0bdef 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -1,7 +1,14 @@
-import { Component, OnInit, TemplateRef, ViewChild, ViewEncapsulation } from '@angular/core';
+import {
+  Component,
+  OnDestroy,
+  OnInit,
+  TemplateRef,
+  ViewChild,
+  ViewEncapsulation
+} from '@angular/core';
 import { Router } from '@angular/router';
-import { BehaviorSubject, forkJoin, Observable, of } from 'rxjs';
-import { catchError, map, switchMap } from 'rxjs/operators';
+import { BehaviorSubject, forkJoin, Observable, of, Subject } from 'rxjs';
+import { catchError, finalize, map, shareReplay, switchMap, takeUntil, tap } from 'rxjs/operators';
 import { GatewayGroup, NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { HostService } from '~/app/shared/api/host.service';
 import { ActionLabelsI18n } from '~/app/shared/constants/app.constants';
@@ -25,6 +32,7 @@ import { NotificationService } from '~/app/shared/services/notification.service'
 import { NotificationType } from '~/app/shared/enum/notification-type.enum';
 import { URLBuilderService } from '~/app/shared/services/url-builder.service';
 import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group-delete-guard-modal.component';
+import { NvmeofStateService } from '../nvmeof-state.service';
 
 const BASE_URL = 'block/nvmeof/gateways';
 
@@ -36,7 +44,9 @@ const BASE_URL = 'block/nvmeof/gateways';
   encapsulation: ViewEncapsulation.None,
   providers: [{ provide: URLBuilderService, useValue: new URLBuilderService(BASE_URL) }]
 })
-export class NvmeofGatewayGroupComponent implements OnInit {
+export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
+  private destroy$ = new Subject<void>();
+
   @ViewChild(TableComponent, { static: true })
   table: TableComponent;
 
@@ -63,6 +73,7 @@ export class NvmeofGatewayGroupComponent implements OnInit {
   gatewayGroupName: string;
   subsystemCount: number;
   gatewayCount: number;
+  private lastGroupCount = 0;
 
   viewUrl = `/${BASE_URL}/view`;
   icons = Icons;
@@ -79,7 +90,8 @@ export class NvmeofGatewayGroupComponent implements OnInit {
     public taskWrapper: TaskWrapperService,
     private notificationService: NotificationService,
     private urlBuilder: URLBuilderService,
-    private router: Router
+    private router: Router,
+    private nvmeofStateService: NvmeofStateService
   ) {}
 
   ngOnInit(): void {
@@ -172,9 +184,20 @@ export class NvmeofGatewayGroupComponent implements OnInit {
             return of([]);
           })
         )
-      )
+      ),
+      shareReplay({ bufferSize: 1, refCount: true }),
+      tap((groups) => {
+        const wasNonEmpty = this.lastGroupCount > 0;
+        this.lastGroupCount = groups.length;
+        if (wasNonEmpty && groups.length === 0) {
+          this.nvmeofStateService.requestRefresh();
+        }
+      })
     );
     this.checkNodesAvailability();
+    this.nvmeofStateService.refresh$
+      .pipe(takeUntil(this.destroy$))
+      .subscribe(() => this.fetchData());
   }
   fetchData(): void {
     this.subject.next([]);
@@ -240,17 +263,19 @@ export class NvmeofGatewayGroupComponent implements OnInit {
             call: this.cephServiceService.delete(serviceName)
           })
           .pipe(
-            map(() => {
-              this.table.refreshBtn();
+            tap({
+              complete: () => {
+                this.nvmeofStateService.requestRefresh();
+              }
             }),
             catchError((error) => {
-              this.table.refreshBtn();
               this.notificationService.show(
                 NotificationType.error,
                 $localize`${`Failed to delete gateway group ${selectedGroup.spec.group}: ${error.message}`}`
               );
               return of(null);
-            })
+            }),
+            finalize(() => this.table?.refreshBtn())
           );
       }
     });
@@ -299,4 +324,9 @@ export class NvmeofGatewayGroupComponent implements OnInit {
     }
     this.router.navigate([this.viewUrl, groupName]);
   }
+
+  ngOnDestroy(): void {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.ts
index 88d2d4f5fd5..3223e7a1c41 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.ts
@@ -44,8 +44,6 @@ export class NvmeofGatewayComponent implements OnInit, OnDestroy {
     this.route.queryParams.subscribe((params) => {
       if (params['tab'] && Object.values(TABS).includes(params['tab'])) {
         this.activeTab = params['tab'] as TABS;
-      } else {
-        this.activeTab = TABS.gateways;
       }
       this.breadcrumbService.setTabCrumb(TAB_LABELS[this.activeTab]);
     });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
index 79c82c3c4a2..38c5c2fc78c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
@@ -1,27 +1,6 @@
-<cd-nvmeof-tabs></cd-nvmeof-tabs>
-
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-<div cdsCol
-     [columnNumbers]="{sm: 4, md: 8}">
-  <div class="cds-mt-3 form-item"
-       cdsRow>
-    <cds-combo-box
-        type="single"
-        label="Selected Gateway Group"
-        i18n-label
-        [placeholder]="gwGroupPlaceholder"
-        [items]="gwGroups"
-        (selected)="onGroupSelection($event)"
-        (clear)="onGroupClear()"
-        [disabled]="gwGroupsEmpty">
-      <cds-dropdown-list></cds-dropdown-list>
-    </cds-combo-box>
-  </div>
-</div>
-</div>
+<cd-nvmeof-gateway-group-filter
+  (groupChange)="onGroupChange($event)">
+</cd-nvmeof-gateway-group-filter>
 
 <ng-container *ngIf="namespaces$ | async as namespaces">
   <cd-table [data]="namespaces"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
index 6ac05c63b69..f64b74416b9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
@@ -1,12 +1,13 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { HttpClientModule } from '@angular/common/http';
-import { CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';
-import { of } from 'rxjs';
+import { NO_ERRORS_SCHEMA } from '@angular/core';
+import { of, Subject } from 'rxjs';
 import { take } from 'rxjs/operators';
 import { RouterTestingModule } from '@angular/router/testing';
 import { SharedModule } from '~/app/shared/shared.module';
 
 import { NvmeofService } from '../../../shared/api/nvmeof.service';
+import { NvmeofStateService } from '../nvmeof-state.service';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
@@ -63,6 +64,11 @@ describe('NvmeofNamespacesListComponent', () => {
   let modalService: MockModalCdsService;
 
   beforeEach(async () => {
+    const nvmeofStateServiceMock = {
+      refresh$: new Subject<void>(),
+      requestRefresh: jest.fn()
+    };
+
     await TestBed.configureTestingModule({
       declarations: [NvmeofNamespacesListComponent, NvmeofSubsystemsDetailsComponent],
       imports: [HttpClientModule, RouterTestingModule, SharedModule],
@@ -70,9 +76,10 @@ describe('NvmeofNamespacesListComponent', () => {
         { provide: NvmeofService, useClass: MockNvmeOfService },
         { provide: AuthStorageService, useClass: MockAuthStorageService },
         { provide: ModalCdsService, useClass: MockModalCdsService },
-        { provide: TaskWrapperService, useClass: MockTaskWrapperService }
+        { provide: TaskWrapperService, useClass: MockTaskWrapperService },
+        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
       ],
-      schemas: [CUSTOM_ELEMENTS_SCHEMA]
+      schemas: [NO_ERRORS_SCHEMA]
     }).compileComponents();
 
     fixture = TestBed.createComponent(NvmeofNamespacesListComponent);
@@ -98,7 +105,7 @@ describe('NvmeofNamespacesListComponent', () => {
       );
       done();
     });
-    component.listNamespaces();
+    component.fetchData();
   });
 
   it('should open delete modal with correct data', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
index 37b1aa4d3a6..3217bc23cd8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
@@ -1,6 +1,6 @@
 import { Component, Input, NgZone, OnDestroy, OnInit, TemplateRef, ViewChild } from '@angular/core';
 import { ActivatedRoute, Router } from '@angular/router';
-import { NvmeofService, GroupsComboboxItem } from '~/app/shared/api/nvmeof.service';
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
 import { ActionLabelsI18n, URLVerbs } from '~/app/shared/constants/app.constants';
 import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impact.enum';
@@ -11,16 +11,14 @@ import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { NvmeofSubsystemNamespace } from '~/app/shared/models/nvmeof';
 import { Permission } from '~/app/shared/models/permissions';
-import { CephServiceSpec } from '~/app/shared/models/service.interface';
 import { DimlessBinaryPipe } from '~/app/shared/pipes/dimless-binary.pipe';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
+import { NvmeofStateService } from '../nvmeof-state.service';
 import { BehaviorSubject, Observable, of, Subject } from 'rxjs';
-import { catchError, map, switchMap, takeUntil } from 'rxjs/operators';
-
-const DEFAULT_PLACEHOLDER = $localize`Enter group name`;
+import { catchError, map, switchMap, takeUntil, tap } from 'rxjs/operators';
 
 @Component({
   selector: 'cd-nvmeof-namespaces-list',
@@ -42,11 +40,6 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
   namespaces$: Observable<NvmeofSubsystemNamespace[]>;
   private namespaceSubject = new BehaviorSubject<void>(undefined);
 
-  // Gateway group dropdown properties
-  gwGroups: GroupsComboboxItem[] = [];
-  gwGroupsEmpty: boolean = false;
-  gwGroupPlaceholder: string = DEFAULT_PLACEHOLDER;
-
   private destroy$ = new Subject<void>();
 
   constructor(
@@ -58,16 +51,13 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
     private authStorageService: AuthStorageService,
     private taskWrapper: TaskWrapperService,
     private nvmeofService: NvmeofService,
-    private dimlessBinaryPipe: DimlessBinaryPipe
+    private dimlessBinaryPipe: DimlessBinaryPipe,
+    private nvmeofStateService: NvmeofStateService
   ) {
     this.permission = this.authStorageService.getPermissions().nvmeof;
   }
 
   ngOnInit() {
-    this.route.queryParams.pipe(takeUntil(this.destroy$)).subscribe((params) => {
-      if (params?.['group']) this.onGroupSelection({ content: params?.['group'] });
-    });
-    this.setGatewayGroups();
     this.namespacesColumns = [
       {
         name: $localize`Namespace ID`,
@@ -166,78 +156,24 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
       }),
       takeUntil(this.destroy$)
     );
+    this.nvmeofStateService.refresh$
+      .pipe(takeUntil(this.destroy$))
+      .subscribe(() => this.fetchData());
+  }
+
+  onGroupChange(group: string | null): void {
+    this.group = group;
+    this.namespaceSubject.next();
   }
 
   updateSelection(selection: CdTableSelection) {
     this.selection = selection;
   }
 
-  listNamespaces() {
-    this.namespaceSubject.next();
-  }
-
   fetchData() {
     this.namespaceSubject.next();
   }
 
-  // Gateway groups methods
-  onGroupSelection(selected: GroupsComboboxItem) {
-    selected.selected = true;
-    this.group = selected.content;
-    this.listNamespaces();
-  }
-
-  onGroupClear() {
-    this.group = null;
-    this.listNamespaces();
-  }
-
-  setGatewayGroups() {
-    this.nvmeofService
-      .listGatewayGroups()
-      .pipe(takeUntil(this.destroy$))
-      .subscribe({
-        next: (response: CephServiceSpec[][]) => this.handleGatewayGroupsSuccess(response),
-        error: (error) => this.handleGatewayGroupsError(error)
-      });
-  }
-
-  handleGatewayGroupsSuccess(response: CephServiceSpec[][]) {
-    if (response?.[0]?.length) {
-      this.gwGroups = this.nvmeofService.formatGwGroupsList(response);
-    } else {
-      this.gwGroups = [];
-    }
-    this.updateGroupSelectionState();
-  }
-
-  updateGroupSelectionState() {
-    if (this.gwGroups.length) {
-      if (!this.group) {
-        this.onGroupSelection(this.gwGroups[0]);
-      } else {
-        this.gwGroups = this.gwGroups.map((g) => ({
-          ...g,
-          selected: g.content === this.group
-        }));
-      }
-      this.gwGroupsEmpty = false;
-      this.gwGroupPlaceholder = DEFAULT_PLACEHOLDER;
-    } else {
-      this.gwGroupsEmpty = true;
-      this.gwGroupPlaceholder = $localize`No groups available`;
-    }
-  }
-
-  handleGatewayGroupsError(error: any) {
-    this.gwGroups = [];
-    this.gwGroupsEmpty = true;
-    this.gwGroupPlaceholder = $localize`Unable to fetch Gateway groups`;
-    if (error?.preventDefault) {
-      error?.preventDefault?.();
-    }
-  }
-
   deleteNamespaceModal() {
     const namespace = this.selection.first();
     const subsystemNqn = namespace.ns_subsystem_nqn;
@@ -251,13 +187,15 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
         deletionMessage: $localize`Deleting the namespace <strong>${namespace.nsid}</strong> will permanently remove all resources, services, and configurations within it. This action cannot be undone.`
       },
       submitActionObservable: () =>
-        this.taskWrapper.wrapTaskAroundCall({
-          task: new FinishedTask('nvmeof/namespace/delete', {
-            nqn: subsystemNqn,
-            nsid: namespace.nsid
-          }),
-          call: this.nvmeofService.deleteNamespace(subsystemNqn, namespace.nsid, this.group)
-        })
+        this.taskWrapper
+          .wrapTaskAroundCall({
+            task: new FinishedTask('nvmeof/namespace/delete', {
+              nqn: subsystemNqn,
+              nsid: namespace.nsid
+            }),
+            call: this.nvmeofService.deleteNamespace(subsystemNqn, namespace.nsid, this.group)
+          })
+          .pipe(tap({ complete: () => this.nvmeofStateService.requestRefresh() }))
     });
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
new file mode 100644
index 00000000000..d4fb4f1b491
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
@@ -0,0 +1,57 @@
+<cd-productive-card>
+  <ng-template #header>
+    <div cdsStack="vertical"
+         [gap]="3">
+      <h2 class="cds--type-heading-03"
+          i18n>Recommended first-time setup</h2>
+      <p class="cds--type-body-01"
+         i18n>
+        Start your NVMe over Fabrics configuration by creating the essential resources in sequence.
+      </p>
+    </div>
+  </ng-template>
+
+  <div cdsStack="horizontal" [gap]="4">
+    <div>
+      <cd-setup-step-card
+        [stepNumber]="1"
+        [title]="cards.gateway.title"
+        [description]="cards.gateway.description"
+        [isConfigured]="hasGatewayGroups"
+        [successMessage]="cards.gateway.successMessage"
+        [infoMessage]="cards.gateway.infoMessage">
+      </cd-setup-step-card>
+    </div>
+
+    <div >
+      <cd-setup-step-card
+        [stepNumber]="2"
+        [title]="cards.subsystem.title"
+        [description]="cards.subsystem.description"
+        [isConfigured]="hasSubsystems"
+        [successMessage]="cards.subsystem.successMessage"
+        [infoMessage]="hasGatewayGroups ? cards.subsystem.infoMessage : gatewayPendingMessage">
+      </cd-setup-step-card>
+    </div>
+
+    <div >
+      <cd-setup-step-card
+        [stepNumber]="3"
+        [title]="cards.namespace.title"
+        [description]="cards.namespace.description"
+        [isConfigured]="hasNamespaces"
+        [successMessage]="cards.namespace.successMessage"
+        [infoMessage]="hasGatewayGroups ? cards.namespace.infoMessage : gatewayPendingMessage">
+      </cd-setup-step-card>
+    </div>
+  </div>
+
+  @if (isAllConfigured) {
+  <div class="nvmeof-setup-cards__completion">
+    <a cdsLink
+       class="cds--link--disabled"
+       aria-disabled="true"
+       i18n>Configuration complete. View status →</a>
+  </div>
+  }
+</cd-productive-card>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.scss
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts
new file mode 100644
index 00000000000..a41e9e24f0e
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts
@@ -0,0 +1,160 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { RouterModule } from '@angular/router';
+
+import { NvmeofSetupCardsComponent } from './nvmeof-setup-cards.component';
+
+describe('NvmeofSetupCardsComponent', () => {
+  let component: NvmeofSetupCardsComponent;
+  let fixture: ComponentFixture<NvmeofSetupCardsComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [NvmeofSetupCardsComponent, RouterModule.forRoot([])]
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(NvmeofSetupCardsComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should render 3 setup step cards', () => {
+    const cards = fixture.nativeElement.querySelectorAll('cd-setup-step-card');
+    expect(cards.length).toBe(3);
+  });
+
+  it('should not show completion link when isAllConfigured is false', () => {
+    component.isAllConfigured = false;
+    fixture.detectChanges();
+    const link = fixture.nativeElement.querySelector('.nvmeof-setup-cards__completion');
+    expect(link).toBeNull();
+  });
+
+  it('should show completion link when isAllConfigured is true', () => {
+    component.isAllConfigured = true;
+    fixture.detectChanges();
+    const link = fixture.nativeElement.querySelector('.nvmeof-setup-cards__completion');
+    expect(link).toBeTruthy();
+  });
+
+  describe('setup state', () => {
+    const getStepCards = () =>
+      fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+
+    it('should show gateway-only setup state when gateway exists but subsystems and namespaces do not', () => {
+      component.hasGatewayGroups = true;
+      component.hasSubsystems = false;
+      component.hasNamespaces = false;
+      fixture.detectChanges();
+
+      const cards = getStepCards();
+      expect(cards[0].componentInstance.statusMessage).toBe(
+        'Gateway group configured successfully.'
+      );
+      expect(cards[1].componentInstance.statusMessage).toBe(
+        'No subsystem configured for this cluster yet.'
+      );
+      expect(cards[2].componentInstance.statusMessage).toBe(
+        'No namespace allocated or mapped yet.'
+      );
+    });
+
+    it('should show subsystem-complete setup state when gateway and subsystem exist', () => {
+      component.hasGatewayGroups = true;
+      component.hasSubsystems = true;
+      component.hasNamespaces = false;
+      fixture.detectChanges();
+
+      const cards = getStepCards();
+      expect(cards[0].componentInstance.statusMessage).toBe(
+        'Gateway group configured successfully.'
+      );
+      expect(cards[1].componentInstance.statusMessage).toBe('Subsystem configured successfully.');
+      expect(cards[2].componentInstance.statusMessage).toBe(
+        'No namespace allocated or mapped yet.'
+      );
+    });
+  });
+
+  it('should display "No gateway configured yet." on step 2 and 3 when hasGatewayGroups is false', () => {
+    component.hasGatewayGroups = false;
+    component.hasSubsystems = false;
+    component.hasNamespaces = false;
+    fixture.detectChanges();
+
+    const cardElements = fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+    const subsystemCard = cardElements[1].componentInstance;
+    const namespaceCard = cardElements[2].componentInstance;
+
+    expect(subsystemCard.statusMessage).toBe('No gateway configured yet.');
+    expect(namespaceCard.statusMessage).toBe('No gateway configured yet.');
+  });
+
+  it('should display original info messages when hasGatewayGroups is true', () => {
+    component.hasGatewayGroups = true;
+    component.hasSubsystems = false;
+    component.hasNamespaces = false;
+    fixture.detectChanges();
+
+    const cardElements = fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+    const subsystemCard = cardElements[1].componentInstance;
+    const namespaceCard = cardElements[2].componentInstance;
+
+    expect(subsystemCard.statusMessage).toBe('No subsystem configured for this cluster yet.');
+    expect(namespaceCard.statusMessage).toBe('No namespace allocated or mapped yet.');
+  });
+
+  it('should display gateway info message when hasGatewayGroups is false', () => {
+    component.hasGatewayGroups = false;
+    fixture.detectChanges();
+
+    const gatewayCard = fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card')[0]
+      .componentInstance;
+
+    expect(gatewayCard.statusMessage).toBe('No gateway groups configured for this cluster yet.');
+  });
+
+  it('should display success messages when all setup steps are configured', () => {
+    component.hasGatewayGroups = true;
+    component.hasSubsystems = true;
+    component.hasNamespaces = true;
+    fixture.detectChanges();
+
+    const cardElements = fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+
+    expect(cardElements[0].componentInstance.statusMessage).toBe(
+      'Gateway group configured successfully.'
+    );
+    expect(cardElements[1].componentInstance.statusMessage).toBe(
+      'Subsystem configured successfully.'
+    );
+    expect(cardElements[2].componentInstance.statusMessage).toBe('Namespaces mapped successfully.');
+  });
+
+  it('should update all step messages when gateway groups are removed after full configuration', () => {
+    component.hasGatewayGroups = true;
+    component.hasSubsystems = true;
+    component.hasNamespaces = true;
+    fixture.detectChanges();
+
+    const getCards = () => fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+
+    expect(getCards()[0].componentInstance.statusMessage).toBe(
+      'Gateway group configured successfully.'
+    );
+
+    component.hasGatewayGroups = false;
+    component.hasSubsystems = false;
+    component.hasNamespaces = false;
+    fixture.detectChanges();
+
+    expect(getCards()[0].componentInstance.statusMessage).toBe(
+      'No gateway groups configured for this cluster yet.'
+    );
+    expect(getCards()[1].componentInstance.statusMessage).toBe('No gateway configured yet.');
+    expect(getCards()[2].componentInstance.statusMessage).toBe('No gateway configured yet.');
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts
new file mode 100644
index 00000000000..9dc9100fa90
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts
@@ -0,0 +1,53 @@
+import { CommonModule } from '@angular/common';
+import { Component, Input, ViewEncapsulation } from '@angular/core';
+import { RouterModule } from '@angular/router';
+import { LayoutModule, LayerModule, LinkModule, TilesModule } from 'carbon-components-angular';
+import { ProductiveCardComponent } from '~/app/shared/components/productive-card/productive-card.component';
+import { SetupStepCardComponent } from '~/app/shared/components/setup-step-card/setup-step-card.component';
+
+@Component({
+  selector: 'cd-nvmeof-setup-cards',
+  templateUrl: './nvmeof-setup-cards.component.html',
+  styleUrls: ['./nvmeof-setup-cards.component.scss'],
+  standalone: true,
+  encapsulation: ViewEncapsulation.None,
+  imports: [
+    CommonModule,
+    RouterModule,
+    LayoutModule,
+    LayerModule,
+    TilesModule,
+    LinkModule,
+    ProductiveCardComponent,
+    SetupStepCardComponent
+  ]
+})
+export class NvmeofSetupCardsComponent {
+  @Input() hasGatewayGroups = false;
+  @Input() hasSubsystems = false;
+  @Input() hasNamespaces = false;
+  @Input() isAllConfigured = false;
+
+  readonly gatewayPendingMessage = $localize`No gateway configured yet.`;
+
+  readonly cards = {
+    gateway: {
+      title: $localize`Create Gateway groups`,
+      description: $localize`Group NVMe gateway nodes to enable high availability and load balancing for storage targets.`,
+      successMessage: $localize`Gateway group configured successfully.`,
+      infoMessage: $localize`No gateway groups configured for this cluster yet.`
+    },
+    subsystem: {
+      title: $localize`Create Subsystems`,
+      description: $localize`Define storage targets by creating NVMe subsystems and configuring security, listeners, and host access.`,
+      successMessage: $localize`Subsystem configured successfully.`,
+      infoMessage: $localize`No subsystem configured for this cluster yet.`
+    },
+    namespace: {
+      title: $localize`Create Namespaces`,
+      description: $localize`Create storage namespaces backed by Ceph block images. This completes your NVMe over Fabrics setup.`,
+      successMessage: $localize`Namespaces mapped successfully.`,
+      infoMessage: $localize`No namespace allocated or mapped yet.`
+    }
+  };
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.spec.ts
new file mode 100644
index 00000000000..ccdd04dcd25
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.spec.ts
@@ -0,0 +1,187 @@
+import { TestBed } from '@angular/core/testing';
+
+import { Subject } from 'rxjs';
+
+import { NvmeofStateService } from './nvmeof-state.service';
+import { SummaryService } from '~/app/shared/services/summary.service';
+
+describe('NvmeofStateService', () => {
+  let service: NvmeofStateService;
+  let summaryData$: Subject<any>;
+  let summaryServiceSpy: any;
+
+  const emitSummary = (tasks: any[]) => summaryData$.next({ finished_tasks: tasks });
+
+  beforeEach(() => {
+    summaryData$ = new Subject<any>();
+    summaryServiceSpy = {
+      subscribe: jest.fn().mockImplementation((callback: (s: any) => void) => {
+        return summaryData$.subscribe(callback);
+      })
+    };
+
+    TestBed.configureTestingModule({
+      providers: [NvmeofStateService, { provide: SummaryService, useValue: summaryServiceSpy }]
+    });
+
+    service = TestBed.inject(NvmeofStateService);
+  });
+
+  it('should create', () => {
+    expect(service).toBeTruthy();
+  });
+
+  it('should emit refresh$ when requestRefresh is called', (done) => {
+    service.refresh$.subscribe(() => done());
+    service.requestRefresh();
+  });
+
+  it('should not emit refresh$ on the first summary update (initialization baseline)', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([
+      {
+        name: 'service/delete',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { service_name: 'nvmeof.rbd.default' }
+      }
+    ]);
+
+    expect(refreshSpy).not.toHaveBeenCalled();
+  });
+
+  it('should emit refresh$ when a new NVMe service/delete task appears', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([
+      {
+        name: 'service/delete',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { service_name: 'nvmeof.rbd.default' }
+      }
+    ]);
+
+    expect(refreshSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should emit refresh$ when a new NVMe service/create task appears', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([
+      {
+        name: 'service/create',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { service_name: 'nvmeof.rbd.default' }
+      }
+    ]);
+
+    expect(refreshSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should emit refresh$ when a nvmeof/subsystem/delete task appears', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([
+      {
+        name: 'nvmeof/subsystem/delete',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { nqn: 'sub1' }
+      }
+    ]);
+
+    expect(refreshSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should emit refresh$ when a nvmeof/namespace/create task appears', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([
+      {
+        name: 'nvmeof/namespace/create',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { nqn: 'sub1' }
+      }
+    ]);
+
+    expect(refreshSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should emit refresh$ when a nvmeof/namespace/delete task appears', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([
+      {
+        name: 'nvmeof/namespace/delete',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { nsid: 1, nqn: 'sub1' }
+      }
+    ]);
+
+    expect(refreshSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should not emit refresh$ for non-NVMe tasks', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([{ name: 'rbd/create', begin_time: '2026-01-01T00:00:00Z', metadata: {} }]);
+
+    expect(refreshSpy).not.toHaveBeenCalled();
+  });
+
+  it('should not emit refresh$ for service/delete of a non-NVMe service', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    emitSummary([]); // init
+    emitSummary([
+      {
+        name: 'service/delete',
+        begin_time: '2026-01-01T00:00:00Z',
+        metadata: { service_name: 'rbd.default' }
+      }
+    ]);
+
+    expect(refreshSpy).not.toHaveBeenCalled();
+  });
+
+  it('should not emit refresh$ for the same task appearing again', () => {
+    const refreshSpy = jest.fn();
+    service.refresh$.subscribe(refreshSpy);
+
+    const task = {
+      name: 'service/delete',
+      begin_time: '2026-01-01T00:00:00Z',
+      metadata: { service_name: 'nvmeof.rbd.default' }
+    };
+
+    emitSummary([]); // init
+    emitSummary([task]); // new task — emits once
+    emitSummary([task]); // same task — no second emit
+
+    expect(refreshSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('should unsubscribe from SummaryService on destroy', () => {
+    const unsubscribeSpy = jest.fn();
+    const mockSubscription = { unsubscribe: unsubscribeSpy };
+    summaryServiceSpy.subscribe.mockReturnValueOnce(mockSubscription);
+
+    const freshService = new NvmeofStateService(summaryServiceSpy as any);
+    freshService.ngOnDestroy();
+
+    expect(unsubscribeSpy).toHaveBeenCalled();
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.ts
new file mode 100644
index 00000000000..c8343a29f9b
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-state.service.ts
@@ -0,0 +1,95 @@
+import { Injectable, OnDestroy } from '@angular/core';
+
+import { merge, Subject, Subscription } from 'rxjs';
+
+import { FinishedTask } from '~/app/shared/models/finished-task';
+import { Summary } from '~/app/shared/models/summary.model';
+import { SummaryService } from '~/app/shared/services/summary.service';
+
+/**
+ * Provides a unified refresh$ stream for NVMe-oF UI components to react to
+ * task completions and explicit refresh requests.
+ *
+ * A dedicated service is used instead of reusing TaskListService because
+ * TaskListService is tightly coupled to the task-list UI component and does
+ * not expose a clean observable suitable for driving side-effects such as
+ * setup-card state reloads.
+ *
+ * This service is provided at the NvmeofTabsComponent level to ensure
+ * subscriptions are properly destroyed when navigating away from nvmeof pages.
+ */
+@Injectable()
+export class NvmeofStateService implements OnDestroy {
+  private readonly explicitRefreshSource = new Subject<void>();
+  private readonly taskRefreshSource = new Subject<void>();
+  private summarySubscription: Subscription;
+  private seenTaskSignatures = new Set<string>();
+  private summaryInitialized = false;
+
+  readonly refresh$ = merge(
+    this.explicitRefreshSource.asObservable(),
+    this.taskRefreshSource.asObservable()
+  );
+
+  constructor(private summaryService: SummaryService) {
+    this.summarySubscription = this.summaryService.subscribe((summary: Summary) => {
+      const nvmeTasks = (summary?.finished_tasks ?? []).filter((task: FinishedTask) =>
+        this.isNvmeTask(task)
+      );
+      const currentSignatures = new Set(
+        nvmeTasks.map((task: FinishedTask) => this.getTaskSignature(task))
+      );
+
+      if (!this.summaryInitialized) {
+        this.summaryInitialized = true;
+        this.seenTaskSignatures = currentSignatures;
+        return;
+      }
+
+      const hasNewTask = [...currentSignatures].some(
+        (taskSignature) => !this.seenTaskSignatures.has(taskSignature)
+      );
+      this.seenTaskSignatures = currentSignatures;
+
+      if (hasNewTask) {
+        this.taskRefreshSource.next();
+      }
+    });
+  }
+
+  ngOnDestroy(): void {
+    this.summarySubscription?.unsubscribe();
+  }
+
+  requestRefresh(): void {
+    this.explicitRefreshSource.next();
+  }
+
+  private isNvmeTask(task: FinishedTask): boolean {
+    if (!task?.name) {
+      return false;
+    }
+
+    if (task.name === 'service/create' || task.name === 'service/delete') {
+      const serviceName = task.metadata?.['service_name'];
+      return typeof serviceName === 'string' && serviceName.startsWith('nvmeof.');
+    }
+
+    return [
+      'nvmeof/gateway/create',
+      'nvmeof/gateway/delete',
+      'nvmeof/subsystem/create',
+      'nvmeof/subsystem/delete',
+      'nvmeof/namespace/create',
+      'nvmeof/namespace/delete'
+    ].includes(task.name);
+  }
+
+  private getTaskSignature(task: FinishedTask): string {
+    return JSON.stringify({
+      name: task.name,
+      begin_time: task.begin_time,
+      metadata: task.metadata
+    });
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts
index 68927708547..57fa67a8b89 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts
@@ -2,10 +2,11 @@ import { ComponentFixture, TestBed, fakeAsync, tick } from '@angular/core/testin
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { RouterTestingModule } from '@angular/router/testing';
 import { ActivatedRoute } from '@angular/router';
-import { of } from 'rxjs';
+import { of, Subject } from 'rxjs';
 
 import { NvmeofSubsystemNamespacesListComponent } from './nvmeof-subsystem-namespaces-list.component';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
+import { NvmeofStateService } from '../nvmeof-state.service';
 import { SharedModule } from '~/app/shared/shared.module';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 
@@ -42,6 +43,11 @@ describe('NvmeofSubsystemNamespacesListComponent', () => {
   }
 
   beforeEach(async () => {
+    const nvmeofStateServiceMock = {
+      refresh$: new Subject<void>(),
+      requestRefresh: jest.fn()
+    };
+
     await TestBed.configureTestingModule({
       declarations: [NvmeofSubsystemNamespacesListComponent],
       imports: [HttpClientTestingModule, RouterTestingModule, SharedModule],
@@ -61,7 +67,8 @@ describe('NvmeofSubsystemNamespacesListComponent', () => {
             listNamespaces: jest.fn().mockReturnValue(of(mockNamespaces))
           }
         },
-        { provide: AuthStorageService, useClass: MockAuthStorageService }
+        { provide: AuthStorageService, useClass: MockAuthStorageService },
+        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
       ]
     }).compileComponents();
   });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.ts
index 852f0a006d8..fe8e6591d66 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.ts
@@ -14,8 +14,9 @@ import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
+import { NvmeofStateService } from '../nvmeof-state.service';
 import { combineLatest, Subject } from 'rxjs';
-import { takeUntil } from 'rxjs/operators';
+import { catchError, takeUntil, tap } from 'rxjs/operators';
 
 @Component({
   selector: 'cd-nvmeof-subsystem-namespaces-list',
@@ -35,7 +36,6 @@ export class NvmeofSubsystemNamespacesListComponent implements OnInit, OnDestroy
   private destroy$ = new Subject<void>();
 
   constructor(
-    // ... constructor stays mostly same
     public actionLabels: ActionLabelsI18n,
     private router: Router,
     private modalService: ModalCdsService,
@@ -44,7 +44,8 @@ export class NvmeofSubsystemNamespacesListComponent implements OnInit, OnDestroy
     private nvmeofService: NvmeofService,
     private dimlessBinaryPipe: DimlessBinaryPipe,
     private iopsPipe: IopsPipe,
-    private route: ActivatedRoute
+    private route: ActivatedRoute,
+    private nvmeofStateService: NvmeofStateService
   ) {
     this.permission = this.authStorageService.getPermissions().nvmeof;
   }
@@ -155,7 +156,13 @@ export class NvmeofSubsystemNamespacesListComponent implements OnInit, OnDestroy
     if (this.group) {
       this.nvmeofService
         .listNamespaces(this.group, this.subsystemNQN)
-        .pipe(takeUntil(this.destroy$))
+        .pipe(
+          catchError(() => {
+            this.namespaces = [];
+            return [];
+          }),
+          takeUntil(this.destroy$)
+        )
         .subscribe((res: NvmeofSubsystemNamespace[]) => {
           this.namespaces = res || [];
         });
@@ -171,13 +178,15 @@ export class NvmeofSubsystemNamespacesListComponent implements OnInit, OnDestroy
       itemNames: [namespace.nsid],
       actionDescription: 'delete',
       submitActionObservable: () =>
-        this.taskWrapper.wrapTaskAroundCall({
-          task: new FinishedTask('nvmeof/namespace/delete', {
-            nqn: this.subsystemNQN,
-            nsid: namespace.nsid
-          }),
-          call: this.nvmeofService.deleteNamespace(this.subsystemNQN, namespace.nsid, this.group)
-        })
+        this.taskWrapper
+          .wrapTaskAroundCall({
+            task: new FinishedTask('nvmeof/namespace/delete', {
+              nqn: this.subsystemNQN,
+              nsid: namespace.nsid
+            }),
+            call: this.nvmeofService.deleteNamespace(this.subsystemNQN, namespace.nsid, this.group)
+          })
+          .pipe(tap({ complete: () => this.nvmeofStateService.requestRefresh() }))
     });
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
index 3111ae2e8d4..aef098c0d86 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
@@ -1,27 +1,7 @@
-<cd-nvmeof-tabs></cd-nvmeof-tabs>
+<cd-nvmeof-gateway-group-filter
+  (groupChange)="onGroupChange($event)">
+</cd-nvmeof-gateway-group-filter>
 
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-<div cdsCol
-     [columnNumbers]="{sm: 4, md: 8}">
-  <div class="cds-mt-3 form-item"
-       cdsRow>
-    <cds-combo-box
-        type="single"
-        label="Selected Gateway Group"
-        i18n-label
-        [placeholder]="gwGroupPlaceholder"
-        [items]="gwGroups"
-        (selected)="onGroupSelection($event)"
-        (clear)="onGroupClear()"
-        [disabled]="gwGroupsEmpty">
-      <cds-dropdown-list></cds-dropdown-list>
-    </cds-combo-box>
-  </div>
-</div>
-</div>
 <ng-container *ngIf="subsystems$ | async as subsystems">
   <cd-table #table
             [data]="subsystems"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
index a3532ec1e12..f848d67c66e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
@@ -1,6 +1,8 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { HttpClientModule } from '@angular/common/http';
-import { of } from 'rxjs';
+import { ActivatedRoute, Router } from '@angular/router';
+import { BehaviorSubject, of, Subject } from 'rxjs';
+import { skip, take } from 'rxjs/operators';
 import { RouterTestingModule } from '@angular/router/testing';
 import { SharedModule } from '~/app/shared/shared.module';
 
@@ -10,8 +12,9 @@ import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { NvmeofSubsystemsComponent } from './nvmeof-subsystems.component';
 import { NvmeofSubsystemsDetailsComponent } from '../nvmeof-subsystems-details/nvmeof-subsystems-details.component';
+import { NvmeofGatewayGroupFilterComponent } from '../nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component';
 import { ComboBoxModule, GridModule } from 'carbon-components-angular';
-import { CephServiceSpec } from '~/app/shared/models/service.interface';
+import { NvmeofStateService } from '../nvmeof-state.service';
 
 const mockSubsystems = [
   {
@@ -27,38 +30,27 @@ const mockSubsystems = [
   }
 ];
 
-const mockGroups = [
-  [
-    {
-      service_name: 'nvmeof.rbd.default',
-      service_type: 'nvmeof',
-      unmanaged: false,
-      spec: {
-        group: 'default'
-      }
-    },
-    {
-      service_name: 'nvmeof.rbd.foo',
-      service_type: 'nvmeof',
-      unmanaged: false,
-      spec: {
-        group: 'foo'
-      }
-    }
-  ],
-  2
-];
-
-const mockformattedGwGroups = [
-  {
-    content: 'default'
-  },
-  {
-    content: 'foo'
-  }
-];
-
 class MockNvmeOfService {
+  listGatewayGroups() {
+    return of([
+      [
+        {
+          service_name: 'nvmeof.default',
+          service_type: 'nvmeof',
+          service_id: 'default',
+          spec: { group: 'default' }
+        }
+      ]
+    ]);
+  }
+
+  formatGwGroupsList(response: any) {
+    return (response?.[0] || []).map((g: any) => ({
+      content: g.spec.group,
+      selected: false
+    }));
+  }
+
   listSubsystems() {
     return of(mockSubsystems);
   }
@@ -66,14 +58,6 @@ class MockNvmeOfService {
   getInitiators() {
     return of([]);
   }
-
-  formatGwGroupsList(_data: CephServiceSpec[][]) {
-    return mockformattedGwGroups;
-  }
-
-  listGatewayGroups() {
-    return of(mockGroups);
-  }
 }
 
 class MockAuthStorageService {
@@ -89,21 +73,55 @@ class MockTaskWrapperService {}
 describe('NvmeofSubsystemsComponent', () => {
   let component: NvmeofSubsystemsComponent;
   let fixture: ComponentFixture<NvmeofSubsystemsComponent>;
+  let nvmeofService: MockNvmeOfService;
+  let queryParams$: BehaviorSubject<Record<string, string>>;
+  const activatedRouteMock = {
+    queryParams: null as any,
+    snapshot: { queryParams: {} as Record<string, string> }
+  };
 
   beforeEach(async () => {
+    queryParams$ = new BehaviorSubject<Record<string, string>>({});
+    activatedRouteMock.queryParams = queryParams$.asObservable();
+    activatedRouteMock.snapshot.queryParams = queryParams$.value;
+
+    const nvmeofStateServiceMock = {
+      refresh$: new Subject<void>(),
+      requestRefresh: jest.fn()
+    };
+
     await TestBed.configureTestingModule({
       declarations: [NvmeofSubsystemsComponent, NvmeofSubsystemsDetailsComponent],
-      imports: [HttpClientModule, RouterTestingModule, SharedModule, ComboBoxModule, GridModule],
+      imports: [
+        HttpClientModule,
+        RouterTestingModule,
+        SharedModule,
+        ComboBoxModule,
+        GridModule,
+        NvmeofGatewayGroupFilterComponent
+      ],
       providers: [
         { provide: NvmeofService, useClass: MockNvmeOfService },
         { provide: AuthStorageService, useClass: MockAuthStorageService },
         { provide: ModalCdsService, useClass: MockModalService },
-        { provide: TaskWrapperService, useClass: MockTaskWrapperService }
+        { provide: TaskWrapperService, useClass: MockTaskWrapperService },
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
       ]
     }).compileComponents();
 
+    const router = TestBed.inject(Router);
+    jest.spyOn(router, 'navigate').mockImplementation((_commands, extras?) => {
+      const group = extras?.queryParams?.['group'];
+      const params = group ? { group: String(group) } : {};
+      activatedRouteMock.snapshot.queryParams = params;
+      queryParams$.next(params);
+      return Promise.resolve(true);
+    });
+
     fixture = TestBed.createComponent(NvmeofSubsystemsComponent);
     component = fixture.componentInstance;
+    nvmeofService = TestBed.inject(NvmeofService) as any;
     component.ngOnInit();
     fixture.detectChanges();
   });
@@ -115,22 +133,31 @@ describe('NvmeofSubsystemsComponent', () => {
   it('should retrieve subsystems', (done) => {
     const expected = mockSubsystems.map((s) => ({
       ...s,
-      gw_group: component.group,
+      gw_group: 'default',
       auth: 'No authentication',
       initiator_count: 0
     }));
-    component.subsystems$.subscribe((subsystems) => {
+    component.onGroupChange('default');
+    component.subsystems$.pipe(skip(1), take(1)).subscribe((subsystems) => {
       expect(subsystems).toEqual(expected);
       done();
     });
-    component.getSubsystems();
+    component.fetchData();
   });
 
-  it('should load gateway groups correctly', () => {
-    expect(component.gwGroups.length).toBe(2);
+  it('should not fetch subsystems when group is not selected', (done) => {
+    const listSubsystemsSpy = jest.spyOn(nvmeofService, 'listSubsystems');
+    component.group = null;
+    component.fetchData();
+
+    component.subsystems$.pipe(take(1)).subscribe((subsystems) => {
+      expect(subsystems).toEqual([]);
+      expect(listSubsystemsSpy).not.toHaveBeenCalled();
+      done();
+    });
   });
 
   it('should set first group as default initially', () => {
-    expect(component.group).toBe(mockGroups[0][0].spec.group);
+    expect(component.group).toBe('default');
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
index 85590b314b5..cc2467f0652 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
@@ -1,5 +1,5 @@
 import { Component, OnDestroy, OnInit, TemplateRef, ViewChild } from '@angular/core';
-import { ActivatedRoute, Router } from '@angular/router';
+import { Router } from '@angular/router';
 import { ActionLabelsI18n, URLVerbs } from '~/app/shared/constants/app.constants';
 import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 import {
@@ -18,15 +18,14 @@ import { Icons } from '~/app/shared/enum/icons.enum';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
-import { NvmeofService, GroupsComboboxItem } from '~/app/shared/api/nvmeof.service';
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
-import { CephServiceSpec } from '~/app/shared/models/service.interface';
+import { NvmeofStateService } from '../nvmeof-state.service';
 import { BehaviorSubject, forkJoin, Observable, of, Subject } from 'rxjs';
 import { catchError, map, switchMap, takeUntil, tap } from 'rxjs/operators';
 import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impact.enum';
 
 const BASE_URL = 'block/nvmeof/subsystems';
-const DEFAULT_PLACEHOLDER = $localize`Enter group name`;
 
 @Component({
   selector: 'cd-nvmeof-subsystems',
@@ -55,10 +54,7 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
   tableActions: CdTableAction[];
   subsystemDetails: any[];
   context: CdTableFetchDataContext;
-  gwGroups: GroupsComboboxItem[] = [];
   group: string = null;
-  gwGroupsEmpty: boolean = false;
-  gwGroupPlaceholder: string = DEFAULT_PLACEHOLDER;
   authType = NvmeofSubsystemAuthType;
   subsystems$: Observable<(NvmeofSubsystem & { gw_group?: string; initiator_count?: number })[]>;
   private subsystemSubject = new BehaviorSubject<void>(undefined);
@@ -70,19 +66,15 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
     private authStorageService: AuthStorageService,
     public actionLabels: ActionLabelsI18n,
     private router: Router,
-    private route: ActivatedRoute,
     private modalService: ModalCdsService,
-    private taskWrapper: TaskWrapperService
+    private taskWrapper: TaskWrapperService,
+    private nvmeofStateService: NvmeofStateService
   ) {
     super();
     this.permissions = this.authStorageService.getPermissions();
   }
 
   ngOnInit() {
-    this.route.queryParams.pipe(takeUntil(this.destroy$)).subscribe((params) => {
-      if (params?.['group']) this.onGroupSelection({ content: params?.['group'] });
-    });
-    this.setGatewayGroups();
     this.subsystemsColumns = [
       {
         name: $localize`Subsystem NQN`,
@@ -152,16 +144,20 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
       }),
       takeUntil(this.destroy$)
     );
+    this.nvmeofStateService.refresh$
+      .pipe(takeUntil(this.destroy$))
+      .subscribe(() => this.fetchData());
+  }
+
+  onGroupChange(group: string | null): void {
+    this.group = group;
+    this.subsystemSubject.next();
   }
 
   updateSelection(selection: CdTableSelection) {
     this.selection = selection;
   }
 
-  getSubsystems() {
-    this.subsystemSubject.next();
-  }
-
   fetchData() {
     this.subsystemSubject.next();
   }
@@ -179,68 +175,15 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
         forceDeleteAcknowledgementMessage: $localize`I understand this may remove resources still attached to this subsystem.`
       },
       submitActionObservable: () =>
-        this.taskWrapper.wrapTaskAroundCall({
-          task: new FinishedTask('nvmeof/subsystem/delete', { nqn: subsystem.nqn }),
-          call: this.nvmeofService.deleteSubsystem(subsystem.nqn, this.group)
-        })
+        this.taskWrapper
+          .wrapTaskAroundCall({
+            task: new FinishedTask('nvmeof/subsystem/delete', { nqn: subsystem.nqn }),
+            call: this.nvmeofService.deleteSubsystem(subsystem.nqn, this.group)
+          })
+          .pipe(tap({ complete: () => this.nvmeofStateService.requestRefresh() }))
     });
   }
 
-  onGroupSelection(selected: GroupsComboboxItem) {
-    selected.selected = true;
-    this.group = selected.content;
-    this.getSubsystems();
-  }
-
-  onGroupClear() {
-    this.group = null;
-    this.getSubsystems();
-  }
-
-  setGatewayGroups() {
-    this.nvmeofService
-      .listGatewayGroups()
-      .pipe(takeUntil(this.destroy$))
-      .subscribe({
-        next: (response: CephServiceSpec[][]) => this.handleGatewayGroupsSuccess(response),
-        error: (error) => this.handleGatewayGroupsError(error)
-      });
-  }
-
-  handleGatewayGroupsSuccess(response: CephServiceSpec[][]) {
-    if (response?.[0]?.length) {
-      this.gwGroups = this.nvmeofService.formatGwGroupsList(response);
-    } else {
-      this.gwGroups = [];
-    }
-    this.updateGroupSelectionState();
-  }
-
-  updateGroupSelectionState() {
-    if (this.gwGroups.length) {
-      this.gwGroupsEmpty = false;
-      this.gwGroupPlaceholder = DEFAULT_PLACEHOLDER;
-      if (!this.group) {
-        this.onGroupSelection(this.gwGroups[0]);
-      } else {
-        this.gwGroups = this.gwGroups.map((g) => ({
-          ...g,
-          selected: g.content === this.group
-        }));
-      }
-    } else {
-      this.gwGroupsEmpty = true;
-      this.gwGroupPlaceholder = $localize`No groups available`;
-    }
-  }
-
-  handleGatewayGroupsError(error: any) {
-    this.gwGroups = [];
-    this.gwGroupsEmpty = true;
-    this.gwGroupPlaceholder = $localize`Unable to fetch Gateway groups`;
-    this.handleError(error);
-  }
-
   private handleError(error: any): void {
     if (error?.preventDefault) {
       error?.preventDefault?.();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html
index 9b3388838d5..a4f9f1e5241 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html
@@ -1,31 +1,45 @@
-<fieldset>
-  <legend>
-    <h1 class="cds--type-heading-03">NVMe over Fabrics (TCP)</h1>
-  <cd-help-text>Monitor and manage NVMe-over-TCP resources for high-performance block storage.</cd-help-text>
-  </legend>
-</fieldset>
-<section>
-  <cds-tabs type="contained"
-            followFocus="true"
-            isNavigation="true"
-            [cacheActive]="false">
-  <cds-tab
-    heading="Gateways"
-    i18n-heading
-    [active]="activeTab === Tabs.gateways"
-    (selected)="onSelected(Tabs.gateways)">
-  </cds-tab>
-  <cds-tab
-    heading="Subsystems"
-    i18n-heading
-    [active]="activeTab === Tabs.subsystems"
-    (selected)="onSelected(Tabs.subsystems)">
-  </cds-tab>
-  <cds-tab
-    heading="Namespaces"
-    i18n-heading
-    [active]="activeTab === Tabs.namespaces"
-    (selected)="onSelected(Tabs.namespaces)">
-  </cds-tab>
-</cds-tabs>
-</section>
+@if (showTabsShell) {
+  <fieldset>
+    <legend class="cds-mb-5">
+      <h1 class="cds--type-heading-04">NVMe over Fabrics (TCP)</h1>
+      <p class="cds--type-body-01" i18n>Monitor and manage NVMe-over-TCP resources for high-performance block storage.</p>
+    </legend>
+  </fieldset>
+
+  @if (showSetupCards) {
+  <cd-nvmeof-setup-cards
+                         [hasGatewayGroups]="hasGatewayGroups"
+                         [hasSubsystems]="hasSubsystems"
+                         [hasNamespaces]="hasNamespaces"
+                         [isAllConfigured]="isAllConfigured">
+  </cd-nvmeof-setup-cards>
+  }
+
+  <section class="cds-mt-5">
+    <cds-tabs type="contained"
+              followFocus="true"
+              isNavigation="true"
+              [cacheActive]="false">
+    <cds-tab
+      heading="Gateways"
+      i18n-heading
+      [active]="activeTab === Tabs.gateways"
+      (selected)="onSelected(Tabs.gateways)">
+    </cds-tab>
+    <cds-tab
+      heading="Subsystems"
+      i18n-heading
+      [active]="activeTab === Tabs.subsystems"
+      (selected)="onSelected(Tabs.subsystems)">
+    </cds-tab>
+    <cds-tab
+      heading="Namespaces"
+      i18n-heading
+      [active]="activeTab === Tabs.namespaces"
+      (selected)="onSelected(Tabs.namespaces)">
+    </cds-tab>
+  </cds-tabs>
+  </section>
+}
+
+<router-outlet></router-outlet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts
index cdd1ea2e9cf..b97da033c23 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts
@@ -1,26 +1,79 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
-import { Router } from '@angular/router';
+import { ActivatedRoute, Event as RouterEvent, NavigationEnd, Router } from '@angular/router';
 import { RouterTestingModule } from '@angular/router/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { BehaviorSubject, Subject, of } from 'rxjs';
 
 import { TabsModule } from 'carbon-components-angular';
 
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
+import { NvmeofStateService } from '../nvmeof-state.service';
 import { NvmeofTabsComponent } from './nvmeof-tabs.component';
 import { SharedModule } from '~/app/shared/shared.module';
+import { NvmeofSetupCardsComponent } from '../nvmeof-setup-cards/nvmeof-setup-cards.component';
+
+type SetupState = {
+  hasGatewayGroups: boolean;
+  hasSubsystems: boolean;
+  hasNamespaces: boolean;
+};
 
 describe('NvmeofTabsComponent', () => {
   let component: NvmeofTabsComponent;
   let fixture: ComponentFixture<NvmeofTabsComponent>;
   let router: Router;
+  let nvmeofServiceSpy: any;
+  let queryParams$: BehaviorSubject<any>;
+  let refresh$: Subject<void>;
+  let routerEvents$: Subject<RouterEvent>;
+  let currentSetupState: SetupState;
+
+  const setQueryParams = (params: any) => queryParams$.next(params);
+  const emitRefresh = () => refresh$.next();
+  const setSetupState = (state: SetupState) => {
+    currentSetupState = state;
+    nvmeofServiceSpy.fetchSetupState.mockReturnValue(of(currentSetupState));
+  };
 
   beforeEach(async () => {
-    await TestBed.configureTestingModule({
+    queryParams$ = new BehaviorSubject<any>({ group: 'grp1' });
+    refresh$ = new Subject<void>();
+    const nvmeofStateServiceMock = {
+      refresh$: refresh$.asObservable()
+    };
+    currentSetupState = { hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true };
+    nvmeofServiceSpy = {
+      fetchSetupState: jest.fn().mockImplementation(() => of(currentSetupState))
+    };
+
+    TestBed.configureTestingModule({
       declarations: [NvmeofTabsComponent],
-      imports: [RouterTestingModule, SharedModule, TabsModule]
-    }).compileComponents();
+      imports: [
+        RouterTestingModule,
+        HttpClientTestingModule,
+        SharedModule,
+        TabsModule,
+        NvmeofSetupCardsComponent
+      ],
+      providers: [
+        { provide: NvmeofService, useValue: nvmeofServiceSpy },
+        { provide: ActivatedRoute, useValue: { queryParams: queryParams$.asObservable() } }
+      ]
+    });
+    TestBed.overrideComponent(NvmeofTabsComponent, {
+      set: { providers: [{ provide: NvmeofStateService, useValue: nvmeofStateServiceMock }] }
+    });
+    await TestBed.compileComponents();
 
     fixture = TestBed.createComponent(NvmeofTabsComponent);
     component = fixture.componentInstance;
     router = TestBed.inject(Router);
+    routerEvents$ = new Subject<RouterEvent>();
+    Object.defineProperty(router, 'url', {
+      get: () => '/block/nvmeof/gateways',
+      configurable: true
+    });
+    jest.spyOn(router, 'events', 'get').mockReturnValue(routerEvents$.asObservable());
   });
 
   it('should create', () => {
@@ -51,25 +104,59 @@ describe('NvmeofTabsComponent', () => {
     expect(component.activeTab).toBe(component.Tabs.gateways);
   });
 
+  it('should hide the shell on namespace create routes', () => {
+    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/namespaces/create');
+    component.ngOnInit();
+    expect(component.showTabsShell).toBe(false);
+  });
+
+  it('should keep the shell visible on namespace list routes', () => {
+    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/namespaces');
+    component.ngOnInit();
+    expect(component.showTabsShell).toBe(true);
+  });
+
+  it('should keep the shell visible on list routes with a secondary outlet', () => {
+    jest
+      .spyOn(router, 'url', 'get')
+      .mockReturnValue('/block/nvmeof/subsystems(modal:create)?group=default');
+    component.ngOnInit();
+    expect(component.showTabsShell).toBe(true);
+  });
+
+  it('should hide the shell when primary route is a create page with secondary outlet', () => {
+    jest
+      .spyOn(router, 'url', 'get')
+      .mockReturnValue('/block/nvmeof/subsystems/create(modal:create)?group=default');
+    component.ngOnInit();
+    expect(component.showTabsShell).toBe(false);
+  });
+
   it('should navigate to correct path on tab selection', () => {
     spyOn(router, 'navigate');
     component.onSelected(component.Tabs.subsystems);
-    expect(component.selectedTab).toBe(component.Tabs.subsystems);
-    expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof/subsystems']);
+    expect(component.activeTab).toBe(component.Tabs.subsystems);
+    expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof', 'subsystems'], {
+      queryParamsHandling: 'preserve'
+    });
   });
 
   it('should navigate to gateways on selecting gateways tab', () => {
     spyOn(router, 'navigate');
     component.onSelected(component.Tabs.gateways);
-    expect(component.selectedTab).toBe(component.Tabs.gateways);
-    expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof/gateways']);
+    expect(component.activeTab).toBe(component.Tabs.gateways);
+    expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof', 'gateways'], {
+      queryParamsHandling: 'preserve'
+    });
   });
 
   it('should navigate to namespaces on selecting namespaces tab', () => {
     spyOn(router, 'navigate');
     component.onSelected(component.Tabs.namespaces);
-    expect(component.selectedTab).toBe(component.Tabs.namespaces);
-    expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof/namespaces']);
+    expect(component.activeTab).toBe(component.Tabs.namespaces);
+    expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof', 'namespaces'], {
+      queryParamsHandling: 'preserve'
+    });
   });
 
   it('should expose TABS enum via Tabs getter', () => {
@@ -78,4 +165,229 @@ describe('NvmeofTabsComponent', () => {
     expect(tabs.subsystems).toBe('subsystems');
     expect(tabs.namespaces).toBe('namespaces');
   });
+
+  describe('setup cards scenarios', () => {
+    it('should show setup cards', () => {
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      expect(component.showSetupCards).toBe(true);
+    });
+
+    it('should detect subsystems and namespaces regardless of dropdown selection', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true });
+      component.ngOnInit();
+      setQueryParams({});
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(true);
+      expect(component.hasNamespaces).toBe(true);
+      expect(component.isAllConfigured).toBe(true);
+    });
+
+    it('scenario: no gateway groups — all steps pending', () => {
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      expect(component.hasGatewayGroups).toBe(false);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+      expect(component.showSetupCards).toBe(true);
+    });
+
+    it('scenario: gateway groups exist, no subsystems across all groups — step 1 complete', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('scenario: no subsystems in object response across all groups — step 1 complete', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('scenario: subsystems in any group, no namespaces — steps 1 & 2 complete', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: false });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(true);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('scenario: all configured across any group — isAllConfigured is true', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(true);
+      expect(component.hasNamespaces).toBe(true);
+      expect(component.isAllConfigured).toBe(true);
+    });
+
+    it('scenario: all configured in object response across any group — isAllConfigured is true', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(true);
+      expect(component.hasNamespaces).toBe(true);
+      expect(component.isAllConfigured).toBe(true);
+    });
+
+    it('scenario: subsystems exist in grp2 only — step 2 still marked complete', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('scenario: full config in grp2 only — onboarding complete regardless of selected group', () => {
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      setQueryParams({ group: 'grp1' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('should trigger state reload when refresh$ emits', () => {
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      emitRefresh();
+
+      expect(component.hasGatewayGroups).toBe(false);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+    });
+
+    it('should reload state on NavigationEnd (e.g. navigating back from a form)', () => {
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+
+      routerEvents$.next(
+        new NavigationEnd(1, '/block/nvmeof/namespaces', '/block/nvmeof/namespaces')
+      );
+
+      expect(component.hasGatewayGroups).toBe(false);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+    });
+
+    it('should show the initial gateway-only state after the last subsystem and namespace are removed', () => {
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
+
+      emitRefresh();
+
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('should show the initial empty state after the last gateway is removed', () => {
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+
+      emitRefresh();
+
+      expect(component.hasGatewayGroups).toBe(false);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('should refresh setup cards when the gateway list refreshes to empty', () => {
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      emitRefresh();
+
+      expect(component.hasGatewayGroups).toBe(false);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('should show gateway step complete after a gateway is created', () => {
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
+
+      emitRefresh();
+
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(false);
+      expect(component.hasNamespaces).toBe(false);
+      expect(component.isAllConfigured).toBe(false);
+    });
+
+    it('should use fetchSetupState on refresh', () => {
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      component.ngOnInit();
+      nvmeofServiceSpy.fetchSetupState.mockClear();
+
+      emitRefresh();
+
+      expect(nvmeofServiceSpy.fetchSetupState).toHaveBeenCalledTimes(1);
+    });
+
+    it('should render correct setup card messages after all gateway groups are removed', () => {
+      jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/gateways');
+      setSetupState({ hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true });
+      component.ngOnInit();
+
+      setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
+      emitRefresh();
+      fixture.detectChanges();
+
+      const cardElements = fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+
+      expect(cardElements.length).toBe(3);
+      expect(cardElements[0].componentInstance.statusMessage).toBe(
+        'No gateway groups configured for this cluster yet.'
+      );
+      expect(cardElements[1].componentInstance.statusMessage).toBe('No gateway configured yet.');
+      expect(cardElements[2].componentInstance.statusMessage).toBe('No gateway configured yet.');
+    });
+
+    it('should render success setup card messages before gateway groups are removed', () => {
+      jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/gateways');
+      component.ngOnInit();
+      emitRefresh();
+      fixture.detectChanges();
+      component.showSetupCards = true;
+      fixture.detectChanges();
+
+      const cardElements = fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
+
+      expect(cardElements[0].componentInstance.statusMessage).toBe(
+        'Gateway group configured successfully.'
+      );
+      expect(cardElements[1].componentInstance.statusMessage).toBe(
+        'Subsystem configured successfully.'
+      );
+      expect(cardElements[2].componentInstance.statusMessage).toBe(
+        'Namespaces mapped successfully.'
+      );
+    });
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts
index 8b74346db92..a42cd572a2c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts
@@ -1,5 +1,10 @@
-import { Component, OnInit } from '@angular/core';
-import { Router } from '@angular/router';
+import { Component, OnDestroy, OnInit } from '@angular/core';
+import { ActivatedRoute, NavigationEnd, Router } from '@angular/router';
+import { Subscription, merge, of } from 'rxjs';
+import { filter, switchMap, tap } from 'rxjs/operators';
+
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
+import { NvmeofStateService } from '../nvmeof-state.service';
 
 const NVMEOF_PATH = 'block/nvmeof';
 
@@ -9,26 +14,85 @@ enum TABS {
   namespaces = 'namespaces'
 }
 
+const TAB_ROUTES = [
+  '/block/nvmeof/gateways',
+  '/block/nvmeof/subsystems',
+  '/block/nvmeof/namespaces'
+];
+
 @Component({
   selector: 'cd-nvmeof-tabs',
   templateUrl: './nvmeof-tabs.component.html',
   styleUrls: ['./nvmeof-tabs.component.scss'],
-  standalone: false
+  standalone: false,
+  providers: [NvmeofStateService]
 })
-export class NvmeofTabsComponent implements OnInit {
-  selectedTab: TABS;
+export class NvmeofTabsComponent implements OnInit, OnDestroy {
   activeTab: TABS = TABS.gateways;
+  showTabsShell = true;
+  showSetupCards = false;
+  hasGatewayGroups = false;
+  hasSubsystems = false;
+  hasNamespaces = false;
+  isAllConfigured = false;
+  private setupSubscription?: Subscription;
 
-  constructor(private router: Router) {}
+  constructor(
+    private router: Router,
+    private route: ActivatedRoute,
+    private nvmeofService: NvmeofService,
+    private nvmeofStateService: NvmeofStateService
+  ) {}
 
-  ngOnInit(): void {
-    const currentPath = this.router.url;
+  private updateActiveTab(currentPath: string): void {
     this.activeTab = Object.values(TABS).find((tab) => currentPath.includes(tab)) || TABS.gateways;
   }
 
+  private updateShellVisibility(currentPath: string): void {
+    const urlTree = this.router.parseUrl(currentPath);
+    const primarySegments =
+      urlTree.root.children['primary']?.segments.map((segment) => segment.path) ?? [];
+    const primaryPath = `/${primarySegments.join('/')}`;
+
+    this.showTabsShell = TAB_ROUTES.includes(primaryPath);
+  }
+
+  ngOnInit(): void {
+    this.updateActiveTab(this.router.url);
+    this.updateShellVisibility(this.router.url);
+
+    // Merge all trigger streams to prevent memory leaks and race conditions
+    this.setupSubscription = merge(
+      of(null), // Initial load
+      this.router.events.pipe(
+        filter((event): event is NavigationEnd => event instanceof NavigationEnd),
+        tap((event) => {
+          this.updateActiveTab(event.urlAfterRedirects);
+          this.updateShellVisibility(event.urlAfterRedirects);
+        })
+      ),
+      this.route.queryParams,
+      this.nvmeofStateService.refresh$
+    )
+      .pipe(switchMap(() => this.nvmeofService.fetchSetupState()))
+      .subscribe(({ hasGatewayGroups, hasSubsystems, hasNamespaces }) => {
+        this.hasGatewayGroups = hasGatewayGroups;
+        this.hasSubsystems = hasSubsystems;
+        this.hasNamespaces = hasNamespaces;
+        this.isAllConfigured = hasGatewayGroups && hasSubsystems && hasNamespaces;
+        this.showSetupCards = !this.isAllConfigured;
+      });
+  }
+
+  ngOnDestroy(): void {
+    this.setupSubscription?.unsubscribe();
+  }
+
   onSelected(tab: TABS) {
-    this.selectedTab = tab;
-    this.router.navigate([`${NVMEOF_PATH}/${tab}`]);
+    this.activeTab = tab;
+    this.router.navigate([NVMEOF_PATH, tab], {
+      queryParamsHandling: 'preserve'
+    });
   }
 
   public get Tabs(): typeof TABS {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
index 77c31a6553d..121299a9d30 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
@@ -3,15 +3,21 @@ import { HttpClient } from '@angular/common/http';
 
 import _ from 'lodash';
 import { Observable, forkJoin, of as observableOf } from 'rxjs';
-import { catchError, map, mapTo, mergeMap } from 'rxjs/operators';
+import { catchError, map, mapTo, mergeMap, switchMap } from 'rxjs/operators';
 import { CephServiceSpec } from '../models/service.interface';
-import { ListenerItem } from '../models/nvmeof';
+import { ListenerItem, NvmeofSubsystem, NvmeofSubsystemNamespace } from '../models/nvmeof';
 import { HostService } from './host.service';
 import { OrchestratorService } from './orchestrator.service';
 import { HostStatus } from '../enum/host-status.enum';
 import { Host } from '../models/host.interface';
 import { OrchestratorStatus } from '../models/orchestrator.interface';
 
+export type SetupState = {
+  hasGatewayGroups: boolean;
+  hasSubsystems: boolean;
+  hasNamespaces: boolean;
+};
+
 export const DEFAULT_MAX_NAMESPACE_PER_SUBSYSTEM = 512;
 
 export type GatewayGroup = CephServiceSpec;
@@ -173,6 +179,60 @@ export class NvmeofService {
     }, []);
   }
 
+  private normalizeListResponse<T>(response: unknown, key: string): T[] {
+    if (Array.isArray(response)) {
+      return response as T[];
+    }
+
+    const nested = (response as Record<string, T[]> | null)?.[key];
+    return Array.isArray(nested) ? nested : [];
+  }
+
+  fetchSetupState(): Observable<SetupState> {
+    return this.listGatewayGroups().pipe(
+      switchMap((gatewayGroups: CephServiceSpec[][]) => {
+        const rawGroups = Array.isArray(gatewayGroups[0]) ? gatewayGroups[0] : [];
+        const groups = rawGroups.filter((serviceSpec: CephServiceSpec) => serviceSpec?.spec?.group);
+        const hasGatewayGroups = groups.length > 0;
+
+        if (!hasGatewayGroups) {
+          return observableOf({
+            hasGatewayGroups: false,
+            hasSubsystems: false,
+            hasNamespaces: false
+          });
+        }
+
+        const firstGroupName = groups[0].spec.group;
+
+        return forkJoin({
+          subsystems: this.listSubsystems(firstGroupName).pipe(
+            map((resp: unknown) => this.normalizeListResponse<NvmeofSubsystem>(resp, 'subsystems')),
+            catchError(() => observableOf([]))
+          ),
+          namespaces: this.listNamespaces(firstGroupName).pipe(
+            map((resp: unknown) =>
+              this.normalizeListResponse<NvmeofSubsystemNamespace>(resp, 'namespaces')
+            ),
+            catchError(() => observableOf([]))
+          )
+        }).pipe(
+          map(({ subsystems, namespaces }) => ({
+            hasGatewayGroups,
+            hasSubsystems: subsystems.length > 0,
+            hasNamespaces: namespaces.length > 0
+          })),
+          catchError(() =>
+            observableOf({ hasGatewayGroups, hasSubsystems: false, hasNamespaces: false })
+          )
+        );
+      }),
+      catchError(() =>
+        observableOf({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false })
+      )
+    );
+  }
+
   // Gateway groups
   listGatewayGroups() {
     return this.http.get<CephServiceSpec[][]>(`${API_PATH}/gateway/group`);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html
new file mode 100644
index 00000000000..d2cd4c23f30
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html
@@ -0,0 +1,20 @@
+<div class="setup-step-card" [class.setup-step-card--loading]="isLoading">
+  <div class="setup-step-card__step-row">
+    <span class="cds--type-heading-compact-01">{{ stepNumber }}.</span>
+    <span class="cds--type-heading-compact-01">{{ title }}</span>
+  </div>
+  <p class="cds--type-label-01">
+    {{ description }}
+  </p>
+  <div class="setup-step-card__info">
+    @if (isLoading) {
+    <cd-loading-panel></cd-loading-panel>
+    } @else if (isConfigured) {
+    <cd-icon type="success"></cd-icon>
+    <span class="cds--type-label-01">{{ statusMessage }}</span>
+    } @else {
+    <cd-icon type="infoCircle"></cd-icon>
+    <span class="cds--type-label-01">{{ statusMessage }}</span>
+    }
+  </div>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.scss
new file mode 100644
index 00000000000..5becfaf4f90
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.scss
@@ -0,0 +1,24 @@
+.setup-step-card {
+  display: flex;
+  flex-direction: column;
+  gap: var(--cds-spacing-03);
+  height: 100%;
+
+  &--loading {
+    opacity: 0.7;
+    pointer-events: none;
+  }
+
+  &__step-row {
+    display: flex;
+    align-items: baseline;
+    gap: var(--cds-spacing-03);
+  }
+
+  &__info {
+    display: flex;
+    align-items: center;
+    margin-top: auto;
+    gap: var(--cds-spacing-03);
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.spec.ts
new file mode 100644
index 00000000000..0414795e78f
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.spec.ts
@@ -0,0 +1,134 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+
+import { SetupStepCardComponent } from './setup-step-card.component';
+
+describe('SetupStepCardComponent', () => {
+  let component: SetupStepCardComponent;
+  let fixture: ComponentFixture<SetupStepCardComponent>;
+
+  const STEP_TITLE = 'Example step';
+  const STEP_DESCRIPTION = 'Example step description.';
+  const SUCCESS_MESSAGE = 'Example configured successfully.';
+  const INFO_MESSAGE = 'Example not configured yet.';
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [SetupStepCardComponent]
+    }).compileComponents();
+
+    fixture = TestBed.createComponent(SetupStepCardComponent);
+    component = fixture.componentInstance;
+    component.stepNumber = 1;
+    component.title = STEP_TITLE;
+    component.description = STEP_DESCRIPTION;
+    fixture.detectChanges();
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should render step number, title, and description', () => {
+    const element = fixture.nativeElement;
+    expect(element.textContent).toContain('1.');
+    expect(element.textContent).toContain(STEP_TITLE);
+    expect(element.textContent).toContain(STEP_DESCRIPTION);
+  });
+
+  describe('statusMessage', () => {
+    it('should return successMessage when configured', () => {
+      component.isConfigured = true;
+      component.successMessage = SUCCESS_MESSAGE;
+
+      expect(component.statusMessage).toBe(SUCCESS_MESSAGE);
+    });
+
+    it('should return infoMessage when not configured', () => {
+      component.isConfigured = false;
+      component.infoMessage = INFO_MESSAGE;
+
+      expect(component.statusMessage).toBe(INFO_MESSAGE);
+    });
+
+    it('should return default success text when configured without successMessage', () => {
+      component.isConfigured = true;
+      component.successMessage = undefined;
+
+      expect(component.statusMessage).toBe('Configured successfully.');
+    });
+
+    it('should return default info text when not configured without infoMessage', () => {
+      component.isConfigured = false;
+      component.infoMessage = undefined;
+
+      expect(component.statusMessage).toBe('Not configured yet.');
+    });
+
+    it('should prefer successMessage over infoMessage when configured', () => {
+      component.isConfigured = true;
+      component.successMessage = SUCCESS_MESSAGE;
+      component.infoMessage = INFO_MESSAGE;
+
+      expect(component.statusMessage).toBe(SUCCESS_MESSAGE);
+    });
+  });
+
+  describe('template', () => {
+    it('should render the status message when not configured', () => {
+      component.isConfigured = false;
+      component.infoMessage = INFO_MESSAGE;
+      fixture.detectChanges();
+
+      const message = fixture.nativeElement.querySelector('.setup-step-card__info span');
+      expect(message.textContent.trim()).toBe(INFO_MESSAGE);
+    });
+
+    it('should render the status message when configured', () => {
+      component.isConfigured = true;
+      component.successMessage = SUCCESS_MESSAGE;
+      fixture.detectChanges();
+
+      const message = fixture.nativeElement.querySelector('.setup-step-card__info span');
+      expect(message.textContent.trim()).toBe(SUCCESS_MESSAGE);
+    });
+
+    it('should render a success icon when configured', () => {
+      component.isConfigured = true;
+      component.successMessage = SUCCESS_MESSAGE;
+      fixture.detectChanges();
+
+      const icon = fixture.nativeElement.querySelector('cd-icon');
+      expect(icon.getAttribute('ng-reflect-type')).toBe('success');
+    });
+
+    it('should render an info icon when not configured', () => {
+      component.isConfigured = false;
+      component.infoMessage = INFO_MESSAGE;
+      fixture.detectChanges();
+
+      const icon = fixture.nativeElement.querySelector('cd-icon');
+      expect(icon.getAttribute('ng-reflect-type')).toBe('infoCircle');
+    });
+
+    it('should render loading panel when isLoading is true', () => {
+      component.isLoading = true;
+      fixture.detectChanges();
+
+      const loadingPanel = fixture.nativeElement.querySelector('cd-loading-panel');
+      expect(loadingPanel).toBeTruthy();
+    });
+
+    it('should return "Loading..." as statusMessage when isLoading is true', () => {
+      component.isLoading = true;
+      expect(component.statusMessage).toBe('Loading...');
+    });
+
+    it('should apply loading class when isLoading is true', () => {
+      component.isLoading = true;
+      fixture.detectChanges();
+
+      const card = fixture.nativeElement.querySelector('.setup-step-card');
+      expect(card.classList.contains('setup-step-card--loading')).toBe(true);
+    });
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.ts
new file mode 100644
index 00000000000..c77b3b5243b
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.ts
@@ -0,0 +1,33 @@
+import { Component, Input } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { ComponentsModule } from '../components.module';
+
+@Component({
+  selector: 'cd-setup-step-card',
+  standalone: true,
+  imports: [CommonModule, ComponentsModule],
+  templateUrl: './setup-step-card.component.html',
+  styleUrls: ['./setup-step-card.component.scss']
+})
+export class SetupStepCardComponent {
+  @Input() stepNumber!: number;
+  @Input() title!: string;
+  @Input() description!: string;
+  @Input() isConfigured: boolean = false;
+  @Input() isLoading: boolean = false;
+  @Input() successMessage?: string;
+  @Input() infoMessage?: string;
+
+  get statusMessage(): string {
+    if (this.isLoading) {
+      return $localize`Loading...`;
+    }
+    if (this.isConfigured && this.successMessage) {
+      return this.successMessage;
+    }
+    if (!this.isConfigured && this.infoMessage) {
+      return this.infoMessage;
+    }
+    return this.isConfigured ? $localize`Configured successfully.` : $localize`Not configured yet.`;
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
index f5a7297b167..f76c642986f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
@@ -41,6 +41,9 @@
     </cds-table-toolbar-actions>
     <!-- end batch actions -->
     <cds-table-toolbar-content>
+      <!-- gateway group / custom filter slot -->
+      <ng-content select=".table-filter"></ng-content>
+      <!-- end custom filter slot -->
       <!-- search -->
       <cds-table-toolbar-search *ngIf="searchField"
                                 [expandable]="false"
@@ -484,13 +487,15 @@
              let-column="data.column"
              let-row="data.row"
              let-value="data.value">
-  <cds-inline-loading *ngIf="row.cdExecuting"
-                      state="active"></cds-inline-loading>
-  <span [ngClass]="column?.customTemplateConfig?.valueClass">
+  @if (row.cdExecuting) {
+    <cds-inline-loading></cds-inline-loading>
+  }
+  <span [ngClass]="column?.customTemplateConfig?.valueClass || ''">
     {{ value }}
   </span>
-  <span *ngIf="row.cdExecuting"
-        [ngClass]="column?.customTemplateConfig?.executingClass ? column?.customTemplateConfig.executingClass : 'text-muted italic'">({{ row.cdExecuting }})</span>
+  @if (row.cdExecuting) {
+    <span [ngClass]="column?.customTemplateConfig?.executingClass ? column?.customTemplateConfig.executingClass : 'text-muted italic'">({{ row.cdExecuting }})</span>
+  }
 </ng-template>
 <ng-template #classAddingTpl
              let-value="data.value">

From 918adfa512abf9218c335031fa0d910f7851b1fa Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 23 Oct 2025 11:20:16 +0530
Subject: [PATCH 469/596] mgr/cephadm: Stop NFS service/daemon from starting
 automatically after reboot, cephadm to manage startup

Fixes: https://tracker.ceph.com/issues/73442
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py                        |  3 ++
 src/pybind/mgr/cephadm/module.py              | 36 +++++++++++++------
 src/pybind/mgr/cephadm/schedule.py            |  3 +-
 src/pybind/mgr/cephadm/serve.py               | 12 +++++--
 src/pybind/mgr/cephadm/tests/test_cephadm.py  |  1 +
 src/pybind/mgr/cephadm/tests/test_spec.py     |  2 +-
 src/pybind/mgr/orchestrator/_interface.py     |  6 +++-
 .../orchestrator/tests/test_orchestrator.py   |  1 +
 8 files changed, 48 insertions(+), 16 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index 9b3602032d2..ff91ca4cfba 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -1175,12 +1175,15 @@ def deploy_daemon(
             cephadm_agent.deploy_daemon_unit(config_js)
         else:
             if c:
+                # Disable automatic startup for NFS daemons
+                enable_daemon = daemon_type != 'nfs'
                 deploy_daemon_units(
                     ctx,
                     ident,
                     uid,
                     gid,
                     c,
+                    enable=enable_daemon,
                     osd_fsid=osd_fsid,
                     endpoints=endpoints,
                     init_containers=init_containers,
diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 24c6483007a..91dff724ad6 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -47,7 +47,7 @@ from ceph.deployment.service_spec import (
 from ceph.deployment.drive_group import DeviceSelection
 from ceph.utils import str_to_datetime, datetime_to_str, datetime_now
 from ceph.cryptotools.select import choose_crypto_caller
-from cephadm.serve import CephadmServe, REQUIRES_POST_ACTIONS
+from cephadm.serve import CephadmServe
 from cephadm.services.cephadmservice import CephadmDaemonDeploySpec
 from cephadm.http_server import CephadmHttpServer
 from cephadm.agent import CephadmAgentHelpers
@@ -1126,6 +1126,12 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
                     'unknown': DaemonDescriptionStatus.error,
                 }[d['state']]
 
+            cached_dd = None
+            try:
+                cached_dd = self.cache.get_daemon(d['name'], host)
+            except OrchestratorError:
+                self.log.debug(f'Could not find daemon {d["name"]} in cache')
+
             sd = orchestrator.DaemonDescription(
                 daemon_type=daemon_type,
                 daemon_id='.'.join(d['name'].split('.')[1:]),
@@ -1155,16 +1161,10 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
                 rank_generation=rank_generation,
                 extra_container_args=d.get('extra_container_args'),
                 extra_entrypoint_args=d.get('extra_entrypoint_args'),
+                pending_daemon_config=cached_dd.pending_daemon_config if cached_dd else False,
+                user_stopped=cached_dd.user_stopped if cached_dd else False,
             )
 
-            if daemon_type in REQUIRES_POST_ACTIONS:
-                # If post action is required for daemon, then restore value of pending_daemon_config
-                try:
-                    cached_dd = self.cache.get_daemon(sd.name(), host)
-                    sd.update_pending_daemon_config(cached_dd.pending_daemon_config)
-                except orchestrator.OrchestratorError:
-                    pass
-
             dm[sd.name()] = sd
         self.log.debug('Refreshed host %s daemons (%d)' % (host, len(dm)))
         self.cache.update_host_daemons(host, dm)
@@ -1180,6 +1180,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
     def offline_hosts_remove(self, host: str) -> None:
         if host in self.offline_hosts:
             self.offline_hosts.remove(host)
+            self._invalidate_all_host_metadata_and_kick_serve(host)
 
     def update_failed_daemon_health_check(self) -> None:
         failed_daemons = []
@@ -3088,8 +3089,12 @@ Then run the following:
                     out, err, code = self.wait_async(CephadmServe(self)._run_cephadm(
                         daemon_spec.host, name, 'unit',
                         ['--name', name, a]))
-            except Exception:
-                self.log.exception(f'`{daemon_spec.host}: cephadm unit {name} {a}` failed')
+            except Exception as exp:
+                if a == 'reset-failed' and daemon_spec.daemon_type in ['nfs'] and 'not loaded' in str(exp):
+                    # Don't log exception if reset-failed fails because the unit is not loaded
+                    pass
+                else:
+                    self.log.exception(f'`{daemon_spec.host}: cephadm unit {name} {a}` failed')
         self.cache.invalidate_host_daemons(daemon_spec.host)
         msg = "{} {} from host '{}'".format(action, name, daemon_spec.host)
         self.events.for_daemon(name, 'INFO', msg)
@@ -3120,6 +3125,7 @@ Then run the following:
         d = self.cache.get_daemon(daemon_name)
         assert d.daemon_type is not None
         assert d.daemon_id is not None
+        assert d.hostname
 
         if (action == 'redeploy' or action == 'restart') and self.daemon_is_self(d.daemon_type, d.daemon_id) \
                 and not self.mgr_service.mgr_map_has_standby():
@@ -3139,6 +3145,14 @@ Then run the following:
                     f'key rotation not supported for {d.daemon_type}'
                 )
 
+        # Track user-initiated stop/start actions
+        if action == 'stop':
+            d.user_stopped = True
+            self.cache.update_host_daemons(d.hostname, {d.name(): d})
+        elif action in ['start', 'restart']:
+            d.user_stopped = False
+            self.cache.update_host_daemons(d.hostname, {d.name(): d})
+
         self._daemon_action_set_image(action, image, d.daemon_type, d.daemon_id)
 
         self.log.info(f'Schedule {action} daemon {daemon_name}')
diff --git a/src/pybind/mgr/cephadm/schedule.py b/src/pybind/mgr/cephadm/schedule.py
index 6df54a5c6e3..c6695994949 100644
--- a/src/pybind/mgr/cephadm/schedule.py
+++ b/src/pybind/mgr/cephadm/schedule.py
@@ -340,6 +340,7 @@ class HostAssignment(object):
 
         # get candidate hosts based on [hosts, label, host_pattern]
         candidates = self.get_candidates()  # type: List[DaemonPlacement]
+        all_candidates = candidates
         if self.primary_daemon_type in RESCHEDULE_FROM_OFFLINE_HOSTS_TYPES:
             # remove unreachable hosts that are not in maintenance so daemons
             # on these hosts will be rescheduled
@@ -400,7 +401,7 @@ class HostAssignment(object):
         existing_slots: List[DaemonPlacement] = []
         to_add: List[DaemonPlacement] = []
         to_remove: List[orchestrator.DaemonDescription] = []
-        ranks: List[int] = list(range(len(candidates)))
+        ranks: List[int] = list(range(len(all_candidates)))
         others: List[DaemonPlacement] = candidates.copy()
         for dd in daemons:
             found = False
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 6849c586c33..c518baa4d51 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -45,6 +45,7 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 REQUIRES_POST_ACTIONS = ['grafana', 'iscsi', 'prometheus', 'alertmanager', 'rgw', 'nvmeof', 'mgmt-gateway']
+DISABLED_SERVICES = ['nfs']
 
 CEPHADM_EXE = ssh.RemoteExecutable('/usr/bin/cephadm')
 
@@ -978,10 +979,11 @@ class CephadmServe:
                 for d in daemons_to_remove:
                     assert d.hostname is not None
                     self._remove_daemon(d.name(), d.hostname)
-                daemons_to_remove = []
 
                 # fence them
-                svc.fence_old_ranks(spec, rank_map, len(all_slots))
+                if daemons_to_remove:
+                    svc.fence_old_ranks(spec, rank_map, len(all_slots))
+                daemons_to_remove = []
 
             # create daemons
             daemon_place_fails = []
@@ -1241,6 +1243,12 @@ class CephadmServe:
                 action, dd.daemon_type, dd.name(), self.mgr, last_config
             )
 
+            # If no action is specified, check whether we need to start the daemon
+            if not action and dd.daemon_type in DISABLED_SERVICES:
+                if dd.status == 0 and not dd.user_stopped:
+                    self.log.debug(f'Starting daemon {dd.name()}')
+                    action = 'start'
+
             if action:
                 if scheduled_action == 'redeploy' and action == 'reconfig':
                     action = 'redeploy'
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index 79fed21c6c4..ea55695d3c6 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -284,6 +284,7 @@ class TestCephadm(object):
                         'is_active': False,
                         'ports': [],
                         'pending_daemon_config': False,
+                        'user_stopped': False
                     }
                 ]
 
diff --git a/src/pybind/mgr/cephadm/tests/test_spec.py b/src/pybind/mgr/cephadm/tests/test_spec.py
index 6f5a41b7f06..46a702fccf2 100644
--- a/src/pybind/mgr/cephadm/tests/test_spec.py
+++ b/src/pybind/mgr/cephadm/tests/test_spec.py
@@ -300,7 +300,7 @@ def test_dd_octopus(dd_json):
         del j['daemon_name']
         return j
 
-    dd_json.update({'pending_daemon_config': False})
+    dd_json.update({'pending_daemon_config': False, 'user_stopped': False})
     assert dd_json == convert_to_old_style_json(
         DaemonDescription.from_json(dd_json).to_json())
 
diff --git a/src/pybind/mgr/orchestrator/_interface.py b/src/pybind/mgr/orchestrator/_interface.py
index 1266b84df55..816c4c43be9 100644
--- a/src/pybind/mgr/orchestrator/_interface.py
+++ b/src/pybind/mgr/orchestrator/_interface.py
@@ -1226,7 +1226,8 @@ class DaemonDescription(object):
                  rank_generation: Optional[int] = None,
                  extra_container_args: Optional[GeneralArgList] = None,
                  extra_entrypoint_args: Optional[GeneralArgList] = None,
-                 pending_daemon_config: bool = False
+                 pending_daemon_config: bool = False,
+                 user_stopped: bool = False
                  ) -> None:
 
         #: Host is at the same granularity as InventoryHost
@@ -1302,6 +1303,7 @@ class DaemonDescription(object):
             self.extra_entrypoint_args = ArgumentSpec.from_general_args(
                 extra_entrypoint_args)
         self.pending_daemon_config = pending_daemon_config
+        self.user_stopped = user_stopped
 
     def __setattr__(self, name: str, value: Any) -> None:
         if value is not None and name in ('extra_container_args', 'extra_entrypoint_args'):
@@ -1460,6 +1462,7 @@ class DaemonDescription(object):
         out['rank_generation'] = self.rank_generation
         out['systemd_unit'] = self.systemd_unit
         out['pending_daemon_config'] = self.pending_daemon_config
+        out['user_stopped'] = self.user_stopped
 
         for k in ['last_refresh', 'created', 'started', 'last_deployed',
                   'last_configured']:
@@ -1498,6 +1501,7 @@ class DaemonDescription(object):
         out['ip'] = self.ip
         out['systemd_unit'] = self.systemd_unit
         out['pending_daemon_config'] = self.pending_daemon_config
+        out['user_stopped'] = self.user_stopped
 
         for k in ['last_refresh', 'created', 'started', 'last_deployed',
                   'last_configured']:
diff --git a/src/pybind/mgr/orchestrator/tests/test_orchestrator.py b/src/pybind/mgr/orchestrator/tests/test_orchestrator.py
index ecd901abbe4..e21bd1280cb 100644
--- a/src/pybind/mgr/orchestrator/tests/test_orchestrator.py
+++ b/src/pybind/mgr/orchestrator/tests/test_orchestrator.py
@@ -93,6 +93,7 @@ status: 1
 status_desc: starting
 is_active: false
 pending_daemon_config: false
+user_stopped: false
 events:
 - 2020-06-10T10:08:22.933241Z daemon:crash.ubuntu [INFO] "Deployed crash.ubuntu on
   host 'ubuntu'"

From 51504dbf2a12a125930b0f4cd14a35553093f820 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Tue, 11 Nov 2025 18:08:03 +0530
Subject: [PATCH 470/596] mgr/cephadm: Only start ranked daemon with highest
 rank gen, if many daemon exists with same rank

If the removal of an extra NFS daemon fails for any reason, that daemon should not be started, as the NFS daemon with the highest rank generation is already running.

Fixes: https://tracker.ceph.com/issues/73442
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/serve.py | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index c518baa4d51..e82a6daf1ca 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1246,8 +1246,28 @@ class CephadmServe:
             # If no action is specified, check whether we need to start the daemon
             if not action and dd.daemon_type in DISABLED_SERVICES:
                 if dd.status == 0 and not dd.user_stopped:
-                    self.log.debug(f'Starting daemon {dd.name()}')
-                    action = 'start'
+                    should_start = False
+                    if spec and service_registry.get_service(daemon_type_to_service(dd.daemon_type)).ranked(spec):
+                        # For ranked services, check if we should start this daemon
+                        same_rank_daemons = [
+                            d for d in self.mgr.cache.get_daemons_by_service(dd.service_name())
+                            if d.rank == dd.rank and d.daemon_type == dd.daemon_type
+                        ]
+                        self.log.debug(
+                            f'Start hightest rank_gen daemon of same rank daemons {same_rank_daemons}'
+                        )
+                        if len(same_rank_daemons) == 1:
+                            should_start = True
+                        else:
+                            # Multiple daemons exist for this rank, only start the highest generation
+                            highest_gen_daemon = max(same_rank_daemons,
+                                                     key=lambda d: d.rank_generation or 0)
+                            should_start = (dd == highest_gen_daemon)
+                    else:
+                        should_start = True
+                    if should_start:
+                        self.log.debug(f'Starting daemon {dd.name()}')
+                        action = 'start'
 
             if action:
                 if scheduled_action == 'redeploy' and action == 'reconfig':

From 4e20140ecf673f95e9424ab1c938398fa9ea68bc Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 27 Nov 2025 22:08:42 +0530
Subject: [PATCH 471/596] mgr/cephadm: Fixed cache update for updating daemon
 user_stopped status Fixes: https://tracker.ceph.com/issues/73442

Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/module.py          | 8 ++++----
 src/pybind/mgr/orchestrator/_interface.py | 3 +++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 91dff724ad6..2072a8bf5b4 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -3147,11 +3147,11 @@ Then run the following:
 
         # Track user-initiated stop/start actions
         if action == 'stop':
-            d.user_stopped = True
-            self.cache.update_host_daemons(d.hostname, {d.name(): d})
+            d.update_user_stopped_status(True)
+            self.cache.save_host(d.hostname)
         elif action in ['start', 'restart']:
-            d.user_stopped = False
-            self.cache.update_host_daemons(d.hostname, {d.name(): d})
+            d.update_user_stopped_status(False)
+            self.cache.save_host(d.hostname)
 
         self._daemon_action_set_image(action, image, d.daemon_type, d.daemon_id)
 
diff --git a/src/pybind/mgr/orchestrator/_interface.py b/src/pybind/mgr/orchestrator/_interface.py
index 816c4c43be9..384e743a8c0 100644
--- a/src/pybind/mgr/orchestrator/_interface.py
+++ b/src/pybind/mgr/orchestrator/_interface.py
@@ -1428,6 +1428,9 @@ class DaemonDescription(object):
     def update_pending_daemon_config(self, value: bool) -> None:
         self.pending_daemon_config = value
 
+    def update_user_stopped_status(self, value: bool) -> None:
+        self.user_stopped = value
+
     def __repr__(self) -> str:
         return "<DaemonDescription>({type}.{id})".format(type=self.daemon_type,
                                                          id=self.daemon_id)

From e33edc889021f4631a73ab1dd565963c52bbff12 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 23 Mar 2026 16:53:01 +0530
Subject: [PATCH 472/596] mgr/cephadm: Fixed rank calculation logic for
 potential candidates when NFS daemon colocation is enabled

When colocation of NFS daemons is allowed, the existing rank calculation incorrectly derives the
rank based solely on the number of hosts. This leads to inaccurate rank assignment because the logic
does not account for the full set of potential candidates, especially in scenarios where multiple
daemons can reside on the same host.

Fixes: https://tracker.ceph.com/issues/73442
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/schedule.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/cephadm/schedule.py b/src/pybind/mgr/cephadm/schedule.py
index c6695994949..d2846a853cd 100644
--- a/src/pybind/mgr/cephadm/schedule.py
+++ b/src/pybind/mgr/cephadm/schedule.py
@@ -401,7 +401,7 @@ class HostAssignment(object):
         existing_slots: List[DaemonPlacement] = []
         to_add: List[DaemonPlacement] = []
         to_remove: List[orchestrator.DaemonDescription] = []
-        ranks: List[int] = list(range(len(all_candidates)))
+        ranks: List[int] = list(range(len(all_candidates if len(all_candidates) > len(candidates) else candidates)))
         others: List[DaemonPlacement] = candidates.copy()
         for dd in daemons:
             found = False

From 4ca10faf79fa8b2bdd16567f34850751b4c75942 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Tue, 28 Apr 2026 19:32:33 +0530
Subject: [PATCH 473/596] mgr/cephadm: Disable keepalived by default and start
 during serve loop if needed

If the ingress service is configured with a placement count lower than the number of hosts,
then when one node goes down, Keepalived is configured on the remaining hosts.
When the failed host comes back up, if it was previously configured as the master,
the VIP may become active on two hosts. To prevent this, Keepalived is disabled by default
and started within the service loop.

Fixes: https://tracker.ceph.com/issues/76304
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/cephadm/cephadm.py                        |   5 +-
 src/pybind/mgr/cephadm/serve.py               |   8 +-
 src/pybind/mgr/cephadm/services/ingress.py    |  52 ++++++-
 .../cephadm/tests/services/test_ingress.py    | 145 +++++++++++++++++-
 .../mgr/cephadm/tests/services/test_nfs.py    |  70 +++++++++
 5 files changed, 275 insertions(+), 5 deletions(-)

diff --git a/src/cephadm/cephadm.py b/src/cephadm/cephadm.py
index ff91ca4cfba..f14fe91b85a 100755
--- a/src/cephadm/cephadm.py
+++ b/src/cephadm/cephadm.py
@@ -1175,8 +1175,9 @@ def deploy_daemon(
             cephadm_agent.deploy_daemon_unit(config_js)
         else:
             if c:
-                # Disable automatic startup for NFS daemons
-                enable_daemon = daemon_type != 'nfs'
+                # Disable automatic systemd enable for NFS and keepalived; the mgr
+                # starts them when appropriate (see cephadm serve / DISABLED_SERVICES).
+                enable_daemon = daemon_type not in ('nfs', 'keepalived')
                 deploy_daemon_units(
                     ctx,
                     ident,
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index e82a6daf1ca..fe2798984d7 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -34,6 +34,7 @@ from mgr_module import MonCommandFailed
 from mgr_util import format_bytes
 from cephadm.services.service_registry import service_registry
 from cephadm.services.nfs import NFSService
+from cephadm.services.ingress import IngressService
 
 from . import utils
 from . import exchange
@@ -45,7 +46,8 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 REQUIRES_POST_ACTIONS = ['grafana', 'iscsi', 'prometheus', 'alertmanager', 'rgw', 'nvmeof', 'mgmt-gateway']
-DISABLED_SERVICES = ['nfs']
+# Daemons not systemd-enabled on deploy, mgr start them when not user stopped
+DISABLED_SERVICES = ['nfs', 'keepalived']
 
 CEPHADM_EXE = ssh.RemoteExecutable('/usr/bin/cephadm')
 
@@ -1263,6 +1265,10 @@ class CephadmServe:
                             highest_gen_daemon = max(same_rank_daemons,
                                                      key=lambda d: d.rank_generation or 0)
                             should_start = (dd == highest_gen_daemon)
+                    elif dd.daemon_type == 'keepalived' and spec is not None:
+                        should_start = IngressService.keepalived_should_auto_start(
+                            self.mgr, dd, spec
+                        )
                     else:
                         should_start = True
                     if should_start:
diff --git a/src/pybind/mgr/cephadm/services/ingress.py b/src/pybind/mgr/cephadm/services/ingress.py
index d546d73bae9..84955d75549 100644
--- a/src/pybind/mgr/cephadm/services/ingress.py
+++ b/src/pybind/mgr/cephadm/services/ingress.py
@@ -8,7 +8,7 @@ from ceph.deployment.service_spec import ServiceSpec, IngressSpec, MonitorCertSo
 from ceph.deployment.utils import is_ipv6
 from mgr_util import build_url
 from cephadm import utils
-from orchestrator import OrchestratorError, DaemonDescription
+from orchestrator import OrchestratorError, DaemonDescription, DaemonDescriptionStatus
 from cephadm.services.cephadmservice import CephadmDaemonDeploySpec, CephService, CephadmService
 from .service_registry import register_cephadm_service
 from cephadm.tlsobject_types import TLSCredentials
@@ -328,6 +328,56 @@ class IngressService(CephService):
 
         return daemon_spec
 
+    @staticmethod
+    def _ingress_keepalived_required_count(
+        mgr: "CephadmOrchestrator",
+        ispec: IngressSpec,
+    ) -> int:
+        """
+        get keepalived slot count from ingress placement only
+        """
+        return ispec.placement.get_target_count(mgr.cache.get_schedulable_hosts())
+
+    @staticmethod
+    def keepalived_should_auto_start(
+        mgr: "CephadmOrchestrator",
+        dd: DaemonDescription,
+        spec: ServiceSpec,
+    ) -> bool:
+        """
+        Whether a stopped keepalived unit should be started by the serve loop.
+        Does not auto-start while more keepalived daemons exist than the placement target
+        """
+        ispec = cast(IngressSpec, spec)
+        ingress_daemons = mgr.cache.get_daemons_by_service(ispec.service_name())
+        keepalived_total = len(
+            [d for d in ingress_daemons if d.daemon_type == 'keepalived']
+        )
+        required = IngressService._ingress_keepalived_required_count(mgr, ispec)
+        if keepalived_total > required:
+            return False
+        if ispec.keepalive_only:
+            if not ispec.backend_service:
+                return False
+            for d in mgr.cache.get_daemons_by_service(ispec.backend_service):
+                if d.hostname != dd.hostname:
+                    continue
+                if d.status in (
+                    DaemonDescriptionStatus.running,
+                    DaemonDescriptionStatus.starting,
+                ):
+                    return True
+            return False
+        for d in mgr.cache.get_daemons_by_service(spec.service_name()):
+            if d.daemon_type != 'haproxy' or d.hostname != dd.hostname:
+                continue
+            if d.status in (
+                DaemonDescriptionStatus.running,
+                DaemonDescriptionStatus.starting,
+            ):
+                return True
+        return False
+
     @staticmethod
     def get_keepalived_dependencies(mgr: "CephadmOrchestrator", spec: Optional[ServiceSpec]) -> List[str]:
         # because cephadm creates new daemon instances whenever
diff --git a/src/pybind/mgr/cephadm/tests/services/test_ingress.py b/src/pybind/mgr/cephadm/tests/services/test_ingress.py
index 47bb1473034..537e77283a9 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_ingress.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_ingress.py
@@ -14,7 +14,9 @@ from ceph.deployment.service_spec import (
 from cephadm.tests.fixtures import with_host, with_service, async_side_effect
 
 from ceph.utils import datetime_now
-from orchestrator._interface import DaemonDescription
+from orchestrator._interface import DaemonDescription, DaemonDescriptionStatus
+from orchestrator import HostSpec
+from cephadm.services.ingress import IngressService
 
 
 class TestIngressService:
@@ -1455,3 +1457,144 @@ class TestIngressService:
         )
         ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
         assert "Bind_addr = 10.10.2.20" in ganesha_conf
+
+
+def test_keepalived_should_auto_start_colocated_haproxy():
+    mgr = MagicMock()
+    mgr.cache.get_schedulable_hosts.return_value = [HostSpec('host-a')]
+    spec = IngressSpec(
+        service_id='test',
+        backend_service='rgw.foo',
+        frontend_port=8080,
+        monitor_port=8999,
+        virtual_ip='192.168.1.50/24',
+        placement=PlacementSpec(hosts=['host-a']),
+    )
+    k = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='test',
+        hostname='host-a',
+        service_name='ingress.test',
+    )
+    hp = DaemonDescription(
+        daemon_type='haproxy',
+        daemon_id='test',
+        hostname='host-a',
+        service_name='ingress.test',
+        status=DaemonDescriptionStatus.running,
+        ports=[8080, 8999],
+    )
+    hp_stopped = DaemonDescription(
+        daemon_type='haproxy',
+        daemon_id='test',
+        hostname='host-a',
+        service_name='ingress.test',
+        status=DaemonDescriptionStatus.stopped,
+        ports=[8080, 8999],
+    )
+
+    mgr.cache.get_daemons_by_service.side_effect = lambda n: [] if n == 'ingress.test' else []
+    assert not IngressService.keepalived_should_auto_start(mgr, k, spec)
+
+    mgr.cache.get_daemons_by_service.side_effect = lambda n: [hp, k] if n == 'ingress.test' else []
+    assert IngressService.keepalived_should_auto_start(mgr, k, spec)
+
+    mgr.cache.get_daemons_by_service.side_effect = (
+        lambda n: [hp_stopped, k] if n == 'ingress.test' else []
+    )
+    assert not IngressService.keepalived_should_auto_start(mgr, k, spec)
+
+
+def test_keepalived_should_auto_start_false_when_more_kv_than_required():
+    mgr = MagicMock()
+    mgr.cache.get_schedulable_hosts.return_value = [
+        HostSpec('host-a'),
+        HostSpec('host-b'),
+        HostSpec('host-c'),
+    ]
+    spec = IngressSpec(
+        service_id='test',
+        backend_service='rgw.foo',
+        frontend_port=8080,
+        monitor_port=8999,
+        virtual_ip='192.168.1.50/24',
+        placement=PlacementSpec(hosts=['host-a', 'host-b']),
+    )
+    hp_a = DaemonDescription(
+        daemon_type='haproxy',
+        daemon_id='test',
+        hostname='host-a',
+        service_name='ingress.test',
+        status=DaemonDescriptionStatus.running,
+        ports=[8080, 8999],
+    )
+    hp_b = DaemonDescription(
+        daemon_type='haproxy',
+        daemon_id='test',
+        hostname='host-b',
+        service_name='ingress.test',
+        status=DaemonDescriptionStatus.running,
+        ports=[8080, 8999],
+    )
+    kv_a = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='test',
+        hostname='host-a',
+        service_name='ingress.test',
+    )
+    kv_b = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='test',
+        hostname='host-b',
+        service_name='ingress.test',
+    )
+    kv_extra = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='test',
+        hostname='host-c',
+        service_name='ingress.test',
+    )
+    mgr.cache.get_daemons_by_service.side_effect = (
+        lambda n: [hp_a, hp_b, kv_a, kv_b, kv_extra] if n == 'ingress.test' else []
+    )
+    assert not IngressService.keepalived_should_auto_start(mgr, kv_extra, spec)
+
+
+def test_keepalived_should_auto_start_keepalive_only_backend():
+    mgr = MagicMock()
+    mgr.cache.get_schedulable_hosts.return_value = [HostSpec('host1')]
+    spec = IngressSpec(
+        service_id='test',
+        backend_service='nfs.foo',
+        frontend_port=2049,
+        monitor_port=9049,
+        virtual_ip='192.168.122.100/24',
+        keepalive_only=True,
+        placement=PlacementSpec(hosts=['host1']),
+    )
+    k = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='keepalived.test',
+        hostname='host1',
+        service_name='ingress.test',
+    )
+    nfs_d = DaemonDescription(
+        daemon_type='nfs',
+        daemon_id='foo.host1',
+        hostname='host1',
+        service_name='nfs.foo',
+        status=DaemonDescriptionStatus.starting,
+    )
+
+    mgr.cache.get_daemons_by_service.side_effect = lambda n: []
+    assert not IngressService.keepalived_should_auto_start(mgr, k, spec)
+
+    def _with_nfs(name: str):
+        if name == 'ingress.test':
+            return [k]
+        if name == 'nfs.foo':
+            return [nfs_d]
+        return []
+
+    mgr.cache.get_daemons_by_service.side_effect = _with_nfs
+    assert IngressService.keepalived_should_auto_start(mgr, k, spec)
diff --git a/src/pybind/mgr/cephadm/tests/services/test_nfs.py b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
index faf45146fef..cac439c5d26 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_nfs.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
@@ -1,8 +1,13 @@
 import contextlib
+from typing import cast
 from unittest.mock import MagicMock, patch, ANY
 
 import pytest
 
+from ceph.utils import datetime_now
+from orchestrator import DaemonDescriptionStatus
+
+from cephadm.serve import CephadmServe
 from cephadm.services.service_registry import service_registry
 from cephadm.services.cephadmservice import CephadmDaemonDeploySpec
 from cephadm.module import CephadmOrchestrator
@@ -740,3 +745,68 @@ def test_ingress_for_nfs_choose_next_action(cephadm_module, mock_cephadm):
         # _daemon_action so we can check what action was chosen
         mock_cephadm.serve(cephadm_module)._check_daemons()
         mock_cephadm._daemon_action.assert_called_with(ANY, action="redeploy")
+
+
+@patch("cephadm.services.nfs.NFSService.run_grace_tool", MagicMock())
+@patch("cephadm.services.nfs.NFSService.purge", MagicMock())
+@patch("cephadm.services.nfs.NFSService.create_rados_config_obj", MagicMock())
+def test_check_daemons_starts_keepalived_when_stopped_and_haproxy_running(
+    cephadm_module, mock_cephadm
+):
+    """Regression: serve loop must issue 'start' for keepalived when deps are ok
+    and colocated haproxy is running (keepalived is not systemd-enabled)."""
+    nfs_spec = NFSServiceSpec(
+        service_id="foo",
+        placement=PlacementSpec(hosts=['test']),
+        port=8765,
+    )
+    ingress_spec = IngressSpec(
+        service_id='bar',
+        backend_service='nfs.foo',
+        frontend_port=2468,
+        monitor_port=8642,
+        virtual_ip='1.2.3.0/24',
+        placement=PlacementSpec(hosts=['test']),
+        keepalived_password='abcde',
+    )
+    with contextlib.ExitStack() as stack:
+        stack.enter_context(with_host(cephadm_module, "test"))
+        cephadm_module.cache.update_host_networks(
+            'test',
+            {
+                '1.2.3.0/24': {
+                    'if0': [
+                        '1.2.3.4',
+                        '1.2.3.1',
+                    ]
+                }
+            },
+        )
+        stack.enter_context(with_service(cephadm_module, nfs_spec))
+        stack.enter_context(with_service(cephadm_module, ingress_spec))
+
+        ingress_svc = service_registry.get_service('ingress')
+        ispec = cast(IngressSpec, cephadm_module.spec_store[ingress_spec.service_name()].spec)
+
+        for dd in list(cephadm_module.cache.get_daemons_by_service(ingress_spec.service_name())):
+            if dd.daemon_type == 'haproxy' and dd.hostname == 'test':
+                dd.status = DaemonDescriptionStatus.running
+            elif dd.daemon_type == 'keepalived' and dd.hostname == 'test':
+                dd.status = DaemonDescriptionStatus.stopped
+                assert dd.hostname is not None
+                deps = ingress_svc.sorted_dependencies(
+                    cephadm_module, ispec, 'keepalived'
+                )
+                cephadm_module.cache.update_daemon_config_deps(
+                    dd.hostname, dd.name(), deps, datetime_now()
+                )
+
+        mock_cephadm._daemon_action.reset_mock()
+        CephadmServe(cephadm_module)._check_daemons()
+
+        keepalived_started = any(
+            getattr(c.args[0], 'daemon_type', None) == 'keepalived'
+            and (len(c.args) > 1 and c.args[1] == 'start' or c.kwargs.get('action') == 'start')
+            for c in mock_cephadm._daemon_action.call_args_list
+        )
+        assert keepalived_started

From 6ec51414a9ea2b1bc586356d9511aa2c19bbb951 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Tue, 28 Apr 2026 21:38:22 +0530
Subject: [PATCH 474/596] mgr/cephadm: Scale down ingress service only when the
 backend NFS service is scaled down

When scaling ingress down with a ranked NFS backend that still has more
daemons than its placement target, remove ingress from hosts without NFS
first and skip removing co-located ingress on NFS hosts until the next
iteration after NFS scales down.

Fixes: https://tracker.ceph.com/issues/76304
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/schedule.py            | 25 ++++++++-
 src/pybind/mgr/cephadm/serve.py               | 12 ++++
 .../mgr/cephadm/tests/test_scheduling.py      | 55 +++++++++++++++++++
 3 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/cephadm/schedule.py b/src/pybind/mgr/cephadm/schedule.py
index d2846a853cd..b4f9570a3ee 100644
--- a/src/pybind/mgr/cephadm/schedule.py
+++ b/src/pybind/mgr/cephadm/schedule.py
@@ -219,6 +219,7 @@ class HostAssignment(object):
                  draining_hosts: List[orchestrator.HostSpec],
                  daemons: List[orchestrator.DaemonDescription],
                  related_service_daemons: Optional[List[DaemonDescription]] = None,
+                 related_service_required_count: Optional[int] = None,
                  networks: Dict[str, Dict[str, Dict[str, List[str]]]] = {},
                  filter_new_host: Optional[Callable[[str, ServiceSpec], bool]] = None,
                  allow_colo: bool = False,
@@ -240,6 +241,7 @@ class HostAssignment(object):
         self.service_name = spec.service_name()
         self.daemons = daemons
         self.related_service_daemons = related_service_daemons
+        self.related_service_required_count = related_service_required_count
         self.networks = networks
         self.allow_colo = allow_colo
         self.per_host_daemon_type = per_host_daemon_type
@@ -473,8 +475,27 @@ class HostAssignment(object):
                     # If we still need to remove more, remove from hosts with related services
                     remaining_needed = total_excess - len(to_delete)
                     if remaining_needed > 0:
-                        remaining = [dd for dd in existing if dd not in to_delete]
-                        to_delete.extend(remaining[count:])
+                        # Restrict defer-removal behavior to ingress only.
+                        should_defer_related_removal = False
+                        if self.spec.service_type == 'ingress':
+                            related_service_count = len(self.related_service_daemons)
+                            related_service_required_count = (
+                                self.related_service_required_count or count
+                            )
+                            related_service_is_ranked = any(
+                                dd.rank is not None
+                                for dd in self.related_service_daemons
+                            )
+                            # For ingress with ranked backends (e.g. NFS), if backend
+                            # scale-down is still pending, defer deleting co-located
+                            # ingress daemons until a later iteration.
+                            should_defer_related_removal = (
+                                related_service_is_ranked
+                                and related_service_count > related_service_required_count
+                            )
+                        if not should_defer_related_removal:
+                            remaining = [dd for dd in existing if dd not in to_delete]
+                            to_delete.extend(remaining[count:])
 
                     non_matching_daemons = to_delete
                 else:
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index fe2798984d7..24e7e581a9e 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -870,6 +870,17 @@ class CephadmServe:
         rank_map = None
         if svc.ranked(spec):
             rank_map = self.mgr.spec_store[spec.service_name()].rank_map or {}
+        related_service_required_count = None
+        if service_type == 'ingress':
+            ingress_spec = cast(IngressSpec, spec)
+            assert ingress_spec.backend_service
+            backend_spec = self.mgr.spec_store.active_specs.get(
+                ingress_spec.backend_service
+            )
+            if backend_spec and backend_spec.placement:
+                related_service_required_count = backend_spec.placement.get_target_count(
+                    self.mgr.cache.get_schedulable_hosts()
+                )
         host_selector = _host_selector(svc)
         ha = HostAssignment(
             spec=spec,
@@ -880,6 +891,7 @@ class CephadmServe:
             blocking_daemon_hosts=blocking_daemon_hosts,
             daemons=daemons,
             related_service_daemons=related_service_daemons,
+            related_service_required_count=related_service_required_count,
             networks=self.mgr.cache.networks,
             filter_new_host=host_filters.get(service_type, None),
             allow_colo=svc.allow_colo(),
diff --git a/src/pybind/mgr/cephadm/tests/test_scheduling.py b/src/pybind/mgr/cephadm/tests/test_scheduling.py
index d76204c7ffd..5d3595b95e1 100644
--- a/src/pybind/mgr/cephadm/tests/test_scheduling.py
+++ b/src/pybind/mgr/cephadm/tests/test_scheduling.py
@@ -2082,3 +2082,58 @@ def test_related_service_downsize(service_type, placement, hosts, daemons, relat
     assert sorted(got_add) == sorted(expected_add)
 
     assert sorted([d.name() for d in to_remove]) == sorted(expected_remove)
+
+
+def test_ingress_scale_down_defers_related_when_ranked_backend_exceeds_required():
+    """
+    With ingress count below current daemons, ranked NFS backends still above
+    placement target (related_service_required_count), remove only ingress on
+    hosts without NFS first; defer removing co-located ingress until NFS scales
+    down (next iteration).
+    """
+    spec = IngressSpec(
+        service_type='ingress',
+        service_id='nfs.test',
+        frontend_port=443,
+        monitor_port=8888,
+        virtual_ip='10.0.0.20/8',
+        backend_service='nfs.test',
+        placement=PlacementSpec(count=1),
+    )
+    hosts = [HostSpec(h) for h in 'host1 host2 host3'.split()]
+    daemons = [
+        DaemonDescription('haproxy', 'ingress1', 'host1'),
+        DaemonDescription('keepalived', 'ingress1', 'host1'),
+        DaemonDescription('haproxy', 'ingress2', 'host2'),
+        DaemonDescription('keepalived', 'ingress2', 'host2'),
+        DaemonDescription('haproxy', 'ingress3', 'host3'),
+        DaemonDescription('keepalived', 'ingress3', 'host3'),
+    ]
+    related_service_daemons = [
+        DaemonDescription('nfs', 'nfs1', 'host1', rank=0, rank_generation=0),
+        DaemonDescription('nfs', 'nfs2', 'host2', rank=1, rank_generation=0),
+    ]
+    all_slots, to_add, to_remove = HostAssignment(
+        spec=spec,
+        hosts=hosts,
+        unreachable_hosts=[],
+        draining_hosts=[],
+        daemons=daemons,
+        related_service_daemons=related_service_daemons,
+        related_service_required_count=1,
+        primary_daemon_type='haproxy',
+        per_host_daemon_type='keepalived',
+        rank_map=None,
+    ).place()
+
+    assert sorted(str(p) for p in all_slots) == sorted([
+        'haproxy:host1(*:443,8888,1024)',
+        'haproxy:host2(*:443,8888,1024)',
+        'keepalived:host1',
+        'keepalived:host2',
+    ])
+    assert to_add == []
+    assert sorted(d.name() for d in to_remove) == sorted([
+        'haproxy.ingress3',
+        'keepalived.ingress3',
+    ])

From 132c77376f6b28990bdabe838192c4a650178016 Mon Sep 17 00:00:00 2001
From: "Jesse F. Williamson" <jfw@ibm.com>
Date: Fri, 12 Sep 2025 13:07:43 -0700
Subject: [PATCH 475/596] Add FoundationDB client library "libfdb".

Assisted-by: Codex:GPT-5

Signed-off-by: Jesse F. Williamson <jfw@ibm.com>
---
 CMakeLists.txt                  |  23 +-
 examples/libfdb/Makefile        |  21 +
 examples/libfdb/mini_example.cc |  77 +++
 src/include/buffer.h            |   3 +
 src/rgw/CMakeLists.txt          |  54 +-
 src/rgw/ceph_fdb.h              |  96 ++++
 src/rgw/fdb/EXAMPLES.md         | 324 ++++++++++++
 src/rgw/fdb/NOTES.txt           |  55 ++
 src/rgw/fdb/base.h              | 881 ++++++++++++++++++++++++++++++++
 src/rgw/fdb/conversion.h        | 129 +++++
 src/rgw/fdb/fdb.h               |  23 +
 src/rgw/fdb/interface.h         | 657 ++++++++++++++++++++++++
 src/test/bufferlist.cc          |  11 +
 src/test/rgw/CMakeLists.txt     |  38 +-
 src/test/rgw/test_fdb.cc        | 754 +++++++++++++++++++++++++++
 src/test/rgw/test_fdb_ceph.cc   | 496 ++++++++++++++++++
 src/test/rgw/test_fdb_common.h  | 138 +++++
 17 files changed, 3755 insertions(+), 25 deletions(-)
 create mode 100644 examples/libfdb/Makefile
 create mode 100644 examples/libfdb/mini_example.cc
 create mode 100644 src/rgw/ceph_fdb.h
 create mode 100644 src/rgw/fdb/EXAMPLES.md
 create mode 100644 src/rgw/fdb/NOTES.txt
 create mode 100644 src/rgw/fdb/base.h
 create mode 100644 src/rgw/fdb/conversion.h
 create mode 100644 src/rgw/fdb/fdb.h
 create mode 100644 src/rgw/fdb/interface.h
 create mode 100644 src/test/rgw/test_fdb.cc
 create mode 100644 src/test/rgw/test_fdb_ceph.cc
 create mode 100644 src/test/rgw/test_fdb_common.h

diff --git a/CMakeLists.txt b/CMakeLists.txt
index b173c638cd0..43ce6ef4147 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -592,7 +592,7 @@ option(WITH_RADOSGW_DBSTORE "DBStore backend for RADOS Gateway" ON)
 option(WITH_RADOSGW_MOTR "CORTX-Motr backend for RADOS Gateway" OFF)
 option(WITH_RADOSGW_DAOS "DAOS backend for RADOS Gateway" OFF)
 option(WITH_RADOSGW_D4N "D4N wrapper for RADOS Gateway" ON)
-cmake_dependent_option(WITH_RADOSGW_POSIX "POSIX backend for RADOS Gateway" ON WITH_RADOSGW_DBSTORE OFF) # posix depends on dbstore
+option(WITH_RADOSGW_FDB "FoundationDB support for RADOS Gateway (experimental)" OFF)
 option(WITH_RADOSGW_RADOS "RADOS backend for Rados Gateway" ON)
 option(WITH_RADOSGW_SELECT_PARQUET "Support for s3 select on parquet objects" ON)
 option(WITH_RADOSGW_ARROW_FLIGHT "Build arrow flight when not using system-provided arrow" OFF)
@@ -601,6 +601,9 @@ option(WITH_RADOSGW_BACKTRACE_LOGGING "Enable backtraces in rgw logs" OFF)
 option(WITH_SYSTEM_ARROW "Use system-provided arrow" OFF)
 option(WITH_SYSTEM_UTF8PROC "Use system-provided utf8proc" OFF)
 
+# POSIX depends on DBStore:
+cmake_dependent_option(WITH_RADOSGW_POSIX "POSIX backend for RADOS Gateway" ON WITH_RADOSGW_DBSTORE OFF) 
+
 if(WITH_RADOSGW)
   find_package(EXPAT REQUIRED)
   find_package(OATH REQUIRED)
@@ -654,6 +657,23 @@ if(WITH_RADOSGW)
   message(STATUS "crypto soname: ${LIBCRYPTO_SONAME}")
 endif (WITH_RADOSGW)
 
+if(WITH_RADOSGW_FDB)
+ include(${CMAKE_MODULE_PATH}/CPM.cmake)
+
+ CPMAddPackage("gh:eyalz800/zpp_bits@4.5.1")
+ message("-- enabled zpp_bits")
+
+# JFW: sadly, I'm having trouble getting FoundationDB to build, but this is VERY close
+# to "just working". But, how would we install the RPMs, etc.? This will need looking at
+# before this can be non-experimental:
+# CPMAddPackage("gh:apple/foundationdb@7.3.63")
+ message("FoundationDB support is EXPERIMENTAL and requires manual setup:")
+ message(" wget https://github.com/apple/foundationdb/releases/download/7.3.63/foundationdb-clients-7.3.63-1.el7.x86_64.rpm")
+ message(" wget https://github.com/apple/foundationdb/releases/download/7.3.63/foundationdb-server-7.3.63-1.el7.x86_64.rpm")
+ message("-- enabled FoundationDB (whether its there or not)")
+
+endif()
+
 #option for CephFS
 option(WITH_CEPHFS "CephFS is enabled" ON)
 
@@ -924,4 +944,3 @@ add_tags(ctags
   EXCLUDE_OPTS ${CTAG_EXCLUDES}
   EXCLUDES "*.js" "*.css" ".tox" "python-common/build")
 add_custom_target(tags DEPENDS ctags)
-
diff --git a/examples/libfdb/Makefile b/examples/libfdb/Makefile
new file mode 100644
index 00000000000..18304dfa314
--- /dev/null
+++ b/examples/libfdb/Makefile
@@ -0,0 +1,21 @@
+# Mini-example for libfdb
+
+CXX?=g++
+CXXFLAGS+=-std=c++23 -Wno-unused-parameter -Wall -Wextra -Werror -g
+
+CEPH_SRC?=../../src
+CEPH_BUILD?=../../build
+
+INCLUDES=-I$(CEPH_SRC) -I$(CEPH_BUILD)/_deps/zpp_bits-src
+LIBRARY_PATH=-L$(CEPH_BUILD)/lib/ -Wl,-rpath,$(CEPH_BUILD)/lib
+LIBRARIES=-lfdb_c -lfmtd
+
+all: mini_example
+
+.PHONY: clean
+
+mini_example: mini_example.cc
+	$(CXX) $(CXXFLAGS) $(INCLUDES) $(LIBRARY_PATH) -o mini_example mini_example.cc $(LIBRARIES)
+
+clean:
+	rm -f mini_example
diff --git a/examples/libfdb/mini_example.cc b/examples/libfdb/mini_example.cc
new file mode 100644
index 00000000000..f1e14af4f67
--- /dev/null
+++ b/examples/libfdb/mini_example.cc
@@ -0,0 +1,77 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab ft=cpp
+
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2026 International Business Machines Corp. (IBM)
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+ * Whee! A mini-demo for libfdb! 
+ *
+ * This shows how to take a user-defined data stucture and both store and
+ * retrieve it in FoundationDB. 
+ *
+*/
+
+#include "rgw/fdb/interface.h"
+
+#include <print>
+#include <vector>
+#include <string>
+#include <cstdio>
+
+namespace lfdb = ceph::libfdb;
+
+using namespace std;
+
+struct person
+{
+ string name;
+
+ int year_born = 2000;
+
+ vector<string> titles;
+};
+
+static const vector<person> nifty_people {
+  {
+    .name = "Albrecht Duerer",
+    .year_born = 1471,
+    .titles = { "Painter", "Printmaker", "Northern Renaissance artist" },
+  },
+  {
+    .name = "Maria Theresa",
+    .year_born = 1717,
+    .titles = { "Habsburg ruler", "Archduchess of Austria", "Queen of Hungary and Bohemia" },
+  }
+};
+
+int main()
+try
+{
+ auto dbh = lfdb::create_database();
+
+ lfdb::set(dbh, "example/people", nifty_people);
+
+ vector<person> people;
+ if(lfdb::get(dbh, "example/people", people)) {
+     println("read {} people, some of them are likely nifty", people.size());
+ }
+}
+catch(const lfdb::libfdb_exception& e) {
+    println(stderr, "libfdb exception: {}", e.what());
+    return 1;
+}
+catch(const exception& e) {
+    println(stderr, "exception: {}", e.what());
+    return 1;
+}
+catch(...) {
+    println(stderr, "Well, now we're in a real jam, huh?");
+    return 1;
+}
diff --git a/src/include/buffer.h b/src/include/buffer.h
index 73b7309c15a..a182fe06aa2 100644
--- a/src/include/buffer.h
+++ b/src/include/buffer.h
@@ -289,6 +289,7 @@ struct error_code;
     const char *end_c_str() const;
     char *end_c_str();
     unsigned length() const { return _len; }
+    unsigned size() const { return length(); }
     unsigned offset() const { return _off; }
     unsigned start() const { return _off; }
     unsigned end() const { return _off + _len; }
@@ -1010,6 +1011,7 @@ struct error_code;
     const buffers_t& buffers() const { return _buffers; }
     buffers_t& mut_buffers() { return _buffers; }
     void swap(list& other) noexcept;
+
     unsigned length() const {
 #if 0
       // DEBUG: verify _len
@@ -1027,6 +1029,7 @@ struct error_code;
 #endif
       return _len;
     }
+    unsigned size() const { return length(); }
 
     bool contents_equal(const buffer::list& other) const;
     bool contents_equal(const void* other, size_t length) const;
diff --git a/src/rgw/CMakeLists.txt b/src/rgw/CMakeLists.txt
index a8082f580ad..875c5b21397 100644
--- a/src/rgw/CMakeLists.txt
+++ b/src/rgw/CMakeLists.txt
@@ -262,19 +262,22 @@ endif()
 if(WITH_RADOSGW_DAOS)
   list(APPEND librgw_common_srcs driver/motr/rgw_sal_daos.cc)
 endif()
+
 if(WITH_RADOSGW_POSIX)
   #add_subdirectory(driver/posix)
   find_package(LMDB REQUIRED)
   add_compile_definitions(LMDB_SAFE_NO_CPP_UTILITIES)
   list(APPEND librgw_common_srcs
-	      driver/posix/rgw_sal_posix.cc
 	      driver/posix/lmdb-safe.cc
-	      driver/posix/posixDB.cc
-	      driver/posix/notify.cpp)
+	      driver/posix/notify.cpp
+          driver/posix/posixDB.cc
+	      driver/posix/rgw_sal_posix.cc)
 endif()
+
 if(WITH_JAEGER)
   list(APPEND librgw_common_srcs rgw_tracer.cc)
 endif()
+
 if(WITH_RADOSGW_ARROW_FLIGHT)
   # NOTE: eventually don't want this in common but just in radosgw daemon
   # list(APPEND radosgw_srcs rgw_flight.cc rgw_flight_frontend.cc)
@@ -393,10 +396,6 @@ if(WITH_RADOSGW_DBSTORE)
   target_link_libraries(rgw_common PRIVATE global dbstore)
 endif()
 
-if(WITH_RADOSGW_POSIX)
-  target_link_libraries(rgw_common PRIVATE global dbstore)
-endif()
-
 if(WITH_RADOSGW_MOTR)
   find_package(motr REQUIRED)
   target_link_libraries(rgw_common PRIVATE motr::motr)
@@ -516,6 +515,7 @@ set(radosgw_srcs
   rgw_main.cc)
 
 add_executable(radosgw ${radosgw_srcs})
+
 if(WITH_RADOSGW_ARROW_FLIGHT)
   # target_compile_definitions(radosgw PUBLIC WITH_ARROW_FLIGHT)
   target_compile_definitions(rgw_common PUBLIC WITH_ARROW_FLIGHT)
@@ -538,6 +538,46 @@ target_link_libraries(radosgw PRIVATE
   ${rgw_libs}
   ${ALLOC_LIBS})
 
+if(WITH_RADOSGW_FDB)
+ message("FoundationDB support is active (experimental)")
+
+ add_library(rgw_fdb INTERFACE)
+
+ target_link_libraries(rgw_fdb INTERFACE
+  -lfdb_c
+  -lm
+  -lrt
+ )
+
+ target_compile_options(rgw_fdb INTERFACE
+   -pthread)
+
+#JFW: this is where the FDB client library packages install
+#fdb_c headers-- we need to find a smarter way to handle this
+#end of it before libfdb can be non-experimental:
+ target_include_directories(rgw_fdb INTERFACE
+  /usr/include/foundationdb)
+
+ target_include_directories(rgw_common PRIVATE
+  /usr/include/foundationdb
+  "${CMAKE_SOURCE_DIR}/src/rgw")
+
+ target_link_libraries(rgw_common PRIVATE
+  rgw_fdb)
+
+ target_include_directories(radosgw PRIVATE
+  /usr/include/foundationdb)
+
+ # Use the zpp_bits back-end for serialization:
+ add_library(zpp_bits INTERFACE)
+
+ # JFW: there must be a nicer way to refer to this path (or ask it to be installed somewhere?):
+ target_include_directories(zpp_bits INTERFACE "${CMAKE_BINARY_DIR}/_deps/zpp_bits-src/")
+
+ target_link_libraries(rgw_fdb INTERFACE zpp_bits)
+
+endif(WITH_RADOSGW_FDB)
+
 install(TARGETS radosgw DESTINATION bin)
 
 set(radosgw_admin_srcs
diff --git a/src/rgw/ceph_fdb.h b/src/rgw/ceph_fdb.h
new file mode 100644
index 00000000000..763828c1c19
--- /dev/null
+++ b/src/rgw/ceph_fdb.h
@@ -0,0 +1,96 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab ft=cpp
+
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#ifndef CEPH_FDB_H
+ #define CEPH_FDB_H
+
+/* Welcome, brave adventurer! This where Ceph types are converted back and forth 
+between FDB's types! If you have a user type to add, this is the place!
+*/
+ 
+#include "include/buffer.h"
+
+#include "fdb/fdb.h"
+
+#include <span>
+#include <vector>
+#include <cstdint>
+#include <string_view>
+
+/*** Conversions: */
+
+namespace ceph::libfdb::detail {
+
+auto as_fdb_span(ceph::buffer::list& bl)
+{
+ // c_str() makes the buffer::list contiguous. Use length(), not C-string
+ // rules, because buffer::list may contain arbitrary bytes:
+ auto p = bl.c_str();
+
+ return std::span<const std::uint8_t>(
+          reinterpret_cast<const std::uint8_t *>(p), bl.length());
+}
+
+} // namespace ceph::libfdb::detail
+
+namespace ceph::buffer {
+
+auto serialize(auto& archive, ceph::buffer::list& target)
+{
+ // This should be revisited after the library is separated from the larger
+ // surrounding project-- essentially, we can't write directly /into/ the buffer::list
+ // that I know of; yet, it would obviously be great to eliminate the copy
+ // here. I believe that somewhere in zpp::bits there's probably a way to get the
+ // archive to call a custom function-- but it is not clear to me at this time and
+ // I need to move on for now, unfortunately:
+ std::vector<std::uint8_t> out;
+
+ auto r = archive(out);
+
+ // JFW: this is really annoying, but again buffer::list is not something I find
+ // easy to wrangle-- I'm not sure there's a straightforward way to just assign
+ // a new value... so if you know what that is, please improve this:
+ target.clear();
+ target.append(out);
+
+ return r;
+}
+
+auto serialize(auto& archive, const ceph::buffer::list& src)
+{
+ std::vector<std::uint8_t> bytes;
+
+ auto i = std::cbegin(src);
+
+ // buffer::list copy already resizes the vector:
+ i.copy(src.length(), bytes);
+
+ return archive(std::span<const std::uint8_t> { bytes.data(), bytes.size() });
+}
+
+// This transliteration is one-way: we read from a buffer::ptr to an archive; writing 
+// to a ceph::buffer::ptr as output seems pointless to me, as we already support spans 
+// and buffer::list-- I feel in fact like we would be courting danger we don't need as it
+// is a non-owning structure. 
+auto serialize(auto& archive, const ceph::buffer::ptr& src)
+{
+ std::span<std::uint8_t> src_span((std::uint8_t *)src.c_str(), src.length());
+
+ return archive(src_span);
+}
+
+} // namespace ceph::buffer
+
+#endif
diff --git a/src/rgw/fdb/EXAMPLES.md b/src/rgw/fdb/EXAMPLES.md
new file mode 100644
index 00000000000..f06f24d6890
--- /dev/null
+++ b/src/rgw/fdb/EXAMPLES.md
@@ -0,0 +1,324 @@
+# libfdb Examples
+
+"Take a thousand days of practice for forging, and ten thousand days of practice for refining." 
+    -- Miyamoto Musashi, Go Rin No Sho (~1645)
+
+Welcome, traveller! Grab your favorite walking stick, and let us journey into
+the realm of libfdb! 
+
+While this is not proper documentation, hopefully this "cookbook-stye" set
+of mini-examples will help you on your libfdb path.
+
+Errata: Please report errata, or contact with examples you would like to see! 
+
+These examples use a short namespace alias for readability and also to save
+typing with one's poor fingers! Yoikes!
+
+See examples/libfdb/ for some working, compilable simple examples.
+
+```cpp
+namespace lfdb = ceph::libfdb;
+using namespace std::string_literals;
+```
+
+## General Recipes
+
+```cpp
+/* Use a database_handle when you desire a single logical operation. Behind
+ * the scenes, libfdb will create and complete its own transaction for you.
+ * Database-handle operations may retry after recoverable FoundationDB errors,
+ * so callbacks and output iterators may be activated more than once. */
+lfdb::set(dbh, "person/barbara-moo/name", "Barbara Moo");
+```
+
+```cpp
+/* Pass a transaction handle when several operations must be grouped in the
+ * same transaction. Do not use the transaction after commit(). */
+auto txn = lfdb::make_transaction(dbh);
+
+lfdb::set(txn, "person/barbara-moo/name", "Barbara Moo");
+lfdb::set(txn, "person/barbara-moo/book", "Accelerated C++");
+
+if (!lfdb::commit(txn)) {
+  /* Retry the transaction body with a fresh or recovered transaction. */
+}
+```
+
+## Setup
+
+```cpp
+/* Open the default FoundationDB database. */
+auto dbh = lfdb::create_database();
+```
+
+```cpp
+/* Open a database with database and network options. Flag-only options use
+ * lfdb::option_flag because they have no value. Network options are applied
+ * only during the first FoundationDB network initialization; later calls to
+ * create_database() cannot change them. */
+lfdb::database_options dbopts{
+  { FDB_DB_OPTION_TRANSACTION_TIMEOUT, std::int64_t{5000} },
+};
+
+lfdb::network_options netopts{
+  { FDB_NET_OPTION_TRACE_ENABLE, lfdb::option_flag },
+};
+
+auto dbh = lfdb::create_database(dbopts, netopts);
+```
+
+```cpp
+/* Open a database with an explicit cluster file plus database/network options. */
+auto dbh = lfdb::create_database("/path/to/fdb.cluster", dbopts, netopts);
+```
+
+## Single-Key Operations
+
+```cpp
+/* Store and retrieve one value by key. */
+lfdb::set(dbh, "person/konrad-zuse/name", "Konrad Zuse");
+
+std::string name;
+if (lfdb::get(dbh, "person/konrad-zuse/name", name)) {
+  /* use name */
+}
+```
+
+```cpp
+/* Use a callback when the raw serialized bytes must be copied or decoded
+ * immediately. The span is only valid during the callback. */
+lfdb::get(dbh, "person/konrad-zuse/name",
+          [](std::span<const std::uint8_t> bytes) {
+            /* copy or decode bytes here */
+          });
+```
+
+## Key Existence And Erase
+
+```cpp
+/* Check for a key and erase it if it exists. */
+if (lfdb::key_exists(dbh, "person/jose-capablanca/title")) {
+  lfdb::erase(dbh, "person/jose-capablanca/title");
+}
+```
+
+## Multi-Key Writes
+
+```cpp
+/* Write key/value pairs from an STL associative container in one transaction. */
+std::map<std::string, std::string> people{
+  { "person/saladin/name", "Saladin" },
+  { "person/al-khwarizmi/name", "Al-Khwarizmi" },
+  { "person/albrecht-duerer/name", "Albrecht Duerer" },
+};
+
+lfdb::set(dbh, std::begin(people), std::end(people));
+```
+
+## Multi-Key Reads
+
+```cpp
+/* Read a key range into an STL associative container. */
+std::map<std::string, std::string> people;
+
+lfdb::get(dbh,
+          lfdb::select { "person/" },
+          std::inserter(people, std::end(people)));
+```
+
+## Key Ordering
+
+```cpp
+/* FoundationDB keys are ordered lexicographically by byte string. Choose key
+ * formats so lexical order matches the scan order you want. Numeric suffixes
+ * should usually be fixed-width and zero-padded. */
+lfdb::set(dbh, "person/000001/name", "Barbara Moo");
+lfdb::set(dbh, "person/000010/name", "Konrad Zuse");
+```
+
+## Prefix Selection
+
+"select" has two constructor forms. The one-argument form is usually the one
+you want: it selects every key with a shared prefix. This is a natural fit for
+FoundationDB key design, where related records are commonly grouped under a
+prefix such as `person/`, `bucket/index/`, or `object/metadata/`.
+
+```cpp
+/* Select all keys beginning with "person/". */
+auto people = lfdb::select { "person/" };
+```
+
+Using a key beginning with 0xFF will result in unpredictable behavior.
+
+## Explicit Key Ranges
+
+```cpp
+/* Select a half-open lexicographic key range: begin is included, end is
+ * excluded. */
+auto medieval_people = lfdb::select { "person/charlemagne", "person/saladin/" };
+```
+
+## Pair Generator
+
+```cpp
+/* Use pair_generator() for ordinary range scans where processing one key/value
+ * pair at a time is natural. */
+std::map<std::string, std::string> people;
+
+std::ranges::copy(lfdb::pair_generator(dbh, lfdb::select { "person/" }),
+                  std::inserter(people, std::end(people)));
+```
+
+## Block Generator
+
+For very large prefix scans, use the same one-argument selector with
+`block_generator()`. This lets libfdb plan and read the range in blocks while
+the call site still names the logical key family directly.
+
+```cpp
+/* Use block_generator() for large range scans where split planning and
+ * block-at-a-time processing are useful. */
+for (auto&& block : lfdb::block_generator(dbh, lfdb::select { "object/metadata/" })) {
+  /* process block */
+}
+```
+
+## STL Containers As Values
+
+```cpp
+/* Store an STL container as one serialized value. */
+std::vector roles{ "compiler"s, "systems"s, "naval-officer"s };
+
+lfdb::set(dbh, "person/grace-hopper/roles", roles);
+
+std::vector<std::string> out_roles;
+lfdb::get(dbh, "person/grace-hopper/roles", out_roles);
+```
+
+## Associative Containers As Values
+
+```cpp
+/* Store an associative container as one serialized value. */
+std::map<std::string, std::string> profile{
+  { "name", "Maria Theresa" },
+  { "title", "Archduchess of Austria" },
+};
+
+lfdb::set(dbh, "person/maria-theresa/profile", profile);
+
+std::map<std::string, std::string> out_profile;
+lfdb::get(dbh, "person/maria-theresa/profile", out_profile);
+```
+
+## User Types As Values
+
+```cpp
+/* Store a user-defined type as one serialized value. */
+struct person_profile
+{
+  using serialize = zpp::bits::members<3>;
+
+  std::string name;
+  std::string field;
+  std::vector<std::string> tags;
+};
+
+auto profile = person_profile{
+  .name = "Edsger Dijkstra",
+  .field = "computer science",
+  .tags = std::vector{ "algorithms"s, "formal-methods"s },
+};
+
+lfdb::set(dbh, "person/edsger-dijkstra/profile", profile);
+
+person_profile out_profile;
+lfdb::get(dbh, "person/edsger-dijkstra/profile", out_profile);
+```
+
+## Manual Transactions
+
+```cpp
+/* Group multiple operations in one explicit transaction. */
+auto txn = lfdb::make_transaction(dbh);
+
+lfdb::set(txn, "person/matilda-of-tuscany/name", "Matilda of Tuscany");
+lfdb::set(txn, "person/matilda-of-tuscany/title", "Margravine");
+
+if (!lfdb::commit(txn)) {
+  /* Retry the transaction body. */
+}
+```
+
+## Manual Transactions With Options
+
+```cpp
+/* Create an explicit transaction with transaction options. */
+lfdb::transaction_options opts{
+  { FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE, lfdb::option_flag },
+};
+
+auto txn = lfdb::make_transaction(dbh, opts);
+
+lfdb::set(txn, "person/hypatia/name", "Hypatia");
+
+if (!lfdb::commit(txn)) {
+  /* Retry the transaction body. */
+}
+```
+
+## Transactors: Replayable Transactions
+
+Transactors are function objects created with `make_transactor()`. Creating a
+transactor does not start a transaction; calling `operator()` creates the
+transaction, invokes the body, and commits it.
+
+The body may be called more than once after retryable FoundationDB errors. Keep
+it deterministic and free of non-idempotent external side effects. If recovery
+is not possible, or if user code throws, the exception escapes to the caller.
+
+```cpp
+/* Use a transactor when the transaction body should be replayed after retryable
+ * FoundationDB errors. */
+auto txr = lfdb::make_transactor(dbh);
+
+txr([](auto& txn) {
+  lfdb::set(txn, "person/eleanor-of-aquitaine/name", "Eleanor of Aquitaine");
+  lfdb::set(txn, "person/eleanor-of-aquitaine/title", "Duchess of Aquitaine");
+});
+```
+
+### Transactor options
+
+```cpp
+/* Options are applied to each transaction the transactor creates. */
+lfdb::transaction_options opts{
+  { FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE, lfdb::option_flag },
+};
+
+auto txr = lfdb::make_transactor(dbh, opts);
+
+txr([](auto& txn) {
+  lfdb::set(txn, "person/zenobia/name", "Zenobia");
+});
+```
+
+```cpp
+/* Retryable FoundationDB errors are handled before control returns here. */
+auto txr = lfdb::make_transactor(dbh);
+
+try {
+    txr([](auto& txn) {
+        /* User exceptions propagate; the body is not committed. */
+        validate_profile_update();
+
+        lfdb::set(txn, "person/jose-capablanca/title",
+                  std::vector{ "Original Grandmaster"s, "World Chess Champion"s });
+    });
+}
+catch (const lfdb::libfdb_exception& e) {
+    /* FoundationDB reported an error that libfdb could not recover from. */
+}
+catch (const std::exception& e) {
+    /* Application or system error from user code. */
+}
+```
diff --git a/src/rgw/fdb/NOTES.txt b/src/rgw/fdb/NOTES.txt
new file mode 100644
index 00000000000..2f01767bb9b
--- /dev/null
+++ b/src/rgw/fdb/NOTES.txt
@@ -0,0 +1,55 @@
+
+* If you're looking for some information about how to use the library, interface.h is the "user interface".
+
+----
+Network and Database Options:
+
+There are various database at network settings that can be adjusted; see the "options" test for some examples of using
+the network_options and database_options structures. But what may be tweaked, you ask? Excellent question-- and when
+you go to fdb_c's documentation, you will find little, because they are GENERATED! And, from whence? Well... because 
+this file is VERY hard to find (in the FDB source), here you are:
+    fdbclient/vexillographer/fdb.options
+
+----
+Equivalence with FDBStreamingMode:
+
+FDB_STREAMING_MODE_ITERATOR
+
+The caller is implementing an iterator (most likely in a binding to a higher level language). The amount of data returned depends on the value of the iteration parameter to fdb_transaction_get_range().
+
+FDB_STREAMING_MODE_SMALL
+
+Data is returned in small batches (not much more expensive than reading individual key-value pairs).
+
+FDB_STREAMING_MODE_MEDIUM
+
+Data is returned in batches between _SMALL and _LARGE.
+
+FDB_STREAMING_MODE_LARGE
+
+Data is returned in batches large enough to be, in a high-concurrency environment, nearly as efficient as possible. If the caller does not need the entire range, some disk and network bandwidth may be wasted. The batch size may be still be too small to allow a single client to get high throughput from the database.
+
+FDB_STREAMING_MODE_SERIAL
+
+Data is returned in batches large enough that an individual client can get reasonable read bandwidth from the database. If the caller does not need the entire range, considerable disk and network bandwidth may be wasted.
+
+FDB_STREAMING_MODE_WANT_ALL
+
+The caller intends to consume the entire range and would like it all transferred as early as possible.
+
+FDB_STREAMING_MODE_EXACT
+
+The caller has passed a specific row limit and wants that many rows delivered in a single batch.
+
+enum struct streaming_mode_t : int {
+ iterator	= FDB_STREAMING_MODE_ITERATOR,
+ small		= FDB_STREAMING_MODE_SMALL,
+ medium		= FDB_STREAMING_MODE_MEDIUM,
+ large		= FDB_STREAMING_MODE_LARGE,
+ serial		= FDB_STREAMING_MODE_SERIAL,
+ all		= FDB_STREAMING_MODE_WANT_ALL,
+3F exact		= FDB_STREAMING_MODE_EXACT
+};
+
+...these are not defined in terms of int or enum as far as I can tell, needs more exploring.
+
diff --git a/src/rgw/fdb/base.h b/src/rgw/fdb/base.h
new file mode 100644
index 00000000000..b62ce6e855c
--- /dev/null
+++ b/src/rgw/fdb/base.h
@@ -0,0 +1,881 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*- // vim: ts=8 sw=2 smarttab ft=cpp
+      
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#ifndef CEPH_FDB_BASE_H
+ #define CEPH_FDB_BASE_H
+
+// The API version we're writing against, which can (and probably does) differ
+// from the installed version. This must be defined before the FoundationDB header
+// is included (see fdb_c_apiversion.g.h):
+#define FDB_API_VERSION 730
+#include <foundationdb/fdb_c.h> 
+
+// Ceph uses libfmt rather than <format>:
+#include <fmt/format.h>
+#include <fmt/ranges.h>
+
+#include <tuple>
+#include <mutex>
+#include <memory>
+#include <span>
+#include <ranges>
+#include <thread>
+#include <vector>
+#include <cstdint>
+#include <utility>
+#include <variant>
+#include <optional>
+#include <iterator>
+#include <concepts>
+#include <algorithm>
+#include <generator>
+#include <exception>
+#include <functional>
+#include <filesystem>
+#include <type_traits>
+
+#ifdef __cpp_lib_flat_map
+ #include <flat_map>
+ template <typename ...Args>
+ using flat_map = std::flat_map<Args...>;
+#else
+ #include <boost/container/flat_map.hpp>
+ template <typename ...Args>
+ using flat_map = boost::container::flat_map<Args...>;
+#endif
+
+// Wrangle some forward declarations:
+namespace ceph::libfdb {
+
+struct select;
+
+class database;
+class transaction;
+
+using database_handle = std::shared_ptr<database>;
+using transaction_handle = std::shared_ptr<transaction>;
+
+extern transaction_handle make_transaction(database_handle dbh);
+
+} // namespace ceph::libfdb
+
+// MOAR forward declarations-- "pay no attention to that man behind the curtain": 
+namespace ceph::libfdb::detail {
+
+template <typename T, typename ...Ts>
+concept is_any_of = (std::is_same_v<T, Ts> || ...);
+
+struct future_value;
+
+template <typename ValueT = std::string>
+std::pair<std::string, ValueT> to_decoded_kv_pair(const FDBKeyValue& kv);
+
+inline fdb_error_t do_commit(transaction_handle& txn);
+
+inline void transaction_set_kv_bytes(const transaction_handle& txn,
+                                     std::span<const std::uint8_t> k,
+                                     std::span<const std::uint8_t> v);
+
+inline future_value await_ready_key_range_future(transaction_handle txn, const ceph::libfdb::select&, int);
+inline future_value await_ready_keyvalue_range_future(transaction_handle txn, const ceph::libfdb::select& key_range, int& iteration);
+
+// A generator that produces successive spans for a range:
+inline std::generator<std::span<const FDBKeyValue>> generate_FDB_pairs(ceph::libfdb::transaction& txn, ceph::libfdb::select key_range);
+
+// Stores a successively-generated of kv pair results to an iterator:
+template <typename OutIterT>
+requires std::output_iterator<OutIterT, std::pair<std::string, std::string>>
+inline bool get_value_range_from_transaction(ceph::libfdb::transaction& txn, const ceph::libfdb::select& key_range, OutIterT out_iter);
+
+} // namespace ceph::libfdb::detail
+
+namespace ceph::libfdb::concepts {
+
+// Note that "stringlikes" are not all "stringview-likes", such as when they can be
+// written to:
+template <typename StringViewLikeT>
+concept stringview_convertible = std::convertible_to<StringViewLikeT, std::string_view>;
+
+template <typename IteratorT>
+concept key_value_iterator =
+ std::input_iterator<IteratorT> and
+ requires(const std::iter_value_t<IteratorT>& kv) {
+  kv.first;
+  kv.second;
+ };
+
+template <typename FnT>
+concept value_callback =
+ std::invocable<FnT&, std::span<const std::uint8_t>>;
+
+template <typename T>
+concept value_output =
+ !value_callback<std::remove_reference_t<T>> &&
+ std::is_lvalue_reference_v<T>;
+
+template <typename T>
+concept storable_invocation_result =
+ !std::is_void_v<T> && !std::is_reference_v<T>;
+
+template <typename T>
+concept supported_invocation_result =
+ std::is_void_v<T> || storable_invocation_result<T>;
+
+// There's a high likelihood that we're going to get more sophisticated selectors, 
+// so this is doing a more important job than it may appear to be:
+template <typename T>
+concept selector = ceph::libfdb::detail::is_any_of<T, ceph::libfdb::select>;
+
+} // namespace ceph::libfdb::concepts
+
+// libfdb_exception: How to deal, when Bad Things(TM) happen:
+namespace ceph::libfdb {
+
+// Should we commit after the (possibly) mutating operation?
+enum struct commit_after_op { commit, no_commit };
+
+struct libfdb_exception final : std::runtime_error
+{
+ using std::runtime_error::runtime_error;
+
+ fdb_error_t fdb_error_value = -1;
+
+ bool retryable() const noexcept
+ {
+  return 0 < fdb_error_value &&
+         fdb_error_predicate(FDB_ERROR_PREDICATE_RETRYABLE, fdb_error_value);
+ }
+
+ libfdb_exception(std::string_view msg)
+  : std::runtime_error(make_error_string(msg))
+ {}
+
+ explicit libfdb_exception(fdb_error_t fdb_error_value)
+  : std::runtime_error(make_fdb_error_string(fdb_error_value)),
+    fdb_error_value(fdb_error_value)
+ {}
+
+ static std::string make_error_string(const std::string_view msg)
+ {
+  return fmt::format("libfdb: {}", msg);
+ }
+
+ static std::string make_fdb_error_string(const fdb_error_t ec)
+ {
+  return make_error_string(fmt::format("FoundationDB error {}: {}", ec, fdb_get_error(ec)));
+ }
+};
+
+// A straightforward but pretty handy predicate-- ask an exception if it's something the
+// user can try replaying an operation to correct:
+inline bool retryable(const libfdb_exception& e) noexcept
+{
+ return e.retryable();
+}
+
+namespace detail {
+
+struct future_value final
+{
+ std::unique_ptr<FDBFuture, decltype(&fdb_future_destroy)> future_ptr;
+
+ public:
+ explicit future_value(FDBFuture *future_handle)
+  : future_ptr(future_handle, &fdb_future_destroy)
+ {}
+
+ public:
+ FDBFuture *raw_handle() const noexcept { return future_ptr.get(); }
+
+ private:
+ void destroy() noexcept { future_ptr.reset(nullptr); }
+ 
+ private:
+ friend class ceph::libfdb::transaction;
+};
+
+constexpr auto as_fdb_span(const char *s)
+{
+ return std::span<const std::uint8_t>((const std::uint8_t *)s, std::strlen(s));
+}
+
+constexpr auto as_fdb_span(std::string_view sv) 
+{ 
+ return std::span<const std::uint8_t>((const std::uint8_t *)sv.data(), sv.size()); 
+}
+
+/* Prefix selectors assume user keys do not start with 0xFF. Appending 0xFF
+would exclude valid keys (beginning with prefix + 0xFF), so we build the 
+next-in-lexicographic-order key instead. Callers can still specify an 
+explicit full range if they need something special: */
+inline std::string make_range_end_key_for_prefix(std::string_view prefix)
+{
+ if (prefix.empty()) {
+  return "\xFF";
+ }
+
+ if (0xFF == static_cast<unsigned char>(prefix.front())) {
+  throw libfdb_exception("requested prefix has no (finite) end key");
+ }
+
+ auto i = prefix.find_last_not_of(static_cast<char>(0xFF));
+ auto end_key = std::string(prefix.substr(0, i + 1));
+
+ end_key.back() = static_cast<char>(static_cast<unsigned char>(end_key.back()) + 1);
+
+ return end_key;
+}
+
+} // namespace ceph::libfdb::detail
+
+/* lfdb::select is for handling batch queries-- there are two constructors to consider:
+    - single-key select creates the range containing all keys with that prefix;
+    - passing a start and end key creates a half-open lexicographic key range: [begin_key, end_key). */
+struct select final
+{
+ std::string begin_key, end_key;
+
+ public:
+ // We'll eventually need a way to get settings into the base library from the binding layer; there 
+ // are a few ways we could do it, this is one I'm mulling over; do not use this right now.
+ mutable struct {
+  int stride = 0; // "unlimited"
+
+  // Some parts of the documentation claim FDB_STREAMING_MODE_ITERATOR is the default, other parts 
+  // don't... examples tend to use FDB_STREAMING_MODE_WANT_ALL, but they operate on fairly small amounts 
+  // of data. It's pretty hard to understand what the Right Thing(TM) to do is, the sure the answer may 
+  // evolve as I learn more, but for now this setting at least means it's "plumbed through" (this 
+  // particular mode starts with small batches and then grows to larger increments as more data is sent), 
+  // even though this isn't really used at the moment:
+  FDBStreamingMode streaming_mode = FDB_STREAMING_MODE_ITERATOR; 
+
+ } options;
+
+ public:
+ select(std::string_view begin_key_, std::string_view end_key_)
+  : begin_key(begin_key_), end_key(end_key_)
+ {}
+
+ select(std::string_view prefix)
+  : begin_key(prefix),
+    end_key(detail::make_range_end_key_for_prefix(prefix))
+ {}
+
+};
+
+// Flag-only options are indicated with an explicit option_flag, as they have no actual value:
+struct option_flag_t final {};
+inline constexpr option_flag_t option_flag;
+
+using option_value = std::variant<option_flag_t, std::int64_t, std::string, std::vector<std::uint8_t>>;
+
+// i.e. option /code/ to the value of the option itself (e.g. FDB_FOO, 42):
+template <typename OptionCodeT>
+using option_map = flat_map<OptionCodeT, option_value>; 
+
+using network_options = option_map<FDBNetworkOption>;
+using database_options = option_map<FDBDatabaseOption>;
+using transaction_options = option_map<FDBTransactionOption>;
+
+namespace detail {
+
+// Note that these are specific to FDB's needs (see return type, casts):
+constexpr const std::uint8_t *data_of(const std::vector<std::uint8_t>& xs) { return (const std::uint8_t *)xs.data(); }
+constexpr const std::uint8_t *data_of(const std::string& xs) { return (const std::uint8_t *)xs.data(); }
+constexpr const std::uint8_t *data_of(const std::int64_t& x) { return reinterpret_cast<const std::uint8_t *>(&x); }
+constexpr const std::uint8_t *data_of(const option_flag_t&) { return nullptr; }
+
+// Note that these are specific to FDB's needs (see return type, casts):
+constexpr int size_of(const std::vector<std::uint8_t>& xs) { return static_cast<int>(xs.size()); }
+constexpr int size_of(const std::string& xs) { return static_cast<int>(xs.size()); }
+constexpr int size_of(const std::int64_t) { return 8; } // 8b = size required by FDB
+constexpr int size_of(const option_flag_t&) { return 0; }
+
+// ...also used:
+constexpr std::uint8_t *data_of(std::string_view xs) { return (std::uint8_t *)xs.data(); }
+constexpr int size_of(std::string_view xs) { return static_cast<int>(xs.size()); }
+
+inline auto as_fdb_option_args(const auto& option)
+{
+ auto [data, size] = std::visit([](const auto& x) {
+                         return std::tuple { data_of(x), size_of(x) };
+                       },
+                       option.second);
+
+ return std::tuple { option.first, data, size };
+}
+
+inline void apply_options(const auto& option_map, auto&& set_option)
+{
+ std::ranges::for_each(option_map, [&set_option](const auto& option) {
+    auto args = as_fdb_option_args(option);
+
+    if (auto r = std::apply(set_option, args); 0 != r) {
+      throw libfdb_exception(fmt::format("while setting option {}; {}",
+                             static_cast<int>(option.first),
+                             libfdb_exception::make_fdb_error_string(r)));
+    }
+  });
+}
+
+// The global DB state and management thread:
+// JFW: more user hooks that go into FDB system possible here
+class database_system final
+{
+ database_system() = delete;
+
+ private:
+ static inline bool was_initialized = false;
+
+ static inline std::once_flag fdb_was_initialized;
+ static inline std::jthread fdb_network_thread;
+
+ static inline void initialize_fdb(const network_options& options)
+ {
+  // This must be called before ANY other API function:
+  if (fdb_error_t r = fdb_select_api_version(FDB_API_VERSION); 0 != r)
+   throw libfdb_exception(r);
+ 
+  // Zero or more calls to this may now be made:
+  apply_options(options, fdb_network_set_option);
+ 
+  // This must be called before any other API function (besides >= 0 calls to fdb_network_set_option()):
+  if (fdb_error_t r = fdb_setup_network(); 0 != r)
+   throw libfdb_exception(r);
+ 
+  // Launch network thread:
+  fdb_network_thread = std::jthread { &fdb_run_network };
+ 
+  // Okie-dokie, we're all set (distinct from fdb_was_initialized):
+  was_initialized = true;
+ }
+
+ private:
+ database_system(const network_options& network_opts)
+ {
+   std::call_once(ceph::libfdb::detail::database_system::fdb_was_initialized, 
+                  ceph::libfdb::detail::database_system::initialize_fdb, 
+                  network_opts);
+ } 
+
+ public:
+ static bool& initialized() noexcept { return was_initialized; } 
+
+ public: 
+ static inline void shutdown_fdb()
+ {
+  using namespace std::chrono_literals;
+ 
+  if (not initialized()) {
+    return;
+  }
+
+  // shut down network and database:
+  if (int r = fdb_stop_network(); 0 != r)
+   {
+     // In this case, we likely don't want to throw from our dtor, but we may
+     // have something to log. As there's no higher-level hook for that, we
+     // have nothing to do right now.
+     // fmt::println("database::shutdown_fdb() error {}", r);
+   }
+
+  // This may not actually be needed, but it's a traditional courtesy:
+  std::this_thread::sleep_for(7ms); 
+ 
+  if (fdb_network_thread.joinable()) {
+   fdb_network_thread.join();
+  }
+ }
+
+ private:
+ friend struct ceph::libfdb::database;
+};
+ 
+} // namespace ceph::libfdb::detail
+
+class database final
+{
+ detail::database_system db_system;
+
+ private:
+ std::shared_ptr<FDBDatabase> db_handle; 
+
+ FDBDatabase *create_database_ptr(const std::filesystem::path cluster_file_path) {
+    FDBDatabase *fdbp = nullptr;
+
+    if (fdb_error_t r = fdb_create_database(cluster_file_path.c_str(), &fdbp); 0 != r) {
+      throw libfdb_exception(r);
+    }
+    
+    return fdbp;
+ }
+
+ FDBTransaction *create_transaction() {
+    FDBTransaction *txn_p = nullptr;
+    
+    if (fdb_error_t r = fdb_database_create_transaction(raw_handle(), &txn_p); 0 != r) {
+     throw libfdb_exception(r);
+    }
+
+    return txn_p;
+ }
+
+ public:
+ database(const std::filesystem::path cluster_file_path, const ceph::libfdb::database_options& db_opts, const network_options& network_opts)
+  : db_system(network_opts),
+    db_handle(create_database_ptr(cluster_file_path), &fdb_database_destroy)
+ {
+  detail::apply_options(db_opts,
+             [handle = raw_handle()](auto option_code, auto data, auto size) {
+               return fdb_database_set_option(handle, option_code, data, size);
+             });
+ }
+
+ database(const std::filesystem::path cluster_file_path, const ceph::libfdb::database_options& db_opts)
+  : database(cluster_file_path, db_opts, {})
+ {}
+
+ database(const ceph::libfdb::database_options& db_opts, const ceph::libfdb::network_options& net_opts)
+  : database("", db_opts, net_opts)
+ {}
+
+ database(const ceph::libfdb::database_options& db_opts)
+  : database("", db_opts, {})
+ {}
+
+ database(const std::filesystem::path cluster_file_path)
+  : database(cluster_file_path, {}, {})
+ {}
+
+ database()
+  : database(std::filesystem::path {}, {}, {})
+ {}
+
+ public:
+ explicit operator bool() const noexcept { return nullptr != raw_handle(); }
+
+ public:
+ FDBDatabase *raw_handle() const noexcept { return db_handle.get(); }
+
+ private:
+ friend transaction;
+
+};
+
+class transaction final
+{
+ database_handle dbh;
+
+ std::unique_ptr<FDBTransaction, decltype(&fdb_transaction_destroy)> txn_handle;
+
+ private:
+ bool get_single_value_from_transaction(const std::span<const std::uint8_t>& key, std::invocable<std::span<const std::uint8_t>> auto&& write_output); 
+
+ public:
+ transaction(database_handle dbh_)
+ : dbh(dbh_),
+   txn_handle(dbh->create_transaction(), &fdb_transaction_destroy)
+ {}
+
+ transaction(database_handle dbh_, const transaction_options& opts) 
+  : transaction(dbh_)
+ {
+  detail::apply_options(opts,
+             [handle = raw_handle()](auto code, auto data, auto size) {
+               return fdb_transaction_set_option(handle, code, data, size);
+             });
+ }
+
+ public:
+ explicit operator bool() const noexcept { return dbh && nullptr != raw_handle(); }
+
+ public:
+ FDBTransaction *raw_handle() const noexcept { return txn_handle.get(); }
+
+ private:
+ void set(std::span<const std::uint8_t> k, std::span<const std::uint8_t> v) {
+    fdb_transaction_set(raw_handle(),
+                        (const uint8_t*)k.data(), k.size(),
+                        (const uint8_t*)v.data(), v.size());
+ }
+
+ // JFW: it's not as easy to wedge an output_range into here as it appears, perhaps
+ // needs to be revisited; I'm binding it to what's actually used in practice for now:
+ template <typename OutIterT>
+ requires std::output_iterator<OutIterT, std::pair<std::string, std::string>>
+ bool get(const ceph::libfdb::select& key_range, OutIterT out_iter) {
+    return ceph::libfdb::detail::get_value_range_from_transaction(*this, key_range, out_iter);
+ }
+ 
+ bool get(const std::span<const std::uint8_t> k, concepts::value_callback auto&& val_collector) {
+    return get_single_value_from_transaction(k, val_collector);
+ }
+
+ void erase(std::span<const std::uint8_t> k) {
+    fdb_transaction_clear(raw_handle(),
+                          (const std::uint8_t *)k.data(), k.size());
+ }
+
+ void erase(const ceph::libfdb::concepts::selector auto& key_range) {
+    fdb_transaction_clear_range(raw_handle(),
+        (const uint8_t *)key_range.begin_key.data(), key_range.begin_key.size(), 
+        (const uint8_t *)key_range.end_key.data(), key_range.end_key.size());
+ }
+
+ bool key_exists(std::string_view k) {
+    return get_single_value_from_transaction(detail::as_fdb_span(k), [](auto) {});
+ }
+
+ bool commit(fdb_error_t *replay_error = nullptr);
+ void destroy() noexcept { txn_handle.reset(); }
+
+ // As you can see, friends are used extensively to implement the public interface; it would be nice to come up
+ // with a strategy for making these "lists" a bit more managable, but for now it's what we have and it allows me ot
+ // keep these handles mostly-opaque (this has proven to be a good idea as I've a few times shuffled internal details
+ // with no disruption to the user interface surface):
+ private:
+ friend inline void set(transaction_handle, const std::string_view, const auto&, const commit_after_op);
+ friend inline void set(database_handle, std::string_view, const auto&);
+ friend inline void set(transaction_handle, std::string_view, const ceph::libfdb::concepts::stringview_convertible auto&, const commit_after_op);
+ friend inline void set(database_handle, std::string_view, const ceph::libfdb::concepts::stringview_convertible auto&);
+
+ template <typename OutputTargetOrFnT>
+ requires concepts::value_callback<std::remove_reference_t<OutputTargetOrFnT>> ||
+          concepts::value_output<OutputTargetOrFnT&&>
+ friend inline bool get(ceph::libfdb::transaction_handle,
+                        std::string_view,
+                        OutputTargetOrFnT&&,
+                        const commit_after_op);
+ friend inline bool get(ceph::libfdb::transaction_handle, const ceph::libfdb::select&, auto, const commit_after_op);
+
+ friend inline void erase(ceph::libfdb::transaction_handle, std::string_view, const commit_after_op);
+ friend inline void erase(ceph::libfdb::transaction_handle, const ceph::libfdb::select&, const commit_after_op);
+ friend inline void erase(ceph::libfdb::database_handle, std::string_view);
+ friend inline void erase(ceph::libfdb::database_handle, const ceph::libfdb::select&);
+
+ friend inline bool key_exists(transaction_handle txn, std::string_view k, const commit_after_op commit_after);
+
+ friend inline bool commit(transaction_handle& txn);
+ friend inline fdb_error_t ceph::libfdb::detail::do_commit(transaction_handle& txn);
+ friend inline void ceph::libfdb::detail::transaction_set_kv_bytes(const transaction_handle&,
+                                                                   std::span<const std::uint8_t>,
+                                                                   std::span<const std::uint8_t>);
+
+};
+
+namespace detail {
+
+// Since lambdas cannot be friend-functions, we use a named helper:
+inline void transaction_set_kv_bytes(const transaction_handle& txn,
+                                     std::span<const std::uint8_t> k,
+                                     std::span<const std::uint8_t> v)
+{
+ txn->set(k, v);
+}
+
+} // namespace detail
+
+inline bool ceph::libfdb::transaction::get_single_value_from_transaction(const std::span<const std::uint8_t>& key, std::invocable<std::span<const std::uint8_t>> auto&& write_output)
+{
+ const fdb_bool_t is_snapshot = false; 
+
+ detail::future_value fv(fdb_transaction_get(
+                                    raw_handle(), 
+                                    (const uint8_t *)key.data(), key.size(), 
+                                    is_snapshot));
+    
+  if (fdb_error_t r = fdb_future_block_until_ready(fv.raw_handle()); 0 != r) {
+     throw libfdb_exception(r);
+  }
+ 
+  fdb_bool_t key_was_found = false;
+  const uint8_t *out_buffer = nullptr;
+  int out_len = 0;
+
+  if (fdb_error_t r = fdb_future_get_value(fv.raw_handle(), &key_was_found, &out_buffer, &out_len); 0 != r) {
+    throw libfdb_exception(r);
+  }
+
+  // No errors, but no value was found:
+  if (0 == key_was_found) {
+    return false;
+  }
+ 
+  write_output(std::span<const std::uint8_t>(out_buffer, out_len));
+ 
+  // The happy path is the simple path:
+  return true; 
+}
+
+[[nodiscard]] inline bool ceph::libfdb::transaction::commit(fdb_error_t *replay_error)
+{
+ if (nullptr != replay_error) {
+  *replay_error = 0;
+ }
+
+ // We don't want to try to vivify for an "empty" commit:
+ if (!*this)
+  return false;
+
+ detail::future_value fv(fdb_transaction_commit(raw_handle()));
+
+ if (fdb_error_t r = fdb_future_block_until_ready(fv.raw_handle()); 0 != r) {
+  throw libfdb_exception(r);
+ }
+
+ if (fdb_error_t r = fdb_future_get_error(fv.raw_handle()); 0 != r) {
+  detail::future_value ferror_result(fdb_transaction_on_error(raw_handle(), r));
+
+  if (0 != fdb_future_block_until_ready(ferror_result.raw_handle())) {
+    // In their example, they use the first error as the message source, so I will do that also:
+    throw libfdb_exception(r);
+  }
+
+  if (0 != fdb_future_get_error(ferror_result.raw_handle())) {
+    // Destroy the futures AND be sure to invalidate the transaction-- according to the documentation,
+    // this must happen in the specified order (which /should/ currently match the dtor order, but I am
+    // not going to touch this any more right now):
+    fv.destroy(), ferror_result.destroy(), destroy();
+
+    // Again, use the original error:
+    throw libfdb_exception(r);
+  }
+
+  // A false result means on_error() succeeded; the caller should replay the transaction:
+  if (nullptr != replay_error) {
+   *replay_error = r;
+  }
+
+  return false;
+ }
+
+ // Ok:
+ return true;
+}
+
+} // namespace ceph::libfdb
+
+// Future-wrangling and tricky retry-handling:
+namespace ceph::libfdb::detail {
+
+inline future_value block_until_ready(future_value&& fv)
+{
+ if (fdb_error_t r = fdb_future_block_until_ready(fv.raw_handle()); 0 != r) {
+   throw libfdb_exception(r);
+ }
+
+ // Note that fdb_future_block_until_ready() does not by itself check for errors
+ // with the value; so, we need to do this separately:
+ fdb_error_t r = fdb_future_get_error(fv.raw_handle());
+
+ if (r) {
+  throw libfdb_exception(r);
+ }
+
+ return fv;
+}
+
+inline future_value wait_until_ready(future_value&& fv)
+{
+ if (fdb_error_t r = fdb_future_block_until_ready(fv.raw_handle()); 0 != r) {
+   throw libfdb_exception(r);
+ }
+
+ return fv;
+}
+
+template <typename FnT, typename... XS>
+requires std::invocable<FnT, XS...>
+inline future_value await_future_of(FnT&& fn, XS&& ...params)
+{
+ return block_until_ready(
+          std::invoke(std::forward<FnT>(fn), std::forward<XS>(params)...));
+} 
+
+template <typename OutIterT>
+requires std::output_iterator<OutIterT, std::pair<std::string, std::string>>
+inline bool get_value_range_from_transaction(transaction& txn, const select& key_range, OutIterT out_iter)
+{
+ auto flattened = detail::generate_FDB_pairs(txn, key_range) | std::views::join;
+ std::ranges::transform(flattened, out_iter, to_decoded_kv_pair<std::string>);
+
+ return true;
+}
+
+inline fdb_error_t value_from_db(future_value& fv,
+                        std::invocable<future_value&> auto extract_fn)
+{
+ return std::invoke(extract_fn, fv);
+}
+
+inline bool retry_after_error(ceph::libfdb::transaction_handle& txn, const fdb_error_t r)
+{
+ if (0 == r) {
+   return false;
+ }
+
+ if (not fdb_error_predicate(FDB_ERROR_PREDICATE_RETRYABLE, r)) {
+   // Non-retryable errors cannot be repaired by on_error():
+   throw ceph::libfdb::libfdb_exception(r);
+ }
+
+ future_value on_error_future(fdb_transaction_on_error(txn->raw_handle(), r));
+
+ if (fdb_error_t on_error_r = fdb_future_block_until_ready(on_error_future.raw_handle()); 0 != on_error_r) {
+   throw ceph::libfdb::libfdb_exception(r);
+ }
+
+ if (fdb_error_t on_error_r = fdb_future_get_error(on_error_future.raw_handle()); 0 != on_error_r) {
+   throw ceph::libfdb::libfdb_exception(r);
+ }
+
+ return true;
+}
+
+// Convert FDBKey array into something useful:
+inline std::vector<ceph::libfdb::select> as_select_seq(const FDBKey* const xs, const int n)
+{
+ std::vector<ceph::libfdb::select> out;
+
+ if (1 < n) {
+  out.reserve(static_cast<std::size_t>(n - 1));
+ }
+
+ // Gather the flattened list into *overlapping* libfdb::select pairs:
+ for (const auto& dyad : std::span(xs, n) | std::views::slide(2)) {
+    const auto& fst = std::ranges::begin(dyad)[0];
+    const auto& snd = std::ranges::begin(dyad)[1];
+
+    out.push_back({ 
+      { (const char *)fst.key, static_cast<std::string::size_type>(fst.key_length) }, 
+      { (const char *)snd.key, static_cast<std::string::size_type>(snd.key_length) }
+    });
+ }
+
+ return out;
+}
+// Finding a clear example both in the samples and in the documentation is not very easy. The
+// statelessness of FDB requests bleeds into here with basically no hand-holding, so it's fairly subtle and
+// not easy to see what to do (I'm still not sure I have it right), but note for instance that the call
+// parameters have to change for subsequent reads.
+inline future_value get_range_future_from_transaction(ceph::libfdb::transaction& txn, const ceph::libfdb::select& selection, int iteration)
+{
+  const auto& begin_key  = selection.begin_key;
+  const auto& end_key    = selection.end_key;
+
+  // Hook for getting settings into here through the selector:
+  const auto& streaming_mode = selection.options.streaming_mode;
+
+  // The documentation makes this stuff about as clear as mud... read VERY carefully
+  // when you fiddle with these:
+  int begin_or_eq = (1 == iteration) ? 0 : 1;
+  const int begin_offset = 1;
+  const int end_or_eq = 0;
+  const int end_offset = 1;
+
+  // See validate_and_update_parameters() in fdb_c.cpp (FDB source) if greater clarity is needed on the meaning of some of these, it can be
+  // hard to deduce from the documentation:
+  // Returns an FDBKeyValueArray in the future:
+
+  return future_value(fdb_transaction_get_range(txn.raw_handle(),
+                      (const uint8_t *)begin_key.data(), begin_key.size(),      // the reference-point key
+                      begin_or_eq,                                              // begin or eq
+                      begin_offset,                                             // begin offset
+
+                      (const uint8_t *)end_key.data(), end_key.size(),          // the end selector key
+                      end_or_eq,                                                // end or eq
+                      end_offset,                                               // end offset (a shift AFTER end is matched)
+
+                      // How should results be grouped/chunked:
+                      0,                                                        // limit (0 == unlimited)
+                      0,                                                        // target bytes (0 == unlimited)
+                      streaming_mode,                                           // streaming mode (e.g.: FDB_STREAMING_MODE_WANT_ALL)
+                      iteration,                                                // iteration # (produced side effect)
+
+                      // Other options:
+                      0,                                                        // 0 unless this IS a snapshot read
+                      0                                                         // reverse: should items come in reverse order?
+                    ));
+}
+
+inline std::vector<ceph::libfdb::select> locate_split_points(
+          ceph::libfdb::database_handle dbh, 
+          ceph::libfdb::select selector, 
+          const std::int64_t remote_chunk_size)
+{
+ using ceph::libfdb::detail::wait_until_ready;
+
+ auto txn = ceph::libfdb::make_transaction(dbh);
+
+ // We can do this without side-effects by combining some lambdas, but for now I'm satisfied if it works:
+ FDBKey const *keys = nullptr;
+ int nkeys = 0;
+
+ for (bool should_retry = true; should_retry;) {
+
+    auto fv = wait_until_ready(future_value(fdb_transaction_get_range_split_points(
+                              txn->raw_handle(),
+                              (const std::uint8_t *)selector.begin_key.data(), static_cast<int>(selector.begin_key.length()),
+                              (const std::uint8_t *)selector.end_key.data(), static_cast<int>(selector.end_key.length()),
+                              remote_chunk_size))); 
+
+    should_retry = retry_after_error(txn, value_from_db(fv,
+                    [&keys, &nkeys](future_value& fv) {
+                      return fdb_future_get_key_array(fv.raw_handle(), &keys, &nkeys);
+                   }));
+
+    if (not should_retry) {
+      return as_select_seq(keys, nkeys);
+    }
+ }
+
+ return {};
+}
+
+// Generators:
+// The returned memory should be copied immediately as its lifetime will end once the Future is destroyed:
+// (This is pretty much why this is in the "detail" namespace for the moment.)
+inline std::generator<std::span<const FDBKeyValue>> generate_FDB_pairs(transaction& txn, select key_range) 
+{
+  // As FDB is stateless, we need to track state somewhere:
+  int more_available = 1;
+  int out_count = 0;
+  int iteration = 1; // expected to be 1 when FDB is called in iterator mode
+ 
+  const FDBKeyValue *out_kvs = nullptr;
+
+  for (; more_available; iteration++) {
+
+    auto fv = await_future_of([&]() { return get_range_future_from_transaction(txn, key_range, iteration); });
+
+    if (fdb_error_t r = fdb_future_get_keyvalue_array(fv.raw_handle(), &out_kvs, &out_count, &more_available); 0 != r) {
+       throw libfdb_exception(r);
+    }
+
+    auto result = std::span<const FDBKeyValue>(out_kvs, out_count);
+
+    if (more_available) {
+      // Make the first part of the range for the new search equal to the last one from the old search:
+      const auto& last_key = result.back();
+      key_range.begin_key = std::string_view((const char *)last_key.key, last_key.key_length);
+     }
+
+    co_yield result;
+  }
+}
+
+} // namespace ceph::libfdb::detail
+
+
+#endif
diff --git a/src/rgw/fdb/conversion.h b/src/rgw/fdb/conversion.h
new file mode 100644
index 00000000000..eea6882fe22
--- /dev/null
+++ b/src/rgw/fdb/conversion.h
@@ -0,0 +1,129 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab ft=cpp
+      
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#ifndef CEPH_FDB_CONVERSION_H
+ #define CEPH_FDB_CONVERSION_H
+
+#include "base.h"
+
+#include "zpp_bits.h"
+
+#include <span>
+#include <string>
+#include <vector>
+#include <cstdint>
+#include <concepts>
+#include <functional>
+#include <string_view>
+#include <type_traits>
+#include <system_error>
+
+/* This module is for converting internal types "owned" by FoundationDB. They've initially been implemented in 
+a conversion namespace with overloads, which is the same way that user conversions work, but especially with Concepts
+this technique doesn't have to be used-- it is likely possible to avoid default construction and possible extra copies.
+Since I'm building a prototype right now, it's more important to me on this pass to make things understandable and
+clear, because past experience informs me that it's better to have a clear understanding of what the goals of "to"
+and "from" versions actually are in relationship to user-level types than to have every nanosecond of performance
+be available on day one.
+
+The target of "to" conversions is not a USER type, but rather the FUNCTIONS provided inside of libfdb-- users
+should NOT see the output of these or have to handle them outside of tests or edge-cases (and even then, I doubt it's
+needed, though I won't work hard to stop it). 
+
+I'm hoping that later down the line I can sit and spend more time with this-- it would be nice, for example, if we could
+use memory provided by the caller.
+
+Additionally, this mechanism is mostly obviated by forwarding the work to zpp_bits, but keeping it here provides an additional
+hook "ahead" of that library, and indeed eliminates any actual dependency on it-- we use it to smooth out a few areas where
+zpp_bits is designed for serialization ONLY rather than also playing nice with some conversions, especially those where the
+input and output sizes of an array may not match.
+*/
+namespace ceph::libfdb::to {
+
+inline auto convert(const auto& from, std::vector<std::uint8_t>& out_data) -> std::span<const std::uint8_t>
+{
+ out_data.clear();
+ 
+ zpp::bits::out out(out_data);
+
+ // zpp::bits won't write a size if we start with a fixed size array:
+ // (see dynamic_extent):
+ if constexpr (std::is_array_v<decltype(from)>) {
+     out(std::span(from, std::size(from))).or_throw();
+
+     return out_data;
+ }
+
+ out(from).or_throw();
+
+ return out_data;
+}
+
+inline auto convert(const auto& from) -> std::vector<std::uint8_t>
+{
+ std::vector<std::uint8_t> out_data;
+ convert(from, out_data);
+
+ return out_data;
+}
+
+} // namespace ceph::libfdb::to
+
+/* Map from FDB inputs from FDB TYPE to CONCRETE (i.e. copyable) userland types. Do NOT add 
+non-FDB input sources here (or any non-matching user output sources). Do NOT add
+non-owning targets, lest Antevorda be angered!: */
+namespace ceph::libfdb::from {
+
+inline void convert(const std::span<const std::uint8_t>& from, auto& to)
+{
+ zpp::bits::in zpp_in(from);
+ zpp_in(to).or_throw();
+}
+
+template <std::invocable<const char *, size_t> OutputFunction>
+inline void convert(const std::span<const std::uint8_t>& in, OutputFunction& fn)
+{
+ fn((const char *)in.data(), in.size()); 
+}
+
+} // namespace ceph::libfdb::from
+
+namespace ceph::libfdb::detail {
+
+template <typename ValueT>
+inline std::pair<std::string, ValueT> to_decoded_kv_pair(const FDBKeyValue& kv)
+{
+ std::pair<std::string, ValueT> r;
+
+ r.first.assign((const char *)kv.key, static_cast<std::string::size_type>(kv.key_length));
+
+ try 
+  {
+     ceph::libfdb::from::convert(std::span<const std::uint8_t>(kv.value, kv.value_length), r.second);
+  }
+ catch (const std::system_error& e) {
+     // Translate from underlying (e.g. zpp_bits) conversion error into the right type:
+     // This is a bit bound to zpp_bits for the moment, but there's not a more direct way to distinguish this
+     // from a different system_error. We could do that, by using zpp_bits' non-throwing modes and throwing a
+     // special type, but this will do for now.
+     throw ceph::libfdb::libfdb_exception(e.what());
+  }
+
+ return r;
+}
+
+} // namespace ceph::libfdb::detail
+
+#endif
diff --git a/src/rgw/fdb/fdb.h b/src/rgw/fdb/fdb.h
new file mode 100644
index 00000000000..0165a6c96d1
--- /dev/null
+++ b/src/rgw/fdb/fdb.h
@@ -0,0 +1,23 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
+// vim: ts=8 sw=2 smarttab ft=cpp
+
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#ifndef CEPH_RGW_FDB_H
+ #define CEPH_RGW_FDB_H
+
+#include "base.h"
+#include "interface.h"
+#include "conversion.h"
+
+#endif
diff --git a/src/rgw/fdb/interface.h b/src/rgw/fdb/interface.h
new file mode 100644
index 00000000000..d5677e0f18f
--- /dev/null
+++ b/src/rgw/fdb/interface.h
@@ -0,0 +1,657 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*- // vim: ts=8 sw=2 smarttab ft=cpp
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#ifndef CEPH_FDB_BINDINGS_H
+ #define CEPH_FDB_BINDINGS_H
+
+#include "base.h"
+#include "conversion.h"
+
+#include <span>
+#include <ranges>
+#include <cstdint>
+#include <utility>
+#include <optional>
+#include <concepts>
+#include <iterator>
+#include <generator>
+#include <exception>
+#include <algorithm>
+#include <functional>
+#include <filesystem>
+#include <type_traits>
+
+namespace ceph::libfdb {
+
+/* This needs to be called once and only once during application lifetime,
+when no more FoundationDB calls will be made: */
+inline void shutdown_libfdb()
+{
+ ceph::libfdb::detail::database_system::shutdown_fdb();
+}
+
+// By default, libfdb will in turn use FDB's own defaults (see FDB docs):
+inline database_handle create_database()
+{
+ return std::make_shared<database>();
+}
+
+inline database_handle create_database(const std::filesystem::path dbfile)
+{
+ return std::make_shared<database>(dbfile);
+}
+
+inline database_handle create_database(const std::filesystem::path dbfile,
+                                       const database_options& dbopts,
+                                       const network_options& netopts)
+{
+ return std::make_shared<database>(dbfile, dbopts, netopts);
+}
+
+inline database_handle create_database(const database_options& dbopts,
+                                       const network_options& netopts)
+{
+ return std::make_shared<database>(dbopts, netopts);
+}
+
+inline database_handle create_database(const database_options& opts)
+{
+ return std::make_shared<database>(opts, network_options{});
+}
+
+inline database_handle create_database(const std::filesystem::path dbfile,
+                                       const database_options& dbopts)
+{
+ return std::make_shared<database>(dbfile, dbopts, network_options{});
+}
+
+inline transaction_handle make_transaction(database_handle dbh)
+{
+ return std::make_shared<transaction>(dbh);
+}
+
+inline transaction_handle make_transaction(database_handle dbh, const transaction_options& opts)
+{
+ return std::make_shared<transaction>(dbh, opts);
+}
+
+// Note: only rarely is a direct call to this needed. You can use transactors or pass database_handles
+// to get automagic.
+// Note: after a transaction is committed, it cannot be used again; but right now, that is NOT
+// an error with respect to the object. So, don't do operations on the object after you've committed
+// it or the behavior could be surprising.
+// On false, the client should retry the transaction:
+[[nodiscard]] inline bool commit(transaction_handle& txn)
+{
+ return txn->commit(); 
+}
+
+} // namespace ceph::libfdb
+
+namespace ceph::libfdb::detail {
+
+// Forward declarations:
+template <typename FnT>
+using transaction_invocation_result_t =
+ std::invoke_result_t<FnT&, transaction_handle&>;
+
+template <typename FnT>
+concept supported_transaction_invocation =
+ concepts::supported_invocation_result<transaction_invocation_result_t<FnT>>;
+
+template <typename FnT>
+using operation_result_t =
+ std::conditional_t<std::is_void_v<transaction_invocation_result_t<FnT>>,
+                    void,
+                    std::remove_cvref_t<transaction_invocation_result_t<FnT>>>;
+
+template <typename OutValuesT>
+struct value_collector_t final
+{
+ OutValuesT& out_values;
+
+ void operator()(std::span<const std::uint8_t> out_data) const;
+};
+
+template <typename OutValuesT>
+auto value_collector(OutValuesT& out_values) -> value_collector_t<OutValuesT>;
+
+template <supported_transaction_invocation FnT>
+auto maybe_retry(transaction_handle txn, FnT&& fn) -> operation_result_t<FnT>;
+
+template <supported_transaction_invocation FnT>
+auto maybe_commit(transaction_handle txn, const commit_after_op commit_after, FnT&& fn)
+ -> operation_result_t<FnT>;
+
+template <supported_transaction_invocation FnT>
+auto commit_noreplay(transaction_handle txn, const commit_after_op commit_after, FnT&& fn)
+ -> operation_result_t<FnT>;
+
+} // namespace ceph::libfdb::detail
+
+namespace ceph::libfdb {
+
+inline void set(transaction_handle txn,
+                std::string_view k, const auto& v,
+                const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [key = detail::as_fdb_span(k), &v](const transaction_handle& txn) {
+            return txn->set(key, ceph::libfdb::to::convert(v));
+          });
+}
+
+// If someone gives us an explicit transaction handle, they almost certainly don't want to commit 
+// it (though they can always specify otherwise):
+inline void set(transaction_handle txn, std::string_view k, const auto& v)
+{
+ return set(txn, k, v, commit_after_op::no_commit);
+}
+
+// ...conversely, with a database handle given, we can assume they DO want to auto-commit:
+inline void set(database_handle dbh,
+                std::string_view k, const auto& v)
+{
+ return detail::maybe_commit(make_transaction(dbh), commit_after_op::commit,
+          [key = detail::as_fdb_span(k), &v](const transaction_handle& txn) {
+            return txn->set(key, ceph::libfdb::to::convert(v));
+          });
+}
+
+template <template <typename ...> typename AssocT = flat_map,
+          concepts::key_value_iterator IteratorT>
+inline void set(transaction_handle txn,
+                IteratorT b, IteratorT e,
+                const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [&b, &e](const transaction_handle& txn) {
+            std::vector<std::uint8_t> fixed_buffer;
+
+            std::ranges::for_each(std::ranges::subrange(b, e),
+                      [&txn, &fixed_buffer](const auto& kv) {
+                        detail::transaction_set_kv_bytes(txn,
+                                  detail::as_fdb_span(kv.first),
+                                  ceph::libfdb::to::convert(kv.second, fixed_buffer));
+                      });
+          });
+}
+
+template <template <typename ...> typename AssocT = flat_map,
+          concepts::key_value_iterator IteratorT>
+inline void set(database_handle dbh, IteratorT b, IteratorT e)
+{
+ return detail::maybe_commit(make_transaction(dbh), commit_after_op::commit,
+          [b, e](const transaction_handle& txn) {
+            return set(txn, b, e, commit_after_op::no_commit);
+          });
+}
+
+// Note that we force things into a span so that byte streams get the proper encoding expected by zpp_bits:
+inline void set(transaction_handle txn,
+                std::string_view k, const ceph::libfdb::concepts::stringview_convertible auto& v,
+                const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [key = detail::as_fdb_span(k), value = std::string_view(v)](const transaction_handle& txn) {
+            return txn->set(key, ceph::libfdb::to::convert(value));
+          });
+}
+
+inline void set(transaction_handle txn,
+                std::string_view k, const ceph::libfdb::concepts::stringview_convertible auto& v)
+{
+ return set(txn, k, v, commit_after_op::no_commit);
+}
+
+inline void set(database_handle dbh,
+                std::string_view k, const ceph::libfdb::concepts::stringview_convertible auto& v)
+{
+ return detail::maybe_commit(make_transaction(dbh), commit_after_op::commit,
+          [key = detail::as_fdb_span(k), value = std::string_view(v)](const transaction_handle& txn) {
+            return txn->set(key, ceph::libfdb::to::convert(value));
+          });
+}
+
+} // namespace ceph::libfdb
+
+namespace ceph::libfdb {
+
+// erase() in libfdb is clear() in FDB parlance:
+inline void erase(ceph::libfdb::transaction_handle txn,
+                  const ceph::libfdb::select& key_range,
+                  const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [&key_range](const transaction_handle& txn) {
+            return txn->erase(key_range);
+          });
+}
+
+inline void erase(ceph::libfdb::transaction_handle txn, const ceph::libfdb::select& key_range)
+{
+ return erase(txn, key_range, commit_after_op::no_commit);
+}
+
+inline void erase(ceph::libfdb::database_handle dbh,
+                  const ceph::libfdb::select& key_range)
+{
+ return detail::maybe_commit(ceph::libfdb::make_transaction(dbh), commit_after_op::commit,
+          [&key_range](const transaction_handle& txn) {
+            return txn->erase(key_range);
+          });
+}
+
+inline void erase(ceph::libfdb::transaction_handle txn,
+                  std::string_view k,
+                  const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [key = detail::as_fdb_span(k)](const transaction_handle& txn) {
+            return txn->erase(key);
+          });
+}
+
+inline void erase(ceph::libfdb::transaction_handle txn, std::string_view k)
+{
+ return erase(txn, k, commit_after_op::no_commit);
+}
+
+inline void erase(ceph::libfdb::database_handle dbh, std::string_view k)
+{
+ return detail::maybe_commit(make_transaction(dbh), commit_after_op::commit,
+          [key = detail::as_fdb_span(k)](const transaction_handle& txn) {
+            return txn->erase(key);
+          });
+}
+
+} // namespace ceph::libfdb
+
+namespace ceph::libfdb {
+
+// get() with selector:
+// JFW: Satisfying output_iterator is not as straightforward as it appears, I need to look at this mechanism again; meanwhile, the template doesn't
+// /prevent/ future type narrowing, but I'm forcing it to std::string for now:
+inline bool get(ceph::libfdb::transaction_handle txn,
+                const ceph::libfdb::select& key_range, auto out_iter,
+                const ceph::libfdb::commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [&key_range, out_iter](const transaction_handle& txn) {
+            return txn->get(key_range, out_iter);
+          });
+}
+
+inline bool get(ceph::libfdb::transaction_handle txn,
+                const ceph::libfdb::select& key_range, auto out_iter)
+{ 
+ return get(txn, key_range, out_iter, commit_after_op::no_commit);
+}
+
+inline bool get(ceph::libfdb::database_handle dbh,
+                const ceph::libfdb::select& key_range, auto out_iter)
+{
+ return detail::maybe_retry(ceph::libfdb::make_transaction(dbh),
+          [&key_range, out_iter](transaction_handle& txn) {
+            return get(txn, key_range, out_iter, commit_after_op::no_commit);
+          });
+}
+
+template <typename OutputTargetOrFnT>
+requires concepts::value_callback<std::remove_reference_t<OutputTargetOrFnT>> ||
+         concepts::value_output<OutputTargetOrFnT&&>
+inline bool get(ceph::libfdb::transaction_handle txn,
+                std::string_view key,
+                OutputTargetOrFnT&& output_target_or_fn,
+                const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [key = detail::as_fdb_span(key), &output_target_or_fn](const transaction_handle& txn) {
+            if constexpr (concepts::value_callback<std::remove_reference_t<OutputTargetOrFnT>>) {
+              return txn->get(key, output_target_or_fn);
+            }
+
+            if constexpr (concepts::value_output<OutputTargetOrFnT&&>) {
+              return txn->get(key,
+                              detail::value_collector(output_target_or_fn));
+            }
+          });
+}
+
+template <typename OutputTargetOrFnT>
+requires concepts::value_callback<std::remove_reference_t<OutputTargetOrFnT>> ||
+         concepts::value_output<OutputTargetOrFnT&&>
+inline bool get(ceph::libfdb::transaction_handle txn,
+                std::string_view key, OutputTargetOrFnT&& output_target_or_fn)
+{
+ return get(txn, key, std::forward<OutputTargetOrFnT>(output_target_or_fn), commit_after_op::no_commit);
+}
+
+template <typename OutputTargetOrFnT>
+requires concepts::value_callback<std::remove_reference_t<OutputTargetOrFnT>> ||
+         concepts::value_output<OutputTargetOrFnT&&>
+inline bool get(ceph::libfdb::database_handle dbh,
+                std::string_view key, OutputTargetOrFnT&& output_target_or_fn)
+{
+ return detail::maybe_retry(ceph::libfdb::make_transaction(dbh),
+          [key, &output_target_or_fn](transaction_handle& txn) {
+            return get(txn, key, output_target_or_fn, commit_after_op::no_commit);
+          });
+}
+
+} // namespace ceph::libfdb
+
+namespace ceph::libfdb {
+
+// Does a key exist?
+inline bool key_exists(transaction_handle txn,
+                       std::string_view k,
+                       const commit_after_op commit_after)
+{
+ return detail::commit_noreplay(txn, commit_after,
+          [k](const transaction_handle& txn) {
+            return txn->key_exists(k);
+          });
+}
+
+inline bool key_exists(transaction_handle txn, std::string_view k)
+{
+ return key_exists(txn, k, commit_after_op::no_commit);
+}
+
+inline bool key_exists(database_handle dbh, std::string_view k)
+{
+ return detail::maybe_retry(ceph::libfdb::make_transaction(dbh),
+          [k](transaction_handle& txn) {
+            return key_exists(txn, k, commit_after_op::no_commit);
+          });
+}
+
+} // namespace ceph::libfdb
+
+namespace ceph::libfdb {
+
+/* A "transactor" is a function-like wrapper for running replayable transactions.
+ * It defers transaction creation until called, commits after the user function
+ * returns, retries when FoundationDB requests replay, and throws when recovery
+ * fails or retry attempts are exhausted. Plus, the name is pretty cool. */
+class transactor final
+{
+ database_handle dbh;
+
+ std::optional<transaction_options> opts;
+
+ private:
+ explicit transactor(database_handle dbh_)
+  : dbh(dbh_)
+ {}
+
+ transactor(database_handle dbh_, const transaction_options& opts_)
+  : dbh(dbh_),
+    opts(opts_)
+ {}
+
+ public:
+ template <typename FnT>
+ requires std::invocable<FnT&, transaction_handle&>
+ decltype(auto) operator()(FnT&& fn) const
+ {
+  auto txn = opts ? make_transaction(dbh, *opts)
+                  : make_transaction(dbh);
+
+  return detail::maybe_retry(txn, std::forward<FnT>(fn));
+ }
+
+ private:
+ friend inline transactor make_transactor(database_handle dbh);
+ friend inline transactor make_transactor(database_handle dbh, const transaction_options& opts);
+};
+
+inline transactor make_transactor(database_handle dbh)
+{
+ return transactor(dbh);
+}
+
+inline transactor make_transactor(database_handle dbh, const transaction_options& opts)
+{
+ return transactor(dbh, opts);
+}
+
+} // namespace ceph::libfdb
+
+// Basic Generators:
+namespace ceph::libfdb {
+
+template <typename ValueT = std::string>
+inline auto pair_generator(ceph::libfdb::transaction_handle txn, ceph::libfdb::select key_range) 
+  -> std::generator<std::pair<std::string, ValueT>>
+{
+ for (const std::span<const FDBKeyValue>& kvp_block : ceph::libfdb::detail::generate_FDB_pairs(*txn, key_range)) {
+   for (const auto& kvp : kvp_block) {
+     co_yield ceph::libfdb::detail::to_decoded_kv_pair<ValueT>(kvp);
+   }
+ } 
+}
+
+template <typename ValueT = std::string>
+inline auto pair_generator(const ceph::libfdb::database_handle& dbh, ceph::libfdb::select key_range)
+{
+ return pair_generator<ValueT>(ceph::libfdb::make_transaction(dbh), key_range);
+}
+
+// Note: block_generator() uses split planning to tackle large sets; use pair_generator() for 
+// direct scans. This is meant to be straightforward and easy-to-understand-- hence, there's not
+// a recover strategy or other things (you can replay the entire query)-- as new needs arise, this
+// can be made more flexible via selector options, dynamic range-splitting, etc., but so far there
+// has been no need:
+template <typename AssocT = flat_map<std::string, std::string>>
+auto block_generator(ceph::libfdb::database_handle dbh, ceph::libfdb::select selector)
+-> std::generator<AssocT>
+{
+ // JFW: Although this is tunable, in my measurement it isn't a large factor so far-- likely 
+ // these can move into the select instance itself (this is hard to measure in tests-- N
+ // has to be pretty big; I've adjusted chunk_size to where I guesstimate it needs to be,
+ // we need real-world experience to tweak this further):
+ const auto chunk_size = 4*(1024*1024);
+
+ auto split_points = detail::locate_split_points(dbh, selector, chunk_size);
+
+ // This can be paralellized, but early benchmarks didn't show it helping:
+ for (const auto& sp : split_points) {
+    AssocT block;
+    for (auto&& p : pair_generator(dbh, sp)) {
+      block.emplace(std::move(p));
+    }
+
+    co_yield block;
+ }
+}
+
+} // namespace ceph::libfdb
+
+namespace ceph::libfdb::detail {
+
+// Helper implementations:
+inline fdb_error_t do_commit(transaction_handle& txn)
+{
+ if (fdb_error_t r = 0; !txn->commit(&r)) {
+  return r;
+ }
+
+ return 0;
+}
+
+template <typename OutValuesT>
+void value_collector_t<OutValuesT>::operator()(std::span<const std::uint8_t> out_data) const
+{
+ ceph::libfdb::from::convert(out_data, out_values);
+}
+
+template <typename OutValuesT>
+auto value_collector(OutValuesT& out_values) -> value_collector_t<OutValuesT>
+{
+ return { out_values };
+}
+
+enum struct invocation_failure_policy { no_retry, retry };
+
+struct no_invocation_result final {};
+
+template <typename ResultT>
+using stored_invocation_result_t =
+ std::conditional_t<std::is_void_v<ResultT>,
+                    no_invocation_result,
+                    std::remove_cvref_t<ResultT>>;
+
+template <typename ResultT, typename FnT>
+requires concepts::supported_invocation_result<ResultT>
+auto store_invocation_result(transaction_handle& txn, FnT&& fn)
+ -> stored_invocation_result_t<ResultT>
+{
+ if constexpr (std::is_void_v<ResultT>) {
+  return (std::invoke(fn, txn), stored_invocation_result_t<ResultT>{});
+ }
+
+ if constexpr (not std::is_void_v<ResultT>) {
+  return std::invoke(fn, txn);
+ }
+}
+
+template <typename ResultT, typename StoredT>
+requires std::is_void_v<ResultT>
+void invocation_value_from_result(std::optional<StoredT>&&)
+{}
+
+template <typename ResultT, typename StoredT>
+requires concepts::storable_invocation_result<ResultT>
+auto invocation_value_from_result(std::optional<StoredT>&& result)
+{
+ return *std::move(result);
+}
+
+template <invocation_failure_policy FailurePolicy,
+          typename FnT,
+          typename CommitFnT,
+          typename ResultT = std::invoke_result_t<FnT&, transaction_handle&>>
+requires concepts::supported_invocation_result<ResultT>
+auto attempt_invocation(transaction_handle& txn, FnT&& fn, CommitFnT&& commit_fn)
+ -> std::optional<stored_invocation_result_t<ResultT>>
+{
+ using stored_result_t = stored_invocation_result_t<ResultT>;
+
+ std::optional<stored_result_t> result;
+
+ try {
+     result.emplace(store_invocation_result<ResultT>(txn, fn));
+ }
+ catch (const libfdb_exception& e) {
+     // Figure out how to recover from invocation failure:
+
+     if constexpr (invocation_failure_policy::no_retry == FailurePolicy) {
+      throw;
+     }
+
+     if (not e.retryable()) {
+      throw;
+     }
+
+     retry_after_error(txn, e.fdb_error_value);
+     return std::nullopt;
+ }
+
+ if (!std::invoke(commit_fn, txn)) {
+  return std::nullopt;
+ }
+
+ return result;
+}
+
+template <invocation_failure_policy FailurePolicy,
+          typename FnT,
+          typename CommitFnT,
+          typename ResultT = std::invoke_result_t<FnT&, transaction_handle&>>
+requires concepts::supported_invocation_result<ResultT>
+decltype(auto) invoke_with_retry(transaction_handle& txn, FnT&& fn, CommitFnT&& commit_fn)
+{
+ for (auto tries = 10; tries; --tries) {
+  if (auto result = attempt_invocation<FailurePolicy>(txn, fn, commit_fn)) {
+   return invocation_value_from_result<ResultT>(std::move(result));
+  }
+ }
+
+ throw libfdb_exception("transaction retry limit exceeded");
+}
+
+template <supported_transaction_invocation FnT>
+auto maybe_retry(transaction_handle txn, FnT&& fn) -> operation_result_t<FnT>
+{
+ return invoke_with_retry<invocation_failure_policy::retry>(
+          txn, std::forward<FnT>(fn),
+          [](transaction_handle& txn) {
+            return ceph::libfdb::commit(txn);
+          });
+}
+
+// Sadly, a RAII wrapper can't safely capture all of the failure conditions that can occur during an 
+// FDB commit without throwing from its dtor; but, we generally work around that by wrapping as much 
+// into function objects, simplifying the situation about as much as I can think of.
+// Commit operation, possibly replay if FDB requests it:
+template <supported_transaction_invocation FnT>
+auto maybe_commit(transaction_handle txn, const commit_after_op commit_after, FnT&& fn)
+ -> operation_result_t<FnT>
+{
+ if (commit_after_op::commit != commit_after) {
+  return std::invoke(fn, txn);
+ }
+
+ return invoke_with_retry<invocation_failure_policy::no_retry>(
+          txn, std::forward<FnT>(fn),
+          [](transaction_handle& txn) {
+            return ceph::libfdb::commit(txn);
+          });
+}
+
+// Commit only once; the caller is responsible for transaction replay:
+template <supported_transaction_invocation FnT>
+auto commit_noreplay(transaction_handle txn, const commit_after_op commit_after, FnT&& fn)
+ -> operation_result_t<FnT>
+{
+ using result_t = transaction_invocation_result_t<FnT>;
+
+ auto commit_fn = [](transaction_handle& txn) {
+  if (fdb_error_t r = do_commit(txn); 0 != r) {
+   throw ceph::libfdb::libfdb_exception(r);
+  }
+
+  return true;
+ };
+
+ if (commit_after_op::commit != commit_after) {
+  return std::invoke(fn, txn);
+ }
+
+ if constexpr (std::is_void_v<result_t>) {
+  attempt_invocation<invocation_failure_policy::no_retry>(txn, fn, commit_fn);
+  return;
+ }
+
+ if constexpr (concepts::storable_invocation_result<result_t>) {
+  auto result = attempt_invocation<invocation_failure_policy::no_retry>(
+                  txn, fn, commit_fn);
+  return std::remove_cvref_t<result_t>(std::move(*result));
+ }
+}
+
+} // namespace ceph::libfdb::detail
+
+#endif
diff --git a/src/test/bufferlist.cc b/src/test/bufferlist.cc
index 629ab3e21d0..5014f7e487a 100644
--- a/src/test/bufferlist.cc
+++ b/src/test/bufferlist.cc
@@ -3099,6 +3099,17 @@ TEST(BufferList, DanglingLastP) {
   EXPECT_EQ(0, ::memcmp("12C", bl.c_str(), 3));
 }
 
+TEST(BufferList, size) {
+ buffer::list bl;
+ EXPECT_EQ(bl.size(), bl.length());
+
+ bl.append("12345"); 
+ EXPECT_EQ(bl.size(), bl.length());
+
+ bl.clear();
+ EXPECT_EQ(bl.size(), bl.length());
+}
+
 TEST(BufferHash, all) {
   {
     bufferlist bl;
diff --git a/src/test/rgw/CMakeLists.txt b/src/test/rgw/CMakeLists.txt
index 6d8bdf58067..febf1475dd9 100644
--- a/src/test/rgw/CMakeLists.txt
+++ b/src/test/rgw/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Helper for adding RGW tests built with Catch2:
+# Note: to define a test that does not use Catch2::main(), use:
+#   add_catch2_test_rgw(my_test_name NO_CATCH2_MAIN)
+# ...your test should be in a file called "test_<my_test_name>.cc (ex. "test_foo.cc")
+# and the output will be called "unittest_my_test_name".
+#
+function(add_catch2_test_rgw test_name)
+add_catch2_test(${test_name}
+ ${ARGV1}
+ EXTRA_LIBS rgw_common ${rgw_libs}
+ EXTRA_INCS ${rgw_incs}
+ EXTRA_INCS "SYSTEM PRIVATE ${CMAKE_SOURCE_DIR}/src/rgw")
+endfunction()
+
 if(WITH_RADOSGW_AMQP_ENDPOINT)
   # amqp mock library
   set(amqp_mock_src
@@ -461,22 +476,6 @@ target_link_libraries(ceph_test_datalog
 install(TARGETS ceph_test_datalog DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()
 
-#
-# Helper for adding RGW tests built with Catch2:
-# Note: to define a test that does not use Catch2::main(), use:
-#   add_catch2_test_rgw(my_test_name NO_CATCH2_MAIN)
-# ...your test should be in a file called "test_<my_test_name>.cc (ex. "test_foo.cc")
-# and the output will be called "unittest_my_test_name".
-#
-function(add_catch2_test_rgw test_name)
-add_catch2_test(${test_name}
- ${ARGV1}
- EXTRA_LIBS rgw_common ${rgw_libs}
- EXTRA_INCS "SYSTEM PRIVATE ${CMAKE_SOURCE_DIR}/src/rgw")
-endfunction()
-
-add_catch2_test_rgw(rgw_hex)
-
 add_executable(unittest_rgw_async_utils test_rgw_async_utils.cc)
 add_ceph_unittest(unittest_rgw_async_utils)
 target_link_libraries(unittest_rgw_async_utils ${rgw_libs} ${UNITTEST_LIBS})
@@ -490,3 +489,10 @@ add_executable(unittest_rgw_http_client test_rgw_http_client.cc)
 add_ceph_unittest(unittest_rgw_http_client)
 target_link_libraries(unittest_rgw_http_client
   rgw_common ${rgw_libs} ${UNITTEST_LIBS})
+
+if(WITH_RADOSGW_FDB)
+ list(APPEND rgw_incs "${CMAKE_BINARY_DIR}/_deps/zpp_bits-src/")
+ add_catch2_test_rgw(rgw_hex)
+ add_catch2_test_rgw(fdb NO_CATCH2_MAIN)
+ add_catch2_test_rgw(fdb_ceph NO_CATCH2_MAIN)
+endif()
diff --git a/src/test/rgw/test_fdb.cc b/src/test/rgw/test_fdb.cc
new file mode 100644
index 00000000000..23c59dd01b0
--- /dev/null
+++ b/src/test/rgw/test_fdb.cc
@@ -0,0 +1,754 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*- // vim: ts=8 sw=2 smarttab ft=cpp 
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#include <catch2/catch_config.hpp>
+
+#include <catch2/catch_test_macros.hpp>
+#include <catch2/catch_template_test_macros.hpp>
+
+#include <catch2/generators/catch_generators.hpp>
+#include <catch2/generators/catch_generators_adapters.hpp>
+
+#include <catch2/matchers/catch_matchers_all.hpp>
+
+#include "test/rgw/test_fdb_common.h"
+
+#include <fmt/format.h>
+#include <fmt/chrono.h>
+#include <fmt/ranges.h>
+
+#include "include/random.h"
+
+#include <boost/container/flat_map.hpp>
+
+#include <map>
+#include <list>
+#include <chrono>
+#include <vector>
+#include <ranges>
+#include <iterator>
+#include <algorithm>
+#include <unordered_map>
+
+using Catch::Matchers::AllMatch;
+
+using fmt::format;
+using fmt::println;
+
+using std::end;
+using std::begin;
+
+using std::string;
+using std::string_view;
+
+using std::to_string;
+
+using std::vector;
+
+using namespace std::literals;
+
+// Be nice to Catch2's template-test macros:
+using string_pair = std::pair<std::string, std::string>;
+
+// Collect values in selection to out_values:
+auto key_counter(auto txn, const auto& selector, auto& out_values) -> auto {
+ out_values.clear();
+
+ lfdb::get(txn, selector, 
+           std::inserter(out_values, std::end(out_values)));
+
+ return out_values.size();
+};
+
+auto key_count(auto& dbh, const auto& selector) {
+ std::map<std::string, std::string> _;
+ return key_counter(lfdb::make_transaction(dbh), selector, _);
+}
+
+inline auto write_monotonic_kvs(lfdb::database_handle dbh, const int N, std::string_view prefix = "key")
+{
+ auto kvs = make_monotonic_kvs(N, prefix);
+
+ for(const auto& [k, v] : kvs)
+  lfdb::set(lfdb::make_transaction(dbh), k, v, lfdb::commit_after_op::commit);
+
+ return kvs;
+}
+
+// Basically, make sure we're actually linking with the library:
+TEST_CASE()
+{
+ REQUIRE_THROWS_AS([] { throw ceph::libfdb::libfdb_exception(0); }(),
+                   ceph::libfdb::libfdb_exception);
+}
+
+TEST_CASE("fdb simple", "[rgw][fdb]") {
+ janitor j;
+
+ auto dbh = j.dbh();
+
+ const string_view k = "key";
+ const string v = fmt::format("value-{:%c}", std::chrono::system_clock::now());
+
+ SECTION("read missing key") {
+    const string_view missing_key = "missing_key";
+
+    SECTION("with transaction") {
+        std::string out_value;
+
+        auto txn_handle = lfdb::make_transaction(dbh);
+        REQUIRE(nullptr != txn_handle);
+  
+        CAPTURE(missing_key); 
+        CAPTURE(out_value); 
+        REQUIRE_FALSE(lfdb::get(txn_handle, missing_key, out_value, lfdb::commit_after_op::no_commit));
+        CHECK(v != out_value);
+    }
+ }
+
+ SECTION("CRD single-key") {
+    std::string out_value;
+
+    // The key initially either exists, or we'll write it anew, either is fine:
+    CHECK_NOTHROW(lfdb::set(lfdb::make_transaction(dbh), k, v, lfdb::commit_after_op::commit));
+
+    // Make sure that it DOES exist:
+    CHECK(lfdb::get(lfdb::make_transaction(dbh), k, out_value, lfdb::commit_after_op::no_commit));
+    CHECK(v == out_value); 
+
+    // "erase()" is known as "clear" in FDB parlance, deleting a record:
+    REQUIRE_NOTHROW(lfdb::erase(lfdb::make_transaction(dbh), k, lfdb::commit_after_op::commit));
+
+    // ...as this shouldn't be updated again, make sure there isn't an accidental match:
+    out_value.clear();
+
+    // ...and, POOF!-- it should be gone:
+    CHECK_FALSE(lfdb::get(lfdb::make_transaction(dbh), k, out_value, lfdb::commit_after_op::no_commit));
+    CHECK(v != out_value);
+ }
+
+ SECTION("read/write single key") {
+    REQUIRE(nullptr != dbh);
+
+    // First, be sure we have a valid value written to the database:
+    REQUIRE_NOTHROW(lfdb::set(lfdb::make_transaction(dbh), k, v, lfdb::commit_after_op::commit));
+
+    SECTION("read transaction") {
+      std::string out_value;
+     
+      CHECK(lfdb::get(lfdb::make_transaction(dbh), k, out_value, lfdb::commit_after_op::no_commit));
+      CHECK(v == out_value); 
+    }
+ }
+
+ SECTION("check for existence of key") {
+    REQUIRE(nullptr != dbh);
+
+    // Erase the key if it's already there:
+    lfdb::erase(lfdb::make_transaction(dbh), k, lfdb::commit_after_op::commit);
+
+    // Now, we shouldn't find anything:
+    CHECK_FALSE(lfdb::key_exists(lfdb::make_transaction(dbh), k, lfdb::commit_after_op::no_commit));
+
+    // Write the key:
+    lfdb::set(lfdb::make_transaction(dbh), k, v, lfdb::commit_after_op::commit);
+
+    // ...it should magically be there!
+    CHECK(lfdb::key_exists(lfdb::make_transaction(dbh), k, lfdb::commit_after_op::no_commit));
+
+    // ...and now it should be gone again:
+    lfdb::erase(lfdb::make_transaction(dbh), k, lfdb::commit_after_op::commit);
+    CHECK_FALSE(lfdb::key_exists(lfdb::make_transaction(dbh), k, lfdb::commit_after_op::no_commit));
+ }
+}
+
+TEST_CASE("delete keys in range", "[rgw][fdb]") {
+ janitor dbh;
+
+ // Exactly 20 keys, 0-19:
+ const auto selector = lfdb::select { make_key(0), make_key(20) };
+
+ // Make sure we're "empty":
+ REQUIRE(0 == key_count(dbh, selector));
+
+ // Make sure we have a matching number of keys in our selector range:
+ const auto kvs = write_monotonic_kvs(dbh, 20);
+ REQUIRE(20 == key_count(dbh, selector));
+
+ // Erase a single value:
+ lfdb::erase(dbh, make_key(5));
+ CHECK(19 == key_count(dbh, selector));
+
+ // Erase an edge of the range:
+ lfdb::erase(dbh, lfdb::select { make_key(0), make_key(1) });
+ CHECK(18 == key_count(dbh, selector));
+
+ // ...the other edge: 
+ lfdb::erase(dbh, lfdb::select { make_key(19), make_key(20) });
+ CHECK(17 == key_count(dbh, selector));
+
+ // Erase the entire range:
+ lfdb::erase(dbh, selector);
+ CHECK(0 == key_count(dbh, selector));
+}
+
+TEMPLATE_PRODUCT_TEST_CASE("multi-key ops", "[rgw][fdb]", 
+(std::vector, std::list), (string_pair)) 
+{
+ janitor j;
+
+ auto dbh = j.dbh();
+
+ // Write a sequence of keys so we have some data to work with:
+ const auto kvs = write_monotonic_kvs(dbh, 100);
+
+ SECTION("check multiple key write", "[fdb]") {
+  auto txn = lfdb::make_transaction(dbh);
+
+  std::string out_value;
+ 
+  CHECK((*(kvs.find(make_key(0)))).second == make_value(0));
+  CHECK(lfdb::get(txn, make_key(0), out_value, lfdb::commit_after_op::no_commit));
+  CHECK(make_value(0) == out_value);
+
+  out_value.clear();
+  CHECK((*(kvs.find(make_key(99)))).second == make_value(99));
+  CHECK(lfdb::get(txn, make_key(99), out_value, lfdb::commit_after_op::no_commit));
+  CHECK(make_value(99) == out_value);
+ }
+
+ SECTION("check multiple key selection", "[fdb]") {
+  TestType out_values;
+
+  auto txn = lfdb::make_transaction(dbh);
+
+  lfdb::get(txn, lfdb::select { make_key(0), make_key(100) }, std::back_inserter(out_values), lfdb::commit_after_op::no_commit);
+
+  CHECK(100 == out_values.size());
+
+  // Maybe not the world's most creative test, but the idea is to try getting some random keys:
+  for(auto i = ceph::util::generate_random_number(out_values.size() - 1); i; --i) {
+    CHECK(std::end(out_values) != std::ranges::find(out_values, string_pair { make_key(i), make_value(i) }));
+  }
+ }
+}
+
+TEST_CASE("check selectors", "[fdb][rgw]") {
+ janitor dbh;
+
+ const int nentries = 10;
+
+ const auto select_all = lfdb::select { make_key(0), make_key(nentries) };
+
+ CHECK("" == lfdb::select { "" }.begin_key);
+ CHECK("\xFF" == lfdb::select { "" }.end_key);
+ CHECK("abc" == lfdb::select { "abc" }.begin_key);
+ CHECK("abd" == lfdb::select { "abc" }.end_key);
+ CHECK("abd" == lfdb::select { std::string("abc\xFF", 4) }.end_key);
+
+ // Make sure that there's nothing in our test range:
+ dbh.drop_all();
+ REQUIRE(0 == key_count(dbh, select_all));
+
+ const auto kvs = write_monotonic_kvs(dbh, nentries);
+
+ // Make sure there's exactly as many entries as we added:
+ REQUIRE(nentries == key_count(dbh, select_all));
+
+ std::vector<std::pair<std::string, std::string>> out;
+ lfdb::get(dbh, select_all, std::back_inserter(out));
+
+ // These /are/ the droids you're looking for:
+ CHECK(nentries == out.size());
+ CHECK(make_key(0) == out.front().first);
+ CHECK(make_key(nentries - 1) == out.back().first);
+
+ lfdb::set(dbh, "keyx", "outside");
+ out.clear();
+ lfdb::get(dbh, lfdb::select { "key_" }, std::back_inserter(out));
+ CHECK(nentries == out.size());
+
+ // Get exactly no entries:
+ out.clear();
+ lfdb::get(dbh, lfdb::select { make_key(0), make_key(0) }, std::back_inserter(out));
+ CHECK(0 == out.size());
+
+ // Get exactly one entry: 
+ out.clear();
+ lfdb::get(dbh, lfdb::select { make_key(1), make_key(2) }, std::back_inserter(out));
+ REQUIRE(1 == out.size());
+ CHECK(make_key(1) == out.front().first);
+}
+
+TEST_CASE("fdb conversions (built-in)", "[fdb][rgw]") {
+ // Manual tests of conversions to and from supported FDB built-in types.
+
+ SECTION("spanlike") {
+  // span<uint8_t> -> vector<uint8_t> -> vector<uint8_t>
+  const std::span<const std::uint8_t> n((const std::uint8_t *)msg, sizeof(msg));
+
+  std::vector<std::uint8_t> x;
+  x = ceph::libfdb::to::convert(n);
+
+  std::vector<std::uint8_t> o;
+  ceph::libfdb::from::convert(x, o); 
+
+  REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+ } 
+
+ SECTION("NULL-as-data") {
+  // with NULL data-- const char* -> vector<uint8_t> -> vector<uint8_t>
+  const std::span<const std::uint8_t> n((const std::uint8_t *)msg_with_null, sizeof(msg_with_null));
+
+  std::vector<std::uint8_t> x;
+  x = ceph::libfdb::to::convert(n);
+
+  std::vector<std::uint8_t> o;
+  ceph::libfdb::from::convert(x, o); 
+
+  REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+  REQUIRE_THAT(msg_with_null, Catch::Matchers::RangeEquals(o));
+ }
+}
+
+TEST_CASE("fdb conversions (round-trip)", "[fdb][rgw]") {
+ janitor j;
+
+ auto dbh = j.dbh();
+
+ // string_view -> string
+ {
+ const std::string_view n = "Hello, World!";
+ std::string o;
+
+ lfdb::set(lfdb::make_transaction(dbh), "key", n, lfdb::commit_after_op::commit);
+ lfdb::get(lfdb::make_transaction(dbh), "key", o, lfdb::commit_after_op::no_commit);
+
+ REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+ }
+
+ // vector<uint8_t> -> vector<uint8_t>
+ {
+ const std::vector<uint8_t> n = { 1, 2, 3, 4, 5 };
+ std::vector<uint8_t> o;
+
+ lfdb::set(lfdb::make_transaction(dbh), "key", n, lfdb::commit_after_op::commit);
+ lfdb::get(lfdb::make_transaction(dbh), "key", o, lfdb::commit_after_op::no_commit);
+
+ REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+ }
+} 
+
+TEST_CASE("fdb conversions (functions)", "[fdb][rgw]")
+{
+ SECTION("convert with a lambda function")
+ {
+  std::string_view n { pearl_msg };
+  std::string o;
+
+  std::vector<std::uint8_t> x = ceph::libfdb::to::convert(n);
+
+  auto fn = [&o](const char *data, std::size_t sz) -> void { 
+    // Because we did /conversion/ on the inbound data, we're still obliged to
+    // reverse this (or else we'll see whatever artefacts the conversion produced)-- 
+    // the complication is a consequence of dealing with the underlying buffer directly:
+    std::span<const std::uint8_t> in_span((const std::uint8_t *)data, sz);
+ 
+    ceph::libfdb::from::convert(in_span, o);
+  };
+
+  ceph::libfdb::from::convert(x, fn); 
+
+  CAPTURE(n);
+  REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+ }
+
+ SECTION("get with a raw value callback")
+ {
+  janitor j;
+  auto dbh = j.dbh();
+
+  std::string_view n { pearl_msg };
+  std::string o;
+
+  lfdb::set(dbh, "key", n);
+
+  REQUIRE(lfdb::get(dbh, "key", [&o](std::span<const std::uint8_t> in) {
+    ceph::libfdb::from::convert(in, o);
+  }));
+
+  CAPTURE(n);
+  REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+ }
+}
+
+TEST_CASE("basic generators", "[fdb]") {
+ janitor j;
+
+ const unsigned nkeys = GENERATE(0, 1, 2, 3, 10, 100, 1'000);
+
+ auto dbh = j.dbh();
+
+ const auto kvs_in = write_monotonic_kvs(dbh, nkeys);
+ REQUIRE(nkeys == kvs_in.size());
+
+ SECTION("pair_generator, kv pair return") {
+    std::map<std::string, std::string> out;
+
+    // pair_generator returns key-value pairs, keeping the specified transaction (or implicitly created one)
+    // alive until exhausted (note that this may cause the transaction to expire if approaching 5s or so):
+    for(auto&& kvp : lfdb::pair_generator(dbh, lfdb::select { make_key(0), make_key(nkeys) }))
+     out.emplace(kvp);
+
+    REQUIRE(nkeys == out.size());
+
+    // Be sure we captured the head and the tail:
+    if(0 < nkeys) {
+      CHECK(out.contains(make_key(0)));
+      CHECK(out.contains(make_key(nkeys - 1)));
+    }
+ }
+
+ SECTION("pair_generator owns its coroutine transaction") {
+    std::map<std::string, std::string> out;
+    const auto selector = lfdb::select { make_key(0), make_key(nkeys) };
+
+    // The transaction handle local to this lambda must remain alive inside the
+    // generator's coroutine frame after the lambda returns:
+    auto gen = [&dbh, selector] {
+      auto txn = lfdb::make_transaction(dbh);
+      return lfdb::pair_generator(txn, selector);
+    }();
+
+    std::ranges::copy(gen, std::inserter(out, std::end(out)));
+
+    REQUIRE(nkeys == out.size());
+
+    if(0 < nkeys) {
+      CHECK(out.contains(make_key(0)));
+      CHECK(out.contains(make_key(nkeys - 1)));
+    }
+ }
+}
+
+TEMPLATE_PRODUCT_TEST_CASE("associative data", "[fdb][rgw]",
+(std::map, std::unordered_map, boost::container::flat_map), ((std::string, std::string)))
+{
+ janitor j;
+
+ auto dbh = j.dbh();
+
+ TestType kvs{
+      { "hello", "world" },
+      { "lorem", "ipsum" },
+      { "perl", "camel" },
+      { "pearl", pearl_msg }
+    };
+
+ // From the "database" point of view, the structure is now that we have a single 
+ // key pointing (p) to an associative array, e.g. map<p, map<k, v>>:
+ lfdb::set(lfdb::make_transaction(dbh), "key", kvs, lfdb::commit_after_op::commit);
+
+ TestType out_kvs;
+
+ lfdb::get(lfdb::make_transaction(dbh), "key", out_kvs, lfdb::commit_after_op::no_commit);
+
+ CHECK(pearl_msg == out_kvs["pearl"]);
+}
+
+SCENARIO("implicit transactions", "[fdb][rgw]")
+{
+ janitor j;
+
+ auto dbh = j.dbh();
+
+ std::string_view k = "hi", v = "there";
+
+ CAPTURE(k);   
+ CAPTURE(v);   
+
+ SECTION("implicitly create and complete transactions") {
+
+  REQUIRE_FALSE(lfdb::key_exists(dbh, k));
+  CHECK_NOTHROW(lfdb::set(dbh, k, v));
+  CHECK(lfdb::key_exists(dbh, k));
+
+  std::string ov;
+  CHECK(lfdb::get(dbh, k, ov));
+
+  CAPTURE(ov);   
+
+  REQUIRE(v == ov);
+
+  CHECK_NOTHROW(lfdb::erase(dbh, k));
+  REQUIRE_FALSE(lfdb::key_exists(dbh, k));
+
+  REQUIRE_FALSE(lfdb::get(dbh, k, ov));
+ }
+
+ SECTION("implicitly create and complete transactions-- selection operations") {
+  // With an implicit transaction, mutating transactions should commit by default:
+  const auto selector = lfdb::select { make_key(0), make_key(20) };
+
+  const auto kvs = write_monotonic_kvs(dbh, 20);
+
+  lfdb::erase(dbh, lfdb::select { make_key(1), make_key(6) });
+
+  CHECK(15 == key_count(dbh, selector));
+
+  // Let's look around the edge cases of the selection:   
+  CHECK_FALSE(lfdb::key_exists(dbh, make_key(1)));
+  CHECK_FALSE(lfdb::key_exists(dbh, make_key(5)));
+
+  CHECK(lfdb::key_exists(dbh, make_key(0)));
+  CHECK(lfdb::key_exists(dbh, make_key(6)));
+ }
+
+ SECTION("test behavior with shared transaction") {
+    SECTION("write in uncommitted transaction") {
+      using lfdb::commit_after_op;
+    
+      auto txn = lfdb::make_transaction(dbh);
+    
+      lfdb::set(txn, "Herman", "Hollerith", commit_after_op::no_commit);
+     
+      // Key exists with respect to this transaction: 
+      CHECK(lfdb::key_exists(txn, "Herman"));
+      
+      lfdb::set(txn, "John", "Backus", commit_after_op::no_commit);
+    
+      // Key exists with respect to this transaction: 
+      CHECK(lfdb::key_exists(txn, "John", commit_after_op::no_commit));
+    
+      // transaction is abandoned
+    }
+
+  // These were only set in the abandoned transaction:
+  CHECK_FALSE(lfdb::key_exists(dbh, "Herman"));
+  CHECK_FALSE(lfdb::key_exists(dbh, "John"));
+ }
+
+ SECTION("round trip") {
+  janitor j(dbh);
+
+  using namespace ceph::libfdb;
+  
+  set(dbh, "key_0000", "value");
+  std::string out;
+  get(dbh, "key_0000", out);
+  
+  CHECK("value" == out);
+ }
+
+ SECTION("round trip with raw string") {
+  // The underlying serializer can produce some surprising behavior; libfdb
+  // works around this so that the "right" thing to do is what gets done, with
+  // performance-maximzation left as an available, but explicit operation.
+
+  janitor j(dbh);
+
+  using namespace ceph::libfdb;
+ 
+  // Notice the raw literal going in here: 
+  set(dbh, "key_0000", "value");
+
+  std::string out;
+  CHECK_NOTHROW(get(dbh, "key_0000", out));
+
+  CHECK(std::string_view("value") == std::string_view(out));
+
+  // Explicit raw buffers:
+  char out_buffer[9] = {}; 
+  CHECK_NOTHROW(get(dbh, "key_0000", out_buffer));
+  
+  CHECK(std::string_view("value") == std::string_view(out));
+ }
+}
+
+SCENARIO("transactor", "[fdb]")
+{
+ janitor j;
+
+ auto dbh = j.dbh();
+
+ SECTION("transaction function returns nothing") {
+  auto txr = lfdb::make_transactor(dbh);
+
+  txr([](auto txn) {
+    lfdb::set(txn, "key", "value");
+  });
+
+  std::string out;
+  CHECK(lfdb::get(dbh, "key", out));
+  CHECK("value" == out);
+ }
+
+ SECTION("transaction function returns value") {
+  auto txr = lfdb::make_transactor(dbh);
+
+  auto [found, out] = txr([](auto txn) {
+    lfdb::set(txn, "key", "value");
+
+    std::string out;
+    auto found = lfdb::get(txn, "key", out);
+
+    return std::pair(found, out);
+  });
+
+  CHECK(found);
+  CHECK("value" == out);
+ }
+
+ SECTION("construct with transaction options") {
+  lfdb::transaction_options opts {
+    { FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE, lfdb::option_flag }
+  };
+
+  auto txr = lfdb::make_transactor(dbh, opts);
+
+  txr([](auto txn) {
+    lfdb::set(txn, "key", "value");
+  });
+
+  std::string out;
+  CHECK(lfdb::get(dbh, "key", out));
+  CHECK("value" == out);
+ }
+
+ SECTION("transactor replays after conflict") {
+  auto txr = lfdb::make_transactor(dbh);
+
+  lfdb::set(dbh, "key", "initial");
+
+  txr([dbh](auto txn) {
+    std::string out;
+    if(not lfdb::get(txn, "key", out)) {
+     throw std::runtime_error("expected key does not exist");
+    }
+
+    // Force a conflict, making the transactor replay the body:
+    if("initial" == out) {
+     lfdb::set(dbh, "key", "conflict");
+    }
+
+    lfdb::set(txn, "key", "final");
+  });
+
+  std::string out;
+  CHECK(lfdb::get(dbh, "key", out));
+  CHECK("final" == out);
+ }
+
+ SECTION("transactor propagates transaction body exceptions") {
+  auto txr = lfdb::make_transactor(dbh);
+
+  CHECK_THROWS_WITH(txr([](auto) {
+    throw std::runtime_error("transaction body failed");
+  }), "transaction body failed");
+ }
+}
+
+SCENARIO("options", "[fdb]")
+{
+ // For information about options, consult the FoundationDB's source tree's
+ // documentation: fdbclient/vexillographer/fdb.options
+ SECTION("option types") {
+
+  // check that the types supported for FDB options are supported by
+  // the library:
+  lfdb::option_value ov;
+  ov = lfdb::option_flag;                 // flag
+  ov = 42;                                // integer
+  ov = std::string("hi");                 // string
+  ov = std::vector<std::uint8_t>(         // data
+        (const std::uint8_t *)pearl_msg, 
+        (const std::uint8_t *)(pearl_msg + sizeof(pearl_msg)));
+ }
+
+  auto dbh0 = lfdb::create_database(
+                { { FDB_DB_OPTION_LOCATION_CACHE_SIZE, 200'000 } },  
+                { { FDB_NET_OPTION_TRACE_ENABLE, lfdb::option_flag } });         
+
+  auto dbh1 = lfdb::create_database("fishing for databass!",       // name
+                { { FDB_DB_OPTION_LOCATION_CACHE_SIZE, 200'000 } }, // database options
+                { { FDB_NET_OPTION_TRACE_ENABLE, lfdb::option_flag } });        // network options
+ 
+  auto txn = lfdb::make_transaction(dbh0, 
+               { { FDB_TR_OPTION_READ_YOUR_WRITES_DISABLE, lfdb::option_flag } });
+
+ SECTION("create_database()") {
+  lfdb::create_database();
+  lfdb::create_database("");
+  lfdb::create_database("", {}, {});
+  lfdb::create_database(lfdb::database_options {}, lfdb::network_options {});
+ }
+
+ SECTION("piecemeal construction") {
+  lfdb::network_options netopts;
+
+  // Note that, according to FDB's documentation, this setting's actually deprecated:
+  netopts[FDB_NET_OPTION_LOCAL_ADDRESS] = "127.0.0.1:2323"; 
+
+  // The cluster file is in "/etc/foundationdb.fdb.cluster" normally, but we'll point to 
+  // nowhere just for fun. The cluster file is the "approved" way to establish a list of
+  // addressess, AFAIK, rather than setting the option:
+  lfdb::create_database("/dev/null", {}, netopts);
+ }
+}
+
+TEST_CASE("mini-demo", "[fdb]") {
+ janitor j;
+
+ using std::map;
+ using std::string;
+
+ map<string, string> bucket_entries = {
+    { "objName", "obj" },
+    { "bucketName", "bucket" },
+    { "creationTime", "2025-11-12T10:00:00" },
+    { "dirty", "0" },
+    { "hosts", "192.168.1.1:8000_192.168.1.2:8000" },
+    { "etag", "abc123def" },
+    { "objSize", "1048576" },
+    { "userId", "user123" },
+    { "displayName", "John Doe" }
+  };
+ 
+ // In a "real" program, it would be "auto dbh = lfdb::database_handle(...)": 
+ auto dbh = j.dbh();
+
+ // This write will make and commit its own transaction:
+ lfdb::set(dbh, "bucket_obj", bucket_entries);
+
+ map<string, string> out;
+ lfdb::get(dbh, "bucket_obj", out);
+
+ // For "demo" purposes, you can ignore everything below here:
+ CAPTURE(out["userId"]);
+ REQUIRE(bucket_entries == out);
+
+ j.drop_all();
+}
+
+// Adapted from Catch2 documentation:
+#include <catch2/catch_session.hpp>
+
+int main(int argc, char **argv) 
+{
+  int result = Catch::Session().run(argc, argv);
+
+  // Make sure that FoundationDB is shut down once and only once:
+  ceph::libfdb::shutdown_libfdb(); 
+
+  return result;
+}
diff --git a/src/test/rgw/test_fdb_ceph.cc b/src/test/rgw/test_fdb_ceph.cc
new file mode 100644
index 00000000000..764157379a0
--- /dev/null
+++ b/src/test/rgw/test_fdb_ceph.cc
@@ -0,0 +1,496 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*- // vim: ts=8 sw=2 smarttab ft=cpp 
+
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2025-2026 International Business Machines Corp. (IBM)
+ *      
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+*/
+
+#include <catch2/catch_config.hpp>
+
+#include <catch2/catch_test_macros.hpp>
+#include <catch2/catch_template_test_macros.hpp>
+
+#include <catch2/generators/catch_generators.hpp>
+#include <catch2/generators/catch_generators_adapters.hpp>
+
+#include <catch2/matchers/catch_matchers_all.hpp>
+
+#include <catch2/benchmark/catch_benchmark.hpp>
+
+#include "test/rgw/test_fdb_common.h"
+#include "rgw/ceph_fdb.h"
+
+#include <fmt/format.h>
+#include <fmt/chrono.h>
+#include <fmt/ranges.h>
+
+#include "include/random.h"
+
+#include <boost/container/flat_map.hpp>
+
+#include <chrono>
+#include <vector>
+#include <ranges>
+#include <algorithm>
+#include <execution>
+
+using Catch::Matchers::AllMatch;
+
+using fmt::format;
+using fmt::println;
+
+using std::end;
+using std::begin;
+
+using std::string;
+using std::string_view;
+
+using std::to_string;
+
+using std::vector;
+
+using namespace std::literals::string_literals;
+
+TEST_CASE("test the tester") {
+ // Quis custodiet ipsos custodes?
+
+ SECTION("check write and cleanup") {
+  janitor j;
+
+  j.drop_all_keys();
+
+  // Check that there are no keys:
+  std::string s;
+  lfdb::get(j, make_key(2, "VEAL"), s);   
+  REQUIRE(s.empty());
+
+  populate_monotonic(j, 5, "VEAL");
+
+  // Check that we have some keys!
+  lfdb::get(j, make_key(2, "VEAL"), s);   
+  REQUIRE(make_value(2) == s);
+
+  j.drop_all_keys();
+ }
+}
+
+TEST_CASE("don't use non-owning container types for output", "[example]") {
+   SKIP("A cautionary tale! Never use non-owning container types as output.");
+
+   // TL;DR: never use non-owning container types as output!
+   //
+   // It's possible to write an innocent-looking but actually
+   // bad conversion (we may be able to fix this through some
+   // resdesign, but it's how it is for now, and not user-facing). Anyway
+   // DON'T DO THIS! :-) Non-owning conversions are bad.
+   // ...since it won't throw consistently, I'll leave it as a cautionary
+   // tale:
+   const char *msg = "Greetings!";
+  
+   ceph::buffer::list n;
+   n.append(msg);
+  
+   // This looks innocuous... however...
+   std::span<const std::uint8_t> x;
+  
+   // BAD: span<> is non-owning!
+   x = ceph::libfdb::to::convert(n);
+  
+   ceph::buffer::list o;
+  
+   // "x" potentially points at nothing; may throw or explode or work...:
+   ceph::libfdb::from::convert(x, o);
+}
+
+TEST_CASE("fdb conversions (ceph)", "[fdb][rgw]") {
+
+ const char *msg = "Hello, World!";
+
+ auto dbh = lfdb::create_database();
+
+ // ceph::buffer::list -> span<uint8_t> -> std::string
+ {
+  ceph::buffer::list n;
+  n.append(msg);
+
+  std::vector<std::uint8_t> x;
+  x = ceph::libfdb::to::convert(n);
+
+  std::string o;
+  ceph::libfdb::from::convert(x, o); 
+
+  REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+ }
+
+ // buffer::list -> span<uint8_t> -> buffer::list 
+ {
+ ceph::buffer::list n;
+ n.append(msg);
+
+ std::vector<std::uint8_t> x;
+ x = ceph::libfdb::to::convert(n);
+
+ ceph::buffer::list o;
+ ceph::libfdb::from::convert(x, o);
+
+ lfdb::set(lfdb::make_transaction(dbh), "key", n, lfdb::commit_after_op::commit);
+ lfdb::get(lfdb::make_transaction(dbh), "key", o);
+ 
+ REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+
+ lfdb::erase(dbh, "key");
+ }
+
+ SECTION("buffer::list direct and const conversion paths match")
+ {
+   ceph::buffer::list n;
+   n.append("direct conversion should match the normal const path");
+
+   auto direct = ceph::libfdb::to::convert(n);
+
+   const auto& cn = n;
+   auto via_serialize = ceph::libfdb::to::convert(cn);
+
+   CHECK(direct == via_serialize);
+ }
+
+ SECTION("empty buffer::list direct and const conversion paths match")
+ {
+   ceph::buffer::list n;
+
+   auto direct = ceph::libfdb::to::convert(n);
+
+   const auto& cn = n;
+   auto via_serialize = ceph::libfdb::to::convert(cn);
+
+   CHECK(direct == via_serialize);
+ }
+
+ SECTION("buffer::list with embedded nulls uses the same conversion path")
+ {
+   constexpr char data[] = { '\0', 'H', 'i', '\0', '!', '\0' };
+
+   ceph::buffer::list n;
+   n.append(data, sizeof(data));
+
+   auto direct = ceph::libfdb::to::convert(n);
+
+   const auto& cn = n;
+   auto via_serialize = ceph::libfdb::to::convert(cn);
+
+   CHECK(direct == via_serialize);
+ }
+
+ SECTION("buffer::list key span preserves logical key bytes")
+ {
+   ceph::buffer::list key;
+   key.append("buffer-list-key");
+
+   auto key_span = ceph::libfdb::detail::as_fdb_span(key);
+
+   CHECK(key.length() == key_span.size());
+   CHECK(std::ranges::equal(std::span((const char *)key_span.data(), key_span.size()),
+                            std::string_view("buffer-list-key")));
+ }
+
+ SECTION("empty buffer::list key span is empty")
+ {
+   ceph::buffer::list key;
+
+   auto key_span = ceph::libfdb::detail::as_fdb_span(key);
+
+   CHECK(0 == key_span.size());
+ }
+
+ SECTION("buffer::list key span preserves embedded nulls")
+ {
+   constexpr char data[] = { '\0', 'k', 'e', 'y', '\0' };
+
+   ceph::buffer::list key;
+   key.append(data, sizeof(data));
+
+   auto key_span = ceph::libfdb::detail::as_fdb_span(key);
+
+   CHECK(key.length() == key_span.size());
+   CHECK(std::ranges::equal(std::span((const char *)key_span.data(), key_span.size()),
+                            std::string_view(data, sizeof(data))));
+ }
+
+ SECTION("empty buffer::list round trip through public set/get")
+ {
+   ceph::buffer::list in;
+
+   lfdb::set(dbh, "empty-buffer-list", in);
+
+   ceph::buffer::list out;
+   REQUIRE(lfdb::get(dbh, "empty-buffer-list", out));
+   CHECK(0 == out.length());
+
+   lfdb::erase(dbh, "empty-buffer-list");
+ }
+
+ SECTION("buffer::list with embedded nulls round trips through public set/get")
+ {
+   constexpr char data[] = { '\0', 'A', '\0', 'B', '\0' };
+
+   ceph::buffer::list in;
+   in.append(data, sizeof(data));
+
+   lfdb::set(dbh, "embedded-null-buffer-list", in);
+
+   ceph::buffer::list out;
+   REQUIRE(lfdb::get(dbh, "embedded-null-buffer-list", out));
+   REQUIRE_THAT(in, Catch::Matchers::RangeEquals(out));
+
+   lfdb::erase(dbh, "embedded-null-buffer-list");
+ }
+
+ SECTION("buffer::list get replaces existing output")
+ {
+   ceph::buffer::list in;
+   in.append("new-value");
+
+   ceph::buffer::list out;
+   out.append("old-value");
+
+   lfdb::set(dbh, "replace-buffer-list-output", in);
+
+   REQUIRE(lfdb::get(dbh, "replace-buffer-list-output", out));
+   REQUIRE_THAT(in, Catch::Matchers::RangeEquals(out));
+
+   lfdb::erase(dbh, "replace-buffer-list-output");
+ }
+
+ SECTION("buffer::list (and buffer::list key) -> buffer::list")
+ {
+   ceph::buffer::list n;
+   n.append("Hello, World!");
+ 
+   ceph::buffer::list o;
+   o.append(n);
+ 
+   lfdb::set(lfdb::make_transaction(dbh), "key", n, lfdb::commit_after_op::commit);
+   lfdb::get(lfdb::make_transaction(dbh), "key", o);
+ 
+   REQUIRE_THAT(n, Catch::Matchers::RangeEquals(o));
+
+    lfdb::erase(dbh, "key");
+  }
+
+ SECTION("buffer::ptr")
+ {
+    string_view in("Hello, World!");
+    ceph::buffer::ptr p(ceph::buffer::claim_char(in.length(), const_cast<char *>(in.data())));
+    CHECK(in == string_view(p.c_str(), p.length()));
+
+    lfdb::set(dbh, "key", p);
+
+    std::string o;
+    lfdb::get(dbh, "key", o);
+
+    CHECK(in == o);
+ }
+}
+
+std::iostream& operator<<(ceph::libfdb::select& obj, std::iostream& os)
+{
+ os << obj.begin_key;
+ os << obj.end_key;
+ return os;
+}
+namespace ceph::libfdb {
+
+/* Not very coroutine-friendly, sadly; but will be interesting to benchmark, so I'm leaving
+ * it be for now:
+template <typename AssocT = boost::container::flat_map<std::string, std::string>>
+auto tier_generator(ceph::libfdb::database_handle dbh, ceph::libfdb::select selector)
+-> std::generator<AssocT>
+{
+ auto split_points = locate_split_points(dbh, selector);
+
+ const unsigned local_max_block = 2*2024; // vis-a-vis remote request max
+
+ std::transform_reduce(std::begin(split_points), std::end(split_points),
+                      AssocT(),
+
+                      [](auto&& lhs, auto&& rhs) {
+                        return lhs.merge(rhs), lhs;
+                      },
+
+                      [dbh](const ceph::libfdb::select& selector) mutable {
+                        AssocT out;
+
+                        // ...my libstdc++ lacks std::from_range overloads; the Hard Way(TM) it is:
+                        for(auto&& kvp : ceph::libfdb::pair_generator(dbh, selector)) {
+                          out.emplace(kvp);
+                        }
+
+                        return out;                    
+                      });
+}
+*/
+
+} // namespace ceph::libfdb
+
+
+TEST_CASE("generators", "[fdb][rgw]") {
+
+/* This is a generator for large queries that are pretty much expected to 
+exceed the FoundationDB five-second transaction limit: */
+  SECTION("block generator") {
+    janitor j;
+
+    const size_t nkeys = GENERATE(0, 1, 1000); // , 100'000, 1'000'000);
+ 
+    populate_monotonic(j, nkeys);
+
+    SECTION("retrieve all") {
+      auto selector = lfdb::select { "key_" };
+
+      size_t total = 0;
+      for(const auto& block : lfdb::block_generator(j, selector)) {
+        total += block.size();
+      }
+
+      CHECK(nkeys == total);
+    }
+  }
+}
+
+TEST_CASE("generators", "[benchmark]") {
+   const size_t nkeys = GENERATE(0, 1, 1'000); // 5'000, 10'000, 50'000, 250'000, 1'000'000);
+
+   fmt::println("generator benchmark, nkeys = {}", nkeys);
+
+  BENCHMARK_ADVANCED("block generator read all")(Catch::Benchmark::Chronometer meter) {
+    janitor j;
+
+    populate_monotonic(j, nkeys);
+
+    auto selector = lfdb::select { "key_" };
+
+    size_t total = 0;
+    meter.measure([&j, &selector, &total] {
+      total = 0;
+      for(const auto& block : lfdb::block_generator(j, selector)) {
+        total += block.size();
+      }
+    });
+
+    REQUIRE(nkeys == total);
+  };
+}
+
+// Note that these are disabled for regular test runs. Use
+//      unittest_fdb_ceph "simple benchmarks"
+// ...to run:
+TEST_CASE("simple benchmarks", "[benchmark]") {
+
+using namespace std::ranges;
+using std::for_each;
+
+// Remember that these will create exponential growth; you might
+// not want to run ALL combinations if you're short on time:
+auto N = GENERATE(0, 1, 256, 4'096); // 250'000, 1'000'000);
+
+unsigned stride = 512;
+
+fmt::println("N = {}", N);
+fmt::println("stride = {}", stride);
+
+// For casual use, these simply get intolerably slow at higher values:
+const bool run_slow_baselines = (N <= 256);
+
+std::vector<std::pair<std::string, std::string>> inputs;
+inputs.reserve(N);
+
+// Sadly, my version of libstdc++ lacks std::from_range_t:
+for(auto n : views::iota(0, N)) {
+ inputs.emplace_back(std::make_pair<std::string, std::string>(make_key(n), make_value(n)));
+}
+
+if(run_slow_baselines) {
+ BENCHMARK_ADVANCED("write simple records-- implicit transaction per key")(Catch::Benchmark::Chronometer meter) {
+  janitor j;
+
+  meter.measure([&j, &inputs, stride] {
+   // Notice that here we are passing around the database handle, winding up making a new one per-operation:
+   for(auto block : inputs | views::chunk(stride)) {
+    std::for_each(std::begin(block), std::end(block), [&j](const auto& kv) mutable {
+      lfdb::set(j, kv.first, kv.second);
+    });
+   }
+  });
+ };
+}
+
+BENCHMARK_ADVANCED("write simple records-- one transaction per block")(Catch::Benchmark::Chronometer meter) {
+ janitor j;
+
+ meter.measure([&j, &inputs, stride] {
+  // Shared-transaction:
+  for(auto block : inputs | views::chunk(stride)) {
+   auto txn = lfdb::make_transaction(j);
+   std::for_each(std::begin(block), std::end(block), [&txn](const auto& kv) mutable {
+     lfdb::set(txn, kv.first, kv.second);
+   });
+   if(false == lfdb::commit(txn)) {
+     throw std::runtime_error("unable to commit transaction");
+   }
+  }
+ });
+};
+
+BENCHMARK_ADVANCED("write simple records-- range set, one transaction per block")(Catch::Benchmark::Chronometer meter) {
+ janitor j;
+
+ meter.measure([&j, &inputs, stride] {
+  for(auto block : inputs | views::chunk(stride)) {
+   lfdb::set(j, std::begin(block), std::end(block));
+  }
+ });
+};
+
+// On a local FDB setup, block parallelism has not outperformed serial block
+// writes, but it is included as a safe comparison point; remote FDB not yet considered:
+BENCHMARK_ADVANCED("write simple records-- parallel, one transaction per block")(Catch::Benchmark::Chronometer meter) {
+ janitor j;
+
+ meter.measure([&j, &inputs, stride] {
+  auto blocks = inputs | views::chunk(stride);
+
+  std::for_each(std::execution::par, std::begin(blocks), std::end(blocks),
+                [&j](const auto& block) mutable {
+                  auto txn = lfdb::make_transaction(j);
+
+                  std::ranges::for_each(block, [&txn](const auto& kv) mutable {
+                    lfdb::set(txn, kv.first, kv.second);
+                  });
+
+                  if(false == lfdb::commit(txn)) {
+                    throw std::runtime_error("unable to commit transaction");
+                  }
+                });
+ });
+};
+
+}
+
+#include <catch2/catch_session.hpp>
+
+int main(int argc, char **argv) 
+{
+  int result = Catch::Session().run(argc, argv);
+
+  // Make sure that FoundationDB is shut down once and only once:
+  ceph::libfdb::shutdown_libfdb(); 
+
+  return result;
+}
diff --git a/src/test/rgw/test_fdb_common.h b/src/test/rgw/test_fdb_common.h
new file mode 100644
index 00000000000..3c7a2683ace
--- /dev/null
+++ b/src/test/rgw/test_fdb_common.h
@@ -0,0 +1,138 @@
+#ifndef TEST_FDB_COMMON_H
+ #define TEST_FDB_COMMON_H
+
+#include <catch2/catch_test_macros.hpp>
+
+#include <fmt/format.h>
+
+#include "rgw/fdb/fdb.h"
+
+#include <algorithm>
+#include <map>
+#include <ranges>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+
+namespace lfdb = ceph::libfdb;
+
+constexpr const char* const msg = "Hello, World!";
+
+constexpr const char msg_with_null[] = { '\0', 'H', 'i', '\0', ' ', 't', 'h', 'e', 'r', 'e', '!', '\0'};
+
+constexpr const char pearl_msg[] =
+R"(Perle, plesaunte to prynces paye
+To clanly clos in golde so clere;
+Oute of oryent, I hardyly saye.
+Ne proved I never her precios pere.
+)";
+
+// It's a little moribund, but for tests we use this highly-creative (*cough!*) prefix
+// to make it easy to not only remove stale keys but diagnose them when there's a problem:
+inline std::string make_key(const int n, std::string_view prefix = "key")
+{
+ return fmt::format("{}_{:010d}", prefix, n);
+}
+
+inline std::string make_value(const int n)
+{
+ return fmt::format("value_{:010d}", n);
+}
+
+inline std::map<std::string, std::string> make_monotonic_kvs(const unsigned N, std::string_view prefix = "key")
+{
+ std::map<std::string, std::string> kvs;
+
+ for(const auto i : std::ranges::iota_view(0u, N)) {
+  kvs.insert({ make_key(i, prefix), make_value(i) });
+ }
+
+ return kvs;
+}
+
+// Gadget to help clean up test keys-- both removing stale ones when we enter and also tidying
+// up after ourselves when we leave scope:
+struct janitor final
+{
+ ceph::libfdb::database_handle dbh_;
+
+ // flip this off if you need artifacts after debugging:
+ bool drop_after_scope = true;
+
+ janitor(ceph::libfdb::database_handle dbh_)
+  : dbh_(dbh_)
+ {
+  drop_all();
+ }
+
+ janitor()
+  : janitor(ceph::libfdb::create_database())
+ {}
+
+ ~janitor()
+ {
+  if(drop_after_scope)
+    drop_all();
+ }
+
+ public:
+ ceph::libfdb::database_handle dbh() { return dbh_; }
+
+ public:
+ // This type coersion turns out to be very useful:
+ operator ceph::libfdb::database_handle() { return dbh(); }
+
+ public:
+ void drop(const lfdb::select& range)
+ {
+  lfdb::erase(ceph::libfdb::make_transaction(dbh()),
+              range,
+              lfdb::commit_after_op::commit);
+ }
+
+ // Drop everything in the database (except system keys):
+ void drop_all()
+ {
+  // Note: technically, [0x00, 0xFF) is needed to include the system keys (if the transaction's allowed to
+  // access these). However, special permissions are needed to access these magical "system keys" and we
+  // probably don't actually want to delete them erroneously. So, we stick with the normal user-key range...
+  return drop(lfdb::select { "" });
+ }
+
+ // Drop keys made with our key convention:
+ void drop_all_keys()
+ {
+  return drop(lfdb::select { "key_" });
+ }
+};
+
+// This is both a utility for the test suite AND an example of one way to break a long series of writes up
+// into blocks to avoid transaction timeout. Note that it runs serially; a parallel implementation is possible
+// but probably would be slower for the scales used in the test and would involve mechanism a fair amount of
+// extra mechanism, as FDB transactions themselves are not thread-safe:
+inline void populate_monotonic(lfdb::database_handle dbh, const int N, std::string_view prefix = "key")
+{
+ using namespace std::ranges;
+
+ const unsigned stride = 8*1024;
+ const auto total = static_cast<unsigned>(N);
+ const auto nblocks = (total + stride - 1) / stride;
+
+ for(auto block_index : views::iota(0u, nblocks)) {
+  const auto first = block_index * stride;
+  const auto last = std::min(first + stride, total);
+
+  // We make a new transaction each block to avoid session timeout:
+  auto txn = make_transaction(dbh);
+
+  for(auto n : views::iota(first, last)) {
+    lfdb::set(txn, make_key(n, prefix), make_value(n));
+  }
+
+  if(false == lfdb::commit(txn)) {
+    throw std::runtime_error(fmt::format("unable to commit transaction; {} entries, {} stride", total, stride));
+  }
+ }
+}
+
+#endif

From f18247e32b769088d7afb76a9116636bcfab9468 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Tue, 30 Jun 2026 19:50:09 +0800
Subject: [PATCH 476/596] librbd: fix use-after-free in trash purge on image
 open error

When ImageState::open() fails with an error other than -ENOENT, it
asynchronously deletes the ImageCtx before returning. The trash purge
loop only skipped the -ENOENT case and fell through on every other
error, dereferencing the already-freed ictx in diff_iterate() and
state->close(). Add the missing continue so a failed open is skipped.

The fall-through dates back to 504f4e78, which split `if (r < 0)
continue` to log non-ENOENT errors but dropped the continue.

Fixes: https://tracker.ceph.com/issues/77836
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/librbd/api/Trash.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/librbd/api/Trash.cc b/src/librbd/api/Trash.cc
index aff6ff1c943..a135a004abc 100644
--- a/src/librbd/api/Trash.cc
+++ b/src/librbd/api/Trash.cc
@@ -487,6 +487,7 @@ int Trash<I>::purge(IoCtx& io_ctx, time_t expire_ts,
           } else if (r < 0) {
             lderr(cct) << "failed to open image " << it << ": "
                        << cpp_strerror(r) << dendl;
+            continue;
           }
 
           r = librbd::api::DiffIterate<I>::diff_iterate(

From 7272236d1088b0f2a49f5b18811e6ab4c552f3a8 Mon Sep 17 00:00:00 2001
From: Adam King <adking@redhat.com>
Date: Tue, 30 Jun 2026 15:31:20 -0400
Subject: [PATCH 477/596] mgr/cephadm: clear daemon_config_deps entry for
 removed daemons

This covers both removing them actively from now on when removing
daemons from the HostCache and also not loading entries like this
back in next time they are loaded when a user upgrades to a
version with this patch

Fixes: https://tracker.ceph.com/issues/77839

Signed-off-by: Adam King <adking@redhat.com>
---
 src/pybind/mgr/cephadm/inventory.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/pybind/mgr/cephadm/inventory.py b/src/pybind/mgr/cephadm/inventory.py
index 7e396401e38..18e55049600 100644
--- a/src/pybind/mgr/cephadm/inventory.py
+++ b/src/pybind/mgr/cephadm/inventory.py
@@ -854,6 +854,10 @@ class HostCache():
                     self.osdspec_last_applied[host][name] = str_to_datetime(ts)
 
                 for name, d in j.get('daemon_config_deps', {}).items():
+                    # drop potential leftover daemon_config_deps entries
+                    # assume if we didn't find a daemon entry, it's a leftover
+                    if name not in self.daemons.get(host, {}):
+                        continue
                     self.daemon_config_deps[host][name] = {
                         'deps': d.get('deps', []),
                         'last_config': str_to_datetime(d['last_config']),
@@ -1572,6 +1576,9 @@ class HostCache():
         if host in self.daemons:
             if name in self.daemons[host]:
                 del self.daemons[host][name]
+        if host in self.daemon_config_deps:
+            if name in self.daemon_config_deps[host]:
+                del self.daemon_config_deps[host][name]
 
     def daemon_cache_filled(self) -> bool:
         """

From 901a4944bb4243637e4d6bfee1bdd222988a5311 Mon Sep 17 00:00:00 2001
From: Anthony M <amiddleton@linuxfoundation.org>
Date: Tue, 30 Jun 2026 17:11:39 -0500
Subject: [PATCH 478/596] doc/foundation: Removed members section

These updates will allow us to update a single page rather than two. The detailed member lists and categories have been removed. I've added a redirect for visitors to this page to https://ceph.io/en/foundation/members/

Signed-off-by: Anthony M <amiddleton@linuxfoundation.org>
---
 doc/foundation.rst | 65 +---------------------------------------------
 1 file changed, 1 insertion(+), 64 deletions(-)

diff --git a/doc/foundation.rst b/doc/foundation.rst
index a9a3517f4eb..65f26c89b9e 100644
--- a/doc/foundation.rst
+++ b/doc/foundation.rst
@@ -20,59 +20,11 @@ cost.
 For more information, see `https://ceph.com/foundation
 <https://ceph.com/foundation>`_.
 
-
 Members
 =======
 
-Diamond
--------
+Visit `https://ceph.io/en/foundation/members/ <https://ceph.io/en/foundation/members/>`_ to see the full list of Ceph Foundation Members
 
-* `45Drives <https://45drives.com/>`_
-* `Bloomberg <https://bloomberg.com>`_
-* `IBM <https://ibm.com>`_
-* `Clyso <https://www.clyso.com/en/>`_
-
-
-Platinum
---------
-
-* `Western Digital <https://westerndigital.com/>`_
-
-
-Gold
-----
-
-* `42on <https://www.42on.com/>`_
-* `OVH <https://www.ovh.com/>`_
-* `Samsung Electronics <https://samsung.com/>`_
-
-
-Silver
-------
-
-* `Canonical <https://www.canonical.com/>`_
-* `CloudFerro <https://cloudferro.com/>`_
-* `croit <http://www.croit.io/>`_
-* `Digital Ocean <http://digitalocean.com/>`_
-* `ISS <http://iss-integration.com/>`_
-* `Intel <http://www.intel.com/>`_
-* `OSNexus <https://osnexus.com/>`_
-* `Sony Interactive <https://sonyinteractive.com/>`_
-
-Associate
----------
-
-* `Boston University <http://www.bu.com/>`_
-* `Center for Research in Open Source Systems (CROSS) <http://cross.ucsc.edu/>`_
-* `CERN <https://home.cern/>`_
-* `FASRC <https://www.rc.fas.harvard.edu/>`_
-* `grnet <https://grnet.gr/>`_
-* `Monash University <http://www.monash.edu/>`_
-* `NRF SARAO <http://www.ska.ac.za/about/sarao/>`_
-* `Open Infrastructure Foundation <http://openinfra.dev>`_
-* `Science & Technology Facilities Councel (STFC) <https://stfc.ukri.org/>`_
-* `SWITCH <https://switch.ch/>`_
-* `University of Michigan <http://www.osris.org/>`_
 
 Governing Board
 ===============
@@ -97,21 +49,6 @@ engineering activities are managed through traditional open source
 processes and are overseen by the :ref:`csc`. For more
 information see :ref:`governance`.
 
-Members
--------
-
-* Brett Kelly (45Drives)
-* Enrico Bocchi (CERN) - Associate member representative
-* Dan van der Ster (Clyso) - Ceph Council representative
-* Joachim Kraftmayer (Clyso)
-* Josh Durgin (IBM) - Ceph Council representative
-* Matthew Leonard (Bloomberg)
-* Anthony Middleton (Linux Foundation) - Ceph Community Manager
-* Neha Ojha (IBM) - Ceph Council Representative
-* Steven Umbehocker (OSNexus) - General member representative
-* Pawel Sadowski (OVH)
-* Sungmin Lee (Samsung Electronics)
-* Vincent Hsu (IBM)
 
 Joining
 =======

From 2b638869b2986386733fbb29ed95c57f84c4f931 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 1 Jul 2026 13:01:05 +0800
Subject: [PATCH 479/596] crimson: keep seastar's sanitizers in lockstep with
 WITH_ASAN

Seastar_SANITIZE defaults to "DEFAULT", which turns on ASan and UBSan for
Debug and Sanitize builds regardless of ceph's WITH_ASAN. A Debug build
with WITH_ASAN=OFF then instruments seastar while ceph links tcmalloc, and
the seastar tests crash before main() because ASan calls the allocator via
dlsym before it is initialized.

Force Seastar_SANITIZE to follow WITH_ASAN, next to the other forced
Seastar_* cache variables, so seastar is sanitized only when ceph is. This
keeps the fix on the ceph side instead of carrying a seastar fork patch.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/CMakeLists.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 6674ccdd38c..4eb283d4959 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -475,6 +475,11 @@ if(WITH_CRIMSON)
   set(Seastar_API_LEVEL "6" CACHE STRING "" FORCE)
   set(Seastar_IO_URING ${HAVE_LIBURING} CACHE BOOL "" FORCE)
   set(Seastar_DEPRECATED_OSTREAM_FORMATTERS OFF CACHE BOOL "" FORCE)
+  if(WITH_ASAN)
+    set(Seastar_SANITIZE "ON" CACHE STRING "" FORCE)
+  else()
+    set(Seastar_SANITIZE "OFF" CACHE STRING "" FORCE)
+  endif()
   if(Seastar_DPDK)
     find_package(dpdk QUIET)
     if(NOT DPDK_FOUND)

From 227b558f203e8ccedcea742591c78c0e1a8079ef Mon Sep 17 00:00:00 2001
From: Igor Golikov <igolikov@ibm.com>
Date: Wed, 27 May 2026 16:18:44 +0300
Subject: [PATCH 480/596] client: add assert to catch dentry ref drop during
 unlink

Add ceph_assert(dn->ref > 0) after Dentry::unlink() in Client::unlink()
to catch the case where internal put() calls drop the dentry reference
to zero before we proceed to detach/lru_remove.

This turns a silent use-after-free into a clean assertion failure with
a full stack trace, making it possible to catch the exact conditions
in a test environment.

Signed-off-by: Igor Golikov <igolikov@ibm.com>
Fixes: https://tracker.ceph.com/issues/74625
---
 src/client/Client.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 3a2041a8753..5d1464b3a3b 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -3800,6 +3800,7 @@ void Client::unlink(Dentry *dn, bool keepdir, bool keepdentry)
     dec_dentry_nr();
     ldout(cct, 20) << "unlink  inode " << in << " parents now " << in->dentries << dendl;
   }
+  ceph_assert(dn->ref > 0);
 
   if (keepdentry) {
     dn->lease_mds = -1;

From ad95bb54505161696e624646daee4eceec0a9d2e Mon Sep 17 00:00:00 2001
From: Igor Golikov <igolikov@ibm.com>
Date: Wed, 27 May 2026 16:19:25 +0300
Subject: [PATCH 481/596] client: fix Dentry UAF by holding DentryRef across
 unlink

Hold a function-scoped DentryRef in Client::unlink() to keep the dentry
alive through the entire teardown sequence.

Without the O_DIRECTORY dentry pin (PR #60909, merged after v19.2.1),
opening a directory does not call _ll_get(), so the dentry stays at
ref=1 while inode->dir is still active. When trim_cache() evicts this
dentry, Dentry::unlink() calls put() for the dir pin, ref drops to 0,
and the dentry is freed while Client::unlink() still needs it for
detach/lru_remove.

A function-scoped DentryRef guarantees the dentry survives until after
it has been properly removed from the dir and LRU, regardless of pin
state.

Signed-off-by: Igor Golikov <igolikov@ibm.com>
Fixes: https://tracker.ceph.com/issues/74625
---
 src/client/Client.cc | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 5d1464b3a3b..af7449e7220 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -3791,6 +3791,15 @@ Dentry* Client::link(Dir *dir, const string& name, Inode *in, Dentry *dn)
 void Client::unlink(Dentry *dn, bool keepdir, bool keepdentry)
 {
   InodeRef in(dn->inode);
+  // Keep the dentry alive for the duration of this function.
+  // Without the O_DIRECTORY dentry pin (PR #60909), a directory dentry can
+  // remain at ref=1 while its inode->dir is still active. When trim_cache()
+  // evicts it, Dentry::unlink() calls put() for the dir pin, dropping ref
+  // to 0 and freeing the dentry while we still need it for detach/lru_remove.
+  // The DentryRef guard prevents use-after-free regardless of pin state.
+  // See: https://tracker.ceph.com/issues/74625
+  DentryRef dnref(dn);
+
   ldout(cct, 15) << "unlink dir " << dn->dir->parent_inode << " '" << dn->name << "' dn " << dn
 		 << " inode " << dn->inode << dendl;
 
@@ -3800,7 +3809,7 @@ void Client::unlink(Dentry *dn, bool keepdir, bool keepdentry)
     dec_dentry_nr();
     ldout(cct, 20) << "unlink  inode " << in << " parents now " << in->dentries << dendl;
   }
-  ceph_assert(dn->ref > 0);
+  ceph_assert(dn->ref > 1);
 
   if (keepdentry) {
     dn->lease_mds = -1;

From db8d59ee4d615ddcc810da961352ccdb61026abb Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Wed, 1 Jul 2026 16:37:35 +0800
Subject: [PATCH 482/596] osd: report -EINVAL to on_finish in asok_route_to_pg
 catch

The handler passed the stale locate result (0) while returning -EINVAL,
so callers saw success on a bad_cmd_get failure.

Only reachable via the "scrubdebug" asok command (the sole user of
asok_route_to_pg) when a parameter fails type parsing.

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/osd/OSD.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/osd/OSD.cc b/src/osd/OSD.cc
index 6ee2ec0b8ac..e6e7489a675 100644
--- a/src/osd/OSD.cc
+++ b/src/osd/OSD.cc
@@ -2760,7 +2760,7 @@ int OSD::asok_route_to_pg(
   } catch (const TOPNSPC::common::bad_cmd_get& e) {
     (*target_pg)->unlock();
     ss << e.what();
-    on_finish(ret, ss.str(), outbl);
+    on_finish(-EINVAL, ss.str(), outbl);
     return -EINVAL;
   }
 }

From 57342f5373b9331007aa9bf4e54e941bc08ba031 Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Wed, 1 Jul 2026 09:06:22 -0400
Subject: [PATCH 483/596] qa: pykmip task defaults to ceph fork

point the pykmip task to the ceph fork of the PyKMIP repo, which carries
fixes for newer python

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 qa/tasks/pykmip.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/tasks/pykmip.py b/qa/tasks/pykmip.py
index 542691095a1..f413aae7fd6 100644
--- a/qa/tasks/pykmip.py
+++ b/qa/tasks/pykmip.py
@@ -65,7 +65,7 @@ def download(ctx, config):
 
     for (client, cconf) in config.items():
         branch = cconf.get('force-branch', 'master')
-        repo = cconf.get('force-repo', 'https://github.com/OpenKMIP/PyKMIP')
+        repo = cconf.get('force-repo', 'https://github.com/ceph/PyKMIP')
         sha1 = cconf.get('sha1')
         log.info("Using branch '%s' for pykmip", branch)
         log.info('sha1=%s', sha1)

From c63915350ff7e647b2c9cb9a41c17f5e8a8c03ee Mon Sep 17 00:00:00 2001
From: Casey Bodley <cbodley@redhat.com>
Date: Tue, 30 Jun 2026 09:33:35 -0400
Subject: [PATCH 484/596] Revert "Reapply "qa/rgw/crypt: disable failing kmip
 testing""

This reverts commit d27261d0c2641e92365cf590684567c58bbfb905.

Fixes: https://tracker.ceph.com/issues/77873

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---
 qa/suites/rgw/crypt/2-kms/kmip.yaml | 37 +++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 qa/suites/rgw/crypt/2-kms/kmip.yaml

diff --git a/qa/suites/rgw/crypt/2-kms/kmip.yaml b/qa/suites/rgw/crypt/2-kms/kmip.yaml
new file mode 100644
index 00000000000..0057d954e32
--- /dev/null
+++ b/qa/suites/rgw/crypt/2-kms/kmip.yaml
@@ -0,0 +1,37 @@
+overrides:
+  ceph:
+    conf:
+      client:
+        rgw crypt s3 kms backend: kmip
+        rgw crypt kmip ca path: /etc/ceph/kmiproot.crt
+        rgw crypt kmip client cert: /etc/ceph/kmip-client.crt
+        rgw crypt kmip client key: /etc/ceph/kmip-client.key
+        rgw crypt kmip kms key template: pykmip-$keyid
+  rgw:
+    client.0:
+      use-pykmip-role: client.0
+
+tasks:
+- openssl_keys:
+    kmiproot:
+      client: client.0
+      cn: kmiproot
+      key-type: rsa:4096
+    kmip-server:
+      client: client.0
+      ca: kmiproot
+    kmip-client:
+      client: client.0
+      ca: kmiproot
+      cn: rgw-client
+- exec:
+    client.0:
+      - chmod 644 /home/ubuntu/cephtest/ca/kmip-client.key
+- pykmip:
+    client.0:
+      clientca: kmiproot
+      servercert: kmip-server
+      clientcert: kmip-client
+      secrets:
+      - name: pykmip-my-key-1
+      - name: pykmip-my-key-2

From b883573faabca54109a2ddf6556f4be49ebbfc6f Mon Sep 17 00:00:00 2001
From: Jaya Prakash <jayaprakash@ibm.com>
Date: Wed, 1 Jul 2026 13:22:48 +0000
Subject: [PATCH 485/596] os/bluestore: add fast-path allocation latency perf
 counter for Allocator

Fixes: https://tracker.ceph.com/issues/76936

Signed-off-by: Jaya Prakash <jayaprakash@ibm.com>
---
 src/os/bluestore/AllocatorBase.cc   | 7 ++++++-
 src/os/bluestore/AllocatorBase.h    | 1 +
 src/os/bluestore/Btree2Allocator.cc | 4 ++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/os/bluestore/AllocatorBase.cc b/src/os/bluestore/AllocatorBase.cc
index a7c068dcfeb..3f0a78bfceb 100644
--- a/src/os/bluestore/AllocatorBase.cc
+++ b/src/os/bluestore/AllocatorBase.cc
@@ -215,7 +215,7 @@ void AllocatorPerf::_init_logger(std::string_view name) {
 
   b.add_time_avg(l_bluestore_allocator_alloc_process_lat,
     "alloc_process_lat",
-    "Allocator processing latency",
+    "Allocator processing latency while holding lock",
     "apl",
     PerfCountersBuilder::PRIO_USEFUL);
   b.add_time_avg(l_bluestore_allocator_lock_wait_lat,
@@ -223,6 +223,11 @@ void AllocatorPerf::_init_logger(std::string_view name) {
     "Allocator lock wait latency",
     "lwl",
     PerfCountersBuilder::PRIO_USEFUL);
+  b.add_time_avg(l_bluestore_allocator_nolock_process_lat,
+    "nolock_process_lat",
+    "Allocator lockless fast-path allocation latency",
+    "fpl",
+    PerfCountersBuilder::PRIO_USEFUL);
 
   logger = b.create_perf_counters();
 
diff --git a/src/os/bluestore/AllocatorBase.h b/src/os/bluestore/AllocatorBase.h
index dc567c3c2c9..3db35466007 100644
--- a/src/os/bluestore/AllocatorBase.h
+++ b/src/os/bluestore/AllocatorBase.h
@@ -26,6 +26,7 @@ enum {
   l_bluestore_allocator_first = 732300,
   l_bluestore_allocator_alloc_process_lat,
   l_bluestore_allocator_lock_wait_lat,
+  l_bluestore_allocator_nolock_process_lat,
   l_bluestore_allocator_last
 };
 
diff --git a/src/os/bluestore/Btree2Allocator.cc b/src/os/bluestore/Btree2Allocator.cc
index 7531f059852..d01839d3518 100644
--- a/src/os/bluestore/Btree2Allocator.cc
+++ b/src/os/bluestore/Btree2Allocator.cc
@@ -86,9 +86,13 @@ int64_t Btree2Allocator::allocate(
     max_alloc_size = p2align(uint64_t(cap), (uint64_t)block_size);
   }
   uint64_t cached_chunk_offs = 0;
+  auto fast_alloc_start = mono_clock::now();
   if (cache && cache->try_get(&cached_chunk_offs, want)) {
     num_free -= want;
     extents->emplace_back(cached_chunk_offs, want);
+    logger->tinc_with_max(
+        l_bluestore_allocator_nolock_process_lat,
+        mono_clock::now() - fast_alloc_start);
     return want;
   }
   auto lock_wait_start = mono_clock::now();

From 9da610b679d688360c51f46e29a11a15da5868a1 Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Wed, 1 Jul 2026 16:14:27 +0700
Subject: [PATCH 486/596] doc/radosgw: improve style slightly in STS.rst

Fix capitalization and remove unnecessary dashes in text.
Use double backticks for literals.

Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 doc/radosgw/STS.rst | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/doc/radosgw/STS.rst b/doc/radosgw/STS.rst
index 916cb905d6a..946f15c09a7 100644
--- a/doc/radosgw/STS.rst
+++ b/doc/radosgw/STS.rst
@@ -30,10 +30,10 @@ The following STS REST APIs have been implemented in Ceph Object Gateway:
     **DurationSeconds** (Integer/ Optional): The duration in seconds of the session.
     Its default value is 3600.
 
-    **ExternalId** (String/ Optional): A unique Id that might be used when a role is
+    **ExternalId** (String/ Optional): A unique ID that might be used when a role is
     assumed in another account.
 
-    **SerialNumber** (String/ Optional): The Id number of the MFA device associated
+    **SerialNumber** (String/ Optional): The ID number of the MFA device associated
     with the user making the AssumeRole call.
 
     **TokenCode** (String/ Optional): The value provided by the MFA device, if the
@@ -91,9 +91,9 @@ Similarly, an example of a policy that uses 'azp' claim in the condition is of t
 
     "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Federated\":[\"arn:aws:iam:::oidc-provider/<URL of IDP>\"]},\"Action\":[\"sts:AssumeRoleWithWebIdentity\"],\"Condition\":{\"StringEquals\":{\"<URL of IDP> :azp\":\"<azp>\"\}\}\}\]\}"
 
-A shadow user is created corresponding to every federated user. The user id is derived from the 'sub' field of the incoming web token.
-The user is created in a separate namespace - 'oidc' such that the user id doesn't clash with any other user ids in RGW. The format of the user id
-is - ``<tenant>$<user-namespace>$<sub>`` where user-namespace is 'oidc' for users that authenticate with oidc providers.
+A shadow user is created corresponding to every federated user. The user ID is derived from the ``sub`` field of the incoming web token.
+The user is created in a separate namespace ``oidc`` such that the user ID doesn't clash with any other user IDs in RGW. The format of the user ID
+is ``<tenant>$<user-namespace>$<sub>`` where ``user-namespace`` is ``oidc`` for users that authenticate with OIDC providers.
 
 RGW now supports Session tags that can be passed in the web token to AssumeRoleWithWebIdentity call. More information related to Session Tags can be found here
 :doc:`session-tags`.

From c20ba110400d0e6bc53a221701ba81befdfc5290 Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Mon, 18 May 2026 21:19:44 +0530
Subject: [PATCH 487/596] mgr/cephadm: redeploy stopped keepalived when ingress
 deps change

Fixes: https://tracker.ceph.com/issues/76304
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/serve.py               |  1 +
 .../mgr/cephadm/services/cephadmservice.py    |  2 +
 src/pybind/mgr/cephadm/services/ingress.py    | 15 ++++
 src/pybind/mgr/cephadm/services/jaeger.py     |  2 +
 src/pybind/mgr/cephadm/services/monitoring.py |  3 +
 src/pybind/mgr/cephadm/services/nfs.py        |  1 +
 .../cephadm/tests/services/test_ingress.py    | 81 +++++++++++++++++++
 7 files changed, 105 insertions(+)

diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 24e7e581a9e..5bbaa8fbeeb 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1236,6 +1236,7 @@ class CephadmServe:
                     spec,
                     curr_deps=deps,
                     last_deps=last_deps,
+                    daemon=dd,
                 )
                 if _step.action is not _scheduled_action:
                     self.log.info(
diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index 426b86f1b5c..37657d33e64 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -969,6 +969,7 @@ class CephadmService(metaclass=ABCMeta):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
@@ -1997,6 +1998,7 @@ class CephExporterService(CephService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
diff --git a/src/pybind/mgr/cephadm/services/ingress.py b/src/pybind/mgr/cephadm/services/ingress.py
index 84955d75549..360f84b7055 100644
--- a/src/pybind/mgr/cephadm/services/ingress.py
+++ b/src/pybind/mgr/cephadm/services/ingress.py
@@ -605,6 +605,7 @@ class IngressService(CephService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
@@ -614,6 +615,20 @@ class IngressService(CephService):
             scheduled_action, daemon_type, spec, curr_deps, last_deps
         )
         action = step.action
+        # keepalived is not systemd-enabled; when stopped, redeploy rewrites
+        # the unit and container so the serve loop can start the daemon again.
+        if (
+            daemon_type == 'keepalived'
+            and action is utils.Action.RECONFIG
+            and daemon is not None
+            and daemon.status == DaemonDescriptionStatus.stopped
+        ):
+            logger.debug(
+                'Redeploy wanted %s: keepalived deps changed (daemon stopped)',
+                spec.service_name() if spec else daemon_type,
+            )
+            return utils.NextDaemonStep(utils.Action.REDEPLOY)
+
         if (
             action is not utils.Action.REDEPLOY
             and daemon_type == 'haproxy'
diff --git a/src/pybind/mgr/cephadm/services/jaeger.py b/src/pybind/mgr/cephadm/services/jaeger.py
index 8d69c53cec8..6d0b5f441a2 100644
--- a/src/pybind/mgr/cephadm/services/jaeger.py
+++ b/src/pybind/mgr/cephadm/services/jaeger.py
@@ -2,6 +2,7 @@ from dataclasses import replace
 from typing import List, cast, Optional, TYPE_CHECKING
 from cephadm.services.cephadmservice import CephadmService, CephadmDaemonDeploySpec
 from ceph.deployment.service_spec import TracingSpec, ServiceSpec
+from orchestrator import DaemonDescription
 from .service_registry import register_cephadm_service
 from mgr_util import build_url
 from cephadm import utils
@@ -58,6 +59,7 @@ class JaegerAgentService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
diff --git a/src/pybind/mgr/cephadm/services/monitoring.py b/src/pybind/mgr/cephadm/services/monitoring.py
index 0294fdfafa4..6d0008f0ef6 100644
--- a/src/pybind/mgr/cephadm/services/monitoring.py
+++ b/src/pybind/mgr/cephadm/services/monitoring.py
@@ -491,6 +491,7 @@ class AlertmanagerService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
@@ -824,6 +825,7 @@ class PrometheusService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
@@ -891,6 +893,7 @@ class NodeExporterService(CephadmService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
diff --git a/src/pybind/mgr/cephadm/services/nfs.py b/src/pybind/mgr/cephadm/services/nfs.py
index 45d7aad1b9c..83fc8ec945e 100644
--- a/src/pybind/mgr/cephadm/services/nfs.py
+++ b/src/pybind/mgr/cephadm/services/nfs.py
@@ -578,6 +578,7 @@ class NFSService(CephService):
         spec: Optional[ServiceSpec],
         curr_deps: List[str],
         last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
     ) -> utils.NextDaemonStep:
         """Given the scheduled_action, service spec, daemon_type, and
         current and previous dependency lists return the next action that
diff --git a/src/pybind/mgr/cephadm/tests/services/test_ingress.py b/src/pybind/mgr/cephadm/tests/services/test_ingress.py
index 537e77283a9..4166f06179c 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_ingress.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_ingress.py
@@ -16,6 +16,7 @@ from cephadm.tests.fixtures import with_host, with_service, async_side_effect
 from ceph.utils import datetime_now
 from orchestrator._interface import DaemonDescription, DaemonDescriptionStatus
 from orchestrator import HostSpec
+from cephadm import utils
 from cephadm.services.ingress import IngressService
 
 
@@ -1459,6 +1460,86 @@ class TestIngressService:
         assert "Bind_addr = 10.10.2.20" in ganesha_conf
 
 
+def test_keepalived_choose_next_action_redeploy_on_deps_change_when_stopped():
+    mgr = MagicMock()
+    svc = IngressService(mgr)
+    spec = IngressSpec(
+        service_id='test',
+        backend_service='nfs.foo',
+        frontend_port=2049,
+        monitor_port=9049,
+        virtual_ip='192.168.122.100/24',
+        placement=PlacementSpec(hosts=['host1']),
+    )
+    daemon = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='test',
+        hostname='host1',
+        service_name='ingress.test',
+        status=DaemonDescriptionStatus.stopped,
+    )
+    next_step = svc.choose_next_action(
+        utils.Action.NO_ACTION,
+        'keepalived',
+        spec,
+        curr_deps=['haproxy.test'],
+        last_deps=['haproxy.old'],
+        daemon=daemon,
+    )
+    assert next_step.action is utils.Action.REDEPLOY
+
+
+def test_keepalived_choose_next_action_reconfig_when_running():
+    mgr = MagicMock()
+    svc = IngressService(mgr)
+    spec = IngressSpec(
+        service_id='test',
+        backend_service='nfs.foo',
+        frontend_port=2049,
+        monitor_port=9049,
+        virtual_ip='192.168.122.100/24',
+        placement=PlacementSpec(hosts=['host1']),
+    )
+    daemon = DaemonDescription(
+        daemon_type='keepalived',
+        daemon_id='test',
+        hostname='host1',
+        service_name='ingress.test',
+        status=DaemonDescriptionStatus.running,
+    )
+    next_step = svc.choose_next_action(
+        utils.Action.NO_ACTION,
+        'keepalived',
+        spec,
+        curr_deps=['haproxy.test'],
+        last_deps=['haproxy.old'],
+        daemon=daemon,
+    )
+    assert next_step.action is utils.Action.RECONFIG
+
+
+def test_keepalived_choose_next_action_scheduled_when_deps_unchanged():
+    mgr = MagicMock()
+    svc = IngressService(mgr)
+    spec = IngressSpec(
+        service_id='test',
+        backend_service='nfs.foo',
+        frontend_port=2049,
+        monitor_port=9049,
+        virtual_ip='192.168.122.100/24',
+        placement=PlacementSpec(hosts=['host1']),
+    )
+    deps = ['haproxy.test']
+    next_step = svc.choose_next_action(
+        utils.Action.NO_ACTION,
+        'keepalived',
+        spec,
+        curr_deps=deps,
+        last_deps=deps,
+    )
+    assert next_step.action is utils.Action.NO_ACTION
+
+
 def test_keepalived_should_auto_start_colocated_haproxy():
     mgr = MagicMock()
     mgr.cache.get_schedulable_hosts.return_value = [HostSpec('host-a')]

From 52fa867b680fb5dd4592c4e7b7ca6be7c55376ac Mon Sep 17 00:00:00 2001
From: Ali Masarwa <amasarwa@redhat.com>
Date: Wed, 1 Jul 2026 18:51:59 +0300
Subject: [PATCH 488/596] rgw/posix: fix remove API calls

Signed-off-by: Ali Masarwa <amasarwa@redhat.com>
---
 src/test/rgw/test_rgw_posix_driver.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/test/rgw/test_rgw_posix_driver.cc b/src/test/rgw/test_rgw_posix_driver.cc
index 73f53fd245f..d83a20b9f43 100644
--- a/src/test/rgw/test_rgw_posix_driver.cc
+++ b/src/test/rgw/test_rgw_posix_driver.cc
@@ -273,7 +273,7 @@ TEST(FSEnt, DirBase)
   EXPECT_EQ(ret, 0);
   EXPECT_EQ(ent->get_type(), ObjectType::DIRECTORY);
 
-  ret = testdir->remove(env->dpp, null_yield, false);
+  ret = testdir->remove(env->dpp, null_yield, false, nullptr);
   EXPECT_EQ(ret, 0);
   EXPECT_FALSE(sf::exists(tp));
 }
@@ -485,7 +485,7 @@ TEST(FSEnt, FileBase)
   EXPECT_EQ(ret, 0);
   EXPECT_EQ(ent->get_type(), ObjectType::FILE);
 
-  ret = testfile->remove(env->dpp, null_yield, false);
+  ret = testfile->remove(env->dpp, null_yield, false, nullptr);
   EXPECT_EQ(ret, 0);
   EXPECT_FALSE(sf::exists(tp));
 }
@@ -549,7 +549,7 @@ TEST(FSEnt, SymlinkBase)
   EXPECT_EQ(ent->get_type(), ObjectType::SYMLINK);
 
 
-  ret = testlink->remove(env->dpp, null_yield, false);
+  ret = testlink->remove(env->dpp, null_yield, false, nullptr);
   EXPECT_EQ(ret, 0);
   EXPECT_FALSE(sf::exists(tp));
 }
@@ -667,7 +667,7 @@ TEST(FSEnt, MPDirBase)
   EXPECT_EQ(ret, 0);
   EXPECT_EQ(ent->get_type(), ObjectType::MULTIPART);
 
-  ret = testdir->remove(env->dpp, null_yield, false);
+  ret = testdir->remove(env->dpp, null_yield, false, nullptr);
   EXPECT_EQ(ret, 0);
   EXPECT_FALSE(sf::exists(tp));
 }
@@ -877,7 +877,7 @@ TEST(FSEnt, VerDirBase)
   EXPECT_EQ(ret, 0);
   EXPECT_EQ(ent->get_type(), ObjectType::VERSIONED);
 
-  ret = testdir->remove(env->dpp, null_yield, false);
+  ret = testdir->remove(env->dpp, null_yield, false, nullptr);
   EXPECT_EQ(ret, 0);
   EXPECT_FALSE(sf::exists(tp));
 }

From aa70e125320530ceb0c80f000b6b01aed0319571 Mon Sep 17 00:00:00 2001
From: Christopher Hoffman <choffman@redhat.com>
Date: Tue, 21 Apr 2026 16:20:17 +0000
Subject: [PATCH 489/596] qa: Use mount class in test_fscrypt to read/write and
 to compare trees

In TestFSCryptVolumes, make sure to use mount class to
compare directory trees and to read/write files.

Fixes: https://tracker.ceph.com/issues/74110
Signed-off-by: Christopher Hoffman <choffman@redhat.com>
---
 qa/tasks/cephfs/mount.py        | 50 +++++++++++++++++++++++++++++++++
 qa/tasks/cephfs/test_fscrypt.py | 49 ++++----------------------------
 2 files changed, 56 insertions(+), 43 deletions(-)

diff --git a/qa/tasks/cephfs/mount.py b/qa/tasks/cephfs/mount.py
index 26b848b477a..f1c4e1d0587 100644
--- a/qa/tasks/cephfs/mount.py
+++ b/qa/tasks/cephfs/mount.py
@@ -1625,6 +1625,56 @@ class CephFSMountBase(object):
         proc = self._run_python(pyscript)
         proc.wait()
 
+    def compare_trees(self, src, dst):
+        """
+        Compare two directory trees. Compare based on file names and contents.
+
+        :param src:
+        :param dst:
+        :return:
+        """
+        pyscript = dedent("""
+            import os
+            import errno
+
+            def _md5hash_file(self, file):
+                md5 = hashlib.md5()
+                contents = ''
+                with open(file, 'r') as f:
+                    contents = f.read()
+                md5.update(contents)
+                return md5.hexdigest()
+
+            files = os.listdir('{src}')
+            for file in files:
+                src_file = '{src}/' + file
+                dst_file = '{dst}/' + file
+
+                exists = os.path.exists(dst_file)
+                lexists = os.path.lexists(dst_file)
+                if not exists and not lexists:
+                    log.debug('path_dne:=' + dst_file)
+                    raise
+
+                if os.path.islink('{src}'):
+                    #do link check
+                    if os.readlink(src_file) != os.readlink(dst_file):
+                        raise
+                elif os.path.isfile('{src}'):
+                    #check reported size
+                    rsize_match = os.path.getsize(src_file) == os.path.getsize(dst_file)
+                    if not rsize_match:
+                        raise
+
+                    #check contents
+                    src_hash = self._md5hash_file(src_file)
+                    dest_hash = self._md5hash_file(dst_file)
+                    if src_hash != dest_hash:
+                        raise
+            """).format(src=src, dst=dst)
+        proc = self._run_python(pyscript)
+        proc.wait()
+
     def touch_os(self, fs_path):
         """
         Create a dentry if it doesn't already exist. Uses the open method in the os module.
diff --git a/qa/tasks/cephfs/test_fscrypt.py b/qa/tasks/cephfs/test_fscrypt.py
index 6ca3d8a975b..d9584c0fffa 100644
--- a/qa/tasks/cephfs/test_fscrypt.py
+++ b/qa/tasks/cephfs/test_fscrypt.py
@@ -5,7 +5,6 @@ import os
 import random
 import string
 import time
-import hashlib
 
 from logging import getLogger
 from teuthology.contextutil import safe_while
@@ -397,40 +396,6 @@ class TestFSCryptVolumes(CephFSTestCase):
         self.mount_a.run_shell_payload(f"sudo fscrypt purge --force --verbose {self.mount_a.hostfs_mntpt}")
         super().tearDown()
 
-    def _compare_trees(self, src, dst):
-        files = os.listdir(src)
-        for file in files:
-            src_file = f'{src}/{file}'
-            dst_file = f'{dst}/{file}'
-
-            exists = os.path.exists(dst_file)
-            lexists = os.path.lexists(dst_file)
-            if not exists and not lexists:
-                log.debug(f'path_dne:={dst_file}')
-                raise
-
-            if os.path.islink(src):
-                #do link check
-                if os.readlink(src_file) != os.readlink(dst_file):
-                    raise
-            elif os.path.isfile(src):
-                #check reported size
-                rsize_match = os.path.getsize(src_file) == os.path.getsize(dst_file)
-                if not rsize_match:
-                    raise
-
-                #check contents
-                src_hash = self._md5hash_file(src_file)
-                dest_hash = self._md5hash_file(dst_file)
-                if src_hash != dest_hash:
-                    raise
-
-    def _md5hash_file(self, file):
-        md5 = hashlib.md5()
-        with open(file, "rb") as f:
-            md5.update(f.read())
-        return md5.hexdigest()
-
     def _get_sv_path(self, v, sv):
         sv_path = self.get_ceph_cmd_stdout(f'fs subvolume getpath {v} {sv}')
         sv_path = sv_path.strip()
@@ -525,8 +490,7 @@ class TestFSCryptVolumes(CephFSTestCase):
                 rand_file = f'{src_path}/{i}/rand_file{j}'
                 block = ''.join(random.choice(string.ascii_letters) for _ in range(1 * 1024 * 1024))
                 contents = block * 16
-                with open(rand_file, 'w') as f:
-                    f.write(contents)
+                self.mount_a.write_file(rand_file, contents)
 
             self.mount_a.symlink(rand_file, f'{rand_file}-sym')
 
@@ -539,11 +503,11 @@ class TestFSCryptVolumes(CephFSTestCase):
         dst_path = f'{c_path}'
 
         #compare unlocked
-        self._compare_trees(src_path, dst_path)
+        self.mount_a.compare_trees(src_path, dst_path)
 
         #compare locked
         self.mount_a.run_shell_payload(f"sudo fscrypt lock --verbose {src_path}")
-        self._compare_trees(src_path, dst_path)
+        self.mount_a.compare_trees(src_path, dst_path)
 
     def test_fscrypt_clone_long_name(self):
         """ Test that an fscrypt tree with long names can be cloned """
@@ -565,8 +529,7 @@ class TestFSCryptVolumes(CephFSTestCase):
         for i in range(255):
             long_name += 'a'
 
-        with open(long_name, 'w') as f:
-            f.write('contents')
+        self.mount_a.write_file(long_name, 'contents')
 
         long_symlink = f'{src_path}/'
         for i in range(255):
@@ -583,11 +546,11 @@ class TestFSCryptVolumes(CephFSTestCase):
         dst_path = f'{c_path}'
 
         #compare unlocked
-        self._compare_trees(src_path, dst_path)
+        self.mount_a.compare_trees(src_path, dst_path)
 
         #compare locked
         self.mount_a.run_shell_payload(f"sudo fscrypt lock --verbose {src_path}")
-        self._compare_trees(src_path, dst_path)
+        self.mount_a.compare_trees(src_path, dst_path)
 
 class TestFSCryptXFS(XFSTestsDev):
 

From 708d79cd5cb5441df310968f7d63abdf6765a89f Mon Sep 17 00:00:00 2001
From: John Mulligan <jmulligan@redhat.com>
Date: Mon, 29 Jun 2026 13:12:00 -0400
Subject: [PATCH 490/596] doc: fix some small errors and oversights for new rgw
 shares

Fix some field names differing from the implementation and
add a missing field.

Fixes: 847dc5cc8c099fed82f1228e95051b4a30c4a4da
Signed-off-by: John Mulligan <jmulligan@redhat.com>
---
 doc/mgr/smb.rst | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/doc/mgr/smb.rst b/doc/mgr/smb.rst
index 4a3411fa5fe..71d9ffacb71 100644
--- a/doc/mgr/smb.rst
+++ b/doc/mgr/smb.rst
@@ -1226,6 +1226,10 @@ rgw
         Optional string. The RGW user ID that owns the bucket. If not provided,
         the system will automatically determine the bucket owner and fetch the
         necessary credentials.
+    credential_ref
+        Optional string. The ``rgw_credential_id`` value of a
+        ``ceph.smb.rgw.credential`` resource that contains RGW access and
+        secret key values needed to use the given bucket.
 
 restrict_access
     Optional boolean, defaulting to false. If true the share will only permit
@@ -1465,9 +1469,9 @@ intent
     If ``removed`` all following fields are optional
 user_id
     Required string. The RGW user ID that owns the credentials
-access_key
+access_key_id
     Required string. The RGW access key for authentication
-secret_key
+secret_access_key
     Required string. The RGW secret key for authentication
 linked_to_cluster:
     Optional. A string containing a cluster ID. If set, the resource may only

From 705d865ae77f4d3e80a9d3da3281ba6a824d7f29 Mon Sep 17 00:00:00 2001
From: Leonid Chernin <leonidc@il.ibm.com>
Date: Mon, 2 Feb 2026 08:01:14 +0200
Subject: [PATCH 491/596] librbd/migration/NativeFormat: support specifying
 mon_host and key via spec

migration:
           -take  secret_key from spec
           -take  mon_host from the spec
           -ignore source keyring, source ceph.conf - bypass them
           -added validations of the new way schema
           -get key from the KV DB if key in spec  is actually key-ref

Fixes: https://tracker.ceph.com/issues/68177
Signed-off-by: Leonid Chernin <leonidc@il.ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 src/librbd/migration/NativeFormat.cc | 95 +++++++++++++++++++++++-----
 1 file changed, 80 insertions(+), 15 deletions(-)

diff --git a/src/librbd/migration/NativeFormat.cc b/src/librbd/migration/NativeFormat.cc
index a681c7c252e..5dbb82f90a8 100644
--- a/src/librbd/migration/NativeFormat.cc
+++ b/src/librbd/migration/NativeFormat.cc
@@ -10,6 +10,7 @@
 #include "librbd/ImageCtx.h"
 #include "json_spirit/json_spirit.h"
 #include "boost/lexical_cast.hpp"
+#include "librbd/Utils.h"
 
 #define dout_subsys ceph_subsys_rbd
 #undef dout_prefix
@@ -22,6 +23,8 @@ namespace migration {
 namespace {
 
 const std::string TYPE_KEY{"type"};
+const std::string MON_HOST_KEY{"mon_host"};
+const std::string SECRET_KEY{"key"};
 const std::string CLUSTER_NAME_KEY{"cluster_name"};
 const std::string CLIENT_NAME_KEY{"client_name"};
 const std::string POOL_ID_KEY{"pool_id"};
@@ -66,6 +69,8 @@ int NativeFormat<I>::create_image_ctx(
     librados::Rados** src_rados) {
   auto cct = reinterpret_cast<CephContext*>(dst_io_ctx.cct());
   std::string cluster_name;
+  std::string mon_host;
+  std::string secret_key;
   std::string client_name;
   std::string pool_name;
   int64_t pool_id = -1;
@@ -76,6 +81,34 @@ int NativeFormat<I>::create_image_ctx(
   uint64_t snap_id = CEPH_NOSNAP;
   int r;
 
+  if (auto it = source_spec_object.find(MON_HOST_KEY);
+      it != source_spec_object.end()) {
+    if (it->second.type() == json_spirit::str_type) {
+      mon_host = it->second.get_str();
+    } else {
+      lderr(cct) << "invalid mon host" << dendl;
+      return -EINVAL;
+    }
+  }
+
+  if (auto it = source_spec_object.find(SECRET_KEY);
+      it != source_spec_object.end()) {
+    if (it->second.type() == json_spirit::str_type) {
+      secret_key = it->second.get_str();
+    } else {
+      lderr(cct) << "invalid key" << dendl;
+      return -EINVAL;
+    }
+  }
+
+  if (!mon_host.empty() && secret_key.empty()) {
+    lderr(cct) << "cannot specify mon host without key" << dendl;
+    return -EINVAL;
+  } else if (mon_host.empty() && !secret_key.empty()) {
+    lderr(cct) << "cannot specify key without mon host" << dendl;
+    return -EINVAL;
+  }
+
   if (auto it = source_spec_object.find(CLUSTER_NAME_KEY);
       it != source_spec_object.end()) {
     if (it->second.type() == json_spirit::str_type) {
@@ -84,12 +117,17 @@ int NativeFormat<I>::create_image_ctx(
       lderr(cct) << "invalid cluster name" << dendl;
       return -EINVAL;
     }
+    if (!mon_host.empty()) {
+      lderr(cct) << "cannot specify both cluster name and mon host" << dendl;
+      return -EINVAL;
+    }
   }
 
   if (auto it = source_spec_object.find(CLIENT_NAME_KEY);
       it != source_spec_object.end()) {
-    if (cluster_name.empty()) {
-      lderr(cct) << "cannot specify client name without cluster name" << dendl;
+    if (cluster_name.empty() && mon_host.empty()) {
+      lderr(cct) << "cannot specify client name without cluster name or mon host"
+                 << dendl;
       return -EINVAL;
     }
     if (it->second.type() == json_spirit::str_type) {
@@ -212,12 +250,11 @@ int NativeFormat<I>::create_image_ctx(
   }
 
   std::unique_ptr<librados::Rados> rados_ptr;
-  if (!cluster_name.empty()) {
+  if (!cluster_name.empty() || !mon_host.empty()) {
     // manually bootstrap a CephContext, skipping reading environment
     // variables for now -- since we don't have access to command line
     // arguments here, the least confusing option is to limit initial
     // remote cluster config to a file in the default location
-    // TODO: support specifying mon_host and key via source spec
     // TODO: support merging in effective local cluster config to get
     // overrides for log levels, etc
     CephInitParameters iparams(CEPH_ENTITY_TYPE_CLIENT);
@@ -229,17 +266,44 @@ int NativeFormat<I>::create_image_ctx(
     auto remote_cct = common_preinit(iparams, CODE_ENVIRONMENT_LIBRARY, 0);
     auto put_remote_cct = make_scope_guard([remote_cct] { remote_cct->put(); });
 
-    remote_cct->_conf->cluster = cluster_name;
+    if (!cluster_name.empty()) {
+      remote_cct->_conf->cluster = cluster_name;
 
-    // pass CEPH_CONF_FILE_DEFAULT instead of nullptr to prevent
-    // CEPH_CONF environment variable from being picked up
-    r = remote_cct->_conf.parse_config_files(CEPH_CONF_FILE_DEFAULT, nullptr,
-                                             0);
-    if (r < 0) {
-      remote_cct->_conf.complain_about_parse_error(cct);
-      lderr(cct) << "failed to read ceph conf for remote cluster: "
-                 << cpp_strerror(r) << dendl;
-      return r;
+      // pass CEPH_CONF_FILE_DEFAULT instead of nullptr to prevent
+      // CEPH_CONF environment variable from being picked up
+      r = remote_cct->_conf.parse_config_files(CEPH_CONF_FILE_DEFAULT, nullptr,
+                                               0);
+      if (r < 0) {
+        remote_cct->_conf.complain_about_parse_error(cct);
+        lderr(cct) << "failed to read ceph conf for remote cluster: "
+                   << cpp_strerror(r) << dendl;
+        return r;
+      }
+    } else if (!mon_host.empty()) {
+      ldout(cct, 5) << "found mon host in source spec: " << mon_host << dendl;
+      if (util::is_config_key_uri(secret_key)) {
+        ldout(cct, 5) << "found key ref in source spec: " << secret_key << dendl;
+        librados::Rados dest_rados(dst_io_ctx);
+        r = util::get_config_key(dest_rados, secret_key, &secret_key);
+        if (r < 0) {
+          lderr(cct) << "failed to retrieve secret key: " << cpp_strerror(r)
+                     << dendl;
+          return r;
+        }
+      }
+
+      r = remote_cct->_conf.set_val(MON_HOST_KEY, mon_host);
+      if (r < 0) {
+        lderr(cct) << "failed to set_val " << MON_HOST_KEY << ": "
+                   << cpp_strerror(r) << dendl;
+        return r;
+      }
+      r = remote_cct->_conf.set_val(SECRET_KEY, secret_key);
+      if (r < 0) {
+        lderr(cct) << "failed to set_val " << SECRET_KEY << ": "
+                   << cpp_strerror(r) << dendl;
+        return r;
+      }
     }
 
     remote_cct->_conf.apply_changes(nullptr);
@@ -248,6 +312,7 @@ int NativeFormat<I>::create_image_ctx(
     r = rados_ptr->init_with_context(remote_cct);
     ceph_assert(r == 0);
 
+    ldout(cct, 5) << "going to connect to remote cluster" <<dendl;
     r = rados_ptr->connect();
     if (r < 0) {
       lderr(cct) << "failed to connect to remote cluster: " << cpp_strerror(r)
@@ -280,7 +345,7 @@ int NativeFormat<I>::create_image_ctx(
                                true);
   }
 
-  if (!cluster_name.empty()) {
+  if (!cluster_name.empty() || !mon_host.empty()) {
     *src_rados = rados_ptr.release();
   } else {
     *src_rados = nullptr;

From 047bbbf863032c76532cc51eadd5368189a8b146 Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Mon, 29 Jun 2026 13:39:50 +0200
Subject: [PATCH 492/596] qa/suites/rbd: use client.0 entity in
 migration-external tests

Currently client.admin is passed for client_name and that doesn't
exercise client_name handling much as client.admin is the default.

When deploying multiple clusters the ceph task distributes keyrings
with only the key for the initial monitor and client.admin key.  Other
keys (e.g. client.0) are present only on their respective clusters, so
client.0's key for cluster2 needs to be obtained on cluster1 explicitly
with "ceph auth get".

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 .../rbd/migration-external/6-prepare/native-clone.yaml   | 9 ++++++---
 .../migration-external/6-prepare/native-standalone.yaml  | 9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/qa/suites/rbd/migration-external/6-prepare/native-clone.yaml b/qa/suites/rbd/migration-external/6-prepare/native-clone.yaml
index 2ca92dccfde..96fc0012549 100644
--- a/qa/suites/rbd/migration-external/6-prepare/native-clone.yaml
+++ b/qa/suites/rbd/migration-external/6-prepare/native-clone.yaml
@@ -22,8 +22,11 @@ tasks:
         - rbd --cluster cluster2 clone client.0.2-src@snap client.0.2
         - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.2
         - rbd --cluster cluster2 snap create client.0.2@snap
+        - ceph --cluster cluster2 auth caps client.0 mon 'profile rbd' mgr 'profile rbd-read-only' osd 'profile rbd-read-only'
   - exec:
       cluster1.client.0:
-        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.admin","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
-        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.admin","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
-        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.admin","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2
+        - ceph --cluster cluster2 auth get client.0 -o /etc/ceph/cluster2.client.0.keyring
+        - ceph --cluster cluster1 auth caps client.0 mon 'profile rbd' mgr 'profile rbd' osd 'profile rbd'
+        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.0","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
+        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.0","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
+        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.0","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2
diff --git a/qa/suites/rbd/migration-external/6-prepare/native-standalone.yaml b/qa/suites/rbd/migration-external/6-prepare/native-standalone.yaml
index 5fdf4d35c26..9da9b799ffc 100644
--- a/qa/suites/rbd/migration-external/6-prepare/native-standalone.yaml
+++ b/qa/suites/rbd/migration-external/6-prepare/native-standalone.yaml
@@ -11,8 +11,11 @@ tasks:
         - rbd --cluster cluster2 create --size 1G client.0.2
         - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.2
         - rbd --cluster cluster2 snap create client.0.2@snap
+        - ceph --cluster cluster2 auth caps client.0 mon 'profile rbd' mgr 'profile rbd-read-only' osd 'profile rbd-read-only'
   - exec:
       cluster1.client.0:
-        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.admin","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
-        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.admin","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
-        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.admin","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2
+        - ceph --cluster cluster2 auth get client.0 -o /etc/ceph/cluster2.client.0.keyring
+        - ceph --cluster cluster1 auth caps client.0 mon 'profile rbd' mgr 'profile rbd' osd 'profile rbd'
+        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.0","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
+        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.0","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
+        - echo '{"type":"native","cluster_name":"cluster2","client_name":"client.0","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2

From e246fad552854cdc942485047b6c9112524a9229 Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Mon, 29 Jun 2026 11:40:02 +0200
Subject: [PATCH 493/596] qa/suites/rbd: add mon_host + key[-ref] coverage to
 migration-external

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 ...tive-clone.yaml => native-clone-conf.yaml} |  0
 .../6-prepare/native-clone-key-ref.yaml       | 36 +++++++++++++++++++
 .../6-prepare/native-clone-raw-key.yaml       | 35 ++++++++++++++++++
 ...alone.yaml => native-standalone-conf.yaml} |  0
 .../6-prepare/native-standalone-key-ref.yaml  | 25 +++++++++++++
 .../6-prepare/native-standalone-raw-key.yaml  | 24 +++++++++++++
 6 files changed, 120 insertions(+)
 rename qa/suites/rbd/migration-external/6-prepare/{native-clone.yaml => native-clone-conf.yaml} (100%)
 create mode 100644 qa/suites/rbd/migration-external/6-prepare/native-clone-key-ref.yaml
 create mode 100644 qa/suites/rbd/migration-external/6-prepare/native-clone-raw-key.yaml
 rename qa/suites/rbd/migration-external/6-prepare/{native-standalone.yaml => native-standalone-conf.yaml} (100%)
 create mode 100644 qa/suites/rbd/migration-external/6-prepare/native-standalone-key-ref.yaml
 create mode 100644 qa/suites/rbd/migration-external/6-prepare/native-standalone-raw-key.yaml

diff --git a/qa/suites/rbd/migration-external/6-prepare/native-clone.yaml b/qa/suites/rbd/migration-external/6-prepare/native-clone-conf.yaml
similarity index 100%
rename from qa/suites/rbd/migration-external/6-prepare/native-clone.yaml
rename to qa/suites/rbd/migration-external/6-prepare/native-clone-conf.yaml
diff --git a/qa/suites/rbd/migration-external/6-prepare/native-clone-key-ref.yaml b/qa/suites/rbd/migration-external/6-prepare/native-clone-key-ref.yaml
new file mode 100644
index 00000000000..035ade05fca
--- /dev/null
+++ b/qa/suites/rbd/migration-external/6-prepare/native-clone-key-ref.yaml
@@ -0,0 +1,36 @@
+tasks:
+  - exec:
+      cluster2.client.0:
+        - echo '{"type":"qcow","stream":{"type":"http","url":"http://download.ceph.com/qa/ubuntu-12.04.qcow2"}}' | rbd --cluster cluster2 migration prepare --import-only --source-spec-path - client.0.0-src
+        - rbd --cluster cluster2 migration execute client.0.0-src
+        - rbd --cluster cluster2 migration commit client.0.0-src
+        - rbd --cluster cluster2 snap create client.0.0-src@snap
+        - rbd --cluster cluster2 snap protect client.0.0-src@snap
+        - rbd --cluster cluster2 clone client.0.0-src@snap client.0.0
+        - rbd --cluster cluster2 snap create client.0.0@snap
+        - rbd --cluster cluster2 create --size 1G client.0.1-src
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 1M client.0.1-src
+        - rbd --cluster cluster2 snap create client.0.1-src@snap
+        - rbd --cluster cluster2 snap protect client.0.1-src@snap
+        - rbd --cluster cluster2 clone client.0.1-src@snap client.0.1
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 1M client.0.1
+        - rbd --cluster cluster2 snap create client.0.1@snap
+        - rbd --cluster cluster2 create --size 1G client.0.2-src
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 1M client.0.2-src
+        - rbd --cluster cluster2 snap create client.0.2-src@snap
+        - rbd --cluster cluster2 snap protect client.0.2-src@snap
+        - rbd --cluster cluster2 clone client.0.2-src@snap client.0.2
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.2
+        - rbd --cluster cluster2 snap create client.0.2@snap
+        - ceph --cluster cluster2 auth caps client.0 mon 'profile rbd' mgr 'profile rbd-read-only' osd 'profile rbd-read-only'
+  - exec:
+      cluster1.client.0:
+        - |
+          set -ex
+          MON_HOST="$(ceph-conf --cluster cluster2 mon_host)"
+          KEY="$(ceph --cluster cluster2 auth get-key client.0)"
+          ceph --cluster cluster1 config-key set rbd/migration/native/client.0/cluster2_key "$KEY"
+          ceph --cluster cluster1 auth caps client.0 mon 'profile rbd, allow command "config-key get" with key prefix rbd/migration/native/client.0/' mgr 'profile rbd' osd 'profile rbd'
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"config://rbd/migration/native/client.0/cluster2_key","client_name":"client.0","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"config://rbd/migration/native/client.0/cluster2_key","client_name":"client.0","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"config://rbd/migration/native/client.0/cluster2_key","client_name":"client.0","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2
diff --git a/qa/suites/rbd/migration-external/6-prepare/native-clone-raw-key.yaml b/qa/suites/rbd/migration-external/6-prepare/native-clone-raw-key.yaml
new file mode 100644
index 00000000000..279d162c763
--- /dev/null
+++ b/qa/suites/rbd/migration-external/6-prepare/native-clone-raw-key.yaml
@@ -0,0 +1,35 @@
+tasks:
+  - exec:
+      cluster2.client.0:
+        - echo '{"type":"qcow","stream":{"type":"http","url":"http://download.ceph.com/qa/ubuntu-12.04.qcow2"}}' | rbd --cluster cluster2 migration prepare --import-only --source-spec-path - client.0.0-src
+        - rbd --cluster cluster2 migration execute client.0.0-src
+        - rbd --cluster cluster2 migration commit client.0.0-src
+        - rbd --cluster cluster2 snap create client.0.0-src@snap
+        - rbd --cluster cluster2 snap protect client.0.0-src@snap
+        - rbd --cluster cluster2 clone client.0.0-src@snap client.0.0
+        - rbd --cluster cluster2 snap create client.0.0@snap
+        - rbd --cluster cluster2 create --size 1G client.0.1-src
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 1M client.0.1-src
+        - rbd --cluster cluster2 snap create client.0.1-src@snap
+        - rbd --cluster cluster2 snap protect client.0.1-src@snap
+        - rbd --cluster cluster2 clone client.0.1-src@snap client.0.1
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 1M client.0.1
+        - rbd --cluster cluster2 snap create client.0.1@snap
+        - rbd --cluster cluster2 create --size 1G client.0.2-src
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 1M client.0.2-src
+        - rbd --cluster cluster2 snap create client.0.2-src@snap
+        - rbd --cluster cluster2 snap protect client.0.2-src@snap
+        - rbd --cluster cluster2 clone client.0.2-src@snap client.0.2
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.2
+        - rbd --cluster cluster2 snap create client.0.2@snap
+        - ceph --cluster cluster2 auth caps client.0 mon 'profile rbd' mgr 'profile rbd-read-only' osd 'profile rbd-read-only'
+  - exec:
+      cluster1.client.0:
+        - |
+          set -ex
+          MON_HOST="$(ceph-conf --cluster cluster2 mon_host)"
+          KEY="$(ceph --cluster cluster2 auth get-key client.0)"
+          ceph --cluster cluster1 auth caps client.0 mon 'profile rbd' mgr 'profile rbd' osd 'profile rbd'
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"'"$KEY"'","client_name":"client.0","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"'"$KEY"'","client_name":"client.0","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"'"$KEY"'","client_name":"client.0","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2
diff --git a/qa/suites/rbd/migration-external/6-prepare/native-standalone.yaml b/qa/suites/rbd/migration-external/6-prepare/native-standalone-conf.yaml
similarity index 100%
rename from qa/suites/rbd/migration-external/6-prepare/native-standalone.yaml
rename to qa/suites/rbd/migration-external/6-prepare/native-standalone-conf.yaml
diff --git a/qa/suites/rbd/migration-external/6-prepare/native-standalone-key-ref.yaml b/qa/suites/rbd/migration-external/6-prepare/native-standalone-key-ref.yaml
new file mode 100644
index 00000000000..58c80838016
--- /dev/null
+++ b/qa/suites/rbd/migration-external/6-prepare/native-standalone-key-ref.yaml
@@ -0,0 +1,25 @@
+tasks:
+  - exec:
+      cluster2.client.0:
+        - echo '{"type":"qcow","stream":{"type":"http","url":"http://download.ceph.com/qa/ubuntu-12.04.qcow2"}}' | rbd --cluster cluster2 migration prepare --import-only --source-spec-path - client.0.0
+        - rbd --cluster cluster2 migration execute client.0.0
+        - rbd --cluster cluster2 migration commit client.0.0
+        - rbd --cluster cluster2 snap create client.0.0@snap
+        - rbd --cluster cluster2 create --size 1G client.0.1
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.1
+        - rbd --cluster cluster2 snap create client.0.1@snap
+        - rbd --cluster cluster2 create --size 1G client.0.2
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.2
+        - rbd --cluster cluster2 snap create client.0.2@snap
+        - ceph --cluster cluster2 auth caps client.0 mon 'profile rbd' mgr 'profile rbd-read-only' osd 'profile rbd-read-only'
+  - exec:
+      cluster1.client.0:
+        - |
+          set -ex
+          MON_HOST="$(ceph-conf --cluster cluster2 mon_host)"
+          KEY="$(ceph --cluster cluster2 auth get-key client.0)"
+          ceph --cluster cluster1 config-key set rbd/migration/native/client.0/cluster2_key "$KEY"
+          ceph --cluster cluster1 auth caps client.0 mon 'profile rbd, allow command "config-key get" with key prefix rbd/migration/native/client.0/' mgr 'profile rbd' osd 'profile rbd'
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"config://rbd/migration/native/client.0/cluster2_key","client_name":"client.0","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"config://rbd/migration/native/client.0/cluster2_key","client_name":"client.0","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"config://rbd/migration/native/client.0/cluster2_key","client_name":"client.0","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2
diff --git a/qa/suites/rbd/migration-external/6-prepare/native-standalone-raw-key.yaml b/qa/suites/rbd/migration-external/6-prepare/native-standalone-raw-key.yaml
new file mode 100644
index 00000000000..ad707212aee
--- /dev/null
+++ b/qa/suites/rbd/migration-external/6-prepare/native-standalone-raw-key.yaml
@@ -0,0 +1,24 @@
+tasks:
+  - exec:
+      cluster2.client.0:
+        - echo '{"type":"qcow","stream":{"type":"http","url":"http://download.ceph.com/qa/ubuntu-12.04.qcow2"}}' | rbd --cluster cluster2 migration prepare --import-only --source-spec-path - client.0.0
+        - rbd --cluster cluster2 migration execute client.0.0
+        - rbd --cluster cluster2 migration commit client.0.0
+        - rbd --cluster cluster2 snap create client.0.0@snap
+        - rbd --cluster cluster2 create --size 1G client.0.1
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.1
+        - rbd --cluster cluster2 snap create client.0.1@snap
+        - rbd --cluster cluster2 create --size 1G client.0.2
+        - rbd --cluster cluster2 bench --io-type write --io-pattern rand --io-size 16K --io-threads 1 --io-total 2M client.0.2
+        - rbd --cluster cluster2 snap create client.0.2@snap
+        - ceph --cluster cluster2 auth caps client.0 mon 'profile rbd' mgr 'profile rbd-read-only' osd 'profile rbd-read-only'
+  - exec:
+      cluster1.client.0:
+        - |
+          set -ex
+          MON_HOST="$(ceph-conf --cluster cluster2 mon_host)"
+          KEY="$(ceph --cluster cluster2 auth get-key client.0)"
+          ceph --cluster cluster1 auth caps client.0 mon 'profile rbd' mgr 'profile rbd' osd 'profile rbd'
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"'"$KEY"'","client_name":"client.0","pool_name":"rbd","image_name":"client.0.0","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.0
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"'"$KEY"'","client_name":"client.0","pool_name":"rbd","image_name":"client.0.1","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.1
+          echo '{"type":"native","mon_host":"'"$MON_HOST"'","key":"'"$KEY"'","client_name":"client.0","pool_name":"rbd","image_name":"client.0.2","snap_name":"snap"}' | rbd --cluster cluster1 migration prepare --import-only --source-spec-path - client.0.2

From c7fddec189e8c6eac08820b73ce44dbd795a28ae Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Wed, 1 Jul 2026 13:17:40 +0200
Subject: [PATCH 494/596] doc/rbd: elaborate on key-ref syntax (existing in
 S3Stream and new in NativeFormat)

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 PendingReleaseNotes            |  6 ++++++
 doc/rbd/rbd-live-migration.rst | 28 ++++++++++++++++++++++------
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 4d43b8bf1c3..154b566effc 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -245,6 +245,12 @@
   state and a subsequent redundancy loss occurs. Used in conjunction with
   ``last_clean``, the ``last_degraded`` timestamp enables the calculation of
   data vulnerability and durability scores.
+* RBD: It's possible to specify source cluster's ``mon_host`` and ``key`` for
+  ``native`` format migration via the migration spec now.  This eliminates the
+  dependency on ``<cluster-name>.conf`` file in a known location which is
+  rather rigid and also challenging to disseminate in some environments.  The
+  key can be embedded in the migration spec or just referenced from there while
+  stored in the MON config-key store.
 
 >=20.0.0
 
diff --git a/doc/rbd/rbd-live-migration.rst b/doc/rbd/rbd-live-migration.rst
index a117bed3623..ba8bfd90fde 100644
--- a/doc/rbd/rbd-live-migration.rst
+++ b/doc/rbd/rbd-live-migration.rst
@@ -157,8 +157,15 @@ as follows::
 
         {
             "type": "native",
+            ["mon_host": "<mon-host>",] (specify if image in another cluster,
+                                         must be specified together with "key",
+                                         mutually exclusive with "cluster_name")
+            ["key": "<key or key-ref>",] (for connecting to another cluster,
+                                          must be specified together with "mon_host",
+                                          mutually exclusive with "cluster_name")
             ["cluster_name": "<cluster-name>",] (specify if image in another cluster,
-                                                 requires ``<cluster-name>.conf`` file)
+                                                 requires ``<cluster-name>.conf`` file,
+                                                 mutually exclusive with "mon_host" and "key")
             ["client_name": "<client-name>",] (for connecting to another cluster,
                                                default is ``client.admin``)
             "pool_name": "<pool-name>",
@@ -182,6 +189,14 @@ it utilizes native Ceph operations. For example, to import from the image
             "snap_name": "snap1"
         }
 
+.. note::
+  The ``key`` parameter supports storing the key in the MON config-key store
+  by utilizing ``config://`` prefix followed by the path in the MON config-key
+  store to the key (key reference). Values can be stored in the config-key store
+  via ``ceph config-key set <key-path> <value>`` (e.g.
+  ``ceph config-key set rbd/native/my_key AQAz7EVWygILFRAAdIcuJ12opU/JKyfFmxhuaw==``
+  and ``"key": "config://rbd/native/my_key"`` in ``source-spec``).
+
 The ``qcow`` format can be used to describe a QCOW (QEMU copy-on-write) block
 device. Both the QCOW (v1) and QCOW2 formats are currently supported with the
 exception of advanced features such as compression, encryption, backing
@@ -280,8 +295,8 @@ The ``s3`` stream can be used to import from a remote S3 bucket. Its
             "stream": {
                 "type": "s3",
                 "url": "<url-path>",
-                "access_key": "<access-key>",
-                "secret_key": "<secret-key>"
+                "access_key": "<access-key or access-key-ref>",
+                "secret_key": "<secret-key or secret-key-ref>"
             }
         }
 
@@ -301,10 +316,11 @@ as follows::
 
 .. note::
   The ``access_key`` and ``secret_key`` parameters support storing the keys in
-  the MON config-key store by prefixing the key values with ``config://``
-  followed by the path in the MON config-key store to the value. Values can be
+  the MON config-key store by utilizing ``config://`` prefix followed by the
+  path in the MON config-key store to the key (key reference). Values can be
   stored in the config-key store via ``ceph config-key set <key-path> <value>``
-  (e.g. ``ceph config-key set rbd/s3/access_key NX5QOQKC6BH2IDN8HC7A``).
+  (e.g. ``ceph config-key set rbd/s3/my_access_key NX5QOQKC6BH2IDN8HC7A`` and
+  ``"access_key": "config://rbd/s3/my_access_key"`` in ``source-spec``).
 
 The ``nbd`` stream can be used to import from a remote NBD export. Its
 ``source-spec`` JSON is encoded as follows::

From 64fe83f2f4ed8fa549e0af26d044494e9652b606 Mon Sep 17 00:00:00 2001
From: Samarah Uriarte <samarah.uriarte@ibm.com>
Date: Wed, 1 Jul 2026 14:26:25 -0500
Subject: [PATCH 495/596] rgw/posix: Implement SQLite lifecycle in POSIXUserDB

Signed-off-by: Samarah Uriarte <samarah.uriarte@ibm.com>
---
 src/rgw/driver/posix/posixDB.h        | 12 +++-
 src/rgw/driver/posix/rgw_sal_posix.cc | 82 ++++++++++++++++++++++++++-
 src/rgw/driver/posix/rgw_sal_posix.h  | 52 ++++++++++++++++-
 3 files changed, 140 insertions(+), 6 deletions(-)

diff --git a/src/rgw/driver/posix/posixDB.h b/src/rgw/driver/posix/posixDB.h
index 7aae32ce360..4c6f1a1df75 100644
--- a/src/rgw/driver/posix/posixDB.h
+++ b/src/rgw/driver/posix/posixDB.h
@@ -30,8 +30,6 @@ namespace rgw { namespace store {
 class POSIXUserDB;
 class POSIXAccountDB;
 
-struct POSIXAccountDBOpAccountInfo : DBOpAccountInfo {};
-
 struct POSIXUserDBOpUserInfo : DBOpUserInfo {};
 
 struct POSIXUserDBOpInfo : DBOpInfo {};
@@ -42,6 +40,8 @@ struct POSIXUserDBOpPrepareInfo : DBOpPrepareInfo {};
 
 struct POSIXUserDBOpPrepareParams : DBOpPrepareParams {};
 
+struct POSIXAccountDBOpAccountInfo : DBOpAccountInfo {};
+
 struct POSIXAccountDBOpInfo : DBOpInfo {};
 
 struct POSIXAccountDBOpPrepareInfo : DBOpPrepareInfo {};
@@ -151,6 +151,8 @@ class RemovePOSIXUserOp: public SQLRemoveUser {};
 class POSIXUserDB : public SQLiteDB {
   private:
     const std::string db_name;
+    const std::string lc_head_table;
+    const std::string lc_entry_table;
     rgw::sal::Driver* driver;
 
   protected:
@@ -166,6 +168,8 @@ class POSIXUserDB : public SQLiteDB {
 
     POSIXUserDB(std::string db_name, CephContext *_cct) : SQLiteDB(db_name, _cct),
 		db_name(db_name),
+		lc_head_table(db_name+"_lc_head_table"),
+		lc_entry_table(db_name+"_lc_entry_table"),
 		cct(_cct),
 		dp(_cct, ceph_subsys_rgw, "rgw POSIXUserDBStore backend: ")
                 { DB::set_context(cct); }
@@ -180,7 +184,9 @@ class POSIXUserDB : public SQLiteDB {
     virtual int InitPrepareParams(const DoutPrefixProvider *dpp,
                                   DBOpPrepareParams &p_params,
                                   DBOpParams* params) override { return 0; }
-    virtual int createLCTables(const DoutPrefixProvider *dpp) override { return 0; }
+    virtual int createLCTables(const DoutPrefixProvider *dpp) override { return SQLiteDB::createLCTables(dpp); }
+    const std::string getLCHeadTable() { return lc_head_table; }
+    const std::string getLCEntryTable() { return lc_entry_table; }
 
     virtual int ListAllBuckets(const DoutPrefixProvider *dpp, DBOpParams *params) override { return 0; }
     virtual int ListAllUsers(const DoutPrefixProvider *dpp, DBOpParams *params) override { return 0; }
diff --git a/src/rgw/driver/posix/rgw_sal_posix.cc b/src/rgw/driver/posix/rgw_sal_posix.cc
index 92710d01669..4530da7db33 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.cc
+++ b/src/rgw/driver/posix/rgw_sal_posix.cc
@@ -23,6 +23,7 @@
 #include "include/scope_guard.h"
 #include "common/Clock.h" // for ceph_clock_now()
 #include "common/errno.h"
+#include "rgw_lc.h"
 
 #define dout_subsys ceph_subsys_rgw
 #define dout_context g_ceph_context
@@ -1970,6 +1971,19 @@ int POSIXDriver::initialize(CephContext *cct, const DoutPrefixProvider *dpp)
       }
     }
   }
+
+  lc = new RGWLC();
+  lc->initialize(cct, this);
+
+  if (use_lc_thread) { 
+    ret = userDB->createLCTables(dpp);
+    if (ret < 0) {
+      ldpp_dout(dpp, 0) << "Failed to create LC tables, ret=" << ret << dendl;
+      return ret;
+    }
+    lc->start_processor();
+  }
+
   ldpp_dout(dpp, 20) << "root_fd: " << root_dir->get_fd() << dendl;
   quota_handler = RGWQuotaHandler::generate_handler(dpp, this, true);
 
@@ -2199,6 +2213,11 @@ int POSIXDriver::cluster_stat(RGWClusterStat& stats)
   return 0;
 }
 
+std::unique_ptr<Lifecycle> POSIXDriver::get_lifecycle(void)
+{
+  return std::make_unique<POSIXLifecycle>(this);
+}
+
 std::unique_ptr<Writer> POSIXDriver::get_append_writer(const DoutPrefixProvider *dpp,
 				  optional_yield y,
 				  rgw::sal::Object* _head_obj,
@@ -2941,9 +2960,18 @@ int POSIXBucket::write_attrs(const DoutPrefixProvider* dpp, optional_yield y)
   // Bucket info is stored as an attribute, but not in attrs[]
   bufferlist bl;
   encode(info, bl);
-  Attrs extra_attrs;
+  Attrs orig_attrs, extra_attrs;
   extra_attrs[RGW_POSIX_ATTR_BUCKET_INFO] = bl;
 
+  ret = dir->read_attrs(dpp, y, orig_attrs);
+
+  for (auto attr : orig_attrs) {
+    if (auto found = attrs.find(attr.first); found == attrs.end()) {
+      /* Attribute needs to be erased */
+      remove_x_attr(dpp, y, dir->get_fd(), attr.first, get_name());
+    }
+  }
+
   return dir->write_attrs(dpp, y, attrs, &extra_attrs);
 }
 
@@ -4626,6 +4654,58 @@ int POSIXAtomicWriter::complete(size_t accounted_size, const std::string& etag,
   return 0;
 }
 
+int POSIXLifecycle::get_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                              const std::string& oid, const std::string& marker,
+                              LCEntry& entry)
+{
+  return driver->get_user_db()->get_entry(oid, marker, entry);
+}
+
+int POSIXLifecycle::get_next_entry(const DoutPrefixProvider* dpp, optional_yield y,
+				   const std::string& oid, const std::string& marker,
+                                   LCEntry& entry)
+{
+  return driver->get_user_db()->get_next_entry(oid, marker, entry);
+}
+
+int POSIXLifecycle::set_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                              const std::string& oid, const LCEntry& entry)
+{
+  return driver->get_user_db()->set_entry(oid, entry);
+}
+
+int POSIXLifecycle::list_entries(const DoutPrefixProvider* dpp, optional_yield y,
+				const std::string& oid, const std::string& marker,
+                                uint32_t max_entries, std::vector<LCEntry>& entries)
+{
+  return driver->get_user_db()->list_entries(oid, marker, max_entries, entries);
+}
+
+int POSIXLifecycle::rm_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                             const std::string& oid, const LCEntry& entry)
+{
+  return driver->get_user_db()->rm_entry(oid, entry);
+}
+
+int POSIXLifecycle::get_head(const DoutPrefixProvider* dpp, optional_yield y,
+                             const std::string& oid, LCHead& head)
+{
+  return driver->get_user_db()->get_head(oid, head);
+}
+
+int POSIXLifecycle::put_head(const DoutPrefixProvider* dpp, optional_yield y,
+                             const std::string& oid, const LCHead& head)
+{
+  return driver->get_user_db()->put_head(oid, head);
+}
+
+std::unique_ptr<LCSerializer> POSIXLifecycle::get_serializer(const std::string& lock_name,
+                                                             const std::string& oid,
+                                                             const std::string& cookie)
+{
+  return std::make_unique<LCPOSIXSerializer>(driver, oid, lock_name, cookie);
+}
+
 } } // namespace rgw::sal
 
 extern "C" {
diff --git a/src/rgw/driver/posix/rgw_sal_posix.h b/src/rgw/driver/posix/rgw_sal_posix.h
index 7779991ee82..6abf0dcb72c 100644
--- a/src/rgw/driver/posix/rgw_sal_posix.h
+++ b/src/rgw/driver/posix/rgw_sal_posix.h
@@ -24,6 +24,8 @@
 #include "bucket_cache.h"
 #include "posixDB.h"
 
+class RGWLC;
+
 namespace rgw { namespace sal {
 
 class POSIXDriver;
@@ -484,6 +486,8 @@ protected:
   int root_fd;
   RGWSyncModuleInstanceRef sync_module;
   RGWQuotaHandler* quota_handler{nullptr};
+  RGWLC* lc{nullptr};
+  bool use_lc_thread;
 
 public:
   POSIXDriver(CephContext *_cct) : StoreDriver(), cct(_cct), zone(this)
@@ -502,6 +506,11 @@ public:
     cct = _cct;
   }
 
+  POSIXDriver& set_run_lc_thread(bool _use_lc_thread) {
+    use_lc_thread = _use_lc_thread;
+    return *this;
+  }
+
   virtual int initialize(CephContext *cct, const DoutPrefixProvider *dpp);
   virtual const std::string get_name() const override { return "posix"; }
   virtual std::string get_cluster_id(const DoutPrefixProvider* dpp,  optional_yield y) override { return "PLACEHOLDER"; };
@@ -654,7 +663,7 @@ public:
   virtual int get_zonegroup(const std::string& id, std::unique_ptr<ZoneGroup>* zonegroup) override;
   virtual int list_all_zones(const DoutPrefixProvider* dpp, std::list<std::string>& zone_ids) override;
   virtual int cluster_stat(RGWClusterStat& stats) override;
-  virtual std::unique_ptr<Lifecycle> get_lifecycle(void) override { return nullptr; } // TODO: implement
+  virtual std::unique_ptr<Lifecycle> get_lifecycle(void) override;
   virtual std::unique_ptr<Restore> get_restore(void) { return nullptr; }
   virtual bool process_expired_objects(const DoutPrefixProvider *dpp, optional_yield y) override { return 0; }
 
@@ -684,7 +693,7 @@ public:
 				      optional_yield y,
 				      const std::string& topic_queue) override { return -ENOTSUP; }
 
-  virtual RGWLC* get_rgwlc(void) override { return NULL; } // TODO: Lifecycle not currently supported
+  virtual RGWLC* get_rgwlc(void) override { return lc; }
   virtual rgw::restore::Restore* get_rgwrestore(void) { return nullptr; }
   virtual RGWCoroutinesManagerRegistry* get_cr_registry() override { return NULL; }
 
@@ -1434,4 +1443,43 @@ public:
   virtual int unlock(const DoutPrefixProvider* dpp, optional_yield y) override;
 };
 
+class LCPOSIXSerializer : public StoreLCSerializer {
+public:
+  LCPOSIXSerializer(POSIXDriver* driver, const std::string& oid, const std::string& lock_name, const std::string& cookie) {}
+
+  virtual int try_lock(const DoutPrefixProvider* dpp, ceph::timespan dur, optional_yield y) override { return 0; }
+  virtual int unlock(const DoutPrefixProvider* dpp, optional_yield y) override { return 0; }
+};
+
+class POSIXLifecycle : public Lifecycle {
+  POSIXDriver* driver;
+
+public:
+  POSIXLifecycle(POSIXDriver* _driver) : driver(_driver) {}
+  virtual ~POSIXLifecycle() = default;
+
+  virtual int get_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                        const std::string& oid, const std::string& marker,
+                        LCEntry& entry) override;
+  virtual int get_next_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                             const std::string& oid, const std::string& marker,
+                             LCEntry& entry) override;
+  virtual int set_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                        const std::string& oid, const LCEntry& entry) override;
+  virtual int list_entries(const DoutPrefixProvider* dpp, optional_yield y,
+                           const std::string& oid, const std::string& marker,
+                           uint32_t max_entries,
+                           std::vector<LCEntry>& entries) override;
+  virtual int rm_entry(const DoutPrefixProvider* dpp, optional_yield y,
+                       const std::string& oid, const LCEntry& entry) override;
+  virtual int get_head(const DoutPrefixProvider* dpp, optional_yield y,
+                       const std::string& oid, LCHead& head) override;
+  virtual int put_head(const DoutPrefixProvider* dpp, optional_yield y,
+                       const std::string& oid, const LCHead& head) override;
+
+  virtual std::unique_ptr<LCSerializer> get_serializer(const std::string& lock_name,
+                                                       const std::string& oid,
+                                                       const std::string& cookie) override;
+};
+
 } } // namespace rgw::sal

From eb595fbad587e4142e0270899e3cc215b2452dc4 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 1 Jul 2026 15:31:52 +0800
Subject: [PATCH 496/596] ceph.spec.in: drop RHEL <= 8 support

RHEL 8 and CentOS 8 left the supported test matrix in 2023 (449db416,
7a1dce1e). RHEL 8 has also been unbuildable since CMakeLists.txt began
requiring Python >= 3.9: it ships python 3.6 by default, so cmake refuses
to configure. The spec still carried the el8 conditionals, so assume
rhel >= 9 and drop them:

- remove branches reachable only on rhel <= 8: the gperftools 2.6.1
  BuildRequires, the tracker-36508 tcmalloc-libs requirement, and the
  dataclasses backport, which also targeted that dead python 3.6
- collapse "rhel >= 8" and "rhel >= 9" to plain "rhel"; with the floor at
  9 this is a no-op for rhel 9/10, fedora, suse and openEuler
- keep the rhel 9-vs-10 checks (== 9, < 10, >= 10)

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 45 ++++++++++++++-------------------------------
 1 file changed, 14 insertions(+), 31 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 7bb56a985a8..d8109ab1813 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -35,7 +35,7 @@
 %bcond_with rbd_rwl_cache
 %endif
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-%if (0%{?rhel} && 0%{?rhel} < 9) || 0%{?openEuler}
+%if 0%{?openEuler}
 %bcond_with system_pmdk
 %else
 %ifarch s390x aarch64
@@ -97,23 +97,21 @@
 %else
 %bcond_without jaeger
 %endif
-%if 0%{?fedora} || 0%{?suse_version} >= 1500 || 0%{?rhel} >= 9
+%if 0%{?fedora} || 0%{?suse_version} >= 1500 || 0%{?rhel}
 # distros that ship cmd2 and/or colorama
 %bcond_without cephfs_shell
 %else
 # distros that do _not_ ship cmd2/colorama
 %bcond_with cephfs_shell
 %endif
-%if 0%{?fedora} || 0%{?rhel} >= 9
+%if 0%{?fedora} || 0%{?rhel}
 %bcond_without system_arrow
 %else
-# for centos 8, utf8proc-devel comes from the subversion-devel module which isn't available in EPEL8
-# this is tracked in https://bugzilla.redhat.com/2152265
 %bcond_with system_arrow
 %endif
 # qat only supported for intel devices
 %ifarch x86_64
-%if 0%{?fedora} || 0%{?rhel} >= 9
+%if 0%{?fedora} || 0%{?rhel}
 %bcond_without system_qat
 %else
 # not fedora/rhel
@@ -123,7 +121,7 @@
 # not x86_64
 %bcond_with system_qat
 %endif
-%if 0%{?fedora} || 0%{?suse_version} || 0%{?rhel} >= 8 || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?suse_version} || 0%{?rhel} || 0%{?openEuler}
 %global weak_deps 1
 %endif
 %if %{with selinux}
@@ -275,12 +273,9 @@ BuildRequires:  libatomic
 %endif
 %if 0%{with tcmalloc}
 # libprofiler did not build on ppc64le until 2.7.90
-%if 0%{?fedora} || 0%{?rhel} >= 8 || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 BuildRequires:	gperftools-devel >= 2.7.90
 %endif
-%if 0%{?rhel} && 0%{?rhel} < 8
-BuildRequires:	gperftools-devel >= 2.6.1
-%endif
 %if 0%{?suse_version}
 BuildRequires:	gperftools-devel >= 2.4
 %endif
@@ -515,7 +510,7 @@ BuildRequires:  libcryptopp-devel
 BuildRequires:  libnuma-devel
 %endif
 %endif
-%if 0%{?rhel} >= 9
+%if 0%{?rhel}
 BuildRequires: python-rpm-macros
 %endif
 
@@ -547,13 +542,6 @@ Requires:      logrotate
 Requires:      psmisc
 Requires:      util-linux
 Requires:      which
-%if 0%{?rhel} && 0%{?rhel} < 8
-# The following is necessary due to tracker 36508 and can be removed once the
-# associated upstream bugs are resolved.
-%if 0%{with tcmalloc}
-Requires:      gperftools-libs >= 2.6.1
-%endif
-%endif
 %if 0%{?weak_deps}
 Recommends:    chrony
 Recommends:    nvme-cli
@@ -729,7 +717,7 @@ Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-smb = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-grafana-dashboards = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-prometheus-alerts = %{_epoch_prefix}%{version}-%{release}
-%if 0%{?fedora} || 0%{?rhel} >= 9
+%if 0%{?fedora} || 0%{?rhel}
 Requires:       python%{python3_pkgversion}-grpcio
 Requires:       python%{python3_pkgversion}-grpcio-tools
 Requires:       python%{python3_pkgversion}-jmespath
@@ -740,7 +728,7 @@ Requires:       python%{python3_pkgversion}-cherrypy
 Requires:       python%{python3_pkgversion}-routes
 %if 0%{?weak_deps}
 Recommends:     python%{python3_pkgversion}-saml
-%if 0%{?fedora} || (0%{?rhel} && 0%{?rhel} <= 8)
+%if 0%{?fedora}
 Recommends:     python%{python3_pkgversion}-grpcio
 Recommends:     python%{python3_pkgversion}-grpcio-tools
 %endif
@@ -782,17 +770,12 @@ Group:          System/Filesystems
 Requires:       python%{python3_pkgversion}-prettytable
 Requires:       python%{python3_pkgversion}-requests
 Requires:       python%{python3_pkgversion}-dateutil
-%if 0%{?fedora} || 0%{?rhel} >= 8 || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 Requires:       python%{python3_pkgversion}-pyyaml
 %endif
 %if 0%{?suse_version}
 Requires:       python%{python3_pkgversion}-PyYAML
 %endif
-# RHEL8 has python 3.6 and that lacks dataclasses in the stdlib, so pull in the
-# backport dataclasses module instead.
-%if 0%{?rhel} && 0%{?rhel} <= 8
-Requires:       python%{python3_pkgversion}-dataclasses
-%endif
 %if 0%{?weak_deps}
 Recommends:	ceph-mgr-rook = %{_epoch_prefix}%{version}-%{release}
 %endif
@@ -1041,7 +1024,7 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
-%if 0%{?fedora} || 0%{?rhel} >= 8 || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 Requires:       python%{python3_pkgversion}-cherrypy
 %endif
 %if 0%{?suse_version}
@@ -1602,7 +1585,7 @@ descriptions, and submitting the command to the appropriate daemon.
 
 %package -n python%{python3_pkgversion}-ceph-common
 Summary:	Python 3 utility libraries for Ceph
-%if 0%{?fedora} || 0%{?rhel} >= 8 || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 Requires:       python%{python3_pkgversion}-pyyaml
 %if %{with pypkg}
 Recommends:     python%{python3_pkgversion}-ceph-smb-ctl
@@ -1996,7 +1979,7 @@ install -m 0644 -D udev/50-rbd.rules %{buildroot}%{_udevrulesdir}/50-rbd.rules
 # sudoers.d
 install -m 0440 -D sudoers.d/ceph-smartctl %{buildroot}%{_sysconfdir}/sudoers.d/ceph-smartctl
 
-%if 0%{?rhel} >= 8 || 0%{?openEuler}
+%if 0%{?rhel} || 0%{?openEuler}
 # Undefine -P flag as it is only supported with python version >= 3.11
 %undefine _py3_shebang_P
 
@@ -2038,7 +2021,7 @@ install -m 644 -D -t %{buildroot}%{_datadir}/snmp/mibs monitoring/snmp/CEPH-MIB.
 %fdupes %{buildroot}%{_prefix}
 %endif
 
-%if 0%{?rhel} == 8 || 0%{?openEuler}
+%if 0%{?openEuler}
 %py_byte_compile %{__python3} %{buildroot}%{python3_sitelib}
 %endif
 

From 8664e52d4b2f0b2245fc6f18403817dfe652f4f2 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 1 Jul 2026 16:26:43 +0800
Subject: [PATCH 497/596] ceph.spec.in: use pkgconfig() for library
 BuildRequires

Library BuildRequires used per-distro -devel package names, some split
across %if suse / %if rhel branches only because the names differ. The
pkgconfig() virtual provides resolve identically on every rpm distro; the
spec already relies on them for fuse3, systemd and udev.

Switch every library dependency that ships a .pc to pkgconfig(), preserving
version constraints and feature guards. This collapses the suse-vs-rhel
naming splits (nss, keyutils, openssl, ldap, ibverbs, rdmacm, lz4, thrift,
libcryptopp) and the dedicated split blocks (nlohmann_json, lttng-ust,
babeltrace, expat) into single lines, and folds the duplicated xmlsec1 devel
packages together.

Left as package names: libaio and xfsprogs ship no reliable .pc; gperftools
carries version and tcmalloc-variant logic; numa is unconditional on rhel
but crimson-only on suse; and the xmlsec1 runtime backend plugins are
runtime test deps, not build-time pkgconfig() deps.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 146 +++++++++++++++++++++------------------------------
 1 file changed, 59 insertions(+), 87 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index d8109ab1813..238103b621e 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -254,7 +254,7 @@ BuildRequires:	gperf
 BuildRequires:  cmake > 3.5
 BuildRequires:	pkgconfig(fuse3)
 BuildRequires:	git
-BuildRequires:	grpc-devel
+BuildRequires:	pkgconfig(grpc++)
 # Before 13.3, an lto bug resulted in a segfault in SafeTimer and perhaps
 # elsewhere. Require the fixed version so we can reenable lto. See
 # ceph bug https://tracker.ceph.com/issues/63867
@@ -281,21 +281,28 @@ BuildRequires:	gperftools-devel >= 2.4
 %endif
 %endif
 BuildRequires:	libaio-devel
-BuildRequires:	libblkid-devel >= 2.17
-BuildRequires:	cryptsetup-devel
-BuildRequires:	libnbd-devel
-BuildRequires:	libcurl-devel
-BuildRequires:	libcap-devel
-BuildRequires:	libcap-ng-devel
-BuildRequires:	fmt-devel >= 6.2.1
+BuildRequires:	pkgconfig(blkid) >= 2.17
+BuildRequires:	pkgconfig(libcryptsetup)
+BuildRequires:	pkgconfig(libnbd)
+BuildRequires:	pkgconfig(libcurl)
+BuildRequires:	pkgconfig(libcap)
+BuildRequires:	pkgconfig(libcap-ng)
+BuildRequires:	pkgconfig(fmt) >= 6.2.1
 BuildRequires:	pkgconfig(libudev)
-BuildRequires:	libnl3-devel
-BuildRequires:	liboath-devel
+BuildRequires:	pkgconfig(nss)
+BuildRequires:	pkgconfig(libkeyutils)
+BuildRequires:	pkgconfig(openssl)
+BuildRequires:	pkgconfig(ldap)
+BuildRequires:	pkgconfig(libibverbs)
+BuildRequires:	pkgconfig(librdmacm)
+BuildRequires:	pkgconfig(liblz4) >= 1.7
+BuildRequires:	pkgconfig(libnl-3.0)
+BuildRequires:	pkgconfig(liboath)
 BuildRequires:	libtool
-BuildRequires:	libxml2-devel
+BuildRequires:	pkgconfig(libxml-2.0)
 BuildRequires:	make
-BuildRequires:	ncurses-devel
-BuildRequires:	libicu-devel
+BuildRequires:	pkgconfig(ncurses)
+BuildRequires:	pkgconfig(icu-uc)
 BuildRequires:	patch
 BuildRequires:	perl
 BuildRequires:	pkgconfig
@@ -306,25 +313,25 @@ BuildRequires:	python%{python3_pkgversion}-setuptools
 BuildRequires:	python%{python3_pkgversion}-Cython
 BuildRequires:	python%{python3_pkgversion}-pip
 BuildRequires:	python%{python3_pkgversion}-wheel
-BuildRequires:	snappy-devel
-BuildRequires:	sqlite-devel
+BuildRequires:	pkgconfig(snappy)
+BuildRequires:	pkgconfig(sqlite3)
 BuildRequires:	sudo
 BuildRequires:	pkgconfig(udev)
-BuildRequires:	valgrind-devel
+BuildRequires:	pkgconfig(valgrind)
 BuildRequires:	which
 BuildRequires:	xfsprogs-devel
 BuildRequires:	xmlstarlet
 BuildRequires:	nasm
-BuildRequires:	lua-devel
-BuildRequires:  lmdb-devel
+BuildRequires:	pkgconfig(lua)
+BuildRequires:  pkgconfig(lmdb)
 %if 0%{with crimson} || 0%{with jaeger}
-BuildRequires:  yaml-cpp-devel >= 0.6
+BuildRequires:  pkgconfig(yaml-cpp) >= 0.6
 %endif
 %if 0%{with amqp_endpoint}
-BuildRequires:  librabbitmq-devel
+BuildRequires:  pkgconfig(librabbitmq)
 %endif
 %if 0%{with kafka_endpoint}
-BuildRequires:  librdkafka-devel >= 1.1.0
+BuildRequires:  pkgconfig(rdkafka) >= 1.1.0
 %endif
 %if 0%{with lua_packages}
 Requires:  lua-devel
@@ -333,7 +340,7 @@ Requires:  %{luarocks_package_name}
 %if 0%{with make_check}
 BuildRequires:  hostname
 BuildRequires:  jq
-BuildRequires:	libuuid-devel
+BuildRequires:	pkgconfig(uuid)
 BuildRequires:	python%{python3_pkgversion}-bcrypt
 BuildRequires:	python%{python3_pkgversion}-requests
 BuildRequires:	python%{python3_pkgversion}-dateutil
@@ -343,53 +350,44 @@ BuildRequires:	socat
 BuildRequires:	python%{python3_pkgversion}-asyncssh
 BuildRequires:	python%{python3_pkgversion}-natsort
 %endif
-%if 0%{?suse_version}
-BuildRequires:  libthrift-devel >= 0.13.0
-%else
-BuildRequires:  thrift-devel >= 0.13.0
-%endif
-BuildRequires:  re2-devel
+BuildRequires:	pkgconfig(thrift) >= 0.13.0
+BuildRequires:  pkgconfig(re2)
 %if 0%{with jaeger}
 BuildRequires:  bison
 BuildRequires:  flex
-%if 0%{?fedora} || 0%{?rhel}
-BuildRequires:  json-devel
-%endif
-%if 0%{?suse_version}
-BuildRequires:  nlohmann_json-devel
-%endif
-BuildRequires:  libevent-devel
+BuildRequires:	pkgconfig(nlohmann_json)
+BuildRequires:  pkgconfig(libevent)
 %endif
 %if 0%{with system_pmdk}
 %if 0%{?suse_version}
-BuildRequires:  libndctl-devel >= 63
+BuildRequires:  pkgconfig(libndctl) >= 63
 %else
-BuildRequires:  ndctl-devel >= 63
-BuildRequires:  daxctl-devel >= 63
+BuildRequires:  pkgconfig(libndctl) >= 63
+BuildRequires:  pkgconfig(libdaxctl) >= 63
 %endif
-BuildRequires:  libpmem-devel
-BuildRequires:  libpmemobj-devel >= 1.8
+BuildRequires:  pkgconfig(libpmem)
+BuildRequires:  pkgconfig(libpmemobj) >= 1.8
 %endif
 %if 0%{with system_arrow}
-BuildRequires:  libarrow-devel
-BuildRequires:  parquet-libs-devel
-BuildRequires:  utf8proc-devel
+BuildRequires:  pkgconfig(arrow)
+BuildRequires:  pkgconfig(parquet)
+BuildRequires:  pkgconfig(libutf8proc)
 %endif
 %if 0%{with system_qat}
-BuildRequires:  qatlib-devel
-BuildRequires:  qatzip-devel
+BuildRequires:  pkgconfig(qatlib)
+BuildRequires:  pkgconfig(qatzip)
 %endif
 %if 0%{with crimson}
-BuildRequires:  c-ares-devel
-BuildRequires:  gnutls-devel
-BuildRequires:  hwloc-devel
-BuildRequires:  libpciaccess-devel
-BuildRequires:  lksctp-tools-devel
+BuildRequires:  pkgconfig(libcares)
+BuildRequires:  pkgconfig(gnutls)
+BuildRequires:  pkgconfig(hwloc)
+BuildRequires:  pkgconfig(pciaccess)
+BuildRequires:  pkgconfig(libsctp)
 BuildRequires:  ragel
 BuildRequires:  systemtap-sdt-devel
 BuildRequires:  libubsan
 BuildRequires:  libasan
-BuildRequires:  protobuf-devel
+BuildRequires:  pkgconfig(protobuf)
 BuildRequires:  protobuf-compiler
 %if 0%{?gts_version} > 0
 BuildRequires:  gcc-toolset-%{gts_version}-gcc-plugin-annobin
@@ -408,20 +406,14 @@ PreReq:		%fillup_prereq
 BuildRequires:	fdupes
 BuildRequires:  memory-constraints
 BuildRequires:	net-tools
-BuildRequires:	libbz2-devel
-BuildRequires:	mozilla-nss-devel
-BuildRequires:	keyutils-devel
-BuildRequires:  libopenssl-devel
+BuildRequires:	pkgconfig(bzip2)
 BuildRequires:  ninja
-BuildRequires:  openldap2-devel
 #BuildRequires:  krb5
 #BuildRequires:  krb5-devel
 BuildRequires:  cunit-devel
 BuildRequires:	python%{python3_pkgversion}-PrettyTable
 BuildRequires:	python%{python3_pkgversion}-PyYAML
 BuildRequires:	python%{python3_pkgversion}-Sphinx
-BuildRequires:  rdma-core-devel
-BuildRequires:	liblz4-devel >= 1.7
 # for prometheus-alerts
 BuildRequires:  golang-github-prometheus-prometheus
 BuildRequires:	jsonnet
@@ -429,36 +421,29 @@ BuildRequires:	jsonnet
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 Requires:	systemd
 BuildRequires:  boost-random
-BuildRequires:	nss-devel
-BuildRequires:	keyutils-libs-devel
 BuildRequires:  libatomic
-BuildRequires:	libibverbs-devel
-BuildRequires:  librdmacm-devel
 BuildRequires:  ninja-build
-BuildRequires:  openldap-devel
 BuildRequires:  numactl-devel
 #BuildRequires:  krb5-devel
-BuildRequires:  openssl-devel
 BuildRequires:  CUnit-devel
 BuildRequires:	python%{python3_pkgversion}-devel
 BuildRequires:	python%{python3_pkgversion}-prettytable
 BuildRequires:	python%{python3_pkgversion}-pyyaml
 BuildRequires:	python%{python3_pkgversion}-sphinx
-BuildRequires:	lz4-devel >= 1.7
 %endif
 # distro-conditional make check dependencies
 %if 0%{with make_check}
 BuildRequires:	golang
+BuildRequires:	pkgconfig(xmlsec1)
+BuildRequires:	pkgconfig(xmlsec1-openssl)
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 BuildRequires:	/usr/bin/promtool
 BuildRequires:	libtool-ltdl-devel
 BuildRequires:	xmlsec1
-BuildRequires:	xmlsec1-devel
 %ifarch x86_64
 BuildRequires:	xmlsec1-nss
 %endif
 BuildRequires:	xmlsec1-openssl
-BuildRequires:	xmlsec1-openssl-devel
 BuildRequires:	python%{python3_pkgversion}-cherrypy
 BuildRequires:	python%{python3_pkgversion}-routes
 BuildRequires:	python%{python3_pkgversion}-scipy
@@ -473,27 +458,14 @@ BuildRequires:	libxmlsec1-openssl1
 BuildRequires:	python%{python3_pkgversion}-CherryPy
 BuildRequires:	python%{python3_pkgversion}-Routes
 BuildRequires:	python%{python3_pkgversion}-numpy-devel
-BuildRequires:	xmlsec1-devel
-BuildRequires:	xmlsec1-openssl-devel
 %endif
 %endif
 # lttng and babeltrace for rbd-replay-prep
 %if %{with lttng}
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-BuildRequires:	lttng-ust-devel
-BuildRequires:	libbabeltrace-devel
-%endif
-%if 0%{?suse_version}
-BuildRequires:	lttng-ust-devel
-BuildRequires:  babeltrace-devel
-%endif
-%endif
-%if 0%{?suse_version}
-BuildRequires:	libexpat-devel
-%endif
-%if 0%{?rhel} || 0%{?fedora} || 0%{?openEuler}
-BuildRequires:	expat-devel
+BuildRequires:	pkgconfig(lttng-ust)
+BuildRequires:	pkgconfig(babeltrace)
 %endif
+BuildRequires:	pkgconfig(expat)
 #hardened-cc1
 %if 0%{?fedora} || 0%{?rhel}
 BuildRequires:  redhat-rpm-config
@@ -502,11 +474,11 @@ BuildRequires:  redhat-rpm-config
 BuildRequires:  openEuler-rpm-config
 %endif
 %if 0%{with crimson}
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-BuildRequires:  cryptopp-devel
-%endif
+# EPEL9's cryptopp-devel ships its pkgconfig file as cryptopp.pc (providing
+# pkgconfig(cryptopp)), while el10 and SUSE's cryptopp/libcryptopp-devel
+# provide pkgconfig(libcryptopp); accept either.
+BuildRequires:  (pkgconfig(libcryptopp) or pkgconfig(cryptopp))
 %if 0%{?suse_version}
-BuildRequires:  libcryptopp-devel
 BuildRequires:  libnuma-devel
 %endif
 %endif

From e125c4746696b4bf432f0f00ee6d3e698b1c451b Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 1 Jul 2026 17:35:05 +0800
Subject: [PATCH 498/596] ceph.spec.in: use python3dist() for Python
 BuildRequires

Many Python deps were split across %if suse / %if rhel branches only
because openSUSE spells them CamelCase (PrettyTable, PyYAML, Sphinx,
CherryPy, Routes, Jinja2) and fedora/rhel/openEuler lowercase. The
python3dist() provides resolve the same on el9, el10, openEuler and
openSUSE, so those splits collapse to single lines.

Spell the deps python%{python3_pkgversion}dist(), matching the spec's
existing python%{python3_pkgversion}-Foo convention. Version constraints
and feature guards are preserved.

The dist name is the PyPI project name, not always the rpm name minus
python3-: python3-dateutil provides python3dist(python-dateutil), and
python3-saml provides python3dist(python3-saml).

Left as package names: the bare interpreter; python3-devel and numpy-devel,
which have no python3dist() provide; the build toolchain (setuptools,
Cython, pip, wheel); and the ceph-internal python3-* subpackages, which are
versioned = release deps.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 149 ++++++++++++++++++---------------------------------
 1 file changed, 52 insertions(+), 97 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 238103b621e..9043abff8a8 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -341,14 +341,14 @@ Requires:  %{luarocks_package_name}
 BuildRequires:  hostname
 BuildRequires:  jq
 BuildRequires:	pkgconfig(uuid)
-BuildRequires:	python%{python3_pkgversion}-bcrypt
-BuildRequires:	python%{python3_pkgversion}-requests
-BuildRequires:	python%{python3_pkgversion}-dateutil
-BuildRequires:	python%{python3_pkgversion}-coverage
-BuildRequires:	python%{python3_pkgversion}-pyOpenSSL
+BuildRequires:	python%{python3_pkgversion}dist(bcrypt)
+BuildRequires:	python%{python3_pkgversion}dist(requests)
+BuildRequires:	python%{python3_pkgversion}dist(python-dateutil)
+BuildRequires:	python%{python3_pkgversion}dist(coverage)
+BuildRequires:	python%{python3_pkgversion}dist(pyopenssl)
 BuildRequires:	socat
-BuildRequires:	python%{python3_pkgversion}-asyncssh
-BuildRequires:	python%{python3_pkgversion}-natsort
+BuildRequires:	python%{python3_pkgversion}dist(asyncssh)
+BuildRequires:	python%{python3_pkgversion}dist(natsort)
 %endif
 BuildRequires:	pkgconfig(thrift) >= 0.13.0
 BuildRequires:  pkgconfig(re2)
@@ -395,6 +395,9 @@ BuildRequires:  gcc-toolset-%{gts_version}-libubsan-devel
 BuildRequires:  gcc-toolset-%{gts_version}-libasan-devel
 %endif
 %endif
+BuildRequires:	python%{python3_pkgversion}dist(prettytable)
+BuildRequires:	python%{python3_pkgversion}dist(pyyaml)
+BuildRequires:	python%{python3_pkgversion}dist(sphinx)
 #################################################################################
 # distro-conditional dependencies
 #################################################################################
@@ -411,9 +414,6 @@ BuildRequires:  ninja
 #BuildRequires:  krb5
 #BuildRequires:  krb5-devel
 BuildRequires:  cunit-devel
-BuildRequires:	python%{python3_pkgversion}-PrettyTable
-BuildRequires:	python%{python3_pkgversion}-PyYAML
-BuildRequires:	python%{python3_pkgversion}-Sphinx
 # for prometheus-alerts
 BuildRequires:  golang-github-prometheus-prometheus
 BuildRequires:	jsonnet
@@ -427,15 +427,14 @@ BuildRequires:  numactl-devel
 #BuildRequires:  krb5-devel
 BuildRequires:  CUnit-devel
 BuildRequires:	python%{python3_pkgversion}-devel
-BuildRequires:	python%{python3_pkgversion}-prettytable
-BuildRequires:	python%{python3_pkgversion}-pyyaml
-BuildRequires:	python%{python3_pkgversion}-sphinx
 %endif
 # distro-conditional make check dependencies
 %if 0%{with make_check}
 BuildRequires:	golang
 BuildRequires:	pkgconfig(xmlsec1)
 BuildRequires:	pkgconfig(xmlsec1-openssl)
+BuildRequires:	python%{python3_pkgversion}dist(cherrypy)
+BuildRequires:	python%{python3_pkgversion}dist(routes)
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 BuildRequires:	/usr/bin/promtool
 BuildRequires:	libtool-ltdl-devel
@@ -444,10 +443,8 @@ BuildRequires:	xmlsec1
 BuildRequires:	xmlsec1-nss
 %endif
 BuildRequires:	xmlsec1-openssl
-BuildRequires:	python%{python3_pkgversion}-cherrypy
-BuildRequires:	python%{python3_pkgversion}-routes
-BuildRequires:	python%{python3_pkgversion}-scipy
-BuildRequires:	python%{python3_pkgversion}-pyOpenSSL
+BuildRequires:	python%{python3_pkgversion}dist(scipy)
+BuildRequires:	python%{python3_pkgversion}dist(pyopenssl)
 %endif
 BuildRequires:	jsonnet
 %if 0%{?suse_version}
@@ -455,8 +452,6 @@ BuildRequires:	golang-github-prometheus-prometheus
 BuildRequires:	libxmlsec1-1
 BuildRequires:	libxmlsec1-nss1
 BuildRequires:	libxmlsec1-openssl1
-BuildRequires:	python%{python3_pkgversion}-CherryPy
-BuildRequires:	python%{python3_pkgversion}-Routes
 BuildRequires:	python%{python3_pkgversion}-numpy-devel
 %endif
 %endif
@@ -546,27 +541,14 @@ Recommends:     podman >= 2.0.2
 %if 0%{with cephadm_bundling}
 %if 0%{without cephadm_pip_deps}
 # Zipapp built from system RPMs at build time; bundled zipapp is self-contained at runtime.
-# SUSE and RHEL/Fedora use different PyPI RPM names (Jinja2/PyYAML vs jinja2/pyyaml).
-%if 0%{?suse_version}
-BuildRequires: python%{python3_pkgversion}-Jinja2 >= 2.10
-BuildRequires: python%{python3_pkgversion}-PyYAML
-%else
-BuildRequires: python%{python3_pkgversion}-jinja2 >= 2.10
-BuildRequires: python%{python3_pkgversion}-pyyaml
-%endif
-%dnl suse/else: rpm bundle, distinct RPM names only (not duplicate stanzas)
+BuildRequires: python%{python3_pkgversion}dist(jinja2) >= 2.10
+BuildRequires: python%{python3_pkgversion}dist(pyyaml)
 %endif
 %dnl end without cephadm_pip_deps (CEPHADM_BUNDLED_DEPENDENCIES=rpm)
 %else
 # Unbundled cephadm: host must provide yaml and jinja2 at runtime.
-%if 0%{?suse_version}
-Requires: python%{python3_pkgversion}-Jinja2 >= 2.10
-Requires: python%{python3_pkgversion}-PyYAML
-%else
-Requires: python%{python3_pkgversion}-jinja2 >= 2.10
-Requires: python%{python3_pkgversion}-pyyaml
-%endif
-%dnl suse/else: unbundled cephadm (CEPHADM_BUNDLED_DEPENDENCIES=none)
+Requires: python%{python3_pkgversion}dist(jinja2) >= 2.10
+Requires: python%{python3_pkgversion}dist(pyyaml)
 %endif
 %dnl end with cephadm_bundling
 %description -n cephadm
@@ -587,12 +569,7 @@ Requires:	python%{python3_pkgversion}-cephfs = %{_epoch_prefix}%{version}-%{rele
 Requires:	python%{python3_pkgversion}-rgw = %{_epoch_prefix}%{version}-%{release}
 Requires:	python%{python3_pkgversion}-ceph-argparse = %{_epoch_prefix}%{version}-%{release}
 Requires:	python%{python3_pkgversion}-ceph-common = %{_epoch_prefix}%{version}-%{release}
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-Requires:	python%{python3_pkgversion}-prettytable
-%endif
-%if 0%{?suse_version}
-Requires:	python%{python3_pkgversion}-PrettyTable
-%endif
+Requires:	python%{python3_pkgversion}dist(prettytable)
 %if 0%{with libradosstriper}
 Requires:	libradosstriper1 = %{_epoch_prefix}%{version}-%{release}
 %endif
@@ -690,27 +667,20 @@ Requires:       ceph-mgr-smb = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-grafana-dashboards = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-prometheus-alerts = %{_epoch_prefix}%{version}-%{release}
 %if 0%{?fedora} || 0%{?rhel}
-Requires:       python%{python3_pkgversion}-grpcio
-Requires:       python%{python3_pkgversion}-grpcio-tools
-Requires:       python%{python3_pkgversion}-jmespath
-Requires:       python%{python3_pkgversion}-xmltodict
+Requires:       python%{python3_pkgversion}dist(grpcio)
+Requires:       python%{python3_pkgversion}dist(grpcio-tools)
+Requires:       python%{python3_pkgversion}dist(jmespath)
+Requires:       python%{python3_pkgversion}dist(xmltodict)
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-Requires:       python%{python3_pkgversion}-cherrypy
-Requires:       python%{python3_pkgversion}-routes
+Requires:       python%{python3_pkgversion}dist(cherrypy)
+Requires:       python%{python3_pkgversion}dist(routes)
 %if 0%{?weak_deps}
-Recommends:     python%{python3_pkgversion}-saml
+Recommends:     python%{python3_pkgversion}dist(python3-saml)
 %if 0%{?fedora}
-Recommends:     python%{python3_pkgversion}-grpcio
-Recommends:     python%{python3_pkgversion}-grpcio-tools
+Recommends:     python%{python3_pkgversion}dist(grpcio)
+Recommends:     python%{python3_pkgversion}dist(grpcio-tools)
 %endif
 %endif
-%endif
-%if 0%{?suse_version}
-Requires:       python%{python3_pkgversion}-CherryPy
-Requires:       python%{python3_pkgversion}-Routes
-Recommends:     python%{python3_pkgversion}-python3-saml
-%endif
 %description mgr-dashboard
 ceph-mgr-dashboard is a manager module, providing a web-based application
 to monitor and manage many aspects of a Ceph cluster and related components.
@@ -724,11 +694,11 @@ BuildArch:      noarch
 Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}-numpy
+Requires:       python%{python3_pkgversion}dist(numpy)
 %if 0%{?fedora} || 0%{?suse_version} || 0%{?openEuler}
-Requires:       python%{python3_pkgversion}-scikit-learn
+Requires:       python%{python3_pkgversion}dist(scikit-learn)
 %endif
-Requires:       python3-scipy
+Requires:       python%{python3_pkgversion}dist(scipy)
 %description mgr-diskprediction-local
 ceph-mgr-diskprediction-local is a ceph-mgr module that tries to predict
 disk failures using local algorithms and machine-learning databases.
@@ -739,15 +709,10 @@ BuildArch:      noarch
 %if 0%{?suse_version}
 Group:          System/Filesystems
 %endif
-Requires:       python%{python3_pkgversion}-prettytable
-Requires:       python%{python3_pkgversion}-requests
-Requires:       python%{python3_pkgversion}-dateutil
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-Requires:       python%{python3_pkgversion}-pyyaml
-%endif
-%if 0%{?suse_version}
-Requires:       python%{python3_pkgversion}-PyYAML
-%endif
+Requires:       python%{python3_pkgversion}dist(prettytable)
+Requires:       python%{python3_pkgversion}dist(requests)
+Requires:       python%{python3_pkgversion}dist(python-dateutil)
+Requires:       python%{python3_pkgversion}dist(pyyaml)
 %if 0%{?weak_deps}
 Recommends:	ceph-mgr-rook = %{_epoch_prefix}%{version}-%{release}
 %endif
@@ -795,8 +760,8 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-nfs = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}-kubernetes
-Requires:       python%{python3_pkgversion}-jsonpatch
+Requires:       python%{python3_pkgversion}dist(kubernetes)
+Requires:       python%{python3_pkgversion}dist(jsonpatch)
 %description mgr-rook
 ceph-mgr-rook is a ceph-mgr module for orchestration functions using
 a Rook backend.
@@ -808,7 +773,7 @@ Summary:        Ceph Manager module to orchestrate ceph-events to kubernetes' ev
 Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}-kubernetes
+Requires:       python%{python3_pkgversion}dist(kubernetes)
 %description mgr-k8sevents
 ceph-mgr-k8sevents is a ceph-mgr module that sends every ceph-events
 to kubernetes' events API
@@ -822,20 +787,18 @@ Group:          System/Filesystems
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-nfs = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-smb = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}-asyncssh
-Requires:       python%{python3_pkgversion}-bcrypt
-Requires:       python%{python3_pkgversion}-natsort
-Requires:       python%{python3_pkgversion}-pyOpenSSL
+Requires:       python%{python3_pkgversion}dist(asyncssh)
+Requires:       python%{python3_pkgversion}dist(bcrypt)
+Requires:       python%{python3_pkgversion}dist(natsort)
+Requires:       python%{python3_pkgversion}dist(pyopenssl)
 Requires:       cephadm = %{_epoch_prefix}%{version}-%{release}
+Requires:       python%{python3_pkgversion}dist(cherrypy)
+Requires:       python%{python3_pkgversion}dist(jinja2)
 %if 0%{?suse_version}
 Requires:       openssh
-Requires:       python%{python3_pkgversion}-CherryPy
-Requires:       python%{python3_pkgversion}-Jinja2
 %endif
 %if 0%{?rhel} || 0%{?fedora} || 0%{?openEuler}
 Requires:       openssh-clients
-Requires:       python%{python3_pkgversion}-cherrypy
-Requires:       python%{python3_pkgversion}-jinja2
 %endif
 %description mgr-cephadm
 ceph-mgr-cephadm is a ceph-mgr module for orchestration functions using
@@ -872,7 +835,7 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 %if 0%{?weak_deps}
-Recommends:     python%{python3_pkgversion}-influxdb
+Recommends:     python%{python3_pkgversion}dist(influxdb)
 %endif
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
 %description mgr-influx
@@ -970,7 +933,7 @@ Summary:        Ceph Manager module for OSD performance counter queries
 Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}-prettytable
+Requires:       python%{python3_pkgversion}dist(prettytable)
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
 %description mgr-osd-perf-query
 ceph-mgr-osd-perf-query is a ceph-mgr module that exposes OSD
@@ -996,12 +959,7 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-Requires:       python%{python3_pkgversion}-cherrypy
-%endif
-%if 0%{?suse_version}
-Requires:       python%{python3_pkgversion}-CherryPy
-%endif
+Requires:       python%{python3_pkgversion}dist(cherrypy)
 %description mgr-prometheus
 ceph-mgr-prometheus is a ceph-mgr module that exposes cluster metrics
 in Prometheus exposition format.
@@ -1557,16 +1515,13 @@ descriptions, and submitting the command to the appropriate daemon.
 
 %package -n python%{python3_pkgversion}-ceph-common
 Summary:	Python 3 utility libraries for Ceph
+Requires:       python%{python3_pkgversion}dist(pyyaml)
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-Requires:       python%{python3_pkgversion}-pyyaml
 %if %{with pypkg}
 Recommends:     python%{python3_pkgversion}-ceph-smb-ctl
 %endif
 %endif
 %if 0%{?suse_version}
-Requires:       python%{python3_pkgversion}-PyYAML
-%endif
-%if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
 %{?python_provide:%python_provide python%{python3_pkgversion}-ceph-common}
@@ -1577,8 +1532,8 @@ It also contains utilities used for the cephadm orchestrator.
 %if 0%{with cephfs_shell}
 %package -n cephfs-shell
 Summary:    Interactive shell for Ceph file system
-Requires:   python%{python3_pkgversion}-cmd2
-Requires:   python%{python3_pkgversion}-colorama
+Requires:   python%{python3_pkgversion}dist(cmd2)
+Requires:   python%{python3_pkgversion}dist(colorama)
 Requires:   python%{python3_pkgversion}-cephfs
 %description -n cephfs-shell
 This package contains an interactive tool that allows accessing a Ceph
@@ -1716,8 +1671,8 @@ BuildArch:      noarch
 Group:          System/Filesystems
 %endif
 Requires:       python%{python3_pkgversion}-ceph-common = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}-grpcio
-Requires:       python%{python3_pkgversion}-grpcio-reflection
+Requires:       python%{python3_pkgversion}dist(grpcio)
+Requires:       python%{python3_pkgversion}dist(grpcio-reflection)
 %description -n python%{python3_pkgversion}-ceph-smb-ctl
 This package provides a tool to interact with Ceph's SMB Service Remote-Control
 gRPC API as a client.

From 8a336b6718b23fb7da6c5a94544f9d90e3f1518d Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Wed, 1 Jul 2026 18:22:21 +0800
Subject: [PATCH 499/596] ceph.spec.in: drop the python3_pkgversion macro

python3_pkgversion picked the native python3 package name on RHEL7, where
python3 was python34/python36 before 7.6 (cea9d18c). RHEL7 and RHEL8 are
gone, so on every supported distro (el9, el10, fedora, suse, openEuler) it
is always 3.

Replace python%{python3_pkgversion} with python3 and drop the fallback
default. No supported distro overrides it to build against a non-default
python flavor, so that capability goes too.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ceph.spec.in | 215 +++++++++++++++++++++++++--------------------------
 1 file changed, 107 insertions(+), 108 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 9043abff8a8..10ccf569956 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -150,7 +150,6 @@
 
 %{!?_udevrulesdir: %global _udevrulesdir /lib/udev/rules.d}
 %{!?tmpfiles_create: %global tmpfiles_create systemd-tmpfiles --create}
-%{!?python3_pkgversion: %global python3_pkgversion 3}
 %{!?python3_version_nodots: %global python3_version_nodots 3}
 %{!?python3_version: %global python3_version 3}
 %global c_ares_min_version 1.28.0
@@ -307,12 +306,12 @@ BuildRequires:	patch
 BuildRequires:	perl
 BuildRequires:	pkgconfig
 BuildRequires:  procps
-BuildRequires:	python%{python3_pkgversion}
-BuildRequires:	python%{python3_pkgversion}-devel
-BuildRequires:	python%{python3_pkgversion}-setuptools
-BuildRequires:	python%{python3_pkgversion}-Cython
-BuildRequires:	python%{python3_pkgversion}-pip
-BuildRequires:	python%{python3_pkgversion}-wheel
+BuildRequires:	python3
+BuildRequires:	python3-devel
+BuildRequires:	python3-setuptools
+BuildRequires:	python3-Cython
+BuildRequires:	python3-pip
+BuildRequires:	python3-wheel
 BuildRequires:	pkgconfig(snappy)
 BuildRequires:	pkgconfig(sqlite3)
 BuildRequires:	sudo
@@ -341,14 +340,14 @@ Requires:  %{luarocks_package_name}
 BuildRequires:  hostname
 BuildRequires:  jq
 BuildRequires:	pkgconfig(uuid)
-BuildRequires:	python%{python3_pkgversion}dist(bcrypt)
-BuildRequires:	python%{python3_pkgversion}dist(requests)
-BuildRequires:	python%{python3_pkgversion}dist(python-dateutil)
-BuildRequires:	python%{python3_pkgversion}dist(coverage)
-BuildRequires:	python%{python3_pkgversion}dist(pyopenssl)
+BuildRequires:	python3dist(bcrypt)
+BuildRequires:	python3dist(requests)
+BuildRequires:	python3dist(python-dateutil)
+BuildRequires:	python3dist(coverage)
+BuildRequires:	python3dist(pyopenssl)
 BuildRequires:	socat
-BuildRequires:	python%{python3_pkgversion}dist(asyncssh)
-BuildRequires:	python%{python3_pkgversion}dist(natsort)
+BuildRequires:	python3dist(asyncssh)
+BuildRequires:	python3dist(natsort)
 %endif
 BuildRequires:	pkgconfig(thrift) >= 0.13.0
 BuildRequires:  pkgconfig(re2)
@@ -395,9 +394,9 @@ BuildRequires:  gcc-toolset-%{gts_version}-libubsan-devel
 BuildRequires:  gcc-toolset-%{gts_version}-libasan-devel
 %endif
 %endif
-BuildRequires:	python%{python3_pkgversion}dist(prettytable)
-BuildRequires:	python%{python3_pkgversion}dist(pyyaml)
-BuildRequires:	python%{python3_pkgversion}dist(sphinx)
+BuildRequires:	python3dist(prettytable)
+BuildRequires:	python3dist(pyyaml)
+BuildRequires:	python3dist(sphinx)
 #################################################################################
 # distro-conditional dependencies
 #################################################################################
@@ -426,15 +425,15 @@ BuildRequires:  ninja-build
 BuildRequires:  numactl-devel
 #BuildRequires:  krb5-devel
 BuildRequires:  CUnit-devel
-BuildRequires:	python%{python3_pkgversion}-devel
+BuildRequires:	python3-devel
 %endif
 # distro-conditional make check dependencies
 %if 0%{with make_check}
 BuildRequires:	golang
 BuildRequires:	pkgconfig(xmlsec1)
 BuildRequires:	pkgconfig(xmlsec1-openssl)
-BuildRequires:	python%{python3_pkgversion}dist(cherrypy)
-BuildRequires:	python%{python3_pkgversion}dist(routes)
+BuildRequires:	python3dist(cherrypy)
+BuildRequires:	python3dist(routes)
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 BuildRequires:	/usr/bin/promtool
 BuildRequires:	libtool-ltdl-devel
@@ -443,8 +442,8 @@ BuildRequires:	xmlsec1
 BuildRequires:	xmlsec1-nss
 %endif
 BuildRequires:	xmlsec1-openssl
-BuildRequires:	python%{python3_pkgversion}dist(scipy)
-BuildRequires:	python%{python3_pkgversion}dist(pyopenssl)
+BuildRequires:	python3dist(scipy)
+BuildRequires:	python3dist(pyopenssl)
 %endif
 BuildRequires:	jsonnet
 %if 0%{?suse_version}
@@ -452,7 +451,7 @@ BuildRequires:	golang-github-prometheus-prometheus
 BuildRequires:	libxmlsec1-1
 BuildRequires:	libxmlsec1-nss1
 BuildRequires:	libxmlsec1-openssl1
-BuildRequires:	python%{python3_pkgversion}-numpy-devel
+BuildRequires:	python3-numpy-devel
 %endif
 %endif
 # lttng and babeltrace for rbd-replay-prep
@@ -525,7 +524,7 @@ Base is the package that includes all the files shared amongst ceph servers
 Summary:        Utility to bootstrap Ceph clusters
 BuildArch:      noarch
 Requires:       lvm2
-Requires:       python%{python3_pkgversion}
+Requires:       python3
 Requires:       openssh-server
 Requires:       which
 %if 0%{?weak_deps}
@@ -541,14 +540,14 @@ Recommends:     podman >= 2.0.2
 %if 0%{with cephadm_bundling}
 %if 0%{without cephadm_pip_deps}
 # Zipapp built from system RPMs at build time; bundled zipapp is self-contained at runtime.
-BuildRequires: python%{python3_pkgversion}dist(jinja2) >= 2.10
-BuildRequires: python%{python3_pkgversion}dist(pyyaml)
+BuildRequires: python3dist(jinja2) >= 2.10
+BuildRequires: python3dist(pyyaml)
 %endif
 %dnl end without cephadm_pip_deps (CEPHADM_BUNDLED_DEPENDENCIES=rpm)
 %else
 # Unbundled cephadm: host must provide yaml and jinja2 at runtime.
-Requires: python%{python3_pkgversion}dist(jinja2) >= 2.10
-Requires: python%{python3_pkgversion}dist(pyyaml)
+Requires: python3dist(jinja2) >= 2.10
+Requires: python3dist(pyyaml)
 %endif
 %dnl end with cephadm_bundling
 %description -n cephadm
@@ -563,13 +562,13 @@ Group:		System/Filesystems
 Requires:	librbd1 = %{_epoch_prefix}%{version}-%{release}
 Requires:	librados2 = %{_epoch_prefix}%{version}-%{release}
 Requires:	libcephfs2 = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-rados = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-rbd = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-cephfs = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-rgw = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-ceph-argparse = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-ceph-common = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}dist(prettytable)
+Requires:	python3-rados = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3-rbd = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3-cephfs = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3-rgw = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3-ceph-argparse = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3-ceph-common = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3dist(prettytable)
 %if 0%{with libradosstriper}
 Requires:	libradosstriper1 = %{_epoch_prefix}%{version}-%{release}
 %endif
@@ -667,18 +666,18 @@ Requires:       ceph-mgr-smb = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-grafana-dashboards = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-prometheus-alerts = %{_epoch_prefix}%{version}-%{release}
 %if 0%{?fedora} || 0%{?rhel}
-Requires:       python%{python3_pkgversion}dist(grpcio)
-Requires:       python%{python3_pkgversion}dist(grpcio-tools)
-Requires:       python%{python3_pkgversion}dist(jmespath)
-Requires:       python%{python3_pkgversion}dist(xmltodict)
+Requires:       python3dist(grpcio)
+Requires:       python3dist(grpcio-tools)
+Requires:       python3dist(jmespath)
+Requires:       python3dist(xmltodict)
 %endif
-Requires:       python%{python3_pkgversion}dist(cherrypy)
-Requires:       python%{python3_pkgversion}dist(routes)
+Requires:       python3dist(cherrypy)
+Requires:       python3dist(routes)
 %if 0%{?weak_deps}
-Recommends:     python%{python3_pkgversion}dist(python3-saml)
+Recommends:     python3dist(python3-saml)
 %if 0%{?fedora}
-Recommends:     python%{python3_pkgversion}dist(grpcio)
-Recommends:     python%{python3_pkgversion}dist(grpcio-tools)
+Recommends:     python3dist(grpcio)
+Recommends:     python3dist(grpcio-tools)
 %endif
 %endif
 %description mgr-dashboard
@@ -694,11 +693,11 @@ BuildArch:      noarch
 Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(numpy)
+Requires:       python3dist(numpy)
 %if 0%{?fedora} || 0%{?suse_version} || 0%{?openEuler}
-Requires:       python%{python3_pkgversion}dist(scikit-learn)
+Requires:       python3dist(scikit-learn)
 %endif
-Requires:       python%{python3_pkgversion}dist(scipy)
+Requires:       python3dist(scipy)
 %description mgr-diskprediction-local
 ceph-mgr-diskprediction-local is a ceph-mgr module that tries to predict
 disk failures using local algorithms and machine-learning databases.
@@ -709,10 +708,10 @@ BuildArch:      noarch
 %if 0%{?suse_version}
 Group:          System/Filesystems
 %endif
-Requires:       python%{python3_pkgversion}dist(prettytable)
-Requires:       python%{python3_pkgversion}dist(requests)
-Requires:       python%{python3_pkgversion}dist(python-dateutil)
-Requires:       python%{python3_pkgversion}dist(pyyaml)
+Requires:       python3dist(prettytable)
+Requires:       python3dist(requests)
+Requires:       python3dist(python-dateutil)
+Requires:       python3dist(pyyaml)
 %if 0%{?weak_deps}
 Recommends:	ceph-mgr-rook = %{_epoch_prefix}%{version}-%{release}
 %endif
@@ -760,8 +759,8 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-nfs = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(kubernetes)
-Requires:       python%{python3_pkgversion}dist(jsonpatch)
+Requires:       python3dist(kubernetes)
+Requires:       python3dist(jsonpatch)
 %description mgr-rook
 ceph-mgr-rook is a ceph-mgr module for orchestration functions using
 a Rook backend.
@@ -773,7 +772,7 @@ Summary:        Ceph Manager module to orchestrate ceph-events to kubernetes' ev
 Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(kubernetes)
+Requires:       python3dist(kubernetes)
 %description mgr-k8sevents
 ceph-mgr-k8sevents is a ceph-mgr module that sends every ceph-events
 to kubernetes' events API
@@ -787,13 +786,13 @@ Group:          System/Filesystems
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-nfs = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-smb = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(asyncssh)
-Requires:       python%{python3_pkgversion}dist(bcrypt)
-Requires:       python%{python3_pkgversion}dist(natsort)
-Requires:       python%{python3_pkgversion}dist(pyopenssl)
+Requires:       python3dist(asyncssh)
+Requires:       python3dist(bcrypt)
+Requires:       python3dist(natsort)
+Requires:       python3dist(pyopenssl)
 Requires:       cephadm = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(cherrypy)
-Requires:       python%{python3_pkgversion}dist(jinja2)
+Requires:       python3dist(cherrypy)
+Requires:       python3dist(jinja2)
 %if 0%{?suse_version}
 Requires:       openssh
 %endif
@@ -835,7 +834,7 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 %if 0%{?weak_deps}
-Recommends:     python%{python3_pkgversion}dist(influxdb)
+Recommends:     python3dist(influxdb)
 %endif
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
 %description mgr-influx
@@ -933,7 +932,7 @@ Summary:        Ceph Manager module for OSD performance counter queries
 Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(prettytable)
+Requires:       python3dist(prettytable)
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
 %description mgr-osd-perf-query
 ceph-mgr-osd-perf-query is a ceph-mgr module that exposes OSD
@@ -959,7 +958,7 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:      ceph-mgr-modules-core < %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(cherrypy)
+Requires:       python3dist(cherrypy)
 %description mgr-prometheus
 ceph-mgr-prometheus is a ceph-mgr module that exposes cluster metrics
 in Prometheus exposition format.
@@ -1054,7 +1053,7 @@ Summary:	Ceph fuse-based client
 Group:		System/Filesystems
 %endif
 Requires:       fuse3
-Requires:	python%{python3_pkgversion}
+Requires:	python3
 %description fuse
 FUSE based client for Ceph distributed network file system
 
@@ -1146,7 +1145,7 @@ service as well as the OpenStack Object Storage ("Swift") API.
 %package -n cephfs-top
 Summary:    top(1) like utility for Ceph Filesystem
 BuildArch:  noarch
-Requires:   python%{python3_pkgversion}-rados
+Requires:   python3-rados
 %description -n cephfs-top
 This package provides a top(1) like utility to display Ceph Filesystem metrics
 in realtime.
@@ -1237,8 +1236,8 @@ Requires: lvm2
 Requires: parted
 Requires: util-linux
 Requires: xfsprogs
-Requires: python%{python3_pkgversion}-setuptools
-Requires: python%{python3_pkgversion}-ceph-common = %{_epoch_prefix}%{version}-%{release}
+Requires: python3-setuptools
+Requires: python3-ceph-common = %{_epoch_prefix}%{version}-%{release}
 %description volume
 This package contains a tool to deploy OSD with different devices like
 lvm or physical disks, and trying to follow a predictable, and robust
@@ -1305,31 +1304,31 @@ Obsoletes:	librgw2-devel < %{_epoch_prefix}%{version}-%{release}
 This package contains libraries and headers needed to develop programs
 that use RADOS gateway client library.
 
-%package -n python%{python3_pkgversion}-rgw
+%package -n python3-rgw
 Summary:	Python 3 libraries for the RADOS gateway
 %if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
 Requires:	librgw2 = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-rados = %{_epoch_prefix}%{version}-%{release}
-%{?python_provide:%python_provide python%{python3_pkgversion}-rgw}
+Requires:	python3-rados = %{_epoch_prefix}%{version}-%{release}
+%{?python_provide:%python_provide python3-rgw}
 Provides:	python-rgw = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:	python-rgw < %{_epoch_prefix}%{version}-%{release}
-%description -n python%{python3_pkgversion}-rgw
+%description -n python3-rgw
 This package contains Python 3 libraries for interacting with Ceph RADOS
 gateway.
 
-%package -n python%{python3_pkgversion}-rados
+%package -n python3-rados
 Summary:	Python 3 libraries for the RADOS object store
 %if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
-Requires:	python%{python3_pkgversion}
+Requires:	python3
 Requires:	librados2 = %{_epoch_prefix}%{version}-%{release}
-%{?python_provide:%python_provide python%{python3_pkgversion}-rados}
+%{?python_provide:%python_provide python3-rados}
 Provides:	python-rados = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:	python-rados < %{_epoch_prefix}%{version}-%{release}
-%description -n python%{python3_pkgversion}-rados
+%description -n python3-rados
 This package contains Python 3 libraries for interacting with Ceph RADOS
 object store.
 
@@ -1420,17 +1419,17 @@ Obsoletes:	librbd1-devel < %{_epoch_prefix}%{version}-%{release}
 This package contains libraries and headers needed to develop programs
 that use RADOS block device.
 
-%package -n python%{python3_pkgversion}-rbd
+%package -n python3-rbd
 Summary:	Python 3 libraries for the RADOS block device
 %if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
 Requires:	librbd1 = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-rados = %{_epoch_prefix}%{version}-%{release}
-%{?python_provide:%python_provide python%{python3_pkgversion}-rbd}
+Requires:	python3-rados = %{_epoch_prefix}%{version}-%{release}
+%{?python_provide:%python_provide python3-rbd}
 Provides:	python-rbd = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:	python-rbd < %{_epoch_prefix}%{version}-%{release}
-%description -n python%{python3_pkgversion}-rbd
+%description -n python3-rbd
 This package contains Python 3 libraries for interacting with Ceph RADOS
 block device.
 
@@ -1486,55 +1485,55 @@ Obsoletes:	libcephfs2-devel < %{_epoch_prefix}%{version}-%{release}
 This package contains libraries and headers needed to develop programs
 that use Ceph distributed file system.
 
-%package -n python%{python3_pkgversion}-cephfs
+%package -n python3-cephfs
 Summary:	Python 3 libraries for Ceph distributed file system
 %if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
 Requires:	libcephfs2 = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-rados = %{_epoch_prefix}%{version}-%{release}
-Requires:	python%{python3_pkgversion}-ceph-argparse = %{_epoch_prefix}%{version}-%{release}
-%{?python_provide:%python_provide python%{python3_pkgversion}-cephfs}
+Requires:	python3-rados = %{_epoch_prefix}%{version}-%{release}
+Requires:	python3-ceph-argparse = %{_epoch_prefix}%{version}-%{release}
+%{?python_provide:%python_provide python3-cephfs}
 Provides:	python-cephfs = %{_epoch_prefix}%{version}-%{release}
 Obsoletes:	python-cephfs < %{_epoch_prefix}%{version}-%{release}
-%description -n python%{python3_pkgversion}-cephfs
+%description -n python3-cephfs
 This package contains Python 3 libraries for interacting with Ceph distributed
 file system.
 
-%package -n python%{python3_pkgversion}-ceph-argparse
+%package -n python3-ceph-argparse
 Summary:	Python 3 utility libraries for Ceph CLI
 %if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
-%{?python_provide:%python_provide python%{python3_pkgversion}-ceph-argparse}
-%description -n python%{python3_pkgversion}-ceph-argparse
+%{?python_provide:%python_provide python3-ceph-argparse}
+%description -n python3-ceph-argparse
 This package contains types and routines for Python 3 used by the Ceph CLI as
 well as the RESTful interface. These have to do with querying the daemons for
 command-description information, validating user command input against those
 descriptions, and submitting the command to the appropriate daemon.
 
-%package -n python%{python3_pkgversion}-ceph-common
+%package -n python3-ceph-common
 Summary:	Python 3 utility libraries for Ceph
-Requires:       python%{python3_pkgversion}dist(pyyaml)
+Requires:       python3dist(pyyaml)
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
 %if %{with pypkg}
-Recommends:     python%{python3_pkgversion}-ceph-smb-ctl
+Recommends:     python3-ceph-smb-ctl
 %endif
 %endif
 %if 0%{?suse_version}
 Group:		Development/Libraries/Python
 %endif
-%{?python_provide:%python_provide python%{python3_pkgversion}-ceph-common}
-%description -n python%{python3_pkgversion}-ceph-common
+%{?python_provide:%python_provide python3-ceph-common}
+%description -n python3-ceph-common
 This package contains data structures, classes and functions used by Ceph.
 It also contains utilities used for the cephadm orchestrator.
 
 %if 0%{with cephfs_shell}
 %package -n cephfs-shell
 Summary:    Interactive shell for Ceph file system
-Requires:   python%{python3_pkgversion}dist(cmd2)
-Requires:   python%{python3_pkgversion}dist(colorama)
-Requires:   python%{python3_pkgversion}-cephfs
+Requires:   python3dist(cmd2)
+Requires:   python3dist(colorama)
+Requires:   python3-cephfs
 %description -n cephfs-shell
 This package contains an interactive tool that allows accessing a Ceph
 file system without mounting it  by providing a nice pseudo-shell which
@@ -1664,20 +1663,20 @@ Group:          System/Monitoring
 This package provides a Ceph hardware monitoring agent.
 
 %if %{with pypkg}
-%package -n python%{python3_pkgversion}-ceph-smb-ctl
+%package -n python3-ceph-smb-ctl
 Summary:        Ceph SMB Service Remote-Control Client
 BuildArch:      noarch
 %if 0%{?suse_version}
 Group:          System/Filesystems
 %endif
-Requires:       python%{python3_pkgversion}-ceph-common = %{_epoch_prefix}%{version}-%{release}
-Requires:       python%{python3_pkgversion}dist(grpcio)
-Requires:       python%{python3_pkgversion}dist(grpcio-reflection)
-%description -n python%{python3_pkgversion}-ceph-smb-ctl
+Requires:       python3-ceph-common = %{_epoch_prefix}%{version}-%{release}
+Requires:       python3dist(grpcio)
+Requires:       python3dist(grpcio-reflection)
+%description -n python3-ceph-smb-ctl
 This package provides a tool to interact with Ceph's SMB Service Remote-Control
 gRPC API as a client.
 %endif
-%dnl end package python%{python3_pkgversion}-ceph-smb-ctl
+%dnl end package python3-ceph-smb-ctl
 
 #################################################################################
 # common
@@ -2798,7 +2797,7 @@ fi
 %{_includedir}/rados/cls_flags.hpp
 %{_includedir}/rados/cls_traits.hpp
 
-%files -n python%{python3_pkgversion}-rados
+%files -n python3-rados
 %{python3_sitearch}/rados.cpython*.so
 %{python3_sitearch}/rados-*.dist-info
 
@@ -2870,11 +2869,11 @@ fi
 %{_libdir}/librgw_rados_tp.so
 %endif
 
-%files -n python%{python3_pkgversion}-rgw
+%files -n python3-rgw
 %{python3_sitearch}/rgw.cpython*.so
 %{python3_sitearch}/rgw-*.dist-info
 
-%files -n python%{python3_pkgversion}-rbd
+%files -n python3-rbd
 %{python3_sitearch}/rbd.cpython*.so
 %{python3_sitearch}/rbd-*.dist-info
 
@@ -2911,17 +2910,17 @@ fi
 %{_libdir}/libcephfs_proxy.so
 %{_libdir}/pkgconfig/cephfs.pc
 
-%files -n python%{python3_pkgversion}-cephfs
+%files -n python3-cephfs
 %{python3_sitearch}/cephfs.cpython*.so
 %{python3_sitearch}/cephfs-*.dist-info
 
-%files -n python%{python3_pkgversion}-ceph-argparse
+%files -n python3-ceph-argparse
 %{python3_sitelib}/ceph_argparse.py
 %{python3_sitelib}/__pycache__/ceph_argparse.cpython*.py*
 %{python3_sitelib}/ceph_daemon.py
 %{python3_sitelib}/__pycache__/ceph_daemon.cpython*.py*
 
-%files -n python%{python3_pkgversion}-ceph-common
+%files -n python3-ceph-common
 %{python3_sitelib}/ceph
 %{python3_sitelib}/ceph-*.%{?with_pypkg:dist}%{!?with_pypkg:egg}-info
 
@@ -3121,7 +3120,7 @@ exit 0
 %{python3_sitelib}/ceph_node_proxy-*
 
 %if %{with pypkg}
-%files -n python%{python3_pkgversion}-ceph-smb-ctl
+%files -n python3-ceph-smb-ctl
 %{_bindir}/ceph-smb-ctl
 %endif
 

From 7240994bf53deabdfaf137a74cf886693682f4e9 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Mon, 22 Jun 2026 20:48:41 +0800
Subject: [PATCH 500/596] test/common: reduce WebCache stress-test thread count

WebCacheConcurrencyTest sized its thread pool as hardware_concurrency() * 100,
which is 3200 on the 32-vCPU CI hosts. Linux runs that in a few seconds, but
the Windows (mingw-llvm/libc++) build times out unittest_web_cache at the
1800s per-test limit on every PR.

BasicAddSame reuses one key, so after the first insert every add() is a
shared-lock hit: 3200 threads log hit=3200000 miss=1 and finish in ~4s.
BasicAddUnique inserts a distinct key each iteration, so every add() misses
and takes the exclusive lock. libc++'s std::shared_mutex wakes all waiting
writers on every unlock, so N contending writers cost O(N^2) wakeups. At
N=3200 that alone overruns the 1800s budget, which is where the failing run
hangs. StampedeSyncCallOnce and StampedeMutex are exclusive-lock bound the
same way.

The tests only need enough threads to race; 4x oversubscription is enough.
Cap the count via a shared helper.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/test/common/test_web_cache.cc | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/test/common/test_web_cache.cc b/src/test/common/test_web_cache.cc
index 524e4c0beb2..6bbcbdc4a15 100644
--- a/src/test/common/test_web_cache.cc
+++ b/src/test/common/test_web_cache.cc
@@ -446,6 +446,13 @@ TEST_F(WebCacheTest, SieveAllVisited) {
 }
 
 class WebCacheConcurrencyTest : public WebCacheTest {
+ protected:
+  // 4x oversubscription is enough to race the threads. The original *100
+  // (3200 on CI) made exclusive-lock tests O(N^2) and timed out on Windows.
+  static unsigned stress_thread_count() {
+    return std::max(std::thread::hardware_concurrency() * 4, 32u);
+  }
+
   void TearDown() override {
     if (_uut->perf() != nullptr) {
       JSONFormatter f(true);
@@ -458,8 +465,7 @@ class WebCacheConcurrencyTest : public WebCacheTest {
 
 TEST_F(WebCacheConcurrencyTest, BasicAddSame) {
   reset_cache_system_mode(100);
-  const auto num_threads =
-      std::max(std::thread::hardware_concurrency() * 100, 100U);
+  const auto num_threads = stress_thread_count();
   std::vector<std::thread> threads;
   for (size_t i = 0; i < num_threads; ++i) {
     threads.emplace_back([&]() {
@@ -478,8 +484,7 @@ TEST_F(WebCacheConcurrencyTest, BasicAddSame) {
 
 TEST_F(WebCacheConcurrencyTest, BasicAddUnique) {
   reset_cache_system_mode(100);
-  const auto num_threads =
-      std::max(std::thread::hardware_concurrency() * 100, 100U);
+  const auto num_threads = stress_thread_count();
   std::vector<std::thread> threads;
   for (size_t i = 0; i < num_threads; ++i) {
     threads.emplace_back([&]() {
@@ -504,8 +509,7 @@ TEST_F(WebCacheConcurrencyTest, StampedeSyncCallOnce) {
   webcache::WebCache<std::string, CacheValue> cache(
       _cct.get(), "test_web_cache", 100);
   std::atomic_int fetches = 0;
-  const auto num_threads =
-      std::max(std::thread::hardware_concurrency() * 100, 100U);
+  const auto num_threads = stress_thread_count();
   std::vector<std::thread> threads;
   for (size_t i = 0; i < num_threads; ++i) {
     threads.emplace_back([&]() {
@@ -542,8 +546,7 @@ TEST_F(WebCacheConcurrencyTest, StampedeMutex) {
   webcache::WebCache<std::string, CacheValue> cache(
       _cct.get(), "test_web_cache", 100);
   std::atomic_int fetches = 0;
-  const auto num_threads =
-      std::max(std::thread::hardware_concurrency() * 100, 100U);
+  const auto num_threads = stress_thread_count();
   std::vector<std::thread> threads;
   for (size_t i = 0; i < num_threads; ++i) {
     threads.emplace_back([&]() {

From b1345f257619a654cf0b955511f3883d8e95bd67 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 2 Jul 2026 08:50:10 +0800
Subject: [PATCH 501/596] common/web_cache: use ceph::shared_mutex instead of
 std::shared_mutex

WebCache declared its cache lock as a raw std::shared_mutex, bypassing the
project's ceph::shared_mutex alias that every other rwlock user goes through
(OSD::map_lock, TrackedOp::lock, ...). Align it with that convention: use
ceph::make_shared_mutex() to construct the member, and drop the explicit
<std::shared_mutex> template argument from each std::shared_lock/lock_guard
so they deduce whichever type ceph::shared_mutex resolves to.

This is idiom alignment only. The preceding commit fixes the Windows CI
timeout; this one does not touch it. ceph::shared_mutex only differs from
std::shared_mutex in debug builds, where it becomes ceph::shared_mutex_debug
for lockdep tracking. On the mingw-llvm release build that times out
unittest_web_cache, it still resolves straight to libc++'s std::shared_mutex.
The O(N^2) writer-wakeup behavior under heavy exclusive-lock contention is
unchanged.

Verified locally: unittest_web_cache builds and passes, exercising the debug
ceph::shared_mutex_debug path.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/common/web_cache.h | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/src/common/web_cache.h b/src/common/web_cache.h
index 97c2e9dfb74..901bc878e7b 100644
--- a/src/common/web_cache.h
+++ b/src/common/web_cache.h
@@ -30,6 +30,7 @@
 #include <utility>
 
 #include "common/ceph_context.h"
+#include "common/ceph_mutex.h"
 #include "common/ceph_time.h"
 #include "include/ceph_assert.h"
 #include "include/common_fwd.h"
@@ -129,7 +130,8 @@ class WebCache {
   std::unordered_map<Key, Node> _lookup;
   SieveQueue _sieve_queue;
   Node* _sieve_hand;
-  mutable std::shared_mutex _cache_mutex;
+  mutable ceph::shared_mutex _cache_mutex =
+      ceph::make_shared_mutex("WebCache::_cache_mutex");
 
  protected:
   // sieve_evict removes the next node using the SIEVE algorithm from
@@ -218,7 +220,7 @@ class WebCache {
 
   friend std::ostream& operator<<(
       std::ostream& os, const WebCache<Key, Value>& cache) {
-    std::shared_lock<std::shared_mutex> lock(cache._cache_mutex);
+    std::shared_lock lock(cache._cache_mutex);
     const auto now = ceph::real_clock::now();
     os << "$" << cache._name << "[";
 
@@ -354,14 +356,14 @@ PerfCounters* WebCache<Key, Value>::initialize_perf_counters(
 
 template <typename Key, typename Value>
 size_t WebCache<Key, Value>::size() const {
-  std::shared_lock<std::shared_mutex> lock(_cache_mutex);
+  std::shared_lock lock(_cache_mutex);
   ceph_assert(_lookup.size() == _sieve_queue.size());
   return _lookup.size();
 }
 
 template <typename Key, typename Value>
 size_t WebCache<Key, Value>::clear() {
-  std::lock_guard<std::shared_mutex> lock(_cache_mutex);
+  std::lock_guard lock(_cache_mutex);
   perf_inc(Metric::clear);
   const size_t size_before = _sieve_queue.size();
   _sieve_queue.clear();
@@ -378,7 +380,7 @@ template <typename Key, typename Value>
 ceph::real_time WebCache<Key, Value>::add(const Key& key, ValuePtr value) {
   // cache hit - fast under read lock
   {
-    std::shared_lock<std::shared_mutex> lock(_cache_mutex);
+    std::shared_lock lock(_cache_mutex);
     if (auto search = _lookup.find(key); search != _lookup.end()) {
       perf_inc(Metric::hit);
       search->second.visited = true;
@@ -387,7 +389,7 @@ ceph::real_time WebCache<Key, Value>::add(const Key& key, ValuePtr value) {
   }
   // miss, take unique lock
   {
-    std::lock_guard<std::shared_mutex> lock(_cache_mutex);
+    std::lock_guard lock(_cache_mutex);
     return insert_or_existing_unmutexed(key, value).expires_at;
   }
 }
@@ -396,7 +398,7 @@ template <typename Key, typename Value>
 WebCache<Key, Value>::ValuePtr WebCache<Key, Value>::lookup_or(
     const Key& key, ValuePtr new_val) {
   {
-    std::shared_lock<std::shared_mutex> cache_lock(_cache_mutex);
+    std::shared_lock cache_lock(_cache_mutex);
     auto maybe_value = lookup_unmutexed(key);
     if (maybe_value.has_value()) {
       perf_inc(Metric::hit);
@@ -406,7 +408,7 @@ WebCache<Key, Value>::ValuePtr WebCache<Key, Value>::lookup_or(
 
   // miss, take unique lock
   {
-    std::lock_guard<std::shared_mutex> lock(_cache_mutex);
+    std::lock_guard lock(_cache_mutex);
     return insert_or_existing_unmutexed(key, new_val).value;
   }
 }
@@ -414,7 +416,7 @@ WebCache<Key, Value>::ValuePtr WebCache<Key, Value>::lookup_or(
 template <typename Key, typename Value>
 bool WebCache<Key, Value>::update_ttl_if(
     const Key& key, const ValuePtr& val, ceph::timespan new_ttl) {
-  std::lock_guard<std::shared_mutex> lock(_cache_mutex);
+  std::lock_guard lock(_cache_mutex);
   if (auto search = _lookup.find(key);
       (search != _lookup.end() && search->second.value == val)) {
     search->second.expires_at = ceph::real_clock::now() + new_ttl;
@@ -426,7 +428,7 @@ bool WebCache<Key, Value>::update_ttl_if(
 template <typename Key, typename Value>
 bool WebCache<Key, Value>::remove_if(
     const Key& key, const ValuePtr& expected_val) {
-  std::lock_guard<std::shared_mutex> lock(_cache_mutex);
+  std::lock_guard lock(_cache_mutex);
   if (auto search = _lookup.find(key);
       (search != _lookup.end() && search->second.value == expected_val)) {
     auto [_, hand_moved] =
@@ -500,7 +502,7 @@ WebCache<Key, Value>::sieve_remove_unmutexed(
 template <typename Key, typename Value>
 std::optional<typename WebCache<Key, Value>::ValuePtr>
 WebCache<Key, Value>::lookup(const Key& key) {
-  std::shared_lock<std::shared_mutex> lock(_cache_mutex);
+  std::shared_lock lock(_cache_mutex);
   auto result = lookup_unmutexed(key);
   if (result.has_value()) {
     perf_inc(Metric::hit);
@@ -537,7 +539,7 @@ typename WebCache<Key, Value>::Node* WebCache<Key, Value>::sieve_expire_erase_un
 
 template <typename Key, typename Value>
 size_t WebCache<Key, Value>::expire_erase() {
-  std::lock_guard<std::shared_mutex> lock(_cache_mutex);
+  std::lock_guard lock(_cache_mutex);
   const auto expiration_cutoff = ceph::real_clock::now();
   const auto lookup_size_before = _lookup.size();
   SieveQueue expired;

From 7edbd7c61d24359bddb4884d7a31ff85d51926ef Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 2 Jul 2026 11:04:45 +0800
Subject: [PATCH 502/596] mgr/dashboard: fix stale nvmeof spec tests from a
 semantic merge conflict

mgr-dashboard-frontend-unittests has been failing on main since 2026-07-01,
unrelated to whatever PR triggers it. Bisected to cfe12305fb1, the merge
commit for PR #68180.

6182e67ea4 ("mgr/dashboard: NVMe Onboarding Setup Cards") moved gateway
group selection out of NvmeofSubsystemsComponent and
NvmeofNamespacesListComponent into a new NvmeofGatewayGroupFilterComponent,
dropping gwGroups, updateGroupSelectionState, handleGatewayGroupsError,
onGroupClear, and getSubsystems from both. Clean on its own.

PR #68180 forked from main in April, before that refactor existed, and
added three new tests against the old API. Also clean on its own, and never
rebased. Both PRs only touch lines the other doesn't, so when #68180 merged
34 minutes after 6182e67ea4, git's 3-way merge combined them without a
conflict. The merge is the only place the bug exists: new tests calling
methods the sibling parent had already deleted. TypeError at runtime,
TS2339/TS2551 from tsc, every run since. CI never caught it: GitHub was
showing #68180's make check as green from a run a full day older than
6182e67ea4.

nvmeof-namespaces-list.component.spec.ts: the dedup test is real, current
logic, it just called the old listNamespaces() instead of fetchData().
Fixed the call. The other two duplicate NvmeofGatewayGroupFilterComponent's
own spec; removed.

nvmeof-subsystems.component.spec.ts: same story, all three duplicate the
filter component's spec; removed.

Both removed error tests also checked preventDefault() on the error object,
which had no coverage elsewhere. Added that to
NvmeofGatewayGroupFilterComponent's spec, and hit a second bug while writing
it: the file's throwError(() => err) is the RxJS 7 factory overload, this
project is on RxJS 6.6.3, so it was emitting the arrow function itself as
the error. The existing error test never noticed since it only checks side
effects, not the error's identity. Used throwError(err) instead.

Verified: jest passes on all three spec files (was 6 failing), tsc -p
tsconfig.spec.json --noEmit is clean (was 17 errors), full block/nvmeof
sweep is 29/29 suites, 216/216 tests.

Fixes: cfe12305fb1
Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 ...eof-gateway-group-filter.component.spec.ts |  7 ++++
 .../nvmeof-namespaces-list.component.spec.ts  | 24 +------------
 .../nvmeof-subsystems.component.spec.ts       | 35 -------------------
 3 files changed, 8 insertions(+), 58 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
index aef321896f5..2324b2ce161 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
@@ -103,6 +103,13 @@ describe('NvmeofGatewayGroupFilterComponent', () => {
     expect(component.placeholder).toBe('Unable to fetch Gateway groups');
   });
 
+  it('should call preventDefault on the error when the API call fails', () => {
+    const err = { preventDefault: jest.fn() };
+    (nvmeofService.listGatewayGroups as jest.Mock).mockReturnValue(throwError(err));
+    fixture.detectChanges();
+    expect(err.preventDefault).toHaveBeenCalled();
+  });
+
   it('should render a cds-combo-box', () => {
     fixture.detectChanges();
     const combo = fixture.nativeElement.querySelector('cds-combo-box');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
index f7f6b4261b1..945c99ea040 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
@@ -148,28 +148,6 @@ describe('NvmeofNamespacesListComponent', () => {
       done();
     });
 
-    component.listNamespaces();
-  });
-
-  it('should default to first group and keep default placeholder when groups exist', () => {
-    component.group = null;
-    component.gwGroups = [{ content: 'g1', selected: false }] as any;
-
-    component.updateGroupSelectionState();
-
-    expect(component.group).toBe('g1');
-    expect(component.gwGroupsEmpty).toBe(false);
-    expect(component.gwGroupPlaceholder).toBe('Enter group name');
-  });
-
-  it('should set error placeholder and call preventDefault on group fetch failure', () => {
-    const preventDefault = jasmine.createSpy('preventDefault');
-
-    component.handleGatewayGroupsError({ preventDefault });
-
-    expect(component.gwGroups).toEqual([]);
-    expect(component.gwGroupsEmpty).toBe(true);
-    expect(component.gwGroupPlaceholder).toBe('Unable to fetch Gateway groups');
-    expect(preventDefault).toHaveBeenCalled();
+    component.fetchData();
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
index 0acf8711376..f848d67c66e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
@@ -160,39 +160,4 @@ describe('NvmeofSubsystemsComponent', () => {
   it('should set first group as default initially', () => {
     expect(component.group).toBe('default');
   });
-
-  it('should mark only current group as selected', () => {
-    component.group = 'foo';
-    component.gwGroups = [{ content: 'default' }, { content: 'foo' }] as any;
-
-    component.updateGroupSelectionState();
-
-    expect(component.gwGroups).toEqual([
-      { content: 'default', selected: false },
-      { content: 'foo', selected: true }
-    ]);
-  });
-
-  it('should clear selected group and refresh subsystem list', () => {
-    component.group = 'default';
-    const getSubsystemsSpy = spyOn(component, 'getSubsystems');
-
-    component.onGroupClear();
-
-    expect(component.group).toBeNull();
-    expect(getSubsystemsSpy).toHaveBeenCalled();
-  });
-
-  it('should set error placeholder and prevent default on groups load error', () => {
-    const preventDefault = jasmine.createSpy('preventDefault');
-    component.context = { error: jasmine.createSpy('error') } as any;
-
-    component.handleGatewayGroupsError({ preventDefault });
-
-    expect(component.gwGroups).toEqual([]);
-    expect(component.gwGroupsEmpty).toBe(true);
-    expect(component.gwGroupPlaceholder).toBe('Unable to fetch Gateway groups');
-    expect(preventDefault).toHaveBeenCalled();
-    expect(component.context.error).toHaveBeenCalled();
-  });
 });

From 76f7f46dbbaa41fee4fe41db77983ef0b4a44f5c Mon Sep 17 00:00:00 2001
From: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
Date: Thu, 2 Jul 2026 10:26:09 +0530
Subject: [PATCH 503/596] mgr/cephadm: remove spec.config options when a
 service is removed

For each key in spec.config, validate the option name and run
config rm on the service's config section. Call this from
remove_service() before spec_store.rm() schedules daemon removal.

Fixes: https://tracker.ceph.com/issues/77891
Signed-off-by: Shweta Bhosale <Shweta.Bhosale1@ibm.com>
---
 src/pybind/mgr/cephadm/module.py             |  2 +
 src/pybind/mgr/cephadm/serve.py              | 24 ++++++++++++
 src/pybind/mgr/cephadm/tests/test_cephadm.py | 40 ++++++++++++++++++++
 3 files changed, 66 insertions(+)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 24c6483007a..bb4c0f7a46f 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -3246,6 +3246,8 @@ Then run the following:
                     f'will remain, --force to proceed anyway\n{msg}'
                 )
 
+        spec = self.spec_store[service_name].spec
+        CephadmServe(self)._remove_service_config(spec)
         found = self.spec_store.rm(service_name, force_delete_data)
         if found and service_name.startswith('osd.'):
             self.spec_store.finally_rm(service_name)
diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index 6849c586c33..af6784a8267 100644
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -709,6 +709,30 @@ class CephadmServe:
                 self.mgr.set_health_warning('CEPHADM_FAILED_SET_OPTION', f'Failed to set {len(options_failed_to_set)} option(s)', len(
                     options_failed_to_set), options_failed_to_set)
 
+    def _remove_service_config(self, spec: ServiceSpec) -> None:
+        if not spec.config:
+            return
+        section = utils.name_to_config_section(spec.service_name())
+        for k in spec.config.keys():
+            try:
+                self.mgr.get_foreign_ceph_option(section, k)
+            except KeyError:
+                self.log.debug(
+                    'Ignoring invalid %s config option %s on removal', spec.service_name(), k
+                )
+                continue
+            self.log.debug(
+                'Removing config keys for %s, section: %s, key: %s', spec.service_name(), section, k
+            )
+            try:
+                self.mgr.check_mon_command({
+                    'prefix': 'config rm',
+                    'name': k,
+                    'who': section,
+                })
+            except MonCommandFailed as e:
+                self.log.warning('Failed to remove %s option %s: %s', spec.service_name(), k, e)
+
     def _update_rgw_endpoints(self, rgw_spec: RGWSpec) -> None:
 
         if not rgw_spec.update_endpoints or rgw_spec.rgw_realm_token is None:
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index 79fed21c6c4..a83e72804c9 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -1815,6 +1815,46 @@ class TestCephadm(object):
             assert 'Ignoring invalid mgr config option test' in cephadm_module.health_checks[
                 'CEPHADM_INVALID_CONFIG_OPTION']['detail']
 
+    @mock.patch("cephadm.module.CephadmOrchestrator.check_mon_command")
+    @mock.patch("cephadm.module.CephadmOrchestrator.get_foreign_ceph_option")
+    def test_remove_service_config(self, get_foreign_ceph_option, check_mon_command, cephadm_module: CephadmOrchestrator):
+        get_foreign_ceph_option.return_value = 'foo'
+        ps = PlacementSpec(hosts=['test'], count=1)
+        spec = ServiceSpec('nfs', service_id='a', placement=ps, config={'rados_replica_read_policy': 'localize'})
+        CephadmServe(cephadm_module)._remove_service_config(spec)
+        check_mon_command.assert_called_once_with({
+            'prefix': 'config rm',
+            'name': 'rados_replica_read_policy',
+            'who': 'client.nfs.a',
+        })
+
+    @mock.patch("cephadm.module.CephadmOrchestrator.check_mon_command")
+    @mock.patch("cephadm.module.CephadmOrchestrator.get_foreign_ceph_option")
+    def test_remove_service_config_skips_invalid(self, get_foreign_ceph_option, check_mon_command, cephadm_module: CephadmOrchestrator):
+        get_foreign_ceph_option.side_effect = KeyError
+        ps = PlacementSpec(hosts=['test'], count=1)
+        spec = ServiceSpec('nfs', placement=ps, config={'invalid_key': 'val'})
+        CephadmServe(cephadm_module)._remove_service_config(spec)
+        check_mon_command.assert_not_called()
+
+    @mock.patch("cephadm.module.CephadmOrchestrator.check_mon_command")
+    @mock.patch("cephadm.module.CephadmOrchestrator.get_foreign_ceph_option")
+    @mock.patch("cephadm.module.CephadmOrchestrator._kick_serve_loop")
+    def test_remove_service_cleans_spec_config(
+        self, _kick_serve_loop, get_foreign_ceph_option, check_mon_command, cephadm_module: CephadmOrchestrator
+    ):
+        get_foreign_ceph_option.return_value = 'foo'
+        ps = PlacementSpec(hosts=['test'], count=1)
+        spec = ServiceSpec('rgw', service_id='foo', placement=ps, config={'rgw_frontends': 'beast port=8080'})
+        cephadm_module.spec_store.save(spec)
+        cephadm_module.remove_service('rgw.foo')
+        check_mon_command.assert_called_once_with({
+            'prefix': 'config rm',
+            'name': 'rgw_frontends',
+            'who': 'client.rgw.foo',
+        })
+        assert 'rgw.foo' in cephadm_module.spec_store.spec_deleted
+
     @mock.patch("cephadm.module.CephadmOrchestrator.get_foreign_ceph_option")
     @mock.patch("cephadm.serve.CephadmServe._run_cephadm")
     @mock.patch("cephadm.module.CephadmOrchestrator.set_store")

From 277b3624395e53b1617cb1d67120b668dc1bccb1 Mon Sep 17 00:00:00 2001
From: Vallari Agrawal <vallari.agrawal@ibm.com>
Date: Mon, 8 Jun 2026 11:55:42 +0530
Subject: [PATCH 504/596] mgr/dashboard: Fix daemon_name for NVMeoFClient

Reset self.daemon_name for matched gateway, to ensure
correct daemon_name is set when server_address param
is passed to the NVMeoFClient object.

Right now, NVMeoFClient().daemon_name shows same daemon_name
for all gateways within the group.

Also add unit test for NVMeoFClient in
src/pybind/mgr/dashboard/tests/test_nvmeof_client.py

Fixes: https://tracker.ceph.com/issues/77469

Signed-off-by: Vallari Agrawal <vallari.agrawal@ibm.com>
---
 .../mgr/dashboard/services/nvmeof_client.py   |  1 +
 .../mgr/dashboard/tests/test_nvmeof_client.py | 54 ++++++++++++++++++-
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/dashboard/services/nvmeof_client.py b/src/pybind/mgr/dashboard/services/nvmeof_client.py
index 57938c62fe3..afd555ef8cd 100644
--- a/src/pybind/mgr/dashboard/services/nvmeof_client.py
+++ b/src/pybind/mgr/dashboard/services/nvmeof_client.py
@@ -74,6 +74,7 @@ else:
                     None
                 )
                 if matched_gateway:
+                    self.daemon_name = matched_gateway.get('daemon_name')
                     self.gateway_addr = matched_gateway.get('service_url')
                     logger.debug("Gateway address set to: %s", self.gateway_addr)
                 else:
diff --git a/src/pybind/mgr/dashboard/tests/test_nvmeof_client.py b/src/pybind/mgr/dashboard/tests/test_nvmeof_client.py
index 9ddc110adb9..8c79f2e5389 100644
--- a/src/pybind/mgr/dashboard/tests/test_nvmeof_client.py
+++ b/src/pybind/mgr/dashboard/tests/test_nvmeof_client.py
@@ -6,8 +6,8 @@ import pytest
 
 from ..exceptions import DashboardException
 from ..services import nvmeof_client
-from ..services.nvmeof_client import MaxRecursionDepthError, convert_to_model, \
-    handle_nvmeof_error, obj_to_namedtuple, pick
+from ..services.nvmeof_client import MaxRecursionDepthError, NVMeoFClient, \
+    convert_to_model, handle_nvmeof_error, obj_to_namedtuple, pick
 
 
 class TestObjToNamedTuple:
@@ -646,3 +646,53 @@ class TestHandleNvmeofError:
         # Should not raise an exception when status is None (default)
         result = mock_function()
         assert result is not None
+
+
+class TestNVMeoFClientInit:
+
+    _GW1_ADDR = '10.0.0.1:5500'
+    _GW2_ADDR = '10.0.0.2:5500'
+    _GW1_DAEMON = 'nvmeof.nvmeof.mygroup1.node1.aaaaaa'
+    _GW2_DAEMON = 'nvmeof.nvmeof.mygroup1.node2.bbbbbb'
+    _SERVICE_INFO = ('nvmeof.nvmeof.mygroup1', _GW1_ADDR, _GW1_DAEMON)
+    _GATEWAYS_CONFIG = {
+        'gateways': {
+            'nvmeof.nvmeof.mygroup1': [
+                {'service_url': _GW1_ADDR, 'group': 'mygroup1', 'daemon_name': _GW1_DAEMON},
+                {'service_url': _GW2_ADDR, 'group': 'mygroup1', 'daemon_name': _GW2_DAEMON},
+            ]
+        }
+    }
+
+    @pytest.fixture
+    def mock_env(self):
+        with patch('dashboard.services.nvmeof_client.NvmeofGatewaysConfig.get_service_info',
+                   return_value=self._SERVICE_INFO), \
+             patch('dashboard.services.nvmeof_client.NvmeofGatewaysConfig.get_gateways_config',
+                   return_value=self._GATEWAYS_CONFIG), \
+             patch('dashboard.services.nvmeof_client.is_mtls_enabled', return_value=False), \
+             patch('dashboard.services.nvmeof_client.grpc') as mock_grpc, \
+             patch('dashboard.services.nvmeof_client.pb2_grpc'):
+            mock_grpc.insecure_channel.return_value = MagicMock()
+            yield
+
+    def test_client_without_server_address(self, mock_env):
+        # pylint: disable=unused-argument
+        client = NVMeoFClient()
+        assert client.daemon_name == self._GW1_DAEMON
+        assert client.gateway_addr == self._GW1_ADDR
+
+    def test_client_server_address_matched_gateway(self, mock_env):
+        # pylint: disable=unused-argument
+        client = NVMeoFClient(server_address='10.0.0.2')
+        assert client.daemon_name == self._GW2_DAEMON
+        assert client.gateway_addr == self._GW2_ADDR
+        client2 = NVMeoFClient(server_address='10.0.0.1')
+        assert client2.daemon_name == self._GW1_DAEMON
+        assert client2.gateway_addr == self._GW1_ADDR
+
+    def test_client_server_address_not_found_raises(self, mock_env):
+        # pylint: disable=unused-argument
+        with pytest.raises(DashboardException) as exc_info:
+            NVMeoFClient(server_address='10.0.0.99')
+        assert exc_info.value.code == 'server_address_not_found'

From aa8f05400de764e9f1b8b3d65d871a665cd922ed Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Fri, 12 Jun 2026 05:25:55 +0530
Subject: [PATCH 505/596] mgr/prometheus: add node-proxy hardware metrics
 exporter

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 src/pybind/mgr/prometheus/module.py | 173 ++++++++++++++++++++++++++++
 1 file changed, 173 insertions(+)

diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index 4fb4f7d5d88..dbdb1e7b1fa 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -140,6 +140,20 @@ NUM_OBJECTS = ['degraded', 'misplaced', 'unfound']
 SMB_METADATA = ('smb_version', 'volume',
                 'subvolume_group', 'subvolume', 'netbiosname', 'share')
 
+NODE_PROXY_STORAGE_LABELS = ('hostname', 'device', 'model', 'protocol')
+
+NODE_PROXY_CPU_LABELS = ('hostname', 'cpu', 'manufacturer', 'model')
+
+NODE_PROXY_MEMORY_LABELS = ('hostname', 'dimm', 'type', 'manufacturer')
+
+NODE_PROXY_HEALTH_LABELS = ('hostname', 'component', 'category')
+
+NODE_PROXY_TEMP_LABELS = ('hostname', 'sensor_name')
+
+NODE_PROXY_FAN_LABELS = ('hostname', 'fan_name')
+
+NODE_PROXY_FIRMWARE_LABELS = ('hostname', 'component', 'version')
+
 CEPHADM_DAEMON_STATUS = ('service_type', 'daemon_name', 'hostname', 'service_name')
 
 alert_metric = namedtuple('alert_metric', 'name description')
@@ -998,6 +1012,55 @@ class Module(MgrModule, OrchestratorClientMixin):
                 check.description,
             )
 
+        metrics['node_proxy_storage_capacity_bytes'] = Metric(
+            'gauge',
+            'node_proxy_storage_capacity_bytes',
+            'Storage device capacity in bytes',
+            NODE_PROXY_STORAGE_LABELS
+        )
+
+        metrics['node_proxy_cpu_cores'] = Metric(
+            'gauge',
+            'node_proxy_cpu_cores',
+            'Total CPU cores',
+            NODE_PROXY_CPU_LABELS
+        )
+
+        metrics['node_proxy_memory_capacity_mib'] = Metric(
+            'gauge',
+            'node_proxy_memory_capacity_mib',
+            'Memory capacity in MiB',
+            NODE_PROXY_MEMORY_LABELS
+        )
+
+        metrics['node_proxy_health'] = Metric(
+            'gauge',
+            'node_proxy_health',
+            'Hardware component health status (0=OK, 1=Warning, 2=Error)',
+            NODE_PROXY_HEALTH_LABELS
+        )
+
+        metrics['node_proxy_temperature_celsius'] = Metric(
+            'gauge',
+            'node_proxy_temperature_celsius',
+            'Hardware temperature sensor reading in Celsius',
+            NODE_PROXY_TEMP_LABELS
+        )
+
+        metrics['node_proxy_fan_rpm'] = Metric(
+            'gauge',
+            'node_proxy_fan_rpm',
+            'Hardware fan speed in RPM',
+            NODE_PROXY_FAN_LABELS
+        )
+
+        metrics['node_proxy_firmware_info'] = Metric(
+            'gauge',
+            'node_proxy_firmware_info',
+            'Firmware version information (value is always 1, version in label)',
+            NODE_PROXY_FIRMWARE_LABELS
+        )
+
         return metrics
 
     def orch_is_available(self) -> bool:
@@ -2000,6 +2063,115 @@ class Module(MgrModule, OrchestratorClientMixin):
         except Exception as e:
             self.log.error(f"Failed to get SMB metadata: {str(e)}")
 
+    @profile_method(True)
+    def get_hardware_metrics(self) -> None:
+        """Collect hardware metrics from node-proxy KV store"""
+        NODE_PROXY_CACHE_PREFIX = 'node_proxy'
+
+        try:
+            for key, value in self.get_store_prefix(f'{NODE_PROXY_CACHE_PREFIX}/data').items():
+                host = key.split('/')[-1]
+                try:
+                    data = json.loads(value)
+                except json.JSONDecodeError:
+                    self.log.error(f"Failed to decode node-proxy data for host {host}")
+                    continue
+
+                status = data.get('status', {})
+
+                # Storage metrics
+                for sys_id, devices in status.get('storage', {}).items():
+                    for device_id, device in devices.items():
+                        capacity = device.get('capacity_bytes', 0)
+                        labels = (
+                            host,
+                            device_id,
+                            device.get('model', 'unknown'),
+                            device.get('protocol', 'unknown')
+                        )
+                        self.metrics['node_proxy_storage_capacity_bytes'].set(capacity, labels)
+
+                # CPU metrics
+                for sys_id, cpus in status.get('processors', {}).items():
+                    for cpu_id, cpu in cpus.items():
+                        cores = cpu.get('total_cores', 0)
+                        labels = (
+                            host,
+                            cpu_id,
+                            cpu.get('manufacturer', 'unknown'),
+                            cpu.get('model', 'unknown')
+                        )
+                        self.metrics['node_proxy_cpu_cores'].set(cores, labels)
+
+                # Memory metrics
+                for sys_id, dimms in status.get('memory', {}).items():
+                    for dimm_id, dimm in dimms.items():
+                        capacity = dimm.get('capacity_mi_b', 0)
+                        labels = (
+                            host,
+                            dimm_id,
+                            dimm.get('memory_device_type', 'unknown'),
+                            dimm.get('manufacturer', 'unknown')
+                        )
+                        self.metrics['node_proxy_memory_capacity_mib'].set(capacity, labels)
+
+                # Health metrics for all component types
+                for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network']:
+                    for sys_id, components in status.get(category, {}).items():
+                        for comp_id, comp in components.items():
+                            health_str = comp.get('status', {}).get('health', 'Unknown')
+                            if health_str == 'OK':
+                                health_value = 0
+                            elif health_str in ['Warning', 'Degraded']:
+                                health_value = 1
+                            else:
+                                health_value = 2
+
+                            labels = (host, comp_id, category)
+                            self.metrics['node_proxy_health'].set(health_value, labels)
+
+                # Temperature metrics
+                for sys_id, sensors in status.get('temperatures', {}).items():
+                    for sensor_id, sensor in sensors.items():
+                        reading = sensor.get('reading')
+                        sensor_name = sensor.get('name', sensor_id)
+                        # Skip absent/unknown sensors
+                        if reading is None or reading == 'unknown':
+                            continue
+                        try:
+                            temp_value = float(reading)
+                            labels = (host, sensor_name)
+                            self.metrics['node_proxy_temperature_celsius'].set(temp_value, labels)
+                        except (ValueError, TypeError):
+                            continue
+
+                # Fan RPM metrics
+                for sys_id, fans_data in status.get('fans', {}).items():
+                    for fan_id, fan in fans_data.items():
+                        # Redfish uses 'Reading' field per Thermal schema
+                        # node-proxy normalizes it to lowercase 'reading'
+                        rpm = fan.get('reading')
+                        fan_name = fan.get('name', fan_id)
+                        if rpm is None or rpm == 'unknown':
+                            continue
+                        try:
+                            rpm_value = float(rpm)
+                            labels = (host, fan_name)
+                            self.metrics['node_proxy_fan_rpm'].set(rpm_value, labels)
+                        except (ValueError, TypeError):
+                            continue
+
+                # Firmware version metrics
+                firmwares = data.get('firmwares', {})
+                for fw_id, fw_info in firmwares.items():
+                    component = fw_info.get('name', fw_id)
+                    version = fw_info.get('version', 'unknown')
+                    if version and version != 'unknown':
+                        labels = (host, component, str(version))
+                        self.metrics['node_proxy_firmware_info'].set(1, labels)
+        except Exception as e:
+            self.log.error(f"Failed to collect hardware metrics: {str(e)}")
+
     @profile_method(True)
     def collect(self) -> str:
         # Clear the metrics before scraping
@@ -2020,6 +2192,7 @@ class Module(MgrModule, OrchestratorClientMixin):
         self.get_num_objects()
         self.get_all_daemon_health_metrics()
         self.get_smb_metadata()
+        self.get_hardware_metrics()
         self.set_cephadm_daemon_status_metrics()
 
         if not self.get_module_option('exclude_perf_counters'):

From 0514014687defceb1805c5ca7c628d6de968a518 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Fri, 12 Jun 2026 05:26:00 +0530
Subject: [PATCH 506/596] monitoring: add hardware metrics Grafana dashboard

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-mixin/dashboards/hardware.libsonnet  |  603 +++++
 .../ceph-mixin/dashboards_out/hardware.json   | 2142 +++++++++++++++++
 src/pybind/mgr/prometheus/module.py           |    2 +-
 3 files changed, 2746 insertions(+), 1 deletion(-)
 create mode 100644 monitoring/ceph-mixin/dashboards/hardware.libsonnet
 create mode 100644 monitoring/ceph-mixin/dashboards_out/hardware.json

diff --git a/monitoring/ceph-mixin/dashboards/hardware.libsonnet b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
new file mode 100644
index 00000000000..6d38bd2a441
--- /dev/null
+++ b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
@@ -0,0 +1,603 @@
+local g = import 'grafonnet/grafana.libsonnet';
+
+(import 'utils.libsonnet') {
+  'hardware.json':
+    $.dashboardSchema(
+      'Ceph Hardware - Platform Monitoring',
+      'Comprehensive hardware monitoring with temperatures, fans, storage, and firmware from node-proxy',
+      'hardware001',
+      'now-1h',
+      '10s',
+      22,
+      $._config.dashboardTags,
+      ''
+    )
+    .addAnnotation(
+      $.addAnnotationSchema(
+        1,
+        '-- Grafana --',
+        true,
+        true,
+        'rgba(0, 211, 255, 1)',
+        'Annotations & Alerts',
+        'dashboard'
+      )
+    )
+    .addLinks([
+      $.addLinkSchema(
+        asDropdown=true,
+        icon='external link',
+        includeVars=true,
+        keepTime=true,
+        tags=[],
+        targetBlank=false,
+        title='Browse Dashboards',
+        tooltip='',
+        type='dashboards',
+        url=''
+      ),
+    ])
+    .addTemplate(
+      g.template.datasource('datasource', 'prometheus', 'default', label='Data Source')
+    )
+    .addTemplate(
+      $.addClusterTemplate()
+    )
+    .addTemplate(
+      $.addTemplateSchema(
+        'hostname',
+        '$datasource',
+        'label_values(ceph_node_proxy_health, hostname)',
+        1,
+        false,
+        1,
+        'Host',
+        ''
+      )
+    )
+    .addTemplate(
+      g.template.new(
+        'fan_speeds',
+        '$datasource',
+        'label_values(ceph_node_proxy_fan_rpm{hostname="$hostname"},fan_name)',
+        label='',
+        refresh='load',
+        includeAll=true,
+        multi=false,
+        allValues='',
+        sort=0,
+        regex='/.*TACH.*/',
+        hide=2
+      )
+    )
+    .addPanels([
+      // Row 1: Overview (collapsed)
+      $.addRowSchema(collapse=true, showTitle=true, title='Overview') + { gridPos: { x: 0, y: 0, w: 24, h: 1 }, panels: [
+        // Health
+        $.addStatPanel(
+          title='Health',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 4, x: 0, y: 1 }
+        )
+        .addTarget($.addTargetSchema(
+          'max(ceph_node_proxy_health)',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              mappings: [
+                { type: 'value', options: { '0': { color: 'green', index: 0, text: 'OK' } } },
+                { type: 'range', options: { from: 1, to: 999, result: { color: 'semi-dark-red', index: 1, text: 'NOT OK' } } },
+              ],
+              thresholds: {
+                mode: 'absolute',
+                steps: [{ color: 'green' }, { color: 'red', value: 1 }],
+              },
+            },
+          },
+          options+: { colorMode: 'background_solid' },
+        },
+
+        // CPU Temp
+        $.addStatPanel(
+          title='CPU Temp',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 4, y: 1 }
+        ).addTarget($.addTargetSchema(
+          'max(ceph_node_proxy_temperature_celsius{sensor_name=~".*CPU_TEMP"})',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              min: 0,
+              max: 100,
+              thresholds: {
+                mode: 'absolute',
+                steps: [{ color: 'green' }, { color: '#EAB839', value: 75 }, { color: 'red', value: 85 }],
+              },
+            },
+          },
+        },
+
+        // BMC Versions
+        $.pieChartPanel(
+          title='BMC Versions',
+          datasource='$datasource',
+          gridPos={ x: 7, y: 1, w: 3, h: 8 }
+        )
+        .addTarget($.addTargetSchema(
+          'count by(version) (ceph_node_proxy_firmware_info{component=~".*BMC.*"})',
+          legendFormat='{{version}}'
+        ))
+        + {
+          fieldConfig+: {
+            defaults+: {
+              color+: {
+                mode: 'palette-classic',
+              },
+            },
+          },
+          options+: {
+            legend+: { showLegend: false },
+            displayLabels: ['name'],
+          },
+        },
+
+        // BIOS Versions
+        $.pieChartPanel(
+          title='BIOS Versions',
+          datasource='$datasource',
+          gridPos={ x: 10, y: 1, w: 3, h: 8 }
+        )
+        .addTarget($.addTargetSchema(
+          'count by(version) (ceph_node_proxy_firmware_info{component=~".*BIOS.*"})',
+          legendFormat='{{version}}'
+        ))
+        + {
+          fieldConfig+: {
+            defaults+: {
+              color+: {
+                mode: 'palette-classic',
+              },
+            },
+          },
+          options+: {
+            legend+: { showLegend: false },
+            displayLabels: ['name'],
+          },
+        },
+
+        // Drive Types
+        $.pieChartPanel(
+          title='Drive Types',
+          datasource='$datasource',
+          gridPos={ x: 13, y: 1, w: 6, h: 8 }
+        )
+        .addTarget($.addTargetSchema(
+          'count by(model) (ceph_node_proxy_storage_capacity_bytes)',
+          legendFormat='{{model}}'
+        ))
+        + {
+          fieldConfig+: {
+            defaults+: {
+              color+: {
+                mode: 'palette-classic',
+              },
+            },
+          },
+          options+: {
+            legend+: { showLegend: true, placement: 'right' },
+            displayLabels: ['value'],
+          },
+        },
+
+        // Drive Firmware
+        $.pieChartPanel(
+          title='Drive Firmware',
+          datasource='$datasource',
+          gridPos={ x: 19, y: 1, w: 5, h: 8 }
+        )
+        .addTarget($.addTargetSchema(
+          'count by(version) (ceph_node_proxy_firmware_info{component=~".*Drive.*"})',
+          legendFormat='{{version}}',
+          instant=true
+        ))
+        + {
+          fieldConfig+: {
+            defaults+: {
+              color+: {
+                mode: 'palette-classic',
+              },
+            },
+          },
+          options+: {
+            legend+: { showLegend: true, placement: 'right' },
+            displayLabels: ['value'],
+          },
+        },
+
+        // Hosts
+        $.addStatPanel(
+          title='Hosts',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 2, x: 0, y: 5 }
+        ).addTarget($.addTargetSchema(
+          'count(count by(hostname) (ceph_node_proxy_health))',
+          legendFormat='__auto'
+        )),
+
+        // Drives
+        $.addStatPanel(
+          title='Drives',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 2, x: 2, y: 5 }
+        ).addTarget($.addTargetSchema(
+          'count(ceph_node_proxy_storage_capacity_bytes)',
+          legendFormat='__auto'
+        )),
+
+        // NVMe Temp
+        $.addStatPanel(
+          title='NVMe Temp',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 4, y: 5 }
+        ).addTarget($.addTargetSchema(
+          'max(ceph_node_proxy_temperature_celsius{sensor_name=~"NVME.*_TEMP"})',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              min: 0,
+              max: 85,
+              thresholds: {
+                mode: 'absolute',
+                steps: [{ color: 'green' }, { color: 'yellow', value: 75 }, { color: 'red', value: 80 }],
+              },
+            },
+          },
+        },
+      ] },
+
+      // Row 2: Host Overview
+      $.addRowSchema(true, true, 'Host Overview: $hostname') + { gridPos: { x: 0, y: 1, w: 24, h: 1 }, panels: [
+        // Power
+        $.addStatPanel(
+          title='Power',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 3, w: 2, x: 0, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_health{hostname="$hostname",category="power"}',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              mappings: [
+                { type: 'value', options: { '0': { color: 'green', index: 0, text: 'OK' } } },
+                { type: 'range', options: { from: 1, to: 9999, result: { color: 'red', index: 1, text: 'NOT OK' } } },
+              ],
+              thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'red', value: 1 }] },
+            },
+          },
+          options+: { colorMode: 'background_solid' },
+        },
+
+        // MB Temperature
+        $.addStatPanel(
+          title='MB Temperature (max)',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 2, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'max(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"})',
+          legendFormat='__auto'
+        )),
+
+        // CPU Temperature
+        $.addStatPanel(
+          title='CPU Temperature',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 5, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'avg(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"})',
+          legendFormat='__auto'
+        )),
+
+        // DIMM Temperature
+        $.addStatPanel(
+          title='DIMM Temperature (max)',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 8, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'max(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"})',
+          legendFormat='__auto'
+        )),
+
+        // PSU Fans
+        $.addStatPanel(
+          title='PSU Fans',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 11, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'count(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
+          legendFormat='__auto'
+        )),
+
+        // AVG PSU Temperature
+        $.addStatPanel(
+          title='AVG PSU Temperature',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 14, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'avg(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"PSU.*_TEMP.*"})',
+          legendFormat='__auto'
+        )),
+
+        // NVMe Drives
+        $.addStatPanel(
+          title='NVMe Drives',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 17, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'count(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*"})',
+          legendFormat='__auto'
+        )),
+
+        // NVMe Temperature
+        $.addStatPanel(
+          title='NVMe Temperature (max)',
+          unit='celsius',
+          datasource='$datasource',
+          gridPosition={ h: 4, w: 3, x: 20, y: 2 }
+        ).addTarget($.addTargetSchema(
+          'max(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*"})',
+          legendFormat='__auto'
+        )),
+
+        // Power Control
+        $.addStatPanel(
+          title='Power Control',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 3, w: 2, x: 0, y: 5 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_health{hostname="$hostname",category="power"}',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              mappings: [
+                { type: 'value', options: { '0': { color: 'green', index: 0, text: 'OK' } } },
+                { type: 'range', options: { from: 1, to: 9999, result: { color: 'red', index: 1, text: 'NOT OK' } } },
+              ],
+              thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'red', value: 1 }] },
+            },
+          },
+          options+: { colorMode: 'background_solid' },
+        },
+
+        // Cooling
+        $.addStatPanel(
+          title='Cooling',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 3, w: 2, x: 0, y: 8 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_health{hostname="$hostname",category="fans"}',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              mappings: [
+                { type: 'value', options: { '0': { color: 'green', index: 0, text: 'OK' } } },
+                { type: 'range', options: { from: 1, to: 9999, result: { color: 'red', index: 1, text: 'NOT OK' } } },
+              ],
+              thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'red', value: 1 }] },
+            },
+          },
+          options+: { colorMode: 'background_solid' },
+        },
+
+        // Drives
+        $.addStatPanel(
+          title='Drives',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 3, w: 2, x: 0, y: 11 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_health{hostname="$hostname",category="storage"}',
+          legendFormat='__auto'
+        ))
+        + {
+          fieldConfig: {
+            defaults: {
+              mappings: [
+                { type: 'value', options: { '0': { color: 'green', index: 0, text: 'OK' } } },
+                { type: 'range', options: { from: 1, to: 9999, result: { color: 'red', index: 1, text: 'NOT OK' } } },
+              ],
+              thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'red', value: 1 }] },
+            },
+          },
+          options+: { colorMode: 'background_solid' },
+        },
+      ] },
+
+      // Row 3: FAN Speeds
+      $.addRowSchema(true, true, 'FAN Speeds: $hostname') + { gridPos: { x: 0, y: 2, w: 24, h: 1 }, panels: [
+        // Repeating panel
+        $.addStatPanel(
+          title='FAN: $fan_speeds (RPM)',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 5, w: 4, x: 0, y: 3 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_fan_rpm{hostname=~"$hostname",fan_name=~"$fan_speeds"}',
+          legendFormat='{{fan_name}}'
+        ))
+        + {
+          repeat: 'fan_speeds',
+          repeatDirection: 'h',
+          maxPerRow: 6,
+        },
+
+        // PSU1
+        $.addStatPanel(
+          title='PSU1 Fan Speed (RPM)',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 5, w: 4, x: 0, y: 8 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_fan_rpm{hostname=~"$hostname",fan_name=~"PSU1.*"}',
+          legendFormat='{{fan_name}}'
+        )),
+
+        // PSU2
+        $.addStatPanel(
+          title='PSU2 Fan Speed (RPM)',
+          unit='short',
+          datasource='$datasource',
+          gridPosition={ h: 5, w: 4, x: 4, y: 8 }
+        ).addTarget($.addTargetSchema(
+          'ceph_node_proxy_fan_rpm{hostname=~"$hostname",fan_name=~"PSU2.*"}',
+          legendFormat='{{fan_name}}'
+        )),
+      ] },
+
+      // Row 4: Temperature History
+      $.addRowSchema(true, true, 'Temperature History: $hostname') + { gridPos: { x: 0, y: 3, w: 24, h: 1 }, panels: [
+        // CPU Temperature
+        g.graphPanel.new(
+          title='CPU Temperature',
+          datasource='$datasource',
+          format='celsius',
+        ).addTarget(
+          g.prometheus.target(
+            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"}',
+            legendFormat='{{sensor_name}}'
+          )
+        ).addTarget(
+          g.prometheus.target('vector(100)', legendFormat='Critical')
+        )
+        + {
+          gridPos: { x: 0, y: 4, w: 12, h: 8 },
+          yaxes: [{ min: 0 }, {}],
+          seriesOverrides: [
+            { alias: 'Critical', color: 'dark-red', dashes: true, fill: 0 },
+          ],
+        },
+
+        // DIMM Temperatures
+        g.graphPanel.new(
+          title='DIMM Temperatures',
+          datasource='$datasource',
+          format='celsius',
+        ).addTarget(
+          g.prometheus.target(
+            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"}',
+            legendFormat='{{sensor_name}}'
+          )
+        ).addTarget(
+          g.prometheus.target('vector(88)', legendFormat='Critical')
+        )
+        + {
+          gridPos: { x: 12, y: 4, w: 12, h: 8 },
+          yaxes: [{ min: 0 }, {}],
+          seriesOverrides: [
+            { alias: 'Critical', color: 'dark-red', dashes: true, fill: 0 },
+          ],
+        },
+
+        // Motherboard Temperatures
+        g.graphPanel.new(
+          title='Motherboard Temperatures',
+          datasource='$datasource',
+          format='celsius',
+        ).addTarget(
+          g.prometheus.target(
+            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"}',
+            legendFormat='{{sensor_name}}'
+          )
+        ).addTarget(
+          g.prometheus.target('vector(85)', legendFormat='Critical')
+        )
+        + {
+          gridPos: { x: 0, y: 12, w: 12, h: 8 },
+          yaxes: [{ min: 0 }, {}],
+          seriesOverrides: [
+            { alias: 'Critical', color: 'dark-red', dashes: true, fill: 0 },
+          ],
+        },
+
+        // NVMe Temperatures
+        g.graphPanel.new(
+          title='NVMe Temperatures',
+          datasource='$datasource',
+          format='celsius',
+        ).addTarget(
+          g.prometheus.target(
+            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*_TEMP"}',
+            legendFormat='{{sensor_name}}'
+          )
+        ).addTarget(
+          g.prometheus.target('vector(85)', legendFormat='Critical')
+        )
+        + {
+          gridPos: { x: 12, y: 12, w: 12, h: 8 },
+          yaxes: [{ min: 0 }, {}],
+          seriesOverrides: [
+            { alias: 'Critical', color: 'dark-red', dashes: true, fill: 0 },
+          ],
+        },
+      ] },
+
+      // Row 5: FAN Speed History
+      $.addRowSchema(true, true, 'FAN Speed History: $hostname') + { gridPos: { x: 0, y: 4, w: 24, h: 1 }, panels: [
+        // AVG PSU Fan Speed
+        g.graphPanel.new(
+          title='AVG PSU Fan Speed',
+          datasource='$datasource',
+          format='short',
+        ).addTarget(
+          g.prometheus.target(
+            'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
+            legendFormat='PSU Fans'
+          )
+        )
+        + {
+          gridPos: { x: 0, y: 5, w: 12, h: 8 },
+          description: 'AVG across both PSUs',
+        },
+
+        // AVG Cooling Fan Speed
+        g.graphPanel.new(
+          title='AVG Cooling Fan Speed',
+          datasource='$datasource',
+          format='short',
+        ).addTarget(
+          g.prometheus.target(
+            'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~".*TACH.*"})',
+            legendFormat='System Fans'
+          )
+        )
+        + {
+          gridPos: { x: 12, y: 5, w: 12, h: 8 },
+        },
+      ] },
+    ]),
+}
diff --git a/monitoring/ceph-mixin/dashboards_out/hardware.json b/monitoring/ceph-mixin/dashboards_out/hardware.json
new file mode 100644
index 00000000000..2691c71890d
--- /dev/null
+++ b/monitoring/ceph-mixin/dashboards_out/hardware.json
@@ -0,0 +1,2142 @@
+{
+   "__inputs": [ ],
+   "__requires": [ ],
+   "annotations": {
+      "list": [
+         {
+            "builtIn": 1,
+            "datasource": "-- Grafana --",
+            "enable": true,
+            "hide": true,
+            "iconColor": "rgba(0, 211, 255, 1)",
+            "name": "Annotations & Alerts",
+            "showIn": 0,
+            "tags": [ ],
+            "type": "dashboard"
+         }
+      ]
+   },
+   "description": "Comprehensive hardware monitoring with temperatures, fans, storage, and firmware from node-proxy",
+   "editable": false,
+   "gnetId": null,
+   "graphTooltip": 0,
+   "hideControls": false,
+   "id": null,
+   "links": [
+      {
+         "asDropdown": true,
+         "icon": "external link",
+         "includeVars": true,
+         "keepTime": true,
+         "tags": [ ],
+         "targetBlank": false,
+         "title": "Browse Dashboards",
+         "tooltip": "",
+         "type": "dashboards",
+         "url": ""
+      }
+   ],
+   "panels": [
+      {
+         "collapse": true,
+         "collapsed": true,
+         "gridPos": {
+            "h": 1,
+            "w": 24,
+            "x": 0,
+            "y": 0
+         },
+         "id": 2,
+         "panels": [
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "mappings": [
+                        {
+                           "options": {
+                              "0": {
+                                 "color": "green",
+                                 "index": 0,
+                                 "text": "OK"
+                              }
+                           },
+                           "type": "value"
+                        },
+                        {
+                           "options": {
+                              "from": 1,
+                              "result": {
+                                 "color": "semi-dark-red",
+                                 "index": 1,
+                                 "text": "NOT OK"
+                              },
+                              "to": 999
+                           },
+                           "type": "range"
+                        }
+                     ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "red",
+                              "value": 1
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 4,
+                  "x": 0,
+                  "y": 1
+               },
+               "id": 3,
+               "links": [ ],
+               "options": {
+                  "colorMode": "background_solid",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "max(ceph_node_proxy_health)",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Health",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "max": 100,
+                     "min": 0,
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "#EAB839",
+                              "value": 75
+                           },
+                           {
+                              "color": "red",
+                              "value": 85
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 4,
+                  "y": 1
+               },
+               "id": 4,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "max(ceph_node_proxy_temperature_celsius{sensor_name=~\".*CPU_TEMP\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "CPU Temp",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "color": {
+                        "mode": "palette-classic"
+                     },
+                     "custom": {
+                        "hideFrom": {
+                           "legend": false,
+                           "tooltip": false,
+                           "viz": false
+                        }
+                     },
+                     "mappings": [ ]
+                  },
+                  "overrides": [ ]
+               },
+               "gridPos": {
+                  "h": 8,
+                  "w": 3,
+                  "x": 7,
+                  "y": 1
+               },
+               "id": 5,
+               "options": {
+                  "displayLabels": [
+                     "name"
+                  ],
+                  "legend": {
+                     "calcs": [ ],
+                     "displayMode": "table",
+                     "placement": "bottom",
+                     "showLegend": false,
+                     "values": [ ]
+                  },
+                  "pieType": "pie",
+                  "reduceOptions": { },
+                  "tooltip": { }
+               },
+               "targets": [
+                  {
+                     "expr": "count by(version) (ceph_node_proxy_firmware_info{component=~\".*BMC.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "{{version}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "BMC Versions",
+               "type": "piechart"
+            },
+            {
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "color": {
+                        "mode": "palette-classic"
+                     },
+                     "custom": {
+                        "hideFrom": {
+                           "legend": false,
+                           "tooltip": false,
+                           "viz": false
+                        }
+                     },
+                     "mappings": [ ]
+                  },
+                  "overrides": [ ]
+               },
+               "gridPos": {
+                  "h": 8,
+                  "w": 3,
+                  "x": 10,
+                  "y": 1
+               },
+               "id": 6,
+               "options": {
+                  "displayLabels": [
+                     "name"
+                  ],
+                  "legend": {
+                     "calcs": [ ],
+                     "displayMode": "table",
+                     "placement": "bottom",
+                     "showLegend": false,
+                     "values": [ ]
+                  },
+                  "pieType": "pie",
+                  "reduceOptions": { },
+                  "tooltip": { }
+               },
+               "targets": [
+                  {
+                     "expr": "count by(version) (ceph_node_proxy_firmware_info{component=~\".*BIOS.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "{{version}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "BIOS Versions",
+               "type": "piechart"
+            },
+            {
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "color": {
+                        "mode": "palette-classic"
+                     },
+                     "custom": {
+                        "hideFrom": {
+                           "legend": false,
+                           "tooltip": false,
+                           "viz": false
+                        }
+                     },
+                     "mappings": [ ]
+                  },
+                  "overrides": [ ]
+               },
+               "gridPos": {
+                  "h": 8,
+                  "w": 6,
+                  "x": 13,
+                  "y": 1
+               },
+               "id": 7,
+               "options": {
+                  "displayLabels": [
+                     "value"
+                  ],
+                  "legend": {
+                     "calcs": [ ],
+                     "displayMode": "table",
+                     "placement": "right",
+                     "showLegend": true,
+                     "values": [ ]
+                  },
+                  "pieType": "pie",
+                  "reduceOptions": { },
+                  "tooltip": { }
+               },
+               "targets": [
+                  {
+                     "expr": "count by(model) (ceph_node_proxy_storage_capacity_bytes)",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "{{model}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Drive Types",
+               "type": "piechart"
+            },
+            {
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "color": {
+                        "mode": "palette-classic"
+                     },
+                     "custom": {
+                        "hideFrom": {
+                           "legend": false,
+                           "tooltip": false,
+                           "viz": false
+                        }
+                     },
+                     "mappings": [ ]
+                  },
+                  "overrides": [ ]
+               },
+               "gridPos": {
+                  "h": 8,
+                  "w": 5,
+                  "x": 19,
+                  "y": 1
+               },
+               "id": 8,
+               "options": {
+                  "displayLabels": [
+                     "value"
+                  ],
+                  "legend": {
+                     "calcs": [ ],
+                     "displayMode": "table",
+                     "placement": "right",
+                     "showLegend": true,
+                     "values": [ ]
+                  },
+                  "pieType": "pie",
+                  "reduceOptions": { },
+                  "tooltip": { }
+               },
+               "targets": [
+                  {
+                     "expr": "count by(version) (ceph_node_proxy_firmware_info{component=~\".*Drive.*\"})",
+                     "format": "time_series",
+                     "instant": true,
+                     "intervalFactor": 1,
+                     "legendFormat": "{{version}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Drive Firmware",
+               "type": "piechart"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 2,
+                  "x": 0,
+                  "y": 5
+               },
+               "id": 9,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "count(count by(hostname) (ceph_node_proxy_health))",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Hosts",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 2,
+                  "x": 2,
+                  "y": 5
+               },
+               "id": 10,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "count(ceph_node_proxy_storage_capacity_bytes)",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Drives",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "max": 85,
+                     "min": 0,
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "yellow",
+                              "value": 75
+                           },
+                           {
+                              "color": "red",
+                              "value": 80
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 4,
+                  "y": 5
+               },
+               "id": 11,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "max(ceph_node_proxy_temperature_celsius{sensor_name=~\"NVME.*_TEMP\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "NVMe Temp",
+               "transparent": false,
+               "type": "stat"
+            }
+         ],
+         "repeat": null,
+         "repeatIteration": null,
+         "repeatRowId": null,
+         "showTitle": true,
+         "title": "Overview",
+         "titleSize": "h6",
+         "type": "row"
+      },
+      {
+         "collapse": true,
+         "collapsed": true,
+         "gridPos": {
+            "h": 1,
+            "w": 24,
+            "x": 0,
+            "y": 1
+         },
+         "id": 12,
+         "panels": [
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "mappings": [
+                        {
+                           "options": {
+                              "0": {
+                                 "color": "green",
+                                 "index": 0,
+                                 "text": "OK"
+                              }
+                           },
+                           "type": "value"
+                        },
+                        {
+                           "options": {
+                              "from": 1,
+                              "result": {
+                                 "color": "red",
+                                 "index": 1,
+                                 "text": "NOT OK"
+                              },
+                              "to": 9999
+                           },
+                           "type": "range"
+                        }
+                     ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "red",
+                              "value": 1
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 3,
+                  "w": 2,
+                  "x": 0,
+                  "y": 2
+               },
+               "id": 13,
+               "links": [ ],
+               "options": {
+                  "colorMode": "background_solid",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"power\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Power",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "celsius"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 2,
+                  "y": 2
+               },
+               "id": 14,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "max(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "MB Temperature (max)",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "celsius"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 5,
+                  "y": 2
+               },
+               "id": 15,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "avg(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "CPU Temperature",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "celsius"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 8,
+                  "y": 2
+               },
+               "id": 16,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "max(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "DIMM Temperature (max)",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 11,
+                  "y": 2
+               },
+               "id": 17,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "count(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "PSU Fans",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "celsius"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 14,
+                  "y": 2
+               },
+               "id": 18,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "avg(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"PSU.*_TEMP.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "AVG PSU Temperature",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 17,
+                  "y": 2
+               },
+               "id": 19,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "count(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "NVMe Drives",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "celsius"
+                  }
+               },
+               "gridPos": {
+                  "h": 4,
+                  "w": 3,
+                  "x": 20,
+                  "y": 2
+               },
+               "id": 20,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "max(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "NVMe Temperature (max)",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "mappings": [
+                        {
+                           "options": {
+                              "0": {
+                                 "color": "green",
+                                 "index": 0,
+                                 "text": "OK"
+                              }
+                           },
+                           "type": "value"
+                        },
+                        {
+                           "options": {
+                              "from": 1,
+                              "result": {
+                                 "color": "red",
+                                 "index": 1,
+                                 "text": "NOT OK"
+                              },
+                              "to": 9999
+                           },
+                           "type": "range"
+                        }
+                     ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "red",
+                              "value": 1
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 3,
+                  "w": 2,
+                  "x": 0,
+                  "y": 5
+               },
+               "id": 21,
+               "links": [ ],
+               "options": {
+                  "colorMode": "background_solid",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"power\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Power Control",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "mappings": [
+                        {
+                           "options": {
+                              "0": {
+                                 "color": "green",
+                                 "index": 0,
+                                 "text": "OK"
+                              }
+                           },
+                           "type": "value"
+                        },
+                        {
+                           "options": {
+                              "from": 1,
+                              "result": {
+                                 "color": "red",
+                                 "index": 1,
+                                 "text": "NOT OK"
+                              },
+                              "to": 9999
+                           },
+                           "type": "range"
+                        }
+                     ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "red",
+                              "value": 1
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 3,
+                  "w": 2,
+                  "x": 0,
+                  "y": 8
+               },
+               "id": 22,
+               "links": [ ],
+               "options": {
+                  "colorMode": "background_solid",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"fans\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Cooling",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "mappings": [
+                        {
+                           "options": {
+                              "0": {
+                                 "color": "green",
+                                 "index": 0,
+                                 "text": "OK"
+                              }
+                           },
+                           "type": "value"
+                        },
+                        {
+                           "options": {
+                              "from": 1,
+                              "result": {
+                                 "color": "red",
+                                 "index": 1,
+                                 "text": "NOT OK"
+                              },
+                              "to": 9999
+                           },
+                           "type": "range"
+                        }
+                     ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "red",
+                              "value": 1
+                           }
+                        ]
+                     }
+                  }
+               },
+               "gridPos": {
+                  "h": 3,
+                  "w": 2,
+                  "x": 0,
+                  "y": 11
+               },
+               "id": 23,
+               "links": [ ],
+               "options": {
+                  "colorMode": "background_solid",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"storage\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "title": "Drives",
+               "transparent": false,
+               "type": "stat"
+            }
+         ],
+         "repeat": null,
+         "repeatIteration": null,
+         "repeatRowId": null,
+         "showTitle": true,
+         "title": "Host Overview: $hostname",
+         "titleSize": "h6",
+         "type": "row"
+      },
+      {
+         "collapse": true,
+         "collapsed": true,
+         "gridPos": {
+            "h": 1,
+            "w": 24,
+            "x": 0,
+            "y": 2
+         },
+         "id": 24,
+         "panels": [
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 5,
+                  "w": 4,
+                  "x": 0,
+                  "y": 3
+               },
+               "id": 25,
+               "links": [ ],
+               "maxPerRow": 6,
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "repeat": "fan_speeds",
+               "repeatDirection": "h",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_fan_rpm{hostname=~\"$hostname\",fan_name=~\"$fan_speeds\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "{{fan_name}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "FAN: $fan_speeds (RPM)",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 5,
+                  "w": 4,
+                  "x": 0,
+                  "y": 8
+               },
+               "id": 26,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_fan_rpm{hostname=~\"$hostname\",fan_name=~\"PSU1.*\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "{{fan_name}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "PSU1 Fan Speed (RPM)",
+               "transparent": false,
+               "type": "stat"
+            },
+            {
+               "colors": null,
+               "datasource": "$datasource",
+               "description": "",
+               "fieldConfig": {
+                  "defaults": {
+                     "decimals": 0,
+                     "links": [ ],
+                     "mappings": [ ],
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [ ]
+                     },
+                     "unit": "short"
+                  }
+               },
+               "gridPos": {
+                  "h": 5,
+                  "w": 4,
+                  "x": 4,
+                  "y": 8
+               },
+               "id": 27,
+               "links": [ ],
+               "options": {
+                  "colorMode": "none",
+                  "graphMode": "none",
+                  "justifyMode": "auto",
+                  "orientation": "horizontal",
+                  "reduceOptions": {
+                     "calcs": [
+                        "lastNotNull"
+                     ],
+                     "fields": "",
+                     "values": false
+                  },
+                  "textMode": "auto"
+               },
+               "pluginVersion": "9.1.3",
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_fan_rpm{hostname=~\"$hostname\",fan_name=~\"PSU2.*\"}",
+                     "format": "time_series",
+                     "intervalFactor": 1,
+                     "legendFormat": "{{fan_name}}",
+                     "refId": "A"
+                  }
+               ],
+               "title": "PSU2 Fan Speed (RPM)",
+               "transparent": false,
+               "type": "stat"
+            }
+         ],
+         "repeat": null,
+         "repeatIteration": null,
+         "repeatRowId": null,
+         "showTitle": true,
+         "title": "FAN Speeds: $hostname",
+         "titleSize": "h6",
+         "type": "row"
+      },
+      {
+         "collapse": true,
+         "collapsed": true,
+         "gridPos": {
+            "h": 1,
+            "w": 24,
+            "x": 0,
+            "y": 3
+         },
+         "id": 28,
+         "panels": [
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 0,
+                  "y": 4
+               },
+               "id": 29,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [
+                  {
+                     "alias": "Critical",
+                     "color": "dark-red",
+                     "dashes": true,
+                     "fill": 0
+                  }
+               ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"}",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "{{sensor_name}}",
+                     "refId": "A"
+                  },
+                  {
+                     "expr": "vector(100)",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "Critical",
+                     "refId": "B"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "CPU Temperature",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "min": 0
+                  },
+                  { }
+               ]
+            },
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 12,
+                  "y": 4
+               },
+               "id": 30,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [
+                  {
+                     "alias": "Critical",
+                     "color": "dark-red",
+                     "dashes": true,
+                     "fill": 0
+                  }
+               ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"}",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "{{sensor_name}}",
+                     "refId": "A"
+                  },
+                  {
+                     "expr": "vector(88)",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "Critical",
+                     "refId": "B"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "DIMM Temperatures",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "min": 0
+                  },
+                  { }
+               ]
+            },
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 0,
+                  "y": 12
+               },
+               "id": 31,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [
+                  {
+                     "alias": "Critical",
+                     "color": "dark-red",
+                     "dashes": true,
+                     "fill": 0
+                  }
+               ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"}",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "{{sensor_name}}",
+                     "refId": "A"
+                  },
+                  {
+                     "expr": "vector(85)",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "Critical",
+                     "refId": "B"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "Motherboard Temperatures",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "min": 0
+                  },
+                  { }
+               ]
+            },
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 12,
+                  "y": 12
+               },
+               "id": 32,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [
+                  {
+                     "alias": "Critical",
+                     "color": "dark-red",
+                     "dashes": true,
+                     "fill": 0
+                  }
+               ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*_TEMP\"}",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "{{sensor_name}}",
+                     "refId": "A"
+                  },
+                  {
+                     "expr": "vector(85)",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "Critical",
+                     "refId": "B"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "NVMe Temperatures",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "min": 0
+                  },
+                  { }
+               ]
+            }
+         ],
+         "repeat": null,
+         "repeatIteration": null,
+         "repeatRowId": null,
+         "showTitle": true,
+         "title": "Temperature History: $hostname",
+         "titleSize": "h6",
+         "type": "row"
+      },
+      {
+         "collapse": true,
+         "collapsed": true,
+         "gridPos": {
+            "h": 1,
+            "w": 24,
+            "x": 0,
+            "y": 4
+         },
+         "id": 33,
+         "panels": [
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "description": "AVG across both PSUs",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 0,
+                  "y": 5
+               },
+               "id": 34,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [ ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "avg(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "PSU Fans",
+                     "refId": "A"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "AVG PSU Fan Speed",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "format": "short",
+                     "label": null,
+                     "logBase": 1,
+                     "max": null,
+                     "min": null,
+                     "show": true
+                  },
+                  {
+                     "format": "short",
+                     "label": null,
+                     "logBase": 1,
+                     "max": null,
+                     "min": null,
+                     "show": true
+                  }
+               ]
+            },
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 12,
+                  "y": 5
+               },
+               "id": 35,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [ ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "avg(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name=~\".*TACH.*\"})",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "System Fans",
+                     "refId": "A"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "AVG Cooling Fan Speed",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "format": "short",
+                     "label": null,
+                     "logBase": 1,
+                     "max": null,
+                     "min": null,
+                     "show": true
+                  },
+                  {
+                     "format": "short",
+                     "label": null,
+                     "logBase": 1,
+                     "max": null,
+                     "min": null,
+                     "show": true
+                  }
+               ]
+            }
+         ],
+         "repeat": null,
+         "repeatIteration": null,
+         "repeatRowId": null,
+         "showTitle": true,
+         "title": "FAN Speed History: $hostname",
+         "titleSize": "h6",
+         "type": "row"
+      }
+   ],
+   "refresh": "10s",
+   "rows": [ ],
+   "schemaVersion": 22,
+   "style": "dark",
+   "tags": [
+      "ceph-mixin"
+   ],
+   "templating": {
+      "list": [
+         {
+            "current": {
+               "text": "default",
+               "value": "default"
+            },
+            "hide": 0,
+            "label": "Data Source",
+            "name": "datasource",
+            "options": [ ],
+            "query": "prometheus",
+            "refresh": 1,
+            "regex": "",
+            "type": "datasource"
+         },
+         {
+            "allValue": null,
+            "current": { },
+            "datasource": "$datasource",
+            "hide": 0,
+            "includeAll": false,
+            "label": "cluster",
+            "multi": false,
+            "name": "cluster",
+            "options": [ ],
+            "query": "label_values(ceph_health_status, cluster)",
+            "refresh": 1,
+            "regex": "(.*)",
+            "sort": 1,
+            "tagValuesQuery": "",
+            "tags": [ ],
+            "tagsQuery": "",
+            "type": "query",
+            "useTags": false
+         },
+         {
+            "allValue": null,
+            "current": { },
+            "datasource": "$datasource",
+            "hide": 0,
+            "includeAll": false,
+            "label": "Host",
+            "multi": false,
+            "name": "hostname",
+            "options": [ ],
+            "query": "label_values(ceph_node_proxy_health, hostname)",
+            "refresh": 1,
+            "regex": "",
+            "sort": 1,
+            "tagValuesQuery": "",
+            "tags": [ ],
+            "tagsQuery": "",
+            "type": "query",
+            "useTags": false
+         },
+         {
+            "allValue": "",
+            "current": { },
+            "datasource": "$datasource",
+            "hide": 2,
+            "includeAll": true,
+            "label": "",
+            "multi": false,
+            "name": "fan_speeds",
+            "options": [ ],
+            "query": "label_values(ceph_node_proxy_fan_rpm{hostname=\"$hostname\"},fan_name)",
+            "refresh": 1,
+            "regex": "/.*TACH.*/",
+            "sort": 0,
+            "tagValuesQuery": "",
+            "tags": [ ],
+            "tagsQuery": "",
+            "type": "query",
+            "useTags": false
+         }
+      ]
+   },
+   "time": {
+      "from": "now-1h",
+      "to": "now"
+   },
+   "timepicker": {
+      "refresh_intervals": [
+         "5s",
+         "10s",
+         "30s",
+         "1m",
+         "5m",
+         "15m",
+         "30m",
+         "1h",
+         "2h",
+         "1d"
+      ],
+      "time_options": [
+         "5m",
+         "15m",
+         "1h",
+         "6h",
+         "12h",
+         "24h",
+         "2d",
+         "7d",
+         "30d"
+      ]
+   },
+   "timezone": "",
+   "title": "Ceph Hardware - Platform Monitoring",
+   "uid": "hardware001",
+   "version": 0
+}
diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index dbdb1e7b1fa..7e334b8d633 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -2066,7 +2066,7 @@ class Module(MgrModule, OrchestratorClientMixin):
     @profile_method(True)
     def get_hardware_metrics(self) -> None:
         """Collect hardware metrics from node-proxy KV store"""
-        NODE_PROXY_CACHE_PREFIX = 'node_proxy'
+        NODE_PROXY_CACHE_PREFIX = 'mgr/cephadm/node_proxy'
 
         try:
             for key, value in self.get_store_prefix(f'{NODE_PROXY_CACHE_PREFIX}/data').items():

From 6bb07c6e5393daeb72fe0cf3832955721e7b4b18 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Thu, 25 Jun 2026 13:43:38 +0530
Subject: [PATCH 507/596] mgr/prometheus: use orchestrator API for node-proxy
 hardware metrics

The hardware metrics exporter was reading cephadm's private KV store
directly via get_store_prefix('mgr/cephadm/node_proxy/data'). This
had two problems:

1. get_store_prefix() is module-scoped, so from the prometheus module
   it searched under prometheus's own namespace instead of cephadm's,
   resulting in zero metrics being exported despite metric definitions
   appearing at /metrics.

2. The firmware key was accessed as 'firmwares' (plural) but the
   stored field is 'firmware' (singular), causing all firmware version
   metrics to be silently empty.

Use node_proxy_fullreport() and node_proxy_firmware() via the
OrchestratorClientMixin instead. This routes through cephadm's
NodeProxyCache which handles KV access and firmware key compat
correctly. Follows the same pattern as set_cephadm_daemon_status_metrics()
and get_smb_metadata().

Signed-off-by: Afreen Misbah <afreen@ibm.com>
Assisted-by: Claude
Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 src/pybind/mgr/prometheus/module.py | 193 +++++++++++++---------------
 1 file changed, 90 insertions(+), 103 deletions(-)

diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index 7e334b8d633..f2d8a230611 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -2065,112 +2065,99 @@ class Module(MgrModule, OrchestratorClientMixin):
 
     @profile_method(True)
     def get_hardware_metrics(self) -> None:
-        """Collect hardware metrics from node-proxy KV store"""
-        NODE_PROXY_CACHE_PREFIX = 'mgr/cephadm/node_proxy'
+        if not self.orch_is_available():
+            return
 
         try:
-            for key, value in self.get_store_prefix(f'{NODE_PROXY_CACHE_PREFIX}/data').items():
-                host = key.split('/')[-1]
-                try:
-                    data = json.loads(value)
-                except json.JSONDecodeError:
-                    self.log.error(f"Failed to decode node-proxy data for host {host}")
-                    continue
-
-                status = data.get('status', {})
-
-                # Storage metrics
-                for sys_id, devices in status.get('storage', {}).items():
-                    for device_id, device in devices.items():
-                        capacity = device.get('capacity_bytes', 0)
-                        labels = (
-                            host,
-                            device_id,
-                            device.get('model', 'unknown'),
-                            device.get('protocol', 'unknown')
-                        )
-                        self.metrics['node_proxy_storage_capacity_bytes'].set(capacity, labels)
-
-                # CPU metrics
-                for sys_id, cpus in status.get('processors', {}).items():
-                    for cpu_id, cpu in cpus.items():
-                        cores = cpu.get('total_cores', 0)
-                        labels = (
-                            host,
-                            cpu_id,
-                            cpu.get('manufacturer', 'unknown'),
-                            cpu.get('model', 'unknown')
-                        )
-                        self.metrics['node_proxy_cpu_cores'].set(cores, labels)
-
-                # Memory metrics
-                for sys_id, dimms in status.get('memory', {}).items():
-                    for dimm_id, dimm in dimms.items():
-                        capacity = dimm.get('capacity_mi_b', 0)
-                        labels = (
-                            host,
-                            dimm_id,
-                            dimm.get('memory_device_type', 'unknown'),
-                            dimm.get('manufacturer', 'unknown')
-                        )
-                        self.metrics['node_proxy_memory_capacity_mib'].set(capacity, labels)
-
-                # Health metrics for all component types
-                for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network']:
-                    for sys_id, components in status.get(category, {}).items():
-                        for comp_id, comp in components.items():
-                            health_str = comp.get('status', {}).get('health', 'Unknown')
-                            if health_str == 'OK':
-                                health_value = 0
-                            elif health_str in ['Warning', 'Degraded']:
-                                health_value = 1
-                            else:
-                                health_value = 2
-
-                            labels = (host, comp_id, category)
-                            self.metrics['node_proxy_health'].set(health_value, labels)
-
-                # Temperature metrics
-                for sys_id, sensors in status.get('temperatures', {}).items():
-                    for sensor_id, sensor in sensors.items():
-                        reading = sensor.get('reading')
-                        sensor_name = sensor.get('name', sensor_id)
-                        # Skip absent/unknown sensors
-                        if reading is None or reading == 'unknown':
-                            continue
-                        try:
-                            temp_value = float(reading)
-                            labels = (host, sensor_name)
-                            self.metrics['node_proxy_temperature_celsius'].set(temp_value, labels)
-                        except (ValueError, TypeError):
-                            continue
-
-                # Fan RPM metrics
-                for sys_id, fans_data in status.get('fans', {}).items():
-                    for fan_id, fan in fans_data.items():
-                        # Redfish uses 'Reading' field per Thermal schema
-                        # node-proxy normalizes it to lowercase 'reading'
-                        rpm = fan.get('reading')
-                        fan_name = fan.get('name', fan_id)
-                        if rpm is None or rpm == 'unknown':
-                            continue
-                        try:
-                            rpm_value = float(rpm)
-                            labels = (host, fan_name)
-                            self.metrics['node_proxy_fan_rpm'].set(rpm_value, labels)
-                        except (ValueError, TypeError):
-                            continue
-
-                # Firmware version metrics
-                firmwares = data.get('firmwares', {})
-                for fw_id, fw_info in firmwares.items():
-                    component = fw_info.get('name', fw_id)
-                    version = fw_info.get('version', 'unknown')
-                    if version and version != 'unknown':
-                        labels = (host, component, str(version))
-                        self.metrics['node_proxy_firmware_info'].set(1, labels)
+            report = raise_if_exception(self.node_proxy_fullreport())
+            firmware_report = raise_if_exception(self.node_proxy_firmware())
         except Exception as e:
-            self.log.error(f"Failed to collect hardware metrics: {str(e)}")
+            self.log.debug(f"node-proxy data not available: {e}")
+            return
+
+        for host, data in report.items():
+            status = data.get('status', {})
+
+            for sys_id, devices in status.get('storage', {}).items():
+                for device_id, device in devices.items():
+                    capacity = device.get('capacity_bytes', 0)
+                    labels = (
+                        host,
+                        device_id,
+                        device.get('model', 'unknown'),
+                        device.get('protocol', 'unknown')
+                    )
+                    self.metrics['node_proxy_storage_capacity_bytes'].set(capacity, labels)
+
+            for sys_id, cpus in status.get('processors', {}).items():
+                for cpu_id, cpu in cpus.items():
+                    cores = cpu.get('total_cores', 0)
+                    labels = (
+                        host,
+                        cpu_id,
+                        cpu.get('manufacturer', 'unknown'),
+                        cpu.get('model', 'unknown')
+                    )
+                    self.metrics['node_proxy_cpu_cores'].set(cores, labels)
+
+            for sys_id, dimms in status.get('memory', {}).items():
+                for dimm_id, dimm in dimms.items():
+                    capacity = dimm.get('capacity_mi_b', 0)
+                    labels = (
+                        host,
+                        dimm_id,
+                        dimm.get('memory_device_type', 'unknown'),
+                        dimm.get('manufacturer', 'unknown')
+                    )
+                    self.metrics['node_proxy_memory_capacity_mib'].set(capacity, labels)
+
+            for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network']:
+                for sys_id, components in status.get(category, {}).items():
+                    for comp_id, comp in components.items():
+                        health_str = comp.get('status', {}).get('health', 'Unknown')
+                        if health_str == 'OK':
+                            health_value = 0
+                        elif health_str in ['Warning', 'Degraded']:
+                            health_value = 1
+                        else:
+                            health_value = 2
+
+                        labels = (host, comp_id, category)
+                        self.metrics['node_proxy_health'].set(health_value, labels)
+
+            for sys_id, sensors in status.get('temperatures', {}).items():
+                for sensor_id, sensor in sensors.items():
+                    reading = sensor.get('reading')
+                    sensor_name = sensor.get('name', sensor_id)
+                    if reading is None or reading == 'unknown':
+                        continue
+                    try:
+                        temp_value = float(reading)
+                        labels = (host, sensor_name)
+                        self.metrics['node_proxy_temperature_celsius'].set(temp_value, labels)
+                    except (ValueError, TypeError):
+                        continue
+
+            for sys_id, fans_data in status.get('fans', {}).items():
+                for fan_id, fan in fans_data.items():
+                    rpm = fan.get('reading')
+                    fan_name = fan.get('name', fan_id)
+                    if rpm is None or rpm == 'unknown':
+                        continue
+                    try:
+                        rpm_value = float(rpm)
+                        labels = (host, fan_name)
+                        self.metrics['node_proxy_fan_rpm'].set(rpm_value, labels)
+                    except (ValueError, TypeError):
+                        continue
+
+        for host, fw_data in firmware_report.items():
+            for fw_id, fw_info in fw_data.items():
+                component = fw_info.get('name', fw_id)
+                version = fw_info.get('version', 'unknown')
+                if version and version != 'unknown':
+                    labels = (host, component, str(version))
+                    self.metrics['node_proxy_firmware_info'].set(1, labels)
 
     @profile_method(True)
     def collect(self) -> str:

From 04207ca6dcfc86c51845912848d9cbf1a7cb87d0 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Thu, 25 Jun 2026 13:48:19 +0530
Subject: [PATCH 508/596] monitoring: fix hardware Grafana dashboard and health
 metrics

- Fix fan repeating panels: set multi=true on fan_speeds template
  variable so Grafana generates one panel per fan instead of one
- Remove TACH-only regex filter on fan_speeds template and AVG
  Cooling query so all system fans are visible regardless of naming
- Replace duplicate Power Control panel with Network health panel
- Fix NVMe drive count to use storage_capacity_bytes{protocol=NVMe}
  instead of counting temperature sensors (inaccurate proxy)
- Normalize all hostname filters to regex match (=~) for consistency
- Register hardware.libsonnet in dashboards.libsonnet so the
  dashboard JSON is generated during ceph-mixin builds
- Add temperatures category to prometheus health metrics loop

Signed-off-by: Afreen Misbah <afreen@ibm.com>
Assisted-by: Claude
Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 monitoring/ceph-mixin/dashboards.libsonnet    |  1 +
 .../ceph-mixin/dashboards/hardware.libsonnet  | 22 +++++++++----------
 .../ceph-mixin/dashboards_out/hardware.json   | 20 ++++++++---------
 src/pybind/mgr/prometheus/module.py           |  2 +-
 4 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/monitoring/ceph-mixin/dashboards.libsonnet b/monitoring/ceph-mixin/dashboards.libsonnet
index ebd8c1bfc34..edb8078784b 100644
--- a/monitoring/ceph-mixin/dashboards.libsonnet
+++ b/monitoring/ceph-mixin/dashboards.libsonnet
@@ -12,5 +12,6 @@
     (import 'dashboards/smb-overview.libsonnet') +
     (import 'dashboards/ceph-nvmeof.libsonnet') +
     (import 'dashboards/ceph-nvmeof-performance.libsonnet') +
+    (import 'dashboards/hardware.libsonnet') +
     { _config:: $._config },
 }
diff --git a/monitoring/ceph-mixin/dashboards/hardware.libsonnet b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
index 6d38bd2a441..f3886e008cb 100644
--- a/monitoring/ceph-mixin/dashboards/hardware.libsonnet
+++ b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
@@ -59,14 +59,14 @@ local g = import 'grafonnet/grafana.libsonnet';
       g.template.new(
         'fan_speeds',
         '$datasource',
-        'label_values(ceph_node_proxy_fan_rpm{hostname="$hostname"},fan_name)',
+        'label_values(ceph_node_proxy_fan_rpm{hostname=~"$hostname"},fan_name)',
         label='',
         refresh='load',
         includeAll=true,
-        multi=false,
+        multi=true,
         allValues='',
         sort=0,
-        regex='/.*TACH.*/',
+        regex='',
         hide=2
       )
     )
@@ -275,7 +275,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 2 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname="$hostname",category="power"}',
+          'ceph_node_proxy_health{hostname=~"$hostname",category="power"}',
           legendFormat='__auto'
         ))
         + {
@@ -353,7 +353,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 17, y: 2 }
         ).addTarget($.addTargetSchema(
-          'count(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*"})',
+          'count(ceph_node_proxy_storage_capacity_bytes{hostname=~"$hostname", protocol="NVMe"})',
           legendFormat='__auto'
         )),
 
@@ -368,14 +368,14 @@ local g = import 'grafonnet/grafana.libsonnet';
           legendFormat='__auto'
         )),
 
-        // Power Control
+        // Network
         $.addStatPanel(
-          title='Power Control',
+          title='Network',
           unit='short',
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 5 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname="$hostname",category="power"}',
+          'ceph_node_proxy_health{hostname=~"$hostname",category="network"}',
           legendFormat='__auto'
         ))
         + {
@@ -398,7 +398,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 8 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname="$hostname",category="fans"}',
+          'ceph_node_proxy_health{hostname=~"$hostname",category="fans"}',
           legendFormat='__auto'
         ))
         + {
@@ -421,7 +421,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 11 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname="$hostname",category="storage"}',
+          'ceph_node_proxy_health{hostname=~"$hostname",category="storage"}',
           legendFormat='__auto'
         ))
         + {
@@ -591,7 +591,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           format='short',
         ).addTarget(
           g.prometheus.target(
-            'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~".*TACH.*"})',
+            'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name!~"PSU.*"})',
             legendFormat='System Fans'
           )
         )
diff --git a/monitoring/ceph-mixin/dashboards_out/hardware.json b/monitoring/ceph-mixin/dashboards_out/hardware.json
index 2691c71890d..94db72377a3 100644
--- a/monitoring/ceph-mixin/dashboards_out/hardware.json
+++ b/monitoring/ceph-mixin/dashboards_out/hardware.json
@@ -658,7 +658,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"power\"}",
+                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"power\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -970,7 +970,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "count(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*\"})",
+                     "expr": "count(ceph_node_proxy_storage_capacity_bytes{hostname=~\"$hostname\", protocol=\"NVMe\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1102,14 +1102,14 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"power\"}",
+                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"network\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
                      "refId": "A"
                   }
                ],
-               "title": "Power Control",
+               "title": "Network",
                "transparent": false,
                "type": "stat"
             },
@@ -1182,7 +1182,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"fans\"}",
+                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"fans\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1262,7 +1262,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=\"$hostname\",category=\"storage\"}",
+                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"storage\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1968,7 +1968,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "avg(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name=~\".*TACH.*\"})",
+                     "expr": "avg(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name!~\"PSU.*\"})",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "System Fans",
@@ -2091,12 +2091,12 @@
             "hide": 2,
             "includeAll": true,
             "label": "",
-            "multi": false,
+            "multi": true,
             "name": "fan_speeds",
             "options": [ ],
-            "query": "label_values(ceph_node_proxy_fan_rpm{hostname=\"$hostname\"},fan_name)",
+            "query": "label_values(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\"},fan_name)",
             "refresh": 1,
-            "regex": "/.*TACH.*/",
+            "regex": "",
             "sort": 0,
             "tagValuesQuery": "",
             "tags": [ ],
diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index f2d8a230611..45b14fe6502 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -2111,7 +2111,7 @@ class Module(MgrModule, OrchestratorClientMixin):
                     )
                     self.metrics['node_proxy_memory_capacity_mib'].set(capacity, labels)
 
-            for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network']:
+            for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network', 'temperatures']:
                 for sys_id, components in status.get(category, {}).items():
                     for comp_id, comp in components.items():
                         health_str = comp.get('status', {}).get('health', 'Unknown')

From ae0567e98a545f13b0c47c4b0e54220cf21e6eb5 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Fri, 26 Jun 2026 00:28:21 +0530
Subject: [PATCH 509/596] mgr/prometheus: Rename node_proxy_memory_capacity_mib
 to node_proxy_memory_capacity_bytes

Prometheus naming conventions require base units (bytes not MiB)

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 src/pybind/mgr/prometheus/module.py | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index 45b14fe6502..06002b7b195 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -145,6 +145,7 @@ NODE_PROXY_STORAGE_LABELS = ('hostname', 'device', 'model', 'protocol')
 NODE_PROXY_CPU_LABELS = ('hostname', 'cpu', 'manufacturer', 'model')
 
 NODE_PROXY_MEMORY_LABELS = ('hostname', 'dimm', 'type', 'manufacturer')
+MIB_TO_BYTES = 1048576
 
 NODE_PROXY_HEALTH_LABELS = ('hostname', 'component', 'category')
 
@@ -1026,10 +1027,10 @@ class Module(MgrModule, OrchestratorClientMixin):
             NODE_PROXY_CPU_LABELS
         )
 
-        metrics['node_proxy_memory_capacity_mib'] = Metric(
+        metrics['node_proxy_memory_capacity_bytes'] = Metric(
             'gauge',
-            'node_proxy_memory_capacity_mib',
-            'Memory capacity in MiB',
+            'node_proxy_memory_capacity_bytes',
+            'Memory capacity in bytes',
             NODE_PROXY_MEMORY_LABELS
         )
 
@@ -2102,19 +2103,29 @@ class Module(MgrModule, OrchestratorClientMixin):
 
             for sys_id, dimms in status.get('memory', {}).items():
                 for dimm_id, dimm in dimms.items():
-                    capacity = dimm.get('capacity_mi_b', 0)
+                    capacity_mib = dimm.get('capacity_mi_b', 0)
+                    capacity_bytes = capacity_mib * MIB_TO_BYTES
                     labels = (
                         host,
                         dimm_id,
                         dimm.get('memory_device_type', 'unknown'),
                         dimm.get('manufacturer', 'unknown')
                     )
-                    self.metrics['node_proxy_memory_capacity_mib'].set(capacity, labels)
+                    self.metrics['node_proxy_memory_capacity_bytes'].set(capacity_bytes, labels)
 
             for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network', 'temperatures']:
                 for sys_id, components in status.get(category, {}).items():
                     for comp_id, comp in components.items():
-                        health_str = comp.get('status', {}).get('health', 'Unknown')
+                        if not isinstance(comp, dict):
+                            continue
+                        status_val = comp.get('status', {})
+                        if isinstance(status_val, dict):
+                            health_str = status_val.get('health', 'Unknown')
+                        elif isinstance(status_val, str):
+                            health_str = status_val
+                        else:
+                            health_str = 'Unknown'
+
                         if health_str == 'OK':
                             health_value = 0
                         elif health_str in ['Warning', 'Degraded']:

From 5dd6807e3187ba6792f69736b5e4d396832b1686 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Fri, 26 Jun 2026 00:28:53 +0530
Subject: [PATCH 510/596] monitoring: improve hardware Grafana dashboard panels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- CPU/NVMe temp: change from stat to gauge panels with colored
  arc thresholds (green/yellow/red) and proper °C units
- Health panels: wrap queries in max() aggregation to show
  single worst-case value instead of overlapping series
- Pie charts: switch to donut style with visible legends
- Fan RPM: use locale unit for comma formatting instead of
  short which auto-scaled to "K"
- Fix temperature panels units
- Add Device List and Platform Firmware table panels

Fixes https://tracker.ceph.com/issues/77723

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-mixin/dashboards/hardware.libsonnet  | 189 +++++++++----
 .../ceph-mixin/dashboards_out/hardware.json   | 255 ++++++++++++++----
 2 files changed, 336 insertions(+), 108 deletions(-)

diff --git a/monitoring/ceph-mixin/dashboards/hardware.libsonnet b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
index f3886e008cb..1fd0c02f0ee 100644
--- a/monitoring/ceph-mixin/dashboards/hardware.libsonnet
+++ b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
@@ -3,7 +3,7 @@ local g = import 'grafonnet/grafana.libsonnet';
 (import 'utils.libsonnet') {
   'hardware.json':
     $.dashboardSchema(
-      'Ceph Hardware - Platform Monitoring',
+      'Ceph Hardware - Overview',
       'Comprehensive hardware monitoring with temperatures, fans, storage, and firmware from node-proxy',
       'hardware001',
       'now-1h',
@@ -31,7 +31,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         keepTime=true,
         tags=[],
         targetBlank=false,
-        title='Browse Dashboards',
+        title='Ceph Hardware - Overview',
         tooltip='',
         type='dashboards',
         url=''
@@ -101,27 +101,23 @@ local g = import 'grafonnet/grafana.libsonnet';
         },
 
         // CPU Temp
-        $.addStatPanel(
+        $.addGaugePanel(
           title='CPU Temp',
           unit='celsius',
           datasource='$datasource',
-          gridPosition={ h: 4, w: 3, x: 4, y: 1 }
-        ).addTarget($.addTargetSchema(
+          gridPosition={ h: 4, w: 3, x: 4, y: 1 },
+          min=0,
+          max=100,
+        )
+        .addThresholds([
+          { color: 'green' },
+          { color: '#EAB839', value: 75 },
+          { color: 'red', value: 85 },
+        ])
+        .addTarget($.addTargetSchema(
           'max(ceph_node_proxy_temperature_celsius{sensor_name=~".*CPU_TEMP"})',
           legendFormat='__auto'
-        ))
-        + {
-          fieldConfig: {
-            defaults: {
-              min: 0,
-              max: 100,
-              thresholds: {
-                mode: 'absolute',
-                steps: [{ color: 'green' }, { color: '#EAB839', value: 75 }, { color: 'red', value: 85 }],
-              },
-            },
-          },
-        },
+        )),
 
         // BMC Versions
         $.pieChartPanel(
@@ -136,14 +132,13 @@ local g = import 'grafonnet/grafana.libsonnet';
         + {
           fieldConfig+: {
             defaults+: {
-              color+: {
-                mode: 'palette-classic',
-              },
+              color+: { mode: 'palette-classic' },
             },
           },
           options+: {
-            legend+: { showLegend: false },
-            displayLabels: ['name'],
+            pieType: 'donut',
+            legend+: { showLegend: true, placement: 'bottom' },
+            displayLabels: ['name', 'value'],
           },
         },
 
@@ -160,14 +155,13 @@ local g = import 'grafonnet/grafana.libsonnet';
         + {
           fieldConfig+: {
             defaults+: {
-              color+: {
-                mode: 'palette-classic',
-              },
+              color+: { mode: 'palette-classic' },
             },
           },
           options+: {
-            legend+: { showLegend: false },
-            displayLabels: ['name'],
+            pieType: 'donut',
+            legend+: { showLegend: true, placement: 'bottom' },
+            displayLabels: ['name', 'value'],
           },
         },
 
@@ -184,12 +178,11 @@ local g = import 'grafonnet/grafana.libsonnet';
         + {
           fieldConfig+: {
             defaults+: {
-              color+: {
-                mode: 'palette-classic',
-              },
+              color+: { mode: 'palette-classic' },
             },
           },
           options+: {
+            pieType: 'donut',
             legend+: { showLegend: true, placement: 'right' },
             displayLabels: ['value'],
           },
@@ -209,12 +202,11 @@ local g = import 'grafonnet/grafana.libsonnet';
         + {
           fieldConfig+: {
             defaults+: {
-              color+: {
-                mode: 'palette-classic',
-              },
+              color+: { mode: 'palette-classic' },
             },
           },
           options+: {
+            pieType: 'donut',
             legend+: { showLegend: true, placement: 'right' },
             displayLabels: ['value'],
           },
@@ -243,27 +235,23 @@ local g = import 'grafonnet/grafana.libsonnet';
         )),
 
         // NVMe Temp
-        $.addStatPanel(
+        $.addGaugePanel(
           title='NVMe Temp',
           unit='celsius',
           datasource='$datasource',
-          gridPosition={ h: 4, w: 3, x: 4, y: 5 }
-        ).addTarget($.addTargetSchema(
+          gridPosition={ h: 4, w: 3, x: 4, y: 5 },
+          min=0,
+          max=85,
+        )
+        .addThresholds([
+          { color: 'green' },
+          { color: 'yellow', value: 75 },
+          { color: 'red', value: 80 },
+        ])
+        .addTarget($.addTargetSchema(
           'max(ceph_node_proxy_temperature_celsius{sensor_name=~"NVME.*_TEMP"})',
           legendFormat='__auto'
-        ))
-        + {
-          fieldConfig: {
-            defaults: {
-              min: 0,
-              max: 85,
-              thresholds: {
-                mode: 'absolute',
-                steps: [{ color: 'green' }, { color: 'yellow', value: 75 }, { color: 'red', value: 80 }],
-              },
-            },
-          },
-        },
+        )),
       ] },
 
       // Row 2: Host Overview
@@ -275,7 +263,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 2 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname=~"$hostname",category="power"}',
+          'max(ceph_node_proxy_health{hostname=~"$hostname",category="power"})',
           legendFormat='__auto'
         ))
         + {
@@ -375,7 +363,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 5 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname=~"$hostname",category="network"}',
+          'max(ceph_node_proxy_health{hostname=~"$hostname",category="network"})',
           legendFormat='__auto'
         ))
         + {
@@ -398,7 +386,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 8 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname=~"$hostname",category="fans"}',
+          'max(ceph_node_proxy_health{hostname=~"$hostname",category="fans"})',
           legendFormat='__auto'
         ))
         + {
@@ -421,7 +409,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 11 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_health{hostname=~"$hostname",category="storage"}',
+          'max(ceph_node_proxy_health{hostname=~"$hostname",category="storage"})',
           legendFormat='__auto'
         ))
         + {
@@ -436,6 +424,89 @@ local g = import 'grafonnet/grafana.libsonnet';
           },
           options+: { colorMode: 'background_solid' },
         },
+
+        // Device List
+        $.addTableExtended(
+          title='Device List',
+          datasource='$datasource',
+          gridPosition={ h: 8, w: 11, x: 2, y: 6 },
+          options={
+            footer: { show: false },
+            showHeader: true,
+          },
+          custom={ align: 'auto', cellOptions: { type: 'auto' }, filterable: false, inspect: false },
+          thresholds={
+            mode: 'absolute',
+            steps: [{ color: 'green', value: null }],
+          },
+        )
+        .addTarget($.addTargetSchema(
+          'ceph_node_proxy_storage_capacity_bytes{hostname=~"$hostname"}',
+          legendFormat='__auto',
+          instant=true
+        ) + { format: 'table' })
+        .addTransformations([
+          {
+            id: 'organize',
+            options: {
+              excludeByName: {
+                Time: true,
+                Value: true,
+                __name__: true,
+                cluster: true,
+                hostname: true,
+                job: true,
+                instance: true,
+              },
+              renameByName: {
+                device: 'Device Name',
+                model: 'Drive Model',
+                protocol: 'Protocol',
+              },
+            },
+          },
+        ]),
+
+        // Platform Firmware
+        $.addTableExtended(
+          title='Platform Firmware',
+          datasource='$datasource',
+          gridPosition={ h: 8, w: 11, x: 13, y: 6 },
+          options={
+            footer: { show: false },
+            showHeader: true,
+          },
+          custom={ align: 'auto', cellOptions: { type: 'auto' }, filterable: false, inspect: false },
+          thresholds={
+            mode: 'absolute',
+            steps: [{ color: 'green', value: null }],
+          },
+        )
+        .addTarget($.addTargetSchema(
+          'ceph_node_proxy_firmware_info{hostname=~"$hostname"}',
+          legendFormat='__auto',
+          instant=true
+        ) + { format: 'table' })
+        .addTransformations([
+          {
+            id: 'organize',
+            options: {
+              excludeByName: {
+                Time: true,
+                Value: true,
+                __name__: true,
+                cluster: true,
+                hostname: true,
+                job: true,
+                instance: true,
+              },
+              renameByName: {
+                component: 'Component',
+                version: 'Version',
+              },
+            },
+          },
+        ]),
       ] },
 
       // Row 3: FAN Speeds
@@ -443,7 +514,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         // Repeating panel
         $.addStatPanel(
           title='FAN: $fan_speeds (RPM)',
-          unit='short',
+          unit='locale',
           datasource='$datasource',
           gridPosition={ h: 5, w: 4, x: 0, y: 3 }
         ).addTarget($.addTargetSchema(
@@ -459,7 +530,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         // PSU1
         $.addStatPanel(
           title='PSU1 Fan Speed (RPM)',
-          unit='short',
+          unit='locale',
           datasource='$datasource',
           gridPosition={ h: 5, w: 4, x: 0, y: 8 }
         ).addTarget($.addTargetSchema(
@@ -470,7 +541,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         // PSU2
         $.addStatPanel(
           title='PSU2 Fan Speed (RPM)',
-          unit='short',
+          unit='locale',
           datasource='$datasource',
           gridPosition={ h: 5, w: 4, x: 4, y: 8 }
         ).addTarget($.addTargetSchema(
@@ -572,7 +643,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         g.graphPanel.new(
           title='AVG PSU Fan Speed',
           datasource='$datasource',
-          format='short',
+          format='none',
         ).addTarget(
           g.prometheus.target(
             'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
@@ -588,7 +659,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         g.graphPanel.new(
           title='AVG Cooling Fan Speed',
           datasource='$datasource',
-          format='short',
+          format='none',
         ).addTarget(
           g.prometheus.target(
             'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name!~"PSU.*"})',
diff --git a/monitoring/ceph-mixin/dashboards_out/hardware.json b/monitoring/ceph-mixin/dashboards_out/hardware.json
index 94db72377a3..b6afffb16fc 100644
--- a/monitoring/ceph-mixin/dashboards_out/hardware.json
+++ b/monitoring/ceph-mixin/dashboards_out/hardware.json
@@ -30,7 +30,7 @@
          "keepTime": true,
          "tags": [ ],
          "targetBlank": false,
-         "title": "Browse Dashboards",
+         "title": "Ceph Hardware - Overview",
          "tooltip": "",
          "type": "dashboards",
          "url": ""
@@ -129,11 +129,12 @@
                "type": "stat"
             },
             {
-               "colors": null,
                "datasource": "$datasource",
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "links": [ ],
+                     "mappings": [ ],
                      "max": 100,
                      "min": 0,
                      "thresholds": {
@@ -151,7 +152,8 @@
                               "value": 85
                            }
                         ]
-                     }
+                     },
+                     "unit": "celsius"
                   }
                },
                "gridPos": {
@@ -161,12 +163,10 @@
                   "y": 1
                },
                "id": 4,
+               "interval": "1m",
                "links": [ ],
+               "maxDataPoints": 100,
                "options": {
-                  "colorMode": "none",
-                  "graphMode": "none",
-                  "justifyMode": "auto",
-                  "orientation": "horizontal",
                   "reduceOptions": {
                      "calcs": [
                         "lastNotNull"
@@ -174,7 +174,8 @@
                      "fields": "",
                      "values": false
                   },
-                  "textMode": "auto"
+                  "showThresholdLabels": false,
+                  "showThresholdMarkers": true
                },
                "pluginVersion": "9.1.3",
                "targets": [
@@ -188,7 +189,7 @@
                ],
                "title": "CPU Temp",
                "transparent": false,
-               "type": "stat"
+               "type": "gauge"
             },
             {
                "datasource": "$datasource",
@@ -218,16 +219,17 @@
                "id": 5,
                "options": {
                   "displayLabels": [
-                     "name"
+                     "name",
+                     "value"
                   ],
                   "legend": {
                      "calcs": [ ],
                      "displayMode": "table",
                      "placement": "bottom",
-                     "showLegend": false,
+                     "showLegend": true,
                      "values": [ ]
                   },
-                  "pieType": "pie",
+                  "pieType": "donut",
                   "reduceOptions": { },
                   "tooltip": { }
                },
@@ -271,16 +273,17 @@
                "id": 6,
                "options": {
                   "displayLabels": [
-                     "name"
+                     "name",
+                     "value"
                   ],
                   "legend": {
                      "calcs": [ ],
                      "displayMode": "table",
                      "placement": "bottom",
-                     "showLegend": false,
+                     "showLegend": true,
                      "values": [ ]
                   },
-                  "pieType": "pie",
+                  "pieType": "donut",
                   "reduceOptions": { },
                   "tooltip": { }
                },
@@ -333,7 +336,7 @@
                      "showLegend": true,
                      "values": [ ]
                   },
-                  "pieType": "pie",
+                  "pieType": "donut",
                   "reduceOptions": { },
                   "tooltip": { }
                },
@@ -386,7 +389,7 @@
                      "showLegend": true,
                      "values": [ ]
                   },
-                  "pieType": "pie",
+                  "pieType": "donut",
                   "reduceOptions": { },
                   "tooltip": { }
                },
@@ -508,11 +511,12 @@
                "type": "stat"
             },
             {
-               "colors": null,
                "datasource": "$datasource",
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "links": [ ],
+                     "mappings": [ ],
                      "max": 85,
                      "min": 0,
                      "thresholds": {
@@ -530,7 +534,8 @@
                               "value": 80
                            }
                         ]
-                     }
+                     },
+                     "unit": "celsius"
                   }
                },
                "gridPos": {
@@ -540,12 +545,10 @@
                   "y": 5
                },
                "id": 11,
+               "interval": "1m",
                "links": [ ],
+               "maxDataPoints": 100,
                "options": {
-                  "colorMode": "none",
-                  "graphMode": "none",
-                  "justifyMode": "auto",
-                  "orientation": "horizontal",
                   "reduceOptions": {
                      "calcs": [
                         "lastNotNull"
@@ -553,7 +556,8 @@
                      "fields": "",
                      "values": false
                   },
-                  "textMode": "auto"
+                  "showThresholdLabels": false,
+                  "showThresholdMarkers": true
                },
                "pluginVersion": "9.1.3",
                "targets": [
@@ -567,7 +571,7 @@
                ],
                "title": "NVMe Temp",
                "transparent": false,
-               "type": "stat"
+               "type": "gauge"
             }
          ],
          "repeat": null,
@@ -658,7 +662,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"power\"}",
+                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"power\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1102,7 +1106,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"network\"}",
+                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"network\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1182,7 +1186,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"fans\"}",
+                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"fans\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1262,7 +1266,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_health{hostname=~\"$hostname\",category=\"storage\"}",
+                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"storage\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1272,6 +1276,159 @@
                "title": "Drives",
                "transparent": false,
                "type": "stat"
+            },
+            {
+               "columns": [ ],
+               "datasource": "$datasource",
+               "fieldConfig": {
+                  "defaults": {
+                     "custom": {
+                        "align": "auto",
+                        "cellOptions": {
+                           "type": "auto"
+                        },
+                        "filterable": false,
+                        "inspect": false
+                     },
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green",
+                              "value": null
+                           }
+                        ]
+                     }
+                  },
+                  "overrides": [ ]
+               },
+               "gridPos": {
+                  "h": 8,
+                  "w": 11,
+                  "x": 2,
+                  "y": 6
+               },
+               "id": 24,
+               "links": [ ],
+               "options": {
+                  "footer": {
+                     "show": false
+                  },
+                  "showHeader": true
+               },
+               "pluginVersion": "9.1.3",
+               "styles": [ ],
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_storage_capacity_bytes{hostname=~\"$hostname\"}",
+                     "format": "table",
+                     "instant": true,
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "Device List",
+               "transformations": [
+                  {
+                     "id": "organize",
+                     "options": {
+                        "excludeByName": {
+                           "Time": true,
+                           "Value": true,
+                           "__name__": true,
+                           "cluster": true,
+                           "hostname": true,
+                           "instance": true,
+                           "job": true
+                        },
+                        "renameByName": {
+                           "device": "Device Name",
+                           "model": "Drive Model",
+                           "protocol": "Protocol"
+                        }
+                     }
+                  }
+               ],
+               "type": "table"
+            },
+            {
+               "columns": [ ],
+               "datasource": "$datasource",
+               "fieldConfig": {
+                  "defaults": {
+                     "custom": {
+                        "align": "auto",
+                        "cellOptions": {
+                           "type": "auto"
+                        },
+                        "filterable": false,
+                        "inspect": false
+                     },
+                     "thresholds": {
+                        "mode": "absolute",
+                        "steps": [
+                           {
+                              "color": "green",
+                              "value": null
+                           }
+                        ]
+                     }
+                  },
+                  "overrides": [ ]
+               },
+               "gridPos": {
+                  "h": 8,
+                  "w": 11,
+                  "x": 13,
+                  "y": 6
+               },
+               "id": 25,
+               "links": [ ],
+               "options": {
+                  "footer": {
+                     "show": false
+                  },
+                  "showHeader": true
+               },
+               "pluginVersion": "9.1.3",
+               "styles": [ ],
+               "targets": [
+                  {
+                     "expr": "ceph_node_proxy_firmware_info{hostname=~\"$hostname\"}",
+                     "format": "table",
+                     "instant": true,
+                     "intervalFactor": 1,
+                     "legendFormat": "__auto",
+                     "refId": "A"
+                  }
+               ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "Platform Firmware",
+               "transformations": [
+                  {
+                     "id": "organize",
+                     "options": {
+                        "excludeByName": {
+                           "Time": true,
+                           "Value": true,
+                           "__name__": true,
+                           "cluster": true,
+                           "hostname": true,
+                           "instance": true,
+                           "job": true
+                        },
+                        "renameByName": {
+                           "component": "Component",
+                           "version": "Version"
+                        }
+                     }
+                  }
+               ],
+               "type": "table"
             }
          ],
          "repeat": null,
@@ -1291,7 +1448,7 @@
             "x": 0,
             "y": 2
          },
-         "id": 24,
+         "id": 26,
          "panels": [
             {
                "colors": null,
@@ -1306,7 +1463,7 @@
                         "mode": "absolute",
                         "steps": [ ]
                      },
-                     "unit": "short"
+                     "unit": "locale"
                   }
                },
                "gridPos": {
@@ -1315,7 +1472,7 @@
                   "x": 0,
                   "y": 3
                },
-               "id": 25,
+               "id": 27,
                "links": [ ],
                "maxPerRow": 6,
                "options": {
@@ -1361,7 +1518,7 @@
                         "mode": "absolute",
                         "steps": [ ]
                      },
-                     "unit": "short"
+                     "unit": "locale"
                   }
                },
                "gridPos": {
@@ -1370,7 +1527,7 @@
                   "x": 0,
                   "y": 8
                },
-               "id": 26,
+               "id": 28,
                "links": [ ],
                "options": {
                   "colorMode": "none",
@@ -1413,7 +1570,7 @@
                         "mode": "absolute",
                         "steps": [ ]
                      },
-                     "unit": "short"
+                     "unit": "locale"
                   }
                },
                "gridPos": {
@@ -1422,7 +1579,7 @@
                   "x": 4,
                   "y": 8
                },
-               "id": 27,
+               "id": 29,
                "links": [ ],
                "options": {
                   "colorMode": "none",
@@ -1470,7 +1627,7 @@
             "x": 0,
             "y": 3
          },
-         "id": 28,
+         "id": 30,
          "panels": [
             {
                "aliasColors": { },
@@ -1486,7 +1643,7 @@
                   "x": 0,
                   "y": 4
                },
-               "id": 29,
+               "id": 31,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -1573,7 +1730,7 @@
                   "x": 12,
                   "y": 4
                },
-               "id": 30,
+               "id": 32,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -1660,7 +1817,7 @@
                   "x": 0,
                   "y": 12
                },
-               "id": 31,
+               "id": 33,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -1747,7 +1904,7 @@
                   "x": 12,
                   "y": 12
                },
-               "id": 32,
+               "id": 34,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -1838,7 +1995,7 @@
             "x": 0,
             "y": 4
          },
-         "id": 33,
+         "id": 35,
          "panels": [
             {
                "aliasColors": { },
@@ -1855,7 +2012,7 @@
                   "x": 0,
                   "y": 5
                },
-               "id": 34,
+               "id": 36,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -1909,7 +2066,7 @@
                },
                "yaxes": [
                   {
-                     "format": "short",
+                     "format": "none",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -1917,7 +2074,7 @@
                      "show": true
                   },
                   {
-                     "format": "short",
+                     "format": "none",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -1940,7 +2097,7 @@
                   "x": 12,
                   "y": 5
                },
-               "id": 35,
+               "id": 37,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -1994,7 +2151,7 @@
                },
                "yaxes": [
                   {
-                     "format": "short",
+                     "format": "none",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -2002,7 +2159,7 @@
                      "show": true
                   },
                   {
-                     "format": "short",
+                     "format": "none",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -2136,7 +2293,7 @@
       ]
    },
    "timezone": "",
-   "title": "Ceph Hardware - Platform Monitoring",
+   "title": "Ceph Hardware - Overview",
    "uid": "hardware001",
    "version": 0
 }

From be324304db45f37d3a4027ab568c5010003ef486 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Tue, 30 Jun 2026 19:39:13 +0530
Subject: [PATCH 511/596] mgr/prometheus: refactor hardware metrics

- export `firmware_version` labels from `node_proxy_storage_capacity_bytes` metrics to be used in device firmware panel
- improve iterations for performance - dropping redundant node_proxy_firmware() RPC; firmware data is already
  present in the fullreport response, and removing unnecessary loops.
- replace health if/elif chain with HEALTH_STATUS_MAP dict lookup
- rename metrics to ceph_hardware_*, fix component labels and add tests
- added unit test cases
- add serial name, slot info to capacity metric
- fix health metrics showing ID instead of component name

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-mixin/dashboards/hardware.libsonnet  | 133 +++++---
 .../ceph-mixin/dashboards_out/hardware.json   | 212 +++++++++----
 src/pybind/mgr/prometheus/module.py           | 299 ++++++++++--------
 src/pybind/mgr/prometheus/test_module.py      | 290 +++++++++++++++++
 4 files changed, 704 insertions(+), 230 deletions(-)

diff --git a/monitoring/ceph-mixin/dashboards/hardware.libsonnet b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
index 1fd0c02f0ee..583d93bb81b 100644
--- a/monitoring/ceph-mixin/dashboards/hardware.libsonnet
+++ b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
@@ -47,7 +47,7 @@ local g = import 'grafonnet/grafana.libsonnet';
       $.addTemplateSchema(
         'hostname',
         '$datasource',
-        'label_values(ceph_node_proxy_health, hostname)',
+        'label_values(ceph_hardware_health, hostname)',
         1,
         false,
         1,
@@ -59,14 +59,14 @@ local g = import 'grafonnet/grafana.libsonnet';
       g.template.new(
         'fan_speeds',
         '$datasource',
-        'label_values(ceph_node_proxy_fan_rpm{hostname=~"$hostname"},fan_name)',
+        'label_values(ceph_hardware_fan_rpm{hostname=~"$hostname"},fan_name)',
         label='',
         refresh='load',
         includeAll=true,
         multi=true,
         allValues='',
         sort=0,
-        regex='',
+        regex='/.*TACH_OUT/',
         hide=2
       )
     )
@@ -81,7 +81,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 4, x: 0, y: 1 }
         )
         .addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_health)',
+          'max(ceph_hardware_health)',
           legendFormat='__auto'
         ))
         + {
@@ -115,7 +115,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           { color: 'red', value: 85 },
         ])
         .addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_temperature_celsius{sensor_name=~".*CPU_TEMP"})',
+          'max(ceph_hardware_temperature_celsius{sensor_name=~".*CPU_TEMP"})',
           legendFormat='__auto'
         )),
 
@@ -126,7 +126,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPos={ x: 7, y: 1, w: 3, h: 8 }
         )
         .addTarget($.addTargetSchema(
-          'count by(version) (ceph_node_proxy_firmware_info{component=~".*BMC.*"})',
+          'count by(version) (ceph_hardware_firmware_info{component=~".*BMC.*"})',
           legendFormat='{{version}}'
         ))
         + {
@@ -149,7 +149,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPos={ x: 10, y: 1, w: 3, h: 8 }
         )
         .addTarget($.addTargetSchema(
-          'count by(version) (ceph_node_proxy_firmware_info{component=~".*BIOS.*"})',
+          'count by(version) (ceph_hardware_firmware_info{component=~".*BIOS.*"})',
           legendFormat='{{version}}'
         ))
         + {
@@ -172,7 +172,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPos={ x: 13, y: 1, w: 6, h: 8 }
         )
         .addTarget($.addTargetSchema(
-          'count by(model) (ceph_node_proxy_storage_capacity_bytes)',
+          'count by(model) (ceph_hardware_storage_capacity_bytes)',
           legendFormat='{{model}}'
         ))
         + {
@@ -195,8 +195,8 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPos={ x: 19, y: 1, w: 5, h: 8 }
         )
         .addTarget($.addTargetSchema(
-          'count by(version) (ceph_node_proxy_firmware_info{component=~".*Drive.*"})',
-          legendFormat='{{version}}',
+          'count by(firmware_version) (ceph_hardware_storage_capacity_bytes{firmware_version!="unknown"})',
+          legendFormat='{{firmware_version}}',
           instant=true
         ))
         + {
@@ -219,7 +219,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 2, x: 0, y: 5 }
         ).addTarget($.addTargetSchema(
-          'count(count by(hostname) (ceph_node_proxy_health))',
+          'count(count by(hostname) (ceph_hardware_health))',
           legendFormat='__auto'
         )),
 
@@ -230,7 +230,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 2, x: 2, y: 5 }
         ).addTarget($.addTargetSchema(
-          'count(ceph_node_proxy_storage_capacity_bytes)',
+          'count(ceph_hardware_storage_capacity_bytes)',
           legendFormat='__auto'
         )),
 
@@ -249,7 +249,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           { color: 'red', value: 80 },
         ])
         .addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_temperature_celsius{sensor_name=~"NVME.*_TEMP"})',
+          'max(ceph_hardware_temperature_celsius{sensor_name=~"NVME.*_TEMP"})',
           legendFormat='__auto'
         )),
       ] },
@@ -263,7 +263,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 2 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_health{hostname=~"$hostname",category="power"})',
+          'max(ceph_hardware_health{hostname=~"$hostname",category="power"})',
           legendFormat='__auto'
         ))
         + {
@@ -286,9 +286,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 2, y: 2 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"})',
+          'max(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"})',
           legendFormat='__auto'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 70 }, { color: 'red', value: 80 }] } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
 
         // CPU Temperature
         $.addStatPanel(
@@ -297,9 +301,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 5, y: 2 }
         ).addTarget($.addTargetSchema(
-          'avg(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"})',
+          'avg(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"})',
           legendFormat='__auto'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { max: 85, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 80 }, { color: 'semi-dark-red', value: 90 }] } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
 
         // DIMM Temperature
         $.addStatPanel(
@@ -308,9 +316,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 8, y: 2 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"})',
+          'max(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"})',
           legendFormat='__auto'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { max: 88, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'yellow', value: 70 }, { color: 'semi-dark-red', value: 80 }] } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
 
         // PSU Fans
         $.addStatPanel(
@@ -319,9 +331,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 11, y: 2 }
         ).addTarget($.addTargetSchema(
-          'count(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
+          'count(ceph_hardware_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
           legendFormat='__auto'
-        )),
+        ))
+        + { options+: { colorMode: 'none', graphMode: 'none' } },
 
         // AVG PSU Temperature
         $.addStatPanel(
@@ -330,9 +343,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 14, y: 2 }
         ).addTarget($.addTargetSchema(
-          'avg(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"PSU.*_TEMP.*"})',
+          'avg(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~"PSU.*_TEMP.*"})',
           legendFormat='__auto'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'fixed' }, max: 100, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'yellow', value: 80 }, { color: 'semi-dark-red', value: 90 }] } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
 
         // NVMe Drives
         $.addStatPanel(
@@ -341,9 +358,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 17, y: 2 }
         ).addTarget($.addTargetSchema(
-          'count(ceph_node_proxy_storage_capacity_bytes{hostname=~"$hostname", protocol="NVMe"})',
+          'count(ceph_hardware_storage_capacity_bytes{hostname=~"$hostname", protocol="NVMe"})',
           legendFormat='__auto'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'thresholds' }, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 70 }, { color: 'semi-dark-red', value: 78 }] } } },
+          options+: { colorMode: 'none', graphMode: 'none' },
+        },
 
         // NVMe Temperature
         $.addStatPanel(
@@ -352,9 +373,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 4, w: 3, x: 20, y: 2 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*"})',
+          'max(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*"})',
           legendFormat='__auto'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'thresholds' }, max: 85, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 70 }, { color: 'semi-dark-red', value: 78 }] } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
 
         // Network
         $.addStatPanel(
@@ -363,7 +388,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 5 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_health{hostname=~"$hostname",category="network"})',
+          'max(ceph_hardware_health{hostname=~"$hostname",category="network"})',
           legendFormat='__auto'
         ))
         + {
@@ -386,7 +411,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 8 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_health{hostname=~"$hostname",category="fans"})',
+          'max(ceph_hardware_health{hostname=~"$hostname",category="fans"})',
           legendFormat='__auto'
         ))
         + {
@@ -409,7 +434,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 3, w: 2, x: 0, y: 11 }
         ).addTarget($.addTargetSchema(
-          'max(ceph_node_proxy_health{hostname=~"$hostname",category="storage"})',
+          'max(ceph_hardware_health{hostname=~"$hostname",category="storage"})',
           legendFormat='__auto'
         ))
         + {
@@ -441,7 +466,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           },
         )
         .addTarget($.addTargetSchema(
-          'ceph_node_proxy_storage_capacity_bytes{hostname=~"$hostname"}',
+          'ceph_hardware_storage_capacity_bytes{hostname=~"$hostname"}',
           legendFormat='__auto',
           instant=true
         ) + { format: 'table' })
@@ -483,7 +508,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           },
         )
         .addTarget($.addTargetSchema(
-          'ceph_node_proxy_firmware_info{hostname=~"$hostname"}',
+          'ceph_hardware_firmware_info{hostname=~"$hostname"}',
           legendFormat='__auto',
           instant=true
         ) + { format: 'table' })
@@ -518,10 +543,12 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 5, w: 4, x: 0, y: 3 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_fan_rpm{hostname=~"$hostname",fan_name=~"$fan_speeds"}',
+          'ceph_hardware_fan_rpm{hostname=~"$hostname",fan_name=~"$fan_speeds"}',
           legendFormat='{{fan_name}}'
         ))
         + {
+          fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'fixed' } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
           repeat: 'fan_speeds',
           repeatDirection: 'h',
           maxPerRow: 6,
@@ -534,9 +561,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 5, w: 4, x: 0, y: 8 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_fan_rpm{hostname=~"$hostname",fan_name=~"PSU1.*"}',
+          'ceph_hardware_fan_rpm{hostname=~"$hostname",fan_name=~"PSU1.*"}',
           legendFormat='{{fan_name}}'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'fixed' } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
 
         // PSU2
         $.addStatPanel(
@@ -545,9 +576,13 @@ local g = import 'grafonnet/grafana.libsonnet';
           datasource='$datasource',
           gridPosition={ h: 5, w: 4, x: 4, y: 8 }
         ).addTarget($.addTargetSchema(
-          'ceph_node_proxy_fan_rpm{hostname=~"$hostname",fan_name=~"PSU2.*"}',
+          'ceph_hardware_fan_rpm{hostname=~"$hostname",fan_name=~"PSU2.*"}',
           legendFormat='{{fan_name}}'
-        )),
+        ))
+        + {
+          fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'fixed' } } },
+          options+: { colorMode: 'none', graphMode: 'area' },
+        },
       ] },
 
       // Row 4: Temperature History
@@ -559,7 +594,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           format='celsius',
         ).addTarget(
           g.prometheus.target(
-            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"}',
+            'ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"}',
             legendFormat='{{sensor_name}}'
           )
         ).addTarget(
@@ -580,7 +615,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           format='celsius',
         ).addTarget(
           g.prometheus.target(
-            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"}',
+            'ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"}',
             legendFormat='{{sensor_name}}'
           )
         ).addTarget(
@@ -601,7 +636,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           format='celsius',
         ).addTarget(
           g.prometheus.target(
-            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"}',
+            'ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"}',
             legendFormat='{{sensor_name}}'
           )
         ).addTarget(
@@ -622,7 +657,7 @@ local g = import 'grafonnet/grafana.libsonnet';
           format='celsius',
         ).addTarget(
           g.prometheus.target(
-            'ceph_node_proxy_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*_TEMP"}',
+            'ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*_TEMP"}',
             legendFormat='{{sensor_name}}'
           )
         ).addTarget(
@@ -643,10 +678,11 @@ local g = import 'grafonnet/grafana.libsonnet';
         g.graphPanel.new(
           title='AVG PSU Fan Speed',
           datasource='$datasource',
-          format='none',
+          format='locale',
+          fill=1,
         ).addTarget(
           g.prometheus.target(
-            'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
+            'avg(ceph_hardware_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
             legendFormat='PSU Fans'
           )
         )
@@ -655,14 +691,15 @@ local g = import 'grafonnet/grafana.libsonnet';
           description: 'AVG across both PSUs',
         },
 
-        // AVG Cooling Fan Speed
+        // AVG Cooling Fan RPMs
         g.graphPanel.new(
-          title='AVG Cooling Fan Speed',
+          title='AVG Cooling Fan RPMs',
           datasource='$datasource',
-          format='none',
+          format='locale',
+          fill=1,
         ).addTarget(
           g.prometheus.target(
-            'avg(ceph_node_proxy_fan_rpm{hostname=~"$hostname", fan_name!~"PSU.*"})',
+            'avg(ceph_hardware_fan_rpm{hostname=~"$hostname", fan_name!~"PSU.*"})',
             legendFormat='System Fans'
           )
         )
diff --git a/monitoring/ceph-mixin/dashboards_out/hardware.json b/monitoring/ceph-mixin/dashboards_out/hardware.json
index b6afffb16fc..263ac97ccfe 100644
--- a/monitoring/ceph-mixin/dashboards_out/hardware.json
+++ b/monitoring/ceph-mixin/dashboards_out/hardware.json
@@ -117,7 +117,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_health)",
+                     "expr": "max(ceph_hardware_health)",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -180,7 +180,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_temperature_celsius{sensor_name=~\".*CPU_TEMP\"})",
+                     "expr": "max(ceph_hardware_temperature_celsius{sensor_name=~\".*CPU_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -235,7 +235,7 @@
                },
                "targets": [
                   {
-                     "expr": "count by(version) (ceph_node_proxy_firmware_info{component=~\".*BMC.*\"})",
+                     "expr": "count by(version) (ceph_hardware_firmware_info{component=~\".*BMC.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "{{version}}",
@@ -289,7 +289,7 @@
                },
                "targets": [
                   {
-                     "expr": "count by(version) (ceph_node_proxy_firmware_info{component=~\".*BIOS.*\"})",
+                     "expr": "count by(version) (ceph_hardware_firmware_info{component=~\".*BIOS.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "{{version}}",
@@ -342,7 +342,7 @@
                },
                "targets": [
                   {
-                     "expr": "count by(model) (ceph_node_proxy_storage_capacity_bytes)",
+                     "expr": "count by(model) (ceph_hardware_storage_capacity_bytes)",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "{{model}}",
@@ -395,11 +395,11 @@
                },
                "targets": [
                   {
-                     "expr": "count by(version) (ceph_node_proxy_firmware_info{component=~\".*Drive.*\"})",
+                     "expr": "count by(firmware_version) (ceph_hardware_storage_capacity_bytes{firmware_version!=\"unknown\"})",
                      "format": "time_series",
                      "instant": true,
                      "intervalFactor": 1,
-                     "legendFormat": "{{version}}",
+                     "legendFormat": "{{firmware_version}}",
                      "refId": "A"
                   }
                ],
@@ -447,7 +447,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "count(count by(hostname) (ceph_node_proxy_health))",
+                     "expr": "count(count by(hostname) (ceph_hardware_health))",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -499,7 +499,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "count(ceph_node_proxy_storage_capacity_bytes)",
+                     "expr": "count(ceph_hardware_storage_capacity_bytes)",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -562,7 +562,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_temperature_celsius{sensor_name=~\"NVME.*_TEMP\"})",
+                     "expr": "max(ceph_hardware_temperature_celsius{sensor_name=~\"NVME.*_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -662,7 +662,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"power\"})",
+                     "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"power\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -684,7 +684,19 @@
                      "mappings": [ ],
                      "thresholds": {
                         "mode": "absolute",
-                        "steps": [ ]
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "#EAB839",
+                              "value": 70
+                           },
+                           {
+                              "color": "red",
+                              "value": 80
+                           }
+                        ]
                      },
                      "unit": "celsius"
                   }
@@ -699,7 +711,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -714,7 +726,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"})",
+                     "expr": "max(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -734,9 +746,23 @@
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
+                     "max": 85,
+                     "min": 0,
                      "thresholds": {
                         "mode": "absolute",
-                        "steps": [ ]
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "#EAB839",
+                              "value": 80
+                           },
+                           {
+                              "color": "semi-dark-red",
+                              "value": 90
+                           }
+                        ]
                      },
                      "unit": "celsius"
                   }
@@ -751,7 +777,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -766,7 +792,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "avg(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"})",
+                     "expr": "avg(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -786,9 +812,23 @@
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
+                     "max": 88,
+                     "min": 0,
                      "thresholds": {
                         "mode": "absolute",
-                        "steps": [ ]
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "yellow",
+                              "value": 70
+                           },
+                           {
+                              "color": "semi-dark-red",
+                              "value": 80
+                           }
+                        ]
                      },
                      "unit": "celsius"
                   }
@@ -803,7 +843,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -818,7 +858,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"})",
+                     "expr": "max(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -870,7 +910,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "count(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
+                     "expr": "count(ceph_hardware_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -887,12 +927,30 @@
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "color": {
+                        "fixedColor": "blue",
+                        "mode": "fixed"
+                     },
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
+                     "max": 100,
+                     "min": 0,
                      "thresholds": {
                         "mode": "absolute",
-                        "steps": [ ]
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "yellow",
+                              "value": 80
+                           },
+                           {
+                              "color": "semi-dark-red",
+                              "value": 90
+                           }
+                        ]
                      },
                      "unit": "celsius"
                   }
@@ -907,7 +965,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -922,7 +980,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "avg(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"PSU.*_TEMP.*\"})",
+                     "expr": "avg(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"PSU.*_TEMP.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -939,12 +997,28 @@
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "color": {
+                        "fixedColor": "blue",
+                        "mode": "thresholds"
+                     },
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
                      "thresholds": {
                         "mode": "absolute",
-                        "steps": [ ]
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "#EAB839",
+                              "value": 70
+                           },
+                           {
+                              "color": "semi-dark-red",
+                              "value": 78
+                           }
+                        ]
                      },
                      "unit": "short"
                   }
@@ -974,7 +1048,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "count(ceph_node_proxy_storage_capacity_bytes{hostname=~\"$hostname\", protocol=\"NVMe\"})",
+                     "expr": "count(ceph_hardware_storage_capacity_bytes{hostname=~\"$hostname\", protocol=\"NVMe\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -991,12 +1065,30 @@
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "color": {
+                        "fixedColor": "blue",
+                        "mode": "thresholds"
+                     },
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
+                     "max": 85,
+                     "min": 0,
                      "thresholds": {
                         "mode": "absolute",
-                        "steps": [ ]
+                        "steps": [
+                           {
+                              "color": "green"
+                           },
+                           {
+                              "color": "#EAB839",
+                              "value": 70
+                           },
+                           {
+                              "color": "semi-dark-red",
+                              "value": 78
+                           }
+                        ]
                      },
                      "unit": "celsius"
                   }
@@ -1011,7 +1103,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -1026,7 +1118,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*\"})",
+                     "expr": "max(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1106,7 +1198,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"network\"})",
+                     "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"network\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1186,7 +1278,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"fans\"})",
+                     "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"fans\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1266,7 +1358,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "max(ceph_node_proxy_health{hostname=~\"$hostname\",category=\"storage\"})",
+                     "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"storage\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "__auto",
@@ -1320,7 +1412,7 @@
                "styles": [ ],
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_storage_capacity_bytes{hostname=~\"$hostname\"}",
+                     "expr": "ceph_hardware_storage_capacity_bytes{hostname=~\"$hostname\"}",
                      "format": "table",
                      "instant": true,
                      "intervalFactor": 1,
@@ -1397,7 +1489,7 @@
                "styles": [ ],
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_firmware_info{hostname=~\"$hostname\"}",
+                     "expr": "ceph_hardware_firmware_info{hostname=~\"$hostname\"}",
                      "format": "table",
                      "instant": true,
                      "intervalFactor": 1,
@@ -1456,6 +1548,10 @@
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "color": {
+                        "fixedColor": "blue",
+                        "mode": "fixed"
+                     },
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
@@ -1477,7 +1573,7 @@
                "maxPerRow": 6,
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -1494,7 +1590,7 @@
                "repeatDirection": "h",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_fan_rpm{hostname=~\"$hostname\",fan_name=~\"$fan_speeds\"}",
+                     "expr": "ceph_hardware_fan_rpm{hostname=~\"$hostname\",fan_name=~\"$fan_speeds\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "{{fan_name}}",
@@ -1511,6 +1607,10 @@
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "color": {
+                        "fixedColor": "blue",
+                        "mode": "fixed"
+                     },
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
@@ -1531,7 +1631,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -1546,7 +1646,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_fan_rpm{hostname=~\"$hostname\",fan_name=~\"PSU1.*\"}",
+                     "expr": "ceph_hardware_fan_rpm{hostname=~\"$hostname\",fan_name=~\"PSU1.*\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "{{fan_name}}",
@@ -1563,6 +1663,10 @@
                "description": "",
                "fieldConfig": {
                   "defaults": {
+                     "color": {
+                        "fixedColor": "blue",
+                        "mode": "fixed"
+                     },
                      "decimals": 0,
                      "links": [ ],
                      "mappings": [ ],
@@ -1583,7 +1687,7 @@
                "links": [ ],
                "options": {
                   "colorMode": "none",
-                  "graphMode": "none",
+                  "graphMode": "area",
                   "justifyMode": "auto",
                   "orientation": "horizontal",
                   "reduceOptions": {
@@ -1598,7 +1702,7 @@
                "pluginVersion": "9.1.3",
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_fan_rpm{hostname=~\"$hostname\",fan_name=~\"PSU2.*\"}",
+                     "expr": "ceph_hardware_fan_rpm{hostname=~\"$hostname\",fan_name=~\"PSU2.*\"}",
                      "format": "time_series",
                      "intervalFactor": 1,
                      "legendFormat": "{{fan_name}}",
@@ -1678,7 +1782,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"}",
+                     "expr": "ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"}",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "{{sensor_name}}",
@@ -1765,7 +1869,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"}",
+                     "expr": "ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"}",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "{{sensor_name}}",
@@ -1852,7 +1956,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"}",
+                     "expr": "ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"}",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "{{sensor_name}}",
@@ -1939,7 +2043,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "ceph_node_proxy_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*_TEMP\"}",
+                     "expr": "ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*_TEMP\"}",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "{{sensor_name}}",
@@ -2040,7 +2144,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "avg(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
+                     "expr": "avg(ceph_hardware_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "PSU Fans",
@@ -2066,7 +2170,7 @@
                },
                "yaxes": [
                   {
-                     "format": "none",
+                     "format": "locale",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -2074,7 +2178,7 @@
                      "show": true
                   },
                   {
-                     "format": "none",
+                     "format": "locale",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -2125,7 +2229,7 @@
                "steppedLine": false,
                "targets": [
                   {
-                     "expr": "avg(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\", fan_name!~\"PSU.*\"})",
+                     "expr": "avg(ceph_hardware_fan_rpm{hostname=~\"$hostname\", fan_name!~\"PSU.*\"})",
                      "format": "time_series",
                      "intervalFactor": 2,
                      "legendFormat": "System Fans",
@@ -2135,7 +2239,7 @@
                "thresholds": [ ],
                "timeFrom": null,
                "timeShift": null,
-               "title": "AVG Cooling Fan Speed",
+               "title": "AVG Cooling Fan RPMs",
                "tooltip": {
                   "shared": true,
                   "sort": 0,
@@ -2151,7 +2255,7 @@
                },
                "yaxes": [
                   {
-                     "format": "none",
+                     "format": "locale",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -2159,7 +2263,7 @@
                      "show": true
                   },
                   {
-                     "format": "none",
+                     "format": "locale",
                      "label": null,
                      "logBase": 1,
                      "max": null,
@@ -2231,7 +2335,7 @@
             "multi": false,
             "name": "hostname",
             "options": [ ],
-            "query": "label_values(ceph_node_proxy_health, hostname)",
+            "query": "label_values(ceph_hardware_health, hostname)",
             "refresh": 1,
             "regex": "",
             "sort": 1,
@@ -2251,9 +2355,9 @@
             "multi": true,
             "name": "fan_speeds",
             "options": [ ],
-            "query": "label_values(ceph_node_proxy_fan_rpm{hostname=~\"$hostname\"},fan_name)",
+            "query": "label_values(ceph_hardware_fan_rpm{hostname=~\"$hostname\"},fan_name)",
             "refresh": 1,
-            "regex": "",
+            "regex": "/.*TACH_OUT/",
             "sort": 0,
             "tagValuesQuery": "",
             "tags": [ ],
diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index 06002b7b195..4b353d2314a 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -140,20 +140,41 @@ NUM_OBJECTS = ['degraded', 'misplaced', 'unfound']
 SMB_METADATA = ('smb_version', 'volume',
                 'subvolume_group', 'subvolume', 'netbiosname', 'share')
 
-NODE_PROXY_STORAGE_LABELS = ('hostname', 'device', 'model', 'protocol')
+HW_STORAGE_LABELS = ('hostname', 'device', 'model', 'protocol', 'firmware_version', 'slot', 'serial_number')
 
-NODE_PROXY_CPU_LABELS = ('hostname', 'cpu', 'manufacturer', 'model')
+HW_CPU_LABELS = ('hostname', 'cpu', 'manufacturer', 'model', 'total_threads')
 
-NODE_PROXY_MEMORY_LABELS = ('hostname', 'dimm', 'type', 'manufacturer')
+HW_MEMORY_LABELS = ('hostname', 'dimm', 'type')
 MIB_TO_BYTES = 1048576
 
-NODE_PROXY_HEALTH_LABELS = ('hostname', 'component', 'category')
+HW_HEALTH_LABELS = ('hostname', 'component', 'category')
 
-NODE_PROXY_TEMP_LABELS = ('hostname', 'sensor_name')
+HW_TEMP_LABELS = ('hostname', 'sensor_name')
 
-NODE_PROXY_FAN_LABELS = ('hostname', 'fan_name')
+HW_FAN_LABELS = ('hostname', 'fan_name')
 
-NODE_PROXY_FIRMWARE_LABELS = ('hostname', 'component', 'version')
+HW_FIRMWARE_LABELS = ('hostname', 'component', 'version')
+
+HEALTH_STATUS_MAP = {
+    'OK': 0,
+    'Warning': 1,
+    'Degraded': 1,
+    'Error': 2,
+    'Critical': 2,
+}
+
+SENSOR_METRICS = {
+    'fans': {
+        'metric': 'hardware_fan_rpm',
+        'description': 'Hardware fan speed in RPM',
+        'labels': HW_FAN_LABELS,
+    },
+    'temperatures': {
+        'metric': 'hardware_temperature_celsius',
+        'description': 'Hardware temperature sensor reading in Celsius',
+        'labels': HW_TEMP_LABELS,
+    },
+}
 
 CEPHADM_DAEMON_STATUS = ('service_type', 'daemon_name', 'hostname', 'service_name')
 
@@ -1013,53 +1034,47 @@ class Module(MgrModule, OrchestratorClientMixin):
                 check.description,
             )
 
-        metrics['node_proxy_storage_capacity_bytes'] = Metric(
+        metrics['hardware_storage_capacity_bytes'] = Metric(
             'gauge',
-            'node_proxy_storage_capacity_bytes',
+            'hardware_storage_capacity_bytes',
             'Storage device capacity in bytes',
-            NODE_PROXY_STORAGE_LABELS
+            HW_STORAGE_LABELS
         )
 
-        metrics['node_proxy_cpu_cores'] = Metric(
+        metrics['hardware_cpu_cores'] = Metric(
             'gauge',
-            'node_proxy_cpu_cores',
+            'hardware_cpu_cores',
             'Total CPU cores',
-            NODE_PROXY_CPU_LABELS
+            HW_CPU_LABELS
         )
 
-        metrics['node_proxy_memory_capacity_bytes'] = Metric(
+        metrics['hardware_memory_capacity_bytes'] = Metric(
             'gauge',
-            'node_proxy_memory_capacity_bytes',
+            'hardware_memory_capacity_bytes',
             'Memory capacity in bytes',
-            NODE_PROXY_MEMORY_LABELS
+            HW_MEMORY_LABELS
         )
 
-        metrics['node_proxy_health'] = Metric(
+        metrics['hardware_health'] = Metric(
             'gauge',
-            'node_proxy_health',
+            'hardware_health',
             'Hardware component health status (0=OK, 1=Warning, 2=Error)',
-            NODE_PROXY_HEALTH_LABELS
+            HW_HEALTH_LABELS
         )
 
-        metrics['node_proxy_temperature_celsius'] = Metric(
-            'gauge',
-            'node_proxy_temperature_celsius',
-            'Hardware temperature sensor reading in Celsius',
-            NODE_PROXY_TEMP_LABELS
-        )
+        for sensor in SENSOR_METRICS.values():
+            metrics[sensor['metric']] = Metric(
+                'gauge',
+                sensor['metric'],
+                sensor['description'],
+                sensor['labels']
+            )
 
-        metrics['node_proxy_fan_rpm'] = Metric(
+        metrics['hardware_firmware_info'] = Metric(
             'gauge',
-            'node_proxy_fan_rpm',
-            'Hardware fan speed in RPM',
-            NODE_PROXY_FAN_LABELS
-        )
-
-        metrics['node_proxy_firmware_info'] = Metric(
-            'gauge',
-            'node_proxy_firmware_info',
+            'hardware_firmware_info',
             'Firmware version information (value is always 1, version in label)',
-            NODE_PROXY_FIRMWARE_LABELS
+            HW_FIRMWARE_LABELS
         )
 
         return metrics
@@ -2064,111 +2079,139 @@ class Module(MgrModule, OrchestratorClientMixin):
         except Exception as e:
             self.log.error(f"Failed to get SMB metadata: {str(e)}")
 
+    def _hw_get_health_value(self, status_val, hostname='', comp_id='', category=''):
+        """Map a Redfish health status to a numeric value (0=OK, 1=Warning, 2=Error)."""
+        if isinstance(status_val, dict):
+            health_str = status_val.get('health', 'Unknown')
+        elif isinstance(status_val, str):
+            health_str = status_val
+        else:
+            health_str = 'Unknown'
+
+        value = HEALTH_STATUS_MAP.get(health_str)
+        if value is None:
+            self.log.warning(
+                f"node-proxy: unexpected health status "
+                f"'{health_str}' for {category}/{comp_id} "
+                f"on {hostname}, skipping"
+            )
+        return value
+
+    def _hw_set_health_metric(self, status_val, hostname, comp_id, category):
+        """Set ceph_hardware_health gauge for a single component."""
+        health_value = self._hw_get_health_value(
+            status_val, hostname, comp_id, category
+        )
+        if health_value is not None:
+            self.metrics['hardware_health'].set(
+                health_value, (hostname, comp_id, category)
+            )
+
+    def _hw_iter_components(self, status, category):
+        """Yield (comp_id, comp_dict) pairs from nested status[category] dicts."""
+        for components in status.get(category, {}).values():
+            for comp_id, comp in components.items():
+                if isinstance(comp, dict):
+                    yield comp_id, comp
+
+    def _hw_set_sensor_metric(self, comp, comp_id, hostname, category, metric_key):
+        """Set sensor value (temperature/fan) and health gauges using the sensor name."""
+        name = comp.get('name', comp_id)
+        reading = comp.get('reading')
+        if reading is not None and reading != 'unknown':
+            try:
+                self.metrics[metric_key].set(float(reading), (hostname, name))
+            except (ValueError, TypeError):
+                pass
+        self._hw_set_health_metric(comp.get('status', {}), hostname, name, category)
+
+    def _process_storage(self, status, hostname):
+        """Set storage capacity and health metrics per drive."""
+        for device_id, device in self._hw_iter_components(status, 'storage'):
+            capacity = device.get('capacity_bytes', 0)
+            labels = (
+                hostname,
+                device_id,
+                device.get('model', 'unknown'),
+                device.get('protocol', 'unknown'),
+                device.get('firmware_version', 'unknown'),
+                device.get('slot', 'unknown'),
+                device.get('serial_number', 'unknown')
+            )
+            self.metrics['hardware_storage_capacity_bytes'].set(capacity, labels)
+            self._hw_set_health_metric(device.get('status', {}), hostname, device_id, 'storage')
+
+    def _process_processors(self, status, hostname):
+        """Set CPU cores count and health metrics per processor."""
+        for cpu_id, cpu in self._hw_iter_components(status, 'processors'):
+            cores = cpu.get('total_cores', 0)
+            labels = (
+                hostname,
+                cpu_id,
+                cpu.get('manufacturer', 'unknown'),
+                cpu.get('model', 'unknown'),
+                cpu.get('total_threads', 'unknown')
+            )
+            self.metrics['hardware_cpu_cores'].set(cores, labels)
+            self._hw_set_health_metric(cpu.get('status', {}), hostname, cpu_id, 'processors')
+
+    def _process_memory(self, status, hostname):
+        """Set memory capacity (in bytes) and health metrics per DIMM."""
+        for dimm_id, dimm in self._hw_iter_components(status, 'memory'):
+            capacity_mib = dimm.get('capacity_mi_b', 0)
+            capacity_bytes = capacity_mib * MIB_TO_BYTES
+            labels = (
+                hostname,
+                dimm_id,
+                dimm.get('memory_device_type', 'unknown'),
+            )
+            self.metrics['hardware_memory_capacity_bytes'].set(capacity_bytes, labels)
+            self._hw_set_health_metric(dimm.get('status', {}), hostname, dimm_id, 'memory')
+
+    def _process_power_network(self, status, hostname):
+        """Set health metrics for power and network"""
+        for comp_id, comp in self._hw_iter_components(status, 'power'):
+            name = comp.get('name', comp_id)
+            self._hw_set_health_metric(comp.get('status', {}), hostname, name, 'power')
+        for comp_id, comp in self._hw_iter_components(status, 'network'):
+            self._hw_set_health_metric(comp.get('status', {}), hostname, comp_id, 'network')
+
+    def _process_sensors(self, status, hostname):
+        """Set fan and temperature readings and health metrics"""
+        for category, sensor in SENSOR_METRICS.items():
+            for comp_id, comp in self._hw_iter_components(status, category):
+                self._hw_set_sensor_metric(comp, comp_id, hostname, category, sensor['metric'])
+
+    def _process_firmware(self, hostname, data):
+        """Set firmware info metrics (value=1) with version as label, skip unknown."""
+        fw_data = data.get('firmware', data.get('firmwares', {}))
+        for fw_id, fw_info in fw_data.items():
+            component = fw_info.get('name', fw_id)
+            version = fw_info.get('version', 'unknown')
+            if version and version != 'unknown':
+                labels = (hostname, component, str(version))
+                self.metrics['hardware_firmware_info'].set(1, labels)
+
     @profile_method(True)
     def get_hardware_metrics(self) -> None:
+        """Fetch node-proxy fullreport and export all hardware metrics."""
         if not self.orch_is_available():
             return
 
         try:
             report = raise_if_exception(self.node_proxy_fullreport())
-            firmware_report = raise_if_exception(self.node_proxy_firmware())
         except Exception as e:
             self.log.debug(f"node-proxy data not available: {e}")
             return
 
-        for host, data in report.items():
+        for hostname, data in report.items():
             status = data.get('status', {})
-
-            for sys_id, devices in status.get('storage', {}).items():
-                for device_id, device in devices.items():
-                    capacity = device.get('capacity_bytes', 0)
-                    labels = (
-                        host,
-                        device_id,
-                        device.get('model', 'unknown'),
-                        device.get('protocol', 'unknown')
-                    )
-                    self.metrics['node_proxy_storage_capacity_bytes'].set(capacity, labels)
-
-            for sys_id, cpus in status.get('processors', {}).items():
-                for cpu_id, cpu in cpus.items():
-                    cores = cpu.get('total_cores', 0)
-                    labels = (
-                        host,
-                        cpu_id,
-                        cpu.get('manufacturer', 'unknown'),
-                        cpu.get('model', 'unknown')
-                    )
-                    self.metrics['node_proxy_cpu_cores'].set(cores, labels)
-
-            for sys_id, dimms in status.get('memory', {}).items():
-                for dimm_id, dimm in dimms.items():
-                    capacity_mib = dimm.get('capacity_mi_b', 0)
-                    capacity_bytes = capacity_mib * MIB_TO_BYTES
-                    labels = (
-                        host,
-                        dimm_id,
-                        dimm.get('memory_device_type', 'unknown'),
-                        dimm.get('manufacturer', 'unknown')
-                    )
-                    self.metrics['node_proxy_memory_capacity_bytes'].set(capacity_bytes, labels)
-
-            for category in ['storage', 'processors', 'memory', 'power', 'fans', 'network', 'temperatures']:
-                for sys_id, components in status.get(category, {}).items():
-                    for comp_id, comp in components.items():
-                        if not isinstance(comp, dict):
-                            continue
-                        status_val = comp.get('status', {})
-                        if isinstance(status_val, dict):
-                            health_str = status_val.get('health', 'Unknown')
-                        elif isinstance(status_val, str):
-                            health_str = status_val
-                        else:
-                            health_str = 'Unknown'
-
-                        if health_str == 'OK':
-                            health_value = 0
-                        elif health_str in ['Warning', 'Degraded']:
-                            health_value = 1
-                        else:
-                            health_value = 2
-
-                        labels = (host, comp_id, category)
-                        self.metrics['node_proxy_health'].set(health_value, labels)
-
-            for sys_id, sensors in status.get('temperatures', {}).items():
-                for sensor_id, sensor in sensors.items():
-                    reading = sensor.get('reading')
-                    sensor_name = sensor.get('name', sensor_id)
-                    if reading is None or reading == 'unknown':
-                        continue
-                    try:
-                        temp_value = float(reading)
-                        labels = (host, sensor_name)
-                        self.metrics['node_proxy_temperature_celsius'].set(temp_value, labels)
-                    except (ValueError, TypeError):
-                        continue
-
-            for sys_id, fans_data in status.get('fans', {}).items():
-                for fan_id, fan in fans_data.items():
-                    rpm = fan.get('reading')
-                    fan_name = fan.get('name', fan_id)
-                    if rpm is None or rpm == 'unknown':
-                        continue
-                    try:
-                        rpm_value = float(rpm)
-                        labels = (host, fan_name)
-                        self.metrics['node_proxy_fan_rpm'].set(rpm_value, labels)
-                    except (ValueError, TypeError):
-                        continue
-
-        for host, fw_data in firmware_report.items():
-            for fw_id, fw_info in fw_data.items():
-                component = fw_info.get('name', fw_id)
-                version = fw_info.get('version', 'unknown')
-                if version and version != 'unknown':
-                    labels = (host, component, str(version))
-                    self.metrics['node_proxy_firmware_info'].set(1, labels)
+            self._process_firmware(hostname, data)
+            self._process_storage(status, hostname)
+            self._process_processors(status, hostname)
+            self._process_memory(status, hostname)
+            self._process_power_network(status, hostname)
+            self._process_sensors(status, hostname)
 
     @profile_method(True)
     def collect(self) -> str:
diff --git a/src/pybind/mgr/prometheus/test_module.py b/src/pybind/mgr/prometheus/test_module.py
index 8a2a686de3e..fa844aa587c 100644
--- a/src/pybind/mgr/prometheus/test_module.py
+++ b/src/pybind/mgr/prometheus/test_module.py
@@ -181,3 +181,293 @@ class ThreadSafeLRUCacheDictTest(TestCase):
         self.assertEqual(len(cache), 100)
         for i in range(100):
             self.assertEqual(cache[f'key{i}'], f'value{i}')
+
+
+MOCK_HW_FULLREPORT = {
+    'at3n2.tuc.stglabs.ibm.com': {
+        'host': 'at3n2.tuc.stglabs.ibm.com',
+        'sn': '11S03NK990YM30ZP58E02X',
+        'status': {
+            'storage': {'Self': {
+                'nvme_device0_nsid1': {
+                    'capacity_bytes': 512110190592,
+                    'model': 'Micron_2550_MTFDKBK512TGE',
+                    'protocol': 'NVMe',
+                    'serial_number': '24424BAA3C40',
+                    'firmware_version': 'V6MA001',
+                    'slot': '0',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+            'processors': {'Self': {
+                'devtype1_cpu0': {
+                    'total_cores': 48,
+                    'total_threads': 96,
+                    'model': 'unknown',
+                    'manufacturer': 'Advanced Micro Devices, Inc.',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+            'memory': {'Self': {
+                'devtype2_dimm0': {
+                    'memory_device_type': 'DDR5',
+                    'capacity_mi_b': 131072,
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+            'power': {'Self': {
+                '38': {
+                    'name': 'PSU1_PIN',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+                '39': {
+                    'name': 'PSU1_POUT',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+            'network': {'Self': {
+                'networkinterfaces_devtype7_nic0': {
+                    'name': 'NetworkAdapter_0',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+            'fans': {'Self': {
+                '0': {
+                    'name': 'FAN1_TACH_IN',
+                    'reading': 23940,
+                    'reading_units': 'RPM',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+            'temperatures': {'Self': {
+                '0': {
+                    'name': 'C1_DCSCM_TEMP',
+                    'reading': 32,
+                    'reading_units': 'Cel',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+                '6': {
+                    'name': 'C1_CPU_TEMP',
+                    'reading': 47,
+                    'reading_units': 'Cel',
+                    'status': {'health': 'OK', 'state': 'Enabled'},
+                },
+            }},
+        },
+        'firmware': {
+            'bios': {
+                'name': 'BIOS',
+                'version': 'unknown',
+            },
+            'bmc': {
+                'name': 'BMC',
+                'version': '0.50.d57cfd',
+            },
+            'cpld': {
+                'name': 'CPLD',
+                'version': 'unknown',
+            },
+        },
+    }
+}
+
+
+class HardwareMetricsTest(TestCase):
+    """Tests for hardware metrics processing from node-proxy fullreport data."""
+
+    def setUp(self):
+        from prometheus.module import (
+            Module, HW_STORAGE_LABELS, HW_CPU_LABELS, HW_MEMORY_LABELS,
+            HW_HEALTH_LABELS, HW_TEMP_LABELS, HW_FAN_LABELS, HW_FIRMWARE_LABELS,
+        )
+        self.module = mock.MagicMock(spec=Module)
+        self.module.log = mock.MagicMock()
+        self.module.metrics = {
+            'hardware_storage_capacity_bytes': Metric(
+                'gauge', 'hardware_storage_capacity_bytes', '', HW_STORAGE_LABELS),
+            'hardware_cpu_cores': Metric(
+                'gauge', 'hardware_cpu_cores', '', HW_CPU_LABELS),
+            'hardware_memory_capacity_bytes': Metric(
+                'gauge', 'hardware_memory_capacity_bytes', '', HW_MEMORY_LABELS),
+            'hardware_health': Metric(
+                'gauge', 'hardware_health', '', HW_HEALTH_LABELS),
+            'hardware_temperature_celsius': Metric(
+                'gauge', 'hardware_temperature_celsius', '', HW_TEMP_LABELS),
+            'hardware_fan_rpm': Metric(
+                'gauge', 'hardware_fan_rpm', '', HW_FAN_LABELS),
+            'hardware_firmware_info': Metric(
+                'gauge', 'hardware_firmware_info', '', HW_FIRMWARE_LABELS),
+        }
+        self.hostname = 'at3n2.tuc.stglabs.ibm.com'
+        self.data = MOCK_HW_FULLREPORT[self.hostname]
+        self.status = self.data['status']
+        self.module._hw_get_health_value = Module._hw_get_health_value.__get__(self.module)
+        self.module._hw_set_health_metric = Module._hw_set_health_metric.__get__(self.module)
+        self.module._hw_iter_components = Module._hw_iter_components.__get__(self.module)
+        self.module._hw_set_sensor_metric = Module._hw_set_sensor_metric.__get__(self.module)
+        self.module._process_storage = Module._process_storage.__get__(self.module)
+        self.module._process_processors = Module._process_processors.__get__(self.module)
+        self.module._process_memory = Module._process_memory.__get__(self.module)
+        self.module._process_power_network = Module._process_power_network.__get__(self.module)
+        self.module._process_sensors = Module._process_sensors.__get__(self.module)
+        self.module._process_firmware = Module._process_firmware.__get__(self.module)
+
+    # --- _hw_get_health_value ---
+
+    def test_health_value_ok(self):
+        val = self.module._hw_get_health_value({'health': 'OK'})
+        self.assertEqual(val, 0)
+
+    def test_health_value_warning(self):
+        val = self.module._hw_get_health_value({'health': 'Warning'})
+        self.assertEqual(val, 1)
+
+    def test_health_value_critical(self):
+        val = self.module._hw_get_health_value({'health': 'Critical'})
+        self.assertEqual(val, 2)
+
+    def test_health_value_string_input(self):
+        val = self.module._hw_get_health_value('OK')
+        self.assertEqual(val, 0)
+
+    def test_health_value_unknown_logs_warning(self):
+        val = self.module._hw_get_health_value(
+            {'health': 'Exploded'}, 'host1', 'comp1', 'storage')
+        self.assertIsNone(val)
+        self.module.log.warning.assert_called_once()
+
+    def test_health_value_unknown_skips_metric(self):
+        self.module._hw_set_health_metric(
+            {'health': 'Exploded'}, 'host1', 'comp1', 'storage')
+        self.assertEqual(self.module.metrics['hardware_health'].value, {})
+
+    # --- _process_storage ---
+
+    def test_storage_capacity_and_labels(self):
+        self.module._process_storage(self.status, self.hostname)
+        expected_labels = (
+            self.hostname, 'nvme_device0_nsid1',
+            'Micron_2550_MTFDKBK512TGE', 'NVMe', 'V6MA001', '0', '24424BAA3C40',
+        )
+        self.assertEqual(
+            self.module.metrics['hardware_storage_capacity_bytes'].value[expected_labels],
+            512110190592,
+        )
+
+    def test_storage_sets_health(self):
+        self.module._process_storage(self.status, self.hostname)
+        health_labels = (self.hostname, 'nvme_device0_nsid1', 'storage')
+        self.assertEqual(
+            self.module.metrics['hardware_health'].value[health_labels], 0)
+
+    # --- _process_processors ---
+
+    def test_cpu_cores_and_threads_label(self):
+        self.module._process_processors(self.status, self.hostname)
+        expected_labels = (
+            self.hostname, 'devtype1_cpu0',
+            'Advanced Micro Devices, Inc.', 'unknown', 96,
+        )
+        self.assertEqual(
+            self.module.metrics['hardware_cpu_cores'].value[expected_labels], 48)
+
+    # --- _process_memory ---
+
+    def test_memory_mib_to_bytes_conversion(self):
+        self.module._process_memory(self.status, self.hostname)
+        expected_labels = (self.hostname, 'devtype2_dimm0', 'DDR5')
+        self.assertEqual(
+            self.module.metrics['hardware_memory_capacity_bytes'].value[expected_labels],
+            131072 * 1048576,
+        )
+
+    # --- _process_power_network ---
+
+    def test_power_uses_name_not_numeric_id(self):
+        """Power components use human-readable name (PSU1_PIN) not dict key (38)."""
+        self.module._process_power_network(self.status, self.hostname)
+        health = self.module.metrics['hardware_health'].value
+        self.assertIn((self.hostname, 'PSU1_PIN', 'power'), health)
+        self.assertIn((self.hostname, 'PSU1_POUT', 'power'), health)
+        self.assertNotIn((self.hostname, '38', 'power'), health)
+        self.assertNotIn((self.hostname, '39', 'power'), health)
+
+    def test_network_uses_comp_id_not_generic_name(self):
+        """Network uses descriptive comp_id, not generic 'NetworkAdapter_0'."""
+        self.module._process_power_network(self.status, self.hostname)
+        health = self.module.metrics['hardware_health'].value
+        self.assertIn(
+            (self.hostname, 'networkinterfaces_devtype7_nic0', 'network'), health)
+        self.assertNotIn(
+            (self.hostname, 'NetworkAdapter_0', 'network'), health)
+
+    # --- _process_sensors ---
+
+    def test_temperature_uses_sensor_name(self):
+        """Temperature reading uses 'C1_DCSCM_TEMP' not numeric key '0'."""
+        self.module._process_sensors(self.status, self.hostname)
+        temp = self.module.metrics['hardware_temperature_celsius'].value
+        self.assertIn((self.hostname, 'C1_DCSCM_TEMP'), temp)
+        self.assertEqual(temp[(self.hostname, 'C1_DCSCM_TEMP')], 32.0)
+        self.assertNotIn((self.hostname, '0'), temp)
+
+    def test_temperature_health_uses_sensor_name(self):
+        """Health metric for temperatures also uses sensor name, not numeric key."""
+        self.module._process_sensors(self.status, self.hostname)
+        health = self.module.metrics['hardware_health'].value
+        self.assertIn((self.hostname, 'C1_DCSCM_TEMP', 'temperatures'), health)
+        self.assertIn((self.hostname, 'C1_CPU_TEMP', 'temperatures'), health)
+        self.assertNotIn((self.hostname, '0', 'temperatures'), health)
+        self.assertNotIn((self.hostname, '6', 'temperatures'), health)
+
+    def test_fan_uses_fan_name(self):
+        """Fan reading uses 'FAN1_TACH_IN' not numeric key '0'."""
+        self.module._process_sensors(self.status, self.hostname)
+        fan = self.module.metrics['hardware_fan_rpm'].value
+        self.assertIn((self.hostname, 'FAN1_TACH_IN'), fan)
+        self.assertEqual(fan[(self.hostname, 'FAN1_TACH_IN')], 23940.0)
+
+    def test_sensor_unknown_reading_skipped(self):
+        """Sensors with 'unknown' reading should not set reading metric but still set health."""
+        status = {'temperatures': {'Self': {
+            '99': {
+                'name': 'GHOST_TEMP',
+                'reading': 'unknown',
+                'status': {'health': 'OK', 'state': 'Enabled'},
+            },
+        }}}
+        self.module._process_sensors(status, self.hostname)
+        self.assertNotIn(
+            (self.hostname, 'GHOST_TEMP'),
+            self.module.metrics['hardware_temperature_celsius'].value)
+        self.assertIn(
+            (self.hostname, 'GHOST_TEMP', 'temperatures'),
+            self.module.metrics['hardware_health'].value)
+
+    # --- _process_firmware ---
+
+    def test_firmware_known_version_exported(self):
+        self.module._process_firmware(self.hostname, self.data)
+        fw = self.module.metrics['hardware_firmware_info'].value
+        self.assertIn((self.hostname, 'BMC', '0.50.d57cfd'), fw)
+        self.assertEqual(fw[(self.hostname, 'BMC', '0.50.d57cfd')], 1)
+
+    def test_firmware_unknown_version_skipped(self):
+        """BIOS and CPLD with version='unknown' should not be exported."""
+        self.module._process_firmware(self.hostname, self.data)
+        fw = self.module.metrics['hardware_firmware_info'].value
+        for labels in fw:
+            self.assertNotEqual(labels[1], 'BIOS')
+            self.assertNotEqual(labels[1], 'CPLD')
+
+    # --- label count consistency ---
+
+    def test_storage_label_count_matches(self):
+        self.module._process_storage(self.status, self.hostname)
+        for labels in self.module.metrics['hardware_storage_capacity_bytes'].value:
+            self.assertEqual(len(labels), 7)
+
+    def test_cpu_label_count_matches(self):
+        self.module._process_processors(self.status, self.hostname)
+        for labels in self.module.metrics['hardware_cpu_cores'].value:
+            self.assertEqual(len(labels), 5)

From aba8698e961da03384c9493cd74e46e368d4c38b Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Wed, 1 Jul 2026 16:49:00 +0530
Subject: [PATCH 512/596] mgr/promethues: fixed tests and refactor module.py

- Update tests to check for queries in nested row panels
- fix tox tests
- add named tuple

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-mixin/tests_dashboards/util.py       | 32 +++++++--
 src/pybind/mgr/prometheus/module.py           | 67 +++++++++++--------
 2 files changed, 67 insertions(+), 32 deletions(-)

diff --git a/monitoring/ceph-mixin/tests_dashboards/util.py b/monitoring/ceph-mixin/tests_dashboards/util.py
index 734216eb94c..071e7dc2b73 100644
--- a/monitoring/ceph-mixin/tests_dashboards/util.py
+++ b/monitoring/ceph-mixin/tests_dashboards/util.py
@@ -44,7 +44,9 @@ def add_dashboard_queries(data: Dict[str, Any], dashboard_data: Dict[str, Any],
         return
     error = 0
     panel_ids_in_file = set()
-    for panel in dashboard_data['panels']:
+
+    def process_panel(panel, in_row=False):
+        nonlocal error
         if (
                 'title' in panel
                 and 'targets' in panel
@@ -55,13 +57,33 @@ def add_dashboard_queries(data: Dict[str, Any], dashboard_data: Dict[str, Any],
                 title = panel['title']
                 legend_format = target['legendFormat'] if 'legendFormat' in target else ""
                 query_id = f'{title}-{legend_format}'
-                if query_id in panel_ids_in_file and legend_format != '__auto':
-                    cprint((f'ERROR: Query in panel "{title}" with legend "{legend_format}"'
-                            f' already exists in the same file: "{path}"'), 'red')
-                    error = 1
+                # Skip duplicates within collapsed rows
+                # but error on duplicates at top-level or across different contexts
+                if query_id in panel_ids_in_file:
+                    if legend_format != '__auto' and not in_row:
+                        cprint((f'ERROR: Query in panel "{title}" with legend "{legend_format}"'
+                                f' already exists in the same file: "{path}"'), 'red')
+                        error = 1
+                    # Skip adding duplicate
+                    continue
+                # Also check for duplicates across different files
+                # NOTE: This silently skips duplicate panel+legend combinations across dashboards,
+                # which means some queries never get tested. A better approach would be to include
+                # dashboard name in query_id (e.g., "dashboard:panel-legend"), but that requires
+                # updating all test .feature files to specify which dashboard they're testing.
+                if query_id in data['queries']:
+                    # Skip silently for duplicates across files (first one wins)
+                    continue
                 data['queries'][query_id] = {'query': target['expr'], 'path': path}
                 data['stats'][path]['total'] += 1
                 panel_ids_in_file.add(query_id)
+        # Recurse into row panels
+        if panel.get('type') == 'row' and 'panels' in panel:
+            for nested_panel in panel['panels']:
+                process_panel(nested_panel, in_row=True)
+
+    for panel in dashboard_data['panels']:
+        process_panel(panel)
     if error:
         raise ValueError('Missing legend_format in queries, please add a proper value.')
 
diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index 4b353d2314a..8a81ec4bf94 100644
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -163,17 +163,19 @@ HEALTH_STATUS_MAP = {
     'Critical': 2,
 }
 
-SENSOR_METRICS = {
-    'fans': {
-        'metric': 'hardware_fan_rpm',
-        'description': 'Hardware fan speed in RPM',
-        'labels': HW_FAN_LABELS,
-    },
-    'temperatures': {
-        'metric': 'hardware_temperature_celsius',
-        'description': 'Hardware temperature sensor reading in Celsius',
-        'labels': HW_TEMP_LABELS,
-    },
+sensor_metric = namedtuple('sensor_metric', 'metric description labels')
+
+SENSOR_METRICS: Dict[str, sensor_metric] = {
+    'fans': sensor_metric(
+        'hardware_fan_rpm',
+        'Hardware fan speed in RPM',
+        HW_FAN_LABELS,
+    ),
+    'temperatures': sensor_metric(
+        'hardware_temperature_celsius',
+        'Hardware temperature sensor reading in Celsius',
+        HW_TEMP_LABELS,
+    )
 }
 
 CEPHADM_DAEMON_STATUS = ('service_type', 'daemon_name', 'hostname', 'service_name')
@@ -1063,11 +1065,11 @@ class Module(MgrModule, OrchestratorClientMixin):
         )
 
         for sensor in SENSOR_METRICS.values():
-            metrics[sensor['metric']] = Metric(
+            metrics[sensor.metric] = Metric(
                 'gauge',
-                sensor['metric'],
-                sensor['description'],
-                sensor['labels']
+                sensor.metric,
+                sensor.description,
+                sensor.labels
             )
 
         metrics['hardware_firmware_info'] = Metric(
@@ -2079,7 +2081,10 @@ class Module(MgrModule, OrchestratorClientMixin):
         except Exception as e:
             self.log.error(f"Failed to get SMB metadata: {str(e)}")
 
-    def _hw_get_health_value(self, status_val, hostname='', comp_id='', category=''):
+    def _hw_get_health_value(
+            self, status_val: Any, hostname: str = '',
+            comp_id: str = '', category: str = ''
+    ) -> Optional[int]:
         """Map a Redfish health status to a numeric value (0=OK, 1=Warning, 2=Error)."""
         if isinstance(status_val, dict):
             health_str = status_val.get('health', 'Unknown')
@@ -2097,8 +2102,11 @@ class Module(MgrModule, OrchestratorClientMixin):
             )
         return value
 
-    def _hw_set_health_metric(self, status_val, hostname, comp_id, category):
-        """Set ceph_hardware_health gauge for a single component."""
+    def _hw_set_health_metric(
+            self, status_val: Any, hostname: str,
+            comp_id: str, category: str
+    ) -> None:
+        """Set hardware_health gauge for a single component."""
         health_value = self._hw_get_health_value(
             status_val, hostname, comp_id, category
         )
@@ -2107,14 +2115,19 @@ class Module(MgrModule, OrchestratorClientMixin):
                 health_value, (hostname, comp_id, category)
             )
 
-    def _hw_iter_components(self, status, category):
+    def _hw_iter_components(
+            self, status: Dict[str, Any], category: str
+    ) -> Iterator[Tuple[str, Dict[str, Any]]]:
         """Yield (comp_id, comp_dict) pairs from nested status[category] dicts."""
         for components in status.get(category, {}).values():
             for comp_id, comp in components.items():
                 if isinstance(comp, dict):
                     yield comp_id, comp
 
-    def _hw_set_sensor_metric(self, comp, comp_id, hostname, category, metric_key):
+    def _hw_set_sensor_metric(
+            self, comp: Dict[str, Any], comp_id: str,
+            hostname: str, category: str, metric_key: str
+    ) -> None:
         """Set sensor value (temperature/fan) and health gauges using the sensor name."""
         name = comp.get('name', comp_id)
         reading = comp.get('reading')
@@ -2125,7 +2138,7 @@ class Module(MgrModule, OrchestratorClientMixin):
                 pass
         self._hw_set_health_metric(comp.get('status', {}), hostname, name, category)
 
-    def _process_storage(self, status, hostname):
+    def _process_storage(self, status: Dict[str, Any], hostname: str) -> None:
         """Set storage capacity and health metrics per drive."""
         for device_id, device in self._hw_iter_components(status, 'storage'):
             capacity = device.get('capacity_bytes', 0)
@@ -2141,7 +2154,7 @@ class Module(MgrModule, OrchestratorClientMixin):
             self.metrics['hardware_storage_capacity_bytes'].set(capacity, labels)
             self._hw_set_health_metric(device.get('status', {}), hostname, device_id, 'storage')
 
-    def _process_processors(self, status, hostname):
+    def _process_processors(self, status: Dict[str, Any], hostname: str) -> None:
         """Set CPU cores count and health metrics per processor."""
         for cpu_id, cpu in self._hw_iter_components(status, 'processors'):
             cores = cpu.get('total_cores', 0)
@@ -2155,7 +2168,7 @@ class Module(MgrModule, OrchestratorClientMixin):
             self.metrics['hardware_cpu_cores'].set(cores, labels)
             self._hw_set_health_metric(cpu.get('status', {}), hostname, cpu_id, 'processors')
 
-    def _process_memory(self, status, hostname):
+    def _process_memory(self, status: Dict[str, Any], hostname: str) -> None:
         """Set memory capacity (in bytes) and health metrics per DIMM."""
         for dimm_id, dimm in self._hw_iter_components(status, 'memory'):
             capacity_mib = dimm.get('capacity_mi_b', 0)
@@ -2168,7 +2181,7 @@ class Module(MgrModule, OrchestratorClientMixin):
             self.metrics['hardware_memory_capacity_bytes'].set(capacity_bytes, labels)
             self._hw_set_health_metric(dimm.get('status', {}), hostname, dimm_id, 'memory')
 
-    def _process_power_network(self, status, hostname):
+    def _process_power_network(self, status: Dict[str, Any], hostname: str) -> None:
         """Set health metrics for power and network"""
         for comp_id, comp in self._hw_iter_components(status, 'power'):
             name = comp.get('name', comp_id)
@@ -2176,13 +2189,13 @@ class Module(MgrModule, OrchestratorClientMixin):
         for comp_id, comp in self._hw_iter_components(status, 'network'):
             self._hw_set_health_metric(comp.get('status', {}), hostname, comp_id, 'network')
 
-    def _process_sensors(self, status, hostname):
+    def _process_sensors(self, status: Dict[str, Any], hostname: str) -> None:
         """Set fan and temperature readings and health metrics"""
         for category, sensor in SENSOR_METRICS.items():
             for comp_id, comp in self._hw_iter_components(status, category):
-                self._hw_set_sensor_metric(comp, comp_id, hostname, category, sensor['metric'])
+                self._hw_set_sensor_metric(comp, comp_id, hostname, category, sensor.metric)
 
-    def _process_firmware(self, hostname, data):
+    def _process_firmware(self, hostname: str, data: Dict[str, Any]) -> None:
         """Set firmware info metrics (value=1) with version as label, skip unknown."""
         fw_data = data.get('firmware', data.get('firmwares', {}))
         for fw_id, fw_info in fw_data.items():

From 959bc2eb07cacf70a4da09170e1c9bbed4b9423f Mon Sep 17 00:00:00 2001
From: Karthik U S <karthik.u.s1@ibm.com>
Date: Sat, 16 May 2026 06:19:59 +0530
Subject: [PATCH 513/596] mgr/mirroring: Add mirroring checkpoint CLIs

Add mgr checkpoint add/remove/ls/now commands that read and write
checkpoint metadata on the primary filesystem via do_snap_md_op.

Sample CLIs:
ceph fs snapshot mirror checkpoint add <vol-name> <dir-root> <snap-name>
ceph fs snapshot mirror checkpoint remove <vol-name> <dir-root> <snap-name>
ceph fs snapshot mirror checkpoint ls <vol-name> <dir-root>
ceph fs snapshot mirror checkpoint now <vol-name> <dir-root>

Fixes: https://tracker.ceph.com/issues/73454
Signed-off-by: Karthik U S <karthik.u.s1@ibm.com>
---
 src/pybind/mgr/mirroring/fs/checkpoint.py     | 147 ++++++++++++++++++
 .../mgr/mirroring/fs/snapshot_mirror.py       | 145 +++++++++++++++++
 src/pybind/mgr/mirroring/module.py            |  31 ++++
 3 files changed, 323 insertions(+)
 create mode 100644 src/pybind/mgr/mirroring/fs/checkpoint.py

diff --git a/src/pybind/mgr/mirroring/fs/checkpoint.py b/src/pybind/mgr/mirroring/fs/checkpoint.py
new file mode 100644
index 00000000000..87bef8851a1
--- /dev/null
+++ b/src/pybind/mgr/mirroring/fs/checkpoint.py
@@ -0,0 +1,147 @@
+import errno
+import os
+import time
+from datetime import datetime
+
+import cephfs
+
+from .exception import MirrorException
+
+# Snapshot metadata keys for mirroring checkpoints (must match Checkpoint.h).
+CHECKPOINT_STATUS_KEY = 'cephfs.mirror.checkpoint.status'
+CHECKPOINT_CREATED_AT_KEY = 'cephfs.mirror.checkpoint.created_at'
+CHECKPOINT_UPDATED_AT_KEY = 'cephfs.mirror.checkpoint.updated_at'
+CHECKPOINT_ERROR_MSG_KEY = 'cephfs.mirror.checkpoint.error_msg'
+CHECKPOINT_METADATA_KEYS = (
+    CHECKPOINT_STATUS_KEY,
+    CHECKPOINT_CREATED_AT_KEY,
+    CHECKPOINT_UPDATED_AT_KEY,
+    CHECKPOINT_ERROR_MSG_KEY,
+)
+CHECKPOINT_STATUS_CREATED = 0
+CHECKPOINT_STATUS_COMPLETE = 1
+CHECKPOINT_STATUS_FAILED = 2
+CHECKPOINT_STATUS_NAMES = {
+    CHECKPOINT_STATUS_CREATED: 'created',
+    CHECKPOINT_STATUS_COMPLETE: 'complete',
+    CHECKPOINT_STATUS_FAILED: 'failed',
+}
+
+
+def get_checkpoint_epoch():
+    """Get current time as UNIX epoch timestamp (9 decimal places, matches C++ %.9f)."""
+    return f'{time.time():.9f}'
+
+
+def format_epoch_timestamp(epoch_str):
+    """Format UNIX epoch timestamp for display in ISO format with timezone."""
+    try:
+        epoch = float(epoch_str)
+        dt = datetime.fromtimestamp(epoch).astimezone()
+        return dt.strftime('%Y-%m-%dT%H:%M:%S.%f%z')
+    except (ValueError, OSError):
+        return epoch_str
+
+
+def snap_path(dir_path, snap_dir, snap_name):
+    return os.path.join(dir_path, snap_dir, snap_name)
+
+
+def checkpoint_status_to_string(status_val):
+    try:
+        return CHECKPOINT_STATUS_NAMES[int(status_val)]
+    except (ValueError, KeyError):
+        return 'unknown'
+
+
+def checkpoint_from_snap(snap_id, snap_name, metadata):
+    created_at = metadata.get(CHECKPOINT_CREATED_AT_KEY, '')
+    updated_at = metadata.get(CHECKPOINT_UPDATED_AT_KEY, '')
+
+    cp = {
+        'snap_id': snap_id,
+        'snap_name': snap_name,
+        'status': checkpoint_status_to_string(
+            metadata.get(CHECKPOINT_STATUS_KEY, CHECKPOINT_STATUS_CREATED)),
+        'created_at': format_epoch_timestamp(created_at) if created_at else '',
+        'updated_at': format_epoch_timestamp(updated_at) if updated_at else '',
+    }
+    if CHECKPOINT_ERROR_MSG_KEY in metadata:
+        cp['error_msg'] = metadata[CHECKPOINT_ERROR_MSG_KEY]
+    return cp
+
+
+def is_checkpointed(metadata):
+    return CHECKPOINT_STATUS_KEY in metadata
+
+
+class Checkpoint:
+    def __init__(self, get_snapdir):
+        self.get_snapdir = get_snapdir
+
+    def list_directory_snapshots(self, fsh, dir_path):
+        snap_dir = self.get_snapdir()
+        snap_names = []
+        try:
+            with fsh.opendir(os.path.join(dir_path, snap_dir)) as d_handle:
+                ent = fsh.readdir(d_handle)
+                while ent:
+                    name = ent.d_name.decode('utf-8')
+                    if name not in ('.', '..') and not name.startswith('_'):
+                        snap_names.append(name)
+                    ent = fsh.readdir(d_handle)
+        except cephfs.Error as e:
+            if e.errno == errno.ENOENT:
+                return []
+            raise MirrorException(-e.errno, f'failed to list snapshots: {e}')
+        return snap_names
+
+    def snap_info(self, fsh, dir_path, snap_name):
+        path = snap_path(dir_path, self.get_snapdir(), snap_name)
+        try:
+            return fsh.snap_info(path)
+        except cephfs.Error as e:
+            raise MirrorException(-e.errno,
+                                  f"snapshot '{snap_name}' not found under {dir_path}")
+
+    def get_latest_snap(self, fsh, dir_path):
+        latest_id = 0
+        latest_name = None
+        latest_info = None
+
+        for snap_name in self.list_directory_snapshots(fsh, dir_path):
+            info = self.snap_info(fsh, dir_path, snap_name)
+            if info['id'] > latest_id:
+                latest_id = info['id']
+                latest_name = snap_name
+                latest_info = info
+
+        if latest_name is None:
+            raise MirrorException(-errno.ENOENT, f'no snapshots found under {dir_path}')
+        return latest_name, latest_info
+
+    def write_metadata(self, fsh, dir_path, snap_name, snap_info):
+        if is_checkpointed(snap_info.get('metadata', {})):
+            raise MirrorException(-errno.EEXIST, 'checkpoint already exists for snapshot')
+
+        path = snap_path(dir_path, self.get_snapdir(), snap_name)
+        now = get_checkpoint_epoch()
+        to_write = {
+            CHECKPOINT_STATUS_KEY: str(CHECKPOINT_STATUS_CREATED),
+            CHECKPOINT_CREATED_AT_KEY: now,
+            CHECKPOINT_UPDATED_AT_KEY: now,
+        }
+
+        op = cephfs.CEPH_SNAP_MD_OP_CREATE | cephfs.CEPH_SNAP_MD_OP_EXCL
+        for key, val in to_write.items():
+            fsh.do_snap_md_op(path, key, val, op)
+
+    def remove_metadata(self, fsh, dir_path, snap_name, snap_info):
+        metadata = snap_info.get('metadata', {})
+        if not is_checkpointed(metadata):
+            raise MirrorException(-errno.ENOENT, 'checkpoint not found for snapshot')
+
+        path = snap_path(dir_path, self.get_snapdir(), snap_name)
+        for key in CHECKPOINT_METADATA_KEYS:
+            if key in metadata:
+                fsh.do_snap_md_op(path, key, '', cephfs.CEPH_SNAP_MD_OP_REMOVE)
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 0d88613e2d6..82075612264 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -31,6 +31,11 @@ from .dir_map.load import load_dir_map, load_instances
 from .dir_map.update import UpdateDirMapRequest, UpdateInstanceRequest
 from .dir_map.policy import Policy
 from .dir_map.state_transition import ActionType
+from .checkpoint import (
+    Checkpoint,
+    checkpoint_from_snap,
+    is_checkpointed,
+)
 
 log = logging.getLogger(__name__)
 
@@ -304,6 +309,7 @@ class FSSnapshotMirror:
         self.lock = threading.Lock()
         self.refresh_pool_policy()
         self.local_fs = CephfsClient(mgr)
+        self.checkpoint = Checkpoint(self._client_snapdir)
 
     def notify(self, notify_type: NotifyType):
         log.debug(f'got notify type {notify_type}')
@@ -992,3 +998,142 @@ class FSSnapshotMirror:
                     return 0, json.dumps(daemons), ''
         except MirrorException as me:
             return me.args[0], '', me.args[1]
+
+    def _validate_checkpoint_dir(self, fs_name, dir_path):
+        """Validate filesystem and mirrored directory; return normalized dir path."""
+        if not self.filesystem_exist(fs_name):
+            raise MirrorException(-errno.ENOENT, f'filesystem {fs_name} does not exist')
+
+        fspolicy = self.pool_policy.get(fs_name, None)
+        if not fspolicy:
+            raise MirrorException(-errno.EINVAL, f'filesystem {fs_name} is not mirrored')
+
+        dir_path = norm_path(dir_path)
+        if not dir_path:
+            raise MirrorException(-errno.EINVAL, 'directory path is required')
+
+        lookup_info = fspolicy.policy.lookup(dir_path)
+        if not lookup_info:
+            raise MirrorException(-errno.ENOENT, f'directory {dir_path} is not tracked')
+
+        if lookup_info['purging']:
+            raise MirrorException(-errno.EINVAL, f'directory {dir_path} is under removal')
+
+        return dir_path
+
+    def _client_snapdir(self):
+        return self.mgr.get_foreign_ceph_option('client', 'client_snapdir')
+
+    def checkpoint_add(self, fs_name, dir_path, snap_name):
+        """Add a checkpoint for a snapshot via snapshot metadata on the primary filesystem."""
+        try:
+            with self.lock:
+                dir_path = self._validate_checkpoint_dir(fs_name, dir_path)
+
+            with open_filesystem(self.local_fs, fs_name) as fsh:
+                info = self.checkpoint.snap_info(fsh, dir_path, snap_name)
+                self.checkpoint.write_metadata(fsh, dir_path, snap_name, info)
+
+            result = {
+                'status': 'success',
+                'message': f'checkpoint added for snapshot {snap_name}',
+                'dir_root': dir_path,
+                'snap_id': info['id'],
+                'snap_name': snap_name,
+                'checkpoint_status': 'created',
+            }
+            return 0, json.dumps(result), ''
+        except MirrorException as me:
+            return me.args[0], '', me.args[1]
+        except cephfs.Error as e:
+            return -e.errno, '', f'failed to add checkpoint: {e}'
+        except Exception as e:
+            log.error(f'failed to add checkpoint: {e}')
+            return -errno.EINVAL, '', f'failed to add checkpoint: {str(e)}'
+
+    def checkpoint_remove(self, fs_name, dir_path, snap_name):
+        """Remove a checkpoint from a snapshot via snapshot metadata on the primary filesystem."""
+        try:
+            with self.lock:
+                dir_path = self._validate_checkpoint_dir(fs_name, dir_path)
+
+            with open_filesystem(self.local_fs, fs_name) as fsh:
+                info = self.checkpoint.snap_info(fsh, dir_path, snap_name)
+                self.checkpoint.remove_metadata(fsh, dir_path, snap_name, info)
+
+            result = {
+                'status': 'success',
+                'message': f'checkpoint removed for snapshot {snap_name}',
+                'dir_root': dir_path,
+                'snap_name': snap_name,
+            }
+            return 0, json.dumps(result), ''
+        except MirrorException as me:
+            return me.args[0], '', me.args[1]
+        except cephfs.Error as e:
+            return -e.errno, '', f'failed to remove checkpoint: {e}'
+        except Exception as e:
+            log.error(f'failed to remove checkpoint: {e}')
+            return -errno.EINVAL, '', f'failed to remove checkpoint: {str(e)}'
+
+    def checkpoint_ls(self, fs_name, dir_path, format='json'):
+        """List all checkpoints for a directory from snapshot metadata on the primary filesystem."""
+        try:
+            with self.lock:
+                dir_path = self._validate_checkpoint_dir(fs_name, dir_path)
+
+            checkpoints = []
+            with open_filesystem(self.local_fs, fs_name) as fsh:
+                for snap_name in self.checkpoint.list_directory_snapshots(fsh, dir_path):
+                    try:
+                        info = self.checkpoint.snap_info(fsh, dir_path, snap_name)
+                    except MirrorException as me:
+                        log.warning(
+                            f'failed to get snapshot info for {snap_name!r} '
+                            f'under {dir_path}: {me.args[1]}')
+                        continue
+                    md = info.get('metadata', {})
+                    if is_checkpointed(md):
+                        checkpoints.append(
+                            checkpoint_from_snap(info['id'], snap_name, md))
+
+            checkpoints.sort(key=lambda cp: cp['snap_id'])
+            result = {'dir_root': dir_path, 'checkpoints': checkpoints}
+
+            if format == 'json-pretty':
+                return 0, json.dumps(result, indent=2), ''
+            return 0, json.dumps(result), ''
+        except MirrorException as me:
+            return me.args[0], '', me.args[1]
+        except cephfs.Error as e:
+            return -e.errno, '', f'failed to list checkpoints: {e}'
+        except Exception as e:
+            log.error(f'failed to list checkpoints: {e}')
+            return -errno.EINVAL, '', f'failed to list checkpoints: {str(e)}'
+
+    def checkpoint_now(self, fs_name, dir_path):
+        """Create a checkpoint on the latest snapshot via snapshot metadata."""
+        try:
+            with self.lock:
+                dir_path = self._validate_checkpoint_dir(fs_name, dir_path)
+
+            with open_filesystem(self.local_fs, fs_name) as fsh:
+                snap_name, info = self.checkpoint.get_latest_snap(fsh, dir_path)
+                self.checkpoint.write_metadata(fsh, dir_path, snap_name, info)
+
+            result = {
+                'status': 'success',
+                'message': 'checkpoint created on latest snapshot',
+                'dir_root': dir_path,
+                'snap_id': info['id'],
+                'snap_name': snap_name,
+                'checkpoint_status': 'created',
+            }
+            return 0, json.dumps(result), ''
+        except MirrorException as me:
+            return me.args[0], '', me.args[1]
+        except cephfs.Error as e:
+            return -e.errno, '', f'failed to create checkpoint: {e}'
+        except Exception as e:
+            log.error(f'failed to create checkpoint: {e}')
+            return -errno.EINVAL, '', f'failed to create checkpoint: {str(e)}'
diff --git a/src/pybind/mgr/mirroring/module.py b/src/pybind/mgr/mirroring/module.py
index 3fbe145864e..829d713436b 100644
--- a/src/pybind/mgr/mirroring/module.py
+++ b/src/pybind/mgr/mirroring/module.py
@@ -141,3 +141,34 @@ class Module(MgrModule):
         """Get snapshot mirror metrics for a filesystem (optional mirrored directory and peer)"""
         return self.fs_snapshot_mirror.metrics_status(fs_name, mirrored_dir_path,
                                                       peer_uuid)
+
+    @MirroringCLICommand.Write('fs snapshot mirror checkpoint add')
+    def snapshot_mirror_checkpoint_add(self,
+                                       fs_name: str,
+                                       path: str,
+                                       snap_name: str):
+        """Add a checkpoint for a snapshot"""
+        return self.fs_snapshot_mirror.checkpoint_add(fs_name, path, snap_name)
+
+    @MirroringCLICommand.Write('fs snapshot mirror checkpoint remove')
+    def snapshot_mirror_checkpoint_remove(self,
+                                          fs_name: str,
+                                          path: str,
+                                          snap_name: str):
+        """Remove a checkpoint from a snapshot"""
+        return self.fs_snapshot_mirror.checkpoint_remove(fs_name, path, snap_name)
+
+    @MirroringCLICommand.Read('fs snapshot mirror checkpoint ls')
+    def snapshot_mirror_checkpoint_ls(self,
+                                       fs_name: str,
+                                       path: str,
+                                       format: str = 'json'):
+        """List all checkpoints for a directory"""
+        return self.fs_snapshot_mirror.checkpoint_ls(fs_name, path, format)
+
+    @MirroringCLICommand.Write('fs snapshot mirror checkpoint now')
+    def snapshot_mirror_checkpoint_now(self,
+                                       fs_name: str,
+                                       path: str):
+        """Create a checkpoint on the latest snapshot"""
+        return self.fs_snapshot_mirror.checkpoint_now(fs_name, path)

From 0a394ef438abd0248d078ea72e8ae5ce4f3d5e84 Mon Sep 17 00:00:00 2001
From: Karthik U S <karthik.u.s1@ibm.com>
Date: Wed, 13 May 2026 04:51:53 +0530
Subject: [PATCH 514/596] tools/cephfs_mirror: Helper functions for mirroring
 checkpoints

Implementation of helper functions and data structures for the
snapshot based mirroring checkpoints feature.

Fixes: https://tracker.ceph.com/issues/73454
Signed-off-by: Karthik U S <karthik.u.s1@ibm.com>
---
 src/tools/cephfs_mirror/CMakeLists.txt  |   1 +
 src/tools/cephfs_mirror/Checkpoint.cc   | 170 ++++++++++++++++++++++++
 src/tools/cephfs_mirror/Checkpoint.h    |  93 +++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.cc |  12 --
 src/tools/cephfs_mirror/Utils.cc        |  13 ++
 src/tools/cephfs_mirror/Utils.h         |   7 +
 6 files changed, 284 insertions(+), 12 deletions(-)
 create mode 100644 src/tools/cephfs_mirror/Checkpoint.cc
 create mode 100644 src/tools/cephfs_mirror/Checkpoint.h

diff --git a/src/tools/cephfs_mirror/CMakeLists.txt b/src/tools/cephfs_mirror/CMakeLists.txt
index 4b6dea7a160..bcba2a277e9 100644
--- a/src/tools/cephfs_mirror/CMakeLists.txt
+++ b/src/tools/cephfs_mirror/CMakeLists.txt
@@ -1,4 +1,5 @@
 set(cephfs_mirror_internal
+  Checkpoint.cc
   ClusterWatcher.cc
   Mirror.cc
   FSMirror.cc
diff --git a/src/tools/cephfs_mirror/Checkpoint.cc b/src/tools/cephfs_mirror/Checkpoint.cc
new file mode 100644
index 00000000000..f21b8389194
--- /dev/null
+++ b/src/tools/cephfs_mirror/Checkpoint.cc
@@ -0,0 +1,170 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab
+
+#include "Checkpoint.h"
+#include "Utils.h"
+
+#include "common/strtol.h"
+
+#include <cstdio>
+#include <vector>
+
+namespace cephfs {
+namespace mirror {
+
+namespace {
+
+const std::vector<std::string> CHECKPOINT_METADATA_KEY_LIST = {
+  CHECKPOINT_STATUS_KEY,
+  CHECKPOINT_CREATED_AT_KEY,
+  CHECKPOINT_UPDATED_AT_KEY,
+  CHECKPOINT_ERROR_MSG_KEY,
+};
+
+std::map<std::string, std::string> decode_snap_metadata(snap_metadata *md,
+                                                        size_t nr_snap_metadata) {
+  std::map<std::string, std::string> metadata;
+  for (size_t i = 0; i < nr_snap_metadata; ++i) {
+    metadata.emplace(md[i].key, md[i].value);
+  }
+  return metadata;
+}
+
+} // anonymous namespace
+
+std::string utime_to_epoch_string(const utime_t &t) {
+  double epoch = (double)t.sec() + (double)t.nsec() / 1000000000.0;
+  char buf[32];
+  snprintf(buf, sizeof(buf), "%.9f", epoch);
+  return std::string(buf);
+}
+
+bool utime_from_epoch_string(const std::string &s, utime_t *t) {
+  std::string err;
+  double epoch = strict_strtod(s, &err);
+  if (!err.empty()) {
+    return false;
+  }
+  t->set_from_double(epoch);
+  return true;
+}
+
+CheckpointInfo::CheckpointInfo()
+  : snap_id(0),
+    status(CheckpointStatus::CREATED) {
+}
+
+CheckpointInfo::CheckpointInfo(uint64_t snap_id_, const std::string &snap_name_)
+  : snap_id(snap_id_),
+    snap_name(snap_name_),
+    status(CheckpointStatus::CREATED) {
+}
+
+std::map<std::string, std::string> CheckpointInfo::to_metadata() const {
+  std::map<std::string, std::string> metadata;
+  metadata[CHECKPOINT_STATUS_KEY] = std::to_string(static_cast<uint8_t>(status));
+  metadata[CHECKPOINT_CREATED_AT_KEY] = utime_to_epoch_string(created_at);
+  metadata[CHECKPOINT_UPDATED_AT_KEY] = utime_to_epoch_string(updated_at);
+  if (!error_msg.empty()) {
+    metadata[CHECKPOINT_ERROR_MSG_KEY] = error_msg;
+  }
+  return metadata;
+}
+
+CheckpointInfo CheckpointInfo::from_metadata(uint64_t snap_id, const std::string &snap_name,
+                                              const std::map<std::string, std::string> &metadata) {
+  CheckpointInfo info(snap_id, snap_name);
+
+  auto it = metadata.find(CHECKPOINT_STATUS_KEY);
+  if (it != metadata.end()) {
+    info.status = static_cast<CheckpointStatus>(std::stoul(it->second));
+  }
+
+  it = metadata.find(CHECKPOINT_CREATED_AT_KEY);
+  if (it != metadata.end()) {
+    utime_from_epoch_string(it->second, &info.created_at);
+  }
+
+  it = metadata.find(CHECKPOINT_UPDATED_AT_KEY);
+  if (it != metadata.end()) {
+    utime_from_epoch_string(it->second, &info.updated_at);
+  }
+
+  it = metadata.find(CHECKPOINT_ERROR_MSG_KEY);
+  if (it != metadata.end()) {
+    info.error_msg = it->second;
+  }
+
+  return info;
+}
+
+int read_snap_metadata(MountRef mnt, const std::string &snap_path,
+                       std::map<std::string, std::string> *metadata) {
+  snap_info info;
+  int r = ceph_get_snap_info(mnt, snap_path.c_str(), &info);
+  if (r < 0) {
+    return r;
+  }
+
+  metadata->clear();
+  if (info.nr_snap_metadata) {
+    *metadata = decode_snap_metadata(info.snap_metadata, info.nr_snap_metadata);
+    ceph_free_snap_info_buffer(&info);
+  }
+  return 0;
+}
+
+CheckpointInfo read_checkpoint_metadata(uint64_t snap_id,
+                                        const std::string &snap_name,
+                                        const std::map<std::string, std::string> &snap_metadata) {
+  return CheckpointInfo::from_metadata(snap_id, snap_name, snap_metadata);
+}
+
+int write_checkpoint_metadata(CephContext *cct, MountRef mnt,
+                               const std::string &dir_root,
+                               const std::string &snap_name,
+                               const std::map<std::string, std::string> &snap_metadata,
+                               const CheckpointInfo &info) {
+  auto snap_path = snapshot_path(cct, dir_root, snap_name);
+  auto checkpoint_metadata = info.to_metadata();
+
+  // Write/update checkpoint metadata keys
+  for (const auto &[key, val] : checkpoint_metadata) {
+    // created_at is set by the mgr when the checkpoint is created; mirror
+    // daemon updates must not rewrite it.
+    if (key == CHECKPOINT_CREATED_AT_KEY && snap_metadata.count(key)) {
+      continue;
+    }
+
+    auto it = snap_metadata.find(key);
+    if (it != snap_metadata.end() && it->second == val) {
+      continue;
+    }
+
+    // For updates: use CREATE (allows both create and update)
+    // For new creates: use CREATE | EXCL (create only, reject update)
+    unsigned int op_flag = it != snap_metadata.end() ?
+      CEPH_SNAP_MD_OP_CREATE : (CEPH_SNAP_MD_OP_CREATE | CEPH_SNAP_MD_OP_EXCL);
+    int r = ceph_do_snap_md_op(mnt, snap_path.c_str(), key.c_str(), val.c_str(),
+                               op_flag);
+    if (r < 0) {
+      return r;
+    }
+  }
+
+  // Remove checkpoint metadata keys that are no longer present
+  for (const auto &key : CHECKPOINT_METADATA_KEY_LIST) {
+    if (snap_metadata.count(key) && !checkpoint_metadata.count(key)) {
+      int r = ceph_do_snap_md_op(mnt, snap_path.c_str(), key.c_str(), "",
+                                 CEPH_SNAP_MD_OP_REMOVE);
+      if (r < 0) {
+        return r;
+      }
+    }
+  }
+
+  return 0;
+}
+
+} // namespace mirror
+} // namespace cephfs
diff --git a/src/tools/cephfs_mirror/Checkpoint.h b/src/tools/cephfs_mirror/Checkpoint.h
new file mode 100644
index 00000000000..8b04a501291
--- /dev/null
+++ b/src/tools/cephfs_mirror/Checkpoint.h
@@ -0,0 +1,93 @@
+// -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:nil -*-
+// vim: ts=8 sw=2 sts=2 expandtab
+
+#ifndef CEPHFS_MIRROR_CHECKPOINT_H
+#define CEPHFS_MIRROR_CHECKPOINT_H
+
+#include <string>
+#include <map>
+
+#include "include/utime.h"
+#include "Types.h"
+
+namespace cephfs {
+namespace mirror {
+
+// Checkpoint status enumeration
+enum class CheckpointStatus : uint8_t {
+  CREATED = 0,   // Checkpoint created but not yet synced
+  COMPLETE = 1,  // Checkpoint successfully synced to remote
+  FAILED = 2     // Checkpoint sync failed
+};
+
+// Convert checkpoint status to string
+inline std::string checkpoint_status_to_string(CheckpointStatus status) {
+  switch (status) {
+    case CheckpointStatus::CREATED:
+      return "created";
+    case CheckpointStatus::COMPLETE:
+      return "complete";
+    case CheckpointStatus::FAILED:
+      return "failed";
+    default:
+      return "unknown";
+  }
+}
+
+// Checkpoint metadata keys stored in snapshot metadata
+inline static const std::string CHECKPOINT_STATUS_KEY = "cephfs.mirror.checkpoint.status";
+inline static const std::string CHECKPOINT_CREATED_AT_KEY = "cephfs.mirror.checkpoint.created_at";
+inline static const std::string CHECKPOINT_UPDATED_AT_KEY = "cephfs.mirror.checkpoint.updated_at";
+inline static const std::string CHECKPOINT_ERROR_MSG_KEY = "cephfs.mirror.checkpoint.error_msg";
+
+// Snapshot metadata stores created_at/updated_at as UNIX epoch strings with
+// 9 decimal places (Python get_checkpoint_epoch() or utime_to_epoch_string()).
+std::string utime_to_epoch_string(const utime_t &t);
+bool utime_from_epoch_string(const std::string &s, utime_t *t);
+
+// Checkpoint information structure
+struct CheckpointInfo {
+  uint64_t snap_id;              // Snapshot ID (unique identifier)
+  std::string snap_name;         // Snapshot name
+  CheckpointStatus status;       // Current status of the checkpoint
+  utime_t created_at;            // When the checkpoint was created (epoch in metadata)
+  utime_t updated_at;            // Last status update time (epoch in metadata)
+  std::string error_msg;         // Error message if status is FAILED
+
+  CheckpointInfo();
+  CheckpointInfo(uint64_t snap_id_, const std::string &snap_name_);
+
+  // Convert to/from snapshot metadata map
+  std::map<std::string, std::string> to_metadata() const;
+  static CheckpointInfo from_metadata(uint64_t snap_id, const std::string &snap_name,
+                                       const std::map<std::string, std::string> &metadata);
+};
+
+
+// Helper functions for checkpoint metadata operations
+
+// Read snapshot metadata
+int read_snap_metadata(MountRef mnt, const std::string &snap_path,
+                       std::map<std::string, std::string> *metadata);
+
+// Read checkpoint metadata from a snapshot
+CheckpointInfo read_checkpoint_metadata(uint64_t snap_id,
+                                        const std::string &snap_name,
+                                        const std::map<std::string, std::string> &snap_metadata);
+
+// Write checkpoint metadata to a snapshot
+int write_checkpoint_metadata(CephContext *cct, MountRef mnt,
+                              const std::string &dir_root,
+                              const std::string &snap_name,
+                              const std::map<std::string, std::string> &snap_metadata,
+                              const CheckpointInfo &info);
+
+// Check if checkpoint key exists in snapshot metadata
+inline bool has_checkpoint(const std::map<std::string, std::string> &snap_metadata) {
+  return snap_metadata.find(CHECKPOINT_STATUS_KEY) != snap_metadata.end();
+}
+
+} // namespace mirror
+} // namespace cephfs
+
+#endif // CEPHFS_MIRROR_CHECKPOINT_H
diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index aafc6eba298..1e9c2cf491a 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -92,18 +92,6 @@ const std::string PEER_CONFIG_KEY_PREFIX = "cephfs/mirror/peer";
 // Matches the mgr mirroring omap read batch size (dir_map/load.py MAX_RETURN).
 constexpr size_t SYNC_STAT_OMAP_LOAD_BATCH_SIZE = 256;
 
-std::string snapshot_dir_path(CephContext *cct, const std::string &path) {
-  return path + "/" + cct->_conf->client_snapdir;
-}
-
-std::string snapshot_path(const std::string &snap_dir, const std::string &snap_name) {
-  return snap_dir + "/" + snap_name;
-}
-
-std::string snapshot_path(CephContext *cct, const std::string &path, const std::string &snap_name) {
-  return path + "/" + cct->_conf->client_snapdir + "/" + snap_name;
-}
-
 std::string entry_path(const std::string &dir, const std::string &name) {
   return dir + "/" + name;
 }
diff --git a/src/tools/cephfs_mirror/Utils.cc b/src/tools/cephfs_mirror/Utils.cc
index cad07fdb90f..e4692b333ff 100644
--- a/src/tools/cephfs_mirror/Utils.cc
+++ b/src/tools/cephfs_mirror/Utils.cc
@@ -162,5 +162,18 @@ int mount(RadosRef cluster, const Filesystem &filesystem, bool cross_check_fscid
   return 0;
 }
 
+std::string snapshot_dir_path(CephContext *cct, const std::string &dir_root) {
+  return dir_root + "/" + cct->_conf->client_snapdir;
+}
+
+std::string snapshot_path(const std::string &snap_dir, const std::string &snap_name) {
+  return snap_dir + "/" + snap_name;
+}
+
+std::string snapshot_path(CephContext *cct, const std::string &dir_root,
+                          const std::string &snap_name) {
+  return snapshot_dir_path(cct, dir_root) + "/" + snap_name;
+}
+
 } // namespace mirror
 } // namespace cephfs
diff --git a/src/tools/cephfs_mirror/Utils.h b/src/tools/cephfs_mirror/Utils.h
index ab6c80ab5c6..28dc08fd0e9 100644
--- a/src/tools/cephfs_mirror/Utils.h
+++ b/src/tools/cephfs_mirror/Utils.h
@@ -4,11 +4,18 @@
 #ifndef CEPHFS_MIRROR_UTILS_H
 #define CEPHFS_MIRROR_UTILS_H
 
+#include <string>
+
 #include "Types.h"
 
 namespace cephfs {
 namespace mirror {
 
+std::string snapshot_dir_path(CephContext *cct, const std::string &dir_root);
+std::string snapshot_path(const std::string &snap_dir, const std::string &snap_name);
+std::string snapshot_path(CephContext *cct, const std::string &dir_root,
+                          const std::string &snap_name);
+
 int connect(std::string_view client_name, std::string_view cluster_name,
             RadosRef *cluster, std::string_view mon_host={}, std::string_view cephx_key={},
             std::vector<const char *> args={});

From 37163436cc87a2be691202bb565c7b5007df026f Mon Sep 17 00:00:00 2001
From: Karthik U S <karthik.u.s1@ibm.com>
Date: Sat, 16 May 2026 06:20:03 +0530
Subject: [PATCH 515/596] tools/cephfs_mirror: update checkpoint status during
 snapshot sync

When the sync completes or fails for a checkpointed snapshot, transition
the status of that checkpoint from CREATED/FAILED to COMPLETE/FAILED in
the do_sync_snaps() along with the timestamp of the event.

Fixes: https://tracker.ceph.com/issues/73454
Signed-off-by: Karthik U S <karthik.u.s1@ibm.com>
---
 src/tools/cephfs_mirror/PeerReplayer.cc | 101 ++++++++++++++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.h  |   6 ++
 2 files changed, 107 insertions(+)

diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 1e9c2cf491a..202f9b1f61f 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -1373,6 +1373,105 @@ int PeerReplayer::build_snap_map(const std::string &dir_root,
   return rv;
 }
 
+void PeerReplayer::checkpoint_sync_complete(const std::string &dir_root,
+                                            uint64_t synced_snap_id,
+                                            const std::string &snap_name) {
+  dout(10) << ": dir_root=" << dir_root << " synced_snap_id=" << synced_snap_id
+           << " snap_name=" << snap_name << dendl;
+
+  // Read snapshot metadata
+  auto snap_path = snapshot_path(m_cct, dir_root, snap_name);
+  std::map<std::string, std::string> snap_metadata;
+  int r = read_snap_metadata(m_local_mount, snap_path, &snap_metadata);
+  if (r < 0) {
+    derr << ": failed to read snap metadata for snap_name=" << snap_name
+         << " dir_root=" << dir_root << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+
+  // Check if this snapshot has a checkpoint
+  if (!has_checkpoint(snap_metadata)) {
+    dout(10) << ": no checkpoint for snap_id=" << synced_snap_id << dendl;
+    return;
+  }
+
+  // Read checkpoint info
+  CheckpointInfo info = read_checkpoint_metadata(synced_snap_id, snap_name, snap_metadata);
+
+  // Skip if already complete
+  if (info.status == CheckpointStatus::COMPLETE) {
+    dout(10) << ": checkpoint already complete for snap_id=" << synced_snap_id << dendl;
+    return;
+  }
+
+  // Update status to COMPLETE
+  info.status = CheckpointStatus::COMPLETE;
+  info.updated_at = ceph_clock_now();
+  info.error_msg.clear();
+
+  r = write_checkpoint_metadata(m_cct, m_local_mount, dir_root, snap_name, snap_metadata, info);
+  if (r < 0) {
+    derr << ": failed to mark checkpoint completed for snap_id=" << synced_snap_id
+         << " snap_name=" << snap_name << " dir_root=" << dir_root
+         << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+
+  dout(10) << ": marked checkpoint completed for snap_id=" << synced_snap_id
+           << " snap_name=" << snap_name << dendl;
+}
+
+void PeerReplayer::checkpoint_sync_failed(const std::string &dir_root,
+                                          uint64_t snap_id,
+                                          const std::string &snap_name,
+                                          int err) {
+  dout(10) << ": dir_root=" << dir_root << " snap_id=" << snap_id
+           << " snap_name=" << snap_name << " err=" << err
+           << " (" << cpp_strerror(err) << ")" << dendl;
+
+  // Read snapshot metadata
+  auto snap_path = snapshot_path(m_cct, dir_root, snap_name);
+  std::map<std::string, std::string> snap_metadata;
+  int r = read_snap_metadata(m_local_mount, snap_path, &snap_metadata);
+  if (r < 0) {
+    derr << ": failed to read snap metadata for snap_name=" << snap_name
+         << " dir_root=" << dir_root << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+
+  // Check if this snapshot has a checkpoint
+  if (!has_checkpoint(snap_metadata)) {
+    dout(10) << ": no checkpoint for snap_id=" << snap_id << dendl;
+    return;
+  }
+
+  // Read checkpoint info
+  CheckpointInfo info = read_checkpoint_metadata(snap_id, snap_name, snap_metadata);
+
+  // Only update if it's in CREATED or FAILED status (to update error message)
+  if (info.status != CheckpointStatus::CREATED && info.status != CheckpointStatus::FAILED) {
+    dout(10) << ": checkpoint not in CREATED or FAILED status, current status="
+             << checkpoint_status_to_string(info.status) << dendl;
+    return;
+  }
+
+  // Update status to FAILED with sync error message
+  info.status = CheckpointStatus::FAILED;
+  info.updated_at = ceph_clock_now();
+  info.error_msg = string("snapshot synchronization failed: ") + cpp_strerror(err);
+
+  r = write_checkpoint_metadata(m_cct, m_local_mount, dir_root, snap_name, snap_metadata, info);
+  if (r < 0) {
+    derr << ": failed to mark checkpoint failed for snap_id=" << snap_id
+         << " snap_name=" << snap_name << " dir_root=" << dir_root
+         << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+
+  dout(10) << ": marked checkpoint failed for snap_id=" << snap_id
+           << " snap_name=" << snap_name << dendl;
+}
+
 int PeerReplayer::propagate_snap_deletes(const std::string &dir_root,
                                          const std::set<std::string> &snaps) {
   dout(5) << ": dir_root=" << dir_root << ", deleted snapshots=" << snaps << dendl;
@@ -3058,6 +3157,7 @@ int PeerReplayer::do_sync_snaps(const std::string &dir_root) {
     if (r < 0) {
       derr << ": failed to synchronize dir_root=" << dir_root
            << ", snapshot=" << it->second << dendl;
+      checkpoint_sync_failed(dir_root, it->first, it->second, r);
       clear_current_syncing_snap(dir_root);
       return r;
     }
@@ -3076,6 +3176,7 @@ int PeerReplayer::do_sync_snaps(const std::string &dir_root) {
 
     set_last_synced_stat(dir_root, it->first, it->second, duration);
     persist_dir_sync_stat(dir_root);
+    checkpoint_sync_complete(dir_root, it->first, it->second);
     if (--snaps_per_cycle == 0) {
       break;
     }
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 60cd81239df..4cf99201bb4 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -10,6 +10,7 @@
 #include "ServiceDaemon.h"
 #include "Types.h"
 #include "json_spirit/json_spirit.h"
+#include "Checkpoint.h"
 
 #include <deque>
 #include <functional>
@@ -766,6 +767,11 @@ private:
   int build_snap_map(const std::string &dir_root, std::map<uint64_t, std::string> *snap_map,
                      bool is_remote=false);
 
+  void checkpoint_sync_complete(const std::string &dir_root, uint64_t synced_snap_id,
+                                const std::string &snap_name);
+  void checkpoint_sync_failed(const std::string &dir_root, uint64_t snap_id,
+                              const std::string &snap_name, int err);
+
   int propagate_snap_deletes(const std::string &dir_root, const std::set<std::string> &snaps);
   int propagate_snap_renames(const std::string &dir_root,
                              const std::set<std::pair<std::string,std::string>> &snaps);

From c64fe9636514d9e9b1c286a0b21b84569e266067 Mon Sep 17 00:00:00 2001
From: Karthik U S <karthik.u.s1@ibm.com>
Date: Wed, 10 Jun 2026 11:18:25 +0530
Subject: [PATCH 516/596] mgr/mirroring,tools/cephfs_mirror: Handle checkpoint
 state transition

When a new checkpoint is being added or when the daemon gets restarted,
it will check whether the newly created checkpoint or any other old
checkpoints have already been mirrored onto the remote peer. If so, it
will transition to the correct state by checking for the highest snap id
present on the remote, and setting all the checkpoints which have snap id
lesser than or equal to that of the remote to COMPLETE. This is done by
sending an acquire notification from the mirroring module to the mirror
daemon, which is handled in the add_directory path, by adding the directory
to be checked for the state transition in the tick thread.
This path gets triggered:
a) when the daemon gets restarted
b) when the peer mapping changes
c) by sending the acquire notification from checkpoint add/now CLIs.
d) when mirroring module restarts

Fixes: https://tracker.ceph.com/issues/73454
Signed-off-by: Karthik U S <karthik.u.s1@ibm.com>
---
 src/pybind/mgr/mirroring/fs/dir_map/policy.py |  3 +-
 .../mgr/mirroring/fs/snapshot_mirror.py       | 53 ++++++++++-
 src/tools/cephfs_mirror/PeerReplayer.cc       | 92 +++++++++++++++++++
 src/tools/cephfs_mirror/PeerReplayer.h        |  2 +
 4 files changed, 148 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/mirroring/fs/dir_map/policy.py b/src/pybind/mgr/mirroring/fs/dir_map/policy.py
index da61bec940b..c9c111cacef 100644
--- a/src/pybind/mgr/mirroring/fs/dir_map/policy.py
+++ b/src/pybind/mgr/mirroring/fs/dir_map/policy.py
@@ -102,7 +102,8 @@ class Policy:
             if dir_state:
                 return {'instance_id': dir_state.instance_id,
                         'mapped_time': dir_state.mapped_time,
-                        'purging': dir_state.purging}
+                        'purging': dir_state.purging,
+                        'state': dir_state.state}
             return None
 
     def get_tracked_instance_id(self, dir_path):
diff --git a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
index 82075612264..e7b0ccba79a 100644
--- a/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
+++ b/src/pybind/mgr/mirroring/fs/snapshot_mirror.py
@@ -30,7 +30,7 @@ from .dir_map.create import create_mirror_object
 from .dir_map.load import load_dir_map, load_instances
 from .dir_map.update import UpdateDirMapRequest, UpdateInstanceRequest
 from .dir_map.policy import Policy
-from .dir_map.state_transition import ActionType
+from .dir_map.state_transition import ActionType, State
 from .checkpoint import (
     Checkpoint,
     checkpoint_from_snap,
@@ -193,6 +193,17 @@ class FSPolicy:
             finally:
                 self.op_tracker.finish_async_op()
 
+    def handle_checkpoint_acquire_ack(self, dir_path, r):
+        """Ack for checkpoint refresh acquire; does not advance the policy state machine."""
+        log.debug(f'handle_checkpoint_acquire_ack: {dir_path} r={r}')
+        with self.lock:
+            try:
+                if self.stopping.is_set():
+                    log.debug('handle_checkpoint_acquire_ack: policy shutting down')
+                    return
+            finally:
+                self.op_tracker.finish_async_op()
+
     def process_updates(self):
         def acquire_message(dir_path):
             return json.dumps({'dir_path': dir_path,
@@ -1024,6 +1035,40 @@ class FSSnapshotMirror:
     def _client_snapdir(self):
         return self.mgr.get_foreign_ceph_option('client', 'client_snapdir')
 
+    def _send_acquire_notification(self, fs_name, dir_path):
+        """Send acquire notification directly to daemon for a directory."""
+        try:
+            with self.lock:
+                fspolicy = self.pool_policy.get(fs_name, None)
+                if not fspolicy:
+                    log.warning(f'filesystem {fs_name} is not mirrored')
+                    return
+
+                with fspolicy.lock:
+                    lookup_info = fspolicy.policy.lookup(dir_path)
+                    if not lookup_info:
+                        log.warning(f'directory {dir_path} not found in policy map')
+                        return
+
+                    if lookup_info.get('state') != State.ASSOCIATED:
+                        log.debug(f'directory {dir_path} is not associated yet '
+                                  f'(state={lookup_info.get("state")}), skipping acquire notification')
+                        return
+
+                    instance_id = lookup_info['instance_id']
+                    if not instance_id:
+                        log.warning(f'directory {dir_path} not mapped to any instance yet')
+                        return
+
+                    acquire_msg = json.dumps({'dir_path': dir_path, 'mode': 'acquire'})
+
+                    log.debug(f'sending acquire notification for {dir_path} to instance {instance_id}')
+                    fspolicy.op_tracker.start_async_op()
+                    fspolicy.notifier.notify(dir_path, (instance_id, acquire_msg),
+                                               fspolicy.handle_checkpoint_acquire_ack)
+        except Exception as e:
+            log.error(f'failed to send acquire notification for {dir_path}: {e}')
+
     def checkpoint_add(self, fs_name, dir_path, snap_name):
         """Add a checkpoint for a snapshot via snapshot metadata on the primary filesystem."""
         try:
@@ -1034,6 +1079,9 @@ class FSSnapshotMirror:
                 info = self.checkpoint.snap_info(fsh, dir_path, snap_name)
                 self.checkpoint.write_metadata(fsh, dir_path, snap_name, info)
 
+            # Send acquire notification to trigger checkpoint state initialization
+            self._send_acquire_notification(fs_name, dir_path)
+
             result = {
                 'status': 'success',
                 'message': f'checkpoint added for snapshot {snap_name}',
@@ -1121,6 +1169,9 @@ class FSSnapshotMirror:
                 snap_name, info = self.checkpoint.get_latest_snap(fsh, dir_path)
                 self.checkpoint.write_metadata(fsh, dir_path, snap_name, info)
 
+            # Send acquire notification to trigger checkpoint state initialization
+            self._send_acquire_notification(fs_name, dir_path)
+
             result = {
                 'status': 'success',
                 'message': 'checkpoint created on latest snapshot',
diff --git a/src/tools/cephfs_mirror/PeerReplayer.cc b/src/tools/cephfs_mirror/PeerReplayer.cc
index 202f9b1f61f..8cb8dbdd183 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.cc
+++ b/src/tools/cephfs_mirror/PeerReplayer.cc
@@ -47,6 +47,7 @@ enum {
   l_cephfs_mirror_peer_replayer_last_synced_end,
   l_cephfs_mirror_peer_replayer_last_synced_duration,
   l_cephfs_mirror_peer_replayer_last_synced_bytes,
+  l_cephfs_mirror_peer_replayer_add_directory,
   l_cephfs_mirror_peer_replayer_last,
 };
 
@@ -289,6 +290,8 @@ PeerReplayer::PeerReplayer(CephContext *cct, FSMirror *fs_mirror,
 	       "last_synced_duration", "Last Synced Duration", "lsdn", prio);
   plb.add_u64_counter(l_cephfs_mirror_peer_replayer_last_synced_bytes,
 		      "last_synced_bytes", "Last Synced Bytes", "lsbt", prio);
+  plb.add_u64_counter(l_cephfs_mirror_peer_replayer_add_directory,
+		      "add_directory", "Add Directory Calls", "adir", prio);
   m_perf_counters = plb.create_perf_counters();
   m_cct->get_perfcounters_collection()->add(m_perf_counters);
 }
@@ -724,10 +727,15 @@ void PeerReplayer::shutdown() {
 
 void PeerReplayer::add_directory(string_view dir_root) {
   dout(20) << ": dir_root=" << dir_root << dendl;
+  if (m_perf_counters) {
+    m_perf_counters->inc(l_cephfs_mirror_peer_replayer_add_directory);
+  }
   auto _dir_root = std::string(dir_root);
 
   {
     std::scoped_lock locker(m_lock);
+    m_checkpoint_init_pending.insert(_dir_root);
+
     if (std::find(m_directories.begin(), m_directories.end(), _dir_root) !=
         m_directories.end()) {
       dout(10) << ": dir_root=" << _dir_root << " already in replay list" << dendl;
@@ -766,6 +774,7 @@ void PeerReplayer::remove_directory(string_view dir_root, bool purging) {
     if (it1 == m_registered.end()) {
       if (purging) {
         remove_persisted_dir_sync_stat(_dir_root);
+        m_checkpoint_init_pending.erase(_dir_root);
       }
       remove_directory_perf_counters(_dir_root);
       m_snap_sync_stats.erase(_dir_root);
@@ -1421,6 +1430,82 @@ void PeerReplayer::checkpoint_sync_complete(const std::string &dir_root,
            << " snap_name=" << snap_name << dendl;
 }
 
+void PeerReplayer::initialize_checkpoints(const std::string &dir_root) {
+  dout(10) << ": dir_root=" << dir_root << dendl;
+
+  // Build local snapshot map
+  std::map<uint64_t, std::string> local_snap_map;
+  int r = build_snap_map(dir_root, &local_snap_map, false);
+  if (r < 0) {
+    derr << ": failed to build local snap map for dir_root=" << dir_root
+         << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+  if (local_snap_map.empty()) {
+    dout(10) << ": no local snapshots for dir_root=" << dir_root << dendl;
+    return;
+  }
+
+  // Build remote snapshot map
+  std::map<uint64_t, std::string> remote_snap_map;
+  r = build_snap_map(dir_root, &remote_snap_map, true);
+  if (r < 0) {
+    derr << ": failed to build remote snap map for dir_root=" << dir_root
+         << ": " << cpp_strerror(r) << dendl;
+    return;
+  }
+  if (remote_snap_map.empty()) {
+    dout(10) << ": no remote snapshots for dir_root=" << dir_root << dendl;
+    return;
+  }
+
+  // Get the highest snap_id from remote
+  uint64_t remote_highest_snap_id = remote_snap_map.rbegin()->first;
+
+  dout(10) << ": remote_highest_snap_id=" << remote_highest_snap_id << dendl;
+
+  // Iterate through local snapshots and mark checkpoints as COMPLETE
+  // if their snap_id is <= remote_highest_snap_id
+  for (const auto &[snap_id, snap_name] : local_snap_map) {
+    // Read snapshot metadata
+    auto snap_path = snapshot_path(m_cct, dir_root, snap_name);
+    std::map<std::string, std::string> snap_metadata;
+    r = read_snap_metadata(m_local_mount, snap_path, &snap_metadata);
+    if (r < 0) {
+      derr << ": failed to read snap metadata for snap_id=" << snap_id
+           << " snap_name=" << snap_name << ": " << cpp_strerror(r) << dendl;
+      continue;
+    }
+
+    if (!has_checkpoint(snap_metadata)) {
+      continue;
+    }
+
+    CheckpointInfo info = read_checkpoint_metadata(snap_id, snap_name, snap_metadata);
+    // Update checkpoints that are in CREATED or FAILED status and have snap_id <= remote_highest_snap_id
+    if ((info.status == CheckpointStatus::CREATED || info.status == CheckpointStatus::FAILED)
+        && snap_id <= remote_highest_snap_id) {
+      dout(10) << ": marking checkpoint as COMPLETE for snap_id=" << snap_id
+               << " snap_name=" << snap_name << " (previous status: "
+               << checkpoint_status_to_string(info.status) << ")" << dendl;
+
+      info.status = CheckpointStatus::COMPLETE;
+      info.updated_at = ceph_clock_now();
+      info.error_msg.clear(); // Clear any previous error message
+
+      r = write_checkpoint_metadata(m_cct, m_local_mount, dir_root, snap_name, snap_metadata, info);
+      if (r < 0) {
+        derr << ": failed to update checkpoint status for snap_id=" << snap_id
+             << " snap_name=" << snap_name << " dir_root=" << dir_root
+             << ": " << cpp_strerror(r) << dendl;
+      } else {
+        dout(10) << ": successfully marked checkpoint as COMPLETE for snap_id=" << snap_id
+                 << " snap_name=" << snap_name << dendl;
+      }
+    }
+  }
+}
+
 void PeerReplayer::checkpoint_sync_failed(const std::string &dir_root,
                                           uint64_t snap_id,
                                           const std::string &snap_name,
@@ -3232,6 +3317,10 @@ void PeerReplayer::run_tick() {
       refresh_directory_current_sync_perf_counters(kv.first);
     }
 
+    std::vector<std::string> checkpoint_dirs(
+      m_checkpoint_init_pending.begin(), m_checkpoint_init_pending.end());
+    m_checkpoint_init_pending.clear();
+
     // persist sync stats to omap for registered directories
     std::vector<std::string> dirs;
     dirs.reserve(m_registered.size());
@@ -3242,6 +3331,9 @@ void PeerReplayer::run_tick() {
     for (const auto &dir_root : dirs) {
       persist_dir_sync_stat(dir_root);
     }
+    for (const auto &dir_root : checkpoint_dirs) {
+      initialize_checkpoints(dir_root);
+    }
     locker.lock();
   }
 }
diff --git a/src/tools/cephfs_mirror/PeerReplayer.h b/src/tools/cephfs_mirror/PeerReplayer.h
index 4cf99201bb4..0a12fe87d25 100644
--- a/src/tools/cephfs_mirror/PeerReplayer.h
+++ b/src/tools/cephfs_mirror/PeerReplayer.h
@@ -692,6 +692,7 @@ private:
   std::vector<std::string> m_directories;
   std::map<std::string, SnapSyncStat> m_snap_sync_stats;
   std::set<std::string> m_purging_directories;
+  std::set<std::string> m_checkpoint_init_pending;
   MountRef m_local_mount;
   ServiceDaemon *m_service_daemon;
   PeerReplayerAdminSocketHook *m_asok_hook = nullptr;
@@ -767,6 +768,7 @@ private:
   int build_snap_map(const std::string &dir_root, std::map<uint64_t, std::string> *snap_map,
                      bool is_remote=false);
 
+  void initialize_checkpoints(const std::string &dir_root);
   void checkpoint_sync_complete(const std::string &dir_root, uint64_t synced_snap_id,
                                 const std::string &snap_name);
   void checkpoint_sync_failed(const std::string &dir_root, uint64_t snap_id,

From 12bd34d69ac7e136d14d25ea274e99727b559870 Mon Sep 17 00:00:00 2001
From: Karthik U S <karthik.u.s1@ibm.com>
Date: Thu, 4 Jun 2026 17:17:05 +0530
Subject: [PATCH 517/596] doc: Add docs and pending release notes for mirroring
 checkpoints

Adding documentations and pending release notes for the mirroring
checkpoints feature.

Fixes: https://tracker.ceph.com/issues/73454
Signed-off-by: Karthik U S <karthik.u.s1@ibm.com>
---
 PendingReleaseNotes                         |  11 +
 doc/cephfs/cephfs-mirroring-checkpoints.rst | 360 ++++++++++++++++++++
 doc/cephfs/cephfs-mirroring.rst             |  33 ++
 doc/cephfs/index.rst                        |   1 +
 4 files changed, 405 insertions(+)
 create mode 100644 doc/cephfs/cephfs-mirroring-checkpoints.rst

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 4d43b8bf1c3..b8904239bc4 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -203,6 +203,17 @@
   ``metrics_updated_at`` (time of the last omap write). Optional filters by
   mirrored directory path and peer UUID are supported. For more information,
   see https://tracker.ceph.com/issues/76686
+* CephFS Mirroring: Introduced snapshot checkpoints feature that allows users to mark
+  specific snapshots as important milestones and track their replication status to remote
+  sites. Checkpoints automatically detect if a snapshot has already been synced and provide
+  visibility into disaster recovery readiness. The feature includes four new CLI commands:
+  ``ceph fs snapshot mirror checkpoint add`` to mark a snapshot,
+  ``ceph fs snapshot mirror checkpoint now`` to checkpoint the latest snapshot,
+  ``ceph fs snapshot mirror checkpoint ls`` to list all checkpoints with their status
+  (created/complete/failed), and ``ceph fs snapshot mirror checkpoint remove`` to remove
+  a checkpoint. Checkpoint metadata is persistent across daemon restarts. This feature is
+  useful for compliance auditing, application consistency verification, and SLA tracking.
+  For more information, see https://tracker.ceph.com/issues/73454
 * RBD: Mirror snapshot creation and trash purge schedules are now automatically
   staggered when no explicit "start-time" is specified. This reduces scheduling
   spikes and distributes work more evenly over time.
diff --git a/doc/cephfs/cephfs-mirroring-checkpoints.rst b/doc/cephfs/cephfs-mirroring-checkpoints.rst
new file mode 100644
index 00000000000..1c642fac3f3
--- /dev/null
+++ b/doc/cephfs/cephfs-mirroring-checkpoints.rst
@@ -0,0 +1,360 @@
+========================================
+CephFS Snapshot Mirroring Checkpoints
+========================================
+
+.. contents::
+   :depth: 3
+   :local:
+
+Introduction
+============
+
+CephFS Snapshot Mirroring Checkpoints allow you to mark specific snapshots as important
+milestones and track whether they have been successfully replicated to your remote site.
+This feature provides visibility into your disaster recovery readiness by showing which
+critical data states have been safely mirrored.
+
+**Use Cases:**
+
+- **Compliance & Auditing**: Verify that end-of-day or end-of-month snapshots are replicated
+- **Application Consistency**: Ensure application-consistent snapshots reach the DR site
+- **Migration Tracking**: Monitor progress when migrating data between sites
+- **SLA Verification**: Confirm that critical snapshots meet replication SLAs
+
+What is a Checkpoint?
+=====================
+
+A checkpoint is a marker you place on a snapshot to track its replication status. When you
+checkpoint a snapshot, the system monitors whether that snapshot (and all previous snapshots)
+have been successfully synchronized to the remote filesystem.
+
+**Key Concepts:**
+
+- **Automatic Status Tracking**: Checkpoints automatically detect if a snapshot has already been synced
+- **Persistent**: Checkpoint information survives daemon restarts
+- **Per-Directory**: Each mirrored directory has its own set of checkpoints
+
+Checkpoint Lifecycle
+--------------------
+
+Every checkpoint goes through these states:
+
+.. code-block:: text
+
+    ┌─────────┐
+    │ CREATED │  ← Checkpoint added, snapshot not yet synced
+    └────┬────┘
+         │
+         ├──→ ┌──────────┐
+         │    │ COMPLETE │  ← Snapshot successfully synced to remote
+         │    └──────────┘
+         │
+         └──→ ┌────────┐
+              │ FAILED │  ← Sync failed (will be retried automatically)
+              └────────┘
+
+- **created**: Waiting for synchronization or sync in progress
+- **complete**: Successfully replicated to remote site
+- **failed**: Sync encountered an error (check error message for details)
+
+Prerequisites
+=============
+
+Before using checkpoints, ensure:
+
+1. **CephFS Mirroring is Enabled**:
+
+   .. code-block:: bash
+
+       ceph fs snapshot mirror enable <fs_name>
+
+2. **Remote Peer is Configured**:
+
+   .. code-block:: bash
+
+       ceph fs snapshot mirror peer_add <fs_name> <peer_spec>
+
+3. **Directory is Being Mirrored**:
+
+   .. code-block:: bash
+
+       ceph fs snapshot mirror add <fs_name> <dir_path>
+
+4. **Snapshots Exist**: You need snapshots to checkpoint
+
+For detailed mirroring setup, see :doc:`cephfs-mirroring`.
+
+Getting Started
+===============
+
+Basic Workflow
+--------------
+
+Here's a typical workflow for using checkpoints:
+
+**Step 1: Create Snapshots**
+
+.. code-block:: bash
+
+    # Create snapshots in your mirrored directory
+    mkdir /mnt/cephfs/data/.snap/daily_backup_2026_06_01
+    mkdir /mnt/cephfs/data/.snap/daily_backup_2026_06_02
+    mkdir /mnt/cephfs/data/.snap/daily_backup_2026_06_03
+
+**Step 2: Add Checkpoints**
+
+.. code-block:: bash
+
+    # Mark important snapshots as checkpoints
+    ceph fs snapshot mirror checkpoint add myfs /data daily_backup_2026_06_01
+    ceph fs snapshot mirror checkpoint add myfs /data daily_backup_2026_06_03
+
+**Step 3: Monitor Status**
+
+.. code-block:: bash
+
+    # Check checkpoint status
+    ceph fs snapshot mirror checkpoint ls myfs /data --format json-pretty
+
+**Example Output:**
+
+.. code-block:: json
+
+    {
+      "dir_root": "/data",
+      "checkpoints": [
+        {
+          "snap_id": 100,
+          "snap_name": "daily_backup_2026_06_01",
+          "status": "complete",
+          "created_at": "2026-06-01T23:00:00.000000+0000",
+          "updated_at": "2026-06-01T23:15:00.000000+0000"
+        },
+        {
+          "snap_id": 102,
+          "snap_name": "daily_backup_2026_06_03",
+          "status": "created",
+          "created_at": "2026-06-03T23:00:00.000000+0000",
+          "updated_at": "2026-06-03T23:00:00.000000+0000"
+        }
+      ]
+    }
+
+Command Reference
+=================
+
+checkpoint add
+--------------
+
+Add a checkpoint to a specific snapshot.
+
+**Syntax:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint add <fs_name> <dir_path> <snap_name>
+
+**Parameters:**
+
+- ``fs_name``: Name of the filesystem
+- ``dir_path``: Path to the mirrored directory (e.g., ``/data``)
+- ``snap_name``: Name of the snapshot to checkpoint
+
+**Example:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint add myfs /data backup_snapshot_1
+
+**Output:**
+
+.. code-block:: json
+
+    {
+      "status": "success",
+      "message": "checkpoint added for snapshot backup_snapshot_1",
+      "dir_root": "/data",
+      "snap_id": 123,
+      "snap_name": "backup_snapshot_1",
+      "checkpoint_status": "created"
+    }
+
+**Notes:**
+
+- If the snapshot has already been synced, status will be ``complete`` immediately
+- You cannot checkpoint the same snapshot twice
+- The snapshot must exist in the directory
+
+checkpoint now
+--------------
+
+Add a checkpoint to the most recent snapshot in a directory.
+
+**Syntax:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint now <fs_name> <dir_path>
+
+**Example:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint now myfs /data
+
+**Output:**
+
+.. code-block:: json
+
+    {
+      "status": "success",
+      "message": "checkpoint created on latest snapshot",
+      "dir_root": "/data",
+      "snap_id": 125,
+      "snap_name": "daily_backup_2026_06_03",
+      "checkpoint_status": "created"
+    }
+
+**Use Case:**
+
+Useful when you want to checkpoint the latest state without knowing the exact snapshot name.
+
+checkpoint ls
+-------------
+
+List all checkpoints for a directory.
+
+**Syntax:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint ls <fs_name> <dir_path> [--format <format>]
+
+**Parameters:**
+
+- ``format``: Output format (``json`` or ``json-pretty``), default is ``json``
+
+**Example:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint ls myfs /data --format json-pretty
+
+**Output Fields:**
+
+- ``snap_id``: Internal snapshot ID
+- ``snap_name``: Snapshot name
+- ``status``: Current status (created/complete/failed)
+- ``created_at``: When checkpoint was created
+- ``updated_at``: Last status update time
+- ``error_msg``: Error description (only present if status is failed)
+
+checkpoint remove
+-----------------
+
+Remove a checkpoint from a specific snapshot.
+
+**Syntax:**
+
+.. code-block:: bash
+
+    ceph fs snapshot mirror checkpoint remove <fs_name> <dir_path> <snap_name>
+
+**Example:**
+
+.. code-block:: bash
+
+    # Remove checkpoint from a specific snapshot
+    ceph fs snapshot mirror checkpoint remove myfs /data backup_snapshot_1
+
+**Output:**
+
+.. code-block:: json
+
+    {
+      "status": "success",
+      "message": "checkpoint removed for snapshot backup_snapshot_1",
+      "dir_root": "/data",
+      "snap_name": "backup_snapshot_1"
+    }
+
+**Notes:**
+
+- Removing a checkpoint does NOT delete the snapshot itself
+- The snapshot and its data remain intact
+- This operation only removes the checkpoint tracking metadata
+- This operation cannot be undone
+- To remove multiple checkpoints, run the command multiple times
+
+Important Notes
+===============
+
+Snapshot Deletion Behavior
+---------------------------
+
+.. warning::
+
+   **If a snapshot with a checkpoint is deleted, the checkpoint metadata is permanently lost.**
+
+When you delete a snapshot that has a checkpoint:
+
+1. **Before Sync Completes**: The checkpoint is lost and will never reach "complete" status
+2. **After Sync Completes**: The checkpoint history is lost, but the data was already replicated
+
+**Impact on Commands:**
+
+- ``checkpoint ls``: Will not show the deleted snapshot's checkpoint
+- ``checkpoint remove``: Will fail with "snapshot not found" error
+
+**Best Practice:**
+
+- Do not delete snapshots with active checkpoints until they reach "complete" status
+- Use ``checkpoint ls`` to verify checkpoint status before deleting snapshots
+- Consider removing checkpoints explicitly before deleting important snapshots
+
+Snapshot Rename Behavior
+-------------------------
+
+.. note::
+
+   **Checkpoints survive snapshot renames, but you must use the new snapshot name in commands.**
+
+When you rename a snapshot that has a checkpoint:
+
+1. **Checkpoint Persists**: The checkpoint metadata remains attached to the snapshot
+2. **Name Updates Automatically**: ``checkpoint ls`` will show the new snapshot name
+3. **Old Name No Longer Works**: You must use the new name for ``checkpoint remove``
+
+**Example:**
+
+.. code-block:: bash
+
+    # Original snapshot with checkpoint
+    ceph fs snapshot mirror checkpoint add myfs /data old_name
+
+    # Rename the snapshot (using CephFS snapshot rename)
+    # ... snapshot renamed from 'old_name' to 'new_name' ...
+
+    # List checkpoints - shows new name
+    ceph fs snapshot mirror checkpoint ls myfs /data
+    # Output shows: "snap_name": "new_name"
+
+    # Remove using NEW name (this works)
+    ceph fs snapshot mirror checkpoint remove myfs /data new_name
+
+    # Remove using OLD name (this fails)
+    ceph fs snapshot mirror checkpoint remove myfs /data old_name
+    # Error: snapshot 'old_name' not found
+
+**Best Practice:**
+
+- Always use ``checkpoint ls`` to verify current snapshot names before removing checkpoints
+- Update any automation scripts if you rename snapshots
+
+
+Additional Resources
+====================
+
+- **CephFS Mirroring Guide**: :doc:`cephfs-mirroring`
+- **Snapshot Documentation**: :doc:`/cephfs/snapshots`
+- **Tracker Issue**: https://tracker.ceph.com/issues/73454
\ No newline at end of file
diff --git a/doc/cephfs/cephfs-mirroring.rst b/doc/cephfs/cephfs-mirroring.rst
index 6139cd64ae0..90e6ab309ae 100644
--- a/doc/cephfs/cephfs-mirroring.rst
+++ b/doc/cephfs/cephfs-mirroring.rst
@@ -1425,3 +1425,36 @@ transfers. Users can fine-tune these operations using configuration parameters:
 - ``cephfs_mirror_max_concurrent_directory_syncs``: controls the number of concurrent snapshots being crawled.
 - ``cephfs_mirror_max_datasync_threads``: controls the total threads available for data sync.
 For more information, see https://tracker.ceph.com/issues/73452
+
+
+Snapshot Mirroring Checkpoints
+-------------------------------
+
+CephFS mirroring supports checkpoints to track the replication status of specific snapshots.
+Checkpoints allow you to mark important snapshots and monitor whether they have been successfully
+synchronized to the remote site, providing visibility into disaster recovery readiness.
+
+**Key Features:**
+
+- Mark snapshots as checkpoints to track their replication status
+- Automatic status detection (created/complete/failed)
+- Per-directory tracking with persistent metadata
+
+**Basic Usage:**
+
+.. code-block:: bash
+
+    # Add a checkpoint to a snapshot
+    ceph fs snapshot mirror checkpoint add <fs_name> <dir_path> <snap_name>
+
+    # List all checkpoints for a directory
+    ceph fs snapshot mirror checkpoint ls <fs_name> <dir_path>
+
+    # Remove a checkpoint
+    ceph fs snapshot mirror checkpoint remove <fs_name> <dir_path> <snap_name>
+
+    # Create checkpoint on latest snapshot
+    ceph fs snapshot mirror checkpoint now <fs_name> <dir_path>
+
+For detailed information about checkpoint commands, lifecycle, and best practices, see
+:doc:`cephfs-mirroring-checkpoints`.
diff --git a/doc/cephfs/index.rst b/doc/cephfs/index.rst
index 07cbbfd25af..863e8462426 100644
--- a/doc/cephfs/index.rst
+++ b/doc/cephfs/index.rst
@@ -93,6 +93,7 @@ Administration
     cephfs-tool <cephfs-tool>
     Scheduled Snapshots <snap-schedule>
     CephFS Snapshot Mirroring <cephfs-mirroring>
+    CephFS Snapshot Mirroring Checkpoints <cephfs-mirroring-checkpoints>
     Purge Queue <purge-queue>
 
 .. raw:: html

From fe7fa7b0761720181cf8735ac7b5f17080c1d8a7 Mon Sep 17 00:00:00 2001
From: Karthik U S <karthik.u.s1@ibm.com>
Date: Sat, 16 May 2026 08:45:50 +0530
Subject: [PATCH 518/596] qa/test_mirroring: Add tests for mirroring
 checkpoints

Adding integration tests for validating the cephfs mirroring
checkpoints feature

Fixes: https://tracker.ceph.com/issues/73454
Signed-off-by: Karthik U S <karthik.u.s1@ibm.com>
---
 qa/tasks/cephfs/test_mirroring.py | 517 ++++++++++++++++++++++++++++++
 1 file changed, 517 insertions(+)

diff --git a/qa/tasks/cephfs/test_mirroring.py b/qa/tasks/cephfs/test_mirroring.py
index 0dd1285b178..38522206b7c 100644
--- a/qa/tasks/cephfs/test_mirroring.py
+++ b/qa/tasks/cephfs/test_mirroring.py
@@ -370,6 +370,22 @@ class TestMirroring(CephFSTestCase):
                                  f'for {dir_path}')
         return entry['counters']
 
+    def get_peer_perf_counters(self):
+        res = self.mirror_daemon_command(
+            f'counter dump for fs: {self.primary_fs_name}', 'counter', 'dump')
+        self.assertIn(self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER, res)
+        self.assertGreater(len(res[self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER]), 0)
+        return res[self.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_PEER][0]['counters']
+
+    @retry_assert(timeout=60, interval=1)
+    def wait_peer_add_directory_counter(self, expected):
+        counters = self.get_peer_perf_counters()
+        self.assertIn('add_directory', counters)
+        actual = counters['add_directory']
+        if actual != expected:
+            raise AssertionError(
+                f'expected add_directory={expected}, got {actual}')
+
     def assert_directory_perf_labels(self, labels, dir_path, peer_uuid):
         self.assertEqual(labels['source_fscid'], str(self.primary_fs_id))
         self.assertEqual(labels['source_filesystem'], self.primary_fs_name)
@@ -717,6 +733,27 @@ class TestMirroring(CephFSTestCase):
             e.res = res
             raise
 
+    @retry_assert(timeout=120, interval=1)
+    def stop_daemon_when_peer_snap_in_progress(self, fs_name, fs_id,
+                                               peer_spec, dir_name, snap_name):
+        peer_uuid = self.get_peer_uuid(peer_spec)
+        res = self.mirror_daemon_command(f'peer status for fs: {fs_name}',
+                                         'fs', 'mirror', 'peer', 'status',
+                                         f'{fs_name}@{fs_id}', peer_uuid)
+        try:
+            dir_stat = self.peer_dir_status(res, dir_name, peer_uuid)
+            if dir_stat.get('last_synced_snap', {}).get('name') == snap_name:
+                raise RuntimeError(
+                    f'snapshot {snap_name!r} synced before caps could be restricted')
+            self.assertTrue('syncing' == dir_stat['state'])
+            self.assertTrue(dir_stat['current_syncing_snap']['name'] == snap_name)
+        except RETRY_EXCEPTIONS as e:
+            e.res = res
+            raise
+
+        log.debug('peer syncing %s, stopping mirror daemon', snap_name)
+        self.stop_mirror_daemon()
+
     def verify_snapshot(self, dir_name, snap_name):
         snap_list = self.mount_b.ls(path=f'{dir_name}/.snap')
         self.assertTrue(snap_name in snap_list)
@@ -802,6 +839,117 @@ class TestMirroring(CephFSTestCase):
         log.debug(f'status: {status}')
         return status
 
+    def checkpoint_list(self, fs_name, dir_path):
+        return json.loads(self.get_ceph_cmd_stdout(
+            "fs", "snapshot", "mirror", "checkpoint", "ls",
+            fs_name, dir_path))
+
+    def checkpoint_add(self, fs_name, dir_path, snap_name):
+        out = json.loads(self.get_ceph_cmd_stdout(
+            "fs", "snapshot", "mirror", "checkpoint", "add",
+            fs_name, dir_path, snap_name))
+        self.assertEqual(out['status'], 'success')
+        return out
+
+    def checkpoint_remove(self, fs_name, dir_path, snap_name):
+        out = json.loads(self.get_ceph_cmd_stdout(
+            "fs", "snapshot", "mirror", "checkpoint", "remove",
+            fs_name, dir_path, snap_name))
+        self.assertEqual(out['status'], 'success')
+        return out
+
+    def checkpoint_now(self, fs_name, dir_path):
+        out = json.loads(self.get_ceph_cmd_stdout(
+            "fs", "snapshot", "mirror", "checkpoint", "now",
+            fs_name, dir_path))
+        self.assertEqual(out['status'], 'success')
+        return out
+
+    @staticmethod
+    def find_checkpoint(checkpoints, snap_name):
+        for cp in checkpoints:
+            if cp['snap_name'] == snap_name:
+                return cp
+        return None
+
+    def assert_checkpoint_listed(self, fs_name, dir_path, snap_name):
+        res = self.checkpoint_list(fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        self.assertIsNotNone(cp, f'checkpoint {snap_name} should be listed')
+
+    def assert_checkpoint_not_listed(self, fs_name, dir_path, snap_name):
+        res = self.checkpoint_list(fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        self.assertIsNone(cp, f'checkpoint {snap_name} should not be listed')
+
+    def start_mirror_daemon(self):
+        self.mount_a.run_shell_payload(
+            'nohup cephfs-mirror --id mirror </dev/null >/dev/null 2>&1 &')
+
+        @retry_assert(timeout=60, interval=2)
+        def wait_ready():
+            res = self.mirror_daemon_command(
+                f'counter dump for fs: {self.primary_fs_name}', 'counter', 'dump')
+            self.assertIn(TestMirroring.PERF_COUNTER_KEY_NAME_CEPHFS_MIRROR_FS, res)
+
+        wait_ready()
+
+    def stop_mirror_daemon(self, wait=5):
+        pid = self.get_mirror_daemon_pid()
+        log.debug(f'stopping cephfs-mirror (pid={pid})')
+        self.mount_a.run_shell_payload(f'kill -TERM {pid} || true')
+        time.sleep(wait)
+
+    def restart_mirroring_module(self, wait=10):
+        log.debug('restarting mirroring mgr module')
+        self.run_ceph_cmd("mgr", "module", "disable", self.MODULE_NAME)
+        time.sleep(2)
+        self.run_ceph_cmd("mgr", "module", "enable", self.MODULE_NAME)
+        time.sleep(wait)
+
+    def _setup_mirrored_directory(self, dir_path, peer_spec=None, mount_b=False):
+        """Enable mirroring and track a directory; optionally mount backup FS and add peer."""
+        if mount_b:
+            self.setup_mount_b(mds_perm='rw')
+        self.mount_a.run_shell(["mkdir", "-p", dir_path.lstrip('/')])
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, dir_path)
+        if peer_spec:
+            self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                          self.secondary_fs_name)
+
+    def _add_checkpoint_snapshot(self, dir_path, snap_name, verify_listed=False):
+        """Create a snapshot and add a checkpoint on it."""
+        self.mount_a.run_shell(["mkdir", f"{dir_path.lstrip('/')}/.snap/{snap_name}"])
+        self.checkpoint_add(self.primary_fs_name, dir_path, snap_name)
+        if verify_listed:
+            self.assert_checkpoint_listed(self.primary_fs_name, dir_path, snap_name)
+
+    def _setup_checkpoint_dir(self, dir_path, snap_name, peer_spec=None, mount_b=True):
+        """Create a tracked directory with a checkpointed snapshot."""
+        self._setup_mirrored_directory(dir_path, peer_spec=peer_spec, mount_b=mount_b)
+        self._add_checkpoint_snapshot(dir_path, snap_name, verify_listed=True)
+
+    def _teardown_mirroring(self, dir_path, peer_spec=None):
+        """Untrack directory, remove peer, and disable mirroring on the filesystem."""
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, dir_path)
+        if peer_spec:
+            self.peer_remove(self.primary_fs_name, self.primary_fs_id, peer_spec)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+
+    @retry_assert(timeout=600, interval=10)
+    def check_checkpoint_status(self, fs_name, dir_path, snap_name, expected_status):
+        res = self.checkpoint_list(fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        if cp is None or cp['status'] != expected_status:
+            raise AssertionError(
+                f'checkpoint {snap_name}: expected status {expected_status}, '
+                f'got {None if cp is None else cp["status"]!r}')
+
+    def check_checkpoint_statuses(self, fs_name, dir_path, snap_names, expected_status):
+        for snap_name in snap_names:
+            self.check_checkpoint_status(fs_name, dir_path, snap_name, expected_status)
+
     def setup_mount_b(self, mds_perm):
         log.debug('reconfigure client auth caps')
         self.get_ceph_cmd_result(
@@ -813,6 +961,29 @@ class TestMirroring(CephFSTestCase):
         log.debug(f'mounting filesystem {self.secondary_fs_name}')
         self.mount_b.mount_wait(cephfs_name=self.secondary_fs_name)
 
+    def _restrict_mirror_remote_caps(self):
+        """Restrict mirror remote client OSD write to force snapshot sync failure.
+
+        The remote mirrored directory must already exist (created while the
+        client still has OSD write).  OSD read-only blocks file data transfer
+        during snapshot sync, where checkpoint_sync_failed() is recorded.
+        """
+        self.get_ceph_cmd_result(
+            'auth', 'caps', 'client.mirror_remote',
+            'mds', 'allow rwps',
+            'mon', 'allow r',
+            'osd', "allow r tag cephfs *=*",
+            'mgr', 'allow r')
+
+    def _restore_mirror_remote_caps(self):
+        """Restore mirror remote client caps used by the mirror test suite."""
+        self.get_ceph_cmd_result(
+            'auth', 'caps', 'client.mirror_remote',
+            'mds', 'allow rwps',
+            'mon', 'allow r',
+            'osd', "allow rw tag cephfs *=*",
+            'mgr', 'allow r')
+
     def test_basic_mirror_commands(self):
         self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
         self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
@@ -960,6 +1131,350 @@ class TestMirroring(CephFSTestCase):
         self.mount_a.run_shell(["rmdir", dir1])
         self.mount_a.run_shell(["rmdir",  dir2])
 
+    def test_checkpoint_cli_add_list_remove_now(self):
+        """Test mgr checkpoint add/list/remove/now on snapshot metadata."""
+        dir_path = '/cp_cli'
+        snap0 = 'snap0'
+        snap1 = 'snap1'
+
+        self._setup_mirrored_directory(dir_path)
+        self._add_checkpoint_snapshot(dir_path, snap0)
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(res['dir_root'], dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap0)
+        self.assertIsNotNone(cp)
+        self.assertEqual(cp['status'], 'created')
+        self.assertTrue(cp['created_at'])
+        self.assertTrue(cp['updated_at'])
+
+        self.mount_a.run_shell(["mkdir", f"{dir_path.lstrip('/')}/.snap/{snap1}"])
+        out = self.checkpoint_now(self.primary_fs_name, dir_path)
+        self.assertEqual(out['snap_name'], snap1)
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 2)
+
+        self.checkpoint_remove(self.primary_fs_name, dir_path, snap0)
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 1)
+        self.assertEqual(res['checkpoints'][0]['snap_name'], snap1)
+
+        self.checkpoint_remove(self.primary_fs_name, dir_path, snap1)
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(res['checkpoints'], [])
+
+        self._teardown_mirroring(dir_path)
+
+    def test_checkpoint_cli_errors(self):
+        """Test checkpoint CLI validation errors."""
+        dir_path = '/cp_err'
+        tracked = '/cp_err/tracked'
+        snap = 'snap0'
+
+        self._setup_mirrored_directory(tracked)
+        self.mount_a.run_shell(["mkdir", f"{tracked.lstrip('/')}/.snap/{snap}"])
+
+        try:
+            self.checkpoint_add(self.primary_fs_name, dir_path, snap)
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.ENOENT:
+                raise RuntimeError(
+                    f'expected ENOENT for untracked directory, got {ce.exitstatus}')
+        else:
+            raise RuntimeError('expected checkpoint add to fail for untracked directory')
+
+        try:
+            self.checkpoint_remove(self.primary_fs_name, tracked, snap)
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.ENOENT:
+                raise RuntimeError(
+                    f'expected ENOENT when removing non-checkpoint snap, got {ce.exitstatus}')
+        else:
+            raise RuntimeError('expected checkpoint remove to fail')
+
+        self.checkpoint_add(self.primary_fs_name, tracked, snap)
+        try:
+            self.checkpoint_add(self.primary_fs_name, tracked, snap)
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.EEXIST:
+                raise RuntimeError(
+                    f'expected EEXIST when re-adding checkpoint, got {ce.exitstatus}')
+        else:
+            raise RuntimeError('expected checkpoint add to fail for duplicate')
+        self.checkpoint_remove(self.primary_fs_name, tracked, snap)
+
+        self.remove_directory(self.primary_fs_name, self.primary_fs_id, tracked)
+        self.disable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        try:
+            self.checkpoint_list(self.primary_fs_name, tracked)
+        except CommandFailedError as ce:
+            if ce.exitstatus != errno.EINVAL:
+                raise RuntimeError(
+                    f'expected EINVAL with mirroring disabled, got {ce.exitstatus}')
+        else:
+            raise RuntimeError('expected checkpoint list to fail')
+
+    def test_checkpoint_sync_status_reaches_complete(self):
+        """Test mirror daemon updates checkpoint status after snapshot sync."""
+        dir_path = '/cp_sync'
+        snap_name = 'snap0'
+        peer_spec = "client.mirror_remote@ceph"
+
+        self._setup_mirrored_directory(dir_path, mount_b=True)
+        self._add_checkpoint_snapshot(dir_path, snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'created')
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        created_at = cp['created_at']
+        updated_at = cp['updated_at']
+
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, dir_path, snap_name, 1)
+        self.verify_snapshot(dir_path.lstrip('/'), snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'complete')
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        self.assertEqual(cp['created_at'], created_at)
+        self.assertTrue(cp['updated_at'])
+        self.assertNotEqual(cp['updated_at'], updated_at)
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
+    def test_checkpoint_deleted_snapshot_not_listed(self):
+        """Deleted checkpointed snapshots must not appear in checkpoint ls."""
+        dir_path = '/cp_del'
+        snap_name = 'snap0'
+
+        self._setup_mirrored_directory(dir_path)
+        self._add_checkpoint_snapshot(dir_path, snap_name)
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 1)
+
+        self.mount_a.run_shell(["rmdir", f"{dir_path.lstrip('/')}/.snap/{snap_name}"])
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(res['checkpoints'], [])
+
+        self._teardown_mirroring(dir_path)
+
+    def test_checkpoint_renamed_snapshot_shows_new_name(self):
+        """Renamed checkpointed snapshots must appear under the new name in ls."""
+        dir_path = '/cp_rename'
+        old_name = 'snap0'
+        new_name = 'snap1'
+
+        self._setup_mirrored_directory(dir_path)
+        self._add_checkpoint_snapshot(dir_path, old_name)
+
+        self.mount_a.run_shell([
+            "mv",
+            f"{dir_path.lstrip('/')}/.snap/{old_name}",
+            f"{dir_path.lstrip('/')}/.snap/{new_name}",
+        ])
+
+        self.assert_checkpoint_not_listed(self.primary_fs_name, dir_path, old_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, new_name, 'created')
+
+        self._teardown_mirroring(dir_path)
+
+    def test_checkpoint_add_after_rename_allows_same_snap_name(self):
+        """A new snapshot can reuse a name after the checkpointed one is renamed."""
+        dir_path = '/cp_reuse_name'
+        old_name = 'snap0'
+        new_name = 'snap1'
+
+        self._setup_mirrored_directory(dir_path)
+        self._add_checkpoint_snapshot(dir_path, old_name)
+
+        self.mount_a.run_shell([
+            "mv",
+            f"{dir_path.lstrip('/')}/.snap/{old_name}",
+            f"{dir_path.lstrip('/')}/.snap/{new_name}",
+        ])
+        self.mount_a.run_shell(["mkdir", f"{dir_path.lstrip('/')}/.snap/{old_name}"])
+        self.checkpoint_add(self.primary_fs_name, dir_path, old_name)
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 2)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, old_name, 'created')
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, new_name, 'created')
+
+        self._teardown_mirroring(dir_path)
+
+    def test_checkpoint_persisted_across_mirror_daemon_restart(self):
+        """Checkpoints survive mirror daemon restart and reach complete after sync."""
+        dir_path = '/cp_mirror_restart'
+        snap_name = 'snap0'
+        peer_spec = "client.mirror_remote@ceph"
+
+        self._setup_checkpoint_dir(dir_path, snap_name)
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 1)
+
+        self.stop_mirror_daemon()
+        self.start_mirror_daemon()
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 1)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'created')
+
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, dir_path, snap_name, 1)
+        self.verify_snapshot(dir_path.lstrip('/'), snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'complete')
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
+    def test_checkpoint_persisted_across_mgr_module_restart(self):
+        """Checkpoints survive mirroring mgr module restart and reach complete after sync."""
+        dir_path = '/cp_mgr_restart'
+        snap_name = 'snap0'
+        peer_spec = "client.mirror_remote@ceph"
+
+        self._setup_checkpoint_dir(dir_path, snap_name)
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 1)
+
+        self.restart_mirroring_module()
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), 1)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'created')
+
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec, self.secondary_fs_name)
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, dir_path, snap_name, 1)
+        self.verify_snapshot(dir_path.lstrip('/'), snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'complete')
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
+    def test_checkpoint_add_on_already_synced_snapshot_is_complete(self):
+        """Checkpoint added after sync should be marked complete by the daemon."""
+        dir_path = '/cp_already_synced'
+        snap_name = 'snap0'
+        peer_spec = "client.mirror_remote@ceph"
+
+        self._setup_mirrored_directory(dir_path, peer_spec=peer_spec, mount_b=True)
+        self.mount_a.run_shell(["mkdir", f"{dir_path.lstrip('/')}/.snap/{snap_name}"])
+
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, dir_path, snap_name, 1)
+        self.verify_snapshot(dir_path.lstrip('/'), snap_name)
+
+        self.checkpoint_add(self.primary_fs_name, dir_path, snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'complete')
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
+    def test_checkpoint_on_synced_snaps_complete_after_daemon_restart(self):
+        """Checkpoints added on synced snaps while daemon is down reach complete after restart."""
+        dir_path = '/cp_daemon_down'
+        snap_names = [f'snap{i}' for i in range(5)]
+        checkpoint_snaps = ['snap0', 'snap2', 'snap4']
+        peer_spec = "client.mirror_remote@ceph"
+
+        self._setup_mirrored_directory(dir_path, peer_spec=peer_spec, mount_b=True)
+
+        for snap_name in snap_names:
+            self.mount_a.run_shell(["mkdir", f"{dir_path.lstrip('/')}/.snap/{snap_name}"])
+
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, dir_path, snap_names[-1], len(snap_names))
+        self.verify_snapshot(dir_path.lstrip('/'), snap_names[-1])
+
+        self.stop_mirror_daemon()
+        for snap_name in checkpoint_snaps:
+            self.checkpoint_add(self.primary_fs_name, dir_path, snap_name)
+        self.check_checkpoint_statuses(
+            self.primary_fs_name, dir_path, checkpoint_snaps, 'created')
+
+        self.start_mirror_daemon()
+        self.check_checkpoint_statuses(
+            self.primary_fs_name, dir_path, checkpoint_snaps, 'complete')
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
+    def test_checkpoint_add_directory_notify_perf_counter(self):
+        """Each checkpoint add must notify the mirror daemon via add_directory()."""
+        snap_count = 100
+        dir_path = '/cp_add_dir_notify'
+        dir_name = dir_path.lstrip('/')
+        peer_spec = "client.mirror_remote@ceph"
+
+        self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
+        self.peer_add(self.primary_fs_name, self.primary_fs_id, peer_spec,
+                      self.secondary_fs_name)
+        add_dir_baseline = self.get_peer_perf_counters()['add_directory']
+
+        self.mount_a.run_shell(['mkdir', '-p', dir_name])
+        self.add_directory(self.primary_fs_name, self.primary_fs_id, dir_path,
+                           check_perf_counter=False)
+
+        for i in range(snap_count):
+            self.mount_a.run_shell(['touch', f'{dir_name}/file.{i}'])
+            self.mount_a.run_shell(['mkdir', f'{dir_name}/.snap/snap{i}'])
+            self.checkpoint_add(self.primary_fs_name, dir_path, f'snap{i}')
+
+        # Expect baseline + 101 add_directory calls: one for the initial
+        # mirror add directory and one per checkpoint add (each sends an
+        # acquire notify).
+        self.wait_peer_add_directory_counter(add_dir_baseline + 1 + snap_count)
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        self.assertEqual(len(res['checkpoints']), snap_count)
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
+    def test_checkpoint_failed_then_complete(self):
+        """Checkpoint is marked failed on sync error and complete after recovery."""
+        dir_path = '/cp_failed'
+        snap_name = 'snap0'
+        peer_spec = "client.mirror_remote@ceph"
+
+        self._setup_mirrored_directory(dir_path, mount_b=True)
+        dir_name = dir_path.lstrip('/')
+        self.mount_a.create_n_files(f'{dir_name}/file', 10000, sync=True)
+        for i in range(20):
+            self.mount_a.write_n_mb(os.path.join(dir_name, f'large_file.{i}'), 100)
+        self._add_checkpoint_snapshot(dir_path, snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'created')
+
+        # peer_add needs write access on the remote MDS (setxattr on ceph.mirror.info).
+        # Let the daemon create the remote dir with full caps, then stop it as soon as
+        # sync starts, restrict OSD write, and start again (checkpoint_sync_failed() path).
+        self.run_ceph_cmd("fs", "snapshot", "mirror", "peer_add",
+                          self.primary_fs_name, peer_spec, self.secondary_fs_name)
+        self.stop_daemon_when_peer_snap_in_progress(self.primary_fs_name, self.primary_fs_id,
+                                                    peer_spec, dir_path, snap_name)
+        self._restrict_mirror_remote_caps()
+        self.start_mirror_daemon()
+
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'failed')
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        self.assertIn('error_msg', cp)
+        self.assertTrue(cp['error_msg'])
+
+        self._restore_mirror_remote_caps()
+        self.restart_mirror_daemon()
+
+        self.check_peer_status(self.primary_fs_name, self.primary_fs_id,
+                               peer_spec, dir_path, snap_name, 1)
+        self.verify_snapshot(dir_path.lstrip('/'), snap_name)
+        self.check_checkpoint_status(self.primary_fs_name, dir_path, snap_name, 'complete')
+
+        res = self.checkpoint_list(self.primary_fs_name, dir_path)
+        cp = self.find_checkpoint(res['checkpoints'], snap_name)
+        self.assertNotIn('error_msg', cp)
+
+        self._teardown_mirroring(dir_path, peer_spec)
+
     def test_add_relative_directory_path(self):
         self.enable_mirroring(self.primary_fs_name, self.primary_fs_id)
         try:
@@ -2835,6 +3350,8 @@ class TestMirroring(CephFSTestCase):
             sync_dir = 'mgr_nc_sync'
             self.mount_a.run_shell(['mkdir', sync_dir])
             self.mount_a.create_n_files(f'{sync_dir}/file', 10000, sync=True)
+            for i in range(20):
+                self.mount_a.write_n_mb(os.path.join(sync_dir, f'large_file.{i}'), 100)
             self.add_directory(self.primary_fs_name, self.primary_fs_id,
                                f'/{sync_dir}')
             snap_name = 'snap0'

From c80f90324ed09eabe02a97d7096093cb45de3416 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Wed, 1 Jul 2026 03:50:24 +0000
Subject: [PATCH 519/596] crimson/osd: skip store flush for empty peering
 transactions

dispatch_context_transaction submits a real empty transaction to
AlienStore even when the peering context has no store ops. This
goes through the AlienCollection lock and thread pool slot machinery.
Under load from broadcast_map_to_pgs (many PGAdvanceMap operations
running concurrently with recovery), some of these empty transactions
get stuck inside AlienStore's pipeline and never reach BlueStore,
causing PGAdvanceMap to hang at complete_rctx indefinitely.

Fix by skipping the store round-trip for empty transactions. The
on_commit callbacks are still collected and fired, preserving the
fix from b0f5e1086a6 ("crimson/osd/pg: also trigger callbacks for
empty peering transactions"). The store flush that commit added was
incidental to the callback fix and is unnecessary here: the peering
pipeline's exclusive process stage already guarantees that prior
peering transactions on the same PG have completed.

Assisted-by: Claude <claude.ai>
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 src/crimson/osd/shard_services.cc | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index bfb75e645ea..e69431089eb 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -1093,9 +1093,6 @@ seastar::future<> ShardServices::dispatch_context_transaction(
   LOG_PREFIX(OSDSingletonState::dispatch_context_transaction);
   if (ctx.transaction.empty()) {
     DEBUG("empty transaction");
-    co_await crimson::os::with_store_do_transaction(
-      get_store(store_index),
-      col, ceph::os::Transaction{});
     Context* on_commit(
       ceph::os::Transaction::collect_all_contexts(ctx.transaction));
     if (on_commit) {

From d0607df42451e050981faf17b15794b334951655 Mon Sep 17 00:00:00 2001
From: Ali Masarwa <amasarwa@redhat.com>
Date: Thu, 2 Jul 2026 13:04:20 +0300
Subject: [PATCH 520/596] rgw/posix: fix for posix versioning test to expect a
 temporary 0 byte file instead of a dangling link

Signed-off-by: Ali Masarwa <amasarwa@redhat.com>
---
 src/test/rgw/test_rgw_posix_driver.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/test/rgw/test_rgw_posix_driver.cc b/src/test/rgw/test_rgw_posix_driver.cc
index d83a20b9f43..c6498212790 100644
--- a/src/test/rgw/test_rgw_posix_driver.cc
+++ b/src/test/rgw/test_rgw_posix_driver.cc
@@ -2189,7 +2189,8 @@ TEST_F(POSIXVerObjectTest, DeleteCurVersion)
   EXPECT_TRUE(sf::is_regular_file(op2));
   EXPECT_TRUE(sf::exists(op3));
   EXPECT_TRUE(sf::is_regular_file(op3));
-  EXPECT_FALSE(sf::exists(ops));
+  // a temporary 0 byte file exists to represent a delete marker
+  EXPECT_TRUE(sf::exists(ops));
   EXPECT_TRUE(sf::is_symlink(ops));
   /* Need to find a way to get the correct version */
   //EXPECT_EQ(sf::read_symlink(ops), dfname);

From fb357cb4c49b515ad619f943d7615cf0fdbe5bf2 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Sat, 13 Jun 2026 03:35:13 +0530
Subject: [PATCH 521/596] mgr/dashboard: Implement NVMe-oF Gateway Group
 Resource Overview Page

Fixes: https://tracker.ceph.com/issues/77383

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../src/app/ceph/block/block.module.ts        |   3 +-
 .../nvme-gateway-view.component.scss          |   8 --
 .../nvme-gateway-view.component.ts            |   2 +-
 ...nvmeof-gateway-group-filter.component.html |   2 +-
 .../nvmeof-gateway-group.component.html       |  15 ++-
 .../nvmeof-gateway-group.component.scss       |   6 +
 .../nvmeof-gateway-group.component.spec.ts    |  24 +++-
 .../nvmeof-gateway-group.component.ts         |  35 +++---
 ...meof-gateway-node-add-modal.component.html | 118 +++++++-----------
 ...meof-gateway-node-add-modal.component.scss |  25 +++-
 ...nvmeof-gateway-node-add-modal.component.ts |   6 +-
 .../nvmeof-gateway-node.component.html        | 111 ++++++++--------
 .../nvmeof-gateway-node.component.ts          |  32 +++++
 .../nvmeof-group-form.component.html          |  24 ++--
 .../nvmeof-group-form.component.ts            |   6 +-
 .../nvmeof-subsystem-step-1.component.html    |   6 +-
 .../nvmeof-subsystems.component.spec.ts       |   8 ++
 .../workbench-layout.component.scss           |   2 +-
 .../shared/components/components.module.ts    |   5 +-
 .../details-card/details-card.component.html  |  46 +++++--
 .../details-card/details-card.component.scss  |  17 ---
 .../details-card.component.spec.ts            |  28 +++++
 .../details-card/details-card.component.ts    |  58 ++++++++-
 .../components/icon/icon.component.scss       |   4 +
 .../productive-card.component.html            |   4 +-
 .../sidebar-layout.component.html             |   2 +-
 .../sidebar-layout.component.scss             |   4 +
 27 files changed, 373 insertions(+), 228 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index 135ec9134b4..368a7de95b7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -96,6 +96,7 @@ import Datastore from '@carbon/icons/es/datastore/16';
 import { NvmeofGatewaySubsystemComponent } from './nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component';
 import { NvmeofNamespaceExpandModalComponent } from './nvmeof-namespace-expand-modal/nvmeof-namespace-expand-modal.component';
 import { NvmeGatewayViewComponent } from './nvme-gateway-view/nvme-gateway-view.component';
+// import { ProductiveCardComponent } from '~/app/shared/components/productive-card/productive-card.component';
 import { NvmeGatewayViewBreadcrumbResolver } from './nvme-gateway-view/nvme-gateway-view-breadcrumb.resolver';
 import { NvmeofGatewayNodeMode } from '~/app/shared/models/nvmeof';
 import { NvmeofGatewayNodeAddModalComponent } from './nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component';
@@ -386,7 +387,7 @@ const routes: Routes = [
               {
                 path: 'nodes',
                 component: NvmeofGatewayNodeComponent,
-                data: { breadcrumbs: $localize`Gateway nodes`, mode: NvmeofGatewayNodeMode.DETAILS }
+                data: { breadcrumbs: $localize`Overview`, mode: NvmeofGatewayNodeMode.DETAILS }
               },
               {
                 path: 'subsystems',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.scss
index 9d8edd73999..e69de29bb2d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.scss
@@ -1,8 +0,0 @@
-.breadcrumbs--padding {
-  padding-left: 0 !important;
-}
-
-.cds--breadcrumb {
-  margin-top: 0;
-  padding: var(--cds-spacing-05);
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.ts
index f5f13e38442..55b8056f942 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.ts
@@ -24,7 +24,7 @@ export class NvmeGatewayViewComponent implements OnInit {
       this.groupName = pm.get('group') ?? '';
       this.sidebarItems = [
         {
-          label: $localize`Gateway nodes`,
+          label: $localize`Overview`,
           route: [this.basePath, this.groupName, 'nodes'],
           routerLinkActiveOptions: { exact: true }
         },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
index d3b43ababa9..c04056a900d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
@@ -4,7 +4,7 @@
      [fullWidth]="true">
 <div cdsCol
      [columnNumbers]="{sm: 4, md: 8}">
-  <div class="form-item"
+  <div class="form-item cds-mt-5"
        cdsRow>
     <cds-combo-box
         type="single"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 40ffb638bfa..8d4007806bc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -12,11 +12,14 @@
     i18n-emptyStateTitle
     emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
     i18n-emptyStateMessage>
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
-  </cd-table-actions>
+
+    <div class="table-actions">
+      <cd-table-actions [permission]="permission"
+                        [selection]="selection"
+                        class="btn-group"
+                        [tableActions]="tableActions">
+      </cd-table-actions>
+    </div>
   </cd-table>
 </ng-container>
 
@@ -37,7 +40,7 @@
 <ng-template #gatewayStatusTpl
              let-gateway="data.value">
   <div [cdsStack]="'horizontal'"
-       gap="4">
+       [gap]="4">
 
     @if (gateway.running > 0) {
     <span [ngClass]="gateway.error > 0 ? 'cds-mr-3' : ''">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
index e69de29bb2d..a5f8a62aac9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
@@ -0,0 +1,6 @@
+@use '@carbon/layout';
+
+cd-details-card {
+  display: block;
+  margin-bottom: layout.$spacing-05;
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
index fe2100fc90b..dcaced4aaaa 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
@@ -6,7 +6,6 @@ import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { Observable, of, Subject } from 'rxjs';
 import { HttpClientModule } from '@angular/common/http';
 import { SharedModule } from '~/app/shared/shared.module';
-import { Router } from '@angular/router';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
 import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group-delete-guard-modal.component';
@@ -34,10 +33,6 @@ describe('NvmeofGatewayGroupComponent', () => {
       declarations: [NvmeofGatewayGroupComponent],
       providers: [
         { provide: NvmeofService, useValue: nvmeofServiceSpy },
-        {
-          provide: Router,
-          useValue: { navigate: jest.fn() }
-        },
         {
           provide: ModalCdsService,
           useValue: { show: jest.fn() }
@@ -267,6 +262,25 @@ describe('NvmeofGatewayGroupComponent', () => {
     });
   });
 
+  describe('View details action', () => {
+    it('should use routerLink and navigate to the resource page for the selected group', () => {
+      component.selection.first = jest.fn().mockReturnValue({ name: 'default' });
+      const viewAction = component.tableActions.find((a) => a.name === 'View details');
+      expect(viewAction).toBeTruthy();
+      expect(viewAction!.click).toBeUndefined();
+      const link = (viewAction!.routerLink as Function)();
+      expect(link).toBe('/block/nvmeof/gateways/view/default');
+    });
+
+    it('should set canBePrimary true for single selection only', () => {
+      const viewAction = component.tableActions.find((a) => a.name === 'View details');
+      const single = { hasSingleSelection: true } as any;
+      const multi = { hasSingleSelection: false } as any;
+      expect((viewAction!.canBePrimary as Function)(single)).toBe(true);
+      expect((viewAction!.canBePrimary as Function)(multi)).toBe(false);
+    });
+  });
+
   describe('Delete Flow with/without Subsystems', () => {
     let mockGroup: any;
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index 5d622a0bdef..b59f235e8af 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -20,7 +20,7 @@ import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 import { Permission } from '~/app/shared/models/permissions';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { Icons, IconSize } from '~/app/shared/enum/icons.enum';
-import { NvmeofGatewayGroup, NvmeofSubsystem } from '~/app/shared/models/nvmeof';
+import { NvmeofSubsystem } from '~/app/shared/models/nvmeof';
 import { CephServiceSpec } from '~/app/shared/models/service.interface';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
@@ -48,31 +48,31 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   private destroy$ = new Subject<void>();
 
   @ViewChild(TableComponent, { static: true })
-  table: TableComponent;
+  table!: TableComponent;
 
   @ViewChild('dateTpl', { static: true })
-  dateTpl: TemplateRef<any>;
+  dateTpl!: TemplateRef<any>;
 
   @ViewChild('customTableItemTemplate', { static: true })
-  customTableItemTemplate: TemplateRef<any>;
+  customTableItemTemplate!: TemplateRef<any>;
 
   @ViewChild('deleteTpl', { static: true })
-  deleteTpl: TemplateRef<any>;
+  deleteTpl!: TemplateRef<any>;
 
   @ViewChild('gatewayStatusTpl', { static: true })
-  gatewayStatusTpl: TemplateRef<any>;
+  gatewayStatusTpl!: TemplateRef<any>;
 
-  permission: Permission;
-  tableActions: CdTableAction[];
+  permission!: Permission;
+  tableActions: CdTableAction[] = [];
   nodesAvailable = false;
   columns: CdTableColumn[] = [];
   selection: CdTableSelection = new CdTableSelection();
-  gatewayGroup$: Observable<CephServiceSpec[]>;
+  gatewayGroup$: Observable<CephServiceSpec[]> = of([]);
   subject = new BehaviorSubject<CephServiceSpec[]>([]);
-  context: CdTableFetchDataContext;
-  gatewayGroupName: string;
-  subsystemCount: number;
-  gatewayCount: number;
+  context!: CdTableFetchDataContext;
+  gatewayGroupName = '';
+  subsystemCount = 0;
+  gatewayCount = 0;
   private lastGroupCount = 0;
 
   viewUrl = `/${BASE_URL}/view`;
@@ -130,9 +130,9 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     const viewAction: CdTableAction = {
       permission: 'read',
       icon: Icons.eye,
-      click: () => this.getViewDetails(),
+      routerLink: () => `${this.viewUrl}/${this.selection.first()?.name}`,
       name: $localize`View details`,
-      canBePrimary: (selection: CdTableSelection) => selection.hasMultiSelection
+      canBePrimary: (selection: CdTableSelection) => selection.hasSingleSelection
     };
 
     const deleteAction: CdTableAction = {
@@ -154,7 +154,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
               return of([]);
             }
             return forkJoin(
-              groups.map((group: NvmeofGatewayGroup) => {
+              groups.map((group: CephServiceSpec) => {
                 const isRunning = (group.status?.running ?? 0) > 0;
                 const subsystemsObservable = isRunning
                   ? this.nvmeofService.listSubsystems(group.spec.group).pipe(
@@ -226,7 +226,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     this.nvmeofService
       .listSubsystems(group)
       .pipe(catchError(() => of([])))
-      .subscribe((subsystems: NvmeofSubsystem[]) => {
+      .subscribe((subsystems: any) => {
         let subsList: NvmeofSubsystem[] = [];
         if (subsystems) {
           const rawList = Array.isArray(subsystems) ? subsystems : [subsystems];
@@ -312,7 +312,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       }
     );
   }
-
   getViewDetails() {
     const selectedGroup = this.selection.first();
     if (!selectedGroup) {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
index 497c5797454..ad98498ca6b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
@@ -1,90 +1,68 @@
-<cds-modal
-  [open]="open"
-  (overlaySelected)="closeModal()"
-  [size]="'lg'">
-  <cds-modal-header
-    (closeSelect)="closeModal()">
-    <h4
-      class="cds--type-heading-04 cds-ml-3"
-      i18n>
+<cds-modal [open]="open" 
+           (overlaySelected)="closeModal()" 
+           [size]="'md'">
+  <cds-modal-header (closeSelect)="closeModal()">
+    <h4 class="cds--type-heading-04" 
+        i18n>
       Add gateway nodes
     </h4>
-    <p
-      class="cds--type-body-compact-01 cds-ml-3"
-      i18n>
+    <p class="cds--type-body-01" 
+       i18n>
       Select NVMe-oF gateway nodes to associate with this gateway group.
     </p>
   </cds-modal-header>
   <section cdsModalContent>
 
-    <div class="cds-mt-5">
-      <div
-        cdsStack="vertical"
-        gap="1">
-        <div
-          class="cds--type-heading-01"
-          i18n>
-          Select gateway nodes
-        </div>
-        <div
-          class="cds--type-label-01"
-          i18n>
-          Nodes to run NVMe-oF target service
-        </div>
-      </div>
+    <div class="cds-ml-5 cds-mt-5">
+      <p class="cds--type-heading-01" i18n>Select gateway nodes</p>
+      <p class="cds--type-label-01" i18n>Nodes to run NVMe-oF target pods/services</p>
+    </div>
 
-      <cd-table
-        (fetchData)="getHosts($event)"
-        selectionType="multiClick"
-        [searchableObjects]="true"
-        [data]="hosts"
-        [columns]="columns"
-        (updateSelection)="updateSelection($event)"
-        [autoReload]="false">
-      </cd-table>
+    <!-- Table on white background -->
+    <cd-table (fetchData)="getHosts($event)" 
+              selectionType="multiClick"
+              [searchableObjects]="true"
+              [data]="hosts"
+              [columns]="columns"
+              (updateSelection)="updateSelection($event)" 
+              [autoReload]="false">
+    </cd-table>
 
-      <ng-template
-        #addrTemplate
-        let-value="data.value">
-        <span>{{ value || '-' }}</span>
-      </ng-template>
+    <ng-template #addrTemplate 
+                 let-value="data.value">
+      <span>{{ value || '-' }}</span>
+    </ng-template>
 
-      <ng-template
-        #statusTemplate
-        let-value="data.value"
-        let-row="data.row">
-        <div
-          class="status-cell"
-          cdsStack="horizontal"
-          gap="3">
+    <ng-template #statusTemplate 
+                 let-value="data.value" 
+                 let-row="data.row">
+      <div class="status-cell" 
+           cdsStack="horizontal"
+           gap="3">
         @if (value === HostStatus.AVAILABLE) {
-          <cd-icon type="success"></cd-icon>
+        <cd-icon type="success"></cd-icon>
         }
         <span>{{ value | titlecase }}</span>
-        </div>
-      </ng-template>
+      </div>
+    </ng-template>
 
-      <ng-template
-        #labelsTemplate
-        let-value="data.value">
+    <ng-template #labelsTemplate 
+                 let-value="data.value">
       @if (value && value.length > 0) {
-        <cds-tag
-          *ngFor="let label of value"
-          class="tag tag-dark">{{ label }}</cds-tag>
+      <cds-tag *ngFor="let label of value" 
+                class="tag tag-dark">{{ label }}</cds-tag>
       } @else {
-        <span>-</span>
+      <span>-</span>
       }
-      </ng-template>
+    </ng-template>
 
-    </div>
   </section>
-  <cd-form-button-panel
-    [modalForm]="true"
-    [showSubmit]="true"
-    submitText="Add"
-    i18n-submitText
-    [disabled]="selection.selected.length === 0"
-    (submitActionEvent)="onSubmit()"
-    (backActionEvent)="closeModal()">
+  <cd-form-button-panel [modalForm]="true" 
+                        [showSubmit]="true" 
+                        submitText="Add" 
+                        i18n-submitText
+                        [disabled]="selection.selected.length === 0" 
+                        (submitActionEvent)="onSubmit()" 
+                        (backActionEvent)="closeModal()">
   </cd-form-button-panel>
-</cds-modal>
+</cds-modal>
\ No newline at end of file
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
index dbb535acfd3..f93358bb00d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
@@ -1,7 +1,22 @@
-cds-modal-header {
-  border-bottom: 1px solid var(--cds-ui-03, #e0e0e0);
-}
+cd-nvmeof-gateway-node-add-modal {
+  .cds--modal-container {
+    height: 80vh;
+    max-height: 80vh;
+  }
 
-.status-cell {
-  align-items: center;
+  .cds--modal-header {
+    border-bottom: none;
+  }
+
+  .cds--modal-content {
+    background-color: var(--cds-background);
+    padding: 0;
+  }
+
+  cd-table {
+    display: block;
+    background-color: var(--cds-layer);
+    border: 1px solid var(--cds-border-subtle-01);
+    margin: 0 var(--cds-spacing-05) var(--cds-spacing-05);
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts
index 6c447d2e244..ee8d64dfa3a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts
@@ -5,7 +5,8 @@ import {
   ViewChild,
   TemplateRef,
   OnDestroy,
-  Inject
+  Inject,
+  ViewEncapsulation
 } from '@angular/core';
 import { Subscription } from 'rxjs';
 
@@ -26,7 +27,8 @@ import { TaskMessageService } from '~/app/shared/services/task-message.service';
   selector: 'cd-nvmeof-gateway-node-add-modal',
   templateUrl: './nvmeof-gateway-node-add-modal.component.html',
   styleUrls: ['./nvmeof-gateway-node-add-modal.component.scss'],
-  standalone: false
+  standalone: false,
+  encapsulation: ViewEncapsulation.None
 })
 export class NvmeofGatewayNodeAddModalComponent extends CdForm implements OnInit, OnDestroy {
   hosts: Host[] = [];
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
index 678e0cd5f63..7e420bfe86e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
@@ -1,77 +1,70 @@
-<div>
-  <cd-table
-    #table
-    [data]="hosts"
-    [columns]="columns"
-    columnMode="flex"
-    (fetchData)="getHosts($event)"
-    [selectionType]="selectionType"
-    [searchableObjects]="true"
-    [serverSide]="false"
-    [maxLimit]="25"
-    identifier="hostname"
-    forceIdentifier="true"
-    (updateSelection)="updateSelection($event)"
-    emptyStateTitle="No nodes available"
-    i18n-emptyStateTitle
-    emptyStateMessage="Add your first gateway node to start using NVMe over Fabrics. Nodes provide the resources required to expose NVMe/TCP block storage."
-    i18n-emptyStateMessage
-  >
-    <cd-table-actions
-      class="table-actions"
-      [permission]="permission"
-      [selection]="selection"
+<div class="content-theme">
+  @if (mode === 'details' && groupName) {
+  <cd-details-card cardTitle="Details" i18n-cardTitle 
+                   [details]="gatewayDetails" 
+                   class="cds-mb-5">
+  </cd-details-card>
+  }
+
+  @if (mode === 'details') {
+  <div class="cds-mb-5">
+    <h2 class="cds--type-heading-03 cds-mt-5" i18n>Gateway nodes</h2>
+    <p class="cds--type-body-compact-01" i18n>Nodes running NVMe-oF target pods/services</p>
+  </div>
+  }
+  <cd-table #table 
+            [data]="hosts" 
+            [columns]="columns" 
+            columnMode="flex" 
+            (fetchData)="getHosts($event)"
+            [selectionType]="selectionType" 
+            [searchableObjects]="true" 
+            [serverSide]="false" 
+            [maxLimit]="25"
+            identifier="hostname" 
+            [forceIdentifier]="true" 
+            (updateSelection)="updateSelection($event)"
+            emptyStateTitle="No nodes available" i18n-emptyStateTitle
+            emptyStateMessage="Add your first gateway node to start using NVMe over Fabrics. Nodes provide the resources required to expose NVMe/TCP block storage."
+            i18n-emptyStateMessage>
+    <cd-table-actions class="table-actions" 
+                      [permission]="permission" 
+                      [selection]="selection"
       [tableActions]="tableActions">
     </cd-table-actions>
   </cd-table>
 </div>
 
-<ng-template
-  #hostNameTpl
-  let-value="data.value"
->
+<ng-template #hostNameTpl 
+             let-value="data.value">
   <span class="cds-ml-2">{{ value }}</span>
 </ng-template>
 
-<ng-template
-  #addrTpl
-  let-value="data.value"
->
+<ng-template #addrTpl let-value="data.value">
   <span>{{ value || '-' }}</span>
 </ng-template>
 
-<ng-template
-  #statusTpl
-  let-value="data.value"
-  let-row="data.row"
->
-@if (value) {
-  <div
-    [cdsStack]="'horizontal'"
-    gap="4"
-  >
-  @if (value === HostStatus.AVAILABLE || value === HostStatus.RUNNING) {
+<ng-template #statusTpl 
+             let-value="data.value" 
+             let-row="data.row">
+  @if (value) {
+  <div [cdsStack]="'horizontal'" [gap]="4">
+    @if (value === HostStatus.AVAILABLE || value === HostStatus.RUNNING) {
     <cd-icon type="success"></cd-icon>
-  } @else {
+    } @else {
     <cd-icon type="error"></cd-icon>
-  }
-  <span class="cds-ml-3">{{ value | titlecase }}</span>
+    }
+    <span class="cds-ml-3">{{ value | titlecase }}</span>
   </div>
-} @else {
+  } @else {
   <span>-</span>
-}
+  }
 </ng-template>
 
-<ng-template
-  #labelsTpl
-  let-value="data.value"
->
-@if (value && value.length > 0) {
-  <cds-tag *ngFor="let label of value"
-           class="tag tag-dark">{{ label }}</cds-tag>
-} @else {
+<ng-template #labelsTpl let-value="data.value">
+  @if (value && value.length > 0) {
+  <cds-tag *ngFor="let label of value" class="tag tag-dark">{{ label }}</cds-tag>
+  } @else {
   <span>-</span>
-}
-</ng-template>
-
-
+  }
+</ng-template>
\ No newline at end of file
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
index 2de89e3a478..b0595304e74 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
@@ -38,6 +38,7 @@ import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { NotificationService } from '~/app/shared/services/notification.service';
 import { NotificationType } from '~/app/shared/enum/notification-type.enum';
+import { DetailItem } from '~/app/shared/components/details-card/details-card.component';
 
 @Component({
   selector: 'cd-nvmeof-gateway-node',
@@ -70,6 +71,7 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
   usedHostnames: Set<string> = new Set();
   serviceSpec: CephServiceSpec | undefined;
   hasAvailableHosts = false;
+  gatewayDetails: DetailItem[] = [];
 
   permission: Permission;
   columns: CdTableColumn[] = [];
@@ -349,9 +351,39 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
       } else {
         this.hosts = [];
       }
+
+      this.gatewayDetails = this.buildGatewayDetails(this.serviceSpec, this.hosts.length);
     }
 
     this.count = this.hosts.length;
     this.hostsLoaded.emit(this.count);
   }
+
+  private buildGatewayDetails(
+    serviceSpec: CephServiceSpec,
+    gatewayNodeCount: number
+  ): DetailItem[] {
+    return [
+      {
+        label: $localize`Gateway name`,
+        value: serviceSpec.spec?.group || this.groupName || '-'
+      },
+      {
+        label: $localize`Gateway nodes`,
+        value: gatewayNodeCount
+      },
+      {
+        label: $localize`Encryption`,
+        value: serviceSpec.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
+        type: 'status',
+        statusIcon: serviceSpec.spec?.enable_auth ? 'success' : 'error'
+      },
+      {
+        label: $localize`mTLS`,
+        value: $localize`Disabled`,
+        type: 'status',
+        statusIcon: 'error'
+      }
+    ];
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index b482607b371..bdac48c78b2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -62,34 +62,34 @@
         </div>
       </div>
 
-      <!-- CDS Input (shown when checkbox is checked) -->
+      <!-- Encryption Configuration (shown when checkbox is checked) -->
       @if (groupForm.controls.enableEncryption.value) {
       <div cdsRow
            class="form-item">
         <div cdsCol>
           <cds-textarea-label
-            labelInputID="cdsInput"
+            labelInputID="encryptionConfig"
             helperText="Provide the encryption configuration details."
+            cdRequiredField="Encryption configuration"
             i18n
-            i18n-helperText>Encryption configuration
+            i18n-helperText
+            [invalid]="encryptionConfigRef.isInvalid">Encryption configuration
             <textarea cdsTextArea
-                      id="cdsInput"
+                      id="encryptionConfig"
                       cdValidate
-                      #encryptionConfig="cdValidate"
-                      [invalid]="encryptionConfig.invalid"
-                      [invalidText]="encryptionConfigError"
+                      #encryptionConfigRef="cdValidate"
+                      [invalid]="encryptionConfigRef.isInvalid"
                       formControlName="encryptionConfig"
                       cols="100"
                       rows="4">
             </textarea>
           </cds-textarea-label>
+          <span
+            class="invalid-feedback"
+            *ngIf="groupForm.showError('encryptionConfig', formDir, 'required')"
+            i18n>This field is required.</span>
         </div>
       </div>
-      <ng-template #encryptionConfigError>
-        <span *ngIf="groupForm.controls.encryptionConfig.hasError('required')"
-              class="invalid-feedback"
-              i18n>This field is required.</span>
-      </ng-template>
       }
       <!-- Target Nodes Selection -->
       <div
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index c1fb56b251e..f55ac8f7357 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -21,11 +21,11 @@ import { NvmeofService } from '~/app/shared/api/nvmeof.service';
   standalone: false
 })
 export class NvmeofGroupFormComponent extends CdForm implements OnInit {
-  @ViewChild(NvmeofGatewayNodeComponent) gatewayNodeComponent: NvmeofGatewayNodeComponent;
+  @ViewChild(NvmeofGatewayNodeComponent) gatewayNodeComponent!: NvmeofGatewayNodeComponent;
 
   permission: Permission;
-  groupForm: CdFormGroup;
-  action: string;
+  groupForm!: CdFormGroup;
+  action!: string;
   resource: string;
   group: string;
   pageURL: string;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
index aab200d7a1c..48b6326e937 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
@@ -22,7 +22,6 @@
         <cds-text-label
           i18n
           [invalid]="nqnRef.isInvalid"
-          [invalidText]="nqnInvalidTemplate"
           helperText="A unique identifier for the subsystem."
           i18n-helperText>
           Subsystem NQN (NVMe Qualified Name)
@@ -36,6 +35,11 @@
                  formControlName="nqn"
                  [invalid]="nqnRef.isInvalid">
         </cds-text-label>
+        @if (nqnRef.isInvalid) {
+          @for (err of formGroup.get('nqn')?.errors | keyvalue; track err.key) {
+            <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+          }
+        }
       </div>
       <div cdsRow
            class="form-item">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
index f848d67c66e..e62934ca8d4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
@@ -160,4 +160,12 @@ describe('NvmeofSubsystemsComponent', () => {
   it('should set first group as default initially', () => {
     expect(component.group).toBe('default');
   });
+
+  it('should clear selected group and stop fetching subsystems', () => {
+    component.group = 'default';
+
+    component.onGroupChange(null);
+
+    expect(component.group).toBeNull();
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.scss
index 7eae41be97c..e32f41ab605 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.scss
@@ -31,7 +31,7 @@
     padding-right: 0;
 
     .breadcrumbs--padding {
-      padding-left: var(--cds-spacing-07);
+      padding-left: var(--cds-spacing-05);
     }
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
index 5fbd0930b45..15452fcf264 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
@@ -137,10 +137,12 @@ import { TearsheetStepComponent } from './tearsheet-step/tearsheet-step.componen
 import { PageHeaderComponent } from './page-header/page-header.component';
 import { SidebarLayoutComponent } from './sidebar-layout/sidebar-layout.component';
 import { NumberWithUnitComponent } from './number-with-unit/number-with-unit.component';
+import { ProductiveCardComponent } from './productive-card/productive-card.component';
 
 @NgModule({
   imports: [
     CommonModule,
+    ProductiveCardComponent,
     FormsModule,
     ReactiveFormsModule,
     NgbAlertModule,
@@ -279,7 +281,8 @@ import { NumberWithUnitComponent } from './number-with-unit/number-with-unit.com
     TearsheetStepComponent,
     PageHeaderComponent,
     SidebarLayoutComponent,
-    NumberWithUnitComponent
+    NumberWithUnitComponent,
+    ProductiveCardComponent
   ]
 })
 export class ComponentsModule {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index 9a402f60c59..dd302459d61 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -1,14 +1,38 @@
-<cds-tile>
-@if (cardTitle) {
-  <div class="details-card-header">
-    <span class="cds--type-heading-03"
-          i18n>{{ cardTitle }}</span>
-  </div>
-}
+<cd-productive-card>
+  <ng-template #header>
+    @if (cardTitle) {
+    <h3 class="cds--type-heading-03" i18n>{{ cardTitle }}</h3>
+    }
+  </ng-template>
 
-  <div class="details-card-body">
-    <div cdsRow>
-      <ng-content select=".details-body-content"></ng-content>
+  <div [cdsStack]="'vertical'" 
+       [gap]="0">
+    @if (details && details.length > 0) {
+    <div [cdsStack]="'horizontal'" 
+         [gap]="6">
+      @for (detail of getVisibleDetails(); track detail.label) {
+      <div [cdsStack]="'vertical'" 
+           [gap]="2">
+        <label class="cds--type-label-01">{{ detail.label }}</label>
+        <div class="cds--type-body-01">
+          @switch (detail.type) {
+            @case ('status') {
+              <div [cdsStack]="'horizontal'" 
+                   [gap]="3">
+                <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
+                <span>{{ getDisplayValue(detail.value) }}</span>
+              </div>
+            }
+            
+            @default {
+              <span>{{ getDisplayValue(detail.value) }}</span>
+            }
+          }
+        </div>
+      </div>
+      }
     </div>
+    }
+    <ng-content></ng-content>
   </div>
-</cds-tile>
+</cd-productive-card>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.scss
index 5d896839cd4..e69de29bb2d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.scss
@@ -1,17 +0,0 @@
-@use '@carbon/layout';
-
-.details-card-header {
-  align-items: center;
-  display: flex;
-  justify-content: space-between;
-  padding-bottom: layout.$spacing-05;
-  position: relative;
-}
-
-::ng-deep .cds--label {
-  display: block;
-}
-
-.cds--row {
-  row-gap: layout.$spacing-05;
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
index da32634778d..8e1912a5da0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
@@ -19,4 +19,32 @@ describe('DetailsCardComponent', () => {
   it('should create', () => {
     expect(component).toBeTruthy();
   });
+
+  it('should filter hidden details', () => {
+    component.details = [
+      { label: 'Visible', value: 'test', type: 'text' },
+      { label: 'Hidden', value: 'test', type: 'text', hidden: true }
+    ];
+    const visible = component.getVisibleDetails();
+    expect(visible.length).toBe(1);
+    expect(visible[0].label).toBe('Visible');
+  });
+
+  it('should detect disabled status', () => {
+    expect(component.isStatusDisabled('Disabled')).toBe(true);
+    expect(component.isStatusDisabled('disabled')).toBe(true);
+    expect(component.isStatusDisabled('Enabled')).toBe(false);
+  });
+
+  it('should handle empty details array', () => {
+    component.details = [];
+    const visible = component.getVisibleDetails();
+    expect(visible.length).toBe(0);
+  });
+
+  it('should handle undefined details', () => {
+    component.details = undefined;
+    const visible = component.getVisibleDetails();
+    expect(visible.length).toBe(0);
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
index 9cfdb999939..41d69190d5b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
@@ -1,12 +1,64 @@
-import { Component, Input } from '@angular/core';
+import { Component, Input, TemplateRef } from '@angular/core';
+
+type DetailValue = any;
+type DetailTemplateContext = { $implicit: DetailValue; detail: DetailItem };
+
+export interface DetailItem {
+  label: string;
+  value: DetailValue;
+  type?: 'text' | 'status' | 'custom';
+  statusIcon?: 'success' | 'error' | 'warning' | 'notification';
+  customTemplate?: TemplateRef<DetailTemplateContext>;
+  hidden?: boolean;
+}
 
 @Component({
   selector: 'cd-details-card',
   templateUrl: './details-card.component.html',
-  styleUrl: './details-card.component.scss',
+  styleUrls: ['./details-card.component.scss'],
   standalone: false
 })
 export class DetailsCardComponent {
   @Input()
-  cardTitle: string;
+  cardTitle?: string;
+
+  @Input()
+  details?: DetailItem[] = [];
+
+  @Input()
+  columns = 4;
+
+  getVisibleDetails(): DetailItem[] {
+    return (this.details || []).filter((detail) => !detail.hidden);
+  }
+
+  getDetailContext(detail: DetailItem): DetailTemplateContext {
+    return {
+      $implicit: detail.value,
+      detail
+    };
+  }
+
+  getStatusIcon(detail: DetailItem): 'success' | 'error' | 'warning' | 'notification' {
+    if (detail.statusIcon) {
+      return detail.statusIcon;
+    }
+    return this.isStatusDisabled(detail.value) ? 'error' : 'success';
+  }
+
+  hasValue(value: DetailValue): boolean {
+    return value !== null && value !== undefined && value !== '';
+  }
+
+  getDisplayValue(value: DetailValue): DetailValue | string {
+    return this.hasValue(value) ? value : '-';
+  }
+
+  isStatusDisabled(value: DetailValue): boolean {
+    if (value === null || value === undefined) {
+      return false;
+    }
+    const normalized = String(value).trim().toLowerCase();
+    return normalized === 'disabled';
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.scss
index f38d638a62b..a702d0fe041 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.scss
@@ -70,3 +70,7 @@ Using `color` in css and seyting svg will fill="currentColor does not work.
 .arrowDown-icon {
   fill: theme.$support-error !important;
 }
+
+.edit-icon {
+  fill: var(--cds-link-primary) !important;
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html
index f9e9cae8e53..1304bb4bc29 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html
@@ -2,7 +2,7 @@
           [ngClass]="{'productive-card--shadow': applyShadow}"
           [cdsLayer]="0">
   <div class="productive-card-header">
-    <ng-container *ngTemplateOutlet="headerTemplate"></ng-container>
+    <ng-container *ngTemplateOutlet="headerTemplate || null"></ng-container>
   </div>
   <section class="productive-card-section cds--type-body-compact-01"
            [ngClass]="{'productive-card-section--footer': footerTemplate}">
@@ -10,7 +10,7 @@
   </section>
   @if(!!footerTemplate) {
   <footer class="productive-card-footer">
-    <ng-container *ngTemplateOutlet="footerTemplate"></ng-container>
+    <ng-container *ngTemplateOutlet="footerTemplate || null"></ng-container>
   </footer>
   }
 </cds-tile>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html
index 3e212b318ec..493b776f4b1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html
@@ -7,7 +7,7 @@
   <div class="sidebar-layout-shell">
     <cds-sidenav
       [expanded]="true"
-      class="sidebar-layout-nav">
+      class="sidebar-layout-nav cds--side-nav--fixed">
       @for (item of items; track item.label) {
       <cds-sidenav-item
         [route]="item.route"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.scss
index b4570fdbe48..5e7c58b68b2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.scss
@@ -23,6 +23,10 @@
 
 .sidebar-layout-nav {
   background-color: var(--cds-layer-03);
+
+  .cds--side-nav__icon:not(.cds--side-nav__submenu-chevron) {
+    display: none;
+  }
 }
 
 .sidebar-layout-main {

From bb9c1fde9f93e8f31d512dd13482da552b2ed52d Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Thu, 2 Jul 2026 13:48:38 +0800
Subject: [PATCH 522/596] vstart.sh: only skip fs volume create when there's no
 mgr to run it

The mgr volumes module handles fs volume ls/create, not the monitor, so
without a mgr (CEPH_NUM_MGR=0) the "wait for volume module to load" loop
spun forever. Open-coding fs new unconditionally, my first attempt,
changed pool creation for every vstart user and dropped the wait, so
cephfs tests calling `fs volume ...` right after vstart.sh returns could
race a module still mid-load.

create_fs_volume() branches on CEPH_NUM_MGR instead. With a mgr it still
calls fs volume ls/create. Without one it runs the plain mon commands fs
volume create wraps: osd pool create cephfs.<name>.{meta,data}, then fs
new <name> <meta> <data>. The wait stays at its one call site above the
per-filesystem loop, so it runs once regardless of CEPH_NUM_FS, not once
per filesystem.

Verified against a local vstart: mgr present, fs volume ls polls once
then creates CEPH_NUM_FS=2 filesystems with no repeated poll;
CEPH_NUM_MGR=0, no poll, fs new creates 'a' directly, HEALTH_OK.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 src/vstart.sh | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/vstart.sh b/src/vstart.sh
index 9e5e6cd3c68..c64c9cf9983 100755
--- a/src/vstart.sh
+++ b/src/vstart.sh
@@ -1482,6 +1482,19 @@ EOF
     fi
 }
 
+create_fs_volume() {
+    local name=$1
+    if [ "$CEPH_NUM_MGR" -gt 0 ]; then
+        ceph_adm fs volume create ${name}
+    else
+        local meta_pool="cephfs.${name}.meta"
+        local data_pool="cephfs.${name}.data"
+        ceph_adm osd pool create "$meta_pool"
+        ceph_adm osd pool create "$data_pool" --bulk
+        ceph_adm fs new ${name} "$meta_pool" "$data_pool"
+    fi
+}
+
 start_mds() {
     local mds=0
     for name in a b c d e f g h i j k l m n o p
@@ -1532,12 +1545,15 @@ EOF
                 ceph_adm fs flag set enable_multiple true --yes-i-really-mean-it
             fi
 
-	    # wait for volume module to load
-	    while ! ceph_adm fs volume ls ; do sleep 1 ; done
+            if [ "$CEPH_NUM_MGR" -gt 0 ]; then
+                # wait for volume module to load
+                while ! ceph_adm fs volume ls ; do sleep 1 ; done
+            fi
+
             local fs=0
             for name in a b c d e f g h i j k l m n o p
             do
-                ceph_adm fs volume create ${name}
+                create_fs_volume ${name}
                 ceph_adm fs authorize ${name} "client.fs_${name}" / rwp >> "$keyring_fn"
                 fs=$(($fs + 1))
                 [ $fs -eq $CEPH_NUM_FS ] && break

From 0338ed302a8c09155d221d2a98516dfdc053fcf5 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Thu, 2 Jul 2026 02:26:59 -0700
Subject: [PATCH 523/596] common/crc32c: stop using gp/tp as scratch in RISC-V
 Zbc CRC32C

crc32c_zbc's fold-by-four loop used gp (x3) and tp (x4) as scratch for
two folding temporaries. Save/restore around the loop is not enough:
they are ABI-reserved, so a signal delivered mid-loop runs its handler
with a corrupted tp, and the first TLS access there faults.

On riscv64 this reliably crashes the crimson/seastore unittests
unittest-transaction-manager and unittest-omap-manager, where seastar's
stall-detector timer fires often: the process dies with SIGSEGV in the
linker's TLS path with garbage in gp/tp.

Fixes: https://tracker.ceph.com/issues/77904
Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/common/crc32c_riscv_zbc_asm.h | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/common/crc32c_riscv_zbc_asm.h b/src/common/crc32c_riscv_zbc_asm.h
index d11ca1257be..7e6109a3084 100644
--- a/src/common/crc32c_riscv_zbc_asm.h
+++ b/src/common/crc32c_riscv_zbc_asm.h
@@ -41,8 +41,8 @@
 #define BUF0LOW  s11
 
 #define X3K1LOW  ra
-#define X3K2HIGH gp
-#define X2K1LOW  tp
+#define X3K2HIGH a4
+#define X2K1LOW  a2
 #define X2K2HIGH s0
 #define X1K1LOW  s1
 #define X1K2HIGH a0
@@ -65,8 +65,6 @@
         addi sp, sp, -128
         sd a3, 120(sp)
         sd ra, 112(sp)
-        sd gp, 104(sp)
-        sd tp, 96(sp)
         sd s0, 88(sp)
         sd s1, 80(sp)
         sd s2, 72(sp)
@@ -105,6 +103,7 @@
         slli a3, a3, 6
         add a3, BUF, a3
         and LEN, LEN, 0x3f
+        sd LEN, 104(sp)
 
 .align 3
 .Lfold_4_loop:
@@ -194,8 +193,8 @@
         /* pop register values saved on stack */
         ld a3, 120(sp)
         ld ra, 112(sp)
-        ld gp, 104(sp)
-        ld tp, 96(sp)
+        ld LEN, 104(sp)
+        ld MU, .Lmu
         ld s0, 88(sp)
         ld s1, 80(sp)
         ld s2, 72(sp)

From 4eb4e25e5e6f14ed70fee5c41b2669cc0c557e19 Mon Sep 17 00:00:00 2001
From: Devika Babrekar <devika.babrekar@ibm.com>
Date: Thu, 2 Jul 2026 16:16:46 +0530
Subject: [PATCH 524/596] mgr/dashboard: Converting Create OSDs tearsheet type
 from Full to Wide Fixes: https://tracker.ceph.com/issues/77132 Signed-off-by:
 Devika Babrekar <devika.babrekar@ibm.com>

---
 .../frontend/src/app/app-routing.module.ts    |  4 +-
 .../create-cluster-step-2.component.html      |  4 +-
 .../create-cluster-step-2.component.ts        |  4 ++
 .../osd/osd-form/osd-form.component.html      | 55 +++++++---------
 .../osd/osd-form/osd-form.component.spec.ts   | 26 ++++----
 .../osd/osd-form/osd-form.component.ts        | 65 ++++++++++++++++---
 .../osd/osd-list/osd-list.component.html      |  2 +
 .../osd/osd-list/osd-list.component.ts        | 18 ++---
 .../tearsheet/tearsheet.component.html        |  2 +
 .../tearsheet/tearsheet.component.spec.ts     | 13 ++++
 .../tearsheet/tearsheet.component.ts          | 36 +++++++++-
 11 files changed, 161 insertions(+), 68 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts
index 5a77bb1f1db..95f1449aa9b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/app-routing.module.ts
@@ -307,13 +307,13 @@ const routes: Routes = [
       },
       {
         path: 'osd',
+        component: OsdListComponent,
         data: { breadcrumbs: 'Cluster/OSDs' },
         children: [
-          { path: '', component: OsdListComponent },
           {
             path: URLVerbs.CREATE,
             component: OsdFormComponent,
-            data: { breadcrumbs: ActionLabels.CREATE }
+            outlet: 'modal'
           }
         ]
       },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
index 1523bdb986b..b95d4092086 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
@@ -13,9 +13,11 @@
                      (emitDriveGroup)="setDriveGroup($event)"
                      (emitDeploymentOption)="setDeploymentOptions($event)"
                      (emitMode)="setDeploymentMode($event)"
-                     (osdCreated)="onOsdCreated()"></cd-osd-form>
+                     (osdCreated)="onOsdCreated()"
+                     (cancelled)="onFormCancelled()"></cd-osd-form>
       } @else {
         <cd-osd-list [showTabs]="false"
+                     [inlineCreate]="true"
                      (createAction)="onCreateAction()"></cd-osd-list>
       }
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts
index 655e675f184..e15cffa08a6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.ts
@@ -37,6 +37,10 @@ export class CreateClusterStep2Component implements OnInit, TearsheetStep {
     this.formGroup.patchValue({ skipped: true });
   }
 
+  onFormCancelled() {
+    this.showForm = false;
+  }
+
   onCreateAction() {
     this.showForm = true;
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
index d536d41a9c6..91dc4ca6ecc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
@@ -6,10 +6,11 @@
   [steps]="steps"
   [title]="!hideTitle ? (action | titlecase) + ' ' + (resource | upperFirst) : ''"
   (submitRequested)="submit()"
+  (closeRequested)="onCancel()"
   (stepChanged)="populateReviewData()"
   [isSubmitLoading]="isSubmitLoading"
   [submitButtonLabel]="simpleDeployment ? createOsdsLabel : actionLabels.PREVIEW"
-  type="full">
+  type="wide">
 
   <cd-tearsheet-step>
   <div class="osd-tearsheet-content">
@@ -18,7 +19,7 @@
     cdsStack="vertical"
     [gap]="6">
 
-    @if (availDevices?.length === 0) {
+    @if (!hasEligibleDevices) {
     <cd-alert-panel
       type="warning"
       class="osd-alert-block"
@@ -50,7 +51,8 @@
           formControlName="deploymentMode"
           orientation="vertical">
 
-          <cds-radio value="automatic">
+          <cds-radio value="automatic"
+                     [disabled]="!hasEligibleDevices ? true : null">
             <div class="osd-radio-label-wrapper">
               <span
               class="cds--type-body-short-01"
@@ -84,7 +86,7 @@
             <cds-radio
               [value]="optionName"
               [class.cds-mb-5]="!isLast"
-              [disabled]="!deploymentOptions?.options[optionName].available ? true : null">
+              [disabled]="!hasEligibleDevices || !deploymentOptions?.options[optionName].available ? true : null">
 
               <div class="osd-radio-label-wrapper">
               <span class="cds--type-body-short-01">
@@ -104,7 +106,8 @@
         </div>
         }
 
-          <cds-radio value="manual">
+          <cds-radio value="manual"
+                     [disabled]="!hasEligibleDevices ? true : null">
             <div class="osd-radio-label-wrapper">
               <span
               class="cds--type-body-short-01"
@@ -122,6 +125,23 @@
       </div>
     </div>
 
+    <div formGroupName="features">
+      <cds-text-label
+      class="cds--type-heading-compact-02 cds-mb-5"
+      i18n>
+      Features
+      </cds-text-label>
+
+    @for (feature of featureList; track feature.key) {
+      <cds-checkbox
+      [name]="feature.key"
+      formControlName="{{ feature.key }}"
+      (checkedChange)="emitDeploymentSelection()">
+      {{ feature.desc }}
+      </cds-checkbox>
+    }
+    </div>
+
     </form>
   </div>
   </cd-tearsheet-step>
@@ -235,31 +255,6 @@
   </cd-tearsheet-step>
   }
 
-  <cd-tearsheet-step>
-  <div class="osd-tearsheet-content">
-    <form
-    [formGroup]="form">
-
-    <div formGroupName="features">
-      <cds-text-label
-      class="cds--type-heading-compact-02 cds-mb-5"
-      i18n>
-      Features
-      </cds-text-label>
-
-    @for (feature of featureList; track feature.key) {
-      <cds-checkbox
-      [name]="feature.key"
-      formControlName="{{ feature.key }}"
-      (checkedChange)="emitDeploymentSelection()">
-      {{ feature.desc }}
-      </cds-checkbox>
-    }
-    </div>
-
-    </form>
-  </div>
-  </cd-tearsheet-step>
 
     <cd-tearsheet-step>
     <div class="osd-tearsheet-content">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts
index 5f46fc4c677..1a19376cf14 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.spec.ts
@@ -215,24 +215,19 @@ describe('OsdFormComponent', () => {
         OsdDeploymentOptions.THROUGHPUT,
         OsdDeploymentOptions.IOPS
       ]);
-      expect(component.steps).toHaveLength(3);
-      expect(component.steps.map((step) => step.label)).toEqual([
-        'Deployment Options',
-        'Features',
-        'Review'
-      ]);
+      expect(component.steps).toHaveLength(2);
+      expect(component.steps.map((step) => step.label)).toEqual(['Deployment Options', 'Review']);
     });
 
     it('should expand and collapse steps when deployment mode changes', () => {
       component.form.get('deploymentMode').setValue('manual');
       fixture.detectChanges();
 
-      expect(component.steps).toHaveLength(5);
+      expect(component.steps).toHaveLength(4);
       expect(component.steps.map((step) => step.label)).toEqual([
         'Deployment Options',
         'Select data devices',
         'Select DB/WAL devices (optional)',
-        'Features',
         'Review'
       ]);
       expect(fixture.nativeElement.textContent).toContain('Select data devices');
@@ -241,12 +236,8 @@ describe('OsdFormComponent', () => {
       component.form.get('deploymentMode').setValue('automatic');
       fixture.detectChanges();
 
-      expect(component.steps).toHaveLength(3);
-      expect(component.steps.map((step) => step.label)).toEqual([
-        'Deployment Options',
-        'Features',
-        'Review'
-      ]);
+      expect(component.steps).toHaveLength(2);
+      expect(component.steps.map((step) => step.label)).toEqual(['Deployment Options', 'Review']);
       expect(fixture.nativeElement.textContent).not.toContain('Select data devices');
       expect(fixture.nativeElement.textContent).not.toContain('Select DB/WAL devices (optional)');
     });
@@ -271,6 +262,13 @@ describe('OsdFormComponent', () => {
       expect(text).toContain('IOPS-optimized');
     });
 
+    it('should mark the first step invalid when no eligible devices are available', () => {
+      expect(component.hasEligibleDevices).toBe(false);
+      expect(component.steps[0].invalid).toBe(true);
+      expect(component.form.get('deploymentMode').disabled).toBe(true);
+      expect(component.form.get('deploymentOption').disabled).toBe(true);
+    });
+
     it('should only disable the options that are not available', () => {
       expect(deploymentOptions.options['throughput_optimized'].available).toBeFalsy();
       expect(deploymentOptions.options['iops_optimized'].available).toBeFalsy();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
index ded0a1be5c9..6860134b3b9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
@@ -8,6 +8,7 @@ import {
   ViewChild
 } from '@angular/core';
 import { UntypedFormControl } from '@angular/forms';
+import { Location } from '@angular/common';
 import { Router } from '@angular/router';
 
 import _ from 'lodash';
@@ -94,6 +95,8 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
 
   @Output() osdCreated: EventEmitter<void> = new EventEmitter();
 
+  @Output() cancelled: EventEmitter<void> = new EventEmitter();
+
   icons = Icons;
 
   form!: CdFormGroup;
@@ -140,6 +143,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     private orchService: OrchestratorService,
     private hostService: HostService,
     private router: Router,
+    private location: Location,
     private formatterService: FormatterService,
     private modalService: ModalService,
     private osdService: OsdService,
@@ -158,22 +162,56 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     this.createForm();
   }
 
+  get hasEligibleDevices(): boolean {
+    return this.allDevices.length > 0;
+  }
+
   private getStepsForMode(mode: string): Array<Step> {
+    const firstStepInvalid = !this.hasEligibleDevices;
+    const subsequentStepDisabled = !this.hasEligibleDevices;
     return mode !== 'manual'
       ? [
-          { label: STEP_LABELS.DEPLOYMENT, invalid: false },
-          { label: STEP_LABELS.FEATURES, invalid: false },
-          { label: STEP_LABELS.REVIEW, invalid: false }
+          { label: STEP_LABELS.DEPLOYMENT, invalid: firstStepInvalid },
+          { label: STEP_LABELS.REVIEW, invalid: false, disabled: subsequentStepDisabled }
         ]
       : [
-          { label: STEP_LABELS.DEPLOYMENT, invalid: false },
-          { label: STEP_LABELS.DATA, invalid: false },
-          { label: STEP_LABELS.DB_WAL, invalid: false },
-          { label: STEP_LABELS.FEATURES, invalid: false },
-          { label: STEP_LABELS.REVIEW, invalid: false }
+          { label: STEP_LABELS.DEPLOYMENT, invalid: firstStepInvalid },
+          { label: STEP_LABELS.DATA, invalid: false, disabled: subsequentStepDisabled },
+          { label: STEP_LABELS.DB_WAL, invalid: false, disabled: subsequentStepDisabled },
+          { label: STEP_LABELS.REVIEW, invalid: false, disabled: subsequentStepDisabled }
         ];
   }
 
+  private updateFirstStepInvalid() {
+    const invalid = !this.hasEligibleDevices;
+    const subsequentStepDisabled = !this.hasEligibleDevices;
+    const unchanged =
+      this.steps[0]?.invalid === invalid &&
+      this.steps.slice(1).every((step) => step.disabled === subsequentStepDisabled);
+    if (unchanged) {
+      return;
+    }
+    this.steps = this.steps.map((step, i) => {
+      if (i === 0) {
+        return { ...step, invalid };
+      }
+      return { ...step, disabled: subsequentStepDisabled };
+    });
+  }
+
+  private updateDeploymentControlsAvailability() {
+    const deploymentMode = this.form.get('deploymentMode');
+    const deploymentOption = this.form.get('deploymentOption');
+    if (!this.hasEligibleDevices) {
+      deploymentMode?.disable({ emitEvent: false });
+      deploymentOption?.disable({ emitEvent: false });
+    } else {
+      deploymentMode?.enable({ emitEvent: false });
+      deploymentOption?.enable({ emitEvent: false });
+    }
+    this.updateFirstStepInvalid();
+  }
+
   private createEmptyReviewDeviceSelection(): ReviewDeviceSelection {
     return {
       count: 0,
@@ -232,6 +270,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
   private updateSteps() {
     const mode = this.form?.get('deploymentMode')?.value ?? 'automatic';
     this.steps = this.getStepsForMode(mode);
+    this.updateFirstStepInvalid();
   }
 
   ngOnInit() {
@@ -311,11 +350,13 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
       (devices: InventoryDevice[]) => {
         this.allDevices = _.filter(devices, 'available');
         this.availDevices = [...this.allDevices];
+        this.updateDeploymentControlsAvailability();
         this.loadingReady();
       },
       () => {
         this.allDevices = [];
         this.availDevices = [];
+        this.updateDeploymentControlsAvailability();
         this.loadingError();
       }
     );
@@ -456,6 +497,14 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     );
   }
 
+  onCancel() {
+    if (this.hideTitle) {
+      this.cancelled.emit();
+      return;
+    }
+    this.location.back();
+  }
+
   private navigateAfterCreate() {
     const returnUrl = window.history.state?.returnUrl;
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
index de9fd2a479d..ca7e1b800d2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
@@ -165,3 +165,5 @@
     </ng-container>
   </ng-container>
 </ng-template>
+
+<router-outlet name="modal"></router-outlet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts
index bac3ee08d6e..2a7e150f992 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.ts
@@ -1,11 +1,11 @@
 import {
   Component,
-  EventEmitter,
   Input,
   OnInit,
-  Output,
   TemplateRef,
-  ViewChild
+  ViewChild,
+  Output,
+  EventEmitter
 } from '@angular/core';
 import { UntypedFormControl } from '@angular/forms';
 import { Router } from '@angular/router';
@@ -39,7 +39,6 @@ import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ModalService } from '~/app/shared/services/modal.service';
 import { NotificationService } from '~/app/shared/services/notification.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
-import { URLBuilderService } from '~/app/shared/services/url-builder.service';
 import { OsdFlagsIndivModalComponent } from '../osd-flags-indiv-modal/osd-flags-indiv-modal.component';
 import { OsdFlagsModalComponent } from '../osd-flags-modal/osd-flags-modal.component';
 import { OsdPgScrubModalComponent } from '../osd-pg-scrub-modal/osd-pg-scrub-modal.component';
@@ -57,11 +56,11 @@ const BASE_URL = 'osd';
   selector: 'cd-osd-list',
   templateUrl: './osd-list.component.html',
   styleUrls: ['./osd-list.component.scss'],
-  providers: [{ provide: URLBuilderService, useValue: new URLBuilderService(BASE_URL) }],
   standalone: false
 })
 export class OsdListComponent extends ListWithDetails implements OnInit {
   @Input() showTabs = true;
+  @Input() inlineCreate = false;
   @Output() createAction = new EventEmitter<void>();
 
   @ViewChild('osdUsageTpl', { static: true })
@@ -121,7 +120,6 @@ export class OsdListComponent extends ListWithDetails implements OnInit {
     private osdService: OsdService,
     private dimlessBinaryPipe: DimlessBinaryPipe,
     private modalService: ModalService,
-    private urlBuilder: URLBuilderService,
     private router: Router,
     private taskWrapper: TaskWrapperService,
     public actionLabels: ActionLabelsI18n,
@@ -137,14 +135,10 @@ export class OsdListComponent extends ListWithDetails implements OnInit {
         permission: 'create',
         icon: Icons.add,
         click: () => {
-          if (this.createAction.observers.length > 0) {
+          if (this.inlineCreate) {
             this.createAction.emit();
           } else {
-            this.router.navigate([this.urlBuilder.getCreate()], {
-              state: {
-                returnUrl: this.router.url
-              }
-            });
+            this.router.navigate([BASE_URL, { outlets: { modal: [URLVerbs.CREATE] } }]);
           }
         },
         disable: (selection: CdTableSelection) => this.getDisable('create', selection),
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
index a5b181968b2..c1bb0ac8c7a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
@@ -81,6 +81,7 @@
           @else {
           <button cdsButton="primary"
                   size="xl"
+                  [disabled]="steps[currentStep]?.invalid"
                   (click)="onNext()"
                   i18n>Next</button>
           }
@@ -194,6 +195,7 @@
         @else {
         <button cdsButton="primary"
                 size="xl"
+                [disabled]="steps[currentStep]?.invalid"
                 (click)="onNext()"
                 i18n>Next</button>
         }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.spec.ts
index c886b41bc1c..791575ec8f7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.spec.ts
@@ -172,5 +172,18 @@ describe('TearsheetComponent', () => {
       tearsheetComponent.onNext();
       expect(tearsheetComponent.currentStep).toBe(0);
     });
+
+    it('should disable next button when current step is invalid', () => {
+      hostComponent.steps = hostComponent.steps.map((step, i) =>
+        i === 0 ? { ...step, invalid: true } : step
+      );
+      hostFixture.detectChanges();
+      const buttons = hostFixture.debugElement.queryAll(
+        By.css('.tearsheet-footer button[cdsButton="primary"]')
+      );
+      const nextBtn = buttons.find((btn) => btn.nativeElement.textContent.trim() === 'Next');
+      expect(nextBtn).toBeTruthy();
+      expect(nextBtn?.nativeElement.disabled).toBe(true);
+    });
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
index dd91a045c95..2be126ef689 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
@@ -10,6 +10,8 @@ import {
   AfterViewInit,
   DestroyRef,
   OnDestroy,
+  OnChanges,
+  SimpleChanges,
   ChangeDetectionStrategy,
   TemplateRef,
   ViewEncapsulation
@@ -61,7 +63,7 @@ formgroup: CdFormGroup;
   changeDetection: ChangeDetectionStrategy.OnPush,
   encapsulation: ViewEncapsulation.None
 })
-export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
+export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy, OnChanges {
   @Input() title!: string;
   @Input() steps!: Array<Step>;
   @Input() description!: string;
@@ -134,13 +136,42 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
     this.hasModalOutlet = this.route.outlet === 'modal';
   }
 
+  ngOnChanges(changes: SimpleChanges) {
+    if (changes['steps']) {
+      this.lastStep = this.steps.length - 1;
+      if (this.currentStep > this.lastStep) {
+        this.currentStep = this.lastStep;
+      }
+      this.cdr.markForCheck();
+    }
+  }
+
   private _updateStepInvalid(index: number, invalid: boolean) {
     this.steps = this.steps.map((step, i) => (i === index ? { ...step, invalid } : step));
   }
 
   onStepSelect(event: { step: Step; index: number }) {
+    if (this.isStepNavBlocked(event.index)) {
+      return;
+    }
     this.currentStep = event.index;
     this.stepChanged.emit({ current: this.currentStep });
+    this.cdr.markForCheck();
+  }
+
+  private isStepNavBlocked(index: number): boolean {
+    if (this.steps[index]?.disabled) {
+      return true;
+    }
+    if (index > this.currentStep && this.steps[this.currentStep]?.invalid) {
+      return true;
+    }
+    for (let i = 0; i < index; i++) {
+      if (this.steps[i]?.invalid || this.steps[i]?.disabled) {
+        return true;
+      }
+    }
+    return false;
   }
 
   closeTearsheet() {
@@ -154,6 +185,9 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy {
   closeWideTearsheet() {
     this.closeRequested.emit();
     this.isOpen = false;
+    if (this.closeRequested.observers.length > 0) {
+      return;
+    }
     if (this.hasModalOutlet) {
       this.location.back();
     } else {

From c1a672751dc1e50a852488b27487e62250e480d5 Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Thu, 2 Jul 2026 16:53:46 +0530
Subject: [PATCH 525/596] mgr/smb: Allow pool creation for empty RGW buckets

When an RGW bucket is empty, SMB clients cannot create directories,
files, or upload data because the default.rgw.buckets.data pool does
not yet exist. The previous CephX capabilities ('mon allow r') did not
permit pool creation during the first write operation.

The fix changes the mon capability from 'allow r' to 'allow *' to
enable pool creation on the first write to an empty RGW bucket. Once
the pool exists, subsequent operations succeed normally.

Fixes: https://tracker.ceph.com/issues/77764
Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/smb/rgw_auth.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pybind/mgr/smb/rgw_auth.py b/src/pybind/mgr/smb/rgw_auth.py
index 14929f17765..fbe873fd441 100644
--- a/src/pybind/mgr/smb/rgw_auth.py
+++ b/src/pybind/mgr/smb/rgw_auth.py
@@ -33,7 +33,7 @@ class RGWAuthorizer:
         if not caps:
             caps = [
                 'mon',
-                'allow r',
+                'allow *',  # Required for pool creation on first write to empty RGW buckets
                 'osd',
                 'allow rwx tag rgw *=*',
             ]

From 0b296db086913c6b03cc78e1f9ade9ab1c5123cf Mon Sep 17 00:00:00 2001
From: Imran Imtiaz <imran.imtiaz@uk.ibm.com>
Date: Wed, 1 Jul 2026 16:31:52 +0100
Subject: [PATCH 526/596] mgr/dashboard: support clone_by_snap_id flag in clone
 API for group snapshots

The clone API endpoint POST /api/block/image/{image_spec}/snap/{snapshot_name}/clone
only accepted a snapshot name, which uses rbd_clone3 (clone by name). This only works
for snapshots in the user namespace.

Group snapshots (with .group prefix, in RBD_SNAP_NAMESPACE_TYPE_GROUP namespace)
require rbd_clone4 (clone by snap ID). The rbd Python binding already supports this:
passing an int for p_snapshot triggers rbd_clone4.

Add an optional clone_by_snap_id boolean flag to the clone endpoint. When set, the
path parameter is treated as a numeric snap ID and passed directly as an int to
rbd.RBD().clone(). Clone format 2 is enforced because this flag is intended for
non-user namespace snapshots which cannot be protected (a prerequisite for clone
format 1).

Usage:
  POST /api/block/image/{image_spec}/snap/{snap_id}/clone
  {"clone_by_snap_id": true, ...}

Fixes: https://tracker.ceph.com/issues/77875
Signed-off-by: Imran Imtiaz <imran.imtiaz@uk.ibm.com>
Assisted-by: IBM Bob
---
 src/pybind/mgr/dashboard/controllers/rbd.py | 21 ++++++++++++++++++---
 src/pybind/mgr/dashboard/openapi.yaml       |  3 +++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/pybind/mgr/dashboard/controllers/rbd.py b/src/pybind/mgr/dashboard/controllers/rbd.py
index 54ec2f75de4..1496d57865b 100644
--- a/src/pybind/mgr/dashboard/controllers/rbd.py
+++ b/src/pybind/mgr/dashboard/controllers/rbd.py
@@ -317,7 +317,7 @@ class RbdSnapshot(RESTController):
     def clone(self, image_spec, snapshot_name, child_pool_name,
               child_image_name, child_namespace=None, obj_size=None, features=None,
               stripe_unit=None, stripe_count=None, data_pool=None,
-              configuration=None, metadata=None):
+              configuration=None, metadata=None, clone_by_snap_id=False):
         """
         Clones a snapshot to an image
         """
@@ -334,10 +334,25 @@ class RbdSnapshot(RESTController):
                 # Set features
                 feature_bitmask = format_features(features)
 
+                # When clone_by_snap_id is set, treat snapshot_name as a
+                # numeric snap ID and clone by ID. This is required for
+                # non-user namespace snapshots (e.g. group snapshots) which
+                # cannot be cloned by name. Passing an int to rbd.RBD().clone()
+                # triggers rbd_clone4 (by snap ID) instead of rbd_clone3.
+                # Clone format 2 is enforced here because this flag is intended
+                # for non-user namespace snapshots which cannot be protected
+                # (a prerequisite for clone format 1).
+                snap_ref = snapshot_name
+                clone_format = None
+                if clone_by_snap_id:
+                    snap_ref = int(snapshot_name)
+                    clone_format = 2
+
                 rbd_inst = rbd.RBD()
-                rbd_inst.clone(p_ioctx, image_name, snapshot_name, ioctx,
+                rbd_inst.clone(p_ioctx, image_name, snap_ref, ioctx,
                                child_image_name, feature_bitmask, l_order,
-                               stripe_unit, stripe_count, data_pool)
+                               stripe_unit, stripe_count, data_pool,
+                               clone_format=clone_format)
 
                 RbdConfiguration(pool_ioctx=ioctx, image_name=child_image_name).set_configuration(
                     configuration)
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index 83f0ca14911..b72f8e2893c 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -1198,6 +1198,9 @@ paths:
                   type: string
                 child_pool_name:
                   type: string
+                clone_by_snap_id:
+                  default: false
+                  type: boolean
                 configuration:
                   type: string
                 data_pool:

From 428898401662ac04dd33cef1806e857c75768c71 Mon Sep 17 00:00:00 2001
From: Guillaume Abrioux <gabrioux@ibm.com>
Date: Wed, 1 Jul 2026 15:28:31 +0200
Subject: [PATCH 527/596] node-proxy: fix NodeProxySpec deserialization from
 JSON

NodeProxySpec.__init__() only accepts service_type and placement,
but ServiceSpec.from_json() passes all stored fields (ssl,
certificate_source, unmanaged, ...)

This breaks 'ceph orch ls' after the mgr reloads a node-proxy spec.

This commit forwards the standard ServiceSpec parameters to the
parent.

Fixes: https://tracker.ceph.com/issues/77874

Signed-off-by: Guillaume Abrioux <gabrioux@ibm.com>
---
 .../ceph/deployment/service_spec.py           | 21 +++++++++++++++++--
 .../ceph/tests/test_service_spec.py           | 13 ++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index bf2429b8b68..33c33518fc4 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -4350,11 +4350,28 @@ class NodeProxySpec(ServiceSpec):
     def __init__(self,
                  service_type: str,
                  placement: Optional[PlacementSpec] = None,
+                 ssl: Optional[bool] = True,
+                 certificate_source: Optional[str] = None,
+                 unmanaged: bool = False,
+                 preview_only: bool = False,
+                 extra_container_args: Optional[GeneralArgList] = None,
+                 extra_entrypoint_args: Optional[GeneralArgList] = None,
+                 custom_configs: Optional[List[CustomConfig]] = None,
                  ) -> None:
         assert service_type == 'node-proxy'
-        super(NodeProxySpec, self).__init__('node-proxy', placement=placement)
-        self.ssl: bool = True
+        super(NodeProxySpec, self).__init__(
+            'node-proxy',
+            placement=placement,
+            ssl=ssl,
+            certificate_source=certificate_source,
+            unmanaged=unmanaged,
+            preview_only=preview_only,
+            extra_container_args=extra_container_args,
+            extra_entrypoint_args=extra_entrypoint_args,
+            custom_configs=custom_configs,
+        )
         self.validate()
 
 
+yaml.add_representer(NodeProxySpec, ServiceSpec.yaml_representer)
 yaml.add_representer(SMBSpec, ServiceSpec.yaml_representer)
diff --git a/src/python-common/ceph/tests/test_service_spec.py b/src/python-common/ceph/tests/test_service_spec.py
index 5d470f7804a..41a7340b474 100644
--- a/src/python-common/ceph/tests/test_service_spec.py
+++ b/src/python-common/ceph/tests/test_service_spec.py
@@ -15,6 +15,7 @@ from ceph.deployment.service_spec import (
     IngressSpec,
     IscsiServiceSpec,
     NFSServiceSpec,
+    NodeProxySpec,
     OAuth2ProxySpec,
     PlacementSpec,
     PrometheusSpec,
@@ -337,6 +338,18 @@ def test_osd_unmanaged():
     assert dg_spec.unmanaged == True
 
 
+def test_node_proxy_unmanaged():
+    node_proxy_spec = {"placement": {"host_pattern": "*"},
+                       "service_name": "node-proxy",
+                       "service_type": "node-proxy",
+                       "unmanaged": True}
+
+    spec = ServiceSpec.from_json(node_proxy_spec)
+    assert isinstance(spec, NodeProxySpec)
+    assert spec.unmanaged is True
+    ServiceSpec.from_json(spec.to_json())
+
+
 @pytest.mark.parametrize("y",
 """service_type: crash
 service_name: crash

From bab1d6b39a9d2dca18a30e476c519c201632f41c Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Thu, 2 Jul 2026 21:52:11 +0530
Subject: [PATCH 528/596] mgr/cephadm: Add documentation for RGW keyring
 capability dependencies

This serves as a reminder for maintainers to verify whether capability
changes in the RGW service should also be applied to SMB and NFS
services to maintain consistency across services that use librgw.

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/cephadm/services/cephadmservice.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index 426b86f1b5c..bc9c270844d 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -1737,6 +1737,11 @@ class RgwService(CephService):
         return daemon_spec
 
     def get_keyring(self, rgw_id: str) -> str:
+        """
+        SMB and NFS services embed librgw. If the RGW service capabilities are
+        updated, verify whether the same changes are required for these
+        services as well.
+        """
         keyring = self.get_keyring_with_caps(self.get_auth_entity(rgw_id),
                                              ['mon', 'allow *',
                                               'mgr', 'allow rw',

From e4fa5048e0b12d627f95f47e70b5cd90d1c1b388 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Tue, 30 Jun 2026 12:55:33 +0000
Subject: [PATCH 529/596] crimson/os/alienstore: make CnLog::_flush
 non-blocking

CnLog::_flush() calls alien::submit_to(...).wait(), which blocks the
log flusher thread until the seastar reactor finishes outputting the
log entries. When the reactor writes to stderr and the pipe buffer is
full (e.g. two OSDs on the same host both dumping at debug level 20),
the reactor itself blocks on the write() syscall. Meanwhile BlueStore
threads filling the log buffer past m_max_new block in submit_entry()
waiting for the flusher - which is waiting for the reactor - which is
blocked on I/O. The kv thread cannot fire commit callbacks while it is
blocked on logging, so store transactions (including osdmap persistence)
hang indefinitely.

Fix by moving the entries into the lambda capture so _flush() can
return immediately without waiting.

This is a corrected version of the approach in commit 511af83e274
("crimson/os/alienstore/alien_log: _flush concurrently", PR #55262),
which was reverted in 4d52d1d22b7 because its lambda captured the
EntryVector by reference - the caller would clear/reuse the vector
before the lambda finished, causing a "pure virtual method called"
crash (https://tracker.ceph.com/issues/64140). The fix here avoids
that by swapping the entries out of the caller's vector and moving
them into the lambda's capture, so the lambda owns them for their
full lifetime.

Fixes: https://tracker.ceph.com/issues/77826
Fixes (failure of the 1st attempt): https://tracker.ceph.com/issues/64140
Assisted-by: Claude <claude.ai>

Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 src/crimson/os/alienstore/alien_log.cc | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/crimson/os/alienstore/alien_log.cc b/src/crimson/os/alienstore/alien_log.cc
index 723f0f08409..74bb9ec66cd 100644
--- a/src/crimson/os/alienstore/alien_log.cc
+++ b/src/crimson/os/alienstore/alien_log.cc
@@ -17,18 +17,16 @@ CnLog::~CnLog() {
 }
 
 void CnLog::_flush(EntryVector& q, bool crash) {
-  // XXX: the waiting here will block the thread for an indeterministic peroid
-  seastar::alien::submit_to(inst, shard, [&q] {
-    for (auto& it : q) {
+  std::ignore = seastar::alien::submit_to(inst, shard,
+    [entries = std::move(q)] {
+    for (const auto& it : entries) {
       crimson::get_logger(it.m_subsys).log(
         crimson::to_log_level(it.m_prio),
         "{}",
         it.strv());
     }
     return seastar::make_ready_future<>();
-  }).wait();
-  q.clear();
-  return;
+  });
 }
 
 } //namespace ceph::logging

From 4be833e11e5138454cc39d4acb5ae2a604e1e486 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Fri, 26 Jun 2026 03:37:58 +0530
Subject: [PATCH 530/596] monitoring: add PSU temperature graph to hardware
 dashboard

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-mixin/dashboards/hardware.libsonnet  | 21 +++++
 .../ceph-mixin/dashboards_out/hardware.json   | 93 ++++++++++++++++++-
 2 files changed, 111 insertions(+), 3 deletions(-)

diff --git a/monitoring/ceph-mixin/dashboards/hardware.libsonnet b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
index 583d93bb81b..d9f10859227 100644
--- a/monitoring/ceph-mixin/dashboards/hardware.libsonnet
+++ b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
@@ -670,6 +670,27 @@ local g = import 'grafonnet/grafana.libsonnet';
             { alias: 'Critical', color: 'dark-red', dashes: true, fill: 0 },
           ],
         },
+
+        // PSU Temperatures
+        g.graphPanel.new(
+          title='PSU Temperatures',
+          datasource='$datasource',
+          format='celsius',
+        ).addTarget(
+          g.prometheus.target(
+            'ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~"PSU.*_TEMP.*"}',
+            legendFormat='{{sensor_name}}'
+          )
+        ).addTarget(
+          g.prometheus.target('vector(65)', legendFormat='Critical')
+        )
+        + {
+          gridPos: { x: 0, y: 20, w: 12, h: 8 },
+          yaxes: [{ min: 0 }, {}],
+          seriesOverrides: [
+            { alias: 'Critical', color: 'dark-red', dashes: true, fill: 0 },
+          ],
+        },
       ] },
 
       // Row 5: FAN Speed History
diff --git a/monitoring/ceph-mixin/dashboards_out/hardware.json b/monitoring/ceph-mixin/dashboards_out/hardware.json
index 263ac97ccfe..6723d45d5d1 100644
--- a/monitoring/ceph-mixin/dashboards_out/hardware.json
+++ b/monitoring/ceph-mixin/dashboards_out/hardware.json
@@ -2080,6 +2080,93 @@
                   },
                   { }
                ]
+            },
+            {
+               "aliasColors": { },
+               "bars": false,
+               "dashLength": 10,
+               "dashes": false,
+               "datasource": "$datasource",
+               "fill": 1,
+               "fillGradient": 0,
+               "gridPos": {
+                  "h": 8,
+                  "w": 12,
+                  "x": 0,
+                  "y": 20
+               },
+               "id": 35,
+               "legend": {
+                  "alignAsTable": false,
+                  "avg": false,
+                  "current": false,
+                  "max": false,
+                  "min": false,
+                  "rightSide": false,
+                  "show": true,
+                  "sideWidth": null,
+                  "total": false,
+                  "values": false
+               },
+               "lines": true,
+               "linewidth": 1,
+               "links": [ ],
+               "nullPointMode": "null",
+               "percentage": false,
+               "pointradius": 5,
+               "points": false,
+               "renderer": "flot",
+               "repeat": null,
+               "seriesOverrides": [
+                  {
+                     "alias": "Critical",
+                     "color": "dark-red",
+                     "dashes": true,
+                     "fill": 0
+                  }
+               ],
+               "spaceLength": 10,
+               "stack": false,
+               "steppedLine": false,
+               "targets": [
+                  {
+                     "expr": "ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"PSU.*_TEMP.*\"}",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "{{sensor_name}}",
+                     "refId": "A"
+                  },
+                  {
+                     "expr": "vector(65)",
+                     "format": "time_series",
+                     "intervalFactor": 2,
+                     "legendFormat": "Critical",
+                     "refId": "B"
+                  }
+               ],
+               "thresholds": [ ],
+               "timeFrom": null,
+               "timeShift": null,
+               "title": "PSU Temperatures",
+               "tooltip": {
+                  "shared": true,
+                  "sort": 0,
+                  "value_type": "individual"
+               },
+               "type": "graph",
+               "xaxis": {
+                  "buckets": null,
+                  "mode": "time",
+                  "name": null,
+                  "show": true,
+                  "values": [ ]
+               },
+               "yaxes": [
+                  {
+                     "min": 0
+                  },
+                  { }
+               ]
             }
          ],
          "repeat": null,
@@ -2099,7 +2186,7 @@
             "x": 0,
             "y": 4
          },
-         "id": 35,
+         "id": 36,
          "panels": [
             {
                "aliasColors": { },
@@ -2116,7 +2203,7 @@
                   "x": 0,
                   "y": 5
                },
-               "id": 36,
+               "id": 37,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,
@@ -2201,7 +2288,7 @@
                   "x": 12,
                   "y": 5
                },
-               "id": 37,
+               "id": 38,
                "legend": {
                   "alignAsTable": false,
                   "avg": false,

From b231e6f31893bf0cdce972a78c5a9e8faeaf39b7 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Wed, 1 Jul 2026 17:55:06 +0530
Subject: [PATCH 531/596] monitoring: add panel descriptions and fix tooltip
 labels

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-mixin/dashboards/hardware.libsonnet  | 64 ++++++++++-------
 .../ceph-mixin/dashboards_out/hardware.json   | 68 +++++++++----------
 2 files changed, 75 insertions(+), 57 deletions(-)

diff --git a/monitoring/ceph-mixin/dashboards/hardware.libsonnet b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
index d9f10859227..74cd6e8162f 100644
--- a/monitoring/ceph-mixin/dashboards/hardware.libsonnet
+++ b/monitoring/ceph-mixin/dashboards/hardware.libsonnet
@@ -82,9 +82,10 @@ local g = import 'grafonnet/grafana.libsonnet';
         )
         .addTarget($.addTargetSchema(
           'max(ceph_hardware_health)',
-          legendFormat='__auto'
+          legendFormat='Health'
         ))
         + {
+          description: 'Overall hardware health across all hosts',
           fieldConfig: {
             defaults: {
               mappings: [
@@ -116,8 +117,9 @@ local g = import 'grafonnet/grafana.libsonnet';
         ])
         .addTarget($.addTargetSchema(
           'max(ceph_hardware_temperature_celsius{sensor_name=~".*CPU_TEMP"})',
-          legendFormat='__auto'
-        )),
+          legendFormat='CPU'
+        ))
+        + { description: 'Highest CPU temperature across all hosts' },
 
         // BMC Versions
         $.pieChartPanel(
@@ -220,8 +222,9 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 2, x: 0, y: 5 }
         ).addTarget($.addTargetSchema(
           'count(count by(hostname) (ceph_hardware_health))',
-          legendFormat='__auto'
-        )),
+          legendFormat='Hosts'
+        ))
+        + { description: 'Total hosts with hardware monitoring' },
 
         // Drives
         $.addStatPanel(
@@ -231,8 +234,9 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 2, x: 2, y: 5 }
         ).addTarget($.addTargetSchema(
           'count(ceph_hardware_storage_capacity_bytes)',
-          legendFormat='__auto'
-        )),
+          legendFormat='Drives'
+        ))
+        + { description: 'Total storage drives detected' },
 
         // NVMe Temp
         $.addGaugePanel(
@@ -250,8 +254,9 @@ local g = import 'grafonnet/grafana.libsonnet';
         ])
         .addTarget($.addTargetSchema(
           'max(ceph_hardware_temperature_celsius{sensor_name=~"NVME.*_TEMP"})',
-          legendFormat='__auto'
-        )),
+          legendFormat='NVMe'
+        ))
+        + { description: 'Highest NVMe drive temperature across all hosts' },
       ] },
 
       // Row 2: Host Overview
@@ -264,9 +269,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 3, w: 2, x: 0, y: 2 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_health{hostname=~"$hostname",category="power"})',
-          legendFormat='__auto'
+          legendFormat='Power'
         ))
         + {
+          description: 'Power supply health status',
           fieldConfig: {
             defaults: {
               mappings: [
@@ -287,9 +293,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 2, y: 2 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*MB_TEMP.*"})',
-          legendFormat='__auto'
+          legendFormat='Motherboard'
         ))
         + {
+          description: 'Highest motherboard temperature',
           fieldConfig+: { defaults+: { thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 70 }, { color: 'red', value: 80 }] } } },
           options+: { colorMode: 'none', graphMode: 'area' },
         },
@@ -302,9 +309,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 5, y: 2 }
         ).addTarget($.addTargetSchema(
           'avg(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*CPU_TEMP"})',
-          legendFormat='__auto'
+          legendFormat='CPU'
         ))
         + {
+          description: 'Average CPU temperature',
           fieldConfig+: { defaults+: { max: 85, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 80 }, { color: 'semi-dark-red', value: 90 }] } } },
           options+: { colorMode: 'none', graphMode: 'area' },
         },
@@ -317,9 +325,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 8, y: 2 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~".*DIMM.*_TEMP"})',
-          legendFormat='__auto'
+          legendFormat='DIMM'
         ))
         + {
+          description: 'Highest DIMM temperature',
           fieldConfig+: { defaults+: { max: 88, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'yellow', value: 70 }, { color: 'semi-dark-red', value: 80 }] } } },
           options+: { colorMode: 'none', graphMode: 'area' },
         },
@@ -332,9 +341,12 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 11, y: 2 }
         ).addTarget($.addTargetSchema(
           'count(ceph_hardware_fan_rpm{hostname=~"$hostname", fan_name=~"PSU.*"})',
-          legendFormat='__auto'
+          legendFormat='PSU Fans'
         ))
-        + { options+: { colorMode: 'none', graphMode: 'none' } },
+        + {
+          description: 'Number of PSU fans detected',
+          options+: { colorMode: 'none', graphMode: 'none' },
+        },
 
         // AVG PSU Temperature
         $.addStatPanel(
@@ -344,9 +356,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 14, y: 2 }
         ).addTarget($.addTargetSchema(
           'avg(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~"PSU.*_TEMP.*"})',
-          legendFormat='__auto'
+          legendFormat='PSU'
         ))
         + {
+          description: 'Average power supply temperature',
           fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'fixed' }, max: 100, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: 'yellow', value: 80 }, { color: 'semi-dark-red', value: 90 }] } } },
           options+: { colorMode: 'none', graphMode: 'area' },
         },
@@ -359,9 +372,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 17, y: 2 }
         ).addTarget($.addTargetSchema(
           'count(ceph_hardware_storage_capacity_bytes{hostname=~"$hostname", protocol="NVMe"})',
-          legendFormat='__auto'
+          legendFormat='NVMe'
         ))
         + {
+          description: 'Number of NVMe drives detected',
           fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'thresholds' }, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 70 }, { color: 'semi-dark-red', value: 78 }] } } },
           options+: { colorMode: 'none', graphMode: 'none' },
         },
@@ -374,9 +388,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 4, w: 3, x: 20, y: 2 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_temperature_celsius{hostname=~"$hostname", sensor_name=~"NVME.*"})',
-          legendFormat='__auto'
+          legendFormat='NVMe'
         ))
         + {
+          description: 'Highest NVMe drive temperature',
           fieldConfig+: { defaults+: { color: { fixedColor: 'blue', mode: 'thresholds' }, max: 85, min: 0, thresholds: { mode: 'absolute', steps: [{ color: 'green' }, { color: '#EAB839', value: 70 }, { color: 'semi-dark-red', value: 78 }] } } },
           options+: { colorMode: 'none', graphMode: 'area' },
         },
@@ -389,9 +404,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 3, w: 2, x: 0, y: 5 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_health{hostname=~"$hostname",category="network"})',
-          legendFormat='__auto'
+          legendFormat='Network'
         ))
         + {
+          description: 'Network adapter health status',
           fieldConfig: {
             defaults: {
               mappings: [
@@ -412,9 +428,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 3, w: 2, x: 0, y: 8 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_health{hostname=~"$hostname",category="fans"})',
-          legendFormat='__auto'
+          legendFormat='Cooling'
         ))
         + {
+          description: 'Cooling fans health status',
           fieldConfig: {
             defaults: {
               mappings: [
@@ -435,9 +452,10 @@ local g = import 'grafonnet/grafana.libsonnet';
           gridPosition={ h: 3, w: 2, x: 0, y: 11 }
         ).addTarget($.addTargetSchema(
           'max(ceph_hardware_health{hostname=~"$hostname",category="storage"})',
-          legendFormat='__auto'
+          legendFormat='Drives'
         ))
         + {
+          description: 'Storage drives health status',
           fieldConfig: {
             defaults: {
               mappings: [
@@ -467,7 +485,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         )
         .addTarget($.addTargetSchema(
           'ceph_hardware_storage_capacity_bytes{hostname=~"$hostname"}',
-          legendFormat='__auto',
+          legendFormat='',
           instant=true
         ) + { format: 'table' })
         .addTransformations([
@@ -509,7 +527,7 @@ local g = import 'grafonnet/grafana.libsonnet';
         )
         .addTarget($.addTargetSchema(
           'ceph_hardware_firmware_info{hostname=~"$hostname"}',
-          legendFormat='__auto',
+          legendFormat='',
           instant=true
         ) + { format: 'table' })
         .addTransformations([
diff --git a/monitoring/ceph-mixin/dashboards_out/hardware.json b/monitoring/ceph-mixin/dashboards_out/hardware.json
index 6723d45d5d1..fa16b7f9670 100644
--- a/monitoring/ceph-mixin/dashboards_out/hardware.json
+++ b/monitoring/ceph-mixin/dashboards_out/hardware.json
@@ -51,7 +51,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Overall hardware health across all hosts",
                "fieldConfig": {
                   "defaults": {
                      "mappings": [
@@ -120,7 +120,7 @@
                      "expr": "max(ceph_hardware_health)",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Health",
                      "refId": "A"
                   }
                ],
@@ -130,7 +130,7 @@
             },
             {
                "datasource": "$datasource",
-               "description": "",
+               "description": "Highest CPU temperature across all hosts",
                "fieldConfig": {
                   "defaults": {
                      "links": [ ],
@@ -183,7 +183,7 @@
                      "expr": "max(ceph_hardware_temperature_celsius{sensor_name=~\".*CPU_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "CPU",
                      "refId": "A"
                   }
                ],
@@ -409,7 +409,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Total hosts with hardware monitoring",
                "fieldConfig": {
                   "defaults": {
                      "decimals": 0,
@@ -450,7 +450,7 @@
                      "expr": "count(count by(hostname) (ceph_hardware_health))",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Hosts",
                      "refId": "A"
                   }
                ],
@@ -461,7 +461,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Total storage drives detected",
                "fieldConfig": {
                   "defaults": {
                      "decimals": 0,
@@ -502,7 +502,7 @@
                      "expr": "count(ceph_hardware_storage_capacity_bytes)",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Drives",
                      "refId": "A"
                   }
                ],
@@ -512,7 +512,7 @@
             },
             {
                "datasource": "$datasource",
-               "description": "",
+               "description": "Highest NVMe drive temperature across all hosts",
                "fieldConfig": {
                   "defaults": {
                      "links": [ ],
@@ -565,7 +565,7 @@
                      "expr": "max(ceph_hardware_temperature_celsius{sensor_name=~\"NVME.*_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "NVMe",
                      "refId": "A"
                   }
                ],
@@ -596,7 +596,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Power supply health status",
                "fieldConfig": {
                   "defaults": {
                      "mappings": [
@@ -665,7 +665,7 @@
                      "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"power\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Power",
                      "refId": "A"
                   }
                ],
@@ -676,7 +676,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Highest motherboard temperature",
                "fieldConfig": {
                   "defaults": {
                      "decimals": 0,
@@ -729,7 +729,7 @@
                      "expr": "max(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*MB_TEMP.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Motherboard",
                      "refId": "A"
                   }
                ],
@@ -740,7 +740,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Average CPU temperature",
                "fieldConfig": {
                   "defaults": {
                      "decimals": 0,
@@ -795,7 +795,7 @@
                      "expr": "avg(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*CPU_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "CPU",
                      "refId": "A"
                   }
                ],
@@ -806,7 +806,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Highest DIMM temperature",
                "fieldConfig": {
                   "defaults": {
                      "decimals": 0,
@@ -861,7 +861,7 @@
                      "expr": "max(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\".*DIMM.*_TEMP\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "DIMM",
                      "refId": "A"
                   }
                ],
@@ -872,7 +872,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Number of PSU fans detected",
                "fieldConfig": {
                   "defaults": {
                      "decimals": 0,
@@ -913,7 +913,7 @@
                      "expr": "count(ceph_hardware_fan_rpm{hostname=~\"$hostname\", fan_name=~\"PSU.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "PSU Fans",
                      "refId": "A"
                   }
                ],
@@ -924,7 +924,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Average power supply temperature",
                "fieldConfig": {
                   "defaults": {
                      "color": {
@@ -983,7 +983,7 @@
                      "expr": "avg(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"PSU.*_TEMP.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "PSU",
                      "refId": "A"
                   }
                ],
@@ -994,7 +994,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Number of NVMe drives detected",
                "fieldConfig": {
                   "defaults": {
                      "color": {
@@ -1051,7 +1051,7 @@
                      "expr": "count(ceph_hardware_storage_capacity_bytes{hostname=~\"$hostname\", protocol=\"NVMe\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "NVMe",
                      "refId": "A"
                   }
                ],
@@ -1062,7 +1062,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Highest NVMe drive temperature",
                "fieldConfig": {
                   "defaults": {
                      "color": {
@@ -1121,7 +1121,7 @@
                      "expr": "max(ceph_hardware_temperature_celsius{hostname=~\"$hostname\", sensor_name=~\"NVME.*\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "NVMe",
                      "refId": "A"
                   }
                ],
@@ -1132,7 +1132,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Network adapter health status",
                "fieldConfig": {
                   "defaults": {
                      "mappings": [
@@ -1201,7 +1201,7 @@
                      "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"network\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Network",
                      "refId": "A"
                   }
                ],
@@ -1212,7 +1212,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Cooling fans health status",
                "fieldConfig": {
                   "defaults": {
                      "mappings": [
@@ -1281,7 +1281,7 @@
                      "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"fans\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Cooling",
                      "refId": "A"
                   }
                ],
@@ -1292,7 +1292,7 @@
             {
                "colors": null,
                "datasource": "$datasource",
-               "description": "",
+               "description": "Storage drives health status",
                "fieldConfig": {
                   "defaults": {
                      "mappings": [
@@ -1361,7 +1361,7 @@
                      "expr": "max(ceph_hardware_health{hostname=~\"$hostname\",category=\"storage\"})",
                      "format": "time_series",
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "Drives",
                      "refId": "A"
                   }
                ],
@@ -1416,7 +1416,7 @@
                      "format": "table",
                      "instant": true,
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "",
                      "refId": "A"
                   }
                ],
@@ -1493,7 +1493,7 @@
                      "format": "table",
                      "instant": true,
                      "intervalFactor": 1,
-                     "legendFormat": "__auto",
+                     "legendFormat": "",
                      "refId": "A"
                   }
                ],

From da21940d118bbd4f88af1e985e2753551ed3a4a7 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Thu, 2 Jul 2026 06:25:13 +0530
Subject: [PATCH 532/596] monitoring: add Ceph Hardware - Compression dashboard

Add comprehensive Grafana dashboard for monitoring hardware compression
metrics from FCM-enabled drives.

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../ceph-hardware-compression.json            | 1518 +++++++++++++++++
 src/pybind/mgr/prometheus/test_module.py      |    6 +-
 2 files changed, 1521 insertions(+), 3 deletions(-)
 create mode 100644 monitoring/ceph-mixin/dashboards_out/ceph-hardware-compression.json

diff --git a/monitoring/ceph-mixin/dashboards_out/ceph-hardware-compression.json b/monitoring/ceph-mixin/dashboards_out/ceph-hardware-compression.json
new file mode 100644
index 00000000000..e116eccc246
--- /dev/null
+++ b/monitoring/ceph-mixin/dashboards_out/ceph-hardware-compression.json
@@ -0,0 +1,1518 @@
+{
+  "__inputs": [],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "12.3.1"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "piechart",
+      "name": "Pie chart",
+      "version": ""
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "bargauge",
+      "name": "Bar gauge",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "table",
+      "name": "Table",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "Hardware compression monitoring: track compression ratios, capacity savings, and physical storage utilization across compression-capable OSDs.",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 100,
+      "panels": [],
+      "title": "Overview",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Amount of physical storage capacity saved through hardware compression.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": 0
+              },
+              {
+                "color": "yellow",
+                "value": 1099511627776
+              },
+              {
+                "color": "green",
+                "value": 10995116277760
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 0,
+        "y": 1
+      },
+      "id": 1,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) - sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "Storage Saved",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Storage Saved",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Ratio of logical data to physical storage after compression. Higher values indicate better compression efficiency.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "decimals": 2,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": 0
+              },
+              {
+                "color": "orange",
+                "value": 1.1
+              },
+              {
+                "color": "yellow",
+                "value": 1.2
+              },
+              {
+                "color": "blue",
+                "value": 1.5
+              },
+              {
+                "color": "green",
+                "value": 2
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 6,
+        "y": 1
+      },
+      "id": 2,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) / clamp_min(sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}), 1)",
+          "instant": false,
+          "legendFormat": "Compression Ratio",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Compression Ratio (X:1)",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Percentage of storage capacity saved through compression. Shows cost savings and infrastructure efficiency.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "decimals": 1,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": 0
+              },
+              {
+                "color": "yellow",
+                "value": 25
+              },
+              {
+                "color": "green",
+                "value": 50
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 12,
+        "y": 1
+      },
+      "id": 3,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "100 * (1 - sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) / clamp_min(sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}), 1))",
+          "instant": false,
+          "legendFormat": "Efficiency",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Compression Efficiency %",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Current usage of physical storage capacity. Monitor this for capacity planning and expansion decisions.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "decimals": 1,
+          "mappings": [],
+          "max": 100,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              },
+              {
+                "color": "yellow",
+                "value": 70
+              },
+              {
+                "color": "orange",
+                "value": 80
+              },
+              {
+                "color": "red",
+                "value": 90
+              }
+            ]
+          },
+          "unit": "percent"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 6,
+        "x": 18,
+        "y": 1
+      },
+      "id": 4,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "100 * sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) / clamp_min(sum(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}), 1)",
+          "instant": false,
+          "legendFormat": "Physical Utilization",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Physical Utilization %",
+      "type": "stat"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 6
+      },
+      "id": 101,
+      "panels": [],
+      "title": "Capacity",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Breakdown of physical storage: used versus available across compression-enabled OSDs.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "mappings": [],
+          "unit": "bytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Used"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "blue",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "displayName",
+                "value": "Used"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Free"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "green",
+                  "mode": "fixed"
+                }
+              },
+              {
+                "id": "displayName",
+                "value": "Free"
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 6,
+        "x": 0,
+        "y": 7
+      },
+      "id": 21,
+      "options": {
+        "displayLabels": [
+          "percent"
+        ],
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "right",
+          "showLegend": true,
+          "values": []
+        },
+        "pieType": "donut",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "sort": "none",
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "Used",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) - sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Free",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Physical Capacity",
+      "type": "piechart"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Total data written before compression is applied. What users and applications see.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3.5,
+        "w": 9,
+        "x": 15,
+        "y": 7
+      },
+      "id": 23,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "Logical Used",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Logical Used",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Actual physical storage consumed after compression. Shows real storage used on hardware.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "blue",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3.5,
+        "w": 9,
+        "x": 6,
+        "y": 7
+      },
+      "id": 7,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "Physical Used",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Physical Used",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Total physical storage capacity across all compression-capable OSDs.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "text",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3.5,
+        "w": 4.5,
+        "x": 15,
+        "y": 10.5
+      },
+      "id": 25,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "Physical Total",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Physical Total",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Number of OSDs with hardware compression capabilities detected.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "semi-dark-blue",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3.5,
+        "w": 4.5,
+        "x": 19.5,
+        "y": 10.5
+      },
+      "id": 10,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "count(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "OSDs",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Compression OSDs",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Available physical storage capacity. Indicates remaining space for data growth.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "red",
+                "value": 0
+              },
+              {
+                "color": "orange",
+                "value": 10995116277760
+              },
+              {
+                "color": "yellow",
+                "value": 54975581388800
+              },
+              {
+                "color": "green",
+                "value": 109951162777600
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 3.5,
+        "w": 9,
+        "x": 6,
+        "y": 10.5
+      },
+      "id": 24,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "percentChangeColorMode": "standard",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "value",
+        "wideLayout": true
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "sum(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) - sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})",
+          "instant": false,
+          "legendFormat": "Physical Free",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Physical Free",
+      "type": "stat"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 14
+      },
+      "id": 102,
+      "panels": [],
+      "title": "Trends & Analysis",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Historical compression effectiveness over time. Stable trend indicates consistent workload. Declining ratios suggest more incompressible data.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "none",
+          "decimals": 2
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 15
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "mean"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none",
+          "maxWidth": 400
+        }
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "round(sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) / sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}), 0.01)",
+          "instant": false,
+          "legendFormat": "Compression Ratio",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Compression Ratio Trend",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "Storage capacity saved during the current time window. Shows rate of savings accumulation from compression.",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 2,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "never",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 15
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [
+            "lastNotNull",
+            "mean"
+          ],
+          "displayMode": "table",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "expr": "(sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) - sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"})) - min_over_time((sum(ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}) - sum(ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}))[$__range:])",
+          "instant": false,
+          "legendFormat": "Storage Saved",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Storage Saved Trend",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 23
+      },
+      "id": 103,
+      "panels": [],
+      "title": "OSD Utilization",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${datasource}"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "custom": {
+            "align": "auto",
+            "cellOptions": {
+              "type": "auto"
+            },
+            "filterable": true,
+            "inspect": false
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": 0
+              }
+            ]
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Physical Size"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "bytes"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Physical Used"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "bytes"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Logical Used"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "bytes"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Capacity Saved"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "bytes"
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byRegexp",
+              "options": "Compression.*Ratio"
+            },
+            "properties": [
+              {
+                "id": "decimals",
+                "value": 2
+              },
+              {
+                "id": "custom.displayMode",
+                "value": "color-text"
+              },
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "type": "color-text"
+                }
+              },
+              {
+                "id": "thresholds",
+                "value": {
+                  "mode": "absolute",
+                  "steps": [
+                    {
+                      "color": "red",
+                      "value": null
+                    },
+                    {
+                      "color": "orange",
+                      "value": 1.1
+                    },
+                    {
+                      "color": "yellow",
+                      "value": 1.2
+                    },
+                    {
+                      "color": "blue",
+                      "value": 1.5
+                    },
+                    {
+                      "color": "green",
+                      "value": 2
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 10,
+        "w": 24,
+        "x": 0,
+        "y": 24
+      },
+      "id": 15,
+      "options": {
+        "cellHeight": "sm",
+        "footer": {
+          "countRows": false,
+          "fields": "",
+          "reducer": [
+            "sum"
+          ],
+          "show": false
+        },
+        "showHeader": true,
+        "sortBy": []
+      },
+      "pluginVersion": "12.3.1",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}",
+          "format": "table",
+          "instant": true,
+          "legendFormat": "Physical Size",
+          "range": false,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "ceph_extblkdev_dev_phy_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}",
+          "format": "table",
+          "hide": false,
+          "instant": true,
+          "legendFormat": "Physical Used",
+          "range": false,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${datasource}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "ceph_extblkdev_dev_log_util{cluster=~\"$cluster\", instance=~\"$instance\", ceph_daemon=~\"$osd\"}",
+          "format": "table",
+          "hide": false,
+          "instant": true,
+          "legendFormat": "Logical Used",
+          "range": false,
+          "refId": "C"
+        }
+      ],
+      "title": "",
+      "transformations": [
+        {
+          "id": "joinByField",
+          "options": {
+            "byField": "ceph_daemon",
+            "mode": "outer"
+          }
+        },
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time 1": true,
+              "Time 2": true,
+              "Time 3": true,
+              "__name__ 1": true,
+              "__name__ 2": true,
+              "__name__ 3": true,
+              "cluster 1": true,
+              "cluster 2": true,
+              "cluster 3": true,
+              "instance 1": true,
+              "instance 2": true,
+              "instance 3": true,
+              "job 1": true,
+              "job 2": true,
+              "job 3": true
+            },
+            "indexByName": {
+              "ceph_daemon": 0,
+              "Value #A": 1,
+              "Value #B": 2,
+              "Value #C": 3,
+              "Capacity Saved": 4,
+              "Compression Ratio": 5
+            },
+            "renameByName": {
+              "Value #A": "Physical Size",
+              "Value #B": "Physical Used",
+              "Value #C": "Logical Used",
+              "ceph_daemon": "OSD"
+            }
+          }
+        },
+        {
+          "id": "calculateField",
+          "options": {
+            "alias": "Compression Ratio",
+            "binary": {
+              "left": "Logical Used",
+              "operator": "/",
+              "right": "Physical Used"
+            },
+            "mode": "binary",
+            "reduce": {
+              "reducer": "sum"
+            }
+          }
+        },
+        {
+          "id": "calculateField",
+          "options": {
+            "alias": "Capacity Saved",
+            "binary": {
+              "left": "Logical Used",
+              "operator": "-",
+              "right": "Physical Used"
+            },
+            "mode": "binary",
+            "reduce": {
+              "reducer": "sum"
+            }
+          }
+        },
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {},
+            "indexByName": {
+              "OSD": 0,
+              "Physical Size": 1,
+              "Physical Used": 2,
+              "Logical Used": 3,
+              "Capacity Saved": 4,
+              "Compression Ratio": 5
+            },
+            "renameByName": {}
+          }
+        }
+      ],
+      "type": "table"
+    }
+  ],
+  "preload": false,
+  "refresh": "30s",
+  "schemaVersion": 42,
+  "tags": [
+    "ceph",
+    "storage",
+    "compression",
+    "hardware",
+    "capacity"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "selected": false,
+          "text": "default",
+          "value": "default"
+        },
+        "hide": 0,
+        "includeAll": false,
+        "label": "Datasource",
+        "multi": false,
+        "name": "datasource",
+        "options": [],
+        "query": "prometheus",
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "type": "datasource"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(ceph_extblkdev_dev_phy_size, cluster)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Cluster",
+        "multi": true,
+        "name": "cluster",
+        "options": [],
+        "query": {
+          "query": "label_values(ceph_extblkdev_dev_phy_size, cluster)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\"}, instance)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Instance",
+        "multi": true,
+        "name": "instance",
+        "options": [],
+        "query": {
+          "query": "label_values(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\"}, instance)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "allValue": ".*",
+        "current": {
+          "selected": false,
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${datasource}"
+        },
+        "definition": "label_values(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\"}, ceph_daemon)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "OSD",
+        "multi": true,
+        "name": "osd",
+        "options": [],
+        "query": {
+          "query": "label_values(ceph_extblkdev_dev_phy_size{cluster=~\"$cluster\", instance=~\"$instance\"}, ceph_daemon)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 2,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 3,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "browser",
+  "title": "Ceph Hardware - Cluster-Wide Compression",
+  "uid": "ceph-hw-compression-v2",
+  "version": 1,
+  "weekStart": ""
+}
\ No newline at end of file
diff --git a/src/pybind/mgr/prometheus/test_module.py b/src/pybind/mgr/prometheus/test_module.py
index fa844aa587c..2a2edcdc747 100644
--- a/src/pybind/mgr/prometheus/test_module.py
+++ b/src/pybind/mgr/prometheus/test_module.py
@@ -184,8 +184,8 @@ class ThreadSafeLRUCacheDictTest(TestCase):
 
 
 MOCK_HW_FULLREPORT = {
-    'at3n2.tuc.stglabs.ibm.com': {
-        'host': 'at3n2.tuc.stglabs.ibm.com',
+    'host.example.com': {
+        'host': 'host.example.com',
         'sn': '11S03NK990YM30ZP58E02X',
         'status': {
             'storage': {'Self': {
@@ -298,7 +298,7 @@ class HardwareMetricsTest(TestCase):
             'hardware_firmware_info': Metric(
                 'gauge', 'hardware_firmware_info', '', HW_FIRMWARE_LABELS),
         }
-        self.hostname = 'at3n2.tuc.stglabs.ibm.com'
+        self.hostname = 'host.example.com'
         self.data = MOCK_HW_FULLREPORT[self.hostname]
         self.status = self.data['status']
         self.module._hw_get_health_value = Module._hw_get_health_value.__get__(self.module)

From 42b3a7dfe820cab0fd5b8af22c88a29c5a1dc546 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Thu, 2 Jul 2026 14:51:19 +0530
Subject: [PATCH 533/596] mointoring: Add hardware alerts

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 monitoring/ceph-mixin/config.libsonnet        |   6 +
 .../ceph-mixin/prometheus_alerts.libsonnet    | 192 +++++--
 monitoring/ceph-mixin/prometheus_alerts.yml   | 184 +++++--
 .../ceph-mixin/tests_alerts/test_alerts.yml   | 500 ++++++++++++++----
 4 files changed, 681 insertions(+), 201 deletions(-)

diff --git a/monitoring/ceph-mixin/config.libsonnet b/monitoring/ceph-mixin/config.libsonnet
index 180ebfa0903..3bd16bf20a1 100644
--- a/monitoring/ceph-mixin/config.libsonnet
+++ b/monitoring/ceph-mixin/config.libsonnet
@@ -22,5 +22,11 @@
     // Read/Write latency is defined in ms
     NVMeoFHighClientReadLatency: 10,
     NVMeoFHighClientWriteLatency: 20,
+    //
+    // Hardware temperature thresholds in Celsius
+    HWTempMotherboardWarning: 60,
+    HWTempDIMMWarning: 80,
+    HWTempProcessorWarning: 80,
+    HWTempNVMeWarning: 70,
   },
 }
diff --git a/monitoring/ceph-mixin/prometheus_alerts.libsonnet b/monitoring/ceph-mixin/prometheus_alerts.libsonnet
index 6173a9dd781..9e5e4eafd5b 100644
--- a/monitoring/ceph-mixin/prometheus_alerts.libsonnet
+++ b/monitoring/ceph-mixin/prometheus_alerts.libsonnet
@@ -689,63 +689,163 @@
       name: 'hardware',
       rules: [
         {
-          alert: 'HardwareStorageError',
-          'for': '30s',
-          expr: 'ceph_health_detail{name="HARDWARE_STORAGE"} > 0',
-          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.1' },
+          alert: 'PowerSupplyDegraded',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="power"} == 1',
+          labels: { severity: 'warning', type: 'ceph_default' },
           annotations: {
-            summary: 'Storage devices error(s) detected%(cluster)s' % $.MultiClusterSummary(),
-            description: 'Some storage devices are in error. Check `ceph health detail`.',
+            summary: 'Power supply {{ $labels.component }} degraded on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'PSU {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}.',
           },
         },
         {
-          alert: 'HardwareMemoryError',
-          'for': '30s',
-          expr: 'ceph_health_detail{name="HARDWARE_MEMORY"} > 0',
-          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.2' },
-          annotations: {
-            summary: 'DIMM error(s) detected%(cluster)s' % $.MultiClusterSummary(),
-            description: 'DIMM error(s) detected. Check `ceph health detail`.',
-          },
-        },
-        {
-          alert: 'HardwareProcessorError',
-          'for': '30s',
-          expr: 'ceph_health_detail{name="HARDWARE_PROCESSOR"} > 0',
-          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.3' },
-          annotations: {
-            summary: 'Processor error(s) detected%(cluster)s' % $.MultiClusterSummary(),
-            description: 'Processor error(s) detected. Check `ceph health detail`.',
-          },
-        },
-        {
-          alert: 'HardwareNetworkError',
-          'for': '30s',
-          expr: 'ceph_health_detail{name="HARDWARE_NETWORK"} > 0',
-          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.4' },
-          annotations: {
-            summary: 'Network error(s) detected%(cluster)s' % $.MultiClusterSummary(),
-            description: 'Network error(s) detected. Check `ceph health detail`.',
-          },
-        },
-        {
-          alert: 'HardwarePowerError',
-          'for': '30s',
-          expr: 'ceph_health_detail{name="HARDWARE_POWER"} > 0',
+          alert: 'PowerSupplyFailed',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="power"} == 2',
           labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.5' },
           annotations: {
-            summary: 'Power supply error(s) detected%(cluster)s' % $.MultiClusterSummary(),
-            description: 'Power supply error(s) detected. Check `ceph health detail`.',
+            summary: 'Power supply {{ $labels.component }} failed on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'PSU fault detected on {{ $labels.hostname }}. PSU {{ $labels.component }} has failed.',
           },
         },
         {
-          alert: 'HardwareFanError',
-          'for': '30s',
-          expr: 'ceph_health_detail{name="HARDWARE_FANS"} > 0',
+          alert: 'CoolingDegraded',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="fans"} == 1',
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'Fan {{ $labels.component }} degraded on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'Fan module {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}.',
+          },
+        },
+        {
+          alert: 'CoolingFailed',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="fans"} == 2',
           labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.6' },
           annotations: {
-            summary: 'Fan error(s) detected%(cluster)s' % $.MultiClusterSummary(),
-            description: 'Fan error(s) detected. Check `ceph health detail`.',
+            summary: 'Fan {{ $labels.component }} failed on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'A cooling fault has been detected on {{ $labels.hostname }}. A cooling FAN within the enclosure has failed.',
+          },
+        },
+        {
+          alert: 'NVMeDriveDegraded',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="storage"} == 1',
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'Storage device {{ $labels.component }} degraded on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'Storage device {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}.',
+          },
+        },
+        {
+          alert: 'NVMeDriveFailed',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="storage"} == 2',
+          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.1' },
+          annotations: {
+            summary: 'Storage device {{ $labels.component }} failed on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'A drive fault has been detected on {{ $labels.hostname }}. Storage device {{ $labels.component }} has failed.',
+          },
+        },
+        {
+          alert: 'MemoryDegraded',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="memory"} == 1',
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'Memory module {{ $labels.component }} degraded on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'Memory module {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}.',
+          },
+        },
+        {
+          alert: 'MemoryFailed',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="memory"} == 2',
+          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.2' },
+          annotations: {
+            summary: 'Memory module {{ $labels.component }} failed on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'A memory fault has been detected on {{ $labels.hostname }}. Memory module {{ $labels.component }} has failed.',
+          },
+        },
+        {
+          alert: 'ProcessorDegraded',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="processors"} == 1',
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'Processor {{ $labels.component }} degraded on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'Processor {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}.',
+          },
+        },
+        {
+          alert: 'ProcessorFailed',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="processors"} == 2',
+          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.3' },
+          annotations: {
+            summary: 'Processor {{ $labels.component }} failed on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'A processor fault has been detected on {{ $labels.hostname }}. Processor {{ $labels.component }} has failed.',
+          },
+        },
+        {
+          alert: 'NetworkDegraded',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="network"} == 1',
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'Network interface {{ $labels.component }} degraded on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'Network interface {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}.',
+          },
+        },
+        {
+          alert: 'NetworkFailed',
+          'for': '1m',
+          expr: 'ceph_hardware_health{category="network"} == 2',
+          labels: { severity: 'critical', type: 'ceph_default', oid: '1.3.6.1.4.1.50495.1.2.1.13.4' },
+          annotations: {
+            summary: 'Network interface {{ $labels.component }} failed on {{ $labels.hostname }}%(cluster)s' % $.MultiClusterSummary(),
+            description: 'A network fault has been detected on {{ $labels.hostname }}. Network interface {{ $labels.component }} has failed.',
+          },
+        },
+        {
+          alert: 'MotherboardTemperatureHigh',
+          'for': '1m',
+          expr: 'ceph_hardware_temperature_celsius{sensor_name=~".*MB_TEMP.*"} > %d' % $._config.HWTempMotherboardWarning,
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'Motherboard sensor {{ $labels.sensor_name }} above %d°C on {{ $labels.hostname }}%s' % [$._config.HWTempMotherboardWarning, $.MultiClusterSummary()],
+            description: 'Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall.',
+          },
+        },
+        {
+          alert: 'DIMMTemperatureHigh',
+          'for': '1m',
+          expr: 'ceph_hardware_temperature_celsius{sensor_name=~".*DIMM.*_TEMP"} > %d' % $._config.HWTempDIMMWarning,
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'DIMM sensor {{ $labels.sensor_name }} above %d°C on {{ $labels.hostname }}%s' % [$._config.HWTempDIMMWarning, $.MultiClusterSummary()],
+            description: 'Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall.',
+          },
+        },
+        {
+          alert: 'ProcessorTemperatureHigh',
+          'for': '1m',
+          expr: 'ceph_hardware_temperature_celsius{sensor_name=~".*CPU_TEMP"} > %d' % $._config.HWTempProcessorWarning,
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'CPU sensor {{ $labels.sensor_name }} above %d°C on {{ $labels.hostname }}%s' % [$._config.HWTempProcessorWarning, $.MultiClusterSummary()],
+            description: 'Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall.',
+          },
+        },
+        {
+          alert: 'NVMeTemperatureHigh',
+          'for': '1m',
+          expr: 'ceph_hardware_temperature_celsius{sensor_name=~"NVME.*_TEMP"} > %d' % $._config.HWTempNVMeWarning,
+          labels: { severity: 'warning', type: 'ceph_default' },
+          annotations: {
+            summary: 'NVMe sensor {{ $labels.sensor_name }} above %d°C on {{ $labels.hostname }}%s' % [$._config.HWTempNVMeWarning, $.MultiClusterSummary()],
+            description: 'An NVMe temperature sensor is indicating a potential cooling problem. NVMe may power down if the temperature continues to rise.',
           },
         },
       ],
diff --git a/monitoring/ceph-mixin/prometheus_alerts.yml b/monitoring/ceph-mixin/prometheus_alerts.yml
index f2aa4defabd..4d3f6d66a61 100644
--- a/monitoring/ceph-mixin/prometheus_alerts.yml
+++ b/monitoring/ceph-mixin/prometheus_alerts.yml
@@ -650,66 +650,156 @@ groups:
           type: "ceph_default"
   - name: "hardware"
     rules:
-      - alert: "HardwareStorageError"
+      - alert: "PowerSupplyDegraded"
         annotations:
-          description: "Some storage devices are in error. Check `ceph health detail`."
-          summary: "Storage devices error(s) detected on cluster {{ $labels.cluster }}"
-        expr: "ceph_health_detail{name=\"HARDWARE_STORAGE\"} > 0"
-        for: "30s"
+          description: "PSU {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}."
+          summary: "Power supply {{ $labels.component }} degraded on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"power\"} == 1"
+        for: "1m"
         labels:
-          oid: "1.3.6.1.4.1.50495.1.2.1.13.1"
-          severity: "critical"
+          severity: "warning"
           type: "ceph_default"
-      - alert: "HardwareMemoryError"
+      - alert: "PowerSupplyFailed"
         annotations:
-          description: "DIMM error(s) detected. Check `ceph health detail`."
-          summary: "DIMM error(s) detected on cluster {{ $labels.cluster }}"
-        expr: "ceph_health_detail{name=\"HARDWARE_MEMORY\"} > 0"
-        for: "30s"
-        labels:
-          oid: "1.3.6.1.4.1.50495.1.2.1.13.2"
-          severity: "critical"
-          type: "ceph_default"
-      - alert: "HardwareProcessorError"
-        annotations:
-          description: "Processor error(s) detected. Check `ceph health detail`."
-          summary: "Processor error(s) detected on cluster {{ $labels.cluster }}"
-        expr: "ceph_health_detail{name=\"HARDWARE_PROCESSOR\"} > 0"
-        for: "30s"
-        labels:
-          oid: "1.3.6.1.4.1.50495.1.2.1.13.3"
-          severity: "critical"
-          type: "ceph_default"
-      - alert: "HardwareNetworkError"
-        annotations:
-          description: "Network error(s) detected. Check `ceph health detail`."
-          summary: "Network error(s) detected on cluster {{ $labels.cluster }}"
-        expr: "ceph_health_detail{name=\"HARDWARE_NETWORK\"} > 0"
-        for: "30s"
-        labels:
-          oid: "1.3.6.1.4.1.50495.1.2.1.13.4"
-          severity: "critical"
-          type: "ceph_default"
-      - alert: "HardwarePowerError"
-        annotations:
-          description: "Power supply error(s) detected. Check `ceph health detail`."
-          summary: "Power supply error(s) detected on cluster {{ $labels.cluster }}"
-        expr: "ceph_health_detail{name=\"HARDWARE_POWER\"} > 0"
-        for: "30s"
+          description: "PSU fault detected on {{ $labels.hostname }}. PSU {{ $labels.component }} has failed."
+          summary: "Power supply {{ $labels.component }} failed on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"power\"} == 2"
+        for: "1m"
         labels:
           oid: "1.3.6.1.4.1.50495.1.2.1.13.5"
           severity: "critical"
           type: "ceph_default"
-      - alert: "HardwareFanError"
+      - alert: "CoolingDegraded"
         annotations:
-          description: "Fan error(s) detected. Check `ceph health detail`."
-          summary: "Fan error(s) detected on cluster {{ $labels.cluster }}"
-        expr: "ceph_health_detail{name=\"HARDWARE_FANS\"} > 0"
-        for: "30s"
+          description: "Fan module {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}."
+          summary: "Fan {{ $labels.component }} degraded on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"fans\"} == 1"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "CoolingFailed"
+        annotations:
+          description: "A cooling fault has been detected on {{ $labels.hostname }}. A cooling FAN within the enclosure has failed."
+          summary: "Fan {{ $labels.component }} failed on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"fans\"} == 2"
+        for: "1m"
         labels:
           oid: "1.3.6.1.4.1.50495.1.2.1.13.6"
           severity: "critical"
           type: "ceph_default"
+      - alert: "NVMeDriveDegraded"
+        annotations:
+          description: "Storage device {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}."
+          summary: "Storage device {{ $labels.component }} degraded on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"storage\"} == 1"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "NVMeDriveFailed"
+        annotations:
+          description: "A drive fault has been detected on {{ $labels.hostname }}. Storage device {{ $labels.component }} has failed."
+          summary: "Storage device {{ $labels.component }} failed on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"storage\"} == 2"
+        for: "1m"
+        labels:
+          oid: "1.3.6.1.4.1.50495.1.2.1.13.1"
+          severity: "critical"
+          type: "ceph_default"
+      - alert: "MemoryDegraded"
+        annotations:
+          description: "Memory module {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}."
+          summary: "Memory module {{ $labels.component }} degraded on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"memory\"} == 1"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "MemoryFailed"
+        annotations:
+          description: "A memory fault has been detected on {{ $labels.hostname }}. Memory module {{ $labels.component }} has failed."
+          summary: "Memory module {{ $labels.component }} failed on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"memory\"} == 2"
+        for: "1m"
+        labels:
+          oid: "1.3.6.1.4.1.50495.1.2.1.13.2"
+          severity: "critical"
+          type: "ceph_default"
+      - alert: "ProcessorDegraded"
+        annotations:
+          description: "Processor {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}."
+          summary: "Processor {{ $labels.component }} degraded on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"processors\"} == 1"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "ProcessorFailed"
+        annotations:
+          description: "A processor fault has been detected on {{ $labels.hostname }}. Processor {{ $labels.component }} has failed."
+          summary: "Processor {{ $labels.component }} failed on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"processors\"} == 2"
+        for: "1m"
+        labels:
+          oid: "1.3.6.1.4.1.50495.1.2.1.13.3"
+          severity: "critical"
+          type: "ceph_default"
+      - alert: "NetworkDegraded"
+        annotations:
+          description: "Network interface {{ $labels.component }} is in a degraded state on {{ $labels.hostname }}."
+          summary: "Network interface {{ $labels.component }} degraded on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"network\"} == 1"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "NetworkFailed"
+        annotations:
+          description: "A network fault has been detected on {{ $labels.hostname }}. Network interface {{ $labels.component }} has failed."
+          summary: "Network interface {{ $labels.component }} failed on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_health{category=\"network\"} == 2"
+        for: "1m"
+        labels:
+          oid: "1.3.6.1.4.1.50495.1.2.1.13.4"
+          severity: "critical"
+          type: "ceph_default"
+      - alert: "MotherboardTemperatureHigh"
+        annotations:
+          description: "Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall."
+          summary: "Motherboard sensor {{ $labels.sensor_name }} above 60°C on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_temperature_celsius{sensor_name=~\".*MB_TEMP.*\"} > 60"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "DIMMTemperatureHigh"
+        annotations:
+          description: "Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall."
+          summary: "DIMM sensor {{ $labels.sensor_name }} above 80°C on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_temperature_celsius{sensor_name=~\".*DIMM.*_TEMP\"} > 80"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "ProcessorTemperatureHigh"
+        annotations:
+          description: "Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall."
+          summary: "CPU sensor {{ $labels.sensor_name }} above 80°C on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_temperature_celsius{sensor_name=~\".*CPU_TEMP\"} > 80"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
+      - alert: "NVMeTemperatureHigh"
+        annotations:
+          description: "An NVMe temperature sensor is indicating a potential cooling problem. NVMe may power down if the temperature continues to rise."
+          summary: "NVMe sensor {{ $labels.sensor_name }} above 70°C on {{ $labels.hostname }} on cluster {{ $labels.cluster }}"
+        expr: "ceph_hardware_temperature_celsius{sensor_name=~\"NVME.*_TEMP\"} > 70"
+        for: "1m"
+        labels:
+          severity: "warning"
+          type: "ceph_default"
   - name: "PrometheusServer"
     rules:
       - alert: "PrometheusJobMissing"
diff --git a/monitoring/ceph-mixin/tests_alerts/test_alerts.yml b/monitoring/ceph-mixin/tests_alerts/test_alerts.yml
index 6a4c2cd2076..d40963ed1e6 100644
--- a/monitoring/ceph-mixin/tests_alerts/test_alerts.yml
+++ b/monitoring/ceph-mixin/tests_alerts/test_alerts.yml
@@ -2087,156 +2087,440 @@ tests:
            summary: "The replication network usage on cluster mycluster has been increased over 80% in the last 30 minutes. Review the number of images being replicated. This alert will be cleaned automatically after 30 minutes"
            description: "Detected a heavy increase in bandwidth for rbd replications (over 80%) in the last 30 min. This might not be a problem, but it is good to review the number of images being replicated simultaneously"
 
- - interval: 30s
+ # Power supply degraded
+ - interval: 1m
    input_series:
-    - series: 'ceph_health_detail{name="HARDWARE_STORAGE", cluster="mycluster"}'
-      values: '1+0x40'
+    - series: 'ceph_hardware_health{category="power",component="PSU0",hostname="node1",cluster="mycluster"}'
+      values: '1 1 1 1 1 1 1 1 1'
    promql_expr_test:
-     - expr: ceph_health_detail{name="HARDWARE_STORAGE"} > 0
+     - expr: ceph_hardware_health{category="power"} == 1
        eval_time: 2m
        exp_samples:
-         - labels: '{__name__="ceph_health_detail", name="HARDWARE_STORAGE", cluster="mycluster"}'
+         - labels: 'ceph_hardware_health{category="power",component="PSU0",hostname="node1",cluster="mycluster"}'
            value: 1
    alert_rule_test:
     - eval_time: 1m
-      alertname: HardwareStorageError
+      alertname: PowerSupplyDegraded
     - eval_time: 5m
-      alertname: HardwareStorageError
+      alertname: PowerSupplyDegraded
       exp_alerts:
       - exp_labels:
-          name: HARDWARE_STORAGE
-          severity: critical
+          category: power
+          component: PSU0
+          hostname: node1
+          severity: warning
           cluster: mycluster
           type: ceph_default
-          oid: 1.3.6.1.4.1.50495.1.2.1.13.1
         exp_annotations:
-          summary: Storage devices error(s) detected on cluster mycluster
-          description: "Some storage devices are in error. Check `ceph health detail`."
- - interval: 30s
+          summary: "Power supply PSU0 degraded on node1 on cluster mycluster"
+          description: "PSU PSU0 is in a degraded state on node1."
+ # Power supply failed
+ - interval: 1m
    input_series:
-    - series: 'ceph_health_detail{name="HARDWARE_MEMORY", cluster="mycluster"}'
-      values: '1+0x40'
+    - series: 'ceph_hardware_health{category="power",component="PSU1",hostname="node2",cluster="mycluster"}'
+      values: '2 2 2 2 2 2 2 2 2'
    promql_expr_test:
-     - expr: ceph_health_detail{name="HARDWARE_MEMORY"} > 0
+     - expr: ceph_hardware_health{category="power"} == 2
        eval_time: 2m
        exp_samples:
-         - labels: '{__name__="ceph_health_detail", name="HARDWARE_MEMORY", cluster="mycluster"}'
-           value: 1
+         - labels: 'ceph_hardware_health{category="power",component="PSU1",hostname="node2",cluster="mycluster"}'
+           value: 2
    alert_rule_test:
     - eval_time: 1m
-      alertname: HardwareMemoryError
+      alertname: PowerSupplyFailed
     - eval_time: 5m
-      alertname: HardwareMemoryError
+      alertname: PowerSupplyFailed
       exp_alerts:
       - exp_labels:
-          name: HARDWARE_MEMORY
-          severity: critical
-          cluster: mycluster
-          type: ceph_default
-          oid: 1.3.6.1.4.1.50495.1.2.1.13.2
-        exp_annotations:
-          summary: DIMM error(s) detected on cluster mycluster
-          description: "DIMM error(s) detected. Check `ceph health detail`."
- - interval: 30s
-   input_series:
-    - series: 'ceph_health_detail{name="HARDWARE_PROCESSOR", cluster="mycluster"}'
-      values: '1+0x40'
-   promql_expr_test:
-     - expr: ceph_health_detail{name="HARDWARE_PROCESSOR"} > 0
-       eval_time: 2m
-       exp_samples:
-         - labels: '{__name__="ceph_health_detail", name="HARDWARE_PROCESSOR", cluster="mycluster"}'
-           value: 1
-   alert_rule_test:
-    - eval_time: 1m
-      alertname: HardwareProcessorError
-    - eval_time: 5m
-      alertname: HardwareProcessorError
-      exp_alerts:
-      - exp_labels:
-          name: HARDWARE_PROCESSOR
-          severity: critical
-          cluster: mycluster
-          type: ceph_default
-          oid: 1.3.6.1.4.1.50495.1.2.1.13.3
-        exp_annotations:
-          summary: Processor error(s) detected on cluster mycluster
-          description: "Processor error(s) detected. Check `ceph health detail`."
- - interval: 30s
-   input_series:
-    - series: 'ceph_health_detail{name="HARDWARE_NETWORK", cluster="mycluster"}'
-      values: '1+0x40'
-   promql_expr_test:
-     - expr: ceph_health_detail{name="HARDWARE_NETWORK"} > 0
-       eval_time: 2m
-       exp_samples:
-         - labels: '{__name__="ceph_health_detail", name="HARDWARE_NETWORK", cluster="mycluster"}'
-           value: 1
-   alert_rule_test:
-    - eval_time: 1m
-      alertname: HardwareNetworkError
-    - eval_time: 5m
-      alertname: HardwareNetworkError
-      exp_alerts:
-      - exp_labels:
-          name: HARDWARE_NETWORK
-          severity: critical
-          cluster: mycluster
-          type: ceph_default
-          oid: 1.3.6.1.4.1.50495.1.2.1.13.4
-        exp_annotations:
-          summary: Network error(s) detected on cluster mycluster
-          description: "Network error(s) detected. Check `ceph health detail`."
- - interval: 30s
-   input_series:
-    - series: 'ceph_health_detail{name="HARDWARE_POWER", cluster="mycluster"}'
-      values: '1+0x40'
-   promql_expr_test:
-     - expr: ceph_health_detail{name="HARDWARE_POWER"} > 0
-       eval_time: 2m
-       exp_samples:
-         - labels: '{__name__="ceph_health_detail", name="HARDWARE_POWER", cluster="mycluster"}'
-           value: 1
-   alert_rule_test:
-    - eval_time: 1m
-      alertname: HardwarePowerError
-    - eval_time: 5m
-      alertname: HardwarePowerError
-      exp_alerts:
-      - exp_labels:
-          name: HARDWARE_POWER
+          category: power
+          component: PSU1
+          hostname: node2
           severity: critical
           cluster: mycluster
           type: ceph_default
           oid: 1.3.6.1.4.1.50495.1.2.1.13.5
         exp_annotations:
-          summary: Power supply error(s) detected on cluster mycluster
-          description: "Power supply error(s) detected. Check `ceph health detail`."
- - interval: 30s
+          summary: "Power supply PSU1 failed on node2 on cluster mycluster"
+          description: "PSU fault detected on node2. PSU PSU1 has failed."
+ # Cooling degraded
+ - interval: 1m
    input_series:
-    - series: 'ceph_health_detail{name="HARDWARE_FANS", cluster="mycluster"}'
-      values: '1+0x40'
+    - series: 'ceph_hardware_health{category="fans",component="FAN0",hostname="node1",cluster="mycluster"}'
+      values: '1 1 1 1 1 1 1 1 1'
    promql_expr_test:
-     - expr: ceph_health_detail{name="HARDWARE_FANS"} > 0
+     - expr: ceph_hardware_health{category="fans"} == 1
        eval_time: 2m
        exp_samples:
-         - labels: '{__name__="ceph_health_detail", name="HARDWARE_FANS", cluster="mycluster"}'
+         - labels: 'ceph_hardware_health{category="fans",component="FAN0",hostname="node1",cluster="mycluster"}'
            value: 1
    alert_rule_test:
     - eval_time: 1m
-      alertname: HardwareFanError
+      alertname: CoolingDegraded
     - eval_time: 5m
-      alertname: HardwareFanError
+      alertname: CoolingDegraded
       exp_alerts:
       - exp_labels:
-          name: HARDWARE_FANS
+          category: fans
+          component: FAN0
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "Fan FAN0 degraded on node1 on cluster mycluster"
+          description: "Fan module FAN0 is in a degraded state on node1."
+ # Cooling failed
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="fans",component="FAN1",hostname="node2",cluster="mycluster"}'
+      values: '2 2 2 2 2 2 2 2 2'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="fans"} == 2
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="fans",component="FAN1",hostname="node2",cluster="mycluster"}'
+           value: 2
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: CoolingFailed
+    - eval_time: 5m
+      alertname: CoolingFailed
+      exp_alerts:
+      - exp_labels:
+          category: fans
+          component: FAN1
+          hostname: node2
           severity: critical
           cluster: mycluster
           type: ceph_default
           oid: 1.3.6.1.4.1.50495.1.2.1.13.6
         exp_annotations:
-          summary: Fan error(s) detected on cluster mycluster
-          description: "Fan error(s) detected. Check `ceph health detail`."
+          summary: "Fan FAN1 failed on node2 on cluster mycluster"
+          description: "A cooling fault has been detected on node2. A cooling FAN within the enclosure has failed."
+ # NVMe drive degraded
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="storage",component="nvme0n1",hostname="node1",cluster="mycluster"}'
+      values: '1 1 1 1 1 1 1 1 1'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="storage"} == 1
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="storage",component="nvme0n1",hostname="node1",cluster="mycluster"}'
+           value: 1
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: NVMeDriveDegraded
+    - eval_time: 5m
+      alertname: NVMeDriveDegraded
+      exp_alerts:
+      - exp_labels:
+          category: storage
+          component: nvme0n1
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "Storage device nvme0n1 degraded on node1 on cluster mycluster"
+          description: "Storage device nvme0n1 is in a degraded state on node1."
+ # NVMe drive failed
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="storage",component="nvme1n1",hostname="node2",cluster="mycluster"}'
+      values: '2 2 2 2 2 2 2 2 2'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="storage"} == 2
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="storage",component="nvme1n1",hostname="node2",cluster="mycluster"}'
+           value: 2
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: NVMeDriveFailed
+    - eval_time: 5m
+      alertname: NVMeDriveFailed
+      exp_alerts:
+      - exp_labels:
+          category: storage
+          component: nvme1n1
+          hostname: node2
+          severity: critical
+          cluster: mycluster
+          type: ceph_default
+          oid: 1.3.6.1.4.1.50495.1.2.1.13.1
+        exp_annotations:
+          summary: "Storage device nvme1n1 failed on node2 on cluster mycluster"
+          description: "A drive fault has been detected on node2. Storage device nvme1n1 has failed."
+ # Memory degraded
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="memory",component="DIMM_A0",hostname="node1",cluster="mycluster"}'
+      values: '1 1 1 1 1 1 1 1 1'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="memory"} == 1
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="memory",component="DIMM_A0",hostname="node1",cluster="mycluster"}'
+           value: 1
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: MemoryDegraded
+    - eval_time: 5m
+      alertname: MemoryDegraded
+      exp_alerts:
+      - exp_labels:
+          category: memory
+          component: DIMM_A0
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "Memory module DIMM_A0 degraded on node1 on cluster mycluster"
+          description: "Memory module DIMM_A0 is in a degraded state on node1."
+ # Memory failed
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="memory",component="DIMM_B0",hostname="node2",cluster="mycluster"}'
+      values: '2 2 2 2 2 2 2 2 2'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="memory"} == 2
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="memory",component="DIMM_B0",hostname="node2",cluster="mycluster"}'
+           value: 2
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: MemoryFailed
+    - eval_time: 5m
+      alertname: MemoryFailed
+      exp_alerts:
+      - exp_labels:
+          category: memory
+          component: DIMM_B0
+          hostname: node2
+          severity: critical
+          cluster: mycluster
+          type: ceph_default
+          oid: 1.3.6.1.4.1.50495.1.2.1.13.2
+        exp_annotations:
+          summary: "Memory module DIMM_B0 failed on node2 on cluster mycluster"
+          description: "A memory fault has been detected on node2. Memory module DIMM_B0 has failed."
+ # Processor degraded
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="processors",component="CPU0",hostname="node1",cluster="mycluster"}'
+      values: '1 1 1 1 1 1 1 1 1'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="processors"} == 1
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="processors",component="CPU0",hostname="node1",cluster="mycluster"}'
+           value: 1
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: ProcessorDegraded
+    - eval_time: 5m
+      alertname: ProcessorDegraded
+      exp_alerts:
+      - exp_labels:
+          category: processors
+          component: CPU0
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "Processor CPU0 degraded on node1 on cluster mycluster"
+          description: "Processor CPU0 is in a degraded state on node1."
+ # Processor failed
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="processors",component="CPU1",hostname="node2",cluster="mycluster"}'
+      values: '2 2 2 2 2 2 2 2 2'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="processors"} == 2
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="processors",component="CPU1",hostname="node2",cluster="mycluster"}'
+           value: 2
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: ProcessorFailed
+    - eval_time: 5m
+      alertname: ProcessorFailed
+      exp_alerts:
+      - exp_labels:
+          category: processors
+          component: CPU1
+          hostname: node2
+          severity: critical
+          cluster: mycluster
+          type: ceph_default
+          oid: 1.3.6.1.4.1.50495.1.2.1.13.3
+        exp_annotations:
+          summary: "Processor CPU1 failed on node2 on cluster mycluster"
+          description: "A processor fault has been detected on node2. Processor CPU1 has failed."
+ # Network degraded
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="network",component="eth0",hostname="node1",cluster="mycluster"}'
+      values: '1 1 1 1 1 1 1 1 1'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="network"} == 1
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="network",component="eth0",hostname="node1",cluster="mycluster"}'
+           value: 1
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: NetworkDegraded
+    - eval_time: 5m
+      alertname: NetworkDegraded
+      exp_alerts:
+      - exp_labels:
+          category: network
+          component: eth0
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "Network interface eth0 degraded on node1 on cluster mycluster"
+          description: "Network interface eth0 is in a degraded state on node1."
+ # Network failed
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_health{category="network",component="eth1",hostname="node2",cluster="mycluster"}'
+      values: '2 2 2 2 2 2 2 2 2'
+   promql_expr_test:
+     - expr: ceph_hardware_health{category="network"} == 2
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_health{category="network",component="eth1",hostname="node2",cluster="mycluster"}'
+           value: 2
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: NetworkFailed
+    - eval_time: 5m
+      alertname: NetworkFailed
+      exp_alerts:
+      - exp_labels:
+          category: network
+          component: eth1
+          hostname: node2
+          severity: critical
+          cluster: mycluster
+          type: ceph_default
+          oid: 1.3.6.1.4.1.50495.1.2.1.13.4
+        exp_annotations:
+          summary: "Network interface eth1 failed on node2 on cluster mycluster"
+          description: "A network fault has been detected on node2. Network interface eth1 has failed."
+ # Motherboard temperature high
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_temperature_celsius{sensor_name="MB_TEMP1",hostname="node1",cluster="mycluster"}'
+      values: '65 65 65 65 65 65 65 65 65'
+   promql_expr_test:
+     - expr: ceph_hardware_temperature_celsius{sensor_name=~".*MB_TEMP.*"} > 60
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_temperature_celsius{sensor_name="MB_TEMP1",hostname="node1",cluster="mycluster"}'
+           value: 65
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: MotherboardTemperatureHigh
+    - eval_time: 5m
+      alertname: MotherboardTemperatureHigh
+      exp_alerts:
+      - exp_labels:
+          sensor_name: MB_TEMP1
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "Motherboard sensor MB_TEMP1 above 60°C on node1 on cluster mycluster"
+          description: "Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall."
+ # DIMM temperature high
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_temperature_celsius{sensor_name="DIMM_A0_TEMP",hostname="node1",cluster="mycluster"}'
+      values: '85 85 85 85 85 85 85 85 85'
+   promql_expr_test:
+     - expr: ceph_hardware_temperature_celsius{sensor_name=~".*DIMM.*_TEMP"} > 80
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_temperature_celsius{sensor_name="DIMM_A0_TEMP",hostname="node1",cluster="mycluster"}'
+           value: 85
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: DIMMTemperatureHigh
+    - eval_time: 5m
+      alertname: DIMMTemperatureHigh
+      exp_alerts:
+      - exp_labels:
+          sensor_name: DIMM_A0_TEMP
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "DIMM sensor DIMM_A0_TEMP above 80°C on node1 on cluster mycluster"
+          description: "Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall."
+ # Processor temperature high
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_temperature_celsius{sensor_name="CPU_TEMP",hostname="node1",cluster="mycluster"}'
+      values: '85 85 85 85 85 85 85 85 85'
+   promql_expr_test:
+     - expr: ceph_hardware_temperature_celsius{sensor_name=~".*CPU_TEMP"} > 80
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_temperature_celsius{sensor_name="CPU_TEMP",hostname="node1",cluster="mycluster"}'
+           value: 85
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: ProcessorTemperatureHigh
+    - eval_time: 5m
+      alertname: ProcessorTemperatureHigh
+      exp_alerts:
+      - exp_labels:
+          sensor_name: CPU_TEMP
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "CPU sensor CPU_TEMP above 80°C on node1 on cluster mycluster"
+          description: "Prolonged high temperatures could lead to platform instability. Investigate cooling issues and hot-spots in the server room/hall."
+ # NVMe temperature high
+ - interval: 1m
+   input_series:
+    - series: 'ceph_hardware_temperature_celsius{sensor_name="NVME0_TEMP",hostname="node1",cluster="mycluster"}'
+      values: '75 75 75 75 75 75 75 75 75'
+   promql_expr_test:
+     - expr: ceph_hardware_temperature_celsius{sensor_name=~"NVME.*_TEMP"} > 70
+       eval_time: 2m
+       exp_samples:
+         - labels: 'ceph_hardware_temperature_celsius{sensor_name="NVME0_TEMP",hostname="node1",cluster="mycluster"}'
+           value: 75
+   alert_rule_test:
+    - eval_time: 1m
+      alertname: NVMeTemperatureHigh
+    - eval_time: 5m
+      alertname: NVMeTemperatureHigh
+      exp_alerts:
+      - exp_labels:
+          sensor_name: NVME0_TEMP
+          hostname: node1
+          severity: warning
+          cluster: mycluster
+          type: ceph_default
+        exp_annotations:
+          summary: "NVMe sensor NVME0_TEMP above 70°C on node1 on cluster mycluster"
+          description: "An NVMe temperature sensor is indicating a potential cooling problem. NVMe may power down if the temperature continues to rise."
 
 # nvmeof Tests
  # NVMeoFSubsystemNamespaceLimit

From b7708cd711f0e2c08985258076e03eb2209cace6 Mon Sep 17 00:00:00 2001
From: pujashahu <pujashahu@li-3d22414c-327d-11b2-a85c-a49077722390.ibm.com>
Date: Tue, 2 Jun 2026 18:41:27 +0530
Subject: [PATCH 534/596] mgr/dashboard : Add gateway filtering support for
 subsystem and namespace lists

Fixes: https://tracker.ceph.com/issues/77068

Signed-off-by: pujaoshahu <pshahu@redhat.com>
(cherry picked from commit e838bb19897ed4a8f6a548eca08e4fdd726e62f5)

 Conflicts:
	src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
	src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
---
 .../gateway-group-query-handler.service.ts    | 153 ++++++++++++++++++
 ...nvmeof-gateway-group-filter.component.html |  34 ++--
 ...nvmeof-gateway-group-filter.component.scss |  43 +++++
 ...eof-gateway-group-filter.component.spec.ts |  10 +-
 .../nvmeof-gateway-group-filter.component.ts  | 145 +++++++----------
 .../nvmeof-gateway-group.component.html       |  43 ++---
 .../nvmeof-gateway-group.component.spec.ts    |   1 -
 .../nvmeof-gateway-group.component.ts         |  11 +-
 .../nvmeof-namespaces-list.component.html     |  15 +-
 .../nvmeof-namespaces-list.component.spec.ts  |  78 +++++++--
 .../nvmeof-namespaces-list.component.ts       | 138 ++++++++++++----
 .../nvmeof-setup-cards.component.html         |   6 +-
 .../nvmeof-setup-cards.component.spec.ts      |  25 ++-
 .../nvmeof-setup-cards.component.ts           |   5 +-
 ...ubsystem-namespaces-list.component.spec.ts |  13 +-
 .../nvmeof-subsystems.component.html          |  15 +-
 .../nvmeof-subsystems.component.spec.ts       |  67 ++++----
 .../nvmeof-subsystems.component.ts            |  99 +++++++++---
 .../nvmeof-tabs/nvmeof-tabs.component.spec.ts |  93 +++++++----
 .../nvmeof-tabs/nvmeof-tabs.component.ts      |   2 +-
 .../datatable/table/table.component.html      |   2 +-
 .../shared/datatable/table/table.component.ts |   6 +
 .../mgr/dashboard/frontend/src/styles.scss    |  15 ++
 23 files changed, 719 insertions(+), 300 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/gateway-group-query-handler.service.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/gateway-group-query-handler.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/gateway-group-query-handler.service.ts
new file mode 100644
index 00000000000..51a30d5c687
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/gateway-group-query-handler.service.ts
@@ -0,0 +1,153 @@
+import { Injectable, OnDestroy } from '@angular/core';
+import { ActivatedRoute, Router } from '@angular/router';
+import { NvmeofService, GroupsComboboxItem } from '~/app/shared/api/nvmeof.service';
+import { CephServiceSpec } from '~/app/shared/models/service.interface';
+import { Subject } from 'rxjs';
+import { takeUntil } from 'rxjs/operators';
+
+const DEFAULT_PLACEHOLDER = $localize`Enter group name`;
+
+@Injectable()
+export class GatewayGroupQueryHandlerService implements OnDestroy {
+  group: string = null;
+  gwGroups: GroupsComboboxItem[] = [];
+  groupSelectionCleared = false;
+  gwGroupsEmpty = false;
+  gwGroupPlaceholder: string = DEFAULT_PLACEHOLDER;
+
+  dataRefresh$ = new Subject<void>();
+  private destroy$ = new Subject<void>();
+
+  constructor(
+    private route: ActivatedRoute,
+    private router: Router,
+    private nvmeofService: NvmeofService
+  ) {}
+
+  init() {
+    this.route.queryParams.pipe(takeUntil(this.destroy$)).subscribe((params) => {
+      const group = params?.['group']?.trim() || null;
+      const hasGroupParam = Object.prototype.hasOwnProperty.call(params ?? {}, 'group');
+      if (group) {
+        if (this.group === group && !this.groupSelectionCleared) {
+          return;
+        }
+        this.groupSelectionCleared = false;
+        this.onGroupSelection({ content: group }, false);
+      } else if (hasGroupParam) {
+        if (!this.group && this.groupSelectionCleared) {
+          return;
+        }
+        this.groupSelectionCleared = true;
+        if (this.group) {
+          this.onGroupClear(false);
+        } else {
+          this.dataRefresh$.next();
+        }
+      } else {
+        if (!this.group && !this.groupSelectionCleared) {
+          return;
+        }
+        this.groupSelectionCleared = false;
+        this.group = null;
+      }
+    });
+    this.fetchGatewayGroups();
+  }
+
+  onGroupChange(group: string | null): void {
+    if (group) {
+      this.onGroupSelection({ content: group });
+    } else {
+      this.onGroupClear();
+    }
+  }
+
+  onGroupSelection(selected: GroupsComboboxItem, syncQueryParam = true) {
+    selected.selected = true;
+    this.group = selected.content;
+    this.groupSelectionCleared = false;
+    if (syncQueryParam) {
+      this.syncGroupQueryParam(this.group);
+    }
+    this.dataRefresh$.next();
+  }
+
+  onGroupClear(syncQueryParam = true) {
+    this.group = null;
+    this.groupSelectionCleared = true;
+    if (syncQueryParam) {
+      this.syncGroupQueryParam(null);
+    }
+    this.dataRefresh$.next();
+  }
+
+  private syncGroupQueryParam(group: string | null): void {
+    const currentGroup = this.route.snapshot.queryParams['group']?.trim() || null;
+    if (currentGroup === group) {
+      return;
+    }
+    this.router.navigate([], {
+      relativeTo: this.route,
+      queryParams: { group: group || null },
+      queryParamsHandling: 'merge',
+      replaceUrl: true
+    });
+  }
+
+  private fetchGatewayGroups() {
+    this.nvmeofService
+      .listGatewayGroups()
+      .pipe(takeUntil(this.destroy$))
+      .subscribe({
+        next: (response: CephServiceSpec[][]) => this.handleGatewayGroupsSuccess(response),
+        error: (error) => this.handleGatewayGroupsError(error)
+      });
+  }
+
+  private handleGatewayGroupsSuccess(response: CephServiceSpec[][]) {
+    if (response?.[0]?.length) {
+      this.gwGroups = this.nvmeofService.formatGwGroupsList(response);
+    } else {
+      this.gwGroups = [];
+    }
+    this.updateGroupSelectionState();
+  }
+
+  private updateGroupSelectionState() {
+    if (this.gwGroups.length) {
+      if (this.group) {
+        this.gwGroups = this.gwGroups.map((g) => ({
+          ...g,
+          selected: g.content === this.group
+        }));
+      } else if (!this.groupSelectionCleared) {
+        this.onGroupSelection(this.gwGroups[0]);
+      } else {
+        this.gwGroups = this.gwGroups.map((g) => ({
+          ...g,
+          selected: false
+        }));
+      }
+      this.gwGroupsEmpty = false;
+      this.gwGroupPlaceholder = DEFAULT_PLACEHOLDER;
+    } else {
+      this.gwGroupsEmpty = true;
+      this.gwGroupPlaceholder = $localize`No groups available`;
+    }
+  }
+
+  private handleGatewayGroupsError(error: any) {
+    this.gwGroups = [];
+    this.gwGroupsEmpty = true;
+    this.gwGroupPlaceholder = $localize`Unable to fetch Gateway groups`;
+    if (error?.preventDefault) {
+      error?.preventDefault?.();
+    }
+  }
+
+  ngOnDestroy() {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
index c04056a900d..1d2b25733f2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
@@ -1,22 +1,14 @@
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-<div cdsCol
-     [columnNumbers]="{sm: 4, md: 8}">
-  <div class="form-item cds-mt-5"
-       cdsRow>
-    <cds-combo-box
-        type="single"
-        label="Selected Gateway Group"
-        i18n-label
-        [placeholder]="placeholder"
-        [items]="items"
-        (selected)="onSelected($event)"
-        (clear)="onClear()"
-        [disabled]="disabled">
-      <cds-dropdown-list></cds-dropdown-list>
-    </cds-combo-box>
-  </div>
-</div>
+<div class="nvmeof-gateway-group-filter cds-mt-3">
+  <span class="nvmeof-gateway-group-filter__label cds--type-body-compact-01"
+        i18n>Gateway group:</span>
+  <cds-combo-box type="single"
+                 size="sm"
+                 class="nvmeof-gateway-group-filter__combo"
+                 [placeholder]="placeholder"
+                 [items]="items"
+                 [disabled]="disabled"
+                 (selected)="onSelected($event)"
+                 (clear)="onClear()">
+    <cds-dropdown-list></cds-dropdown-list>
+  </cds-combo-box>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss
index e69de29bb2d..efb98006402 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.scss
@@ -0,0 +1,43 @@
+.nvmeof-gateway-group-filter {
+  display: flex;
+  align-items: center;
+  gap: var(--cds-spacing-03);
+  margin-left: var(--cds-spacing-05);
+
+  &__label {
+    white-space: nowrap;
+    color: var(--cds-text-secondary);
+    font-weight: 600;
+  }
+
+  &__combo {
+    min-inline-size: 14rem;
+    max-inline-size: 20rem;
+
+    // Remove bottom border from combobox - target all possible elements
+    ::ng-deep {
+      .cds--combo-box,
+      .cds--text-input,
+      .cds--list-box,
+      .cds--text-input__field-wrapper,
+      input,
+      input[role='combobox'] {
+        border-bottom: none !important;
+      }
+
+      // Also remove from parent containers
+      .cds--form-requirement,
+      .cds--text-input__label,
+      .cds--list-box__wrapper {
+        border-bottom: none !important;
+      }
+
+      // Target the input on all states
+      input:focus,
+      input:hover,
+      input:active {
+        border-bottom: none !important;
+      }
+    }
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
index 2324b2ce161..4e16ebd11a9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.spec.ts
@@ -103,11 +103,13 @@ describe('NvmeofGatewayGroupFilterComponent', () => {
     expect(component.placeholder).toBe('Unable to fetch Gateway groups');
   });
 
-  it('should call preventDefault on the error when the API call fails', () => {
-    const err = { preventDefault: jest.fn() };
-    (nvmeofService.listGatewayGroups as jest.Mock).mockReturnValue(throwError(err));
+  it('should handle non-Error API failures by disabling the control', () => {
+    const err = { message: 'network error' };
+    (nvmeofService.listGatewayGroups as jest.Mock).mockReturnValue(throwError(() => err));
     fixture.detectChanges();
-    expect(err.preventDefault).toHaveBeenCalled();
+    expect(component.disabled).toBe(true);
+    expect(component.placeholder).toBe('Unable to fetch Gateway groups');
+    expect(component.items).toEqual([]);
   });
 
   it('should render a cds-combo-box', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts
index 39dd35faa3a..376aa4fe9eb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.ts
@@ -1,115 +1,88 @@
-import { Component, EventEmitter, OnDestroy, OnInit, Output } from '@angular/core';
-import { ActivatedRoute, Router, RouterModule } from '@angular/router';
+import {
+  Component,
+  EventEmitter,
+  OnDestroy,
+  OnInit,
+  Output,
+  ViewEncapsulation
+} from '@angular/core';
+import { ActivatedRoute, Router } from '@angular/router';
 import { Subject } from 'rxjs';
 import { takeUntil } from 'rxjs/operators';
-import { ComboBoxModule, GridModule, LayoutModule } from 'carbon-components-angular';
+import { ComboBoxModule } from 'carbon-components-angular';
 import { NvmeofService, GroupsComboboxItem } from '~/app/shared/api/nvmeof.service';
-import { CephServiceSpec } from '~/app/shared/models/service.interface';
-
-const DEFAULT_PLACEHOLDER = $localize`Enter group name`;
 
 @Component({
   selector: 'cd-nvmeof-gateway-group-filter',
   templateUrl: './nvmeof-gateway-group-filter.component.html',
   styleUrls: ['./nvmeof-gateway-group-filter.component.scss'],
   standalone: true,
-  imports: [ComboBoxModule, GridModule, LayoutModule, RouterModule]
+  imports: [ComboBoxModule],
+  encapsulation: ViewEncapsulation.None
 })
 export class NvmeofGatewayGroupFilterComponent implements OnInit, OnDestroy {
   @Output() groupChange = new EventEmitter<string | null>();
 
   items: GroupsComboboxItem[] = [];
-  disabled = false;
-  placeholder = DEFAULT_PLACEHOLDER;
+  placeholder: string = '';
+  disabled: boolean = false;
 
   private destroy$ = new Subject<void>();
 
   constructor(
     private nvmeofService: NvmeofService,
-    private route: ActivatedRoute,
-    private router: Router
+    private router: Router,
+    private route: ActivatedRoute
   ) {}
 
   ngOnInit(): void {
-    this.loadGatewayGroups();
+    this.nvmeofService
+      .listGatewayGroups()
+      .pipe(takeUntil(this.destroy$))
+      .subscribe({
+        next: (response: any) => {
+          if (!response?.[0]?.length) {
+            this.disabled = true;
+            this.placeholder = $localize`No groups available`;
+            this.items = [];
+            return;
+          }
+          const formatted: GroupsComboboxItem[] = this.nvmeofService.formatGwGroupsList(response);
+          const currentGroup: string | undefined = this.route.snapshot.queryParams['group'];
+          if (currentGroup) {
+            this.items = formatted.map((item) => ({
+              ...item,
+              selected: item.content === currentGroup
+            }));
+          } else {
+            this.items = formatted;
+            const first = formatted[0];
+            this.router.navigate([], {
+              relativeTo: this.route,
+              queryParams: { group: first.content },
+              queryParamsHandling: 'merge',
+              replaceUrl: true
+            });
+          }
+        },
+        error: () => {
+          this.disabled = true;
+          this.placeholder = $localize`Unable to fetch Gateway groups`;
+          this.items = [];
+        }
+      });
+  }
+
+  onSelected(item: GroupsComboboxItem): void {
+    this.groupChange.emit(item.content);
+  }
+
+  onClear(): void {
+    this.groupChange.emit(null);
   }
 
   ngOnDestroy(): void {
     this.destroy$.next();
     this.destroy$.complete();
   }
-
-  onSelected(item: GroupsComboboxItem): void {
-    this.syncQueryParam(item.content);
-  }
-
-  onClear(): void {
-    this.syncQueryParam(null);
-  }
-
-  private loadGatewayGroups(): void {
-    this.nvmeofService
-      .listGatewayGroups()
-      .pipe(takeUntil(this.destroy$))
-      .subscribe({
-        next: (response: CephServiceSpec[][]) => this.onGroupsLoaded(response),
-        error: (error: any) => this.onGroupsError(error)
-      });
-  }
-
-  private onGroupsLoaded(response: CephServiceSpec[][]): void {
-    if (response?.[0]?.length) {
-      this.items = this.nvmeofService.formatGwGroupsList(response);
-    } else {
-      this.items = [];
-    }
-    this.syncSelectionState();
-  }
-
-  private onGroupsError(error: any): void {
-    this.items = [];
-    this.disabled = true;
-    this.placeholder = $localize`Unable to fetch Gateway groups`;
-    if (error?.preventDefault) {
-      error.preventDefault();
-    }
-    this.groupChange.emit(null);
-  }
-
-  private syncSelectionState(): void {
-    if (this.items.length) {
-      this.disabled = false;
-      this.placeholder = DEFAULT_PLACEHOLDER;
-      const urlGroup = this.route.snapshot.queryParams['group']?.trim() || null;
-      if (!urlGroup) {
-        this.syncQueryParam(this.items[0].content);
-      } else {
-        this.items = this.items.map((g) => ({ ...g, selected: g.content === urlGroup }));
-        this.groupChange.emit(urlGroup);
-      }
-    } else {
-      this.disabled = true;
-      this.placeholder = $localize`No groups available`;
-      this.groupChange.emit(null);
-    }
-  }
-
-  private syncQueryParam(group: string | null): void {
-    const currentGroup = this.route.snapshot.queryParams['group']?.trim() || null;
-    if (currentGroup === group) {
-      // URL already correct — still emit so the parent gets the current value on init
-      this.items = this.items.map((g) => ({ ...g, selected: g.content === group }));
-      this.groupChange.emit(group);
-      return;
-    }
-
-    this.router.navigate([], {
-      relativeTo: this.route,
-      queryParams: { group: group || null },
-      queryParamsHandling: 'merge',
-      replaceUrl: true
-    });
-    this.items = this.items.map((g) => ({ ...g, selected: g.content === group }));
-    this.groupChange.emit(group);
-  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 8d4007806bc..285a5705538 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,27 +1,28 @@
-<ng-container *ngIf="gatewayGroup$ | async as gateways">
-  <cd-table
-    #table
-    [data]="gateways"
-    [columns]="columns"
-    columnMode="flex"
-    selectionType="single"
-    identifier="name"
-    (updateSelection)="updateSelection($event)"
-    (fetchData)="fetchData()"
-    emptyStateTitle="No gateway group created"
-    i18n-emptyStateTitle
-    emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
-    i18n-emptyStateMessage>
-
-    <div class="table-actions">
-      <cd-table-actions [permission]="permission"
+<div class="nvmeof-content-layout">
+  <div class="nvmeof-content-main">
+    <ng-container *ngIf="gatewayGroup$ | async as gateways">
+      <cd-table
+        #table
+        [data]="gateways"
+        [columns]="columns"
+        columnMode="flex"
+        selectionType="single"
+        identifier="name"
+        (updateSelection)="updateSelection($event)"
+        (fetchData)="fetchData()"
+        emptyStateTitle="No gateway group created"
+        i18n-emptyStateTitle
+        emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
+        i18n-emptyStateMessage>
+      <cd-table-actions class="table-actions"
+                        [permission]="permission"
                         [selection]="selection"
-                        class="btn-group"
                         [tableActions]="tableActions">
       </cd-table-actions>
-    </div>
-  </cd-table>
-</ng-container>
+      </cd-table>
+    </ng-container>
+  </div>
+</div>
 
 <ng-template #dateTpl
              let-created="data.value">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
index dcaced4aaaa..93055deeddf 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.spec.ts
@@ -22,7 +22,6 @@ describe('NvmeofGatewayGroupComponent', () => {
       listGatewayGroups: jest.fn().mockReturnValue(of([])),
       listSubsystems: jest.fn().mockReturnValue(of([]))
     };
-
     const nvmeofStateServiceMock = {
       refresh$: new Subject<void>(),
       requestRefresh: jest.fn()
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index b59f235e8af..b590f6b1048 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -77,7 +77,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
 
   viewUrl = `/${BASE_URL}/view`;
   icons = Icons;
-
   iconSize = IconSize;
 
   constructor(
@@ -182,7 +181,8 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
           }),
           catchError(() => {
             return of([]);
-          })
+          }),
+          finalize(() => this.setTableLoading(false))
         )
       ),
       shareReplay({ bufferSize: 1, refCount: true }),
@@ -200,10 +200,17 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       .subscribe(() => this.fetchData());
   }
   fetchData(): void {
+    this.setTableLoading(true);
     this.subject.next([]);
     this.checkNodesAvailability();
   }
 
+  private setTableLoading(loading: boolean): void {
+    if (this.table) {
+      this.table.loadingIndicator = loading;
+    }
+  }
+
   updateSelection(selection: CdTableSelection): void {
     this.selection = selection;
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
index 38c5c2fc78c..c8db104d65a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
@@ -1,9 +1,8 @@
-<cd-nvmeof-gateway-group-filter
-  (groupChange)="onGroupChange($event)">
-</cd-nvmeof-gateway-group-filter>
-
+<div class="nvmeof-content-layout">
+  <div class="nvmeof-content-main">
 <ng-container *ngIf="namespaces$ | async as namespaces">
   <cd-table [data]="namespaces"
+            [compactSearchField]="true"
             columnMode="flex"
             (fetchData)="fetchData()"
             [columns]="namespacesColumns"
@@ -16,6 +15,12 @@
             emptyStateMessage="Namespaces are storage volumes mapped to subsystems for host access. Create a namespace to start provisioning storage within a subsystem."
             i18n-emptyStateMessage>
 
+    <div class="table-filter">
+      <cd-nvmeof-gateway-group-filter
+        (groupChange)="groupHandler.onGroupChange($event)">
+      </cd-nvmeof-gateway-group-filter>
+    </div>
+
   <div class="table-actions">
     <cd-table-actions [permission]="permission"
                       [selection]="selection"
@@ -25,5 +30,7 @@
   </div>
 </cd-table>
 </ng-container>
+  </div>
+</div>
 
 <router-outlet name="modal"></router-outlet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
index 945c99ea040..e49ba58057f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
@@ -1,8 +1,9 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { HttpClientModule } from '@angular/common/http';
-import { NO_ERRORS_SCHEMA } from '@angular/core';
-import { of, Subject } from 'rxjs';
-import { take } from 'rxjs/operators';
+import { CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';
+import { ActivatedRoute, Router } from '@angular/router';
+import { BehaviorSubject, Subject, of } from 'rxjs';
+import { skip, take } from 'rxjs/operators';
 import { RouterTestingModule } from '@angular/router/testing';
 import { SharedModule } from '~/app/shared/shared.module';
 
@@ -13,6 +14,7 @@ import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { NvmeofSubsystemsDetailsComponent } from '../nvmeof-subsystems-details/nvmeof-subsystems-details.component';
 import { NvmeofNamespacesListComponent } from './nvmeof-namespaces-list.component';
+import { NvmeofGatewayGroupFilterComponent } from '../nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component';
 
 const mockNamespaces = [
   {
@@ -31,16 +33,36 @@ const mockNamespaces = [
   }
 ];
 
+const mockGroups = [
+  [
+    {
+      service_name: 'nvmeof.rbd.g1',
+      service_type: 'nvmeof',
+      unmanaged: false,
+      spec: {
+        group: 'g1'
+      }
+    }
+  ],
+  1
+];
+
+const mockFormattedGwGroups = [
+  {
+    content: 'g1'
+  }
+];
+
 class MockNvmeOfService {
   gatewayGroupsResponse: any = [[{ id: 'g1' }]];
   namespacesResponse: any = { namespaces: mockNamespaces };
 
   listGatewayGroups() {
-    return of(this.gatewayGroupsResponse);
+    return of(mockGroups);
   }
 
   formatGwGroupsList(_response: any) {
-    return [{ content: 'g1', selected: false }];
+    return mockFormattedGwGroups;
   }
 
   listNamespaces(_group?: string) {
@@ -63,33 +85,55 @@ class MockTaskWrapperService {}
 describe('NvmeofNamespacesListComponent', () => {
   let component: NvmeofNamespacesListComponent;
   let fixture: ComponentFixture<NvmeofNamespacesListComponent>;
-
+  let queryParams$: BehaviorSubject<Record<string, string>>;
   let modalService: MockModalCdsService;
   let nvmeofService: MockNvmeOfService;
+  const activatedRouteMock = {
+    queryParams: null as any,
+    snapshot: { queryParams: {} as Record<string, string> }
+  };
 
   beforeEach(async () => {
-    const nvmeofStateServiceMock = {
-      refresh$: new Subject<void>(),
-      requestRefresh: jest.fn()
-    };
+    const refresh$ = new Subject<void>();
+    queryParams$ = new BehaviorSubject<Record<string, string>>({});
+    activatedRouteMock.queryParams = queryParams$.asObservable();
+    activatedRouteMock.snapshot.queryParams = queryParams$.value;
 
     await TestBed.configureTestingModule({
       declarations: [NvmeofNamespacesListComponent, NvmeofSubsystemsDetailsComponent],
-      imports: [HttpClientModule, RouterTestingModule, SharedModule],
+      imports: [
+        HttpClientModule,
+        RouterTestingModule,
+        SharedModule,
+        NvmeofGatewayGroupFilterComponent
+      ],
       providers: [
         { provide: NvmeofService, useClass: MockNvmeOfService },
         { provide: AuthStorageService, useClass: MockAuthStorageService },
         { provide: ModalCdsService, useClass: MockModalCdsService },
         { provide: TaskWrapperService, useClass: MockTaskWrapperService },
-        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
+        { provide: ActivatedRoute, useValue: activatedRouteMock },
+        {
+          provide: NvmeofStateService,
+          useValue: { refresh$: refresh$.asObservable(), requestRefresh: jest.fn() }
+        }
       ],
-      schemas: [NO_ERRORS_SCHEMA]
+      schemas: [CUSTOM_ELEMENTS_SCHEMA]
     }).compileComponents();
 
+    const router = TestBed.inject(Router);
+    jest.spyOn(router, 'navigate').mockImplementation((_commands, extras?) => {
+      const group = extras?.queryParams?.['group'];
+      const params = group ? { group: String(group) } : {};
+      activatedRouteMock.snapshot.queryParams = params;
+      queryParams$.next(params);
+      return Promise.resolve(true);
+    });
+
     fixture = TestBed.createComponent(NvmeofNamespacesListComponent);
     component = fixture.componentInstance;
-    component.ngOnInit();
     component.subsystemNQN = 'nqn.2001-07.com.ceph:1721040751436';
+    component.ngOnInit();
     fixture.detectChanges();
     modalService = TestBed.inject(ModalCdsService) as any;
     nvmeofService = TestBed.inject(NvmeofService) as any;
@@ -100,7 +144,7 @@ describe('NvmeofNamespacesListComponent', () => {
   });
 
   it('should retrieve namespaces', (done) => {
-    component.group = 'g1';
+    component.groupHandler.group = 'g1';
     component.namespaces$.pipe(take(1)).subscribe((namespaces) => {
       expect(namespaces).toEqual(
         mockNamespaces.map((ns) => ({
@@ -131,7 +175,7 @@ describe('NvmeofNamespacesListComponent', () => {
   });
 
   it('should deduplicate namespaces by nsid and subsystem nqn', (done) => {
-    component.group = 'g1';
+    component.groupHandler.group = 'g1';
     nvmeofService.namespacesResponse = {
       namespaces: [
         { nsid: 1, ns_subsystem_nqn: 'sub1' },
@@ -140,7 +184,7 @@ describe('NvmeofNamespacesListComponent', () => {
       ]
     };
 
-    component.namespaces$.pipe(take(1)).subscribe((namespaces) => {
+    component.namespaces$.pipe(skip(1), take(1)).subscribe((namespaces) => {
       expect(namespaces).toEqual([
         { nsid: 1, ns_subsystem_nqn: 'sub1', unique_id: '1_sub1' },
         { nsid: 1, ns_subsystem_nqn: 'sub2', unique_id: '1_sub2' }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
index 3217bc23cd8..71b05f17cde 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
@@ -7,6 +7,7 @@ import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impa
 import { Icons } from '~/app/shared/enum/icons.enum';
 
 import { CdTableAction } from '~/app/shared/models/cd-table-action';
+import { TableComponent } from '~/app/shared/datatable/table/table.component';
 import { CdTableSelection } from '~/app/shared/models/cd-table-selection';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { NvmeofSubsystemNamespace } from '~/app/shared/models/nvmeof';
@@ -17,22 +18,25 @@ import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { NvmeofStateService } from '../nvmeof-state.service';
-import { BehaviorSubject, Observable, of, Subject } from 'rxjs';
-import { catchError, map, switchMap, takeUntil, tap } from 'rxjs/operators';
+import { GatewayGroupQueryHandlerService } from '../gateway-group-query-handler.service';
+import { BehaviorSubject, Observable, forkJoin, of, Subject } from 'rxjs';
+import { catchError, finalize, map, shareReplay, switchMap, takeUntil, tap } from 'rxjs/operators';
+import { CephServiceSpec } from '~/app/shared/models/service.interface';
 
 @Component({
   selector: 'cd-nvmeof-namespaces-list',
   templateUrl: './nvmeof-namespaces-list.component.html',
   styleUrls: ['./nvmeof-namespaces-list.component.scss'],
-  standalone: false
+  standalone: false,
+  providers: [GatewayGroupQueryHandlerService]
 })
 export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
   @Input()
   subsystemNQN: string;
-  @Input()
-  group: string;
   @ViewChild('deleteTpl', { static: true })
   deleteTpl: TemplateRef<any>;
+  @ViewChild(TableComponent)
+  table: TableComponent;
   namespacesColumns: any;
   tableActions: CdTableAction[];
   selection = new CdTableSelection();
@@ -52,12 +56,17 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
     private taskWrapper: TaskWrapperService,
     private nvmeofService: NvmeofService,
     private dimlessBinaryPipe: DimlessBinaryPipe,
-    private nvmeofStateService: NvmeofStateService
+    private nvmeofStateService: NvmeofStateService,
+    public groupHandler: GatewayGroupQueryHandlerService
   ) {
     this.permission = this.authStorageService.getPermissions().nvmeof;
   }
 
   ngOnInit() {
+    this.groupHandler.init();
+    this.groupHandler.dataRefresh$
+      .pipe(takeUntil(this.destroy$))
+      .subscribe(() => this.listNamespaces());
     this.namespacesColumns = [
       {
         name: $localize`Namespace ID`,
@@ -89,13 +98,13 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
         click: () => {
           this.router.navigate(['block/nvmeof/namespaces/create'], {
             queryParams: {
-              group: this.group,
+              group: this.groupHandler.group,
               subsystem_nqn: this.subsystemNQN
             }
           });
         },
         canBePrimary: (selection: CdTableSelection) => !selection.hasSelection,
-        disable: () => !this.group
+        disable: () => !this.groupHandler.group
       },
       {
         name: $localize`Expand`,
@@ -114,7 +123,7 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
               ],
               {
                 relativeTo: this.route,
-                queryParams: { group: this.group },
+                queryParams: { group: this.groupHandler.group },
                 queryParamsHandling: 'merge'
               }
             );
@@ -131,29 +140,22 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
 
     this.namespaces$ = this.namespaceSubject.pipe(
       switchMap(() => {
-        if (!this.group) {
-          return of([]);
+        if (!this.groupHandler.group) {
+          if (this.groupHandler.groupSelectionCleared) {
+            return of([]);
+          }
+          return this.fetchAllGroupsNamespaces();
         }
-        return this.nvmeofService.listNamespaces(this.group).pipe(
-          map((res: NvmeofSubsystemNamespace[] | { namespaces: NvmeofSubsystemNamespace[] }) => {
-            const namespaces = Array.isArray(res) ? res : res.namespaces || [];
-            // Deduplicate by nsid + subsystem NQN (API with wildcard can return duplicates per gateway)
-            const seen = new Set<string>();
-            return namespaces
-              .filter((ns) => {
-                const key = `${ns.nsid}_${ns['ns_subsystem_nqn']}`;
-                if (seen.has(key)) return false;
-                seen.add(key);
-                return true;
-              })
-              .map((ns) => ({
-                ...ns,
-                unique_id: `${ns.nsid}_${ns['ns_subsystem_nqn']}`
-              }));
-          }),
+        return this.nvmeofService.listNamespaces(this.groupHandler.group).pipe(
+          map((res: NvmeofSubsystemNamespace[] | { namespaces: NvmeofSubsystemNamespace[] }) =>
+            this.normalizeAndDedup(res)
+          ),
           catchError(() => of([]))
         );
       }),
+      tap(() => this.setTableLoading(false)),
+      finalize(() => this.setTableLoading(false)),
+      shareReplay({ bufferSize: 1, refCount: true }),
       takeUntil(this.destroy$)
     );
     this.nvmeofStateService.refresh$
@@ -161,19 +163,85 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
       .subscribe(() => this.fetchData());
   }
 
-  onGroupChange(group: string | null): void {
-    this.group = group;
-    this.namespaceSubject.next();
+  private normalizeAndDedup(
+    res: NvmeofSubsystemNamespace[] | { namespaces: NvmeofSubsystemNamespace[] }
+  ): (NvmeofSubsystemNamespace & { unique_id: string })[] {
+    const namespaces = Array.isArray(res) ? res : res.namespaces || [];
+    const seen = new Set<string>();
+    return namespaces
+      .filter((ns) => {
+        const key = `${ns.nsid}_${ns['ns_subsystem_nqn']}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      })
+      .map((ns) => ({ ...ns, unique_id: `${ns.nsid}_${ns['ns_subsystem_nqn']}` }));
+  }
+
+  private fetchAllGroupsNamespaces() {
+    return this.nvmeofService.listGatewayGroups().pipe(
+      map((gatewayGroups: CephServiceSpec[][]) => this.extractValidGroups(gatewayGroups)),
+      switchMap((groups) => this.fetchNamespacesForGroups(groups)),
+      catchError(() => of([]))
+    );
+  }
+
+  private extractValidGroups(gatewayGroups: CephServiceSpec[][]): CephServiceSpec[] {
+    const firstItem = gatewayGroups?.[0];
+    const groups = Array.isArray(firstItem) ? firstItem : [];
+    return groups.filter((g) => g?.spec?.group);
+  }
+
+  private fetchNamespacesForGroups(
+    groups: CephServiceSpec[]
+  ): Observable<(NvmeofSubsystemNamespace & { unique_id: string })[]> {
+    if (groups.length === 0) return of([]);
+    return forkJoin(groups.map((g) => this.fetchNamespacesForGroup(g.spec.group))).pipe(
+      map((results) => this.deduplicateAcrossGroups(results.flat()))
+    );
+  }
+
+  private fetchNamespacesForGroup(
+    groupName: string
+  ): Observable<(NvmeofSubsystemNamespace & { unique_id: string })[]> {
+    return this.nvmeofService.listNamespaces(groupName).pipe(
+      map((res: NvmeofSubsystemNamespace[] | { namespaces: NvmeofSubsystemNamespace[] }) =>
+        this.normalizeAndDedup(res)
+      ),
+      catchError(() => of([]))
+    );
+  }
+
+  private deduplicateAcrossGroups(
+    namespaces: (NvmeofSubsystemNamespace & { unique_id: string })[]
+  ): (NvmeofSubsystemNamespace & { unique_id: string })[] {
+    const seen = new Set<string>();
+    return namespaces.filter((ns) => {
+      if (seen.has(ns.unique_id)) return false;
+      seen.add(ns.unique_id);
+      return true;
+    });
   }
 
   updateSelection(selection: CdTableSelection) {
     this.selection = selection;
   }
 
-  fetchData() {
+  listNamespaces() {
+    this.setTableLoading(true);
     this.namespaceSubject.next();
   }
 
+  fetchData() {
+    this.listNamespaces();
+  }
+
+  private setTableLoading(loading: boolean): void {
+    if (this.table) {
+      this.table.loadingIndicator = loading;
+    }
+  }
+
   deleteNamespaceModal() {
     const namespace = this.selection.first();
     const subsystemNqn = namespace.ns_subsystem_nqn;
@@ -193,7 +261,11 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
               nqn: subsystemNqn,
               nsid: namespace.nsid
             }),
-            call: this.nvmeofService.deleteNamespace(subsystemNqn, namespace.nsid, this.group)
+            call: this.nvmeofService.deleteNamespace(
+              subsystemNqn,
+              namespace.nsid,
+              this.groupHandler.group
+            )
           })
           .pipe(tap({ complete: () => this.nvmeofStateService.requestRefresh() }))
     });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
index d4fb4f1b491..5592a4aa107 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
@@ -30,7 +30,7 @@
         [description]="cards.subsystem.description"
         [isConfigured]="hasSubsystems"
         [successMessage]="cards.subsystem.successMessage"
-        [infoMessage]="hasGatewayGroups ? cards.subsystem.infoMessage : gatewayPendingMessage">
+        [infoMessage]="cards.subsystem.infoMessage">
       </cd-setup-step-card>
     </div>
 
@@ -41,7 +41,7 @@
         [description]="cards.namespace.description"
         [isConfigured]="hasNamespaces"
         [successMessage]="cards.namespace.successMessage"
-        [infoMessage]="hasGatewayGroups ? cards.namespace.infoMessage : gatewayPendingMessage">
+        [infoMessage]="cards.namespace.infoMessage">
       </cd-setup-step-card>
     </div>
   </div>
@@ -54,4 +54,4 @@
        i18n>Configuration complete. View status →</a>
   </div>
   }
-</cd-productive-card>
+</cd-productive-card>
\ No newline at end of file
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts
index a41e9e24f0e..b0e7044403d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.spec.ts
@@ -40,6 +40,17 @@ describe('NvmeofSetupCardsComponent', () => {
     expect(link).toBeTruthy();
   });
 
+  it('should not emit viewStatus from the disabled completion link', () => {
+    component.isAllConfigured = true;
+    fixture.detectChanges();
+
+    const emitSpy = jest.spyOn(component.viewStatus, 'emit');
+    const link = fixture.nativeElement.querySelector('.nvmeof-setup-cards__completion a');
+    link.click();
+
+    expect(emitSpy).not.toHaveBeenCalled();
+  });
+
   describe('setup state', () => {
     const getStepCards = () =>
       fixture.debugElement.queryAll((el) => el.name === 'cd-setup-step-card');
@@ -79,7 +90,7 @@ describe('NvmeofSetupCardsComponent', () => {
     });
   });
 
-  it('should display "No gateway configured yet." on step 2 and 3 when hasGatewayGroups is false', () => {
+  it('should keep subsystem and namespace info messages when hasGatewayGroups is false', () => {
     component.hasGatewayGroups = false;
     component.hasSubsystems = false;
     component.hasNamespaces = false;
@@ -89,8 +100,8 @@ describe('NvmeofSetupCardsComponent', () => {
     const subsystemCard = cardElements[1].componentInstance;
     const namespaceCard = cardElements[2].componentInstance;
 
-    expect(subsystemCard.statusMessage).toBe('No gateway configured yet.');
-    expect(namespaceCard.statusMessage).toBe('No gateway configured yet.');
+    expect(subsystemCard.statusMessage).toBe('No subsystem configured for this cluster yet.');
+    expect(namespaceCard.statusMessage).toBe('No namespace allocated or mapped yet.');
   });
 
   it('should display original info messages when hasGatewayGroups is true', () => {
@@ -154,7 +165,11 @@ describe('NvmeofSetupCardsComponent', () => {
     expect(getCards()[0].componentInstance.statusMessage).toBe(
       'No gateway groups configured for this cluster yet.'
     );
-    expect(getCards()[1].componentInstance.statusMessage).toBe('No gateway configured yet.');
-    expect(getCards()[2].componentInstance.statusMessage).toBe('No gateway configured yet.');
+    expect(getCards()[1].componentInstance.statusMessage).toBe(
+      'No subsystem configured for this cluster yet.'
+    );
+    expect(getCards()[2].componentInstance.statusMessage).toBe(
+      'No namespace allocated or mapped yet.'
+    );
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts
index 9dc9100fa90..dda0027a22b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.ts
@@ -1,5 +1,5 @@
 import { CommonModule } from '@angular/common';
-import { Component, Input, ViewEncapsulation } from '@angular/core';
+import { Component, EventEmitter, Input, Output, ViewEncapsulation } from '@angular/core';
 import { RouterModule } from '@angular/router';
 import { LayoutModule, LayerModule, LinkModule, TilesModule } from 'carbon-components-angular';
 import { ProductiveCardComponent } from '~/app/shared/components/productive-card/productive-card.component';
@@ -27,8 +27,7 @@ export class NvmeofSetupCardsComponent {
   @Input() hasSubsystems = false;
   @Input() hasNamespaces = false;
   @Input() isAllConfigured = false;
-
-  readonly gatewayPendingMessage = $localize`No gateway configured yet.`;
+  @Output() viewStatus = new EventEmitter<void>();
 
   readonly cards = {
     gateway: {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts
index 57fa67a8b89..9eea105110f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.spec.ts
@@ -2,7 +2,7 @@ import { ComponentFixture, TestBed, fakeAsync, tick } from '@angular/core/testin
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { RouterTestingModule } from '@angular/router/testing';
 import { ActivatedRoute } from '@angular/router';
-import { of, Subject } from 'rxjs';
+import { Subject, of } from 'rxjs';
 
 import { NvmeofSubsystemNamespacesListComponent } from './nvmeof-subsystem-namespaces-list.component';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
@@ -43,11 +43,7 @@ describe('NvmeofSubsystemNamespacesListComponent', () => {
   }
 
   beforeEach(async () => {
-    const nvmeofStateServiceMock = {
-      refresh$: new Subject<void>(),
-      requestRefresh: jest.fn()
-    };
-
+    const refresh$ = new Subject<void>();
     await TestBed.configureTestingModule({
       declarations: [NvmeofSubsystemNamespacesListComponent],
       imports: [HttpClientTestingModule, RouterTestingModule, SharedModule],
@@ -68,7 +64,10 @@ describe('NvmeofSubsystemNamespacesListComponent', () => {
           }
         },
         { provide: AuthStorageService, useClass: MockAuthStorageService },
-        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
+        {
+          provide: NvmeofStateService,
+          useValue: { refresh$: refresh$.asObservable(), requestRefresh: jest.fn() }
+        }
       ]
     }).compileComponents();
   });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
index aef098c0d86..3b2e08dbdf8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
@@ -1,11 +1,10 @@
-<cd-nvmeof-gateway-group-filter
-  (groupChange)="onGroupChange($event)">
-</cd-nvmeof-gateway-group-filter>
-
+<div class="nvmeof-content-layout">
+  <div class="nvmeof-content-main">
 <ng-container *ngIf="subsystems$ | async as subsystems">
   <cd-table #table
             [data]="subsystems"
             [columns]="subsystemsColumns"
+            [compactSearchField]="true"
             columnMode="flex"
             selectionType="single"
             (updateSelection)="updateSelection($event)"
@@ -15,6 +14,12 @@
             emptyStateMessage="Subsystems group NVMe namespaces and manage host access. Create a subsystem to start mapping NVMe volumes to hosts."
             i18n-emptyStateMessage>
 
+    <div class="table-filter">
+      <cd-nvmeof-gateway-group-filter
+        (groupChange)="groupHandler.onGroupChange($event)">
+      </cd-nvmeof-gateway-group-filter>
+    </div>
+
     <div class="table-actions">
       <cd-table-actions [permission]="permissions.nvmeof"
                         [selection]="selection"
@@ -30,6 +35,8 @@
     </cd-nvmeof-subsystems-details>
   </cd-table>
 </ng-container>
+  </div>
+</div>
 
 <ng-template #customTableItemTemplate
              let-value="data.value"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
index e62934ca8d4..fa179366ffe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.spec.ts
@@ -1,8 +1,8 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 import { HttpClientModule } from '@angular/common/http';
 import { ActivatedRoute, Router } from '@angular/router';
-import { BehaviorSubject, of, Subject } from 'rxjs';
-import { skip, take } from 'rxjs/operators';
+import { BehaviorSubject, Subject, of } from 'rxjs';
+import { take } from 'rxjs/operators';
 import { RouterTestingModule } from '@angular/router/testing';
 import { SharedModule } from '~/app/shared/shared.module';
 
@@ -13,7 +13,6 @@ import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { NvmeofSubsystemsComponent } from './nvmeof-subsystems.component';
 import { NvmeofSubsystemsDetailsComponent } from '../nvmeof-subsystems-details/nvmeof-subsystems-details.component';
 import { NvmeofGatewayGroupFilterComponent } from '../nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component';
-import { ComboBoxModule, GridModule } from 'carbon-components-angular';
 import { NvmeofStateService } from '../nvmeof-state.service';
 
 const mockSubsystems = [
@@ -30,6 +29,17 @@ const mockSubsystems = [
   }
 ];
 
+const mockGroups = [
+  [
+    {
+      service_name: 'nvmeof.default',
+      service_type: 'nvmeof',
+      service_id: 'default',
+      spec: { group: 'default' }
+    }
+  ]
+];
+
 class MockNvmeOfService {
   listGatewayGroups() {
     return of([
@@ -73,7 +83,6 @@ class MockTaskWrapperService {}
 describe('NvmeofSubsystemsComponent', () => {
   let component: NvmeofSubsystemsComponent;
   let fixture: ComponentFixture<NvmeofSubsystemsComponent>;
-  let nvmeofService: MockNvmeOfService;
   let queryParams$: BehaviorSubject<Record<string, string>>;
   const activatedRouteMock = {
     queryParams: null as any,
@@ -81,23 +90,17 @@ describe('NvmeofSubsystemsComponent', () => {
   };
 
   beforeEach(async () => {
+    const refresh$ = new Subject<void>();
     queryParams$ = new BehaviorSubject<Record<string, string>>({});
     activatedRouteMock.queryParams = queryParams$.asObservable();
     activatedRouteMock.snapshot.queryParams = queryParams$.value;
 
-    const nvmeofStateServiceMock = {
-      refresh$: new Subject<void>(),
-      requestRefresh: jest.fn()
-    };
-
     await TestBed.configureTestingModule({
       declarations: [NvmeofSubsystemsComponent, NvmeofSubsystemsDetailsComponent],
       imports: [
         HttpClientModule,
         RouterTestingModule,
         SharedModule,
-        ComboBoxModule,
-        GridModule,
         NvmeofGatewayGroupFilterComponent
       ],
       providers: [
@@ -106,7 +109,10 @@ describe('NvmeofSubsystemsComponent', () => {
         { provide: ModalCdsService, useClass: MockModalService },
         { provide: TaskWrapperService, useClass: MockTaskWrapperService },
         { provide: ActivatedRoute, useValue: activatedRouteMock },
-        { provide: NvmeofStateService, useValue: nvmeofStateServiceMock }
+        {
+          provide: NvmeofStateService,
+          useValue: { refresh$: refresh$.asObservable(), requestRefresh: jest.fn() }
+        }
       ]
     }).compileComponents();
 
@@ -121,7 +127,6 @@ describe('NvmeofSubsystemsComponent', () => {
 
     fixture = TestBed.createComponent(NvmeofSubsystemsComponent);
     component = fixture.componentInstance;
-    nvmeofService = TestBed.inject(NvmeofService) as any;
     component.ngOnInit();
     fixture.detectChanges();
   });
@@ -133,39 +138,35 @@ describe('NvmeofSubsystemsComponent', () => {
   it('should retrieve subsystems', (done) => {
     const expected = mockSubsystems.map((s) => ({
       ...s,
-      gw_group: 'default',
+      gw_group: component.groupHandler.group,
       auth: 'No authentication',
       initiator_count: 0
     }));
-    component.onGroupChange('default');
-    component.subsystems$.pipe(skip(1), take(1)).subscribe((subsystems) => {
+    component.subsystems$.pipe(take(1)).subscribe((subsystems) => {
       expect(subsystems).toEqual(expected);
       done();
     });
-    component.fetchData();
-  });
-
-  it('should not fetch subsystems when group is not selected', (done) => {
-    const listSubsystemsSpy = jest.spyOn(nvmeofService, 'listSubsystems');
-    component.group = null;
-    component.fetchData();
-
-    component.subsystems$.pipe(take(1)).subscribe((subsystems) => {
-      expect(subsystems).toEqual([]);
-      expect(listSubsystemsSpy).not.toHaveBeenCalled();
-      done();
-    });
+    component.getSubsystems();
   });
 
   it('should set first group as default initially', () => {
-    expect(component.group).toBe('default');
+    expect(component.groupHandler.group).toBe(mockGroups[0][0].spec.group);
+  });
+
+  it('should show subsystems across groups when dropdown selection is cleared', (done) => {
+    component.groupHandler.onGroupClear();
+    component.subsystems$.pipe(take(1)).subscribe((subsystems) => {
+      expect(subsystems.length).toBeGreaterThan(0);
+      done();
+    });
+    component.getSubsystems();
   });
 
   it('should clear selected group and stop fetching subsystems', () => {
-    component.group = 'default';
+    component.groupHandler.group = 'default';
 
-    component.onGroupChange(null);
+    component.groupHandler.onGroupChange(null);
 
-    expect(component.group).toBeNull();
+    expect(component.groupHandler.group).toBeNull();
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
index cc2467f0652..de0e7ebd4cc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.ts
@@ -13,6 +13,7 @@ import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { ListWithDetails } from '~/app/shared/classes/list-with-details.class';
 import { CdTableFetchDataContext } from '~/app/shared/models/cd-table-fetch-data-context';
 import { CdTableAction } from '~/app/shared/models/cd-table-action';
+import { TableComponent } from '~/app/shared/datatable/table/table.component';
 
 import { Icons } from '~/app/shared/enum/icons.enum';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
@@ -21,9 +22,11 @@ import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { NvmeofStateService } from '../nvmeof-state.service';
+import { GatewayGroupQueryHandlerService } from '../gateway-group-query-handler.service';
 import { BehaviorSubject, forkJoin, Observable, of, Subject } from 'rxjs';
-import { catchError, map, switchMap, takeUntil, tap } from 'rxjs/operators';
+import { catchError, finalize, map, shareReplay, switchMap, takeUntil, tap } from 'rxjs/operators';
 import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impact.enum';
+import { CephServiceSpec } from '~/app/shared/models/service.interface';
 
 const BASE_URL = 'block/nvmeof/subsystems';
 
@@ -31,7 +34,8 @@ const BASE_URL = 'block/nvmeof/subsystems';
   selector: 'cd-nvmeof-subsystems',
   templateUrl: './nvmeof-subsystems.component.html',
   styleUrls: ['./nvmeof-subsystems.component.scss'],
-  standalone: false
+  standalone: false,
+  providers: [GatewayGroupQueryHandlerService]
 })
 export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit, OnDestroy {
   @ViewChild('authenticationTpl', { static: true })
@@ -46,6 +50,9 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
   @ViewChild('customTableItemTemplate', { static: true })
   customTableItemTemplate: TemplateRef<any>;
 
+  @ViewChild(TableComponent)
+  table: TableComponent;
+
   subsystems: (NvmeofSubsystem & { gw_group?: string; initiator_count?: number })[] = [];
   pendingNqn: string = null;
   subsystemsColumns: any;
@@ -54,9 +61,9 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
   tableActions: CdTableAction[];
   subsystemDetails: any[];
   context: CdTableFetchDataContext;
-  group: string = null;
   authType = NvmeofSubsystemAuthType;
   subsystems$: Observable<(NvmeofSubsystem & { gw_group?: string; initiator_count?: number })[]>;
+
   private subsystemSubject = new BehaviorSubject<void>(undefined);
 
   private destroy$ = new Subject<void>();
@@ -68,13 +75,18 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
     private router: Router,
     private modalService: ModalCdsService,
     private taskWrapper: TaskWrapperService,
-    private nvmeofStateService: NvmeofStateService
+    private nvmeofStateService: NvmeofStateService,
+    public groupHandler: GatewayGroupQueryHandlerService
   ) {
     super();
     this.permissions = this.authStorageService.getPermissions();
   }
 
   ngOnInit() {
+    this.groupHandler.init();
+    this.groupHandler.dataRefresh$
+      .pipe(takeUntil(this.destroy$))
+      .subscribe(() => this.getSubsystems());
     this.subsystemsColumns = [
       {
         name: $localize`Subsystem NQN`,
@@ -109,10 +121,10 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
         icon: Icons.add,
         click: () =>
           this.router.navigate([BASE_URL, { outlets: { modal: [URLVerbs.CREATE] } }], {
-            queryParams: { group: this.group }
+            queryParams: { group: this.groupHandler.group }
           }),
         canBePrimary: (selection: CdTableSelection) => !selection.hasSelection,
-        disable: () => !this.group
+        disable: () => !this.groupHandler.group
       },
       {
         name: this.actionLabels.DELETE,
@@ -124,14 +136,19 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
 
     this.subsystems$ = this.subsystemSubject.pipe(
       switchMap(() => {
-        if (!this.group) {
-          return of([]);
+        if (!this.groupHandler.group) {
+          if (this.groupHandler.groupSelectionCleared) {
+            return of([]);
+          }
+          return this.fetchAllGroupsSubsystems();
         }
-        return this.nvmeofService.listSubsystems(this.group).pipe(
-          switchMap((subsystems: NvmeofSubsystem[] | NvmeofSubsystem) => {
-            const subs = Array.isArray(subsystems) ? subsystems : [subsystems];
+        return this.nvmeofService.listSubsystems(this.groupHandler.group).pipe(
+          switchMap((subsystems: any) => {
+            const subs: NvmeofSubsystem[] = Array.isArray(subsystems) ? subsystems : [subsystems];
             if (subs.length === 0) return of([]);
-            return forkJoin(subs.map((sub) => this.enrichSubsystemWithInitiators(sub)));
+            return forkJoin(
+              subs.map((sub) => this.enrichSubsystemForGroup(sub, this.groupHandler.group))
+            );
           }),
           catchError((error) => {
             this.handleError(error);
@@ -141,7 +158,10 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
       }),
       tap((subs) => {
         this.subsystems = subs;
+        this.setTableLoading(false);
       }),
+      finalize(() => this.setTableLoading(false)),
+      shareReplay({ bufferSize: 1, refCount: true }),
       takeUntil(this.destroy$)
     );
     this.nvmeofStateService.refresh$
@@ -149,8 +169,8 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
       .subscribe(() => this.fetchData());
   }
 
-  onGroupChange(group: string | null): void {
-    this.group = group;
+  getSubsystems() {
+    this.setTableLoading(true);
     this.subsystemSubject.next();
   }
 
@@ -159,7 +179,13 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
   }
 
   fetchData() {
-    this.subsystemSubject.next();
+    this.getSubsystems();
+  }
+
+  private setTableLoading(loading: boolean): void {
+    if (this.table) {
+      this.table.loadingIndicator = loading;
+    }
   }
 
   deleteSubsystemModal() {
@@ -178,7 +204,7 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
         this.taskWrapper
           .wrapTaskAroundCall({
             task: new FinishedTask('nvmeof/subsystem/delete', { nqn: subsystem.nqn }),
-            call: this.nvmeofService.deleteSubsystem(subsystem.nqn, this.group)
+            call: this.nvmeofService.deleteSubsystem(subsystem.nqn, this.groupHandler.group)
           })
           .pipe(tap({ complete: () => this.nvmeofStateService.requestRefresh() }))
     });
@@ -191,8 +217,8 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
     this.context?.error?.(error);
   }
 
-  private enrichSubsystemWithInitiators(sub: NvmeofSubsystem) {
-    return this.nvmeofService.getInitiators(sub.nqn, this.group).pipe(
+  private enrichSubsystemForGroup(sub: NvmeofSubsystem, group: string) {
+    return this.nvmeofService.getInitiators(sub.nqn, group).pipe(
       catchError(() => of([])),
       map((initiators: NvmeofSubsystemInitiator[] | { hosts?: NvmeofSubsystemInitiator[] }) => {
         let count = 0;
@@ -200,10 +226,9 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
         else if (initiators?.hosts && Array.isArray(initiators.hosts)) {
           count = initiators.hosts.length;
         }
-
         return {
           ...sub,
-          gw_group: this.group,
+          gw_group: group,
           initiator_count: count,
           auth: getSubsystemAuthStatus(sub, initiators)
         } as NvmeofSubsystem & { initiator_count?: number; auth?: string };
@@ -211,6 +236,40 @@ export class NvmeofSubsystemsComponent extends ListWithDetails implements OnInit
     );
   }
 
+  private fetchAllGroupsSubsystems() {
+    return this.nvmeofService.listGatewayGroups().pipe(
+      map((gatewayGroups) => this.extractValidGroups(gatewayGroups)),
+      switchMap((groups) => this.fetchSubsystemsForGroups(groups)),
+      catchError(() => of([]))
+    );
+  }
+
+  private extractValidGroups(gatewayGroups: CephServiceSpec[][]): CephServiceSpec[] {
+    const firstItem = gatewayGroups?.[0];
+    const groups = Array.isArray(firstItem) ? firstItem : [];
+    return groups.filter((g) => g?.spec?.group);
+  }
+
+  private fetchSubsystemsForGroups(groups: CephServiceSpec[]): Observable<NvmeofSubsystem[]> {
+    if (groups.length === 0) return of([]);
+    return forkJoin(groups.map((g) => this.fetchSubsystemsForGroup(g.spec.group))).pipe(
+      map((results) => results.flat())
+    );
+  }
+
+  private fetchSubsystemsForGroup(groupName: string): Observable<NvmeofSubsystem[]> {
+    return this.nvmeofService.listSubsystems(groupName).pipe(
+      switchMap((subsystems) => this.enrichSubsystems(subsystems, groupName)),
+      catchError(() => of([]))
+    );
+  }
+
+  private enrichSubsystems(subsystems: any, groupName: string): Observable<NvmeofSubsystem[]> {
+    const subs = Array.isArray(subsystems) ? subsystems : [subsystems];
+    if (subs.length === 0) return of([]);
+    return forkJoin(subs.map((sub) => this.enrichSubsystemForGroup(sub, groupName)));
+  }
+
   ngOnDestroy() {
     this.destroy$.next();
     this.destroy$.complete();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts
index b97da033c23..44e14837721 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.spec.ts
@@ -1,7 +1,7 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { ActivatedRoute, Event as RouterEvent, NavigationEnd, Router } from '@angular/router';
 import { RouterTestingModule } from '@angular/router/testing';
-import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { BehaviorSubject, Subject, of } from 'rxjs';
 
 import { TabsModule } from 'carbon-components-angular';
@@ -27,9 +27,13 @@ describe('NvmeofTabsComponent', () => {
   let refresh$: Subject<void>;
   let routerEvents$: Subject<RouterEvent>;
   let currentSetupState: SetupState;
+  let routerUrl = '/block/nvmeof/gateways';
 
   const setQueryParams = (params: any) => queryParams$.next(params);
   const emitRefresh = () => refresh$.next();
+  const setRouterUrl = (url: string) => {
+    routerUrl = url;
+  };
   const setSetupState = (state: SetupState) => {
     currentSetupState = state;
     nvmeofServiceSpy.fetchSetupState.mockReturnValue(of(currentSetupState));
@@ -38,9 +42,7 @@ describe('NvmeofTabsComponent', () => {
   beforeEach(async () => {
     queryParams$ = new BehaviorSubject<any>({ group: 'grp1' });
     refresh$ = new Subject<void>();
-    const nvmeofStateServiceMock = {
-      refresh$: refresh$.asObservable()
-    };
+    routerUrl = '/block/nvmeof/gateways';
     currentSetupState = { hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true };
     nvmeofServiceSpy = {
       fetchSetupState: jest.fn().mockImplementation(() => of(currentSetupState))
@@ -49,8 +51,8 @@ describe('NvmeofTabsComponent', () => {
     TestBed.configureTestingModule({
       declarations: [NvmeofTabsComponent],
       imports: [
-        RouterTestingModule,
         HttpClientTestingModule,
+        RouterTestingModule,
         SharedModule,
         TabsModule,
         NvmeofSetupCardsComponent
@@ -59,21 +61,38 @@ describe('NvmeofTabsComponent', () => {
         { provide: NvmeofService, useValue: nvmeofServiceSpy },
         { provide: ActivatedRoute, useValue: { queryParams: queryParams$.asObservable() } }
       ]
-    });
-    TestBed.overrideComponent(NvmeofTabsComponent, {
-      set: { providers: [{ provide: NvmeofStateService, useValue: nvmeofStateServiceMock }] }
-    });
-    await TestBed.compileComponents();
+    })
+      .overrideComponent(NvmeofTabsComponent, {
+        set: {
+          providers: [
+            {
+              provide: NvmeofStateService,
+              useValue: {
+                refresh$: refresh$.asObservable(),
+                requestRefresh: jest.fn()
+              }
+            }
+          ]
+        }
+      })
+      .compileComponents();
 
     fixture = TestBed.createComponent(NvmeofTabsComponent);
     component = fixture.componentInstance;
     router = TestBed.inject(Router);
     routerEvents$ = new Subject<RouterEvent>();
-    Object.defineProperty(router, 'url', {
-      get: () => '/block/nvmeof/gateways',
-      configurable: true
+    Object.defineProperty(router, 'events', {
+      configurable: true,
+      get: () => routerEvents$.asObservable()
+    });
+    Object.defineProperty(router, 'url', {
+      configurable: true,
+      get: () => routerUrl
+    });
+    Object.defineProperty(router, 'navigate', {
+      configurable: true,
+      value: jest.fn().mockResolvedValue(true)
     });
-    jest.spyOn(router, 'events', 'get').mockReturnValue(routerEvents$.asObservable());
   });
 
   it('should create', () => {
@@ -81,59 +100,54 @@ describe('NvmeofTabsComponent', () => {
   });
 
   it('should default activeTab to gateways', () => {
-    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/gateways');
+    setRouterUrl('/block/nvmeof/gateways');
     component.ngOnInit();
     expect(component.activeTab).toBe(component.Tabs.gateways);
   });
 
   it('should set activeTab to subsystems when URL contains subsystems', () => {
-    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/subsystems');
+    setRouterUrl('/block/nvmeof/subsystems');
     component.ngOnInit();
     expect(component.activeTab).toBe(component.Tabs.subsystems);
   });
 
   it('should set activeTab to namespaces when URL contains namespaces', () => {
-    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/namespaces');
+    setRouterUrl('/block/nvmeof/namespaces');
     component.ngOnInit();
     expect(component.activeTab).toBe(component.Tabs.namespaces);
   });
 
   it('should fallback to gateways when URL does not match any tab', () => {
-    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/unknown');
+    setRouterUrl('/block/nvmeof/unknown');
     component.ngOnInit();
     expect(component.activeTab).toBe(component.Tabs.gateways);
   });
 
   it('should hide the shell on namespace create routes', () => {
-    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/namespaces/create');
+    setRouterUrl('/block/nvmeof/namespaces/create');
     component.ngOnInit();
     expect(component.showTabsShell).toBe(false);
   });
 
   it('should keep the shell visible on namespace list routes', () => {
-    jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/namespaces');
+    setRouterUrl('/block/nvmeof/namespaces');
     component.ngOnInit();
     expect(component.showTabsShell).toBe(true);
   });
 
   it('should keep the shell visible on list routes with a secondary outlet', () => {
-    jest
-      .spyOn(router, 'url', 'get')
-      .mockReturnValue('/block/nvmeof/subsystems(modal:create)?group=default');
+    setRouterUrl('/block/nvmeof/subsystems(modal:create)?group=default');
     component.ngOnInit();
     expect(component.showTabsShell).toBe(true);
   });
 
   it('should hide the shell when primary route is a create page with secondary outlet', () => {
-    jest
-      .spyOn(router, 'url', 'get')
-      .mockReturnValue('/block/nvmeof/subsystems/create(modal:create)?group=default');
+    setRouterUrl('/block/nvmeof/subsystems/create(modal:create)?group=default');
     component.ngOnInit();
     expect(component.showTabsShell).toBe(false);
   });
 
   it('should navigate to correct path on tab selection', () => {
-    spyOn(router, 'navigate');
     component.onSelected(component.Tabs.subsystems);
     expect(component.activeTab).toBe(component.Tabs.subsystems);
     expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof', 'subsystems'], {
@@ -142,7 +156,6 @@ describe('NvmeofTabsComponent', () => {
   });
 
   it('should navigate to gateways on selecting gateways tab', () => {
-    spyOn(router, 'navigate');
     component.onSelected(component.Tabs.gateways);
     expect(component.activeTab).toBe(component.Tabs.gateways);
     expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof', 'gateways'], {
@@ -151,7 +164,6 @@ describe('NvmeofTabsComponent', () => {
   });
 
   it('should navigate to namespaces on selecting namespaces tab', () => {
-    spyOn(router, 'navigate');
     component.onSelected(component.Tabs.namespaces);
     expect(component.activeTab).toBe(component.Tabs.namespaces);
     expect(router.navigate).toHaveBeenCalledWith(['block/nvmeof', 'namespaces'], {
@@ -181,6 +193,7 @@ describe('NvmeofTabsComponent', () => {
       expect(component.hasSubsystems).toBe(true);
       expect(component.hasNamespaces).toBe(true);
       expect(component.isAllConfigured).toBe(true);
+      expect(component.showSetupCards).toBe(true);
     });
 
     it('scenario: no gateway groups — all steps pending', () => {
@@ -203,6 +216,15 @@ describe('NvmeofTabsComponent', () => {
       expect(component.isAllConfigured).toBe(false);
     });
 
+    it('scenario: selected gateway group does not exist — setup still reflects all groups', () => {
+      component.ngOnInit();
+      setQueryParams({ group: 'grp-other' });
+      expect(component.hasGatewayGroups).toBe(true);
+      expect(component.hasSubsystems).toBe(true);
+      expect(component.hasNamespaces).toBe(true);
+      expect(component.isAllConfigured).toBe(true);
+    });
+
     it('scenario: no subsystems in object response across all groups — step 1 complete', () => {
       setSetupState({ hasGatewayGroups: true, hasSubsystems: false, hasNamespaces: false });
       component.ngOnInit();
@@ -351,8 +373,7 @@ describe('NvmeofTabsComponent', () => {
     });
 
     it('should render correct setup card messages after all gateway groups are removed', () => {
-      jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/gateways');
-      setSetupState({ hasGatewayGroups: true, hasSubsystems: true, hasNamespaces: true });
+      setRouterUrl('/block/nvmeof/gateways');
       component.ngOnInit();
 
       setSetupState({ hasGatewayGroups: false, hasSubsystems: false, hasNamespaces: false });
@@ -365,12 +386,16 @@ describe('NvmeofTabsComponent', () => {
       expect(cardElements[0].componentInstance.statusMessage).toBe(
         'No gateway groups configured for this cluster yet.'
       );
-      expect(cardElements[1].componentInstance.statusMessage).toBe('No gateway configured yet.');
-      expect(cardElements[2].componentInstance.statusMessage).toBe('No gateway configured yet.');
+      expect(cardElements[1].componentInstance.statusMessage).toBe(
+        'No subsystem configured for this cluster yet.'
+      );
+      expect(cardElements[2].componentInstance.statusMessage).toBe(
+        'No namespace allocated or mapped yet.'
+      );
     });
 
     it('should render success setup card messages before gateway groups are removed', () => {
-      jest.spyOn(router, 'url', 'get').mockReturnValue('/block/nvmeof/gateways');
+      setRouterUrl('/block/nvmeof/gateways');
       component.ngOnInit();
       emitRefresh();
       fixture.detectChanges();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts
index a42cd572a2c..e8c933fc2fe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.ts
@@ -80,7 +80,7 @@ export class NvmeofTabsComponent implements OnInit, OnDestroy {
         this.hasSubsystems = hasSubsystems;
         this.hasNamespaces = hasNamespaces;
         this.isAllConfigured = hasGatewayGroups && hasSubsystems && hasNamespaces;
-        this.showSetupCards = !this.isAllConfigured;
+        this.showSetupCards = true;
       });
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
index f76c642986f..feed57940b8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
@@ -127,7 +127,7 @@
           }}
           @if (customFilter) {
           @for (filter of stagedCustomFilters; track filter.id; let i = $index) {
-            @if (typeof customFilter === 'string') {
+            @if (isCustomFilterLabel()) {
               <div cdsRow
                    class="cds-mt-4 cds--type-body-02">
                 Filter {{ customFilter }}:
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
index a261212f324..d44f5f053b4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
@@ -207,6 +207,10 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
   @Input()
   customFilter: boolean | string = false;
 
+  isCustomFilterLabel(): boolean {
+    return typeof this.customFilter === 'string';
+  }
+
   @Input()
   status = new TableStatus();
 
@@ -283,6 +287,8 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
 
   @Output()
   setExpandedRow = new EventEmitter();
+  @Input()
+  compactSearchField? = false;
 
   /**
    * This should be defined if you need access to the applied column filters.
diff --git a/src/pybind/mgr/dashboard/frontend/src/styles.scss b/src/pybind/mgr/dashboard/frontend/src/styles.scss
index ebfc501f584..35786d29db3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/styles.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/styles.scss
@@ -241,3 +241,18 @@ input:-webkit-autofill:active {
 .popover {
   --bs-popover-zindex: 9999;
 }
+
+// Remove bottom border from NVMeoF gateway group filter combobox
+.nvmeof-gateway-group-filter__combo {
+  .cds--combo-box,
+  .cds--text-input,
+  .cds--list-box,
+  input[role='combobox'],
+  input {
+    border-bottom: none !important;
+  }
+
+  .cds--text-input__field-wrapper {
+    border-bottom: none !important;
+  }
+}

From 517f6da8a9fa7b4c423a6082eb7d21893a4d8e4b Mon Sep 17 00:00:00 2001
From: Abhishek Desai <abhishek.desai1@ibm.com>
Date: Mon, 15 Jun 2026 16:42:15 +0530
Subject: [PATCH 535/596] mgr/dashboard : Enable cephadm-signed TLS for NVMeOf
 fixes: https://tracker.ceph.com/issues/77406 Signed-off-by: Abhishek Desai
 <abhishek.desai1@ibm.com>

(cherry picked from commit 9623f6847cecf7f2e79f461420fce4821fd1b159)
---
 .../service-form/service-form.component.html  | 221 +++++++++---------
 .../service-form.component.spec.ts            |  36 +++
 .../service-form/service-form.component.ts    |  58 +++--
 3 files changed, 192 insertions(+), 123 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index 0e7ecb82f24..1fc6559d020 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -1153,112 +1153,8 @@
       }
 
       <!-- Certificate Management UI -->
-      @if (serviceForm.controls.ssl.value && ['rgw', 'ingress', 'iscsi', 'grafana', 'oauth2-proxy', 'mgmt-gateway', 'nvmeof', 'nfs'].includes(serviceForm.controls.service_type.value)) {
-      <div>
-        <!-- Current Certificate Section - Only shown in Edit mode when certificate exists -->
-        @if (editing && currentCertificate?.has_certificate) {
-        <div class="form-item">
-          <label class="cds--label fw-bold"
-                 i18n>Current Certificate</label>
-          <div class="row">
-            <div class="col-6">
-              <label class="cds--label"
-                     i18n>Certificate</label>
-              <div>{{ currentCertificate.cert_name }}</div>
-            </div>
-            <div class="col-6">
-              <label class="cds--label"
-                     i18n>Valid Until</label>
-              <div>{{ currentCertificate.expiry_date | cdDate }} • {{ currentCertificate.days_to_expiration }} <span i18n>days left</span></div>
-            </div>
-          </div>
-          <div class="row mt-3">
-            <div class="col-6">
-              <label class="cds--label"
-                     i18n>Status</label>
-              <div class="align-items-center">
-                <cd-icon [type]="statusIconMap[currentCertificate.status] || statusIconMap['default']"></cd-icon>
-                @switch (currentCertificate.status) {
-                  @case ('valid') { <span i18n>Valid</span> }
-                  @case ('expiring') { <span i18n>Expiring soon</span> }
-                  @case ('expired') { <span i18n>Expired</span> }
-                  @case ('not_configured') { <span i18n>Not configured</span> }
-                  @case ('invalid') { <span i18n>Invalid</span> }
-                  @default { {{ currentCertificate.status }} }
-                }
-              </div>
-            </div>
-            <div class="col-6">
-              <label class="cds--label"
-                     i18n>Issuer</label>
-              <div>
-                @if (currentCertificate.signed_by === 'cephadm') {
-                <span i18n>Internal (Cephadm CA)</span>
-                } @else {
-                {{ currentCertificate.issuer || 'External' }}
-                }
-              </div>
-            </div>
-          </div>
-        </div>
-        }
-
-        <!-- Certificate Authority Selection -->
-        <div class="form-item">
-          <label class="cds--label fw-bold"
-                 i18n>Choose Certificate Authority</label>
-          <cds-radio-group formControlName="certificateType"
-                           orientation="horizontal"
-                           helperText="Select how certificates will be signed for this service. Choose internal to use the cluster’s CA, or external to upload certificates signed by your organization.">
-            <cds-radio [value]="CertificateType.internal"
-                       (change)="onCertificateTypeChange(CertificateType.internal)"
-                       i18n>
-              Internal
-            </cds-radio>
-            <cds-radio [value]="CertificateType.external"
-                       (change)="onCertificateTypeChange(CertificateType.external)"
-                       i18n>
-              External
-            </cds-radio>
-          </cds-radio-group>
-        </div>
-
-        @if (showCertSourceChangeWarning) {
-          <cd-alert-panel type="warning"
-                          spacingClass="mb-3"
-                          i18n>
-            Changing the certificate source will redeploy the service daemons to apply the new certificate configuration.
-          </cd-alert-panel>
-        }
-
-        @if (serviceForm.controls.certificateType.value === CertificateType.internal) {
-        <cd-alert-panel type="info"
-                        spacingClass="mb-3"
-                        i18n>
-          Certificate will be generated automatically by Cephadm CA for internal certificate type.
-        </cd-alert-panel>
-        <div class="form-item">
-          <cd-text-label-list formControlName="custom_sans"
-                              label="Custom SAN Entries"
-                              i18n-label
-                              helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
-                              i18n-helperText>
-          </cd-text-label-list>
-        </div>
-        @if (serviceForm.controls.service_type.value === 'rgw'
-             && serviceForm.controls.virtual_host_enabled.value) {
-        <div class="form-item">
-          <cds-checkbox i18n-label
-                        formControlName="wildcard_enabled">
-            Include wildcard certificate for bucket subdomains
-            <cd-help-text i18n>
-              Add wildcard certificates (*.domain) to allow SSL for all bucket subdomains. Required for virtual-host style with SSL.
-            </cd-help-text>
-          </cds-checkbox>
-        </div>
-        }
-        }
-      </div>
+      @if (serviceForm.controls.ssl.value && ['rgw', 'ingress', 'iscsi', 'grafana', 'oauth2-proxy', 'mgmt-gateway', 'nfs'].includes(serviceForm.controls.service_type.value)) {
+      <ng-container *ngTemplateOutlet="certificateAuthorityManagement"></ng-container>
       }
 
       <!-- ssl_cert - Only show when SSL is enabled AND certificate type is external -->
@@ -1396,6 +1292,9 @@
         </fieldset>
       </div>
       @if (serviceForm.controls.enable_mtls.value) {
+      <ng-container *ngTemplateOutlet="certificateAuthorityManagement"></ng-container>
+
+      @if (serviceForm.controls.certificateType.value === CertificateType.external) {
       <!-- root_ca_cert -->
       <div class="form-item">
         <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'root_ca_cert', title: 'Root CA Certificate Input', helperText: 'Uploaded files will populate the Root CA certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a Root CA certificate file, or paste the Root CA certificate PEM content directly.', invalidTemplate: invalidRootCaCertError, isRequired: true }"></ng-container>
@@ -1452,6 +1351,7 @@
       </div>
       }
       }
+      }
     </form>
   </section>
   <cd-form-button-panel (submitActionEvent)="onSubmit()"
@@ -1467,6 +1367,115 @@
   </span>
 </ng-template>
 
+<ng-template #certificateAuthorityManagement>
+  <div [formGroup]="serviceForm">
+  <!-- Current Certificate Section - Only shown in Edit mode when certificate exists -->
+  @if (editing && currentCertificate?.has_certificate) {
+  <div class="form-item">
+    <label class="cds--label cds--type-heading-compact-01"
+           i18n>Current Certificate</label>
+    <div class="row">
+      <div class="col-6">
+        <label class="cds--label"
+               i18n>Certificate</label>
+        <div>{{ currentCertificate.cert_name }}</div>
+      </div>
+      <div class="col-6">
+        <label class="cds--label"
+               i18n>Valid Until</label>
+        <div>{{ currentCertificate.expiry_date | cdDate }} • {{ currentCertificate.days_to_expiration }} <span i18n>days left</span></div>
+      </div>
+    </div>
+    <div class="row mt-3">
+      <div class="col-6">
+        <label class="cds--label"
+               i18n>Status</label>
+        <div class="align-items-center">
+          <cd-icon [type]="statusIconMap[currentCertificate.status] || statusIconMap['default']"></cd-icon>
+          @switch (currentCertificate.status) {
+            @case ('valid') { <span i18n>Valid</span> }
+            @case ('expiring') { <span i18n>Expiring soon</span> }
+            @case ('expired') { <span i18n>Expired</span> }
+            @case ('not_configured') { <span i18n>Not configured</span> }
+            @case ('invalid') { <span i18n>Invalid</span> }
+            @default { {{ currentCertificate.status }} }
+          }
+        </div>
+      </div>
+      <div class="col-6">
+        <label class="cds--label"
+               i18n>Issuer</label>
+        <div>
+          @if (currentCertificate.signed_by === 'cephadm') {
+          <span i18n>Internal (Cephadm CA)</span>
+          } @else {
+          {{ currentCertificate.issuer || 'External' }}
+          }
+        </div>
+      </div>
+    </div>
+  </div>
+  }
+
+  <!-- Certificate Authority Selection -->
+  <div class="form-item">
+    <label class="cds--label cds--type-heading-compact-01"
+           i18n>Choose Certificate Authority</label>
+    <cds-radio-group formControlName="certificateType"
+                     orientation="horizontal"
+                     helperText="Select how certificates will be signed for this service. Choose internal to use the cluster’s CA, or external to upload certificates signed by your organization."
+                     i18n-helperText>
+      <cds-radio [value]="CertificateType.internal"
+                 (change)="onCertificateTypeChange(CertificateType.internal)"
+                 i18n>
+        Internal
+      </cds-radio>
+      <cds-radio [value]="CertificateType.external"
+                 (change)="onCertificateTypeChange(CertificateType.external)"
+                 i18n>
+        External
+      </cds-radio>
+    </cds-radio-group>
+  </div>
+
+  @if (showCertSourceChangeWarning) {
+    <cd-alert-panel type="warning"
+                    spacingClass="mb-3"
+                    i18n>
+      Changing the certificate source will redeploy the service daemons to apply the new certificate configuration.
+    </cd-alert-panel>
+  }
+
+  @if (serviceForm.controls.certificateType.value === CertificateType.internal) {
+  <cd-alert-panel type="info"
+                  spacingClass="mb-3"
+                  i18n>
+    Certificate will be generated automatically by Cephadm CA for internal certificate type.
+  </cd-alert-panel>
+  <div class="form-item">
+    <cd-text-label-list formControlName="custom_sans"
+                        label="Custom SAN Entries"
+                        i18n-label
+                        helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
+                        i18n-helperText>
+    </cd-text-label-list>
+  </div>
+  @if (serviceForm.controls.service_type.value === 'rgw'
+       && serviceForm.controls.virtual_host_enabled.value) {
+  <div class="form-item">
+    <cds-checkbox i18n-label
+                  formControlName="wildcard_enabled">
+      Include wildcard certificate for bucket subdomains
+      <cd-help-text i18n>
+        Add wildcard certificates (*.domain) to allow SSL for all bucket subdomains. Required for virtual-host style with SSL.
+      </cd-help-text>
+    </cds-checkbox>
+  </div>
+  }
+  }
+  </div>
+</ng-template>
+
 <ng-template #fileUploaderTextarea
              let-controlName="controlName"
              let-title="title"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
index a1c2590e20f..b4fbab508ea 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
@@ -558,6 +558,22 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         expect(server_key).toBeNull();
       });
 
+      it('should not show certs and keys field with internal mTLS', () => {
+        formHelper.setValue('enable_mtls', true);
+        formHelper.setValue('certificateType', 'internal');
+        fixture.detectChanges();
+        const root_ca_cert = fixture.debugElement.query(By.css('#root_ca_cert'));
+        const client_cert = fixture.debugElement.query(By.css('#client_cert'));
+        const client_key = fixture.debugElement.query(By.css('#client_key'));
+        const server_cert = fixture.debugElement.query(By.css('#server_cert'));
+        const server_key = fixture.debugElement.query(By.css('#server_key'));
+        expect(root_ca_cert).toBeNull();
+        expect(client_cert).toBeNull();
+        expect(client_key).toBeNull();
+        expect(server_cert).toBeNull();
+        expect(server_key).toBeNull();
+      });
+
       it('should submit nvmeof without mTLS', () => {
         component.onSubmit();
         expect(cephServiceService.create).toHaveBeenCalledWith({
@@ -572,6 +588,7 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
 
       it('should submit nvmeof with mTLS', () => {
         formHelper.setValue('enable_mtls', true);
+        formHelper.setValue('certificateType', 'external');
         formHelper.setValue('root_ca_cert', 'root_ca_cert');
         formHelper.setValue('client_cert', 'client_cert');
         formHelper.setValue('client_key', 'client_key');
@@ -585,6 +602,8 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
           unmanaged: false,
           group: 'default',
           enable_auth: true,
+          ssl: true,
+          certificate_source: 'inline',
           root_ca_cert: 'root_ca_cert',
           client_cert: 'client_cert',
           client_key: 'client_key',
@@ -592,6 +611,23 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
           server_key: 'server_key'
         });
       });
+
+      it('should submit nvmeof with internal mTLS', () => {
+        formHelper.setValue('enable_mtls', true);
+        formHelper.setValue('certificateType', 'internal');
+        component.onSubmit();
+        expect(cephServiceService.create).toHaveBeenCalledWith({
+          service_type: 'nvmeof',
+          service_id: 'rbd.default',
+          placement: {},
+          unmanaged: false,
+          pool: 'rbd',
+          group: 'default',
+          enable_auth: true,
+          ssl: true,
+          certificate_source: 'cephadm-signed'
+        });
+      });
     });
 
     describe('should test service smb', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index 86a074fef8c..6c10ff5a2ce 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -238,7 +238,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
           CdValidators.composeIf(
             {
               service_type: 'nvmeof',
-              enable_mtls: true
+              enable_mtls: true,
+              certificateType: CertificateType.external
             },
             [Validators.required]
           )
@@ -250,7 +251,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
           CdValidators.composeIf(
             {
               service_type: 'nvmeof',
-              enable_mtls: true
+              enable_mtls: true,
+              certificateType: CertificateType.external
             },
             [Validators.required]
           )
@@ -262,7 +264,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
           CdValidators.composeIf(
             {
               service_type: 'nvmeof',
-              enable_mtls: true
+              enable_mtls: true,
+              certificateType: CertificateType.external
             },
             [Validators.required]
           )
@@ -274,7 +277,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
           CdValidators.composeIf(
             {
               service_type: 'nvmeof',
-              enable_mtls: true
+              enable_mtls: true,
+              certificateType: CertificateType.external
             },
             [Validators.required]
           )
@@ -286,7 +290,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
           CdValidators.composeIf(
             {
               service_type: 'nvmeof',
-              enable_mtls: true
+              enable_mtls: true,
+              certificateType: CertificateType.external
             },
             [Validators.required]
           )
@@ -781,11 +786,19 @@ export class ServiceFormComponent extends CdForm implements OnInit {
             case 'nvmeof':
               this.serviceForm.get('group').setValue(response[0].spec.group);
               this.serviceForm.get('enable_mtls').setValue(response[0].spec?.enable_auth);
-              this.serviceForm.get('root_ca_cert').setValue(response[0].spec?.root_ca_cert);
-              this.serviceForm.get('client_cert').setValue(response[0].spec?.client_cert);
-              this.serviceForm.get('client_key').setValue(response[0].spec?.client_key);
-              this.serviceForm.get('server_cert').setValue(response[0].spec?.server_cert);
-              this.serviceForm.get('server_key').setValue(response[0].spec?.server_key);
+              if (response[0].spec?.enable_auth) {
+                if (response[0].spec?.certificate_source !== 'cephadm-signed') {
+                  this.serviceForm.get('certificateType').setValue(CertificateType.external);
+                }
+                if (response[0].spec?.['custom_sans']) {
+                  this.serviceForm.get('custom_sans').setValue(response[0].spec['custom_sans']);
+                }
+                this.serviceForm.get('root_ca_cert').setValue(response[0].spec?.root_ca_cert);
+                this.serviceForm.get('client_cert').setValue(response[0].spec?.client_cert);
+                this.serviceForm.get('client_key').setValue(response[0].spec?.client_key);
+                this.serviceForm.get('server_cert').setValue(response[0].spec?.server_cert);
+                this.serviceForm.get('server_key').setValue(response[0].spec?.server_key);
+              }
               break;
             case 'rgw':
               this.serviceForm
@@ -1329,11 +1342,22 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         serviceSpec['group'] = values['group'];
         serviceSpec['enable_auth'] = values['enable_mtls'];
         if (values['enable_mtls']) {
-          serviceSpec['root_ca_cert'] = values['root_ca_cert'];
-          serviceSpec['client_cert'] = values['client_cert'];
-          serviceSpec['client_key'] = values['client_key'];
-          serviceSpec['server_cert'] = values['server_cert'];
-          serviceSpec['server_key'] = values['server_key'];
+          serviceSpec['ssl'] = true;
+          serviceSpec['certificate_source'] =
+            values['certificateType'] === CertificateType.internal ? 'cephadm-signed' : 'inline';
+          if (
+            values['certificateType'] === CertificateType.internal &&
+            values['custom_sans']?.length > 0
+          ) {
+            serviceSpec['custom_sans'] = values['custom_sans'];
+          }
+          if (values['certificateType'] === CertificateType.external) {
+            serviceSpec['root_ca_cert'] = values['root_ca_cert'];
+            serviceSpec['client_cert'] = values['client_cert'];
+            serviceSpec['client_key'] = values['client_key'];
+            serviceSpec['server_cert'] = values['server_cert'];
+            serviceSpec['server_key'] = values['server_key'];
+          }
         }
         break;
       case 'iscsi':
@@ -1583,7 +1607,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
       return isExternalCert;
     }
 
-    const sslCertServices = ['rgw', 'ingress', 'iscsi', 'grafana', 'oauth2-proxy', 'nvmeof', 'nfs'];
+    const sslCertServices = ['rgw', 'ingress', 'iscsi', 'grafana', 'oauth2-proxy', 'nfs'];
     return isSslEnabled && isExternalCert && sslCertServices.includes(serviceType);
   }
 
@@ -1593,7 +1617,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
       this.serviceForm.controls.certificateType?.value === CertificateType.external;
     const isSslEnabled = this.serviceForm.controls.ssl?.value;
 
-    const sslKeyServices = ['iscsi', 'grafana', 'oauth2-proxy', 'nvmeof', 'nfs', 'mgmt-gateway'];
+    const sslKeyServices = ['iscsi', 'grafana', 'oauth2-proxy', 'nfs', 'mgmt-gateway'];
     return isSslEnabled && isExternalCert && sslKeyServices.includes(serviceType);
   }
 

From eb36d949e945e6f24f4e1b4cf39b87a58d863826 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Sat, 13 Jun 2026 03:35:13 +0530
Subject: [PATCH 536/596] mgr/dashboard: Implement NVMe-oF Gateway Group
 Resource Overview Page

Fixes: https://tracker.ceph.com/issues/77383

Signed-off-by: pujaoshahu <pshahu@redhat.com>
(cherry picked from commit 254ab5383505962460d06b483dd931bf91c1f0b8)
---
 .../nvmeof-gateway-group.component.html       | 13 +++++
 .../nvmeof-gateway-group.component.scss       |  4 ++
 .../nvmeof-gateway-group.component.ts         | 54 ++++++++++++++++++-
 ...meof-gateway-node-add-modal.component.html |  0
 ...meof-gateway-node-add-modal.component.scss |  0
 ...f-gateway-node-add-modal.component.spec.ts |  0
 ...nvmeof-gateway-node-add-modal.component.ts |  0
 ...meof-gateway-node-add-modal.component.scss |  1 +
 .../shared/components/components.module.ts    |  4 +-
 .../details-card/details-card.component.html  | 24 ++++++---
 .../details-card.component.spec.ts            |  5 ++
 .../details-card/details-card.component.ts    | 21 +++++++-
 12 files changed, 114 insertions(+), 12 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 8d4007806bc..5084e98a14b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,4 +1,17 @@
 <ng-container *ngIf="gatewayGroup$ | async as gateways">
+  <!-- Details Card Section -->
+  <ng-container *ngIf="selection.hasSelection">
+    <cd-details-card
+      cardTitle="Details"
+      i18n-cardTitle
+      [details]="selectedGatewayDetails"
+      [showEditButton]="true"
+      [editButtonLabel]="actionLabels.EDIT"
+      [columns]="4"
+      (editClicked)="editSelectedGatewayGroup()">
+    </cd-details-card>
+  </ng-container>
+
   <cd-table
     #table
     [data]="gateways"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
index a5f8a62aac9..71694a4ab86 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
@@ -4,3 +4,7 @@ cd-details-card {
   display: block;
   margin-bottom: layout.$spacing-05;
 }
+
+.table-actions {
+  margin-top: layout.$spacing-03;
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index b59f235e8af..b89d8bc9a51 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -26,6 +26,7 @@ import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
+import { DetailItem } from '~/app/shared/components/details-card/details-card.component';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impact.enum';
 import { NotificationService } from '~/app/shared/services/notification.service';
@@ -69,10 +70,11 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   selection: CdTableSelection = new CdTableSelection();
   gatewayGroup$: Observable<CephServiceSpec[]> = of([]);
   subject = new BehaviorSubject<CephServiceSpec[]>([]);
-  context!: CdTableFetchDataContext;
+  context?: CdTableFetchDataContext;
   gatewayGroupName = '';
   subsystemCount = 0;
   gatewayCount = 0;
+  selectedGatewayDetails: DetailItem[] = [];
   private lastGroupCount = 0;
 
   viewUrl = `/${BASE_URL}/view`;
@@ -127,6 +129,14 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
     };
 
+    const editAction: CdTableAction = {
+      permission: 'update',
+      icon: Icons.edit,
+      routerLink: () => this.urlBuilder.getEdit(this.selection.first()?.name),
+      name: this.actionLabels.EDIT,
+      canBePrimary: (selection: CdTableSelection) => selection.hasSingleSelection
+    };
+
     const viewAction: CdTableAction = {
       permission: 'read',
       icon: Icons.eye,
@@ -143,7 +153,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       canBePrimary: (selection: CdTableSelection) => selection.hasMultiSelection
     };
 
-    this.tableActions = [createAction, viewAction, deleteAction];
+    this.tableActions = [createAction, editAction, viewAction, deleteAction];
 
     this.gatewayGroup$ = this.subject.pipe(
       switchMap(() =>
@@ -206,6 +216,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
 
   updateSelection(selection: CdTableSelection): void {
     this.selection = selection;
+    this.selectedGatewayDetails = this.buildGatewayDetails(selection.first());
   }
 
   deleteGatewayGroupModal() {
@@ -324,6 +335,45 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     this.router.navigate([this.viewUrl, groupName]);
   }
 
+  editSelectedGatewayGroup(): void {
+    const selectedGroup = this.selection.first();
+    if (!selectedGroup) {
+      return;
+    }
+    this.router.navigate([this.urlBuilder.getEdit(selectedGroup.name)]);
+  }
+
+  private buildGatewayDetails(selectedGroup: any): DetailItem[] {
+    if (!selectedGroup) {
+      return [];
+    }
+
+    const runningGateways = selectedGroup.statusCount?.running ?? 0;
+    const errorGateways = selectedGroup.statusCount?.error ?? 0;
+    const totalGateways = runningGateways + errorGateways;
+
+    return [
+      {
+        label: $localize`Gateway name`,
+        value: selectedGroup.name
+      },
+      {
+        label: $localize`Gateway nodes`,
+        value: totalGateways
+      },
+      {
+        label: $localize`Encryption`,
+        value: selectedGroup.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
+        type: 'status'
+      },
+      {
+        label: $localize`mTLS`,
+        value: selectedGroup.spec?.enable_mtls ? $localize`Enabled` : $localize`Disabled`,
+        type: 'status'
+      }
+    ];
+  }
+
   ngOnDestroy(): void {
     this.destroy$.next();
     this.destroy$.complete();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.spec.ts
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
index f93358bb00d..83757259841 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
@@ -1,3 +1,4 @@
+// Scoped to this component (ViewEncapsulation.None)
 cd-nvmeof-gateway-node-add-modal {
   .cds--modal-container {
     height: 80vh;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
index 15452fcf264..294dd0ad5f2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
@@ -45,6 +45,7 @@ import {
   LayerModule,
   ThemeModule
 } from 'carbon-components-angular';
+import { ProductiveCardComponent } from './productive-card/productive-card.component';
 import EditIcon from '@carbon/icons/es/edit/16';
 import CodeIcon from '@carbon/icons/es/code/16';
 import { MotdComponent } from '~/app/shared/components/motd/motd.component';
@@ -186,7 +187,8 @@ import { ProductiveCardComponent } from './productive-card/productive-card.compo
     TagModule,
     LinkModule,
     LayerModule,
-    ThemeModule
+    ThemeModule,
+    ProductiveCardComponent
   ],
   declarations: [
     SparklineComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index dd302459d61..d60b1f3b345 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -2,23 +2,31 @@
   <ng-template #header>
     @if (cardTitle) {
     <h3 class="cds--type-heading-03" i18n>{{ cardTitle }}</h3>
+    @if (showEditButton) {
+    <button
+      cdsButton="ghost"
+      size="sm"
+      [disabled]="editButtonDisabled"
+      (click)="onEditClick()"
+      [attr.aria-label]="editButtonLabel"
+    >
+      {{ editButtonLabel }}
+      <cd-icon class="cds-ml-5" type="edit"></cd-icon>
+    </button>
+    }
     }
   </ng-template>
 
-  <div [cdsStack]="'vertical'" 
-       [gap]="0">
+  <div [cdsStack]="'vertical'" [gap]="0">
     @if (details && details.length > 0) {
-    <div [cdsStack]="'horizontal'" 
-         [gap]="6">
+    <div [cdsStack]="'horizontal'" [gap]="6">
       @for (detail of getVisibleDetails(); track detail.label) {
-      <div [cdsStack]="'vertical'" 
-           [gap]="2">
+      <div [cdsStack]="'vertical'" [gap]="2">
         <label class="cds--type-label-01">{{ detail.label }}</label>
         <div class="cds--type-body-01">
           @switch (detail.type) {
             @case ('status') {
-              <div [cdsStack]="'horizontal'" 
-                   [gap]="3">
+              <div [cdsStack]="'horizontal'" [gap]="3">
                 <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
                 <span>{{ getDisplayValue(detail.value) }}</span>
               </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
index 8e1912a5da0..a8eb9996aa8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
@@ -36,6 +36,11 @@ describe('DetailsCardComponent', () => {
     expect(component.isStatusDisabled('Enabled')).toBe(false);
   });
 
+  it('should emit editClicked event', () => {
+    spyOn(component.editClicked, 'emit');
+    component.onEditClick();
+    expect(component.editClicked.emit).toHaveBeenCalled();
+  });
   it('should handle empty details array', () => {
     component.details = [];
     const visible = component.getVisibleDetails();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
index 41d69190d5b..7cfed7235e0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
@@ -1,4 +1,4 @@
-import { Component, Input, TemplateRef } from '@angular/core';
+import { Component, EventEmitter, Input, Output, TemplateRef } from '@angular/core';
 
 type DetailValue = any;
 type DetailTemplateContext = { $implicit: DetailValue; detail: DetailItem };
@@ -25,6 +25,25 @@ export class DetailsCardComponent {
   @Input()
   details?: DetailItem[] = [];
 
+  @Input()
+  showEditButton = false;
+
+  @Input()
+  editButtonLabel = $localize`Edit`;
+
+  @Input()
+  editButtonDisabled = false;
+
+  @Input()
+  columns = 4;
+
+  @Output()
+  editClicked = new EventEmitter<void>();
+
+  onEditClick(): void {
+    this.editClicked.emit();
+  }
+  
   @Input()
   columns = 4;
 

From 507765d71e12539e428ffb04e8a82aca6a5e38d4 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Wed, 24 Jun 2026 13:38:54 +0530
Subject: [PATCH 537/596] mgr/dashboard: Implement backword support for Create
 existing nvme-oF gateway groups through UI

Fixes : https://tracker.ceph.com/issues/77632

Signed-off-by: pujaoshahu <pshahu@redhat.com>
(cherry picked from commit 26b7e9e4849f8f0f1d044cb23cc94a5ce910061d)
---
 .../src/app/ceph/block/block.module.ts        |  16 +-
 .../nvmeof-gateway-group.component.html       |  15 +-
 .../nvmeof-gateway-group.component.scss       |   4 -
 .../nvmeof-gateway-group.component.ts         |  35 +-
 .../nvmeof-gateway-node.component.html        |   5 +-
 .../nvmeof-gateway-node.component.ts          |   4 +-
 .../nvmeof-group-form.component.html          | 442 ++++++++++++++++--
 .../nvmeof-group-form.component.spec.ts       |  64 +++
 .../nvmeof-group-form.component.ts            | 236 ++++++++--
 .../shared/components/components.module.ts    |   4 +-
 .../details-card/details-card.component.html  |   9 +-
 .../details-card/details-card.component.ts    |   3 -
 12 files changed, 726 insertions(+), 111 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index 368a7de95b7..7dbdfbbd518 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -10,6 +10,7 @@ import { ActionLabels, URLVerbs } from '~/app/shared/constants/app.constants';
 import { FeatureTogglesGuardService } from '~/app/shared/services/feature-toggles-guard.service';
 import { ModuleStatusGuardService } from '~/app/shared/services/module-status-guard.service';
 import { SharedModule } from '~/app/shared/shared.module';
+import { TextLabelListComponent } from '~/app/shared/components/text-label-list/text-label-list.component';
 import { IscsiSettingComponent } from './iscsi-setting/iscsi-setting.component';
 import { IscsiTabsComponent } from './iscsi-tabs/iscsi-tabs.component';
 import { IscsiTargetDetailsComponent } from './iscsi-target-details/iscsi-target-details.component';
@@ -147,7 +148,9 @@ import { NvmeofGatewayGroupFilterComponent } from './nvmeof-gateway-group-filter
     LayoutModule,
     ThemeModule,
     NvmeofSetupCardsComponent,
-    NvmeofGatewayGroupFilterComponent
+    NvmeofGatewayGroupFilterComponent,
+    TextLabelListComponent
+    // ProductiveCardComponent
   ],
   declarations: [
     RbdListComponent,
@@ -378,6 +381,17 @@ const routes: Routes = [
               }
             }
           },
+          {
+            path: `${URLVerbs.EDIT}/:name`,
+            component: NvmeofGroupFormComponent,
+            data: {
+              breadcrumbs: ActionLabels.EDIT,
+              pageHeader: {
+                title: $localize`Edit Gateway Group`,
+                description: $localize`Modify gateway group configuration.`
+              }
+            }
+          },
           {
             path: `${URLVerbs.VIEW}/:group`,
             component: NvmeGatewayViewComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 5084e98a14b..435410a6aca 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,14 +1,12 @@
 <ng-container *ngIf="gatewayGroup$ | async as gateways">
   <!-- Details Card Section -->
-  <ng-container *ngIf="selection.hasSelection">
+  <ng-container *ngIf="selection.hasSelection && showDetailsCard">
     <cd-details-card
       cardTitle="Details"
       i18n-cardTitle
       [details]="selectedGatewayDetails"
-      [showEditButton]="true"
-      [editButtonLabel]="actionLabels.EDIT"
-      [columns]="4"
-      (editClicked)="editSelectedGatewayGroup()">
+      [showEditButton]="false"
+      [columns]="4">
     </cd-details-card>
   </ng-container>
 
@@ -42,10 +40,11 @@
 </ng-template>
 
 <ng-template #customTableItemTemplate
-             let-value="data.value">
+             let-value="data.value"
+             let-row="data.row">
   <a cdsLink
-     [routerLink]="[viewUrl, value | encodeUri]"
-     (click)="$event.stopPropagation()">
+     href="#"
+     (click)="onNameClick(row, $event)">
     {{ value }}
   </a>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
index 71694a4ab86..a5f8a62aac9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
@@ -4,7 +4,3 @@ cd-details-card {
   display: block;
   margin-bottom: layout.$spacing-05;
 }
-
-.table-actions {
-  margin-top: layout.$spacing-03;
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index b89d8bc9a51..9b00fff7533 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -76,6 +76,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   gatewayCount = 0;
   selectedGatewayDetails: DetailItem[] = [];
   private lastGroupCount = 0;
+  showDetailsCard = false;
 
   viewUrl = `/${BASE_URL}/view`;
   icons = Icons;
@@ -129,14 +130,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
     };
 
-    const editAction: CdTableAction = {
-      permission: 'update',
-      icon: Icons.edit,
-      routerLink: () => this.urlBuilder.getEdit(this.selection.first()?.name),
-      name: this.actionLabels.EDIT,
-      canBePrimary: (selection: CdTableSelection) => selection.hasSingleSelection
-    };
-
     const viewAction: CdTableAction = {
       permission: 'read',
       icon: Icons.eye,
@@ -153,7 +146,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       canBePrimary: (selection: CdTableSelection) => selection.hasMultiSelection
     };
 
-    this.tableActions = [createAction, editAction, viewAction, deleteAction];
+    this.tableActions = [createAction, viewAction, deleteAction];
 
     this.gatewayGroup$ = this.subject.pipe(
       switchMap(() =>
@@ -217,6 +210,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   updateSelection(selection: CdTableSelection): void {
     this.selection = selection;
     this.selectedGatewayDetails = this.buildGatewayDetails(selection.first());
+    this.showDetailsCard = false;
   }
 
   deleteGatewayGroupModal() {
@@ -275,6 +269,11 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
           })
           .pipe(
             tap({
+              next: () => {
+                this.table.data = this.table.data.filter(
+                  (row: CephServiceSpec) => row.spec?.group !== selectedGroup.spec.group
+                );
+              },
               complete: () => {
                 this.nvmeofStateService.requestRefresh();
               }
@@ -292,6 +291,14 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     });
   }
 
+  onNameClick(row: any, event?: Event): void {
+    event?.preventDefault();
+    event?.stopPropagation();
+    this.selection = new CdTableSelection([row]);
+    this.selectedGatewayDetails = this.buildGatewayDetails(row);
+    this.showDetailsCard = true;
+  }
+
   private checkNodesAvailability(): void {
     forkJoin([this.nvmeofService.listGatewayGroups(), this.hostService.getAllHosts()]).subscribe(
       ([groups, hosts]: [GatewayGroup[][], any[]]) => {
@@ -335,14 +342,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     this.router.navigate([this.viewUrl, groupName]);
   }
 
-  editSelectedGatewayGroup(): void {
-    const selectedGroup = this.selection.first();
-    if (!selectedGroup) {
-      return;
-    }
-    this.router.navigate([this.urlBuilder.getEdit(selectedGroup.name)]);
-  }
-
   private buildGatewayDetails(selectedGroup: any): DetailItem[] {
     if (!selectedGroup) {
       return [];
@@ -368,7 +367,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       },
       {
         label: $localize`mTLS`,
-        value: selectedGroup.spec?.enable_mtls ? $localize`Enabled` : $localize`Disabled`,
+        value: selectedGroup.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
         type: 'status'
       }
     ];
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
index 7e420bfe86e..0a97671fa3b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
@@ -1,8 +1,7 @@
 <div class="content-theme">
   @if (mode === 'details' && groupName) {
-  <cd-details-card cardTitle="Details" i18n-cardTitle 
-                   [details]="gatewayDetails" 
-                   class="cds-mb-5">
+  <cd-details-card cardTitle="Details" i18n-cardTitle [details]="gatewayDetails" [showEditButton]="false"
+    class="cds-mb-5">
   </cd-details-card>
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
index b0595304e74..98e7190faf2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
@@ -380,9 +380,9 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
       },
       {
         label: $localize`mTLS`,
-        value: $localize`Disabled`,
+        value: serviceSpec.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
         type: 'status',
-        statusIcon: 'error'
+        statusIcon: serviceSpec.spec?.enable_auth ? 'success' : 'error'
       }
     ];
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index bdac48c78b2..8cd803d79aa 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -50,49 +50,40 @@
 
         </div>
       </div>
-      
-      <!-- CDS Checkbox -->
+      <!-- Pool -->
       <div cdsRow
            class="form-item">
         <div cdsCol>
-          <cds-checkbox id="enableCds"
-                        formControlName="enableEncryption"
-                        i18n>Enable encryption
-          </cds-checkbox>
-        </div>
-      </div>
-
-      <!-- Encryption Configuration (shown when checkbox is checked) -->
-      @if (groupForm.controls.enableEncryption.value) {
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-textarea-label
-            labelInputID="encryptionConfig"
-            helperText="Provide the encryption configuration details."
-            cdRequiredField="Encryption configuration"
-            i18n
+          <cds-select
+            label="Block pool"
+            helperText="An RBD application-enabled pool in which the gateway configuration can be managed."
+            labelInputID="pool"
+            id="pool"
+            formControlName="pool"
+            cdRequiredField="Block pool"
+            [invalid]="groupForm.controls.pool.invalid && groupForm.controls.pool.dirty"
+            [invalidText]="poolError"
+            i18n-label
             i18n-helperText
-            [invalid]="encryptionConfigRef.isInvalid">Encryption configuration
-            <textarea cdsTextArea
-                      id="encryptionConfig"
-                      cdValidate
-                      #encryptionConfigRef="cdValidate"
-                      [invalid]="encryptionConfigRef.isInvalid"
-                      formControlName="encryptionConfig"
-                      cols="100"
-                      rows="4">
-            </textarea>
-          </cds-textarea-label>
-          <span
-            class="invalid-feedback"
-            *ngIf="groupForm.showError('encryptionConfig', formDir, 'required')"
-            i18n>This field is required.</span>
+          >
+            <option *ngIf="poolsLoading"
+                    [ngValue]="null"
+                    i18n>Loading...</option>
+            <option *ngIf="!poolsLoading && pools.length === 0"
+                    [ngValue]="null"
+                    i18n>-- No block pools available --</option>
+            <option *ngFor="let pool of pools"
+                    [value]="pool.pool_name">{{ pool.pool_name }}</option>
+          </cds-select>
+          <ng-template #poolError>
+            <span class="invalid-feedback"
+                  *ngIf="groupForm.showError('pool', formDir, 'required')"
+                  i18n>This field is required.</span>
+          </ng-template>
         </div>
       </div>
-      }
-      <!-- Target Nodes Selection -->
-      <div
+        <!-- Target Nodes Selection -->
+        <div
         cdsRow
         class="form-item"
       >
@@ -113,14 +104,387 @@
         ></cd-nvmeof-gateway-node>
       </div>
       </div>
+      <div cdsRow class="form-item cds-mb-0">
+        <div cdsCol>
+          <cds-tile [cdsLayer]="1">
+            <!-- Encryption -->
+            <div cdsRow class="form-item">
+              <div cdsCol>
+                <div [cdsStack]="'horizontal'" 
+                      gap="1" 
+                      alignment="center">
+                  <label class="cds--type-label-01" 
+                         i18n>Enable encryption</label>
+                  <cds-tag type="green"
+                           size="sm"
+                           i18n>Recommended</cds-tag>
+                </div>
+                <cds-checkbox id="enableEncryption" 
+                              formControlName="enableEncryption">
+                  <span
+                  class="cds--type-body-01"
+                  i18n>Secures group metadata and unlocks advanced authentication features.</span>
+                </cds-checkbox>
+              </div>
+            </div>
 
-      <div cdsRow>
+        @if (!groupForm.controls.enableEncryption.value) {
+        <div cdsRow 
+             class="cds-mt-2">
+          <div cdsCol>
+            <cd-alert-panel type="warning"
+                            spacingClass="mb-0"
+                            i18n>
+             <span class="cds--type-heading-01">Encryption is required if you plan to use DH-CHAP or mTLS authentication.</span> 
+            </cd-alert-panel>
+          </div>
+        </div>
+        }
+
+            @if (groupForm.controls.enableEncryption.value) {
+            <div cdsRow class="form-item">
+              <div cdsCol>
+                <cds-textarea-label
+                  labelInputID="encryptionKey"
+                  helperText="Provide the encryption key used for securing the gateway group."
+                  i18n
+                  i18n-helperText>
+                  Encryption key
+                  <textarea
+                    cdsTextArea
+                    id="encryptionKey"
+                    formControlName="encryptionKey"
+                    rows="4"
+                    cols="100">
+                  </textarea>
+                </cds-textarea-label>
+                <span
+                  class="invalid-feedback"
+                  *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
+                  i18n>This field is required.</span>
+              </div>
+            </div>
+            }
+          </cds-tile>
+
+          <cds-tile [cdsLayer]="1"
+                    class="cds-mt-3">
+            <div cdsRow class="form-item">
+              <div cdsCol>
+                <div [cdsStack]="'horizontal'" gap="1" alignment="center" class="cds-mb-3">
+                  <label class="cds--type-label-01" i18n>Enable Mutual TLS (mTLS)</label>
+                </div>
+                <cds-checkbox id="enableMtls" formControlName="enableMtls">
+                  <span
+                  class="cds--type-body-01"
+                  i18n>Use mutual TLS (mTLS) to encrypt control and monitoring commands exchanged with NVMe-oF gateways.</span>
+                </cds-checkbox>
+              </div>
+            </div>
+
+            @if (!groupForm.controls.enableMtls.value) {
+            <div cdsRow class="cds-mt-3">
+              <div cdsCol>
+                <cd-alert-panel type="warning"
+                                spacingClass="mb-0"
+                                class="cds--type-heading-01"
+                                i18n>
+                  Disabling mTLS leaves gateway control and monitoring communication unencrypted.
+                </cd-alert-panel>
+              </div>
+            </div>
+            }
+
+            @if (groupForm.controls.enableMtls.value) {
+            <div cdsRow class="form-item">
+              <div cdsCol>
+                <label class="cds--label fw-bold" 
+                i18n>Choose Certificate Authority</label>
+                <cds-radio-group
+                  formControlName="certificateType"
+                  orientation="horizontal"
+                  helperText="Select how certificates will be signed for this service. Choose internal to use the cluster's CA, or external to upload certificates signed by your organization."
+                  i18n-helperText>
+                  <cds-radio
+                    value="internal"
+                    [checked]="groupForm.controls.certificateType.value === CertificateType.internal"
+                    (change)="onCertificateTypeChange(CertificateType.internal)"
+                    i18n>
+                    Internal
+                  </cds-radio>
+                  <cds-radio
+                    value="external"
+                    [checked]="groupForm.controls.certificateType.value === CertificateType.external"
+                    (change)="onCertificateTypeChange(CertificateType.external)"
+                    i18n>
+                    External
+                  </cds-radio>
+                </cds-radio-group>
+              </div>
+            </div>
+            }
+          </cds-tile>
+        </div>
+      </div>
+
+      @if (groupForm.controls.enableMtls.value && groupForm.controls.certificateType.value === CertificateType.internal) {
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cd-alert-panel type="info"
+                          spacingClass="mb-3"
+                          i18n>
+            Certificate will be generated automatically by Cephadm CA for internal certificate type.
+          </cd-alert-panel>
+          <cd-text-label-list formControlName="custom_sans"
+                              label="Custom SAN Entries"
+                              i18n-label
+                              helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
+                              i18n-helperText>
+          </cd-text-label-list>
+        </div>
+      </div>
+      }
+
+      @if (groupForm.controls.enableMtls.value && groupForm.controls.certificateType.value === CertificateType.external) {
+      <!-- Root CA Certificate Input -->
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cds-text-label
+            labelInputID="rootCACert"
+            i18n
+            i18n-helperText
+            helperText="Upload a Root CA certificate file, or paste the Root CA certificate PEM content directly.">
+            Root CA Certificate Input
+          </cds-text-label>
+          <div class="cds-mb-2">
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="rootCAFileInput.click()"
+              i18n>
+              Upload File
+            </button>
+            <input
+              #rootCAFileInput
+              type="file"
+              accept=".pem,.crt,.cer"
+              style="display: none"
+              (change)="onFileUpload($event, 'rootCACert')"
+            />
+          </div>
+          <cds-textarea-label
+            labelInputID="rootCACertText"
+            helperText="Uploaded files will populate the Root CA certificate details automatically. Or paste the PEM content directly in the text area."
+            i18n-helperText>
+            <textarea cdsTextArea
+                      id="rootCACertText"
+                      formControlName="rootCACert"
+                      placeholder="Paste certificate or private key PEM content"
+                      i18n-placeholder
+                      cols="100"
+                      rows="4">
+            </textarea>
+          </cds-textarea-label>
+          <span class="invalid-feedback"
+                *ngIf="groupForm.showError('rootCACert', formDir, 'required')"
+                i18n>This field is required.</span>
+        </div>
+      </div>
+
+      <!-- Client Certificate Input -->
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cds-text-label
+            labelInputID="clientCert"
+            i18n
+            i18n-helperText
+            helperText="Upload a client certificate file, or paste the client certificate PEM content directly.">
+            Client Certificate Input
+          </cds-text-label>
+          <div class="cds-mb-2">
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="clientCertFileInput.click()"
+              i18n>
+              Upload File
+            </button>
+            <input
+              #clientCertFileInput
+              type="file"
+              accept=".pem,.crt,.cer"
+              style="display: none"
+              (change)="onFileUpload($event, 'clientCert')"
+            />
+          </div>
+          <cds-textarea-label
+            labelInputID="clientCertText"
+            helperText="Uploaded files will populate the client certificate details automatically. Or paste the PEM content directly in the text area."
+            i18n-helperText>
+            <textarea cdsTextArea
+                      id="clientCertText"
+                      formControlName="clientCert"
+                      placeholder="Paste certificate or private key PEM content"
+                      i18n-placeholder
+                      cols="100"
+                      rows="4">
+            </textarea>
+          </cds-textarea-label>
+          <span class="invalid-feedback"
+                *ngIf="groupForm.showError('clientCert', formDir, 'required')"
+                i18n>This field is required.</span>
+        </div>
+      </div>
+
+      <!-- Client Key Input -->
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cds-text-label
+            labelInputID="clientKey"
+            i18n
+            i18n-helperText
+            helperText="Upload a client key file, or paste the client key PEM content directly.">
+            Client Key Input
+          </cds-text-label>
+          <div class="cds-mb-2">
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="clientKeyFileInput.click()"
+              i18n>
+              Upload File
+            </button>
+            <input
+              #clientKeyFileInput
+              type="file"
+              accept=".pem,.key"
+              style="display: none"
+              (change)="onFileUpload($event, 'clientKey')"
+            />
+          </div>
+          <cds-textarea-label
+            labelInputID="clientKeyText"
+            helperText="Uploaded files will populate the client key details automatically. Or paste the PEM content directly in the text area."
+            i18n-helperText>
+            <textarea cdsTextArea
+                      id="clientKeyText"
+                      formControlName="clientKey"
+                      placeholder="Paste certificate or private key PEM content"
+                      i18n-placeholder
+                      cols="100"
+                      rows="4">
+            </textarea>
+          </cds-textarea-label>
+          <span class="invalid-feedback"
+                *ngIf="groupForm.showError('clientKey', formDir, 'required')"
+                i18n>This field is required.</span>
+        </div>
+      </div>
+
+      <!-- Server Certificate Input -->
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cds-text-label
+            labelInputID="serverCert"
+            i18n
+            i18n-helperText
+            helperText="Upload a server certificate file, or paste the server certificate PEM content directly.">
+            Server Certificate Input
+          </cds-text-label>
+          <div class="cds-mb-2">
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="serverCertFileInput.click()"
+              i18n>
+              Upload File
+            </button>
+            <input
+              #serverCertFileInput
+              type="file"
+              accept=".pem,.crt,.cer"
+              style="display: none"
+              (change)="onFileUpload($event, 'serverCert')"
+            />
+          </div>
+          <cds-textarea-label
+            labelInputID="serverCertText"
+            helperText="Uploaded files will populate the server certificate details automatically. Or paste the PEM content directly in the text area."
+            i18n-helperText>
+            <textarea cdsTextArea
+                      id="serverCertText"
+                      formControlName="serverCert"
+                      placeholder="Paste certificate or private key PEM content"
+                      i18n-placeholder
+                      cols="100"
+                      rows="4">
+            </textarea>
+          </cds-textarea-label>
+          <span class="invalid-feedback"
+                *ngIf="groupForm.showError('serverCert', formDir, 'required')"
+                i18n>This field is required.</span>
+        </div>
+      </div>
+
+      <!-- Server Key Input -->
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cds-text-label
+            labelInputID="serverKey"
+            i18n
+            i18n-helperText
+            helperText="Upload a server key file, or paste the server key PEM content directly.">
+            Server Key Input
+          </cds-text-label>
+          <div class="cds-mb-2">
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="serverKeyFileInput.click()"
+              i18n>
+              Upload File
+            </button>
+            <input
+              #serverKeyFileInput
+              type="file"
+              accept=".pem,.key"
+              style="display: none"
+              (change)="onFileUpload($event, 'serverKey')"
+            />
+          </div>
+          <cds-textarea-label
+            labelInputID="serverKeyText"
+            helperText="Uploaded files will populate the server key details automatically. Or paste the PEM content directly in the text area."
+            i18n-helperText>
+            <textarea cdsTextArea
+                      id="serverKeyText"
+                      formControlName="serverKey"
+                      placeholder="Paste certificate or private key PEM content"
+                      i18n-placeholder
+                      cols="100"
+                      rows="4">
+            </textarea>
+          </cds-textarea-label>
+          <span class="invalid-feedback"
+                *ngIf="groupForm.showError('serverKey', formDir, 'required')"
+                i18n>This field is required.</span>
+        </div>
+      </div>
+      }
+
+      <div cdsRow class="cds-mt-5">
         <cd-form-button-panel
           (submitActionEvent)="onSubmit()"
           [form]="groupForm"
           [submitText]="(action | titlecase) + ' ' + (resource)"
           [disabled]="isCreateDisabled"
-          wrappingClass="text-right form-button"
+          wrappingClass="text-right"
         >
         </cd-form-button-panel>
       </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
index 5b60872cd1b..640d7a7d0bc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
@@ -65,6 +65,7 @@ describe('NvmeofGroupFormComponent', () => {
     expect(form.controls.groupName.value).toBeNull();
     expect(form.controls.unmanaged.value).toBe(false);
     expect(form.controls.enableEncryption.value).toBe(false);
+    expect(form.controls.certificateType.value).toBe('internal');
   });
 
   it('should set action to CREATE on init', () => {
@@ -169,6 +170,69 @@ describe('NvmeofGroupFormComponent', () => {
       );
     });
 
+    it('should create service with cephadm-signed mTLS when internal selected', () => {
+      component.gatewayNodeComponent = {
+        getSelectedHosts: (): any[] => [{ hostname: 'host1' }],
+        getSelectedHostnames: (): string[] => ['host1']
+      } as any;
+
+      component.groupForm.get('groupName').setValue('mtls-internal');
+      component.groupForm.get('pool').setValue('rbd');
+      component.groupForm.get('enableEncryption').setValue(true);
+      component.groupForm.get('encryptionKey').setValue('test-encryption-key');
+      component.groupForm.get('enableMtls').setValue(true);
+      component.groupForm.get('certificateType').setValue(component.CertificateType.internal);
+      component.groupForm.get('custom_sans').setValue(['gw1.local', '192.168.0.10']);
+
+      component.onSubmit();
+
+      expect(cephServiceService.create).toHaveBeenCalledWith(
+        jasmine.objectContaining({
+          service_type: 'nvmeof',
+          service_id: 'rbd.mtls-internal',
+          ssl: true,
+          enable_auth: true,
+          certificate_source: 'cephadm-signed',
+          custom_sans: ['gw1.local', '192.168.0.10']
+        })
+      );
+    });
+
+    it('should create service with inline mTLS when external selected', () => {
+      component.gatewayNodeComponent = {
+        getSelectedHosts: (): any[] => [{ hostname: 'host1' }],
+        getSelectedHostnames: (): string[] => ['host1']
+      } as any;
+
+      component.groupForm.get('groupName').setValue('mtls-external');
+      component.groupForm.get('pool').setValue('rbd');
+      component.groupForm.get('enableEncryption').setValue(true);
+      component.groupForm.get('encryptionKey').setValue('test-encryption-key');
+      component.groupForm.get('enableMtls').setValue(true);
+      component.groupForm.get('certificateType').setValue(component.CertificateType.external);
+      component.groupForm.get('rootCACert').setValue('root');
+      component.groupForm.get('clientCert').setValue('client-cert');
+      component.groupForm.get('clientKey').setValue('client-key');
+      component.groupForm.get('serverCert').setValue('server-cert');
+      component.groupForm.get('serverKey').setValue('server-key');
+
+      component.onSubmit();
+
+      expect(cephServiceService.create).toHaveBeenCalledWith(
+        jasmine.objectContaining({
+          service_id: 'rbd.mtls-external',
+          ssl: true,
+          enable_auth: true,
+          certificate_source: 'inline',
+          root_ca_cert: 'root',
+          client_cert: 'client-cert',
+          client_key: 'client-key',
+          server_cert: 'server-cert',
+          server_key: 'server-key'
+        })
+      );
+    });
+
     it('should navigate to list view on success', () => {
       component.gatewayNodeComponent = {
         getSelectedHosts: (): any[] => [{ hostname: 'host1' }],
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index f55ac8f7357..f27cbec917d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -1,5 +1,6 @@
 import { Component, OnInit, ViewChild } from '@angular/core';
 import { UntypedFormControl, Validators } from '@angular/forms';
+import { ActivatedRoute, Router } from '@angular/router';
 import { ActionLabelsI18n, URLVerbs } from '~/app/shared/constants/app.constants';
 import { CdForm } from '~/app/shared/forms/cd-form';
 import { CdFormGroup } from '~/app/shared/forms/cd-form-group';
@@ -10,10 +11,14 @@ import { NvmeofGatewayNodeComponent } from '../nvmeof-gateway-node/nvmeof-gatewa
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
 import { FinishedTask } from '~/app/shared/models/finished-task';
-import { Router } from '@angular/router';
 import { CdValidators } from '~/app/shared/forms/cd-validators';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 
+enum CertificateType {
+  internal = 'internal',
+  external = 'external'
+}
+
 @Component({
   selector: 'cd-nvmeof-group-form',
   templateUrl: './nvmeof-group-form.component.html',
@@ -30,6 +35,12 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   group: string;
   pageURL: string;
   hasAvailableNodes = true;
+  CertificateType = CertificateType;
+  editing = false;
+  gatewayGroupName = '';
+  existingServiceData: any = null;
+  pools: Array<{ pool_name: string }> = [{ pool_name: 'rbd' }];
+  poolsLoading = false;
 
   constructor(
     private authStorageService: AuthStorageService,
@@ -37,7 +48,8 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     private taskWrapperService: TaskWrapperService,
     private cephServiceService: CephServiceService,
     private nvmeofService: NvmeofService,
-    private router: Router
+    private router: Router,
+    private route: ActivatedRoute
   ) {
     super();
     this.permission = this.authStorageService.getPermissions().nvmeof;
@@ -45,37 +57,155 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   }
 
   ngOnInit() {
-    this.action = this.actionLabels.CREATE;
-    this.createForm();
+    this.route.params.subscribe((params) => {
+      if (params['name']) {
+        this.editing = true;
+        this.gatewayGroupName = params['name'];
+        this.action = this.actionLabels.EDIT;
+        this.createForm();
+        this.loadGatewayGroupData(params['name']);
+      } else {
+        this.editing = false;
+        this.action = this.actionLabels.CREATE;
+        this.gatewayGroupName = '';
+        this.createForm();
+      }
+    });
   }
 
   createForm() {
-    this.groupForm = new CdFormGroup({
-      groupName: new UntypedFormControl(
-        null,
-        [
+    const groupNameValidators = this.editing
+      ? [
           Validators.required,
           (control) => {
             const value = control.value;
             return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
           }
-        ],
-        [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)]
-      ),
+        ]
+      : [
+          Validators.required,
+          (control) => {
+            const value = control.value;
+            return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
+          }
+        ];
+
+    const groupNameAsyncValidators = this.editing
+      ? []
+      : [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)];
+
+    this.groupForm = new CdFormGroup({
+      groupName: new UntypedFormControl(null, groupNameValidators, groupNameAsyncValidators),
+      pool: new UntypedFormControl('rbd', {
+        validators: [Validators.required]
+      }),
       unmanaged: new UntypedFormControl(false),
       enableEncryption: new UntypedFormControl(false),
-      encryptionConfig: new UntypedFormControl(null)
+      enableMtls: new UntypedFormControl(false),
+      encryptionKey: new UntypedFormControl('', [
+        CdValidators.composeIf(
+          {
+            enableEncryption: true
+          },
+          [Validators.required]
+        )
+      ]),
+      certificateType: new UntypedFormControl(CertificateType.internal),
+      custom_sans: new UntypedFormControl([]),
+      rootCACert: new UntypedFormControl(null, [
+        CdValidators.composeIf(
+          {
+            enableEncryption: true,
+            certificateType: 'external'
+          },
+          [Validators.required]
+        )
+      ]),
+      clientCert: new UntypedFormControl(null, [
+        CdValidators.composeIf(
+          {
+            enableEncryption: true,
+            certificateType: 'external'
+          },
+          [Validators.required]
+        )
+      ]),
+      clientKey: new UntypedFormControl(null, [
+        CdValidators.composeIf(
+          {
+            enableEncryption: true,
+            certificateType: 'external'
+          },
+          [Validators.required]
+        )
+      ]),
+      serverCert: new UntypedFormControl(null, [
+        CdValidators.composeIf(
+          {
+            enableEncryption: true,
+            certificateType: 'external'
+          },
+          [Validators.required]
+        )
+      ]),
+      serverKey: new UntypedFormControl(null, [
+        CdValidators.composeIf(
+          {
+            enableEncryption: true,
+            certificateType: CertificateType.external
+          },
+          [Validators.required]
+        )
+      ])
     });
 
-    this.groupForm.get('enableEncryption')?.valueChanges.subscribe((enabled) => {
-      const encryptionControl = this.groupForm.get('encryptionConfig');
-      if (enabled) {
-        encryptionControl?.setValidators([Validators.required]);
-      } else {
-        encryptionControl?.clearValidators();
+    // Disable group name field in edit mode
+    if (this.editing) {
+      this.groupForm.get('groupName')?.disable();
+    }
+  }
+
+  loadGatewayGroupData(groupName: string) {
+    this.nvmeofService.listGatewayGroups().subscribe(
+      (gatewayGroups: any) => {
+        const groups = gatewayGroups?.[0] ?? [];
+        const group = groups.find((g: any) => g.spec?.group === groupName);
+
+        if (group) {
+          this.existingServiceData = group;
+          const spec = group.spec || {};
+
+          // Prefill form with existing data
+          this.groupForm.patchValue({
+            groupName: groupName,
+            pool: spec.pool || 'rbd',
+            unmanaged: spec.unmanaged || false,
+            enableEncryption: spec.ssl || false,
+            enableMtls: spec.ssl || false,
+            certificateType:
+              spec.certificate_source === 'inline'
+                ? CertificateType.external
+                : CertificateType.internal,
+            encryptionKey: spec.encryption_key || '',
+            custom_sans: spec.custom_sans || []
+          });
+
+          // If external certificates, load them
+          if (spec.certificate_source === 'inline') {
+            this.groupForm.patchValue({
+              rootCACert: spec.root_ca_cert || null,
+              clientCert: spec.client_cert || null,
+              clientKey: spec.client_key || null,
+              serverCert: spec.server_cert || null,
+              serverKey: spec.server_key || null
+            });
+          }
+        }
+      },
+      (_error) => {
+        // Error loading gateway group data
       }
-      encryptionControl?.updateValueAndValidity();
-    });
+    );
   }
 
   onHostsLoaded(count: number): void {
@@ -119,35 +249,59 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       return;
     }
 
-    const formValues = this.groupForm.value;
+    const formValues = this.groupForm.getRawValue(); // Use getRawValue to get disabled fields too
     const selectedHostnames = this.gatewayNodeComponent?.getSelectedHostnames() || [];
     if (selectedHostnames.length === 0) {
       this.groupForm.setErrors({ cdSubmitButton: true });
       return;
     }
-    let taskUrl = `service/${URLVerbs.CREATE}`;
-    const serviceName = `${formValues.groupName}`;
+
+    const groupName = this.editing ? this.gatewayGroupName : formValues.groupName;
+    const pool = formValues.pool;
+    const serviceName = `${pool}.${groupName}`;
+
+    let taskUrl = this.editing ? `service/${URLVerbs.EDIT}` : `service/${URLVerbs.CREATE}`;
 
     const serviceSpec: Record<string, any> = {
       service_type: 'nvmeof',
       service_id: serviceName,
-      group: formValues.groupName,
+      pool: pool,
+      group: groupName,
       placement: {
         hosts: selectedHostnames
       },
       unmanaged: formValues.unmanaged
     };
 
-    if (formValues.enableEncryption && formValues.encryptionConfig) {
-      serviceSpec['encryption_key'] = formValues.encryptionConfig;
+    if (formValues.enableMtls) {
+      serviceSpec['ssl'] = true;
+      serviceSpec['enable_auth'] = true;
+      serviceSpec['certificate_source'] =
+        formValues.certificateType === CertificateType.internal ? 'cephadm-signed' : 'inline';
+
+      if (formValues.certificateType === CertificateType.internal) {
+        if (formValues.custom_sans && formValues.custom_sans.length > 0) {
+          serviceSpec['custom_sans'] = formValues.custom_sans;
+        }
+      } else {
+        serviceSpec['root_ca_cert'] = formValues.rootCACert;
+        serviceSpec['client_cert'] = formValues.clientCert;
+        serviceSpec['client_key'] = formValues.clientKey;
+        serviceSpec['server_cert'] = formValues.serverCert;
+        serviceSpec['server_key'] = formValues.serverKey;
+      }
     }
 
+    const apiCall = this.editing
+      ? this.cephServiceService.update(serviceSpec)
+      : this.cephServiceService.create(serviceSpec);
+
     this.taskWrapperService
       .wrapTaskAroundCall({
         task: new FinishedTask(taskUrl, {
           service_name: `nvmeof.${serviceName}`
         }),
-        call: this.cephServiceService.create(serviceSpec)
+        call: apiCall
       })
       .subscribe({
         complete: () => {
@@ -162,4 +316,32 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   private goToListView() {
     this.router.navigateByUrl('/block/nvmeof/gateways');
   }
+
+  onFileUpload(event: any, controlName: string) {
+    const file = event.target.files[0];
+    if (file) {
+      const reader = new FileReader();
+      reader.onload = (e: any) => {
+        this.groupForm.get(controlName)?.setValue(e.target.result);
+      };
+      reader.readAsText(file);
+    }
+  }
+
+  onCertificateTypeChange(type: CertificateType) {
+    this.groupForm.get('certificateType')?.setValue(type);
+    if (type === CertificateType.internal) {
+      this.groupForm.patchValue({
+        rootCACert: null,
+        clientCert: null,
+        clientKey: null,
+        serverCert: null,
+        serverKey: null
+      });
+    } else {
+      this.groupForm.patchValue({
+        custom_sans: []
+      });
+    }
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
index 294dd0ad5f2..91a5cbced6a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
@@ -138,7 +138,6 @@ import { TearsheetStepComponent } from './tearsheet-step/tearsheet-step.componen
 import { PageHeaderComponent } from './page-header/page-header.component';
 import { SidebarLayoutComponent } from './sidebar-layout/sidebar-layout.component';
 import { NumberWithUnitComponent } from './number-with-unit/number-with-unit.component';
-import { ProductiveCardComponent } from './productive-card/productive-card.component';
 
 @NgModule({
   imports: [
@@ -187,8 +186,7 @@ import { ProductiveCardComponent } from './productive-card/productive-card.compo
     TagModule,
     LinkModule,
     LayerModule,
-    ThemeModule,
-    ProductiveCardComponent
+    ThemeModule
   ],
   declarations: [
     SparklineComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index d60b1f3b345..b1595fbcdf2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -17,11 +17,14 @@
     }
   </ng-template>
 
-  <div [cdsStack]="'vertical'" [gap]="0">
+  <div [cdsStack]="'vertical'" 
+       [gap]="0">
     @if (details && details.length > 0) {
-    <div [cdsStack]="'horizontal'" [gap]="6">
+    <div [cdsStack]="'horizontal'"
+         [gap]="5">
       @for (detail of getVisibleDetails(); track detail.label) {
-      <div [cdsStack]="'vertical'" [gap]="2">
+      <div [cdsStack]="'vertical'" 
+           [gap]="2">
         <label class="cds--type-label-01">{{ detail.label }}</label>
         <div class="cds--type-body-01">
           @switch (detail.type) {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
index 7cfed7235e0..9b2fad7afb8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
@@ -43,9 +43,6 @@ export class DetailsCardComponent {
   onEditClick(): void {
     this.editClicked.emit();
   }
-  
-  @Input()
-  columns = 4;
 
   getVisibleDetails(): DetailItem[] {
     return (this.details || []).filter((detail) => !detail.hidden);

From c3efbebd047f83f9fa7cfa968d212eca1b6930d6 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Fri, 26 Jun 2026 00:42:45 +0530
Subject: [PATCH 538/596] mgr/dashboard: Implement support for editing existing
 nvme-oF gateway groups through UI

Fixes: https://tracker.ceph.com/issues/77386

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../src/app/ceph/block/block.module.ts        |  16 +-
 .../nvmeof-gateway-group.component.html       |  15 +-
 .../nvmeof-gateway-group.component.ts         |  45 +--
 ...meof-gateway-node-add-modal.component.html |   0
 ...meof-gateway-node-add-modal.component.scss |   0
 ...f-gateway-node-add-modal.component.spec.ts |   0
 ...nvmeof-gateway-node-add-modal.component.ts |   0
 .../nvmeof-gateway-node.component.ts          |  84 +++++-
 .../nvmeof-group-form.component.html          |  73 ++---
 .../nvmeof-group-form.component.ts            | 275 +++++-------------
 .../nvmeof-subsystem-step-1.component.html    |   4 +-
 .../service-form/service-form.component.html  |  12 +-
 .../service-form.component.spec.ts            |   3 +-
 .../service-form/service-form.component.ts    |  29 ++
 .../src/app/shared/constants/app.constants.ts |   2 +
 .../app/shared/models/service.interface.ts    |   1 +
 16 files changed, 266 insertions(+), 293 deletions(-)
 delete mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
 delete mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
 delete mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.spec.ts
 delete mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index 7dbdfbbd518..368a7de95b7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -10,7 +10,6 @@ import { ActionLabels, URLVerbs } from '~/app/shared/constants/app.constants';
 import { FeatureTogglesGuardService } from '~/app/shared/services/feature-toggles-guard.service';
 import { ModuleStatusGuardService } from '~/app/shared/services/module-status-guard.service';
 import { SharedModule } from '~/app/shared/shared.module';
-import { TextLabelListComponent } from '~/app/shared/components/text-label-list/text-label-list.component';
 import { IscsiSettingComponent } from './iscsi-setting/iscsi-setting.component';
 import { IscsiTabsComponent } from './iscsi-tabs/iscsi-tabs.component';
 import { IscsiTargetDetailsComponent } from './iscsi-target-details/iscsi-target-details.component';
@@ -148,9 +147,7 @@ import { NvmeofGatewayGroupFilterComponent } from './nvmeof-gateway-group-filter
     LayoutModule,
     ThemeModule,
     NvmeofSetupCardsComponent,
-    NvmeofGatewayGroupFilterComponent,
-    TextLabelListComponent
-    // ProductiveCardComponent
+    NvmeofGatewayGroupFilterComponent
   ],
   declarations: [
     RbdListComponent,
@@ -381,17 +378,6 @@ const routes: Routes = [
               }
             }
           },
-          {
-            path: `${URLVerbs.EDIT}/:name`,
-            component: NvmeofGroupFormComponent,
-            data: {
-              breadcrumbs: ActionLabels.EDIT,
-              pageHeader: {
-                title: $localize`Edit Gateway Group`,
-                description: $localize`Modify gateway group configuration.`
-              }
-            }
-          },
           {
             path: `${URLVerbs.VIEW}/:group`,
             component: NvmeGatewayViewComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 435410a6aca..926e3267883 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,15 +1,4 @@
 <ng-container *ngIf="gatewayGroup$ | async as gateways">
-  <!-- Details Card Section -->
-  <ng-container *ngIf="selection.hasSelection && showDetailsCard">
-    <cd-details-card
-      cardTitle="Details"
-      i18n-cardTitle
-      [details]="selectedGatewayDetails"
-      [showEditButton]="false"
-      [columns]="4">
-    </cd-details-card>
-  </ng-container>
-
   <cd-table
     #table
     [data]="gateways"
@@ -43,8 +32,8 @@
              let-value="data.value"
              let-row="data.row">
   <a cdsLink
-     href="#"
-     (click)="onNameClick(row, $event)">
+     [routerLink]="[viewUrl, value]"
+     (click)="$event.stopPropagation()">
     {{ value }}
   </a>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index 9b00fff7533..4ca09129451 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -76,7 +76,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   gatewayCount = 0;
   selectedGatewayDetails: DetailItem[] = [];
   private lastGroupCount = 0;
-  showDetailsCard = false;
 
   viewUrl = `/${BASE_URL}/view`;
   icons = Icons;
@@ -130,6 +129,14 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       canBePrimary: (selection: CdTableSelection) => !selection.hasSelection
     };
 
+    const editAction: CdTableAction = {
+      permission: 'update',
+      icon: Icons.edit,
+      routerLink: () => this.urlBuilder.getEdit(this.selection.first()?.name),
+      name: this.actionLabels.EDIT,
+      canBePrimary: (selection: CdTableSelection) => selection.hasSingleSelection
+    };
+
     const viewAction: CdTableAction = {
       permission: 'read',
       icon: Icons.eye,
@@ -146,7 +153,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       canBePrimary: (selection: CdTableSelection) => selection.hasMultiSelection
     };
 
-    this.tableActions = [createAction, viewAction, deleteAction];
+    this.tableActions = [createAction, editAction, viewAction, deleteAction];
 
     this.gatewayGroup$ = this.subject.pipe(
       switchMap(() =>
@@ -210,7 +217,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   updateSelection(selection: CdTableSelection): void {
     this.selection = selection;
     this.selectedGatewayDetails = this.buildGatewayDetails(selection.first());
-    this.showDetailsCard = false;
   }
 
   deleteGatewayGroupModal() {
@@ -269,11 +275,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
           })
           .pipe(
             tap({
-              next: () => {
-                this.table.data = this.table.data.filter(
-                  (row: CephServiceSpec) => row.spec?.group !== selectedGroup.spec.group
-                );
-              },
               complete: () => {
                 this.nvmeofStateService.requestRefresh();
               }
@@ -291,14 +292,6 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     });
   }
 
-  onNameClick(row: any, event?: Event): void {
-    event?.preventDefault();
-    event?.stopPropagation();
-    this.selection = new CdTableSelection([row]);
-    this.selectedGatewayDetails = this.buildGatewayDetails(row);
-    this.showDetailsCard = true;
-  }
-
   private checkNodesAvailability(): void {
     forkJoin([this.nvmeofService.listGatewayGroups(), this.hostService.getAllHosts()]).subscribe(
       ([groups, hosts]: [GatewayGroup[][], any[]]) => {
@@ -342,6 +335,19 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     this.router.navigate([this.viewUrl, groupName]);
   }
 
+  ngOnDestroy(): void {
+    this.destroy$.next();
+    this.destroy$.complete();
+  }
+
+  editSelectedGatewayGroup(): void {
+    const selectedGroup = this.selection.first();
+    if (!selectedGroup) {
+      return;
+    }
+    this.router.navigate([this.urlBuilder.getEdit(selectedGroup.name)]);
+  }
+
   private buildGatewayDetails(selectedGroup: any): DetailItem[] {
     if (!selectedGroup) {
       return [];
@@ -367,14 +373,9 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       },
       {
         label: $localize`mTLS`,
-        value: selectedGroup.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
+        value: selectedGroup.spec?.enable_mtls ? $localize`Enabled` : $localize`Disabled`,
         type: 'status'
       }
     ];
   }
-
-  ngOnDestroy(): void {
-    this.destroy$.next();
-    this.destroy$.complete();
-  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.scss
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.spec.ts
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.ts
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
index 98e7190faf2..89fe4865356 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
@@ -2,9 +2,11 @@ import {
   Component,
   EventEmitter,
   Input,
+  OnChanges,
   OnDestroy,
   OnInit,
   Output,
+  SimpleChanges,
   TemplateRef,
   ViewChild
 } from '@angular/core';
@@ -46,7 +48,7 @@ import { DetailItem } from '~/app/shared/components/details-card/details-card.co
   styleUrls: ['./nvmeof-gateway-node.component.scss'],
   standalone: false
 })
-export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
+export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy, OnChanges {
   @ViewChild(TableComponent, { static: true })
   table!: TableComponent;
 
@@ -67,6 +69,7 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
 
   @Input() groupName: string | undefined;
   @Input() mode: 'selector' | 'details' = NvmeofGatewayNodeMode.SELECTOR;
+  @Input() preSelectedHostnames: string[] = [];
 
   usedHostnames: Set<string> = new Set();
   serviceSpec: CephServiceSpec | undefined;
@@ -144,6 +147,43 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
     ];
   }
 
+  ngOnChanges(changes: SimpleChanges): void {
+    if (
+      changes['preSelectedHostnames'] &&
+      !changes['preSelectedHostnames'].firstChange &&
+      changes['preSelectedHostnames'].currentValue?.length > 0
+    ) {
+      this.table.refreshBtn();
+    }
+  }
+
+  private applyPreSelection(): void {
+    if (!this.preSelectedHostnames?.length || !this.table) {
+      return;
+    }
+
+    const hostsToSelect = this.hosts.filter((host) =>
+      this.preSelectedHostnames.includes(host.hostname)
+    );
+
+    if (hostsToSelect.length > 0) {
+      this.selection.selected = hostsToSelect;
+      this.selectionChange.emit(this.selection);
+
+      setTimeout(() => {
+        hostsToSelect.forEach((host) => {
+          const rowIndex = this.table.model?.data?.findIndex(
+            (row: any) => _.get(row, [0, 'selected', 'hostname']) === host.hostname
+          );
+          if (rowIndex > -1) {
+            this.table.model.selectRow(rowIndex, true);
+          }
+        });
+        this.table.updateSelection.emit(this.selection);
+      });
+    }
+  }
+
   private setTableActions() {
     this.tableActions = [
       {
@@ -273,8 +313,11 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
       this.sub.unsubscribe();
     }
 
+    const useEditMode =
+      this.mode === NvmeofGatewayNodeMode.SELECTOR && this.preSelectedHostnames?.length > 0;
+
     const fetchData$: Observable<any> =
-      this.mode === NvmeofGatewayNodeMode.DETAILS
+      this.mode === NvmeofGatewayNodeMode.DETAILS || useEditMode
         ? this.nvmeofService.fetchHostsAndGroups()
         : this.nvmeofService.getAvailableHosts(this.tableContext?.toParams());
 
@@ -288,6 +331,8 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
         next: (result: any) => {
           if (this.mode === NvmeofGatewayNodeMode.DETAILS) {
             this.processDetailsData(result.groups, result.hosts);
+          } else if (useEditMode) {
+            this.processEditModeData(result.groups, result.hosts);
           } else {
             this.hosts = result;
             this.count = this.hosts.length;
@@ -298,6 +343,41 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy {
       });
   }
 
+  private processEditModeData(groups: any[][], hostList: Host[]) {
+    const groupList = groups?.[0] ?? [];
+    const preSelectedSet = new Set(this.preSelectedHostnames);
+
+    const usedByOtherGroups = new Set<string>();
+    groupList.forEach((group: CephServiceSpec) => {
+      const hosts = group.placement?.hosts || [];
+      const isCurrentGroup =
+        hosts.every((h: string) => preSelectedSet.has(h)) && hosts.length === preSelectedSet.size;
+
+      if (!isCurrentGroup) {
+        hosts.forEach((hostname: string) => usedByOtherGroups.add(hostname));
+
+        const label = group.placement?.label;
+        if (label) {
+          (hostList || []).forEach((host: Host) => {
+            if (host.labels?.includes(label as string)) {
+              usedByOtherGroups.add(host.hostname);
+            }
+          });
+        }
+      }
+    });
+
+    this.hosts = (hostList || []).filter((host: Host) => {
+      const isPreSelected = preSelectedSet.has(host.hostname);
+      const isAvailable = !usedByOtherGroups.has(host.hostname);
+      return isPreSelected || isAvailable;
+    });
+
+    this.count = this.hosts.length;
+    this.hostsLoaded.emit(this.count);
+    this.applyPreSelection();
+  }
+
   private processDetailsData(groups: any[][], hostList: Host[]) {
     const groupList = groups?.[0] ?? [];
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 8cd803d79aa..7acb2ea574c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -50,40 +50,49 @@
 
         </div>
       </div>
-      <!-- Pool -->
+
+      <!-- CDS Checkbox -->
       <div cdsRow
            class="form-item">
         <div cdsCol>
-          <cds-select
-            label="Block pool"
-            helperText="An RBD application-enabled pool in which the gateway configuration can be managed."
-            labelInputID="pool"
-            id="pool"
-            formControlName="pool"
-            cdRequiredField="Block pool"
-            [invalid]="groupForm.controls.pool.invalid && groupForm.controls.pool.dirty"
-            [invalidText]="poolError"
-            i18n-label
-            i18n-helperText
-          >
-            <option *ngIf="poolsLoading"
-                    [ngValue]="null"
-                    i18n>Loading...</option>
-            <option *ngIf="!poolsLoading && pools.length === 0"
-                    [ngValue]="null"
-                    i18n>-- No block pools available --</option>
-            <option *ngFor="let pool of pools"
-                    [value]="pool.pool_name">{{ pool.pool_name }}</option>
-          </cds-select>
-          <ng-template #poolError>
-            <span class="invalid-feedback"
-                  *ngIf="groupForm.showError('pool', formDir, 'required')"
-                  i18n>This field is required.</span>
-          </ng-template>
+          <cds-checkbox id="enableCds"
+                        formControlName="enableEncryption"
+                        i18n>Enable encryption
+          </cds-checkbox>
         </div>
       </div>
-        <!-- Target Nodes Selection -->
-        <div
+
+      <!-- Encryption Configuration (shown when checkbox is checked) -->
+      @if (groupForm.controls.enableEncryption.value) {
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <cds-textarea-label
+            labelInputID="encryptionConfig"
+            helperText="Provide the encryption configuration details."
+            cdRequiredField="Encryption configuration"
+            i18n
+            i18n-helperText
+            [invalid]="encryptionConfigRef.isInvalid">Encryption configuration
+            <textarea cdsTextArea
+                      id="encryptionConfig"
+                      cdValidate
+                      #encryptionConfigRef="cdValidate"
+                      [invalid]="encryptionConfigRef.isInvalid"
+                      formControlName="encryptionConfig"
+                      cols="100"
+                      rows="4">
+            </textarea>
+          </cds-textarea-label>
+          <span
+            class="invalid-feedback"
+            *ngIf="groupForm.showError('encryptionConfig', formDir, 'required')"
+            i18n>This field is required.</span>
+        </div>
+      </div>
+      }
+      <!-- Target Nodes Selection -->
+      <div
         cdsRow
         class="form-item"
       >
@@ -110,9 +119,7 @@
             <!-- Encryption -->
             <div cdsRow class="form-item">
               <div cdsCol>
-                <div [cdsStack]="'horizontal'" 
-                      gap="1" 
-                      alignment="center">
+                <div class="cds--stack cds--stack-horizontal">
                   <label class="cds--type-label-01" 
                          i18n>Enable encryption</label>
                   <cds-tag type="green"
@@ -171,7 +178,7 @@
                     class="cds-mt-3">
             <div cdsRow class="form-item">
               <div cdsCol>
-                <div [cdsStack]="'horizontal'" gap="1" alignment="center" class="cds-mb-3">
+                <div class="cds--stack cds--stack-horizontal cds-mb-3">
                   <label class="cds--type-label-01" i18n>Enable Mutual TLS (mTLS)</label>
                 </div>
                 <cds-checkbox id="enableMtls" formControlName="enableMtls">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index f27cbec917d..ac97aa3a3b8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -1,6 +1,5 @@
 import { Component, OnInit, ViewChild } from '@angular/core';
 import { UntypedFormControl, Validators } from '@angular/forms';
-import { ActivatedRoute, Router } from '@angular/router';
 import { ActionLabelsI18n, URLVerbs } from '~/app/shared/constants/app.constants';
 import { CdForm } from '~/app/shared/forms/cd-form';
 import { CdFormGroup } from '~/app/shared/forms/cd-form-group';
@@ -11,13 +10,11 @@ import { NvmeofGatewayNodeComponent } from '../nvmeof-gateway-node/nvmeof-gatewa
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
 import { FinishedTask } from '~/app/shared/models/finished-task';
+import { Router } from '@angular/router';
 import { CdValidators } from '~/app/shared/forms/cd-validators';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
-
-enum CertificateType {
-  internal = 'internal',
-  external = 'external'
-}
+import { Pool } from '../../pool/pool';
+import { CertificateType } from '~/app/shared/models/service.interface';
 
 @Component({
   selector: 'cd-nvmeof-group-form',
@@ -28,19 +25,16 @@ enum CertificateType {
 export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   @ViewChild(NvmeofGatewayNodeComponent) gatewayNodeComponent!: NvmeofGatewayNodeComponent;
 
+  readonly CertificateType = CertificateType;
   permission: Permission;
   groupForm!: CdFormGroup;
   action!: string;
   resource: string;
-  group: string;
-  pageURL: string;
-  hasAvailableNodes = true;
-  CertificateType = CertificateType;
-  editing = false;
-  gatewayGroupName = '';
-  existingServiceData: any = null;
-  pools: Array<{ pool_name: string }> = [{ pool_name: 'rbd' }];
+  group = '';
+  pageURL = '';
+  pools: Pool[] = [];
   poolsLoading = false;
+  hasAvailableNodes = true;
 
   constructor(
     private authStorageService: AuthStorageService,
@@ -48,8 +42,7 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     private taskWrapperService: TaskWrapperService,
     private cephServiceService: CephServiceService,
     private nvmeofService: NvmeofService,
-    private router: Router,
-    private route: ActivatedRoute
+    private router: Router
   ) {
     super();
     this.permission = this.authStorageService.getPermissions().nvmeof;
@@ -57,155 +50,52 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   }
 
   ngOnInit() {
-    this.route.params.subscribe((params) => {
-      if (params['name']) {
-        this.editing = true;
-        this.gatewayGroupName = params['name'];
-        this.action = this.actionLabels.EDIT;
-        this.createForm();
-        this.loadGatewayGroupData(params['name']);
-      } else {
-        this.editing = false;
-        this.action = this.actionLabels.CREATE;
-        this.gatewayGroupName = '';
-        this.createForm();
-      }
-    });
+    this.action = this.actionLabels.CREATE;
+    this.createForm();
   }
 
   createForm() {
-    const groupNameValidators = this.editing
-      ? [
-          Validators.required,
-          (control) => {
-            const value = control.value;
-            return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
-          }
-        ]
-      : [
-          Validators.required,
-          (control) => {
-            const value = control.value;
-            return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
-          }
-        ];
-
-    const groupNameAsyncValidators = this.editing
-      ? []
-      : [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)];
-
     this.groupForm = new CdFormGroup({
-      groupName: new UntypedFormControl(null, groupNameValidators, groupNameAsyncValidators),
-      pool: new UntypedFormControl('rbd', {
-        validators: [Validators.required]
-      }),
+      groupName: new UntypedFormControl(
+        null,
+        [
+          Validators.required,
+          (control) => {
+            const value = control.value;
+            return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
+          }
+        ],
+        [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)]
+      ),
       unmanaged: new UntypedFormControl(false),
       enableEncryption: new UntypedFormControl(false),
+      encryptionConfig: new UntypedFormControl(null),
+      encryptionKey: new UntypedFormControl(null),
       enableMtls: new UntypedFormControl(false),
-      encryptionKey: new UntypedFormControl('', [
-        CdValidators.composeIf(
-          {
-            enableEncryption: true
-          },
-          [Validators.required]
-        )
-      ]),
       certificateType: new UntypedFormControl(CertificateType.internal),
+      pool: new UntypedFormControl('rbd'),
       custom_sans: new UntypedFormControl([]),
-      rootCACert: new UntypedFormControl(null, [
-        CdValidators.composeIf(
-          {
-            enableEncryption: true,
-            certificateType: 'external'
-          },
-          [Validators.required]
-        )
-      ]),
-      clientCert: new UntypedFormControl(null, [
-        CdValidators.composeIf(
-          {
-            enableEncryption: true,
-            certificateType: 'external'
-          },
-          [Validators.required]
-        )
-      ]),
-      clientKey: new UntypedFormControl(null, [
-        CdValidators.composeIf(
-          {
-            enableEncryption: true,
-            certificateType: 'external'
-          },
-          [Validators.required]
-        )
-      ]),
-      serverCert: new UntypedFormControl(null, [
-        CdValidators.composeIf(
-          {
-            enableEncryption: true,
-            certificateType: 'external'
-          },
-          [Validators.required]
-        )
-      ]),
-      serverKey: new UntypedFormControl(null, [
-        CdValidators.composeIf(
-          {
-            enableEncryption: true,
-            certificateType: CertificateType.external
-          },
-          [Validators.required]
-        )
-      ])
+      rootCACert: new UntypedFormControl(null),
+      clientCert: new UntypedFormControl(null),
+      clientKey: new UntypedFormControl(null),
+      serverCert: new UntypedFormControl(null),
+      serverKey: new UntypedFormControl(null)
     });
 
-    // Disable group name field in edit mode
-    if (this.editing) {
-      this.groupForm.get('groupName')?.disable();
-    }
-  }
-
-  loadGatewayGroupData(groupName: string) {
-    this.nvmeofService.listGatewayGroups().subscribe(
-      (gatewayGroups: any) => {
-        const groups = gatewayGroups?.[0] ?? [];
-        const group = groups.find((g: any) => g.spec?.group === groupName);
-
-        if (group) {
-          this.existingServiceData = group;
-          const spec = group.spec || {};
-
-          // Prefill form with existing data
-          this.groupForm.patchValue({
-            groupName: groupName,
-            pool: spec.pool || 'rbd',
-            unmanaged: spec.unmanaged || false,
-            enableEncryption: spec.ssl || false,
-            enableMtls: spec.ssl || false,
-            certificateType:
-              spec.certificate_source === 'inline'
-                ? CertificateType.external
-                : CertificateType.internal,
-            encryptionKey: spec.encryption_key || '',
-            custom_sans: spec.custom_sans || []
-          });
-
-          // If external certificates, load them
-          if (spec.certificate_source === 'inline') {
-            this.groupForm.patchValue({
-              rootCACert: spec.root_ca_cert || null,
-              clientCert: spec.client_cert || null,
-              clientKey: spec.client_key || null,
-              serverCert: spec.server_cert || null,
-              serverKey: spec.server_key || null
-            });
-          }
-        }
-      },
-      (_error) => {
-        // Error loading gateway group data
+    this.groupForm.get('enableEncryption')?.valueChanges.subscribe((enabled) => {
+      // Keep both legacy and new encryption fields in sync.
+      if (!enabled) {
+        return;
       }
-    );
+      const encryptionConfigControl = this.groupForm.get('encryptionConfig');
+      const encryptionKeyControl = this.groupForm.get('encryptionKey');
+      if (!encryptionKeyControl?.value && encryptionConfigControl?.value) {
+        encryptionKeyControl.setValue(encryptionConfigControl.value, { emitEvent: false });
+      }
+      if (!encryptionConfigControl?.value && encryptionKeyControl?.value) {
+        encryptionConfigControl.setValue(encryptionKeyControl.value, { emitEvent: false });
+      }
+    });
   }
 
   onHostsLoaded(count: number): void {
@@ -249,41 +139,51 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       return;
     }
 
-    const formValues = this.groupForm.getRawValue(); // Use getRawValue to get disabled fields too
+    const formValues = this.groupForm.value;
     const selectedHostnames = this.gatewayNodeComponent?.getSelectedHostnames() || [];
     if (selectedHostnames.length === 0) {
       this.groupForm.setErrors({ cdSubmitButton: true });
       return;
     }
-
-    const groupName = this.editing ? this.gatewayGroupName : formValues.groupName;
-    const pool = formValues.pool;
-    const serviceName = `${pool}.${groupName}`;
-
-    let taskUrl = this.editing ? `service/${URLVerbs.EDIT}` : `service/${URLVerbs.CREATE}`;
+    let taskUrl = `service/${URLVerbs.CREATE}`;
+    const serviceName = `${formValues.groupName}`;
 
     const serviceSpec: Record<string, any> = {
       service_type: 'nvmeof',
       service_id: serviceName,
-      pool: pool,
-      group: groupName,
+      group: formValues.groupName,
       placement: {
         hosts: selectedHostnames
       },
       unmanaged: formValues.unmanaged
     };
 
+    if (formValues.enableEncryption) {
+      const encryptionKey = formValues.encryptionKey || formValues.encryptionConfig;
+      if (encryptionKey) {
+        serviceSpec['encryption_key'] = encryptionKey;
+      }
+    }
+
     if (formValues.enableMtls) {
       serviceSpec['ssl'] = true;
       serviceSpec['enable_auth'] = true;
       serviceSpec['certificate_source'] =
         formValues.certificateType === CertificateType.internal ? 'cephadm-signed' : 'inline';
 
-      if (formValues.certificateType === CertificateType.internal) {
-        if (formValues.custom_sans && formValues.custom_sans.length > 0) {
-          serviceSpec['custom_sans'] = formValues.custom_sans;
-        }
-      } else {
+      if (formValues.pool) {
+        serviceSpec['pool'] = formValues.pool;
+        serviceSpec['service_id'] = `${formValues.pool}.${serviceName}`;
+      }
+
+      if (
+        formValues.certificateType === CertificateType.internal &&
+        formValues.custom_sans?.length > 0
+      ) {
+        serviceSpec['custom_sans'] = formValues.custom_sans;
+      }
+
+      if (formValues.certificateType === CertificateType.external) {
         serviceSpec['root_ca_cert'] = formValues.rootCACert;
         serviceSpec['client_cert'] = formValues.clientCert;
         serviceSpec['client_key'] = formValues.clientKey;
@@ -292,16 +192,12 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       }
     }
 
-    const apiCall = this.editing
-      ? this.cephServiceService.update(serviceSpec)
-      : this.cephServiceService.create(serviceSpec);
-
     this.taskWrapperService
       .wrapTaskAroundCall({
         task: new FinishedTask(taskUrl, {
           service_name: `nvmeof.${serviceName}`
         }),
-        call: apiCall
+        call: this.cephServiceService.create(serviceSpec)
       })
       .subscribe({
         complete: () => {
@@ -317,31 +213,20 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     this.router.navigateByUrl('/block/nvmeof/gateways');
   }
 
-  onFileUpload(event: any, controlName: string) {
-    const file = event.target.files[0];
-    if (file) {
-      const reader = new FileReader();
-      reader.onload = (e: any) => {
-        this.groupForm.get(controlName)?.setValue(e.target.result);
-      };
-      reader.readAsText(file);
-    }
+  onCertificateTypeChange(type: CertificateType): void {
+    this.groupForm.get('certificateType')?.setValue(type);
   }
 
-  onCertificateTypeChange(type: CertificateType) {
-    this.groupForm.get('certificateType')?.setValue(type);
-    if (type === CertificateType.internal) {
-      this.groupForm.patchValue({
-        rootCACert: null,
-        clientCert: null,
-        clientKey: null,
-        serverCert: null,
-        serverKey: null
-      });
-    } else {
-      this.groupForm.patchValue({
-        custom_sans: []
-      });
+  onFileUpload(event: Event, controlName: string): void {
+    const target = event.target as HTMLInputElement;
+    const file = target?.files?.[0];
+    const control = this.groupForm.get(controlName);
+    if (!file || !control) {
+      return;
     }
+
+    const reader = new FileReader();
+    reader.onload = () => control.setValue(reader.result);
+    reader.readAsText(file, 'utf8');
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
index 48b6326e937..61de7d2648d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
@@ -107,9 +107,7 @@
       <div cdsRow
            class="form-item">
         <cds-combo-box i18n
-                       cdValidate
-                       #listenersRef="cdValidate"
-                       [invalid]="listenersRef.isInvalid"
+                       [invalid]="formGroup.get('listeners')?.invalid && (formGroup.get('listeners')?.dirty || formGroup.get('listeners')?.touched)"
                        [invalidText]="listenersInvalidText"
                        [label]="listenersLabel"
                        [helperText]="listenersHelperText"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index 1fc6559d020..d88531a22c2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -201,8 +201,7 @@
                     [invalid]="serviceForm.controls.realm_name.invalid && serviceForm.controls.realm_name.dirty"
                     [invalidText]="authModeError"
                     helperText="Active-directory authentication for domain member servers and User authentication for Stand-alone servers configuration."
-                    i18n-helperText
-                    [disabled]="realmList.length === 0  || editing ? true : false">
+                    i18n-helperText>
           @if (realmList.length === 0) {
           <option i18n
                   selected>-- No realm available --
@@ -225,8 +224,7 @@
       <div class="form-item">
         <cds-select id="zonegroup_name"
                     formControlName="zonegroup_name"
-                    label="Zonegroup"
-                    [disabled]="zonegroupList.length === 0  || editing ? true : null">
+                    label="Zonegroup">
           @for (zonegroup of zonegroupList; track zonegroup) {
           <option [value]="zonegroup.name">
             {{ zonegroup.name }}
@@ -238,8 +236,7 @@
       <div class="form-item">
         <cds-select id="zone_name"
                     formControlName="zone_name"
-                    label="Zone"
-                    [disabled]="zoneList.length === 0  || editing ? true : null">
+                    label="Zone">
           @for (zone of zoneList; track zone) {
           <option [value]="zone.name">
             {{ zone.name }}
@@ -1257,8 +1254,7 @@
           <input cdsPassword
                  type="password"
                  id="grafana_admin_password"
-                 formControlName="grafana_admin_password"
-                 [disabled]="editing ? true:null" />
+                 formControlName="grafana_admin_password" />
         </cds-password-label>
         <cd-copy-2-clipboard-button source="grafana_admin_password"
                                     class="mt-4">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
index b4fbab508ea..3b56e8df9bd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
@@ -618,10 +618,9 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         component.onSubmit();
         expect(cephServiceService.create).toHaveBeenCalledWith({
           service_type: 'nvmeof',
-          service_id: 'rbd.default',
+          service_id: 'default',
           placement: {},
           unmanaged: false,
-          pool: 'rbd',
           group: 'default',
           enable_auth: true,
           ssl: true,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index 6c10ff5a2ce..c52f488b031 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -1151,6 +1151,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         } else {
           this.showRealmCreationForm = false;
         }
+        this.updateRgwControlStates();
       },
       (_error) => {
         const defaultZone = new RgwZone();
@@ -1159,6 +1160,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         defaultZonegroup.name = 'default';
         this.zoneList.push(defaultZone);
         this.zonegroupList.push(defaultZonegroup);
+        this.updateRgwControlStates();
       }
     );
   }
@@ -1229,6 +1231,33 @@ export class ServiceFormComponent extends CdForm implements OnInit {
       case 'nvmeof':
         this.serviceForm.get('group').disable();
         break;
+      case 'grafana':
+        this.serviceForm.get('grafana_admin_password').disable();
+        break;
+    }
+  }
+
+  private updateRgwControlStates(): void {
+    const realmControl = this.serviceForm.get('realm_name');
+    const zonegroupControl = this.serviceForm.get('zonegroup_name');
+    const zoneControl = this.serviceForm.get('zone_name');
+
+    if (this.editing || this.realmList.length === 0) {
+      realmControl.disable({ emitEvent: false });
+    } else {
+      realmControl.enable({ emitEvent: false });
+    }
+
+    if (this.editing || this.zonegroupList.length === 0) {
+      zonegroupControl.disable({ emitEvent: false });
+    } else {
+      zonegroupControl.enable({ emitEvent: false });
+    }
+
+    if (this.editing || this.zoneList.length === 0) {
+      zoneControl.disable({ emitEvent: false });
+    } else {
+      zoneControl.enable({ emitEvent: false });
     }
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/constants/app.constants.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/constants/app.constants.ts
index 22673b0ac2d..d5352edea15 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/constants/app.constants.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/constants/app.constants.ts
@@ -165,6 +165,7 @@ export class ActionLabelsI18n {
   SETUP_MULTISITE_REPLICATION: string;
   NFS_EXPORT: string;
   VIEW: string;
+  EDIT_GATEWAYS_GROUP: string;
   constructor() {
     /* Create a new item */
     this.CREATE = $localize`Create`;
@@ -257,6 +258,7 @@ export class ActionLabelsI18n {
 
     this.NFS_EXPORT = $localize`Create NFS Share`;
     this.VIEW = $localize`View`;
+    this.EDIT_GATEWAYS_GROUP = $localize`Edit gateways group`;
   }
 }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts
index eaca956d3ad..3ee76701830 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/service.interface.ts
@@ -111,6 +111,7 @@ export interface CephServiceAdditionalSpec {
   client_secret: string;
   oidc_issuer_url: string;
   enable_auth: boolean;
+  encryption_key?: string;
   qat: QatSepcs;
 }
 

From ef6af190a765c2d771b61a4fcbf6e96d85b8c327 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Tue, 30 Jun 2026 01:12:04 +0530
Subject: [PATCH 539/596] =?UTF-8?q?mgr/dashboard:=20NVMe-oF=20=E2=80=93=20?=
 =?UTF-8?q?Subsystem=20Resource=20page=20enhancements?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fixes:https://tracker.ceph.com/issues/77789

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../nvmeof-group-form.component.html          |  71 ++++----
 .../nvmeof-subsystem-overview.component.html  | 152 +++++++++++-------
 .../nvmeof-subsystem-overview.component.scss  |  17 --
 ...vmeof-subsystem-overview.component.spec.ts |  34 ++--
 .../nvmeof-subsystem-overview.component.ts    | 116 ++++++++++++-
 .../frontend/src/app/shared/models/nvmeof.ts  |   1 +
 6 files changed, 247 insertions(+), 144 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 7acb2ea574c..f38f1fe0d4a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -8,10 +8,10 @@
        [narrow]="true"
        [fullWidth]="true">
     <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8}">
+         [columnNumbers]="{ sm: 4, md: 8 }">
       <div cdsRow
            class="form-heading form-item cds-mt-5">
-      <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
+        <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
       </div>
       <div cdsRow
            class="form-item">
@@ -32,8 +32,7 @@
               autofocus
               formControlName="groupName"
               cdRequiredField="Gateway group name"
-              [invalid]="groupName.isInvalid"
-            />
+              [invalid]="groupName.isInvalid" />
           </cds-text-label>
           <span
             class="invalid-feedback"
@@ -47,23 +46,20 @@
             class="invalid-feedback"
             *ngIf="groupForm.get('groupName')?.hasError('invalidChars') && (groupForm.get('groupName')?.dirty || groupForm.get('groupName')?.touched)"
             i18n>Special characters are not allowed.</span>
-
         </div>
       </div>
 
-      <!-- CDS Checkbox -->
       <div cdsRow
            class="form-item">
         <div cdsCol>
           <cds-checkbox id="enableCds"
-                        formControlName="enableEncryption"
+                        formControlName="enable_auth"
                         i18n>Enable encryption
           </cds-checkbox>
         </div>
       </div>
 
-      <!-- Encryption Configuration (shown when checkbox is checked) -->
-      @if (groupForm.controls.enableEncryption.value) {
+      @if (groupForm.controls.enable_auth.value) {
       <div cdsRow
            class="form-item">
         <div cdsCol>
@@ -79,39 +75,33 @@
                       cdValidate
                       #encryptionConfigRef="cdValidate"
                       [invalid]="encryptionConfigRef.isInvalid"
-                      formControlName="encryptionConfig"
+                      formControlName="encryptionKey"
                       cols="100"
-                      rows="4">
-            </textarea>
+                      rows="4"></textarea>
           </cds-textarea-label>
           <span
             class="invalid-feedback"
-            *ngIf="groupForm.showError('encryptionConfig', formDir, 'required')"
+            *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
             i18n>This field is required.</span>
         </div>
       </div>
       }
-      <!-- Target Nodes Selection -->
-      <div
-        cdsRow
-        class="form-item"
-      >
-      <div cdsCol>
-        <h1 class="cds--type-heading-02">Select target nodes</h1>
-      <cd-help-text>
-        <span i18n>
-          Gateway nodes to run NVMe-oF target pods/services
-        </span>
-      </cd-help-text>
-      </div>
-      <div
-        cdsCol
-        class="cds-pt-3 cds-pb-3"
-      >
-        <cd-nvmeof-gateway-node
-          (hostsLoaded)="onHostsLoaded($event)"
-        ></cd-nvmeof-gateway-node>
-      </div>
+
+      <div cdsRow
+           class="form-item">
+        <div cdsCol>
+          <h1 class="cds--type-heading-02">Select target nodes</h1>
+          <cd-help-text>
+            <span i18n>
+              Gateway nodes to run NVMe-oF target pods/services
+            </span>
+          </cd-help-text>
+        </div>
+        <div cdsCol
+             class="cds-pt-3 cds-pb-3">
+          <cd-nvmeof-gateway-node
+            (hostsLoaded)="onHostsLoaded($event)"></cd-nvmeof-gateway-node>
+        </div>
       </div>
       <div cdsRow class="form-item cds-mb-0">
         <div cdsCol>
@@ -120,13 +110,13 @@
             <div cdsRow class="form-item">
               <div cdsCol>
                 <div class="cds--stack cds--stack-horizontal">
-                  <label class="cds--type-label-01" 
+                  <label class="cds--type-label-01"
                          i18n>Enable encryption</label>
                   <cds-tag type="green"
                            size="sm"
                            i18n>Recommended</cds-tag>
                 </div>
-                <cds-checkbox id="enableEncryption" 
+                <cds-checkbox id="enableEncryption"
                               formControlName="enableEncryption">
                   <span
                   class="cds--type-body-01"
@@ -136,13 +126,13 @@
             </div>
 
         @if (!groupForm.controls.enableEncryption.value) {
-        <div cdsRow 
+        <div cdsRow
              class="cds-mt-2">
           <div cdsCol>
             <cd-alert-panel type="warning"
                             spacingClass="mb-0"
                             i18n>
-             <span class="cds--type-heading-01">Encryption is required if you plan to use DH-CHAP or mTLS authentication.</span> 
+             <span class="cds--type-heading-01">Encryption is required if you plan to use DH-CHAP or mTLS authentication.</span>
             </cd-alert-panel>
           </div>
         </div>
@@ -205,7 +195,7 @@
             @if (groupForm.controls.enableMtls.value) {
             <div cdsRow class="form-item">
               <div cdsCol>
-                <label class="cds--label fw-bold" 
+                <label class="cds--label fw-bold"
                 i18n>Choose Certificate Authority</label>
                 <cds-radio-group
                   formControlName="certificateType"
@@ -491,8 +481,7 @@
           [form]="groupForm"
           [submitText]="(action | titlecase) + ' ' + (resource)"
           [disabled]="isCreateDisabled"
-          wrappingClass="text-right"
-        >
+          wrappingClass="text-right">
         </cd-form-button-panel>
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
index f781372b9b7..e873691c077 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
@@ -1,62 +1,106 @@
 <cds-tile *ngIf="subsystem">
-  <h4 class="cds--type-heading-03 tile-title"
-      i18n>Subsystem details</h4>
-
-  <div class="details-grid">
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Serial number</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.serial_number }}</span>
-    </div>
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Model Number</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.model_number }}</span>
-    </div>
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Gateway group</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.gw_group || groupName }}</span>
+  <div [cdsStack]="'vertical'"
+       [gap]="6">
+    <div cdsGrid
+         [useCssGrid]="true"
+         [condensed]="true"
+         [fullWidth]="true">
+      <div cdsCol
+           [columnNumbers]="{ sm: 4, md: 8, lg: 12 }">
+        <h3 class="cds--type-heading-03"
+            i18n>Subsystem details</h3>
+      </div>
     </div>
 
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Subsystem Type</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.subtype }}</span>
-    </div>
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>HA Enabled</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.enable_ha ? 'Yes' : 'No' }}</span>
-    </div>
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Hosts allowed</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.allow_any_host ? 'Any host' : 'Restricted' }}</span>
-    </div>
+    @for (row of getRows(); track row) {
+    <div cdsGrid
+         [useCssGrid]="true"
+         [condensed]="true"
+         [fullWidth]="true">
 
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Maximum Controller Identifier</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.max_cntlid }}</span>
-    </div>
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Minimum Controller Identifier</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.min_cntlid }}</span>
-    </div>
-    <div class="detail-item"></div>
+      @for (detail of getDetailsForRow(row); track detail.label) {
+        @if (detail.type === 'auth') {
+          <div cdsCol
+               [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+               [cdsStack]="'vertical'"
+               [gap]="2">
+            <span class="cds--type-label-01"
+                  i18n>Authentication</span>
+            <div>
+              <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
+              <span class="cds--type-label-02">
+                {{ detail.value ? 'Bi-directional' : 'No authentication' }}
+              </span>
+              <a cdsLink
+                 [routerLink]="['../hosts']"
+                 [queryParams]="{ group: groupName }"
+                 [cdsStack]="'horizontal'"
+                 [gap]="1">
+                <span i18n>Edit</span>
+                <cd-icon type="edit"></cd-icon>
+              </a>
+            </div>
+          </div>
+        }
 
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Namespaces</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.namespace_count }}</span>
+        @else if (detail.type === 'listeners') {
+          <div cdsCol
+               [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+               [cdsStack]="'vertical'"
+               [gap]="2">
+            <div>
+              <span class="cds--type-label-01">{{ detail.label }}</span>
+              @if (detail.tooltip) {
+                <cd-icon type="infoCircle"
+                         class="cds-ml-2"
+                         [ngbTooltip]="detail.tooltip"></cd-icon>
+              }
+            </div>
+            <span class="cds--type-label-02">{{ detail.value }}</span>
+          </div>
+        }
+
+        @else if (detail.type === 'host-access') {
+          <div cdsCol
+               [columnNumbers]="getColNumbers(detail)"
+               [cdsStack]="'vertical'"
+               [gap]="2">
+            <span class="cds--type-label-01">{{ detail.label }}</span>
+            <div class="cds--type-label-02">
+              <span>{{ detail.value ? 'Allow all hosts' : 'Restrict to specific hosts' }}</span>
+              <a cdsLink
+                 [routerLink]="['../hosts']"
+                 [queryParams]="{ group: groupName }"
+                 [cdsStack]="'horizontal'"
+                 class="cds-ml-2"
+                 [gap]="1">
+                <span i18n>Edit</span>
+                <cd-icon type="edit"></cd-icon>
+              </a>
+            </div>
+          </div>
+        }
+
+        <!-- Default: plain text row -->
+        @else {
+          <div cdsCol
+               [columnNumbers]="getColNumbers(detail)"
+               [cdsStack]="'vertical'"
+               [gap]="2">
+            <span class="cds--type-label-01">{{ detail.label }}</span>
+            <span class="cds--type-label-02">{{ getDisplayValue(detail.value) }}</span>
+          </div>
+        }
+
+      }
+
+      @if (getDetailsForRow(row).length < 3 && !isFullWidthRow(row)) {
+        @for (filler of getFillerCount(row); track filler) {
+          <div cdsCol
+               [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"></div>
+        }
+      }
     </div>
-    <div class="detail-item">
-      <span class="cds--type-label-01"
-            i18n>Maximum allowed namespaces</span>
-      <span class="cds--type-body-compact-01">{{ subsystem.max_namespaces }}</span>
-    </div>
-    <div class="detail-item"></div>
+    }
   </div>
 </cds-tile>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.scss
index 6270f1ecb84..e22ab988885 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.scss
@@ -1,18 +1 @@
 @use '@carbon/layout';
-
-.tile-title {
-  margin-bottom: layout.$spacing-06;
-}
-
-.details-grid {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  row-gap: layout.$spacing-06;
-  column-gap: layout.$spacing-07;
-}
-
-.detail-item {
-  display: flex;
-  flex-direction: column;
-  gap: layout.$spacing-02;
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
index d76456422fd..364ab36502a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
@@ -28,7 +28,8 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     enable_ha: true,
     allow_any_host: true,
     gw_group: 'gateway-prod',
-    psk: 'some-key'
+    has_dhchap_key: true,
+    network_mask: []
   };
 
   beforeEach(async () => {
@@ -143,38 +144,23 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     expect(labelTexts).toContain('Serial number');
     expect(labelTexts).toContain('Model Number');
     expect(labelTexts).toContain('Gateway group');
+    expect(labelTexts).toContain('Host access');
+    expect(labelTexts).toContain('Authentication');
+    expect(labelTexts).toContain('Listeners');
     expect(labelTexts).toContain('Maximum Controller Identifier');
     expect(labelTexts).toContain('Minimum Controller Identifier');
     expect(labelTexts).toContain('Namespaces');
     expect(labelTexts).toContain('Maximum allowed namespaces');
   }));
 
-  it('should not display MTLS label in overview details', fakeAsync(() => {
+  it('should display host access and auth state from subsystem data', fakeAsync(() => {
     component.ngOnInit();
     tick();
     fixture.detectChanges();
 
-    const values = fixture.nativeElement.querySelectorAll('.cds--type-body-compact-01');
-    const valueTexts = Array.from(values).map((el: HTMLElement) => el.textContent.trim());
-    expect(valueTexts).not.toContain('MTLS');
-  }));
-
-  it('should display hosts allowed from subsystem data', fakeAsync(() => {
-    component.ngOnInit();
-    tick();
-    fixture.detectChanges();
-
-    const values = fixture.nativeElement.querySelectorAll('.cds--type-body-compact-01');
-    const valueTexts = Array.from(values).map((el: HTMLElement) => el.textContent.trim());
-    expect(valueTexts).toContain('Any host');
-  }));
-
-  it('should not render Edit link for Hosts allowed', fakeAsync(() => {
-    component.ngOnInit();
-    tick();
-    fixture.detectChanges();
-
-    const editLink = fixture.nativeElement.querySelector('a[cdsLink]');
-    expect(editLink).toBeFalsy();
+    const hostAccessText = fixture.nativeElement.textContent;
+    expect(hostAccessText).toContain('Allow all hosts');
+    expect(hostAccessText).toContain('Bi-directional');
+    expect(hostAccessText).toContain('Edit');
   }));
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
index a414dcf6c96..5b9643065d9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
@@ -2,6 +2,15 @@ import { Component, OnInit } from '@angular/core';
 import { ActivatedRoute } from '@angular/router';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { NvmeofSubsystem } from '~/app/shared/models/nvmeof';
+import { ICON_TYPE } from '~/app/shared/enum/icons.enum';
+
+export interface SubsystemDetail {
+  label: string;
+  value: string | number | boolean;
+  type: 'text' | 'host-access' | 'auth' | 'listeners';
+  tooltip?: string;
+  row: number;
+}
 
 @Component({
   selector: 'cd-nvmeof-subsystem-overview',
@@ -10,9 +19,10 @@ import { NvmeofSubsystem } from '~/app/shared/models/nvmeof';
   standalone: false
 })
 export class NvmeofSubsystemOverviewComponent implements OnInit {
-  subsystemNQN: string;
-  groupName: string;
-  subsystem: NvmeofSubsystem;
+  subsystemNQN!: string;
+  groupName!: string;
+  subsystem!: NvmeofSubsystem;
+  details: SubsystemDetail[] = [];
 
   constructor(private route: ActivatedRoute, private nvmeofService: NvmeofService) {}
 
@@ -34,10 +44,100 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
   }
 
   fetchSubsystem() {
-    this.nvmeofService
-      .getSubsystem(this.subsystemNQN, this.groupName)
-      .subscribe((subsystem: NvmeofSubsystem) => {
-        this.subsystem = subsystem;
-      });
+    this.nvmeofService.getSubsystem(this.subsystemNQN, this.groupName).subscribe((subsystem) => {
+      this.subsystem = subsystem as NvmeofSubsystem;
+      this.buildDetails();
+    });
+  }
+
+  private buildDetails() {
+    this.details = [
+      {
+        label: $localize`Serial number`,
+        value: this.subsystem.serial_number,
+        type: 'text',
+        row: 1
+      },
+      { label: $localize`Model Number`, value: this.subsystem.model_number, type: 'text', row: 1 },
+      {
+        label: $localize`Gateway group`,
+        value: this.subsystem.gw_group || this.groupName,
+        type: 'text',
+        row: 1
+      },
+      {
+        label: $localize`Host access`,
+        value: this.subsystem.allow_any_host ?? false,
+        type: 'host-access',
+        row: 2
+      },
+      {
+        label: $localize`Authentication`,
+        value: this.subsystem.has_dhchap_key,
+        type: 'auth',
+        row: 2
+      },
+      {
+        label: $localize`Listeners`,
+        value:
+          (this.subsystem.network_mask?.length ?? 0) > 0
+            ? $localize`Auto-fetched`
+            : $localize`Manually selected`,
+        type: 'listeners',
+        tooltip: $localize`Listeners are automatically fetched from the gateway`,
+        row: 3
+      },
+      {
+        label: $localize`Maximum Controller Identifier`,
+        value: this.subsystem.max_cntlid,
+        type: 'text',
+        row: 3
+      },
+      {
+        label: $localize`Minimum Controller Identifier`,
+        value: this.subsystem.min_cntlid,
+        type: 'text',
+        row: 3
+      },
+      { label: $localize`Namespaces`, value: this.subsystem.namespace_count, type: 'text', row: 4 },
+      {
+        label: $localize`Maximum allowed namespaces`,
+        value: this.subsystem.max_namespaces,
+        type: 'text',
+        row: 4
+      }
+    ];
+  }
+
+  getRows(): number[] {
+    return [...new Set(this.details.map((d) => d.row))];
+  }
+
+  getDetailsForRow(row: number): SubsystemDetail[] {
+    return this.details.filter((d) => d.row === row);
+  }
+
+  getDisplayValue(value: string | number | boolean): string {
+    if (typeof value === 'boolean') {
+      return value ? $localize`Enabled` : $localize`Disabled`;
+    }
+    return String(value);
+  }
+
+  getStatusIcon(detail: SubsystemDetail): keyof typeof ICON_TYPE {
+    return detail.value ? 'success' : 'error';
+  }
+
+  getColNumbers(detail: SubsystemDetail): { sm: number; md: number; lg: number } {
+    return detail.type === 'auth' ? { sm: 4, md: 8, lg: 12 } : { sm: 4, md: 4, lg: 4 };
+  }
+
+  isFullWidthRow(row: number): boolean {
+    return this.getDetailsForRow(row).some((d) => d.type === 'auth');
+  }
+
+  getFillerCount(row: number): number[] {
+    const needed = 3 - this.getDetailsForRow(row).length;
+    return Array.from({ length: needed });
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
index e177f8198eb..912cd4d3cbe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
@@ -24,6 +24,7 @@ export interface NvmeofSubsystem {
   gw_group?: string;
   initiator_count?: number;
   has_dhchap_key: boolean;
+  network_mask?: string[];
 }
 
 export interface NvmeofSubsystemData extends NvmeofSubsystem {

From 6c923d6c57884a31750e267a2d11a904430d82dc Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Wed, 1 Jul 2026 02:21:53 +0530
Subject: [PATCH 540/596] =?UTF-8?q?mgr/dashboard:=20NVMe-oF=20=E2=80=93=20?=
 =?UTF-8?q?Add=20edit=20authentication=20support=20for=20subsystem?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://tracker.ceph.com/issues/77840

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../mgr/dashboard/controllers/nvmeof.py       |   2 +
 .../src/app/ceph/block/block.module.ts        |   4 +-
 .../nvmeof-edit-authentication.component.html |  29 ++
 .../nvmeof-edit-authentication.component.scss |   0
 ...meof-edit-authentication.component.spec.ts | 270 ++++++++++++++++++
 .../nvmeof-edit-authentication.component.ts   | 179 ++++++++++++
 .../nvmeof-group-form.component.html          |   9 +-
 .../nvmeof-subsystem-overview.component.html  |  11 +-
 ...vmeof-subsystem-overview.component.spec.ts | 118 +++++---
 .../nvmeof-subsystem-overview.component.ts    |  45 ++-
 .../nvmeof-subsystem-step-3.component.ts      |  10 +-
 .../src/app/shared/api/nvmeof.service.ts      |  46 ++-
 src/pybind/mgr/dashboard/openapi.yaml         |  62 ++++
 13 files changed, 718 insertions(+), 67 deletions(-)
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.scss
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts
 create mode 100644 src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.ts

diff --git a/src/pybind/mgr/dashboard/controllers/nvmeof.py b/src/pybind/mgr/dashboard/controllers/nvmeof.py
index 95065f361bd..832d3b28c16 100644
--- a/src/pybind/mgr/dashboard/controllers/nvmeof.py
+++ b/src/pybind/mgr/dashboard/controllers/nvmeof.py
@@ -616,6 +616,8 @@ else:
                 )
             )
 
+        @Endpoint('PUT', '{nqn}/change_key')
+        @UpdatePermission
         @EndpointDoc(
             "Change subsystem inband authentication key",
             parameters={
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index 368a7de95b7..722832ae977 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -109,6 +109,7 @@ import { NvmeofTabsComponent } from './nvmeof-tabs/nvmeof-tabs.component';
 import { NvmeofGatewayGroupDeleteGuardModalComponent } from './nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component';
 import { NvmeofSetupCardsComponent } from './nvmeof-setup-cards/nvmeof-setup-cards.component';
 import { NvmeofGatewayGroupFilterComponent } from './nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component';
+import { NvmeofEditAuthenticationComponent } from './nvmeof-edit-authentication/nvmeof-edit-authentication.component';
 
 @NgModule({
   imports: [
@@ -201,7 +202,8 @@ import { NvmeofGatewayGroupFilterComponent } from './nvmeof-gateway-group-filter
     NvmeofSubsystemOverviewComponent,
     NvmeofSubsystemPerformanceComponent,
     NvmeofTabsComponent,
-    NvmeofGatewayGroupDeleteGuardModalComponent
+    NvmeofGatewayGroupDeleteGuardModalComponent,
+    NvmeofEditAuthenticationComponent
   ],
 
   exports: [RbdConfigurationListComponent, RbdConfigurationFormComponent]
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html
new file mode 100644
index 00000000000..4261e9c0c32
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html
@@ -0,0 +1,29 @@
+<cd-tearsheet [steps]="steps"
+              [title]="title"
+              [description]="description"
+              size="md"
+              [isSubmitLoading]="isSubmitLoading"
+              [submitButtonLabel]="'Save changes'"
+              [submitButtonLoadingLabel]="'Saving'"
+              (submitRequested)="onSubmit()"
+              (closeRequested)="closeModal()">
+  <cd-tearsheet-step>
+    @if (showAuthAlert) {
+    <cd-alert-panel type="warning"
+                    title="Subsystem DHCHAP Key will be deleted permanently"
+                    i18n-title
+                    class="cd-nvmeof-edit-auth-downgrade-alert">
+      <span i18n>
+        Switching from bidirectional authentication to unidirectional method will remove the subsystem authentication key,
+        exposing the subsystem to unauthorised access.
+      </span>
+    </cd-alert-panel>
+    }
+    <cd-nvmeof-subsystem-step-three
+      #tearsheetStep
+      [group]="groupName"
+      [initialAuthType]="initialAuthType"
+      [stepTwoValue]="stepTwoValue">
+    </cd-nvmeof-subsystem-step-three>
+  </cd-tearsheet-step>
+</cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.scss
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts
new file mode 100644
index 00000000000..a60fe0d3e81
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts
@@ -0,0 +1,270 @@
+import { ComponentFixture, TestBed, waitForAsync } from '@angular/core/testing';
+import { ReactiveFormsModule } from '@angular/forms';
+import { HttpClientTestingModule } from '@angular/common/http/testing';
+import { RouterTestingModule } from '@angular/router/testing';
+
+import { of, throwError } from 'rxjs';
+
+import { GridModule, InputModule, RadioModule, TagModule } from 'carbon-components-angular';
+import { SharedModule } from '~/app/shared/shared.module';
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
+import { NotificationService } from '~/app/shared/services/notification.service';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
+import { AUTHENTICATION } from '~/app/shared/models/nvmeof';
+import {
+  NvmeofEditAuthenticationComponent,
+  SUBSYSTEM_NQN_TOKEN,
+  GROUP_NAME_TOKEN
+} from './nvmeof-edit-authentication.component';
+import { NvmeofSubsystemsStepThreeComponent } from '../nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component';
+
+describe('NvmeofEditAuthenticationComponent', () => {
+  let component: NvmeofEditAuthenticationComponent;
+  let fixture: ComponentFixture<NvmeofEditAuthenticationComponent>;
+  let nvmeofService: jest.Mocked<Pick<
+    NvmeofService,
+    'getInitiators' | 'getSubsystem' | 'updateAuthenticationKey'
+  >>;
+  let notificationService: { show: jest.Mock };
+  let modalService: { dismissAll: jest.Mock };
+
+  const mockSubsystemNQN = 'nqn.2014-08.org.nvmexpress:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6';
+  const mockGroupName = 'default';
+  const mockHosts = [
+    { nqn: 'nqn.2014-08.org.nvmexpress:uuid:host-1', use_dhchap: false },
+    { nqn: 'nqn.2014-08.org.nvmexpress:uuid:host-2', use_dhchap: false }
+  ];
+  const mockHostsWithKey = [{ nqn: 'nqn.2014-08.org.nvmexpress:uuid:host-1', use_dhchap: true }];
+
+  beforeEach(
+    waitForAsync(() => {
+      nvmeofService = {
+        getInitiators: jest.fn().mockReturnValue(of([])),
+        getSubsystem: jest.fn().mockReturnValue(of({ has_dhchap_key: false })),
+        updateAuthenticationKey: jest.fn().mockReturnValue(of(undefined))
+      };
+      notificationService = { show: jest.fn() };
+      modalService = { dismissAll: jest.fn() };
+
+      TestBed.configureTestingModule({
+        declarations: [NvmeofEditAuthenticationComponent, NvmeofSubsystemsStepThreeComponent],
+        imports: [
+          ReactiveFormsModule,
+          HttpClientTestingModule,
+          RouterTestingModule,
+          SharedModule,
+          GridModule,
+          InputModule,
+          RadioModule,
+          TagModule
+        ],
+        providers: [
+          { provide: NvmeofService, useValue: nvmeofService },
+          { provide: NotificationService, useValue: notificationService },
+          { provide: ModalCdsService, useValue: modalService },
+          { provide: SUBSYSTEM_NQN_TOKEN, useValue: mockSubsystemNQN },
+          { provide: GROUP_NAME_TOKEN, useValue: mockGroupName }
+        ]
+      }).compileComponents();
+    })
+  );
+
+  beforeEach(() => {
+    fixture = TestBed.createComponent(NvmeofEditAuthenticationComponent);
+    component = fixture.componentInstance;
+    fixture.detectChanges(); // runs ngOnInit + ngAfterViewInit
+  });
+
+  it('should create', () => {
+    expect(component).toBeTruthy();
+  });
+
+  it('should inject subsystemNQN and groupName', () => {
+    expect(component.subsystemNQN).toBe(mockSubsystemNQN);
+    expect(component.groupName).toBe(mockGroupName);
+  });
+
+  it('should fetch initiators on init and build stepTwoValue with host NQNs', () => {
+    nvmeofService.getInitiators.mockReturnValue(of(mockHosts));
+    component.ngOnInit();
+    expect(nvmeofService.getInitiators).toHaveBeenCalledWith(mockSubsystemNQN, mockGroupName);
+    expect(component.stepTwoValue?.addedHosts).toEqual([
+      'nqn.2014-08.org.nvmexpress:uuid:host-1',
+      'nqn.2014-08.org.nvmexpress:uuid:host-2'
+    ]);
+  });
+
+  it('should handle hosts returned as { hosts: [...] } response shape', () => {
+    nvmeofService.getInitiators.mockReturnValue(of({ hosts: mockHosts }));
+    component.ngOnInit();
+    expect(component.stepTwoValue?.addedHosts.length).toBe(2);
+  });
+
+  it('should handle empty host list', () => {
+    nvmeofService.getInitiators.mockReturnValue(of([]));
+    component.ngOnInit();
+    expect(component.stepTwoValue?.addedHosts).toEqual([]);
+  });
+
+  describe('initialAuthType pre-selection', () => {
+    it('should default to Unidirectional when subsystem has no DHCHAP key', () => {
+      expect(component.initialAuthType).toBe(AUTHENTICATION.Unidirectional);
+      expect(component.authStep.formGroup.get('authType')?.value).toBe(
+        AUTHENTICATION.Unidirectional
+      );
+    });
+
+    it('should patch form control to Bidirectional when subsystem and host both have keys', () => {
+      nvmeofService.getSubsystem.mockReturnValue(of({ has_dhchap_key: true }));
+      nvmeofService.getInitiators.mockReturnValue(of(mockHostsWithKey));
+      component.ngOnInit();
+      expect(component.initialAuthType).toBe(AUTHENTICATION.Bidirectional);
+      component.authStep.initialAuthType = component.initialAuthType;
+      expect(component.authStep.formGroup.get('authType')?.value).toBe(
+        AUTHENTICATION.Bidirectional
+      );
+    });
+
+    it('should set Unidirectional when only host has a key', () => {
+      nvmeofService.getSubsystem.mockReturnValue(of({ has_dhchap_key: false }));
+      nvmeofService.getInitiators.mockReturnValue(of(mockHostsWithKey));
+      component.ngOnInit();
+      expect(component.initialAuthType).toBe(AUTHENTICATION.Unidirectional);
+      expect(component.authStep.formGroup.get('authType')?.value).toBe(
+        AUTHENTICATION.Unidirectional
+      );
+    });
+
+    it('should set Unidirectional when no keys are present', () => {
+      nvmeofService.getSubsystem.mockReturnValue(of({ has_dhchap_key: false }));
+      nvmeofService.getInitiators.mockReturnValue(of([]));
+      component.ngOnInit();
+      expect(component.initialAuthType).toBe(AUTHENTICATION.Unidirectional);
+    });
+  });
+
+  describe('showAuthAlert', () => {
+    it('should be false by default', () => {
+      expect(component.showAuthAlert).toBe(false);
+    });
+
+    it('should remain false when subsystem has no DHCHAP key and radio changes to Unidirectional', () => {
+      nvmeofService.getSubsystem.mockReturnValue(of({ has_dhchap_key: false }));
+      component.ngOnInit();
+      component.authStep.formGroup.get('authType')?.setValue(AUTHENTICATION.Unidirectional);
+      expect(component.showAuthAlert).toBe(false);
+    });
+
+    it('should remain false when subsystem has DHCHAP key and radio changes to Bidirectional', () => {
+      nvmeofService.getSubsystem.mockReturnValue(of({ has_dhchap_key: true }));
+      component.ngOnInit();
+      component.authStep.formGroup.get('authType')?.setValue(AUTHENTICATION.Bidirectional);
+      expect(component.showAuthAlert).toBe(false);
+    });
+
+    it('should become true when subsystem has DHCHAP key and radio changes to Unidirectional', () => {
+      nvmeofService.getSubsystem.mockReturnValue(of({ has_dhchap_key: true }));
+      component.ngOnInit();
+      component.authStep.formGroup.get('authType')?.setValue(AUTHENTICATION.Unidirectional);
+      expect(component.showAuthAlert).toBe(true);
+    });
+  });
+
+  describe('onSubmit', () => {
+    it('should not call updateAuthenticationKey when form is invalid', () => {
+      const form = component.authStep?.formGroup;
+      if (form) {
+        form.markAllAsTouched();
+        form.setErrors({ test: true });
+      }
+      component.onSubmit();
+      expect(nvmeofService.updateAuthenticationKey).not.toHaveBeenCalled();
+    });
+
+    it('should not call updateAuthenticationKey when authStep is absent', () => {
+      component.authStep = undefined as any;
+      component.onSubmit();
+      expect(nvmeofService.updateAuthenticationKey).not.toHaveBeenCalled();
+    });
+
+    it('should extract and submit authentication settings on valid Bidirectional form', () => {
+      const validKey = 'Q2VwaE52bWVvRkNoYXBTeW50aGV0aWNLZXkxMjM0NTY=';
+      const form = component.authStep.formGroup;
+      form.get('authType')?.setValue(AUTHENTICATION.Bidirectional);
+      form.get('subsystemDchapKey')?.setValue(validKey);
+      component.onSubmit();
+      expect(nvmeofService.updateAuthenticationKey).toHaveBeenCalledWith(
+        mockSubsystemNQN,
+        mockGroupName,
+        expect.objectContaining({
+          authType: AUTHENTICATION.Bidirectional,
+          subsystemKey: validKey
+        })
+      );
+    });
+
+    it('should submit Unidirectional authentication without subsystem key', () => {
+      const form = component.authStep?.formGroup;
+      form?.get('authType')?.setValue(AUTHENTICATION.Unidirectional);
+      component.onSubmit();
+      expect(nvmeofService.updateAuthenticationKey).toHaveBeenCalledWith(
+        mockSubsystemNQN,
+        mockGroupName,
+        expect.objectContaining({ authType: AUTHENTICATION.Unidirectional })
+      );
+    });
+
+    it('should show notification and emit closeChange on successful submit', (done) => {
+      // closeChange fires synchronously inside onSubmit's complete handler,
+      // but dismissAll is called after — use setTimeout to assert the full chain.
+      component.closeChange.subscribe(() => {
+        setTimeout(() => {
+          expect(notificationService.show).toHaveBeenCalledWith(
+            expect.anything(),
+            expect.stringContaining('updated'),
+            expect.anything()
+          );
+          expect(modalService.dismissAll).toHaveBeenCalled();
+          done();
+        }, 0);
+      });
+
+      const form = component.authStep?.formGroup;
+      form?.get('authType')?.setValue(AUTHENTICATION.Unidirectional);
+      component.onSubmit();
+    });
+
+    it('should mark form with submission error on API failure', (done) => {
+      const form = component.authStep?.formGroup;
+      form?.get('authType')?.setValue(AUTHENTICATION.Unidirectional);
+      nvmeofService.updateAuthenticationKey.mockReturnValue(
+        throwError(() => ({ status: 500, message: 'Server error' }))
+      );
+
+      component.onSubmit();
+
+      setTimeout(() => {
+        expect(component.isSubmitLoading).toBe(false);
+        expect(form?.hasError('cdSubmitButton')).toBe(true);
+        expect(notificationService.show).not.toHaveBeenCalled();
+        expect(modalService.dismissAll).not.toHaveBeenCalled();
+        done();
+      }, 0);
+    });
+
+    it('should clear isSubmitLoading after error', (done) => {
+      const form = component.authStep?.formGroup;
+      form?.get('authType')?.setValue(AUTHENTICATION.Unidirectional);
+      nvmeofService.updateAuthenticationKey.mockReturnValue(
+        throwError(() => new Error('Network error'))
+      );
+
+      component.onSubmit();
+
+      setTimeout(() => {
+        expect(component.isSubmitLoading).toBe(false);
+        done();
+      }, 0);
+    });
+  });
+});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.ts
new file mode 100644
index 00000000000..0c1b1aac9a3
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.ts
@@ -0,0 +1,179 @@
+import {
+  AfterViewInit,
+  ChangeDetectorRef,
+  Component,
+  EventEmitter,
+  Inject,
+  OnInit,
+  Output,
+  ViewChild
+} from '@angular/core';
+import { FormGroup } from '@angular/forms';
+import { forkJoin } from 'rxjs';
+import { finalize } from 'rxjs/operators';
+
+import { BaseModal } from 'carbon-components-angular';
+import { AuthKeyUpdate, NvmeofService } from '~/app/shared/api/nvmeof.service';
+import {
+  AUTHENTICATION,
+  HostStepType,
+  NvmeofSubsystem,
+  NvmeofSubsystemInitiator,
+  getSubsystemAuthStatus,
+  NvmeofSubsystemAuthType
+} from '~/app/shared/models/nvmeof';
+import { NotificationService } from '~/app/shared/services/notification.service';
+import { NotificationType } from '~/app/shared/enum/notification-type.enum';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
+import { NvmeofSubsystemsStepThreeComponent } from '../nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component';
+
+export const SUBSYSTEM_NQN_TOKEN = 'subsystemNQN';
+export const GROUP_NAME_TOKEN = 'groupName';
+
+@Component({
+  selector: 'cd-nvmeof-edit-authentication',
+  templateUrl: './nvmeof-edit-authentication.component.html',
+  styleUrls: ['./nvmeof-edit-authentication.component.scss'],
+  standalone: false
+})
+export class NvmeofEditAuthenticationComponent extends BaseModal implements OnInit, AfterViewInit {
+  @ViewChild(NvmeofSubsystemsStepThreeComponent)
+  authStep!: NvmeofSubsystemsStepThreeComponent;
+
+  @Output() closeChange = new EventEmitter<void>();
+
+  isSubmitLoading = false;
+  stepTwoValue: HostStepType | null = null;
+  subsystemHasDhchapKey = false;
+  initialAuthType: AUTHENTICATION = AUTHENTICATION.Unidirectional;
+  showAuthAlert = false;
+
+  readonly steps = [{ label: $localize`Authentication`, invalid: false }];
+  readonly title = $localize`Edit authentication`;
+  readonly description = $localize`Configure authentication to verify the identity of connecting hosts and protect the subsystem from unauthorized access.`;
+
+  constructor(
+    @Inject(SUBSYSTEM_NQN_TOKEN) public subsystemNQN: string,
+    @Inject(GROUP_NAME_TOKEN) public groupName: string,
+    private nvmeofService: NvmeofService,
+    private notificationService: NotificationService,
+    private modalCdsService: ModalCdsService,
+    private cdr: ChangeDetectorRef
+  ) {
+    super();
+  }
+
+  ngOnInit() {
+    forkJoin({
+      subsystem: this.nvmeofService.getSubsystem(this.subsystemNQN, this.groupName),
+      initiators: this.nvmeofService.getInitiators(this.subsystemNQN, this.groupName)
+    }).subscribe(({ subsystem, initiators }) => {
+      const sub = subsystem as NvmeofSubsystem;
+      this.subsystemHasDhchapKey = sub.has_dhchap_key;
+      this.initialAuthType = this.deriveAuthType(sub, initiators);
+      this.stepTwoValue = this.buildStepTwoValue(initiators);
+    });
+  }
+
+  /**
+   * @ViewChild is guaranteed to be set by ngAfterViewInit.
+   * Subscribing here ensures the authType form control exists before we attach
+   * the valueChanges listener that drives showAuthAlert.
+   */
+  ngAfterViewInit() {
+    this.authStep.formGroup.get('authType')?.valueChanges.subscribe((authType: AUTHENTICATION) => {
+      this.showAuthAlert = this.subsystemHasDhchapKey && authType === AUTHENTICATION.Unidirectional;
+      this.cdr.markForCheck();
+    });
+  }
+
+  /**
+   * Maps the current subsystem auth status string to the AUTHENTICATION enum
+   * so the form radio pre-selects the correct option on open.
+   */
+  private deriveAuthType(subsystem: NvmeofSubsystem, initiators: unknown): AUTHENTICATION {
+    const status = getSubsystemAuthStatus(
+      subsystem,
+      initiators as NvmeofSubsystemInitiator[] | { hosts?: NvmeofSubsystemInitiator[] }
+    );
+    switch (status) {
+      case NvmeofSubsystemAuthType.BIDIRECTIONAL:
+        return AUTHENTICATION.Bidirectional;
+      case NvmeofSubsystemAuthType.UNIDIRECTIONAL:
+        return AUTHENTICATION.Unidirectional;
+      default:
+        return AUTHENTICATION.Unidirectional;
+    }
+  }
+
+  private buildStepTwoValue(initiators: unknown): HostStepType {
+    const hosts = this.extractHostsFromResponse(initiators);
+    return {
+      addedHosts: hosts.map((h) => h.nqn),
+      hostname: '',
+      hostType: 'specific'
+    };
+  }
+
+  /**
+   * Handles both response shapes from getInitiators:
+   * - direct array: `NvmeofSubsystemInitiator[]`
+   * - object wrapper: `{ hosts: NvmeofSubsystemInitiator[] }`
+   */
+  private extractHostsFromResponse(response: unknown): NvmeofSubsystemInitiator[] {
+    if (!response) {
+      return [];
+    }
+    if (Array.isArray(response)) {
+      return response;
+    }
+    const hostWrapper = response as { hosts?: NvmeofSubsystemInitiator[] };
+    return hostWrapper.hosts ?? [];
+  }
+
+  onSubmit() {
+    const form = this.getValidatedForm();
+    if (!form) {
+      return;
+    }
+
+    this.isSubmitLoading = true;
+
+    const update = this.buildAuthenticationUpdate(form);
+
+    this.nvmeofService
+      .updateAuthenticationKey(this.subsystemNQN, this.groupName, update)
+      .pipe(
+        finalize(() => {
+          this.isSubmitLoading = false;
+        })
+      )
+      .subscribe({
+        error: () => {
+          form.setErrors({ cdSubmitButton: true });
+        },
+        complete: () => {
+          this.notificationService.show(
+            NotificationType.success,
+            $localize`Authentication updated`,
+            $localize`Authentication settings for subsystem ${this.subsystemNQN} have been saved.`
+          );
+          this.closeChange.emit();
+          this.modalCdsService.dismissAll();
+        }
+      });
+  }
+
+  private getValidatedForm(): FormGroup | null {
+    const form = this.authStep?.formGroup;
+    return form && !form.invalid ? form : null;
+  }
+
+  private buildAuthenticationUpdate(form: FormGroup): AuthKeyUpdate {
+    return {
+      authType: form.get('authType')?.value,
+      subsystemKey: form.get('subsystemDchapKey')?.value,
+      hostKeyList: form.get('hostDchapKeyList')?.value
+    };
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index f38f1fe0d4a..b14b435e9df 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -48,18 +48,17 @@
             i18n>Special characters are not allowed.</span>
         </div>
       </div>
-
       <div cdsRow
            class="form-item">
         <div cdsCol>
           <cds-checkbox id="enableCds"
-                        formControlName="enable_auth"
+                        formControlName="enableEncryption"
                         i18n>Enable encryption
           </cds-checkbox>
         </div>
       </div>
 
-      @if (groupForm.controls.enable_auth.value) {
+      @if (groupForm.controls.enableEncryption.value) {
       <div cdsRow
            class="form-item">
         <div cdsCol>
@@ -75,13 +74,13 @@
                       cdValidate
                       #encryptionConfigRef="cdValidate"
                       [invalid]="encryptionConfigRef.isInvalid"
-                      formControlName="encryptionKey"
+                      formControlName="encryptionConfig"
                       cols="100"
                       rows="4"></textarea>
           </cds-textarea-label>
           <span
             class="invalid-feedback"
-            *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
+            *ngIf="groupForm.showError('encryptionConfig', formDir, 'required')"
             i18n>This field is required.</span>
         </div>
       </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
index e873691c077..c975058fe7c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
@@ -27,13 +27,12 @@
             <span class="cds--type-label-01"
                   i18n>Authentication</span>
             <div>
-              <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
-              <span class="cds--type-label-02">
-                {{ detail.value ? 'Bi-directional' : 'No authentication' }}
-              </span>
+              <cd-icon [type]="getAuthStatusIcon(detail.value.toString())"
+                       class="cds-mr-3"></cd-icon>
+              <span class="cds--type-label-02">{{ detail.value }}</span>
               <a cdsLink
-                 [routerLink]="['../hosts']"
-                 [queryParams]="{ group: groupName }"
+                 class="cds-ml-2"
+                 (click)="openEditAuthModal()"
                  [cdsStack]="'horizontal'"
                  [gap]="1">
                 <span i18n>Edit</span>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
index 364ab36502a..4b4dc82ecf9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
@@ -10,13 +10,14 @@ import { GridModule, TilesModule } from 'carbon-components-angular';
 import { NvmeofSubsystemOverviewComponent } from './nvmeof-subsystem-overview.component';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { SharedModule } from '~/app/shared/shared.module';
+import { NvmeofSubsystem, NvmeofSubsystemInitiator } from '~/app/shared/models/nvmeof';
 
 describe('NvmeofSubsystemOverviewComponent', () => {
   let component: NvmeofSubsystemOverviewComponent;
   let fixture: ComponentFixture<NvmeofSubsystemOverviewComponent>;
   let nvmeofService: NvmeofService;
 
-  const mockSubsystem = {
+  const mockSubsystem: NvmeofSubsystem = {
     nqn: 'nqn.2016-06.io.spdk:cnode1',
     serial_number: 'Ceph30487186726692',
     model_number: 'Ceph bdev Controller',
@@ -32,6 +33,51 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     network_mask: []
   };
 
+  const defaultActivatedRoute = {
+    parent: { params: of({ subsystem_nqn: 'nqn.2016-06.io.spdk:cnode1' }) },
+    queryParams: of({ group: 'group1' })
+  };
+
+  /**
+   * Creates a TestBed configuration with custom service overrides.
+   * Avoids repeating the full module declaration in tests that need different mock data.
+   */
+  function createTestBed(
+    initiators: NvmeofSubsystemInitiator[],
+    subsystem: NvmeofSubsystem = mockSubsystem,
+    activatedRoute: object = defaultActivatedRoute
+  ): Promise<ComponentFixture<NvmeofSubsystemOverviewComponent>> {
+    return TestBed.configureTestingModule({
+      declarations: [NvmeofSubsystemOverviewComponent],
+      imports: [
+        HttpClientTestingModule,
+        RouterTestingModule,
+        SharedModule,
+        NgbTooltipModule,
+        TilesModule,
+        GridModule
+      ],
+      providers: [
+        { provide: ActivatedRoute, useValue: activatedRoute },
+        {
+          provide: NvmeofService,
+          useValue: {
+            getSubsystem: jest.fn().mockReturnValue(of(subsystem)),
+            getInitiators: jest.fn().mockReturnValue(of(initiators))
+          }
+        }
+      ]
+    })
+      .compileComponents()
+      .then(() => {
+        const f = TestBed.createComponent(NvmeofSubsystemOverviewComponent);
+        f.detectChanges();
+        tick();
+        f.detectChanges();
+        return f;
+      });
+  }
+
   beforeEach(async () => {
     await TestBed.configureTestingModule({
       declarations: [NvmeofSubsystemOverviewComponent],
@@ -44,19 +90,12 @@ describe('NvmeofSubsystemOverviewComponent', () => {
         GridModule
       ],
       providers: [
-        {
-          provide: ActivatedRoute,
-          useValue: {
-            parent: {
-              params: of({ subsystem_nqn: 'nqn.2016-06.io.spdk:cnode1' })
-            },
-            queryParams: of({ group: 'group1' })
-          }
-        },
+        { provide: ActivatedRoute, useValue: defaultActivatedRoute },
         {
           provide: NvmeofService,
           useValue: {
-            getSubsystem: jest.fn().mockReturnValue(of(mockSubsystem))
+            getSubsystem: jest.fn().mockReturnValue(of(mockSubsystem)),
+            getInitiators: jest.fn().mockReturnValue(of([]))
           }
         }
       ]
@@ -93,44 +132,13 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     expect(component.subsystem.gw_group).toBe('gateway-prod');
   }));
 
-  it('should not fetch when subsystemNQN is missing', fakeAsync(() => {
+  it('should not fetch when subsystemNQN is missing', fakeAsync(async () => {
     TestBed.resetTestingModule();
-    TestBed.configureTestingModule({
-      declarations: [NvmeofSubsystemOverviewComponent],
-      imports: [
-        HttpClientTestingModule,
-        RouterTestingModule,
-        SharedModule,
-        NgbTooltipModule,
-        TilesModule,
-        GridModule
-      ],
-      providers: [
-        {
-          provide: ActivatedRoute,
-          useValue: {
-            parent: {
-              params: of({})
-            },
-            queryParams: of({ group: 'group1' })
-          }
-        },
-        {
-          provide: NvmeofService,
-          useValue: {
-            getSubsystem: jest.fn().mockReturnValue(of(mockSubsystem))
-          }
-        }
-      ]
-    }).compileComponents();
-
-    const newFixture = TestBed.createComponent(NvmeofSubsystemOverviewComponent);
-    const newComponent = newFixture.componentInstance;
+    const noNqnRoute = { parent: { params: of({}) }, queryParams: of({ group: 'group1' }) };
+    const f = await createTestBed([], mockSubsystem, noNqnRoute);
     const newService = TestBed.inject(NvmeofService);
-    newFixture.detectChanges();
-    tick();
     expect(newService.getSubsystem).not.toHaveBeenCalled();
-    expect(newComponent.subsystem).toBeUndefined();
+    expect(f.componentInstance.subsystem).toBeUndefined();
   }));
 
   it('should render detail labels in the template', fakeAsync(() => {
@@ -160,7 +168,23 @@ describe('NvmeofSubsystemOverviewComponent', () => {
 
     const hostAccessText = fixture.nativeElement.textContent;
     expect(hostAccessText).toContain('Allow all hosts');
-    expect(hostAccessText).toContain('Bi-directional');
+    // has_dhchap_key=true but no initiators with use_dhchap → No authentication
+    expect(hostAccessText).toContain('No authentication');
     expect(hostAccessText).toContain('Edit');
   }));
+
+  it('should display Bidirectional when subsystem and host both have keys', fakeAsync(async () => {
+    TestBed.resetTestingModule();
+    const f = await createTestBed([{ nqn: 'nqn.host-1', use_dhchap: true }]);
+    expect(f.nativeElement.textContent).toContain('Bi-directional');
+  }));
+
+  it('should display Unidirectional when only host has a key', fakeAsync(async () => {
+    TestBed.resetTestingModule();
+    const f = await createTestBed([{ nqn: 'nqn.host-1', use_dhchap: true }], {
+      ...mockSubsystem,
+      has_dhchap_key: false
+    });
+    expect(f.nativeElement.textContent).toContain('Unidirectional');
+  }));
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
index 5b9643065d9..1abf3c48262 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
@@ -1,8 +1,17 @@
 import { Component, OnInit } from '@angular/core';
 import { ActivatedRoute } from '@angular/router';
+import { forkJoin } from 'rxjs';
+
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
-import { NvmeofSubsystem } from '~/app/shared/models/nvmeof';
+import {
+  NvmeofSubsystem,
+  NvmeofSubsystemInitiator,
+  NO_AUTH,
+  getSubsystemAuthStatus
+} from '~/app/shared/models/nvmeof';
 import { ICON_TYPE } from '~/app/shared/enum/icons.enum';
+import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
+import { NvmeofEditAuthenticationComponent } from '../nvmeof-edit-authentication/nvmeof-edit-authentication.component';
 
 export interface SubsystemDetail {
   label: string;
@@ -24,7 +33,11 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
   subsystem!: NvmeofSubsystem;
   details: SubsystemDetail[] = [];
 
-  constructor(private route: ActivatedRoute, private nvmeofService: NvmeofService) {}
+  constructor(
+    private route: ActivatedRoute,
+    private nvmeofService: NvmeofService,
+    private modalService: ModalCdsService
+  ) {}
 
   ngOnInit() {
     this.route.parent?.params.subscribe((params) => {
@@ -44,13 +57,19 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
   }
 
   fetchSubsystem() {
-    this.nvmeofService.getSubsystem(this.subsystemNQN, this.groupName).subscribe((subsystem) => {
+    forkJoin({
+      subsystem: this.nvmeofService.getSubsystem(this.subsystemNQN, this.groupName),
+      initiators: this.nvmeofService.getInitiators(this.subsystemNQN, this.groupName)
+    }).subscribe(({ subsystem, initiators }) => {
       this.subsystem = subsystem as NvmeofSubsystem;
-      this.buildDetails();
+      const initiatorList = initiators as
+        | NvmeofSubsystemInitiator[]
+        | { hosts?: NvmeofSubsystemInitiator[] };
+      this.buildDetails(getSubsystemAuthStatus(this.subsystem, initiatorList));
     });
   }
 
-  private buildDetails() {
+  private buildDetails(authStatus: string) {
     this.details = [
       {
         label: $localize`Serial number`,
@@ -73,7 +92,7 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
       },
       {
         label: $localize`Authentication`,
-        value: this.subsystem.has_dhchap_key,
+        value: authStatus,
         type: 'auth',
         row: 2
       },
@@ -124,6 +143,10 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
     return String(value);
   }
 
+  getAuthStatusIcon(authStatus: string): keyof typeof ICON_TYPE {
+    return authStatus === NO_AUTH ? 'error' : 'success';
+  }
+
   getStatusIcon(detail: SubsystemDetail): keyof typeof ICON_TYPE {
     return detail.value ? 'success' : 'error';
   }
@@ -140,4 +163,14 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
     const needed = 3 - this.getDetailsForRow(row).length;
     return Array.from({ length: needed });
   }
+
+  openEditAuthModal() {
+    const modalRef = this.modalService.show(NvmeofEditAuthenticationComponent, {
+      subsystemNQN: this.subsystemNQN,
+      groupName: this.groupName
+    });
+    if (modalRef?.closeChange) {
+      modalRef.closeChange.subscribe(() => this.fetchSubsystem());
+    }
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.ts
index 9bfc3c4c0cd..e6670359952 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.ts
@@ -15,6 +15,13 @@ import { TearsheetStep } from '~/app/shared/models/tearsheet-step';
 })
 export class NvmeofSubsystemsStepThreeComponent implements OnInit, TearsheetStep {
   @Input() group!: string;
+  @Input() set initialAuthType(value: AUTHENTICATION) {
+    this._initialAuthType = value;
+    if (this.formGroup) {
+      this.formGroup.get('authType')?.setValue(value, { emitEvent: false });
+      this.refreshHostKeyValidation();
+    }
+  }
   @Input() set stepTwoValue(value: HostStepType | null) {
     this._addedHosts = value?.addedHosts ?? [];
     if (this.formGroup) {
@@ -31,6 +38,7 @@ export class NvmeofSubsystemsStepThreeComponent implements OnInit, TearsheetStep
   };
   AUTHENTICATION = AUTHENTICATION;
 
+  _initialAuthType: AUTHENTICATION = AUTHENTICATION.Unidirectional;
   _addedHosts: Array<string> = [];
 
   constructor(public actionLabels: ActionLabelsI18n) {}
@@ -55,7 +63,7 @@ export class NvmeofSubsystemsStepThreeComponent implements OnInit, TearsheetStep
 
   private createForm() {
     this.formGroup = new CdFormGroup({
-      authType: new UntypedFormControl(AUTHENTICATION.Unidirectional),
+      authType: new UntypedFormControl(this._initialAuthType),
       subsystemDchapKey: new UntypedFormControl(null, [
         CdValidators.base64(),
         CdValidators.requiredIf({
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
index 121299a9d30..fb3bb1c9ede 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/nvmeof.service.ts
@@ -5,7 +5,12 @@ import _ from 'lodash';
 import { Observable, forkJoin, of as observableOf } from 'rxjs';
 import { catchError, map, mapTo, mergeMap, switchMap } from 'rxjs/operators';
 import { CephServiceSpec } from '../models/service.interface';
-import { ListenerItem, NvmeofSubsystem, NvmeofSubsystemNamespace } from '../models/nvmeof';
+import {
+  AUTHENTICATION,
+  ListenerItem,
+  NvmeofSubsystem,
+  NvmeofSubsystemNamespace
+} from '../models/nvmeof';
 import { HostService } from './host.service';
 import { OrchestratorService } from './orchestrator.service';
 import { HostStatus } from '../enum/host-status.enum';
@@ -65,6 +70,12 @@ export type NamespaceInitiatorRequest = InitiatorRequest & {
   subsystem_nqn: string;
 };
 
+export type AuthKeyUpdate = {
+  authType: AUTHENTICATION;
+  subsystemKey: string | null;
+  hostKeyList: Array<{ host_nqn: string; dhchap_key: string | null }>;
+};
+
 const API_PATH = 'api/nvmeof';
 const UI_API_PATH = 'ui-api/nvmeof';
 
@@ -300,6 +311,14 @@ export class NvmeofService {
     });
   }
 
+  changeSubsystemKey(subsystemNQN: string, dhchapKey: string, gwGroup: string) {
+    return this.http.put(
+      `${API_PATH}/subsystem/${subsystemNQN}/change_key`,
+      { dhchap_key: dhchapKey, gw_group: gwGroup },
+      { observe: 'response' }
+    );
+  }
+
   updateHostKey(subsystemNQN: string, request: InitiatorRequest) {
     return this.http.put(
       `${API_PATH}/subsystem/${subsystemNQN}/host/${request.host_nqn}/change_key`,
@@ -310,6 +329,31 @@ export class NvmeofService {
     );
   }
 
+  updateAuthenticationKey(
+    subsystemNQN: string,
+    gwGroup: string,
+    update: AuthKeyUpdate
+  ): Observable<void> {
+    const { authType, subsystemKey, hostKeyList } = update;
+
+    const subsystemKeyCall =
+      authType === AUTHENTICATION.Bidirectional && subsystemKey
+        ? this.changeSubsystemKey(subsystemNQN, subsystemKey, gwGroup)
+        : observableOf(null);
+
+    const hostKeyCalls = hostKeyList
+      .filter((item) => !!item.dhchap_key)
+      .map((item) =>
+        this.updateHostKey(subsystemNQN, {
+          host_nqn: item.host_nqn,
+          dhchap_key: item.dhchap_key,
+          gw_group: gwGroup
+        }).pipe(catchError(() => observableOf(null)))
+      );
+
+    return forkJoin([subsystemKeyCall, ...hostKeyCalls]).pipe(map(() => undefined));
+  }
+
   removeInitiators(subsystemNQN: string, request: InitiatorRequest) {
     return this.http.delete(
       `${UI_API_PATH}/subsystem/${subsystemNQN}/host/${request.host_nqn}/${request.gw_group}`,
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index b72f8e2893c..3b3a64eff03 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -13545,6 +13545,68 @@ paths:
       summary: Get information from a specific NVMeoF subsystem
       tags:
       - NVMe-oF Subsystem
+  /api/nvmeof/subsystem/{nqn}/change_key:
+    put:
+      parameters:
+      - description: NVMeoF subsystem NQN
+        in: path
+        name: nqn
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              properties:
+                dhchap_key:
+                  description: Subsystem DH-HMAC-CHAP key
+                  type: string
+                gw_group:
+                  description: NVMeoF gateway group
+                  type: string
+                server_address:
+                  description: NVMeoF gateway address
+                  type: string
+                traddr:
+                  description: NVMeoF gateway address (deprecated)
+                  type: string
+              required:
+              - dhchap_key
+              type: object
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Resource updated.
+        '202':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: Operation is still executing. Please check the task queue.
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Change subsystem inband authentication key
+      tags:
+      - NVMe-oF Subsystem
   /api/nvmeof/subsystem/{nqn}/connection:
     get:
       parameters:

From f45a073d9dd1fe9c7fc140de564e8453e06dfebb Mon Sep 17 00:00:00 2001
From: Anthony D'Atri <anthonyeleven@users.noreply.github.com>
Date: Sun, 28 Jun 2026 15:20:36 -0400
Subject: [PATCH 541/596] doc: Improve src/common/options/mds-client.yaml.in

Signed-off-by: Anthony D'Atri <anthonyeleven@users.noreply.github.com>
---
 src/common/options/mds-client.yaml.in | 112 ++++++++++++++------------
 1 file changed, 60 insertions(+), 52 deletions(-)

diff --git a/src/common/options/mds-client.yaml.in b/src/common/options/mds-client.yaml.in
index 94d717dfbe9..3291d941529 100644
--- a/src/common/options/mds-client.yaml.in
+++ b/src/common/options/mds-client.yaml.in
@@ -24,7 +24,7 @@ options:
 - name: client_use_random_mds
   type: bool
   level: dev
-  desc: issue new requests to a random active MDS
+  desc: Issue new requests to a random active MDS
   fmt_desc: Choose random MDS for each request.
   default: false
   services:
@@ -34,7 +34,7 @@ options:
   type: secs
   level: advanced
   desc: timeout for mounting CephFS (seconds)
-  fmt_desc: Set the timeout for CephFS mount in seconds.
+  fmt_desc: Set the timeout in seconds for CephFS mounts.
   default: 5_min
   services:
   - mds_client
@@ -42,21 +42,21 @@ options:
   type: secs
   level: dev
   desc: seconds between client upkeep ticks
-  fmt_desc: Set the interval in seconds between capability renewal and other upkeep.
+  fmt_desc: Set the interval in seconds between capability renewal and other upkeep iterations.
   default: 1
   services:
   - mds_client
 - name: client_trace
   type: str
   level: dev
-  desc: file containing trace of client operations
+  desc: File containing a trace of client operations
   services:
   - mds_client
   with_legacy: true
 - name: client_readahead_min
   type: size
   level: advanced
-  desc: minimum bytes to readahead in a file
+  desc: Minimum bytes to read ahead in a file
   fmt_desc: Set the minimum number bytes that the client reads ahead.
   default: 128_K
   services:
@@ -65,7 +65,7 @@ options:
 - name: client_readahead_max_bytes
   type: size
   level: advanced
-  desc: maximum bytes to readahead in a file (zero is unlimited)
+  desc: Maximum bytes to read ahead in a file (zero is unlimited)
   fmt_desc: Set the maximum number of bytes that the client reads ahead for
     future read operations. Overridden by the ``client_readahead_max_periods``
     setting.
@@ -77,7 +77,7 @@ options:
 - name: client_readahead_max_periods
   type: int
   level: advanced
-  desc: maximum stripe periods to readahead in a file
+  desc: Maximum stripe periods to read ahead in a file
   fmt_desc: Set the number of file layout periods (object size * number of
     stripes) that the client reads ahead. Overrides the
     ``client_readahead_max_bytes`` setting.
@@ -88,14 +88,14 @@ options:
 - name: client_reconnect_stale
   type: bool
   level: advanced
-  desc: reconnect when the session becomes stale
+  desc: Reconnect when the session becomes stale
   default: false
   services:
   - mds_client
 - name: client_snapdir
   type: str
   level: advanced
-  desc: pseudo directory for snapshot access to a directory
+  desc: Subdirectory name for snapshot access (not a real subdirectory)
   fmt_desc: Set the snapshot directory name.
   default: .snap
   services:
@@ -104,8 +104,8 @@ options:
 - name: client_mountpoint
   type: str
   level: advanced
-  desc: default mount-point
-  fmt_desc: Directory to mount on the CephFS file system. An alternative to the
+  desc: Default mountpoint
+  fmt_desc: Directory on which to mount a the CephFS file system. An alternative to the
     ``-r`` option of the ``ceph-fuse`` command.
   default: /
   services:
@@ -113,7 +113,7 @@ options:
 - name: client_mount_uid
   type: int
   level: advanced
-  desc: uid to mount as
+  desc: UID as which to mount
   default: -1
   services:
   - mds_client
@@ -122,7 +122,7 @@ options:
 - name: client_mount_gid
   type: int
   level: advanced
-  desc: gid to mount as
+  desc: GID as which to mount
   fmt_desc: Set the group ID of CephFS mount.
   default: -1
   services:
@@ -149,7 +149,7 @@ options:
   services:
   - mds_client
   fmt_desc: Set the delay between capability releases in seconds. The delay
-    sets how many   seconds a client waits to release capabilities that it no
+    sets how many seconds a client waits to release capabilities that it no
     longer needs in case the capabilities are needed for another user space
     operation.
 - name: client_quota_df
@@ -164,7 +164,7 @@ options:
 - name: client_oc
   type: bool
   level: advanced
-  desc: enable object caching
+  desc: Enable object caching
   default: true
   services:
   - mds_client
@@ -172,8 +172,8 @@ options:
 - name: client_oc_size
   type: size
   level: advanced
-  desc: maximum size of object cache
-  fmt_desc: Set how many bytes of data will the client cache.
+  desc: Maximum size of object cache
+  fmt_desc: Set how many bytes of data the client may cache.
   default: 200_M
   services:
   - mds_client
@@ -184,7 +184,7 @@ options:
 - name: client_oc_max_dirty
   type: size
   level: advanced
-  desc: maximum size of dirty pages in object cache
+  desc: Maximum size of dirty pages in object cache
   fmt_desc: Set the maximum number of dirty bytes in the object cache.
   default: 100_M
   services:
@@ -196,7 +196,7 @@ options:
 - name: client_oc_target_dirty
   type: size
   level: advanced
-  desc: target size of dirty pages object cache
+  desc: Target size of dirty pages object cache
   fmt_desc: Set the target size of dirty data. We recommend to keep this number low.
   default: 8_M
   services:
@@ -207,7 +207,7 @@ options:
 - name: client_oc_max_dirty_age
   type: float
   level: advanced
-  desc: maximum age of dirty pages in object cache (seconds)
+  desc: Maximum age in seconds of dirty pages in the object cache
   fmt_desc: Set the maximum age in seconds of dirty data in the object cache
     before writeback.
   default: 5
@@ -219,7 +219,7 @@ options:
 - name: client_oc_max_objects
   type: int
   level: advanced
-  desc: maximum number of objects in cache
+  desc: Maximum number of objects in the cache
   fmt_desc: Set the maximum number of objects in the object cache.
   default: 1000
   services:
@@ -227,18 +227,18 @@ options:
   flags:
   - runtime
   with_legacy: true
-# check if MDS reply contains wanted caps
 - name: client_debug_getattr_caps
   type: bool
   level: dev
+  desc: Should the client check MDS replies for wanted capabiliites?
   default: false
   services:
   - mds_client
   with_legacy: true
-# always read synchronously (go to osds)
 - name: client_debug_force_sync_read
   type: bool
   level: dev
+  desc: Should the client bypass the local page cache?
   default: false
   services:
   - mds_client
@@ -263,24 +263,25 @@ options:
   type: size
   level: dev
   default: 4_K
+  desc: Maximum size of inlined data
   services:
   - mds_client
   fmt_desc: Set the maximum size of inlined data stored in a file inode rather
     than in a separate data object in RADOS. This setting only applies if the
     ``inline_data`` flag is set on the MDS map.
   with_legacy: true
-# synthetic client bug for testing
 - name: client_inject_release_failure
   type: bool
   level: dev
+  desc: Simulate a client inject release failure for testing purposes
   default: false
   services:
   - mds_client
   with_legacy: true
-# synthetic client bug for testing
 - name: client_inject_fixed_oldest_tid
   type: bool
   level: dev
+  desc: Simulate a specific client bug for testing purposes
   default: false
   services:
   - mds_client
@@ -288,7 +289,7 @@ options:
 - name: client_metadata
   type: str
   level: advanced
-  desc: metadata key=value comma-delimited pairs appended to session metadata
+  desc: Metadata key=value comma-delimited pairs to append to session metadata
   fmt_desc: Comma-delimited strings for client metadata sent to each MDS, in addition
     to the automatically generated version, host name, and other metadata.
   services:
@@ -307,7 +308,7 @@ options:
 - name: client_permissions
   type: bool
   level: advanced
-  desc: client-enforced permission checking
+  desc: Whether to enable client-enforced permission checking
   fmt_desc: Check client permissions on all I/O operations.
   default: true
   services:
@@ -317,9 +318,9 @@ options:
 - name: client_dirsize_rbytes
   type: bool
   level: advanced
-  desc: set the directory size as the number of file bytes recursively used
+  desc: Set the directory size as the number of file bytes recursively stored
   long_desc: This option enables a CephFS feature that stores the recursive directory
-    size (the bytes used by files in the directory and its descendents) in the st_size
+    size (the bytes stored in files in the directory and its descendents) in the st_size
     field of the stat structure. May confuse programs such as ``rsync``.
   default: true
   services:
@@ -330,6 +331,7 @@ options:
 - name: client_force_lazyio
   type: bool
   level: advanced
+  desc: Should the client force lazy IO?
   default: false
   services:
   - mds_client
@@ -338,14 +340,14 @@ options:
 - name: fuse_use_invalidate_cb
   type: bool
   level: advanced
-  desc: use fuse 2.8+ invalidate callback to keep page cache consistent
+  desc: Should the client use FUSE 2.8+ invalidate callback to keep page cache consistent?
   default: true
   services:
   - mds_client
 - name: fuse_disable_pagecache
   type: bool
   level: advanced
-  desc: disable page caching in the kernel for this FUSE mount
+  desc: Disable page caching in the kernel for this FUSE mount
   fmt_desc: If set to ``true``, kernel page cache is disabled for ``ceph-fuse``
     mounts. When multiple clients read/write to a file at the same
     time, readers may get stale data from page cache. Due to
@@ -356,14 +358,14 @@ options:
 - name: fuse_allow_other
   type: bool
   level: advanced
-  desc: pass allow_other to FUSE on mount
+  desc: Pass allow_other to FUSE on mount
   default: true
   services:
   - mds_client
 - name: fuse_default_permissions
   type: bool
   level: advanced
-  desc: pass default_permisions to FUSE on mount
+  desc: Pass default_permisions to FUSE on mount
   fmt_desc: When set to ``false``, ``ceph-fuse`` utility checks does its own
     permissions checking, instead of relying on the permissions enforcement in
     FUSE. Set to ``false`` together with the ``client acl type=posix_acl``
@@ -376,21 +378,21 @@ options:
 - name: fuse_splice_read
   type: bool
   level: advanced
-  desc: enable splice read to reduce the memory copies
+  desc: Enable splice read to reduce memory copies
   default: true
   services:
   - mds_client
 - name: fuse_splice_write
   type: bool
   level: advanced
-  desc: enable splice write to reduce the memory copies
+  desc: Enable splice write to reduce memory copies
   default: true
   services:
   - mds_client
 - name: fuse_splice_move
   type: bool
   level: advanced
-  desc: enable splice move to reduce the memory copies
+  desc: Enable splice move to reduce memory copies
   default: true
   services:
   - mds_client
@@ -404,7 +406,7 @@ options:
 - name: fuse_max_write
   type: size
   level: advanced
-  desc: set the maximum number of bytes in a single write operation
+  desc: Set the maximum number of bytes in a single write operation
   long_desc: Set the maximum number of bytes in a single write operation that may
     pass atomically through FUSE. The FUSE default is 128kB and may be indicated by
     setting this option to 0.
@@ -416,14 +418,14 @@ options:
 - name: fuse_atomic_o_trunc
   type: bool
   level: advanced
-  desc: pass atomic_o_trunc flag to FUSE on mount
+  desc: Pass the atomic_o_trunc flag to FUSE on mount
   default: true
   services:
   - mds_client
 - name: fuse_debug
   type: bool
   level: advanced
-  desc: enable debugging for the libfuse
+  desc: Enable debugging for libfuse
   default: false
   services:
   - mds_client
@@ -433,35 +435,36 @@ options:
 - name: fuse_multithreaded
   type: bool
   level: advanced
-  desc: allow parallel processing through FUSE library
+  desc: Allow parallel processing through the FUSE library
   default: true
   services:
   - mds_client
 - name: fuse_require_active_mds
   type: bool
   level: advanced
-  desc: require active MDSs in the file system when mounting
+  desc: Require active MDSes when mounting
   default: true
   services:
   - mds_client
 - name: fuse_syncfs_on_mksnap
   type: bool
   level: advanced
-  desc: synchronize all local metadata/file changes after snapshot
+  desc: Synchronize all local metadata/file changes after snapshot
   default: true
   services:
   - mds_client
 - name: fuse_set_user_groups
   type: bool
   level: advanced
-  desc: check for ceph-fuse to consider supplementary groups for permissions
+  desc: Should ceph-fuse consider supplementary groups for permissions?
   default: true
   services:
   - mds_client
-# the client should try to use dentry invalidation instead of remounting, on kernels it believes that will work for
 - name: client_try_dentry_invalidate
   type: bool
   level: dev
+  desc: Should the client try to use dentry invalidation instead of remounting, when it
+    believes this will work with the running kernel?
   default: false
   services:
   - mds_client
@@ -469,14 +472,15 @@ options:
 - name: client_max_retries_on_remount_failure
   type: uint
   level: advanced
-  desc: number of consecutive failed remount attempts for invalidating kernel dcache
-    after which client would abort.
+  desc: Number of consecutive failed remount attempts for invalidating kernel dcache
+    after which client will abort.
   default: 5
   services:
   - mds_client
 - name: client_die_on_failed_remount
   type: bool
   level: dev
+  desc: Should the client die on a failed remount?
   default: false
   services:
   - mds_client
@@ -494,7 +498,7 @@ options:
 - name: client_check_pool_perm
   type: bool
   level: advanced
-  desc: confirm access to inode's data pool/namespace described in file layout
+  desc: Confirm access to inode's data pool/namespace described in file layout
   default: true
   services:
   - mds_client
@@ -502,6 +506,7 @@ options:
 - name: client_use_faked_inos
   type: bool
   level: dev
+  desc: Should the client use fake inos?
   default: false
   services:
   - mds_client
@@ -558,7 +563,7 @@ options:
 - name: client_shutdown_timeout
   type: secs
   level: advanced
-  desc: timeout for shutting down CephFS
+  desc: Timeout for shutting down CephFS
   long_desc: Timeout for shutting down CephFS via unmount or shutdown.
   default: 30
   tags:
@@ -571,7 +576,7 @@ options:
 - name: client_collect_and_send_global_metrics
   type: bool
   level: advanced
-  desc: to enable and force collecting and sending the global metrics to MDS
+  desc: Whether to enable and force collecting and sending the global metrics to MDS
   long_desc: To be careful for this, when connecting to some old ceph clusters
     it may crash the MDS daemons while upgrading.
   default: false
@@ -605,7 +610,7 @@ options:
 - name: client_file_blockdiff_max_concurrent_object_scans
   type: uint
   level: advanced
-  desc: maximum number of concurrent object scans
+  desc: Maximum number of concurrent object scans
   long_desc: Maximum number of concurrent listsnaps operations sent to RADOS.
   default: 16
   services:
@@ -614,8 +619,11 @@ options:
 - name: client_inject_write_delay_secs
   type: secs
   level: dev
-  desc: induce delay in write operation for testing
-  long_desc: Inject a delay in write operation after grabbing required cap references (Fb caps in this case). This config is disabled by default (value of 0) and is to be used for the purpose of validating a race case bug with concurrent fsync.
+  desc: Induce delay in write operation for testing
+  long_desc: Inject a delay in write operation after grabbing required
+    cap references (Fb caps in this case). This config is disabled by
+    default (value of 0) and is to be used for the purpose of validating
+    a race case bug with concurrent fsync.
   default: 0
   services:
   - mds_client

From e6a2a8d996b12eb2e3b23884355905f523a64672 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Sat, 4 Jul 2026 03:23:05 +0530
Subject: [PATCH 542/596] =?UTF-8?q?mgr/dashboard:=20NVMe-oF=20=E2=80=93=20?=
 =?UTF-8?q?Subsystem=20Resource=20page=20enhancements?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fixes:https://tracker.ceph.com/issues/77789

Signed-off-by: pujaoshahu <pshahu@redhat.com>

# Conflicts:
#	src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
#	src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
#	src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
#	src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
---
 .../nvmeof-group-form.component.html              |  6 +++---
 .../nvmeof-group-form.component.spec.ts           |  6 ++++--
 .../nvmeof-group-form.component.ts                | 10 +++++-----
 .../nvmeof-subsystem-overview.component.spec.ts   |  2 ++
 .../nvmeof-subsystem-overview.component.ts        |  6 ++++++
 .../service-form/service-form.component.spec.ts   |  3 ++-
 .../service-form/service-form.component.ts        | 15 ++++++++++-----
 .../shared/datatable/table/table.component.html   |  2 +-
 .../app/shared/datatable/table/table.component.ts |  3 +++
 9 files changed, 36 insertions(+), 17 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index b14b435e9df..94cf5fc5b58 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -52,7 +52,7 @@
            class="form-item">
         <div cdsCol>
           <cds-checkbox id="enableCds"
-                        formControlName="enableEncryption"
+                        formControlName="enable_auth"
                         i18n>Enable encryption
           </cds-checkbox>
         </div>
@@ -74,13 +74,13 @@
                       cdValidate
                       #encryptionConfigRef="cdValidate"
                       [invalid]="encryptionConfigRef.isInvalid"
-                      formControlName="encryptionConfig"
+                      formControlName="encryptionKey"
                       cols="100"
                       rows="4"></textarea>
           </cds-textarea-label>
           <span
             class="invalid-feedback"
-            *ngIf="groupForm.showError('encryptionConfig', formDir, 'required')"
+            *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
             i18n>This field is required.</span>
         </div>
       </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
index 640d7a7d0bc..5b77ae89ceb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
@@ -43,7 +43,9 @@ describe('NvmeofGroupFormComponent', () => {
         SelectModule
       ],
       schemas: [CUSTOM_ELEMENTS_SCHEMA]
-    }).compileComponents();
+    })
+      .overrideTemplate(NvmeofGroupFormComponent, '')
+      .compileComponents();
 
     fixture = TestBed.createComponent(NvmeofGroupFormComponent);
     component = fixture.componentInstance;
@@ -159,7 +161,7 @@ describe('NvmeofGroupFormComponent', () => {
 
       component.groupForm.get('groupName').setValue('encrypted-group');
       component.groupForm.get('enableEncryption').setValue(true);
-      component.groupForm.get('encryptionConfig').setValue('encryption-key-123');
+      component.groupForm.get('encryptionKey').setValue('encryption-key-123');
       component.onSubmit();
 
       expect(cephServiceService.create).toHaveBeenCalledWith(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index ac97aa3a3b8..7053bbbe9f9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -145,12 +145,12 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       this.groupForm.setErrors({ cdSubmitButton: true });
       return;
     }
-    let taskUrl = `service/${URLVerbs.CREATE}`;
-    const serviceName = `${formValues.groupName}`;
+    const taskUrl = `service/${URLVerbs.CREATE}`;
+    const serviceId = `${formValues.groupName}`;
 
     const serviceSpec: Record<string, any> = {
       service_type: 'nvmeof',
-      service_id: serviceName,
+      service_id: serviceId,
       group: formValues.groupName,
       placement: {
         hosts: selectedHostnames
@@ -173,7 +173,7 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
 
       if (formValues.pool) {
         serviceSpec['pool'] = formValues.pool;
-        serviceSpec['service_id'] = `${formValues.pool}.${serviceName}`;
+        serviceSpec['service_id'] = `${formValues.pool}.${formValues.groupName}`;
       }
 
       if (
@@ -195,7 +195,7 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     this.taskWrapperService
       .wrapTaskAroundCall({
         task: new FinishedTask(taskUrl, {
-          service_name: `nvmeof.${serviceName}`
+          service_name: `nvmeof.${serviceId}`
         }),
         call: this.cephServiceService.create(serviceSpec)
       })
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
index 4b4dc82ecf9..f86a3acb95d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
@@ -130,6 +130,7 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     expect(component.subsystem.namespace_count).toBe(3);
     expect(component.subsystem.max_namespaces).toBe(256);
     expect(component.subsystem.gw_group).toBe('gateway-prod');
+    expect(component.subsystem.subtype).toBe('NVMe');
   }));
 
   it('should not fetch when subsystemNQN is missing', fakeAsync(async () => {
@@ -152,6 +153,7 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     expect(labelTexts).toContain('Serial number');
     expect(labelTexts).toContain('Model Number');
     expect(labelTexts).toContain('Gateway group');
+    expect(labelTexts).toContain('Subsystem Type');
     expect(labelTexts).toContain('Host access');
     expect(labelTexts).toContain('Authentication');
     expect(labelTexts).toContain('Listeners');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
index 1abf3c48262..acb97b9a4e8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
@@ -84,6 +84,12 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
         type: 'text',
         row: 1
       },
+      {
+        label: $localize`Subsystem Type`,
+        value: this.subsystem.subtype,
+        type: 'text',
+        row: 2
+      },
       {
         label: $localize`Host access`,
         value: this.subsystem.allow_any_host ?? false,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
index 3b56e8df9bd..18fe82a0959 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.spec.ts
@@ -597,12 +597,13 @@ x4Ea7kGVgx9kWh5XjWz9wjZvY49UKIT5ppIAWPMbLl3UpfckiuNhTA==
         component.onSubmit();
         expect(cephServiceService.create).toHaveBeenCalledWith({
           service_type: 'nvmeof',
-          service_id: 'default',
+          service_id: 'rbd.default',
           placement: {},
           unmanaged: false,
           group: 'default',
           enable_auth: true,
           ssl: true,
+          pool: 'rbd',
           certificate_source: 'inline',
           root_ca_cert: 'root_ca_cert',
           client_cert: 'client_cert',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index c52f488b031..33f6d602c4c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -1198,6 +1198,10 @@ export class ServiceFormComponent extends CdForm implements OnInit {
 
     this.getDefaultPlacementCount(selectedServiceType);
 
+    if (selectedServiceType === 'nvmeof' && this.rbdPools?.length > 0) {
+      this.serviceForm.get('pool').setValue(this.rbdPools[0].pool_name);
+    }
+
     if (selectedServiceType === 'rgw') {
       this.setRgwFields();
     }
@@ -1374,13 +1378,14 @@ export class ServiceFormComponent extends CdForm implements OnInit {
           serviceSpec['ssl'] = true;
           serviceSpec['certificate_source'] =
             values['certificateType'] === CertificateType.internal ? 'cephadm-signed' : 'inline';
-          if (
-            values['certificateType'] === CertificateType.internal &&
-            values['custom_sans']?.length > 0
-          ) {
-            serviceSpec['custom_sans'] = values['custom_sans'];
+          if (values['certificateType'] === CertificateType.internal) {
+            if (values['custom_sans']?.length > 0) {
+              serviceSpec['custom_sans'] = values['custom_sans'];
+            }
           }
           if (values['certificateType'] === CertificateType.external) {
+            serviceSpec['pool'] = values['pool'];
+            serviceSpec['service_id'] = `${values['pool']}.${values['group']}`;
             serviceSpec['root_ca_cert'] = values['root_ca_cert'];
             serviceSpec['client_cert'] = values['client_cert'];
             serviceSpec['client_key'] = values['client_key'];
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
index feed57940b8..51485d12c04 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
@@ -127,7 +127,7 @@
           }}
           @if (customFilter) {
           @for (filter of stagedCustomFilters; track filter.id; let i = $index) {
-            @if (isCustomFilterLabel()) {
+            @if (isCustomFilterString) {
               <div cdsRow
                    class="cds-mt-4 cds--type-body-02">
                 Filter {{ customFilter }}:
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
index d44f5f053b4..975905b9d37 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.ts
@@ -206,6 +206,9 @@ export class TableComponent implements AfterViewInit, OnInit, OnChanges, OnDestr
   */
   @Input()
   customFilter: boolean | string = false;
+  get isCustomFilterString(): boolean {
+    return typeof this.customFilter === 'string';
+  }
 
   isCustomFilterLabel(): boolean {
     return typeof this.customFilter === 'string';

From 89cb0fc152ba3c7719353f51d970ff2b8b910293 Mon Sep 17 00:00:00 2001
From: Kefu Chai <k.chai@proxmox.com>
Date: Sat, 4 Jul 2026 08:54:17 +0800
Subject: [PATCH 543/596] monitoring/ceph-mixin: scope test queries per
 dashboard

get_dashboards_data() keeps every query in a single map keyed by
"<panel title>-<legendFormat>", but that id is not unique: several
dashboards have a panel titled "IOPS", "OSDs" or "Throughput". The
dashboard read last overwrites the earlier entry, so one query shadows
another and never gets tested. glob() walks the files in filesystem
order, so which query survives, and whether the test passes, depends on
readdir.

run-tox-promql-query-test hit this in "Test IOPS Read"
(ceph-cluster.feature): the scenario feeds ceph_osd_op_r but the id
resolved to a CephFS pool panel.

    FAILED:
      expr: "sum(rate(ceph_pool_rd{cluster=~"mycluster|",  pool_id=~"UNSET VARIABLE"}[1m]))", time: 1m,
          exp:"{} 2.5E+01"
          got:"nil"
    HOOK-ERROR in after_scenario: AssertionError:

pool_id is "UNSET VARIABLE" because the scenario does not set $mdatapool,
and no ceph_pool_rd series were fed, so the query returns nil. It only
fails when readdir returns cephfsdashboard after ceph-cluster-advanced,
so the earlier change that walked nested rows and made the winner
deterministic did not fix it; it fixed which query wins, not that the
wrong one can win.

Key the queries per dashboard (data['queries'][<dashboard>][<id>]) and
have each .feature name its dashboard in a Background step. The lookup is
confined to that dashboard, so a title/legend used elsewhere no longer
shadows it. A duplicate within one dashboard is still an error, unless it
is in a collapsed row.

ceph-cluster.feature covers ceph-cluster-advanced; the rest map to one
dashboard each.

Signed-off-by: Kefu Chai <k.chai@proxmox.com>
---
 .../features/ceph-cluster.feature             |  3 +++
 .../tests_dashboards/features/environment.py  | 26 ++++++++++++++-----
 .../features/host-details.feature             |  3 +++
 .../features/hosts_overview.feature           |  3 +++
 .../features/osd-device-details.feature       |  3 +++
 .../features/osds-overview.feature            |  3 +++
 .../features/radosgw-detail.feature           |  3 +++
 .../features/radosgw_overview.feature         |  3 +++
 .../ceph-mixin/tests_dashboards/util.py       | 26 +++++++++----------
 9 files changed, 53 insertions(+), 20 deletions(-)

diff --git a/monitoring/ceph-mixin/tests_dashboards/features/ceph-cluster.feature b/monitoring/ceph-mixin/tests_dashboards/features/ceph-cluster.feature
index c144e52664d..e8522128653 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/ceph-cluster.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/ceph-cluster.feature
@@ -1,5 +1,8 @@
 Feature: Ceph Cluster Dashboard
 
+  Background:
+    Given the dashboard is `ceph-cluster-advanced`
+
   Scenario: "Test cluster health"
   Given the following series:
     | metrics                  | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/environment.py b/monitoring/ceph-mixin/tests_dashboards/features/environment.py
index 921474015c8..4d710c75e70 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/environment.py
+++ b/monitoring/ceph-mixin/tests_dashboards/features/environment.py
@@ -15,6 +15,7 @@ class GlobalContext:
         self.promql_expr_test = None
         self.data = get_dashboards_data()
         self.query_map = self.data['queries']
+        self.dashboard = None
 
     def reset_promql_test(self):
         self.promql_expr_test = PromqlTest()
@@ -53,6 +54,7 @@ global_context = GlobalContext()
 
 def before_scenario(context, scenario):
     global_context.reset_promql_test()
+    global_context.dashboard = None
 
 
 def after_scenario(context, scenario):
@@ -63,6 +65,14 @@ def after_all(context):
     global_context.print_query_stats()
 
 
+@given('the dashboard is `{dashboard}`')
+def step_impl(context, dashboard):
+    if dashboard not in global_context.query_map:
+        raise KeyError(f'Unknown dashboard "{dashboard}". Known: '
+                       f'{sorted(global_context.query_map)}')
+    global_context.dashboard = dashboard
+
+
 @given("the following series")
 def step_impl(context):
     for row in context.table:
@@ -111,19 +121,23 @@ def step_impl(context, panel_name, legend):
     """
     if legend == "EMPTY":
         legend = ''
+    if global_context.dashboard is None:
+        raise KeyError('No dashboard selected; add "Given the dashboard is '
+                       '`<name>`" to the feature Background')
     query_id = panel_name + '-' + legend
-    if query_id not in global_context.query_map:
-        print(f"QueryMap: {global_context.query_map}")
-        raise KeyError((f'Query with legend {legend} in panel "{panel_name}"'
-                           'couldn\'t be found'))
+    dashboard_queries = global_context.query_map[global_context.dashboard]
+    if query_id not in dashboard_queries:
+        raise KeyError(f'Query with legend {legend} in panel "{panel_name}" '
+                       f'couldn\'t be found in dashboard '
+                       f'"{global_context.dashboard}"')
 
-    expr = global_context.query_map[query_id]['query']
+    expr = dashboard_queries[query_id]['query']
     global_context.promql_expr_test.set_expression(expr)
     for row in context.table:
         metric = row['metrics']
         value = row['values']
         global_context.promql_expr_test.add_exp_samples(metric, float(value))
-    path = global_context.query_map[query_id]['path']
+    path = dashboard_queries[query_id]['path']
     global_context.data['stats'][path]['tested'] += 1
 
 
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/host-details.feature b/monitoring/ceph-mixin/tests_dashboards/features/host-details.feature
index e1a543dab34..ea2b51e2f9c 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/host-details.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/host-details.feature
@@ -1,5 +1,8 @@
 Feature: Host Details Dashboard
 
+  Background:
+    Given the dashboard is `host-details`
+
 Scenario: "Test OSD"
   Given the following series:
     | metrics | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/hosts_overview.feature b/monitoring/ceph-mixin/tests_dashboards/features/hosts_overview.feature
index f2945d423dd..4f7e6cc5d45 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/hosts_overview.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/hosts_overview.feature
@@ -1,5 +1,8 @@
 Feature: Hosts Overview Dashboard
 
+  Background:
+    Given the dashboard is `hosts-overview`
+
 Scenario: "Test network load succeeds"
   Given the following series:
     | metrics | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/osd-device-details.feature b/monitoring/ceph-mixin/tests_dashboards/features/osd-device-details.feature
index f25167aaf66..09b57835c29 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/osd-device-details.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/osd-device-details.feature
@@ -1,5 +1,8 @@
 Feature: OSD device details
 
+  Background:
+    Given the dashboard is `osd-device-details`
+
 Scenario: "Test Physical Device Latency for $osd - Reads"
   Given the following series:
     | metrics | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/osds-overview.feature b/monitoring/ceph-mixin/tests_dashboards/features/osds-overview.feature
index cb3bf876464..3c47f406e43 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/osds-overview.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/osds-overview.feature
@@ -1,5 +1,8 @@
 Feature: OSD Overview
 
+  Background:
+    Given the dashboard is `osds-overview`
+
 Scenario: "Test OSD onode Hits Ratio"
   Given the following series:
     | metrics | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/radosgw-detail.feature b/monitoring/ceph-mixin/tests_dashboards/features/radosgw-detail.feature
index db5fb4e9017..89aa728ba7d 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/radosgw-detail.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/radosgw-detail.feature
@@ -1,5 +1,8 @@
 Feature: RGW Host Detail Dashboard
 
+  Background:
+    Given the dashboard is `radosgw-detail`
+
 Scenario: "Test $rgw_servers GET/PUT Latencies - GET"
   Given the following series:
     | metrics | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/features/radosgw_overview.feature b/monitoring/ceph-mixin/tests_dashboards/features/radosgw_overview.feature
index a34d5759437..697effb2d4a 100644
--- a/monitoring/ceph-mixin/tests_dashboards/features/radosgw_overview.feature
+++ b/monitoring/ceph-mixin/tests_dashboards/features/radosgw_overview.feature
@@ -1,5 +1,8 @@
 Feature: RGW Overview Dashboard
 
+  Background:
+    Given the dashboard is `radosgw-overview`
+
 Scenario: "Test Average GET Latencies"
   Given the following series:
     | metrics | values |
diff --git a/monitoring/ceph-mixin/tests_dashboards/util.py b/monitoring/ceph-mixin/tests_dashboards/util.py
index 071e7dc2b73..960780da6df 100644
--- a/monitoring/ceph-mixin/tests_dashboards/util.py
+++ b/monitoring/ceph-mixin/tests_dashboards/util.py
@@ -23,8 +23,8 @@ def resolve_time_and_unit(time: str) -> Union[Tuple[int, str], Tuple[None, None]
 
 def get_dashboards_data() -> Dict[str, Any]:
     data: Dict[str, Any] = {'queries': {}, 'variables': {}, 'stats': {}}
-    for file in Path(__file__).parent.parent \
-                              .joinpath('dashboards_out').glob('*.json'):
+    for file in sorted(Path(__file__).parent.parent
+                       .joinpath('dashboards_out').glob('*.json')):
         with open(file, 'r') as f:
             dashboard_data = json.load(f)
             data['stats'][str(file)] = {'total': 0, 'tested': 0}
@@ -39,9 +39,16 @@ def add_dashboard_queries(data: Dict[str, Any], dashboard_data: Dict[str, Any],
     Grafana panels can have more than one target/query, in order to identify each
     query in the panel we append the "legendFormat" of the target to the panel name.
     format: panel_name-legendFormat
+
+    Queries are grouped per dashboard (data['queries'][<dashboard>]) so that
+    different dashboards reusing a panel title/legend, e.g. "IOPS-Read", stay in
+    separate namespaces. Each .feature picks its dashboard so the lookup is
+    unambiguous.
     """
     if 'panels' not in dashboard_data:
         return
+    dashboard = Path(path).stem
+    queries = data['queries'].setdefault(dashboard, {})
     error = 0
     panel_ids_in_file = set()
 
@@ -57,24 +64,15 @@ def add_dashboard_queries(data: Dict[str, Any], dashboard_data: Dict[str, Any],
                 title = panel['title']
                 legend_format = target['legendFormat'] if 'legendFormat' in target else ""
                 query_id = f'{title}-{legend_format}'
-                # Skip duplicates within collapsed rows
-                # but error on duplicates at top-level or across different contexts
+                # a repeated id within one dashboard is expected for a collapsed
+                # row; at top level it means a missing legendFormat
                 if query_id in panel_ids_in_file:
                     if legend_format != '__auto' and not in_row:
                         cprint((f'ERROR: Query in panel "{title}" with legend "{legend_format}"'
                                 f' already exists in the same file: "{path}"'), 'red')
                         error = 1
-                    # Skip adding duplicate
                     continue
-                # Also check for duplicates across different files
-                # NOTE: This silently skips duplicate panel+legend combinations across dashboards,
-                # which means some queries never get tested. A better approach would be to include
-                # dashboard name in query_id (e.g., "dashboard:panel-legend"), but that requires
-                # updating all test .feature files to specify which dashboard they're testing.
-                if query_id in data['queries']:
-                    # Skip silently for duplicates across files (first one wins)
-                    continue
-                data['queries'][query_id] = {'query': target['expr'], 'path': path}
+                queries[query_id] = {'query': target['expr'], 'path': path}
                 data['stats'][path]['total'] += 1
                 panel_ids_in_file.add(query_id)
         # Recurse into row panels

From d524306b51ac0a5be491aaff4d065cd703196804 Mon Sep 17 00:00:00 2001
From: adatri <anthony.datri@gmail.com>
Date: Fri, 13 Mar 2026 10:30:11 -0400
Subject: [PATCH 544/596] doc/rados/operations: Fix typos in erasure-code.rst

Signed-off-by: adatri <anthony.datri@gmail.com>
---
 doc/rados/operations/erasure-code.rst | 35 +++++++++++++++------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/doc/rados/operations/erasure-code.rst b/doc/rados/operations/erasure-code.rst
index 5d54e266005..f953972b217 100644
--- a/doc/rados/operations/erasure-code.rst
+++ b/doc/rados/operations/erasure-code.rst
@@ -272,38 +272,41 @@ Erasure-coded pool overhead
 ---------------------------
 
 The overhead factor (space amplification) of an erasure-coded pool
-is `(k+m) / k`.  For a 4,2 profile, the overhead is
+is ``(k+m) / k``.  For a ``4+2`` profile, the overhead is
 thus 1.5, which means that 1.5 GiB of underlying storage is used to store
-1 GiB of user data.  Contrast with default replication with ``size-3``, with
-which the overhead factor is 3.0.  Do not mistake erasure coding for a free
+1 GiB of user data.  Contrast with default replication with ``size=3``, with
+which the space amplification factor is ``3.0``.  Do not mistake erasure coding for a free
 lunch: there is a significant performance tradeoff, especially when using HDDs
 and when performing cluster recovery or backfill.
 
-Below is a table showing the overhead factors for various values of `k` and `m`.
-As `k` increases above 4, the incremental capacity overhead gain quickly
+Below is a table showing the overhead factors for various values of ``k`` and ``m``.
+As ``k`` increases above ``4``, the incremental space amplification gain
 experiences diminishing returns but the performance impact grows proportionally.
-We recommend that you do not choose a profile with `k` > 4 or `m` > 2 unless
+We recommend that you do not choose a profile with ``k`` > ``4` or ``m`` > 2 unless
 and until you fully understand the ramifications, including the number of
-failure domains your cluster topology presents.  If  you choose `m=1`,
+failure domains your cluster topology presents.  If  you choose ``m=1``,
 expect data unavailability during maintenance and data loss when component
-failures overlap.  Profiles with `m=1` are thus strongly discouraged for
+failures overlap.  Profiles with ``m=1`` are strongly discouraged for
 production data.
 
 Deployments that must remain active and avoid data loss when larger numbers
-of overlapping component failure must be survived may favor a value of `m` > 2.
-Note that such profiles result in lower space efficiency and lessened performance, especially
+of overlapping component failure must be survived may favor a value of ``m`` > 2.
+Note that such profiles may result in lower space efficiency and lessened performance, especially
 during backfill and recovery.
 
 If you are certain that you wish to use erasure coding for one or more pools but
-are not certain which profile to use, select `k=4` and `m=2`.  You will realize
-double the usable space compared to replication with `size=3` with relatively
+are not certain which profile to use, select ``4+2`` or ``6+3``.  You will realize
+double the usable space compared to replication with ``size=3`` with relatively
 tolerable write and recovery performance impact.
 
-.. note:: Most erasure-coded pool deployments require at least `k+m` CRUSH failure
-	  domains, which in most cases means `rack`s or `hosts`.  There are
+.. note:: For a discussion of how durability varies across EC profiles, consult
+	  `this Cephalocon presentation <https://www.youtube.com/watch?v=0y8WMu-hMBQ>`_ .
+
+.. note:: Most erasure-coded pool deployments require at least ``k+m`` CRUSH failure
+	  domains, which in most cases means racks or hosts.  There are
 	  operational advantages to planning EC profiles and cluster topology
-	  so that there are at least `k+m+1` failure domains. In most cases
-	  a value of `k` > 8 is discouragd.
+	  so that there are at least ``k+m+1`` failure domains. In most cases
+	  a value of ``k`` > 8 is discouraged.
 
 .. note:: CephFS and RGW deployments with a significant proportion
           of very small user files/objects may wish to plan carefully as

From f64896d83858425084057e33c1e9beeb5209d653 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Sun, 5 Jul 2026 12:11:01 +0000
Subject: [PATCH 545/596] crimson/osd: fix backfill deadlock when only drop
 operations remain

BackfillState::Waiting requires an ObjectPushed event to transition
back to Enqueuing, but drop (remove) operations are fire-and-forget
and never generate ObjectPushed. When a backfill round enqueues only
drops and no pushes, the FSM permanently stalls in the Waiting state,
holding the backfill reservation and blocking all other PGs from
backfilling to that OSD.

Fix by adding a pending-pushes counter to ProgressTracker to
distinguish "only drops remain" from "pushes still in-flight". When
all pushes are complete and the namespace is exhausted, drain remaining
drop entries and advance last_backfill to MAX so that
OP_BACKFILL_FINISH triggers the normal completion path via
RequestDone.

The classic OSD avoids this by design: drops are never tracked as
in-flight operations in recover_backfill() and are drained inline.

Fixes: https://tracker.ceph.com/issues/77936
Assisted-by: Claude <claude.ai>
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 src/crimson/osd/backfill_state.cc | 32 ++++++++++++++++++++++++++++++-
 src/crimson/osd/backfill_state.h  | 10 ++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/src/crimson/osd/backfill_state.cc b/src/crimson/osd/backfill_state.cc
index 411b009d489..295113c2f16 100644
--- a/src/crimson/osd/backfill_state.cc
+++ b/src/crimson/osd/backfill_state.cc
@@ -444,10 +444,11 @@ BackfillState::Enqueuing::Enqueuing(my_context ctx)
     post_event(RequestPrimaryScanning{});
     return;
   } else {
-    if (backfill_state().progress_tracker->tracked_objects_completed()
+    if (backfill_state().progress_tracker->tracked_pushes_completed()
 	&& Enqueuing::all_enqueued(peering_state(),
 				   backfill_state().backfill_info,
 				   backfill_state().peer_backfill_info)) {
+      backfill_state().progress_tracker->complete_drops();
       backfill_state().last_backfill_started = hobject_t::get_max();
       backfill_listener().update_peers_last_backfill(hobject_t::get_max());
     }
@@ -686,6 +687,10 @@ bool BackfillState::ProgressTracker::enqueue_push(const hobject_t& obj)
 {
   [[maybe_unused]] const auto [it, first_seen] = registry.try_emplace(
     obj, registry_item_t{op_stage_t::enqueued_push, std::nullopt});
+  if (first_seen) {
+    // multiple targets may enqueue the same object; only count it once
+    ++num_pending_pushes;
+  }
   return first_seen;
 }
 
@@ -704,6 +709,10 @@ void BackfillState::ProgressTracker::complete_to(
   DEBUGDPP("obj={}", pg(), obj);
   if (auto completion_iter = registry.find(obj);
       completion_iter != std::end(registry)) {
+    if (completion_iter->second.stage == op_stage_t::enqueued_push) {
+      ceph_assert(num_pending_pushes > 0);
+      --num_pending_pushes;
+    }
     completion_iter->second = \
       registry_item_t{ op_stage_t::completed_push, stats };
   } else {
@@ -734,6 +743,27 @@ void BackfillState::ProgressTracker::complete_to(
   }
 }
 
+void BackfillState::ProgressTracker::complete_drops()
+{
+  LOG_PREFIX(BackfillState::ProgressTracker::complete_drops);
+  ceph_assert(num_pending_pushes == 0);
+  auto new_last_backfill = peering_state().earliest_backfill();
+  for (auto it = std::begin(registry);
+       it != std::end(registry);
+       it = registry.erase(it)) {
+    const auto& [soid, item] = *it;
+    ceph_assert(item.stage == op_stage_t::enqueued_drop);
+    assert(item.stats);
+    DEBUGDPP("draining drop obj={}", pg(), soid);
+    peering_state().update_complete_backfill_object_stats(
+      soid,
+      *item.stats);
+    assert(soid > new_last_backfill);
+    new_last_backfill = soid;
+  }
+  backfill_listener().update_peers_last_backfill(new_last_backfill);
+}
+
 void BackfillState::enqueue_standalone_push(
   const hobject_t &obj,
   const eversion_t &v,
diff --git a/src/crimson/osd/backfill_state.h b/src/crimson/osd/backfill_state.h
index bd30ad9778e..5870859abef 100644
--- a/src/crimson/osd/backfill_state.h
+++ b/src/crimson/osd/backfill_state.h
@@ -446,6 +446,8 @@ class BackfillState::ProgressTracker {
 
   BackfillMachine& backfill_machine;
   std::map<hobject_t, registry_item_t> registry;
+  // count of registry entries at enqueued_push stage, awaiting ObjectPushed.
+  size_t num_pending_pushes = 0;
 
   BackfillState& backfill_state() {
     return backfill_machine.backfill_state;
@@ -467,9 +469,17 @@ public:
 
   bool tracked_objects_completed() const;
 
+  // true when no push operations are awaiting ObjectPushed completion.
+  bool tracked_pushes_completed() const {
+    return num_pending_pushes == 0;
+  }
+
   bool enqueue_push(const hobject_t&);
   void enqueue_drop(const hobject_t&);
   void complete_to(const hobject_t&, const pg_stat_t&, bool may_push_to_max);
+
+  // drain all remaining drop entries from the registry, updating stats.
+  void complete_drops();
 };
 
 } // namespace crimson::osd

From 274fa2e27cbf2625efe5efdf21a5bc533273f963 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 5 Jul 2026 08:24:15 -0700
Subject: [PATCH 546/596] ceph.spec.in: switch more build deps to pkgconfig()
 and python3dist()

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 ceph.spec.in | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index 10ccf569956..a5924cb32dd 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -273,7 +273,7 @@ BuildRequires:  libatomic
 %if 0%{with tcmalloc}
 # libprofiler did not build on ppc64le until 2.7.90
 %if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-BuildRequires:	gperftools-devel >= 2.7.90
+BuildRequires:	pkgconfig(libtcmalloc) >= 2.7.90
 %endif
 %if 0%{?suse_version}
 BuildRequires:	gperftools-devel >= 2.4
@@ -309,7 +309,7 @@ BuildRequires:  procps
 BuildRequires:	python3
 BuildRequires:	python3-devel
 BuildRequires:	python3-setuptools
-BuildRequires:	python3-Cython
+BuildRequires:	python3dist(cython)
 BuildRequires:	python3-pip
 BuildRequires:	python3-wheel
 BuildRequires:	pkgconfig(snappy)
@@ -351,6 +351,7 @@ BuildRequires:	python3dist(natsort)
 %endif
 BuildRequires:	pkgconfig(thrift) >= 0.13.0
 BuildRequires:  pkgconfig(re2)
+BuildRequires:	pkgconfig(numa)
 %if 0%{with jaeger}
 BuildRequires:  bison
 BuildRequires:  flex
@@ -422,7 +423,6 @@ Requires:	systemd
 BuildRequires:  boost-random
 BuildRequires:  libatomic
 BuildRequires:  ninja-build
-BuildRequires:  numactl-devel
 #BuildRequires:  krb5-devel
 BuildRequires:  CUnit-devel
 BuildRequires:	python3-devel
@@ -472,9 +472,6 @@ BuildRequires:  openEuler-rpm-config
 # pkgconfig(cryptopp)), while el10 and SUSE's cryptopp/libcryptopp-devel
 # provide pkgconfig(libcryptopp); accept either.
 BuildRequires:  (pkgconfig(libcryptopp) or pkgconfig(cryptopp))
-%if 0%{?suse_version}
-BuildRequires:  libnuma-devel
-%endif
 %endif
 %if 0%{?rhel}
 BuildRequires: python-rpm-macros

From 4598137a817767f9698da5af4b6b1fabc023c362 Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Sun, 5 Jul 2026 08:24:15 -0700
Subject: [PATCH 547/596] ceph.spec.in: add support for openRuyi

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 ceph.spec.in | 95 +++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 64 insertions(+), 31 deletions(-)

diff --git a/ceph.spec.in b/ceph.spec.in
index a5924cb32dd..e7032069af6 100644
--- a/ceph.spec.in
+++ b/ceph.spec.in
@@ -34,8 +34,8 @@
 %else
 %bcond_with rbd_rwl_cache
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
-%if 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
+%if 0%{?openEuler} || 0%{?openruyi}
 %bcond_with system_pmdk
 %else
 %ifarch s390x aarch64
@@ -44,7 +44,11 @@
 %bcond_without system_pmdk
 %endif
 %endif
+%if 0%{?openruyi}
+%bcond_with selinux
+%else
 %bcond_without selinux
+%endif
 %bcond_without amqp_endpoint
 %bcond_without kafka_endpoint
 %bcond_without lttng
@@ -97,7 +101,7 @@
 %else
 %bcond_without jaeger
 %endif
-%if 0%{?fedora} || 0%{?suse_version} >= 1500 || 0%{?rhel}
+%if 0%{?fedora} || 0%{?suse_version} >= 1500 || 0%{?rhel} || 0%{?openruyi}
 # distros that ship cmd2 and/or colorama
 %bcond_without cephfs_shell
 %else
@@ -133,7 +137,11 @@
 %{!?_selinux_policy_version: %global _selinux_policy_version 0.0.0}
 %endif
 %endif
+%if 0%{?openruyi}
+%bcond_with cephadm_bundling
+%else
 %bcond_without cephadm_bundling
+%endif
 %bcond_without cephadm_pip_deps
 %bcond_without dwz
 %if %{with dwz}
@@ -272,7 +280,7 @@ BuildRequires:  libatomic
 %endif
 %if 0%{with tcmalloc}
 # libprofiler did not build on ppc64le until 2.7.90
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 BuildRequires:	pkgconfig(libtcmalloc) >= 2.7.90
 %endif
 %if 0%{?suse_version}
@@ -348,6 +356,18 @@ BuildRequires:	python3dist(pyopenssl)
 BuildRequires:	socat
 BuildRequires:	python3dist(asyncssh)
 BuildRequires:	python3dist(natsort)
+%if 0%{?openruyi}
+BuildRequires:	python3dist(cryptography)
+BuildRequires:	python3dist(jsonpatch)
+BuildRequires:	python3dist(jinja2)
+BuildRequires:	python3dist(werkzeug)
+BuildRequires:	python3dist(mypy)
+BuildRequires:	python3dist(pecan)
+BuildRequires:	python3dist(requests-mock)
+BuildRequires:	python3dist(kubernetes)
+BuildRequires:	python3dist(asyncmock)
+BuildRequires:	python3dist(types-pyyaml)
+%endif
 %endif
 BuildRequires:	pkgconfig(thrift) >= 0.13.0
 BuildRequires:  pkgconfig(re2)
@@ -427,6 +447,9 @@ BuildRequires:  ninja-build
 BuildRequires:  CUnit-devel
 BuildRequires:	python3-devel
 %endif
+%if 0%{?openruyi}
+BuildRequires:	ninja
+%endif
 # distro-conditional make check dependencies
 %if 0%{with make_check}
 BuildRequires:	golang
@@ -445,6 +468,13 @@ BuildRequires:	xmlsec1-openssl
 BuildRequires:	python3dist(scipy)
 BuildRequires:	python3dist(pyopenssl)
 %endif
+%if 0%{?openruyi}
+BuildRequires:	/usr/bin/promtool
+BuildRequires:	python3dist(scipy)
+BuildRequires:	python3dist(numpy)
+BuildRequires:	python3dist(tox)
+BuildRequires:	python3dist(pyfakefs)
+%endif
 BuildRequires:	jsonnet
 %if 0%{?suse_version}
 BuildRequires:	golang-github-prometheus-prometheus
@@ -662,7 +692,7 @@ Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-mgr-smb = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-grafana-dashboards = %{_epoch_prefix}%{version}-%{release}
 Requires:       ceph-prometheus-alerts = %{_epoch_prefix}%{version}-%{release}
-%if 0%{?fedora} || 0%{?rhel}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openruyi}
 Requires:       python3dist(grpcio)
 Requires:       python3dist(grpcio-tools)
 Requires:       python3dist(jmespath)
@@ -691,7 +721,7 @@ Group:          System/Filesystems
 %endif
 Requires:       ceph-mgr = %{_epoch_prefix}%{version}-%{release}
 Requires:       python3dist(numpy)
-%if 0%{?fedora} || 0%{?suse_version} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?suse_version} || 0%{?openEuler} || 0%{?openruyi}
 Requires:       python3dist(scikit-learn)
 %endif
 Requires:       python3dist(scipy)
@@ -793,7 +823,7 @@ Requires:       python3dist(jinja2)
 %if 0%{?suse_version}
 Requires:       openssh
 %endif
-%if 0%{?rhel} || 0%{?fedora} || 0%{?openEuler}
+%if 0%{?rhel} || 0%{?fedora} || 0%{?openEuler} || 0%{?openruyi}
 Requires:       openssh-clients
 %endif
 %description mgr-cephadm
@@ -1847,6 +1877,9 @@ popd
 
 %if 0%{with make_check}
 %check
+%if 0%{?openruyi}
+export CEPH_PYTHON_SYSTEM_SITE=true
+%endif
 # run in-tree unittests
 pushd %{_vpath_builddir}
 ctest %{_smp_mflags}
@@ -1868,7 +1901,7 @@ mv %{buildroot}%{_bindir}/crimson-osd %{buildroot}%{_bindir}/ceph-osd-crimson
 mv %{buildroot}%{_bindir}/ceph-osd %{buildroot}%{_bindir}/ceph-osd-classic
 
 install -m 0644 -D src/etc-rbdmap %{buildroot}%{_sysconfdir}/ceph/rbdmap
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 install -m 0644 -D etc/sysconfig/ceph %{buildroot}%{_sysconfdir}/sysconfig/ceph
 %endif
 %if 0%{?suse_version}
@@ -1902,7 +1935,7 @@ install -m 0644 -D udev/50-rbd.rules %{buildroot}%{_udevrulesdir}/50-rbd.rules
 # sudoers.d
 install -m 0440 -D sudoers.d/ceph-smartctl %{buildroot}%{_sysconfdir}/sudoers.d/ceph-smartctl
 
-%if 0%{?rhel} || 0%{?openEuler}
+%if 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 # Undefine -P flag as it is only supported with python version >= 3.11
 %undefine _py3_shebang_P
 
@@ -1988,7 +2021,7 @@ rm -rf %{_vpath_builddir}
 %{_libdir}/libmgr_op_tp.so*
 %endif
 %config(noreplace) %{_sysconfdir}/logrotate.d/ceph
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %config(noreplace) %{_sysconfdir}/sysconfig/ceph
 %endif
 %if 0%{?suse_version}
@@ -2021,7 +2054,7 @@ if [ $1 -eq 1 ] ; then
 /usr/bin/systemctl preset ceph.target ceph-crash.service >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph.target ceph-crash.service
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2032,7 +2065,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph.target ceph-crash.service
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph.target ceph-crash.service
 %endif
 
@@ -2133,7 +2166,7 @@ exit 0
 %pre common
 CEPH_GROUP_ID=167
 CEPH_USER_ID=167
-%if 0%{?rhel} || 0%{?fedora} || 0%{?openEuler}
+%if 0%{?rhel} || 0%{?fedora} || 0%{?openEuler} || 0%{?openruyi}
 /usr/sbin/groupadd ceph -g $CEPH_GROUP_ID -o -r 2>/dev/null || :
 /usr/sbin/useradd ceph -u $CEPH_USER_ID -o -r -g ceph -s /sbin/nologin -c "Ceph daemons" -d %{_localstatedir}/lib/ceph 2>/dev/null || :
 %endif
@@ -2172,7 +2205,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-mds@\*.service ceph-mds.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-mds@\*.service ceph-mds.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2183,7 +2216,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-mds@\*.service ceph-mds.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-mds@\*.service ceph-mds.target
 %endif
 
@@ -2220,7 +2253,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-mgr@\*.service ceph-mgr.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-mgr@\*.service ceph-mgr.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2231,7 +2264,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-mgr@\*.service ceph-mgr.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-mgr@\*.service ceph-mgr.target
 %endif
 
@@ -2403,7 +2436,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-mon@\*.service ceph-mon.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-mon@\*.service ceph-mon.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2414,7 +2447,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-mon@\*.service ceph-mon.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-mon@\*.service ceph-mon.target
 %endif
 
@@ -2455,7 +2488,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset cephfs-mirror@\*.service cephfs-mirror.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post cephfs-mirror@\*.service cephfs-mirror.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2466,7 +2499,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun cephfs-mirror@\*.service cephfs-mirror.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun cephfs-mirror@\*.service cephfs-mirror.target
 %endif
 
@@ -2504,7 +2537,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-rbd-mirror@\*.service ceph-rbd-mirror.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-rbd-mirror@\*.service ceph-rbd-mirror.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2515,7 +2548,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-rbd-mirror@\*.service ceph-rbd-mirror.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-rbd-mirror@\*.service ceph-rbd-mirror.target
 %endif
 
@@ -2545,7 +2578,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-immutable-object-cache@\*.service ceph-immutable-object-cache.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-immutable-object-cache@\*.service ceph-immutable-object-cache.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2556,7 +2589,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-immutable-object-cache@\*.service ceph-immutable-object-cache.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-immutable-object-cache@\*.service ceph-immutable-object-cache.target
 %endif
 
@@ -2599,7 +2632,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-radosgw@\*.service ceph-radosgw.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-radosgw@\*.service ceph-radosgw.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2610,7 +2643,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-radosgw@\*.service ceph-radosgw.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-radosgw@\*.service ceph-radosgw.target
 %endif
 
@@ -2644,7 +2677,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-osd@\*.service ceph-osd.target >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-osd@\*.service ceph-osd.target
 %endif
 if [ $1 -eq 1 ] ; then
@@ -2656,7 +2689,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-osd@\*.service ceph-osd.target
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-osd@\*.service ceph-osd.target
 %endif
 
@@ -2721,7 +2754,7 @@ if [ $1 -eq 1 ] ; then
   /usr/bin/systemctl preset ceph-volume@\*.service >/dev/null 2>&1 || :
 fi
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_post ceph-volume@\*.service
 %endif
 
@@ -2729,7 +2762,7 @@ fi
 %if 0%{?suse_version}
 %service_del_preun ceph-volume@\*.service
 %endif
-%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
+%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler} || 0%{?openruyi}
 %systemd_preun ceph-volume@\*.service
 %endif
 

From 8dafeeb22e5c7d2ea6cc4e52c91ac780ae9194fe Mon Sep 17 00:00:00 2001
From: Naman Munet <naman.munet@ibm.com>
Date: Tue, 30 Jun 2026 18:33:25 +0530
Subject: [PATCH 548/596] mgr/dashboard: add account name duplicate check

fixes: https://tracker.ceph.com/issues/77828

Signed-off-by: Naman Munet <naman.munet@ibm.com>
---
 .../mgr/dashboard/controllers/rgw_iam.py      | 19 +++++++++
 .../rgw-user-accounts-form.component.html     |  8 ++++
 .../rgw-user-accounts-form.component.spec.ts  | 31 ++++++++++----
 .../rgw-user-accounts-form.component.ts       |  8 +++-
 .../shared/api/rgw-user-accounts.service.ts   |  7 ++++
 src/pybind/mgr/dashboard/openapi.yaml         | 41 +++++++++++++++++++
 src/pybind/mgr/dashboard/services/rgw_iam.py  |  9 ++++
 7 files changed, 113 insertions(+), 10 deletions(-)

diff --git a/src/pybind/mgr/dashboard/controllers/rgw_iam.py b/src/pybind/mgr/dashboard/controllers/rgw_iam.py
index 7bc9ff56b8c..a7b5429be99 100644
--- a/src/pybind/mgr/dashboard/controllers/rgw_iam.py
+++ b/src/pybind/mgr/dashboard/controllers/rgw_iam.py
@@ -1,6 +1,8 @@
 from typing import Optional
 
 from ..controllers.rgw import RgwRESTController
+from ..exceptions import DashboardException
+from ..rest_client import RequestException
 from ..security import Scope
 from ..services.rgw_iam import RgwAccounts
 from ..tools import str_to_bool
@@ -77,6 +79,23 @@ class RgwUserAccountsController(RgwRESTController):
         """
         return self.get_account(account_id, daemon_name)
 
+    @EndpointDoc("Check if account name exists",
+                 parameters={'account_name': (str, 'Account name'),
+                             'daemon_name': (str, 'Name of the daemon')})
+    @RESTController.Collection(method='GET', path='/exists')
+    def exists(self, account_name: str, daemon_name=None):
+        """
+        Check if an account with the given name exists
+        Returns True if account exists, False otherwise
+        """
+        try:
+            self.proxy(daemon_name, 'GET', 'account', {'name': account_name})
+            # If we get a result without error, the account exists
+            return True
+        except (DashboardException, RequestException):
+            # If we get an error (e.g., account not found), it doesn't exist
+            return False
+
     def get_account(self, account_id, daemon_name=None) -> dict:
         return self.proxy(daemon_name, 'GET', 'account', {'id': account_id})
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
index 7233732e63f..f0687548848 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
@@ -23,6 +23,9 @@
                  placeholder="Enter account name"
                  id="acc_name"
                  name="acc_name"
+                 cdValidate
+                 #accName="cdValidate"
+                 [invalid]="accName.isInvalid"
                  formControlName="name"/>
         </cds-text-label>
         <ng-template #accountIdError>
@@ -30,6 +33,11 @@
                 class="invalid-feedback">
             <ng-container i18n>This field is required.</ng-container>
           </span>
+          @if(accountForm.showError('name', formDir, 'notUnique')) {
+            <div class="invalid-feedback">
+          <ng-container i18n>An account with this name already exists.</ng-container>
+            </div>
+          }
         </ng-template>
       </div>
       <!-- Tenant -->
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts
index 0db3d09f6b1..c138789b473 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts
@@ -1,4 +1,4 @@
-import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { ComponentFixture, TestBed, fakeAsync, tick, flush } from '@angular/core/testing';
 
 import { RgwUserAccountsFormComponent } from './rgw-user-accounts-form.component';
 import { ComponentsModule } from '~/app/shared/components/components.module';
@@ -10,11 +10,13 @@ import { RgwUserAccountsService } from '~/app/shared/api/rgw-user-accounts.servi
 import { ModalModule } from 'carbon-components-angular';
 import { ReactiveFormsModule } from '@angular/forms';
 import { RgwUserAccountsComponent } from '../rgw-user-accounts/rgw-user-accounts.component';
+import { DUE_TIMER } from '~/app/shared/forms/cd-validators';
 
 class MockRgwUserAccountsService {
   create = jest.fn().mockReturnValue(of(null));
   modify = jest.fn().mockReturnValue(of(null));
   setQuota = jest.fn().mockReturnValue(of(null));
+  exists = jest.fn().mockReturnValue(of(false));
 }
 
 describe('RgwUserAccountsFormComponent', () => {
@@ -50,9 +52,10 @@ describe('RgwUserAccountsFormComponent', () => {
     expect(component).toBeTruthy();
   });
 
-  it('should call create method of MockRgwUserAccountsService and show success notification', () => {
+  it('should call create method of MockRgwUserAccountsService and show success notification', fakeAsync(() => {
     component.editing = false;
-    component.accountForm.get('name').setValue('test');
+    component.accountForm.get('name').setValue('test', { emitEvent: true });
+    tick(DUE_TIMER);
     const payload = {
       account_name: 'test',
       email: '',
@@ -63,18 +66,24 @@ describe('RgwUserAccountsFormComponent', () => {
       max_group: 1000,
       max_access_keys: 4
     };
+    const mockAccount = { id: 'RGW12312312312312312', name: 'test' };
     const spy = jest.spyOn(component, 'submit');
-    const createDataSpy = jest.spyOn(rgwUserAccountsService, 'create').mockReturnValue(of(null));
+    const createDataSpy = jest
+      .spyOn(rgwUserAccountsService, 'create')
+      .mockReturnValue(of(mockAccount));
     component.submit();
     expect(component.accountForm.valid).toBe(true);
     expect(spy).toHaveBeenCalled();
     expect(createDataSpy).toHaveBeenCalled();
     expect(createDataSpy).toHaveBeenCalledWith(payload);
-  });
+    flush();
+  }));
 
-  it('should call modify method of MockRgwUserAccountsService and show success notification', () => {
+  it('should call modify method of MockRgwUserAccountsService and show success notification', fakeAsync(() => {
     component.editing = true;
-    component.accountForm.get('name').setValue('test');
+    component.originalAccountName = 'test';
+    component.accountForm.get('name').setValue('test', { emitEvent: true });
+    tick(DUE_TIMER);
     component.accountForm.get('id').setValue('RGW12312312312312312');
     component.accountForm.get('email').setValue('test@test.com');
     const payload = {
@@ -88,14 +97,18 @@ describe('RgwUserAccountsFormComponent', () => {
       max_group: 1000,
       max_access_keys: 4
     };
+    const mockAccount = { id: 'RGW12312312312312312', name: 'test' };
     const spy = jest.spyOn(component, 'submit');
-    const modifyDataSpy = jest.spyOn(rgwUserAccountsService, 'modify').mockReturnValue(of(null));
+    const modifyDataSpy = jest
+      .spyOn(rgwUserAccountsService, 'modify')
+      .mockReturnValue(of(mockAccount));
     component.submit();
     expect(component.accountForm.valid).toBe(true);
     expect(spy).toHaveBeenCalled();
     expect(modifyDataSpy).toHaveBeenCalled();
     expect(modifyDataSpy).toHaveBeenCalledWith(payload);
-  });
+    flush();
+  }));
 
   it('should call setQuota for "account" if account quota is dirty', () => {
     component.accountForm.get('id').setValue('123');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts
index 1c1506d7afe..da78beb5d69 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts
@@ -26,6 +26,7 @@ export class RgwUserAccountsFormComponent extends CdForm implements OnInit {
   resource: string;
   editing: boolean = false;
   submitObservables: Observable<Object>[] = [];
+  originalAccountName: string = '';
 
   constructor(
     private router: Router,
@@ -48,6 +49,7 @@ export class RgwUserAccountsFormComponent extends CdForm implements OnInit {
       this.route.paramMap.subscribe((params: any) => {
         const account_id = params.get('id');
         this.rgwUserAccountsService.get(account_id).subscribe((accountData: Account) => {
+          this.originalAccountName = accountData.name;
           // Get the default values.
           const defaults = _.clone(this.accountForm.value);
           // Extract the values displayed in the form.
@@ -112,7 +114,11 @@ export class RgwUserAccountsFormComponent extends CdForm implements OnInit {
     this.accountForm = this.formBuilder.group({
       id: [''],
       tenant: [''],
-      name: ['', Validators.required],
+      name: [
+        '',
+        [Validators.required],
+        [CdValidators.unique(this.rgwUserAccountsService.exists, this.rgwUserAccountsService)]
+      ],
       email: ['', CdValidators.email],
       max_users_mode: ['1'],
       max_users: [
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts
index b5035fd344a..4c53a46c054 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts
@@ -54,4 +54,11 @@ export class RgwUserAccountsService {
   ) {
     return this.http.put(`${this.url}/${account_id}/quota`, payload);
   }
+
+  exists(account_name: string): Observable<boolean> {
+    return this.rgwDaemonService.request((params: HttpParams) => {
+      params = params.append('account_name', account_name);
+      return this.http.get<boolean>(`${this.url}/exists`, { params });
+    });
+  }
 }
diff --git a/src/pybind/mgr/dashboard/openapi.yaml b/src/pybind/mgr/dashboard/openapi.yaml
index 83f0ca14911..3c8f1804188 100644
--- a/src/pybind/mgr/dashboard/openapi.yaml
+++ b/src/pybind/mgr/dashboard/openapi.yaml
@@ -18053,6 +18053,47 @@ paths:
       summary: Update RGW account info
       tags:
       - RgwUserAccounts
+  /api/rgw/accounts/exists:
+    get:
+      description: "\n        Check if an account with the given name exists\n   \
+        \     Returns True if account exists, False otherwise\n        "
+      parameters:
+      - description: Account name
+        in: query
+        name: account_name
+        required: true
+        schema:
+          type: string
+      - allowEmptyValue: true
+        description: Name of the daemon
+        in: query
+        name: daemon_name
+        schema:
+          type: string
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: object
+            application/vnd.ceph.api.v1.0+json:
+              schema:
+                type: object
+          description: OK
+        '400':
+          description: Operation exception. Please check the response body for details.
+        '401':
+          description: Unauthenticated access. Please login first.
+        '403':
+          description: Unauthorized access. Please check your permissions.
+        '500':
+          description: Unexpected error. Please check the response body for the stack
+            trace.
+      security:
+      - jwt: []
+      summary: Check if account name exists
+      tags:
+      - RgwUserAccounts
   /api/rgw/accounts/{account_id}:
     delete:
       description: "\n        Removes an account\n\n        :param account_id: account\
diff --git a/src/pybind/mgr/dashboard/services/rgw_iam.py b/src/pybind/mgr/dashboard/services/rgw_iam.py
index ed1bfe09581..928560f154d 100644
--- a/src/pybind/mgr/dashboard/services/rgw_iam.py
+++ b/src/pybind/mgr/dashboard/services/rgw_iam.py
@@ -25,6 +25,15 @@ class RgwAccounts:
         get_accounts_cmd = ['account', 'list']
         return cls.send_rgw_cmd(get_accounts_cmd)
 
+    @classmethod
+    def get_account_by_name(cls, account_name: str):
+        """
+        Get account info by account name
+        Returns account info if found, raises exception otherwise
+        """
+        get_account_cmd = ['account', 'info', '--account-name', account_name]
+        return cls.send_rgw_cmd(get_account_cmd)
+
     @classmethod
     def set_quota(cls, quota_type: str, account_id: str, max_size: str, max_objects: str,
                   enabled: bool):

From 6aa58ca1eca9d15febe4f1cbbd4d1004e35015ea Mon Sep 17 00:00:00 2001
From: Sun Yuechi <sunyuechi@iscas.ac.cn>
Date: Mon, 6 Jul 2026 01:06:09 -0700
Subject: [PATCH 549/596] test/subprocess: add missing space in SubshellKilled
 subcommand

9abf2388f24 rewrote "sh -c cat" as SHELL "-c cat", which concatenates
to "/bin/sh-c cat", so the subshell tries to execute a non-existent
"/bin/sh-c". The test still passed because the SIGTERM sent by kill()
usually wins the race against the shell startup; under CI load the
shell occasionally prints

  /bin/sh: line 1: /bin/sh-c: No such file or directory

into the stderr pipe first, ASSERT_TRUE(buf.empty()) fails, and the
skipped join() turns this into a SIGABRT in ~SubProcess().

Signed-off-by: Sun Yuechi <sunyuechi@iscas.ac.cn>
---
 src/test/test_subprocess.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/test_subprocess.cc b/src/test/test_subprocess.cc
index c6415c4864a..6f2542895b0 100644
--- a/src/test/test_subprocess.cc
+++ b/src/test/test_subprocess.cc
@@ -258,7 +258,7 @@ TEST(SubProcessTimed, SubshellNoTimeout)
 TEST(SubProcessTimed, SubshellKilled)
 {
   SubProcessTimed sh(SHELL, SubProcess::PIPE, SubProcess::PIPE, SubProcess::PIPE, 10);
-  sh.add_cmd_args("-c", SHELL "-c cat", NULL);
+  sh.add_cmd_args("-c", SHELL " -c cat", NULL);
   ASSERT_EQ(sh.spawn(), 0);
   std::string msg("etaoin shrdlu");
   int n = write(sh.get_stdin(), msg.c_str(), msg.size());

From 6573766548a1d020b1414bb9e4944f7b6bf695a0 Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Thu, 2 Jul 2026 19:05:52 +0530
Subject: [PATCH 550/596] =?UTF-8?q?mgr/dashboard:=20NVMe-oF=20=E2=80=93=20?=
 =?UTF-8?q?Enable=20editing=20host=20access=20from=20the=20Subsystem=20Ove?=
 =?UTF-8?q?rview=20page?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://tracker.ceph.com/issues/77912

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../nvmeof-group-form.component.spec.ts       |  2 +-
 .../nvmeof-group-form.component.ts            |  3 +-
 .../nvmeof-initiators-form.component.spec.ts  | 27 +++++++-
 .../nvmeof-initiators-form.component.ts       | 20 +++++-
 .../nvmeof-initiators-list.component.html     | 64 ++++++++-----------
 .../nvmeof-initiators-list.component.spec.ts  | 26 +++++++-
 .../nvmeof-initiators-list.component.ts       |  8 ++-
 .../nvmeof-subsystem-overview.component.html  |  3 +-
 ...vmeof-subsystem-overview.component.spec.ts | 45 ++++++++++++-
 .../nvmeof-subsystem-overview.component.ts    | 55 ++++++++++++----
 10 files changed, 192 insertions(+), 61 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
index 5b77ae89ceb..a4979e2c93d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
@@ -160,7 +160,7 @@ describe('NvmeofGroupFormComponent', () => {
       } as any;
 
       component.groupForm.get('groupName').setValue('encrypted-group');
-      component.groupForm.get('enableEncryption').setValue(true);
+      component.groupForm.get('enable_auth').setValue(true);
       component.groupForm.get('encryptionKey').setValue('encryption-key-123');
       component.onSubmit();
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index 7053bbbe9f9..583626b7bd1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -68,6 +68,7 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
         [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)]
       ),
       unmanaged: new UntypedFormControl(false),
+      enable_auth: new UntypedFormControl(false),
       enableEncryption: new UntypedFormControl(false),
       encryptionConfig: new UntypedFormControl(null),
       encryptionKey: new UntypedFormControl(null),
@@ -158,7 +159,7 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       unmanaged: formValues.unmanaged
     };
 
-    if (formValues.enableEncryption) {
+    if (formValues.enableEncryption || formValues.enable_auth) {
       const encryptionKey = formValues.encryptionKey || formValues.encryptionConfig;
       if (encryptionKey) {
         serviceSpec['encryption_key'] = encryptionKey;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts
index 388592eaea4..702c976954a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.spec.ts
@@ -10,7 +10,7 @@ import { NgbActiveModal, NgbTypeaheadModule } from '@ng-bootstrap/ng-bootstrap';
 
 import { SharedModule } from '~/app/shared/shared.module';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
-import { HOST_TYPE } from '~/app/shared/models/nvmeof';
+import { ALLOW_ALL_HOST, HOST_TYPE } from '~/app/shared/models/nvmeof';
 
 import { NvmeofInitiatorsFormComponent } from './nvmeof-initiators-form.component';
 
@@ -92,6 +92,7 @@ describe('NvmeofInitiatorsFormComponent', () => {
     beforeEach(() => {
       nvmeofService = TestBed.inject(NvmeofService);
       spyOn(nvmeofService, 'addSubsystemInitiators').and.returnValue(of({}));
+      spyOn(nvmeofService, 'removeInitiators').and.returnValue(of({}));
     });
 
     it('should be creating request correctly', () => {
@@ -147,5 +148,29 @@ describe('NvmeofInitiatorsFormComponent', () => {
       expect(nvmeofService.addSubsystemInitiators).not.toHaveBeenCalled();
       expect(component.isSubmitLoading).toBe(false);
     });
+
+    it('should remove wildcard host before adding specific hosts', () => {
+      const subsystemNQN = 'nqn.test';
+      component.subsystemNQN = subsystemNQN;
+      component.group = 'test-group';
+      component.existingHosts = [ALLOW_ALL_HOST];
+
+      const payload: any = {
+        hostType: HOST_TYPE.SPECIFIC,
+        addedHosts: ['host3']
+      };
+
+      component.onSubmit(payload);
+
+      expect(nvmeofService.removeInitiators).toHaveBeenCalledWith(subsystemNQN, {
+        host_nqn: ALLOW_ALL_HOST,
+        gw_group: 'test-group'
+      });
+      expect(nvmeofService.addSubsystemInitiators).toHaveBeenCalledWith(subsystemNQN, {
+        allow_all: false,
+        gw_group: 'test-group',
+        hosts: [{ dhchap_key: '', host_nqn: 'host3' }]
+      });
+    });
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
index d3cb2308f39..789054cc746 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
@@ -3,6 +3,7 @@ import { Step } from 'carbon-components-angular';
 import { NvmeofService, SubsystemInitiatorRequest } from '~/app/shared/api/nvmeof.service';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import {
+  ALLOW_ALL_HOST,
   AuthStepType,
   HOST_TYPE,
   HostStepType,
@@ -11,6 +12,8 @@ import {
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { ActivatedRoute, Params, Router } from '@angular/router';
 import { TearsheetComponent } from '~/app/shared/components/tearsheet/tearsheet.component';
+import { Observable } from 'rxjs';
+import { switchMap } from 'rxjs/operators';
 
 type InitiatorsFormPayload = Pick<HostStepType, 'hostType' | 'addedHosts'> &
   Partial<Pick<AuthStepType, 'hostDchapKeyList'>>;
@@ -149,12 +152,27 @@ export class NvmeofInitiatorsFormComponent implements OnInit {
       hosts,
       gw_group: this.group
     };
+
+    const shouldRemoveAllowAllHost =
+      payload.hostType === HOST_TYPE.SPECIFIC && this.existingHosts.includes(ALLOW_ALL_HOST);
+
+    const submitCall$: Observable<unknown> = shouldRemoveAllowAllHost
+      ? this.nvmeofService
+          .removeInitiators(this.subsystemNQN, {
+            host_nqn: ALLOW_ALL_HOST,
+            gw_group: this.group
+          })
+          .pipe(
+            switchMap(() => this.nvmeofService.addSubsystemInitiators(this.subsystemNQN, request))
+          )
+      : this.nvmeofService.addSubsystemInitiators(this.subsystemNQN, request);
+
     this.taskWrapperService
       .wrapTaskAroundCall({
         task: new FinishedTask(taskUrl, {
           nqn: this.subsystemNQN
         }),
-        call: this.nvmeofService.addSubsystemInitiators(this.subsystemNQN, request)
+        call: submitCall$
       })
       .subscribe({
         error: () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
index 0988d0563d5..b97d6684bad 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
@@ -1,43 +1,35 @@
 @if (allowAllHosts) {
   <cd-alert-panel
-    class="cds-mb-4"
-    type="info"
-    [showTitle]="false">
-    <div cdsStack="horizontal"
-         gap="2">
-      <div cdsStack="vertical"
-           gap="2">
-        <strong i18n>Host access: All hosts allowed</strong>
-        <p
-          class="cds-mb-0 cds-mt-1"
-          i18n
-        >
-          Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
-        </p>
-      </div>
-      <a cdsLink
-         class="cds-ml-3"
-         (click)="openAddInitiatorForm(true)"
-         i18n>Edit host access</a>
-    </div>
-  </cd-alert-panel>
-} @else {
-  <cd-table [data]="initiators"
-            columnMode="flex"
-            (fetchData)="listInitiators()"
-            [columns]="initiatorColumns"
-            selectionType="multiClick"
-            (updateSelection)="updateSelection($event)">
-    <div class="table-actions">
-      <cd-table-actions [permission]="permission"
-                        [selection]="selection"
-                        class="btn-group"
-                        [tableActions]="tableActions">
-      </cd-table-actions>
-    </div>
-  </cd-table>
+  class="cds-mb-4"
+  type="warning"
+  [showTitle]="false">
+  <div cdsStack="vertical"
+       gap="1">
+    <strong class="cds-mb-1"
+            i18n>All hosts allowed</strong>
+    <p class="cds-mb-0"
+       i18n>
+      Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
+    </p>
+  </div>
+</cd-alert-panel>
 }
 
+<cd-table [data]="initiators"
+          columnMode="flex"
+          (fetchData)="listInitiators()"
+          [columns]="initiatorColumns"
+          selectionType="multiClick"
+          (updateSelection)="updateSelection($event)">
+  <div class="table-actions">
+    <cd-table-actions [permission]="permission"
+                      [selection]="selection"
+                      class="btn-group"
+                      [tableActions]="tableActions">
+    </cd-table-actions>
+  </div>
+</cd-table>
+
 <ng-template #hostNqnTpl
              let-row="data.row">
   {{ getDisplayedHostNqn(row.nqn) }}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
index 0f72f0225b6..61f5d39ac74 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.spec.ts
@@ -180,7 +180,7 @@ describe('NvmeofInitiatorsListComponent', () => {
     expect(getSubsystemSpy).toHaveBeenCalledTimes(2);
   });
 
-  it('should filter ALLOW_ALL_HOST from array response', fakeAsync(() => {
+  it('should include ALLOW_ALL_HOST from array response', fakeAsync(() => {
     spyOn(nvmeofService, 'getInitiators').and.returnValue(
       of([
         { nqn: ALLOW_ALL_HOST, use_dhchap: false },
@@ -191,7 +191,10 @@ describe('NvmeofInitiatorsListComponent', () => {
     component.listInitiators();
     tick();
 
-    expect(component.initiators).toEqual([{ nqn: 'nqn.2016-06.io.spdk:host2', use_dhchap: false }]);
+    expect(component.initiators).toEqual([
+      { nqn: ALLOW_ALL_HOST, use_dhchap: false },
+      { nqn: 'nqn.2016-06.io.spdk:host2', use_dhchap: false }
+    ]);
   }));
 
   it('should support hosts-wrapper response from getInitiators', fakeAsync(() => {
@@ -207,6 +210,23 @@ describe('NvmeofInitiatorsListComponent', () => {
     component.listInitiators();
     tick();
 
-    expect(component.initiators).toEqual([{ nqn: 'nqn.2016-06.io.spdk:host3', use_dhchap: true }]);
+    expect(component.initiators).toEqual([
+      { nqn: ALLOW_ALL_HOST, use_dhchap: false },
+      { nqn: 'nqn.2016-06.io.spdk:host3', use_dhchap: true }
+    ]);
+  }));
+
+  it('should set allowAllHosts to true when wildcard initiator exists', fakeAsync(() => {
+    const allowAllSubsystem = { ...mockSubsystem, allow_any_host: true };
+    spyOn(nvmeofService, 'getInitiators').and.returnValue(
+      of([{ nqn: ALLOW_ALL_HOST, use_dhchap: false }])
+    );
+    spyOn(nvmeofService, 'getSubsystem').and.returnValue(of(allowAllSubsystem));
+
+    component.listInitiators();
+    component.getSubsystem();
+    tick();
+
+    expect(component.allowAllHosts).toBe(true);
   }));
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
index 7f4461e96e0..872d004ad73 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.ts
@@ -183,7 +183,11 @@ export class NvmeofInitiatorsListComponent implements OnInit, OnDestroy {
   }
 
   hasAllHostsAllowed(): boolean {
-    return !!this.subsystem?.allow_any_host && this.initiators.length === 0;
+    return (
+      !!this.subsystem?.allow_any_host &&
+      (this.initiators.length === 0 ||
+        this.initiators.some((initiator) => initiator.nqn === ALLOW_ALL_HOST))
+    );
   }
 
   updateSelection(selection: CdTableSelection) {
@@ -195,7 +199,7 @@ export class NvmeofInitiatorsListComponent implements OnInit, OnDestroy {
       .getInitiators(this.subsystemNQN, this.group)
       .subscribe((response: NvmeofSubsystemInitiator[] | { hosts: NvmeofSubsystemInitiator[] }) => {
         const initiators = Array.isArray(response) ? response : response?.hosts || [];
-        this.initiators = initiators.filter((i) => i.nqn !== ALLOW_ALL_HOST);
+        this.initiators = initiators;
         this.updateAuthStatus();
       });
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
index c975058fe7c..922b0d03990 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
@@ -68,8 +68,7 @@
             <div class="cds--type-label-02">
               <span>{{ detail.value ? 'Allow all hosts' : 'Restrict to specific hosts' }}</span>
               <a cdsLink
-                 [routerLink]="['../hosts']"
-                 [queryParams]="{ group: groupName }"
+                 (click)="openEditHostAccessModal()"
                  [cdsStack]="'horizontal'"
                  class="cds-ml-2"
                  [gap]="1">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
index f86a3acb95d..8c3557c6372 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.spec.ts
@@ -1,14 +1,15 @@
 import { ComponentFixture, TestBed, fakeAsync, tick } from '@angular/core/testing';
 import { HttpClientTestingModule } from '@angular/common/http/testing';
 import { RouterTestingModule } from '@angular/router/testing';
-import { ActivatedRoute } from '@angular/router';
-import { of } from 'rxjs';
+import { ActivatedRoute, NavigationEnd, Router } from '@angular/router';
+import { of, Subject } from 'rxjs';
 
 import { NgbTooltipModule } from '@ng-bootstrap/ng-bootstrap';
 import { GridModule, TilesModule } from 'carbon-components-angular';
 
 import { NvmeofSubsystemOverviewComponent } from './nvmeof-subsystem-overview.component';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
+import { URLVerbs } from '~/app/shared/constants/app.constants';
 import { SharedModule } from '~/app/shared/shared.module';
 import { NvmeofSubsystem, NvmeofSubsystemInitiator } from '~/app/shared/models/nvmeof';
 
@@ -16,6 +17,9 @@ describe('NvmeofSubsystemOverviewComponent', () => {
   let component: NvmeofSubsystemOverviewComponent;
   let fixture: ComponentFixture<NvmeofSubsystemOverviewComponent>;
   let nvmeofService: NvmeofService;
+  let router: Router;
+  let activatedRoute: ActivatedRoute;
+  let routerEvents$: Subject<any>;
 
   const mockSubsystem: NvmeofSubsystem = {
     nqn: 'nqn.2016-06.io.spdk:cnode1',
@@ -79,6 +83,8 @@ describe('NvmeofSubsystemOverviewComponent', () => {
   }
 
   beforeEach(async () => {
+    routerEvents$ = new Subject<any>();
+
     await TestBed.configureTestingModule({
       declarations: [NvmeofSubsystemOverviewComponent],
       imports: [
@@ -97,6 +103,13 @@ describe('NvmeofSubsystemOverviewComponent', () => {
             getSubsystem: jest.fn().mockReturnValue(of(mockSubsystem)),
             getInitiators: jest.fn().mockReturnValue(of([]))
           }
+        },
+        {
+          provide: Router,
+          useValue: {
+            events: routerEvents$.asObservable(),
+            navigate: jest.fn().mockResolvedValue(true)
+          }
         }
       ]
     }).compileComponents();
@@ -106,6 +119,8 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     fixture = TestBed.createComponent(NvmeofSubsystemOverviewComponent);
     component = fixture.componentInstance;
     nvmeofService = TestBed.inject(NvmeofService);
+    router = TestBed.inject(Router);
+    activatedRoute = TestBed.inject(ActivatedRoute);
     fixture.detectChanges();
   });
 
@@ -189,4 +204,30 @@ describe('NvmeofSubsystemOverviewComponent', () => {
     });
     expect(f.nativeElement.textContent).toContain('Unidirectional');
   }));
+
+  it('should open host access edit modal route when edit is clicked', () => {
+    const navigateSpy = jest.spyOn(router, 'navigate').mockResolvedValue(true);
+    component.groupName = 'group1';
+    component.openEditHostAccessModal();
+
+    expect(navigateSpy).toHaveBeenCalledWith(
+      [{ outlets: { modal: [URLVerbs.ADD, 'initiator'] } }],
+      {
+        queryParams: { group: 'group1' },
+        relativeTo: activatedRoute.parent
+      }
+    );
+  });
+
+  it('should refresh subsystem on non-modal navigation end', () => {
+    (nvmeofService.getSubsystem as jest.Mock).mockClear();
+
+    routerEvents$.next(new NavigationEnd(1, '/nvmeof/(modal:add)', '/nvmeof/(modal:add)'));
+    expect(nvmeofService.getSubsystem).not.toHaveBeenCalled();
+
+    routerEvents$.next(
+      new NavigationEnd(2, '/nvmeof/subsystems/overview', '/nvmeof/subsystems/overview')
+    );
+    expect(nvmeofService.getSubsystem).toHaveBeenCalledWith('nqn.2016-06.io.spdk:cnode1', 'group1');
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
index acb97b9a4e8..84e1abee4a8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
@@ -1,6 +1,7 @@
-import { Component, OnInit } from '@angular/core';
-import { ActivatedRoute } from '@angular/router';
-import { forkJoin } from 'rxjs';
+import { Component, OnDestroy, OnInit } from '@angular/core';
+import { ActivatedRoute, NavigationEnd, Router } from '@angular/router';
+import { forkJoin, Subscription } from 'rxjs';
+import { filter } from 'rxjs/operators';
 
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import {
@@ -9,6 +10,7 @@ import {
   NO_AUTH,
   getSubsystemAuthStatus
 } from '~/app/shared/models/nvmeof';
+import { URLVerbs } from '~/app/shared/constants/app.constants';
 import { ICON_TYPE } from '~/app/shared/enum/icons.enum';
 import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { NvmeofEditAuthenticationComponent } from '../nvmeof-edit-authentication/nvmeof-edit-authentication.component';
@@ -27,27 +29,49 @@ export interface SubsystemDetail {
   styleUrls: ['./nvmeof-subsystem-overview.component.scss'],
   standalone: false
 })
-export class NvmeofSubsystemOverviewComponent implements OnInit {
+export class NvmeofSubsystemOverviewComponent implements OnInit, OnDestroy {
   subsystemNQN!: string;
   groupName!: string;
   subsystem!: NvmeofSubsystem;
   details: SubsystemDetail[] = [];
+  private subscriptions = new Subscription();
 
   constructor(
     private route: ActivatedRoute,
+    private router: Router,
     private nvmeofService: NvmeofService,
     private modalService: ModalCdsService
   ) {}
 
   ngOnInit() {
-    this.route.parent?.params.subscribe((params) => {
-      this.subsystemNQN = params['subsystem_nqn'];
-      this.fetchIfReady();
-    });
-    this.route.queryParams.subscribe((qp) => {
-      this.groupName = qp['group'];
-      this.fetchIfReady();
-    });
+    this.subscriptions.add(
+      this.route.parent?.params.subscribe((params) => {
+        this.subsystemNQN = params['subsystem_nqn'];
+        this.fetchIfReady();
+      })
+    );
+    this.subscriptions.add(
+      this.route.queryParams.subscribe((qp) => {
+        this.groupName = qp['group'];
+        this.fetchIfReady();
+      })
+    );
+    this.subscriptions.add(
+      this.router.events
+        .pipe(
+          filter(
+            (event): event is NavigationEnd =>
+              event instanceof NavigationEnd && !event.urlAfterRedirects.includes('(modal:')
+          )
+        )
+        .subscribe(() => {
+          this.fetchIfReady();
+        })
+    );
+  }
+
+  ngOnDestroy() {
+    this.subscriptions.unsubscribe();
   }
 
   private fetchIfReady() {
@@ -179,4 +203,11 @@ export class NvmeofSubsystemOverviewComponent implements OnInit {
       modalRef.closeChange.subscribe(() => this.fetchSubsystem());
     }
   }
+
+  openEditHostAccessModal() {
+    this.router.navigate([{ outlets: { modal: [URLVerbs.ADD, 'initiator'] } }], {
+      queryParams: { group: this.groupName },
+      relativeTo: this.route.parent
+    });
+  }
 }

From 4ac6a8298f5cbd37b92acc554e9467c3bb16a6af Mon Sep 17 00:00:00 2001
From: Abhishek Desai <abhishek.desai1@ibm.com>
Date: Mon, 15 Jun 2026 16:42:15 +0530
Subject: [PATCH 551/596] mgr/dashboard : Enable cephadm-signed TLS for NVMeOf
 fixes: https://tracker.ceph.com/issues/77406 Signed-off-by: Abhishek Desai
 <abhishek.desai1@ibm.com>

(cherry picked from commit 14162473bb6a6993ec729056b35dc514cad2228e)
Signed-off-by: pujashahu <pshahu@redhat.com>
---
 .../nvmeof-gateway-group.component.html       | 25 ++++++++---
 .../nvmeof-gateway-group.component.scss       |  4 ++
 .../nvmeof-gateway-group.component.ts         | 39 ++++++++++++++++
 .../nvmeof-gateway-node.component.html        |  4 +-
 .../nvmeof-gateway-node.component.ts          |  2 +
 .../service-form/service-form.component.html  |  2 +-
 .../service-form/service-form.component.ts    | 34 +++++++++++++-
 .../shared/components/components.module.ts    |  4 +-
 .../details-card/details-card.component.html  | 45 ++++++++++---------
 .../details-card.component.spec.ts            |  4 +-
 .../details-card/details-card.component.ts    |  1 -
 11 files changed, 128 insertions(+), 36 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 078553f626a..287361a41dc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,6 +1,19 @@
 <div class="nvmeof-content-layout">
   <div class="nvmeof-content-main">
     <ng-container *ngIf="gatewayGroup$ | async as gateways">
+      <!-- Details Card Section -->
+      <ng-container *ngIf="selection.hasSelection">
+        <cd-details-card
+          cardTitle="Details"
+          i18n-cardTitle
+          [details]="selectedGatewayDetails"
+          [showEditButton]="true"
+          [editButtonLabel]="actionLabels.EDIT"
+          [columns]="4"
+          (editClicked)="editSelectedGatewayGroup()">
+        </cd-details-card>
+      </ng-container>
+
       <cd-table
         #table
         [data]="gateways"
@@ -14,11 +27,13 @@
         i18n-emptyStateTitle
         emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
         i18n-emptyStateMessage>
-      <cd-table-actions class="table-actions"
-                        [permission]="permission"
-                        [selection]="selection"
-                        [tableActions]="tableActions">
-      </cd-table-actions>
+        <div class="table-actions">
+          <cd-table-actions
+            [permission]="permission"
+            [selection]="selection"
+            [tableActions]="tableActions">
+          </cd-table-actions>
+        </div>
       </cd-table>
     </ng-container>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
index a5f8a62aac9..71694a4ab86 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
@@ -4,3 +4,7 @@ cd-details-card {
   display: block;
   margin-bottom: layout.$spacing-05;
 }
+
+.table-actions {
+  margin-top: layout.$spacing-03;
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index 17766f2b717..04c3bf4fbe7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -342,6 +342,45 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     this.router.navigate([this.viewUrl, groupName]);
   }
 
+  editSelectedGatewayGroup(): void {
+    const selectedGroup = this.selection.first();
+    if (!selectedGroup) {
+      return;
+    }
+    this.router.navigate([this.urlBuilder.getEdit(selectedGroup.name)]);
+  }
+
+  private buildGatewayDetails(selectedGroup: any): DetailItem[] {
+    if (!selectedGroup) {
+      return [];
+    }
+
+    const runningGateways = selectedGroup.statusCount?.running ?? 0;
+    const errorGateways = selectedGroup.statusCount?.error ?? 0;
+    const totalGateways = runningGateways + errorGateways;
+
+    return [
+      {
+        label: $localize`Gateway name`,
+        value: selectedGroup.name
+      },
+      {
+        label: $localize`Gateway nodes`,
+        value: totalGateways
+      },
+      {
+        label: $localize`Encryption`,
+        value: selectedGroup.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
+        type: 'status'
+      },
+      {
+        label: $localize`mTLS`,
+        value: selectedGroup.spec?.enable_mtls ? $localize`Enabled` : $localize`Disabled`,
+        type: 'status'
+      }
+    ];
+  }
+
   ngOnDestroy(): void {
     this.destroy$.next();
     this.destroy$.complete();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
index 0a97671fa3b..b8025d08f06 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
@@ -1,7 +1,7 @@
 <div class="content-theme">
   @if (mode === 'details' && groupName) {
-  <cd-details-card cardTitle="Details" i18n-cardTitle [details]="gatewayDetails" [showEditButton]="false"
-    class="cds-mb-5">
+  <cd-details-card cardTitle="Details" i18n-cardTitle [details]="gatewayDetails" [showEditButton]="true"
+    editButtonLabel="Edit" i18n-editButtonLabel (editClicked)="onEditGateway()" class="cds-mb-5">
   </cd-details-card>
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
index 89fe4865356..fecbbe14a47 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
@@ -439,6 +439,8 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy, OnChanges
     this.hostsLoaded.emit(this.count);
   }
 
+  onEditGateway(): void {}
+
   private buildGatewayDetails(
     serviceSpec: CephServiceSpec,
     gatewayNodeCount: number
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index d88531a22c2..b6e9374e006 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -1419,7 +1419,7 @@
            i18n>Choose Certificate Authority</label>
     <cds-radio-group formControlName="certificateType"
                      orientation="horizontal"
-                     helperText="Select how certificates will be signed for this service. Choose internal to use the cluster’s CA, or external to upload certificates signed by your organization."
+                     helperText="Select how certificates will be signed for this service. Choose internal to use the cluster's CA, or external to upload certificates signed by your organization."
                      i18n-helperText>
       <cds-radio [value]="CertificateType.internal"
                  (change)="onCertificateTypeChange(CertificateType.internal)"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index 33f6d602c4c..26b6a0b2721 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -978,6 +978,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         });
     }
     this.detectChanges();
+    this.updateRgwPlacementControlsState();
+    this.updateGrafanaPasswordControlState();
   }
 
   detectChanges(): void {
@@ -1151,7 +1153,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         } else {
           this.showRealmCreationForm = false;
         }
-        this.updateRgwControlStates();
+         this.updateRgwControlStates();
       },
       (_error) => {
         const defaultZone = new RgwZone();
@@ -1160,7 +1162,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         defaultZonegroup.name = 'default';
         this.zoneList.push(defaultZone);
         this.zonegroupList.push(defaultZonegroup);
-        this.updateRgwControlStates();
+         this.updateRgwControlStates();
       }
     );
   }
@@ -1191,6 +1193,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
 
   onServiceTypeChange(selectedServiceType: string) {
     this.setServiceId(selectedServiceType);
+    this.updateGrafanaPasswordControlState(selectedServiceType);
 
     this.serviceIds = this.serviceList
       ?.filter((service) => service['service_type'] === selectedServiceType)
@@ -1217,6 +1220,33 @@ export class ServiceFormComponent extends CdForm implements OnInit {
     }
   }
 
+  private updateRgwPlacementControlsState(): void {
+    this.toggleFormControlState('realm_name', this.editing || this.realmList.length === 0);
+    this.toggleFormControlState('zonegroup_name', this.editing || this.zonegroupList.length === 0);
+    this.toggleFormControlState('zone_name', this.editing || this.zoneList.length === 0);
+  }
+
+  private updateGrafanaPasswordControlState(serviceType = this.serviceForm?.get('service_type')?.value): void {
+    this.toggleFormControlState(
+      'grafana_admin_password',
+      this.editing && serviceType === 'grafana'
+    );
+  }
+
+  private toggleFormControlState(controlName: string, disabled: boolean): void {
+    const control = this.serviceForm.get(controlName);
+    if (!control) {
+      return;
+    }
+    if (disabled && control.enabled) {
+      control.disable({ emitEvent: false });
+      return;
+    }
+    if (!disabled && control.disabled) {
+      control.enable({ emitEvent: false });
+    }
+  }
+
   onPlacementChange(selected: string) {
     if (selected === 'label') {
       this.serviceForm.get('count').setValue(null);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
index 91a5cbced6a..fd81525f009 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/components.module.ts
@@ -142,7 +142,6 @@ import { NumberWithUnitComponent } from './number-with-unit/number-with-unit.com
 @NgModule({
   imports: [
     CommonModule,
-    ProductiveCardComponent,
     FormsModule,
     ReactiveFormsModule,
     NgbAlertModule,
@@ -186,7 +185,8 @@ import { NumberWithUnitComponent } from './number-with-unit/number-with-unit.com
     TagModule,
     LinkModule,
     LayerModule,
-    ThemeModule
+    ThemeModule,
+    ProductiveCardComponent
   ],
   declarations: [
     SparklineComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index b1595fbcdf2..3d558fb8c56 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -17,31 +17,32 @@
     }
   </ng-template>
 
-  <div [cdsStack]="'vertical'" 
-       [gap]="0">
+  <div>
     @if (details && details.length > 0) {
-    <div [cdsStack]="'horizontal'"
-         [gap]="5">
-      @for (detail of getVisibleDetails(); track detail.label) {
-      <div [cdsStack]="'vertical'" 
-           [gap]="2">
-        <label class="cds--type-label-01">{{ detail.label }}</label>
-        <div class="cds--type-body-01">
-          @switch (detail.type) {
-            @case ('status') {
-              <div [cdsStack]="'horizontal'" [gap]="3">
-                <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
-                <span>{{ getDisplayValue(detail.value) }}</span>
-              </div>
-            }
-            
-            @default {
-              <span>{{ getDisplayValue(detail.value) }}</span>
-            }
-          }
+    <div class="cds--grid cds--no-gutter">
+      <div class="cds--row">
+        @for (detail of getVisibleDetails(); track detail.label) {
+        <div class="cds--col">
+          <div [cdsStack]="'vertical'" [gap]="2">
+            <label class="cds--type-label-01">{{ detail.label }}</label>
+            <div class="cds--type-body-01">
+              @switch (detail.type) {
+                @case ('status') {
+                  <div [cdsStack]="'horizontal'" [gap]="3">
+                    <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
+                    <span>{{ getDisplayValue(detail.value) }}</span>
+                  </div>
+                }
+                
+                @default {
+                  <span>{{ getDisplayValue(detail.value) }}</span>
+                }
+              }
+            </div>
+          </div>
         </div>
+        }
       </div>
-      }
     </div>
     }
     <ng-content></ng-content>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
index a8eb9996aa8..0896ba2a603 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.spec.ts
@@ -1,6 +1,7 @@
 import { ComponentFixture, TestBed } from '@angular/core/testing';
 
 import { DetailsCardComponent } from './details-card.component';
+import { ProductiveCardComponent } from '../productive-card/productive-card.component';
 
 describe('DetailsCardComponent', () => {
   let component: DetailsCardComponent;
@@ -8,7 +9,8 @@ describe('DetailsCardComponent', () => {
 
   beforeEach(async () => {
     await TestBed.configureTestingModule({
-      declarations: [DetailsCardComponent]
+      declarations: [DetailsCardComponent],
+      imports: [ProductiveCardComponent]
     }).compileComponents();
 
     fixture = TestBed.createComponent(DetailsCardComponent);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
index 9b2fad7afb8..cbd62d6f8ef 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.ts
@@ -43,7 +43,6 @@ export class DetailsCardComponent {
   onEditClick(): void {
     this.editClicked.emit();
   }
-
   getVisibleDetails(): DetailItem[] {
     return (this.details || []).filter((detail) => !detail.hidden);
   }

From f6d0164a05580cf71d74e5e11fcb7a1b21e595be Mon Sep 17 00:00:00 2001
From: pujashahu <pshahu@redhat.com>
Date: Wed, 24 Jun 2026 13:38:54 +0530
Subject: [PATCH 552/596] mgr/dashboard: Implement backword support for Create
 existing nvme-oF gateway groups through UI

Fixes : https://tracker.ceph.com/issues/77632

Signed-off-by: pujaoshahu <pshahu@redhat.com>
---
 .../src/app/ceph/block/block.module.ts        |  15 +-
 .../nvmeof-gateway-group.component.html       |  67 ++++-----
 .../nvmeof-gateway-group.component.scss       |   4 -
 .../nvmeof-gateway-group.component.ts         |  84 +----------
 .../nvmeof-gateway-node.component.html        |   4 +-
 .../nvmeof-gateway-node.component.ts          |   2 -
 .../nvmeof-group-form.component.html          |  74 +++------
 .../nvmeof-group-form.component.spec.ts       |  16 +-
 .../nvmeof-group-form.component.ts            | 140 +++++++++++++-----
 .../nvmeof-namespaces-list.component.spec.ts  |  15 ++
 .../nvmeof-namespaces-list.component.ts       |  12 ++
 .../service-form/service-form.component.ts    |   8 +-
 .../details-card/details-card.component.html  |  57 +++----
 13 files changed, 234 insertions(+), 264 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
index 722832ae977..2291a091997 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/block.module.ts
@@ -10,6 +10,7 @@ import { ActionLabels, URLVerbs } from '~/app/shared/constants/app.constants';
 import { FeatureTogglesGuardService } from '~/app/shared/services/feature-toggles-guard.service';
 import { ModuleStatusGuardService } from '~/app/shared/services/module-status-guard.service';
 import { SharedModule } from '~/app/shared/shared.module';
+import { TextLabelListComponent } from '~/app/shared/components/text-label-list/text-label-list.component';
 import { IscsiSettingComponent } from './iscsi-setting/iscsi-setting.component';
 import { IscsiTabsComponent } from './iscsi-tabs/iscsi-tabs.component';
 import { IscsiTargetDetailsComponent } from './iscsi-target-details/iscsi-target-details.component';
@@ -148,7 +149,8 @@ import { NvmeofEditAuthenticationComponent } from './nvmeof-edit-authentication/
     LayoutModule,
     ThemeModule,
     NvmeofSetupCardsComponent,
-    NvmeofGatewayGroupFilterComponent
+    NvmeofGatewayGroupFilterComponent,
+    TextLabelListComponent
   ],
   declarations: [
     RbdListComponent,
@@ -380,6 +382,17 @@ const routes: Routes = [
               }
             }
           },
+          {
+            path: `${URLVerbs.EDIT}/:name`,
+            component: NvmeofGroupFormComponent,
+            data: {
+              breadcrumbs: ActionLabels.EDIT,
+              pageHeader: {
+                title: $localize`Edit Gateway Group`,
+                description: $localize`Modify gateway group configuration.`
+              }
+            }
+          },
           {
             path: `${URLVerbs.VIEW}/:group`,
             component: NvmeGatewayViewComponent,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 287361a41dc..8d4007806bc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -1,43 +1,27 @@
-<div class="nvmeof-content-layout">
-  <div class="nvmeof-content-main">
-    <ng-container *ngIf="gatewayGroup$ | async as gateways">
-      <!-- Details Card Section -->
-      <ng-container *ngIf="selection.hasSelection">
-        <cd-details-card
-          cardTitle="Details"
-          i18n-cardTitle
-          [details]="selectedGatewayDetails"
-          [showEditButton]="true"
-          [editButtonLabel]="actionLabels.EDIT"
-          [columns]="4"
-          (editClicked)="editSelectedGatewayGroup()">
-        </cd-details-card>
-      </ng-container>
+<ng-container *ngIf="gatewayGroup$ | async as gateways">
+  <cd-table
+    #table
+    [data]="gateways"
+    [columns]="columns"
+    columnMode="flex"
+    selectionType="single"
+    identifier="name"
+    (updateSelection)="updateSelection($event)"
+    (fetchData)="fetchData()"
+    emptyStateTitle="No gateway group created"
+    i18n-emptyStateTitle
+    emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
+    i18n-emptyStateMessage>
 
-      <cd-table
-        #table
-        [data]="gateways"
-        [columns]="columns"
-        columnMode="flex"
-        selectionType="single"
-        identifier="name"
-        (updateSelection)="updateSelection($event)"
-        (fetchData)="fetchData()"
-        emptyStateTitle="No gateway group created"
-        i18n-emptyStateTitle
-        emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
-        i18n-emptyStateMessage>
-        <div class="table-actions">
-          <cd-table-actions
-            [permission]="permission"
-            [selection]="selection"
-            [tableActions]="tableActions">
-          </cd-table-actions>
-        </div>
-      </cd-table>
-    </ng-container>
-  </div>
-</div>
+    <div class="table-actions">
+      <cd-table-actions [permission]="permission"
+                        [selection]="selection"
+                        class="btn-group"
+                        [tableActions]="tableActions">
+      </cd-table-actions>
+    </div>
+  </cd-table>
+</ng-container>
 
 <ng-template #dateTpl
              let-created="data.value">
@@ -45,10 +29,9 @@
 </ng-template>
 
 <ng-template #customTableItemTemplate
-             let-value="data.value"
-             let-row="data.row">
+             let-value="data.value">
   <a cdsLink
-     [routerLink]="[viewUrl, value]"
+     [routerLink]="[viewUrl, value | encodeUri]"
      (click)="$event.stopPropagation()">
     {{ value }}
   </a>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
index 71694a4ab86..a5f8a62aac9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.scss
@@ -4,7 +4,3 @@ cd-details-card {
   display: block;
   margin-bottom: layout.$spacing-05;
 }
-
-.table-actions {
-  margin-top: layout.$spacing-03;
-}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
index 04c3bf4fbe7..0c436fa10d6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.ts
@@ -26,7 +26,6 @@ import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { DeleteConfirmationModalComponent } from '~/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component';
-import { DetailItem } from '~/app/shared/components/details-card/details-card.component';
 import { FinishedTask } from '~/app/shared/models/finished-task';
 import { DeletionImpact } from '~/app/shared/enum/delete-confirmation-modal-impact.enum';
 import { NotificationService } from '~/app/shared/services/notification.service';
@@ -74,11 +73,11 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
   gatewayGroupName = '';
   subsystemCount = 0;
   gatewayCount = 0;
-  selectedGatewayDetails: DetailItem[] = [];
   private lastGroupCount = 0;
 
   viewUrl = `/${BASE_URL}/view`;
   icons = Icons;
+
   iconSize = IconSize;
 
   constructor(
@@ -191,8 +190,7 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
           }),
           catchError(() => {
             return of([]);
-          }),
-          finalize(() => this.setTableLoading(false))
+          })
         )
       ),
       shareReplay({ bufferSize: 1, refCount: true }),
@@ -210,20 +208,12 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
       .subscribe(() => this.fetchData());
   }
   fetchData(): void {
-    this.setTableLoading(true);
     this.subject.next([]);
     this.checkNodesAvailability();
   }
 
-  private setTableLoading(loading: boolean): void {
-    if (this.table) {
-      this.table.loadingIndicator = loading;
-    }
-  }
-
   updateSelection(selection: CdTableSelection): void {
     this.selection = selection;
-    this.selectedGatewayDetails = this.buildGatewayDetails(selection.first());
   }
 
   deleteGatewayGroupModal() {
@@ -350,78 +340,8 @@ export class NvmeofGatewayGroupComponent implements OnInit, OnDestroy {
     this.router.navigate([this.urlBuilder.getEdit(selectedGroup.name)]);
   }
 
-  private buildGatewayDetails(selectedGroup: any): DetailItem[] {
-    if (!selectedGroup) {
-      return [];
-    }
-
-    const runningGateways = selectedGroup.statusCount?.running ?? 0;
-    const errorGateways = selectedGroup.statusCount?.error ?? 0;
-    const totalGateways = runningGateways + errorGateways;
-
-    return [
-      {
-        label: $localize`Gateway name`,
-        value: selectedGroup.name
-      },
-      {
-        label: $localize`Gateway nodes`,
-        value: totalGateways
-      },
-      {
-        label: $localize`Encryption`,
-        value: selectedGroup.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
-        type: 'status'
-      },
-      {
-        label: $localize`mTLS`,
-        value: selectedGroup.spec?.enable_mtls ? $localize`Enabled` : $localize`Disabled`,
-        type: 'status'
-      }
-    ];
-  }
-
   ngOnDestroy(): void {
     this.destroy$.next();
     this.destroy$.complete();
   }
-
-  editSelectedGatewayGroup(): void {
-    const selectedGroup = this.selection.first();
-    if (!selectedGroup) {
-      return;
-    }
-    this.router.navigate([this.urlBuilder.getEdit(selectedGroup.name)]);
-  }
-
-  private buildGatewayDetails(selectedGroup: any): DetailItem[] {
-    if (!selectedGroup) {
-      return [];
-    }
-
-    const runningGateways = selectedGroup.statusCount?.running ?? 0;
-    const errorGateways = selectedGroup.statusCount?.error ?? 0;
-    const totalGateways = runningGateways + errorGateways;
-
-    return [
-      {
-        label: $localize`Gateway name`,
-        value: selectedGroup.name
-      },
-      {
-        label: $localize`Gateway nodes`,
-        value: totalGateways
-      },
-      {
-        label: $localize`Encryption`,
-        value: selectedGroup.spec?.enable_auth ? $localize`Enabled` : $localize`Disabled`,
-        type: 'status'
-      },
-      {
-        label: $localize`mTLS`,
-        value: selectedGroup.spec?.enable_mtls ? $localize`Enabled` : $localize`Disabled`,
-        type: 'status'
-      }
-    ];
-  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
index b8025d08f06..0a97671fa3b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
@@ -1,7 +1,7 @@
 <div class="content-theme">
   @if (mode === 'details' && groupName) {
-  <cd-details-card cardTitle="Details" i18n-cardTitle [details]="gatewayDetails" [showEditButton]="true"
-    editButtonLabel="Edit" i18n-editButtonLabel (editClicked)="onEditGateway()" class="cds-mb-5">
+  <cd-details-card cardTitle="Details" i18n-cardTitle [details]="gatewayDetails" [showEditButton]="false"
+    class="cds-mb-5">
   </cd-details-card>
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
index fecbbe14a47..89fe4865356 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.ts
@@ -439,8 +439,6 @@ export class NvmeofGatewayNodeComponent implements OnInit, OnDestroy, OnChanges
     this.hostsLoaded.emit(this.count);
   }
 
-  onEditGateway(): void {}
-
   private buildGatewayDetails(
     serviceSpec: CephServiceSpec,
     gatewayNodeCount: number
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 94cf5fc5b58..70dfb6453fb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -48,59 +48,28 @@
             i18n>Special characters are not allowed.</span>
         </div>
       </div>
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-checkbox id="enableCds"
-                        formControlName="enable_auth"
-                        i18n>Enable encryption
-          </cds-checkbox>
-        </div>
-      </div>
 
-      @if (groupForm.controls.enableEncryption.value) {
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-textarea-label
-            labelInputID="encryptionConfig"
-            helperText="Provide the encryption configuration details."
-            cdRequiredField="Encryption configuration"
-            i18n
-            i18n-helperText
-            [invalid]="encryptionConfigRef.isInvalid">Encryption configuration
-            <textarea cdsTextArea
-                      id="encryptionConfig"
-                      cdValidate
-                      #encryptionConfigRef="cdValidate"
-                      [invalid]="encryptionConfigRef.isInvalid"
-                      formControlName="encryptionKey"
-                      cols="100"
-                      rows="4"></textarea>
-          </cds-textarea-label>
-          <span
-            class="invalid-feedback"
-            *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
-            i18n>This field is required.</span>
-        </div>
+      <!-- Target Nodes Selection -->
+      <div
+        cdsRow
+        class="form-item"
+      >
+      <div cdsCol>
+        <h1 class="cds--type-heading-02">Select target nodes</h1>
+      <cd-help-text>
+        <span i18n>
+          Gateway nodes to run NVMe-oF target pods/services
+        </span>
+      </cd-help-text>
+      </div>
+      <div
+        cdsCol
+        class="cds-pt-3 cds-pb-3"
+      >
+        <cd-nvmeof-gateway-node
+          (hostsLoaded)="onHostsLoaded($event)"
+        ></cd-nvmeof-gateway-node>
       </div>
-      }
-
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <h1 class="cds--type-heading-02">Select target nodes</h1>
-          <cd-help-text>
-            <span i18n>
-              Gateway nodes to run NVMe-oF target pods/services
-            </span>
-          </cd-help-text>
-        </div>
-        <div cdsCol
-             class="cds-pt-3 cds-pb-3">
-          <cd-nvmeof-gateway-node
-            (hostsLoaded)="onHostsLoaded($event)"></cd-nvmeof-gateway-node>
-        </div>
       </div>
       <div cdsRow class="form-item cds-mb-0">
         <div cdsCol>
@@ -151,7 +120,8 @@
                     id="encryptionKey"
                     formControlName="encryptionKey"
                     rows="4"
-                    cols="100">
+                    cols="100"
+                    cdsTheme="g10">
                   </textarea>
                 </cds-textarea-label>
                 <span
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
index 5b77ae89ceb..6a86280d935 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.spec.ts
@@ -16,6 +16,7 @@ import { NvmeofGroupFormComponent } from './nvmeof-group-form.component';
 import { CheckboxModule, GridModule, InputModule, SelectModule } from 'carbon-components-angular';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
+import { NvmeofService } from '~/app/shared/api/nvmeof.service';
 import { FormHelper } from '~/testing/unit-test-helper';
 
 describe('NvmeofGroupFormComponent', () => {
@@ -25,6 +26,7 @@ describe('NvmeofGroupFormComponent', () => {
   let formHelper: FormHelper;
   let taskWrapperService: TaskWrapperService;
   let cephServiceService: CephServiceService;
+  let nvmeofService: NvmeofService;
   let router: Router;
 
   beforeEach(async () => {
@@ -51,8 +53,12 @@ describe('NvmeofGroupFormComponent', () => {
     component = fixture.componentInstance;
     taskWrapperService = TestBed.inject(TaskWrapperService);
     cephServiceService = TestBed.inject(CephServiceService);
+    nvmeofService = TestBed.inject(NvmeofService);
     router = TestBed.inject(Router);
 
+    // Mock NvmeofService.exists so the async unique validator resolves immediately
+    spyOn(nvmeofService, 'exists').and.returnValue(of(false));
+
     component.ngOnInit();
     form = component.groupForm;
     formHelper = new FormHelper(form);
@@ -126,7 +132,7 @@ describe('NvmeofGroupFormComponent', () => {
 
       expect(cephServiceService.create).toHaveBeenCalledWith({
         service_type: 'nvmeof',
-        service_id: 'default',
+        service_id: 'nvmeof.default',
         group: 'default',
         placement: {
           hosts: ['host1', 'host2']
@@ -153,7 +159,7 @@ describe('NvmeofGroupFormComponent', () => {
       );
     });
 
-    it('should create service with encryption when enabled', () => {
+    it('should create service with encryption key when enabled', () => {
       component.gatewayNodeComponent = {
         getSelectedHosts: (): any[] => [{ hostname: 'host1' }],
         getSelectedHostnames: (): string[] => ['host1']
@@ -179,7 +185,6 @@ describe('NvmeofGroupFormComponent', () => {
       } as any;
 
       component.groupForm.get('groupName').setValue('mtls-internal');
-      component.groupForm.get('pool').setValue('rbd');
       component.groupForm.get('enableEncryption').setValue(true);
       component.groupForm.get('encryptionKey').setValue('test-encryption-key');
       component.groupForm.get('enableMtls').setValue(true);
@@ -191,7 +196,7 @@ describe('NvmeofGroupFormComponent', () => {
       expect(cephServiceService.create).toHaveBeenCalledWith(
         jasmine.objectContaining({
           service_type: 'nvmeof',
-          service_id: 'rbd.mtls-internal',
+          service_id: 'nvmeof.mtls-internal',
           ssl: true,
           enable_auth: true,
           certificate_source: 'cephadm-signed',
@@ -207,7 +212,6 @@ describe('NvmeofGroupFormComponent', () => {
       } as any;
 
       component.groupForm.get('groupName').setValue('mtls-external');
-      component.groupForm.get('pool').setValue('rbd');
       component.groupForm.get('enableEncryption').setValue(true);
       component.groupForm.get('encryptionKey').setValue('test-encryption-key');
       component.groupForm.get('enableMtls').setValue(true);
@@ -222,7 +226,7 @@ describe('NvmeofGroupFormComponent', () => {
 
       expect(cephServiceService.create).toHaveBeenCalledWith(
         jasmine.objectContaining({
-          service_id: 'rbd.mtls-external',
+          service_id: 'nvmeof.mtls-external',
           ssl: true,
           enable_auth: true,
           certificate_source: 'inline',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
index 7053bbbe9f9..dd54c824f19 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.ts
@@ -1,5 +1,6 @@
 import { Component, OnInit, ViewChild } from '@angular/core';
 import { UntypedFormControl, Validators } from '@angular/forms';
+import { ActivatedRoute, Router } from '@angular/router';
 import { ActionLabelsI18n, URLVerbs } from '~/app/shared/constants/app.constants';
 import { CdForm } from '~/app/shared/forms/cd-form';
 import { CdFormGroup } from '~/app/shared/forms/cd-form-group';
@@ -10,10 +11,8 @@ import { NvmeofGatewayNodeComponent } from '../nvmeof-gateway-node/nvmeof-gatewa
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { CephServiceService } from '~/app/shared/api/ceph-service.service';
 import { FinishedTask } from '~/app/shared/models/finished-task';
-import { Router } from '@angular/router';
 import { CdValidators } from '~/app/shared/forms/cd-validators';
 import { NvmeofService } from '~/app/shared/api/nvmeof.service';
-import { Pool } from '../../pool/pool';
 import { CertificateType } from '~/app/shared/models/service.interface';
 
 @Component({
@@ -32,9 +31,10 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   resource: string;
   group = '';
   pageURL = '';
-  pools: Pool[] = [];
-  poolsLoading = false;
   hasAvailableNodes = true;
+  editing = false;
+  gatewayGroupName = '';
+  existingServiceData: any = null;
 
   constructor(
     private authStorageService: AuthStorageService,
@@ -42,7 +42,8 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     private taskWrapperService: TaskWrapperService,
     private cephServiceService: CephServiceService,
     private nvmeofService: NvmeofService,
-    private router: Router
+    private router: Router,
+    private route: ActivatedRoute
   ) {
     super();
     this.permission = this.authStorageService.getPermissions().nvmeof;
@@ -50,30 +51,42 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
   }
 
   ngOnInit() {
-    this.action = this.actionLabels.CREATE;
     this.createForm();
+
+    this.route.params.subscribe((params) => {
+      if (params['name']) {
+        this.editing = true;
+        this.gatewayGroupName = params['name'];
+        this.action = this.actionLabels.EDIT;
+        this.loadGatewayGroupData(params['name']);
+      } else {
+        this.editing = false;
+        this.action = this.actionLabels.CREATE;
+      }
+    });
   }
 
   createForm() {
+    const groupNameValidators = [
+      Validators.required,
+      (control: any) => {
+        const value = control.value;
+        return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
+      }
+    ];
+
+    const groupNameAsyncValidators = this.editing
+      ? []
+      : [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)];
+
     this.groupForm = new CdFormGroup({
-      groupName: new UntypedFormControl(
-        null,
-        [
-          Validators.required,
-          (control) => {
-            const value = control.value;
-            return value && /[^a-zA-Z0-9_-]/.test(value) ? { invalidChars: true } : null;
-          }
-        ],
-        [CdValidators.unique(this.nvmeofService.exists, this.nvmeofService)]
-      ),
+      groupName: new UntypedFormControl(null, groupNameValidators, groupNameAsyncValidators),
       unmanaged: new UntypedFormControl(false),
       enableEncryption: new UntypedFormControl(false),
       encryptionConfig: new UntypedFormControl(null),
       encryptionKey: new UntypedFormControl(null),
       enableMtls: new UntypedFormControl(false),
       certificateType: new UntypedFormControl(CertificateType.internal),
-      pool: new UntypedFormControl('rbd'),
       custom_sans: new UntypedFormControl([]),
       rootCACert: new UntypedFormControl(null),
       clientCert: new UntypedFormControl(null),
@@ -83,7 +96,6 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     });
 
     this.groupForm.get('enableEncryption')?.valueChanges.subscribe((enabled) => {
-      // Keep both legacy and new encryption fields in sync.
       if (!enabled) {
         return;
       }
@@ -96,6 +108,50 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
         encryptionConfigControl.setValue(encryptionKeyControl.value, { emitEvent: false });
       }
     });
+
+    if (this.editing) {
+      this.groupForm.get('groupName')?.disable();
+    }
+  }
+
+  loadGatewayGroupData(groupName: string) {
+    this.nvmeofService.listGatewayGroups().subscribe(
+      (gatewayGroups: any) => {
+        const groups = gatewayGroups?.[0] ?? [];
+        const group = groups.find((g: any) => g.spec?.group === groupName);
+
+        if (group) {
+          this.existingServiceData = group;
+          const spec = group.spec || {};
+
+          this.groupForm.patchValue({
+            groupName: groupName,
+            unmanaged: spec.unmanaged || false,
+            enableEncryption: spec.ssl || false,
+            enableMtls: spec.ssl || false,
+            certificateType:
+              spec.certificate_source === 'inline'
+                ? CertificateType.external
+                : CertificateType.internal,
+            encryptionKey: spec.encryption_key || '',
+            custom_sans: spec.custom_sans || []
+          });
+
+          if (spec.certificate_source === 'inline') {
+            this.groupForm.patchValue({
+              rootCACert: spec.root_ca_cert || null,
+              clientCert: spec.client_cert || null,
+              clientKey: spec.client_key || null,
+              serverCert: spec.server_cert || null,
+              serverKey: spec.server_key || null
+            });
+          }
+        }
+      },
+      (_error) => {
+        // Error loading gateway group data
+      }
+    );
   }
 
   onHostsLoaded(count: number): void {
@@ -139,19 +195,21 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       return;
     }
 
-    const formValues = this.groupForm.value;
+    const formValues = this.groupForm.getRawValue();
     const selectedHostnames = this.gatewayNodeComponent?.getSelectedHostnames() || [];
     if (selectedHostnames.length === 0) {
       this.groupForm.setErrors({ cdSubmitButton: true });
       return;
     }
-    const taskUrl = `service/${URLVerbs.CREATE}`;
-    const serviceId = `${formValues.groupName}`;
+
+    const groupName = this.editing ? this.gatewayGroupName : formValues.groupName;
+    const serviceName = `nvmeof.${groupName}`;
+    const taskUrl = this.editing ? `service/${URLVerbs.EDIT}` : `service/${URLVerbs.CREATE}`;
 
     const serviceSpec: Record<string, any> = {
       service_type: 'nvmeof',
-      service_id: serviceId,
-      group: formValues.groupName,
+      service_id: serviceName,
+      group: groupName,
       placement: {
         hosts: selectedHostnames
       },
@@ -171,11 +229,6 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       serviceSpec['certificate_source'] =
         formValues.certificateType === CertificateType.internal ? 'cephadm-signed' : 'inline';
 
-      if (formValues.pool) {
-        serviceSpec['pool'] = formValues.pool;
-        serviceSpec['service_id'] = `${formValues.pool}.${formValues.groupName}`;
-      }
-
       if (
         formValues.certificateType === CertificateType.internal &&
         formValues.custom_sans?.length > 0
@@ -192,12 +245,16 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
       }
     }
 
+    const apiCall = this.editing
+      ? this.cephServiceService.update(serviceSpec)
+      : this.cephServiceService.create(serviceSpec);
+
     this.taskWrapperService
       .wrapTaskAroundCall({
         task: new FinishedTask(taskUrl, {
-          service_name: `nvmeof.${serviceId}`
+          service_name: serviceName
         }),
-        call: this.cephServiceService.create(serviceSpec)
+        call: apiCall
       })
       .subscribe({
         complete: () => {
@@ -213,10 +270,6 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     this.router.navigateByUrl('/block/nvmeof/gateways');
   }
 
-  onCertificateTypeChange(type: CertificateType): void {
-    this.groupForm.get('certificateType')?.setValue(type);
-  }
-
   onFileUpload(event: Event, controlName: string): void {
     const target = event.target as HTMLInputElement;
     const file = target?.files?.[0];
@@ -229,4 +282,21 @@ export class NvmeofGroupFormComponent extends CdForm implements OnInit {
     reader.onload = () => control.setValue(reader.result);
     reader.readAsText(file, 'utf8');
   }
+
+  onCertificateTypeChange(type: CertificateType): void {
+    this.groupForm.get('certificateType')?.setValue(type);
+    if (type === CertificateType.internal) {
+      this.groupForm.patchValue({
+        rootCACert: null,
+        clientCert: null,
+        clientKey: null,
+        serverCert: null,
+        serverKey: null
+      });
+    } else {
+      this.groupForm.patchValue({
+        custom_sans: []
+      });
+    }
+  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
index e49ba58057f..48021924dd8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.spec.ts
@@ -194,4 +194,19 @@ describe('NvmeofNamespacesListComponent', () => {
 
     component.fetchData();
   });
+
+  it('should update group and trigger namespace fetch on group change', () => {
+    const fetchDataSpy = jest.spyOn(component, 'fetchData');
+
+    component.onGroupChange('g1');
+
+    expect(component.group).toBe('g1');
+    expect(fetchDataSpy).not.toHaveBeenCalled(); // onGroupChange calls namespaceSubject.next() directly
+  });
+
+  it('should clear group on onGroupChange with null', () => {
+    component.group = 'g1';
+    component.onGroupChange(null);
+    expect(component.group).toBeNull();
+  });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
index 71b05f17cde..427dd606894 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.ts
@@ -223,6 +223,18 @@ export class NvmeofNamespacesListComponent implements OnInit, OnDestroy {
     });
   }
 
+  get group(): string | null {
+    return this.groupHandler.group;
+  }
+
+  set group(value: string | null) {
+    this.groupHandler.group = value;
+  }
+
+  onGroupChange(group: string | null): void {
+    this.groupHandler.onGroupChange(group);
+  }
+
   updateSelection(selection: CdTableSelection) {
     this.selection = selection;
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index 26b6a0b2721..1e213685305 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -1153,7 +1153,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         } else {
           this.showRealmCreationForm = false;
         }
-         this.updateRgwControlStates();
+        this.updateRgwControlStates();
       },
       (_error) => {
         const defaultZone = new RgwZone();
@@ -1162,7 +1162,7 @@ export class ServiceFormComponent extends CdForm implements OnInit {
         defaultZonegroup.name = 'default';
         this.zoneList.push(defaultZone);
         this.zonegroupList.push(defaultZonegroup);
-         this.updateRgwControlStates();
+        this.updateRgwControlStates();
       }
     );
   }
@@ -1226,7 +1226,9 @@ export class ServiceFormComponent extends CdForm implements OnInit {
     this.toggleFormControlState('zone_name', this.editing || this.zoneList.length === 0);
   }
 
-  private updateGrafanaPasswordControlState(serviceType = this.serviceForm?.get('service_type')?.value): void {
+  private updateGrafanaPasswordControlState(
+    serviceType = this.serviceForm?.get('service_type')?.value
+  ): void {
     this.toggleFormControlState(
       'grafana_admin_password',
       this.editing && serviceType === 'grafana'
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index 3d558fb8c56..b0d356e099b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -2,47 +2,34 @@
   <ng-template #header>
     @if (cardTitle) {
     <h3 class="cds--type-heading-03" i18n>{{ cardTitle }}</h3>
-    @if (showEditButton) {
-    <button
-      cdsButton="ghost"
-      size="sm"
-      [disabled]="editButtonDisabled"
-      (click)="onEditClick()"
-      [attr.aria-label]="editButtonLabel"
-    >
-      {{ editButtonLabel }}
-      <cd-icon class="cds-ml-5" type="edit"></cd-icon>
-    </button>
-    }
     }
   </ng-template>
 
-  <div>
+  <div [cdsStack]="'vertical'"
+       [gap]="0">
     @if (details && details.length > 0) {
-    <div class="cds--grid cds--no-gutter">
-      <div class="cds--row">
-        @for (detail of getVisibleDetails(); track detail.label) {
-        <div class="cds--col">
-          <div [cdsStack]="'vertical'" [gap]="2">
-            <label class="cds--type-label-01">{{ detail.label }}</label>
-            <div class="cds--type-body-01">
-              @switch (detail.type) {
-                @case ('status') {
-                  <div [cdsStack]="'horizontal'" [gap]="3">
-                    <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
-                    <span>{{ getDisplayValue(detail.value) }}</span>
-                  </div>
-                }
-                
-                @default {
-                  <span>{{ getDisplayValue(detail.value) }}</span>
-                }
-              }
-            </div>
-          </div>
+    <div [cdsStack]="'horizontal'"
+         [gap]="5">
+      @for (detail of getVisibleDetails(); track detail.label) {
+      <div [cdsStack]="'vertical'"
+           [gap]="2">
+        <label class="cds--type-label-01">{{ detail.label }}</label>
+        <div class="cds--type-body-01">
+          @switch (detail.type) {
+            @case ('status') {
+              <div [cdsStack]="'horizontal'" [gap]="3">
+                <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
+                <span>{{ getDisplayValue(detail.value) }}</span>
+              </div>
+            }
+
+            @default {
+              <span>{{ getDisplayValue(detail.value) }}</span>
+            }
+          }
         </div>
-        }
       </div>
+      }
     </div>
     }
     <ng-content></ng-content>

From 045ec191a8916e6a8a2155a692c58f04b4ef301b Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Mon, 15 Jun 2026 13:57:44 +0530
Subject: [PATCH 553/596] mgr/dashboard: fix version string overlap, incomplete
 version on upgrades page

Fixes: https://tracker.ceph.com/issues/77400

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 .../src/app/ceph/cluster/upgrade/upgrade.component.scss   | 1 +
 .../src/app/ceph/cluster/upgrade/upgrade.component.ts     | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.scss
index f2e90ffffd2..fa8fdf0296f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.scss
@@ -13,4 +13,5 @@
   display: flex;
   flex-direction: column;
   gap: var(--cds-spacing-02);
+  overflow-wrap: break-word;
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.ts
index e1806dfc35c..2abdd0906e1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.ts
@@ -74,8 +74,12 @@ export class UpgradeComponent implements OnInit, OnDestroy {
 
     this.subs.add(
       this.summaryService.subscribe((summary) => {
-        const version = summary.version.replace(VERSION_PREFIX, '').split('-');
-        this.version = version[0];
+        const versionString = summary.version.replace(VERSION_PREFIX, '').trim();
+        // Match legacy Ceph versions that include a build suffix
+        // (e.g. 13.1.0-419-g251e2515b5) and extract only the semantic version.
+        // Newer version formats without this suffix are left unchanged.
+        const match = versionString.match(/^(\d+\.\d+\.\d+)-\d+-g[0-9a-f]+/i);
+        this.version = match ? match[1] : versionString;
         this.executingTasks = summary.executing_tasks.filter((tasks) =>
           tasks.name.includes('progress/Upgrade')
         )[0];

From 3ceee3ad3ffcbac4ded9da2060633d7bec0ea39a Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Tue, 7 Jul 2026 12:37:53 +0200
Subject: [PATCH 554/596] mgr/cephadm: pass RGW zonegroup hostnames as custom
 SANs

Fix RGW certificate generation so `zonegroup_hostnames` and wildcard
SANs are passed to `get_certificates()` using the correct keyword
argument. Previously, RGW built the expected SAN list from
`zonegroup_hostnames` and `wildcard_enabled`, but passed it
positionally so it was interpreted as ips list.

Also add a unit test to cover the RGW `zonegroup_hostnames` +
`wildcard_enabled` path and ensure SANs are passed as `custom_sans`.

Fixed other calls to enforce the usage of keywords for arguments just
to avoid similar issues in the future.

Fixes: https://tracker.ceph.com/issues/77980
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 .../mgr/cephadm/services/cephadmservice.py    |  2 +-
 .../mgr/cephadm/services/mgmt_gateway.py      |  2 +-
 src/pybind/mgr/cephadm/services/monitoring.py |  6 ++--
 .../mgr/cephadm/tests/services/test_rgw.py    | 36 +++++++++++++++++++
 4 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/cephadmservice.py b/src/pybind/mgr/cephadm/services/cephadmservice.py
index cdc254c8678..f1b3a56da7a 100644
--- a/src/pybind/mgr/cephadm/services/cephadmservice.py
+++ b/src/pybind/mgr/cephadm/services/cephadmservice.py
@@ -1568,7 +1568,7 @@ class RgwService(CephService):
         if spec.ssl:
             san_list = spec.zonegroup_hostnames or []
             custom_sans = san_list + [f"*.{h}" for h in san_list] if spec.wildcard_enabled else san_list
-            tls_creds = self.get_certificates(daemon_spec, custom_sans)
+            tls_creds = self.get_certificates(daemon_spec, custom_sans=custom_sans)
             pem = f'{tls_creds.key.rstrip()}\n{tls_creds.cert.lstrip()}'
             rgw_cert_name = daemon_spec.name() if spec.generate_cert else spec.service_name()
             ret, out, err = self.mgr.check_mon_command({
diff --git a/src/pybind/mgr/cephadm/services/mgmt_gateway.py b/src/pybind/mgr/cephadm/services/mgmt_gateway.py
index 801a76b281e..8dfa7730041 100644
--- a/src/pybind/mgr/cephadm/services/mgmt_gateway.py
+++ b/src/pybind/mgr/cephadm/services/mgmt_gateway.py
@@ -143,7 +143,7 @@ class MgmtGatewayService(CephadmService):
 
         if svc_spec.ssl:
             ip = self.get_mgmt_gw_ip(svc_spec, daemon_spec)
-            tls_pair = self.get_certificates(daemon_spec, [ip])
+            tls_pair = self.get_certificates(daemon_spec, ips=[ip])
             daemon_config["files"]["nginx.crt"] = tls_pair.cert
             daemon_config["files"]["nginx.key"] = tls_pair.key
 
diff --git a/src/pybind/mgr/cephadm/services/monitoring.py b/src/pybind/mgr/cephadm/services/monitoring.py
index 6d0008f0ef6..f80cab0bd70 100644
--- a/src/pybind/mgr/cephadm/services/monitoring.py
+++ b/src/pybind/mgr/cephadm/services/monitoring.py
@@ -159,7 +159,7 @@ class GrafanaService(CephadmService):
     def get_grafana_certificates(self, daemon_spec: CephadmDaemonDeploySpec) -> TLSCredentials:
         host_ips = [self.mgr.inventory.get_addr(daemon_spec.host)]
         host_fqdns = [self.mgr.get_fqdn(daemon_spec.host), 'grafana_servers']
-        return self.get_certificates(daemon_spec, host_ips, host_fqdns)
+        return self.get_certificates(daemon_spec, ips=host_ips, fqdns=host_fqdns)
 
     def generate_config(self, daemon_spec: CephadmDaemonDeploySpec) -> Tuple[Dict[str, Any], List[str]]:
         assert self.TYPE == daemon_spec.daemon_type
@@ -301,7 +301,7 @@ class AlertmanagerService(CephadmService):
     def get_alertmanager_certificates(self, daemon_spec: CephadmDaemonDeploySpec) -> TLSCredentials:
         host_ips = [self.mgr.inventory.get_addr(daemon_spec.host)]
         host_fqdns = [self.mgr.get_fqdn(daemon_spec.host), 'alertmanager_servers']
-        return self.get_certificates(daemon_spec, host_ips, host_fqdns)
+        return self.get_certificates(daemon_spec, ips=host_ips, fqdns=host_fqdns)
 
     @classmethod
     def get_dependencies(cls, mgr: "CephadmOrchestrator",
@@ -524,7 +524,7 @@ class PrometheusService(CephadmService):
     def get_prometheus_certificates(self, daemon_spec: CephadmDaemonDeploySpec) -> TLSCredentials:
         host_ips = [self.mgr.inventory.get_addr(daemon_spec.host)]
         host_fqdns = [self.mgr.get_fqdn(daemon_spec.host), 'prometheus_servers']
-        return self.get_certificates(daemon_spec, host_ips, host_fqdns)
+        return self.get_certificates(daemon_spec, ips=host_ips, fqdns=host_fqdns)
 
     def get_service_discovery_cfg(self, security_enabled: bool, mgmt_gw_enabled: bool) -> Dict[str, List[str]]:
         """
diff --git a/src/pybind/mgr/cephadm/tests/services/test_rgw.py b/src/pybind/mgr/cephadm/tests/services/test_rgw.py
index ecf9510885b..cec0197d64d 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_rgw.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_rgw.py
@@ -496,3 +496,39 @@ class TestRGWService:
             # Inline certs must still be present — the service is still running on host2
             assert cm.get_cert(rgw_svc.cert_name, service_name=svc_name) is not None
             assert cm.get_key(rgw_svc.key_name, service_name=svc_name) is not None
+
+    @patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm('{}'))
+    def test_rgw_zonegroup_hostnames_are_passed_as_custom_sans(
+            self, cephadm_module: CephadmOrchestrator):
+        """RGW zonegroup hostnames must be passed as custom DNS SANs.
+
+        Verifies that zonegroup hostnames are routed to get_certificates() as
+        the custom_sans keyword argument, so that values like s3.example.com
+        and *.s3.example.com are registered as DNS SANs on the generated
+        certificate.
+        """
+        with with_host(cephadm_module, 'host1'):
+            s = RGWSpec(
+                service_id='foo',
+                ssl=True,
+                zonegroup_hostnames=['s3.example.com'],
+                wildcard_enabled=True,
+                rgw_frontend_type='beast',
+            )
+            rgw_svc = service_registry.get_service('rgw')
+            tls_creds = TLSCredentials(
+                cert=ceph_generated_cert,
+                key=ceph_generated_key,
+            )
+            with patch.object(rgw_svc, 'get_certificates',
+                              return_value=tls_creds) as get_certificates:
+                with with_service(cephadm_module, s):
+                    # The serve loop may invoke get_certificates more than once;
+                    # assert on the arguments of every call, not the count.
+                    get_certificates.assert_called()
+                    for args, kwargs in get_certificates.call_args_list:
+                        # custom_sans must be a kwarg, never the positional ips arg
+                        assert len(args) == 1
+                        assert kwargs == {
+                            'custom_sans': ['s3.example.com', '*.s3.example.com'],
+                        }

From 9899e7bfebd57fd74946a49e23f41080b66a06a8 Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Tue, 23 Jun 2026 10:31:55 +0000
Subject: [PATCH 555/596] crimson/os/seastore/onode: measure onode-tree lookup
 cost

Before optimizing the onode lookup paths we should measure the existing
cost if each possible optimization.

The per-node search is already binary search(see search_result_bs_t
binary_search). Possible costs are:
- per-level node traversal
- STAGE_STRING ns/oid memcmp (rbd has long shared oid prefixes)

Adding the following stats to be exposed as seastar-metrics (not logs).

Keep the new sampling per-comparison overhead out unless needed for
measurment runs.

Candidate optimization leads from the numbers:
* cross-node string/prefix dedup (marked as TODOs in stage.h) this could
  result in cheaper compares for shared (rbd) prefixes.
* shrink onode_layout_t - marked as onode.h TODO.
  stop inlining oi and ss to get more objects per leaf.

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/CMakeLists.txt                    |  6 +++
 .../onode_manager/staged-fltree/node.cc       | 22 +++++++++
 .../staged-fltree/stages/key_layout.h         | 10 ++++
 src/crimson/os/seastore/seastore.cc           | 49 +++++++++++++++++++
 src/crimson/os/seastore/seastore.h            | 17 +++++++
 src/crimson/os/seastore/transaction.h         |  8 ++-
 6 files changed, 111 insertions(+), 1 deletion(-)

diff --git a/src/crimson/CMakeLists.txt b/src/crimson/CMakeLists.txt
index ff5c366f036..2a97044226b 100644
--- a/src/crimson/CMakeLists.txt
+++ b/src/crimson/CMakeLists.txt
@@ -1,6 +1,12 @@
 add_library(crimson::cflags INTERFACE IMPORTED)
 set(crimson_cflag_definitions "WITH_CRIMSON=1")
 
+option(WITH_CRIMSON_DETAILED_SAMPLING
+  "Enable detailed onode-tree sampling metrics in crimson-seastore" OFF)
+if(WITH_CRIMSON_DETAILED_SAMPLING)
+  list(APPEND crimson_cflag_definitions "CRIMSON_DETAILED_SAMPLING=1")
+endif()
+
 set_target_properties(crimson::cflags PROPERTIES
   INTERFACE_COMPILE_DEFINITIONS "${crimson_cflag_definitions}"
   INTERFACE_LINK_LIBRARIES Seastar::seastar)
diff --git a/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc b/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc
index 9d78d87a8cd..0a4f890bb2b 100644
--- a/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc
+++ b/src/crimson/os/seastore/onode_manager/staged-fltree/node.cc
@@ -319,6 +319,9 @@ level_t Node::level() const
 eagain_ifuture<Node::search_result_t> Node::lower_bound(
     context_t c, const key_hobj_t& key)
 {
+#ifdef CRIMSON_DETAILED_SAMPLING
+  ++c.t.get_onode_tree_stats().lookup_count;
+#endif
   return seastar::do_with(
     MatchHistory(), [this, c, &key](auto& history) {
       return lower_bound_tracked(c, key, history);
@@ -332,6 +335,9 @@ eagain_ifuture<std::pair<Ref<tree_cursor_t>, bool>> Node::insert(
     value_config_t vconf,
     Ref<Node>&& this_ref)
 {
+#ifdef CRIMSON_DETAILED_SAMPLING
+  ++c.t.get_onode_tree_stats().lookup_count;
+#endif
   return seastar::do_with(
     MatchHistory(), [this, c, &key, vconf,
                      this_ref = std::move(this_ref)] (auto& history) mutable {
@@ -1265,7 +1271,15 @@ eagain_ifuture<Node::search_result_t>
 InternalNode::lower_bound_tracked(
     context_t c, const key_hobj_t& key, MatchHistory& history)
 {
+#ifdef CRIMSON_DETAILED_SAMPLING
+  auto& tstats = c.t.get_onode_tree_stats();
+  ++tstats.nodes_visited;
+  auto cmp0 = key.ncmp_str;
   auto result = impl->lower_bound(key, history);
+  tstats.string_cmp_count += key.ncmp_str - cmp0;
+#else
+  auto result = impl->lower_bound(key, history);
+#endif
   return get_or_track_child(c, result.position, result.p_value->value
   ).si_then([c, &key, &history](auto child) {
     // XXX(multi-type): pass result.mstat to child
@@ -1954,7 +1968,15 @@ LeafNode::lower_bound_tracked(
     context_t c, const key_hobj_t& key, MatchHistory& history)
 {
   key_view_t index_key;
+#ifdef CRIMSON_DETAILED_SAMPLING
+  auto& tstats = c.t.get_onode_tree_stats();
+  ++tstats.nodes_visited;
+  auto cmp0 = key.ncmp_str;
   auto result = impl->lower_bound(key, history, &index_key);
+  tstats.string_cmp_count += key.ncmp_str - cmp0;
+#else
+  auto result = impl->lower_bound(key, history, &index_key);
+#endif
   Ref<tree_cursor_t> cursor;
   if (result.position.is_end()) {
     assert(!result.p_value);
diff --git a/src/crimson/os/seastore/onode_manager/staged-fltree/stages/key_layout.h b/src/crimson/os/seastore/onode_manager/staged-fltree/stages/key_layout.h
index ca8659d8c0f..562acc8cc9b 100644
--- a/src/crimson/os/seastore/onode_manager/staged-fltree/stages/key_layout.h
+++ b/src/crimson/os/seastore/onode_manager/staged-fltree/stages/key_layout.h
@@ -406,6 +406,10 @@ bool is_valid_key(const Key& key);
  */
 class key_hobj_t {
  public:
+  // number of ns/oid comparisons this query key participated in during lookup.
+  // Only incremented under CRIMSON_DETAILED_SAMPLING; otherwise stays zero.
+  mutable uint64_t ncmp_str = 0;
+
   explicit key_hobj_t(const ghobject_t& _ghobj) {
     if (_ghobj.is_max()) {
       ghobj = _MAX_OID();
@@ -920,6 +924,12 @@ auto operator<=>(const T& key, const shard_pool_crush_t& target) {
 
 template <IsFullKey T>
 auto operator<=>(const T& key, const ns_oid_view_t& target) {
+#ifdef CRIMSON_DETAILED_SAMPLING
+  // only key_hobj_t carries the counter
+  if constexpr (requires { key.ncmp_str; }) {
+    ++key.ncmp_str;
+  }
+#endif
   auto ret = key.nspace() <=> string_view_masked_t{target.nspace};
   if (ret != 0)
     return ret;
diff --git a/src/crimson/os/seastore/seastore.cc b/src/crimson/os/seastore/seastore.cc
index d8165270476..ea7b8898df0 100644
--- a/src/crimson/os/seastore/seastore.cc
+++ b/src/crimson/os/seastore/seastore.cc
@@ -249,6 +249,54 @@ void SeaStore::Shard::register_metrics(store_index_t store_index)
     );
   }
 
+  metrics.add_group(
+    "onode_tree",
+    {
+      sm::make_counter(
+        "onode_lookups",
+        [this] { return stats.onode_lookups; },
+        sm::description("onode-tree find + insert search"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+      sm::make_counter(
+        "onode_lookup_nodes",
+        [this] { return stats.onode_lookup_nodes; },
+        sm::description("nodes searched across onode-tree"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+      sm::make_counter(
+        "onode_lookup_str_cmp_count",
+        [this] { return stats.onode_str_cmp_count; },
+        sm::description("ns/oid key comparisons during onode-tree ops"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+      sm::make_counter(
+        "onode_inserts",
+        [this] { return stats.onode_inserts; },
+        sm::description("onode-tree key inserts"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+      sm::make_counter(
+        "onode_updates",
+        [this] { return stats.onode_updates; },
+        sm::description("onode-tree value updates"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+      sm::make_counter(
+        "onode_erases",
+        [this] { return stats.onode_erases; },
+        sm::description("onode-tree key erases"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+      sm::make_gauge(
+        "onode_extents_delta",
+        [this] { return stats.onode_extents_delta; },
+        sm::description("net onode-tree extents added(+)/removed(-)"),
+        {sm::label_instance("shard_store_index", std::to_string(store_index))}
+      ),
+    }
+  );
+
   metrics.add_group(
     "seastore",
     {
@@ -1786,6 +1834,7 @@ seastar::future<> SeaStore::Shard::do_transaction_no_callbacks(
   add_latency_sample(
     op_type_t::DO_TRANSACTION,
     std::chrono::steady_clock::now() - ctx.begin_timestamp);
+  add_onode_tree_sample(ctx.transaction->get_onode_tree_stats());
 
   throttler.put();
 
diff --git a/src/crimson/os/seastore/seastore.h b/src/crimson/os/seastore/seastore.h
index 93fb8bbf0a5..34ac5e060c3 100644
--- a/src/crimson/os/seastore/seastore.h
+++ b/src/crimson/os/seastore/seastore.h
@@ -465,8 +465,25 @@ public:
       std::array<seastar::metrics::histogram, LAT_MAX> op_lat;
       seastar::metrics::histogram conflict_replays;
       std::array<seastar::metrics::histogram, STAGE_MAX> stage_lat;
+      uint64_t onode_lookups = 0;      // tree lookups
+      uint64_t onode_lookup_nodes = 0; // nodes searched (~depth/lookup)
+      uint64_t onode_str_cmp_count = 0;// ns/oid memcmp calls
+      uint64_t onode_inserts = 0;
+      uint64_t onode_updates = 0;
+      uint64_t onode_erases = 0;
+      int64_t  onode_extents_delta = 0;
     } stats;
 
+    void add_onode_tree_sample(const Transaction::tree_stats_t& ts) {
+      stats.onode_lookups        += ts.lookup_count;
+      stats.onode_lookup_nodes   += ts.nodes_visited;
+      stats.onode_str_cmp_count  += ts.string_cmp_count;
+      stats.onode_inserts        += ts.num_inserts;
+      stats.onode_updates        += ts.num_updates;
+      stats.onode_erases         += ts.num_erases;
+      stats.onode_extents_delta  += ts.extents_num_delta;
+    }
+
     seastar::metrics::histogram& get_latency(
       op_type_t op_type) {
       assert(static_cast<std::size_t>(op_type) < stats.op_lat.size());
diff --git a/src/crimson/os/seastore/transaction.h b/src/crimson/os/seastore/transaction.h
index 3c2be49db9a..8b32be30ba4 100644
--- a/src/crimson/os/seastore/transaction.h
+++ b/src/crimson/os/seastore/transaction.h
@@ -567,13 +567,19 @@ public:
     uint64_t num_erases = 0;
     uint64_t num_updates = 0;
     int64_t extents_num_delta = 0;
+    uint64_t lookup_count = 0;
+    uint64_t nodes_visited = 0;
+    uint64_t string_cmp_count = 0;
 
     bool is_clear() const {
       return (depth == 0 &&
               num_inserts == 0 &&
               num_erases == 0 &&
               num_updates == 0 &&
-	      extents_num_delta == 0);
+	      extents_num_delta == 0 &&
+              lookup_count == 0 &&
+              nodes_visited == 0 &&
+              string_cmp_count == 0);
     }
   };
   tree_stats_t& get_onode_tree_stats() {

From 1cbf39b594e32535eae505e5c5d8168af58bff42 Mon Sep 17 00:00:00 2001
From: Matan Breizman <mbreizma@redhat.com>
Date: Mon, 8 Jun 2026 15:45:20 +0300
Subject: [PATCH 556/596] crimson/osd: fix CyanStore boot with crimson OSD

- Remove dead cyan_store.h includes from pg.cc and shard_services.cc.
- Fix CyanStore::mkfs to write type="cyanstore" instead of "memstore"
- Handle missing device class in OSD::start: stores that return an empty
  device class (e.g CyanStore) now fall back to is_rotational=false with
  a warning instead of throwing

Signed-off-by: Matan Breizman <mbreizma@redhat.com>
---
 src/crimson/os/cyanstore/cyan_store.cc | 2 +-
 src/crimson/osd/osd.cc                 | 3 ++-
 src/crimson/osd/pg.cc                  | 1 -
 src/crimson/osd/shard_services.cc      | 1 -
 4 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/crimson/os/cyanstore/cyan_store.cc b/src/crimson/os/cyanstore/cyan_store.cc
index cf45dbb556f..7b29afc8c22 100644
--- a/src/crimson/os/cyanstore/cyan_store.cc
+++ b/src/crimson/os/cyanstore/cyan_store.cc
@@ -179,7 +179,7 @@ CyanStore::mkfs_ertr::future<> CyanStore::mkfs(uuid_d new_osd_fsid)
       }
     }
   }).safe_then([this]{
-    return write_meta("type", "memstore");
+    return write_meta("type", "cyanstore");
   }).safe_then([this] {
     return shard_stores.invoke_on_all([](auto &local_store) {
       return seastar::do_for_each(local_store.mshard_stores, [](auto& mshard_store) {
diff --git a/src/crimson/osd/osd.cc b/src/crimson/osd/osd.cc
index 25096a1fb8a..791338db7ac 100644
--- a/src/crimson/osd/osd.cc
+++ b/src/crimson/osd/osd.cc
@@ -600,7 +600,8 @@ seastar::future<> OSD::start()
       local_service.local_state.initialize_scheduler(local_service.get_cct(), *is_rotational);
     });
   } else {
-    throw std::runtime_error("No device class is set");
+    WARN("no device class set, defaulting is_rotational to false");
+    is_rotational = false;
   }
   monc->sub_want("osd_pg_creates", last_pg_create_epoch, 0);
   monc->sub_want("mgrmap", 0, 0);
diff --git a/src/crimson/osd/pg.cc b/src/crimson/osd/pg.cc
index dfd756f9908..fd382088f7f 100644
--- a/src/crimson/osd/pg.cc
+++ b/src/crimson/osd/pg.cc
@@ -35,7 +35,6 @@
 #include "crimson/common/log.h"
 #include "crimson/net/Connection.h"
 #include "crimson/net/Messenger.h"
-#include "crimson/os/cyanstore/cyan_store.h"
 #include "crimson/os/futurized_collection.h"
 #include "crimson/osd/ec_backend.h"
 #include "crimson/osd/ec_recovery_backend.h"
diff --git a/src/crimson/osd/shard_services.cc b/src/crimson/osd/shard_services.cc
index bf108a1c73b..7b1df03eba2 100644
--- a/src/crimson/osd/shard_services.cc
+++ b/src/crimson/osd/shard_services.cc
@@ -20,7 +20,6 @@
 #include "crimson/mon/MonClient.h"
 #include "crimson/net/Messenger.h"
 #include "crimson/net/Connection.h"
-#include "crimson/os/cyanstore/cyan_store.h"
 #include "crimson/osd/osdmap_service.h"
 #include "crimson/osd/osd_operations/pg_advance_map.h"
 #include "crimson/osd/pg.h"

From 75c4e2897f03240d64efca1d6b95abfd8b799dac Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Tue, 7 Jul 2026 11:29:44 +0200
Subject: [PATCH 557/596] qa/suites/rbd/valgrind: pin to centos_9.stream
 instead of rpm_latest

This used to be the case before commit d4b977afdc59 ("qa/distros:
rename centos_latest.yaml to rpm_latest.yaml") and subsequent changes
to enable Rocky 10.  When paired with valgrind, python_api_tests* jobs
fail persistently on Ubuntu and Rocky, see [1].  Switch back until that
is resolved (or for as long as centos_9.stream remains in the mix).

[1] https://tracker.ceph.com/issues/74864

Fixes: https://tracker.ceph.com/issues/77982
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
 qa/suites/rbd/valgrind/centos_9.stream.yaml | 1 +
 qa/suites/rbd/valgrind/rpm_latest.yaml      | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)
 create mode 120000 qa/suites/rbd/valgrind/centos_9.stream.yaml
 delete mode 120000 qa/suites/rbd/valgrind/rpm_latest.yaml

diff --git a/qa/suites/rbd/valgrind/centos_9.stream.yaml b/qa/suites/rbd/valgrind/centos_9.stream.yaml
new file mode 120000
index 00000000000..dc442c24149
--- /dev/null
+++ b/qa/suites/rbd/valgrind/centos_9.stream.yaml
@@ -0,0 +1 @@
+.qa/distros/all/centos_9.stream.yaml
\ No newline at end of file
diff --git a/qa/suites/rbd/valgrind/rpm_latest.yaml b/qa/suites/rbd/valgrind/rpm_latest.yaml
deleted file mode 120000
index 2e6628f8e20..00000000000
--- a/qa/suites/rbd/valgrind/rpm_latest.yaml
+++ /dev/null
@@ -1 +0,0 @@
-.qa/distros/all/rpm_latest.yaml
\ No newline at end of file

From b35999b6435cf4bf10ebdfa0204621836d76bcf0 Mon Sep 17 00:00:00 2001
From: Afreen Misbah <afreen@ibm.com>
Date: Tue, 7 Jul 2026 18:28:32 +0530
Subject: [PATCH 558/596] mgr/dashboard: fix cancel button

Signed-off-by: Afreen Misbah <afreen@ibm.com>
---
 .../osd/osd-form/osd-form.component.ts        | 25 ++-----------------
 .../tearsheet/tearsheet.component.ts          |  2 +-
 2 files changed, 3 insertions(+), 24 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
index 6860134b3b9..63dfd3d58b2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
@@ -8,7 +8,6 @@ import {
   ViewChild
 } from '@angular/core';
 import { UntypedFormControl } from '@angular/forms';
-import { Location } from '@angular/common';
 import { Router } from '@angular/router';
 
 import _ from 'lodash';
@@ -143,7 +142,6 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     private orchService: OrchestratorService,
     private hostService: HostService,
     private router: Router,
-    private location: Location,
     private formatterService: FormatterService,
     private modalService: ModalService,
     private osdService: OsdService,
@@ -502,34 +500,15 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
       this.cancelled.emit();
       return;
     }
-    this.location.back();
+    this.router.navigate(['osd', { outlets: { modal: null } }]);
   }
 
   private navigateAfterCreate() {
-    const returnUrl = window.history.state?.returnUrl;
-
     if (this.osdCreated.observers.length > 0) {
       this.osdCreated.emit();
       return;
     }
-
-    if (returnUrl === '/add-storage') {
-      this.router.navigate(['/add-storage']);
-      return;
-    }
-
-    const hasSafeReturnUrl =
-      typeof returnUrl === 'string' &&
-      returnUrl.startsWith('/') &&
-      !returnUrl.startsWith('//') &&
-      returnUrl !== '/osd/create';
-
-    if (hasSafeReturnUrl) {
-      this.router.navigateByUrl(returnUrl);
-      return;
-    }
-
-    this.router.navigate(['/osd']);
+    this.router.navigate(['osd', { outlets: { modal: null } }]);
   }
 
   submit() {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
index 2be126ef689..2874b164e74 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.ts
@@ -183,9 +183,9 @@ export class TearsheetComponent implements OnInit, AfterViewInit, OnDestroy, OnC
   }
 
   closeWideTearsheet() {
-    this.closeRequested.emit();
     this.isOpen = false;
     if (this.closeRequested.observers.length > 0) {
+      this.closeRequested.emit();
       return;
     }
     if (this.hasModalOutlet) {

From 7b2217caf3c720ca058e3525276d8b6e205fcacb Mon Sep 17 00:00:00 2001
From: Redouane Kachach <rkachach@ibm.com>
Date: Tue, 7 Jul 2026 15:47:11 +0200
Subject: [PATCH 559/596] qa/cephadm: fix hardcoded 'sshd' unit name in
 setup_ca_signed_keys

setup_ca_signed_keys() hardcoded `systemctl restart sshd`, which fails
on Debian/Ubuntu where the SSH server unit is named `ssh.service`
rather than `sshd.service`. Try `ssh` first, fall back to `sshd` if
that fails, grouped so the fallback only fires on restart failure and
doesn't mask a failed config write.

Fixes: https://tracker.ceph.com/issues/77991
Signed-off-by: Redouane Kachach <rkachach@ibm.com>
---
 qa/tasks/cephadm.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/qa/tasks/cephadm.py b/qa/tasks/cephadm.py
index 6b08d8885e3..2c426044abb 100644
--- a/qa/tasks/cephadm.py
+++ b/qa/tasks/cephadm.py
@@ -628,12 +628,14 @@ def setup_ca_signed_keys(ctx, config):
             'sudo', 'tee', '-a', '/etc/ssh/ca-key.pub',
         ])
         # make sshd accept the CA signed key
+        # NOTE: the SSH server systemd unit is named 'ssh' on Debian/Ubuntu
+        # and 'sshd' on RHEL/CentOS/Rocky -- try both, but only after the
+        # config write itself has succeeded (grouped with parens so the
+        # restart fallback doesn't mask a failed config write).
         remote.run(args=[
-            'sudo', 'echo', 'TrustedUserCAKeys /etc/ssh/ca-key.pub',
-            run.Raw('|'),
-            'sudo', 'tee', '-a', '/etc/ssh/sshd_config',
-            run.Raw('&&'),
-            'sudo', 'systemctl', 'restart', 'sshd',
+            'sudo', 'sh', '-c',
+            "echo 'TrustedUserCAKeys /etc/ssh/ca-key.pub' | sudo tee -a /etc/ssh/sshd_config && "
+            "(sudo systemctl restart ssh || sudo systemctl restart sshd)"
         ])
 
     # generate a new key pair and sign the pub key to make a cert

From 13383ddfa2592ac6bb5150dca691b5ccc5f4c0d8 Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Fri, 26 Jun 2026 15:02:08 +0530
Subject: [PATCH 560/596] mgr/dashboard: bump angular to 19.2.25

Fixes: https://tracker.ceph.com/issues/77729
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../mgr/dashboard/frontend/package-lock.json  | 1648 ++++++++++++-----
 .../mgr/dashboard/frontend/package.json       |   32 +-
 .../productive-card.component.scss            |    8 +-
 .../frontend/src/styles/themes/_default.scss  |    3 +-
 4 files changed, 1160 insertions(+), 531 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/package-lock.json b/src/pybind/mgr/dashboard/frontend/package-lock.json
index 889a78d7d7a..30aba53baab 100644
--- a/src/pybind/mgr/dashboard/frontend/package-lock.json
+++ b/src/pybind/mgr/dashboard/frontend/package-lock.json
@@ -9,15 +9,15 @@
       "version": "0.0.0",
       "license": "MIT",
       "dependencies": {
-        "@angular/animations": "19.2.9",
-        "@angular/common": "19.2.9",
-        "@angular/compiler": "19.2.9",
-        "@angular/core": "19.2.9",
-        "@angular/forms": "19.2.9",
-        "@angular/localize": "19.2.9",
-        "@angular/platform-browser": "19.2.9",
-        "@angular/platform-browser-dynamic": "19.2.9",
-        "@angular/router": "19.2.9",
+        "@angular/animations": "19.2.25",
+        "@angular/common": "19.2.25",
+        "@angular/compiler": "19.2.25",
+        "@angular/core": "19.2.25",
+        "@angular/forms": "19.2.25",
+        "@angular/localize": "19.2.25",
+        "@angular/platform-browser": "19.2.25",
+        "@angular/platform-browser-dynamic": "19.2.25",
+        "@angular/router": "19.2.25",
         "@carbon/charts-angular": "1.23.9",
         "@carbon/icons": "11.63.0",
         "@carbon/styles": "1.83.0",
@@ -47,20 +47,20 @@
         "timers-browserify": "2.0.12",
         "tslib": "2.6.2",
         "xml2js": "0.6.2",
-        "zone.js": "0.14.10"
+        "zone.js": "0.15.1"
       },
       "devDependencies": {
-        "@angular-devkit/build-angular": "19.2.9",
-        "@angular-devkit/core": "19.2.9",
-        "@angular-devkit/schematics": "19.2.9",
+        "@angular-devkit/build-angular": "19.2.27",
+        "@angular-devkit/core": "19.2.27",
+        "@angular-devkit/schematics": "19.2.27",
         "@angular-eslint/builder": "18.4.0",
         "@angular-eslint/eslint-plugin": "18.4.0",
         "@angular-eslint/eslint-plugin-template": "18.4.0",
         "@angular-eslint/schematics": "18.4.0",
         "@angular-eslint/template-parser": "18.4.0",
-        "@angular/cli": "19.2.9",
-        "@angular/compiler-cli": "19.2.9",
-        "@angular/language-service": "19.2.9",
+        "@angular/cli": "19.2.27",
+        "@angular/compiler-cli": "19.2.25",
+        "@angular/language-service": "19.2.25",
         "@applitools/eyes-cypress": "3.52.0",
         "@compodoc/compodoc": "1.1.26",
         "@cypress/browserify-preprocessor": "3.0.2",
@@ -130,13 +130,13 @@
       }
     },
     "node_modules/@angular-devkit/architect": {
-      "version": "0.1902.9",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/architect/-/architect-0.1902.9.tgz",
-      "integrity": "sha512-SLUc7EaFMjhCnimqxTcv32wESJBLQ3E6c/1sAndPojyCoGiX24ASu2pxrTXrYNS9DqiJT8tReAnqmh7dmf3xwQ==",
+      "version": "0.1902.27",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/architect/-/architect-0.1902.27.tgz",
+      "integrity": "sha512-I2YW4Zn1818toEGKPPcbv8qqglegNnWT4A4GM28LPRg4rOYwPkZzy3PAB7EIJEwZIDQgz2I+Oy0pc56BWcFVUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-devkit/core": "19.2.9",
+        "@angular-devkit/core": "19.2.27",
         "rxjs": "7.8.1"
       },
       "engines": {
@@ -156,17 +156,17 @@
       }
     },
     "node_modules/@angular-devkit/build-angular": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/build-angular/-/build-angular-19.2.9.tgz",
-      "integrity": "sha512-v6x3h+LYyEew3EjoI1+2IiFDz6f96lJB1JvbbZj3Li9FMhO4M/xo4BaWHbeg9Lot/vUy6IAlR+BJywawNIzv0Q==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/build-angular/-/build-angular-19.2.27.tgz",
+      "integrity": "sha512-63dLzZeRAZiDOWegZHDG1L3Su4m7tfh2n4uV4fXhJYQeyblAQIrmz/dsyjn2cwR021neDbteLCn7MeysKj47/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@ampproject/remapping": "2.3.0",
-        "@angular-devkit/architect": "0.1902.9",
-        "@angular-devkit/build-webpack": "0.1902.9",
-        "@angular-devkit/core": "19.2.9",
-        "@angular/build": "19.2.9",
+        "@angular-devkit/architect": "0.1902.27",
+        "@angular-devkit/build-webpack": "0.1902.27",
+        "@angular-devkit/core": "19.2.27",
+        "@angular/build": "19.2.27",
         "@babel/core": "7.26.10",
         "@babel/generator": "7.26.10",
         "@babel/helper-annotate-as-pure": "7.25.9",
@@ -177,7 +177,7 @@
         "@babel/preset-env": "7.26.9",
         "@babel/runtime": "7.26.10",
         "@discoveryjs/json-ext": "0.6.3",
-        "@ngtools/webpack": "19.2.9",
+        "@ngtools/webpack": "19.2.27",
         "@vitejs/plugin-basic-ssl": "1.2.0",
         "ansi-colors": "4.1.3",
         "autoprefixer": "10.4.20",
@@ -185,7 +185,7 @@
         "browserslist": "^4.21.5",
         "copy-webpack-plugin": "12.0.2",
         "css-loader": "7.1.2",
-        "esbuild-wasm": "0.25.1",
+        "esbuild-wasm": "0.28.0",
         "fast-glob": "3.3.3",
         "http-proxy-middleware": "3.0.5",
         "istanbul-lib-instrument": "6.0.3",
@@ -198,9 +198,9 @@
         "mini-css-extract-plugin": "2.9.2",
         "open": "10.1.0",
         "ora": "5.4.1",
-        "picomatch": "4.0.2",
+        "picomatch": "4.0.4",
         "piscina": "4.8.0",
-        "postcss": "8.5.2",
+        "postcss": "8.5.12",
         "postcss-loader": "8.1.1",
         "resolve-url-loader": "5.0.0",
         "rxjs": "7.8.1",
@@ -212,9 +212,9 @@
         "terser": "5.39.0",
         "tree-kill": "1.2.2",
         "tslib": "2.8.1",
-        "webpack": "5.98.0",
+        "webpack": "5.105.0",
         "webpack-dev-middleware": "7.4.2",
-        "webpack-dev-server": "5.2.0",
+        "webpack-dev-server": "5.2.2",
         "webpack-merge": "6.0.1",
         "webpack-subresource-integrity": "5.1.0"
       },
@@ -224,14 +224,14 @@
         "yarn": ">= 1.13.0"
       },
       "optionalDependencies": {
-        "esbuild": "0.25.1"
+        "esbuild": "0.28.0"
       },
       "peerDependencies": {
         "@angular/compiler-cli": "^19.0.0 || ^19.2.0-next.0",
         "@angular/localize": "^19.0.0 || ^19.2.0-next.0",
         "@angular/platform-server": "^19.0.0 || ^19.2.0-next.0",
         "@angular/service-worker": "^19.0.0 || ^19.2.0-next.0",
-        "@angular/ssr": "^19.2.9",
+        "@angular/ssr": "^19.2.27",
         "@web/test-runner": "^0.20.0",
         "browser-sync": "^3.0.2",
         "jest": "^29.5.0",
@@ -281,6 +281,19 @@
         }
       }
     },
+    "node_modules/@angular-devkit/build-angular/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@angular-devkit/build-angular/node_modules/rxjs": {
       "version": "7.8.1",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
@@ -299,13 +312,13 @@
       "license": "0BSD"
     },
     "node_modules/@angular-devkit/build-webpack": {
-      "version": "0.1902.9",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/build-webpack/-/build-webpack-0.1902.9.tgz",
-      "integrity": "sha512-iklNoxKgwd54KT5GE0o5SB+0hr6Iu3YSpj9fi23DlLKcWWwFYaKqoRaYcfuL7KdUzunFg7dzB7n6TgYpVHWWJw==",
+      "version": "0.1902.27",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/build-webpack/-/build-webpack-0.1902.27.tgz",
+      "integrity": "sha512-O3v9/x2+yJrXJIBG0x7o/EMSjRjJqWcJb8u5lHFKut9qCpQJ6oDeoxqGM5SWXIk4RGr3qbAsOragkR2Lsq0cRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-devkit/architect": "0.1902.9",
+        "@angular-devkit/architect": "0.1902.27",
         "rxjs": "7.8.1"
       },
       "engines": {
@@ -329,16 +342,16 @@
       }
     },
     "node_modules/@angular-devkit/core": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-19.2.9.tgz",
-      "integrity": "sha512-vbTomKnN7H4jaif0hWAECFU2WvRbhfkYWHdlk/JtJM53iIJVL3mKWBRZ0QXITjmgfdIo3c9RcX+wFI7gGqGd6g==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-19.2.27.tgz",
+      "integrity": "sha512-3amNzoCVSKd7ah6l6lBQL4onwwJvqvam7FMoQBILrxtW5LB5ezh8gMSPuA4zJjKjoRzf9uoWdlzqv/84I52xZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ajv": "8.17.1",
+        "ajv": "8.18.0",
         "ajv-formats": "3.0.1",
         "jsonc-parser": "3.3.1",
-        "picomatch": "4.0.2",
+        "picomatch": "4.0.4",
         "rxjs": "7.8.1",
         "source-map": "0.7.4"
       },
@@ -356,6 +369,36 @@
         }
       }
     },
+    "node_modules/@angular-devkit/core/node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@angular-devkit/core/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@angular-devkit/core/node_modules/rxjs": {
       "version": "7.8.1",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
@@ -367,13 +410,13 @@
       }
     },
     "node_modules/@angular-devkit/schematics": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-19.2.9.tgz",
-      "integrity": "sha512-B8FQ4hFsP4Ffh895F9GVvyhgDoZztWnAyYKiM1pyvLSQikzaUZqi9NZnD12HgMALmwm2z36zTzoSNsYFBTHgaw==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-19.2.27.tgz",
+      "integrity": "sha512-/PZmyAlb2NGWPikRRuiWLdfHQd8Wrx6lX4HqvTcaDhlU43M3T0ud4PH2T3QDp7BzHYY92xtD8iPxX2asg67G1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-devkit/core": "19.2.9",
+        "@angular-devkit/core": "19.2.27",
         "jsonc-parser": "3.3.1",
         "magic-string": "0.30.17",
         "ora": "5.4.1",
@@ -510,9 +553,9 @@
       }
     },
     "node_modules/@angular/animations": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/animations/-/animations-19.2.9.tgz",
-      "integrity": "sha512-Xg/JD8GyeUpBwno51iuK/iJnbSVc6A+THyP+2ScNVdWFdLyuCiEr9EbIHdeGDnhK1f/MVjRKbkrN6OElkxCx8A==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/animations/-/animations-19.2.25.tgz",
+      "integrity": "sha512-1IE7wuC3ecAumb7ZQHCugV1jsSl93j0omX7BAWwwmM8C7Xo//fZcO/ad/IFfn0zV/VCBAhOAFBUKUIVAGpsylw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -521,19 +564,19 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/common": "19.2.9",
-        "@angular/core": "19.2.9"
+        "@angular/common": "19.2.25",
+        "@angular/core": "19.2.25"
       }
     },
     "node_modules/@angular/build": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/build/-/build-19.2.9.tgz",
-      "integrity": "sha512-hrRhSdY98wGQ/jrpT3K73/Ii5FadQEJFcHy+ockqP2Xh7pXOwhGFc+D0ks4AdHea+pHtNbIb/qPd+UvR5izY3Q==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@angular/build/-/build-19.2.27.tgz",
+      "integrity": "sha512-kMcuTUxDcnTa+JF9SaxdY+b6pkGjtefxGp/VYblSbvlzQ1rVX4wH4V9LHHyXsTOxRRNGqRJ01g0Enhq1iA19mQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@ampproject/remapping": "2.3.0",
-        "@angular-devkit/architect": "0.1902.9",
+        "@angular-devkit/architect": "0.1902.27",
         "@babel/core": "7.26.10",
         "@babel/helper-annotate-as-pure": "7.25.9",
         "@babel/helper-split-export-declaration": "7.24.7",
@@ -542,7 +585,7 @@
         "@vitejs/plugin-basic-ssl": "1.2.0",
         "beasties": "0.3.2",
         "browserslist": "^4.23.0",
-        "esbuild": "0.25.1",
+        "esbuild": "0.28.0",
         "fast-glob": "3.3.3",
         "https-proxy-agent": "7.0.6",
         "istanbul-lib-instrument": "6.0.3",
@@ -550,13 +593,13 @@
         "magic-string": "0.30.17",
         "mrmime": "2.0.1",
         "parse5-html-rewriting-stream": "7.0.0",
-        "picomatch": "4.0.2",
+        "picomatch": "4.0.4",
         "piscina": "4.8.0",
-        "rollup": "4.34.8",
+        "rollup": "4.59.0",
         "sass": "1.85.0",
         "semver": "7.7.1",
         "source-map-support": "0.5.21",
-        "vite": "6.2.6",
+        "vite": "6.4.2",
         "watchpack": "2.4.2"
       },
       "engines": {
@@ -573,7 +616,7 @@
         "@angular/localize": "^19.0.0 || ^19.2.0-next.0",
         "@angular/platform-server": "^19.0.0 || ^19.2.0-next.0",
         "@angular/service-worker": "^19.0.0 || ^19.2.0-next.0",
-        "@angular/ssr": "^19.2.9",
+        "@angular/ssr": "^19.2.27",
         "karma": "^6.4.0",
         "less": "^4.2.0",
         "ng-packagr": "^19.0.0 || ^19.2.0-next.0",
@@ -611,19 +654,32 @@
         }
       }
     },
+    "node_modules/@angular/build/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/@angular/cli": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/cli/-/cli-19.2.9.tgz",
-      "integrity": "sha512-m3yaqrtodzO+tDspAqD6h7Ft8HzP4xbTmqPoSHaAN6Wupf/m/q94AMBmuEk74URS3q7v6PhayOuNOzBY2q4bIw==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@angular/cli/-/cli-19.2.27.tgz",
+      "integrity": "sha512-npqpoV7Y49ggwUysXbRUDDmFRmwQdZ92nljtxX1yjakmwR93WdEq7NwqHEGODOAXo5NtPoEeBNc3InPtrLmh5g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-devkit/architect": "0.1902.9",
-        "@angular-devkit/core": "19.2.9",
-        "@angular-devkit/schematics": "19.2.9",
+        "@angular-devkit/architect": "0.1902.27",
+        "@angular-devkit/core": "19.2.27",
+        "@angular-devkit/schematics": "19.2.27",
         "@inquirer/prompts": "7.3.2",
         "@listr2/prompt-adapter-inquirer": "2.0.18",
-        "@schematics/angular": "19.2.9",
+        "@schematics/angular": "19.2.27",
         "@yarnpkg/lockfile": "1.1.0",
         "ini": "5.0.0",
         "jsonc-parser": "3.3.1",
@@ -646,9 +702,9 @@
       }
     },
     "node_modules/@angular/common": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/common/-/common-19.2.9.tgz",
-      "integrity": "sha512-4Lio3nRp13sTU15hsVcv8Zkj+7OKZ6Pc6CIIkQYHs9KisSwwvwmRZDU1wFhKlH+ogebLgOcNurIPdqeYWWnLjQ==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/common/-/common-19.2.25.tgz",
+      "integrity": "sha512-WteFLyfDPvilzpSGHk64bqowa4NnHdbjNl1xXeGr038fgTjp0l0NdiUPqeDtYT4pf5lWl6477pPoQN7o//NyyQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -657,14 +713,14 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/core": "19.2.9",
+        "@angular/core": "19.2.25",
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
     "node_modules/@angular/compiler": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-19.2.9.tgz",
-      "integrity": "sha512-K6wtAsJhQeD2OjoupV03gWHBqnqhEP9llzFzlnQoXAAZzM1eIT/KAtQEdNY75NO+BESKxaXvQBAU16Tg/1I6uw==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-19.2.25.tgz",
+      "integrity": "sha512-GGEeTTd/DV71E07K0u5753bxXozc6Z7iWaCZJDW7xiA7hdHCwrYBMz1PVUJAtXcxf4wTdiXQR48kw8/YHYnDAw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -674,9 +730,9 @@
       }
     },
     "node_modules/@angular/compiler-cli": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-19.2.9.tgz",
-      "integrity": "sha512-+tTxBHO0siPPK6yxQeEQOS/Ihn9ntEa/uiwVO2IEaCrsmRLEYS6Wwqq7H3x7Pj64axnZdA0YRo8kOyTUbMs4+A==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-19.2.25.tgz",
+      "integrity": "sha512-IBBKRz6ua+y6bdcaUIpOPq7G/S4biJfcT1TCMD7wi+48wiKKSXj4J/8BN5fSjt+UozlHwya3B8z0XqnwO2ywZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -698,7 +754,7 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/compiler": "19.2.9",
+        "@angular/compiler": "19.2.25",
         "typescript": ">=5.5 <5.9"
       }
     },
@@ -751,9 +807,9 @@
       }
     },
     "node_modules/@angular/core": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/core/-/core-19.2.9.tgz",
-      "integrity": "sha512-73WMvxWll8/nQiAbigDhR27dQ+GjciODY5JVADdneNBSEwcQxi0HirlGzm5wy1TonOu4eTTWkvgV/3YlTOmo4A==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/core/-/core-19.2.25.tgz",
+      "integrity": "sha512-j7/irbbdO4rmZfRXS+sphCerzgcRlpGFwxHc/76Ual+ckwJG0MPsNFkllz2SIEZzE1EZkmIunGrHbjeRBJjyvg==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -767,9 +823,9 @@
       }
     },
     "node_modules/@angular/forms": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-19.2.9.tgz",
-      "integrity": "sha512-RKzShsMf9X7LQd4qsfx1ShSPF0qODS7HWBPz/khFvfpscDYAqXvqzfXS2yvu0PaCwyNneR7vZKYMCN564SK7hw==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-19.2.25.tgz",
+      "integrity": "sha512-lbuhZiuNKy8vcIHFSP7sOW5kfHSVDiVsXh2/+rWjqGklscfUG5cTK9F9d+k60CH24OhK0NgRKoCHiAK5zPQi2g==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -778,16 +834,16 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/common": "19.2.9",
-        "@angular/core": "19.2.9",
-        "@angular/platform-browser": "19.2.9",
+        "@angular/common": "19.2.25",
+        "@angular/core": "19.2.25",
+        "@angular/platform-browser": "19.2.25",
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
     "node_modules/@angular/language-service": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/language-service/-/language-service-19.2.9.tgz",
-      "integrity": "sha512-j7M1P+Y7uMfbFg2ylSsrcxdB+CNZi2XiZfg0/EfsR+56QdXf24psq0n6DNINTUUH++ulWF86owwu9PCNUQnJ1Q==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/language-service/-/language-service-19.2.25.tgz",
+      "integrity": "sha512-/b5K0sWs1JB9i8Rbb26V4Y38EjHqwzi5ADk28wJ40lqH908cWHAsNJP+PJWbhCo/tOaAYoaD1GKdOb7ODeeKyA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -795,9 +851,9 @@
       }
     },
     "node_modules/@angular/localize": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/localize/-/localize-19.2.9.tgz",
-      "integrity": "sha512-ZJ59YTV/1rEGQ9V1LZiJZeINbXsy9yLm2ZX1zTMAqNTUAgcv2wjf+yCUKL03DJoKXPiSIKdRiA0FLPIG+49EYQ==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/localize/-/localize-19.2.25.tgz",
+      "integrity": "sha512-8/1j0BUYMwjRxCAOK9mjW9Gud0g9C6hLJMr2HOBdiIPNvhXkdZqF3nMXgF12xqnD33fbrE+zsURZgF0fxoL5Ww==",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "7.26.9",
@@ -814,8 +870,8 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/compiler": "19.2.9",
-        "@angular/compiler-cli": "19.2.9"
+        "@angular/compiler": "19.2.25",
+        "@angular/compiler-cli": "19.2.25"
       }
     },
     "node_modules/@angular/localize/node_modules/@babel/core": {
@@ -864,9 +920,9 @@
       }
     },
     "node_modules/@angular/platform-browser": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-19.2.9.tgz",
-      "integrity": "sha512-vMBgCj/R2OxVX7YAqBTOsBiEUbwB3sJoZSy+E05vJovC0QhPWTiR4QiBXB1nlCoAZ8HTv79j7j8AYl10pqlPfQ==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-19.2.25.tgz",
+      "integrity": "sha512-UF7cyBnMF3puA/cGy3MXbiPB2Rlw0Umf78XH664Iwqsb37A+TxqzOPaByXsNTIbpV6/h28yO3dMvDVFT3aOvOA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -875,9 +931,9 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/animations": "19.2.9",
-        "@angular/common": "19.2.9",
-        "@angular/core": "19.2.9"
+        "@angular/animations": "19.2.25",
+        "@angular/common": "19.2.25",
+        "@angular/core": "19.2.25"
       },
       "peerDependenciesMeta": {
         "@angular/animations": {
@@ -886,9 +942,9 @@
       }
     },
     "node_modules/@angular/platform-browser-dynamic": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/platform-browser-dynamic/-/platform-browser-dynamic-19.2.9.tgz",
-      "integrity": "sha512-llyjP1d3f6NDP6GwfHVNKZmkHlKpRKR/nYvP60Xl5vt90Gw2H5MJ+JHlzAHMt4O4paQHaYH1+b+2bio5/VSxjQ==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/platform-browser-dynamic/-/platform-browser-dynamic-19.2.25.tgz",
+      "integrity": "sha512-T6LK+NH6VR0bNKepN6urSHPE86OxbIMvgm855W06YjXvK7cMotPCC+N10zv7M8zQRZtQ7WBkY0EGpC8qLrao0g==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -897,16 +953,16 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/common": "19.2.9",
-        "@angular/compiler": "19.2.9",
-        "@angular/core": "19.2.9",
-        "@angular/platform-browser": "19.2.9"
+        "@angular/common": "19.2.25",
+        "@angular/compiler": "19.2.25",
+        "@angular/core": "19.2.25",
+        "@angular/platform-browser": "19.2.25"
       }
     },
     "node_modules/@angular/router": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@angular/router/-/router-19.2.9.tgz",
-      "integrity": "sha512-EOTzOJhdUHRakK+/oJV8tArLEs3xbe0AIxxdvntBVIy/99x/ovjAkdDs5QtIOFSYmZ7I0FgQpx5b8AXPkBxcRw==",
+      "version": "19.2.25",
+      "resolved": "https://registry.npmjs.org/@angular/router/-/router-19.2.25.tgz",
+      "integrity": "sha512-IddC2vPiagB2jAsUrNuAr74p+OirWaroouvPkUjzPmyQ+12/0EsygHamsgUbsCVLXJKh72oqnD+xViN0AMguOA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -915,9 +971,9 @@
         "node": "^18.19.1 || ^20.11.1 || >=22.0.0"
       },
       "peerDependencies": {
-        "@angular/common": "19.2.9",
-        "@angular/core": "19.2.9",
-        "@angular/platform-browser": "19.2.9",
+        "@angular/common": "19.2.25",
+        "@angular/core": "19.2.25",
+        "@angular/platform-browser": "19.2.25",
         "rxjs": "^6.5.3 || ^7.4.0"
       }
     },
@@ -4662,9 +4718,9 @@
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.1.tgz",
-      "integrity": "sha512-kfYGy8IdzTGy+z0vFGvExZtxkFlA4zAxgKEahG9KE1ScBjpQnFsNOX8KTU5ojNru5ed5CVoJYXFtoxaq5nFbjQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
+      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
       "cpu": [
         "ppc64"
       ],
@@ -4679,9 +4735,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.1.tgz",
-      "integrity": "sha512-dp+MshLYux6j/JjdqVLnMglQlFu+MuVeNrmT5nk6q07wNhCdSnB7QZj+7G8VMUGh1q+vj2Bq8kRsuyA00I/k+Q==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
+      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
       "cpu": [
         "arm"
       ],
@@ -4696,9 +4752,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.1.tgz",
-      "integrity": "sha512-50tM0zCJW5kGqgG7fQ7IHvQOcAn9TKiVRuQ/lN0xR+T2lzEFvAi1ZcS8DiksFcEpf1t/GYOeOfCAgDHFpkiSmA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
+      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
       "cpu": [
         "arm64"
       ],
@@ -4713,9 +4769,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.1.tgz",
-      "integrity": "sha512-GCj6WfUtNldqUzYkN/ITtlhwQqGWu9S45vUXs7EIYf+7rCiiqH9bCloatO9VhxsL0Pji+PF4Lz2XXCES+Q8hDw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
+      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
       "cpu": [
         "x64"
       ],
@@ -4730,9 +4786,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.1.tgz",
-      "integrity": "sha512-5hEZKPf+nQjYoSr/elb62U19/l1mZDdqidGfmFutVUjjUZrOazAtwK+Kr+3y0C/oeJfLlxo9fXb1w7L+P7E4FQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
+      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
       "cpu": [
         "arm64"
       ],
@@ -4747,9 +4803,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.1.tgz",
-      "integrity": "sha512-hxVnwL2Dqs3fM1IWq8Iezh0cX7ZGdVhbTfnOy5uURtao5OIVCEyj9xIzemDi7sRvKsuSdtCAhMKarxqtlyVyfA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
+      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
       "cpu": [
         "x64"
       ],
@@ -4764,9 +4820,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.1.tgz",
-      "integrity": "sha512-1MrCZs0fZa2g8E+FUo2ipw6jw5qqQiH+tERoS5fAfKnRx6NXH31tXBKI3VpmLijLH6yriMZsxJtaXUyFt/8Y4A==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
       "cpu": [
         "arm64"
       ],
@@ -4781,9 +4837,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.1.tgz",
-      "integrity": "sha512-0IZWLiTyz7nm0xuIs0q1Y3QWJC52R8aSXxe40VUxm6BB1RNmkODtW6LHvWRrGiICulcX7ZvyH6h5fqdLu4gkww==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
+      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
       "cpu": [
         "x64"
       ],
@@ -4798,9 +4854,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.1.tgz",
-      "integrity": "sha512-NdKOhS4u7JhDKw9G3cY6sWqFcnLITn6SqivVArbzIaf3cemShqfLGHYMx8Xlm/lBit3/5d7kXvriTUGa5YViuQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
+      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
       "cpu": [
         "arm"
       ],
@@ -4815,9 +4871,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.1.tgz",
-      "integrity": "sha512-jaN3dHi0/DDPelk0nLcXRm1q7DNJpjXy7yWaWvbfkPvI+7XNSc/lDOnCLN7gzsyzgu6qSAmgSvP9oXAhP973uQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
+      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
       "cpu": [
         "arm64"
       ],
@@ -4832,9 +4888,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.1.tgz",
-      "integrity": "sha512-OJykPaF4v8JidKNGz8c/q1lBO44sQNUQtq1KktJXdBLn1hPod5rE/Hko5ugKKZd+D2+o1a9MFGUEIUwO2YfgkQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
+      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
       "cpu": [
         "ia32"
       ],
@@ -4849,9 +4905,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.1.tgz",
-      "integrity": "sha512-nGfornQj4dzcq5Vp835oM/o21UMlXzn79KobKlcs3Wz9smwiifknLy4xDCLUU0BWp7b/houtdrgUz7nOGnfIYg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
+      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
       "cpu": [
         "loong64"
       ],
@@ -4866,9 +4922,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.1.tgz",
-      "integrity": "sha512-1osBbPEFYwIE5IVB/0g2X6i1qInZa1aIoj1TdL4AaAb55xIIgbg8Doq6a5BzYWgr+tEcDzYH67XVnTmUzL+nXg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
+      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
       "cpu": [
         "mips64el"
       ],
@@ -4883,9 +4939,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.1.tgz",
-      "integrity": "sha512-/6VBJOwUf3TdTvJZ82qF3tbLuWsscd7/1w+D9LH0W/SqUgM5/JJD0lrJ1fVIfZsqB6RFmLCe0Xz3fmZc3WtyVg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
+      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
       "cpu": [
         "ppc64"
       ],
@@ -4900,9 +4956,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.1.tgz",
-      "integrity": "sha512-nSut/Mx5gnilhcq2yIMLMe3Wl4FK5wx/o0QuuCLMtmJn+WeWYoEGDN1ipcN72g1WHsnIbxGXd4i/MF0gTcuAjQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
+      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
       "cpu": [
         "riscv64"
       ],
@@ -4917,9 +4973,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.1.tgz",
-      "integrity": "sha512-cEECeLlJNfT8kZHqLarDBQso9a27o2Zd2AQ8USAEoGtejOrCYHNtKP8XQhMDJMtthdF4GBmjR2au3x1udADQQQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
+      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
       "cpu": [
         "s390x"
       ],
@@ -4934,9 +4990,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.1.tgz",
-      "integrity": "sha512-xbfUhu/gnvSEg+EGovRc+kjBAkrvtk38RlerAzQxvMzlB4fXpCFCeUAYzJvrnhFtdeyVCDANSjJvOvGYoeKzFA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
+      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
       "cpu": [
         "x64"
       ],
@@ -4951,9 +5007,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.1.tgz",
-      "integrity": "sha512-O96poM2XGhLtpTh+s4+nP7YCCAfb4tJNRVZHfIE7dgmax+yMP2WgMd2OecBuaATHKTHsLWHQeuaxMRnCsH8+5g==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
       "cpu": [
         "arm64"
       ],
@@ -4968,9 +5024,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.1.tgz",
-      "integrity": "sha512-X53z6uXip6KFXBQ+Krbx25XHV/NCbzryM6ehOAeAil7X7oa4XIq+394PWGnwaSQ2WRA0KI6PUO6hTO5zeF5ijA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
       "cpu": [
         "x64"
       ],
@@ -4985,9 +5041,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.1.tgz",
-      "integrity": "sha512-Na9T3szbXezdzM/Kfs3GcRQNjHzM6GzFBeU1/6IV/npKP5ORtp9zbQjvkDJ47s6BCgaAZnnnu/cY1x342+MvZg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
       "cpu": [
         "arm64"
       ],
@@ -5002,9 +5058,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.1.tgz",
-      "integrity": "sha512-T3H78X2h1tszfRSf+txbt5aOp/e7TAz3ptVKu9Oyir3IAOFPGV6O9c2naym5TOriy1l0nNf6a4X5UXRZSGX/dw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
       "cpu": [
         "x64"
       ],
@@ -5018,10 +5074,27 @@
         "node": ">=18"
       }
     },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
+      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.1.tgz",
-      "integrity": "sha512-2H3RUvcmULO7dIE5EWJH8eubZAI4xw54H1ilJnRNZdeo8dTADEZ21w6J22XBkXqGJbe0+wnNJtw3UXRoLJnFEg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
+      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
       "cpu": [
         "x64"
       ],
@@ -5036,9 +5109,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.1.tgz",
-      "integrity": "sha512-GE7XvrdOzrb+yVKB9KsRMq+7a2U/K5Cf/8grVFRAGJmfADr/e/ODQ134RK2/eeHqYV5eQRFxb1hY7Nr15fv1NQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
+      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
       "cpu": [
         "arm64"
       ],
@@ -5053,9 +5126,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.1.tgz",
-      "integrity": "sha512-uOxSJCIcavSiT6UnBhBzE8wy3n0hOkJsBOzy7HDAuTDE++1DJMRRVCPGisULScHL+a/ZwdXPpXD3IyFKjA7K8A==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
+      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
       "cpu": [
         "ia32"
       ],
@@ -5070,9 +5143,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.1.tgz",
-      "integrity": "sha512-Y1EQdcfwMSeQN/ujR5VayLOJ1BHaK+ssyk0AEzPjC+t1lITgsnccPqFjb6V+LsTp/9Iov4ysfjxLaGJ9RPtkVg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
+      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
       "cpu": [
         "x64"
       ],
@@ -6609,14 +6682,14 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-core": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-core/-/fs-core-4.57.2.tgz",
-      "integrity": "sha512-SVjwklkpIV5wrynpYtuYnfYH1QF4/nDuLBX7VXdb+3miglcAgBVZb/5y0cOsehRV/9Vb+3UqhkMq3/NR3ztdkQ==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-core/-/fs-core-4.57.8.tgz",
+      "integrity": "sha512-YzVbwggV9452VCeHgo0bjsTaUt1O7JE0XpEsPar93nn/+RAwXk0mb1Y+f5EDJ3TRtRCFe+Ck5RuojdfB4jeHVw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-node-builtins": "4.57.2",
-        "@jsonjoy.com/fs-node-utils": "4.57.2",
+        "@jsonjoy.com/fs-node-builtins": "4.57.8",
+        "@jsonjoy.com/fs-node-utils": "4.57.8",
         "thingies": "^2.5.0"
       },
       "engines": {
@@ -6631,15 +6704,15 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-fsa": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-fsa/-/fs-fsa-4.57.2.tgz",
-      "integrity": "sha512-fhO8+iR2I+OCw668ISDJdn1aArc9zx033sWejIyzQ8RBeXa9bDSaUeA3ix0poYOfrj1KdOzytmYNv2/uLDfV6g==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-fsa/-/fs-fsa-4.57.8.tgz",
+      "integrity": "sha512-vmClyvCQMxgqz7uamDiGtRfp4MjzOznk3pcQjCxlIwJcw7TWeyr+bF30hI0x8NxdtNOGMg1pHM74VDIXOeyjuw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-core": "4.57.2",
-        "@jsonjoy.com/fs-node-builtins": "4.57.2",
-        "@jsonjoy.com/fs-node-utils": "4.57.2",
+        "@jsonjoy.com/fs-core": "4.57.8",
+        "@jsonjoy.com/fs-node-builtins": "4.57.8",
+        "@jsonjoy.com/fs-node-utils": "4.57.8",
         "thingies": "^2.5.0"
       },
       "engines": {
@@ -6654,17 +6727,17 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-node": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node/-/fs-node-4.57.2.tgz",
-      "integrity": "sha512-nX2AdL6cOFwLdju9G4/nbRnYevmCJbh7N7hvR3gGm97Cs60uEjyd0rpR+YBS7cTg175zzl22pGKXR5USaQMvKg==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node/-/fs-node-4.57.8.tgz",
+      "integrity": "sha512-IPEOlDYSnTDYpjQlQg2F8h+eqxKQN3sdbroI0WrteRiQZ462HzVpBo9ZZX485njz4nAacoe3fd4iDiIhk+k5Hg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-core": "4.57.2",
-        "@jsonjoy.com/fs-node-builtins": "4.57.2",
-        "@jsonjoy.com/fs-node-utils": "4.57.2",
-        "@jsonjoy.com/fs-print": "4.57.2",
-        "@jsonjoy.com/fs-snapshot": "4.57.2",
+        "@jsonjoy.com/fs-core": "4.57.8",
+        "@jsonjoy.com/fs-node-builtins": "4.57.8",
+        "@jsonjoy.com/fs-node-utils": "4.57.8",
+        "@jsonjoy.com/fs-print": "4.57.8",
+        "@jsonjoy.com/fs-snapshot": "4.57.8",
         "glob-to-regex.js": "^1.0.0",
         "thingies": "^2.5.0"
       },
@@ -6680,9 +6753,9 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-node-builtins": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-builtins/-/fs-node-builtins-4.57.2.tgz",
-      "integrity": "sha512-xhiegylRmhw43Ki2HO1ZBL7DQ5ja/qpRsL29VtQ2xuUHiuDGbgf2uD4p9Qd8hJI5P6RCtGYD50IXHXVq/Ocjcg==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-builtins/-/fs-node-builtins-4.57.8.tgz",
+      "integrity": "sha512-mxXSXw8zZwRVakcjLqR2I/psy4gURFSASZS10kKJ2kJw05GC2nXGroGrWVHxwgkxXgQLsFQnB74QaLzsxzdL/w==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6697,15 +6770,15 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-node-to-fsa": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-to-fsa/-/fs-node-to-fsa-4.57.2.tgz",
-      "integrity": "sha512-18LmWTSONhoAPW+IWRuf8w/+zRolPFGPeGwMxlAhhfY11EKzX+5XHDBPAw67dBF5dxDErHJbl40U+3IXSDRXSQ==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-to-fsa/-/fs-node-to-fsa-4.57.8.tgz",
+      "integrity": "sha512-AWZcT/4+H+iDl4XCukbXrarvwEgOrf/prFI5/7eg4ix9FxqVsZysIDJd1Kjd+AjlCeHKHJOaRqjLd5HiGSCJEw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-fsa": "4.57.2",
-        "@jsonjoy.com/fs-node-builtins": "4.57.2",
-        "@jsonjoy.com/fs-node-utils": "4.57.2"
+        "@jsonjoy.com/fs-fsa": "4.57.8",
+        "@jsonjoy.com/fs-node-builtins": "4.57.8",
+        "@jsonjoy.com/fs-node-utils": "4.57.8"
       },
       "engines": {
         "node": ">=10.0"
@@ -6719,13 +6792,13 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-node-utils": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-utils/-/fs-node-utils-4.57.2.tgz",
-      "integrity": "sha512-rsPSJgekz43IlNbLyAM/Ab+ouYLWGp5DDBfYBNNEqDaSpsbXfthBn29Q4muFA9L0F+Z3mKo+CWlgSCXrf+mOyQ==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-utils/-/fs-node-utils-4.57.8.tgz",
+      "integrity": "sha512-E/bJ7sQAb4pu9nbeJhbULU3WnqWrswte4N9Js/oHt7aHB746S8/XBqKlcbrqIgnD3095XluovNEZuu5ONT230g==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-node-builtins": "4.57.2"
+        "@jsonjoy.com/fs-node-builtins": "4.57.8"
       },
       "engines": {
         "node": ">=10.0"
@@ -6739,13 +6812,13 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-print": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-print/-/fs-print-4.57.2.tgz",
-      "integrity": "sha512-wK9NSow48i4DbDl9F1CQE5TqnyZOJ04elU3WFG5aJ76p+YxO/ulyBBQvKsessPxdo381Bc2pcEoyPujMOhcRqQ==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-print/-/fs-print-4.57.8.tgz",
+      "integrity": "sha512-DfzhOBpmvNu5P/KSe4NNQaOnvNliTdcf0qrh/4EReErF/XUQXYkd0vZl/OiJCm/qjEEo8DWRstliw2/JNS84dA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-node-utils": "4.57.2",
+        "@jsonjoy.com/fs-node-utils": "4.57.8",
         "tree-dump": "^1.1.0"
       },
       "engines": {
@@ -6760,14 +6833,14 @@
       }
     },
     "node_modules/@jsonjoy.com/fs-snapshot": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-snapshot/-/fs-snapshot-4.57.2.tgz",
-      "integrity": "sha512-GdduDZuoP5V/QCgJkx9+BZ6SC0EZ/smXAdTS7PfMqgMTGXLlt/bH/FqMYaqB9JmLf05sJPtO0XRbAwwkEEPbVw==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-snapshot/-/fs-snapshot-4.57.8.tgz",
+      "integrity": "sha512-L+eqKaWOHLDaiMv1dh/EWQ4hA+o6xAhWSumTo3Teg7OM18jU/KE13/e8Mfal+eAZ/pSl4wIhKHcDiwapJzC8Wg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@jsonjoy.com/buffers": "^17.65.0",
-        "@jsonjoy.com/fs-node-utils": "4.57.2",
+        "@jsonjoy.com/fs-node-utils": "4.57.8",
         "@jsonjoy.com/json-pack": "^17.65.0",
         "@jsonjoy.com/util": "^17.65.0"
       },
@@ -7155,9 +7228,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.3.tgz",
-      "integrity": "sha512-QZHtlVgbAdy2zAqNA9Gu1UpIuI8Xvsd1v8ic6B2pZmeFnFcMWiPLfWXh7TVw4eGEZ/C9TH281KwhVoeQUKbyjw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.4.tgz",
+      "integrity": "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ==",
       "cpu": [
         "arm64"
       ],
@@ -7169,9 +7242,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.3.tgz",
-      "integrity": "sha512-mdzd3AVzYKuUmiWOQ8GNhl64/IoFGol569zNRdkLReh6LRLHOXxU4U8eq0JwaD8iFHdVGqSy4IjFL4reoWCDFw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.4.tgz",
+      "integrity": "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w==",
       "cpu": [
         "x64"
       ],
@@ -7183,9 +7256,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.3.tgz",
-      "integrity": "sha512-fg0uy/dG/nZEXfYilKoRe7yALaNmHoYeIoJuJ7KJ+YyU2bvY8vPv27f7UKhGRpY6euFYqEVhxCFZgAUNQBM3nw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.4.tgz",
+      "integrity": "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw==",
       "cpu": [
         "arm"
       ],
@@ -7197,9 +7270,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.3.tgz",
-      "integrity": "sha512-YxQL+ax0XqBJDZiKimS2XQaf+2wDGVa1enVRGzEvLLVFeqa5kx2bWbtcSXgsxjQB7nRqqIGFIcLteF/sHeVtQg==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.4.tgz",
+      "integrity": "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw==",
       "cpu": [
         "arm64"
       ],
@@ -7211,9 +7284,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.3.tgz",
-      "integrity": "sha512-cvwNfbP07pKUfq1uH+S6KJ7dT9K8WOE4ZiAcsrSes+UY55E/0jLYc+vq+DO7jlmqRb5zAggExKm0H7O/CBaesg==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.4.tgz",
+      "integrity": "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ==",
       "cpu": [
         "x64"
       ],
@@ -7225,9 +7298,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.3.tgz",
-      "integrity": "sha512-x0fWaQtYp4E6sktbsdAqnehxDgEc/VwM7uLsRCYWaiGu0ykYdZPiS8zCWdnjHwyiumousxfBm4SO31eXqwEZhQ==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.4.tgz",
+      "integrity": "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ==",
       "cpu": [
         "x64"
       ],
@@ -7579,9 +7652,9 @@
       }
     },
     "node_modules/@ngtools/webpack": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-19.2.9.tgz",
-      "integrity": "sha512-CLfUauqi2Xp/jKGxp5wUwjqfVQWcBE09GMd51ovcCRLkgB2Kh26+CiVnGw5/lkBpISUCNdgN6nGiS+nfqMfFeQ==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-19.2.27.tgz",
+      "integrity": "sha512-nuKxH4WaRILjlje4143T8XeDWVi5AIDlCMu/SPSKsYtyGxX7AC3sEu0UatFG7rrJkS/SB+fZngtuydoprhvYkQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8508,9 +8581,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.34.8.tgz",
-      "integrity": "sha512-q217OSE8DTp8AFHuNHXo0Y86e1wtlfVrXiAlwkIvGRQv9zbc6mE3sjIVfwI8sYUyNxwOg0j/Vm1RKM04JcWLJw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
+      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
       "cpu": [
         "arm"
       ],
@@ -8522,9 +8595,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.34.8.tgz",
-      "integrity": "sha512-Gigjz7mNWaOL9wCggvoK3jEIUUbGul656opstjaUSGC3eT0BM7PofdAJaBfPFWWkXNVAXbaQtC99OCg4sJv70Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
+      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
       "cpu": [
         "arm64"
       ],
@@ -8536,9 +8609,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.34.8.tgz",
-      "integrity": "sha512-02rVdZ5tgdUNRxIUrFdcMBZQoaPMrxtwSb+/hOfBdqkatYHR3lZ2A2EGyHq2sGOd0Owk80oV3snlDASC24He3Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
+      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
       "cpu": [
         "arm64"
       ],
@@ -8550,9 +8623,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.34.8.tgz",
-      "integrity": "sha512-qIP/elwR/tq/dYRx3lgwK31jkZvMiD6qUtOycLhTzCvrjbZ3LjQnEM9rNhSGpbLXVJYQ3rq39A6Re0h9tU2ynw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
+      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
       "cpu": [
         "x64"
       ],
@@ -8564,9 +8637,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.34.8.tgz",
-      "integrity": "sha512-IQNVXL9iY6NniYbTaOKdrlVP3XIqazBgJOVkddzJlqnCpRi/yAeSOa8PLcECFSQochzqApIOE1GHNu3pCz+BDA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
+      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
       "cpu": [
         "arm64"
       ],
@@ -8578,9 +8651,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.34.8.tgz",
-      "integrity": "sha512-TYXcHghgnCqYFiE3FT5QwXtOZqDj5GmaFNTNt3jNC+vh22dc/ukG2cG+pi75QO4kACohZzidsq7yKTKwq/Jq7Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
+      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
       "cpu": [
         "x64"
       ],
@@ -8592,9 +8665,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.34.8.tgz",
-      "integrity": "sha512-A4iphFGNkWRd+5m3VIGuqHnG3MVnqKe7Al57u9mwgbyZ2/xF9Jio72MaY7xxh+Y87VAHmGQr73qoKL9HPbXj1g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
+      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
       "cpu": [
         "arm"
       ],
@@ -8606,9 +8679,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.34.8.tgz",
-      "integrity": "sha512-S0lqKLfTm5u+QTxlFiAnb2J/2dgQqRy/XvziPtDd1rKZFXHTyYLoVL58M/XFwDI01AQCDIevGLbQrMAtdyanpA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
+      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
       "cpu": [
         "arm"
       ],
@@ -8620,9 +8693,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.34.8.tgz",
-      "integrity": "sha512-jpz9YOuPiSkL4G4pqKrus0pn9aYwpImGkosRKwNi+sJSkz+WU3anZe6hi73StLOQdfXYXC7hUfsQlTnjMd3s1A==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
+      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
       "cpu": [
         "arm64"
       ],
@@ -8634,9 +8707,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.34.8.tgz",
-      "integrity": "sha512-KdSfaROOUJXgTVxJNAZ3KwkRc5nggDk+06P6lgi1HLv1hskgvxHUKZ4xtwHkVYJ1Rep4GNo+uEfycCRRxht7+Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
+      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
       "cpu": [
         "arm64"
       ],
@@ -8647,10 +8720,10 @@
         "linux"
       ]
     },
-    "node_modules/@rollup/rollup-linux-loongarch64-gnu": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.34.8.tgz",
-      "integrity": "sha512-NyF4gcxwkMFRjgXBM6g2lkT58OWztZvw5KkV2K0qqSnUEqCVcqdh2jN4gQrTn/YUpAcNKyFHfoOZEer9nwo6uQ==",
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
+      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
       "cpu": [
         "loong64"
       ],
@@ -8661,10 +8734,38 @@
         "linux"
       ]
     },
-    "node_modules/@rollup/rollup-linux-powerpc64le-gnu": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.34.8.tgz",
-      "integrity": "sha512-LMJc999GkhGvktHU85zNTDImZVUCJ1z/MbAJTnviiWmmjyckP5aQsHtcujMjpNdMZPT2rQEDBlJfubhs3jsMfw==",
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
+      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
+      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
+      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
       "cpu": [
         "ppc64"
       ],
@@ -8676,9 +8777,23 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.34.8.tgz",
-      "integrity": "sha512-xAQCAHPj8nJq1PI3z8CIZzXuXCstquz7cIOL73HHdXiRcKk8Ywwqtx2wrIy23EcTn4aZ2fLJNBB8d0tQENPCmw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
+      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
+      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
       "cpu": [
         "riscv64"
       ],
@@ -8690,9 +8805,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.34.8.tgz",
-      "integrity": "sha512-DdePVk1NDEuc3fOe3dPPTb+rjMtuFw89gw6gVWxQFAuEqqSdDKnrwzZHrUYdac7A7dXl9Q2Vflxpme15gUWQFA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
+      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
       "cpu": [
         "s390x"
       ],
@@ -8704,9 +8819,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.34.8.tgz",
-      "integrity": "sha512-8y7ED8gjxITUltTUEJLQdgpbPh1sUQ0kMTmufRF/Ns5tI9TNMNlhWtmPKKHCU0SilX+3MJkZ0zERYYGIVBYHIA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
       "cpu": [
         "x64"
       ],
@@ -8718,9 +8833,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.34.8.tgz",
-      "integrity": "sha512-SCXcP0ZpGFIe7Ge+McxY5zKxiEI5ra+GT3QRxL0pMMtxPfpyLAKleZODi1zdRHkz5/BhueUrYtYVgubqe9JBNQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
+      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
       "cpu": [
         "x64"
       ],
@@ -8731,10 +8846,38 @@
         "linux"
       ]
     },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
+      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
+      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.34.8.tgz",
-      "integrity": "sha512-YHYsgzZgFJzTRbth4h7Or0m5O74Yda+hLin0irAIobkLQFRQd1qWmnoVfwmKm9TXIZVAD0nZ+GEb2ICicLyCnQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
+      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
       "cpu": [
         "arm64"
       ],
@@ -8746,9 +8889,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.34.8.tgz",
-      "integrity": "sha512-r3NRQrXkHr4uWy5TOjTpTYojR9XmF0j/RYgKCef+Ag46FWUTltm5ziticv8LdNsDMehjJ543x/+TJAek/xBA2w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
+      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
       "cpu": [
         "ia32"
       ],
@@ -8759,10 +8902,24 @@
         "win32"
       ]
     },
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.34.8.tgz",
-      "integrity": "sha512-U0FaE5O1BCpZSeE6gBl3c5ObhePQSfk9vDRToMmTkbhCOgW4jqvtS5LGyQ76L1fH8sM0keRp4uDTsbjiUyjk0g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
+      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
       "cpu": [
         "x64"
       ],
@@ -8781,14 +8938,14 @@
       "license": "Apache-2.0"
     },
     "node_modules/@schematics/angular": {
-      "version": "19.2.9",
-      "resolved": "https://registry.npmjs.org/@schematics/angular/-/angular-19.2.9.tgz",
-      "integrity": "sha512-V5c8qycipodwbDX3lY0sbQaG2OKkO2HdjxL0K70TzcpEwnD4uVMs73PRaLtREASzpnSo6CKewQCsgPSgyzJCKw==",
+      "version": "19.2.27",
+      "resolved": "https://registry.npmjs.org/@schematics/angular/-/angular-19.2.27.tgz",
+      "integrity": "sha512-kJX5nyDjwo6iHQ+g/AJa+4SyHRSQyGgutpqXUIuYY2htGWVS1HUQlHfwAER5btjSNKe/iHgh4pzYGZfvJ2V6/A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-devkit/core": "19.2.9",
-        "@angular-devkit/schematics": "19.2.9",
+        "@angular-devkit/core": "19.2.27",
+        "@angular-devkit/schematics": "19.2.27",
         "jsonc-parser": "3.3.1"
       },
       "engines": {
@@ -9527,19 +9684,6 @@
       }
     },
     "node_modules/@types/express-serve-static-core": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.1.tgz",
-      "integrity": "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*",
-        "@types/qs": "*",
-        "@types/range-parser": "*",
-        "@types/send": "*"
-      }
-    },
-    "node_modules/@types/express/node_modules/@types/express-serve-static-core": {
       "version": "4.19.8",
       "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.8.tgz",
       "integrity": "sha512-02S5fmqeoKzVZCHPZid4b8JH2eM5HzQLZWN2FohQEy/0eXTq8VXZfSN6Pcr3F6N9R/vNrj7cpgbhjie6m/1tCA==",
@@ -10622,6 +10766,19 @@
         "node": ">=0.4.0"
       }
     },
+    "node_modules/acorn-import-phases": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/acorn-import-phases/-/acorn-import-phases-1.0.4.tgz",
+      "integrity": "sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.13.0"
+      },
+      "peerDependencies": {
+        "acorn": "^8.14.0"
+      }
+    },
     "node_modules/acorn-jsx": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
@@ -11893,13 +12050,14 @@
       }
     },
     "node_modules/body-parser/node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.15.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -11909,9 +12067,9 @@
       }
     },
     "node_modules/bonjour-service": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.3.0.tgz",
-      "integrity": "sha512-3YuAUiSkWykd+2Azjgyxei8OWf8thdn8AITIog2M4UICzoqfjlqr64WIjEXZllf/W6vK1goqleSR6brGomxQqA==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.4.2.tgz",
+      "integrity": "sha512-lMskhnsW70yWHr4PhPeh2rvaIkLSaDpp+nmtbXBZaNKTXwxL73QOkW6HhbzqTImXjevn9TreGT4GACGBCGP9nQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16217,9 +16375,9 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.21.4",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.4.tgz",
-      "integrity": "sha512-wE4fDO8OjJhrPFH69HUQStq5oKvGRTNXEyW+k5C/pUQLASSsTu7obd2V3GvCDgPcY9AWjhJ4jz9Kh7iRvrxhJg==",
+      "version": "5.24.1",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.1.tgz",
+      "integrity": "sha512-7DdUaTjmNwMcH2gLr1qycesKII3BK4RLy/mdAb7x10Lq7bR4aNKHt1BR1ZALSv0rPM/hF5wYF0PhGop/rJm8vw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16411,9 +16569,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
-      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -16515,9 +16673,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.1.tgz",
-      "integrity": "sha512-BGO5LtrGC7vxnqucAe/rmvKdJllfGaYWdyABvyMoXQlfYMb2bbRuReWR5tEGE//4LcNJj9XrkovTqNYRFZHAMQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
+      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -16528,37 +16686,38 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.25.1",
-        "@esbuild/android-arm": "0.25.1",
-        "@esbuild/android-arm64": "0.25.1",
-        "@esbuild/android-x64": "0.25.1",
-        "@esbuild/darwin-arm64": "0.25.1",
-        "@esbuild/darwin-x64": "0.25.1",
-        "@esbuild/freebsd-arm64": "0.25.1",
-        "@esbuild/freebsd-x64": "0.25.1",
-        "@esbuild/linux-arm": "0.25.1",
-        "@esbuild/linux-arm64": "0.25.1",
-        "@esbuild/linux-ia32": "0.25.1",
-        "@esbuild/linux-loong64": "0.25.1",
-        "@esbuild/linux-mips64el": "0.25.1",
-        "@esbuild/linux-ppc64": "0.25.1",
-        "@esbuild/linux-riscv64": "0.25.1",
-        "@esbuild/linux-s390x": "0.25.1",
-        "@esbuild/linux-x64": "0.25.1",
-        "@esbuild/netbsd-arm64": "0.25.1",
-        "@esbuild/netbsd-x64": "0.25.1",
-        "@esbuild/openbsd-arm64": "0.25.1",
-        "@esbuild/openbsd-x64": "0.25.1",
-        "@esbuild/sunos-x64": "0.25.1",
-        "@esbuild/win32-arm64": "0.25.1",
-        "@esbuild/win32-ia32": "0.25.1",
-        "@esbuild/win32-x64": "0.25.1"
+        "@esbuild/aix-ppc64": "0.28.0",
+        "@esbuild/android-arm": "0.28.0",
+        "@esbuild/android-arm64": "0.28.0",
+        "@esbuild/android-x64": "0.28.0",
+        "@esbuild/darwin-arm64": "0.28.0",
+        "@esbuild/darwin-x64": "0.28.0",
+        "@esbuild/freebsd-arm64": "0.28.0",
+        "@esbuild/freebsd-x64": "0.28.0",
+        "@esbuild/linux-arm": "0.28.0",
+        "@esbuild/linux-arm64": "0.28.0",
+        "@esbuild/linux-ia32": "0.28.0",
+        "@esbuild/linux-loong64": "0.28.0",
+        "@esbuild/linux-mips64el": "0.28.0",
+        "@esbuild/linux-ppc64": "0.28.0",
+        "@esbuild/linux-riscv64": "0.28.0",
+        "@esbuild/linux-s390x": "0.28.0",
+        "@esbuild/linux-x64": "0.28.0",
+        "@esbuild/netbsd-arm64": "0.28.0",
+        "@esbuild/netbsd-x64": "0.28.0",
+        "@esbuild/openbsd-arm64": "0.28.0",
+        "@esbuild/openbsd-x64": "0.28.0",
+        "@esbuild/openharmony-arm64": "0.28.0",
+        "@esbuild/sunos-x64": "0.28.0",
+        "@esbuild/win32-arm64": "0.28.0",
+        "@esbuild/win32-ia32": "0.28.0",
+        "@esbuild/win32-x64": "0.28.0"
       }
     },
     "node_modules/esbuild-wasm": {
-      "version": "0.25.1",
-      "resolved": "https://registry.npmjs.org/esbuild-wasm/-/esbuild-wasm-0.25.1.tgz",
-      "integrity": "sha512-dZxPeDHcDIQ6ilml/NzYxnPbNkoVsHSFH3JGLSobttc5qYYgExMo8lh2XcB+w+AfiqykVDGK5PWanGB0gWaAWw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/esbuild-wasm/-/esbuild-wasm-0.28.0.tgz",
+      "integrity": "sha512-5TRVKExcEmeMkccIZMzUq+Az6X2RoMAJyfl6SMMO1dMVhmvt0I2mx7gAb6zYi42n4d1ETcatFXazGKzA+aW7fg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -17205,13 +17364,14 @@
       }
     },
     "node_modules/express/node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.15.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -19327,9 +19487,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "5.1.5",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
-      "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
+      "version": "5.1.8",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.8.tgz",
+      "integrity": "sha512-TM5YqrGeTsVIPPpILzeqZ8D2Zc2TvNgSDi88zPF2a4cyqQdWV/wVWBDRDbNzzrLeRWScrFcOX9lW2iX6GOtUDw==",
       "dev": true,
       "license": "MIT"
     },
@@ -22764,14 +22924,14 @@
       }
     },
     "node_modules/launch-editor": {
-      "version": "2.13.2",
-      "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.13.2.tgz",
-      "integrity": "sha512-4VVDnbOpLXy/s8rdRCSXb+zfMeFR0WlJWpET1iA9CQdlZDfwyLjUuGQzXU4VeOoey6AicSAluWan7Etga6Kcmg==",
+      "version": "2.14.1",
+      "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.1.tgz",
+      "integrity": "sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "picocolors": "^1.1.1",
-        "shell-quote": "^1.8.3"
+        "shell-quote": "^1.8.4"
       }
     },
     "node_modules/lazy-ass": {
@@ -23698,20 +23858,20 @@
       }
     },
     "node_modules/memfs": {
-      "version": "4.57.2",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-4.57.2.tgz",
-      "integrity": "sha512-2nWzSsJzrukurSDna4Z0WywuScK4Id3tSKejgu74u8KCdW4uNrseKRSIDg75C6Yw5ZRqBe0F0EtMNlTbUq8bAQ==",
+      "version": "4.57.8",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-4.57.8.tgz",
+      "integrity": "sha512-bApYhn8BLpFAnAQmFfEl/NPN+8qx5Ar3V4Qt3ek23mVwBEElzV7c6XoPkb/PCG8ZFpowCEpHcPwMFTwHS7tSMA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@jsonjoy.com/fs-core": "4.57.2",
-        "@jsonjoy.com/fs-fsa": "4.57.2",
-        "@jsonjoy.com/fs-node": "4.57.2",
-        "@jsonjoy.com/fs-node-builtins": "4.57.2",
-        "@jsonjoy.com/fs-node-to-fsa": "4.57.2",
-        "@jsonjoy.com/fs-node-utils": "4.57.2",
-        "@jsonjoy.com/fs-print": "4.57.2",
-        "@jsonjoy.com/fs-snapshot": "4.57.2",
+        "@jsonjoy.com/fs-core": "4.57.8",
+        "@jsonjoy.com/fs-fsa": "4.57.8",
+        "@jsonjoy.com/fs-node": "4.57.8",
+        "@jsonjoy.com/fs-node-builtins": "4.57.8",
+        "@jsonjoy.com/fs-node-to-fsa": "4.57.8",
+        "@jsonjoy.com/fs-node-utils": "4.57.8",
+        "@jsonjoy.com/fs-print": "4.57.8",
+        "@jsonjoy.com/fs-snapshot": "4.57.8",
         "@jsonjoy.com/json-pack": "^1.11.0",
         "@jsonjoy.com/util": "^1.9.0",
         "glob-to-regex.js": "^1.0.1",
@@ -24278,9 +24438,9 @@
       "license": "MIT"
     },
     "node_modules/msgpackr": {
-      "version": "1.11.12",
-      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.11.12.tgz",
-      "integrity": "sha512-RBdJ1Un7yGlXWajrkxcSa93nvQ0w4zBf60c0yYv7YtBelP8H2FA7XsfBbMHtXKXUMUxH7zV3Zuozh+kUQWhHvg==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.12.1.tgz",
+      "integrity": "sha512-4EUH9tQHnMmEgzW/MdAP0KIfa1T9AF+htl0ffe2n5vb2EKn9y2co8ccpgWko6S52Jy1PQZKwRnx5/KkYjtd9MQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -24289,9 +24449,9 @@
       }
     },
     "node_modules/msgpackr-extract": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.3.tgz",
-      "integrity": "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.4.tgz",
+      "integrity": "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -24303,12 +24463,12 @@
         "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
       },
       "optionalDependencies": {
-        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3"
+        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4"
       }
     },
     "node_modules/multicast-dns": {
@@ -26162,9 +26322,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.2",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.2.tgz",
-      "integrity": "sha512-MjOadfU3Ys9KYoX0AdkBlFEF1Vx37uCCeN4ZHnmwm9FfpbsGWMZeBLMmmpY+6Ocqod7mkdZ0DT31OlbsFrLlkA==",
+      "version": "8.5.12",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
       "dev": true,
       "funding": [
         {
@@ -26182,7 +26342,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.8",
+        "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -27491,13 +27651,13 @@
       "license": "Unlicense"
     },
     "node_modules/rollup": {
-      "version": "4.34.8",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.34.8.tgz",
-      "integrity": "sha512-489gTVMzAYdiZHFVA/ig/iYFllCcWFHMvUHI1rpFmkoUtRlQxqh6/yiNqnYibjMZ2b/+FUQwldG+aLsEt6bglQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
+      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.6"
+        "@types/estree": "1.0.8"
       },
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -27507,32 +27667,38 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.34.8",
-        "@rollup/rollup-android-arm64": "4.34.8",
-        "@rollup/rollup-darwin-arm64": "4.34.8",
-        "@rollup/rollup-darwin-x64": "4.34.8",
-        "@rollup/rollup-freebsd-arm64": "4.34.8",
-        "@rollup/rollup-freebsd-x64": "4.34.8",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.34.8",
-        "@rollup/rollup-linux-arm-musleabihf": "4.34.8",
-        "@rollup/rollup-linux-arm64-gnu": "4.34.8",
-        "@rollup/rollup-linux-arm64-musl": "4.34.8",
-        "@rollup/rollup-linux-loongarch64-gnu": "4.34.8",
-        "@rollup/rollup-linux-powerpc64le-gnu": "4.34.8",
-        "@rollup/rollup-linux-riscv64-gnu": "4.34.8",
-        "@rollup/rollup-linux-s390x-gnu": "4.34.8",
-        "@rollup/rollup-linux-x64-gnu": "4.34.8",
-        "@rollup/rollup-linux-x64-musl": "4.34.8",
-        "@rollup/rollup-win32-arm64-msvc": "4.34.8",
-        "@rollup/rollup-win32-ia32-msvc": "4.34.8",
-        "@rollup/rollup-win32-x64-msvc": "4.34.8",
+        "@rollup/rollup-android-arm-eabi": "4.59.0",
+        "@rollup/rollup-android-arm64": "4.59.0",
+        "@rollup/rollup-darwin-arm64": "4.59.0",
+        "@rollup/rollup-darwin-x64": "4.59.0",
+        "@rollup/rollup-freebsd-arm64": "4.59.0",
+        "@rollup/rollup-freebsd-x64": "4.59.0",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
+        "@rollup/rollup-linux-arm-musleabihf": "4.59.0",
+        "@rollup/rollup-linux-arm64-gnu": "4.59.0",
+        "@rollup/rollup-linux-arm64-musl": "4.59.0",
+        "@rollup/rollup-linux-loong64-gnu": "4.59.0",
+        "@rollup/rollup-linux-loong64-musl": "4.59.0",
+        "@rollup/rollup-linux-ppc64-gnu": "4.59.0",
+        "@rollup/rollup-linux-ppc64-musl": "4.59.0",
+        "@rollup/rollup-linux-riscv64-gnu": "4.59.0",
+        "@rollup/rollup-linux-riscv64-musl": "4.59.0",
+        "@rollup/rollup-linux-s390x-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-musl": "4.59.0",
+        "@rollup/rollup-openbsd-x64": "4.59.0",
+        "@rollup/rollup-openharmony-arm64": "4.59.0",
+        "@rollup/rollup-win32-arm64-msvc": "4.59.0",
+        "@rollup/rollup-win32-ia32-msvc": "4.59.0",
+        "@rollup/rollup-win32-x64-gnu": "4.59.0",
+        "@rollup/rollup-win32-x64-msvc": "4.59.0",
         "fsevents": "~2.3.2"
       }
     },
     "node_modules/rollup/node_modules/@types/estree": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.6.tgz",
-      "integrity": "sha512-AYnb1nQyY49te+VRAVgmzfcgjYS91mY5P0TKUDCLEM+gNnA+3T6rWITXRLYCpahpqSQbN5cE+gHpnPyXjHWxcw==",
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "dev": true,
       "license": "MIT"
     },
@@ -28339,9 +28505,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.3",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
-      "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
+      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28352,15 +28518,15 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -30045,9 +30211,9 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.6.0.tgz",
-      "integrity": "sha512-Eum+5ajkaOhf5KbM26osvv21kLD7BaGqQ1UA4Ami4arYwylmGUQTgHFpHDdmJod1q4QXa66p0to/FBKID+J1vA==",
+      "version": "5.6.1",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz",
+      "integrity": "sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31407,15 +31573,18 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.2.6",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.6.tgz",
-      "integrity": "sha512-9xpjNl3kR4rVDZgPNdTL0/c6ao4km69a/2ihNQbcANz8RuCOK3hQBmLSJf3bRKVQjVMda+YvizNE8AwvogcPbw==",
+      "version": "6.4.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
+      "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "esbuild": "^0.25.0",
+        "fdir": "^6.4.4",
+        "picomatch": "^4.0.2",
         "postcss": "^8.5.3",
-        "rollup": "^4.30.1"
+        "rollup": "^4.34.9",
+        "tinyglobby": "^0.2.13"
       },
       "bin": {
         "vite": "bin/vite.js"
@@ -31478,43 +31647,488 @@
         }
       }
     },
-    "node_modules/vite/node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
+    "node_modules/vite/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "nanoid": "^3.3.11",
-        "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
-      },
+      "optional": true,
+      "os": [
+        "aix"
+      ],
       "engines": {
-        "node": "^10 || ^12 || >=14"
+        "node": ">=18"
       }
     },
-    "node_modules/vite/node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+    "node_modules/vite/node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
       "dev": true,
-      "license": "BSD-3-Clause",
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/esbuild": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
       }
     },
     "node_modules/vm-browserify": {
@@ -31952,35 +32566,37 @@
       }
     },
     "node_modules/webpack": {
-      "version": "5.98.0",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.98.0.tgz",
-      "integrity": "sha512-UFynvx+gM44Gv9qFgj0acCQK2VE1CtdfwFdimkapco3hlPCJ/zeq73n2yVKimVbtm+TnApIugGhLJnkU6gjYXA==",
+      "version": "5.105.0",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.0.tgz",
+      "integrity": "sha512-gX/dMkRQc7QOMzgTe6KsYFM7DxeIONQSui1s0n/0xht36HvrgbxtM1xBlgx596NbpHuQU8P7QpKwrZYwUX48nw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/eslint-scope": "^3.7.7",
-        "@types/estree": "^1.0.6",
+        "@types/estree": "^1.0.8",
+        "@types/json-schema": "^7.0.15",
         "@webassemblyjs/ast": "^1.14.1",
         "@webassemblyjs/wasm-edit": "^1.14.1",
         "@webassemblyjs/wasm-parser": "^1.14.1",
-        "acorn": "^8.14.0",
-        "browserslist": "^4.24.0",
+        "acorn": "^8.15.0",
+        "acorn-import-phases": "^1.0.3",
+        "browserslist": "^4.28.1",
         "chrome-trace-event": "^1.0.2",
-        "enhanced-resolve": "^5.17.1",
-        "es-module-lexer": "^1.2.1",
+        "enhanced-resolve": "^5.19.0",
+        "es-module-lexer": "^2.0.0",
         "eslint-scope": "5.1.1",
         "events": "^3.2.0",
         "glob-to-regexp": "^0.4.1",
         "graceful-fs": "^4.2.11",
         "json-parse-even-better-errors": "^2.3.1",
-        "loader-runner": "^4.2.0",
+        "loader-runner": "^4.3.1",
         "mime-types": "^2.1.27",
         "neo-async": "^2.6.2",
-        "schema-utils": "^4.3.0",
-        "tapable": "^2.1.1",
-        "terser-webpack-plugin": "^5.3.11",
-        "watchpack": "^2.4.1",
-        "webpack-sources": "^3.2.3"
+        "schema-utils": "^4.3.3",
+        "tapable": "^2.3.0",
+        "terser-webpack-plugin": "^5.3.16",
+        "watchpack": "^2.5.1",
+        "webpack-sources": "^3.3.3"
       },
       "bin": {
         "webpack": "bin/webpack.js"
@@ -32042,15 +32658,16 @@
       }
     },
     "node_modules/webpack-dev-server": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.0.tgz",
-      "integrity": "sha512-90SqqYXA2SK36KcT6o1bvwvZfJFcmoamqeJY7+boioffX9g9C0wjjJRGUrQIuh43pb0ttX7+ssavmj/WN2RHtA==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.2.tgz",
+      "integrity": "sha512-QcQ72gh8a+7JO63TAx/6XZf/CWhgMzu5m0QirvPfGvptOusAxG12w2+aua1Jkjr7hzaWDnJ2n6JFeexMHI+Zjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/bonjour": "^3.5.13",
         "@types/connect-history-api-fallback": "^1.5.4",
         "@types/express": "^4.17.21",
+        "@types/express-serve-static-core": "^4.17.21",
         "@types/serve-index": "^1.9.4",
         "@types/serve-static": "^1.15.5",
         "@types/sockjs": "^0.3.36",
@@ -32063,7 +32680,7 @@
         "connect-history-api-fallback": "^2.0.0",
         "express": "^4.21.2",
         "graceful-fs": "^4.2.6",
-        "http-proxy-middleware": "^2.0.7",
+        "http-proxy-middleware": "^2.0.9",
         "ipaddr.js": "^2.1.0",
         "launch-editor": "^2.6.1",
         "open": "^10.0.3",
@@ -32154,9 +32771,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/http-proxy-middleware": {
-      "version": "2.0.9",
-      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.9.tgz",
-      "integrity": "sha512-c1IyJYLYppU574+YI7R4QyX2ystMtVXZwIdzazUIPIJsHuWNd+mho2j+bKoHftndicGj9yh+xjd+l0yj7VeT1Q==",
+      "version": "2.0.10",
+      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.10.tgz",
+      "integrity": "sha512-RKzRWNPxUZqbuk3BC5mGVJbBnWgr+diEnjJexIOytFbBzDy88Fbh/YvBr3DsNrl1jYAfjWfpATEv0NO35FDuPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32233,9 +32850,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32342,6 +32959,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/webpack/node_modules/watchpack": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.2.tgz",
+      "integrity": "sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.1.2"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
     "node_modules/websocket-driver": {
       "version": "0.7.4",
       "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz",
@@ -32826,9 +33456,9 @@
       }
     },
     "node_modules/zone.js": {
-      "version": "0.14.10",
-      "resolved": "https://registry.npmjs.org/zone.js/-/zone.js-0.14.10.tgz",
-      "integrity": "sha512-YGAhaO7J5ywOXW6InXNlLmfU194F8lVgu7bRntUF3TiG8Y3nBK0x1UJJuHUP/e8IyihkjCYqhCScpSwnlaSRkQ==",
+      "version": "0.15.1",
+      "resolved": "https://registry.npmjs.org/zone.js/-/zone.js-0.15.1.tgz",
+      "integrity": "sha512-XE96n56IQpJM7NAoXswY3XRLcWFW83xe0BiAOeMD7K5k5xecOeul3Qcpx6GqEeeHNkW5DWL5zOyTbEfB4eti8w==",
       "license": "MIT"
     }
   }
diff --git a/src/pybind/mgr/dashboard/frontend/package.json b/src/pybind/mgr/dashboard/frontend/package.json
index 18fc33addf6..0d17c20e365 100644
--- a/src/pybind/mgr/dashboard/frontend/package.json
+++ b/src/pybind/mgr/dashboard/frontend/package.json
@@ -44,15 +44,15 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "19.2.9",
-    "@angular/common": "19.2.9",
-    "@angular/compiler": "19.2.9",
-    "@angular/core": "19.2.9",
-    "@angular/forms": "19.2.9",
-    "@angular/localize": "19.2.9",
-    "@angular/platform-browser": "19.2.9",
-    "@angular/platform-browser-dynamic": "19.2.9",
-    "@angular/router": "19.2.9",
+    "@angular/animations": "19.2.25",
+    "@angular/common": "19.2.25",
+    "@angular/compiler": "19.2.25",
+    "@angular/core": "19.2.25",
+    "@angular/forms": "19.2.25",
+    "@angular/localize": "19.2.25",
+    "@angular/platform-browser": "19.2.25",
+    "@angular/platform-browser-dynamic": "19.2.25",
+    "@angular/router": "19.2.25",
     "@carbon/charts-angular": "1.23.9",
     "@carbon/icons": "11.63.0",
     "@carbon/styles": "1.83.0",
@@ -82,20 +82,20 @@
     "timers-browserify": "2.0.12",
     "tslib": "2.6.2",
     "xml2js": "0.6.2",
-    "zone.js": "0.14.10"
+    "zone.js": "0.15.1"
   },
   "devDependencies": {
-    "@angular-devkit/build-angular": "19.2.9",
-    "@angular-devkit/core": "19.2.9",
-    "@angular-devkit/schematics": "19.2.9",
+    "@angular-devkit/build-angular": "19.2.27",
+    "@angular-devkit/core": "19.2.27",
+    "@angular-devkit/schematics": "19.2.27",
     "@angular-eslint/builder": "18.4.0",
     "@angular-eslint/eslint-plugin": "18.4.0",
     "@angular-eslint/eslint-plugin-template": "18.4.0",
     "@angular-eslint/schematics": "18.4.0",
     "@angular-eslint/template-parser": "18.4.0",
-    "@angular/cli": "19.2.9",
-    "@angular/compiler-cli": "19.2.9",
-    "@angular/language-service": "19.2.9",
+    "@angular/cli": "19.2.27",
+    "@angular/compiler-cli": "19.2.25",
+    "@angular/language-service": "19.2.25",
     "@applitools/eyes-cypress": "3.52.0",
     "@compodoc/compodoc": "1.1.26",
     "@cypress/browserify-preprocessor": "3.0.2",
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss
index 49596dbb1e8..1a672579f5e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss
@@ -34,10 +34,10 @@
     background-image:
       // cyan left edge
       radial-gradient(120% 60% at -15% 100%, rgba(colors.$cyan-60, 0.13) 0%, transparent 65%),
-      // cyan right edge
-      radial-gradient(120% 60% at 115% 100%, rgba(colors.$cyan-60, 0.1) 0%, transparent 65%),
-      // pink center
-      radial-gradient(120% 60% at 50% 100%, rgba(colors.$magenta-60, 0.11) 0%, transparent 70%);
+      /* cyan right edge*/
+        radial-gradient(120% 60% at 115% 100%, rgba(colors.$cyan-60, 0.1) 0%, transparent 65%),
+      /* pink center*/
+        radial-gradient(120% 60% at 50% 100%, rgba(colors.$magenta-60, 0.11) 0%, transparent 70%);
     box-shadow: var(--cds-ai-drop-shadow), inset 0 0 0 1px var(--cds-ai-inner-shadow);
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/styles/themes/_default.scss b/src/pybind/mgr/dashboard/frontend/src/styles/themes/_default.scss
index 1cd8dcf9dad..d0a6396afeb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/styles/themes/_default.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/styles/themes/_default.scss
@@ -39,8 +39,7 @@ $base: (
   support-info: vv.$info,
   notification-background-info: vv.$info,
   button-danger-primary: vv.$danger,
-  // Sizes
-  heading-03: 1.75rem,
+  /* Sizes*/ heading-03: 1.75rem,
   spacing-03: 0.5rem
 );
 

From fcbbca8949a97aa73bf59f318acd449f103b415c Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Wed, 8 Jul 2026 10:51:50 +0530
Subject: [PATCH 561/596] mgr/dashboard: teardown http requests for
 feature-toggle

angular 19.2.latest is aggressively tearing down the test env which
forces the active rxjs timer to emit one execution as it collapses which
produces a ghost http in the case of request wrapped in the timer
service. so for now flushing all the requests manually to prevent it

Fixes: https://tracker.ceph.com/issues/77729
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../src/app/shared/services/feature-toggles.service.spec.ts      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.spec.ts
index ddb8888512a..996e7fe3217 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.spec.ts
@@ -19,6 +19,7 @@ describe('FeatureTogglesService', () => {
   });
 
   afterEach(() => {
+    httpTesting.match(() => true).forEach((req) => req.flush({}));
     httpTesting.verify();
   });
 

From d0dc93a22eb05f06272e8a104f1c1efeae1add25 Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Wed, 8 Jul 2026 12:27:06 +0700
Subject: [PATCH 562/596] doc: fix Sphinx complaints and some rendering errors

Fix 25 criticals, errors, and warnings from Sphinx.
Some of the changes did not change rendering but most fixed unintended
rendering, broken link etc.
Change Mon to Monitor in ceph-secrets.rst.

Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 doc/cephadm/host-management.rst                         | 8 ++++----
 doc/cephadm/upgrade.rst                                 | 2 +-
 doc/dev/crimson/seastore_laddr.rst                      | 3 ++-
 doc/dev/osd_internals/erasure_coding/client_support.rst | 4 ++--
 doc/dev/release-process.rst                             | 2 +-
 doc/man/8/cephadm.rst                                   | 2 +-
 doc/mgr/ceph_secrets.rst                                | 9 +++------
 doc/rados/troubleshooting/troubleshooting-mon.rst       | 2 +-
 doc/radosgw/adminops.rst                                | 2 +-
 doc/radosgw/encryption.rst                              | 4 ++++
 10 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/doc/cephadm/host-management.rst b/doc/cephadm/host-management.rst
index 0fd4f1284e0..9c65810fdb5 100644
--- a/doc/cephadm/host-management.rst
+++ b/doc/cephadm/host-management.rst
@@ -689,7 +689,7 @@ requires the bare host name when adding a host to the cluster:
 ``ceph orch host add <bare-name>``.
 
 Sudo Hardening
-=============
+==============
 
 Cephadm supports sudo hardening to enhance security by restricting sudo privilege
 escalation for non-root SSH users. When sudo hardening is enabled, cephadm uses the
@@ -697,7 +697,7 @@ escalation for non-root SSH users. When sudo hardening is enabled, cephadm uses
 privilege escalation.
 
 Enabling Sudo Hardening
-----------------------
+-----------------------
 
 To enable sudo hardening for the entire cluster, use the following command:
 
@@ -730,7 +730,7 @@ You can manually prepare a host for sudo hardening using:
    access will be used for ongoing operations.
 
 Sudo Hardening Workflow
-----------------------
+-----------------------
 
 When sudo hardening is enabled, the following workflow is used:
 
@@ -770,7 +770,7 @@ Sudo hardening provides the following security benefits:
 
 
 Disabling Sudo Hardening
------------------------
+------------------------
 
 To disable sudo hardening:
 
diff --git a/doc/cephadm/upgrade.rst b/doc/cephadm/upgrade.rst
index 5d7d7e44b4a..54f2a304345 100644
--- a/doc/cephadm/upgrade.rst
+++ b/doc/cephadm/upgrade.rst
@@ -136,7 +136,7 @@ Requirements:
   (same shape as ``ceph_version_short`` in ``ceph osd metadata``).
 * If the Monitors indicate to cephadm that no OSDs in the selected CRUSH bucket
   are okay to upgrade, cephadm will log details and then retry the operation.
-*  If the bucket parameters for a ceph ``osd ok-to-upgrade`` upgrade are not provided,
+* If the bucket parameters for a ceph ``osd ok-to-upgrade`` upgrade are not provided,
   cephadm will fall back to the default ceph osd ok-to-stop gate for OSD upgrades.
 * Bucket-scope upgrades apply only to OSDs. CRUSH buckets do not influence upgrades
   of other daemon types, for example Monitors, Managers, and MDSes.
diff --git a/doc/dev/crimson/seastore_laddr.rst b/doc/dev/crimson/seastore_laddr.rst
index 477aca7a865..ef228720b38 100644
--- a/doc/dev/crimson/seastore_laddr.rst
+++ b/doc/dev/crimson/seastore_laddr.rst
@@ -201,7 +201,8 @@ after the upgrade finishes.
 
 TODO: fsck/tooling must support scanning and migrating all mappings
 between upgrades.
-             //create tracker after PR merged/ready.
+
+//create tracker after PR merged/ready.
 
 Multi-push Recovery
 -------------------
diff --git a/doc/dev/osd_internals/erasure_coding/client_support.rst b/doc/dev/osd_internals/erasure_coding/client_support.rst
index 96c84bd7432..5ce50348aec 100644
--- a/doc/dev/osd_internals/erasure_coding/client_support.rst
+++ b/doc/dev/osd_internals/erasure_coding/client_support.rst
@@ -466,7 +466,7 @@ These operations provide the same semantics as in replicated pools, ensuring
 compatibility with existing applications.
 
 Read Operation Flow
-~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~
 
 Read operations follow a simple flow:
 
@@ -906,7 +906,7 @@ Required Settings
 
 To enable the new features, the following OSDMap pool settings are required:
 
-- ``allows_ec_overwrites = true`
+- ``allows_ec_overwrites = true``
 - ``allows_ec_optimizations = true``
 - ``supports_omap = true``
 
diff --git a/doc/dev/release-process.rst b/doc/dev/release-process.rst
index 15ac516c23d..4dd13d09db1 100644
--- a/doc/dev/release-process.rst
+++ b/doc/dev/release-process.rst
@@ -88,7 +88,7 @@ Once QE has determined a stopping point in the working (e.g., ``squid``) branch,
 Notify the "Build Lead" that the release branch is ready.
 
 2a. Starting the build
-=====================
+======================
 
 We'll use a stable/regular 19.2.2 release of Squid as an example throughout this document.
 
diff --git a/doc/man/8/cephadm.rst b/doc/man/8/cephadm.rst
index 5843448d19d..a2030ff3c7e 100644
--- a/doc/man/8/cephadm.rst
+++ b/doc/man/8/cephadm.rst
@@ -458,7 +458,7 @@ Arguments:
 
 
 prepare-host-sudo-hardening
---------------------------
+---------------------------
 
 Prepare a host for sudo hardening by authorizing SSH keys, installing/upgrading
 the cephadm package, and setting up restricted sudoers permissions::
diff --git a/doc/mgr/ceph_secrets.rst b/doc/mgr/ceph_secrets.rst
index 45675c002d2..dc8b7c6167c 100644
--- a/doc/mgr/ceph_secrets.rst
+++ b/doc/mgr/ceph_secrets.rst
@@ -25,7 +25,7 @@ service spec instead of the plaintext token.  A cephadm integration can then
 resolve the URI at deploy time and write the token only into the daemon files
 that need it.
 
-Secrets are stored in the Mon KV store under the ``secret_store/v1/`` prefix
+Secrets are stored in the Monitor KV store under the ``secret_store/v1/`` prefix
 and are organised by namespace, scope, and name.  Each secret is versioned and
 carries ``created``/``updated`` timestamps.  A per-namespace epoch counter
 is incremented on every ``set`` and on any ``rm`` that actually removes a
@@ -34,7 +34,7 @@ list.
 
 .. note::
 
-   The ``mon`` backend stores secrets in the Mon KV store, which is not an
+   The ``mon`` backend stores secrets in the Monitor KV store, which is not an
    external KMS or vault.  Users and MGR modules with sufficient Ceph
    permissions can still reveal or resolve stored secret values.  Namespaces
    provide logical and storage isolation, not an authorisation boundary.
@@ -429,9 +429,6 @@ Configuration
 .. mgr_module:: ceph_secrets
 .. confval:: secrets_backend
 
-   :type: str
-   :default: ``mon``
-
-   The storage backend used for secrets.  Currently only the Mon KV store
+   The storage backend used for secrets.  Currently only the Monitor KV store
    (``mon``) is supported.  This option is reserved for future backends
    (e.g. HashiCorp Vault).
diff --git a/doc/rados/troubleshooting/troubleshooting-mon.rst b/doc/rados/troubleshooting/troubleshooting-mon.rst
index 791b8a7b53a..55e68be5e75 100644
--- a/doc/rados/troubleshooting/troubleshooting-mon.rst
+++ b/doc/rados/troubleshooting/troubleshooting-mon.rst
@@ -565,7 +565,7 @@ from a service shell), the restored ``kv_backend`` file and the rehydrated
 them.
 
 Restoring a multi-monitor cluster
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Each monitor has its own Paxos state (rank, accepted proposal numbers,
 ``last_committed``), so backups are per-monitor: a backup taken from
diff --git a/doc/radosgw/adminops.rst b/doc/radosgw/adminops.rst
index 17da43773a0..20fce8a7894 100644
--- a/doc/radosgw/adminops.rst
+++ b/doc/radosgw/adminops.rst
@@ -2946,7 +2946,7 @@ CLI commands.
 
 To view dedup status, the user must have ``dedup=read`` capability. To
 control dedup operations, the user must have ``dedup=write`` capability.
-See the `Admin Guide`_ for details.
+See the :ref:`radosgw-admin-guide` for details.
 
 Get Dedup Stats
 ~~~~~~~~~~~~~~~
diff --git a/doc/radosgw/encryption.rst b/doc/radosgw/encryption.rst
index df91e38de99..1bd07af26ff 100644
--- a/doc/radosgw/encryption.rst
+++ b/doc/radosgw/encryption.rst
@@ -160,6 +160,7 @@ Secrets are stored using the `Linux Kernel Key Retention Service`_ in
 the RGW processes' process keyring. This is subject to a global quota
 and must be set in accordance with the configured cache size.
 Depending on whether RGW runs as root, these quotas can be managed by adjusting:
+
 - ``/proc/sys/kernel/keys/root_maxkeys`` and ``/proc/sys/kernel/keys/root_maxbytes``
 - ``/proc/sys/kernel/keys/maxkeys`` and ``/proc/sys/kernel/keys/maxbytes``
 
@@ -167,6 +168,7 @@ Exceeding a quota will disable the cache, fail the request with an
 internal error, and log a failure message.
 
 Three different Cache Time-to-Live (TTL) values can be set:
+
 - **Positive TTL**: How long a successfully retrieved secret remains
   in the cache.
 - **Negative TTL**: How long to remember that a key does not exist,
@@ -178,6 +180,7 @@ Metrics
 ---------
 
 The cache exports metrics under the ``kms-cache`` collection.
+
 - ``hit``: Hit counter
 - ``miss``:  Miss counter
 - ``expired``: Number of TTL expired entries
@@ -187,6 +190,7 @@ The cache exports metrics under the ``kms-cache`` collection.
   ``miss``, ``expired``
 
 In addition the ``rgw`` collection has:
+
 - ``kms_fetch_lat``: Average KMS fetch latency. Also includes a
   successful request counter. Each event results in a positive cache
   entry.

From 95b56b2a43a4876fd030c1146a1977fb6fc61689 Mon Sep 17 00:00:00 2001
From: Aashish Sharma <aashish@li-e9bf2ecc-2ad7-11b2-a85c-baf05c5182ab.ibm.com>
Date: Wed, 8 Jul 2026 17:19:31 +0530
Subject: [PATCH 563/596] mgr/dashboard: fix RGW - Export realm token form

When there are multiple realms in rgw multi-site, the realm name/token fields overflow the modal content area

Fixes: https://tracker.ceph.com/issues/78051

Signed-off-by: Aashish Sharma <aasharma@redhat.com>
---
 .../rgw-multisite-export.component.html       | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html
index 2bad5d8ed1c..df49b0ea56d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html
@@ -1,5 +1,5 @@
 <cds-modal
-  size="sm"
+  size="md"
   [open]="open"
   [hasScrollingContent]="true"
   (overlaySelected)="closeModal()"
@@ -11,13 +11,13 @@
       Export multi-site realm token
   </cds-modal-header>
 
-  <ng-container *cdFormLoading="loading">
+  <div cdsModalContent>
     <form
       name="exportTokenForm"
       [formGroup]="exportTokenForm"
       novalidate
     >
-      <div cdsModalContent>
+      <ng-container *cdFormLoading="loading">
         <div class="form-item">
           @if (!tokenValid) {
           <cd-alert-panel
@@ -77,13 +77,13 @@
           </div>
         </div>
         }
-      </div>
-      <cd-form-button-panel
-        [modalForm]="true"
-        [showSubmit]="false"
-        (backActionEvent)="closeModal()"
-      >
-      </cd-form-button-panel>
+      </ng-container>
     </form>
-  </ng-container>
+  </div>
+  <cd-form-button-panel
+    [modalForm]="true"
+    [showSubmit]="false"
+    (backActionEvent)="closeModal()"
+  >
+  </cd-form-button-panel>
 </cds-modal>

From d5b730736f58c232f6b314ece7815e3246f76055 Mon Sep 17 00:00:00 2001
From: Shwetha Acharya <shwetha174@gmail.com>
Date: Fri, 3 Jul 2026 12:26:34 +0530
Subject: [PATCH 564/596] mgr/smb: add fruit:nfs_aces=no for macOS
 compatibility mode

When macOS client compatibility is enabled, add the global Samba
configuration option 'fruit:nfs_aces = no' to disable NFS ACE
handling in the fruit VFS module. This improves compatibility
with macOS SMB clients by preventing conflicts between NFS-style
ACLs and macOS extended attributes.

The configuration is automatically applied when:
- Creating a new cluster with --client-compat=macos
- Updating an existing cluster to macOS mode

Signed-off-by: Shwetha K Acharya <Shwetha.K.Acharya@ibm.com>
---
 src/pybind/mgr/smb/handler.py            |  5 ++
 src/pybind/mgr/smb/tests/test_handler.py | 88 ++++++++++++++++++++++++
 2 files changed, 93 insertions(+)

diff --git a/src/pybind/mgr/smb/handler.py b/src/pybind/mgr/smb/handler.py
index a6270243ba9..ec081aad4d8 100644
--- a/src/pybind/mgr/smb/handler.py
+++ b/src/pybind/mgr/smb/handler.py
@@ -1176,6 +1176,11 @@ def _generate_config(conf: _ClusterConf) -> Dict[str, Any]:
     cluster_global_opts['smb ports'] = str(_smb_port(cluster))
     _set_debug_level(cluster_global_opts, conf)
 
+    # Disable NFS ACE handling for macOS compatibility
+    # See https://tracker.ceph.com/issues/78052 for rationale and follow-up.
+    if cluster.is_macos_compatibility_enabled:
+        cluster_global_opts['fruit:nfs_aces'] = 'no'
+
     # Check if cluster has RGW shares and add global RGW options
     has_rgw_shares = any(share.resource.rgw for share in conf.shares)
     if has_rgw_shares:
diff --git a/src/pybind/mgr/smb/tests/test_handler.py b/src/pybind/mgr/smb/tests/test_handler.py
index eb470cdc414..1564605c655 100644
--- a/src/pybind/mgr/smb/tests/test_handler.py
+++ b/src/pybind/mgr/smb/tests/test_handler.py
@@ -1824,3 +1824,91 @@ def test_apply_share_with_qos(thandler):
     assert share_dict['cephfs']['qos']['write_bw_limit'] == "2097152"
     assert share_dict['cephfs']['qos']['read_burst_mult'] == 20
     assert share_dict['cephfs']['qos']['write_burst_mult'] == 15
+
+
+def test_generate_config_macos_compat(thandler):
+    """Test that macOS compatibility adds fruit:nfs_aces = no to global config."""
+    thandler.internal_store.overwrite(
+        {
+            'clusters.foo': {
+                'resource_type': 'ceph.smb.cluster',
+                'cluster_id': 'foo',
+                'auth_mode': 'user',
+                'intent': 'present',
+                'client_compat': 'macos',
+                'user_group_settings': [
+                    {
+                        'source_type': 'empty',
+                    }
+                ],
+            },
+            'shares.foo.s1': {
+                'resource_type': 'ceph.smb.share',
+                'cluster_id': 'foo',
+                'share_id': 's1',
+                'intent': 'present',
+                'name': 'MacShare',
+                'readonly': False,
+                'browseable': True,
+                'cephfs': {
+                    'volume': 'cephfs',
+                    'path': '/',
+                    'provider': 'samba-vfs',
+                },
+            },
+        }
+    )
+
+    thandler._sync_clusters(['foo'])
+    cfg = thandler.public_store['foo', 'config.smb'].get()
+    assert cfg
+    # Verify fruit:nfs_aces is set to 'no' in global options
+    assert cfg['globals']['foo']['options']['fruit:nfs_aces'] == 'no'
+    # Verify VFS modules include fruit and streams_xattr
+    share_vfs = cfg['shares']['MacShare']['options']['vfs objects']
+    assert 'fruit' in share_vfs
+    assert 'streams_xattr' in share_vfs
+
+
+def test_generate_config_default_compat(thandler):
+    """Test that default compatibility does not add fruit:nfs_aces."""
+    thandler.internal_store.overwrite(
+        {
+            'clusters.foo': {
+                'resource_type': 'ceph.smb.cluster',
+                'cluster_id': 'foo',
+                'auth_mode': 'user',
+                'intent': 'present',
+                'client_compat': 'default',
+                'user_group_settings': [
+                    {
+                        'source_type': 'empty',
+                    }
+                ],
+            },
+            'shares.foo.s1': {
+                'resource_type': 'ceph.smb.share',
+                'cluster_id': 'foo',
+                'share_id': 's1',
+                'intent': 'present',
+                'name': 'DefaultShare',
+                'readonly': False,
+                'browseable': True,
+                'cephfs': {
+                    'volume': 'cephfs',
+                    'path': '/',
+                    'provider': 'samba-vfs',
+                },
+            },
+        }
+    )
+
+    thandler._sync_clusters(['foo'])
+    cfg = thandler.public_store['foo', 'config.smb'].get()
+    assert cfg
+    # Verify fruit:nfs_aces is NOT in global options
+    assert 'fruit:nfs_aces' not in cfg['globals']['foo']['options']
+    # Verify VFS modules do NOT include fruit and streams_xattr
+    share_vfs = cfg['shares']['DefaultShare']['options']['vfs objects']
+    assert 'fruit' not in share_vfs
+    assert 'streams_xattr' not in share_vfs

From 77356f1f789ea916d18b9a32b588d06449564eaf Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Wed, 8 Jul 2026 16:59:30 +0700
Subject: [PATCH 565/596] doc: remove unused readthedocs-sphinx-search

Remove readthedocs-sphinx-search from the RTD build environment because
it seems to be unused and unsupported.

RTD has archived the readthedocs-sphinx-search repo since Apr 2025.
The docs website does not seem to show such function, the search box
in the top-left corner requires a search to be submitted and is not
live.

Fixes: https://tracker.ceph.com/issues/72918
Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 admin/doc-read-the-docs.txt | 1 -
 doc/conf.py                 | 3 ---
 2 files changed, 4 deletions(-)

diff --git a/admin/doc-read-the-docs.txt b/admin/doc-read-the-docs.txt
index ed405c4e3bd..bcc77ccffb0 100644
--- a/admin/doc-read-the-docs.txt
+++ b/admin/doc-read-the-docs.txt
@@ -1,2 +1 @@
 plantweb
-readthedocs-sphinx-search@git+https://github.com/readthedocs/readthedocs-sphinx-search@main
diff --git a/doc/conf.py b/doc/conf.py
index 3c2e214a8ac..9a3372b9363 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -165,9 +165,6 @@ else:
         'engine': 'ditaa'
     }
 
-if build_with_rtd:
-    extensions += ['sphinx_search.extension']
-
 # sphinx.ext.todo options
 todo_include_todos = True
 

From f70b3a29344ba67e79dc8f24eae5767456da6e26 Mon Sep 17 00:00:00 2001
From: Shubha Jain <SHUBHA.JAIN1@ibm.com>
Date: Wed, 14 Jan 2026 22:45:59 +0530
Subject: [PATCH 566/596] mgr/cephadm,nfs: support monitoring_addr and
 bind_addr for NFS

Add support for configuring monitoring_addr and bind_addr
for NFS daemons managed by cephadm.

Also restores required RADOS configuration blocks and
updates tests accordingly.

Fixes: https://tracker.ceph.com/issues/74403
Signed-off-by: Shubha Jain <SHUBHA.JAIN1@ibm.com>
---
 src/pybind/mgr/cephadm/services/nfs.py        | 26 ++++++++++++--
 .../templates/services/nfs/ganesha.conf.j2    | 36 ++++++++++---------
 src/pybind/mgr/nfs/cluster.py                 | 28 ++++++++-------
 src/pybind/mgr/nfs/module.py                  | 23 ++++++++++++
 4 files changed, 80 insertions(+), 33 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/nfs.py b/src/pybind/mgr/cephadm/services/nfs.py
index 8227e030965..27641ab588d 100644
--- a/src/pybind/mgr/cephadm/services/nfs.py
+++ b/src/pybind/mgr/cephadm/services/nfs.py
@@ -173,13 +173,16 @@ class NFSService(CephService):
         rgw_user = f'{rados_user}-rgw'
         rgw_keyring = self.create_rgw_keyring(daemon_spec)
         bind_addr = ''
+
         if spec.virtual_ip and not spec.enable_haproxy_protocol:
+            # keepalive_only mode: prioritize virtual_ip
             bind_addr = spec.virtual_ip
             daemon_spec.port_ips = {str(port): spec.virtual_ip}
             # update daemon spec ip for prometheus, as monitoring will happen on this
             # ip, if no monitor ip specified
             daemon_spec.ip = bind_addr
         elif daemon_spec.ip:
+            # daemon_spec.ip is already set by scheduler from ip_addrs if specified
             bind_addr = daemon_spec.ip
             daemon_spec.port_ips = {str(port): daemon_spec.ip}
         if not bind_addr:
@@ -563,9 +566,26 @@ class NFSService(CephService):
 
         # check if monitor needs to be bind on specific ip
         monitoring_addr = spec.monitoring_ip_addrs.get(host) if spec.monitoring_ip_addrs else None
-        if monitoring_addr and monitoring_addr not in self.mgr.cache.get_host_network_ips(host):
-            logger.debug(f"Monitoring IP {monitoring_addr} is not configured on host {host}.")
-            monitoring_addr = None
+
+        if monitoring_addr:
+            try:
+                ip = ipaddress.ip_address(monitoring_addr)
+
+                # Fetch host IPs once and normalize to strings
+                host_ips = set(self.mgr.cache.get_host_network_ips(host))
+
+                # Allow loopback addresses without requiring them on an interface
+                if not ip.is_loopback and str(ip) not in host_ips:
+                    logger.debug(
+                        f"Monitoring IP {monitoring_addr} is not configured on host {host}."
+                    )
+                    monitoring_addr = None
+
+            except ValueError:
+                logger.warning(
+                    f"Invalid monitoring IP address {monitoring_addr} for host {host}."
+                )
+                monitoring_addr = None
         if not monitoring_addr and spec.monitoring_networks:
             monitoring_addr = self.mgr.get_first_matching_network_ip(host, spec, spec.monitoring_networks)
             if not monitoring_addr:
diff --git a/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2 b/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
index 2e2461c0841..768e64302f4 100644
--- a/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
+++ b/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
@@ -11,16 +11,18 @@ NFS_CORE_PARAM {
         Enable_UDP = false;
         NFS_Port = {{ port }};
         allow_set_io_flusher_fail = true;
+{% if monitoring_addr %}
+        Monitoring_Addr = {{ monitoring_addr }};
+{% endif %}
+{% if monitoring_port %}
+        Monitoring_Port = {{ monitoring_port }};
+{% endif %}
 {% if bind_addr %}
         Bind_addr = {{ bind_addr }};
 {% endif %}
 {% if haproxy_hosts %}
         HAProxy_Hosts = {{ haproxy_hosts|join(", ") }};
 {% endif %}
-{% if monitoring_addr %}
-	Monitoring_Addr = {{ monitoring_addr }};
-{% endif %}
-        Monitoring_Port = {{ monitoring_port }};
 {% if enable_rdma and rdma_port %}
         NFS_RDMA_Port = {{ rdma_port }};
 {% endif %}
@@ -78,19 +80,19 @@ TLS_CONFIG{
         TLS_Cert_File = /etc/ganesha/tls/tls_cert.pem;
         TLS_Key_File = /etc/ganesha/tls/tls_key.pem;
         TLS_CA_File = /etc/ganesha/tls/tls_ca_cert.pem;
-	{% if tls_ciphers %}
+{% if tls_ciphers %}
         TLS_Ciphers = "{{ tls_ciphers }}";
-	{% endif %}
-	{% if tls_min_version %}
-        TLS_Min_Version = "{{ tls_min_version }}";
-	{% endif %}
-	{% if tls_ktls %}
-        Enable_KTLS = {{ tls_ktls }};
-	{% endif %}
-	{% if tls_debug %}
-        Enable_debug = {{ tls_debug }};
-	{% endif %}
-}
-
 {% endif %}
+{% if tls_min_version %}
+        TLS_Min_Version = "{{ tls_min_version }}";
+{% endif %}
+{% if tls_ktls %}
+        Enable_KTLS = {{ tls_ktls }};
+{% endif %}
+{% if tls_debug %}
+        Enable_debug = {{ tls_debug }};
+{% endif %}
+}
+{% endif %}
+
 %url    {{ url }}
diff --git a/src/pybind/mgr/nfs/cluster.py b/src/pybind/mgr/nfs/cluster.py
index d67ca4cb1e3..acbedf104af 100644
--- a/src/pybind/mgr/nfs/cluster.py
+++ b/src/pybind/mgr/nfs/cluster.py
@@ -170,6 +170,9 @@ class NFSCluster:
             tls_debug: bool = False,
             tls_min_version: Optional[str] = None,
             tls_ciphers: Optional[str] = None,
+            ip_addrs: Optional[Dict[str, str]] = None,
+            monitoring_ip_addrs: Optional[Dict[str, str]] = None,
+            monitoring_port: Optional[int] = None,
             enable_rdma: bool = False,
             rdma_port: Optional[int] = None,
     ) -> None:
@@ -216,6 +219,9 @@ class NFSCluster:
                                   tls_debug=tls_debug,
                                   tls_min_version=tls_min_version,
                                   tls_ciphers=tls_ciphers,
+                                  ip_addrs=ip_addrs,
+                                  monitoring_ip_addrs=monitoring_ip_addrs,
+                                  monitoring_port=monitoring_port,
                                   enable_rdma=enable_rdma,
                                   rdma_port=rdma_port)
             completion = self.mgr.apply_nfs(spec)
@@ -246,6 +252,9 @@ class NFSCluster:
                                   tls_debug=tls_debug,
                                   tls_min_version=tls_min_version,
                                   tls_ciphers=tls_ciphers,
+                                  ip_addrs=ip_addrs,
+                                  monitoring_ip_addrs=monitoring_ip_addrs,
+                                  monitoring_port=monitoring_port,
                                   enable_rdma=enable_rdma,
                                   rdma_port=rdma_port)
             completion = self.mgr.apply_nfs(spec)
@@ -281,6 +290,9 @@ class NFSCluster:
             tls_debug: bool = False,
             tls_min_version: Optional[str] = None,
             tls_ciphers: Optional[str] = None,
+            ip_addrs: Optional[Dict[str, str]] = None,
+            monitoring_ip_addrs: Optional[Dict[str, str]] = None,
+            monitoring_port: Optional[int] = None,
             enable_rdma: bool = False,
             rdma_port: Optional[int] = None,
     ) -> None:
@@ -322,6 +334,9 @@ class NFSCluster:
                     tls_debug=tls_debug,
                     tls_min_version=tls_min_version,
                     tls_ciphers=tls_ciphers,
+                    ip_addrs=ip_addrs,
+                    monitoring_ip_addrs=monitoring_ip_addrs,
+                    monitoring_port=monitoring_port,
                     enable_rdma=enable_rdma,
                     rdma_port=rdma_port
                 )
@@ -402,7 +417,6 @@ class NFSCluster:
                     if len(svc.ports) > 1:
                         monitor_port = svc.ports[1]
         except orchestrator.OrchestratorError:
-            # No ingress service found for this cluster
             log.debug(f"No ingress service found for NFS cluster {cluster_id}")
 
         # Build backend list with daemon information
@@ -412,17 +426,13 @@ class NFSCluster:
                 continue
 
             try:
-                # Resolve daemon IP
                 if daemon.ip:
                     ip = daemon.ip
                 elif daemon.hostname in hosts_map:
-                    # Use cached host data
                     ip = resolve_ip(hosts_map[daemon.hostname].addr)
                 else:
-                    # Fallback to hostname resolution
                     ip = resolve_ip(daemon.hostname)
 
-                # Get daemon status
                 status = orchestrator.DaemonDescriptionStatus.to_str(daemon.status)
 
                 backends.append({
@@ -437,14 +447,11 @@ class NFSCluster:
                     f" on {daemon.hostname} in cluster {cluster_id}")
                 continue
 
-        # Sort backends by hostname for consistent output
         backends.sort(key=lambda x: x["hostname"])
 
-        # Determine deployment type based on ingress configuration and actual daemon count
         deployment_type = "standalone"
         placement = None
 
-        # Get NFS service spec for placement information first
         nfs_sc = self.mgr.describe_service(
             service_type='nfs',
             service_name=f'nfs.{cluster_id}'
@@ -456,17 +463,13 @@ class NFSCluster:
                 break
 
         if ingress_mode:
-            # Determine deployment type from placement spec (source of truth)
-            # Note: Using placement.count instead of len(backends) to avoid race conditions
             if placement and placement.count and placement.count > 1:
                 deployment_type = "active-active"
             elif len(backends) > 1:
-                # Fallback to actual daemon count if placement.count not set
                 deployment_type = "active-active"
             else:
                 deployment_type = "active-passive"
 
-        # Build result dictionary
         r: Dict[str, Any] = {
             'deployment_type': deployment_type,
             'virtual_ip': virtual_ip,
@@ -474,7 +477,6 @@ class NFSCluster:
             'placement': placement.to_json() if placement else {},
         }
 
-        # Add ingress configuration to result
         if ingress_mode:
             r['ingress_mode'] = ingress_mode.value
         if ingress_port is not None:
diff --git a/src/pybind/mgr/nfs/module.py b/src/pybind/mgr/nfs/module.py
index 0f4ed118d94..80d5fb46855 100644
--- a/src/pybind/mgr/nfs/module.py
+++ b/src/pybind/mgr/nfs/module.py
@@ -162,6 +162,9 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
                                 virtual_ip: Optional[str] = None,
                                 ingress_mode: Optional[IngressType] = None,
                                 port: Optional[int] = None,
+                                bind_addrs: Optional[str] = None,
+                                monitoring_addrs: Optional[str] = None,
+                                monitoring_port: Optional[int] = None,
                                 enable_rdma: bool = False,
                                 rdma_port: Optional[int] = None,
                                 enable_nfsv3: bool = False,
@@ -182,11 +185,31 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             tls_debug = config.get('tls_debug')
             tls_ciphers = config.get('tls_ciphers')
 
+        # Parse bind_addrs and monitoring_addrs from CLI format
+        ip_addrs = None
+        if bind_addrs:
+            ip_addrs = {}
+            for pair in bind_addrs.split(','):
+                if ':' in pair:
+                    host, ip = pair.split(':', 1)
+                    ip_addrs[host.strip()] = ip.strip()
+
+        monitoring_ip_addrs = None
+        if monitoring_addrs:
+            monitoring_ip_addrs = {}
+            for pair in monitoring_addrs.split(','):
+                if ':' in pair:
+                    host, ip = pair.split(':', 1)
+                    monitoring_ip_addrs[host.strip()] = ip.strip()
+
         return self.nfs.create_nfs_cluster(cluster_id=cluster_id, placement=placement,
                                            virtual_ip=virtual_ip, ingress=ingress,
                                            ingress_mode=ingress_mode, port=port,
                                            cluster_qos_config=cluster_qos_config,
                                            enable_nfsv3=enable_nfsv3,
+                                           ip_addrs=ip_addrs,
+                                           monitoring_ip_addrs=monitoring_ip_addrs,
+                                           monitoring_port=monitoring_port,
                                            ssl=ssl,
                                            ssl_cert=ssl_cert,
                                            ssl_key=ssl_key,

From 01d5bec5e6f2756c458d0986151792885c470149 Mon Sep 17 00:00:00 2001
From: Shubha Jain <SHUBHA.JAIN1@ibm.com>
Date: Fri, 17 Apr 2026 17:11:10 +0530
Subject: [PATCH 567/596] tests: add coverage for virtual_ip bind_addr in nfs

Signed-off-by: Shubha Jain <SHUBHA.JAIN1@ibm.com>
---
 .../templates/services/nfs/ganesha.conf.j2    |  7 ++---
 .../mgr/cephadm/tests/services/test_nfs.py    | 31 +++++++++++++++++++
 2 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2 b/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
index 768e64302f4..1c10f2b9128 100644
--- a/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
+++ b/src/pybind/mgr/cephadm/templates/services/nfs/ganesha.conf.j2
@@ -11,6 +11,9 @@ NFS_CORE_PARAM {
         Enable_UDP = false;
         NFS_Port = {{ port }};
         allow_set_io_flusher_fail = true;
+{% if haproxy_hosts %}
+        HAProxy_Hosts = {{ haproxy_hosts|join(", ") }};
+{% endif %}
 {% if monitoring_addr %}
         Monitoring_Addr = {{ monitoring_addr }};
 {% endif %}
@@ -20,9 +23,6 @@ NFS_CORE_PARAM {
 {% if bind_addr %}
         Bind_addr = {{ bind_addr }};
 {% endif %}
-{% if haproxy_hosts %}
-        HAProxy_Hosts = {{ haproxy_hosts|join(", ") }};
-{% endif %}
 {% if enable_rdma and rdma_port %}
         NFS_RDMA_Port = {{ rdma_port }};
 {% endif %}
@@ -94,5 +94,4 @@ TLS_CONFIG{
 {% endif %}
 }
 {% endif %}
-
 %url    {{ url }}
diff --git a/src/pybind/mgr/cephadm/tests/services/test_nfs.py b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
index 0094aad24f5..21a94f40a61 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_nfs.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_nfs.py
@@ -99,6 +99,37 @@ class TestNFS:
                 ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
                 assert "Bind_addr = 1.2.3.7" in ganesha_conf
 
+    @patch("cephadm.serve.CephadmServe._run_cephadm")
+    @patch("cephadm.services.nfs.NFSService.fence_old_ranks", MagicMock())
+    @patch("cephadm.services.nfs.NFSService.run_grace_tool", MagicMock())
+    @patch("cephadm.services.nfs.NFSService.purge", MagicMock())
+    @patch("cephadm.services.nfs.NFSService.create_rados_config_obj", MagicMock())
+    def test_nfs_bind_addr_virtual_ip(self, _run_cephadm, cephadm_module: CephadmOrchestrator):
+        _run_cephadm.side_effect = async_side_effect(('{}', '', 0))
+
+        with with_host(cephadm_module, 'host1', addr='1.2.3.7'):
+            cephadm_module.cache.update_host_networks('host1', {
+                '1.2.3.0/24': {
+                    'if0': ['1.2.3.7']
+                }
+            })
+
+            nfs_spec = NFSServiceSpec(
+                service_id="foo",
+                placement=PlacementSpec(hosts=['host1']),
+                virtual_ip='1.2.3.100',
+                enable_haproxy_protocol=False
+            )
+
+            with with_service(cephadm_module, nfs_spec, status_running=True) as _:
+                dds = wait(cephadm_module, cephadm_module.list_daemons())
+                daemon_spec = CephadmDaemonDeploySpec.from_daemon_description(dds[0])
+
+                nfs_generated_conf, _ = service_registry.get_service('nfs').generate_config(daemon_spec)
+                ganesha_conf = nfs_generated_conf['files']['ganesha.conf']
+
+                assert "Bind_addr = 1.2.3.100" in ganesha_conf
+
     @patch("cephadm.serve.CephadmServe._run_cephadm")
     def test_ingress_without_haproxy_stats(self, _run_cephadm, cephadm_module: CephadmOrchestrator):
         _run_cephadm.side_effect = async_side_effect(('{}', '', 0))

From b4363bb25e2f7c06193b1d7701adb5cc607916f1 Mon Sep 17 00:00:00 2001
From: Lumir Sliva <61183145+lumir-sliva@users.noreply.github.com>
Date: Thu, 9 Apr 2026 18:14:21 +0200
Subject: [PATCH 568/596] mgr/cephadm: don't treat unknown daemon state as
 error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cephadm ls may transiently report state='unknown' for daemons that are
still starting up. The state mapping in _refresh_host_daemons mapped
'unknown' to DaemonDescriptionStatus.error, which caused
update_failed_daemon_health_check to fire CEPHADM_FAILED_DAEMON for
daemons that were simply mid-startup. The warning clears on the next
refresh once the daemon reaches a real state, but it causes spurious
QA failures across many test suites.

Map 'unknown' to DaemonDescriptionStatus.unknown instead — the enum
value already exists and is handled by to_str() and the dashboard.
get_error_daemons() only checks for .error, so unknown daemons no
longer trigger the health warning.

Signed-off-by: Lumir Sliva <61183145+lumir-sliva@users.noreply.github.com>
---
 src/pybind/mgr/cephadm/module.py             |  2 +-
 src/pybind/mgr/cephadm/tests/test_cephadm.py | 42 ++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 5fcc4afac0c..0d0c8988af8 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -1123,7 +1123,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
                     'running': DaemonDescriptionStatus.running,
                     'stopped': DaemonDescriptionStatus.stopped,
                     'error': DaemonDescriptionStatus.error,
-                    'unknown': DaemonDescriptionStatus.error,
+                    'unknown': DaemonDescriptionStatus.unknown,
                 }[d['state']]
 
             cached_dd = None
diff --git a/src/pybind/mgr/cephadm/tests/test_cephadm.py b/src/pybind/mgr/cephadm/tests/test_cephadm.py
index e2c5f5bc4bd..f56a2a7619c 100644
--- a/src/pybind/mgr/cephadm/tests/test_cephadm.py
+++ b/src/pybind/mgr/cephadm/tests/test_cephadm.py
@@ -419,6 +419,48 @@ class TestCephadm(object):
             dds = wait(cephadm_module, cephadm_module.list_daemons())
             assert {d.name() for d in dds} == {'rgw.myrgw.foobar', 'haproxy.test.bar'}
 
+    @mock.patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm(
+        json.dumps([
+            dict(
+                name='rgw.myrgw.running',
+                style='cephadm',
+                fsid='fsid',
+                container_id='container_id',
+                state='running',
+            ),
+            dict(
+                name='rgw.myrgw.unknown',
+                style='cephadm',
+                fsid='fsid',
+                container_id='container_id',
+                state='unknown',
+            ),
+            dict(
+                name='rgw.myrgw.error',
+                style='cephadm',
+                fsid='fsid',
+                container_id='container_id',
+                state='error',
+            ),
+        ])
+    ))
+    def test_unknown_state_not_error(self, cephadm_module: CephadmOrchestrator):
+        # Verify that daemons with state='unknown' from cephadm ls are not
+        # treated as errors and do not trigger CEPHADM_FAILED_DAEMON.
+        # See https://tracker.ceph.com/issues/65728
+        cephadm_module.service_cache_timeout = 10
+        with with_host(cephadm_module, 'myhost'):
+            CephadmServe(cephadm_module)._refresh_host_daemons('myhost')
+            dds = {d.name(): d for d in wait(cephadm_module, cephadm_module.list_daemons())}
+            # unknown should map to DaemonDescriptionStatus.unknown, not error
+            assert dds['rgw.myrgw.unknown'].status == DaemonDescriptionStatus.unknown
+            assert dds['rgw.myrgw.error'].status == DaemonDescriptionStatus.error
+            assert dds['rgw.myrgw.running'].status == DaemonDescriptionStatus.running
+            # only the error daemon should appear in get_error_daemons
+            error_names = {d.name() for d in cephadm_module.cache.get_error_daemons()}
+            assert 'rgw.myrgw.error' in error_names
+            assert 'rgw.myrgw.unknown' not in error_names
+
     @mock.patch("cephadm.serve.CephadmServe._run_cephadm", _run_cephadm('[]'))
     def test_daemon_action(self, cephadm_module: CephadmOrchestrator):
         cephadm_module.service_cache_timeout = 10

From a4d69dc20c0a2c0d3205bf79e54d236fa32a6005 Mon Sep 17 00:00:00 2001
From: Shraddha Agrawal <shraddha.agrawal000@gmail.com>
Date: Thu, 2 Jul 2026 18:05:16 +0530
Subject: [PATCH 569/596] src/test/librados: enable FastEC tests with crimson

This commit enables fast EC tests such that they are run for crimson
OSDs. This is done towards an effort to establish reliable fast EC
support in crimson.

These tests where previously enabled as part of another PR but
ultimately were not merged due to insufficient confidence.

Fixes: https://tracker.ceph.com/issues/77910
Signed-off-by: Shraddha Agrawal <shraddha.agrawal000@gmail.com>
---
 src/test/librados/TestCase.cc |  5 -----
 src/test/librados/aio.cc      | 14 --------------
 src/test/librados/io.cc       | 10 ----------
 3 files changed, 29 deletions(-)

diff --git a/src/test/librados/TestCase.cc b/src/test/librados/TestCase.cc
index 3be0a0c1ca7..f0c82c209bc 100644
--- a/src/test/librados/TestCase.cc
+++ b/src/test/librados/TestCase.cc
@@ -174,7 +174,6 @@ rados_t RadosTestEC::s_cluster = NULL;
 
 void RadosTestEC::SetUpTestCase()
 {
-  SKIP_IF_CRIMSON();
   auto pool_prefix = fmt::format("{}_", ::testing::UnitTest::GetInstance()->current_test_case()->name()); 
   pool_name_default = get_temp_pool_name(pool_prefix);
   pool_name_fast = get_temp_pool_name(pool_prefix);
@@ -187,7 +186,6 @@ void RadosTestEC::SetUpTestCase()
 
 void RadosTestEC::TearDownTestCase()
 {
-  SKIP_IF_CRIMSON();
   ASSERT_EQ(0, destroy_ec_pool(pool_name_default, &s_cluster));
   ASSERT_EQ(0, destroy_ec_pool(pool_name_fast, &s_cluster));
   ASSERT_EQ(0, destroy_ec_pool(pool_name_fast_split, &s_cluster));
@@ -196,8 +194,6 @@ void RadosTestEC::TearDownTestCase()
 
 void RadosTestEC::SetUp()
 {
-  SKIP_IF_CRIMSON();
-
   const auto& params = GetParam();
   bool fast_ec = std::get<0>(params);
   bool split_ops = std::get<1>(params);
@@ -223,7 +219,6 @@ void RadosTestEC::SetUp()
 
 void RadosTestEC::TearDown()
 {
-  SKIP_IF_CRIMSON();
   if (cleanup) {
     cleanup_default_namespace(ioctx);
     cleanup_namespace(ioctx, nspace);
diff --git a/src/test/librados/aio.cc b/src/test/librados/aio.cc
index 1b9be019843..fa5ad189704 100644
--- a/src/test/librados/aio.cc
+++ b/src/test/librados/aio.cc
@@ -1103,7 +1103,6 @@ public:
 class LibRadosAioEC : public ::testing::TestWithParam<std::tuple<bool, bool>> {};
 
 TEST_P(LibRadosAioEC, SimpleWrite) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1138,7 +1137,6 @@ TEST_P(LibRadosAioEC, SimpleWrite) {
 }
 
 TEST_P(LibRadosAioEC, WaitForComplete) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1158,7 +1156,6 @@ TEST_P(LibRadosAioEC, WaitForComplete) {
 }
 
 TEST_P(LibRadosAioEC, RoundTrip) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1194,7 +1191,6 @@ TEST_P(LibRadosAioEC, RoundTrip) {
 }
 
 TEST_P(LibRadosAioEC, RoundTrip2) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1304,7 +1300,6 @@ TEST_P(LibRadosAioEC, RoundTripAppend) {
 }
 
 TEST_P(LibRadosAioEC, IsComplete) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1347,7 +1342,6 @@ TEST_P(LibRadosAioEC, IsComplete) {
 }
 
 TEST_P(LibRadosAioEC, IsSafe) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1390,7 +1384,6 @@ TEST_P(LibRadosAioEC, IsSafe) {
 }
 
 TEST_P(LibRadosAioEC, ReturnValue) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1412,7 +1405,6 @@ TEST_P(LibRadosAioEC, ReturnValue) {
 }
 
 TEST_P(LibRadosAioEC, Flush) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1445,7 +1437,6 @@ TEST_P(LibRadosAioEC, Flush) {
 }
 
 TEST_P(LibRadosAioEC, FlushAsync) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1487,7 +1478,6 @@ TEST_P(LibRadosAioEC, FlushAsync) {
 }
 
 TEST_P(LibRadosAioEC, RoundTripWriteFull) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion, my_completion2, my_completion3;
   const auto& params = GetParam();
@@ -1534,7 +1524,6 @@ TEST_P(LibRadosAioEC, RoundTripWriteFull) {
 }
 
 TEST_P(LibRadosAioEC, SimpleStat) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1571,7 +1560,6 @@ TEST_P(LibRadosAioEC, SimpleStat) {
 
 
 TEST_P(LibRadosAioEC, SimpleStatNS) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1635,7 +1623,6 @@ TEST_P(LibRadosAioEC, SimpleStatNS) {
 }
 
 TEST_P(LibRadosAioEC, StatRemove) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
@@ -1694,7 +1681,6 @@ TEST_P(LibRadosAioEC, StatRemove) {
 }
 
 TEST_P(LibRadosAioEC, ExecuteClass) {
-  SKIP_IF_CRIMSON();
   AioTestDataEC test_data;
   rados_completion_t my_completion;
   const auto& params = GetParam();
diff --git a/src/test/librados/io.cc b/src/test/librados/io.cc
index d97ca98351d..725c00385ee 100644
--- a/src/test/librados/io.cc
+++ b/src/test/librados/io.cc
@@ -270,7 +270,6 @@ TEST_P(LibRadosIo, XattrIter) {
 }
 
 TEST_P(LibRadosIoEC, SimpleWrite) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   memset(buf, 0xcc, sizeof(buf));
   ASSERT_EQ(0, rados_write(ioctx, "foo", buf, sizeof(buf), 0));
@@ -279,7 +278,6 @@ TEST_P(LibRadosIoEC, SimpleWrite) {
 }
 
 TEST_P(LibRadosIoEC, RoundTrip) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char buf2[128];
   memset(buf, 0xcc, sizeof(buf));
@@ -295,7 +293,6 @@ TEST_P(LibRadosIoEC, RoundTrip) {
 }
 
 TEST_P(LibRadosIoEC, OverlappingWriteRoundTrip) {
-  SKIP_IF_CRIMSON();
   int bsize = alignment;
   int dbsize = bsize * 2;
   char *buf = (char *)new char[dbsize];
@@ -320,7 +317,6 @@ TEST_P(LibRadosIoEC, OverlappingWriteRoundTrip) {
 }
 
 TEST_P(LibRadosIoEC, WriteFullRoundTrip) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char buf2[64];
   char buf3[128];
@@ -334,7 +330,6 @@ TEST_P(LibRadosIoEC, WriteFullRoundTrip) {
 }
 
 TEST_P(LibRadosIoEC, AppendRoundTrip) {
-  SKIP_IF_CRIMSON();
   char *buf = (char *)new char[alignment];
   char *buf2 = (char *)new char[alignment];
   char *buf3 = (char *)new char[alignment *2];
@@ -363,7 +358,6 @@ TEST_P(LibRadosIoEC, AppendRoundTrip) {
 }
 
 TEST_P(LibRadosIoEC, TruncTest) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char buf2[sizeof(buf)];
   memset(buf, 0xaa, sizeof(buf));
@@ -379,7 +373,6 @@ TEST_P(LibRadosIoEC, TruncTest) {
 }
 
 TEST_P(LibRadosIoEC, RemoveTest) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char buf2[sizeof(buf)];
   memset(buf, 0xaa, sizeof(buf));
@@ -390,7 +383,6 @@ TEST_P(LibRadosIoEC, RemoveTest) {
 }
 
 TEST_P(LibRadosIoEC, XattrsRoundTrip) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char attr1[] = "attr1";
   char attr1_buf[] = "foo bar baz";
@@ -404,7 +396,6 @@ TEST_P(LibRadosIoEC, XattrsRoundTrip) {
 }
 
 TEST_P(LibRadosIoEC, RmXattr) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char attr1[] = "attr1";
   char attr1_buf[] = "foo bar baz";
@@ -428,7 +419,6 @@ TEST_P(LibRadosIoEC, RmXattr) {
 }
 
 TEST_P(LibRadosIoEC, XattrIter) {
-  SKIP_IF_CRIMSON();
   char buf[128];
   char attr1[] = "attr1";
   char attr1_buf[] = "foo bar baz";

From b9e272c469250d2f1bcc4301117ca790ae1c4748 Mon Sep 17 00:00:00 2001
From: Devika Babrekar <devika.babrekar@ibm.com>
Date: Wed, 8 Jul 2026 18:40:12 +0530
Subject: [PATCH 570/596] mgr/dashboard: fixing manual deployment option for
 osd creation flow

Signed-off-by: Devika Babrekar <devika.babrekar@ibm.com>
---
 .../inventory-devices.component.ts            |   8 +-
 ...sd-devices-selection-groups.component.html |  75 +++--
 ...sd-devices-selection-groups.component.scss |  22 ++
 ...devices-selection-groups.component.spec.ts | 117 +++++--
 .../osd-devices-selection-groups.component.ts | 285 +++++++++++++++---
 .../osd/osd-form/osd-form.component.html      |  51 +++-
 .../osd/osd-form/osd-form.component.ts        |  52 +++-
 7 files changed, 499 insertions(+), 111 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.ts
index c52784b5155..eafd0baaf3d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.ts
@@ -106,13 +106,13 @@ export class InventoryDevicesComponent implements OnInit, OnDestroy {
     ];
     const columns = [
       {
-        name: $localize`Hostname`,
-        prop: 'hostname',
+        name: $localize`Device path`,
+        prop: 'path',
         flexGrow: 1
       },
       {
-        name: $localize`Device path`,
-        prop: 'path',
+        name: $localize`Hostname`,
+        prop: 'hostname',
         flexGrow: 1
       },
       {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
index 5e0b0c90cc2..08ccc032996 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
@@ -15,53 +15,77 @@
     </cd-helper>
   </label>
   <div class="cd-col-form-input">
-    @if (devices.length === 0 && inlineSelection) {
-    @if (!canSelect) {
+    @if (inlineSelection) {
+    @if (showAddPrimaryFirstAlert) {
     <cd-alert-panel type="info"
                     size="slim"
                     [showTitle]="false">
       <ng-container i18n>{{ tooltips.addPrimaryFirst }}</ng-container>
     </cd-alert-panel>
     }
-    @if (canSelect) {
-    @if (availDevices.length === 0) {
+    @if (showNoAvailDevicesAlert) {
     <cd-alert-panel type="warning"
                     size="slim"
                     [showTitle]="false">
       <ng-container i18n>No available devices</ng-container>
     </cd-alert-panel>
     }
-    @if (availDevices.length > 0 && !canInlineSubmit) {
+    @if (showFilterSection) {
+    @if (!canInlineSubmit) {
     <cd-alert-panel type="warning"
                     size="slim"
                     [showTitle]="false">
-      <ng-container i18n>At least one of these filters must be applied in order to proceed:</ng-container>
+      <ng-container i18n>Select at least one of these filters to fetch the data:</ng-container>
       @for (filter of requiredFilters; track filter) {
       <cds-tag class="tag-dark ms-2">{{ filter }}</cds-tag>
       }
     </cd-alert-panel>
     }
-    <cd-inventory-devices [devices]="availDevices"
+    <div class="device-filter-form">
+      <div class="filter-dropdown-row">
+        @for (field of filterFields; track field.prop) {
+        <div class="filter-dropdown">
+          <cds-select (valueChange)="onFilterFieldChange(field.prop, $event)"
+                      [id]="'device_filter_' + field.prop"
+                      [label]="field.name"
+                      size="md"
+                      [attr.data-testid]="'device-filter-' + field.prop">
+            <option value=""
+                    i18n>Any</option>
+            @for (option of field.options; track option.raw) {
+            <option [value]="option.raw"
+                    [selected]="selectedFilters[field.prop] === option.raw">
+              {{ option.formatted }}
+            </option>
+            }
+          </cds-select>
+        </div>
+        }
+      </div>
+    </div>
+    @if (showSelectionSummary) {
+    <div class="selection-summary pb-2 my-2 border-bottom">
+      @for (filter of displayedFilters; track filter.prop) {
+      <cds-tag class="tag-dark me-2">{{ filter.name }}: {{ filter.value.formatted }}</cds-tag>
+      }
+      <a class="tc_clearSelections"
+         href=""
+         (click)="clearDevices(); false">
+        <svg [cdsIcon]="icons.clearFilters"
+             [size]="icons.size16"></svg>
+        <ng-container i18n>Clear</ng-container>
+      </a>
+      <div class="selection-capacity cds-mt-2">
+        <span i18n>Raw capacity: {{ inlineCapacity | dimlessBinary }}.</span>
+      </div>
+    </div>
+    }
+    <cd-inventory-devices [devices]="tableDevices"
                           [hostname]="hostname"
                           [diskType]="name === 'Primary' ? 'hdd' : 'ssd'"
                           [hiddenColumns]="['available', 'osd_ids']"
-                          [filterColumns]="filterColumns"
-                          (filterChange)="onInlineFilterChange($event)">
+                          [filterColumns]="[]">
     </cd-inventory-devices>
-    @if (canInlineSubmit) {
-    <div class="text-center cds-mt-3 cds-mb-3">
-      <span i18n>Number of devices: {{ inlineFilteredDevices.length }}. Raw capacity:
-        {{ inlineCapacity | dimlessBinary }}.</span>
-    </div>
-    }
-    <button type="button"
-            class="btn btn-light"
-            (click)="submitInlineSelection()"
-            [disabled]="!canInlineSubmit || inlineFilteredDevices.length === 0">
-      <svg [cdsIcon]="icons.add"
-           [size]="icons.size16"></svg>
-      <ng-container i18n>Add</ng-container>
-    </button>
     }
     } @else {
     @if (devices.length === 0) {
@@ -94,11 +118,6 @@
                             [filterColumns]="[]">
       </cd-inventory-devices>
     </div>
-    @if (type === 'data') {
-    <div class="float-end">
-      <span i18n>Raw capacity: {{ capacity | dimlessBinary }}</span>
-    </div>
-    }
     }
     }
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss
index bf3223c234d..742a942df5a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.scss
@@ -15,3 +15,25 @@
     width: 100%;
   }
 }
+
+.device-filter-form {
+  margin-bottom: 1rem;
+}
+
+.filter-dropdown-row {
+  display: flex;
+  flex-wrap: nowrap;
+  gap: 0.75rem;
+  width: 100%;
+}
+
+.filter-dropdown {
+  flex: 1 1 0;
+  min-width: 0;
+}
+
+.selection-summary {
+  .selection-capacity {
+    text-align: center;
+  }
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.spec.ts
index 8e6b1e9865c..d66f7ad93e6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.spec.ts
@@ -16,11 +16,6 @@ describe('OsdDevicesSelectionGroupsComponent', () => {
   let fixtureHelper: FixtureHelper;
   const devices: InventoryDevice[] = [Mocks.getInventoryDevice('node0', '1')];
 
-  const buttonSelector = '.cd-col-form-input button';
-  const getButton = () => {
-    const debugElement = fixtureHelper.getElementByCss(buttonSelector);
-    return debugElement.nativeElement;
-  };
   const clearTextSelector = '.tc_clearSelections';
   const getClearText = () => {
     const debugElement = fixtureHelper.getElementByCss(clearTextSelector);
@@ -42,7 +37,9 @@ describe('OsdDevicesSelectionGroupsComponent', () => {
     fixture = TestBed.createComponent(OsdDevicesSelectionGroupsComponent);
     fixtureHelper = new FixtureHelper(fixture);
     component = fixture.componentInstance;
+    component.type = 'data';
     component.canSelect = true;
+    component.inlineSelection = true;
   });
 
   describe('without available devices', () => {
@@ -55,14 +52,11 @@ describe('OsdDevicesSelectionGroupsComponent', () => {
       expect(component).toBeTruthy();
     });
 
-    it('should display Add button in disabled state', () => {
-      const button = getButton();
-      expect(button).toBeTruthy();
-      expect(button.disabled).toBe(true);
-      expect(button.textContent).toBe('Add');
+    it('should not display filter form', () => {
+      fixtureHelper.expectElementVisible('.device-filter-form', false);
     });
 
-    it('should not display devices table', () => {
+    it('should display devices table', () => {
       fixtureHelper.expectElementVisible('cd-inventory-devices', false);
     });
   });
@@ -77,23 +71,29 @@ describe('OsdDevicesSelectionGroupsComponent', () => {
       expect(component).toBeTruthy();
     });
 
-    it('should display Add button in enabled state', () => {
-      const button = getButton();
-      expect(button).toBeTruthy();
-      expect(button.disabled).toBe(false);
-      expect(button.textContent).toBe('Add');
+    it('should display filter form', () => {
+      fixtureHelper.expectElementVisible('.device-filter-form', true);
     });
 
-    it('should not display devices table', () => {
-      fixtureHelper.expectElementVisible('cd-inventory-devices', false);
+    it('should display empty devices table', () => {
+      fixtureHelper.expectElementVisible('cd-inventory-devices', true);
+      expect(component.tableDevices).toEqual([]);
     });
   });
 
   describe('with devices selected', () => {
     beforeEach(() => {
       component.isOsdPage = true;
-      component.availDevices = [];
+      component.availDevices = devices;
       component.devices = devices;
+      component.appliedFilters = [
+        {
+          name: 'Type',
+          prop: 'human_readable_type',
+          value: { raw: 'nvme/ssd', formatted: 'nvme/ssd' }
+        }
+      ];
+      component.selectedFilters = { human_readable_type: 'nvme/ssd' };
       component.ngOnInit();
       fixture.detectChanges();
     });
@@ -111,12 +111,87 @@ describe('OsdDevicesSelectionGroupsComponent', () => {
     it('should clear devices by clicking Clear link', () => {
       spyOn(component.cleared, 'emit');
       fixtureHelper.clickElement(clearTextSelector);
-      fixtureHelper.expectElementVisible('cd-inventory-devices', false);
+      fixtureHelper.expectElementVisible('cd-inventory-devices', true);
       const event: Record<string, any> = {
-        type: undefined,
+        type: 'data',
         clearedDevices: devices
       };
       expect(component.cleared.emit).toHaveBeenCalledWith(event);
+      expect(component.devices).toEqual([]);
+    });
+  });
+
+  describe('wal inline selection', () => {
+    beforeEach(() => {
+      component.type = 'wal';
+      component.name = 'WAL';
+      component.availDevices = devices;
+      component.canSelect = true;
+      component.inlineSelection = true;
+      fixture.detectChanges();
+    });
+
+    it('should display filter form instead of Add button', () => {
+      fixtureHelper.expectElementVisible('.device-filter-form', true);
+      fixtureHelper.expectElementVisible('cd-inventory-devices', true);
+      fixtureHelper.expectElementVisible('.cd-col-form-input button.btn-light', false);
+    });
+
+    it('should display empty devices table before filters are applied', () => {
+      expect(component.tableDevices).toEqual([]);
+    });
+
+    it('should auto-apply filtered devices when a required filter is selected', () => {
+      spyOn(component.selected, 'emit');
+      component.onFilterFieldChange('human_readable_type', 'nvme/ssd');
+      fixture.detectChanges();
+
+      expect(component.tableDevices.length).toBe(1);
+      expect(component.devices.length).toBe(1);
+      expect(component.selected.emit).toHaveBeenCalled();
+    });
+  });
+
+  describe('wal inline selection without primary devices', () => {
+    beforeEach(() => {
+      component.type = 'wal';
+      component.name = 'WAL';
+      component.availDevices = devices;
+      component.canSelect = false;
+      component.inlineSelection = true;
+      fixture.detectChanges();
+    });
+
+    it('should display add primary first alert without filter form', () => {
+      fixtureHelper.expectElementVisible('.device-filter-form', false);
+      fixtureHelper.expectElementVisible('cd-inventory-devices', false);
+    });
+  });
+
+  describe('db inline selection', () => {
+    beforeEach(() => {
+      component.type = 'db';
+      component.name = 'DB';
+      component.availDevices = devices;
+      component.canSelect = true;
+      component.inlineSelection = true;
+      fixture.detectChanges();
+    });
+
+    it('should display filter form instead of Add button', () => {
+      fixtureHelper.expectElementVisible('.device-filter-form', true);
+      fixtureHelper.expectElementVisible('cd-inventory-devices', true);
+      fixtureHelper.expectElementVisible('.cd-col-form-input button.btn-light', false);
+    });
+
+    it('should auto-apply filtered devices when a required filter is selected', () => {
+      spyOn(component.selected, 'emit');
+      component.onFilterFieldChange('sys_api.vendor', 'AAA');
+      fixture.detectChanges();
+
+      expect(component.tableDevices.length).toBe(1);
+      expect(component.devices.length).toBe(1);
+      expect(component.selected.emit).toHaveBeenCalled();
     });
   });
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts
index 79d03d10b45..b9c454c2565 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.ts
@@ -1,4 +1,14 @@
-import { Component, EventEmitter, Input, OnChanges, OnInit, Output } from '@angular/core';
+import {
+  ChangeDetectionStrategy,
+  ChangeDetectorRef,
+  Component,
+  EventEmitter,
+  Input,
+  OnChanges,
+  OnInit,
+  Output,
+  PipeTransform
+} from '@angular/core';
 import { Router } from '@angular/router';
 
 import _ from 'lodash';
@@ -7,16 +17,30 @@ import { InventoryDevice } from '~/app/ceph/cluster/inventory/inventory-devices/
 import { OsdService } from '~/app/shared/api/osd.service';
 import { Icons } from '~/app/shared/enum/icons.enum';
 import { CdTableColumnFiltersChange } from '~/app/shared/models/cd-table-column-filters-change';
+import { DimlessBinaryPipe } from '~/app/shared/pipes/dimless-binary.pipe';
 import { ModalService } from '~/app/shared/services/modal.service';
 import { OsdDevicesSelectionModalComponent } from '../osd-devices-selection-modal/osd-devices-selection-modal.component';
 import { DevicesSelectionChangeEvent } from './devices-selection-change-event.interface';
 import { DevicesSelectionClearEvent } from './devices-selection-clear-event.interface';
 
+interface DeviceFilterOption {
+  raw: string;
+  formatted: string;
+}
+
+interface DeviceFilterField {
+  prop: string;
+  name: string;
+  pipe?: PipeTransform;
+  options: DeviceFilterOption[];
+}
+
 @Component({
   selector: 'cd-osd-devices-selection-groups',
   templateUrl: './osd-devices-selection-groups.component.html',
   styleUrls: ['./osd-devices-selection-groups.component.scss'],
-  standalone: false
+  standalone: false,
+  changeDetection: ChangeDetectionStrategy.OnPush
 })
 export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
   // data, wal, db
@@ -60,9 +84,12 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
     $localize`Model`,
     $localize`Size`
   ];
-  inlineFilteredDevices: InventoryDevice[] = [];
+  filterFields: DeviceFilterField[] = [];
+  selectedFilters: Record<string, string | undefined> = {};
+  filteredDevices: InventoryDevice[] = [];
   inlineCapacity = 0;
   canInlineSubmit = false;
+  hasAnyFilter = false;
   inlineFilterEvent?: CdTableColumnFiltersChange;
   tooltips = {
     noAvailDevices: $localize`No available devices`,
@@ -70,12 +97,27 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
     addByFilters: $localize`Add devices by using filters`
   };
 
+  private filterFieldConfig: Array<{
+    prop: string;
+    name: string;
+    pipe?: PipeTransform;
+  }>;
+
   constructor(
     private modalService: ModalService,
     public osdService: OsdService,
-    private router: Router
+    private router: Router,
+    private dimlessBinary: DimlessBinaryPipe,
+    private cdr: ChangeDetectorRef
   ) {
     this.isOsdPage = this.router.url.includes('/osd');
+    this.filterFieldConfig = [
+      { prop: 'human_readable_type', name: $localize`Type` },
+      { prop: 'hostname', name: $localize`Hostname` },
+      { prop: 'sys_api.vendor', name: $localize`Vendor` },
+      { prop: 'sys_api.model', name: $localize`Model` },
+      { prop: 'sys_api.size', name: $localize`Size`, pipe: this.dimlessBinary }
+    ];
   }
 
   ngOnInit() {
@@ -87,12 +129,78 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
       this.osdService?.osdDevices
         ? (this.expansionCanSelect = this.osdService?.osdDevices['disableSelect'])
         : (this.expansionCanSelect = false);
+      if (this.inlineSelection) {
+        this.restoreSelectedFiltersFromApplied();
+      }
     }
-    this.updateAddButtonTooltip();
+    if (this.inlineSelection) {
+      this.initDefaultFilterValues();
+      this.updateFilterFields();
+      this.updateFilteredDevices();
+    } else {
+      this.updateAddButtonTooltip();
+    }
+    this.cdr.markForCheck();
   }
 
   ngOnChanges() {
-    this.updateAddButtonTooltip();
+    if (this.inlineSelection) {
+      this.initDefaultFilterValues();
+      this.updateFilterFields();
+      this.updateFilteredDevices();
+    } else {
+      this.updateAddButtonTooltip();
+    }
+    this.cdr.markForCheck();
+  }
+
+  get showAddPrimaryFirstAlert(): boolean {
+    return this.type !== 'data' && !this.canSelect && this.devices.length === 0;
+  }
+
+  get showFilterSection(): boolean {
+    if (this.type === 'data') {
+      return this.availDevices?.length > 0 || this.devices?.length > 0;
+    }
+
+    if (this.devices?.length > 0) {
+      return true;
+    }
+
+    return this.canSelect && this.availDevices?.length > 0;
+  }
+
+  get showNoAvailDevicesAlert(): boolean {
+    if (this.type !== 'data' && !this.canSelect) {
+      return false;
+    }
+
+    return !this.showFilterSection;
+  }
+
+  get tableDevices(): InventoryDevice[] {
+    return this.canInlineSubmit ? this.filteredDevices : [];
+  }
+
+  get displayedFilters(): CdTableColumnFiltersChange['filters'] {
+    return this.inlineFilterEvent?.filters ?? this.appliedFilters ?? [];
+  }
+
+  get showSelectionSummary(): boolean {
+    return (
+      (this.canInlineSubmit && this.tableDevices.length > 0) ||
+      (this.devices.length > 0 && this.appliedFilters.length > 0)
+    );
+  }
+
+  onFilterFieldChange(prop: string, value: string) {
+    const normalizedValue = value === '' ? undefined : value;
+    const hadDevices = this.devices.length > 0;
+    const clearedDevices = [...this.devices];
+    this.selectedFilters[prop] = normalizedValue;
+    this.updateFilteredDevices();
+    this.syncSelectionState(hadDevices, clearedDevices);
+    this.cdr.markForCheck();
   }
 
   showSelectionModal() {
@@ -112,33 +220,143 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
     });
   }
 
-  onInlineFilterChange(event: CdTableColumnFiltersChange) {
+  clearDevices() {
+    if (!this.isOsdPage) {
+      this.expansionCanSelect = false;
+      this.osdService.osdDevices['disableSelect'] = false;
+      this.osdService.osdDevices = [];
+    }
+    const event = {
+      type: this.type,
+      clearedDevices: [...this.devices]
+    };
+    this.devices = [];
+    this.appliedFilters = [];
+    this.capacity = 0;
+    this.selectedFilters = {};
     this.inlineCapacity = 0;
     this.canInlineSubmit = false;
     this.inlineFilterEvent = undefined;
-
-    if (_.isEmpty(event.filters)) {
-      this.inlineFilteredDevices = [];
-      return;
+    if (this.inlineSelection) {
+      this.initDefaultFilterValues();
+      this.updateFilterFields();
+      this.updateFilteredDevices();
     }
-
-    const filters = event.filters.filter((filter) => filter.prop !== 'hostname');
-    this.canInlineSubmit = !_.isEmpty(filters);
-    this.inlineFilteredDevices = event.data;
-    this.inlineCapacity = _.sumBy(this.inlineFilteredDevices, 'sys_api.size');
-    this.inlineFilterEvent = event;
+    this.cleared.emit(event);
+    this.cdr.markForCheck();
   }
 
-  submitInlineSelection() {
-    if (
-      !this.inlineFilterEvent ||
-      !this.canInlineSubmit ||
-      this.inlineFilteredDevices.length === 0
-    ) {
+  private get devicesForFiltering(): InventoryDevice[] {
+    return _.uniqBy([...(this.availDevices || []), ...(this.devices || [])], 'uid');
+  }
+
+  private get canApplySelection(): boolean {
+    return this.type === 'data' || this.canSelect;
+  }
+
+  private initDefaultFilterValues() {
+    if (this.hostname && !this.selectedFilters['hostname']) {
+      this.selectedFilters['hostname'] = this.hostname;
+    }
+  }
+
+  private restoreSelectedFiltersFromApplied() {
+    if (_.isEmpty(this.appliedFilters)) {
+      return;
+    }
+    this.appliedFilters.forEach((filter) => {
+      this.selectedFilters[filter.prop as string] = filter.value?.raw;
+    });
+  }
+
+  private updateFilterFields() {
+    this.filterFields = this.filterFieldConfig
+      .filter((field) => this.filterColumns.includes(field.prop))
+      .map((field) => ({
+        ...field,
+        options: this.buildFilterOptions(field.prop, field.pipe)
+      }));
+  }
+
+  private buildFilterOptions(prop: string, pipe?: PipeTransform): DeviceFilterOption[] {
+    const values = _.sortedUniq(
+      _.filter(_.map(this.devicesForFiltering, prop), (value) => {
+        return (_.isString(value) && value !== '') || _.isBoolean(value) || _.isFinite(value);
+      }).sort()
+    );
+
+    return values.map((value) => this.createFilterOption(value, pipe));
+  }
+
+  private createFilterOption(value: unknown, pipe?: PipeTransform): DeviceFilterOption {
+    const raw = _.toString(value);
+    return {
+      raw,
+      formatted: pipe ? pipe.transform(value) : raw
+    };
+  }
+
+  private syncSelectionState(hadDevices: boolean, clearedDevices: InventoryDevice[]) {
+    if (this.canApplySelection && this.canInlineSubmit && this.filteredDevices.length > 0) {
+      this.applySelectionResult(this.inlineFilterEvent);
       return;
     }
 
-    this.applySelectionResult(this.inlineFilterEvent);
+    if (hadDevices) {
+      this.resetSelectionState();
+      this.cleared.emit({
+        type: this.type,
+        clearedDevices
+      });
+    }
+  }
+
+  private resetSelectionState() {
+    this.devices = [];
+    this.capacity = 0;
+    this.appliedFilters = [];
+  }
+
+  private updateFilteredDevices() {
+    let data = [...this.devicesForFiltering];
+    const appliedFilters: CdTableColumnFiltersChange['filters'] = [];
+
+    this.filterFields.forEach((field) => {
+      const selectedValue = this.selectedFilters[field.prop];
+      if (_.isUndefined(selectedValue)) {
+        return;
+      }
+
+      const option = field.options.find((entry) => entry.raw === selectedValue);
+      if (!option) {
+        delete this.selectedFilters[field.prop];
+        return;
+      }
+
+      appliedFilters.push({
+        name: field.name,
+        prop: field.prop,
+        value: option
+      });
+      data = data.filter((row) => `${_.get(row, field.prop)}` === selectedValue);
+    });
+
+    this.hasAnyFilter = !_.isEmpty(appliedFilters);
+    const filtersWithoutHostname = appliedFilters.filter((filter) => filter.prop !== 'hostname');
+    this.canInlineSubmit = !_.isEmpty(filtersWithoutHostname);
+    this.filteredDevices = this.hasAnyFilter ? data : [];
+    this.inlineCapacity = _.sumBy(this.filteredDevices, 'sys_api.size');
+
+    if (this.hasAnyFilter) {
+      const filteredUids = new Set(this.filteredDevices.map((device) => device.uid));
+      this.inlineFilterEvent = {
+        filters: appliedFilters,
+        data: this.filteredDevices,
+        dataOut: this.devicesForFiltering.filter((device) => !filteredUids.has(device.uid))
+      };
+    } else {
+      this.inlineFilterEvent = undefined;
+    }
   }
 
   private applySelectionResult(result: CdTableColumnFiltersChange) {
@@ -160,7 +378,6 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
       this.addButtonTooltip = this.tooltips.noAvailDevices;
     } else {
       if (!this.canSelect) {
-        // No primary devices added yet.
         this.addButtonTooltip = this.tooltips.addPrimaryFirst;
       } else if (this.availDevices.length === 0) {
         this.addButtonTooltip = this.tooltips.noAvailDevices;
@@ -169,22 +386,4 @@ export class OsdDevicesSelectionGroupsComponent implements OnInit, OnChanges {
       }
     }
   }
-
-  clearDevices() {
-    if (!this.isOsdPage) {
-      this.expansionCanSelect = false;
-      this.osdService.osdDevices['disableSelect'] = false;
-      this.osdService.osdDevices = [];
-    }
-    const event = {
-      type: this.type,
-      clearedDevices: [...this.devices]
-    };
-    this.devices = [];
-    this.inlineFilteredDevices = [];
-    this.inlineCapacity = 0;
-    this.canInlineSubmit = false;
-    this.inlineFilterEvent = undefined;
-    this.cleared.emit(event);
-  }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
index 91dc4ca6ecc..700c8af631e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
@@ -9,9 +9,9 @@
   (closeRequested)="onCancel()"
   (stepChanged)="populateReviewData()"
   [isSubmitLoading]="isSubmitLoading"
-  [submitButtonLabel]="simpleDeployment ? createOsdsLabel : actionLabels.PREVIEW"
+  [submitButtonLabel]="createOsdsLabel">
   type="wide">
-
+<!-- [submitButtonLabel]="simpleDeployment ? createOsdsLabel : actionLabels.PREVIEW" -->
   <cd-tearsheet-step>
   <div class="osd-tearsheet-content">
     <form
@@ -413,6 +413,53 @@
           i18n>None selected</p>
         }
       </div>
+
+       <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+          class="cds-mt-7">
+        <h4
+          class="cds--type-heading-compact-01"
+          i18n>Device Groups</h4>
+      </div>
+
+       <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+          class="cds-mt-5">
+          <p
+            class="cds--type-label-01"
+            i18n>Service Type</p>
+          <p
+            class="cds--type-label-02 cds-mt-2"
+            i18n>{{driveGroup.spec.service_type}}</p>   
+        </div>
+
+        <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+          class="cds-mt-5">
+          <p
+            class="cds--type-label-01"
+            i18n>Service ID</p>
+          <p
+            class="cds--type-label-02 cds-mt-2"
+            i18n>{{driveGroup.spec.service_id}}</p>       
+        </div>
+
+        <!-- <div
+          cdsCol
+          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+          class="cds-mt-5">
+          <p
+            class="cds--type-label-01"
+            i18n>Data devices</p>
+           <div class="osd-review-section cds-pl-4 cds-mt-3">
+              <p class="cds--type-label-01 cds-mb-2">Rotational</p>
+              <p class="cds--type-label-02 cds-mt-1">{{ driveGroup.spec.data_devices.rotational }}</p>
+            </div>       
+        </div> -->
+
       }
 
       <div
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
index 63dfd3d58b2..90bc800f57c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.ts
@@ -29,10 +29,10 @@ import {
 } from '~/app/shared/models/osd-deployment-options';
 import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { FormatterService } from '~/app/shared/services/formatter.service';
-import { ModalService } from '~/app/shared/services/modal.service';
+// import { ModalService } from '~/app/shared/services/modal.service';
 import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 import { TearsheetComponent } from '~/app/shared/components/tearsheet/tearsheet.component';
-import { OsdCreationPreviewModalComponent } from '../osd-creation-preview-modal/osd-creation-preview-modal.component';
+// import { OsdCreationPreviewModalComponent } from '../osd-creation-preview-modal/osd-creation-preview-modal.component';
 import { DevicesSelectionChangeEvent } from '../osd-devices-selection-groups/devices-selection-change-event.interface';
 import { DevicesSelectionClearEvent } from '../osd-devices-selection-groups/devices-selection-clear-event.interface';
 import { OsdDevicesSelectionGroupsComponent } from '../osd-devices-selection-groups/osd-devices-selection-groups.component';
@@ -143,7 +143,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
     private hostService: HostService,
     private router: Router,
     private formatterService: FormatterService,
-    private modalService: ModalService,
+    // private modalService: ModalService,
     private osdService: OsdService,
     private taskWrapper: TaskWrapperService
   ) {
@@ -222,6 +222,7 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
 
   private formatHostPattern(pattern?: string): string {
     if (!pattern || pattern === '*') {
+      // this.driveGroup.setHostPattern('*');
       return $localize`All hosts`;
     }
 
@@ -463,6 +464,9 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
   }
 
   populateReviewData() {
+    const user = this.authStorageService.getUsername();
+    this.driveGroup.setName(`dashboard-${user}-${_.now()}`);
+
     this.reviewDeploymentModeLabel = this.simpleDeployment
       ? $localize`Automatic`
       : $localize`Manual selection`;
@@ -537,16 +541,38 @@ export class OsdFormComponent extends CdForm implements OnInit, OnDestroy {
         });
     } else {
       // use user name and timestamp for drive group name
-      const user = this.authStorageService.getUsername();
-      this.driveGroup.setName(`dashboard-${user}-${_.now()}`);
-      const modalRef = this.modalService.show(OsdCreationPreviewModalComponent, {
-        driveGroups: [this.driveGroup.spec]
-      });
-      modalRef.componentInstance.submitAction.subscribe(() => {
-        this.navigateAfterCreate();
-      });
-      this.isSubmitLoading = false;
-      this.previewButtonPanel.submitButton.loading = false;
+
+      // const user = this.authStorageService.getUsername();
+      // this.driveGroup.setName(`dashboard-${user}-${_.now()}`);
+      // const modalRef = this.modalService.show(OsdCreationPreviewModalComponent, {
+      //   driveGroups: [this.driveGroup.spec]
+      // });
+      // modalRef.componentInstance.submitAction.subscribe(() => {
+      //   this.navigateAfterCreate();
+      // });
+      // this.isSubmitLoading = false;
+      // this.previewButtonPanel.submitButton.loading = false;
+
+      // let driveGroups = [this.driveGroup.spec];
+
+      const trackingId = _.join(_.map([this.driveGroup.spec], 'service_id'), ', ');
+      this.taskWrapper
+        .wrapTaskAroundCall({
+          task: new FinishedTask('osd/' + URLVerbs.CREATE, {
+            tracking_id: trackingId
+          }),
+          call: this.osdService.create([this.driveGroup.spec], trackingId)
+        })
+        .subscribe({
+          error: () => {
+            this.isSubmitLoading = false;
+          },
+          complete: () => {
+            this.isSubmitLoading = false;
+            this.navigateAfterCreate();
+            this.previewButtonPanel.submitButton.loading = false;
+          }
+        });
     }
   }
 

From 9dff563eacb1336c12e7354a01a6b5add3250d09 Mon Sep 17 00:00:00 2001
From: John Mulligan <jmulligan@redhat.com>
Date: Wed, 8 Jul 2026 10:18:19 -0400
Subject: [PATCH 571/596] doc/mgr: update out of date paragraph in smb.rst

We still had a part of the document saying we only support the default
port. We added service colocation via custom_ports/bind_addrs a while
back so the doc has been out of date.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
---
 doc/mgr/smb.rst | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/doc/mgr/smb.rst b/doc/mgr/smb.rst
index 71d9ffacb71..23cd1ca8712 100644
--- a/doc/mgr/smb.rst
+++ b/doc/mgr/smb.rst
@@ -1688,10 +1688,11 @@ cluster has been configured for at least one share. The ``placement`` field of
 the cluster resource is passed onto the orchestration layer and is used to
 determine on what nodes of the Ceph cluster Samba containers will be run.
 
-At this time Samba services can only listen on port 445. Due to this
-restriction only one Samba server, as part of one cluster, may run on a single
-Ceph node at a time. Ensure that the placement specs on each cluster do not
-overlap.
+The Samba containers may run on the same hosts if, and only if, the services
+use different IP addresses and/or ports. If the placement spec allows more than
+one container to run on the same host, use the ``bind_addrs`` field, the
+``custom_ports`` field, or some combination, in the cluster resource to ensure
+that the Samba server instances do not conflict.
 
 The ``smb`` clusters are fully isolated from each other. This means that, as
 long as you have sufficient resources in your Ceph cluster, you can run multiple

From 17f994f1c229c0aed204931a5a0dc66ef2ad9b0b Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Wed, 1 Apr 2026 14:30:18 -0400
Subject: [PATCH 572/596] rgw: Check `going_down` in other-than-`interval_set`
 loop

Without this we can end up in an infinite loop where we just fill the
log with -ECANCELED from `get_next()`. Duplicates a check in the
`blocked_operations` loop.

Fixes: https://tracker.ceph.com/issues/76094
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/rgw_coroutine.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/rgw/rgw_coroutine.cc b/src/rgw/rgw_coroutine.cc
index 314e704342b..961a52c309f 100644
--- a/src/rgw/rgw_coroutine.cc
+++ b/src/rgw/rgw_coroutine.cc
@@ -731,7 +731,15 @@ int RGWCoroutinesManager::run(const DoutPrefixProvider *dpp, list<RGWCoroutinesS
       if (ret < 0) {
        ldout(cct, 5) << "completion_mgr.get_next() returned ret=" << ret << dendl;
       }
-      handle_unblocked_stack(context_stacks, scheduled_stacks, io, &blocked_count, &interval_wait_count);
+      // Without this check, `get_next` will error with -ECANCELED and this loop will never exit.
+      if (going_down) {
+        ldout(cct, 5) << __func__ << "(): was stopped, exiting" << dendl;
+        ret = -ECANCELED;
+        canceled = true;
+        break;
+      }
+      handle_unblocked_stack(context_stacks, scheduled_stacks, io,
+                             &blocked_count, &interval_wait_count);
     }
 
 next:

From e8639cc9d4960cbe2a5bbdbf97a673b827c6bde9 Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Wed, 1 Apr 2026 15:40:12 -0400
Subject: [PATCH 573/596] rgw/rados: Initialize things before starting threads
 that use them

To prevent a race condition/crash on realm reload where sync was
trying to put objects through quota before quota was initialized.

Fixes: https://tracker.ceph.com/issues/76094
Fixes: https://tracker.ceph.com/issues/77883
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/driver/rados/rgw_rados.cc | 82 +++++++++++++++----------------
 1 file changed, 41 insertions(+), 41 deletions(-)

diff --git a/src/rgw/driver/rados/rgw_rados.cc b/src/rgw/driver/rados/rgw_rados.cc
index 5907e907534..697d9582371 100644
--- a/src/rgw/driver/rados/rgw_rados.cc
+++ b/src/rgw/driver/rados/rgw_rados.cc
@@ -1371,6 +1371,47 @@ int RGWRados::init_complete(const DoutPrefixProvider *dpp, optional_yield y, rgw
   auto& zone_params = svc.zone->get_zone_params();
   auto& zone = svc.zone->get_zone();
 
+  binfo_cache = new RGWChainedCacheImpl<bucket_info_entry>;
+  binfo_cache->init(svc.cache);
+
+  topic_cache = new RGWChainedCacheImpl<pubsub_bucket_topics_entry>;
+  topic_cache->init(svc.cache);
+
+  lc = new RGWLC();
+  lc->initialize(cct, this->driver);
+
+  restore = make_unique<rgw::restore::Restore>();
+  ret = restore->initialize(cct, this->driver);
+
+  if (ret < 0) {
+    ldpp_dout(dpp, 0) << "ERROR: failed to initialize restore thread" << dendl;
+    return ret;
+  }
+
+  quota_handler = RGWQuotaHandler::generate_handler(dpp, this->driver, quota_threads);
+
+  bucket_index_max_shards = (cct->_conf->rgw_override_bucket_index_max_shards ? cct->_conf->rgw_override_bucket_index_max_shards :
+                             zone.bucket_index_max_shards);
+  if (bucket_index_max_shards > get_max_bucket_shards()) {
+    bucket_index_max_shards = get_max_bucket_shards();
+    ldpp_dout(dpp, 1) << __func__ << " bucket index max shards is too large, reset to value: "
+      << get_max_bucket_shards() << dendl;
+  }
+  ldpp_dout(dpp, 20) << __func__ << " bucket index max shards: " << bucket_index_max_shards << dendl;
+
+  bool need_tombstone_cache = !svc.zone->get_zone_data_notify_to_map().empty(); /* have zones syncing from us */
+
+  if (need_tombstone_cache) {
+    obj_tombstone_cache = new tombstone_cache_t(cct->_conf->rgw_obj_tombstone_cache_size);
+  }
+
+  reshard_wait = std::make_shared<RGWReshardWait>();
+
+  reshard = new RGWReshard(this->driver);
+
+  // disable reshard thread based on zone/zonegroup support
+  run_reshard_thread = run_reshard_thread && svc.zone->can_reshard();
+
   /* no point of running sync thread if we don't have a master zone configured
     or there is no rest_master_conn */
   if (!svc.zone->need_to_sync()) {
@@ -1449,53 +1490,12 @@ int RGWRados::init_complete(const DoutPrefixProvider *dpp, optional_yield y, rgw
     data_notifier->start();
   }
 
-  binfo_cache = new RGWChainedCacheImpl<bucket_info_entry>;
-  binfo_cache->init(svc.cache);
-
-  topic_cache = new RGWChainedCacheImpl<pubsub_bucket_topics_entry>;
-  topic_cache->init(svc.cache);
-
-  lc = new RGWLC();
-  lc->initialize(cct, this->driver);
-
   if (use_lc_thread)
     lc->start_processor();
 
-  restore = make_unique<rgw::restore::Restore>();
-  ret = restore->initialize(cct, this->driver);
-
-  if (ret < 0) {
-    ldpp_dout(dpp, 0) << "ERROR: failed to initialize restore thread" << dendl;
-    return ret;
-  }
-
   if (use_restore_thread)
     restore->start_processor();
 
-  quota_handler = RGWQuotaHandler::generate_handler(dpp, this->driver, quota_threads);
-
-  bucket_index_max_shards = (cct->_conf->rgw_override_bucket_index_max_shards ? cct->_conf->rgw_override_bucket_index_max_shards :
-                             zone.bucket_index_max_shards);
-  if (bucket_index_max_shards > get_max_bucket_shards()) {
-    bucket_index_max_shards = get_max_bucket_shards();
-    ldpp_dout(dpp, 1) << __func__ << " bucket index max shards is too large, reset to value: "
-      << get_max_bucket_shards() << dendl;
-  }
-  ldpp_dout(dpp, 20) << __func__ << " bucket index max shards: " << bucket_index_max_shards << dendl;
-
-  bool need_tombstone_cache = !svc.zone->get_zone_data_notify_to_map().empty(); /* have zones syncing from us */
-
-  if (need_tombstone_cache) {
-    obj_tombstone_cache = new tombstone_cache_t(cct->_conf->rgw_obj_tombstone_cache_size);
-  }
-
-  reshard_wait = std::make_shared<RGWReshardWait>();
-
-  reshard = new RGWReshard(this->driver);
-
-  // disable reshard thread based on zone/zonegroup support
-  run_reshard_thread = run_reshard_thread && svc.zone->can_reshard();
-
   if (run_reshard_thread)  {
     reshard->start_processor();
   }

From 3a099061cff4223a9291d394719cc57fafa6654b Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Tue, 7 Apr 2026 03:06:53 -0400
Subject: [PATCH 574/596] rgw: Fix name and add operators for io_context holder

This is essentially a special case of an optional and it should act
like one.

I asked the original author to updated it but they didn't want to, so
I did it myself.

Fixes: https://tracker.ceph.com/issues/76094
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/rgw_appmain.cc | 12 ++++++------
 src/rgw/rgw_main.h     |  4 +++-
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/rgw/rgw_appmain.cc b/src/rgw/rgw_appmain.cc
index b0ed595a244..cc0322a9f69 100644
--- a/src/rgw/rgw_appmain.cc
+++ b/src/rgw/rgw_appmain.cc
@@ -95,7 +95,7 @@ namespace {
 
 OpsLogFile* rgw::AppMain::ops_log_file;
 
-rgw::AppMain::AppMain(const DoutPrefixProvider* dpp) : dpp(dpp), context_pool_holder(dpp) {}
+rgw::AppMain::AppMain(const DoutPrefixProvider* dpp) : dpp(dpp), context_pool(dpp) {}
 rgw::AppMain::~AppMain() = default;
 
 void rgw::AppMain::init_frontends1(bool nfs) 
@@ -239,7 +239,7 @@ int rgw::AppMain::init_storage()
   DriverManager::Config cfg = DriverManager::get_config(false, g_ceph_context);
   env.driver = DriverManager::get_storage(dpp, dpp->get_cct(),
           cfg,
-          context_pool_holder.get(),
+          *context_pool,
           site,
           run_gc,
           run_lc,
@@ -463,11 +463,11 @@ int rgw::AppMain::init_frontends2(RGWLib* rgwlib)
       fe = new RGWLoadGenFrontend(env, config);
     }
     else if (framework == "beast") {
-      fe = new RGWAsioFrontend(env, config, *sched_ctx, context_pool_holder.get());
+      fe = new RGWAsioFrontend(env, config, *sched_ctx, *context_pool);
       if (g_conf()->rgw_crypt_s3_kms_cache_enabled) {
         env.kms_cache->initialize_ttl_reaper(
             g_conf()->rgw_beast_enable_async
-            ? std::optional(context_pool_holder.get().get_executor())
+            ? std::optional(context_pool->get_executor())
                 : nullopt);
       }
     }
@@ -539,7 +539,7 @@ int rgw::AppMain::init_frontends2(RGWLib* rgwlib)
       rgw_pauser->add_pauser(dedup_background.get());
     }
       reloader = std::make_unique<RGWRealmReloader>(
-          env, *implicit_tenant_context, service_map_meta, rgw_pauser.get(), context_pool_holder.get());
+          env, *implicit_tenant_context, service_map_meta, rgw_pauser.get(), *context_pool);
       realm_watcher->add_watcher(RGWRealmNotify::Reload, *reloader);
     }
   }
@@ -657,7 +657,7 @@ void rgw::AppMain::shutdown(std::function<void(void)> finalize_async_signals)
   env.driver->shutdown();
   // Do this before closing storage so requests don't try to call into
   // closed storage.
-  context_pool_holder.get().finish();
+  context_pool->finish();
 
   cfgstore.reset(); // deletes
   DriverManager::close_storage(env.driver);
diff --git a/src/rgw/rgw_main.h b/src/rgw/rgw_main.h
index 66f4c932af7..d30e7b86609 100644
--- a/src/rgw/rgw_main.h
+++ b/src/rgw/rgw_main.h
@@ -106,9 +106,11 @@ class AppMain {
     IOContextPoolHolder& operator=(const IOContextPoolHolder&) = delete;
 
     ceph::async::io_context_pool& get();
+    ceph::async::io_context_pool& operator*() { return get(); }
+    ceph::async::io_context_pool* operator->() { return std::addressof(get()); }
   };
 
-  IOContextPoolHolder context_pool_holder;
+  IOContextPoolHolder context_pool;
 public:
   AppMain(const DoutPrefixProvider* dpp);
   ~AppMain();

From 3ab380f6f8435095cca2c67464c5ca6f06fee81c Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Wed, 29 Apr 2026 20:57:35 -0400
Subject: [PATCH 575/596] common/async: `io_context_pool` no longer moves from
 init function

Previously if we received an rvalue function object we would call a
moved-from object on all but the first thread. In practice this didn't
cause an issue, but only because of the functions we were passing.

Fixes: https://tracker.ceph.com/issues/76094
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/common/async/context_pool.h | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/common/async/context_pool.h b/src/common/async/context_pool.h
index 6ec194ba77d..12993e9ccc2 100644
--- a/src/common/async/context_pool.h
+++ b/src/common/async/context_pool.h
@@ -18,7 +18,6 @@
 #define CEPH_COMMON_ASYNC_CONTEXT_POOL_H
 
 #include <concepts>
-#include <cstddef>
 #include <cstdint>
 #include <mutex>
 #include <optional>
@@ -54,7 +53,7 @@ public:
   }
   template<std::invocable<> Init>
   io_context_pool(std::int64_t threadcnt, Init&& init) noexcept {
-    start(threadcnt, std::move(init));
+    start(threadcnt, std::forward<Init>(init));
   }
   ~io_context_pool() {
     stop();
@@ -80,8 +79,8 @@ public:
       ioctx.restart();
       for (std::int16_t i = 0; i < threadcnt; ++i) {
 	threadvec.emplace_back(make_named_thread("io_context_pool",
-						 [this, init=std::move(init)] {
-						   std::move(init)();
+						 [this, init] {
+						   init();
 						   ioctx.run();
 						 }));
       }

From 1430b8855352b4d682e1186005861f18e9eb7e45 Mon Sep 17 00:00:00 2001
From: Lumir Sliva <61183145+lumir-sliva@users.noreply.github.com>
Date: Fri, 24 Apr 2026 13:01:23 +0200
Subject: [PATCH 576/596] rgw/beast: dispatch connection close on strand during
 pause

AsioFrontend::pause() (and stop()) call ConnectionList::close() from
the realm reloader thread. That invokes socket.close() on every live
connection from a thread that isn't the connection's asio strand, so
the reactor deregisters each socket's descriptor_state racing against
the coroutine that handles the connection. If a keep-alive connection
is starting its next async_read_some() on its strand at the same time,
epoll_reactor::start_op() dereferences the descriptor_state that close
has already freed and radosgw segfaults in an io_context_pool thread.

This matches the race pattern fixed for timeout_timer in 86ad0b891b0:
any caller that touches socket state from outside the strand needs to
be serialized with the coroutine.

Store the coroutine's strand executor on Connection and dispatch the
close onto that strand in ConnectionList::close(). The lambda captures
an intrusive_ptr to Connection so the object lives until the close
actually runs, since connections.clear() unlinks the list entry right
after dispatch.

Tracker: https://tracker.ceph.com/issues/76094
Signed-off-by: Lumir Sliva <61183145+lumir-sliva@users.noreply.github.com>

Update `unittest_rgw_asio_frontend` to run the `io_context` and
execute in a coroutine to match the environment in RGW.

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/rgw_asio_frontend.cc                  |  8 +-
 src/rgw/rgw_asio_frontend_connection.h        | 39 +++++---
 .../rgw/test_rgw_asio_frontend_connection.cc  | 92 +++++++++++--------
 3 files changed, 84 insertions(+), 55 deletions(-)

diff --git a/src/rgw/rgw_asio_frontend.cc b/src/rgw/rgw_asio_frontend.cc
index 8148001ef3c..96c20548723 100644
--- a/src/rgw/rgw_asio_frontend.cc
+++ b/src/rgw/rgw_asio_frontend.cc
@@ -1174,7 +1174,7 @@ void AsioFrontend::on_accept(Listener& l, tcp::socket stream)
 #endif
     boost::asio::spawn(make_strand(context), std::allocator_arg, make_stack_allocator(),
       [this, s=std::move(stream), ssl_ctx] (boost::asio::yield_context yield) mutable {
-        auto conn = boost::intrusive_ptr{new Connection(std::move(s))};
+        auto conn = boost::intrusive_ptr{new Connection(std::move(s), yield.get_executor())};
         auto c = connections.add(*conn);
         // wrap the tcp stream in an ssl stream
         boost::asio::ssl::stream<tcp::socket&> stream{conn->socket, *ssl_ctx};
@@ -1209,7 +1209,7 @@ void AsioFrontend::on_accept(Listener& l, tcp::socket stream)
 #endif // WITH_RADOSGW_BEAST_OPENSSL
     boost::asio::spawn(make_strand(context), std::allocator_arg, make_stack_allocator(),
       [this, s=std::move(stream)] (boost::asio::yield_context yield) mutable {
-        auto conn = boost::intrusive_ptr{new Connection(std::move(s))};
+        auto conn = boost::intrusive_ptr{new Connection(std::move(s), yield.get_executor())};
         auto c = connections.add(*conn);
         auto timeout = timeout_timer{yield.get_executor(), request_timeout, conn};
         boost::system::error_code ec;
@@ -1254,7 +1254,7 @@ void AsioFrontend::stop()
   }
 
   // close all connections
-  connections.close(ec);
+  connections.close();
   pause_mutex.cancel();
 }
 
@@ -1280,7 +1280,7 @@ void AsioFrontend::pause()
   const bool graceful_stop{ g_ceph_context->_conf->rgw_graceful_stop };
   if (!graceful_stop) {
     // close all connections so outstanding requests fail quickly
-    connections.close(ec);
+    connections.close();
   }
 
   // pause and wait until outstanding requests complete
diff --git a/src/rgw/rgw_asio_frontend_connection.h b/src/rgw/rgw_asio_frontend_connection.h
index d06ef98849a..0f9956fd099 100644
--- a/src/rgw/rgw_asio_frontend_connection.h
+++ b/src/rgw/rgw_asio_frontend_connection.h
@@ -2,9 +2,12 @@
 
 #include <mutex>
 
+#include <boost/asio/any_io_executor.hpp>
+#include <boost/asio/dispatch.hpp>
 #include <boost/asio/ip/tcp.hpp>
 #include <boost/beast/core/flat_static_buffer.hpp>
 #include <boost/intrusive/list.hpp>
+#include <boost/smart_ptr/intrusive_ptr.hpp>
 #include <boost/smart_ptr/intrusive_ref_counter.hpp>
 
 namespace rgw::asio {
@@ -21,12 +24,19 @@ struct Connection : boost::intrusive::list_base_hook<>,
 {
   tcp::socket socket;
   parse_buffer buffer;
+  // executor of the handle_connection coroutine's strand. used so that close()
+  // from outside the strand (e.g. frontend pause) serializes with coroutine
+  // operations on the socket instead of racing the reactor
+  boost::asio::any_io_executor strand;
+  Connection(tcp::socket&& socket,
+             boost::asio::any_io_executor strand) noexcept
+      : socket(std::move(socket)), strand(std::move(strand)) {}
 
-  explicit Connection(tcp::socket&& socket) noexcept
-      : socket(std::move(socket)) {}
-
-  void close(boost::system::error_code& ec) {
-    socket.close(ec);
+  void close() {
+    boost::asio::dispatch(strand, [c = boost::intrusive_ptr<Connection>{this}] {
+      boost::system::error_code ec;
+      c->socket.close(ec);
+    });
   }
 
   tcp::socket& get_socket() { return socket; }
@@ -60,16 +70,21 @@ class ConnectionList {
     std::lock_guard lock{mutex};
     return connections.size();
   }
-  void close(boost::system::error_code& ec) {
+  void close() {
     std::lock_guard lock{mutex};
     for (auto& conn : connections) {
-      // cancel pending reactor operations which delivers operation_aborted
-      // to completion handlers and then shutdown the transport so any
-      // subsequent I/O attempts fail immediately.
-      conn.socket.cancel(ec);
-      conn.socket.shutdown(tcp::socket::shutdown_both, ec);
+      // dispatch operations to the connection's strand so it serializes with
+      // the handle_connection coroutine.
+      boost::asio::dispatch(
+	  conn.strand, [c = boost::intrusive_ptr<Connection>{&conn}] {
+	    boost::system::error_code ec;
+	    // cancel pending reactor operations which delivers operation_aborted
+	    // to completion handlers and then shutdown the transport so any
+	    // subsequent I/O attempts fail immediately.
+	    c->socket.cancel(ec);
+	    c->socket.shutdown(tcp::socket::shutdown_both, ec);
+	  });
     }
   }
 };
-
 } // namespace rgw::asio
diff --git a/src/test/rgw/test_rgw_asio_frontend_connection.cc b/src/test/rgw/test_rgw_asio_frontend_connection.cc
index 079723f586d..c88cfb391ae 100644
--- a/src/test/rgw/test_rgw_asio_frontend_connection.cc
+++ b/src/test/rgw/test_rgw_asio_frontend_connection.cc
@@ -17,6 +17,8 @@
 
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/ip/tcp.hpp>
+#include <boost/asio/strand.hpp>
+#include <boost/asio/spawn.hpp>
 #include <boost/asio/write.hpp>
 #include <boost/intrusive_ptr.hpp>
 
@@ -40,52 +42,64 @@ using rgw::asio::ConnectionList;
 TEST(BeastFrontendShutdown, CloseShutdownsButDoesNotCloseSocket)
 {
   asio::io_context ioctx;
-  ConnectionList connections;
+  asio::spawn(
+      ioctx.get_executor(),
+      [&](asio::yield_context yield) -> void {
+        ConnectionList connections;
 
-  tcp::acceptor acceptor(ioctx, tcp::endpoint(tcp::v4(), 0));
-  acceptor.listen(3);
+        tcp::acceptor acceptor(ioctx, tcp::endpoint(tcp::v4(), 0));
+        acceptor.listen(3);
 
-  tcp::socket c0(ioctx), c1(ioctx), c2(ioctx);
-  c0.connect(acceptor.local_endpoint());
-  auto s0 = acceptor.accept();
-  c1.connect(acceptor.local_endpoint());
-  auto s1 = acceptor.accept();
-  c2.connect(acceptor.local_endpoint());
-  auto s2 = acceptor.accept();
+        tcp::socket c0(ioctx), c1(ioctx), c2(ioctx);
+        c0.async_connect(acceptor.local_endpoint(), yield);
+        auto s0 = acceptor.async_accept(yield);
+        c1.async_connect(acceptor.local_endpoint(), yield);
+        auto s1 = acceptor.async_accept(yield);
+        c2.async_connect(acceptor.local_endpoint(), yield);
+        auto s2 = acceptor.async_accept(yield);
 
-  boost::intrusive_ptr<Connection> conns[] = {
-    new Connection(std::move(s0)),
-    new Connection(std::move(s1)),
-    new Connection(std::move(s2)),
-  };
+        boost::intrusive_ptr<Connection> conns[] = {
+            new Connection(
+                std::move(s0), asio::make_strand(yield.get_executor())),
+            new Connection(
+                std::move(s1), asio::make_strand(yield.get_executor())),
+            new Connection(
+                std::move(s2), asio::make_strand(yield.get_executor())),
+        };
 
-  {
-    auto g0 = connections.add(*conns[0]);
-    auto g1 = connections.add(*conns[1]);
-    auto g2 = connections.add(*conns[2]);
+        {
+          auto g0 = connections.add(*conns[0]);
+          auto g1 = connections.add(*conns[1]);
+          auto g2 = connections.add(*conns[2]);
 
-    ASSERT_EQ(3u, connections.size());
+          ASSERT_EQ(3u, connections.size());
 
-    boost::system::error_code ec;
-    connections.close(ec);
+          connections.close();
 
-    // After close(): sockets must still be "open" from boost::asio's
-    // perspective (fd not released, descriptor_data not zeroed).
-    // socket.close() would have set is_open()=false and fd=-1, which is the
-    // thread-safety violation that causes SIGSEGV.
-    for (auto& conn : conns) {
-      EXPECT_TRUE(conn->socket.is_open());
-      EXPECT_GE(conn->socket.native_handle(), 0);
-    }
+          // After close(): sockets must still be "open" from boost::asio's
+          // perspective (fd not released, descriptor_data not zeroed).
+          // socket.close() would have set is_open()=false and fd=-1, which is the
+          // thread-safety violation that causes SIGSEGV.
+          for (auto& conn : conns) {
+            EXPECT_TRUE(conn->socket.is_open());
+            EXPECT_GE(conn->socket.native_handle(), 0);
+          }
 
-    // But the transport is shut down — writes must fail
-    for (auto& conn : conns) {
-      char buf[] = "test";
-      asio::write(conn->socket, asio::buffer(buf), ec);
-      EXPECT_TRUE(ec.failed())
-          << "Write should fail after shutdown";
-    }
-  } // guards destroyed here — connections removed from list
+          // But the transport is shut down — writes must fail
+          for (auto& conn : conns) {
+            boost::system::error_code ec;
+            char buf[] = "test";
+            asio::async_write(conn->socket, asio::buffer(buf), yield[ec]);
+            EXPECT_TRUE(ec.failed()) << "Write should fail after shutdown";
+          }
+        } // guards destroyed here — connections removed from list
 
-  EXPECT_EQ(0u, connections.size());
+        EXPECT_EQ(0u, connections.size());
+      },
+      [](std::exception_ptr eptr) {
+        if (eptr) {
+          std::rethrow_exception(eptr);
+        }
+      });
+  ioctx.run();
 }

From 8a73bcfecc45e1c488c5a6966b77a5bdc318bbbb Mon Sep 17 00:00:00 2001
From: Kautilya Tripathi <kautilya.tripathi@ibm.com>
Date: Mon, 22 Jun 2026 08:58:43 +0530
Subject: [PATCH 577/596] crimson/osd: guard recovery clone overlap with
 try_lock_for_read

Crimson recovery could use a neighbor clone as a clone_subset source
during osd_recover_clone_overlap without checking whether that clone
was safe to read. Classic OSD takes a read lock on the neighbor clone
via try_lock_for_read() before using it.

Under snap trim + recovery stress, recovery could clone_range from a
clone that snap trim was modifying, producing wrong object content
(ceph_test_rados: incorrect buffer at pos 1462272).

calc_clone_subsets() and calc_head_subsets() now return clone overlap
candidates in preference order only. ReplicatedRecoveryBackend locks
the first usable neighbor clone from each list and holds those read
locks until push/pull recovery completes. RecoveryCloneLockManager
releases locks in its destructor so move-assign cannot leak a held
lock and block snap trim.

Fixes: https://tracker.ceph.com/issues/76499
Signed-off-by: Kautilya Tripathi <kautilya.tripathi@ibm.com>
---
 src/crimson/osd/object_context.h              |   6 +
 src/crimson/osd/object_metadata_helper.cc     | 149 +++++++++---------
 src/crimson/osd/object_metadata_helper.h      |  55 +++++--
 src/crimson/osd/recovery_backend.cc           |   6 +
 src/crimson/osd/recovery_backend.h            |  52 ++++++
 .../osd/replicated_recovery_backend.cc        | 119 +++++++++++---
 src/crimson/osd/replicated_recovery_backend.h |  14 +-
 src/test/crimson/test_calc_subsets.cc         |  64 ++++----
 8 files changed, 317 insertions(+), 148 deletions(-)

diff --git a/src/crimson/osd/object_context.h b/src/crimson/osd/object_context.h
index 1845cb179b3..cbf43fc38a7 100644
--- a/src/crimson/osd/object_context.h
+++ b/src/crimson/osd/object_context.h
@@ -234,6 +234,12 @@ public:
     return lock.is_acquired();
   }
 
+  bool try_get_read_lock() {
+    return lock.try_lock_for_read();
+  }
+  void put_read_lock() {
+    lock.unlock_for_read();
+  }
   bool get_recovery_read() {
     if (lock.try_lock_for_read()) {
       recovery_read_marker = true;
diff --git a/src/crimson/osd/object_metadata_helper.cc b/src/crimson/osd/object_metadata_helper.cc
index 352ede567b3..9766e7117a0 100644
--- a/src/crimson/osd/object_metadata_helper.cc
+++ b/src/crimson/osd/object_metadata_helper.cc
@@ -16,14 +16,17 @@ namespace crimson::osd {
  *   next older and the next newest clone obejct.
  *   Use the existing (next) clones object overlaps instead
  *   of pushing the whole clone object to the replica.
+ *
+ *   Returns candidates in preference order (closest first).
+ *   The caller locks the first usable candidate from each list.
  */
 
-subsets_t calc_clone_subsets(
+clone_overlap_plan_t calc_clone_subsets(
   SnapSet& snapset, const hobject_t& soid,
   const pg_missing_t& missing,
   const hobject_t &last_backfill)
 {
-  subsets_t subsets;
+  clone_overlap_plan_t plan;
   logger().debug("{}: {} clone_overlap {} ",
                  __func__, soid, snapset.clone_overlap);
   assert(missing.get_items().contains(soid));
@@ -34,17 +37,17 @@ subsets_t calc_clone_subsets(
       "{} {} not touched, no need to recover, skipping",
       __func__,
       soid);
-    return subsets;
+    return plan;
   }
   uint64_t size = snapset.clone_size[soid.snap];
   if (size) {
-    subsets.data_subset.insert(0, size);
+    plan.data_subset.insert(0, size);
   }
 
   // let data_subset store only the modified content of the object.
-  subsets.data_subset.intersection_of(dirty_regions);
+  plan.data_subset.intersection_of(dirty_regions);
   logger().debug("{} {} data_subset {}",
-                 __func__, soid, subsets.data_subset);
+                 __func__, soid, plan.data_subset);
 
   // TODO: make sure CEPH_FEATURE_OSD_CACHEPOOL is not supported in Crimson
   // Skips clone subsets if caching was enabled (allow_incomplete_clones).
@@ -52,14 +55,14 @@ subsets_t calc_clone_subsets(
 #ifndef UNIT_TESTS_BUILT
   if (!crimson::common::local_conf()->osd_recover_clone_overlap) {
     logger().debug("{} {} -- osd_recover_clone_overlap is disabled",
-                   __func__, soid); ;
-    return subsets;
+                   __func__, soid);
+    return plan;
   }
 #endif
 
   if (snapset.clones.empty()) {
     logger().debug("{} {} -- no clones", __func__, soid);
-    return subsets;
+    return plan;
   }
 
   auto soid_snap_iter = find(snapset.clones.begin(),
@@ -68,8 +71,7 @@ subsets_t calc_clone_subsets(
   assert(soid_snap_iter != snapset.clones.end());
   auto soid_snap_index = soid_snap_iter - snapset.clones.begin();
 
-  // any overlap with next older clone?
-  interval_set<uint64_t> cloning;
+  // older clones, closest first
   interval_set<uint64_t> prev;
   if (size) {
     prev.insert(0, size);
@@ -80,54 +82,42 @@ subsets_t calc_clone_subsets(
     // clone_overlap of i holds the overlap between i to i+1
     prev.intersection_of(snapset.clone_overlap[snapset.clones[i]]);
     if (!missing.is_missing(clone) && clone < last_backfill) {
-      logger().debug("{} {} has prev {} overlap {}",
+      logger().debug("{} {} candidate prev {} overlap {}",
+                     __func__, soid, clone, prev);
+      plan.older_candidates.push_back(
+        clone_candidate_t{clone, prev});
+    } else {
+      logger().debug("{} {} does not have prev {} overlap {}",
                      __func__, soid, clone, prev);
-      subsets.clone_subsets[clone] = prev;
-      cloning.union_of(prev);
-      break;
     }
-    logger().debug("{} {} does not have prev {} overlap {}",
-                   __func__, soid, clone, prev);
   }
 
-  // overlap with next newest?
+  // newer clones, closest first
   interval_set<uint64_t> next;
   if (size) {
     next.insert(0, size);
   }
-  for (unsigned i = soid_snap_index+1;
+  for (unsigned i = soid_snap_index + 1;
        i < snapset.clones.size(); i++) {
     hobject_t clone = soid;
     clone.snap = snapset.clones[i];
     // clone_overlap of i-1 holds the overlap between i-1 to i
     next.intersection_of(snapset.clone_overlap[snapset.clones[i - 1]]);
     if (!missing.is_missing(clone) && clone < last_backfill) {
-      logger().debug("{} {} has next {} overlap {}",
+      logger().debug("{} {} candidate next {} overlap {}",
+                     __func__, soid, clone, next);
+      plan.newer_candidates.push_back(
+        clone_candidate_t{clone, next});
+    } else {
+      logger().debug("{} {} does not have next {} overlap {}",
                      __func__, soid, clone, next);
-      subsets.clone_subsets[clone] = next;
-      cloning.union_of(next);
-      break;
     }
-    logger().debug("{} {} does not have next {} overlap {}",
-                   __func__, soid, clone, next);
   }
 
-#ifndef UNIT_TESTS_BUILT
-  if (cloning.num_intervals() >
-      crimson::common::local_conf().get_val<uint64_t>
-      ("osd_recover_clone_overlap_limit")) {
-    logger().debug("skipping clone, too many holes");
-    subsets.clone_subsets.clear();
-    cloning.clear();
-  }
-#endif
-
-  // what's left for us to push?
-  subsets.data_subset.subtract(cloning);
-  logger().debug("{} {} data_subsets {}"
-                 "clone_subsets {}",
-                 __func__, soid, subsets.data_subset, subsets.clone_subsets);
-  return subsets;
+  logger().debug("{} {} data_subset {} older_candidates {} newer_candidates {}",
+                 __func__, soid, plan.data_subset,
+                 plan.older_candidates.size(), plan.newer_candidates.size());
+  return plan;
 }
 
 /*
@@ -138,9 +128,11 @@ subsets_t calc_clone_subsets(
  * 2) The modified content may already overlap with the
  *    next older clone obejct. Use the existing clone
  *    object overlap as well.
+ *
+ * Returns older candidates in preference order (newest clone first).
  */
 
-subsets_t calc_head_subsets(
+clone_overlap_plan_t calc_head_subsets(
   uint64_t obj_size,
   SnapSet& snapset,
   const hobject_t& head,
@@ -150,18 +142,18 @@ subsets_t calc_head_subsets(
   logger().debug("{}: {} clone_overlap {} ",
                  __func__, head, snapset.clone_overlap);
 
-  subsets_t subsets;
+  clone_overlap_plan_t plan;
 
 // 1) Calculate modified content only
   if (obj_size) {
-    subsets.data_subset.insert(0, obj_size);
+    plan.data_subset.insert(0, obj_size);
   }
   assert(missing.get_items().contains(head));
   const pg_missing_item &missing_item = missing.get_items().at(head);
   // let data_subset store only the modified content of the object.
-  subsets.data_subset.intersection_of(missing_item.clean_regions.get_dirty_regions());
+  plan.data_subset.intersection_of(missing_item.clean_regions.get_dirty_regions());
   logger().debug("{} {} data_subset {}",
-                 __func__, head, subsets.data_subset);
+                 __func__, head, plan.data_subset);
 
   // TODO: make sure CEPH_FEATURE_OSD_CACHEPOOL is not supported in Crimson
   // Skips clone subsets if caching was enabled (allow_incomplete_clones).
@@ -170,17 +162,16 @@ subsets_t calc_head_subsets(
   if (!crimson::common::local_conf()->osd_recover_clone_overlap) {
     logger().debug("{} {} -- osd_recover_clone_overlap is disabled",
                    __func__, head);
-    return subsets;
+    return plan;
   }
 #endif
 
   if (snapset.clones.empty()) {
     logger().debug("{} {} -- no clones", __func__, head);
-    return subsets;
+    return plan;
   }
 
-  // 2) Find any overlap with next older clone
-  interval_set<uint64_t> cloning;
+  // 2) Candidates: next older clones, newest first
   interval_set<uint64_t> prev;
   hobject_t clone = head;
   if (obj_size) {
@@ -191,39 +182,45 @@ subsets_t calc_head_subsets(
     // let prev store only the overlap with clone i
     prev.intersection_of(snapset.clone_overlap[snapset.clones[i]]);
     if (!missing.is_missing(clone) && clone < last_backfill) {
-      logger().debug("{} {} has prev {} overlap {}",
+      interval_set<uint64_t> overlap = prev;
+      overlap.intersection_of(plan.data_subset);
+      if (overlap.empty()) {
+        logger().debug("{} {} candidate prev {} overlap empty after data_subset",
+                       __func__, head, clone);
+      } else {
+        logger().debug("{} {} candidate prev {} overlap {}",
+                       __func__, head, clone, overlap);
+        plan.older_candidates.push_back(
+          clone_candidate_t{clone, std::move(overlap)});
+      }
+    } else {
+      logger().debug("{} {} does not have prev {} overlap {}",
                      __func__, head, clone, prev);
-      cloning = prev;
-      break;
     }
-    logger().debug("{} {} does not have prev {} overlap {}",
-                   __func__, head, clone, prev);
   }
 
-  // let cloning store only the overlap with data_subset
-  cloning.intersection_of(subsets.data_subset);
-  if (cloning.empty()) {
-    logger().debug("skipping clone, nothing needs to clone");
-    return subsets;
-  }
+  logger().debug("{} {} data_subset {} older_candidates {}",
+                 __func__, head, plan.data_subset,
+                 plan.older_candidates.size());
+  return plan;
+}
 
-#ifndef UNIT_TESTS_BUILT
-  if (cloning.num_intervals() >
-      crimson::common::local_conf().get_val<uint64_t>
-      ("osd_recover_clone_overlap_limit")) {
-    logger().debug("skipping clone, too many holes");
-    subsets.clone_subsets.clear();
-    cloning.clear();
+subsets_t commit_subsets_unlocked(clone_overlap_plan_t plan)
+{
+  subsets_t subsets;
+  subsets.data_subset = std::move(plan.data_subset);
+  interval_set<uint64_t> cloning;
+  if (!plan.older_candidates.empty()) {
+    const auto& c = plan.older_candidates.front();
+    subsets.clone_subsets[c.clone] = c.overlap;
+    cloning.union_of(c.overlap);
+  }
+  if (!plan.newer_candidates.empty()) {
+    const auto& c = plan.newer_candidates.front();
+    subsets.clone_subsets[c.clone] = c.overlap;
+    cloning.union_of(c.overlap);
   }
-#endif
-
-  // what's left for us to push?
-  subsets.clone_subsets[clone] = cloning;
   subsets.data_subset.subtract(cloning);
-  logger().debug("{} {} data_subsets {}"
-                 "clone_subsets {}",
-                 __func__, head, subsets.data_subset, subsets.clone_subsets);
-
   return subsets;
 }
 
diff --git a/src/crimson/osd/object_metadata_helper.h b/src/crimson/osd/object_metadata_helper.h
index 927fc488811..1e6fc13444e 100644
--- a/src/crimson/osd/object_metadata_helper.h
+++ b/src/crimson/osd/object_metadata_helper.h
@@ -1,24 +1,45 @@
 #pragma once
 
+#include <vector>
+
 #include "osd/osd_types_fmt.h"
 
 namespace crimson::osd {
-  struct subsets_t {
-    interval_set<uint64_t> data_subset;
-    std::map<hobject_t, interval_set<uint64_t>> clone_subsets;
-  };
 
-  subsets_t calc_clone_subsets(
-    SnapSet& snapset, const hobject_t& soid,
-    const pg_missing_t& missing,
-    const hobject_t &last_backfill);
-  subsets_t calc_head_subsets(
-    uint64_t obj_size,
-    SnapSet& snapset,
-    const hobject_t& head,
-    const pg_missing_t& missing,
-    const hobject_t &last_backfill);
-  void set_subsets(
-    const subsets_t& subsets,
-    ObjectRecoveryInfo& recovery_info);
+struct clone_candidate_t {
+  hobject_t clone;
+  interval_set<uint64_t> overlap;
+};
+
+/// Pure overlap plan: candidates in preference order (best-first).
+/// Locking / committing a candidate is the caller's responsibility.
+struct clone_overlap_plan_t {
+  interval_set<uint64_t> data_subset;
+  std::vector<clone_candidate_t> older_candidates;
+  std::vector<clone_candidate_t> newer_candidates;
+};
+
+struct subsets_t {
+  interval_set<uint64_t> data_subset;
+  std::map<hobject_t, interval_set<uint64_t>> clone_subsets;
+};
+
+clone_overlap_plan_t calc_clone_subsets(
+  SnapSet& snapset, const hobject_t& soid,
+  const pg_missing_t& missing,
+  const hobject_t &last_backfill);
+clone_overlap_plan_t calc_head_subsets(
+  uint64_t obj_size,
+  SnapSet& snapset,
+  const hobject_t& head,
+  const pg_missing_t& missing,
+  const hobject_t &last_backfill);
+
+/// Build final subsets from a plan, taking the first candidate in each
+/// list (no locking). Used by unit tests.
+subsets_t commit_subsets_unlocked(clone_overlap_plan_t plan);
+
+void set_subsets(
+  const subsets_t& subsets,
+  ObjectRecoveryInfo& recovery_info);
 }
diff --git a/src/crimson/osd/recovery_backend.cc b/src/crimson/osd/recovery_backend.cc
index 1709f56c034..d40fb1704d3 100644
--- a/src/crimson/osd/recovery_backend.cc
+++ b/src/crimson/osd/recovery_backend.cc
@@ -60,6 +60,12 @@ void RecoveryBackend::clean_up(ceph::os::Transaction& t,
   replica_push_targets.clear();
 
   for (auto& [soid, recovery_waiter] : recovering) {
+    for (auto& kv : recovery_waiter->pushing) {
+      kv.second.clone_lock_manager.release_locks();
+    }
+    if (recovery_waiter->pull_info) {
+      recovery_waiter->pull_info->clone_lock_manager.release_locks();
+    }
     if (recovery_waiter->obc) {
       recovery_waiter->obc->interrupt(
 	  ::crimson::common::actingset_changed(
diff --git a/src/crimson/osd/recovery_backend.h b/src/crimson/osd/recovery_backend.h
index 5e164384e43..9ef47858573 100644
--- a/src/crimson/osd/recovery_backend.h
+++ b/src/crimson/osd/recovery_backend.h
@@ -24,6 +24,56 @@ class PG;
 
 class PGRecovery;
 
+/// holds read locks on neighbor clones used for clone overlap recovery
+class RecoveryCloneLockManager {
+  std::map<hobject_t, ObjectContextRef> locks;
+
+  void unlock_all() {
+    for (auto& kv : locks) {
+      kv.second->put_read_lock();
+    }
+    locks.clear();
+  }
+public:
+  RecoveryCloneLockManager() = default;
+  RecoveryCloneLockManager(RecoveryCloneLockManager&& o) noexcept
+    : locks(std::move(o.locks)) {}
+  RecoveryCloneLockManager(const RecoveryCloneLockManager&) = delete;
+  RecoveryCloneLockManager& operator=(RecoveryCloneLockManager&& o) noexcept {
+    if (this != &o) {
+      unlock_all();
+      locks = std::move(o.locks);
+    }
+    return *this;
+  }
+  RecoveryCloneLockManager& operator=(const RecoveryCloneLockManager&) = delete;
+
+  bool try_lock_for_read(
+    const hobject_t& hoid,
+    ObjectContextRegistry& registry) {
+    if (locks.count(hoid)) {
+      return false;
+    }
+    auto obc = registry.maybe_get_cached_obc(hoid);
+    if (!obc || !obc->try_get_read_lock()) {
+      return false;
+    }
+    locks.emplace(hoid, std::move(obc));
+    return true;
+  }
+
+  void release_locks() {
+    unlock_all();
+  }
+
+  ~RecoveryCloneLockManager() {
+    // Safe to unlock from the dtor: unlock_for_read() only decrements
+    // and wakes waiters.  Also covers move-assign replacing a non-empty
+    // target without an explicit release_locks() call.
+    unlock_all();
+  }
+};
+
 class RecoveryBackend {
 public:
   class WaitForObjectRecovery;
@@ -151,6 +201,7 @@ protected:
     crimson::osd::ObjectContextRef head_ctx;
     crimson::osd::ObjectContextRef obc;
     object_stat_sum_t stat;
+    RecoveryCloneLockManager clone_lock_manager;
     bool is_complete() const {
       return recovery_progress.is_complete(recovery_info);
     }
@@ -161,6 +212,7 @@ protected:
     ObjectRecoveryInfo recovery_info;
     crimson::osd::ObjectContextRef obc;
     object_stat_sum_t stat;
+    RecoveryCloneLockManager clone_lock_manager;
   };
 
 public:
diff --git a/src/crimson/osd/replicated_recovery_backend.cc b/src/crimson/osd/replicated_recovery_backend.cc
index 6d43707e14f..445f753b26e 100644
--- a/src/crimson/osd/replicated_recovery_backend.cc
+++ b/src/crimson/osd/replicated_recovery_backend.cc
@@ -134,6 +134,12 @@ ReplicatedRecoveryBackend::maybe_push_shards(
     if (recovery.obc) {
       recovery.obc->drop_recovery_read();
     }
+    for (auto& kv : recovery.pushing) {
+      kv.second.clone_lock_manager.release_locks();
+    }
+    if (recovery.pull_info) {
+      recovery.pull_info->clone_lock_manager.release_locks();
+    }
     recovering.erase(soid);
     return seastar::make_exception_future<>(e);
   });
@@ -386,6 +392,7 @@ ReplicatedRecoveryBackend::prep_push_to_replica(
   auto& obc = recovery_waiter.obc;
   SnapSet push_info_ss; // only populated if soid is_snap()
   crimson::osd::subsets_t subsets;
+  RecoveryCloneLockManager clone_lock_manager;
   const auto& missing =
     pg.get_shard_missing().find(pg_shard)->second;
 
@@ -413,30 +420,35 @@ ReplicatedRecoveryBackend::prep_push_to_replica(
     push_info_ss = ssc->snapset;
     DEBUGDPP("snapset is {}", pg, ssc->snapset);
 
-    subsets = crimson::osd::calc_clone_subsets(
-      ssc->snapset, soid,
-      missing,
-      // get_peer_info() asserts `peer_info` existence.
-      pg.get_peering_state().get_peer_info(
-        pg_shard).last_backfill);
+    subsets = commit_clone_overlap_plan(
+      crimson::osd::calc_clone_subsets(
+        ssc->snapset, soid,
+        missing,
+        // get_peer_info() asserts `peer_info` existence.
+        pg.get_peering_state().get_peer_info(
+          pg_shard).last_backfill),
+      clone_lock_manager);
   } else if (soid.snap == CEPH_NOSNAP) {
     // pushing head or unversioned object.
     // base this on partially on replica's clones?
     auto ssc = obc->ssc;
     ceph_assert(ssc);
     DEBUGDPP("snapset is {}", pg, ssc->snapset);
-    subsets = crimson::osd::calc_head_subsets(
-      obc->obs.oi.size,
-      ssc->snapset, soid,
-      missing,
-      pg.get_peering_state().get_peer_info(
-        pg_shard).last_backfill);
+    subsets = commit_clone_overlap_plan(
+      crimson::osd::calc_head_subsets(
+        obc->obs.oi.size,
+        ssc->snapset, soid,
+        missing,
+        pg.get_peering_state().get_peer_info(
+          pg_shard).last_backfill),
+      clone_lock_manager);
   }
   return prep_push(soid,
                    need,
                    pg_shard,
                    subsets,
-                   push_info_ss);
+                   push_info_ss,
+                   std::move(clone_lock_manager));
 }
 
 RecoveryBackend::interruptible_future<PushOp>
@@ -445,7 +457,8 @@ ReplicatedRecoveryBackend::prep_push(
   eversion_t need,
   pg_shard_t pg_shard,
   const crimson::osd::subsets_t& subsets,
-  const SnapSet push_info_ss)
+  const SnapSet push_info_ss,
+  RecoveryCloneLockManager&& clone_lock_manager)
 {
   LOG_PREFIX(ReplicatedRecoveryBackend::prep_push);
   DEBUGDPP("{}, {}", pg, soid, need);
@@ -459,6 +472,7 @@ ReplicatedRecoveryBackend::prep_push(
   assert(missing_iter != pmissing_iter->second.get_items().end());
 
   push_info.obc = obc;
+  push_info.clone_lock_manager = std::move(clone_lock_manager);
   push_info.recovery_info.size = obc->obs.oi.size;
   push_info.recovery_info.copy_subset = subsets.data_subset;
   push_info.recovery_info.clone_subset = subsets.clone_subsets;
@@ -503,7 +517,7 @@ void ReplicatedRecoveryBackend::prepare_pull(
   pg_shard_t fromshard = *(iter);
 
   pull_op.recovery_info =
-    set_recovery_info(soid, head_obc->ssc);
+    set_recovery_info(soid, head_obc->ssc, pull_info.clone_lock_manager);
   pull_op.soid = soid;
   pull_op.recovery_progress.data_complete = false;
   pull_op.recovery_progress.omap_complete =
@@ -520,7 +534,8 @@ void ReplicatedRecoveryBackend::prepare_pull(
 
 ObjectRecoveryInfo ReplicatedRecoveryBackend::set_recovery_info(
   const hobject_t& soid,
-  const crimson::osd::SnapSetContextRef ssc)
+  const crimson::osd::SnapSetContextRef ssc,
+  RecoveryCloneLockManager& clone_lock_manager)
 {
   LOG_PREFIX(ReplicatedRecoveryBackend::set_recovery_info);
   pg_missing_tracker_t local_missing = pg.get_local_missing();
@@ -530,8 +545,10 @@ ObjectRecoveryInfo ReplicatedRecoveryBackend::set_recovery_info(
     assert(!local_missing.is_missing(soid.get_head()));
     assert(ssc);
     recovery_info.ss = ssc->snapset;
-    auto subsets = crimson::osd::calc_clone_subsets(
-      ssc->snapset, soid, local_missing, pg.get_info().last_backfill);
+    auto subsets = commit_clone_overlap_plan(
+      crimson::osd::calc_clone_subsets(
+        ssc->snapset, soid, local_missing, pg.get_info().last_backfill),
+      clone_lock_manager);
     crimson::osd::set_subsets(subsets, recovery_info);
     DEBUGDPP("pulling {}", pg, recovery_info);
     ceph_assert(ssc->snapset.clone_size.count(soid.snap));
@@ -892,7 +909,8 @@ ReplicatedRecoveryBackend::_handle_pull_response(
     if (pull_info.recovery_info.soid.snap &&
 	pull_info.recovery_info.soid.snap < CEPH_NOSNAP) {
       recalc_subsets(pull_info.recovery_info,
-		     ssc);
+		     ssc,
+		     pull_info.clone_lock_manager);
     }
 
     pull_info.obc = recovery_waiter.obc =
@@ -931,6 +949,7 @@ ReplicatedRecoveryBackend::_handle_pull_response(
 
   if (complete) {
     pull_info.stat.num_objects_recovered++;
+    pull_info.clone_lock_manager.release_locks();
     auto manager = pg.obc_loader.get_obc_manager(
       recovery_waiter.obc);
     manager.lock_excl_sync(); /* cannot already be locked */
@@ -959,15 +978,67 @@ ReplicatedRecoveryBackend::_handle_pull_response(
 
 void ReplicatedRecoveryBackend::recalc_subsets(
     ObjectRecoveryInfo& recovery_info,
-    crimson::osd::SnapSetContextRef ssc)
+    crimson::osd::SnapSetContextRef ssc,
+    RecoveryCloneLockManager& clone_lock_manager)
 {
   assert(ssc);
-  auto subsets = crimson::osd::calc_clone_subsets(
-    ssc->snapset, recovery_info.soid, pg.get_local_missing(),
-    pg.get_info().last_backfill);
+  clone_lock_manager.release_locks();
+  auto subsets = commit_clone_overlap_plan(
+    crimson::osd::calc_clone_subsets(
+      ssc->snapset, recovery_info.soid, pg.get_local_missing(),
+      pg.get_info().last_backfill),
+    clone_lock_manager);
   crimson::osd::set_subsets(subsets, recovery_info);
 }
 
+subsets_t ReplicatedRecoveryBackend::commit_clone_overlap_plan(
+  clone_overlap_plan_t plan,
+  RecoveryCloneLockManager& clone_lock_manager)
+{
+  LOG_PREFIX(ReplicatedRecoveryBackend::commit_clone_overlap_plan);
+  subsets_t subsets;
+  subsets.data_subset = std::move(plan.data_subset);
+  interval_set<uint64_t> cloning;
+
+  auto try_commit = [&](std::vector<clone_candidate_t>& candidates) {
+    for (auto& c : candidates) {
+      // missing was already filtered in calc_*; re-check local missing
+      // in case the set changed, then try the read lock.
+      if (pg.get_local_missing().is_missing(c.clone)) {
+        DEBUGDPP("skip candidate {}, now missing", pg, c.clone);
+        continue;
+      }
+      if (!clone_lock_manager.try_lock_for_read(c.clone, pg.obc_registry)) {
+        DEBUGDPP("skip candidate {}, cannot lock for read", pg, c.clone);
+        continue;
+      }
+      DEBUGDPP("locked candidate {} overlap {}", pg, c.clone, c.overlap);
+      subsets.clone_subsets[c.clone] = c.overlap;
+      cloning.union_of(c.overlap);
+      return;
+    }
+  };
+
+  try_commit(plan.older_candidates);
+  try_commit(plan.newer_candidates);
+
+#ifndef UNIT_TESTS_BUILT
+  if (cloning.num_intervals() >
+      crimson::common::local_conf().get_val<uint64_t>(
+        "osd_recover_clone_overlap_limit")) {
+    DEBUGDPP("skipping clone, too many holes", pg);
+    clone_lock_manager.release_locks();
+    subsets.clone_subsets.clear();
+    cloning.clear();
+  }
+#endif
+
+  subsets.data_subset.subtract(cloning);
+  DEBUGDPP("data_subset {} clone_subsets {}",
+           pg, subsets.data_subset, subsets.clone_subsets);
+  return subsets;
+}
+
 RecoveryBackend::interruptible_future<>
 ReplicatedRecoveryBackend::handle_pull_response(
   Ref<MOSDPGPush> m)
@@ -1122,6 +1193,7 @@ ReplicatedRecoveryBackend::_handle_push_reply(
       }).handle_exception_interruptible(
         [recovering_iter, &push_info, peer] (auto e) {
         push_info.recovery_progress.error = true;
+        push_info.clone_lock_manager.release_locks();
         recovering_iter->second->set_push_failed(peer, e);
         return seastar::make_ready_future<std::optional<PushOp>>();
       });
@@ -1131,6 +1203,7 @@ ReplicatedRecoveryBackend::_handle_push_reply(
                                                  soid,
                                                  push_info.recovery_info);
     }
+    push_info.clone_lock_manager.release_locks();
     recovering_iter->second->set_pushed(peer);
     return seastar::make_ready_future<std::optional<PushOp>>();
   }
diff --git a/src/crimson/osd/replicated_recovery_backend.h b/src/crimson/osd/replicated_recovery_backend.h
index 2b144a08b1b..ce9563ccb69 100644
--- a/src/crimson/osd/replicated_recovery_backend.h
+++ b/src/crimson/osd/replicated_recovery_backend.h
@@ -49,7 +49,8 @@ protected:
     eversion_t need,
     pg_shard_t pg_shard,
     const crimson::osd::subsets_t& subsets,
-    const SnapSet push_info_ss);
+    const SnapSet push_info_ss,
+    RecoveryCloneLockManager&& clone_lock_manager = {});
   void prepare_pull(
     const crimson::osd::ObjectContextRef &head_obc,
     PullOp& pull_op,
@@ -58,7 +59,13 @@ protected:
     eversion_t need);
   ObjectRecoveryInfo set_recovery_info(
     const hobject_t& soid,
-    const crimson::osd::SnapSetContextRef ssc);
+    const crimson::osd::SnapSetContextRef ssc,
+    RecoveryCloneLockManager& clone_lock_manager);
+  /// Lock the first usable candidate from each preference list and
+  /// build final recovery subsets.  Lock policy stays in the backend.
+  subsets_t commit_clone_overlap_plan(
+    clone_overlap_plan_t plan,
+    RecoveryCloneLockManager& clone_lock_manager);
   std::vector<pg_shard_t> get_shards_to_push(
     const hobject_t& soid) const;
   interruptible_future<PushOp> build_push_op(
@@ -73,7 +80,8 @@ protected:
     PullOp* response);
   void recalc_subsets(
     ObjectRecoveryInfo& recovery_info,
-    crimson::osd::SnapSetContextRef ssc);
+    crimson::osd::SnapSetContextRef ssc,
+    RecoveryCloneLockManager& clone_lock_manager);
   std::pair<interval_set<uint64_t>, ceph::bufferlist> trim_pushed_data(
     const interval_set<uint64_t> &copy_subset,
     const interval_set<uint64_t> &intervals_received,
diff --git a/src/test/crimson/test_calc_subsets.cc b/src/test/crimson/test_calc_subsets.cc
index 96888495a84..44b628f931f 100644
--- a/src/test/crimson/test_calc_subsets.cc
+++ b/src/test/crimson/test_calc_subsets.cc
@@ -24,11 +24,12 @@ TEST(head_subsets, dirty_region)
 // ****
 
   crimson::osd::subsets_t result =
-    crimson::osd::calc_head_subsets(obj_size,
-                                    empty_ss,
-                                    head,
-                                    missing,
-                                    last_backfill);
+    crimson::osd::commit_subsets_unlocked(
+      crimson::osd::calc_head_subsets(obj_size,
+                                      empty_ss,
+                                      head,
+                                      missing,
+                                      last_backfill));
 
   EXPECT_TRUE(result.clone_subsets.empty());
   EXPECT_TRUE(result.data_subset == expect_data_region);
@@ -47,11 +48,12 @@ TEST(head_subsets, head_all_clean)
 // ****
 
   crimson::osd::subsets_t result =
-    crimson::osd::calc_head_subsets(obj_size,
-                                    empty_ss,
-                                    head,
-                                    missing,
-                                    last_backfill);
+    crimson::osd::commit_subsets_unlocked(
+      crimson::osd::calc_head_subsets(obj_size,
+                                      empty_ss,
+                                      head,
+                                      missing,
+                                      last_backfill));
 
   EXPECT_TRUE(result.clone_subsets.empty());
   EXPECT_TRUE(result.data_subset.empty());
@@ -71,11 +73,12 @@ TEST(head_subsets, all_dirty)
 // ****
 
   crimson::osd::subsets_t result =
-    crimson::osd::calc_head_subsets(obj_size,
-                                    empty_ss,
-                                    head,
-                                    missing,
-                                    last_backfill);
+    crimson::osd::commit_subsets_unlocked(
+      crimson::osd::calc_head_subsets(obj_size,
+                                      empty_ss,
+                                      head,
+                                      missing,
+                                      last_backfill));
 
   EXPECT_TRUE(result.clone_subsets.empty());
   EXPECT_TRUE(result.data_subset.size() == obj_size);
@@ -118,11 +121,12 @@ TEST(head_subsets, clone_overlap)
 // ****
 
   crimson::osd::subsets_t result =
-    crimson::osd::calc_head_subsets(obj_size,
-                                    ss,
-                                    head,
-                                    missing,
-                                    last_backfill);
+    crimson::osd::commit_subsets_unlocked(
+      crimson::osd::calc_head_subsets(obj_size,
+                                      ss,
+                                      head,
+                                      missing,
+                                      last_backfill));
   EXPECT_TRUE(result.clone_subsets[clone] == expect_clone_subset);
 }
 
@@ -170,11 +174,12 @@ TEST(head_subsets, dirty_region_and_clone_overlap)
 // ****
 
   crimson::osd::subsets_t result =
-    crimson::osd::calc_head_subsets(obj_size,
-                                    ss,
-                                    head,
-                                    missing,
-                                    last_backfill);
+    crimson::osd::commit_subsets_unlocked(
+      crimson::osd::calc_head_subsets(obj_size,
+                                      ss,
+                                      head,
+                                      missing,
+                                      last_backfill));
   EXPECT_TRUE(result.clone_subsets[clone] == expect_clone_subset);
   EXPECT_TRUE(result.data_subset == expect_data_region);
 }
@@ -247,10 +252,11 @@ TEST(clone_subsets, overlap)
 // ****
 
   crimson::osd::subsets_t result =
-    crimson::osd::calc_clone_subsets(ss,
-                                     clone,
-                                     missing,
-                                     last_backfill);
+    crimson::osd::commit_subsets_unlocked(
+      crimson::osd::calc_clone_subsets(ss,
+                                       clone,
+                                       missing,
+                                       last_backfill));
   EXPECT_TRUE(result.clone_subsets[older_clone] == expect_clone_subset1);
   EXPECT_TRUE(result.clone_subsets[newest_clone] == expect_clone_subset2);
 }

From 4b6a4a69df5ed55262e58facb511c9eadc97a928 Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Thu, 9 Jul 2026 12:06:33 +0700
Subject: [PATCH 578/596] doc/radosgw: use ref instead of external link
 definition

Use a validated intra-docs link using the ref role instead of abusing
external link definitions.

Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 doc/radosgw/adminops.rst         | 4 +---
 doc/radosgw/s3_objects_dedup.rst | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/radosgw/adminops.rst b/doc/radosgw/adminops.rst
index 20fce8a7894..22d1a8fa33d 100644
--- a/doc/radosgw/adminops.rst
+++ b/doc/radosgw/adminops.rst
@@ -2939,11 +2939,9 @@ Dedup
 =====
 
 The Admin Operations API can be used to manage RGW object deduplication.
-See `Full RGW Object Dedup`_ for additional details on the dedup feature and
+See :ref:`radosgw-s3-dedup` for additional details on the dedup feature and
 CLI commands.
 
-.. _Full RGW Object Dedup: ../s3_objects_dedup
-
 To view dedup status, the user must have ``dedup=read`` capability. To
 control dedup operations, the user must have ``dedup=write`` capability.
 See the :ref:`radosgw-admin-guide` for details.
diff --git a/doc/radosgw/s3_objects_dedup.rst b/doc/radosgw/s3_objects_dedup.rst
index 3c731766b76..6a15182d76d 100644
--- a/doc/radosgw/s3_objects_dedup.rst
+++ b/doc/radosgw/s3_objects_dedup.rst
@@ -1,3 +1,5 @@
+.. _radosgw-s3-dedup:
+
 =====================
 Full RGW Object Dedup
 =====================

From 5f5e4093ad3dbe306593999a6b1ee0410f079af3 Mon Sep 17 00:00:00 2001
From: Sagar Gopale <sagar.gopale@ibm.com>
Date: Thu, 25 Jun 2026 12:37:25 +0530
Subject: [PATCH 579/596] mgr/dashboard: Align RGW Account Role forms with
 updated UX design

Signed-off-by: Sagar Gopale <sagar.gopale@ibm.com>
---
 .../frontend/cypress/e2e/rgw/accounts.po.ts   |  12 +-
 .../frontend/cypress/e2e/rgw/roles.po.ts      |   2 +-
 .../rgw-account-role-form.component.html      |  73 ++++-
 .../rgw-account-role-form.component.ts        |   3 +-
 .../rgw-user-accounts-form.component.html     | 269 ++++++++++--------
 .../rgw-user-accounts-form.component.scss     |   4 +
 .../rgw-user-accounts-form.component.ts       |   1 +
 .../rgw-user-accounts.component.html          |   2 +-
 .../frontend/src/app/ceph/rgw/rgw.module.ts   |   8 +-
 .../app/core/context/context.component.html   |  10 +-
 .../core/context/context.component.spec.ts    |  11 +-
 .../frontend/src/app/core/core.module.ts      |   6 +-
 12 files changed, 248 insertions(+), 153 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts
index f58932982fd..f172c6265cd 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/accounts.po.ts
@@ -32,6 +32,8 @@ export class AccountsPageHelper extends PageHelper {
     // Enter email
     cy.get('#email').type(account.email);
 
+    cy.contains('button', 'Show advanced settings').click();
+
     // Enter max buckets
     cy.get('input#max_buckets').should('exist').should('have.value', '1000');
 
@@ -49,7 +51,7 @@ export class AccountsPageHelper extends PageHelper {
     cy.get('input#account_checkbox_input').check({ force: true });
 
     // Click the create button and wait for account to be made
-    cy.contains('button', 'Create Account').click();
+    cy.contains('button', 'Create account').click();
 
     this.getFirstTableCell(account.name).should('have.text', account.name);
     this.getTableRow(account.name).within(() => {
@@ -106,6 +108,8 @@ export class AccountsPageHelper extends PageHelper {
     // Enter email
     cy.get('#email').clear().type(account.email);
 
+    cy.contains('button', 'Show advanced settings').click();
+
     // Enter max buckets
     this.selectOption('max_buckets_mode', 'Custom');
     cy.get('input#max_buckets').click().clear().type(account.max_buckets);
@@ -129,7 +133,7 @@ export class AccountsPageHelper extends PageHelper {
     cy.get('input#account_quota_max_objects').clear().type('200');
 
     // Click the create button and wait for account to be made
-    cy.contains('button', 'Edit Account').click();
+    cy.contains('button', 'Edit account').click();
 
     this.getTableRow(account.name).within(() => {
       cy.get('td').eq(this.columnIndex.tenant).should('have.text', account.tenant);
@@ -215,6 +219,8 @@ export class AccountsPageHelper extends PageHelper {
       .find('.cds--form-requirement')
       .should('have.text', ' Please enter a valid email ');
 
+    cy.contains('button', 'Show advanced settings').click();
+
     cy.get('input#max_buckets').click().clear().type('0').blur();
 
     cy.get('label[for=max_buckets]')
@@ -252,6 +258,8 @@ export class AccountsPageHelper extends PageHelper {
       .find('.cds--form-requirement')
       .should('have.text', ' Please enter a valid email ');
 
+    cy.contains('button', 'Show advanced settings').click();
+
     cy.get('input#max_buckets').click().clear().type('0').blur();
 
     cy.get('label[for=max_buckets]')
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts
index 611a060236e..4ec20aa1105 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/roles.po.ts
@@ -38,7 +38,7 @@ export class RolesPageHelper extends PageHelper {
     cy.get('cds-number[formControlName="max_session_duration"] input')
       .clear()
       .type(maxSessionDuration.toString());
-    cy.get('cds-modal').contains('button', 'Edit').click();
+    cy.get('cds-modal').contains('button', 'Save').click();
     cy.get('cds-modal').should('not.exist');
 
     this.getRolesTableCell(this.columnIndex.roleName, name)
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
index 11fff876688..641b3c9c94e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
@@ -1,19 +1,38 @@
 <cds-modal size="md" [open]="open" [hasScrollingContent]="false" (overlaySelected)="closeModal()">
   <cds-modal-header (closeSelect)="closeModal()">
-    <h4 cdsModalHeaderLabel class="cds--type-label-01">{{ accountName }}</h4>
-    <h3 cdsModalHeaderHeading i18n>{{ mode }} role</h3>
+    @if (isEdit) {
+      <h4 cdsModalHeaderLabel class="cds--type-label-01" i18n>Role</h4>
+      <h3 cdsModalHeaderHeading i18n>Edit session duration</h3>
+      <p class="cds--modal-header__description cds--type-body-01 cds-mt-3" i18n>
+        Update the maximum session duration for this role.
+      </p>
+    } @else {
+      <h4 cdsModalHeaderLabel class="cds--type-label-01" i18n>User account</h4>
+      <h3 cdsModalHeaderHeading i18n>Create role</h3>
+      <p class="cds--modal-header__description cds--type-body-01 cds-mt-3" i18n>
+        Role grants temporary permissions to trusted users, applications, or services.
+      </p>
+    }
   </cds-modal-header>
 
   <form class="form" #formDir="ngForm" [formGroup]="form">
     <div cdsModalContent>
+      @if (!isEdit) {
+      <!-- Account -->
+      <div class="form-item">
+        <label class="cds--label cds--type-label-01" i18n>Account</label>
+        <p class="cds--type-body-01">{{ accountName }}</p>
+      </div>
+
       <!-- Role Name -->
       <div class="form-item">
         <cds-text-label
           label="Role name"
           for="role_name"
-          cdRequiredField="Role name"
           [invalid]="roleName.isInvalid"
           [invalidText]="roleNameError"
+          helperText="Unique name used to identify this role within the account."
+          i18n-helperText
           >Role name
           <input
             cdsText
@@ -23,7 +42,7 @@
             id="role_name"
             name="role_name"
             formControlName="role_name"
-            placeholder="Placeholder text"
+            placeholder="Enter a role name (e.g. BackupServiceRole)"
             [invalid]="roleName.isInvalid"
             [autofocus]="true"
             modal-primary-focus
@@ -36,17 +55,44 @@
         </ng-template>
       </div>
 
+      <!-- Role (Edit only) -->
+      } @else {
+      <div class="form-item">
+        <label class="cds--label cds--type-label-01" i18n>Role</label>
+        <p class="cds--type-body-01">
+          <cds-tooltip-definition
+            align="right"
+            [description]="accountTooltip"
+            [openOnHover]="true"
+            [caret]="true"
+            [highContrast]="true"
+            [dropShadow]="true"
+            [autoAlign]="true"
+          >
+            {{ form.getValue('role_name') }}
+          </cds-tooltip-definition>
+        </p>
+        <ng-template #accountTooltip>
+          <div>
+            User account:<br />
+            <strong>{{ accountName }}</strong>
+          </div>
+        </ng-template>
+      </div>
+      }
+
       <!-- Path & Assume Role Policy Document (Create only) -->
       @if (!isEdit) {
       <!-- Path -->
       <div class="form-item">
         <cds-text-label
-          label="Path"
+          label="Role path"
           for="role_path"
-          cdRequiredField="Path"
           [invalid]="rolePath.isInvalid"
           [invalidText]="pathError"
-          >Path
+          helperText='Specifies the hierarchy or namespace for the role. Use "/" for the root path.'
+          i18n-helperText
+          >Role path
           <input
             cdsText
             cdValidate
@@ -55,7 +101,7 @@
             id="role_path"
             name="role_path"
             formControlName="role_path"
-            placeholder="Placeholder text"
+            placeholder="Enter path (/applications/)"
             [invalid]="rolePath.isInvalid"
           />
         </cds-text-label>
@@ -72,7 +118,8 @@
           labelInputID="role_assume_policy_doc"
           [invalid]="policyDoc.isInvalid"
           [invalidText]="policyError"
-          cdRequiredField="Trust Policy"
+          helperText="Defines which principals can assume this role. Enter a valid JSON policy document."
+          i18n-helperText
           >Trust policy
           <textarea
             cdsTextArea
@@ -81,7 +128,7 @@
             id="role_assume_policy_doc"
             name="role_assume_policy_doc"
             formControlName="role_assume_policy_doc"
-            placeholder="Placeholder text"
+            placeholder="Enter a JSON trust policy document"
             rows="8"
             cols="200"
             [invalid]="policyDoc.isInvalid"
@@ -98,11 +145,11 @@
       </div>
       }
 
-      <!-- Max Session Duration (Edit only) -->
+      <!-- Maximum Session Duration (Edit only) -->
       @if (isEdit) {
       <div class="form-item">
         <cds-number
-          label="Max Session Duration (Hours)"
+          label="Maximum session duration (hours)"
           cdValidate
           #maxSessionDuration="cdValidate"
           [invalid]="maxSessionDuration.isInvalid"
@@ -129,7 +176,7 @@
     <cd-form-button-panel
       (submitActionEvent)="onSubmit()"
       [form]="form"
-      [submitText]="mode"
+      [submitText]="isEdit ? 'Save' : 'Create'"
       [modalForm]="true"
     ></cd-form-button-panel>
   </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts
index 8cd266cdf46..ca5db5d287e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.ts
@@ -88,7 +88,8 @@ export class RgwAccountRoleFormComponent extends BaseModal implements OnInit {
           next: () => {
             this.notificationService.show(
               NotificationType.success,
-              $localize`Role updated successfully`
+              $localize`Session duration updated`,
+              $localize`The maximum session duration for role "${this.roleName}" has been updated to ${payload.max_session_duration} hours.`
             );
             this.closeModal();
           },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
index 7233732e63f..9a29716ad9e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
@@ -7,20 +7,23 @@
           novalidate>
 
       <div i18n="form title"
-           class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}
+           class="form-header cds--type-heading-04 cds-mb-5">{{ action | titlecase }} {{ resource | lowercase }}
       </div>
 
+      <h4 class="cds--type-heading-03 cds-mb-4" i18n>Account details</h4>
+
       <!-- Account Name -->
       <div class="form-item">
-        <cds-text-label label="Account Name"
+        <cds-text-label label="Account name"
                         for="acc_name"
-                        cdRequiredField="Account Name"
                         [invalid]="!accountForm.controls.name.valid && accountForm.controls.name.dirty"
                         [invalidText]="accountIdError"
-                        i18n>Account Name
+                        helperText="Name must start and end in alphanumeric characters (3 to 63). Characters allowed: lowercase, numbers and nonconsecutive dots and hyphens."
+                        i18n-helperText
+                        i18n>Account name
           <input cdsText
                  type="text"
-                 placeholder="Enter account name"
+                 placeholder="for example, team-storage-01"
                  id="acc_name"
                  name="acc_name"
                  formControlName="name"/>
@@ -34,12 +37,14 @@
       </div>
       <!-- Tenant -->
       <div class="form-item">
-        <cds-text-label label="tenant"
+        <cds-text-label label="Tenant (optional)"
                         for="tenant"
-                        i18n>Tenant
+                        helperText="Associates this account with an existing tenant namespace."
+                        i18n-helperText
+                        i18n>Tenant (optional)
           <input cdsText
                  type="text"
-                 placeholder="Enter tenant"
+                 placeholder="for example, finance-team"
                  id="tenant"
                  name="tenant"
                  formControlName="tenant"/>
@@ -48,14 +53,16 @@
 
       <!-- Email -->
       <div class="form-item">
-        <cds-text-label label="email"
+        <cds-text-label label="Email address (optional)"
                         for="email"
                         [invalid]="!accountForm.controls.email.valid && accountForm.controls.email.dirty"
                         [invalidText]="emailError"
-                        i18n>Email
+                        helperText="Contact for quota alerts and notifications."
+                        i18n-helperText
+                        i18n>Email address (optional)
           <input cdsText
                  type="text"
-                 placeholder="Enter email"
+                 placeholder="for example, admin@example.com"
                  id="email"
                  name="email"
                  formControlName="email"/>
@@ -67,108 +74,113 @@
         </ng-template>
       </div>
 
-      <div class="form-item form-item-append"
-           cdsRow>
-        <div cdsCol>
-          <!-- Max. bucket mode -->
-          <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_buckets_mode' }"></ng-container>
-        </div>
-        <div cdsCol>
-        <!-- Max buckets -->
-        <span *ngIf="1 == accountForm.get('max_buckets_mode').value">
-          <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_buckets' }"></ng-container>
-          </span>
+      <div class="form-item cds-mt-5 cds-mb-3">
+        <h4 class="cds--type-heading-03" i18n>Advanced settings</h4>
+        <p class="cds--type-body-01" i18n>Configure resource limits and quota for this account</p>
+        <div class="cds-mt-3">
+          <button type="button" class="cds--btn cds--btn--ghost advanced-settings-btn" (click)="showAdvanced = !showAdvanced">
+            {{ showAdvanced ? 'Hide advanced settings' : 'Show advanced settings' }}
+            <svg cdsIcon="chevron--down" *ngIf="!showAdvanced" size="16" class="cds--btn__icon"></svg>
+            <svg cdsIcon="chevron--up" *ngIf="showAdvanced" size="16" class="cds--btn__icon"></svg>
+          </button>
         </div>
       </div>
 
-      <div class="form-item form-item-append"
-           cdsRow>
-        <div cdsCol>
-          <!-- Max. users mode -->
-          <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_users_mode' }"></ng-container>
-        </div>
-        <div cdsCol>
-        <!-- Max users -->
-        <span *ngIf="1 == accountForm.get('max_users_mode').value">
-          <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_users' }"></ng-container>
-          </span>
-        </div>
-      </div>
+      <div *ngIf="showAdvanced">
+        <h5 class="cds--type-heading-02 cds-mb-2" i18n>Resource limits</h5>
+        <p class="cds--type-body-01 cds-mb-4" i18n>Set the mode and maximum allowed values for each resource type. Select Custom to specify a limit.</p>
 
-      <div class="form-item form-item-append"
-           cdsRow>
-        <div cdsCol>
-          <!-- Max. roles mode -->
-          <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_roles_mode' }"></ng-container>
+        <div class="form-item form-item-append" cdsRow>
+          <div cdsCol>
+            <!-- Max. bucket mode -->
+            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_buckets_mode' }"></ng-container>
+          </div>
+          <div cdsCol>
+            <!-- Max buckets -->
+            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_buckets' }"></ng-container>
+          </div>
         </div>
-        <div cdsCol>
-        <!-- Max roles -->
-        <span *ngIf="1 == accountForm.get('max_roles_mode').value">
-          <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_roles' }"></ng-container>
-        </span>
-        </div>
-      </div>
 
-      <div class="form-item form-item-append"
-           cdsRow>
-        <div cdsCol>
-          <!-- Max. group mode -->
-          <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_groups_mode' }"></ng-container>
+        <div class="form-item form-item-append" cdsRow>
+          <div cdsCol>
+            <!-- Max. users mode -->
+            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_users_mode' }"></ng-container>
+          </div>
+          <div cdsCol>
+            <!-- Max users -->
+            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_users' }"></ng-container>
+          </div>
         </div>
-        <div cdsCol>
-        <!-- Max group -->
-        <span *ngIf="1 == accountForm.get('max_groups_mode').value">
-          <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_groups' }"></ng-container>
-          </span>
-        </div>
-      </div>
 
-      <div class="form-item form-item-append"
-           cdsRow>
-        <div cdsCol>
-          <!-- Max. acess keys mode -->
-          <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_access_keys_mode' }"></ng-container>
+        <div class="form-item form-item-append" cdsRow>
+          <div cdsCol>
+            <!-- Max. roles mode -->
+            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_roles_mode' }"></ng-container>
+          </div>
+          <div cdsCol>
+            <!-- Max roles -->
+            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_roles' }"></ng-container>
+          </div>
         </div>
-        <div cdsCol>
-        <!-- Max acess keys -->
-        <span *ngIf="1 == accountForm.get('max_access_keys_mode').value">
-          <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_access_keys' }"></ng-container>
-        </span>
+
+        <div class="form-item form-item-append" cdsRow>
+          <div cdsCol>
+            <!-- Max. group mode -->
+            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_groups_mode' }"></ng-container>
+          </div>
+          <div cdsCol>
+            <!-- Max group -->
+            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_groups' }"></ng-container>
+          </div>
         </div>
-      </div>
 
-      <!-- Account Quota -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="quotaTemplate;context: { formControl: {
-                      enabled: 'account_quota_enabled',
-                      unlimitedSize: 'account_quota_max_size_unlimited',
-                      maxSize: 'account_quota_max_size',
-                      unlimitedObjects: 'account_quota_max_objects_unlimited',
-                      maxObjects: 'account_quota_max_objects'
-                      },
-                      quotaType: 'account'
-                      }">
-        </ng-container>
-      </div>
+        <div class="form-item form-item-append" cdsRow>
+          <div cdsCol>
+            <!-- Max. access keys mode -->
+            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_access_keys_mode' }"></ng-container>
+          </div>
+          <div cdsCol>
+            <!-- Max access keys -->
+            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_access_keys' }"></ng-container>
+          </div>
+        </div>
 
-      <!-- Bucket Quota -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="quotaTemplate;
-                      context: {
-                      formControl: {
-                      enabled: 'bucket_quota_enabled',
-                      unlimitedSize: 'bucket_quota_max_size_unlimited',
-                      maxSize: 'bucket_quota_max_size',
-                      unlimitedObjects: 'bucket_quota_max_objects_unlimited',
-                      maxObjects: 'bucket_quota_max_objects'
-                      },
-                      quotaType: 'bucket'
-                      }">
-        </ng-container>
+        <h5 class="cds--type-heading-02 cds-mb-2 cds-mt-5" i18n>Quotas</h5>
+        <p class="cds--type-body-01 cds-mb-4" i18n>Define storage usage limits for the account and the buckets it owns. Quotas help control capacity consumption and enforce resource allocation policies.</p>
+
+        <!-- Account Quota -->
+        <div class="form-item">
+          <ng-container *ngTemplateOutlet="quotaTemplate;context: { formControl: {
+                        enabled: 'account_quota_enabled',
+                        unlimitedSize: 'account_quota_max_size_unlimited',
+                        maxSize: 'account_quota_max_size',
+                        unlimitedObjects: 'account_quota_max_objects_unlimited',
+                        maxObjects: 'account_quota_max_objects'
+                        },
+                        quotaType: 'account'
+                        }">
+          </ng-container>
+        </div>
+
+        <!-- Bucket Quota -->
+        <div class="form-item">
+          <ng-container *ngTemplateOutlet="quotaTemplate;
+                        context: {
+                        formControl: {
+                        enabled: 'bucket_quota_enabled',
+                        unlimitedSize: 'bucket_quota_max_size_unlimited',
+                        maxSize: 'bucket_quota_max_size',
+                        unlimitedObjects: 'bucket_quota_max_objects_unlimited',
+                        maxObjects: 'bucket_quota_max_objects'
+                        },
+                        quotaType: 'bucket'
+                        }">
+          </ng-container>
+        </div>
       </div>
       <cd-form-button-panel (submitActionEvent)="submit()"
                             [form]="formDir"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+                            [submitText]="(action | titlecase) + ' ' + (resource | lowercase)"
                             wrappingClass="text-right"></cd-form-button-panel>
 
     </form>
@@ -181,7 +193,7 @@
   <cds-select [formControlName]="formControl"
               [name]="formControl"
               [id]="formControl"
-              label="{{formControl.split('_')[1] | upperFirst}} Mode"
+              label="{{formControl.split('_')[1] | upperFirst}} mode"
               (change)="onModeChange($event.target.value, formControl)"
               [helperText]="getHelperTextForMode(formControl)">
     <option value="0">Unlimited</option>
@@ -193,14 +205,28 @@
 <ng-template #accountMaxValueTemplate
              let-formControl="formControl"
              [formGroup]="accountForm">
-<cds-number [id]="formControl"
-            [name]="formControl"
-            formControlName="{{formControl}}"
-            label="{{formControl.split('_')[0] | upperFirst}}. {{formControl.split('_').length > 2 ? formControl.split('_')[1]+' '+formControl.split('_')[2]: formControl.split('_')[1]}}"
-            [min]="1"
-            cdRequiredField="{{formControl.split('_')[0] | upperFirst}}. {{formControl.split('_').length > 2 ? formControl.split('_')[1]+' '+formControl.split('_')[2]: formControl.split('_')[1]}}"
-            [invalid]="!accountForm.controls[formControl].valid && accountForm.controls[formControl].dirty"
-            [invalidText]="maxValError"></cds-number>
+  <cds-number *ngIf="accountForm.get(formControl + '_mode').value == '1'"
+              [id]="formControl"
+              [name]="formControl"
+              formControlName="{{formControl}}"
+              label="Maximum {{formControl.replace('max_', '').replace('_', ' ')}}"
+              [min]="1"
+              [invalid]="!accountForm.controls[formControl].valid && accountForm.controls[formControl].dirty"
+              [invalidText]="maxValError"></cds-number>
+  
+  <cds-text-label *ngIf="accountForm.get(formControl + '_mode').value != '1'"
+                  label="Maximum {{formControl.replace('max_', '').replace('_', ' ')}}"
+                  for="{{formControl}}_disabled">
+    Maximum {{formControl.replace('max_', '').replace('_', ' ')}}
+    <input cdsText
+           type="text"
+           [id]="formControl + '_disabled'"
+           name="{{formControl}}_disabled"
+           [ngModel]="'-'"
+           [ngModelOptions]="{standalone: true}"
+           [disabled]="true" />
+  </cds-text-label>
+
 <ng-template #maxValError>
   <span *ngIf="accountForm.showError(formControl, formDir, 'required')"
         i18n>This field is required.</span>
@@ -215,20 +241,19 @@
              let-quotaType="quotaType"
              let-formControl="formControl"
              [formGroup]="accountForm">
-  <fieldset class="cds--fieldset">
-    <legend class="cds--label">{{quotaType | upperFirst}} Quota</legend>
-    <div *ngIf="quotaType == 'account';else bucket"
-         class="quota-heading">Set quota on account owned by users.</div>
-    <ng-template #bucket>
-      <div class="quota-heading">
-        Set quota on buckets owned by an account.
-      </div>
-    </ng-template>
+  <fieldset class="cds--fieldset cds-mb-4">
+    <legend class="cds--label">{{quotaType | upperFirst}} quota</legend>
     <!-- Enabled -->
-    <cds-checkbox [formControlName]="formControl.enabled"
-                  [id]="quotaType+'_checkbox'">
-      Enabled
+    <cds-checkbox *ngIf="quotaType == 'account'" [formControlName]="formControl.enabled"
+                  [id]="quotaType+'_checkbox'" class="cds-mb-3">
+      Enable account quota
     </cds-checkbox >
+    <cds-checkbox *ngIf="quotaType == 'bucket'" [formControlName]="formControl.enabled"
+                  [id]="quotaType+'_checkbox'" class="cds-mb-3">
+      Enable bucket quota
+    </cds-checkbox >
+    <p class="cds--type-body-01 cds-mb-4" *ngIf="quotaType == 'account'">Applies a storage quota to each user account.</p>
+    <p class="cds--type-body-01 cds-mb-4" *ngIf="quotaType == 'bucket'">Limits the total storage available across all buckets in an account.</p>
     <div class="quota-sub-block"
          *ngIf="accountForm.controls[formControl.enabled].value">
       <!-- Unlimited size -->
@@ -242,10 +267,9 @@
            *ngIf="accountForm.controls[formControl.enabled].value && !accountForm.getValue(formControl.unlimitedSize)">
         <cds-text-label [label]="formControl.maxSize"
                         [for]="formControl.maxSize"
-                        cdRequiredField="Max. size"
                         [invalid]="!accountForm.controls[formControl.maxSize].valid && accountForm.controls[formControl.maxSize].dirty"
                         [invalidText]="quotaSizeError"
-                        i18n>Max. size
+                        i18n>Maximum size
           <input cdsText
                  type="text"
                  placeholder="Enter size"
@@ -274,10 +298,9 @@
            *ngIf="accountForm.controls[formControl.enabled].value && !accountForm.getValue(formControl.unlimitedObjects)">
         <cds-text-label [label]="formControl.maxObjects"
                         [for]="formControl.maxObjects"
-                        cdRequiredField="Max. objects"
                         [invalid]="!accountForm.controls[formControl.maxObjects].valid && accountForm.controls[formControl.maxObjects].dirty"
                         [invalidText]="quotaObjectError"
-                        i18n>Max. objects
+                        i18n>Maximum objects
           <input cdsText
                  type="number"
                  placeholder="Enter number of objects"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.scss
index 6c6969a7718..4f187b9e096 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.scss
@@ -19,3 +19,7 @@
     }
   }
 }
+
+.advanced-settings-btn {
+  margin-left: calc(-1 * layout.$spacing-05);
+}
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts
index 1c1506d7afe..d90ab47aeda 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.ts
@@ -25,6 +25,7 @@ export class RgwUserAccountsFormComponent extends CdForm implements OnInit {
   action: string;
   resource: string;
   editing: boolean = false;
+  showAdvanced: boolean = false;
   submitObservables: Observable<Object>[] = [];
 
   constructor(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html
index 047b89f621d..dddae94c99e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html
@@ -2,7 +2,7 @@
 <legend i18n>
   User Accounts
   <cd-help-text>
-    Administrators can assign unique credentials to users or applications, enabling granular access control and enhancing security across the cluster.
+    Create and manage accounts and their permissions.
   </cd-help-text>
 </legend>
 <cd-table #table
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
index 585f3c25f12..86ee46d60fc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw.module.ts
@@ -96,6 +96,8 @@ import ShareIcon from '@carbon/icons/es/share/16';
 import ViewIcon from '@carbon/icons/es/view/16';
 import PasswordIcon from '@carbon/icons/es/password/16';
 import ArrowDownIcon from '@carbon/icons/es/arrow--down/16';
+import ChevronDownIcon from '@carbon/icons/es/chevron--down/16';
+import ChevronUpIcon from '@carbon/icons/es/chevron--up/16';
 import ProgressBarRoundIcon from '@carbon/icons/es/progress-bar--round/32';
 import ToolsIcon from '@carbon/icons/es/tools/32';
 import UserAccessLocked from '@carbon/icons/es/user--access-locked/16';
@@ -248,6 +250,8 @@ export class RgwModule {
       ViewIcon,
       PasswordIcon,
       ArrowDownIcon,
+      ChevronDownIcon,
+      ChevronUpIcon,
       ProgressBarRoundIcon,
       ToolsIcon,
       UserAccessLocked
@@ -287,12 +291,12 @@ const routes: Routes = [
       {
         path: URLVerbs.CREATE,
         component: RgwUserAccountsFormComponent,
-        data: { breadcrumbs: ActionLabels.CREATE }
+        data: { breadcrumbs: $localize`Create account` }
       },
       {
         path: `${URLVerbs.EDIT}/:id`,
         component: RgwUserAccountsFormComponent,
-        data: { breadcrumbs: ActionLabels.EDIT }
+        data: { breadcrumbs: $localize`Edit account` }
       }
     ]
   },
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html
index f04a96b88cf..bae77dfdbfd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html
@@ -2,22 +2,24 @@
   <ng-container *ngIf="data.ftMap && data.ftMap.rgw && permissions.rgw.read && isRgwRoute && data.daemons.length > 1">
     <div class="cd-context-bar pt-3 pb-3">
       <span class="me-1"
-            i18n>Selected Object Gateway:</span>
+            i18n>Object gateway:</span>
       <div ngbDropdown
            placement="bottom-left"
            class="d-inline-block ms-2">
         <button ngbDropdownToggle
                 class="btn btn-outline-info ctx-bar-selected-rgw-daemon"
                 i18n-title
-                title="Select Object Gateway">
-          {{ data.selectedDaemon.id }} ( {{ data.selectedDaemon.zonegroup_name }} )
+                title="Object gateway">
+          {{ data.selectedDaemon.id }}
+          <cds-tag type="blue" size="sm">{{ data.selectedDaemon.zonegroup_name }}</cds-tag>
         </button>
         <div ngbDropdownMenu>
           <ng-container *ngFor="let daemon of data.daemons">
             <button ngbDropdownItem
                     class="ctx-bar-available-rgw-daemon"
                     (click)="onDaemonSelection(daemon)">
-              {{ daemon.id }} ( {{ daemon.zonegroup_name }} )
+              {{ daemon.id }}
+              <cds-tag type="blue" size="sm">{{ daemon.zonegroup_name }}</cds-tag>
             </button>
           </ng-container>
         </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.spec.ts
index 9512e3183ab..865e9b26f70 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.spec.ts
@@ -12,6 +12,8 @@ import {
   FeatureTogglesService
 } from '~/app/shared/services/feature-toggles.service';
 import { configureTestBed, RgwHelper } from '~/testing/unit-test-helper';
+import { TagModule } from 'carbon-components-angular';
+import { RgwDaemonService } from '~/app/shared/api/rgw-daemon.service';
 import { ContextComponent } from './context.component';
 
 describe('ContextComponent', () => {
@@ -29,7 +31,7 @@ describe('ContextComponent', () => {
 
   configureTestBed({
     declarations: [ContextComponent],
-    imports: [HttpClientTestingModule, RouterTestingModule]
+    imports: [HttpClientTestingModule, RouterTestingModule, TagModule]
   });
 
   beforeEach(() => {
@@ -46,6 +48,7 @@ describe('ContextComponent', () => {
     ftMap = new FeatureTogglesMap();
     ftMap.rgw = true;
     getFeatureTogglesSpy.and.returnValue(of(ftMap));
+    TestBed.inject(RgwDaemonService).selectDaemon(null);
     fixture = TestBed.createComponent(ContextComponent);
     component = fixture.componentInstance;
   });
@@ -69,13 +72,13 @@ describe('ContextComponent', () => {
     const selectedDaemon = fixture.debugElement.nativeElement.querySelector(
       '.ctx-bar-selected-rgw-daemon'
     );
-    expect(selectedDaemon.textContent).toEqual(' daemon2 ( zonegroup2 ) ');
+    expect(selectedDaemon.textContent).toEqual(' daemon2 zonegroup2');
 
     const availableDaemons = fixture.debugElement.nativeElement.querySelectorAll(
       '.ctx-bar-available-rgw-daemon'
     );
     expect(availableDaemons.length).toEqual(daemonList.length);
-    expect(availableDaemons[0].textContent).toEqual(' daemon1 ( zonegroup1 ) ');
+    expect(availableDaemons[0].textContent).toEqual(' daemon1 zonegroup1');
     component.ngOnDestroy();
   }));
 
@@ -94,7 +97,7 @@ describe('ContextComponent', () => {
     const selectedDaemon = fixture.debugElement.nativeElement.querySelector(
       '.ctx-bar-selected-rgw-daemon'
     );
-    expect(selectedDaemon.textContent).toEqual(' daemon3 ( zonegroup3 ) ');
+    expect(selectedDaemon.textContent).toEqual(' daemon3 zonegroup3');
     component.ngOnDestroy();
   }));
 });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/core.module.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/core.module.ts
index dc4e1c189ab..4ed2ad784b3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/core.module.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/core.module.ts
@@ -8,7 +8,8 @@ import {
   PlaceholderModule,
   IconModule,
   ThemeModule,
-  ButtonModule
+  ButtonModule,
+  TagModule
 } from 'carbon-components-angular';
 
 import { ContextComponent } from '~/app/core/context/context.component';
@@ -30,7 +31,8 @@ import { NavigationModule } from './navigation/navigation.module';
     PlaceholderModule,
     IconModule,
     ThemeModule,
-    ButtonModule
+    ButtonModule,
+    TagModule
   ],
   exports: [NavigationModule],
   declarations: [

From d80a038a00fa6e405a3df2ec66f7fdd303a4370c Mon Sep 17 00:00:00 2001
From: Super User <root@li-4c4c4544-0051-4710-8053-c6c04f423534.ibm.com>
Date: Wed, 8 Jul 2026 17:35:16 +0530
Subject: [PATCH 580/596] doc/rbd: clarify mirror resync snapshot behavior

Add documentation explaining that rbd mirror resync only copies
image state and data up to the last mirror-snapshot for
snapshot-based mirroring. Document the requirement to create
a new mirror-snapshot on current primary so that new changes
(including resize operation) gets reflected on secondary after
resync.

Fixes: https://tracker.ceph.com/issues/78050

Signed-off-by: Miki Patel <miki.patel132@gmail.com>
---
 doc/rbd/rbd-mirroring.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/rbd/rbd-mirroring.rst b/doc/rbd/rbd-mirroring.rst
index 5357ce21554..dbeaa179763 100644
--- a/doc/rbd/rbd-mirroring.rst
+++ b/doc/rbd/rbd-mirroring.rst
@@ -558,6 +558,10 @@ For example::
    local cluster's ``rbd-mirror`` daemon process is responsible for performing
    the resync asynchronously.
 
+.. note:: For snapshot-based mirroring, resync replicates the image contents
+   only up to the most recent mirror-snapshot. Create a new mirror-snapshot on
+   the primary image to sync the latest updates.
+
 Mirror Status
 =============
 

From d98e84a6183704f3c32436c9c802483c924e56d3 Mon Sep 17 00:00:00 2001
From: Ronen Friedman <rfriedma@redhat.com>
Date: Sat, 4 Jul 2026 11:29:53 +0000
Subject: [PATCH 581/596] qa/crimson: ignore PG_NOT_DEEP_SCRUBBED in all
 crimson tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As we do not yet scrub scheduling in Crimson, the
OSDs do not perform deep scrubs. last_deep_scrub_stamp thus
stays at epoch 0 for all PGs. The monitor flags these as overdue
immediately, causing spurious test failures — particularly in tests
that restart OSDs (e.g. crimson_fio_restart), where PGs reaching
active+clean state trigger the health check.

Fixes: https://tracker.ceph.com/issues/77929
Signed-off-by: Ronen Friedman <rfriedma@redhat.com>
---
 qa/config/crimson_qa_overrides.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/qa/config/crimson_qa_overrides.yaml b/qa/config/crimson_qa_overrides.yaml
index c0edf21f15e..ce095c423af 100644
--- a/qa/config/crimson_qa_overrides.yaml
+++ b/qa/config/crimson_qa_overrides.yaml
@@ -2,6 +2,8 @@ overrides:
   ceph:
     log-ignorelist:
     - \(POOL_APP_NOT_ENABLED\)
+    # \todo delete once scrub scheduling is enabled in Crimson:
+    - \(PG_NOT_DEEP_SCRUBBED\)
     conf:
       global:
         enable experimental unrecoverable data corrupting features: crimson

From cfb382b82c186401ce2d6cdef4cd7bf13f08bc64 Mon Sep 17 00:00:00 2001
From: Mohit Agrawal <moagrawa@redhat.com>
Date: Tue, 30 Jun 2026 14:23:46 +0530
Subject: [PATCH 582/596] crimson/osd: add per-class mClock scheduler perf
 counters

Fixes: https://tracker.ceph.com/issues/77806
Signed-off-by: Mohit Agrawal <moagrawa@redhat.com>
---
 src/crimson/osd/osd_operation.cc | 72 ++++++++++++++++++++++++++++++++
 src/crimson/osd/osd_operation.h  | 16 ++++++-
 2 files changed, 86 insertions(+), 2 deletions(-)

diff --git a/src/crimson/osd/osd_operation.cc b/src/crimson/osd/osd_operation.cc
index 41b630eb767..7b9a80a8be8 100644
--- a/src/crimson/osd/osd_operation.cc
+++ b/src/crimson/osd/osd_operation.cc
@@ -167,9 +167,61 @@ void OperationThrottler::start()
   return;
 }
 
+void OperationThrottler::register_metrics(const std::string &sched_type) {
+  namespace sm = seastar::metrics;
+
+  LOG_PREFIX(OperationThrottler::register_metrics);
+  INFO("registering metrics for scheduler {}", sched_type);
+  const std::string group_name =
+    (sched_type == "mclock_scheduler") ? "osd_mclock" : "osd_wpq";
+
+  for (auto& [op_class, name] : {
+    std::pair{SchedulerClass::background_recovery,    "background_recovery"},
+    std::pair{SchedulerClass::background_best_effort, "background_best_effort"},
+    std::pair{SchedulerClass::client,                 "client"},
+    std::pair{SchedulerClass::repop,                  "repop"},
+    std::pair{SchedulerClass::immediate,              "immediate"},
+  }) {
+    auto label = sm::label("op_class")(name);
+    metrics.add_group(group_name, {
+      sm::make_counter("throttled_ops",
+        [this, op_class] { return throttled_ops[op_class]; },
+        sm::description("ops delayed by mClock scheduler"), {label}),
+      sm::make_counter("total_wait_ms",
+        [this, op_class] { return total_wait_ms[op_class]; },
+        sm::description("total ms spent waiting in mClock"), {label}),
+      sm::make_gauge("max_wait_ms",
+        [this, op_class] { return max_wait_ms[op_class]; },
+        sm::description("max wait ms in mClock by op class"), {label}),
+      sm::make_histogram("throttle_wait_latency",
+        [this, op_class]() -> seastar::metrics::histogram& {
+          return wait_hist[op_class]; },
+        sm::description("mClock throttle wait distribution"), {label}),
+    });
+  }
+}
+
+
 OperationThrottler::OperationThrottler(ConfigProxy &conf)
 {
   conf.add_observer(this);
+  for (auto op_class : {SchedulerClass::background_recovery,
+                        SchedulerClass::background_best_effort,
+                        SchedulerClass::client,
+                        SchedulerClass::repop,
+                        SchedulerClass::immediate}) {
+    wait_hist[op_class].buckets = {
+      {0, 1},
+      {0, 5},
+      {0, 10},
+      {0, 50},
+      {0, 100},
+      {0, 500},
+      {0, 1000},
+    };
+  }
+  register_metrics(conf.get_val<std::string>("osd_op_queue"));
+
 }
 
 void OperationThrottler::initialize_scheduler(CephContext *cct, ConfigProxy &conf, bool is_rotational, int whoami)
@@ -262,6 +314,26 @@ seastar::future<> OperationThrottler::stop()
   co_return;
 }
 
+void OperationThrottler::record_throttle_wait(
+  SchedulerClass op_class, uint64_t wait_ms)
+{
+  if (wait_ms == 0) {
+    return;
+  }
+  throttled_ops[op_class]++;
+  total_wait_ms[op_class] += wait_ms;
+  max_wait_ms[op_class] = std::max(max_wait_ms[op_class], wait_ms);
+
+  auto& h = wait_hist[op_class];
+  h.sample_count++;
+  h.sample_sum += wait_ms;
+  for (auto& bucket : h.buckets) {
+    if (wait_ms <= bucket.upper_bound) {
+      bucket.count++;
+    }
+  }
+}
+
 void OperationThrottler::dump_detail(Formatter *f) const
 {
   f->dump_unsigned("max_in_progress", max_in_progress);
diff --git a/src/crimson/osd/osd_operation.h b/src/crimson/osd/osd_operation.h
index e41cc1abf52..40a7ddfe73c 100644
--- a/src/crimson/osd/osd_operation.h
+++ b/src/crimson/osd/osd_operation.h
@@ -362,6 +362,13 @@ class OperationThrottler : public BlockerT<OperationThrottler>,
   friend BlockerT<OperationThrottler>;
   static constexpr const char* type_name = "OperationThrottler";
 
+  // Perf counters used to capture mClock throttling behavior per op class
+  std::unordered_map<SchedulerClass, uint64_t> throttled_ops;
+  std::unordered_map<SchedulerClass, uint64_t> total_wait_ms;
+  std::unordered_map<SchedulerClass, uint64_t> max_wait_ms;
+  std::unordered_map<SchedulerClass, seastar::metrics::histogram> wait_hist;
+  seastar::metrics::metric_groups metrics;
+
 public:
   OperationThrottler(ConfigProxy &conf);
   void start();
@@ -396,14 +403,19 @@ public:
     }
   };
 
+  void record_throttle_wait(SchedulerClass op_class, uint64_t wait_ms);
   auto get_throttle(crimson::osd::scheduler::params_t params) {
+    auto start = seastar::steady_clock_type::now();
     return acquire_throttle(
       params
-    ).then([this] {
+    ).then([this, start, klass = params.klass] {
+      auto wait_ms = std::chrono::duration_cast<std::chrono::milliseconds>(
+      seastar::steady_clock_type::now() - start).count();
+      record_throttle_wait(klass, wait_ms);
       return ThrottleReleaser{this};
     });
   }
-
+  void register_metrics(const std::string &sched_type);
   void initialize_scheduler(CephContext* cct, ConfigProxy &conf, bool is_rotational, int whoami);
 private:
   void dump_detail(Formatter *f) const final;

From ce5ceabfae51ea7f1d2168fbdc982521d3766584 Mon Sep 17 00:00:00 2001
From: John Mulligan <jmulligan@redhat.com>
Date: Thu, 9 Jul 2026 10:28:13 -0400
Subject: [PATCH 583/596] qa/workunits/smb: work around test failures by
 pinning smbprotocol version

Work around new tests failures (in the TestHostsAccessToggle1 tests)
where the error/exception handling has apparently changed by just
pinning the version (by excluding the new v1.17.0 and newer versions).

Signed-off-by: John Mulligan <jmulligan@redhat.com>
---
 qa/workunits/smb/smb_tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qa/workunits/smb/smb_tests.sh b/qa/workunits/smb/smb_tests.sh
index 24337ff6c9c..8bb33ca4b03 100755
--- a/qa/workunits/smb/smb_tests.sh
+++ b/qa/workunits/smb/smb_tests.sh
@@ -23,5 +23,5 @@ fi
 trap cleanup EXIT
 
 cd "${HERE}"
-"${VENV}/bin/${PY}" -m pip install pytest smbprotocol
+"${VENV}/bin/${PY}" -m pip install pytest 'smbprotocol<1.17.0'
 "${VENV}/bin/${PY}" -m pytest -v "$@"

From 3c39960168bf9f0dc2dd0c89e8d63dbcd84e0000 Mon Sep 17 00:00:00 2001
From: Shweta Sodani <Shweta.Sodani@ibm.com>
Date: Wed, 1 Jul 2026 16:16:40 +0530
Subject: [PATCH 584/596] mgr/cephadm/smb: Add feature-based REDEPLOY logic for
 SMB services

Implement intelligent action selection for SMB daemon updates by tracking
feature changes as dependencies. When SMB service features change (e.g.,
adding cephfs-proxy, remote-control, keybridge), the system now triggers
a REDEPLOY instead of RECONFIG, as these changes require container
structure modifications.

Fixes: https://tracker.ceph.com/issues/77762

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
---
 src/pybind/mgr/cephadm/services/smb.py        | 23 ++++++++++++++++++-
 .../mgr/cephadm/tests/services/test_smb.py    |  3 ++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/src/pybind/mgr/cephadm/services/smb.py b/src/pybind/mgr/cephadm/services/smb.py
index f63730221eb..79549b55c28 100644
--- a/src/pybind/mgr/cephadm/services/smb.py
+++ b/src/pybind/mgr/cephadm/services/smb.py
@@ -36,6 +36,8 @@ from .cephadmservice import (
 )
 from ..tlsobject_types import TLSCredentials, EMPTY_TLS_CREDENTIALS
 from ..schedule import DaemonPlacement
+from cephadm import utils
+from dataclasses import replace
 
 if TYPE_CHECKING:
     from ..module import CephadmOrchestrator
@@ -300,7 +302,7 @@ class SMBService(CephService):
 
         logger.debug('smb generate_config: %r', config_blobs)
         self._configure_cluster_meta(smb_spec, daemon_spec)
-        deps = self.get_dependencies(self.mgr, smb_spec)
+        deps = sorted(self.get_dependencies(self.mgr, smb_spec))
         return config_blobs, deps
 
     def _cert_or_uri(self, data: Optional[str]) -> Optional[str]:
@@ -534,8 +536,27 @@ class SMBService(CephService):
         for ccc in smb_spec.ceph_cluster_configs or []:
             value = _hash_ceph_cluster_config(ccc)
             out.append(Dep.META(f'ceph_cluster_config.{ccc.alias}', value))
+        # Add features as a dependency
+        out.append(Dep.FIELD('features', ','.join(sorted(smb_spec.features or []))))
         return out
 
+    def choose_next_action(
+        self,
+        scheduled_action: utils.Action,
+        daemon_type: Optional[str],
+        spec: Optional[ServiceSpec],
+        curr_deps: List[str],
+        last_deps: List[str],
+        daemon: Optional[DaemonDescription] = None,
+    ) -> utils.NextDaemonStep:
+        step = super().choose_next_action(
+            scheduled_action, daemon_type, spec, curr_deps, last_deps)
+        if step.action is utils.Action.RECONFIG:
+            sym_diff = set(curr_deps).symmetric_difference(last_deps)
+            if any(d.startswith(Dep.FIELD('features', '')) for d in sym_diff):
+                return replace(step, action=utils.Action.REDEPLOY)
+        return step
+
 
 Network = Union[ipaddress.IPv4Network, ipaddress.IPv6Network]
 
diff --git a/src/pybind/mgr/cephadm/tests/services/test_smb.py b/src/pybind/mgr/cephadm/tests/services/test_smb.py
index 6c942096392..c3239066378 100644
--- a/src/pybind/mgr/cephadm/tests/services/test_smb.py
+++ b/src/pybind/mgr/cephadm/tests/services/test_smb.py
@@ -233,5 +233,6 @@ def test_smb_get_dependencies(cephadm_module):
 
     deps = SMBService.get_dependencies(cephadm_module, spec, spec.service_type)
     assert deps == [
-        'smb+meta:ceph_cluster_config.exo=sha256:859b001f76df4d184b858b9c3e323ca8ff85a311414d0405f4484d17aa481ef3'
+        'smb+meta:ceph_cluster_config.exo=sha256:859b001f76df4d184b858b9c3e323ca8ff85a311414d0405f4484d17aa481ef3',
+        'smb+field:features=domain'
     ]

From b36fc5500b5d0adf75467afcd35b38d52dbe343c Mon Sep 17 00:00:00 2001
From: Yixin Jin <yjin77@yahoo.ca>
Date: Wed, 8 Jul 2026 09:46:12 -0400
Subject: [PATCH 585/596] rgw/cls: Make cmpomap workable for atomic updates
 with different values

1. Make cmp_vals() to take in ObjectOperation to allow
it work with ObjectWriteOperation.

2. Add comments for cmp_set_vals() regarding how different
omap values may be set.

3. Add unit tests to verify the transactional nature of
ObjectWriteOperation used when setting different omap values.

Fixes: https://tracker.ceph.com/issues/76622
Signed-off-by: Yixin Jin <yjin77@yahoo.ca>
---
 src/cls/cmpomap/client.cc                |  2 +-
 src/cls/cmpomap/client.h                 | 12 +++++-
 src/test/cls_cmpomap/test_cls_cmpomap.cc | 49 ++++++++++++++++++++++++
 3 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/src/cls/cmpomap/client.cc b/src/cls/cmpomap/client.cc
index 946f33518d1..8c4a25f0a65 100644
--- a/src/cls/cmpomap/client.cc
+++ b/src/cls/cmpomap/client.cc
@@ -18,7 +18,7 @@
 
 namespace cls::cmpomap {
 
-int cmp_vals(librados::ObjectReadOperation& op,
+int cmp_vals(librados::ObjectOperation& op,
              Mode mode, Op comparison, ComparisonMap values,
              std::optional<ceph::bufferlist> default_value)
 {
diff --git a/src/cls/cmpomap/client.h b/src/cls/cmpomap/client.h
index cfb0be8d97d..521c5fd13cc 100644
--- a/src/cls/cmpomap/client.h
+++ b/src/cls/cmpomap/client.h
@@ -28,7 +28,7 @@ static constexpr uint32_t max_keys = 1000;
 /// comparisons with Mode::U64, failure to decode an input value is reported
 /// as -EINVAL, an empty stored value is compared as 0, and failure to decode
 /// a stored value is reported as -EIO
-[[nodiscard]] int cmp_vals(librados::ObjectReadOperation& op,
+[[nodiscard]] int cmp_vals(librados::ObjectOperation& op,
                            Mode mode, Op comparison, ComparisonMap values,
                            std::optional<ceph::bufferlist> default_value);
 
@@ -38,6 +38,16 @@ static constexpr uint32_t max_keys = 1000;
 /// to decode an input value is reported as -EINVAL. an empty stored value is
 /// compared as 0, while decode failure of a stored value is treated as an
 /// unsuccessful comparison and is not reported as an error
+///
+/// NOTE: This function cannot be used to set different values when Op::EQ
+/// is used. To accomplish this, one may utilize the transactional operation
+/// with librados::ObjectWriteOperation in combination with cmp_vals(). For example,
+///
+///   librados::ObjectWriteOperation op;
+///   // cmp_vals() fails the operation with -ECANCELED if any comparison fails
+///   cls::cmpomap::cmp_vals(op, mode, comparison, cmp_values, std::nullopt);
+///   // write new values on success
+///   op.omap_set(set_values);
 [[nodiscard]] int cmp_set_vals(librados::ObjectWriteOperation& writeop,
                                Mode mode, Op comparison, ComparisonMap values,
                                std::optional<ceph::bufferlist> default_value);
diff --git a/src/test/cls_cmpomap/test_cls_cmpomap.cc b/src/test/cls_cmpomap/test_cls_cmpomap.cc
index 2ea9b260a96..5b5cfc065f7 100644
--- a/src/test/cls_cmpomap/test_cls_cmpomap.cc
+++ b/src/test/cls_cmpomap/test_cls_cmpomap.cc
@@ -446,6 +446,55 @@ TEST_F(CmpOmap, cmp_set_vals_str)
   }
 }
 
+TEST_F(CmpOmap, atomic_omap_set_conditional_match)
+{
+  const std::string oid = __PRETTY_FUNCTION__;
+  const bufferlist value1 = u64_buffer(1);
+  const bufferlist value2 = u64_buffer(42);
+  {
+    std::map<std::string, bufferlist> vals = {
+      {"eq", value1},
+    };
+    ASSERT_EQ(ioctx.omap_set(oid, vals), 0);
+  }
+
+  librados::ObjectWriteOperation op;
+  ASSERT_EQ(cmp_vals(op, Mode::U64, Op::EQ, {{"eq", value1}}, std::nullopt), 0);
+  op.omap_set({{"eq", value2}});
+  ASSERT_EQ(ioctx.operate(oid, &op), 0);
+  {
+    std::map<std::string, bufferlist> vals;
+    ASSERT_EQ(get_vals(oid, &vals), 0);
+    ASSERT_EQ(vals.size(), 1);
+    EXPECT_EQ(value2, vals["eq"]);
+  }
+}
+
+TEST_F(CmpOmap, atomic_omap_set_conditional_mismatch)
+{
+  const std::string oid = __PRETTY_FUNCTION__;
+  const bufferlist value1 = u64_buffer(1);
+  const bufferlist value2 = u64_buffer(2);
+  const bufferlist value3 = u64_buffer(42);
+  {
+    std::map<std::string, bufferlist> vals = {
+      {"eq", value1},
+    };
+    ASSERT_EQ(ioctx.omap_set(oid, vals), 0);
+  }
+
+  librados::ObjectWriteOperation op;
+  ASSERT_EQ(cmp_vals(op, Mode::U64, Op::EQ, {{"eq", value2}}, std::nullopt), 0);
+  op.omap_set({{"eq", value3}});
+  ASSERT_EQ(ioctx.operate(oid, &op), -ECANCELED);
+  {
+    std::map<std::string, bufferlist> vals;
+    ASSERT_EQ(get_vals(oid, &vals), 0);
+    ASSERT_EQ(vals.size(), 1);
+    EXPECT_EQ(value1, vals["eq"]); // Nothing is changed
+  }
+}
+
 TEST_F(CmpOmap, cmp_set_vals_u64)
 {
   const std::string oid = __PRETTY_FUNCTION__;

From 8ed03627fd2a9f9ff4d040fcb60cba2634cf63a0 Mon Sep 17 00:00:00 2001
From: Ville Ojamo <14869000+bluikko@users.noreply.github.com>
Date: Thu, 9 Jul 2026 12:45:37 +0700
Subject: [PATCH 586/596] doc: add orphan files to toctree

Fix three Sphinx warnings and make the documents discoverable.

Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
---
 doc/dev/crimson/index.rst | 2 ++
 doc/radosgw/s3.rst        | 1 +
 2 files changed, 3 insertions(+)

diff --git a/doc/dev/crimson/index.rst b/doc/dev/crimson/index.rst
index 1ee5afd6fb9..0facd5e7388 100644
--- a/doc/dev/crimson/index.rst
+++ b/doc/dev/crimson/index.rst
@@ -420,3 +420,5 @@ Code Walkthroughs
    BackfillMachine <backfillmachine>
    SeaStore <seastore>
    PoseidonStore <poseidonstore>
+   PG Merge Synchronization <pgmerging>
+   The Logical Address in SeaStore <seastore_laddr>
diff --git a/doc/radosgw/s3.rst b/doc/radosgw/s3.rst
index c8f103466a5..32ca2612a48 100644
--- a/doc/radosgw/s3.rst
+++ b/doc/radosgw/s3.rst
@@ -17,6 +17,7 @@ API
    Service Ops <s3/serviceops>
    Bucket Ops <s3/bucketops>
    Object Ops <s3/objectops>
+   S3 Control <s3/s3control>
    C++ <s3/cpp>
    C# <s3/csharp>
    Java <s3/java>

From fc49390a36517b02e49bc350ce082912cc39103d Mon Sep 17 00:00:00 2001
From: John Mulligan <jmulligan@redhat.com>
Date: Thu, 9 Jul 2026 16:12:11 -0400
Subject: [PATCH 587/596] pybind/mgr: disable type checking in
 diskprediction_local

Disable type checking in the __preprocess function of
diskprediction_local. This function is already collecting a lot of
`type: ignore` comments and adding more is getting difficult due to
the structure of this function. This time we were hitting errors
like:

diskprediction_local/predictor.py:160: error: Value of type "NDArray?[Any]" is not indexable  [index]
diskprediction_local/predictor.py:161: error: "NDArray?[Any]" has no attribute "shape"  [attr-defined]

on python 3.12.

Fixes: https://tracker.ceph.com/issues/78117

Signed-off-by: John Mulligan <jmulligan@redhat.com>
---
 src/pybind/mgr/diskprediction_local/predictor.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/pybind/mgr/diskprediction_local/predictor.py b/src/pybind/mgr/diskprediction_local/predictor.py
index 858c5296594..0e36a1d89c7 100644
--- a/src/pybind/mgr/diskprediction_local/predictor.py
+++ b/src/pybind/mgr/diskprediction_local/predictor.py
@@ -26,7 +26,7 @@ import os
 import json
 import pickle
 import logging
-from typing import Any, Dict, List, Optional, Sequence, Tuple
+from typing import Any, Dict, List, Optional, Sequence, Tuple, no_type_check
 
 import numpy as np
 
@@ -119,6 +119,7 @@ class RHDiskFailurePredictor(Predictor):
 
         self.model_dirpath = model_dirpath
 
+    @no_type_check
     def __preprocess(self, disk_days: Sequence[DevSmartT], manufacturer: str) -> Optional[np.ndarray]:
         """Scales and transforms input dataframe to feed it to prediction model
 

From 31f32da51ada25d47d28dfec1baf624e39890285 Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Fri, 10 Jul 2026 11:12:58 +0530
Subject: [PATCH 588/596] .github: fix check-license permission issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RCA done by copilot inside the github actions

Root cause: the workflow is passing the default token to a third‑party action that calls PR/diff APIs, and in this run that token doesn’t have the required permission scope for that request.

From the failing job log:

There seems to be an error in an API request
This is usually due to using a GitHub token without the adequate scope
From the job definition (.github/workflows/check-license.yml):

It uses JJ/github-pr-contains-action
Token passed is ${{ github.token }}
Fix
Grant explicit read permissions needed for pull request metadata/content in this workflow (or job), so the token has consistent scope when the action fetches diff data.

Why this solves it
The action needs to read PR diff data. Explicitly setting pull-requests: read (and contents: read) prevents under-scoped default token behavior that triggers the API failure.

Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .github/workflows/check-license.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/check-license.yml b/.github/workflows/check-license.yml
index 89dcfa292c3..9dc48b6aa30 100644
--- a/.github/workflows/check-license.yml
+++ b/.github/workflows/check-license.yml
@@ -2,6 +2,10 @@
 name: "Check for Incompatible Licenses"
 on: [pull_request]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   pull_request:
     name: "Check for Incompatible Licenses"

From 00f61bb64dfb43410a5669b2817c12f65a362d78 Mon Sep 17 00:00:00 2001
From: Avan Thakkar <athakkar@redhat.com>
Date: Mon, 6 Jul 2026 14:07:03 +0530
Subject: [PATCH 589/596] mgr/cephadm: suppress CEPHADM_FAILED_DAEMON for
 services being removed

When a service is deleted, a daemon belonging to it may transiently
enter a failed state before orphan cleanup removes it. This happens
when there is a race between dependency-changed REDEPLOY and a
service removal going on paralelly.

Skip daemons in update_failed_daemon_health_check whose service is
already in spec_deleted.

Fixes: https://tracker.ceph.com/issues/77944
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/cephadm/module.py | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 24c6483007a..12c45526d2f 100644
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -1184,10 +1184,19 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule):
     def update_failed_daemon_health_check(self) -> None:
         failed_daemons = []
         for dd in self.cache.get_error_daemons():
-            if dd.daemon_type != 'agent':  # agents tracked by CEPHADM_AGENT_DOWN
-                failed_daemons.append('daemon %s on %s is in %s state' % (
-                    dd.name(), dd.hostname, dd.status_desc
-                ))
+            if dd.daemon_type == 'agent':  # agents tracked by CEPHADM_AGENT_DOWN
+                continue
+            assert dd.daemon_type is not None
+            svc_type = daemon_type_to_service(dd.daemon_type)
+            if (svc_type in ServiceSpec.REQUIRES_SERVICE_ID
+                    and dd.service_name() in self.spec_store.spec_deleted):
+                # Service is being removed; daemon failure will be
+                # resolved by orphan cleanup. Don't raise a health
+                # alert that clears itself once removal completes.
+                continue
+            failed_daemons.append('daemon %s on %s is in %s state' % (
+                dd.name(), dd.hostname, dd.status_desc
+            ))
         self.remove_health_warning('CEPHADM_FAILED_DAEMON')
         if failed_daemons:
             self.set_health_warning('CEPHADM_FAILED_DAEMON', f'{len(failed_daemons)} failed cephadm daemon(s)', len(

From 4ae80fb44646972b9750bfa1b70a5498f2e7feac Mon Sep 17 00:00:00 2001
From: Avan Thakkar <athakkar@redhat.com>
Date: Wed, 24 Jun 2026 17:19:20 +0530
Subject: [PATCH 590/596] mgr/smb: gracefully handle transient sqlitedb errors

Translate sqlite3.DatabaseError into a generic StoreUnavailable in
sqlite_store.py and handle it in cli.py and module.py instead of
letting it surface as an unhandled exception

Fixes: https://tracker.ceph.com/issues/78125
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
---
 src/pybind/mgr/smb/cli.py          | 10 +++++-
 src/pybind/mgr/smb/module.py       | 50 +++++++++++++++++++++---------
 src/pybind/mgr/smb/sqlite_store.py | 43 +++++++++++++++----------
 3 files changed, 71 insertions(+), 32 deletions(-)

diff --git a/src/pybind/mgr/smb/cli.py b/src/pybind/mgr/smb/cli.py
index 8b70675a0a9..2159f7e67da 100644
--- a/src/pybind/mgr/smb/cli.py
+++ b/src/pybind/mgr/smb/cli.py
@@ -7,7 +7,7 @@ import functools
 import object_format
 from mgr_module import CLICommandBase
 
-from . import resourcelib
+from . import resourcelib, sqlite_store
 from .proto import Self
 
 
@@ -81,6 +81,11 @@ class NoMatchingValue(object_format.ErrorResponseBase):
         return -errno.ENOENT, "", str(self)
 
 
+class SMBDBUnavailable(object_format.ErrorResponseBase):
+    def format_response(self) -> Tuple[int, str, str]:
+        return -errno.EAGAIN, "", str(self)
+
+
 @contextlib.contextmanager
 def error_wrapper() -> Iterator[None]:
     """Context-decorator that converts between certain common exception types."""
@@ -89,3 +94,6 @@ def error_wrapper() -> Iterator[None]:
     except resourcelib.ResourceTypeError as err:
         msg = f'failed to parse input: {err}'
         raise InvalidInputValue(msg) from err
+    except sqlite_store.StoreUnavailable as err:
+        msg = f'smb database temporarily unavailable: {err}'
+        raise SMBDBUnavailable(msg) from err
diff --git a/src/pybind/mgr/smb/module.py b/src/pybind/mgr/smb/module.py
index 9badbe57460..1eaca8abb26 100644
--- a/src/pybind/mgr/smb/module.py
+++ b/src/pybind/mgr/smb/module.py
@@ -204,6 +204,17 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
             return results.ResultGroup(
                 [results.InvalidResourceResult(err.resource_data, str(err))]
             )
+        except sqlite_store.StoreUnavailable as err:
+            # Reached only via remote() calls (e.g. dashboard), which bypass
+            # cli.py's error_wrapper. Return a result instead of raising so a
+            # transient db outage doesn't surface as an unhandled exception.
+            return results.ResultGroup(
+                [
+                    results.InvalidResourceResult(
+                        {}, f'smb database temporarily unavailable: {err}'
+                    )
+                ]
+            )
 
     @SMBCLICommand('cluster ls', perm='r')
     def cluster_ls(self) -> List[str]:
@@ -738,20 +749,31 @@ class Module(orchestrator.OrchestratorClientMixin, MgrModule):
         """Show resources fetched from the local config store based on resource
         type or resource type and id(s).
         """
-        if not resource_names:
-            resources = self._handler.all_resources()
-        else:
-            try:
-                resources = self._handler.matching_resources(resource_names)
-            except handler.InvalidResourceMatch as err:
-                raise cli.InvalidInputValue(str(err)) from err
-        if password_filter is not PasswordFilter.NONE:
-            op = (PasswordFilter.NONE, password_filter)
-            log.debug('Password filtering for smb show: %r', op)
-            resources = [r.convert(op) for r in resources]
-        if len(resources) == 1 and results is ShowResults.COLLAPSED:
-            return resources[0].to_simplified()
-        return {"resources": [r.to_simplified() for r in resources]}
+        try:
+            if not resource_names:
+                resources = self._handler.all_resources()
+            else:
+                try:
+                    resources = self._handler.matching_resources(
+                        resource_names
+                    )
+                except handler.InvalidResourceMatch as err:
+                    raise cli.InvalidInputValue(str(err)) from err
+            if password_filter is not PasswordFilter.NONE:
+                op = (PasswordFilter.NONE, password_filter)
+                log.debug('Password filtering for smb show: %r', op)
+                resources = [r.convert(op) for r in resources]
+            if len(resources) == 1 and results is ShowResults.COLLAPSED:
+                return resources[0].to_simplified()
+            return {"resources": [r.to_simplified() for r in resources]}
+        except sqlite_store.StoreUnavailable as err:
+            # Reached only via remote() calls (e.g. dashboard), which bypass
+            # cli.py's error_wrapper. Return a value instead of raising so a
+            # transient db outage doesn't surface as an unhandled exception.
+            return {
+                "error": f"smb database temporarily unavailable: {err}",
+                "resources": [],
+            }
 
     def submit_smb_spec(self, spec: SMBSpec) -> None:
         """Submit a new or updated smb spec object to ceph orchestration."""
diff --git a/src/pybind/mgr/smb/sqlite_store.py b/src/pybind/mgr/smb/sqlite_store.py
index 0f01aa5f5b0..3ceb1bfb019 100644
--- a/src/pybind/mgr/smb/sqlite_store.py
+++ b/src/pybind/mgr/smb/sqlite_store.py
@@ -21,6 +21,7 @@ import contextlib
 import copy
 import json
 import logging
+import sqlite3
 import threading
 
 from .config_store import ObjectCachingEntry
@@ -36,6 +37,11 @@ from .proto import (
 log = logging.getLogger(__name__)
 
 
+class StoreUnavailable(RuntimeError):
+    """Raised when the underlying store backend cannot be reached (e.g. a
+    transient RADOS/lock-loss condition during cluster instability)."""
+
+
 class DirectDBAcessor(Protocol):
     """A simple protocol describing the minimal per-mgr-module (mon) store interface
     provided by the fairly giganto MgrModule class.
@@ -290,26 +296,29 @@ class SqliteStore:
 
     @contextlib.contextmanager
     def _db(self) -> Iterator[Cursor]:
-        if self._cursor is not None:
-            log.debug('fetching cached cursor')
-            yield self._cursor
-            return
-        if hasattr(self._backend, 'exclusive_db_cursor'):
-            log.debug('fetching exclusive db cursor')
-            with self._backend.exclusive_db_cursor() as cursor:
+        try:
+            if self._cursor is not None:
+                log.debug('fetching cached cursor')
+                yield self._cursor
+                return
+            if hasattr(self._backend, 'exclusive_db_cursor'):
+                log.debug('fetching exclusive db cursor')
+                with self._backend.exclusive_db_cursor() as cursor:
+                    try:
+                        self._cursor = cursor
+                        yield cursor
+                    finally:
+                        self._cursor = None
+                return
+            log.debug('fetching default db cursor')
+            with self._backend.db:
                 try:
-                    self._cursor = cursor
-                    yield cursor
+                    self._cursor = self._backend.db.cursor()
+                    yield self._cursor
                 finally:
                     self._cursor = None
-            return
-        log.debug('fetching default db cursor')
-        with self._backend.db:
-            try:
-                self._cursor = self._backend.db.cursor()
-                yield self._cursor
-            finally:
-                self._cursor = None
+        except sqlite3.DatabaseError as e:
+            raise StoreUnavailable(str(e)) from e
 
     def __getitem__(self, key: EntryKey) -> SqliteStoreEntry:
         """Return an entry object given a namespaced entry key. This entry does

From 8ae8c8177f809100ee07b4c73d1082293a5ba35c Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Thu, 9 Jul 2026 13:19:59 +0530
Subject: [PATCH 591/596] mgr/dashboard: add more html lint rules and fixer

deprecate the older eslint packages and install the unified official
packages for eslint and migrate .eslintrc to eslint.config.js.

also bump prettier

Fixes: https://tracker.ceph.com/issues/77112
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../mgr/dashboard/frontend/.eslintrc.json     |   95 -
 src/pybind/mgr/dashboard/frontend/.prettierrc |    7 +-
 .../mgr/dashboard/frontend/eslint.config.mjs  |  103 +
 .../mgr/dashboard/frontend/package-lock.json  | 7148 ++---------------
 .../mgr/dashboard/frontend/package.json       |   15 +-
 5 files changed, 654 insertions(+), 6714 deletions(-)
 delete mode 100644 src/pybind/mgr/dashboard/frontend/.eslintrc.json
 create mode 100644 src/pybind/mgr/dashboard/frontend/eslint.config.mjs

diff --git a/src/pybind/mgr/dashboard/frontend/.eslintrc.json b/src/pybind/mgr/dashboard/frontend/.eslintrc.json
deleted file mode 100644
index 1b24d889b6a..00000000000
--- a/src/pybind/mgr/dashboard/frontend/.eslintrc.json
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  "root": true,
-  "ignorePatterns": [
-    "projects/**/*"
-  ],
-  "overrides": [
-    {
-      "files": [
-        "*.ts"
-      ],
-      "parserOptions": {
-        "project": [
-          "tsconfig.json"
-        ],
-        "createDefaultProgram": true
-      },
-      "extends": [
-        "plugin:@angular-eslint/recommended",
-        "plugin:@angular-eslint/template/process-inline-templates"
-      ],
-      "rules": {
-        "no-multiple-empty-lines": [
-          "error",
-          {
-            "max": 2,
-            "maxEOF": 1
-          }
-        ],
-        "spaced-comment": [
-          "error",
-          "always",
-          {
-            "exceptions": ["-", "+", "*"] 
-          }
-        ],
-        "curly": [
-          "error",
-          "multi-line"
-        ],
-        "guard-for-in": "error",
-        "no-restricted-imports": ["error", {
-          "paths": ["rxjs/Rx", {
-            "name" : "@angular/core/testing",
-            "importNames": ["async"]
-          }],
-          "patterns": ["(\\.{1,2}/){2,}"]
-        }],
-        "no-console": [
-          "error",
-          {
-            "allow": [
-              "debug",
-              "info",
-              "time",
-              "timeEnd",
-              "trace"
-            ]
-          }
-        ],
-        "no-trailing-spaces": "error",
-        "no-caller": "error",
-        "no-bitwise": "error",
-        "no-duplicate-imports": "error",
-        "no-eval": "error",
-        "@angular-eslint/directive-selector": [
-          "error",
-          { "type": "attribute", "prefix": "cd", "style": "camelCase" }
-        ],
-        "@angular-eslint/component-selector": [
-          "error",
-          { "type": "element", "prefix": "cd", "style": "kebab-case" }
-        ]
-      }
-    },
-    {
-      "files": [
-        "*.html"
-      ],
-      "extends": [
-        "plugin:@angular-eslint/template/recommended"
-      ],
-      "rules": {
-        "@angular-eslint/template/eqeqeq": "off",
-
-        // HTML validation rules for template files
-        "@angular-eslint/template/alt-text": "error",
-        "@angular-eslint/template/no-duplicate-attributes": "error",
-        "@angular-eslint/template/no-distracting-elements": "error",
-        "@angular-eslint/template/valid-aria": "error",
-        "@angular-eslint/template/table-scope": "error",
-        "@angular-eslint/template/no-positive-tabindex": "error"
-      }
-    }
-  ]
-}
diff --git a/src/pybind/mgr/dashboard/frontend/.prettierrc b/src/pybind/mgr/dashboard/frontend/.prettierrc
index e2c84e58f64..d9e92822716 100644
--- a/src/pybind/mgr/dashboard/frontend/.prettierrc
+++ b/src/pybind/mgr/dashboard/frontend/.prettierrc
@@ -2,5 +2,10 @@
   "arrowParens": "always",
   "printWidth": 100,
   "singleQuote": true,
-  "trailingComma": "none"
+  "trailingComma": "none",
+  "tabWidth": 2,
+  "useTabs": false,
+  "endOfLine": "lf",
+  "singleAttributePerLine": true, 
+  "htmlWhitespaceSensitivity": "css"
 }
diff --git a/src/pybind/mgr/dashboard/frontend/eslint.config.mjs b/src/pybind/mgr/dashboard/frontend/eslint.config.mjs
new file mode 100644
index 00000000000..9809a42a9e5
--- /dev/null
+++ b/src/pybind/mgr/dashboard/frontend/eslint.config.mjs
@@ -0,0 +1,103 @@
+import eslint from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import angular from 'angular-eslint';
+
+export default tseslint.config(
+  {
+    ignores: ['projects/**/*']
+  },
+  {
+    files: ['**/*.ts'],
+    extends: [
+      eslint.configs.recommended,
+      ...tseslint.configs.recommended,
+      ...tseslint.configs.recommendedTypeChecked,
+      ...angular.configs.tsRecommended
+    ],
+    processor: angular.processInlineTemplates,
+    languageOptions: {
+      parserOptions: {
+        project: ['tsconfig.json'],
+        createDefaultProgram: true
+      }
+    },
+    rules: {
+      'no-multiple-empty-lines': [
+        'error',
+        {
+          max: 2,
+          maxEOF: 1
+        }
+      ],
+      'spaced-comment': [
+        'error',
+        'always',
+        {
+          exceptions: ['-', '+', '*']
+        }
+      ],
+      curly: ['error', 'multi-line'],
+      'guard-for-in': 'error',
+      'no-restricted-imports': [
+        'error',
+        {
+          paths: [
+            'rxjs/Rx',
+            {
+              name: '@angular/core/testing',
+              importNames: ['async']
+            }
+          ],
+          patterns: ['(\\.{1,2}/){2,}']
+        }
+      ],
+      'no-console': [
+        'error',
+        {
+          allow: ['debug', 'info', 'time', 'timeEnd', 'trace']
+        }
+      ],
+      'no-trailing-spaces': 'error',
+      'no-caller': 'error',
+      'no-bitwise': 'error',
+      'no-duplicate-imports': 'error',
+      'no-eval': 'error',
+      '@angular-eslint/directive-selector': [
+        'error',
+        {
+          type: 'attribute',
+          prefix: 'cd',
+          style: 'camelCase'
+        }
+      ],
+      '@angular-eslint/component-selector': [
+        'error',
+        {
+          type: 'element',
+          prefix: 'cd',
+          style: 'kebab-case'
+        }
+      ]
+    }
+  },
+  {
+    files: ['**/*.html'],
+    extends: [
+      ...angular.configs.templateRecommended
+    ],
+    rules: {
+      '@angular-eslint/template/eqeqeq': 'off',
+      '@angular-eslint/template/alt-text': 'error',
+      '@angular-eslint/template/no-duplicate-attributes': 'error',
+      '@angular-eslint/template/no-distracting-elements': 'error',
+      '@angular-eslint/template/valid-aria': 'error',
+      '@angular-eslint/template/table-scope': 'error',
+      '@angular-eslint/template/no-positive-tabindex': 'error',
+      '@angular-eslint/template/button-has-type': 'error',
+      '@angular-eslint/template/interactive-supports-focus': 'error',
+      '@angular-eslint/template/click-events-have-key-events': 'error',
+      '@angular-eslint/template/label-has-associated-control': 'error',
+      '@angular-eslint/template/elements-content': 'error'
+    }
+  }
+);
diff --git a/src/pybind/mgr/dashboard/frontend/package-lock.json b/src/pybind/mgr/dashboard/frontend/package-lock.json
index 30aba53baab..3554caf774e 100644
--- a/src/pybind/mgr/dashboard/frontend/package-lock.json
+++ b/src/pybind/mgr/dashboard/frontend/package-lock.json
@@ -53,11 +53,8 @@
         "@angular-devkit/build-angular": "19.2.27",
         "@angular-devkit/core": "19.2.27",
         "@angular-devkit/schematics": "19.2.27",
-        "@angular-eslint/builder": "18.4.0",
-        "@angular-eslint/eslint-plugin": "18.4.0",
-        "@angular-eslint/eslint-plugin-template": "18.4.0",
-        "@angular-eslint/schematics": "18.4.0",
-        "@angular-eslint/template-parser": "18.4.0",
+        "@angular-eslint/builder": "19.8.1",
+        "@angular-eslint/schematics": "19.8.1",
         "@angular/cli": "19.2.27",
         "@angular/compiler-cli": "19.2.25",
         "@angular/language-service": "19.2.25",
@@ -75,8 +72,7 @@
         "@types/node": "22.19.3",
         "@types/validator": "13.15.10",
         "@types/xml2js": "0.4.14",
-        "@typescript-eslint/eslint-plugin": "8.14.0",
-        "@typescript-eslint/parser": "8.14.0",
+        "angular-eslint": "19.8.1",
         "axe-core": "4.4.3",
         "cypress": "12.17.4",
         "cypress-axe": "1.5.0",
@@ -97,7 +93,7 @@
         "ng-mocks": "14.13.1",
         "npm-run-all": "4.1.5",
         "postcss-scss": "4.0.9",
-        "prettier": "2.1.2",
+        "prettier": "3.9.4",
         "pretty-quick": "3.0.2",
         "start-server-and-test": "2.0.3",
         "stylelint": "16.20.0",
@@ -106,20 +102,17 @@
         "table": "6.8.0",
         "ts-node": "10.9.2",
         "typescript": "5.8.3",
+        "typescript-eslint": "8.63.0",
         "validator": "13.15.23"
       }
     },
     "node_modules/@aduh95/viz.js": {
       "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/@aduh95/viz.js/-/viz.js-3.4.0.tgz",
-      "integrity": "sha512-KI2nVf9JdwWCXqK6RVf+9/096G7VWN4Z84mnynlyZKao2xQENW8WNEjLmvdlxS5X8PNWXFC1zqwm7tveOXw/4A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@ampproject/remapping": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
-      "integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.5",
@@ -131,8 +124,6 @@
     },
     "node_modules/@angular-devkit/architect": {
       "version": "0.1902.27",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/architect/-/architect-0.1902.27.tgz",
-      "integrity": "sha512-I2YW4Zn1818toEGKPPcbv8qqglegNnWT4A4GM28LPRg4rOYwPkZzy3PAB7EIJEwZIDQgz2I+Oy0pc56BWcFVUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -147,8 +138,6 @@
     },
     "node_modules/@angular-devkit/architect/node_modules/rxjs": {
       "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
-      "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -157,8 +146,6 @@
     },
     "node_modules/@angular-devkit/build-angular": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/build-angular/-/build-angular-19.2.27.tgz",
-      "integrity": "sha512-63dLzZeRAZiDOWegZHDG1L3Su4m7tfh2n4uV4fXhJYQeyblAQIrmz/dsyjn2cwR021neDbteLCn7MeysKj47/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -283,8 +270,6 @@
     },
     "node_modules/@angular-devkit/build-angular/node_modules/picomatch": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -296,8 +281,6 @@
     },
     "node_modules/@angular-devkit/build-angular/node_modules/rxjs": {
       "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
-      "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -306,15 +289,11 @@
     },
     "node_modules/@angular-devkit/build-angular/node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "dev": true,
       "license": "0BSD"
     },
     "node_modules/@angular-devkit/build-webpack": {
       "version": "0.1902.27",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/build-webpack/-/build-webpack-0.1902.27.tgz",
-      "integrity": "sha512-O3v9/x2+yJrXJIBG0x7o/EMSjRjJqWcJb8u5lHFKut9qCpQJ6oDeoxqGM5SWXIk4RGr3qbAsOragkR2Lsq0cRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -333,8 +312,6 @@
     },
     "node_modules/@angular-devkit/build-webpack/node_modules/rxjs": {
       "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
-      "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -343,8 +320,6 @@
     },
     "node_modules/@angular-devkit/core": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-19.2.27.tgz",
-      "integrity": "sha512-3amNzoCVSKd7ah6l6lBQL4onwwJvqvam7FMoQBILrxtW5LB5ezh8gMSPuA4zJjKjoRzf9uoWdlzqv/84I52xZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -371,8 +346,6 @@
     },
     "node_modules/@angular-devkit/core/node_modules/ajv": {
       "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
-      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -388,8 +361,6 @@
     },
     "node_modules/@angular-devkit/core/node_modules/picomatch": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -401,8 +372,6 @@
     },
     "node_modules/@angular-devkit/core/node_modules/rxjs": {
       "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
-      "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -411,8 +380,6 @@
     },
     "node_modules/@angular-devkit/schematics": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-19.2.27.tgz",
-      "integrity": "sha512-/PZmyAlb2NGWPikRRuiWLdfHQd8Wrx6lX4HqvTcaDhlU43M3T0ud4PH2T3QDp7BzHYY92xtD8iPxX2asg67G1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -430,8 +397,6 @@
     },
     "node_modules/@angular-devkit/schematics/node_modules/rxjs": {
       "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
-      "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -439,32 +404,52 @@
       }
     },
     "node_modules/@angular-eslint/builder": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/builder/-/builder-18.4.0.tgz",
-      "integrity": "sha512-FOzGHX/nHSV1wSduSsabsx3aqC1nfde0opEpEDSOJhxExDxKCwoS1XPy1aERGyKip4ZVA6phC3dLtoBH3QMkVQ==",
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/builder/-/builder-19.8.1.tgz",
+      "integrity": "sha512-NOMkw0xgDoDVCLkL5nkkvdd3ouDYkOGqtEmabTR7N4/kQnk1R4coOTWGCqAgMXCFdxlyjuxquDwuJ+yni81pRg==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "@angular-devkit/architect": ">= 0.1900.0 < 0.2000.0",
+        "@angular-devkit/core": ">= 19.0.0 < 20.0.0"
+      },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0",
         "typescript": "*"
       }
     },
-    "node_modules/@angular-eslint/bundled-angular-compiler": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/bundled-angular-compiler/-/bundled-angular-compiler-18.4.0.tgz",
-      "integrity": "sha512-HlFHt2qgdd+jqyVIkCXmrjHauXo/XY3Rp0UNabk83ejGi/raM/6lEFI7iFWzHxLyiAKk4OgGI5W26giSQw991A==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@angular-eslint/eslint-plugin": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/eslint-plugin/-/eslint-plugin-18.4.0.tgz",
-      "integrity": "sha512-Saz9lkWPN3da7ZKW17UsOSN7DeY+TPh+wz/6GCNZCh67Uw2wvMC9agb+4hgpZNXYCP5+u7erqzxQmBoWnS/A+A==",
+    "node_modules/@angular-eslint/schematics": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/schematics/-/schematics-19.8.1.tgz",
+      "integrity": "sha512-MKzfO3puOCuQFgP8XDUkEr5eaqcCQLAdYLLMcywEO/iRs1eRHL46+rkW+SjDp1cUqlxKtu+rLiTYr0T/O4fi9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-eslint/bundled-angular-compiler": "18.4.0",
-        "@angular-eslint/utils": "18.4.0"
+        "@angular-devkit/core": ">= 19.0.0 < 20.0.0",
+        "@angular-devkit/schematics": ">= 19.0.0 < 20.0.0",
+        "@angular-eslint/eslint-plugin": "19.8.1",
+        "@angular-eslint/eslint-plugin-template": "19.8.1",
+        "ignore": "7.0.5",
+        "semver": "7.7.2",
+        "strip-json-comments": "3.1.1"
+      }
+    },
+    "node_modules/@angular-eslint/schematics/node_modules/@angular-eslint/bundled-angular-compiler": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/bundled-angular-compiler/-/bundled-angular-compiler-19.8.1.tgz",
+      "integrity": "sha512-WXi1YbSs7SIQo48u+fCcc5Nt14/T4QzYQPLZUnjtsUXPgQG7ZoahhcGf7PPQ+n0V3pSopHOlSHwqK+tSsYK87A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@angular-eslint/schematics/node_modules/@angular-eslint/eslint-plugin": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/eslint-plugin/-/eslint-plugin-19.8.1.tgz",
+      "integrity": "sha512-wZEBMPwD2TRhifG751hcj137EMIEaFmsxRB2EI+vfINCgPnFGSGGOHXqi8aInn9fXqHs7VbXkAzXYdBsvy1m4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@angular-eslint/bundled-angular-compiler": "19.8.1",
+        "@angular-eslint/utils": "19.8.1"
       },
       "peerDependencies": {
         "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
@@ -472,47 +457,55 @@
         "typescript": "*"
       }
     },
-    "node_modules/@angular-eslint/eslint-plugin-template": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/eslint-plugin-template/-/eslint-plugin-template-18.4.0.tgz",
-      "integrity": "sha512-n3uZFCy76DnggPqjSVFV3gYD1ik7jCG28o2/HO4kobcMNKnwW8XAlFUagQ4TipNQh7fQiAefsEqvv2quMsYDVw==",
+    "node_modules/@angular-eslint/schematics/node_modules/@angular-eslint/eslint-plugin-template": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/eslint-plugin-template/-/eslint-plugin-template-19.8.1.tgz",
+      "integrity": "sha512-0ZVQldndLrDfB0tzFe/uIwvkUcakw8qGxvkEU0l7kSbv/ngNQ/qrkRi7P64otB15inIDUNZI2jtmVat52dqSfQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-eslint/bundled-angular-compiler": "18.4.0",
-        "@angular-eslint/utils": "18.4.0",
+        "@angular-eslint/bundled-angular-compiler": "19.8.1",
+        "@angular-eslint/utils": "19.8.1",
         "aria-query": "5.3.2",
         "axobject-query": "4.1.0"
       },
       "peerDependencies": {
+        "@angular-eslint/template-parser": "19.8.1",
         "@typescript-eslint/types": "^7.11.0 || ^8.0.0",
         "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
         "eslint": "^8.57.0 || ^9.0.0",
         "typescript": "*"
       }
     },
-    "node_modules/@angular-eslint/schematics": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/schematics/-/schematics-18.4.0.tgz",
-      "integrity": "sha512-ssqe+0YCfekbWIXNdCrHfoPK/bPZAWybs0Bn/b99dfd8h8uyXkERo9AzIOx4Uyj/08SkP9aPL/0uOOEHDsRGwQ==",
+    "node_modules/@angular-eslint/schematics/node_modules/@angular-eslint/utils": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/utils/-/utils-19.8.1.tgz",
+      "integrity": "sha512-gVDKYWmAjeTPtaYmddT/HS03fCebXJtrk8G1MouQIviZbHqLjap6TbVlzlkBigRzaF0WnFnrDduQslkJzEdceA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@angular-eslint/eslint-plugin": "18.4.0",
-        "@angular-eslint/eslint-plugin-template": "18.4.0",
-        "ignore": "5.3.2",
-        "semver": "7.6.3",
-        "strip-json-comments": "3.1.1"
+        "@angular-eslint/bundled-angular-compiler": "19.8.1"
       },
       "peerDependencies": {
-        "@angular-devkit/core": ">= 18.0.0 < 19.0.0",
-        "@angular-devkit/schematics": ">= 18.0.0 < 19.0.0"
+        "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
+        "eslint": "^8.57.0 || ^9.0.0",
+        "typescript": "*"
+      }
+    },
+    "node_modules/@angular-eslint/schematics/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
       }
     },
     "node_modules/@angular-eslint/schematics/node_modules/semver": {
-      "version": "7.6.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "version": "7.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
+      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -522,40 +515,8 @@
         "node": ">=10"
       }
     },
-    "node_modules/@angular-eslint/template-parser": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/template-parser/-/template-parser-18.4.0.tgz",
-      "integrity": "sha512-VTep3Xd3IOaRIPL+JN/TV4/2DqUPbjtF3TNY15diD/llnrEhqFnmsvMihexbQyTqzOG+zU554oK44YfvAtHOrw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@angular-eslint/bundled-angular-compiler": "18.4.0",
-        "eslint-scope": "^8.0.2"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": "*"
-      }
-    },
-    "node_modules/@angular-eslint/utils": {
-      "version": "18.4.0",
-      "resolved": "https://registry.npmjs.org/@angular-eslint/utils/-/utils-18.4.0.tgz",
-      "integrity": "sha512-At1yS8GRviGBoaupiQwEOL4/IcZJCE/+2vpXdItMWPGB1HWetxlKAUZTMmIBX/r5Z7CoXxl+LbqpGhrhyzIQAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@angular-eslint/bundled-angular-compiler": "18.4.0"
-      },
-      "peerDependencies": {
-        "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": "*"
-      }
-    },
     "node_modules/@angular/animations": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/animations/-/animations-19.2.25.tgz",
-      "integrity": "sha512-1IE7wuC3ecAumb7ZQHCugV1jsSl93j0omX7BAWwwmM8C7Xo//fZcO/ad/IFfn0zV/VCBAhOAFBUKUIVAGpsylw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -570,8 +531,6 @@
     },
     "node_modules/@angular/build": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@angular/build/-/build-19.2.27.tgz",
-      "integrity": "sha512-kMcuTUxDcnTa+JF9SaxdY+b6pkGjtefxGp/VYblSbvlzQ1rVX4wH4V9LHHyXsTOxRRNGqRJ01g0Enhq1iA19mQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -656,8 +615,6 @@
     },
     "node_modules/@angular/build/node_modules/picomatch": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -669,8 +626,6 @@
     },
     "node_modules/@angular/cli": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@angular/cli/-/cli-19.2.27.tgz",
-      "integrity": "sha512-npqpoV7Y49ggwUysXbRUDDmFRmwQdZ92nljtxX1yjakmwR93WdEq7NwqHEGODOAXo5NtPoEeBNc3InPtrLmh5g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -703,8 +658,6 @@
     },
     "node_modules/@angular/common": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/common/-/common-19.2.25.tgz",
-      "integrity": "sha512-WteFLyfDPvilzpSGHk64bqowa4NnHdbjNl1xXeGr038fgTjp0l0NdiUPqeDtYT4pf5lWl6477pPoQN7o//NyyQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -719,8 +672,6 @@
     },
     "node_modules/@angular/compiler": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/compiler/-/compiler-19.2.25.tgz",
-      "integrity": "sha512-GGEeTTd/DV71E07K0u5753bxXozc6Z7iWaCZJDW7xiA7hdHCwrYBMz1PVUJAtXcxf4wTdiXQR48kw8/YHYnDAw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -731,8 +682,6 @@
     },
     "node_modules/@angular/compiler-cli": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/compiler-cli/-/compiler-cli-19.2.25.tgz",
-      "integrity": "sha512-IBBKRz6ua+y6bdcaUIpOPq7G/S4biJfcT1TCMD7wi+48wiKKSXj4J/8BN5fSjt+UozlHwya3B8z0XqnwO2ywZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -760,8 +709,6 @@
     },
     "node_modules/@angular/compiler-cli/node_modules/@babel/core": {
       "version": "7.26.9",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.26.9.tgz",
-      "integrity": "sha512-lWBYIrF7qK5+GjY5Uy+/hEgp8OJWOD/rpy74GplYRhEauvbHDeFB8t5hPOZxCZ0Oxf4Cc36tK51/l3ymJysrKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -791,15 +738,11 @@
     },
     "node_modules/@angular/compiler-cli/node_modules/@babel/core/node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@angular/compiler-cli/node_modules/@babel/core/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -808,8 +751,6 @@
     },
     "node_modules/@angular/core": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/core/-/core-19.2.25.tgz",
-      "integrity": "sha512-j7/irbbdO4rmZfRXS+sphCerzgcRlpGFwxHc/76Ual+ckwJG0MPsNFkllz2SIEZzE1EZkmIunGrHbjeRBJjyvg==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -824,8 +765,6 @@
     },
     "node_modules/@angular/forms": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/forms/-/forms-19.2.25.tgz",
-      "integrity": "sha512-lbuhZiuNKy8vcIHFSP7sOW5kfHSVDiVsXh2/+rWjqGklscfUG5cTK9F9d+k60CH24OhK0NgRKoCHiAK5zPQi2g==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -842,8 +781,6 @@
     },
     "node_modules/@angular/language-service": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/language-service/-/language-service-19.2.25.tgz",
-      "integrity": "sha512-/b5K0sWs1JB9i8Rbb26V4Y38EjHqwzi5ADk28wJ40lqH908cWHAsNJP+PJWbhCo/tOaAYoaD1GKdOb7ODeeKyA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -852,8 +789,6 @@
     },
     "node_modules/@angular/localize": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/localize/-/localize-19.2.25.tgz",
-      "integrity": "sha512-8/1j0BUYMwjRxCAOK9mjW9Gud0g9C6hLJMr2HOBdiIPNvhXkdZqF3nMXgF12xqnD33fbrE+zsURZgF0fxoL5Ww==",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "7.26.9",
@@ -876,8 +811,6 @@
     },
     "node_modules/@angular/localize/node_modules/@babel/core": {
       "version": "7.26.9",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.26.9.tgz",
-      "integrity": "sha512-lWBYIrF7qK5+GjY5Uy+/hEgp8OJWOD/rpy74GplYRhEauvbHDeFB8t5hPOZxCZ0Oxf4Cc36tK51/l3ymJysrKw==",
       "license": "MIT",
       "dependencies": {
         "@ampproject/remapping": "^2.2.0",
@@ -906,14 +839,10 @@
     },
     "node_modules/@angular/localize/node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "license": "MIT"
     },
     "node_modules/@angular/localize/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -921,8 +850,6 @@
     },
     "node_modules/@angular/platform-browser": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/platform-browser/-/platform-browser-19.2.25.tgz",
-      "integrity": "sha512-UF7cyBnMF3puA/cGy3MXbiPB2Rlw0Umf78XH664Iwqsb37A+TxqzOPaByXsNTIbpV6/h28yO3dMvDVFT3aOvOA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -943,8 +870,6 @@
     },
     "node_modules/@angular/platform-browser-dynamic": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/platform-browser-dynamic/-/platform-browser-dynamic-19.2.25.tgz",
-      "integrity": "sha512-T6LK+NH6VR0bNKepN6urSHPE86OxbIMvgm855W06YjXvK7cMotPCC+N10zv7M8zQRZtQ7WBkY0EGpC8qLrao0g==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -961,8 +886,6 @@
     },
     "node_modules/@angular/router": {
       "version": "19.2.25",
-      "resolved": "https://registry.npmjs.org/@angular/router/-/router-19.2.25.tgz",
-      "integrity": "sha512-IddC2vPiagB2jAsUrNuAr74p+OirWaroouvPkUjzPmyQ+12/0EsygHamsgUbsCVLXJKh72oqnD+xViN0AMguOA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -979,8 +902,6 @@
     },
     "node_modules/@applitools/core": {
       "version": "4.37.0",
-      "resolved": "https://registry.npmjs.org/@applitools/core/-/core-4.37.0.tgz",
-      "integrity": "sha512-bHZrQYliXaWr3UxZN+AFcU6brvK9/HMGeyJ3jFQohTsszVa5m1aaK1igIvmy/njgWdUtEK9xHX90S9xu3YyIzg==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1018,8 +939,6 @@
     },
     "node_modules/@applitools/core-base": {
       "version": "1.24.0",
-      "resolved": "https://registry.npmjs.org/@applitools/core-base/-/core-base-1.24.0.tgz",
-      "integrity": "sha512-raqFFC5JPkgsz4nM2yVL9nvieMtBqB32omtpe+sOWeFPvRhscgEHIXXsccWm2Fsnj9yYKa4MLI4fS3oEAUwC+g==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1036,8 +955,6 @@
     },
     "node_modules/@applitools/core/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1053,8 +970,6 @@
     },
     "node_modules/@applitools/core/node_modules/semver": {
       "version": "7.6.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.2.tgz",
-      "integrity": "sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -1066,8 +981,6 @@
     },
     "node_modules/@applitools/css-tree": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@applitools/css-tree/-/css-tree-1.1.4.tgz",
-      "integrity": "sha512-rH3aq/dkTweEUgS/MKuthD79CZDqpQVJlqmxqVxLZVAzbeFxYdTG/gnfG0zj6YJ025jzcPH2ktdW16Rl3QLutg==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1080,8 +993,6 @@
     },
     "node_modules/@applitools/dom-capture": {
       "version": "11.5.5",
-      "resolved": "https://registry.npmjs.org/@applitools/dom-capture/-/dom-capture-11.5.5.tgz",
-      "integrity": "sha512-LE/Ri1od93eT0m8mpqcbj1l/NJqG/1qr33731PXirMQIhXCs0knwm8BP+A+MAnMhFrOVmrmBi2klFC5yk1l+0A==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1094,8 +1005,6 @@
     },
     "node_modules/@applitools/dom-shared": {
       "version": "1.0.16",
-      "resolved": "https://registry.npmjs.org/@applitools/dom-shared/-/dom-shared-1.0.16.tgz",
-      "integrity": "sha512-P0JA5mq1f8rIi/xbh2+gCsEvv1CGenf0sGrC2UxXjmaFRpgoVS9BfpNg5aZyFJ9OPoi4qRMi9LCGsFiqZNNcTQ==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "engines": {
@@ -1104,8 +1013,6 @@
     },
     "node_modules/@applitools/dom-snapshot": {
       "version": "4.11.18",
-      "resolved": "https://registry.npmjs.org/@applitools/dom-snapshot/-/dom-snapshot-4.11.18.tgz",
-      "integrity": "sha512-FewB86dQ3Povdi5+dmziYbJR2aej36Umr7ZoIy5obm5VKDH+6obUyd5zBqYhVkv5YwwXdp08dgRfLlOuk2XMug==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1120,8 +1027,6 @@
     },
     "node_modules/@applitools/driver": {
       "version": "1.21.1",
-      "resolved": "https://registry.npmjs.org/@applitools/driver/-/driver-1.21.1.tgz",
-      "integrity": "sha512-bnJdlsoD8G1Y59fQlNi+sl1Zr5MFz11ilop86PKo8SGbmZwIYTGQkDiFhw0D4f23RxzWJdtUjzWRvFb8+uy/Ew==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1136,8 +1041,6 @@
     },
     "node_modules/@applitools/driver/node_modules/semver": {
       "version": "7.6.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.2.tgz",
-      "integrity": "sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -1149,8 +1052,6 @@
     },
     "node_modules/@applitools/ec-client": {
       "version": "1.10.9",
-      "resolved": "https://registry.npmjs.org/@applitools/ec-client/-/ec-client-1.10.9.tgz",
-      "integrity": "sha512-f/GcTD1HHJtCXr7n1WaN+hvG3ABGhIFy3aAJEUwvG0iKrsRrObprcYQZwHW7BK/quN5hLrzolmTssq0/sKjfmQ==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1176,8 +1077,6 @@
     },
     "node_modules/@applitools/eg-frpc": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/@applitools/eg-frpc/-/eg-frpc-1.0.5.tgz",
-      "integrity": "sha512-9qUNiCK3R3VKxIAaLr5HO5QnUx6TioLFkJ2JcpU1ZqefApt1X2bdfS7eA4TGDXDWv/a0OIl2Lddzuo5/h3vbTw==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "engines": {
@@ -1186,8 +1085,6 @@
     },
     "node_modules/@applitools/eg-socks5-proxy-server": {
       "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/@applitools/eg-socks5-proxy-server/-/eg-socks5-proxy-server-0.5.6.tgz",
-      "integrity": "sha512-SjjDBFeiKspX3nHKOoSQ+l4JUiJK3xJiWAEaR8b+GuMvnGFLnrvAECHhuXXG00+LwBJM8WKmfxEe17nvZe+nhg==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1200,8 +1097,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel": {
       "version": "3.0.8",
-      "resolved": "https://registry.npmjs.org/@applitools/execution-grid-tunnel/-/execution-grid-tunnel-3.0.8.tgz",
-      "integrity": "sha512-4S6NcpxELH4NXketD3g6VUhWDUCuwAm4F1sCZdZLpPWOSMu5QwQDYUoe6/4t5KuktTQ4K7N90NmTzQrxiFtDKA==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1229,8 +1124,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel/node_modules/@applitools/logger": {
       "version": "1.1.53",
-      "resolved": "https://registry.npmjs.org/@applitools/logger/-/logger-1.1.53.tgz",
-      "integrity": "sha512-4mlzYxc0MgM3WIxEwKqIjn9W7G7kMtQc2bFRxozViKOXypTfr72j8iODs88wcetP0GsXtplhZQ5/6aZN5WY9ug==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1244,8 +1137,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel/node_modules/@applitools/utils": {
       "version": "1.3.36",
-      "resolved": "https://registry.npmjs.org/@applitools/utils/-/utils-1.3.36.tgz",
-      "integrity": "sha512-eROEssh7wIW+V87PvLiHI2hUPxqoBxXFMRx3+z5qOZqXUPSR1Uz7EMFwxZcDDR7T6C3O3UDckB2aVB5fJAg5JA==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "engines": {
@@ -1254,8 +1145,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1271,8 +1160,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel/node_modules/debug": {
       "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
-      "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1289,8 +1176,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel/node_modules/ini": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-3.0.1.tgz",
-      "integrity": "sha512-it4HyVAUTKBc6m8e1iXWvXSTdndF7HbdN713+kvLrymxTaU4AUBWrJ4vEooP+V7fexnVD3LKcBshjGGPefSMUQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -1299,9 +1184,6 @@
     },
     "node_modules/@applitools/execution-grid-tunnel/node_modules/uuid": {
       "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -1314,8 +1196,6 @@
     },
     "node_modules/@applitools/eyes": {
       "version": "1.34.0",
-      "resolved": "https://registry.npmjs.org/@applitools/eyes/-/eyes-1.34.0.tgz",
-      "integrity": "sha512-H8UTrHqkpQsRTMkKV9aKpHLIEJykw8wBzHPPWfYuoGFZ9S4H/hW5fSKolQY5H/Mz0YcvP8bau8rLW3RpsYw+MA==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1334,8 +1214,6 @@
     },
     "node_modules/@applitools/eyes-cypress": {
       "version": "3.52.0",
-      "resolved": "https://registry.npmjs.org/@applitools/eyes-cypress/-/eyes-cypress-3.52.0.tgz",
-      "integrity": "sha512-7TyjvZN4kLZjWkNjhauVjvZoVO0Y+kY4TYQ3QgZmE6DB0tstsMdX4ZBC+HMevXCAdq303vnMYmCgHtxMfpVFRg==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1359,8 +1237,6 @@
     },
     "node_modules/@applitools/eyes-cypress/node_modules/semver": {
       "version": "7.6.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.2.tgz",
-      "integrity": "sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -1372,8 +1248,6 @@
     },
     "node_modules/@applitools/eyes/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1389,8 +1263,6 @@
     },
     "node_modules/@applitools/functional-commons": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/@applitools/functional-commons/-/functional-commons-1.6.0.tgz",
-      "integrity": "sha512-fwiF0CbeYHDEOTD/NKaFgaI8LvRcGYG2GaJJiRwcedKko16sQ8F3TK5wXfj2Ytjf+8gjwHwsEEX550z3yvDWxA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -1399,8 +1271,6 @@
     },
     "node_modules/@applitools/image": {
       "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/@applitools/image/-/image-1.1.18.tgz",
-      "integrity": "sha512-KLcg7otBIrXZ8u+/FofrxpBAqvQii0rKPoIdJKiIPtOKJMMwZLDwBoTR1k1fmbfc2Msoj91VL6jyBQMG6G13mw==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1416,8 +1286,6 @@
     },
     "node_modules/@applitools/logger": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@applitools/logger/-/logger-2.1.2.tgz",
-      "integrity": "sha512-0e/Rr/cZLGg8OOytTlFht1fQCLO2k3XKxodzsFO+IxTrEp53mXPA8r+tHA5BLO9YnqvKx4AiieFMRGbPyBuSWg==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1431,8 +1299,6 @@
     },
     "node_modules/@applitools/logger/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1448,8 +1314,6 @@
     },
     "node_modules/@applitools/nml-client": {
       "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@applitools/nml-client/-/nml-client-1.9.1.tgz",
-      "integrity": "sha512-C0JgbxpXmHoRbNcRGSsKLzRkXyh4cwnTHUoGrL1NEnwCjppD2rwIXXJGB48Jts/Wpph4hH8BmzBhRg3rDhcLAw==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1463,8 +1327,6 @@
     },
     "node_modules/@applitools/req": {
       "version": "1.7.10",
-      "resolved": "https://registry.npmjs.org/@applitools/req/-/req-1.7.10.tgz",
-      "integrity": "sha512-KcK6P2oinKb3wGsCvzyxjAIrBnqr0l8eShw6bNDfDUNzY2mVR9ZxgY+br7xNwymI2dht6QN7Dw1bYfX+zTX1Mw==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1480,8 +1342,6 @@
     },
     "node_modules/@applitools/req/node_modules/https-proxy-agent": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1494,8 +1354,6 @@
     },
     "node_modules/@applitools/req/node_modules/node-fetch": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.1.tgz",
-      "integrity": "sha512-cRVc/kyto/7E5shrWca1Wsea4y6tL9iYJE5FBCius3JQfb/4P4I295PfhgbJQBLTx6lATE4z+wK0rPM4VS2uow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1513,8 +1371,6 @@
     },
     "node_modules/@applitools/screenshoter": {
       "version": "3.11.1",
-      "resolved": "https://registry.npmjs.org/@applitools/screenshoter/-/screenshoter-3.11.1.tgz",
-      "integrity": "sha512-gP9IZZXSzLZuTboUEvRsD/pR6UHBqL2/tHrcxc4tjs8xyHzH1V/CDFTpECbwnDXE3gD3GUn2N5aL597oJBwVpw==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1529,8 +1385,6 @@
     },
     "node_modules/@applitools/snippets": {
       "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@applitools/snippets/-/snippets-2.6.5.tgz",
-      "integrity": "sha512-sfWOKkJ4sBnlTMLKlXy308EnFbetp2Cg0Rlop21VPs+Mi5sPiln+6LX9VvRt+qNd5Q0xTavDXCUYMK2b5k4mOg==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "engines": {
@@ -1539,8 +1393,6 @@
     },
     "node_modules/@applitools/socket": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/@applitools/socket/-/socket-1.2.3.tgz",
-      "integrity": "sha512-VRX4C9uPUvRlntFinIv8+DvOkleehIxsBz5RthWROXZFWscSqFqCpEDhChGYl6YMI8jm4amtc2F4oVVDR7CIqA==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1553,8 +1405,6 @@
     },
     "node_modules/@applitools/spec-driver-webdriver": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@applitools/spec-driver-webdriver/-/spec-driver-webdriver-1.2.2.tgz",
-      "integrity": "sha512-0rqXb3DSHLi+yK9vkFnW+VRahu8CEeco2fn43XLZyp9rieYQdOGUX5lMP8pAKOY0qHTQDIA7jv+e0djvtNrJ+g==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1572,8 +1422,6 @@
     },
     "node_modules/@applitools/spec-driver-webdriver/node_modules/https-proxy-agent": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1586,8 +1434,6 @@
     },
     "node_modules/@applitools/tunnel-client": {
       "version": "1.6.5",
-      "resolved": "https://registry.npmjs.org/@applitools/tunnel-client/-/tunnel-client-1.6.5.tgz",
-      "integrity": "sha512-Kmf0bQTxw+FmkVJw3nzrQKzrW3ZVyUlgyVoz3sDJhhJsNSWsFzpPcP1jtGyKM9CsULSuBBrsTJNYY0RM2uhc3Q==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1608,8 +1454,6 @@
     },
     "node_modules/@applitools/ufg-client": {
       "version": "1.16.9",
-      "resolved": "https://registry.npmjs.org/@applitools/ufg-client/-/ufg-client-1.16.9.tgz",
-      "integrity": "sha512-haXkDyEaQeJtWjJq5UbRNnqC3ReNTV6A8fBdMUqVsfH5U1L0Op1l+xBxWVOqt9fg9unqnBLYpoA0hR4C2B4Xlw==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
@@ -1628,8 +1472,6 @@
     },
     "node_modules/@applitools/utils": {
       "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@applitools/utils/-/utils-1.8.0.tgz",
-      "integrity": "sha512-W4rkXPN9/Q4yxJqeHkILGH9nO6qiilBF+d2RJcrgbKii9f2h+iX6hAd9ropnq60tO2PZtJCBaELzKPQ4b9b86g==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE",
       "engines": {
@@ -1638,8 +1480,6 @@
     },
     "node_modules/@babel/code-frame": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-validator-identifier": "^7.28.5",
@@ -1652,8 +1492,6 @@
     },
     "node_modules/@babel/compat-data": {
       "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -1661,8 +1499,6 @@
     },
     "node_modules/@babel/core": {
       "version": "7.26.10",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.26.10.tgz",
-      "integrity": "sha512-vMqyb7XCDMPvJFFOaT9kxtiRh42GwlZEg1/uIgtZshS5a/8OaduUfCi7kynKgc3Tw/6Uo2D+db9qBttghhmxwQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1692,15 +1528,11 @@
     },
     "node_modules/@babel/core/node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@babel/core/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -1709,8 +1541,6 @@
     },
     "node_modules/@babel/generator": {
       "version": "7.26.10",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.26.10.tgz",
-      "integrity": "sha512-rRHT8siFIXQrAYOYqZQVsAr8vJ+cBNqcVAY6m5V8/4QqzaPl+zDBe6cLEPRDuNOUf3ww8RfJVlOyQMoSI+5Ang==",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.26.10",
@@ -1725,8 +1555,6 @@
     },
     "node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.25.9",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.25.9.tgz",
-      "integrity": "sha512-gv7320KBUFJz1RnylIg5WWYPRXKZ884AGkYpgpWW02TH66Dl+HaC1t1CKd0z3R4b6hdYEcmrNZHUmfCP+1u3/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1738,8 +1566,6 @@
     },
     "node_modules/@babel/helper-compilation-targets": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
       "license": "MIT",
       "dependencies": {
         "@babel/compat-data": "^7.28.6",
@@ -1754,8 +1580,6 @@
     },
     "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -1763,8 +1587,6 @@
     },
     "node_modules/@babel/helper-create-class-features-plugin": {
       "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.29.3.tgz",
-      "integrity": "sha512-RpLYy2sb51oNLjuu1iD3bwBqCBWUzjO0ocp+iaCP/lJtb2CPLcnC2Fftw+4sAzaMELGeWTgExSKADbdo0GFVzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1785,8 +1607,6 @@
     },
     "node_modules/@babel/helper-create-class-features-plugin/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1798,8 +1618,6 @@
     },
     "node_modules/@babel/helper-create-class-features-plugin/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -1808,8 +1626,6 @@
     },
     "node_modules/@babel/helper-create-regexp-features-plugin": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.28.5.tgz",
-      "integrity": "sha512-N1EhvLtHzOvj7QQOUCCS3NrPJP8c5W6ZXCHDn7Yialuy1iu4r5EmIYkXlKNqT99Ciw+W0mDqWoR6HWMZlFP3hw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1826,8 +1642,6 @@
     },
     "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1839,8 +1653,6 @@
     },
     "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -1849,8 +1661,6 @@
     },
     "node_modules/@babel/helper-define-polyfill-provider": {
       "version": "0.6.8",
-      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.8.tgz",
-      "integrity": "sha512-47UwBLPpQi1NoWzLuHNjRoHlYXMwIJoBf7MFou6viC/sIHWYygpvr0B6IAyh5sBdA2nr2LPIRww8lfaUVQINBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1866,8 +1676,6 @@
     },
     "node_modules/@babel/helper-define-polyfill-provider/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1884,15 +1692,11 @@
     },
     "node_modules/@babel/helper-define-polyfill-provider/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@babel/helper-define-polyfill-provider/node_modules/resolve": {
       "version": "1.22.12",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
-      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1913,8 +1717,6 @@
     },
     "node_modules/@babel/helper-globals": {
       "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -1922,8 +1724,6 @@
     },
     "node_modules/@babel/helper-member-expression-to-functions": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.28.5.tgz",
-      "integrity": "sha512-cwM7SBRZcPCLgl8a7cY0soT1SptSzAlMH39vwiRpOQkJlh53r5hdHwLSCZpQdVLT39sZt+CRpNwYG4Y2v77atg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1936,8 +1736,6 @@
     },
     "node_modules/@babel/helper-module-imports": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
       "license": "MIT",
       "dependencies": {
         "@babel/traverse": "^7.28.6",
@@ -1949,8 +1747,6 @@
     },
     "node_modules/@babel/helper-module-transforms": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-imports": "^7.28.6",
@@ -1966,8 +1762,6 @@
     },
     "node_modules/@babel/helper-optimise-call-expression": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.27.1.tgz",
-      "integrity": "sha512-URMGH08NzYFhubNSGJrpUEphGKQwMQYBySzat5cAByY1/YgIRkULnIy3tAMeszlL/so2HbeilYloUmSpd7GdVw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1979,8 +1773,6 @@
     },
     "node_modules/@babel/helper-plugin-utils": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1989,8 +1781,6 @@
     },
     "node_modules/@babel/helper-remap-async-to-generator": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.27.1.tgz",
-      "integrity": "sha512-7fiA521aVw8lSPeI4ZOD3vRFkoqkJcS+z4hFo82bFSH/2tNd6eJ5qCVMS5OzDmZh/kaHQeBaeyxK6wljcPtveA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2007,8 +1797,6 @@
     },
     "node_modules/@babel/helper-remap-async-to-generator/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2020,8 +1808,6 @@
     },
     "node_modules/@babel/helper-replace-supers": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.28.6.tgz",
-      "integrity": "sha512-mq8e+laIk94/yFec3DxSjCRD2Z0TAjhVbEJY3UQrlwVo15Lmt7C2wAUbK4bjnTs4APkwsYLTahXRraQXhb1WCg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2038,8 +1824,6 @@
     },
     "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.27.1.tgz",
-      "integrity": "sha512-Tub4ZKEXqbPjXgWLl2+3JpQAYBJ8+ikpQ2Ocj/q/r0LwE3UhENh7EUabyHjz2kCEsrRY83ew2DQdHluuiDQFzg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2052,8 +1836,6 @@
     },
     "node_modules/@babel/helper-split-export-declaration": {
       "version": "7.24.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.24.7.tgz",
-      "integrity": "sha512-oy5V7pD+UvfkEATUKvIjvIAH/xCzfsFVw7ygW2SI6NClZzquT+mwdTfgfdbUiceh6iQO0CHtCPsyze/MZ2YbAA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2065,8 +1847,6 @@
     },
     "node_modules/@babel/helper-string-parser": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -2074,8 +1854,6 @@
     },
     "node_modules/@babel/helper-validator-identifier": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -2083,8 +1861,6 @@
     },
     "node_modules/@babel/helper-validator-option": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -2092,8 +1868,6 @@
     },
     "node_modules/@babel/helper-wrap-function": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.28.6.tgz",
-      "integrity": "sha512-z+PwLziMNBeSQJonizz2AGnndLsP2DeGHIxDAn+wdHOGuo4Fo1x1HBPPXeE9TAOPHNNWQKCSlA2VZyYyyibDnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2107,8 +1881,6 @@
     },
     "node_modules/@babel/helpers": {
       "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
       "license": "MIT",
       "dependencies": {
         "@babel/template": "^7.28.6",
@@ -2120,8 +1892,6 @@
     },
     "node_modules/@babel/parser": {
       "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.0"
@@ -2135,8 +1905,6 @@
     },
     "node_modules/@babel/plugin-bugfix-firefox-class-in-computed-class-key": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.28.5.tgz",
-      "integrity": "sha512-87GDMS3tsmMSi/3bWOte1UblL+YUTFMV8SZPZ2eSEL17s74Cw/l63rR6NmGVKMYW2GYi85nE+/d6Hw5N0bEk2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2152,8 +1920,6 @@
     },
     "node_modules/@babel/plugin-bugfix-safari-class-field-initializer-scope": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-class-field-initializer-scope/-/plugin-bugfix-safari-class-field-initializer-scope-7.27.1.tgz",
-      "integrity": "sha512-qNeq3bCKnGgLkEXUuFry6dPlGfCdQNZbn7yUAPCInwAJHMU7THJfrBSozkcWq5sNM6RcF3S8XyQL2A52KNR9IA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2168,8 +1934,6 @@
     },
     "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.27.1.tgz",
-      "integrity": "sha512-g4L7OYun04N1WyqMNjldFwlfPCLVkgB54A/YCXICZYBsvJJE3kByKv9c9+R/nAfmIfjl2rKYLNyMHboYbZaWaA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2184,8 +1948,6 @@
     },
     "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.27.1.tgz",
-      "integrity": "sha512-oO02gcONcD5O1iTLi/6frMJBIwWEHceWGSGqrpCmEL8nogiS6J9PBlE48CaK20/Jx1LuRml9aDftLgdjXT8+Cw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2202,8 +1964,6 @@
     },
     "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.28.6.tgz",
-      "integrity": "sha512-a0aBScVTlNaiUe35UtfxAN7A/tehvvG4/ByO6+46VPKTRSlfnAFsgKy0FUh+qAkQrDTmhDkT+IBOKlOoMUxQ0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2219,9 +1979,6 @@
     },
     "node_modules/@babel/plugin-proposal-class-properties": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
-      "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
-      "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2237,9 +1994,6 @@
     },
     "node_modules/@babel/plugin-proposal-object-rest-spread": {
       "version": "7.20.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.20.7.tgz",
-      "integrity": "sha512-d2S98yCiLxDVmBmE8UjGcfPvNEUbA1U5q5WxaWFUGRzJSVAZqm5W6MbPct0jxnegUZ0niLeNX+IOzEs7wYg9Dg==",
-      "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2258,8 +2012,6 @@
     },
     "node_modules/@babel/plugin-proposal-private-property-in-object": {
       "version": "7.21.0-placeholder-for-preset-env.2",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.0-placeholder-for-preset-env.2.tgz",
-      "integrity": "sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2271,8 +2023,6 @@
     },
     "node_modules/@babel/plugin-syntax-async-generators": {
       "version": "7.8.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
-      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2284,8 +2034,6 @@
     },
     "node_modules/@babel/plugin-syntax-bigint": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
-      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2297,8 +2045,6 @@
     },
     "node_modules/@babel/plugin-syntax-class-properties": {
       "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
-      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2310,8 +2056,6 @@
     },
     "node_modules/@babel/plugin-syntax-class-static-block": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
-      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2326,8 +2070,6 @@
     },
     "node_modules/@babel/plugin-syntax-import-assertions": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.28.6.tgz",
-      "integrity": "sha512-pSJUpFHdx9z5nqTSirOCMtYVP2wFgoWhP0p3g8ONK/4IHhLIBd0B9NYqAvIUAhq+OkhO4VM1tENCt0cjlsNShw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2342,8 +2084,6 @@
     },
     "node_modules/@babel/plugin-syntax-import-attributes": {
       "version": "7.26.0",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.26.0.tgz",
-      "integrity": "sha512-e2dttdsJ1ZTpi3B9UYGLw41hifAubg19AtCu/2I/F1QNVclOBr1dYpTdmdyZ84Xiz43BS/tCUkMAZNLv12Pi+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2358,8 +2098,6 @@
     },
     "node_modules/@babel/plugin-syntax-import-meta": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2371,8 +2109,6 @@
     },
     "node_modules/@babel/plugin-syntax-json-strings": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
-      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2384,8 +2120,6 @@
     },
     "node_modules/@babel/plugin-syntax-jsx": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.28.6.tgz",
-      "integrity": "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2400,8 +2134,6 @@
     },
     "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
-      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2413,8 +2145,6 @@
     },
     "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
-      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2426,8 +2156,6 @@
     },
     "node_modules/@babel/plugin-syntax-numeric-separator": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
-      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2439,8 +2167,6 @@
     },
     "node_modules/@babel/plugin-syntax-object-rest-spread": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
-      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2452,8 +2178,6 @@
     },
     "node_modules/@babel/plugin-syntax-optional-catch-binding": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
-      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2465,8 +2189,6 @@
     },
     "node_modules/@babel/plugin-syntax-optional-chaining": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
-      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2478,8 +2200,6 @@
     },
     "node_modules/@babel/plugin-syntax-private-property-in-object": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
-      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2494,8 +2214,6 @@
     },
     "node_modules/@babel/plugin-syntax-top-level-await": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
-      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2510,8 +2228,6 @@
     },
     "node_modules/@babel/plugin-syntax-typescript": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.28.6.tgz",
-      "integrity": "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2526,8 +2242,6 @@
     },
     "node_modules/@babel/plugin-syntax-unicode-sets-regex": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-unicode-sets-regex/-/plugin-syntax-unicode-sets-regex-7.18.6.tgz",
-      "integrity": "sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2543,8 +2257,6 @@
     },
     "node_modules/@babel/plugin-transform-arrow-functions": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.27.1.tgz",
-      "integrity": "sha512-8Z4TGic6xW70FKThA5HYEKKyBpOOsucTOD1DjU3fZxDg+K3zBJcXMFnt/4yQiZnf5+MiOMSXQ9PaEK/Ilh1DeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2559,8 +2271,6 @@
     },
     "node_modules/@babel/plugin-transform-async-generator-functions": {
       "version": "7.26.8",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.26.8.tgz",
-      "integrity": "sha512-He9Ej2X7tNf2zdKMAGOsmg2MrFc+hfoAhd3po4cWfo/NWjzEAKa0oQruj1ROVUdl0e6fb6/kE/G3SSxE0lRJOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2577,8 +2287,6 @@
     },
     "node_modules/@babel/plugin-transform-async-to-generator": {
       "version": "7.25.9",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.25.9.tgz",
-      "integrity": "sha512-NT7Ejn7Z/LjUH0Gv5KsBCxh7BH3fbLTV0ptHvpeMvrt3cPThHfJfst9Wrb7S8EvJ7vRTFI7z+VAvFVEQn/m5zQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2595,8 +2303,6 @@
     },
     "node_modules/@babel/plugin-transform-block-scoped-functions": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.27.1.tgz",
-      "integrity": "sha512-cnqkuOtZLapWYZUYM5rVIdv1nXYuFVIltZ6ZJ7nIj585QsjKM5dhL2Fu/lICXZ1OyIAFc7Qy+bvDAtTXqGrlhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2611,8 +2317,6 @@
     },
     "node_modules/@babel/plugin-transform-block-scoping": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.28.6.tgz",
-      "integrity": "sha512-tt/7wOtBmwHPNMPu7ax4pdPz6shjFrmHDghvNC+FG9Qvj7D6mJcoRQIF5dy4njmxR941l6rgtvfSB2zX3VlUIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2627,8 +2331,6 @@
     },
     "node_modules/@babel/plugin-transform-class-properties": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.28.6.tgz",
-      "integrity": "sha512-dY2wS3I2G7D697VHndN91TJr8/AAfXQNt5ynCTI/MpxMsSzHp+52uNivYT5wCPax3whc47DR8Ba7cmlQMg24bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2644,8 +2346,6 @@
     },
     "node_modules/@babel/plugin-transform-class-static-block": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.28.6.tgz",
-      "integrity": "sha512-rfQ++ghVwTWTqQ7w8qyDxL1XGihjBss4CmTgGRCTAC9RIbhVpyp4fOeZtta0Lbf+dTNIVJer6ych2ibHwkZqsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2661,8 +2361,6 @@
     },
     "node_modules/@babel/plugin-transform-classes": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.28.6.tgz",
-      "integrity": "sha512-EF5KONAqC5zAqT783iMGuM2ZtmEBy+mJMOKl2BCvPZ2lVrwvXnB6o+OBWCS+CoeCCpVRF2sA2RBKUxvT8tQT5Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2682,8 +2380,6 @@
     },
     "node_modules/@babel/plugin-transform-classes/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2695,8 +2391,6 @@
     },
     "node_modules/@babel/plugin-transform-computed-properties": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.28.6.tgz",
-      "integrity": "sha512-bcc3k0ijhHbc2lEfpFHgx7eYw9KNXqOerKWfzbxEHUGKnS3sz9C4CNL9OiFN1297bDNfUiSO7DaLzbvHQQQ1BQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2712,8 +2406,6 @@
     },
     "node_modules/@babel/plugin-transform-destructuring": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.28.5.tgz",
-      "integrity": "sha512-Kl9Bc6D0zTUcFUvkNuQh4eGXPKKNDOJQXVyyM4ZAQPMveniJdxi8XMJwLo+xSoW3MIq81bD33lcUe9kZpl0MCw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2729,8 +2421,6 @@
     },
     "node_modules/@babel/plugin-transform-dotall-regex": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.28.6.tgz",
-      "integrity": "sha512-SljjowuNKB7q5Oayv4FoPzeB74g3QgLt8IVJw9ADvWy3QnUb/01aw8I4AVv8wYnPvQz2GDDZ/g3GhcNyDBI4Bg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2746,8 +2436,6 @@
     },
     "node_modules/@babel/plugin-transform-duplicate-keys": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.27.1.tgz",
-      "integrity": "sha512-MTyJk98sHvSs+cvZ4nOauwTTG1JeonDjSGvGGUNHreGQns+Mpt6WX/dVzWBHgg+dYZhkC4X+zTDfkTU+Vy9y7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2762,8 +2450,6 @@
     },
     "node_modules/@babel/plugin-transform-duplicate-named-capturing-groups-regex": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-named-capturing-groups-regex/-/plugin-transform-duplicate-named-capturing-groups-regex-7.29.0.tgz",
-      "integrity": "sha512-zBPcW2lFGxdiD8PUnPwJjag2J9otbcLQzvbiOzDxpYXyCuYX9agOwMPGn1prVH0a4qzhCKu24rlH4c1f7yA8rw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2779,8 +2465,6 @@
     },
     "node_modules/@babel/plugin-transform-dynamic-import": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.27.1.tgz",
-      "integrity": "sha512-MHzkWQcEmjzzVW9j2q8LGjwGWpG2mjwaaB0BNQwst3FIjqsg8Ct/mIZlvSPJvfi9y2AC8mi/ktxbFVL9pZ1I4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2795,8 +2479,6 @@
     },
     "node_modules/@babel/plugin-transform-exponentiation-operator": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.28.6.tgz",
-      "integrity": "sha512-WitabqiGjV/vJ0aPOLSFfNY1u9U3R7W36B03r5I2KoNix+a3sOhJ3pKFB3R5It9/UiK78NiO0KE9P21cMhlPkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2811,8 +2493,6 @@
     },
     "node_modules/@babel/plugin-transform-export-namespace-from": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.27.1.tgz",
-      "integrity": "sha512-tQvHWSZ3/jH2xuq/vZDy0jNn+ZdXJeM8gHvX4lnJmsc3+50yPlWdZXIc5ay+umX+2/tJIqHqiEqcJvxlmIvRvQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2827,8 +2507,6 @@
     },
     "node_modules/@babel/plugin-transform-for-of": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.27.1.tgz",
-      "integrity": "sha512-BfbWFFEJFQzLCQ5N8VocnCtA8J1CLkNTe2Ms2wocj75dd6VpiqS5Z5quTYcUoo4Yq+DN0rtikODccuv7RU81sw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2844,8 +2522,6 @@
     },
     "node_modules/@babel/plugin-transform-function-name": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.27.1.tgz",
-      "integrity": "sha512-1bQeydJF9Nr1eBCMMbC+hdwmRlsv5XYOMu03YSWFwNs0HsAmtSxxF1fyuYPqemVldVyFmlCU7w8UE14LupUSZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2862,8 +2538,6 @@
     },
     "node_modules/@babel/plugin-transform-json-strings": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.28.6.tgz",
-      "integrity": "sha512-Nr+hEN+0geQkzhbdgQVPoqr47lZbm+5fCUmO70722xJZd0Mvb59+33QLImGj6F+DkK3xgDi1YVysP8whD6FQAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2878,8 +2552,6 @@
     },
     "node_modules/@babel/plugin-transform-literals": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.27.1.tgz",
-      "integrity": "sha512-0HCFSepIpLTkLcsi86GG3mTUzxV5jpmbv97hTETW3yzrAij8aqlD36toB1D0daVFJM8NK6GvKO0gslVQmm+zZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2894,8 +2566,6 @@
     },
     "node_modules/@babel/plugin-transform-logical-assignment-operators": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.28.6.tgz",
-      "integrity": "sha512-+anKKair6gpi8VsM/95kmomGNMD0eLz1NQ8+Pfw5sAwWH9fGYXT50E55ZpV0pHUHWf6IUTWPM+f/7AAff+wr9A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2910,8 +2580,6 @@
     },
     "node_modules/@babel/plugin-transform-member-expression-literals": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.27.1.tgz",
-      "integrity": "sha512-hqoBX4dcZ1I33jCSWcXrP+1Ku7kdqXf1oeah7ooKOIiAdKQ+uqftgCFNOSzA5AMS2XIHEYeGFg4cKRCdpxzVOQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2926,8 +2594,6 @@
     },
     "node_modules/@babel/plugin-transform-modules-amd": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.27.1.tgz",
-      "integrity": "sha512-iCsytMg/N9/oFq6n+gFTvUYDZQOMK5kEdeYxmxt91fcJGycfxVP9CnrxoliM0oumFERba2i8ZtwRUCMhvP1LnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2943,8 +2609,6 @@
     },
     "node_modules/@babel/plugin-transform-modules-commonjs": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.28.6.tgz",
-      "integrity": "sha512-jppVbf8IV9iWWwWTQIxJMAJCWBuuKx71475wHwYytrRGQ2CWiDvYlADQno3tcYpS/T2UUWFQp3nVtYfK/YBQrA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2960,8 +2624,6 @@
     },
     "node_modules/@babel/plugin-transform-modules-systemjs": {
       "version": "7.29.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.4.tgz",
-      "integrity": "sha512-N7QmZ0xRZfjHOfZeQLJjwgX2zS9pdGHSVl/cjSGlo4dXMqvurfxXDMKY4RqEKzPozV78VMcd0lxyG13mlbKc4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2979,8 +2641,6 @@
     },
     "node_modules/@babel/plugin-transform-modules-umd": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.27.1.tgz",
-      "integrity": "sha512-iQBE/xC5BV1OxJbp6WG7jq9IWiD+xxlZhLrdwpPkTX3ydmXdvoCpyfJN7acaIBZaOqTfr76pgzqBJflNbeRK+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2996,8 +2656,6 @@
     },
     "node_modules/@babel/plugin-transform-named-capturing-groups-regex": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.29.0.tgz",
-      "integrity": "sha512-1CZQA5KNAD6ZYQLPw7oi5ewtDNxH/2vuCh+6SmvgDfhumForvs8a1o9n0UrEoBD8HU4djO2yWngTQlXl1NDVEQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3013,8 +2671,6 @@
     },
     "node_modules/@babel/plugin-transform-new-target": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.27.1.tgz",
-      "integrity": "sha512-f6PiYeqXQ05lYq3TIfIDu/MtliKUbNwkGApPUvyo6+tc7uaR4cPjPe7DFPr15Uyycg2lZU6btZ575CuQoYh7MQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3029,8 +2685,6 @@
     },
     "node_modules/@babel/plugin-transform-nullish-coalescing-operator": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.28.6.tgz",
-      "integrity": "sha512-3wKbRgmzYbw24mDJXT7N+ADXw8BC/imU9yo9c9X9NKaLF1fW+e5H1U5QjMUBe4Qo4Ox/o++IyUkl1sVCLgevKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3045,8 +2699,6 @@
     },
     "node_modules/@babel/plugin-transform-numeric-separator": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-numeric-separator/-/plugin-transform-numeric-separator-7.28.6.tgz",
-      "integrity": "sha512-SJR8hPynj8outz+SlStQSwvziMN4+Bq99it4tMIf5/Caq+3iOc0JtKyse8puvyXkk3eFRIA5ID/XfunGgO5i6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3061,8 +2713,6 @@
     },
     "node_modules/@babel/plugin-transform-object-rest-spread": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.28.6.tgz",
-      "integrity": "sha512-5rh+JR4JBC4pGkXLAcYdLHZjXudVxWMXbB6u6+E9lRL5TrGVbHt1TjxGbZ8CkmYw9zjkB7jutzOROArsqtncEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3081,8 +2731,6 @@
     },
     "node_modules/@babel/plugin-transform-object-super": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.27.1.tgz",
-      "integrity": "sha512-SFy8S9plRPbIcxlJ8A6mT/CxFdJx/c04JEctz4jf8YZaVS2px34j7NXRrlGlHkN/M2gnpL37ZpGRGVFLd3l8Ng==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3098,8 +2746,6 @@
     },
     "node_modules/@babel/plugin-transform-optional-catch-binding": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.28.6.tgz",
-      "integrity": "sha512-R8ja/Pyrv0OGAvAXQhSTmWyPJPml+0TMqXlO5w+AsMEiwb2fg3WkOvob7UxFSL3OIttFSGSRFKQsOhJ/X6HQdQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3114,8 +2760,6 @@
     },
     "node_modules/@babel/plugin-transform-optional-chaining": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.28.6.tgz",
-      "integrity": "sha512-A4zobikRGJTsX9uqVFdafzGkqD30t26ck2LmOzAuLL8b2x6k3TIqRiT2xVvA9fNmFeTX484VpsdgmKNA0bS23w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3131,8 +2775,6 @@
     },
     "node_modules/@babel/plugin-transform-parameters": {
       "version": "7.27.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.27.7.tgz",
-      "integrity": "sha512-qBkYTYCb76RRxUM6CcZA5KRu8K4SM8ajzVeUgVdMVO9NN9uI/GaVmBg/WKJJGnNokV9SY8FxNOVWGXzqzUidBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3147,8 +2789,6 @@
     },
     "node_modules/@babel/plugin-transform-private-methods": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.28.6.tgz",
-      "integrity": "sha512-piiuapX9CRv7+0st8lmuUlRSmX6mBcVeNQ1b4AYzJxfCMuBfB0vBXDiGSmm03pKJw1v6cZ8KSeM+oUnM6yAExg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3164,8 +2804,6 @@
     },
     "node_modules/@babel/plugin-transform-private-property-in-object": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.28.6.tgz",
-      "integrity": "sha512-b97jvNSOb5+ehyQmBpmhOCiUC5oVK4PMnpRvO7+ymFBoqYjeDHIU9jnrNUuwHOiL9RpGDoKBpSViarV+BU+eVA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3182,8 +2820,6 @@
     },
     "node_modules/@babel/plugin-transform-private-property-in-object/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3195,8 +2831,6 @@
     },
     "node_modules/@babel/plugin-transform-property-literals": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.27.1.tgz",
-      "integrity": "sha512-oThy3BCuCha8kDZ8ZkgOg2exvPYUlprMukKQXI1r1pJ47NCvxfkEy8vK+r/hT9nF0Aa4H1WUPZZjHTFtAhGfmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3211,8 +2845,6 @@
     },
     "node_modules/@babel/plugin-transform-react-display-name": {
       "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.28.0.tgz",
-      "integrity": "sha512-D6Eujc2zMxKjfa4Zxl4GHMsmhKKZ9VpcqIchJLvwTxad9zWIYulwYItBovpDOoNLISpcZSXoDJ5gaGbQUDqViA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3227,8 +2859,6 @@
     },
     "node_modules/@babel/plugin-transform-react-jsx": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.28.6.tgz",
-      "integrity": "sha512-61bxqhiRfAACulXSLd/GxqmAedUSrRZIu/cbaT18T1CetkTmtDN15it7i80ru4DVqRK1WMxQhXs+Lf9kajm5Ow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3247,8 +2877,6 @@
     },
     "node_modules/@babel/plugin-transform-react-jsx-development": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.27.1.tgz",
-      "integrity": "sha512-ykDdF5yI4f1WrAolLqeF3hmYU12j9ntLQl/AOG1HAS21jxyg1Q0/J/tpREuYLfatGdGmXp/3yS0ZA76kOlVq9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3263,8 +2891,6 @@
     },
     "node_modules/@babel/plugin-transform-react-jsx/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3276,8 +2902,6 @@
     },
     "node_modules/@babel/plugin-transform-react-pure-annotations": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.27.1.tgz",
-      "integrity": "sha512-JfuinvDOsD9FVMTHpzA/pBLisxpv1aSf+OIV8lgH3MuWrks19R27e6a6DipIg4aX1Zm9Wpb04p8wljfKrVSnPA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3293,8 +2917,6 @@
     },
     "node_modules/@babel/plugin-transform-react-pure-annotations/node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.27.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.27.3.tgz",
-      "integrity": "sha512-fXSwMQqitTGeHLBC08Eq5yXz2m37E4pJX1qAU1+2cNedz/ifv/bVXft90VeSav5nFO61EcNgwr0aJxbyPaWBPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3306,8 +2928,6 @@
     },
     "node_modules/@babel/plugin-transform-regenerator": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.29.0.tgz",
-      "integrity": "sha512-FijqlqMA7DmRdg/aINBSs04y8XNTYw/lr1gJ2WsmBnnaNw1iS43EPkJW+zK7z65auG3AWRFXWj+NcTQwYptUog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3322,8 +2942,6 @@
     },
     "node_modules/@babel/plugin-transform-regexp-modifiers": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regexp-modifiers/-/plugin-transform-regexp-modifiers-7.28.6.tgz",
-      "integrity": "sha512-QGWAepm9qxpaIs7UM9FvUSnCGlb8Ua1RhyM4/veAxLwt3gMat/LSGrZixyuj4I6+Kn9iwvqCyPTtbdxanYoWYg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3339,8 +2957,6 @@
     },
     "node_modules/@babel/plugin-transform-reserved-words": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.27.1.tgz",
-      "integrity": "sha512-V2ABPHIJX4kC7HegLkYoDpfg9PVmuWy/i6vUM5eGK22bx4YVFD3M5F0QQnWQoDs6AGsUWTVOopBiMFQgHaSkVw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3355,8 +2971,6 @@
     },
     "node_modules/@babel/plugin-transform-runtime": {
       "version": "7.26.10",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.26.10.tgz",
-      "integrity": "sha512-NWaL2qG6HRpONTnj4JvDU6th4jYeZOJgu3QhmFTCihib0ermtOJqktA5BduGm3suhhVe9EMP9c9+mfJ/I9slqw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3376,8 +2990,6 @@
     },
     "node_modules/@babel/plugin-transform-runtime/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -3386,8 +2998,6 @@
     },
     "node_modules/@babel/plugin-transform-shorthand-properties": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.27.1.tgz",
-      "integrity": "sha512-N/wH1vcn4oYawbJ13Y/FxcQrWk63jhfNa7jef0ih7PHSIHX2LB7GWE1rkPrOnka9kwMxb6hMl19p7lidA+EHmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3402,8 +3012,6 @@
     },
     "node_modules/@babel/plugin-transform-spread": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.28.6.tgz",
-      "integrity": "sha512-9U4QObUC0FtJl05AsUcodau/RWDytrU6uKgkxu09mLR9HLDAtUMoPuuskm5huQsoktmsYpI+bGmq+iapDcriKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3419,8 +3027,6 @@
     },
     "node_modules/@babel/plugin-transform-sticky-regex": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.27.1.tgz",
-      "integrity": "sha512-lhInBO5bi/Kowe2/aLdBAawijx+q1pQzicSgnkB6dUPc1+RC8QmJHKf2OjvU+NZWitguJHEaEmbV6VWEouT58g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3435,8 +3041,6 @@
     },
     "node_modules/@babel/plugin-transform-template-literals": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.27.1.tgz",
-      "integrity": "sha512-fBJKiV7F2DxZUkg5EtHKXQdbsbURW3DZKQUWphDum0uRP6eHGGa/He9mc0mypL680pb+e/lDIthRohlv8NCHkg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3451,8 +3055,6 @@
     },
     "node_modules/@babel/plugin-transform-typeof-symbol": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.27.1.tgz",
-      "integrity": "sha512-RiSILC+nRJM7FY5srIyc4/fGIwUhyDuuBSdWn4y6yT6gm652DpCHZjIipgn6B7MQ1ITOUnAKWixEUjQRIBIcLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3467,8 +3069,6 @@
     },
     "node_modules/@babel/plugin-transform-unicode-escapes": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.27.1.tgz",
-      "integrity": "sha512-Ysg4v6AmF26k9vpfFuTZg8HRfVWzsh1kVfowA23y9j/Gu6dOuahdUVhkLqpObp3JIv27MLSii6noRnuKN8H0Mg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3483,8 +3083,6 @@
     },
     "node_modules/@babel/plugin-transform-unicode-property-regex": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.28.6.tgz",
-      "integrity": "sha512-4Wlbdl/sIZjzi/8St0evF0gEZrgOswVO6aOzqxh1kDZOl9WmLrHq2HtGhnOJZmHZYKP8WZ1MDLCt5DAWwRo57A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3500,8 +3098,6 @@
     },
     "node_modules/@babel/plugin-transform-unicode-regex": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.27.1.tgz",
-      "integrity": "sha512-xvINq24TRojDuyt6JGtHmkVkrfVV3FPT16uytxImLeBZqW3/H52yN+kM1MGuyPkIQxrzKwPHs5U/MP3qKyzkGw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3517,8 +3113,6 @@
     },
     "node_modules/@babel/plugin-transform-unicode-sets-regex": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.28.6.tgz",
-      "integrity": "sha512-/wHc/paTUmsDYN7SZkpWxogTOBNnlx7nBQYfy6JJlCT7G3mVhltk3e++N7zV0XfgGsrqBxd4rJQt9H16I21Y1Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3534,8 +3128,6 @@
     },
     "node_modules/@babel/preset-env": {
       "version": "7.26.9",
-      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.26.9.tgz",
-      "integrity": "sha512-vX3qPGE8sEKEAZCWk05k3cpTAE3/nOYca++JA+Rd0z2NCNzabmYvEiSShKzm10zdquOIAVXsy2Ei/DTW34KlKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3618,8 +3210,6 @@
     },
     "node_modules/@babel/preset-env/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -3628,8 +3218,6 @@
     },
     "node_modules/@babel/preset-modules": {
       "version": "0.1.6-no-external-plugins",
-      "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.6-no-external-plugins.tgz",
-      "integrity": "sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3643,8 +3231,6 @@
     },
     "node_modules/@babel/preset-react": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.28.5.tgz",
-      "integrity": "sha512-Z3J8vhRq7CeLjdC58jLv4lnZ5RKFUJWqH5emvxmv9Hv3BD1T9R/Im713R4MTKwvFaV74ejZ3sM01LyEKk4ugNQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3664,8 +3250,6 @@
     },
     "node_modules/@babel/runtime": {
       "version": "7.26.10",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.26.10.tgz",
-      "integrity": "sha512-2WJMeRQPHKSPemqk/awGrAiuFfzBmOIPXKizAsVhWH9YJqLZ0H+HS4c8loHGgW6utJ3E/ejXQUsiGaQy2NZ9Fw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3677,8 +3261,6 @@
     },
     "node_modules/@babel/template": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.28.6",
@@ -3691,8 +3273,6 @@
     },
     "node_modules/@babel/traverse": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
@@ -3709,8 +3289,6 @@
     },
     "node_modules/@babel/traverse/node_modules/@babel/generator": {
       "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.29.0",
@@ -3725,8 +3303,6 @@
     },
     "node_modules/@babel/types": {
       "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-string-parser": "^7.27.1",
@@ -3738,15 +3314,11 @@
     },
     "node_modules/@bcoe/v8-coverage": {
       "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
-      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@cacheable/memory": {
       "version": "2.0.9",
-      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.0.9.tgz",
-      "integrity": "sha512-HdMx6DoGywB30vacDbBsITbIX4pgFqj1zsrV58jZBUw3klzkNoXhj7qOqAgledhxG7YZI5rBSJg7Zp8/VG0DuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3758,8 +3330,6 @@
     },
     "node_modules/@cacheable/memory/node_modules/keyv": {
       "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
-      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3768,8 +3338,6 @@
     },
     "node_modules/@cacheable/utils": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.4.1.tgz",
-      "integrity": "sha512-eiFgzCbIneyMlLOmNG4g9xzF7Hv3Mga4LjxjcSC/ues6VYq2+gUbQI8JqNuw/ZM8tJIeIaBGpswAsqV2V7ApgA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3779,8 +3347,6 @@
     },
     "node_modules/@cacheable/utils/node_modules/keyv": {
       "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
-      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3789,8 +3355,6 @@
     },
     "node_modules/@carbon/charts": {
       "version": "1.23.9",
-      "resolved": "https://registry.npmjs.org/@carbon/charts/-/charts-1.23.9.tgz",
-      "integrity": "sha512-hYd+jN+EuM1OcA/apoHv3fPN0TGnvjKBRBJkDwDBjkrp1YwoMYf3arqL9VDrq+Gl5hy3MPu4j57elVAOCCMG0Q==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3812,8 +3376,6 @@
     },
     "node_modules/@carbon/charts-angular": {
       "version": "1.23.9",
-      "resolved": "https://registry.npmjs.org/@carbon/charts-angular/-/charts-angular-1.23.9.tgz",
-      "integrity": "sha512-vN+9BIvlv+LqeDT0LrlwbmQR9Qj1C1E9OQaMLHattGrCLInpwQG0YBtzJQ/Jrhp9IrAjeEMvDm6jPWek6EI3Hg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@carbon/charts": "1.23.9",
@@ -3827,20 +3389,14 @@
     },
     "node_modules/@carbon/charts-angular/node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
     "node_modules/@carbon/charts/node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
     "node_modules/@carbon/colors": {
       "version": "11.51.0",
-      "resolved": "https://registry.npmjs.org/@carbon/colors/-/colors-11.51.0.tgz",
-      "integrity": "sha512-PgCHKIrZ8t/1oG8ofkv2XDHeuwcmvKsT0nUWVyiCoL6Xf2JWdAyuWyNDDtRuQXJ4ayNAdRk2+pijT23/ooXGlw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3849,8 +3405,6 @@
     },
     "node_modules/@carbon/feature-flags": {
       "version": "0.27.0",
-      "resolved": "https://registry.npmjs.org/@carbon/feature-flags/-/feature-flags-0.27.0.tgz",
-      "integrity": "sha512-YDV3IcQnSxDHHHguJQ3DJd7Vi5OA9NsRg0CicrNX7fKyjHpNpFuLy1yan47LItXY1atw4GP7agpZgSumlUl9UA==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3859,8 +3413,6 @@
     },
     "node_modules/@carbon/grid": {
       "version": "11.55.0",
-      "resolved": "https://registry.npmjs.org/@carbon/grid/-/grid-11.55.0.tgz",
-      "integrity": "sha512-3qn6oRfFlJLQPiq3NIyuObEvqmoi8uWzGdFNGgNuuWnt+jjMlB72beST2eUdwkTm+ZgvI4ezelo0HWzpMJE8ig==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3870,14 +3422,10 @@
     },
     "node_modules/@carbon/icon-helpers": {
       "version": "10.37.0",
-      "resolved": "https://registry.npmjs.org/@carbon/icon-helpers/-/icon-helpers-10.37.0.tgz",
-      "integrity": "sha512-YXed2JUSCGddp3UnY5OffR3W8Pl+dy9a+vfUtYhSLH9TbIEBR6EvYIfvruFMhA8JIVMCUClUqgyMQXM5oMFQ0g==",
       "license": "Apache-2.0"
     },
     "node_modules/@carbon/icons": {
       "version": "11.63.0",
-      "resolved": "https://registry.npmjs.org/@carbon/icons/-/icons-11.63.0.tgz",
-      "integrity": "sha512-J5sGbamMMBbQPcdX9ImzEIoa7l2DyNiZYu9ScKtY3dJ6lKeG6GJUFQYH5/vcpuyj02tizVe6rSgWcH210+OOqw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3886,8 +3434,6 @@
     },
     "node_modules/@carbon/layout": {
       "version": "11.52.0",
-      "resolved": "https://registry.npmjs.org/@carbon/layout/-/layout-11.52.0.tgz",
-      "integrity": "sha512-VJQygK1ZB3HSiRBJbRVfrgBfT8jkltD3H1glx6L1nw/Yv1qgAYkta5iIQ1bhlArBDy6pd00/oBiHrd3hOaMrxw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3896,8 +3442,6 @@
     },
     "node_modules/@carbon/motion": {
       "version": "11.45.0",
-      "resolved": "https://registry.npmjs.org/@carbon/motion/-/motion-11.45.0.tgz",
-      "integrity": "sha512-5n3MTAf5vHhsNVkpjOCvGxSk7sgoNrn4MlSIIK6aQVDBYNJTI6r8lL5LZ7a+vAUUktFp8Lp9/hOXaDzbi2SayA==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3906,8 +3450,6 @@
     },
     "node_modules/@carbon/styles": {
       "version": "1.83.0",
-      "resolved": "https://registry.npmjs.org/@carbon/styles/-/styles-1.83.0.tgz",
-      "integrity": "sha512-ez8Hhi4yxGyXoUBVdQDdA5a7A5XGtOEHkszdjl8gYLI4LC/8A2Idmed65lgIlemjsFefWqOa04wrynmU5RoFXA==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3940,8 +3482,6 @@
     },
     "node_modules/@carbon/styles/node_modules/@ibm/plex": {
       "version": "6.0.0-next.6",
-      "resolved": "https://registry.npmjs.org/@ibm/plex/-/plex-6.0.0-next.6.tgz",
-      "integrity": "sha512-B3uGruTn2rS5gweynLmfSe7yCawSRsJguJJQHVQiqf4rh2RNgJFu8YLE2Zd/JHV0ZXoVMOslcXP2k3hMkxKEyA==",
       "license": "OFL-1.1",
       "engines": {
         "node": ">=14"
@@ -3949,8 +3489,6 @@
     },
     "node_modules/@carbon/themes": {
       "version": "11.73.0",
-      "resolved": "https://registry.npmjs.org/@carbon/themes/-/themes-11.73.0.tgz",
-      "integrity": "sha512-3ZvDdf5t3rwzLcHwGLTSGSY8JI6dMhtTU49LfBDRnb7wsH3wQpa0c/Jm0hoqW+ZeqalZimrAHZwWeigLMpk95Q==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3963,8 +3501,6 @@
     },
     "node_modules/@carbon/type": {
       "version": "11.59.0",
-      "resolved": "https://registry.npmjs.org/@carbon/type/-/type-11.59.0.tgz",
-      "integrity": "sha512-juQePeqbFJHzz9gAvUdR7EpvT+BAqBOLIpanqhR3BWLOxbzEeLpySYy/C9gw8uM0Cuh/efoCVM2Q9k3TbdJBVw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3975,8 +3511,6 @@
     },
     "node_modules/@carbon/utils-position": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@carbon/utils-position/-/utils-position-1.3.0.tgz",
-      "integrity": "sha512-bfar2dV+fQ15syIrH3n9ujY4PXd1Q+AF2VcTLJIC04IDe2f80zOnJlLNPc/RktHcWTZ7WSQm80cQo3abGcsfTA==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -3985,8 +3519,6 @@
     },
     "node_modules/@colors/colors": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz",
-      "integrity": "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3996,8 +3528,6 @@
     },
     "node_modules/@compodoc/compodoc": {
       "version": "1.1.26",
-      "resolved": "https://registry.npmjs.org/@compodoc/compodoc/-/compodoc-1.1.26.tgz",
-      "integrity": "sha512-CJkqTtdotxMA4SDyUx8J6Mrm3MMmcgFtfEViUnG9Of2CXhYiXIqNeD881+pxn0opmMC+VCTL0/SCD03tDYhWYA==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -4051,8 +3581,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/core": {
       "version": "18.2.8",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/core/-/core-18.2.8.tgz",
-      "integrity": "sha512-4o2T6wsmXGE/v53+F8L7kGoN2+qzt03C9rtjLVQpOljzpJVttQ8bhvfWxyYLWwcl04RWqRa+82fpIZtBkOlZJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4079,8 +3607,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@angular-devkit/schematics": {
       "version": "18.2.8",
-      "resolved": "https://registry.npmjs.org/@angular-devkit/schematics/-/schematics-18.2.8.tgz",
-      "integrity": "sha512-i/h2Oji5FhJMC7wDSnIl5XUe/qym+C1ZwScaATJwDyRLCUIynZkj5rLgdG/uK6l+H0PgvxigkF+akWpokkwW6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4098,8 +3624,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@babel/core": {
       "version": "7.25.8",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.25.8.tgz",
-      "integrity": "sha512-Oixnb+DzmRT30qu9d3tJSQkxuygWm32DFykT4bRoORPa9hZ/L4KhVB/XiRm6KG+roIEM7DBQlmg27kw2HZkdZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4129,8 +3653,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@babel/core/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4139,8 +3661,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@babel/plugin-transform-private-methods": {
       "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.25.7.tgz",
-      "integrity": "sha512-KY0hh2FluNxMLwOCHbxVOKfdB5sjWG4M183885FmaqWWiGMhRZq4DQRKH6mHdEucbJnyDyYiZNwNG424RymJjA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4156,8 +3676,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@babel/preset-env": {
       "version": "7.25.8",
-      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.25.8.tgz",
-      "integrity": "sha512-58T2yulDHMN8YMUxiLq5YmWUnlDCyY1FsHM+v12VMx+1/FlrUj5tY50iDCpofFQEM8fMYOaY9YRvym2jcjn1Dg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4239,8 +3757,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/@babel/preset-env/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4249,8 +3765,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/babel-plugin-polyfill-corejs3": {
       "version": "0.10.6",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.10.6.tgz",
-      "integrity": "sha512-b37+KR2i/khY5sKmWNVQAnitvquQbNdWy6lJdsr0kmquCKEEUgMKK4SboVM3HtfnZilfjr4MMQ7vY58FVWDtIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4263,15 +3777,11 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@compodoc/compodoc/node_modules/magic-string": {
       "version": "0.30.11",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.11.tgz",
-      "integrity": "sha512-+Wri9p0QHMy+545hKww7YAu5NyzF8iomPL/RQazugQ9+Ez4Ic3mERMd8ZTX5rfK944j+560ZJi8iAwgak1Ac7A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4280,8 +3790,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/rxjs": {
       "version": "7.8.1",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz",
-      "integrity": "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -4290,9 +3798,6 @@
     },
     "node_modules/@compodoc/compodoc/node_modules/uuid": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -4305,8 +3810,6 @@
     },
     "node_modules/@compodoc/live-server": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/@compodoc/live-server/-/live-server-1.2.3.tgz",
-      "integrity": "sha512-hDmntVCyjjaxuJzPzBx68orNZ7TW4BtHWMnXlIVn5dqhK7vuFF/11hspO1cMmc+2QTYgqde1TBcb3127S7Zrow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4334,8 +3837,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/chokidar": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
-      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4359,8 +3860,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/define-lazy-prop": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
-      "integrity": "sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4369,8 +3868,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -4382,8 +3879,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/is-docker": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -4398,8 +3893,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/is-wsl": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4411,8 +3904,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/open": {
       "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/open/-/open-8.4.0.tgz",
-      "integrity": "sha512-XgFPPM+B28FtCCgSb9I+s9szOC1vZRSwgWsRUA5ylIxRTgKozqjOCrVOqGsYABPYK5qnfqClxZTFBa8PKt2v6Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4429,8 +3920,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4442,8 +3931,6 @@
     },
     "node_modules/@compodoc/live-server/node_modules/readdirp": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4455,8 +3942,6 @@
     },
     "node_modules/@compodoc/ngd-core": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@compodoc/ngd-core/-/ngd-core-2.1.1.tgz",
-      "integrity": "sha512-Z+wE6wWZYVnudRYg6qunDlyh3Orw39Ib66Gvrz5kX5u7So+iu3tr6sQJdqH6yGS3hAjig5avlfhWLlgsb6/x1Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4470,8 +3955,6 @@
     },
     "node_modules/@compodoc/ngd-transformer": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/@compodoc/ngd-transformer/-/ngd-transformer-2.1.3.tgz",
-      "integrity": "sha512-oWxJza7CpWR8/FeWYfE6j+jgncnGBsTWnZLt5rD2GUpsGSQTuGrsFPnmbbaVLgRS5QIVWBJYke7QFBr/7qVMWg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4486,8 +3969,6 @@
     },
     "node_modules/@cspotcode/source-map-support": {
       "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
-      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4499,8 +3980,6 @@
     },
     "node_modules/@cspotcode/source-map-support/node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.9",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
-      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4510,8 +3989,6 @@
     },
     "node_modules/@csstools/css-parser-algorithms": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
-      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
       "dev": true,
       "funding": [
         {
@@ -4533,8 +4010,6 @@
     },
     "node_modules/@csstools/css-tokenizer": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
-      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
       "dev": true,
       "funding": [
         {
@@ -4553,8 +4028,6 @@
     },
     "node_modules/@csstools/media-query-list-parser": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/@csstools/media-query-list-parser/-/media-query-list-parser-4.0.3.tgz",
-      "integrity": "sha512-HAYH7d3TLRHDOUQK4mZKf9k9Ph/m8Akstg66ywKR4SFAigjs3yBiUeZtFxywiTm5moZMAp/5W/ZuFnNXXYLuuQ==",
       "dev": true,
       "funding": [
         {
@@ -4577,8 +4050,6 @@
     },
     "node_modules/@csstools/selector-specificity": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-5.0.0.tgz",
-      "integrity": "sha512-PCqQV3c4CoVm3kdPhyeZ07VmBRdH2EpMFA/pd9OASpOEC3aXNGoqPDAZ80D0cLpMBxnmk0+yNhGsEx31hq7Gtw==",
       "dev": true,
       "funding": [
         {
@@ -4600,9 +4071,6 @@
     },
     "node_modules/@cypress/browserify-preprocessor": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@cypress/browserify-preprocessor/-/browserify-preprocessor-3.0.2.tgz",
-      "integrity": "sha512-y6mlFR+IR2cqcm3HabSp7AEcX9QfF1EUL4eOaw/7xexdhmdQU8ez6piyRopZQob4BK8oKTsc9PkupsU2rzjqMA==",
-      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4631,8 +4099,6 @@
     },
     "node_modules/@cypress/browserify-preprocessor/node_modules/fs-extra": {
       "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4647,8 +4113,6 @@
     },
     "node_modules/@cypress/request": {
       "version": "2.88.12",
-      "resolved": "https://registry.npmjs.org/@cypress/request/-/request-2.88.12.tgz",
-      "integrity": "sha512-tOn+0mDZxASFM+cuAP9szGUGPI1HwWVSvdzm7V4cCsPdFTx6qMj29CwaQmRAMIEhORIUBFBsYROYJcveK4uOjA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -4677,8 +4141,6 @@
     },
     "node_modules/@cypress/xvfb": {
       "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@cypress/xvfb/-/xvfb-1.2.4.tgz",
-      "integrity": "sha512-skbBzPggOVYCbnGgV+0dmBdW/s77ZkAOXIC1knS8NagwDjBrNC1LuXtQJeiN6l+m7lzmHtaoUw/ctJKdqkG57Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4688,8 +4150,6 @@
     },
     "node_modules/@cypress/xvfb/node_modules/debug": {
       "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4698,8 +4158,6 @@
     },
     "node_modules/@discoveryjs/json-ext": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.6.3.tgz",
-      "integrity": "sha512-4B4OijXeVNOPZlYA2oEwWOTkzyltLao+xbotHQeqN++Rv27Y6s818+n2Qkp8q+Fxhn0t/5lA5X1Mxktud8eayQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4708,8 +4166,6 @@
     },
     "node_modules/@dual-bundle/import-meta-resolve": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@dual-bundle/import-meta-resolve/-/import-meta-resolve-4.2.1.tgz",
-      "integrity": "sha512-id+7YRUgoUX6CgV0DtuhirQWodeeA7Lf4i2x71JS/vtA5pRb/hIGWlw+G6MeXvsM+MXrz0VAydTGElX1rAfgPg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -4717,282 +4173,8 @@
         "url": "https://github.com/sponsors/JounQin"
       }
     },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@esbuild/linux-x64": {
       "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
       "cpu": [
         "x64"
       ],
@@ -5006,163 +4188,8 @@
         "node": ">=18"
       }
     },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5180,8 +4207,6 @@
     },
     "node_modules/@eslint-community/regexpp": {
       "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5190,8 +4215,6 @@
     },
     "node_modules/@eslint/config-array": {
       "version": "0.18.0",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.18.0.tgz",
-      "integrity": "sha512-fTxvnS1sRMu3+JjXwJG0j/i4RT9u4qJ+lqS/yCGap4lH4zZGzQ7tu+xZqQmcMZq5OBZDL4QRxQzRjkWcGt8IVw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5205,8 +4228,6 @@
     },
     "node_modules/@eslint/config-array/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5216,8 +4237,6 @@
     },
     "node_modules/@eslint/config-array/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -5229,8 +4248,6 @@
     },
     "node_modules/@eslint/core": {
       "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.7.0.tgz",
-      "integrity": "sha512-xp5Jirz5DyPYlPiKat8jaq0EmYvDXKKpzTbxXMpT9eqlRJkRKIz9AGMdlvYjih+im+QlhWrpvVjl8IPC/lHlUw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5239,8 +4256,6 @@
     },
     "node_modules/@eslint/eslintrc": {
       "version": "3.3.5",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz",
-      "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5263,8 +4278,6 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5280,8 +4293,6 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5291,8 +4302,6 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5304,15 +4313,11 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@eslint/eslintrc/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -5324,8 +4329,6 @@
     },
     "node_modules/@eslint/js": {
       "version": "9.14.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.14.0.tgz",
-      "integrity": "sha512-pFoEtFWCPyDOl+C6Ift+wC7Ro89otjigCf5vcuWqWgqNSQbRrpjSvdeE6ofLz4dHmyxD5f7gIdGT4+p36L6Twg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5334,8 +4337,6 @@
     },
     "node_modules/@eslint/object-schema": {
       "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
-      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5344,8 +4345,6 @@
     },
     "node_modules/@eslint/plugin-kit": {
       "version": "0.2.8",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.2.8.tgz",
-      "integrity": "sha512-ZAoA40rNMPwSm+AeHpCq8STiNAwzWLJuP8Xv4CHIc9wv/PSuExjMrmjfYNj682vW0OOiZ1HKxzvjQr9XZIisQA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5358,8 +4357,6 @@
     },
     "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
       "version": "0.13.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.13.0.tgz",
-      "integrity": "sha512-yfkgDw1KR66rkT5A8ci4irzDysN7FRpq3ttJolR88OqQikAWqwA8j5VZyas+vjyBNFIJ7MfybJ9plMILI2UrCw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5371,8 +4368,6 @@
     },
     "node_modules/@fastify/ajv-compiler": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-3.6.0.tgz",
-      "integrity": "sha512-LwdXQJjmMD+GwLOkP7TVC68qa+pSSogeWWmznRJ/coyTcfe9qA05AHFSe1eZFwK6q+xVRpChnvFUkf1iYaSZsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5383,8 +4378,6 @@
     },
     "node_modules/@fastify/ajv-compiler/node_modules/ajv-formats": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz",
-      "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5401,22 +4394,16 @@
     },
     "node_modules/@fastify/ajv-compiler/node_modules/fast-uri": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-2.4.0.tgz",
-      "integrity": "sha512-ypuAmmMKInk5q7XcepxlnUWDLWv4GFtaJqAzWKqn62IpQ3pejtr5dTVbt3vwqVaMKmkNR55sTT+CqUKIaT21BA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@fastify/error": {
       "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/@fastify/error/-/error-3.4.1.tgz",
-      "integrity": "sha512-wWSvph+29GR783IhmvdwWnN4bUxTD01Vm5Xad4i7i1VuAOItLvbPAb69sb0IQ2N57yprvhNIwAP5B6xfKTmjmQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@fastify/fast-json-stringify-compiler": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@fastify/fast-json-stringify-compiler/-/fast-json-stringify-compiler-4.3.0.tgz",
-      "integrity": "sha512-aZAXGYo6m22Fk1zZzEUKBvut/CIIQe/BapEORnxiD5Qr0kPHqqI69NtEMCme74h+at72sPhbkb4ZrLd1W3KRLA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5425,8 +4412,6 @@
     },
     "node_modules/@fastify/merge-json-schemas": {
       "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/merge-json-schemas/-/merge-json-schemas-0.1.1.tgz",
-      "integrity": "sha512-fERDVz7topgNjtXsJTTW1JKLy0rhuLRcquYqNR9rF7OcVpCa2OVW49ZPDIhaRRCaUuvVxI+N416xUoF76HNSXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5435,8 +4420,6 @@
     },
     "node_modules/@floating-ui/core": {
       "version": "1.7.5",
-      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.5.tgz",
-      "integrity": "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/utils": "^0.2.11"
@@ -5444,8 +4427,6 @@
     },
     "node_modules/@floating-ui/dom": {
       "version": "1.6.13",
-      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.6.13.tgz",
-      "integrity": "sha512-umqzocjDgNRGTuO7Q8CU32dkHkECqI8ZdMZ5Swb6QAM0t5rnlrN3lGo1hdpscRd3WS8T6DKYK4ephgIH9iRh3w==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/core": "^1.6.0",
@@ -5454,21 +4435,15 @@
     },
     "node_modules/@floating-ui/utils": {
       "version": "0.2.11",
-      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.11.tgz",
-      "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
       "license": "MIT"
     },
     "node_modules/@hapi/hoek": {
       "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
-      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@hapi/topo": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
-      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -5477,8 +4452,6 @@
     },
     "node_modules/@humanfs/core": {
       "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
-      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5490,8 +4463,6 @@
     },
     "node_modules/@humanfs/node": {
       "version": "0.16.8",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
-      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5505,8 +4476,6 @@
     },
     "node_modules/@humanfs/types": {
       "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
-      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5515,8 +4484,6 @@
     },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5529,8 +4496,6 @@
     },
     "node_modules/@humanwhocodes/retry": {
       "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5543,62 +4508,42 @@
     },
     "node_modules/@ibm/plex": {
       "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex/-/plex-6.4.0.tgz",
-      "integrity": "sha512-P70hmNoSJhpV6fGG4++JEivoccUVuvkyZoXprsDmPTtv3s6QvL+Q8bK3HFSGmK/VgyLMDptoKPV7b/h/1xaWAw==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-mono": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-mono/-/plex-mono-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-xSa/c1vrzGmMR5xQr/aWP/q62jUD41mKwm2w4kFsvIVyT9fxC3wq81UYMSGBxQZ6+P1AROMSefF22aLXkv6uqw==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-sans": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-sans/-/plex-sans-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-JU3dmaJiTNL17MO2pTzUJUzYSLZjUmkFUOia9c/2mU4ehqyvw95yQ6G4XRRqEHQdUA7auO4I0GX8mcI8rQk/Tw==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-sans-arabic": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-sans-arabic/-/plex-sans-arabic-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-tFi6soIKl/A2xWf5/N9kCkMhv+MOcEewWWFM9Bz9U0YO5I4KR0qdUTU7rN4jTjvCJGPExwPFukQKBNz7djuShg==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-sans-devanagari": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-sans-devanagari/-/plex-sans-devanagari-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-jrhO6KOxwtpw3WaidCNSn+IWqxDyYGSUUP8i4WjmxkBREQNf4fSJwbjzgB79E/Mnhc3b2NZska+41k5owRlIoQ==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-sans-hebrew": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-sans-hebrew/-/plex-sans-hebrew-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-sMsn1jU8kyYfSlWMfjcbvpGXJIIXGOZD+sxtBcogZz4umnCq5ys+bmsqlzkfGR25DCB49WvseD2IHbejes0/aA==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-sans-thai": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-sans-thai/-/plex-sans-thai-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-3RteUFhshRTmP5Swq9LYravDXmVvjxtxsZ7qeSqjn31CUgeSuZKprDWb+RzSQrO+Jg7AI4g1lolzTr/jG/LnxA==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-sans-thai-looped": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-sans-thai-looped/-/plex-sans-thai-looped-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-mcddR5ZcAQx5TjmaxaXd6gTdtOgxlyVaKqjzQAjUbzNQy0cjTGhIJHB5VrFES7yJLRCtQNCNGP+bzupzHOQERw==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/plex-serif": {
       "version": "0.0.3-alpha.0",
-      "resolved": "https://registry.npmjs.org/@ibm/plex-serif/-/plex-serif-0.0.3-alpha.0.tgz",
-      "integrity": "sha512-wuyglvk5dVTiOtRMlGhbRdu9zptl84CHLhjzuWPb2LwU3IiFlVWAirKaRKRv/AFwtAT9RoTtvT7spEyffdCzFw==",
       "license": "OFL-1.1"
     },
     "node_modules/@ibm/telemetry-js": {
       "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@ibm/telemetry-js/-/telemetry-js-1.11.0.tgz",
-      "integrity": "sha512-RO/9j+URJnSfseWg9ZkEX9p+a3Ousd33DBU7rOafoZB08RqdzxFVYJ2/iM50dkBuD0o7WX7GYt1sLbNgCoE+pA==",
       "license": "Apache-2.0",
       "bin": {
         "ibmtelemetry": "dist/collect.js"
@@ -5606,8 +4551,6 @@
     },
     "node_modules/@inquirer/ansi": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@inquirer/ansi/-/ansi-1.0.2.tgz",
-      "integrity": "sha512-S8qNSZiYzFd0wAcyG5AXCvUHC5Sr7xpZ9wZ2py9XR88jUz8wooStVx5M6dRzczbBWjic9NP7+rY0Xi7qqK/aMQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5616,8 +4559,6 @@
     },
     "node_modules/@inquirer/checkbox": {
       "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/@inquirer/checkbox/-/checkbox-4.3.2.tgz",
-      "integrity": "sha512-VXukHf0RR1doGe6Sm4F0Em7SWYLTHSsbGfJdS9Ja2bX5/D5uwVOEjr07cncLROdBvmnvCATYEWlHqYmXv2IlQA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5641,8 +4582,6 @@
     },
     "node_modules/@inquirer/confirm": {
       "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/@inquirer/confirm/-/confirm-5.1.6.tgz",
-      "integrity": "sha512-6ZXYK3M1XmaVBZX6FCfChgtponnL0R6I7k8Nu+kaoNkT828FVZTcca1MqmWQipaW2oNREQl5AaPCUOOCVNdRMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5663,8 +4602,6 @@
     },
     "node_modules/@inquirer/core": {
       "version": "10.3.2",
-      "resolved": "https://registry.npmjs.org/@inquirer/core/-/core-10.3.2.tgz",
-      "integrity": "sha512-43RTuEbfP8MbKzedNqBrlhhNKVwoK//vUFNW3Q3vZ88BLcrs4kYpGg+B2mm5p2K/HfygoCxuKwJJiv8PbGmE0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5691,8 +4628,6 @@
     },
     "node_modules/@inquirer/editor": {
       "version": "4.2.23",
-      "resolved": "https://registry.npmjs.org/@inquirer/editor/-/editor-4.2.23.tgz",
-      "integrity": "sha512-aLSROkEwirotxZ1pBaP8tugXRFCxW94gwrQLxXfrZsKkfjOYC1aRvAZuhpJOb5cu4IBTJdsCigUlf2iCOu4ZDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5714,8 +4649,6 @@
     },
     "node_modules/@inquirer/expand": {
       "version": "4.0.23",
-      "resolved": "https://registry.npmjs.org/@inquirer/expand/-/expand-4.0.23.tgz",
-      "integrity": "sha512-nRzdOyFYnpeYTTR2qFwEVmIWypzdAx/sIkCMeTNTcflFOovfqUk+HcFhQQVBftAh9gmGrpFj6QcGEqrDMDOiew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5737,8 +4670,6 @@
     },
     "node_modules/@inquirer/external-editor": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-1.0.3.tgz",
-      "integrity": "sha512-RWbSrDiYmO4LbejWY7ttpxczuwQyZLBUyygsA9Nsv95hpzUWwnNTVQmAq3xuh7vNwCp07UTmE5i11XAEExx4RA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5759,8 +4690,6 @@
     },
     "node_modules/@inquirer/figures": {
       "version": "1.0.15",
-      "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.15.tgz",
-      "integrity": "sha512-t2IEY+unGHOzAaVM5Xx6DEWKeXlDDcNPeDyUpsRc6CUhBfU3VQOEl+Vssh7VNp1dR8MdUJBWhuObjXCsVpjN5g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5769,8 +4698,6 @@
     },
     "node_modules/@inquirer/input": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@inquirer/input/-/input-4.3.1.tgz",
-      "integrity": "sha512-kN0pAM4yPrLjJ1XJBjDxyfDduXOuQHrBB8aLDMueuwUGn+vNpF7Gq7TvyVxx8u4SHlFFj4trmj+a2cbpG4Jn1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5791,8 +4718,6 @@
     },
     "node_modules/@inquirer/number": {
       "version": "3.0.23",
-      "resolved": "https://registry.npmjs.org/@inquirer/number/-/number-3.0.23.tgz",
-      "integrity": "sha512-5Smv0OK7K0KUzUfYUXDXQc9jrf8OHo4ktlEayFlelCjwMXz0299Y8OrI+lj7i4gCBY15UObk76q0QtxjzFcFcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5813,8 +4738,6 @@
     },
     "node_modules/@inquirer/password": {
       "version": "4.0.23",
-      "resolved": "https://registry.npmjs.org/@inquirer/password/-/password-4.0.23.tgz",
-      "integrity": "sha512-zREJHjhT5vJBMZX/IUbyI9zVtVfOLiTO66MrF/3GFZYZ7T4YILW5MSkEYHceSii/KtRk+4i3RE7E1CUXA2jHcA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5836,8 +4759,6 @@
     },
     "node_modules/@inquirer/prompts": {
       "version": "7.3.2",
-      "resolved": "https://registry.npmjs.org/@inquirer/prompts/-/prompts-7.3.2.tgz",
-      "integrity": "sha512-G1ytyOoHh5BphmEBxSwALin3n1KGNYB6yImbICcRQdzXfOGbuJ9Jske/Of5Sebk339NSGGNfUshnzK8YWkTPsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5866,8 +4787,6 @@
     },
     "node_modules/@inquirer/rawlist": {
       "version": "4.1.11",
-      "resolved": "https://registry.npmjs.org/@inquirer/rawlist/-/rawlist-4.1.11.tgz",
-      "integrity": "sha512-+LLQB8XGr3I5LZN/GuAHo+GpDJegQwuPARLChlMICNdwW7OwV2izlCSCxN6cqpL0sMXmbKbFcItJgdQq5EBXTw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5889,8 +4808,6 @@
     },
     "node_modules/@inquirer/search": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/@inquirer/search/-/search-3.2.2.tgz",
-      "integrity": "sha512-p2bvRfENXCZdWF/U2BXvnSI9h+tuA8iNqtUKb9UWbmLYCRQxd8WkvwWvYn+3NgYaNwdUkHytJMGG4MMLucI1kA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5913,8 +4830,6 @@
     },
     "node_modules/@inquirer/select": {
       "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/@inquirer/select/-/select-4.4.2.tgz",
-      "integrity": "sha512-l4xMuJo55MAe+N7Qr4rX90vypFwCajSakx59qe/tMaC1aEHWLyw68wF4o0A4SLAY4E0nd+Vt+EyskeDIqu1M6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5938,8 +4853,6 @@
     },
     "node_modules/@inquirer/type": {
       "version": "3.0.10",
-      "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
-      "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5956,8 +4869,6 @@
     },
     "node_modules/@isaacs/cliui": {
       "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-9.0.0.tgz",
-      "integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -5966,8 +4877,6 @@
     },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
-      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -5979,8 +4888,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
-      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -5996,8 +4903,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6006,8 +4911,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/camelcase": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6016,8 +4919,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/find-up": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6030,8 +4931,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
       "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6044,8 +4943,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/locate-path": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6057,8 +4954,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/p-limit": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6073,8 +4968,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/p-locate": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6086,8 +4979,6 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/resolve-from": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6096,8 +4987,6 @@
     },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
-      "integrity": "sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6106,8 +4995,6 @@
     },
     "node_modules/@jest/console": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-29.7.0.tgz",
-      "integrity": "sha512-5Ni4CU7XHQi32IJ398EEP4RrB8eV09sXP2ROqD4bksHrnTree52PsxvX8tpL8LvTZ3pFzXyPbNQReSN41CAhOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6124,8 +5011,6 @@
     },
     "node_modules/@jest/console/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6141,8 +5026,6 @@
     },
     "node_modules/@jest/console/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6151,8 +5034,6 @@
     },
     "node_modules/@jest/core": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-29.7.0.tgz",
-      "integrity": "sha512-n7aeXWKMnGtDA48y8TLWJPJmLmmZ642Ceo78cYWEpiD7FzDgmNDV/GCVRorPABdXLJZ/9wzzgZAlHjXjxDHGsg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6199,8 +5080,6 @@
     },
     "node_modules/@jest/core/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6216,8 +5095,6 @@
     },
     "node_modules/@jest/core/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6226,8 +5103,6 @@
     },
     "node_modules/@jest/environment": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-29.7.0.tgz",
-      "integrity": "sha512-aQIfHDq33ExsN4jP1NWGXhxgQ/wixs60gDiKO+XVMd8Mn0NWPWgc34ZQDTb2jKaUWQ7MuwoitXAsN2XVXNMpAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6242,8 +5117,6 @@
     },
     "node_modules/@jest/expect": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-29.7.0.tgz",
-      "integrity": "sha512-8uMeAMycttpva3P1lBHB8VciS9V0XAr3GymPpipdyQXbBcuhkLQOSe8E/p92RyAdToS6ZD1tFkX+CkhoECE0dQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6256,8 +5129,6 @@
     },
     "node_modules/@jest/expect-utils": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-29.7.0.tgz",
-      "integrity": "sha512-GlsNBWiFQFCVi9QVSx7f5AgMeLxe9YCCs5PuP2O2LdjDAA8Jh9eX7lA1Jq/xdXw3Wb3hyvlFNfZIfcRetSzYcA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6269,8 +5140,6 @@
     },
     "node_modules/@jest/fake-timers": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-29.7.0.tgz",
-      "integrity": "sha512-q4DH1Ha4TTFPdxLsqDXK1d3+ioSL7yL5oCMJZgDYm6i+6CygW5E5xVr/D1HdsGxjt1ZWSfUAs9OxSB/BNelWrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6287,8 +5156,6 @@
     },
     "node_modules/@jest/globals": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-29.7.0.tgz",
-      "integrity": "sha512-mpiz3dutLbkW2MNFubUGUEVLkTGiqW6yLVTA+JbP6fI6J5iL9Y0Nlg8k95pcF8ctKwCS7WVxteBs29hhfAotzQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6303,8 +5170,6 @@
     },
     "node_modules/@jest/reporters": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-29.7.0.tgz",
-      "integrity": "sha512-DApq0KJbJOEzAFYjHADNNxAE3KbhxQB1y5Kplb5Waqw6zVbuWatSnMjE5gs8FUgEPmNsnZA3NCWl9NG0ia04Pg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6347,8 +5212,6 @@
     },
     "node_modules/@jest/reporters/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6358,8 +5221,6 @@
     },
     "node_modules/@jest/reporters/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6375,9 +5236,6 @@
     },
     "node_modules/@jest/reporters/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -6397,8 +5255,6 @@
     },
     "node_modules/@jest/reporters/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -6410,8 +5266,6 @@
     },
     "node_modules/@jest/reporters/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6420,8 +5274,6 @@
     },
     "node_modules/@jest/schemas": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz",
-      "integrity": "sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6433,8 +5285,6 @@
     },
     "node_modules/@jest/source-map": {
       "version": "28.1.2",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-28.1.2.tgz",
-      "integrity": "sha512-cV8Lx3BeStJb8ipPHnqVw/IM2VCMWO3crWZzYodSIkxXnRcXJipCdx1JCK0K5MsJJouZQTH73mzf4vgxRaH9ww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6448,8 +5298,6 @@
     },
     "node_modules/@jest/test-result": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-29.7.0.tgz",
-      "integrity": "sha512-Fdx+tv6x1zlkJPcWXmMDAG2HBnaR9XPSd5aDWQVsfrZmLVT3lU1cwyxLgRmXR9yrq4NBoEm9BMsfgFzTQAbJYA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6464,8 +5312,6 @@
     },
     "node_modules/@jest/test-sequencer": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-29.7.0.tgz",
-      "integrity": "sha512-GQwJ5WZVrKnOJuiYiAF52UNUJXgTZx1NHjFSEB0qEMmSZKAkdMoIzw/Cj6x6NF4AvV23AUqDpFzQkN/eYCYTxw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6480,8 +5326,6 @@
     },
     "node_modules/@jest/test-sequencer/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6490,8 +5334,6 @@
     },
     "node_modules/@jest/transform": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-29.7.0.tgz",
-      "integrity": "sha512-ok/BTPFzFKVMwO5eOHRrvnBVHdRy9IrsrW1GpMaQ9MCnilNLXQKmAX8s1YXDFaai9xJpac2ySzV0YeRRECr2Vw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6517,8 +5359,6 @@
     },
     "node_modules/@jest/transform/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6534,15 +5374,11 @@
     },
     "node_modules/@jest/transform/node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@jest/transform/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6551,8 +5387,6 @@
     },
     "node_modules/@jest/types": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-29.6.3.tgz",
-      "integrity": "sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6569,8 +5403,6 @@
     },
     "node_modules/@jest/types/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6586,8 +5418,6 @@
     },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.5.0",
@@ -6596,8 +5426,6 @@
     },
     "node_modules/@jridgewell/resolve-uri": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.0.0"
@@ -6605,8 +5433,6 @@
     },
     "node_modules/@jridgewell/source-map": {
       "version": "0.3.11",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz",
-      "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6616,14 +5442,10 @@
     },
     "node_modules/@jridgewell/sourcemap-codec": {
       "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/resolve-uri": "^3.1.0",
@@ -6632,8 +5454,6 @@
     },
     "node_modules/@jsonjoy.com/base64": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-q6XAnWQDIMA3+FTiOYajoYqySkO+JSat0ytXGSuRdq9uXE7o92gzuQwQM14xaCRlBLGq3v5miDGC4vkVTn54xA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6649,8 +5469,6 @@
     },
     "node_modules/@jsonjoy.com/buffers": {
       "version": "17.67.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/buffers/-/buffers-17.67.0.tgz",
-      "integrity": "sha512-tfExRpYxBvi32vPs9ZHaTjSP4fHAfzSmcahOfNxtvGHcyJel+aibkPlGeBB+7AoC6hL7lXIE++8okecBxx7lcw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6666,8 +5484,6 @@
     },
     "node_modules/@jsonjoy.com/codegen": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/codegen/-/codegen-1.0.0.tgz",
-      "integrity": "sha512-E8Oy+08cmCf0EK/NMxpaJZmOxPqM+6iSe2S4nlSBrPZOORoDJILxtbSUEDKQyTamm/BVAhIGllOBNU79/dwf0g==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6683,8 +5499,6 @@
     },
     "node_modules/@jsonjoy.com/fs-core": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-core/-/fs-core-4.57.8.tgz",
-      "integrity": "sha512-YzVbwggV9452VCeHgo0bjsTaUt1O7JE0XpEsPar93nn/+RAwXk0mb1Y+f5EDJ3TRtRCFe+Ck5RuojdfB4jeHVw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6705,8 +5519,6 @@
     },
     "node_modules/@jsonjoy.com/fs-fsa": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-fsa/-/fs-fsa-4.57.8.tgz",
-      "integrity": "sha512-vmClyvCQMxgqz7uamDiGtRfp4MjzOznk3pcQjCxlIwJcw7TWeyr+bF30hI0x8NxdtNOGMg1pHM74VDIXOeyjuw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6728,8 +5540,6 @@
     },
     "node_modules/@jsonjoy.com/fs-node": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node/-/fs-node-4.57.8.tgz",
-      "integrity": "sha512-IPEOlDYSnTDYpjQlQg2F8h+eqxKQN3sdbroI0WrteRiQZ462HzVpBo9ZZX485njz4nAacoe3fd4iDiIhk+k5Hg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6754,8 +5564,6 @@
     },
     "node_modules/@jsonjoy.com/fs-node-builtins": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-builtins/-/fs-node-builtins-4.57.8.tgz",
-      "integrity": "sha512-mxXSXw8zZwRVakcjLqR2I/psy4gURFSASZS10kKJ2kJw05GC2nXGroGrWVHxwgkxXgQLsFQnB74QaLzsxzdL/w==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6771,8 +5579,6 @@
     },
     "node_modules/@jsonjoy.com/fs-node-to-fsa": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-to-fsa/-/fs-node-to-fsa-4.57.8.tgz",
-      "integrity": "sha512-AWZcT/4+H+iDl4XCukbXrarvwEgOrf/prFI5/7eg4ix9FxqVsZysIDJd1Kjd+AjlCeHKHJOaRqjLd5HiGSCJEw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6793,8 +5599,6 @@
     },
     "node_modules/@jsonjoy.com/fs-node-utils": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-node-utils/-/fs-node-utils-4.57.8.tgz",
-      "integrity": "sha512-E/bJ7sQAb4pu9nbeJhbULU3WnqWrswte4N9Js/oHt7aHB746S8/XBqKlcbrqIgnD3095XluovNEZuu5ONT230g==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6813,8 +5617,6 @@
     },
     "node_modules/@jsonjoy.com/fs-print": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-print/-/fs-print-4.57.8.tgz",
-      "integrity": "sha512-DfzhOBpmvNu5P/KSe4NNQaOnvNliTdcf0qrh/4EReErF/XUQXYkd0vZl/OiJCm/qjEEo8DWRstliw2/JNS84dA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6834,8 +5636,6 @@
     },
     "node_modules/@jsonjoy.com/fs-snapshot": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/fs-snapshot/-/fs-snapshot-4.57.8.tgz",
-      "integrity": "sha512-L+eqKaWOHLDaiMv1dh/EWQ4hA+o6xAhWSumTo3Teg7OM18jU/KE13/e8Mfal+eAZ/pSl4wIhKHcDiwapJzC8Wg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6857,8 +5657,6 @@
     },
     "node_modules/@jsonjoy.com/fs-snapshot/node_modules/@jsonjoy.com/base64": {
       "version": "17.67.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/base64/-/base64-17.67.0.tgz",
-      "integrity": "sha512-5SEsJGsm15aP8TQGkDfJvz9axgPwAEm98S5DxOuYe8e1EbfajcDmgeXXzccEjh+mLnjqEKrkBdjHWS5vFNwDdw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6874,8 +5672,6 @@
     },
     "node_modules/@jsonjoy.com/fs-snapshot/node_modules/@jsonjoy.com/codegen": {
       "version": "17.67.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/codegen/-/codegen-17.67.0.tgz",
-      "integrity": "sha512-idnkUplROpdBOV0HMcwhsCUS5TRUi9poagdGs70A6S4ux9+/aPuKbh8+UYRTLYQHtXvAdNfQWXDqZEx5k4Dj2Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6891,8 +5687,6 @@
     },
     "node_modules/@jsonjoy.com/fs-snapshot/node_modules/@jsonjoy.com/json-pack": {
       "version": "17.67.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/json-pack/-/json-pack-17.67.0.tgz",
-      "integrity": "sha512-t0ejURcGaZsn1ClbJ/3kFqSOjlryd92eQY465IYrezsXmPcfHPE/av4twRSxf6WE+TkZgLY+71vCZbiIiFKA/w==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6918,8 +5712,6 @@
     },
     "node_modules/@jsonjoy.com/fs-snapshot/node_modules/@jsonjoy.com/json-pointer": {
       "version": "17.67.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/json-pointer/-/json-pointer-17.67.0.tgz",
-      "integrity": "sha512-+iqOFInH+QZGmSuaybBUNdh7yvNrXvqR+h3wjXm0N/3JK1EyyFAeGJvqnmQL61d1ARLlk/wJdFKSL+LHJ1eaUA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6938,8 +5730,6 @@
     },
     "node_modules/@jsonjoy.com/fs-snapshot/node_modules/@jsonjoy.com/util": {
       "version": "17.67.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/util/-/util-17.67.0.tgz",
-      "integrity": "sha512-6+8xBaz1rLSohlGh68D1pdw3AwDi9xydm8QNlAFkvnavCJYSze+pxoW2VKP8p308jtlMRLs5NTHfPlZLd4w7ew==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6959,8 +5749,6 @@
     },
     "node_modules/@jsonjoy.com/json-pack": {
       "version": "1.21.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/json-pack/-/json-pack-1.21.0.tgz",
-      "integrity": "sha512-+AKG+R2cfZMShzrF2uQw34v3zbeDYUqnQ+jg7ORic3BGtfw9p/+N6RJbq/kkV8JmYZaINknaEQ2m0/f693ZPpg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6986,8 +5774,6 @@
     },
     "node_modules/@jsonjoy.com/json-pack/node_modules/@jsonjoy.com/buffers": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/buffers/-/buffers-1.2.1.tgz",
-      "integrity": "sha512-12cdlDwX4RUM3QxmUbVJWqZ/mrK6dFQH4Zxq6+r1YXKXYBNgZXndx2qbCJwh3+WWkCSn67IjnlG3XYTvmvYtgA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -7003,8 +5789,6 @@
     },
     "node_modules/@jsonjoy.com/json-pointer": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/json-pointer/-/json-pointer-1.0.2.tgz",
-      "integrity": "sha512-Fsn6wM2zlDzY1U+v4Nc8bo3bVqgfNTGcn6dMgs6FjrEnt4ZCe60o6ByKRjOGlI2gow0aE/Q41QOigdTqkyK5fg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7024,8 +5808,6 @@
     },
     "node_modules/@jsonjoy.com/util": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/util/-/util-1.9.0.tgz",
-      "integrity": "sha512-pLuQo+VPRnN8hfPqUTLTHk126wuYdXVxE6aDmjSeV4NCAgyxWbiOIeNJVtID3h1Vzpoi9m4jXezf73I6LgabgQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7045,8 +5827,6 @@
     },
     "node_modules/@jsonjoy.com/util/node_modules/@jsonjoy.com/buffers": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@jsonjoy.com/buffers/-/buffers-1.2.1.tgz",
-      "integrity": "sha512-12cdlDwX4RUM3QxmUbVJWqZ/mrK6dFQH4Zxq6+r1YXKXYBNgZXndx2qbCJwh3+WWkCSn67IjnlG3XYTvmvYtgA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -7062,15 +5842,11 @@
     },
     "node_modules/@juggle/resize-observer": {
       "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/@juggle/resize-observer/-/resize-observer-3.4.0.tgz",
-      "integrity": "sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/@keyv/bigmap": {
       "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
-      "integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7086,28 +5862,20 @@
     },
     "node_modules/@keyv/serialize": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.1.1.tgz",
-      "integrity": "sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@kurkle/color": {
       "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
-      "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
       "license": "MIT"
     },
     "node_modules/@leichtgewicht/ip-codec": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@leichtgewicht/ip-codec/-/ip-codec-2.0.5.tgz",
-      "integrity": "sha512-Vo+PSpZG2/fmgmiNzYK9qWRh8h/CHrwD0mo1h1DzL4yzHNSfWYujGTYsWGreD000gcgmZ7K4Ys6Tx9TxtsKdDw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@listr2/prompt-adapter-inquirer": {
       "version": "2.0.18",
-      "resolved": "https://registry.npmjs.org/@listr2/prompt-adapter-inquirer/-/prompt-adapter-inquirer-2.0.18.tgz",
-      "integrity": "sha512-0hz44rAcrphyXcA8IS7EJ2SCoaBZD2u5goE8S/e+q/DL+dOGpqpcLidVOFeLG3VgML62SXmfRLAhWt0zL1oW4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7122,8 +5890,6 @@
     },
     "node_modules/@listr2/prompt-adapter-inquirer/node_modules/@inquirer/type": {
       "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-1.5.5.tgz",
-      "integrity": "sha512-MzICLu4yS7V8AA61sANROZ9vT1H3ooca5dSmI1FjZkzq7o/koMsRfQSzRtFo+F3Ao4Sf1C0bpLKejpKB/+j6MA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7135,74 +5901,14 @@
     },
     "node_modules/@listr2/prompt-adapter-inquirer/node_modules/mute-stream": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-1.0.0.tgz",
-      "integrity": "sha512-avsJQhyd+680gKXyG/sQc0nXaC6rBkPOfyHYcFb9+hdkqQkR9bdnkJ0AMZhke0oesPqIO+mFFJ+IdBc7mst4IA==",
       "dev": true,
       "license": "ISC",
       "engines": {
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
-    "node_modules/@lmdb/lmdb-darwin-arm64": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@lmdb/lmdb-darwin-arm64/-/lmdb-darwin-arm64-3.2.6.tgz",
-      "integrity": "sha512-yF/ih9EJJZc72psFQbwnn8mExIWfTnzWJg+N02hnpXtDPETYLmQswIMBn7+V88lfCaFrMozJsUvcEQIkEPU0Gg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@lmdb/lmdb-darwin-x64": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@lmdb/lmdb-darwin-x64/-/lmdb-darwin-x64-3.2.6.tgz",
-      "integrity": "sha512-5BbCumsFLbCi586Bb1lTWQFkekdQUw8/t8cy++Uq251cl3hbDIGEwD9HAwh8H6IS2F6QA9KdKmO136LmipRNkg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@lmdb/lmdb-linux-arm": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@lmdb/lmdb-linux-arm/-/lmdb-linux-arm-3.2.6.tgz",
-      "integrity": "sha512-+6XgLpMb7HBoWxXj+bLbiiB4s0mRRcDPElnRS3LpWRzdYSe+gFk5MT/4RrVNqd2MESUDmb53NUXw1+BP69bjiQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@lmdb/lmdb-linux-arm64": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@lmdb/lmdb-linux-arm64/-/lmdb-linux-arm64-3.2.6.tgz",
-      "integrity": "sha512-l5VmJamJ3nyMmeD1ANBQCQqy7do1ESaJQfKPSm2IG9/ADZryptTyCj8N6QaYgIWewqNUrcbdMkJajRQAt5Qjfg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
     "node_modules/@lmdb/lmdb-linux-x64": {
       "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@lmdb/lmdb-linux-x64/-/lmdb-linux-x64-3.2.6.tgz",
-      "integrity": "sha512-nDYT8qN9si5+onHYYaI4DiauDMx24OAiuZAUsEqrDy+ja/3EbpXPX/VAkMV8AEaQhy3xc4dRC+KcYIvOFefJ4Q==",
       "cpu": [
         "x64"
       ],
@@ -7213,80 +5919,8 @@
         "linux"
       ]
     },
-    "node_modules/@lmdb/lmdb-win32-x64": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@lmdb/lmdb-win32-x64/-/lmdb-win32-x64-3.2.6.tgz",
-      "integrity": "sha512-XlqVtILonQnG+9fH2N3Aytria7P/1fwDgDhl29rde96uH2sLB8CHORIf2PfuLVzFQJ7Uqp8py9AYwr3ZUCFfWg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.4.tgz",
-      "integrity": "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.4.tgz",
-      "integrity": "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.4.tgz",
-      "integrity": "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.4.tgz",
-      "integrity": "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.4.tgz",
-      "integrity": "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ==",
       "cpu": [
         "x64"
       ],
@@ -7297,24 +5931,8 @@
         "linux"
       ]
     },
-    "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.4.tgz",
-      "integrity": "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
     "node_modules/@napi-rs/nice": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice/-/nice-1.1.1.tgz",
-      "integrity": "sha512-xJIPs+bYuc9ASBl+cvGsKbGrJmS6fAKaSZCnT0lhahT5rhA2VVy9/EcIgd2JhtEuFOJNx7UHNn/qiTPTY4nrQw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -7345,197 +5963,8 @@
         "@napi-rs/nice-win32-x64-msvc": "1.1.1"
       }
     },
-    "node_modules/@napi-rs/nice-android-arm-eabi": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-android-arm-eabi/-/nice-android-arm-eabi-1.1.1.tgz",
-      "integrity": "sha512-kjirL3N6TnRPv5iuHw36wnucNqXAO46dzK9oPb0wj076R5Xm8PfUVA9nAFB5ZNMmfJQJVKACAPd/Z2KYMppthw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-android-arm64": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-android-arm64/-/nice-android-arm64-1.1.1.tgz",
-      "integrity": "sha512-blG0i7dXgbInN5urONoUCNf+DUEAavRffrO7fZSeoRMJc5qD+BJeNcpr54msPF6qfDD6kzs9AQJogZvT2KD5nw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-darwin-arm64": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-darwin-arm64/-/nice-darwin-arm64-1.1.1.tgz",
-      "integrity": "sha512-s/E7w45NaLqTGuOjC2p96pct4jRfo61xb9bU1unM/MJ/RFkKlJyJDx7OJI/O0ll/hrfpqKopuAFDV8yo0hfT7A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-darwin-x64": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-darwin-x64/-/nice-darwin-x64-1.1.1.tgz",
-      "integrity": "sha512-dGoEBnVpsdcC+oHHmW1LRK5eiyzLwdgNQq3BmZIav+9/5WTZwBYX7r5ZkQC07Nxd3KHOCkgbHSh4wPkH1N1LiQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-freebsd-x64": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-freebsd-x64/-/nice-freebsd-x64-1.1.1.tgz",
-      "integrity": "sha512-kHv4kEHAylMYmlNwcQcDtXjklYp4FCf0b05E+0h6nDHsZ+F0bDe04U/tXNOqrx5CmIAth4vwfkjjUmp4c4JktQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-linux-arm-gnueabihf": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-arm-gnueabihf/-/nice-linux-arm-gnueabihf-1.1.1.tgz",
-      "integrity": "sha512-E1t7K0efyKXZDoZg1LzCOLxgolxV58HCkaEkEvIYQx12ht2pa8hoBo+4OB3qh7e+QiBlp1SRf+voWUZFxyhyqg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-linux-arm64-gnu": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-arm64-gnu/-/nice-linux-arm64-gnu-1.1.1.tgz",
-      "integrity": "sha512-CIKLA12DTIZlmTaaKhQP88R3Xao+gyJxNWEn04wZwC2wmRapNnxCUZkVwggInMJvtVElA+D4ZzOU5sX4jV+SmQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-linux-arm64-musl": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-arm64-musl/-/nice-linux-arm64-musl-1.1.1.tgz",
-      "integrity": "sha512-+2Rzdb3nTIYZ0YJF43qf2twhqOCkiSrHx2Pg6DJaCPYhhaxbLcdlV8hCRMHghQ+EtZQWGNcS2xF4KxBhSGeutg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-linux-ppc64-gnu": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-ppc64-gnu/-/nice-linux-ppc64-gnu-1.1.1.tgz",
-      "integrity": "sha512-4FS8oc0GeHpwvv4tKciKkw3Y4jKsL7FRhaOeiPei0X9T4Jd619wHNe4xCLmN2EMgZoeGg+Q7GY7BsvwKpL22Tg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-linux-riscv64-gnu": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-riscv64-gnu/-/nice-linux-riscv64-gnu-1.1.1.tgz",
-      "integrity": "sha512-HU0nw9uD4FO/oGCCk409tCi5IzIZpH2agE6nN4fqpwVlCn5BOq0MS1dXGjXaG17JaAvrlpV5ZeyZwSon10XOXw==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-linux-s390x-gnu": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-s390x-gnu/-/nice-linux-s390x-gnu-1.1.1.tgz",
-      "integrity": "sha512-2YqKJWWl24EwrX0DzCQgPLKQBxYDdBxOHot1KWEq7aY2uYeX+Uvtv4I8xFVVygJDgf6/92h9N3Y43WPx8+PAgQ==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/@napi-rs/nice-linux-x64-gnu": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-x64-gnu/-/nice-linux-x64-gnu-1.1.1.tgz",
-      "integrity": "sha512-/gaNz3R92t+dcrfCw/96pDopcmec7oCcAQ3l/M+Zxr82KT4DljD37CpgrnXV+pJC263JkW572pdbP3hP+KjcIg==",
       "cpu": [
         "x64"
       ],
@@ -7551,8 +5980,6 @@
     },
     "node_modules/@napi-rs/nice-linux-x64-musl": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-linux-x64-musl/-/nice-linux-x64-musl-1.1.1.tgz",
-      "integrity": "sha512-xScCGnyj/oppsNPMnevsBe3pvNaoK7FGvMjT35riz9YdhB2WtTG47ZlbxtOLpjeO9SqqQ2J2igCmz6IJOD5JYw==",
       "cpu": [
         "x64"
       ],
@@ -7566,78 +5993,8 @@
         "node": ">= 10"
       }
     },
-    "node_modules/@napi-rs/nice-openharmony-arm64": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-openharmony-arm64/-/nice-openharmony-arm64-1.1.1.tgz",
-      "integrity": "sha512-6uJPRVwVCLDeoOaNyeiW0gp2kFIM4r7PL2MczdZQHkFi9gVlgm+Vn+V6nTWRcu856mJ2WjYJiumEajfSm7arPQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-win32-arm64-msvc": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-win32-arm64-msvc/-/nice-win32-arm64-msvc-1.1.1.tgz",
-      "integrity": "sha512-uoTb4eAvM5B2aj/z8j+Nv8OttPf2m+HVx3UjA5jcFxASvNhQriyCQF1OB1lHL43ZhW+VwZlgvjmP5qF3+59atA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-win32-ia32-msvc": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-win32-ia32-msvc/-/nice-win32-ia32-msvc-1.1.1.tgz",
-      "integrity": "sha512-CNQqlQT9MwuCsg1Vd/oKXiuH+TcsSPJmlAFc5frFyX/KkOh0UpBLEj7aoY656d5UKZQMQFP7vJNa1DNUNORvug==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@napi-rs/nice-win32-x64-msvc": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/nice-win32-x64-msvc/-/nice-win32-x64-msvc-1.1.1.tgz",
-      "integrity": "sha512-vB+4G/jBQCAh0jelMTY3+kgFy00Hlx2f2/1zjMoH821IbplbWZOkLiTYXQkygNTzQJTq5cvwBDgn2ppHD+bglQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/@ng-bootstrap/ng-bootstrap": {
       "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/@ng-bootstrap/ng-bootstrap/-/ng-bootstrap-17.0.1.tgz",
-      "integrity": "sha512-utbm8OXIoqVVYGVzQkOS773ymbjc+UMkXv8lyi7hTqLhCQs0rZ0yA74peqVZRuOGXLHgcSTA7fnJhA80iQOblw==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -7653,8 +6010,6 @@
     },
     "node_modules/@ngtools/webpack": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-19.2.27.tgz",
-      "integrity": "sha512-nuKxH4WaRILjlje4143T8XeDWVi5AIDlCMu/SPSKsYtyGxX7AC3sEu0UatFG7rrJkS/SB+fZngtuydoprhvYkQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7670,8 +6025,6 @@
     },
     "node_modules/@ngx-formly/bootstrap": {
       "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/@ngx-formly/bootstrap/-/bootstrap-6.1.1.tgz",
-      "integrity": "sha512-yNzASqUrzvhMndERzoTBCvj1rtsgsmMXiXsqIP7PRJ4AdGtsTZvpxNYZAltdKEgJvc1hS/lDMJdS7IHg2qFN9Q==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.0.0"
@@ -7683,8 +6036,6 @@
     },
     "node_modules/@ngx-formly/core": {
       "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/@ngx-formly/core/-/core-6.1.1.tgz",
-      "integrity": "sha512-6Fg9TBcXXrnUkHqVlpCQbVE5BWJQBvCitQRngW7kiA/+86rhH5mkL19enULWKq7fEMi54uCVvWsz7l6VOaJhLA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.0.0"
@@ -7696,8 +6047,6 @@
     },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
-      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.stat": "2.0.5",
@@ -7709,8 +6058,6 @@
     },
     "node_modules/@nodelib/fs.stat": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
-      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
       "license": "MIT",
       "engines": {
         "node": ">= 8"
@@ -7718,8 +6065,6 @@
     },
     "node_modules/@nodelib/fs.walk": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
-      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.scandir": "2.1.5",
@@ -7731,8 +6076,6 @@
     },
     "node_modules/@npmcli/agent": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
-      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7748,8 +6091,6 @@
     },
     "node_modules/@npmcli/agent/node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7758,8 +6099,6 @@
     },
     "node_modules/@npmcli/agent/node_modules/http-proxy-agent": {
       "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7772,15 +6111,11 @@
     },
     "node_modules/@npmcli/agent/node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/@npmcli/fs": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
-      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7792,8 +6127,6 @@
     },
     "node_modules/@npmcli/git": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-6.0.3.tgz",
-      "integrity": "sha512-GUYESQlxZRAdhs3UhbB6pVRNUELQOHXwK9ruDkwmCv2aZ5y0SApQzUJCg02p3A7Ue2J5hxvlk1YI53c00NmRyQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7812,8 +6145,6 @@
     },
     "node_modules/@npmcli/git/node_modules/isexe": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
-      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -7822,15 +6153,11 @@
     },
     "node_modules/@npmcli/git/node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/@npmcli/git/node_modules/which": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
-      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7845,8 +6172,6 @@
     },
     "node_modules/@npmcli/installed-package-contents": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/installed-package-contents/-/installed-package-contents-3.0.0.tgz",
-      "integrity": "sha512-fkxoPuFGvxyrH+OQzyTkX2LUEamrF4jZSmxjAtPPHHGO0dqsQ8tTKjnIS8SAnPHdk2I03BDtSMR5K/4loKg79Q==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7862,8 +6187,6 @@
     },
     "node_modules/@npmcli/node-gyp": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/node-gyp/-/node-gyp-4.0.0.tgz",
-      "integrity": "sha512-+t5DZ6mO/QFh78PByMq1fGSAub/agLJZDRfJRMeOSNCt8s9YVlTjmGpIPwPhvXTGUIJk+WszlT0rQa1W33yzNA==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -7872,8 +6195,6 @@
     },
     "node_modules/@npmcli/package-json": {
       "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/package-json/-/package-json-6.2.0.tgz",
-      "integrity": "sha512-rCNLSB/JzNvot0SEyXqWZ7tX2B5dD2a1br2Dp0vSYVo5jh8Z0EZ7lS9TsZ1UtziddB1UfNUaMCc538/HztnJGA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7891,8 +6212,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/@isaacs/cliui": {
       "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7909,8 +6228,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7922,8 +6239,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7935,16 +6250,11 @@
     },
     "node_modules/@npmcli/package-json/node_modules/emoji-regex": {
       "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@npmcli/package-json/node_modules/glob": {
       "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7964,8 +6274,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/jackspeak": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -7980,15 +6288,11 @@
     },
     "node_modules/@npmcli/package-json/node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/@npmcli/package-json/node_modules/path-scurry": {
       "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -8004,8 +6308,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/string-width": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8022,8 +6324,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8038,8 +6338,6 @@
     },
     "node_modules/@npmcli/package-json/node_modules/wrap-ansi": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8056,8 +6354,6 @@
     },
     "node_modules/@npmcli/promise-spawn": {
       "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-8.0.3.tgz",
-      "integrity": "sha512-Yb00SWaL4F8w+K8YGhQ55+xE4RUNdMHV43WZGsiTM92gS+lC0mGsn7I4hLug7pbao035S6bj3Y3w0cUNGLfmkg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8069,8 +6365,6 @@
     },
     "node_modules/@npmcli/promise-spawn/node_modules/isexe": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
-      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -8079,8 +6373,6 @@
     },
     "node_modules/@npmcli/promise-spawn/node_modules/which": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
-      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8095,8 +6387,6 @@
     },
     "node_modules/@npmcli/redact": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/redact/-/redact-3.2.2.tgz",
-      "integrity": "sha512-7VmYAmk4csGv08QzrDKScdzn11jHPFGyqJW39FyPgPuAp3zIaUmuCo1yxw9aGs+NEJuTGQ9Gwqpt93vtJubucg==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -8105,8 +6395,6 @@
     },
     "node_modules/@npmcli/run-script": {
       "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-9.1.0.tgz",
-      "integrity": "sha512-aoNSbxtkePXUlbZB+anS1LqsJdctG5n3UVhfU47+CDdwMi6uNTBMF9gPcQRnqghQd2FGzcwwIFBruFMxjhBewg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8123,8 +6411,6 @@
     },
     "node_modules/@npmcli/run-script/node_modules/isexe": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
-      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -8133,8 +6419,6 @@
     },
     "node_modules/@npmcli/run-script/node_modules/which": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
-      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8149,8 +6433,6 @@
     },
     "node_modules/@parcel/watcher": {
       "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.6.tgz",
-      "integrity": "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -8184,178 +6466,8 @@
         "@parcel/watcher-win32-x64": "2.5.6"
       }
     },
-    "node_modules/@parcel/watcher-android-arm64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.6.tgz",
-      "integrity": "sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-darwin-arm64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.6.tgz",
-      "integrity": "sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-darwin-x64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.6.tgz",
-      "integrity": "sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-freebsd-x64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.6.tgz",
-      "integrity": "sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-linux-arm-glibc": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.5.6.tgz",
-      "integrity": "sha512-9JiYfB6h6BgV50CCfasfLf/uvOcJskMSwcdH1PHH9rvS1IrNy8zad6IUVPVUfmXr+u+Km9IxcfMLzgdOudz9EQ==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-linux-arm-musl": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.5.6.tgz",
-      "integrity": "sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-linux-arm64-glibc": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.5.6.tgz",
-      "integrity": "sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-linux-arm64-musl": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.5.6.tgz",
-      "integrity": "sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
     "node_modules/@parcel/watcher-linux-x64-glibc": {
       "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.5.6.tgz",
-      "integrity": "sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ==",
       "cpu": [
         "x64"
       ],
@@ -8375,8 +6487,6 @@
     },
     "node_modules/@parcel/watcher-linux-x64-musl": {
       "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.6.tgz",
-      "integrity": "sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg==",
       "cpu": [
         "x64"
       ],
@@ -8394,81 +6504,14 @@
         "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/@parcel/watcher-win32-arm64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.5.6.tgz",
-      "integrity": "sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-win32-ia32": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-ia32/-/watcher-win32-ia32-2.5.6.tgz",
-      "integrity": "sha512-k35yLp1ZMwwee3Ez/pxBi5cf4AoBKYXj00CZ80jUz5h8prpiaQsiRPKQMxoLstNuqe2vR4RNPEAEcjEFzhEz/g==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/@parcel/watcher-win32-x64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.5.6.tgz",
-      "integrity": "sha512-hbQlYcCq5dlAX9Qx+kFb0FHue6vbjlf0FrNzSKdYK2APUf7tGfGxQCk2ihEREmbR6ZMc0MVAD5RIX/41gpUzTw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
     "node_modules/@parcel/watcher/node_modules/node-addon-api": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
-      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/@parcel/watcher/node_modules/picomatch": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8481,15 +6524,11 @@
     },
     "node_modules/@pinojs/redact": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
-      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8499,8 +6538,6 @@
     },
     "node_modules/@popperjs/core": {
       "version": "2.11.8",
-      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz",
-      "integrity": "sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -8509,36 +6546,26 @@
     },
     "node_modules/@protobufjs/aspromise": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/base64": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/codegen": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/eventemitter": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
-      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/fetch": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
-      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -8547,281 +6574,31 @@
     },
     "node_modules/@protobufjs/float": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/inquire": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.2.tgz",
-      "integrity": "sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/path": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/pool": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/utf8": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
-      "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
-    "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
-      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
-    },
-    "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
-      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
-      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
-      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
-      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
-      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
-      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
-      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
-      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
-      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
-      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
-      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
-      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
-      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
-      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
-      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
-      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
       "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
       "cpu": [
         "x64"
       ],
@@ -8834,8 +6611,6 @@
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
       "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
-      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
       "cpu": [
         "x64"
       ],
@@ -8846,101 +6621,13 @@
         "linux"
       ]
     },
-    "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
-      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
-      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
-      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
-      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
-      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
     "node_modules/@scarf/scarf": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/@scarf/scarf/-/scarf-1.4.0.tgz",
-      "integrity": "sha512-xxeapPiUXdZAE3che6f3xogoJPeZgig6omHEy1rIY5WVsB3H2BHNnZH+gHG6x91SCWyQCzWGsuL2Hh3ClO5/qQ==",
       "hasInstallScript": true,
       "license": "Apache-2.0"
     },
     "node_modules/@schematics/angular": {
       "version": "19.2.27",
-      "resolved": "https://registry.npmjs.org/@schematics/angular/-/angular-19.2.27.tgz",
-      "integrity": "sha512-kJX5nyDjwo6iHQ+g/AJa+4SyHRSQyGgutpqXUIuYY2htGWVS1HUQlHfwAER5btjSNKe/iHgh4pzYGZfvJ2V6/A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8956,8 +6643,6 @@
     },
     "node_modules/@sideway/address": {
       "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
-      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -8966,22 +6651,16 @@
     },
     "node_modules/@sideway/formula": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
-      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@sideway/pinpoint": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
-      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@sigstore/bundle": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-3.1.0.tgz",
-      "integrity": "sha512-Mm1E3/CmDDCz3nDhFKTuYdB47EdRFRQMOE/EAbiG1MJW77/w1b3P7Qx7JSrVJs8PfwOLOVcKQCHErIwCTyPbag==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -8993,8 +6672,6 @@
     },
     "node_modules/@sigstore/core": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-2.0.0.tgz",
-      "integrity": "sha512-nYxaSb/MtlSI+JWcwTHQxyNmWeWrUXJJ/G4liLrGG7+tS4vAz6LF3xRXqLH6wPIVUoZQel2Fs4ddLx4NCpiIYg==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -9003,8 +6680,6 @@
     },
     "node_modules/@sigstore/protobuf-specs": {
       "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.4.3.tgz",
-      "integrity": "sha512-fk2zjD9117RL9BjqEwF7fwv7Q/P9yGsMV4MUJZ/DocaQJ6+3pKr+syBq1owU5Q5qGw5CUbXzm+4yJ2JVRDQeSA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -9013,8 +6688,6 @@
     },
     "node_modules/@sigstore/sign": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-3.1.0.tgz",
-      "integrity": "sha512-knzjmaOHOov1Ur7N/z4B1oPqZ0QX5geUfhrVaqVlu+hl0EAoL4o+l0MSULINcD5GCWe3Z0+YJO8ues6vFlW0Yw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -9031,8 +6704,6 @@
     },
     "node_modules/@sigstore/tuf": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-3.1.1.tgz",
-      "integrity": "sha512-eFFvlcBIoGwVkkwmTi/vEQFSva3xs5Ot3WmBcjgjVdiaoelBLQaQ/ZBfhlG0MnG0cmTYScPpk7eDdGDWUcFUmg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -9045,8 +6716,6 @@
     },
     "node_modules/@sigstore/verify": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-2.1.1.tgz",
-      "integrity": "sha512-hVJD77oT67aowHxwT4+M6PGOp+E2LtLdTK3+FC0lBO9T7sYwItDMXZ7Z07IDCvR1M717a4axbIWckrW67KMP/w==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -9060,15 +6729,11 @@
     },
     "node_modules/@sinclair/typebox": {
       "version": "0.27.10",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.10.tgz",
-      "integrity": "sha512-MTBk/3jGLNB2tVxv6uLlFh1iu64iYOQ2PbdOSK3NW8JZsmlaOh2q6sdtKowBhfw8QFLmYNzTW4/oK4uATIi6ZA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@sindresorhus/is": {
       "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-4.6.0.tgz",
-      "integrity": "sha512-t09vSN3MdfsyCHoFcTRCH/iUtG7OJ0CsjzB8cjAmKc/va/kIgeDI/TxsigdncE/4be734m0cvIYwNaV4i2XqAw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9080,8 +6745,6 @@
     },
     "node_modules/@sindresorhus/merge-streams": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-2.3.0.tgz",
-      "integrity": "sha512-LtoMMhxAlorcGhmFYI+LhPgbPZCkgP6ra1YL604EeF6U98pLlQ3iWIGMdWSC+vWmPBWBNgmDBAhnAobLROJmwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9093,8 +6756,6 @@
     },
     "node_modules/@sinonjs/commons": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-3.0.1.tgz",
-      "integrity": "sha512-K3mCHKQ9sVh8o1C9cxkwxaOmXoAMlDxC1mYyHrjqOWEcBjYr76t96zL2zlj5dUGZ3HSw240X1qgH3Mjf1yJWpQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -9103,8 +6764,6 @@
     },
     "node_modules/@sinonjs/commons/node_modules/type-detect": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9113,8 +6772,6 @@
     },
     "node_modules/@sinonjs/fake-timers": {
       "version": "10.3.0",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-10.3.0.tgz",
-      "integrity": "sha512-V4BG07kuYSUkTCSBHG8G8TNhM+F19jXFWnQtzj+we8DrkpSBCee9Z3Ms8yiGer/dlmhe35/Xdgyo3/0rQKg7YA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -9123,8 +6780,6 @@
     },
     "node_modules/@szmarczak/http-timer": {
       "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/@szmarczak/http-timer/-/http-timer-4.0.6.tgz",
-      "integrity": "sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9136,8 +6791,6 @@
     },
     "node_modules/@thednp/event-listener": {
       "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@thednp/event-listener/-/event-listener-2.0.15.tgz",
-      "integrity": "sha512-X1B+Yuvb30a/0rGdXnTLMfqvzCQ4D/1Kns7B78ON3BoFNFazJyFQ4ypuErY1jQLZSFDN4c3zTAIrdrtuIa/fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9147,8 +6800,6 @@
     },
     "node_modules/@thednp/position-observer": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@thednp/position-observer/-/position-observer-1.1.3.tgz",
-      "integrity": "sha512-5I3rdcZGTd6xJrDG0uRgME6O4jeYHlt2bedXz2yTkkCttYHhDuhtkTh3a2+NzMv2yNPXpXz0HykkeEm3RgQDDw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9161,8 +6812,6 @@
     },
     "node_modules/@thednp/shorty": {
       "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/@thednp/shorty/-/shorty-2.0.14.tgz",
-      "integrity": "sha512-jCxbkyQryQjovIzK5ko683RNq1pZRAKiscJfhtF71yGxneEzFR9IQgzayw/WRjQ5KDD/5UVqTwgtfQ7pJpmIYA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9172,8 +6821,6 @@
     },
     "node_modules/@tootallnate/once": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.1.tgz",
-      "integrity": "sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9182,8 +6829,6 @@
     },
     "node_modules/@ts-morph/common": {
       "version": "0.25.0",
-      "resolved": "https://registry.npmjs.org/@ts-morph/common/-/common-0.25.0.tgz",
-      "integrity": "sha512-kMnZz+vGGHi4GoHnLmMhGNjm44kGtKUXGnOvrKmMwAuvNjM/PgKVGfUnL7IDvK7Jb2QQ82jq3Zmp04Gy+r3Dkg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9194,43 +6839,31 @@
     },
     "node_modules/@ts-morph/common/node_modules/path-browserify": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-1.0.1.tgz",
-      "integrity": "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@tsconfig/node10": {
       "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.12.tgz",
-      "integrity": "sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@tsconfig/node12": {
       "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node12/-/node12-1.0.11.tgz",
-      "integrity": "sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@tsconfig/node14": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node14/-/node14-1.0.3.tgz",
-      "integrity": "sha512-ysT8mhdixWK6Hw3i1V2AeRqZ5WfXg1G43mqoYlM2nc6388Fq5jcXyr5mRsqViLx/GJYdoL0bfXD8nmF+Zn/Iow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@tsconfig/node16": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@tsconfig/node16/-/node16-1.0.4.tgz",
-      "integrity": "sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@tufjs/canonical-json": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@tufjs/canonical-json/-/canonical-json-2.0.0.tgz",
-      "integrity": "sha512-yVtV8zsdo8qFHe+/3kw81dSLyF7D576A5cCFCi4X7B39tWT7SekaEFUnvnWJHz+9qO7qJTah1JbrDjWKqFtdWA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9239,8 +6872,6 @@
     },
     "node_modules/@tufjs/models": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@tufjs/models/-/models-3.0.1.tgz",
-      "integrity": "sha512-UUYHISyhCU3ZgN8yaear3cGATHb3SMuKHsQ/nVbHXcmnBf+LzQ/cQfhNG+rfaSHgqGKNEm2cOCLVLELStUQ1JA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9253,8 +6884,6 @@
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
-      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
-      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.20.7",
@@ -9266,8 +6895,6 @@
     },
     "node_modules/@types/babel__generator": {
       "version": "7.27.0",
-      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
-      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.0.0"
@@ -9275,8 +6902,6 @@
     },
     "node_modules/@types/babel__template": {
       "version": "7.4.4",
-      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
-      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.1.0",
@@ -9285,8 +6910,6 @@
     },
     "node_modules/@types/babel__traverse": {
       "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
-      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.28.2"
@@ -9294,8 +6917,6 @@
     },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
-      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
-      "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9305,8 +6926,6 @@
     },
     "node_modules/@types/bonjour": {
       "version": "3.5.13",
-      "resolved": "https://registry.npmjs.org/@types/bonjour/-/bonjour-3.5.13.tgz",
-      "integrity": "sha512-z9fJ5Im06zvUL548KvYNecEVlA7cVDkGUi6kZusb04mpyEFKCIZJvloCcmpmLaIahDpOQGHaHmG6imtPMmPXGQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9315,15 +6934,11 @@
     },
     "node_modules/@types/brace-expansion": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@types/brace-expansion/-/brace-expansion-1.1.0.tgz",
-      "integrity": "sha512-SaU/Kgp6z40CiF9JxlsrSrBEa+8YIry9IiCPhhYSNekeEhIAkY7iyu9aZ+5dSQIdo7mf86MUVvxWYm5GAzB/0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/cacheable-request": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/@types/cacheable-request/-/cacheable-request-6.0.3.tgz",
-      "integrity": "sha512-IQ3EbTzGxIigb1I3qPZc1rWJnH0BmSKv5QYTalEwweFvyBDLSAe24zP0le/hyi7ecGfZVlIVAg4BZqb8WBwKqw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9335,8 +6950,6 @@
     },
     "node_modules/@types/connect": {
       "version": "3.4.38",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
-      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9345,8 +6958,6 @@
     },
     "node_modules/@types/connect-history-api-fallback": {
       "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@types/connect-history-api-fallback/-/connect-history-api-fallback-1.5.4.tgz",
-      "integrity": "sha512-n6Cr2xS1h4uAulPRdlw6Jl6s1oG8KrVilPN2yUITEs+K48EzMJJ3W1xy8K5eWuFvjp3R74AOIGSmp2UfBJ8HFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9356,15 +6967,11 @@
     },
     "node_modules/@types/cypress": {
       "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/@types/cypress/-/cypress-0.1.6.tgz",
-      "integrity": "sha512-FYKQLvCsRYxZ3fp+XsoCiJZ1aK3x17RmaZjHI4Ou43khFkXPycrQaXo9b1J07PNlEfWnRtUc9loxHXzKjSsbYg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/cypress-axe": {
       "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/@types/cypress-axe/-/cypress-axe-0.8.0.tgz",
-      "integrity": "sha512-4sTqNsXUXnl/CqmSI+xCCmYwml+/zZ66uBExMLqnF1dn3wd+BIyrLL8fJ81O/AJePuh08igR2VjZqWuZaoqWaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9373,8 +6980,6 @@
     },
     "node_modules/@types/cypress-axe/node_modules/axe-core": {
       "version": "3.5.6",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-3.5.6.tgz",
-      "integrity": "sha512-LEUDjgmdJoA3LqklSTwKYqkjcZ4HKc4ddIYGSAiSkr46NTjzg2L9RNB+lekO9P7Dlpa87+hBtzc2Fzn/+GUWMQ==",
       "dev": true,
       "license": "MPL-2.0",
       "engines": {
@@ -9383,15 +6988,11 @@
     },
     "node_modules/@types/cypress-cucumber-preprocessor": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@types/cypress-cucumber-preprocessor/-/cypress-cucumber-preprocessor-4.0.1.tgz",
-      "integrity": "sha512-sK2/uU5CtmJ51zo0JF2Lc4iSw9Fy3xn9ewfewuooV5Qmeb5O+brAHuoXKMV7UWwRbBmd+txhAXAJoi4S5QLDRQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/d3": {
       "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/@types/d3/-/d3-7.4.3.tgz",
-      "integrity": "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-array": "*",
@@ -9428,14 +7029,10 @@
     },
     "node_modules/@types/d3-array": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
-      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
       "license": "MIT"
     },
     "node_modules/@types/d3-axis": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-axis/-/d3-axis-3.0.6.tgz",
-      "integrity": "sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -9443,8 +7040,6 @@
     },
     "node_modules/@types/d3-brush": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-brush/-/d3-brush-3.0.6.tgz",
-      "integrity": "sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -9452,20 +7047,14 @@
     },
     "node_modules/@types/d3-chord": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-chord/-/d3-chord-3.0.6.tgz",
-      "integrity": "sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg==",
       "license": "MIT"
     },
     "node_modules/@types/d3-color": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
-      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
       "license": "MIT"
     },
     "node_modules/@types/d3-contour": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-contour/-/d3-contour-3.0.6.tgz",
-      "integrity": "sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-array": "*",
@@ -9474,20 +7063,14 @@
     },
     "node_modules/@types/d3-delaunay": {
       "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-delaunay/-/d3-delaunay-6.0.4.tgz",
-      "integrity": "sha512-ZMaSKu4THYCU6sV64Lhg6qjf1orxBthaC161plr5KuPHo3CNm8DTHiLw/5Eq2b6TsNP0W0iJrUOFscY6Q450Hw==",
       "license": "MIT"
     },
     "node_modules/@types/d3-dispatch": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-dispatch/-/d3-dispatch-3.0.7.tgz",
-      "integrity": "sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA==",
       "license": "MIT"
     },
     "node_modules/@types/d3-drag": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-drag/-/d3-drag-3.0.7.tgz",
-      "integrity": "sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -9495,20 +7078,14 @@
     },
     "node_modules/@types/d3-dsv": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-dsv/-/d3-dsv-3.0.7.tgz",
-      "integrity": "sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g==",
       "license": "MIT"
     },
     "node_modules/@types/d3-ease": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
-      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
       "license": "MIT"
     },
     "node_modules/@types/d3-fetch": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-fetch/-/d3-fetch-3.0.7.tgz",
-      "integrity": "sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-dsv": "*"
@@ -9516,20 +7093,14 @@
     },
     "node_modules/@types/d3-force": {
       "version": "3.0.10",
-      "resolved": "https://registry.npmjs.org/@types/d3-force/-/d3-force-3.0.10.tgz",
-      "integrity": "sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw==",
       "license": "MIT"
     },
     "node_modules/@types/d3-format": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-3.0.4.tgz",
-      "integrity": "sha512-fALi2aI6shfg7vM5KiR1wNJnZ7r6UuggVqtDA+xiEdPZQwy/trcQaHnwShLuLdta2rTymCNpxYTiMZX/e09F4g==",
       "license": "MIT"
     },
     "node_modules/@types/d3-geo": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-3.1.0.tgz",
-      "integrity": "sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ==",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*"
@@ -9537,14 +7108,10 @@
     },
     "node_modules/@types/d3-hierarchy": {
       "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-hierarchy/-/d3-hierarchy-3.1.7.tgz",
-      "integrity": "sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg==",
       "license": "MIT"
     },
     "node_modules/@types/d3-interpolate": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
-      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-color": "*"
@@ -9552,32 +7119,22 @@
     },
     "node_modules/@types/d3-path": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
-      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
       "license": "MIT"
     },
     "node_modules/@types/d3-polygon": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-polygon/-/d3-polygon-3.0.2.tgz",
-      "integrity": "sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA==",
       "license": "MIT"
     },
     "node_modules/@types/d3-quadtree": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-quadtree/-/d3-quadtree-3.0.6.tgz",
-      "integrity": "sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg==",
       "license": "MIT"
     },
     "node_modules/@types/d3-random": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-3.0.3.tgz",
-      "integrity": "sha512-Imagg1vJ3y76Y2ea0871wpabqp613+8/r0mCLEBfdtqC7xMSfj9idOnmBYyMoULfHePJyxMAw3nWhJxzc+LFwQ==",
       "license": "MIT"
     },
     "node_modules/@types/d3-scale": {
       "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
-      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-time": "*"
@@ -9585,20 +7142,14 @@
     },
     "node_modules/@types/d3-scale-chromatic": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz",
-      "integrity": "sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ==",
       "license": "MIT"
     },
     "node_modules/@types/d3-selection": {
       "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.11.tgz",
-      "integrity": "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==",
       "license": "MIT"
     },
     "node_modules/@types/d3-shape": {
       "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.8.tgz",
-      "integrity": "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-path": "*"
@@ -9606,26 +7157,18 @@
     },
     "node_modules/@types/d3-time": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
-      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
       "license": "MIT"
     },
     "node_modules/@types/d3-time-format": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-4.0.3.tgz",
-      "integrity": "sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg==",
       "license": "MIT"
     },
     "node_modules/@types/d3-timer": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
-      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
       "license": "MIT"
     },
     "node_modules/@types/d3-transition": {
       "version": "3.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-transition/-/d3-transition-3.0.9.tgz",
-      "integrity": "sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -9633,8 +7176,6 @@
     },
     "node_modules/@types/d3-zoom": {
       "version": "3.0.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-zoom/-/d3-zoom-3.0.8.tgz",
-      "integrity": "sha512-iqMC4/YlFCSlO8+2Ii1GGGliCAY4XdeG748w5vQUbevlbDu0zSjH/+jojorQVBK/se0j6DUFNPBGSqD3YWYnDw==",
       "license": "MIT",
       "dependencies": {
         "@types/d3-interpolate": "*",
@@ -9643,8 +7184,6 @@
     },
     "node_modules/@types/eslint": {
       "version": "9.6.1",
-      "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-9.6.1.tgz",
-      "integrity": "sha512-FXx2pKgId/WyYo2jXw63kk7/+TY7u7AziEJxJAnSFzHlqTAS3Ync6SvgYAN/k4/PQpnnVuzoMuVnByKK2qp0ag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9654,8 +7193,6 @@
     },
     "node_modules/@types/eslint-scope": {
       "version": "3.7.7",
-      "resolved": "https://registry.npmjs.org/@types/eslint-scope/-/eslint-scope-3.7.7.tgz",
-      "integrity": "sha512-MzMFlSLBqNF2gcHWO0G1vP/YQyfvrxZ0bF+u7mzUdZ1/xK4A4sru+nraZz5i3iEIk1l1uyicaDVTB4QbbEkAYg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9665,15 +7202,11 @@
     },
     "node_modules/@types/estree": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
-      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/express": {
       "version": "4.17.25",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.25.tgz",
-      "integrity": "sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9685,8 +7218,6 @@
     },
     "node_modules/@types/express-serve-static-core": {
       "version": "4.19.8",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.8.tgz",
-      "integrity": "sha512-02S5fmqeoKzVZCHPZid4b8JH2eM5HzQLZWN2FohQEy/0eXTq8VXZfSN6Pcr3F6N9R/vNrj7cpgbhjie6m/1tCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9698,20 +7229,14 @@
     },
     "node_modules/@types/file-saver": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/file-saver/-/file-saver-2.0.7.tgz",
-      "integrity": "sha512-dNKVfHd/jk0SkR/exKGj2ggkB45MAkzvWCaqLUUgkyjITkGNzH8H+yUwr+BLJUBjZOe9w8X3wgmXhZDRg1ED6A==",
       "license": "MIT"
     },
     "node_modules/@types/geojson": {
       "version": "7946.0.16",
-      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
-      "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
       "license": "MIT"
     },
     "node_modules/@types/glob": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/@types/glob/-/glob-8.1.0.tgz",
-      "integrity": "sha512-IO+MJPVhoqz+28h1qLAcBEH2+xHMK6MTyHJc7MTnnYb6wsoLR29POVGJ7LycmVXIqyy/4/2ShP5sUwTXuOwb/w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9721,15 +7246,11 @@
     },
     "node_modules/@types/glob/node_modules/@types/minimatch": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-5.1.2.tgz",
-      "integrity": "sha512-K0VQKziLUWkVKiRVrx4a40iPaxTUefQmjtkQofBkYRcoaaL/8rhwDWww9qWbrgicNOgnpIsMxyNIUM4+n6dUIA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/graceful-fs": {
       "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.9.tgz",
-      "integrity": "sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9738,22 +7259,16 @@
     },
     "node_modules/@types/http-cache-semantics": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@types/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/http-errors": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
-      "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/http-proxy": {
       "version": "1.17.17",
-      "resolved": "https://registry.npmjs.org/@types/http-proxy/-/http-proxy-1.17.17.tgz",
-      "integrity": "sha512-ED6LB+Z1AVylNTu7hdzuBqOgMnvG/ld6wGCG8wFnAzKX5uyW2K3WD52v0gnLCTK/VLpXtKckgWuyScYK6cSPaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9762,15 +7277,11 @@
     },
     "node_modules/@types/istanbul-lib-coverage": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
-      "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/istanbul-lib-report": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz",
-      "integrity": "sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9779,8 +7290,6 @@
     },
     "node_modules/@types/istanbul-reports": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz",
-      "integrity": "sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9789,8 +7298,6 @@
     },
     "node_modules/@types/jest": {
       "version": "29.5.4",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.4.tgz",
-      "integrity": "sha512-PhglGmhWeD46FYOVLt3X7TiWjzwuVGW9wG/4qocPevXMjCmrIc5b6db9WjeGE4QYVpUAWMDv3v0IiBwObY289A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9800,15 +7307,11 @@
     },
     "node_modules/@types/js-yaml": {
       "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
-      "integrity": "sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/jsdom": {
       "version": "20.0.1",
-      "resolved": "https://registry.npmjs.org/@types/jsdom/-/jsdom-20.0.1.tgz",
-      "integrity": "sha512-d0r18sZPmMQr1eG35u12FZfhIXNrnsPU/g5wvRKCUf/tOGilKKwYMYGqh33BNR6ba+2gkHw1EUiHoN3mn7E5IQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9819,15 +7322,11 @@
     },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/keyv": {
       "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/@types/keyv/-/keyv-3.1.4.tgz",
-      "integrity": "sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9836,36 +7335,26 @@
     },
     "node_modules/@types/lodash": {
       "version": "4.14.161",
-      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.161.tgz",
-      "integrity": "sha512-EP6O3Jkr7bXvZZSZYlsgt5DIjiGr0dXP1/jVEwVLTFgg0d+3lWVQkRavYVQszV7dYUwvg0B8R0MBDpcmXg7XIA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/long": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/long/-/long-4.0.2.tgz",
-      "integrity": "sha512-MqTGEo5bj5t157U6fA/BiDynNkn0YknVdh48CMPkTSpFTVmvao5UQmm7uEF6xBEo7qIMAlY/JSleYaE6VOdpaA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/mime": {
       "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
-      "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/minimatch": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.5.tgz",
-      "integrity": "sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/node": {
       "version": "22.19.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.3.tgz",
-      "integrity": "sha512-1N9SBnWYOJTrNZCdh/yJE+t910Y128BoyY+zBLWhL3r0TYzlTmFdXrPwHL9DyFZmlEXNQQolTZh3KHV31QDhyA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9874,8 +7363,6 @@
     },
     "node_modules/@types/node-forge": {
       "version": "1.3.14",
-      "resolved": "https://registry.npmjs.org/@types/node-forge/-/node-forge-1.3.14.tgz",
-      "integrity": "sha512-mhVF2BnD4BO+jtOp7z1CdzaK4mbuK0LLQYAvdOLqHTavxFNq4zA1EmYkpnFjP8HOUzedfQkRnp0E2ulSAYSzAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9884,29 +7371,21 @@
     },
     "node_modules/@types/prettier": {
       "version": "2.7.3",
-      "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.3.tgz",
-      "integrity": "sha512-+68kP9yzs4LMp7VNh8gdzMSPZFL44MLGqiHWvttYJe+6qnuVr4Ek9wSBQoveqY/r+LwjCcU29kNVkidwim+kYA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/qs": {
       "version": "6.15.1",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz",
-      "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
-      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/responselike": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@types/responselike/-/responselike-1.0.3.tgz",
-      "integrity": "sha512-H/+L+UkTV33uf49PH5pCAUBVPNj2nDBXTN+qS1dOwyyg24l3CcicicCA7ca+HMvJBZcFgl5r8e+RR6elsb4Lyw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9915,15 +7394,11 @@
     },
     "node_modules/@types/retry": {
       "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/send": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9932,8 +7407,6 @@
     },
     "node_modules/@types/serve-index": {
       "version": "1.9.4",
-      "resolved": "https://registry.npmjs.org/@types/serve-index/-/serve-index-1.9.4.tgz",
-      "integrity": "sha512-qLpGZ/c2fhSs5gnYsQxtDEq3Oy8SXPClIXkW5ghvAvsNuVSA8k+gCONcUCS/UjLEYvYps+e8uBtfgXgvhwfNug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9942,8 +7415,6 @@
     },
     "node_modules/@types/serve-static": {
       "version": "1.15.10",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.10.tgz",
-      "integrity": "sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9954,8 +7425,6 @@
     },
     "node_modules/@types/serve-static/node_modules/@types/send": {
       "version": "0.17.6",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.6.tgz",
-      "integrity": "sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9965,22 +7434,16 @@
     },
     "node_modules/@types/sinonjs__fake-timers": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@types/sinonjs__fake-timers/-/sinonjs__fake-timers-8.1.1.tgz",
-      "integrity": "sha512-0kSuKjAS0TrGLJ0M/+8MaFkGsQhZpB6pxOmvS3K8FYI72K//YmdfoW9X2qPsAKh1mkwxGD5zib9s1FIFed6E8g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/sizzle": {
       "version": "2.3.10",
-      "resolved": "https://registry.npmjs.org/@types/sizzle/-/sizzle-2.3.10.tgz",
-      "integrity": "sha512-TC0dmN0K8YcWEAEfiPi5gJP14eJe30TTGjkvek3iM/1NdHHsdCA/Td6GvNndMOo/iSnIsZ4HuuhrYPDAmbxzww==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/sockjs": {
       "version": "0.3.36",
-      "resolved": "https://registry.npmjs.org/@types/sockjs/-/sockjs-0.3.36.tgz",
-      "integrity": "sha512-MK9V6NzAS1+Ud7JV9lJLFqW85VbC9dq3LmwZCuBe4wBDgKC0Kj/jd8Xl+nSviU+Qc3+m7umHHyHg//2KSa0a0Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9989,15 +7452,11 @@
     },
     "node_modules/@types/stack-utils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz",
-      "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/topojson": {
       "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/@types/topojson/-/topojson-3.2.6.tgz",
-      "integrity": "sha512-ppfdlxjxofWJ66XdLgIlER/85RvpGyfOf8jrWf+3kVIjEatFxEZYD/Ea83jO672Xu1HRzd/ghwlbcZIUNHTskw==",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*",
@@ -10009,8 +7468,6 @@
     },
     "node_modules/@types/topojson-client": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/@types/topojson-client/-/topojson-client-3.1.5.tgz",
-      "integrity": "sha512-C79rySTyPxnQNNguTZNI1Ct4D7IXgvyAs3p9HPecnl6mNrJ5+UhvGNYcZfpROYV2lMHI48kJPxwR+F9C6c7nmw==",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*",
@@ -10019,8 +7476,6 @@
     },
     "node_modules/@types/topojson-server": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/topojson-server/-/topojson-server-3.0.4.tgz",
-      "integrity": "sha512-5+ieK8ePfP+K2VH6Vgs1VCt+fO1U8XZHj0UsF+NktaF0DavAo1q3IvCBXgokk/xmtvoPltSUs6vxuR/zMdOE1g==",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*",
@@ -10029,8 +7484,6 @@
     },
     "node_modules/@types/topojson-simplify": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/topojson-simplify/-/topojson-simplify-3.0.3.tgz",
-      "integrity": "sha512-sBO5UZ0O2dB0bNwo0vut2yLHhj3neUGi9uL7/ROdm8Gs6dtt4jcB9OGDKr+M2isZwQM2RuzVmifnMZpxj4IGNw==",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*",
@@ -10039,8 +7492,6 @@
     },
     "node_modules/@types/topojson-specification": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/@types/topojson-specification/-/topojson-specification-1.0.5.tgz",
-      "integrity": "sha512-C7KvcQh+C2nr6Y2Ub4YfgvWvWCgP2nOQMtfhlnwsRL4pYmmwzBS7HclGiS87eQfDOU/DLQpX6GEscviaz4yLIQ==",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*"
@@ -10048,36 +7499,26 @@
     },
     "node_modules/@types/tough-cookie": {
       "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.5.tgz",
-      "integrity": "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/trusted-types": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/@types/uuid": {
       "version": "3.4.13",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.13.tgz",
-      "integrity": "sha512-pAeZeUbLE4Z9Vi9wsWV2bYPTweEHeJJy0G4pEjOA/FSvy1Ad5U5Km8iDV6TKre1mjBiVNfAdVHKruP8bAh4Q5A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/validator": {
       "version": "13.15.10",
-      "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.15.10.tgz",
-      "integrity": "sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/ws": {
       "version": "8.5.5",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.5.tgz",
-      "integrity": "sha512-lwhs8hktwxSjf9UaZ9tG5M03PGogvFaH8gUgLNbN9HKIg0dvv6q+gkSuJ8HN4/VbyxkuLzCjlN7GquQ0gUJfIg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10086,8 +7527,6 @@
     },
     "node_modules/@types/xml2js": {
       "version": "0.4.14",
-      "resolved": "https://registry.npmjs.org/@types/xml2js/-/xml2js-0.4.14.tgz",
-      "integrity": "sha512-4YnrRemBShWRO2QjvUin8ESA41rH+9nQGLUGZV/1IDhi3SL9OhdpNC/MrulTWuptXKwhx/aDxE7toV0f/ypIXQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10096,8 +7535,6 @@
     },
     "node_modules/@types/yargs": {
       "version": "17.0.35",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz",
-      "integrity": "sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10106,15 +7543,11 @@
     },
     "node_modules/@types/yargs-parser": {
       "version": "21.0.3",
-      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.3.tgz",
-      "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/yauzl": {
       "version": "2.10.3",
-      "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz",
-      "integrity": "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -10122,22 +7555,16 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.14.0.tgz",
-      "integrity": "sha512-tqp8H7UWFaZj0yNO6bycd5YjMwxa6wIHOLZvWPkidwbgLCsBMetQoGj7DPuAlWa2yGO3H48xmPwjhsSPPCGU5w==",
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.63.0.tgz",
+      "integrity": "sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.14.0",
-        "@typescript-eslint/type-utils": "8.14.0",
-        "@typescript-eslint/utils": "8.14.0",
-        "@typescript-eslint/visitor-keys": "8.14.0",
-        "graphemer": "^1.4.0",
-        "ignore": "^5.3.1",
-        "natural-compare": "^1.4.0",
-        "ts-api-utils": "^1.3.0"
+        "@typescript-eslint/tsconfig-utils": "^8.63.0",
+        "@typescript-eslint/types": "^8.63.0",
+        "debug": "^4.4.3"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10147,48 +7574,50 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.0.0 || ^8.0.0-alpha.0",
-        "eslint": "^8.57.0 || ^9.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service/node_modules/@typescript-eslint/types": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz",
+      "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
       },
       "peerDependenciesMeta": {
-        "typescript": {
+        "supports-color": {
           "optional": true
         }
       }
     },
-    "node_modules/@typescript-eslint/parser": {
-      "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.14.0.tgz",
-      "integrity": "sha512-2p82Yn9juUJq0XynBXtFCyrBDb6/dJombnz6vbo6mgQEtWHfvHbQuEa9kAOVIt1c9YFwi7H6WxtPj1kg+80+RA==",
+    "node_modules/@typescript-eslint/project-service/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.14.0",
-        "@typescript-eslint/types": "8.14.0",
-        "@typescript-eslint/typescript-estree": "8.14.0",
-        "@typescript-eslint/visitor-keys": "8.14.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
+      "license": "MIT"
     },
     "node_modules/@typescript-eslint/scope-manager": {
       "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.14.0.tgz",
-      "integrity": "sha512-aBbBrnW9ARIDn92Zbo7rguLnqQ/pOrUguVpbUwzOhkFg2npFDwTgPGqFqE0H5feXcOoJOfX3SxlJaKEVtq54dw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10203,18 +7632,12 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
-    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.14.0.tgz",
-      "integrity": "sha512-Xcz9qOtZuGusVOH5Uk07NGs39wrKkf3AxlkK79RBK6aJC1l03CobXjJbwBPSidetAOV+5rEVuiT1VSBUOAsanQ==",
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz",
+      "integrity": "sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/typescript-estree": "8.14.0",
-        "@typescript-eslint/utils": "8.14.0",
-        "debug": "^4.3.4",
-        "ts-api-utils": "^1.3.0"
-      },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
@@ -10222,16 +7645,12 @@
         "type": "opencollective",
         "url": "https://opencollective.com/typescript-eslint"
       },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
       "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.14.0.tgz",
-      "integrity": "sha512-yjeB9fnO/opvLJFAsPNYlKPnEM8+z4og09Pk504dkqonT02AyL5Z9SSqlE0XqezS93v6CXn49VHvB2G7XSsl0g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10244,8 +7663,6 @@
     },
     "node_modules/@typescript-eslint/typescript-estree": {
       "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.14.0.tgz",
-      "integrity": "sha512-OPXPLYKGZi9XS/49rdaCbR5j/S14HazviBlUQFvSKz3npr3NikF+mrgK7CFVur6XEt95DZp/cmke9d5i3vtVnQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -10273,8 +7690,6 @@
     },
     "node_modules/@typescript-eslint/utils": {
       "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.14.0.tgz",
-      "integrity": "sha512-OGqj6uB8THhrHj0Fk27DcHPojW7zKwKkPmHXHvQ58pLYp4hy8CSUdTKykKeh+5vFqTTVmjz0zCOOPKRovdsgHA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10296,8 +7711,6 @@
     },
     "node_modules/@typescript-eslint/visitor-keys": {
       "version": "8.14.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.14.0.tgz",
-      "integrity": "sha512-vG0XZo8AdTH9OE6VFRwAZldNc7qtJ/6NLGWak+BtENuEUXGZgFpihILPiBvKXvJ2nFu27XNGC6rKiwuaoMbYzQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10314,8 +7727,6 @@
     },
     "node_modules/@vitejs/plugin-basic-ssl": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-basic-ssl/-/plugin-basic-ssl-1.2.0.tgz",
-      "integrity": "sha512-mkQnxTkcldAzIsomk1UuLfAu9n+kpQ3JbHcpCp7d2Oo6ITtji8pHS3QToOWjhPFvNQSnhlkAjmGbhv2QvwO/7Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10327,8 +7738,6 @@
     },
     "node_modules/@wdio/config": {
       "version": "7.31.1",
-      "resolved": "https://registry.npmjs.org/@wdio/config/-/config-7.31.1.tgz",
-      "integrity": "sha512-WAfswbCatwiaDVqy6kfF/5T8/WS/US/SRhBGUFrfBuGMIe+RRoHgy7jURFWSvUIE7CNHj8yvs46fLUcxhXjzcQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10345,9 +7754,6 @@
     },
     "node_modules/@wdio/config/node_modules/glob": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
-      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -10366,8 +7772,6 @@
     },
     "node_modules/@wdio/config/node_modules/minimatch": {
       "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
-      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -10379,8 +7783,6 @@
     },
     "node_modules/@wdio/logger": {
       "version": "7.26.0",
-      "resolved": "https://registry.npmjs.org/@wdio/logger/-/logger-7.26.0.tgz",
-      "integrity": "sha512-kQj9s5JudAG9qB+zAAcYGPHVfATl2oqKgqj47yjehOQ1zzG33xmtL1ArFbQKWhDG32y1A8sN6b0pIqBEIwgg8Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10395,8 +7797,6 @@
     },
     "node_modules/@wdio/logger/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10412,8 +7812,6 @@
     },
     "node_modules/@wdio/protocols": {
       "version": "7.27.0",
-      "resolved": "https://registry.npmjs.org/@wdio/protocols/-/protocols-7.27.0.tgz",
-      "integrity": "sha512-hT/U22R5i3HhwPjkaKAG0yd59eaOaZB0eibRj2+esCImkb5Y6rg8FirrlYRxIGFVBl0+xZV0jKHzR5+o097nvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10422,8 +7820,6 @@
     },
     "node_modules/@wdio/types": {
       "version": "7.30.2",
-      "resolved": "https://registry.npmjs.org/@wdio/types/-/types-7.30.2.tgz",
-      "integrity": "sha512-uZ8o7FX8RyBsaXiOWa59UKTCHTtADNvOArYTcHNEIzt+rh4JdB/uwqfc8y4TCNA2kYm7PWaQpUFwpStLeg0H1Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10444,8 +7840,6 @@
     },
     "node_modules/@wdio/types/node_modules/@types/node": {
       "version": "18.19.130",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz",
-      "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10454,15 +7848,11 @@
     },
     "node_modules/@wdio/types/node_modules/undici-types": {
       "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@wdio/utils": {
       "version": "7.30.2",
-      "resolved": "https://registry.npmjs.org/@wdio/utils/-/utils-7.30.2.tgz",
-      "integrity": "sha512-np7I+smszFUennbQKdzbMN/zUL3s3EZq9pCCUcTRjjs9TE4tnn0wfmGdoz2o7REYu6kn9NfFFJyVIM2VtBbKEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10476,8 +7866,6 @@
     },
     "node_modules/@webassemblyjs/ast": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.14.1.tgz",
-      "integrity": "sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10487,29 +7875,21 @@
     },
     "node_modules/@webassemblyjs/floating-point-hex-parser": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.13.2.tgz",
-      "integrity": "sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-api-error": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.13.2.tgz",
-      "integrity": "sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-buffer": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.14.1.tgz",
-      "integrity": "sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-numbers": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.13.2.tgz",
-      "integrity": "sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10520,15 +7900,11 @@
     },
     "node_modules/@webassemblyjs/helper-wasm-bytecode": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.13.2.tgz",
-      "integrity": "sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-wasm-section": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.14.1.tgz",
-      "integrity": "sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10540,8 +7916,6 @@
     },
     "node_modules/@webassemblyjs/ieee754": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.13.2.tgz",
-      "integrity": "sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10550,8 +7924,6 @@
     },
     "node_modules/@webassemblyjs/leb128": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.13.2.tgz",
-      "integrity": "sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -10560,15 +7932,11 @@
     },
     "node_modules/@webassemblyjs/utf8": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.13.2.tgz",
-      "integrity": "sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/wasm-edit": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.14.1.tgz",
-      "integrity": "sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10584,8 +7952,6 @@
     },
     "node_modules/@webassemblyjs/wasm-gen": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.14.1.tgz",
-      "integrity": "sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10598,8 +7964,6 @@
     },
     "node_modules/@webassemblyjs/wasm-opt": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.14.1.tgz",
-      "integrity": "sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10611,8 +7975,6 @@
     },
     "node_modules/@webassemblyjs/wasm-parser": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.14.1.tgz",
-      "integrity": "sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10626,8 +7988,6 @@
     },
     "node_modules/@webassemblyjs/wast-printer": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.14.1.tgz",
-      "integrity": "sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10637,9 +7997,6 @@
     },
     "node_modules/@xmldom/xmldom": {
       "version": "0.8.10",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.10.tgz",
-      "integrity": "sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw==",
-      "deprecated": "this version has critical issues, please update to the latest version",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10648,37 +8005,26 @@
     },
     "node_modules/@xtuc/ieee754": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
-      "integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/@xtuc/long": {
       "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz",
-      "integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/@yarnpkg/lockfile": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz",
-      "integrity": "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
     "node_modules/abab": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
-      "integrity": "sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==",
-      "deprecated": "Use your platform's native atob() and btoa() methods instead",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/abbrev": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
-      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -10687,8 +8033,6 @@
     },
     "node_modules/abort-controller": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
-      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10700,15 +8044,11 @@
     },
     "node_modules/abstract-logging": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/abstract-logging/-/abstract-logging-2.0.1.tgz",
-      "integrity": "sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/accepts": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
-      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10721,8 +8061,6 @@
     },
     "node_modules/accepts/node_modules/negotiator": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
-      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10731,8 +8069,6 @@
     },
     "node_modules/acorn": {
       "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
-      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -10744,8 +8080,6 @@
     },
     "node_modules/acorn-globals": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/acorn-globals/-/acorn-globals-7.0.1.tgz",
-      "integrity": "sha512-umOSDSDrfHbTNPuNpC2NSnnA3LUrqpevPb4T9jRx4MagXNS0rs+gwiTcAvqCRmsD6utzsrzNt+ebm00SNWiC3Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10755,8 +8089,6 @@
     },
     "node_modules/acorn-globals/node_modules/acorn-walk": {
       "version": "8.3.5",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz",
-      "integrity": "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10768,8 +8100,6 @@
     },
     "node_modules/acorn-import-phases": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/acorn-import-phases/-/acorn-import-phases-1.0.4.tgz",
-      "integrity": "sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10781,8 +8111,6 @@
     },
     "node_modules/acorn-jsx": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -10791,8 +8119,6 @@
     },
     "node_modules/acorn-node": {
       "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/acorn-node/-/acorn-node-1.8.2.tgz",
-      "integrity": "sha512-8mt+fslDufLYntIoPAaIMUe/lrbrehIiwmR3t2k9LljIzoigEPF27eLk2hy8zSGzmR/ogr7zbRKINMo1u0yh5A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -10803,8 +8129,6 @@
     },
     "node_modules/acorn-node/node_modules/acorn": {
       "version": "7.4.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -10816,8 +8140,6 @@
     },
     "node_modules/acorn-walk": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
-      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10826,8 +8148,6 @@
     },
     "node_modules/adjust-sourcemap-loader": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/adjust-sourcemap-loader/-/adjust-sourcemap-loader-4.0.0.tgz",
-      "integrity": "sha512-OXwN5b9pCUXNQHJpwwD2qP40byEmSgzj8B4ydSN0uMNYWiFmJ6x6KwUllMmfk8Rwu/HJDFR7U8ubsWBoN0Xp0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10840,8 +8160,6 @@
     },
     "node_modules/adjust-sourcemap-loader/node_modules/loader-utils": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
-      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10855,8 +8173,6 @@
     },
     "node_modules/agent-base": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10868,8 +8184,6 @@
     },
     "node_modules/aggregate-error": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
-      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10882,8 +8196,6 @@
     },
     "node_modules/aggregate-error/node_modules/indent-string": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
-      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10892,8 +8204,6 @@
     },
     "node_modules/ajv": {
       "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10909,8 +8219,6 @@
     },
     "node_modules/ajv-formats": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10927,8 +8235,6 @@
     },
     "node_modules/ajv-keywords": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
-      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10938,10 +8244,104 @@
         "ajv": "^8.8.2"
       }
     },
+    "node_modules/angular-eslint": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/angular-eslint/-/angular-eslint-19.8.1.tgz",
+      "integrity": "sha512-A6mPcVAXEDdJk7bKKBwd+1b/VA/xwpWWN2fExTGO1dkVNPz550LlgxBjEio9G7u4i+pD2aLrl6Cx6O+9o1iusQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@angular-devkit/core": ">= 19.0.0 < 20.0.0",
+        "@angular-devkit/schematics": ">= 19.0.0 < 20.0.0",
+        "@angular-eslint/builder": "19.8.1",
+        "@angular-eslint/eslint-plugin": "19.8.1",
+        "@angular-eslint/eslint-plugin-template": "19.8.1",
+        "@angular-eslint/schematics": "19.8.1",
+        "@angular-eslint/template-parser": "19.8.1",
+        "@typescript-eslint/types": "^8.0.0",
+        "@typescript-eslint/utils": "^8.0.0"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0",
+        "typescript": "*",
+        "typescript-eslint": "^8.0.0"
+      }
+    },
+    "node_modules/angular-eslint/node_modules/@angular-eslint/bundled-angular-compiler": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/bundled-angular-compiler/-/bundled-angular-compiler-19.8.1.tgz",
+      "integrity": "sha512-WXi1YbSs7SIQo48u+fCcc5Nt14/T4QzYQPLZUnjtsUXPgQG7ZoahhcGf7PPQ+n0V3pSopHOlSHwqK+tSsYK87A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/angular-eslint/node_modules/@angular-eslint/eslint-plugin": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/eslint-plugin/-/eslint-plugin-19.8.1.tgz",
+      "integrity": "sha512-wZEBMPwD2TRhifG751hcj137EMIEaFmsxRB2EI+vfINCgPnFGSGGOHXqi8aInn9fXqHs7VbXkAzXYdBsvy1m4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@angular-eslint/bundled-angular-compiler": "19.8.1",
+        "@angular-eslint/utils": "19.8.1"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
+        "eslint": "^8.57.0 || ^9.0.0",
+        "typescript": "*"
+      }
+    },
+    "node_modules/angular-eslint/node_modules/@angular-eslint/eslint-plugin-template": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/eslint-plugin-template/-/eslint-plugin-template-19.8.1.tgz",
+      "integrity": "sha512-0ZVQldndLrDfB0tzFe/uIwvkUcakw8qGxvkEU0l7kSbv/ngNQ/qrkRi7P64otB15inIDUNZI2jtmVat52dqSfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@angular-eslint/bundled-angular-compiler": "19.8.1",
+        "@angular-eslint/utils": "19.8.1",
+        "aria-query": "5.3.2",
+        "axobject-query": "4.1.0"
+      },
+      "peerDependencies": {
+        "@angular-eslint/template-parser": "19.8.1",
+        "@typescript-eslint/types": "^7.11.0 || ^8.0.0",
+        "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
+        "eslint": "^8.57.0 || ^9.0.0",
+        "typescript": "*"
+      }
+    },
+    "node_modules/angular-eslint/node_modules/@angular-eslint/template-parser": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/template-parser/-/template-parser-19.8.1.tgz",
+      "integrity": "sha512-pQiOg+se1AU/ncMlnJ9V6xYnMQ84qI1BGWuJpbU6A99VTXJg90scg0+T7DWmKssR1YjP5qmmBtrZfKsHEcLW/A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@angular-eslint/bundled-angular-compiler": "19.8.1",
+        "eslint-scope": "^8.0.2"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0",
+        "typescript": "*"
+      }
+    },
+    "node_modules/angular-eslint/node_modules/@angular-eslint/utils": {
+      "version": "19.8.1",
+      "resolved": "https://registry.npmjs.org/@angular-eslint/utils/-/utils-19.8.1.tgz",
+      "integrity": "sha512-gVDKYWmAjeTPtaYmddT/HS03fCebXJtrk8G1MouQIviZbHqLjap6TbVlzlkBigRzaF0WnFnrDduQslkJzEdceA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@angular-eslint/bundled-angular-compiler": "19.8.1"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/utils": "^7.11.0 || ^8.0.0",
+        "eslint": "^8.57.0 || ^9.0.0",
+        "typescript": "*"
+      }
+    },
     "node_modules/ansi-align": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-align/-/ansi-align-3.0.1.tgz",
-      "integrity": "sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -10950,8 +8350,6 @@
     },
     "node_modules/ansi-colors": {
       "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz",
-      "integrity": "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10960,8 +8358,6 @@
     },
     "node_modules/ansi-escapes": {
       "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
-      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10976,8 +8372,6 @@
     },
     "node_modules/ansi-escapes/node_modules/type-fest": {
       "version": "0.21.3",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "engines": {
@@ -10989,8 +8383,6 @@
     },
     "node_modules/ansi-html-community": {
       "version": "0.0.8",
-      "resolved": "https://registry.npmjs.org/ansi-html-community/-/ansi-html-community-0.0.8.tgz",
-      "integrity": "sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==",
       "dev": true,
       "engines": [
         "node >= 0.8.0"
@@ -11002,8 +8394,6 @@
     },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -11011,8 +8401,6 @@
     },
     "node_modules/ansi-styles": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
       "license": "MIT",
       "dependencies": {
         "color-convert": "^2.0.1"
@@ -11026,15 +8414,11 @@
     },
     "node_modules/any-promise": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
-      "integrity": "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/anymatch": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
-      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -11047,8 +8431,6 @@
     },
     "node_modules/anymatch/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11060,8 +8442,6 @@
     },
     "node_modules/apache-crypt": {
       "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/apache-crypt/-/apache-crypt-1.2.6.tgz",
-      "integrity": "sha512-072WetlM4blL8PREJVeY+WHiUh1R5VNt2HfceGS8aKqttPHcmqE5pkKuXPz/ULmJOFkc8Hw3kfKl6vy7Qka6DA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11073,8 +8453,6 @@
     },
     "node_modules/apache-md5": {
       "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/apache-md5/-/apache-md5-1.1.8.tgz",
-      "integrity": "sha512-FCAJojipPn0bXjuEpjOOOMN8FZDkxfWWp4JGN9mifU2IhxvKyXZYqpzPHdnTSUpmPDy+tsslB6Z1g+Vg6nVbYA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11083,8 +8461,6 @@
     },
     "node_modules/arch": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/arch/-/arch-2.2.0.tgz",
-      "integrity": "sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ==",
       "dev": true,
       "funding": [
         {
@@ -11104,21 +8480,15 @@
     },
     "node_modules/arg": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
-      "integrity": "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/argparse": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
       "license": "Python-2.0"
     },
     "node_modules/aria-query": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.2.tgz",
-      "integrity": "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -11127,8 +8497,6 @@
     },
     "node_modules/array-buffer-byte-length": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.2.tgz",
-      "integrity": "sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11144,8 +8512,6 @@
     },
     "node_modules/array-differ": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/array-differ/-/array-differ-3.0.0.tgz",
-      "integrity": "sha512-THtfYS6KtME/yIAhKjZ2ul7XI96lQGHRputJQHO80LAWQnuGP4iCIN8vdMRboGbIEYBwU33q8Tch1os2+X0kMg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11154,15 +8520,11 @@
     },
     "node_modules/array-flatten": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/array-union": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
-      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11171,8 +8533,6 @@
     },
     "node_modules/arraybuffer.prototype.slice": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.4.tgz",
-      "integrity": "sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11193,8 +8553,6 @@
     },
     "node_modules/arrify": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/arrify/-/arrify-2.0.1.tgz",
-      "integrity": "sha512-3duEwti880xqi4eAMN8AyR4a0ByT90zoYdLlevfrvU43vb0YZwZVfxOgxWrLXXXpyugL0hNZc9G6BiB5B3nUug==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11203,8 +8561,6 @@
     },
     "node_modules/asn1": {
       "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.6.tgz",
-      "integrity": "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11213,8 +8569,6 @@
     },
     "node_modules/asn1.js": {
       "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/asn1.js/-/asn1.js-4.10.1.tgz",
-      "integrity": "sha512-p32cOF5q0Zqs9uBiONKYLm6BClCoBCM5O9JfeUSlnQLBTxYdTK+pW+nXflm8UkKd2UYlEbYz5qEi0JuZR9ckSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11225,15 +8579,11 @@
     },
     "node_modules/asn1.js/node_modules/bn.js": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
-      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/assert": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/assert/-/assert-1.5.1.tgz",
-      "integrity": "sha512-zzw1uCAgLbsKwBfFc8CX78DDg+xZeBksSO3vwVIDDN5i94eOrPsSSyiVhmsSABFDM/OcpE2aagCat9dnWQLG1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11243,8 +8593,6 @@
     },
     "node_modules/assert-plus": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11253,8 +8601,6 @@
     },
     "node_modules/assertion-error": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-1.1.0.tgz",
-      "integrity": "sha512-jgsaNduz+ndvGyFt3uSuWqvy4lCnIJiovtouQN5JZHOKCS2QuhEdbcQHFhVksz2N2U9hXJo8odG7ETyWlEeuDw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11263,8 +8609,6 @@
     },
     "node_modules/assertion-error-formatter": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/assertion-error-formatter/-/assertion-error-formatter-2.0.1.tgz",
-      "integrity": "sha512-cjC3jUCh9spkroKue5PDSKH5RFQ/KNuZJhk3GwHYmB/8qqETxLOmMdLH+ohi/VukNzxDlMvIe7zScvLoOdhb6Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11275,8 +8619,6 @@
     },
     "node_modules/astral-regex": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
-      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11285,15 +8627,11 @@
     },
     "node_modules/async": {
       "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
-      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/async-function": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/async-function/-/async-function-1.0.0.tgz",
-      "integrity": "sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11302,8 +8640,6 @@
     },
     "node_modules/async-mutex": {
       "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/async-mutex/-/async-mutex-0.5.0.tgz",
-      "integrity": "sha512-1A94B18jkJ3DYq284ohPxoXbfTA5HsQ7/Mf4DEhcyLx3Bz27Rh59iScbB6EPiP+B+joue6YCxcMXSbFC1tZKwA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.4.0"
@@ -11311,15 +8647,11 @@
     },
     "node_modules/asynckit": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/at-least-node": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
-      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -11328,8 +8660,6 @@
     },
     "node_modules/atomic-sleep": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
-      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11338,8 +8668,6 @@
     },
     "node_modules/autoprefixer": {
       "version": "10.4.20",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.20.tgz",
-      "integrity": "sha512-XY25y5xSv/wEoqzDyXXME4AFfkZI0P23z6Fs3YgymDnKJkCGOnkL0iTxCa85UTqaSgfcqyf3UA6+c7wUvx/16g==",
       "dev": true,
       "funding": [
         {
@@ -11376,8 +8704,6 @@
     },
     "node_modules/available-typed-arrays": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
-      "integrity": "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11392,8 +8718,6 @@
     },
     "node_modules/avvio": {
       "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/avvio/-/avvio-8.4.0.tgz",
-      "integrity": "sha512-CDSwaxINFy59iNwhYnkvALBwZiTydGkOecZyPkqBpABYR1KqGEsET0VOOYDwtleZSUIdeY36DC2bSZ24CO1igA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11403,8 +8727,6 @@
     },
     "node_modules/aws-sign2": {
       "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/aws-sign2/-/aws-sign2-0.7.0.tgz",
-      "integrity": "sha512-08kcGqnYf/YmjoRhfxyu+CLxBjUtHLXLXX/vUfx9l2LYzG3c1m61nrpyFUZI6zeS+Li/wWMMidD9KgrqtGq3mA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -11413,15 +8735,11 @@
     },
     "node_modules/aws4": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz",
-      "integrity": "sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/axe-core": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.4.3.tgz",
-      "integrity": "sha512-32+ub6kkdhhWick/UjvEwRchgoetXqTK14INLqbGm5U2TzBkBNF3nQtLYm8ovxSkQWArjEQvftCKryjZaATu3w==",
       "dev": true,
       "license": "MPL-2.0",
       "engines": {
@@ -11430,8 +8748,6 @@
     },
     "node_modules/axios": {
       "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.1.tgz",
-      "integrity": "sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11443,8 +8759,6 @@
     },
     "node_modules/axios/node_modules/form-data": {
       "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11460,8 +8774,6 @@
     },
     "node_modules/axios/node_modules/https-proxy-agent": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11474,8 +8786,6 @@
     },
     "node_modules/axios/node_modules/proxy-from-env": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
-      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11484,8 +8794,6 @@
     },
     "node_modules/axobject-query": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
-      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -11494,8 +8802,6 @@
     },
     "node_modules/babel-jest": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-29.7.0.tgz",
-      "integrity": "sha512-BrvGY3xZSwEcCzKvKsCi2GgHqDqsYkOP4/by5xCgIwGXQxIEh+8ew3gmrE1y7XRR6LHZIj6yLYnUi/mm2KXKBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11516,8 +8822,6 @@
     },
     "node_modules/babel-jest/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11533,8 +8837,6 @@
     },
     "node_modules/babel-jest/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11543,8 +8845,6 @@
     },
     "node_modules/babel-loader": {
       "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-9.2.1.tgz",
-      "integrity": "sha512-fqe8naHt46e0yIdkjUZYqddSXfej3AHajX+CSO5X7oy0EmPc6o5Xh+RClNoHjnieWz9AW4kZxW9yyFMhVB1QLA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11561,15 +8861,11 @@
     },
     "node_modules/babel-plugin-add-module-exports": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/babel-plugin-add-module-exports/-/babel-plugin-add-module-exports-1.0.4.tgz",
-      "integrity": "sha512-g+8yxHUZ60RcyaUpfNzy56OtWW+x9cyEe9j+CranqLiqbju2yf/Cy6ZtYK40EZxtrdHllzlVZgLmcOUCTlJ7Jg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/babel-plugin-istanbul": {
       "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz",
-      "integrity": "sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -11585,8 +8881,6 @@
     },
     "node_modules/babel-plugin-istanbul/node_modules/istanbul-lib-instrument": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.1.tgz",
-      "integrity": "sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -11602,8 +8896,6 @@
     },
     "node_modules/babel-plugin-istanbul/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -11612,8 +8904,6 @@
     },
     "node_modules/babel-plugin-jest-hoist": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-29.6.3.tgz",
-      "integrity": "sha512-ESAc/RJvGTFEzRwOTT4+lNDk/GNHMkKbNzsvT0qKRfDyyYTskxB5rnU2njIDYVxXCBHHEI1c0YwHob3WaYujOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11628,8 +8918,6 @@
     },
     "node_modules/babel-plugin-polyfill-corejs2": {
       "version": "0.4.17",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.17.tgz",
-      "integrity": "sha512-aTyf30K/rqAsNwN76zYrdtx8obu0E4KoUME29B1xj+B3WxgvWkp943vYQ+z8Mv3lw9xHXMHpvSPOBxzAkIa94w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11643,8 +8931,6 @@
     },
     "node_modules/babel-plugin-polyfill-corejs2/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -11653,8 +8939,6 @@
     },
     "node_modules/babel-plugin-polyfill-corejs3": {
       "version": "0.11.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.11.1.tgz",
-      "integrity": "sha512-yGCqvBT4rwMczo28xkH/noxJ6MZ4nJfkVYdoDaC/utLtWrXxv27HVrzAeSbqR8SxDsp46n0YF47EbHoixy6rXQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11667,8 +8951,6 @@
     },
     "node_modules/babel-plugin-polyfill-regenerator": {
       "version": "0.6.8",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.8.tgz",
-      "integrity": "sha512-M762rNHfSF1EV3SLtnCJXFoQbbIIz0OyRwnCmV0KPC7qosSfCO0QLTSuJX3ayAebubhE6oYBAYPrBA5ljowaZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11680,8 +8962,6 @@
     },
     "node_modules/babel-preset-current-node-syntax": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz",
-      "integrity": "sha512-E/VlAEzRrsLEb2+dv8yp3bo4scof3l9nR4lrld+Iy5NyVqgVYUJnDAmunkhPMisRI32Qc4iRiz425d8vM++2fg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11707,8 +8987,6 @@
     },
     "node_modules/babel-preset-jest": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-29.6.3.tgz",
-      "integrity": "sha512-0B3bhxR6snWXJZtR/RliHTDPRgn1sNHOR0yVtq/IiQFyuOVjFS+wuio/R4gSNkyYmKmJB4wGZv2NZanmKmTnNA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11724,8 +9002,6 @@
     },
     "node_modules/babel-runtime": {
       "version": "6.26.0",
-      "resolved": "https://registry.npmjs.org/babel-runtime/-/babel-runtime-6.26.0.tgz",
-      "integrity": "sha512-ITKNuq2wKlW1fJg9sSW52eepoYgZBggvOAHC0u/CYu/qxQ9EVzThCgR69BnSXLHjy2f7SY5zaQ4yt7H9ZVxY2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11735,15 +9011,11 @@
     },
     "node_modules/babel-runtime/node_modules/regenerator-runtime": {
       "version": "0.11.1",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.11.1.tgz",
-      "integrity": "sha512-MguG95oij0fC3QV3URf4V2SDYGJhJnJGqvIIgdECeODCT98wSWDAJ94SSuVpYQUoTcGUIL6L4yNB7j1DFFHSBg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/babelify": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/babelify/-/babelify-10.0.0.tgz",
-      "integrity": "sha512-X40FaxyH7t3X+JFAKvb1H9wooWKLRCi8pg3m8poqtdZaIng+bjzp9RvKQCvRjF9isHiPkXspbbXT/zwXLtwgwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11755,15 +9027,11 @@
     },
     "node_modules/balanced-match": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
       "dev": true,
       "funding": [
         {
@@ -11783,8 +9051,6 @@
     },
     "node_modules/baseline-browser-mapping": {
       "version": "2.10.31",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.31.tgz",
-      "integrity": "sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -11795,8 +9061,6 @@
     },
     "node_modules/basic-auth": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
-      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11808,22 +9072,16 @@
     },
     "node_modules/basic-auth/node_modules/safe-buffer": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/batch": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/batch/-/batch-0.6.1.tgz",
-      "integrity": "sha512-x+VAiMRL6UPkx+kudNvxTl6hB2XNNCG2r+7wixVfIYwu/2HKRXimwQyaumLjMveWvT2Hkd/cAJw+QBMfJ/EKVw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/bcrypt-pbkdf": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz",
-      "integrity": "sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -11832,15 +9090,11 @@
     },
     "node_modules/bcryptjs": {
       "version": "2.4.3",
-      "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-2.4.3.tgz",
-      "integrity": "sha512-V/Hy/X9Vt7f3BbPJEi8BdVFMByHi+jNXrYkW3huaybV/kQ0KJg0Y6PkEMbn+zeT+i+SiKZ/HMqJGIIt4LZDqNQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/beasties": {
       "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/beasties/-/beasties-0.3.2.tgz",
-      "integrity": "sha512-p4AF8uYzm9Fwu8m/hSVTCPXrRBPmB34hQpHsec2KOaR9CZmgoU8IOv4Cvwq4hgz2p4hLMNbsdNl5XeA6XbAQwA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -11859,15 +9113,11 @@
     },
     "node_modules/becke-ch--regex--s0-0-v1--base--pl--lib": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/becke-ch--regex--s0-0-v1--base--pl--lib/-/becke-ch--regex--s0-0-v1--base--pl--lib-1.4.0.tgz",
-      "integrity": "sha512-FnWonOyaw7Vivg5nIkrUll9HSS5TjFbyuURAiDssuL6VxrBe3ERzudRxOcWRhZYlP89UArMDikz7SapRPQpmZQ==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE"
     },
     "node_modules/big.js": {
       "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/big.js/-/big.js-5.2.2.tgz",
-      "integrity": "sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11876,22 +9126,15 @@
     },
     "node_modules/binary": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/binary/-/binary-0.3.0.tgz",
-      "integrity": "sha512-D4H1y5KYwpJgK8wk1Cue5LLPgmwHKYSChkbspQg5JtVuR5ulGckxfR62H3AE9UDkdMC8yyXlqYihuz3Aqg2XZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "buffers": "~0.1.1",
         "chainsaw": "~0.1.0"
-      },
-      "engines": {
-        "node": "*"
       }
     },
     "node_modules/binary-extensions": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
-      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11903,8 +9146,6 @@
     },
     "node_modules/bl": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11915,8 +9156,6 @@
     },
     "node_modules/bl/node_modules/buffer": {
       "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
       "dev": true,
       "funding": [
         {
@@ -11940,8 +9179,6 @@
     },
     "node_modules/bl/node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11955,36 +9192,26 @@
     },
     "node_modules/blob-util": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/blob-util/-/blob-util-2.0.2.tgz",
-      "integrity": "sha512-T7JQa+zsXXEa6/8ZhHcQEW1UFfVM49Ts65uBkFL6fz2QmrElqmbajIDJvuA0tEhRe5eIjpV9ZF+0RfZR9voJFQ==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/bluebird": {
       "version": "3.7.2",
-      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
-      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/bmpimagejs": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/bmpimagejs/-/bmpimagejs-1.0.4.tgz",
-      "integrity": "sha512-21oKU7kbRt2OgOOj7rdiNr/yznDNUQ585plxR00rsmECcZr+6O1oCwB8OIoSHk/bDhbG8mFXIdeQuCPHgZ6QBw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/bn.js": {
       "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.3.tgz",
-      "integrity": "sha512-EAcmnPkxpntVL+DS7bO1zhcZNvCkxqtkd0ZY53h06GNQ3DEkkGZ/gKgmDv6DdZQGj9BgfSPKtJJ7Dp1GPP8f7w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/body-parser": {
       "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12008,8 +9235,6 @@
     },
     "node_modules/body-parser/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12018,8 +9243,6 @@
     },
     "node_modules/body-parser/node_modules/iconv-lite": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12031,15 +9254,11 @@
     },
     "node_modules/body-parser/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/body-parser/node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12051,8 +9270,6 @@
     },
     "node_modules/body-parser/node_modules/qs": {
       "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -12068,8 +9285,6 @@
     },
     "node_modules/bonjour-service": {
       "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.4.2.tgz",
-      "integrity": "sha512-lMskhnsW70yWHr4PhPeh2rvaIkLSaDpp+nmtbXBZaNKTXwxL73QOkW6HhbzqTImXjevn9TreGT4GACGBCGP9nQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12079,15 +9294,11 @@
     },
     "node_modules/boolbase": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
-      "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/bootstrap": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-5.3.2.tgz",
-      "integrity": "sha512-D32nmNWiQHo94BKHLmOrdjlL05q1c8oxbtBphQFb9Z5to6eGRDCm0QgeaZ4zFBHzfg2++rqa2JkqCcxDy0sH0g==",
       "funding": [
         {
           "type": "github",
@@ -12105,8 +9316,6 @@
     },
     "node_modules/bootstrap.native": {
       "version": "5.1.10",
-      "resolved": "https://registry.npmjs.org/bootstrap.native/-/bootstrap.native-5.1.10.tgz",
-      "integrity": "sha512-JwJnMWx/zJirvwEPuvmKve4JoSh6upA5qNWdWj78nJmBCmVhBGXdYHxQIldkIRIReZjCiXntZBLFd3TYoGfgxw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12121,8 +9330,6 @@
     },
     "node_modules/boxen": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/boxen/-/boxen-5.1.2.tgz",
-      "integrity": "sha512-9gYgQKXx+1nP8mP7CzFyaUARhg7D3n1dF/FnErWmu9l6JvGpNUN278h0aSb+QjoiKSWG+iZ3uHrcqk0qrY9RQQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12144,8 +9351,6 @@
     },
     "node_modules/boxen/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12161,8 +9366,6 @@
     },
     "node_modules/boxen/node_modules/wrap-ansi": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12179,8 +9382,6 @@
     },
     "node_modules/brace-expansion": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12189,8 +9390,6 @@
     },
     "node_modules/braces": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "license": "MIT",
       "dependencies": {
         "fill-range": "^7.1.1"
@@ -12201,15 +9400,11 @@
     },
     "node_modules/brorand": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/brorand/-/brorand-1.1.0.tgz",
-      "integrity": "sha512-cKV8tMCEpQs4hK/ik71d6LrPOnpkpGBR0wzxqr68g2m/LB2GxVYQroAjMJZRVM1Y4BCjCKc3vAamxSzOY2RP+w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/browser-pack": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/browser-pack/-/browser-pack-6.1.0.tgz",
-      "integrity": "sha512-erYug8XoqzU3IfcU8fUgyHqyOXqIE4tUTTQ+7mqUjQlvnXkOO6OlT9c/ZoJVHYoAaqGxr09CN53G7XIsO4KtWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12226,8 +9421,6 @@
     },
     "node_modules/browser-resolve": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/browser-resolve/-/browser-resolve-2.0.0.tgz",
-      "integrity": "sha512-7sWsQlYL2rGLy2IWm8WL8DCTJvYLc/qlOnsakDac87SOoCd16WLsaAMdCiAqsTNHIe+SXfaqyxyo6THoWqs8WQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12236,8 +9429,6 @@
     },
     "node_modules/browserify": {
       "version": "16.5.2",
-      "resolved": "https://registry.npmjs.org/browserify/-/browserify-16.5.2.tgz",
-      "integrity": "sha512-TkOR1cQGdmXU9zW4YukWzWVSJwrxmNdADFbqbE3HFgQWe5wqZmOawqZ7J/8MPCwk/W8yY7Y0h+7mOtcZxLP23g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12299,8 +9490,6 @@
     },
     "node_modules/browserify-aes": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/browserify-aes/-/browserify-aes-1.2.0.tgz",
-      "integrity": "sha512-+7CHXqGuspUn/Sl5aO7Ea0xWGAtETPXNSAjHo48JfLdPWcMng33Xe4znFvQweqc/uzk5zSOI3H52CYnjCfb5hA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12314,8 +9503,6 @@
     },
     "node_modules/browserify-cipher": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/browserify-cipher/-/browserify-cipher-1.0.1.tgz",
-      "integrity": "sha512-sPhkz0ARKbf4rRQt2hTpAHqn47X3llLkUGn+xEJzLjwY8LRs2p0v7ljvI5EyoRO/mexrNunNECisZs+gw2zz1w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12326,8 +9513,6 @@
     },
     "node_modules/browserify-des": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/browserify-des/-/browserify-des-1.0.2.tgz",
-      "integrity": "sha512-BioO1xf3hFwz4kc6iBhI3ieDFompMhrMlnDFC4/0/vd5MokpuAc3R+LYbwTA9A5Yc9pq9UYPqffKpW2ObuwX5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12339,8 +9524,6 @@
     },
     "node_modules/browserify-rsa": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/browserify-rsa/-/browserify-rsa-4.1.1.tgz",
-      "integrity": "sha512-YBjSAiTqM04ZVei6sXighu679a3SqWORA3qZTEqZImnlkDIFtKc6pNutpjyZ8RJTjQtuYfeetkxM11GwoYXMIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12354,8 +9537,6 @@
     },
     "node_modules/browserify-sign": {
       "version": "4.2.5",
-      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.5.tgz",
-      "integrity": "sha512-C2AUdAJg6rlM2W5QMp2Q4KGQMVBwR1lIimTsUnutJ8bMpW5B52pGpR2gEnNBNwijumDo5FojQ0L9JrXA8m4YEw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12375,8 +9556,6 @@
     },
     "node_modules/browserify-zlib": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/browserify-zlib/-/browserify-zlib-0.2.0.tgz",
-      "integrity": "sha512-Z942RysHXmJrhqk88FmKBVq/v5tqmSkDz7p54G/MGyjMnCFFnC79XWNbg+Vta8W6Wb2qtSZTSxIGkJrRpCFEiA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12385,8 +9564,6 @@
     },
     "node_modules/browserify/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12396,9 +9573,6 @@
     },
     "node_modules/browserify/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12418,8 +9592,6 @@
     },
     "node_modules/browserify/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12431,8 +9603,6 @@
     },
     "node_modules/browserify/node_modules/stream-browserify": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-2.0.2.tgz",
-      "integrity": "sha512-nX6hmklHs/gr2FuxYDltq8fJA1GDlxKQCz8O/IM4atRqBH8OORmBNgfvW5gG10GT/qQ9u0CzIvr2X5Pkt6ntqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12442,8 +9612,6 @@
     },
     "node_modules/browserify/node_modules/timers-browserify": {
       "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/timers-browserify/-/timers-browserify-1.4.2.tgz",
-      "integrity": "sha512-PIxwAupJZiYU4JmVZYwXp9FKsHMXb5h0ZEFyuXTAn8WLHOlcij+FEcbrvDsom1o5dr1YggEtFbECvGCW2sT53Q==",
       "dev": true,
       "dependencies": {
         "process": "~0.11.0"
@@ -12454,8 +9622,6 @@
     },
     "node_modules/browserslist": {
       "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
       "funding": [
         {
           "type": "opencollective",
@@ -12487,8 +9653,6 @@
     },
     "node_modules/bs-logger": {
       "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/bs-logger/-/bs-logger-0.2.6.tgz",
-      "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12500,8 +9664,6 @@
     },
     "node_modules/bser": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -12510,8 +9672,6 @@
     },
     "node_modules/buffer": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.2.1.tgz",
-      "integrity": "sha512-c+Ko0loDaFfuPWiL02ls9Xd3GO3cPVmUobQ6t3rXNUk304u6hGq+8N/kFi+QEIKhzK3uwolVhLzszmfLmMLnqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12521,8 +9681,6 @@
     },
     "node_modules/buffer-crc32": {
       "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12531,22 +9689,16 @@
     },
     "node_modules/buffer-from": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/buffer-xor": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/buffer-xor/-/buffer-xor-1.0.3.tgz",
-      "integrity": "sha512-571s0T7nZWK6vB67HI5dyUF7wXiNcfaPPPTl6zYCNApANjIvYJTg7hlud/+cJpdAhS7dVzqMLmfhfHR3rAcOjQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/buffers": {
       "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/buffers/-/buffers-0.1.1.tgz",
-      "integrity": "sha512-9q/rDEGSb/Qsvv2qvzIzdluL5k7AaJOTrw23z9reQthrbF7is4CtlT0DXyO1oei2DCp4uojjzQ7igaSHp1kAEQ==",
       "dev": true,
       "engines": {
         "node": ">=0.2.0"
@@ -12554,15 +9706,11 @@
     },
     "node_modules/builtin-status-codes": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/builtin-status-codes/-/builtin-status-codes-3.0.0.tgz",
-      "integrity": "sha512-HpGFw18DgFWlncDfjTa2rcQ4W88O1mC8e8yZ2AvQY5KDaktSTwo+KRf6nHK6FRI5FyRyb/5T6+TSxfP7QyGsmQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/bundle-name": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-4.1.0.tgz",
-      "integrity": "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12577,8 +9725,6 @@
     },
     "node_modules/bytes": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12587,8 +9733,6 @@
     },
     "node_modules/cacache": {
       "version": "19.0.1",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
-      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12611,8 +9755,6 @@
     },
     "node_modules/cacache/node_modules/@isaacs/cliui": {
       "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12629,8 +9771,6 @@
     },
     "node_modules/cacache/node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12642,8 +9782,6 @@
     },
     "node_modules/cacache/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12655,8 +9793,6 @@
     },
     "node_modules/cacache/node_modules/chownr": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -12665,16 +9801,11 @@
     },
     "node_modules/cacache/node_modules/emoji-regex": {
       "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cacache/node_modules/glob": {
       "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12694,8 +9825,6 @@
     },
     "node_modules/cacache/node_modules/jackspeak": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -12710,15 +9839,11 @@
     },
     "node_modules/cacache/node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/cacache/node_modules/path-scurry": {
       "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -12734,8 +9859,6 @@
     },
     "node_modules/cacache/node_modules/string-width": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12752,8 +9875,6 @@
     },
     "node_modules/cacache/node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12768,8 +9889,6 @@
     },
     "node_modules/cacache/node_modules/tar": {
       "version": "7.5.15",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
-      "integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -12785,8 +9904,6 @@
     },
     "node_modules/cacache/node_modules/wrap-ansi": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12803,8 +9920,6 @@
     },
     "node_modules/cacache/node_modules/yallist": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -12813,8 +9928,6 @@
     },
     "node_modules/cacheable": {
       "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.3.5.tgz",
-      "integrity": "sha512-EQfaKe09tl615iNvq/TBRWTFf1AKJNXYQSsMx0Z3EI0nA+pVsVPS8wJhnRlkbdacKPh1d0qVIhwTc2zsQNFEEg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12827,8 +9940,6 @@
     },
     "node_modules/cacheable-lookup": {
       "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-5.0.4.tgz",
-      "integrity": "sha512-2/kNscPhpcxrOigMZzbiWF7dz8ilhb/nIHU3EyZiXWXpeq/au8qJ8VhdftMkty3n7Gj6HIGalQG8oiBNB3AJgA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12837,8 +9948,6 @@
     },
     "node_modules/cacheable-request": {
       "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-7.0.4.tgz",
-      "integrity": "sha512-v+p6ongsrp0yTGbJXjgxPow2+DL93DASP4kXCDKb8/bwRtt9OEF3whggkkDkGNzgcWy2XaF4a8nZglC7uElscg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12856,8 +9965,6 @@
     },
     "node_modules/cacheable/node_modules/keyv": {
       "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
-      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12866,15 +9973,11 @@
     },
     "node_modules/cached-path-relative": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/cached-path-relative/-/cached-path-relative-1.1.0.tgz",
-      "integrity": "sha512-WF0LihfemtesFcJgO7xfOoOcnWzY/QHR4qeDqV44jPU3HTI54+LnfXK3SA27AVVGCdZFgjjFFaqUA9Jx7dMJZA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cachedir": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/cachedir/-/cachedir-2.4.0.tgz",
-      "integrity": "sha512-9EtFOZR8g22CL7BWjJ9BUx1+A/djkofnyW3aOXZORNW2kxoUpx2h+uN2cOqwPmFhnpVmxg+KW2OjOSgChTEvsQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12883,8 +9986,6 @@
     },
     "node_modules/call-bind": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz",
-      "integrity": "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12902,8 +10003,6 @@
     },
     "node_modules/call-bind-apply-helpers": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12916,8 +10015,6 @@
     },
     "node_modules/call-bound": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12933,8 +10030,6 @@
     },
     "node_modules/callsite": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/callsite/-/callsite-1.0.0.tgz",
-      "integrity": "sha512-0vdNRFXn5q+dtOqjfFtmtlI9N2eVZ7LMyEV2iKC5mEEFvSg/69Ml6b/WU2qF8W1nLRa0wiSrDT3Y5jOHZCwKPQ==",
       "dev": true,
       "engines": {
         "node": "*"
@@ -12942,8 +10037,6 @@
     },
     "node_modules/callsites": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12952,8 +10045,6 @@
     },
     "node_modules/camelcase": {
       "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
-      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12965,8 +10056,6 @@
     },
     "node_modules/caniuse-lite": {
       "version": "1.0.30001793",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz",
-      "integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==",
       "funding": [
         {
           "type": "opencollective",
@@ -12985,8 +10074,6 @@
     },
     "node_modules/carbon-components-angular": {
       "version": "5.59.2",
-      "resolved": "https://registry.npmjs.org/carbon-components-angular/-/carbon-components-angular-5.59.2.tgz",
-      "integrity": "sha512-afu0MsU4rNO2J4mMhN9HhsX4epDnep6ru/n1Ll3FJ6o+s2WFBfGYmht/I8L/0PgGl8IFUJz3Ie/WvTXiFr0A+g==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -13005,8 +10092,6 @@
     },
     "node_modules/carbon-components-angular/node_modules/@carbon/icons": {
       "version": "11.58.0",
-      "resolved": "https://registry.npmjs.org/@carbon/icons/-/icons-11.58.0.tgz",
-      "integrity": "sha512-ArqDWsH7AZg2oenQX3PS1GK0HW5mRCAkIt2Yx1eucKXIi9tlAROmEZLDkU4FSSipNU8wa+Yncu2oAPOg7p7qMg==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -13015,33 +10100,23 @@
     },
     "node_modules/carbon-components-angular/node_modules/@carbon/utils-position": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@carbon/utils-position/-/utils-position-1.1.4.tgz",
-      "integrity": "sha512-/01kFPKr+wD2pPd5Uck2gElm3K/+eNxX7lEn2j1NKzzE4+eSZXDfQtLR/UHcvOSgkP+Av42LET6B9h9jXGV+HA==",
       "license": "MIT"
     },
     "node_modules/carbon-components-angular/node_modules/lodash-es": {
       "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.21.tgz",
-      "integrity": "sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw==",
       "license": "MIT"
     },
     "node_modules/carbon-components-angular/node_modules/tslib": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.3.0.tgz",
-      "integrity": "sha512-N82ooyxVNm6h1riLCoyS9e3fuJ3AMG2zIZs2Gd1ATcSFjSA23Q0fzjjZeh0jbJvWVDZ0cJT8yaNNaaXHzueNjg==",
       "license": "0BSD"
     },
     "node_modules/caseless": {
       "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz",
-      "integrity": "sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/chai": {
       "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-4.5.0.tgz",
-      "integrity": "sha512-RITGBfijLkBddZvnn8jdqoTypxvqbOLYQkGGxXzeFjVHvudaPw0HNFD9x928/eUwYWd2dPCugVqspGALTZZQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13059,21 +10134,14 @@
     },
     "node_modules/chainsaw": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/chainsaw/-/chainsaw-0.1.0.tgz",
-      "integrity": "sha512-75kWfWt6MEKNC8xYXIdRpDehRYY/tNSgwKaJq+dbbDcxORuVrrQ+SEHoWsniVn9XPYfP4gmdWIeDk/4YNp1rNQ==",
       "dev": true,
       "license": "MIT/X11",
       "dependencies": {
         "traverse": ">=0.3.0 <0.4"
-      },
-      "engines": {
-        "node": "*"
       }
     },
     "node_modules/chalk": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
-      "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13086,8 +10154,6 @@
     },
     "node_modules/char-regex": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
-      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13096,15 +10162,11 @@
     },
     "node_modules/chardet": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/chardet/-/chardet-2.1.1.tgz",
-      "integrity": "sha512-PsezH1rqdV9VvyNhxxOW32/d75r01NY7TQCmOqomRo15ZSOKbpTFVsfjghxo6JloQUCGnH4k1LGu0R4yCLlWQQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/charenc": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/charenc/-/charenc-0.0.2.tgz",
-      "integrity": "sha512-yrLQ/yVUFXkzg7EDQsPieE/53+0RlaWTs+wBrvW36cyilJ2SaDWfl4Yj7MtLTXleV9uEKefbAGUPv2/iWSooRA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -13113,8 +10175,6 @@
     },
     "node_modules/chart.js": {
       "version": "4.4.7",
-      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.4.7.tgz",
-      "integrity": "sha512-pwkcKfdzTMAU/+jNosKhNL2bHtJc/sSmYgVbuGTEDhzkrhmyihmP7vUc/5ZK9WopidMDHNe3Wm7jOd/WhuHWuw==",
       "license": "MIT",
       "dependencies": {
         "@kurkle/color": "^0.3.0"
@@ -13125,8 +10185,6 @@
     },
     "node_modules/chartjs-adapter-moment": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/chartjs-adapter-moment/-/chartjs-adapter-moment-1.0.1.tgz",
-      "integrity": "sha512-Uz+nTX/GxocuqXpGylxK19YG4R3OSVf8326D+HwSTsNw1LgzyIGRo+Qujwro1wy6X+soNSnfj5t2vZ+r6EaDmA==",
       "license": "MIT",
       "peerDependencies": {
         "chart.js": ">=3.0.0",
@@ -13135,8 +10193,6 @@
     },
     "node_modules/check-error": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/check-error/-/check-error-1.0.3.tgz",
-      "integrity": "sha512-iKEoDYaRmd1mxM90a2OEfWhjsjPpYPuQ+lMYsoxB126+t8fw7ySEO48nmDg5COTjxDI65/Y2OWpeEHk3ZOe8zg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13148,8 +10204,6 @@
     },
     "node_modules/check-more-types": {
       "version": "2.24.0",
-      "resolved": "https://registry.npmjs.org/check-more-types/-/check-more-types-2.24.0.tgz",
-      "integrity": "sha512-Pj779qHxV2tuapviy1bSZNEL1maXr13bPYpsvSDB68HlYcYuhlDrmGd63i0JHMCLKzc7rUSNIrpdJlhVlNwrxA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13158,8 +10212,6 @@
     },
     "node_modules/cheerio": {
       "version": "1.0.0-rc.12",
-      "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0-rc.12.tgz",
-      "integrity": "sha512-VqR8m68vM46BNnuZ5NtnGBKIE/DfN0cRIzg9n40EIq9NOv90ayxLBXA8fXC5gquFRGJSTRqBq25Jt2ECLR431Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13180,8 +10232,6 @@
     },
     "node_modules/cheerio-select": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/cheerio-select/-/cheerio-select-2.1.0.tgz",
-      "integrity": "sha512-9v9kG0LvzrlcungtnJtpGNxY+fzECQKhK4EGJX2vByejiMX84MFNQw4UxPJl3bFbTMw+Dfs37XaIkCwTZfLh4g==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -13198,8 +10248,6 @@
     },
     "node_modules/cheerio/node_modules/htmlparser2": {
       "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-8.0.2.tgz",
-      "integrity": "sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==",
       "dev": true,
       "funding": [
         "https://github.com/fb55/htmlparser2?sponsor=1",
@@ -13218,8 +10266,6 @@
     },
     "node_modules/chokidar": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
-      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13234,8 +10280,6 @@
     },
     "node_modules/chownr": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
-      "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -13244,8 +10288,6 @@
     },
     "node_modules/chrome-trace-event": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz",
-      "integrity": "sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13254,8 +10296,6 @@
     },
     "node_modules/ci-info": {
       "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
-      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
       "dev": true,
       "funding": [
         {
@@ -13270,8 +10310,6 @@
     },
     "node_modules/cipher-base": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/cipher-base/-/cipher-base-1.0.7.tgz",
-      "integrity": "sha512-Mz9QMT5fJe7bKI7MH31UilT5cEK5EHHRCccw/YRFsRY47AuNgaV6HY3rscp0/I4Q+tTW/5zoqpSeRRI54TkDWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13285,15 +10323,11 @@
     },
     "node_modules/cjs-module-lexer": {
       "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.4.3.tgz",
-      "integrity": "sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/clean-stack": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
-      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13302,8 +10336,6 @@
     },
     "node_modules/cli-boxes": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-2.2.1.tgz",
-      "integrity": "sha512-y4coMcylgSCdVinjiDBuR8PCC2bLjyGTwEmPb9NHR/QaNU6EUOXcTY/s6VjGMD6ENSEaeQYHCY0GNGS5jfMwPw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13315,8 +10347,6 @@
     },
     "node_modules/cli-cursor": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13328,8 +10358,6 @@
     },
     "node_modules/cli-spinners": {
       "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
-      "integrity": "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13341,8 +10369,6 @@
     },
     "node_modules/cli-table": {
       "version": "0.3.11",
-      "resolved": "https://registry.npmjs.org/cli-table/-/cli-table-0.3.11.tgz",
-      "integrity": "sha512-IqLQi4lO0nIB4tcdTpN4LCB9FI3uqrJZK7RC515EnhZ6qBaglkIgICb1wjeAqpdoOabm1+SuQtkXIPdYC93jhQ==",
       "dev": true,
       "dependencies": {
         "colors": "1.0.3"
@@ -13353,8 +10379,6 @@
     },
     "node_modules/cli-table/node_modules/colors": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/colors/-/colors-1.0.3.tgz",
-      "integrity": "sha512-pFGrxThWcWQ2MsAz6RtgeWe4NK2kUE1WfsrvvlctdII745EW9I0yflqhe7++M5LEc7bV2c/9/5zc8sFcpL0Drw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13363,8 +10387,6 @@
     },
     "node_modules/cli-table3": {
       "version": "0.6.5",
-      "resolved": "https://registry.npmjs.org/cli-table3/-/cli-table3-0.6.5.tgz",
-      "integrity": "sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13379,8 +10401,6 @@
     },
     "node_modules/cli-truncate": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-4.0.0.tgz",
-      "integrity": "sha512-nPdaFdQ0h/GEigbPClz11D0v/ZJEwxmeVZGeMo3Z5StPtUTkA9o1lD6QwoirYiSDzbcwn2XcjwmCp68W1IS4TA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13396,8 +10416,6 @@
     },
     "node_modules/cli-truncate/node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13409,15 +10427,11 @@
     },
     "node_modules/cli-truncate/node_modules/emoji-regex": {
       "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
-      "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cli-truncate/node_modules/string-width": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13434,8 +10448,6 @@
     },
     "node_modules/cli-truncate/node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13450,8 +10462,6 @@
     },
     "node_modules/cli-width": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/cli-width/-/cli-width-4.1.0.tgz",
-      "integrity": "sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -13460,8 +10470,6 @@
     },
     "node_modules/cliui": {
       "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
       "license": "ISC",
       "dependencies": {
         "string-width": "^4.2.0",
@@ -13474,8 +10482,6 @@
     },
     "node_modules/cliui/node_modules/wrap-ansi": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "license": "MIT",
       "dependencies": {
         "ansi-styles": "^4.0.0",
@@ -13491,8 +10497,6 @@
     },
     "node_modules/clone": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
-      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13501,8 +10505,6 @@
     },
     "node_modules/clone-deep": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-4.0.1.tgz",
-      "integrity": "sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13516,8 +10518,6 @@
     },
     "node_modules/clone-deep/node_modules/is-plain-object": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
-      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13529,8 +10529,6 @@
     },
     "node_modules/clone-response": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/clone-response/-/clone-response-1.0.3.tgz",
-      "integrity": "sha512-ROoL94jJH2dUVML2Y/5PEDNaSHgeOdSDicUyS7izcF63G6sTc/FTjLub4b8Il9S8S0beOfYt0TaA5qvFK+w0wA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13542,8 +10540,6 @@
     },
     "node_modules/co": {
       "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
-      "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13553,15 +10549,11 @@
     },
     "node_modules/code-block-writer": {
       "version": "13.0.3",
-      "resolved": "https://registry.npmjs.org/code-block-writer/-/code-block-writer-13.0.3.tgz",
-      "integrity": "sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/coffeeify": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/coffeeify/-/coffeeify-3.0.1.tgz",
-      "integrity": "sha512-Qjnr7UX6ldK1PHV7wCnv7AuCd4q19KTUtwJnu/6JRJB4rfm12zvcXtKdacUoePOKr1I4ka/ydKiwWpNAdsQb0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13574,8 +10566,6 @@
     },
     "node_modules/coffeescript": {
       "version": "1.12.7",
-      "resolved": "https://registry.npmjs.org/coffeescript/-/coffeescript-1.12.7.tgz",
-      "integrity": "sha512-pLXHFxQMPklVoEekowk8b3erNynC+DVJzChxS/LCBBgR6/8AJkHivkm//zbowcfc7BTCAjryuhx6gPqPRfsFoA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -13588,15 +10578,11 @@
     },
     "node_modules/collect-v8-coverage": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz",
-      "integrity": "sha512-1L5aqIkwPfiodaMgQunkF1zRhNqifHBmtbbbxcr6yVxxBnliw4TDOW6NxpO8DJLgJ16OT+Y4ztZqP6p/FtXnAw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/color": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/color/-/color-4.2.3.tgz",
-      "integrity": "sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==",
       "license": "MIT",
       "dependencies": {
         "color-convert": "^2.0.1",
@@ -13608,8 +10594,6 @@
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -13620,14 +10604,10 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
     "node_modules/color-string": {
       "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/color-string/-/color-string-1.9.1.tgz",
-      "integrity": "sha512-shrVawQFojnZv6xM40anx4CkoDP+fZsw/ZerEMsW/pyzsRbElpsL/DBVW7q3ExxwusdNXI3lXpuhEZkzs8p5Eg==",
       "license": "MIT",
       "dependencies": {
         "color-name": "^1.0.0",
@@ -13636,8 +10616,6 @@
     },
     "node_modules/color-support": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-support/-/color-support-1.1.3.tgz",
-      "integrity": "sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -13646,22 +10624,16 @@
     },
     "node_modules/colord": {
       "version": "2.9.3",
-      "resolved": "https://registry.npmjs.org/colord/-/colord-2.9.3.tgz",
-      "integrity": "sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/colorette": {
       "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/colors": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/colors/-/colors-1.4.0.tgz",
-      "integrity": "sha512-a+UqTh4kgZg/SlGvfbzDHpgRu7AAQOmmqRHJnxhRZICKFUT91brVhNNt58CMWU9PsBbv3PDCZUHbVxuDiH2mtA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13670,8 +10642,6 @@
     },
     "node_modules/combine-source-map": {
       "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/combine-source-map/-/combine-source-map-0.8.0.tgz",
-      "integrity": "sha512-UlxQ9Vw0b/Bt/KYwCFqdEwsQ1eL8d1gibiFb7lxQJFdvTgc2hIZi6ugsg+kyhzhPV+QEpUiEIwInIAIrgoEkrg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13683,15 +10653,11 @@
     },
     "node_modules/combine-source-map/node_modules/convert-source-map": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.1.3.tgz",
-      "integrity": "sha512-Y8L5rp6jo+g9VEPgvqNfEopjTR4OTYct8lXlS8iVQdmnjDvbdbzYe9rjtFCB9egC86JoNCU61WRY+ScjkZpnIg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/combine-source-map/node_modules/source-map": {
       "version": "0.5.7",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-      "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -13700,8 +10666,6 @@
     },
     "node_modules/combined-stream": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13713,8 +10677,6 @@
     },
     "node_modules/commander": {
       "version": "12.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
-      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13723,15 +10685,11 @@
     },
     "node_modules/common-path-prefix": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/common-path-prefix/-/common-path-prefix-3.0.0.tgz",
-      "integrity": "sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/common-tags": {
       "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/common-tags/-/common-tags-1.8.2.tgz",
-      "integrity": "sha512-gk/Z852D2Wtb//0I+kRFNKKE9dIIVirjoqPoA1wJU+XePVXZfGeBpk45+A1rKO4Q43prqWBNY/MiIeRLbPWUaA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13740,8 +10698,6 @@
     },
     "node_modules/compressible": {
       "version": "2.0.18",
-      "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
-      "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13753,8 +10709,6 @@
     },
     "node_modules/compression": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
-      "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13772,8 +10726,6 @@
     },
     "node_modules/compression/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13782,15 +10734,11 @@
     },
     "node_modules/compression/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/compression/node_modules/negotiator": {
       "version": "0.6.4",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
-      "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13799,15 +10747,11 @@
     },
     "node_modules/concat-map": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/concat-stream": {
       "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
-      "integrity": "sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==",
       "dev": true,
       "engines": [
         "node >= 0.8"
@@ -13822,8 +10766,6 @@
     },
     "node_modules/connect": {
       "version": "3.7.0",
-      "resolved": "https://registry.npmjs.org/connect/-/connect-3.7.0.tgz",
-      "integrity": "sha512-ZqRXc+tZukToSNmh5C2iWMSoV3X1YUcPbqEM4DkEG5tNQXrQUZCNVGGv3IuicnkMtPfGf3Xtp8WCXs295iQ1pQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13838,8 +10780,6 @@
     },
     "node_modules/connect-history-api-fallback": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/connect-history-api-fallback/-/connect-history-api-fallback-2.0.0.tgz",
-      "integrity": "sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13848,8 +10788,6 @@
     },
     "node_modules/connect/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13858,28 +10796,20 @@
     },
     "node_modules/connect/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/console-browserify": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/console-browserify/-/console-browserify-1.2.0.tgz",
-      "integrity": "sha512-ZMkYO/LkF17QvCPqM0gxw8yUzigAOZOSWSHg91FH6orS7vcEj5dVZTidN2fQ14yBSdg97RqhSNwLUXInd52OTA==",
       "dev": true
     },
     "node_modules/constants-browserify": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/constants-browserify/-/constants-browserify-1.0.0.tgz",
-      "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/content-disposition": {
       "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
-      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13891,8 +10821,6 @@
     },
     "node_modules/content-type": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13901,15 +10829,11 @@
     },
     "node_modules/convert-source-map": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cookie": {
       "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13918,15 +10842,11 @@
     },
     "node_modules/cookie-signature": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
-      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/copy-anything": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/copy-anything/-/copy-anything-2.0.6.tgz",
-      "integrity": "sha512-1j20GZTsvKNkc4BY3NpMOM8tt///wY3FpIzozTOFO2ffuZcV61nojHXVKIy3WM+7ADCy5FVhdZYHYDdgTU0yJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13938,8 +10858,6 @@
     },
     "node_modules/copy-webpack-plugin": {
       "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-12.0.2.tgz",
-      "integrity": "sha512-SNwdBeHyII+rWvee/bTnAYyO8vfVdcSTud4EIb6jcZ8inLeWucJE0DnxXQBjlQ5zlteuuvooGQy3LIyGxhvlOA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13963,17 +10881,12 @@
     },
     "node_modules/core-js": {
       "version": "2.6.12",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-2.6.12.tgz",
-      "integrity": "sha512-Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==",
-      "deprecated": "core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT"
     },
     "node_modules/core-js-compat": {
       "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.49.0.tgz",
-      "integrity": "sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13986,8 +10899,6 @@
     },
     "node_modules/core-util-is": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -14011,8 +10922,6 @@
     },
     "node_modules/cosmiconfig": {
       "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-9.0.1.tgz",
-      "integrity": "sha512-hr4ihw+DBqcvrsEDioRO31Z17x71pUYoNe/4h6Z0wB72p7MU7/9gH8Q3s12NFhHPfYBBOV3qyfUxmr/Yn3shnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14038,8 +10947,6 @@
     },
     "node_modules/create-ecdh": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/create-ecdh/-/create-ecdh-4.0.4.tgz",
-      "integrity": "sha512-mf+TCx8wWc9VpuxfP2ht0iSISLZnt0JgWlrOKZiNqyUZWnjIaCIVNQArMHnCZKfEYRg6IM7A+NeJoN8gf/Ws0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14049,15 +10956,11 @@
     },
     "node_modules/create-ecdh/node_modules/bn.js": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
-      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/create-hash": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/create-hash/-/create-hash-1.2.0.tgz",
-      "integrity": "sha512-z00bCGNHDG8mHAkP7CtT1qVu+bFQUPjYq/4Iv3C3kWjTFV10zIjfSoeqXo9Asws8gwSHDGj/hl2u4OGIjapeCg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14070,8 +10973,6 @@
     },
     "node_modules/create-hmac": {
       "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/create-hmac/-/create-hmac-1.1.7.tgz",
-      "integrity": "sha512-MJG9liiZ+ogc4TzUwuvbER1JRdgvUFSB5+VR/g5h82fGaIRWMWddtKBHi7/sVhfjQZ6SehlyhvQYrcYkaUIpLg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14085,8 +10986,6 @@
     },
     "node_modules/create-jest": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/create-jest/-/create-jest-29.7.0.tgz",
-      "integrity": "sha512-Adz2bdH0Vq3F53KEMJOoftQFutWCukm6J24wbPWRO4k1kMY7gS7ds/uoJkNuV8wDCtWWnuwGcJwpWcih+zEW1Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14107,8 +11006,6 @@
     },
     "node_modules/create-jest/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14124,15 +11021,11 @@
     },
     "node_modules/create-require": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/create-require/-/create-require-1.1.1.tgz",
-      "integrity": "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14146,8 +11039,6 @@
     },
     "node_modules/crypt": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/crypt/-/crypt-0.0.2.tgz",
-      "integrity": "sha512-mCxBlsHFYh9C+HVpiEacem8FEBnMXgU9gy4zmNC+SXAZNB/1idgp/aulFJ4FgCi7GPEVbfyng092GqL2k2rmow==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -14156,8 +11047,6 @@
     },
     "node_modules/crypto-browserify": {
       "version": "3.12.1",
-      "resolved": "https://registry.npmjs.org/crypto-browserify/-/crypto-browserify-3.12.1.tgz",
-      "integrity": "sha512-r4ESw/IlusD17lgQi1O20Fa3qNnsckR126TdUuBgAu7GBYSIPvdNyONd3Zrxh0xCwA4+6w/TDArBPsMvhur+KQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14183,8 +11072,6 @@
     },
     "node_modules/css-functions-list": {
       "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/css-functions-list/-/css-functions-list-3.3.3.tgz",
-      "integrity": "sha512-8HFEBPKhOpJPEPu70wJJetjKta86Gw9+CCyCnB3sui2qQfOvRyqBy4IKLKKAwdMpWb2lHXWk9Wb4Z6AmaUT1Pg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14193,8 +11080,6 @@
     },
     "node_modules/css-loader": {
       "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-7.1.2.tgz",
-      "integrity": "sha512-6WvYYn7l/XEGN8Xu2vWFt9nVzrCn39vKyTEFf/ExEyoksJjjSZV/0/35XPlMbpnr6VGhZIUg5yJrL8tGfes/FA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14229,8 +11114,6 @@
     },
     "node_modules/css-select": {
       "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.2.2.tgz",
-      "integrity": "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -14246,8 +11129,6 @@
     },
     "node_modules/css-tree": {
       "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
-      "integrity": "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14260,15 +11141,11 @@
     },
     "node_modules/css-tree/node_modules/mdn-data": {
       "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
-      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
       "dev": true,
       "license": "CC0-1.0"
     },
     "node_modules/css-tree/node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -14277,8 +11154,6 @@
     },
     "node_modules/css-what": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.2.2.tgz",
-      "integrity": "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -14290,8 +11165,6 @@
     },
     "node_modules/cssesc": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -14303,22 +11176,16 @@
     },
     "node_modules/cssfontparser": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/cssfontparser/-/cssfontparser-1.2.1.tgz",
-      "integrity": "sha512-6tun4LoZnj7VN6YeegOVb67KBX/7JJsqvj+pv3ZA7F878/eN33AbGa5b/S/wXxS/tcp8nc40xRUrsPlxIyNUPg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cssom": {
       "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.5.0.tgz",
-      "integrity": "sha512-iKuQcq+NdHqlAcwUY0o/HL69XQrUaQdMjmStJ8JFmUaiiQErlhrmuigkg/CU4E2J0IyUKUrMAgl36TvN67MqTw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cssstyle": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-2.3.0.tgz",
-      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14330,16 +11197,11 @@
     },
     "node_modules/cssstyle/node_modules/cssom": {
       "version": "0.3.8",
-      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz",
-      "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cucumber": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/cucumber/-/cucumber-4.2.1.tgz",
-      "integrity": "sha512-3gQ0Vv4kSHsvXEFC6b1c+TfLRDzWD1/kU7e5vm8Kh8j35b95k6favan9/4ixcBNqd7UsU1T6FYcawC87+DlNKw==",
-      "deprecated": "Cucumber is publishing new releases under @cucumber/cucumber",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14381,9 +11243,6 @@
     },
     "node_modules/cucumber-expressions": {
       "version": "6.6.2",
-      "resolved": "https://registry.npmjs.org/cucumber-expressions/-/cucumber-expressions-6.6.2.tgz",
-      "integrity": "sha512-WcFSVBiWNLJbIcAAC3t/ACU46vaOKfe1UIF5H3qveoq+Y4XQm9j3YwHurQNufRKBBg8nCnpU7Ttsx7egjS3hwA==",
-      "deprecated": "This package is now published under @cucumber/cucumber-expressions",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14392,9 +11251,6 @@
     },
     "node_modules/cucumber-messages": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/cucumber-messages/-/cucumber-messages-8.0.0.tgz",
-      "integrity": "sha512-lUnWRMjwA9+KhDec/5xRZV3Du67ISumHnVLywWQXyvzmc4P+Eqx8CoeQrBQoau3Pw1hs4kJLTDyV85hFBF00SQ==",
-      "deprecated": "This package is now published under @cucumber/messages",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14405,9 +11261,6 @@
     },
     "node_modules/cucumber-messages/node_modules/uuid": {
       "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -14416,16 +11269,11 @@
     },
     "node_modules/cucumber-tag-expressions": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/cucumber-tag-expressions/-/cucumber-tag-expressions-1.1.1.tgz",
-      "integrity": "sha512-V9jv81sR/HaJ87FoidrvHkviXId7KmBcUi7aQPfi+W3nRO30N6GqH6lcp8K+nyiT1DgemRJBPDDeBMS93xJqMQ==",
-      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cucumber/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14435,16 +11283,11 @@
     },
     "node_modules/cucumber/node_modules/commander": {
       "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cucumber/node_modules/cucumber-expressions": {
       "version": "5.0.18",
-      "resolved": "https://registry.npmjs.org/cucumber-expressions/-/cucumber-expressions-5.0.18.tgz",
-      "integrity": "sha512-cj9UKCEvsB7bN97THmowcZt8I3rYFbTAFBNeDpKmWW3vr43CLZeWBmbk7NlHijndLwPJ7+uiF72xWrRU+RLyZA==",
-      "deprecated": "This package is now published under @cucumber/cucumber-expressions",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -14454,8 +11297,6 @@
     },
     "node_modules/cucumber/node_modules/figures": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/figures/-/figures-2.0.0.tgz",
-      "integrity": "sha512-Oa2M9atig69ZkfwiApY8F2Yy+tzMbazyvqv21R0NsSC8floSOC09BbT1ITWAdoMGQvJ/aZnR1KMwdx9tvHnTNA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14467,9 +11308,6 @@
     },
     "node_modules/cucumber/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -14489,8 +11327,6 @@
     },
     "node_modules/cucumber/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -14502,8 +11338,6 @@
     },
     "node_modules/cypress": {
       "version": "12.17.4",
-      "resolved": "https://registry.npmjs.org/cypress/-/cypress-12.17.4.tgz",
-      "integrity": "sha512-gAN8Pmns9MA5eCDFSDJXWKUpaL3IDd89N9TtIupjYnzLSmlpVr+ZR+vb4U/qaMp+lB6tBvAmt7504c3Z4RU5KQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -14561,8 +11395,6 @@
     },
     "node_modules/cypress-axe": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/cypress-axe/-/cypress-axe-1.5.0.tgz",
-      "integrity": "sha512-Hy/owCjfj+25KMsecvDgo4fC/781ccL+e8p+UUYoadGVM2ogZF9XIKbiM6KI8Y3cEaSreymdD6ZzccbI2bY0lQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14575,8 +11407,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/cypress-cucumber-preprocessor/-/cypress-cucumber-preprocessor-4.3.1.tgz",
-      "integrity": "sha512-BKUYXqoTeKzkPXohEczDtpAwRCY0ZPtIpfRwJut16yNLqdXQMV+aItwanxe3cbJTFlwg562NAjL4LMdiOhkAjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14601,8 +11431,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/argparse": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14611,8 +11439,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14622,8 +11448,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/chokidar": {
       "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.2.tgz",
-      "integrity": "sha512-ekGhOnNVPgT77r4K/U3GDhu+FQ2S8TnK/s2KbIGXi0SZWuwkZ2QNyfWdZW+TVfn84DpEP7rLeCt2UI6bJ8GwbQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14644,8 +11468,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/cosmiconfig": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-4.0.0.tgz",
-      "integrity": "sha512-6e5vDdrXZD+t5v0L8CrurPeybg4Fmf+FCSYxXKYVAqLUtyCSbuyqE059d0kDthTNRzKVjL7QMgNpEUlsoYH3iQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14660,8 +11482,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/debug": {
       "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14670,9 +11490,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -14692,8 +11509,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -14705,8 +11520,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/js-yaml": {
       "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14719,8 +11532,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -14732,8 +11543,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/parse-json": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz",
-      "integrity": "sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14746,8 +11555,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14759,8 +11566,6 @@
     },
     "node_modules/cypress-cucumber-preprocessor/node_modules/readdirp": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14772,8 +11577,6 @@
     },
     "node_modules/cypress-iframe": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/cypress-iframe/-/cypress-iframe-1.0.1.tgz",
-      "integrity": "sha512-Ne+xkZmWMhfq3x6wbfzK/SzsVTCrJru3R3cLXsoSAZyfUtJDamXyaIieHXeea3pQDXF4wE2w4iUuvCYHhoD31g==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -14782,8 +11585,6 @@
     },
     "node_modules/cypress-multi-reporters": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/cypress-multi-reporters/-/cypress-multi-reporters-1.5.0.tgz",
-      "integrity": "sha512-6rJ1rk1RpjZwTeydCDc8r3iOmWj2ZEYo++oDTJHNEu7eetb3W1cYDNo5CdxF/r0bo7TLQsOEpBHOCYBZfPVt/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14799,15 +11600,11 @@
     },
     "node_modules/cypress/node_modules/@types/node": {
       "version": "16.18.126",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.126.tgz",
-      "integrity": "sha512-OTcgaiwfGFBKacvfwuHzzn1KLxH/er8mluiy8/uM3sGXHaRe73RrSIj01jow9t4kJEW633Ov+cOexXeiApTyAw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/cypress/node_modules/buffer": {
       "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
       "dev": true,
       "funding": [
         {
@@ -14831,8 +11628,6 @@
     },
     "node_modules/cypress/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14848,8 +11643,6 @@
     },
     "node_modules/cypress/node_modules/chalk/node_modules/supports-color": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14861,8 +11654,6 @@
     },
     "node_modules/cypress/node_modules/cli-truncate": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-2.1.0.tgz",
-      "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14878,8 +11669,6 @@
     },
     "node_modules/cypress/node_modules/commander": {
       "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-6.2.1.tgz",
-      "integrity": "sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14888,8 +11677,6 @@
     },
     "node_modules/cypress/node_modules/fs-extra": {
       "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14904,8 +11691,6 @@
     },
     "node_modules/cypress/node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -14914,8 +11699,6 @@
     },
     "node_modules/cypress/node_modules/listr2": {
       "version": "3.14.0",
-      "resolved": "https://registry.npmjs.org/listr2/-/listr2-3.14.0.tgz",
-      "integrity": "sha512-TyWI8G99GX9GjE54cJ+RrNMcIFBfwMPxc3XTFiAYGN4s10hWROGtOg7+O6u6LE3mNkyld7RSLE6nrKBvTfcs3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14942,8 +11725,6 @@
     },
     "node_modules/cypress/node_modules/listr2/node_modules/wrap-ansi": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14960,8 +11741,6 @@
     },
     "node_modules/cypress/node_modules/log-update": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/log-update/-/log-update-4.0.0.tgz",
-      "integrity": "sha512-9fkkDevMefjg0mmzWFBW8YkFP91OrizzkW3diF7CpG+S2EYdy4+TVfGwz1zeF8x7hCx1ovSPTOE9Ngib74qqUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14979,8 +11758,6 @@
     },
     "node_modules/cypress/node_modules/log-update/node_modules/slice-ansi": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz",
-      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -14997,8 +11774,6 @@
     },
     "node_modules/cypress/node_modules/p-map": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz",
-      "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15013,8 +11788,6 @@
     },
     "node_modules/cypress/node_modules/rxjs": {
       "version": "7.8.2",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
-      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -15023,8 +11796,6 @@
     },
     "node_modules/cypress/node_modules/slice-ansi": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-3.0.0.tgz",
-      "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15038,8 +11809,6 @@
     },
     "node_modules/cypress/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15054,8 +11823,6 @@
     },
     "node_modules/d": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/d/-/d-1.0.2.tgz",
-      "integrity": "sha512-MOqHvMWF9/9MX6nza0KgvFH4HpMU0EF5uUDXqX/BtxtU8NfB0QzRtJ8Oe/6SuS4kbhyzVJwjd97EA4PKrzJ8bw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -15068,8 +11835,6 @@
     },
     "node_modules/d3": {
       "version": "7.9.0",
-      "resolved": "https://registry.npmjs.org/d3/-/d3-7.9.0.tgz",
-      "integrity": "sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA==",
       "license": "ISC",
       "dependencies": {
         "d3-array": "3",
@@ -15109,8 +11874,6 @@
     },
     "node_modules/d3-array": {
       "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
-      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
       "license": "ISC",
       "dependencies": {
         "internmap": "1 - 2"
@@ -15121,8 +11884,6 @@
     },
     "node_modules/d3-axis": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-axis/-/d3-axis-3.0.0.tgz",
-      "integrity": "sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15130,8 +11891,6 @@
     },
     "node_modules/d3-brush": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-brush/-/d3-brush-3.0.0.tgz",
-      "integrity": "sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ==",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -15146,8 +11905,6 @@
     },
     "node_modules/d3-chord": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-chord/-/d3-chord-3.0.1.tgz",
-      "integrity": "sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g==",
       "license": "ISC",
       "dependencies": {
         "d3-path": "1 - 3"
@@ -15158,8 +11915,6 @@
     },
     "node_modules/d3-cloud": {
       "version": "1.2.9",
-      "resolved": "https://registry.npmjs.org/d3-cloud/-/d3-cloud-1.2.9.tgz",
-      "integrity": "sha512-leL1GLneC9ZQtnV+6TGWrNlGfI1WX7S2arcTv2vae12DaXo5wjm6GBCkskXbrDlyOymd/A75Pyj1H37MW4BZ/Q==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "d3-dispatch": "^1.0.3"
@@ -15167,14 +11922,10 @@
     },
     "node_modules/d3-cloud/node_modules/d3-dispatch": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-1.0.6.tgz",
-      "integrity": "sha512-fVjoElzjhCEy+Hbn8KygnmMS7Or0a9sI2UzGwoB7cCtvI1XpVN9GpoYlnb3xt2YV66oXYb1fLJ8GMvP4hdU1RA==",
       "license": "BSD-3-Clause"
     },
     "node_modules/d3-color": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
-      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15182,8 +11933,6 @@
     },
     "node_modules/d3-contour": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-4.0.2.tgz",
-      "integrity": "sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA==",
       "license": "ISC",
       "dependencies": {
         "d3-array": "^3.2.0"
@@ -15194,8 +11943,6 @@
     },
     "node_modules/d3-delaunay": {
       "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/d3-delaunay/-/d3-delaunay-6.0.4.tgz",
-      "integrity": "sha512-mdjtIZ1XLAM8bm/hx3WwjfHt6Sggek7qH043O8KEjDXN40xi3vx/6pYSVTwLjEgiXQTbvaouWKynLBiUZ6SK6A==",
       "license": "ISC",
       "dependencies": {
         "delaunator": "5"
@@ -15206,8 +11953,6 @@
     },
     "node_modules/d3-dispatch": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-3.0.1.tgz",
-      "integrity": "sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15215,8 +11960,6 @@
     },
     "node_modules/d3-drag": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-drag/-/d3-drag-3.0.0.tgz",
-      "integrity": "sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg==",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -15228,8 +11971,6 @@
     },
     "node_modules/d3-dsv": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-dsv/-/d3-dsv-3.0.1.tgz",
-      "integrity": "sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q==",
       "license": "ISC",
       "dependencies": {
         "commander": "7",
@@ -15253,8 +11994,6 @@
     },
     "node_modules/d3-dsv/node_modules/commander": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
-      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
       "license": "MIT",
       "engines": {
         "node": ">= 10"
@@ -15262,8 +12001,6 @@
     },
     "node_modules/d3-dsv/node_modules/iconv-lite": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -15274,8 +12011,6 @@
     },
     "node_modules/d3-ease": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
-      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=12"
@@ -15283,8 +12018,6 @@
     },
     "node_modules/d3-fetch": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-fetch/-/d3-fetch-3.0.1.tgz",
-      "integrity": "sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw==",
       "license": "ISC",
       "dependencies": {
         "d3-dsv": "1 - 3"
@@ -15295,8 +12028,6 @@
     },
     "node_modules/d3-force": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-3.0.0.tgz",
-      "integrity": "sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg==",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -15309,8 +12040,6 @@
     },
     "node_modules/d3-format": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
-      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15318,8 +12047,6 @@
     },
     "node_modules/d3-geo": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-3.1.1.tgz",
-      "integrity": "sha512-637ln3gXKXOwhalDzinUgY83KzNWZRKbYubaG+fGVuc/dxO64RRljtCTnf5ecMyE1RIdtqpkVcq0IbtU2S8j2Q==",
       "license": "ISC",
       "dependencies": {
         "d3-array": "2.5.0 - 3"
@@ -15330,8 +12057,6 @@
     },
     "node_modules/d3-hierarchy": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/d3-hierarchy/-/d3-hierarchy-3.1.2.tgz",
-      "integrity": "sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15339,8 +12064,6 @@
     },
     "node_modules/d3-interpolate": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
-      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
       "license": "ISC",
       "dependencies": {
         "d3-color": "1 - 3"
@@ -15351,8 +12074,6 @@
     },
     "node_modules/d3-path": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
-      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15360,8 +12081,6 @@
     },
     "node_modules/d3-polygon": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-polygon/-/d3-polygon-3.0.1.tgz",
-      "integrity": "sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15369,8 +12088,6 @@
     },
     "node_modules/d3-quadtree": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-quadtree/-/d3-quadtree-3.0.1.tgz",
-      "integrity": "sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15378,8 +12095,6 @@
     },
     "node_modules/d3-random": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-random/-/d3-random-3.0.1.tgz",
-      "integrity": "sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15387,8 +12102,6 @@
     },
     "node_modules/d3-sankey": {
       "version": "0.12.3",
-      "resolved": "https://registry.npmjs.org/d3-sankey/-/d3-sankey-0.12.3.tgz",
-      "integrity": "sha512-nQhsBRmM19Ax5xEIPLMY9ZmJ/cDvd1BG3UVvt5h3WRxKg5zGRbvnteTyWAbzeSvlh3tW7ZEmq4VwR5mB3tutmQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "d3-array": "1 - 2",
@@ -15397,8 +12110,6 @@
     },
     "node_modules/d3-sankey/node_modules/d3-array": {
       "version": "2.12.1",
-      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-2.12.1.tgz",
-      "integrity": "sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "internmap": "^1.0.0"
@@ -15406,14 +12117,10 @@
     },
     "node_modules/d3-sankey/node_modules/d3-path": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-1.0.9.tgz",
-      "integrity": "sha512-VLaYcn81dtHVTjEHd8B+pbe9yHWpXKZUC87PzoFmsFrJqgFwDe/qxfp5MlfsfM1V5E/iVt0MmEbWQ7FVIXh/bg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/d3-sankey/node_modules/d3-shape": {
       "version": "1.3.7",
-      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-1.3.7.tgz",
-      "integrity": "sha512-EUkvKjqPFUAZyOlhY5gzCxCeI0Aep04LwIRpsZ/mLFelJiUfnK56jo5JMDSE7yyP2kLSb6LtF+S5chMk7uqPqw==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "d3-path": "1"
@@ -15421,14 +12128,10 @@
     },
     "node_modules/d3-sankey/node_modules/internmap": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/internmap/-/internmap-1.0.1.tgz",
-      "integrity": "sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw==",
       "license": "ISC"
     },
     "node_modules/d3-scale": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
-      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
       "license": "ISC",
       "dependencies": {
         "d3-array": "2.10.0 - 3",
@@ -15443,8 +12146,6 @@
     },
     "node_modules/d3-scale-chromatic": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz",
-      "integrity": "sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ==",
       "license": "ISC",
       "dependencies": {
         "d3-color": "1 - 3",
@@ -15456,8 +12157,6 @@
     },
     "node_modules/d3-selection": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz",
-      "integrity": "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15465,8 +12164,6 @@
     },
     "node_modules/d3-shape": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
-      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
       "license": "ISC",
       "dependencies": {
         "d3-path": "^3.1.0"
@@ -15477,8 +12174,6 @@
     },
     "node_modules/d3-time": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
-      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
       "license": "ISC",
       "dependencies": {
         "d3-array": "2 - 3"
@@ -15489,8 +12184,6 @@
     },
     "node_modules/d3-time-format": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
-      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
       "license": "ISC",
       "dependencies": {
         "d3-time": "1 - 3"
@@ -15501,8 +12194,6 @@
     },
     "node_modules/d3-timer": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
-      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -15510,8 +12201,6 @@
     },
     "node_modules/d3-transition": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-transition/-/d3-transition-3.0.1.tgz",
-      "integrity": "sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w==",
       "license": "ISC",
       "dependencies": {
         "d3-color": "1 - 3",
@@ -15529,8 +12218,6 @@
     },
     "node_modules/d3-zoom": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-zoom/-/d3-zoom-3.0.0.tgz",
-      "integrity": "sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw==",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -15545,8 +12232,6 @@
     },
     "node_modules/dargs": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/dargs/-/dargs-7.0.0.tgz",
-      "integrity": "sha512-2iy1EkLdlBzQGvbweYRFxmFath8+K7+AKB0TlhHWkNuH+TmovaMH/Wp7V7R4u7f4SnX3OgLsU9t1NI9ioDnUpg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15555,15 +12240,11 @@
     },
     "node_modules/dash-ast": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/dash-ast/-/dash-ast-1.0.0.tgz",
-      "integrity": "sha512-Vy4dx7gquTeMcQR/hDkYLGUnwVil6vk4FOOct+djUnHOUWt+zJPJAaRIXaAFkPXtJjvlY7o3rfRu0/3hpnwoUA==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/dashdash": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/dashdash/-/dashdash-1.14.1.tgz",
-      "integrity": "sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15575,8 +12256,6 @@
     },
     "node_modules/data-uri-to-buffer": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
-      "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15585,8 +12264,6 @@
     },
     "node_modules/data-urls": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-3.0.2.tgz",
-      "integrity": "sha512-Jy/tj3ldjZJo63sVAvg6LHt2mHvl4V6AgRAmNDtLdm7faqtsx+aJG42rsyCo9JCoRVKwPFzKlIPx3DIibwSIaQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15600,8 +12277,6 @@
     },
     "node_modules/data-view-buffer": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/data-view-buffer/-/data-view-buffer-1.0.2.tgz",
-      "integrity": "sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15618,8 +12293,6 @@
     },
     "node_modules/data-view-byte-length": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/data-view-byte-length/-/data-view-byte-length-1.0.2.tgz",
-      "integrity": "sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15636,8 +12309,6 @@
     },
     "node_modules/data-view-byte-offset": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/data-view-byte-offset/-/data-view-byte-offset-1.0.1.tgz",
-      "integrity": "sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15654,8 +12325,6 @@
     },
     "node_modules/date-fns": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-4.2.1.tgz",
-      "integrity": "sha512-37RhSdxaG1suen6VDCza6rNrQfooyQh57HFVPwQGEq2QWliVLzPQZ8Oa017weOu+HZCnzI7N3Pf/wyoBKfEqrA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -15664,15 +12333,11 @@
     },
     "node_modules/dayjs": {
       "version": "1.11.20",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.20.tgz",
-      "integrity": "sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/debug": {
       "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
       "license": "MIT",
       "dependencies": {
         "ms": "2.1.2"
@@ -15688,8 +12353,6 @@
     },
     "node_modules/decache": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/decache/-/decache-4.6.2.tgz",
-      "integrity": "sha512-2LPqkLeu8XWHU8qNCS3kcF6sCcb5zIzvWaAHYSvPfwhdd7mHuah29NssMzrTYyHN4F5oFy2ko9OBYxegtU0FEw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15698,15 +12361,11 @@
     },
     "node_modules/decimal.js": {
       "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
-      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/decompress-response": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
-      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15721,8 +12380,6 @@
     },
     "node_modules/decompress-response/node_modules/mimic-response": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
-      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15734,8 +12391,6 @@
     },
     "node_modules/dedent": {
       "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz",
-      "integrity": "sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -15749,8 +12404,6 @@
     },
     "node_modules/deep-eql": {
       "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-4.1.4.tgz",
-      "integrity": "sha512-SUwdGfqdKOwxCPeVYjwSyRpJ7Z+fhpwIAtmCUdZIWZ/YP5R9WAsyuSgpLVDi9bjWoN2LXHNss/dk3urXtdQxGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15762,15 +12415,11 @@
     },
     "node_modules/deep-is": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/deepmerge": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15779,8 +12428,6 @@
     },
     "node_modules/default-browser": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-5.5.0.tgz",
-      "integrity": "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15796,8 +12443,6 @@
     },
     "node_modules/default-browser-id": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/default-browser-id/-/default-browser-id-5.0.1.tgz",
-      "integrity": "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15809,8 +12454,6 @@
     },
     "node_modules/defaults": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
-      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15822,8 +12465,6 @@
     },
     "node_modules/defer-to-connect": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-2.0.1.tgz",
-      "integrity": "sha512-4tvttepXG1VaYGrRibk5EwJd1t4udunSOVMdLSAL6mId1ix438oPwPZMALY41FCijukO1L0twNcGsdzS7dHgDg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15832,8 +12473,6 @@
     },
     "node_modules/define-data-property": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
-      "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15850,8 +12489,6 @@
     },
     "node_modules/define-lazy-prop": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
-      "integrity": "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15863,8 +12500,6 @@
     },
     "node_modules/define-properties": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
-      "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15881,8 +12516,6 @@
     },
     "node_modules/defined": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/defined/-/defined-1.0.1.tgz",
-      "integrity": "sha512-hsBd2qSVCRE+5PmNdHt1uzyrFu5d3RwmFDKzyNZMFq/EwDNJF7Ee5+D5oEKF0hU6LhtoUF1macFvOe4AskQC1Q==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -15891,8 +12524,6 @@
     },
     "node_modules/delaunator": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.1.0.tgz",
-      "integrity": "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==",
       "license": "ISC",
       "dependencies": {
         "robust-predicates": "^3.0.2"
@@ -15900,8 +12531,6 @@
     },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15910,8 +12539,6 @@
     },
     "node_modules/depd": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15920,8 +12547,6 @@
     },
     "node_modules/deps-sort": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/deps-sort/-/deps-sort-2.0.1.tgz",
-      "integrity": "sha512-1orqXQr5po+3KI6kQb9A4jnXT1PBwggGl2d7Sq2xsnOeI9GPcE/tGcF9UiSZtZBM7MukY4cAh7MemS6tZYipfw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15936,8 +12561,6 @@
     },
     "node_modules/des.js": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/des.js/-/des.js-1.1.0.tgz",
-      "integrity": "sha512-r17GxjhUCjSRy8aiJpr8/UadFIzMzJGexI3Nmz4ADi9LYSFx4gTBp80+NaX/YsXWWLhpZ7v/v/ubEc/bCNfKwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15947,8 +12570,6 @@
     },
     "node_modules/destroy": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
-      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15958,14 +12579,10 @@
     },
     "node_modules/detect-browser": {
       "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/detect-browser/-/detect-browser-5.3.0.tgz",
-      "integrity": "sha512-53rsFbGdwMwlF7qvCt0ypLM5V5/Mbl0szB7GPN8y9NCcbknYOeVVXdrXEq+90IwAfrrzt6Hd+u2E2ntakICU8w==",
       "license": "MIT"
     },
     "node_modules/detect-libc": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
       "dev": true,
       "license": "Apache-2.0",
       "optional": true,
@@ -15975,8 +12592,6 @@
     },
     "node_modules/detect-newline": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
-      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15985,15 +12600,11 @@
     },
     "node_modules/detect-node": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
-      "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/detective": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/detective/-/detective-5.2.1.tgz",
-      "integrity": "sha512-v9XE1zRnz1wRtgurGu0Bs8uHKFSTdteYZNbIPFVhUZ39L/S79ppMpdmVOZAnoz1jfEFodc48n6MX483Xo3t1yw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16010,8 +12621,6 @@
     },
     "node_modules/diff": {
       "version": "3.5.1",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-3.5.1.tgz",
-      "integrity": "sha512-Z3u54A8qGyqFOSr2pk0ijYs8mOE9Qz8kTvtKeBI+upoG9j04Sq+oI7W8zAJiQybDcESET8/uIdHzs0p3k4fZlw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -16020,8 +12629,6 @@
     },
     "node_modules/diff-sequences": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-29.6.3.tgz",
-      "integrity": "sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16030,8 +12637,6 @@
     },
     "node_modules/diffie-hellman": {
       "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/diffie-hellman/-/diffie-hellman-5.0.3.tgz",
-      "integrity": "sha512-kqag/Nl+f3GwyK25fhUMYj81BUOrZ9IuJsjIcDE5icNM9FJHAVm3VcUDxdLPoQtTuUylWm6ZIknYJwwaPxsUzg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16042,15 +12647,11 @@
     },
     "node_modules/diffie-hellman/node_modules/bn.js": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
-      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/dir-glob": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
-      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16062,8 +12663,6 @@
     },
     "node_modules/dir-glob/node_modules/path-type": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16072,8 +12671,6 @@
     },
     "node_modules/dns-packet": {
       "version": "5.6.1",
-      "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.6.1.tgz",
-      "integrity": "sha512-l4gcSouhcgIKRvyy99RNVOgxXiicE+2jZoNmaNmZ6JXiGajBOJAesk1OBlJuM5k2c+eudGdLxDqXuPCKIj6kpw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16085,8 +12682,6 @@
     },
     "node_modules/dom-serializer": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
-      "integrity": "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16100,8 +12695,6 @@
     },
     "node_modules/domain-browser": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/domain-browser/-/domain-browser-1.2.0.tgz",
-      "integrity": "sha512-jnjyiM6eRyZl2H+W8Q/zLMA481hzi0eszAaBUzIVnmYVDBbnLxVNnfu1HgEBvCbL+71FrxMl3E6lpKH7Ge3OXA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16111,8 +12704,6 @@
     },
     "node_modules/domelementtype": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
-      "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
       "dev": true,
       "funding": [
         {
@@ -16124,9 +12715,6 @@
     },
     "node_modules/domexception": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/domexception/-/domexception-4.0.0.tgz",
-      "integrity": "sha512-A2is4PLG+eeSfoTMA95/s4pvAoSo2mKtiM5jlHkAVewmiO8ISFTFKZjH7UAM1Atli/OT/7JHOrJRJiMKUZKYBw==",
-      "deprecated": "Use your platform's native DOMException instead",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16138,8 +12726,6 @@
     },
     "node_modules/domhandler": {
       "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
-      "integrity": "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -16154,8 +12740,6 @@
     },
     "node_modules/dompurify": {
       "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.5.tgz",
-      "integrity": "sha512-OrwIBKsdNSVEeubdJ1HBv/wNENRM9ytAVCv7YXt//A3vPdVMNuACRqK9mXCGCBW2ln7BT/A4X0jXHo2Gu89miA==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -16163,8 +12747,6 @@
     },
     "node_modules/domutils": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
-      "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -16178,15 +12760,11 @@
     },
     "node_modules/dot": {
       "version": "2.0.0-beta.1",
-      "resolved": "https://registry.npmjs.org/dot/-/dot-2.0.0-beta.1.tgz",
-      "integrity": "sha512-kxM7fSnNQTXOmaeGuBSXM8O3fEsBb7XSDBllkGbRwa0lJSJTxxDE/4eSNGLKZUmlFw0f1vJ5qSV2BljrgQtgIA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/dotenv": {
       "version": "16.6.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
-      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -16198,8 +12776,6 @@
     },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16213,15 +12789,11 @@
     },
     "node_modules/duplexer": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/duplexer/-/duplexer-0.1.2.tgz",
-      "integrity": "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/duplexer2": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
-      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -16230,8 +12802,6 @@
     },
     "node_modules/duration": {
       "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/duration/-/duration-0.2.2.tgz",
-      "integrity": "sha512-06kgtea+bGreF5eKYgI/36A6pLXggY7oR4p1pq4SmdFBn1ReOL5D8RhG64VrqfTTKNucqqtBAwEj8aB88mcqrg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -16241,15 +12811,11 @@
     },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/ecc-jsbn": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
-      "integrity": "sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16259,21 +12825,15 @@
     },
     "node_modules/ee-first": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
       "version": "1.5.357",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.357.tgz",
-      "integrity": "sha512-NHlTIQDK8fmVwHwuIzmXYEJ1Ewq3D9wDNc0cWXxDGysP6Pb21giwGNkxiTifyKy/4SoPuN5l6GLP1W9Sv7zB2g==",
       "license": "ISC"
     },
     "node_modules/elliptic": {
       "version": "6.6.1",
-      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.6.1.tgz",
-      "integrity": "sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16288,15 +12848,11 @@
     },
     "node_modules/elliptic/node_modules/bn.js": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
-      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/emitter-component": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/emitter-component/-/emitter-component-1.1.2.tgz",
-      "integrity": "sha512-QdXO3nXOzZB4pAjM0n6ZE+R9/+kPpECA/XSELIcc54NeYVnBqIk+4DFiBgK+8QbV3mdvTG6nedl7dTYgO+5wDw==",
       "dev": true,
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -16304,8 +12860,6 @@
     },
     "node_modules/emittery": {
       "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz",
-      "integrity": "sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16317,14 +12871,10 @@
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "license": "MIT"
     },
     "node_modules/emojis-list": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-3.0.0.tgz",
-      "integrity": "sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16333,8 +12883,6 @@
     },
     "node_modules/encodeurl": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
-      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16343,8 +12891,6 @@
     },
     "node_modules/encoding": {
       "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
-      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16353,8 +12899,6 @@
     },
     "node_modules/encoding/node_modules/iconv-lite": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16366,8 +12910,6 @@
     },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
-      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16376,8 +12918,6 @@
     },
     "node_modules/enhanced-resolve": {
       "version": "5.24.1",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.1.tgz",
-      "integrity": "sha512-7DdUaTjmNwMcH2gLr1qycesKII3BK4RLy/mdAb7x10Lq7bR4aNKHt1BR1ZALSv0rPM/hF5wYF0PhGop/rJm8vw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16390,8 +12930,6 @@
     },
     "node_modules/enquirer": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/enquirer/-/enquirer-2.4.1.tgz",
-      "integrity": "sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16404,8 +12942,6 @@
     },
     "node_modules/entities": {
       "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
-      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -16417,8 +12953,6 @@
     },
     "node_modules/env-paths": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
-      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16427,8 +12961,6 @@
     },
     "node_modules/environment": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/environment/-/environment-1.1.0.tgz",
-      "integrity": "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16440,15 +12972,11 @@
     },
     "node_modules/err-code": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
-      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/errno": {
       "version": "0.1.8",
-      "resolved": "https://registry.npmjs.org/errno/-/errno-0.1.8.tgz",
-      "integrity": "sha512-dJ6oBr5SQ1VSd9qkk7ByRgb/1SH4JZjCHSW/mr63/QcXO9zLVxvJ6Oy13nio03rxpSnVDDjFor75SjVeZWPW/A==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -16461,8 +12989,6 @@
     },
     "node_modules/error-ex": {
       "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
-      "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16471,8 +12997,6 @@
     },
     "node_modules/error-stack-parser": {
       "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
-      "integrity": "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16481,8 +13005,6 @@
     },
     "node_modules/es-abstract": {
       "version": "1.24.2",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.2.tgz",
-      "integrity": "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16550,8 +13072,6 @@
     },
     "node_modules/es-define-property": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16560,8 +13080,6 @@
     },
     "node_modules/es-errors": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16570,15 +13088,11 @@
     },
     "node_modules/es-module-lexer": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16590,8 +13104,6 @@
     },
     "node_modules/es-set-tostringtag": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
-      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16606,8 +13118,6 @@
     },
     "node_modules/es-to-primitive": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.3.0.tgz",
-      "integrity": "sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16624,8 +13134,6 @@
     },
     "node_modules/es5-ext": {
       "version": "0.10.64",
-      "resolved": "https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.64.tgz",
-      "integrity": "sha512-p2snDhiLaXe6dahss1LddxqEm+SkuDvV8dnIQG0MWjyHpcMNfXKPE+/Cc0y+PhxJX3A4xGNeFCj5oc0BUh6deg==",
       "dev": true,
       "hasInstallScript": true,
       "license": "ISC",
@@ -16641,8 +13149,6 @@
     },
     "node_modules/es6-iterator": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/es6-iterator/-/es6-iterator-2.0.3.tgz",
-      "integrity": "sha512-zw4SRzoUkd+cl+ZoE15A9o1oQd920Bb0iOJMQkQhl3jNc03YqVjAhG7scf9C5KWRU/R13Orf588uCC6525o02g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16653,15 +13159,11 @@
     },
     "node_modules/es6-shim": {
       "version": "0.35.8",
-      "resolved": "https://registry.npmjs.org/es6-shim/-/es6-shim-0.35.8.tgz",
-      "integrity": "sha512-Twf7I2v4/1tLoIXMT8HlqaBSS5H2wQTs2wx3MNYCI8K1R1/clXyCazrcVCPm/FuO9cyV8+leEaZOWD5C253NDg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/es6-symbol": {
       "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/es6-symbol/-/es6-symbol-3.1.4.tgz",
-      "integrity": "sha512-U9bFFjX8tFiATgtkJ1zg25+KviIXpgRvRHS8sau3GfhVzThRQrOeksPeT0BWW2MNZs1OEWJ1DPXOQMn0KKRkvg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -16674,8 +13176,6 @@
     },
     "node_modules/esbuild": {
       "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -16716,8 +13216,6 @@
     },
     "node_modules/esbuild-wasm": {
       "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/esbuild-wasm/-/esbuild-wasm-0.28.0.tgz",
-      "integrity": "sha512-5TRVKExcEmeMkccIZMzUq+Az6X2RoMAJyfl6SMMO1dMVhmvt0I2mx7gAb6zYi42n4d1ETcatFXazGKzA+aW7fg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -16729,8 +13227,6 @@
     },
     "node_modules/escalade": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -16738,15 +13234,11 @@
     },
     "node_modules/escape-html": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/escape-string-regexp": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16755,8 +13247,6 @@
     },
     "node_modules/escodegen": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.1.0.tgz",
-      "integrity": "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -16777,8 +13267,6 @@
     },
     "node_modules/escodegen/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -16788,8 +13276,6 @@
     },
     "node_modules/eslint": {
       "version": "9.14.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.14.0.tgz",
-      "integrity": "sha512-c2FHsVBr87lnUtjP4Yhvk4yEhKrQavGafRA/Se1ouse8PfbfC/Qh9Mxa00yWsZRlqeUB9raXip0aiiUZkgnr9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16849,8 +13335,6 @@
     },
     "node_modules/eslint-scope": {
       "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
-      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -16866,8 +13350,6 @@
     },
     "node_modules/eslint-visitor-keys": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -16879,8 +13361,6 @@
     },
     "node_modules/eslint/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16896,8 +13376,6 @@
     },
     "node_modules/eslint/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16907,8 +13385,6 @@
     },
     "node_modules/eslint/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -16924,8 +13400,6 @@
     },
     "node_modules/eslint/node_modules/escape-string-regexp": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16937,8 +13411,6 @@
     },
     "node_modules/eslint/node_modules/eslint-visitor-keys": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
-      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -16950,15 +13422,11 @@
     },
     "node_modules/eslint/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/eslint/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -16970,8 +13438,6 @@
     },
     "node_modules/esniff": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/esniff/-/esniff-2.0.1.tgz",
-      "integrity": "sha512-kTUIGKQ/mDPFoJ0oVfcmyJn4iBDRptjNVIzwIFR7tqWXdVI9xfA2RMwY/gbSpJG3lkdWNEjLap/NqVHZiJsdfg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -16986,8 +13452,6 @@
     },
     "node_modules/espree": {
       "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
-      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -17004,8 +13468,6 @@
     },
     "node_modules/espree/node_modules/eslint-visitor-keys": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
-      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -17017,8 +13479,6 @@
     },
     "node_modules/esprima": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
       "dev": true,
       "license": "BSD-2-Clause",
       "bin": {
@@ -17031,8 +13491,6 @@
     },
     "node_modules/esquery": {
       "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
-      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -17044,8 +13502,6 @@
     },
     "node_modules/esrecurse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -17057,8 +13513,6 @@
     },
     "node_modules/estraverse": {
       "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -17067,8 +13521,6 @@
     },
     "node_modules/esutils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -17077,8 +13529,6 @@
     },
     "node_modules/etag": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17087,8 +13537,6 @@
     },
     "node_modules/event-emitter": {
       "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/event-emitter/-/event-emitter-0.3.5.tgz",
-      "integrity": "sha512-D9rRn9y7kLPnJ+hMq7S/nhvoKwwvVJahBi2BPmx3bvbsEdK3W9ii8cBSGjP+72/LnM4n6fo3+dkCX5FeTQruXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17098,8 +13546,6 @@
     },
     "node_modules/event-stream": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/event-stream/-/event-stream-4.0.1.tgz",
-      "integrity": "sha512-qACXdu/9VHPBzcyhdOWR5/IahhGMf0roTeZJfzz077GwylcDd90yOHLouhmv7GJ5XzPi6ekaQWd8AvPP2nOvpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17114,8 +13560,6 @@
     },
     "node_modules/event-target-shim": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
-      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17124,22 +13568,16 @@
     },
     "node_modules/eventemitter2": {
       "version": "6.4.7",
-      "resolved": "https://registry.npmjs.org/eventemitter2/-/eventemitter2-6.4.7.tgz",
-      "integrity": "sha512-tYUSVOGeQPKt/eC1ABfhHy5Xd96N3oIijJvN3O9+TsC28T5V9yX9oEfEK5faP0EFSNVOG97qtAS68GBrQB2hDg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/eventemitter3": {
       "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
-      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/events": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-2.1.0.tgz",
-      "integrity": "sha512-3Zmiobend8P9DjmKAty0Era4jV8oJ0yGYe2nJJAxgymF9+N8F2m0hhZiMoWtcfepExzNKZumFU3ksdQbInGWCg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17148,8 +13586,6 @@
     },
     "node_modules/evp_bytestokey": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/evp_bytestokey/-/evp_bytestokey-1.0.3.tgz",
-      "integrity": "sha512-/f2Go4TognH/KvCISP7OUsHn85hT9nUkxxA9BEWxFn+Oj9o8ZNLm/40hdlgSLyuOimsrTKLUMEorQexp/aPQeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17159,8 +13595,6 @@
     },
     "node_modules/execa": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-4.1.0.tgz",
-      "integrity": "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17183,8 +13617,6 @@
     },
     "node_modules/execa/node_modules/is-stream": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17196,15 +13628,11 @@
     },
     "node_modules/execa/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/executable": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/executable/-/executable-4.1.1.tgz",
-      "integrity": "sha512-8iA79xD3uAch729dUG8xaaBBFGaEa0wdD2VkYLFHwlqosEj/jT66AzcreRDSgV7ehnNLBW2WR5jIXwGKjVdTLg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17216,8 +13644,6 @@
     },
     "node_modules/exit": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz",
-      "integrity": "sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==",
       "dev": true,
       "engines": {
         "node": ">= 0.8.0"
@@ -17225,8 +13651,6 @@
     },
     "node_modules/expect": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-29.7.0.tgz",
-      "integrity": "sha512-2Zks0hf1VLFYI1kbh0I5jP3KHHyCHpkfyHBzsSXRFgl/Bg9mWYfMW8oD+PdMPlEwy5HNsR9JutYy6pMeOh61nw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17242,15 +13666,11 @@
     },
     "node_modules/exponential-backoff": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
-      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/express": {
       "version": "4.22.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
-      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17296,8 +13716,6 @@
     },
     "node_modules/express/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17306,8 +13724,6 @@
     },
     "node_modules/express/node_modules/encodeurl": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17316,8 +13732,6 @@
     },
     "node_modules/express/node_modules/finalhandler": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
-      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17335,8 +13749,6 @@
     },
     "node_modules/express/node_modules/fresh": {
       "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
-      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17345,15 +13757,11 @@
     },
     "node_modules/express/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/express/node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17365,8 +13773,6 @@
     },
     "node_modules/express/node_modules/qs": {
       "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -17382,8 +13788,6 @@
     },
     "node_modules/express/node_modules/send": {
       "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
-      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17407,15 +13811,11 @@
     },
     "node_modules/express/node_modules/send/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/express/node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17424,8 +13824,6 @@
     },
     "node_modules/ext": {
       "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/ext/-/ext-1.7.0.tgz",
-      "integrity": "sha512-6hxeJYaL110a9b5TEJSj0gojyHQAmA2ch5Os+ySCiA1QGdS697XWY1pzsrSjqA9LDEEgdB/KypIlR59RcLuHYw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -17434,15 +13832,11 @@
     },
     "node_modules/extend": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/extract-zip": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/extract-zip/-/extract-zip-2.0.1.tgz",
-      "integrity": "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -17462,8 +13856,6 @@
     },
     "node_modules/extsprintf": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.3.0.tgz",
-      "integrity": "sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g==",
       "dev": true,
       "engines": [
         "node >=0.6.0"
@@ -17472,8 +13864,6 @@
     },
     "node_modules/fancy-log": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fancy-log/-/fancy-log-2.0.0.tgz",
-      "integrity": "sha512-9CzxZbACXMUXW13tS0tI8XsGGmxWzO2DmYrGuBJOJ8k8q2K7hwfJA5qHjuPPe8wtsco33YR9wc+Rlr5wYFvhSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17485,29 +13875,21 @@
     },
     "node_modules/fast-content-type-parse": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-1.1.0.tgz",
-      "integrity": "sha512-fBHHqSTFLVnR61C+gltJuE5GkVQMV0S2nqUO8TJ+5Z3qAKG8vAx4FKai1s5jq/inV1+sREynIWSuQ6HgoSXpDQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-decode-uri-component": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/fast-decode-uri-component/-/fast-decode-uri-component-1.0.1.tgz",
-      "integrity": "sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-glob": {
       "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
-      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.stat": "^2.0.2",
@@ -17522,8 +13904,6 @@
     },
     "node_modules/fast-glob/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "license": "ISC",
       "dependencies": {
         "is-glob": "^4.0.1"
@@ -17534,15 +13914,11 @@
     },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-json-stringify": {
       "version": "5.16.1",
-      "resolved": "https://registry.npmjs.org/fast-json-stringify/-/fast-json-stringify-5.16.1.tgz",
-      "integrity": "sha512-KAdnLvy1yu/XrRtP+LJnxbBGrhN+xXu+gt3EUvZhYGKCr3lFHq/7UFJHHFgmJKoqlh6B40bZLEv7w46B0mqn1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17557,22 +13933,16 @@
     },
     "node_modules/fast-json-stringify/node_modules/fast-uri": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-2.4.0.tgz",
-      "integrity": "sha512-ypuAmmMKInk5q7XcepxlnUWDLWv4GFtaJqAzWKqn62IpQ3pejtr5dTVbt3vwqVaMKmkNR55sTT+CqUKIaT21BA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-levenshtein": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-querystring": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/fast-querystring/-/fast-querystring-1.1.2.tgz",
-      "integrity": "sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17581,15 +13951,11 @@
     },
     "node_modules/fast-safe-stringify": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz",
-      "integrity": "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-uri": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
       "dev": true,
       "funding": [
         {
@@ -17605,8 +13971,6 @@
     },
     "node_modules/fastest-levenshtein": {
       "version": "1.0.16",
-      "resolved": "https://registry.npmjs.org/fastest-levenshtein/-/fastest-levenshtein-1.0.16.tgz",
-      "integrity": "sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17615,8 +13979,6 @@
     },
     "node_modules/fastify": {
       "version": "4.29.1",
-      "resolved": "https://registry.npmjs.org/fastify/-/fastify-4.29.1.tgz",
-      "integrity": "sha512-m2kMNHIG92tSNWv+Z3UeTR9AWLLuo7KctC7mlFPtMEVrfjIhmQhkQnT9v15qA/BfVq3vvj134Y0jl9SBje3jXQ==",
       "dev": true,
       "funding": [
         {
@@ -17650,15 +14012,11 @@
     },
     "node_modules/fastify-plugin": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-3.0.1.tgz",
-      "integrity": "sha512-qKcDXmuZadJqdTm6vlCqioEbyewF60b/0LOFCcYN1B6BIZGlYJumWWOYs70SFYLDAH4YqdE1cxH/RKMG7rFxgA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fastq": {
       "version": "1.20.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
-      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
       "license": "ISC",
       "dependencies": {
         "reusify": "^1.0.4"
@@ -17666,8 +14024,6 @@
     },
     "node_modules/faye-websocket": {
       "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
-      "integrity": "sha512-CzbClwlXAuiRQAlUyfqPgvPoNKTckTPGfwZV4ZdAhVcP2lh9KUxJg2b5GkE7XbjKQ3YJnQ9z6D9ntLAlB+tP8g==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -17679,8 +14035,6 @@
     },
     "node_modules/fb-watchman": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz",
-      "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -17689,8 +14043,6 @@
     },
     "node_modules/fd-slicer": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17699,8 +14051,6 @@
     },
     "node_modules/fdir": {
       "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -17717,8 +14067,6 @@
     },
     "node_modules/fetch-blob": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz",
-      "integrity": "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==",
       "dev": true,
       "funding": [
         {
@@ -17741,8 +14089,6 @@
     },
     "node_modules/figures": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz",
-      "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17757,8 +14103,6 @@
     },
     "node_modules/file-entry-cache": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17770,14 +14114,10 @@
     },
     "node_modules/file-saver": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/file-saver/-/file-saver-2.0.5.tgz",
-      "integrity": "sha512-P9bmyZ3h/PRG+Nzga+rbdI4OEpNDzAVyy74uVO9ATgzLK6VtAsYybF/+TOCvrc0MO793d6+42lLyZTw7/ArVzA==",
       "license": "MIT"
     },
     "node_modules/fill-range": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "license": "MIT",
       "dependencies": {
         "to-regex-range": "^5.0.1"
@@ -17788,8 +14128,6 @@
     },
     "node_modules/finalhandler": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.2.tgz",
-      "integrity": "sha512-aAWcW57uxVNrQZqFXjITpW3sIUQmHGG3qSb9mUah9MgMC4NeWhNOlNjXEYq3HjRAvL6arUviZGGJsBg6z0zsWA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17807,8 +14145,6 @@
     },
     "node_modules/finalhandler/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17817,15 +14153,11 @@
     },
     "node_modules/finalhandler/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/find-cache-dir": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-4.0.0.tgz",
-      "integrity": "sha512-9ZonPT4ZAK4a+1pUPVPZJapbi7O5qbbJPdYw/NOQWZZbVLdDTYM3A4R9z/DpAM08IDaFGsvPgiGZ82WEwUDWjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17841,8 +14173,6 @@
     },
     "node_modules/find-my-way": {
       "version": "8.2.2",
-      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-8.2.2.tgz",
-      "integrity": "sha512-Dobi7gcTEq8yszimcfp/R7+owiT4WncAJ7VTTgFH1jYJ5GaG1FbhjwDG820hptN0QDFvzVY3RfCzdInvGPGzjA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17856,8 +14186,6 @@
     },
     "node_modules/find-process": {
       "version": "1.4.11",
-      "resolved": "https://registry.npmjs.org/find-process/-/find-process-1.4.11.tgz",
-      "integrity": "sha512-mAOh9gGk9WZ4ip5UjV0o6Vb4SrfnAmtsFNzkMRH9HQiFXVQnDyQFrSHTK5UoG6E+KV+s+cIznbtwpfN41l2nFA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17871,8 +14199,6 @@
     },
     "node_modules/find-process/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17888,8 +14214,6 @@
     },
     "node_modules/find-up": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17905,8 +14229,6 @@
     },
     "node_modules/flat": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/flat/-/flat-5.0.2.tgz",
-      "integrity": "sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "bin": {
@@ -17915,8 +14237,6 @@
     },
     "node_modules/flat-cache": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17929,21 +14249,15 @@
     },
     "node_modules/flatpickr": {
       "version": "4.6.13",
-      "resolved": "https://registry.npmjs.org/flatpickr/-/flatpickr-4.6.13.tgz",
-      "integrity": "sha512-97PMG/aywoYpB4IvbvUJi0RQi8vearvU0oov1WW3k0WZPBMrTQVqekSX5CjSG/M4Q3i6A/0FKXC7RyAoAUUSPw==",
       "license": "MIT"
     },
     "node_modules/flatted": {
       "version": "3.4.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
-      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
       "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
       "dev": true,
       "funding": [
         {
@@ -17963,8 +14277,6 @@
     },
     "node_modules/for-each": {
       "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.5.tgz",
-      "integrity": "sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17979,8 +14291,6 @@
     },
     "node_modules/foreground-child": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -17996,8 +14306,6 @@
     },
     "node_modules/forever-agent": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/forever-agent/-/forever-agent-0.6.1.tgz",
-      "integrity": "sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -18006,8 +14314,6 @@
     },
     "node_modules/form-data": {
       "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz",
-      "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18021,8 +14327,6 @@
     },
     "node_modules/formdata-polyfill": {
       "version": "4.0.10",
-      "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
-      "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18034,8 +14338,6 @@
     },
     "node_modules/forwarded": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18044,8 +14346,6 @@
     },
     "node_modules/fraction.js": {
       "version": "4.3.7",
-      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz",
-      "integrity": "sha512-ZsDfxO51wGAXREY55a7la9LScWpwv9RxIrYABrlvOFBlH/ShPnrtsXeuUIfXKKOVicNxQ+o8JTbJvjS4M89yew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18058,8 +14358,6 @@
     },
     "node_modules/fresh": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
-      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18068,15 +14366,11 @@
     },
     "node_modules/from": {
       "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/from/-/from-0.1.7.tgz",
-      "integrity": "sha512-twe20eF1OxVxp/ML/kq2p1uc6KvFK/+vs8WjEbeKmV2He22MKm7YF2ANIt+EOqhJ5L3K/SuuPhk0hWQDjOM23g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fs-extra": {
       "version": "11.3.5",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.5.tgz",
-      "integrity": "sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18090,8 +14384,6 @@
     },
     "node_modules/fs-minipass": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
-      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18103,30 +14395,11 @@
     },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
     "node_modules/function-bind": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -18135,8 +14408,6 @@
     },
     "node_modules/function.prototype.name": {
       "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.8.tgz",
-      "integrity": "sha512-e5iwyodOHhbMr/yNrc7fDYG4qlbIvI5gajyzPnb5TCwyhjApznQh1BMFou9b30SevY43gCJKXycoCBjMbsuW0Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18156,8 +14427,6 @@
     },
     "node_modules/functions-have-names": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
-      "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -18166,8 +14435,6 @@
     },
     "node_modules/generator-function": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/generator-function/-/generator-function-2.0.1.tgz",
-      "integrity": "sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18176,8 +14443,6 @@
     },
     "node_modules/gensync": {
       "version": "1.0.0-beta.2",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -18185,15 +14450,11 @@
     },
     "node_modules/get-assigned-identifiers": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/get-assigned-identifiers/-/get-assigned-identifiers-1.2.0.tgz",
-      "integrity": "sha512-mBBwmeGTrxEMO4pMaaf/uUEFHnYtwr8FTe8Y/mer4rcV/bye0qGm6pw1bGZFGStxC5O76c5ZAVBGnqHmOaJpdQ==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/get-caller-file": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
       "license": "ISC",
       "engines": {
         "node": "6.* || 8.* || >= 10.*"
@@ -18201,8 +14462,6 @@
     },
     "node_modules/get-east-asian-width": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz",
-      "integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18214,8 +14473,6 @@
     },
     "node_modules/get-func-name": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/get-func-name/-/get-func-name-2.0.2.tgz",
-      "integrity": "sha512-8vXOvuE167CtIc3OyItco7N/dpRtBbYOsPsXCz7X/PMnlGjYjSGuZJgM1Y7mmew7BKf9BqvLX2tnOVy1BBUsxQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18224,8 +14481,6 @@
     },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18249,8 +14504,6 @@
     },
     "node_modules/get-package-type": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
-      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18259,8 +14512,6 @@
     },
     "node_modules/get-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18273,8 +14524,6 @@
     },
     "node_modules/get-stream": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz",
-      "integrity": "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18289,8 +14538,6 @@
     },
     "node_modules/get-symbol-description": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.1.0.tgz",
-      "integrity": "sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18307,8 +14554,6 @@
     },
     "node_modules/getos": {
       "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/getos/-/getos-3.2.1.tgz",
-      "integrity": "sha512-U56CfOK17OKgTVqozZjUKNdkfEv6jk5WISBJ8SHoagjE6L69zOwl3Z+O8myjY9MEW3i2HPWQBt/LTbCgcC973Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18317,8 +14562,6 @@
     },
     "node_modules/getpass": {
       "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/getpass/-/getpass-0.1.7.tgz",
-      "integrity": "sha512-0fzj9JxOLfJ+XGLhR8ze3unN0KZCgZwiSSDz168VERjK8Wl8kVSdcu2kspd4s4wtAa1y/qrVRiAA0WclVsu0ng==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18327,9 +14570,6 @@
     },
     "node_modules/gherkin": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/gherkin/-/gherkin-5.1.0.tgz",
-      "integrity": "sha512-axTCsxH0m0cixijLvo7s9591h5pMb8ifQxFDun5FnfFhVsUhxgdnH0H7TSK7q8I4ASUU18DJ/tmlnMegMuLUUQ==",
-      "deprecated": "This package is now published under @cucumber/gherkin",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -18338,8 +14578,6 @@
     },
     "node_modules/gherkin-lint": {
       "version": "4.2.4",
-      "resolved": "https://registry.npmjs.org/gherkin-lint/-/gherkin-lint-4.2.4.tgz",
-      "integrity": "sha512-iM+ECIHOF6Wh94YIF1hSHA6JH9rzcgozlMLHA/uCzGtQiMjb/uL093eh1nTpfoJ/38veL7Jfh4yY2inu7uUoFA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18360,8 +14598,6 @@
     },
     "node_modules/gherkin-lint/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18371,8 +14607,6 @@
     },
     "node_modules/gherkin-lint/node_modules/commander": {
       "version": "11.0.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-11.0.0.tgz",
-      "integrity": "sha512-9HMlXtt/BNoYr8ooyjjNRdIilOTkVJXB+GhxMTtOKwk0R4j4lS4NpjuqmRxroBfnfTSHQIHQB7wryHhXarNjmQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18381,8 +14615,6 @@
     },
     "node_modules/gherkin-lint/node_modules/core-js": {
       "version": "3.33.1",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.33.1.tgz",
-      "integrity": "sha512-qVSq3s+d4+GsqN0teRCJtM6tdEEXyWxjzbhVrCHmBS5ZTM0FS2MOS0D13dUXAWDUN6a+lHI/N1hF9Ytz6iLl9Q==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -18393,9 +14625,6 @@
     },
     "node_modules/gherkin-lint/node_modules/gherkin": {
       "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/gherkin/-/gherkin-9.0.0.tgz",
-      "integrity": "sha512-6xoAepoxo5vhkBXjB4RCfVnSKHu5z9SqXIQVUyj+Jw8BQX8odATlee5otXgdN8llZvyvHokuvNiBeB3naEnnIQ==",
-      "deprecated": "This package is now published under @cucumber/gherkin",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18409,8 +14638,6 @@
     },
     "node_modules/gherkin-lint/node_modules/gherkin/node_modules/commander": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
-      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18419,9 +14646,6 @@
     },
     "node_modules/gherkin-lint/node_modules/glob": {
       "version": "7.1.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz",
-      "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18441,15 +14665,11 @@
     },
     "node_modules/gherkin-lint/node_modules/lodash": {
       "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/gherkin-lint/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18461,8 +14681,6 @@
     },
     "node_modules/gherkin-lint/node_modules/strip-json-comments": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.0.1.tgz",
-      "integrity": "sha512-VTyMAUfdm047mwKl+u79WIdrZxtFtn+nBxHeb844XBQ9uMNTuTHdx2hc5RiAJYqwTj3wc/xe5HLSdJSkJ+WfZw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18471,9 +14689,6 @@
     },
     "node_modules/glob": {
       "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-11.1.0.tgz",
-      "integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -18496,8 +14711,6 @@
     },
     "node_modules/glob-parent": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18509,8 +14722,6 @@
     },
     "node_modules/glob-to-regex.js": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/glob-to-regex.js/-/glob-to-regex.js-1.2.0.tgz",
-      "integrity": "sha512-QMwlOQKU/IzqMUOAZWubUOT8Qft+Y0KQWnX9nK3ch0CJg0tTp4TvGZsTfudYKv2NzoQSyPcnA6TYeIQ3jGichQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -18526,15 +14737,11 @@
     },
     "node_modules/glob-to-regexp": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz",
-      "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
     "node_modules/glob/node_modules/balanced-match": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18543,8 +14750,6 @@
     },
     "node_modules/glob/node_modules/brace-expansion": {
       "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18556,8 +14761,6 @@
     },
     "node_modules/glob/node_modules/minimatch": {
       "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -18572,8 +14775,6 @@
     },
     "node_modules/global-dirs": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/global-dirs/-/global-dirs-3.0.1.tgz",
-      "integrity": "sha512-NBcGGFbBA9s1VzD41QXDG+3++t9Mn5t1FpLdhESY6oKY4gYTFpX4wO3sqGUa0Srjtbfj3szX0RnemmrVRUdULA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18588,8 +14789,6 @@
     },
     "node_modules/global-dirs/node_modules/ini": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-2.0.0.tgz",
-      "integrity": "sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -18598,8 +14797,6 @@
     },
     "node_modules/global-modules": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/global-modules/-/global-modules-2.0.0.tgz",
-      "integrity": "sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18611,8 +14808,6 @@
     },
     "node_modules/global-prefix": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-3.0.0.tgz",
-      "integrity": "sha512-awConJSVCHVGND6x3tmMaKcQvwXLhjdkmomy2W+Goaui8YPgYgXJZewhg3fWC+DlfqqQuWg8AwqjGTD2nAPVWg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18626,15 +14821,11 @@
     },
     "node_modules/global-prefix/node_modules/ini": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/global-prefix/node_modules/which": {
       "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
-      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18646,8 +14837,6 @@
     },
     "node_modules/globals": {
       "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18659,8 +14848,6 @@
     },
     "node_modules/globalthis": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
-      "integrity": "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18676,8 +14863,6 @@
     },
     "node_modules/globby": {
       "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-14.1.0.tgz",
-      "integrity": "sha512-0Ia46fDOaT7k4og1PDW4YbodWWr3scS2vAr2lTbsplOt2WkKp0vQbkI9wKis/T5LV/dqPjO3bpS/z6GTJB82LA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18697,8 +14882,6 @@
     },
     "node_modules/globby/node_modules/ignore": {
       "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18707,15 +14890,11 @@
     },
     "node_modules/globjoin": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/globjoin/-/globjoin-0.1.4.tgz",
-      "integrity": "sha512-xYfnw62CKG8nLkZBfWbhWwDw02CHty86jfPcc2cr3ZfeuK9ysoVPPEUxf21bAD/rWAgk52SuBrLJlefNy8mvFg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/gopd": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18727,8 +14906,6 @@
     },
     "node_modules/got": {
       "version": "11.8.6",
-      "resolved": "https://registry.npmjs.org/got/-/got-11.8.6.tgz",
-      "integrity": "sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18753,22 +14930,11 @@
     },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/graphemer": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
-      "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/hammerjs": {
       "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/hammerjs/-/hammerjs-2.0.8.tgz",
-      "integrity": "sha512-tSQXBXS/MWQOn/RKckawJ61vvsDpCom87JgxiYdGwHdOa0ht0vzUWDlfioofFCRU0L+6NGDt6XzbgoJvZkMeRQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18777,15 +14943,11 @@
     },
     "node_modules/handle-thing": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/handle-thing/-/handle-thing-2.0.1.tgz",
-      "integrity": "sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/handlebars": {
       "version": "4.7.9",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
-      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18806,8 +14968,6 @@
     },
     "node_modules/handlebars/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -18816,15 +14976,11 @@
     },
     "node_modules/harmony-reflect": {
       "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/harmony-reflect/-/harmony-reflect-1.6.2.tgz",
-      "integrity": "sha512-HIp/n38R9kQjDEziXyDTuW3vvoxxyxjxFzXLrBr18uB47GnSt+G9D29fqrpM5ZkspMcPICud3XsBJQ4Y2URg8g==",
       "dev": true,
       "license": "(Apache-2.0 OR MPL-1.1)"
     },
     "node_modules/has": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.4.tgz",
-      "integrity": "sha512-qdSAmqLF6209RFj4VVItywPMbm3vWylknmB3nvNiUIs72xAimcM8nVYxYr7ncvZq5qzk9MKIZR8ijqD/1QuYjQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18833,8 +14989,6 @@
     },
     "node_modules/has-bigints": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.1.0.tgz",
-      "integrity": "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18846,8 +15000,6 @@
     },
     "node_modules/has-flag": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18856,8 +15008,6 @@
     },
     "node_modules/has-property-descriptors": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
-      "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18869,8 +15019,6 @@
     },
     "node_modules/has-proto": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.2.0.tgz",
-      "integrity": "sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18885,8 +15033,6 @@
     },
     "node_modules/has-symbols": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -18898,8 +15044,6 @@
     },
     "node_modules/has-tostringtag": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
-      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18914,8 +15058,6 @@
     },
     "node_modules/hash-base": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.0.5.tgz",
-      "integrity": "sha512-vXm0l45VbcHEVlTCzs8M+s0VeYsB2lnlAaThoLKGXr3bE/VWDOelNUnycUPEhKEaXARL2TEFjBOyUiM6+55KBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18928,8 +15070,6 @@
     },
     "node_modules/hash.js": {
       "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/hash.js/-/hash.js-1.1.7.tgz",
-      "integrity": "sha512-taOaskGt4z4SOANNseOviYDvjEJinIkRgmp7LbKP2YTTmVxWBl87s/uzK9r+44BclBSp2X7K1hqeNfz9JbBeXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18939,8 +15079,6 @@
     },
     "node_modules/hashery": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
-      "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18952,8 +15090,6 @@
     },
     "node_modules/hasown": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
-      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18965,8 +15101,6 @@
     },
     "node_modules/hmac-drbg": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/hmac-drbg/-/hmac-drbg-1.0.1.tgz",
-      "integrity": "sha512-Tti3gMqLdZfhOQY1Mzf/AanLiqh1WTiJgEj26ZuYQ9fbkLomzGchCws4FyrSd4VkpBfiNhaE1On+lOz894jvXg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -18977,15 +15111,11 @@
     },
     "node_modules/hookified": {
       "version": "1.15.1",
-      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
-      "integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/hosted-git-info": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-8.1.0.tgz",
-      "integrity": "sha512-Rw/B2DNQaPBICNXEm8balFz9a6WpZrkCGpcWFpy7nCj+NyhSdqXipmfvtmWt9xGfp0wZnBxB+iVpLmQMYt47Tw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -18997,15 +15127,11 @@
     },
     "node_modules/hosted-git-info/node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/hpack.js": {
       "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/hpack.js/-/hpack.js-2.1.6.tgz",
-      "integrity": "sha512-zJxVehUdMGIKsRaNt7apO2Gqp0BdqW5yaiGHXXmbpvxgBYVZnAql+BJb4RO5ad2MgpbZKn5G6nMnegrH1FcNYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19017,8 +15143,6 @@
     },
     "node_modules/html-encoding-sniffer": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-3.0.0.tgz",
-      "integrity": "sha512-oWv4T4yJ52iKrufjnyZPkrN0CH3QnrUqdB6In1g5Fe1mia8GmF36gnfNySxoZtxD5+NmYw1EElVXiBk93UeskA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19030,8 +15154,6 @@
     },
     "node_modules/html-entities": {
       "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.6.0.tgz",
-      "integrity": "sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==",
       "dev": true,
       "funding": [
         {
@@ -19047,15 +15169,11 @@
     },
     "node_modules/html-escaper": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/html-tags": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-3.3.1.tgz",
-      "integrity": "sha512-ztqyC3kLto0e9WbNp0aeP+M3kTt+nbaIveGmUxAtZa+8iFgKLUOD4YKM5j+f3QD89bra7UeumolZHKuOXnTmeQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19067,14 +15185,10 @@
     },
     "node_modules/html-to-image": {
       "version": "1.11.11",
-      "resolved": "https://registry.npmjs.org/html-to-image/-/html-to-image-1.11.11.tgz",
-      "integrity": "sha512-9gux8QhvjRO/erSnDPv28noDZcPZmYE7e1vFsBLKLlRlKDSqNJYebj6Qz1TGd5lsRV+X+xYyjCKjuZdABinWjA==",
       "license": "MIT"
     },
     "node_modules/htmlescape": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/htmlescape/-/htmlescape-1.1.1.tgz",
-      "integrity": "sha512-eVcrzgbR4tim7c7soKQKtxa/kQM4TzjnlU83rcZ9bHU6t31ehfV7SktN6McWgwPWg+JYMA/O3qpGxBvFq1z2Jg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19083,8 +15197,6 @@
     },
     "node_modules/htmlparser2": {
       "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-10.1.0.tgz",
-      "integrity": "sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==",
       "dev": true,
       "funding": [
         "https://github.com/fb55/htmlparser2?sponsor=1",
@@ -19103,8 +15215,6 @@
     },
     "node_modules/htmlparser2/node_modules/entities": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
-      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -19116,8 +15226,6 @@
     },
     "node_modules/http-auth": {
       "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/http-auth/-/http-auth-4.1.9.tgz",
-      "integrity": "sha512-kvPYxNGc9EKGTXvOMnTBQw2RZfuiSihK/mLw/a4pbtRueTE45S55Lw/3k5CktIf7Ak0veMKEIteDj4YkNmCzmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19132,8 +15240,6 @@
     },
     "node_modules/http-auth-connect": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/http-auth-connect/-/http-auth-connect-1.0.6.tgz",
-      "integrity": "sha512-yaO0QSCPqGCjPrl3qEEHjJP+lwZ6gMpXLuCBE06eWwcXomkI5TARtu0kxf9teFuBj6iaV3Ybr15jaWUvbzNzHw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19142,22 +15248,16 @@
     },
     "node_modules/http-cache-semantics": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
     "node_modules/http-deceiver": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/http-deceiver/-/http-deceiver-1.2.7.tgz",
-      "integrity": "sha512-LmpOGxTfbpgtGVxJrj5k7asXHCgNZp5nLfp+hWc8QQRqtb7fUy6kRY3BO1h9ddF6yIPYUARgxGOwB42DnxIaNw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/http-errors": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19177,8 +15277,6 @@
     },
     "node_modules/http-errors/node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19187,15 +15285,11 @@
     },
     "node_modules/http-parser-js": {
       "version": "0.5.10",
-      "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.5.10.tgz",
-      "integrity": "sha512-Pysuw9XpUq5dVc/2SMHpuTY01RFl8fttgcyunjL7eEMhGM3cI4eOmiCycJDVCo/7O7ClfQD3SaI6ftDzqOXYMA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/http-proxy": {
       "version": "1.18.1",
-      "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
-      "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19209,8 +15303,6 @@
     },
     "node_modules/http-proxy-agent": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-5.0.0.tgz",
-      "integrity": "sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19224,8 +15316,6 @@
     },
     "node_modules/http-proxy-middleware": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-3.0.5.tgz",
-      "integrity": "sha512-GLZZm1X38BPY4lkXA01jhwxvDoOkkXqjgVyUzVxiEK4iuRu03PZoYHhHRwxnfhQMDuaxi3vVri0YgSro/1oWqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19242,8 +15332,6 @@
     },
     "node_modules/http-proxy-middleware/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19260,15 +15348,11 @@
     },
     "node_modules/http-proxy-middleware/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/http-signature": {
       "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/http-signature/-/http-signature-1.3.6.tgz",
-      "integrity": "sha512-3adrsD6zqo4GsTqtO7FyrejHNv+NgiIfAfv68+jVlFmSr9OGy7zrxONceFRLKvnnZA5jbxQBX1u9PpB6Wi32Gw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19282,8 +15366,6 @@
     },
     "node_modules/http2-wrapper": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/http2-wrapper/-/http2-wrapper-1.0.3.tgz",
-      "integrity": "sha512-V+23sDMr12Wnz7iTcDeJr3O6AIxlnvT/bmaAAAP/Xda35C90p9599p0F1eHR/N1KILWSoWVAiOMFjBBXaXSMxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19296,15 +15378,11 @@
     },
     "node_modules/https-browserify": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/https-browserify/-/https-browserify-1.0.0.tgz",
-      "integrity": "sha512-J+FkSdyD+0mA0N+81tMotaRMfSL9SGi+xpD3T6YApKsc3bGSXJlfXri3VyFOeYkfLRQisDk1W+jIFFKBeUBbBg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/https-proxy-agent": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19317,8 +15395,6 @@
     },
     "node_modules/https-proxy-agent/node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19327,8 +15403,6 @@
     },
     "node_modules/human-signals": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-1.1.1.tgz",
-      "integrity": "sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -19337,8 +15411,6 @@
     },
     "node_modules/husky": {
       "version": "9.1.7",
-      "resolved": "https://registry.npmjs.org/husky/-/husky-9.1.7.tgz",
-      "integrity": "sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -19353,8 +15425,6 @@
     },
     "node_modules/hyperdyperid": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/hyperdyperid/-/hyperdyperid-1.2.0.tgz",
-      "integrity": "sha512-Y93lCzHYgGWdrJ66yIktxiaGULYc6oGiABxhcO5AufBeOyoIdZF7bIfLaOrbM0iGIOXQQgxxRrFEnb+Y6w1n4A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19363,8 +15433,6 @@
     },
     "node_modules/i18next": {
       "version": "23.16.8",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-23.16.8.tgz",
-      "integrity": "sha512-06r/TitrM88Mg5FdUXAKL96dJMzgqLE5dv3ryBAra4KCwD9mJ4ndOTS95ZuymIGoE+2hzfdaMak2X11/es7ZWg==",
       "dev": true,
       "funding": [
         {
@@ -19387,8 +15455,6 @@
     },
     "node_modules/iconv-lite": {
       "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19404,8 +15470,6 @@
     },
     "node_modules/icss-utils": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/icss-utils/-/icss-utils-5.1.0.tgz",
-      "integrity": "sha512-soFhflCVWLfRNOPU3iv5Z9VUdT44xFRbzjLsEzSr5AQmgqPMTHdU3PMT1Cf1ssx8fLNJDA1juftYl+PUcv3MqA==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -19417,8 +15481,6 @@
     },
     "node_modules/identity-obj-proxy": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/identity-obj-proxy/-/identity-obj-proxy-3.0.0.tgz",
-      "integrity": "sha512-00n6YnVHKrinT9t0d9+5yZC6UBNJANpYEQvL2LlX6Ab9lnmxzIRcEmTPuyGScvl1+jKuCICX1Z0Ab1pPKKdikA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19430,8 +15492,6 @@
     },
     "node_modules/ieee754": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
       "dev": true,
       "funding": [
         {
@@ -19451,8 +15511,6 @@
     },
     "node_modules/ignore": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19461,8 +15519,6 @@
     },
     "node_modules/ignore-walk": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-7.0.0.tgz",
-      "integrity": "sha512-T4gbf83A4NH95zvhVYZc+qWocBBGlpzUXLPGurJggw/WIOwicfXJChLDP/iBZnN5WqROSu5Bm3hhle4z8a8YGQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -19474,8 +15530,6 @@
     },
     "node_modules/image-size": {
       "version": "0.5.5",
-      "resolved": "https://registry.npmjs.org/image-size/-/image-size-0.5.5.tgz",
-      "integrity": "sha512-6TDAlDPZxUFCv+fuOkIoXT/V/f3Qbq8e37p+YOiYrUv3v9cc3/6x78VdfPgFVaB9dZYeLUfKgHRebpkm/oP2VQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -19488,15 +15542,11 @@
     },
     "node_modules/immutable": {
       "version": "5.1.8",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.8.tgz",
-      "integrity": "sha512-TM5YqrGeTsVIPPpILzeqZ8D2Zc2TvNgSDi88zPF2a4cyqQdWV/wVWBDRDbNzzrLeRWScrFcOX9lW2iX6GOtUDw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/import-fresh": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
-      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19512,8 +15562,6 @@
     },
     "node_modules/import-local": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
-      "integrity": "sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19532,8 +15580,6 @@
     },
     "node_modules/import-local/node_modules/find-up": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19546,8 +15592,6 @@
     },
     "node_modules/import-local/node_modules/locate-path": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19559,8 +15603,6 @@
     },
     "node_modules/import-local/node_modules/p-limit": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19575,8 +15617,6 @@
     },
     "node_modules/import-local/node_modules/p-locate": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19588,8 +15628,6 @@
     },
     "node_modules/import-local/node_modules/pkg-dir": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
-      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19601,8 +15639,6 @@
     },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19611,8 +15647,6 @@
     },
     "node_modules/indent-string": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-3.2.0.tgz",
-      "integrity": "sha512-BYqTHXTGUIvg7t1r4sJNKcbDZkL92nkXA8YtRpbjFHRHGDL/NtUeiBJMeE60kIFN/Mg8ESaWQvftaYMGJzQZCQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19621,9 +15655,6 @@
     },
     "node_modules/inflight": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -19633,14 +15664,10 @@
     },
     "node_modules/inherits": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
     "node_modules/ini": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-5.0.0.tgz",
-      "integrity": "sha512-+N0ngpO3e7cRUWOJAS7qw0IZIVc6XPrW4MlFBdD066F2L4k1L6ker3hLqSq7iXxU5tgS4WGkIUElWn5vogAEnw==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -19649,8 +15676,6 @@
     },
     "node_modules/inline-source-map": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/inline-source-map/-/inline-source-map-0.6.3.tgz",
-      "integrity": "sha512-1aVsPEsJWMJq/pdMU61CDlm1URcW702MTB4w9/zUjMus6H/Py8o7g68Pr9D4I6QluWGt/KdmswuRhaA05xVR1w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19659,8 +15684,6 @@
     },
     "node_modules/inline-source-map/node_modules/source-map": {
       "version": "0.5.7",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-      "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -19669,8 +15692,6 @@
     },
     "node_modules/insert-module-globals": {
       "version": "7.2.1",
-      "resolved": "https://registry.npmjs.org/insert-module-globals/-/insert-module-globals-7.2.1.tgz",
-      "integrity": "sha512-ufS5Qq9RZN+Bu899eA9QCAYThY+gGW7oRkmb0vC93Vlyu/CFGcH0OYPEjVkDXA5FEbTt1+VWzdoOD3Ny9N+8tg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19691,8 +15712,6 @@
     },
     "node_modules/internal-slot": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
-      "integrity": "sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19706,8 +15725,6 @@
     },
     "node_modules/internmap": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
-      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -19715,8 +15732,6 @@
     },
     "node_modules/ip-address": {
       "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19725,8 +15740,6 @@
     },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19735,8 +15748,6 @@
     },
     "node_modules/is-arguments": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.2.0.tgz",
-      "integrity": "sha512-7bVbi0huj/wrIAOzb8U1aszg9kdi3KN/CyU19CTI7tAoZYEZoL9yCDXpbXN+uPsuWnP02cyug1gleqq+TU+YCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19752,8 +15763,6 @@
     },
     "node_modules/is-array-buffer": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.5.tgz",
-      "integrity": "sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19770,15 +15779,11 @@
     },
     "node_modules/is-arrayish": {
       "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-async-function": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-async-function/-/is-async-function-2.1.1.tgz",
-      "integrity": "sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19797,8 +15802,6 @@
     },
     "node_modules/is-bigint": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.1.0.tgz",
-      "integrity": "sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19813,8 +15816,6 @@
     },
     "node_modules/is-binary-path": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
-      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19826,8 +15827,6 @@
     },
     "node_modules/is-boolean-object": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.2.2.tgz",
-      "integrity": "sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19843,15 +15842,11 @@
     },
     "node_modules/is-buffer": {
       "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-callable": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
-      "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19863,8 +15858,6 @@
     },
     "node_modules/is-ci": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-3.0.1.tgz",
-      "integrity": "sha512-ZYvCgrefwqoQ6yTyYUbQu64HsITZ3NfKX1lzaEYdkTDcfKzzCI/wthRRYKkdjHKFVgNiXKAKm65Zo1pk2as/QQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19876,8 +15869,6 @@
     },
     "node_modules/is-core-module": {
       "version": "2.16.2",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
-      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19892,8 +15883,6 @@
     },
     "node_modules/is-data-view": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-data-view/-/is-data-view-1.0.2.tgz",
-      "integrity": "sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19910,8 +15899,6 @@
     },
     "node_modules/is-date-object": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.1.0.tgz",
-      "integrity": "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19927,8 +15914,6 @@
     },
     "node_modules/is-directory": {
       "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/is-directory/-/is-directory-0.3.1.tgz",
-      "integrity": "sha512-yVChGzahRFvbkscn2MlwGismPO12i9+znNruC5gVEntG3qu0xQMzsGg/JFbrsqDOHtHFPci+V5aP5T9I+yeKqw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19937,8 +15922,6 @@
     },
     "node_modules/is-docker": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
-      "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -19953,8 +15936,6 @@
     },
     "node_modules/is-extglob": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -19962,8 +15943,6 @@
     },
     "node_modules/is-finalizationregistry": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-finalizationregistry/-/is-finalizationregistry-1.1.1.tgz",
-      "integrity": "sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -19978,8 +15957,6 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-4.0.0.tgz",
-      "integrity": "sha512-O4L094N2/dZ7xqVdrXhh9r1KODPJpFms8B5sGdJLPy664AgvXsreZUyCQQNItZRDlYug4xStLjNp/sz3HvBowQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -19991,15 +15968,11 @@
     },
     "node_modules/is-generator": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/is-generator/-/is-generator-1.0.3.tgz",
-      "integrity": "sha512-G56jBpbJeg7ds83HW1LuShNs8J73Fv3CPz/bmROHOHlnKkN8sWb9ujiagjmxxMUywftgq48HlBZELKKqFLk0oA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-generator-fn": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
-      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20008,8 +15981,6 @@
     },
     "node_modules/is-generator-function": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.1.2.tgz",
-      "integrity": "sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20028,8 +15999,6 @@
     },
     "node_modules/is-glob": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "license": "MIT",
       "dependencies": {
         "is-extglob": "^2.1.1"
@@ -20040,8 +16009,6 @@
     },
     "node_modules/is-inside-container": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
-      "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20059,8 +16026,6 @@
     },
     "node_modules/is-installed-globally": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/is-installed-globally/-/is-installed-globally-0.4.0.tgz",
-      "integrity": "sha512-iwGqO3J21aaSkC7jWnHP/difazwS7SFeIqxv6wEtLU8Y5KlzFTjyqcSIT0d8s4+dDhKytsk9PJZ2BkS5eZwQRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20076,8 +16041,6 @@
     },
     "node_modules/is-interactive": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
-      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20086,8 +16049,6 @@
     },
     "node_modules/is-localhost-ip": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/is-localhost-ip/-/is-localhost-ip-2.0.0.tgz",
-      "integrity": "sha512-vlgs2cSgMOfnKU8c1ewgKPyum9rVrjjLLW2HBdL5i0iAJjOs8NY55ZBd/hqUTaYR0EO9CKZd3hVSC2HlIbygTQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20096,8 +16057,6 @@
     },
     "node_modules/is-map": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.3.tgz",
-      "integrity": "sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20109,8 +16068,6 @@
     },
     "node_modules/is-negative-zero": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.3.tgz",
-      "integrity": "sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20122,8 +16079,6 @@
     },
     "node_modules/is-network-error": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.2.tgz",
-      "integrity": "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20135,8 +16090,6 @@
     },
     "node_modules/is-number": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "license": "MIT",
       "engines": {
         "node": ">=0.12.0"
@@ -20144,8 +16097,6 @@
     },
     "node_modules/is-number-object": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.1.1.tgz",
-      "integrity": "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20161,8 +16112,6 @@
     },
     "node_modules/is-path-inside": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz",
-      "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20171,8 +16120,6 @@
     },
     "node_modules/is-plain-obj": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-3.0.0.tgz",
-      "integrity": "sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20184,8 +16131,6 @@
     },
     "node_modules/is-plain-object": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
-      "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20194,15 +16139,11 @@
     },
     "node_modules/is-potential-custom-element-name": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-regex": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz",
-      "integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20220,8 +16161,6 @@
     },
     "node_modules/is-set": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.3.tgz",
-      "integrity": "sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20233,8 +16172,6 @@
     },
     "node_modules/is-shared-array-buffer": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.4.tgz",
-      "integrity": "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20249,8 +16186,6 @@
     },
     "node_modules/is-stream": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz",
-      "integrity": "sha512-uQPm8kcs47jx38atAcWTVxyltQYoPT68y9aWYdV6yWXSyW8mzSat0TL6CiWdZeCdF3KrAvpVtnHbTv4RN+rqdQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20259,8 +16194,6 @@
     },
     "node_modules/is-string": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.1.1.tgz",
-      "integrity": "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20276,8 +16209,6 @@
     },
     "node_modules/is-symbol": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.1.1.tgz",
-      "integrity": "sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20294,8 +16225,6 @@
     },
     "node_modules/is-typed-array": {
       "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.15.tgz",
-      "integrity": "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20310,15 +16239,11 @@
     },
     "node_modules/is-typedarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
-      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-unicode-supported": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
-      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20330,8 +16255,6 @@
     },
     "node_modules/is-weakmap": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.2.tgz",
-      "integrity": "sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20343,8 +16266,6 @@
     },
     "node_modules/is-weakref": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.1.1.tgz",
-      "integrity": "sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20359,8 +16280,6 @@
     },
     "node_modules/is-weakset": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.4.tgz",
-      "integrity": "sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20376,15 +16295,11 @@
     },
     "node_modules/is-what": {
       "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/is-what/-/is-what-3.14.1.tgz",
-      "integrity": "sha512-sNxgpk9793nzSs7bA6JQJGeIuRBQhAaNGG77kzYQgMkrID+lS6SlK07K5LaptscDlSaIgH+GPFzf+d75FVxozA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-wsl": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
-      "integrity": "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20399,22 +16314,16 @@
     },
     "node_modules/isarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/isobject": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-      "integrity": "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20423,8 +16332,6 @@
     },
     "node_modules/isomorphic-form-data": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isomorphic-form-data/-/isomorphic-form-data-2.0.0.tgz",
-      "integrity": "sha512-TYgVnXWeESVmQSg4GLVbalmQ+B4NPi/H4eWxqALKj63KsUrcu301YDjBqaOw3h+cbak7Na4Xyps3BiptHtxTfg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20433,15 +16340,11 @@
     },
     "node_modules/isstream": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/isstream/-/isstream-0.1.2.tgz",
-      "integrity": "sha512-Yljz7ffyPbrLpLngrMtZ7NduUgVvi6wG9RJ9IUcyCd59YQ911PBJphODUcbOVbqYfxe1wuYf/LJ8PauMRwsM/g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/istanbul-lib-coverage": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
-      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -20450,8 +16353,6 @@
     },
     "node_modules/istanbul-lib-instrument": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-6.0.3.tgz",
-      "integrity": "sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -20467,8 +16368,6 @@
     },
     "node_modules/istanbul-lib-report": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
-      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -20482,8 +16381,6 @@
     },
     "node_modules/istanbul-lib-source-maps": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz",
-      "integrity": "sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -20497,8 +16394,6 @@
     },
     "node_modules/istanbul-lib-source-maps/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -20507,8 +16402,6 @@
     },
     "node_modules/istanbul-reports": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
-      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -20521,8 +16414,6 @@
     },
     "node_modules/jackspeak": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.2.3.tgz",
-      "integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -20537,8 +16428,6 @@
     },
     "node_modules/jest": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-29.7.0.tgz",
-      "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20564,8 +16453,6 @@
     },
     "node_modules/jest-canvas-mock": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/jest-canvas-mock/-/jest-canvas-mock-2.4.0.tgz",
-      "integrity": "sha512-mmMpZzpmLzn5vepIaHk5HoH3Ka4WykbSoLuG/EKoJd0x0ID/t+INo1l8ByfcUJuDM+RIsL4QDg/gDnBbrj2/IQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20575,8 +16462,6 @@
     },
     "node_modules/jest-changed-files": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-29.7.0.tgz",
-      "integrity": "sha512-fEArFiwf1BpQ+4bXSprcDc3/x4HSzL4al2tozwVpDFpsxALjLYdyiIK4e5Vz66GQJIbXJ82+35PtysofptNX2w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20590,8 +16475,6 @@
     },
     "node_modules/jest-changed-files/node_modules/execa": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20614,8 +16497,6 @@
     },
     "node_modules/jest-changed-files/node_modules/get-stream": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20627,8 +16508,6 @@
     },
     "node_modules/jest-changed-files/node_modules/human-signals": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -20637,8 +16516,6 @@
     },
     "node_modules/jest-changed-files/node_modules/is-stream": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20650,15 +16527,11 @@
     },
     "node_modules/jest-changed-files/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/jest-circus": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-29.7.0.tgz",
-      "integrity": "sha512-3E1nCMgipcTkCocFwM90XXQab9bS+GMsjdpmPrlelaxwD93Ad8iVEjX/vvHPdLPnFf+L40u+5+iutRdA1N9myw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20689,8 +16562,6 @@
     },
     "node_modules/jest-circus/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20706,8 +16577,6 @@
     },
     "node_modules/jest-circus/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20716,8 +16585,6 @@
     },
     "node_modules/jest-cli": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-29.7.0.tgz",
-      "integrity": "sha512-OVVobw2IubN/GSYsxETi+gOe7Ka59EFMR/twOU3Jb2GnKKeMGJB5SGUUrEz3SFVmJASUdZUzy83sLNNQ2gZslg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20750,8 +16617,6 @@
     },
     "node_modules/jest-cli/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20767,8 +16632,6 @@
     },
     "node_modules/jest-config": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-29.7.0.tgz",
-      "integrity": "sha512-uXbpfeQ7R6TZBqI3/TxCU4q4ttk3u0PJeC+E0zbfSoSjq6bJ7buBPxzQPL0ifrkY4DNu4JUdk0ImlBUYi840eQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20813,8 +16676,6 @@
     },
     "node_modules/jest-config/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20824,8 +16685,6 @@
     },
     "node_modules/jest-config/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20841,9 +16700,6 @@
     },
     "node_modules/jest-config/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -20863,8 +16719,6 @@
     },
     "node_modules/jest-config/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -20876,8 +16730,6 @@
     },
     "node_modules/jest-config/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20886,8 +16738,6 @@
     },
     "node_modules/jest-diff": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-29.7.0.tgz",
-      "integrity": "sha512-LMIgiIrhigmPrs03JHpxUh2yISK3vLFPkAodPeo0+BuF7wA2FoQbkEg1u8gBYBThncu7e1oEDUfIXVuTqLRUjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20902,8 +16752,6 @@
     },
     "node_modules/jest-diff/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20919,8 +16767,6 @@
     },
     "node_modules/jest-docblock": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-29.7.0.tgz",
-      "integrity": "sha512-q617Auw3A612guyaFgsbFeYpNP5t2aoUNLwBUbc/0kD1R4t9ixDbyFTHd1nok4epoVFpr7PmeWHrhvuV3XaJ4g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20932,8 +16778,6 @@
     },
     "node_modules/jest-each": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-29.7.0.tgz",
-      "integrity": "sha512-gns+Er14+ZrEoC5fhOfYCY1LOHHr0TI+rQUHZS8Ttw2l7gl+80eHc/gFf2Ktkw0+SIACDTeWvpFcv3B04VembQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20949,8 +16793,6 @@
     },
     "node_modules/jest-each/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20966,8 +16808,6 @@
     },
     "node_modules/jest-environment-jsdom": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-29.7.0.tgz",
-      "integrity": "sha512-k9iQbsf9OyOfdzWH8HDmrRT0gSIcX+FLNW7IQq94tFX0gynPwqDTW0Ho6iMVNjGz/nb+l/vW3dWM2bbLLpkbXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -20994,8 +16834,6 @@
     },
     "node_modules/jest-environment-node": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-29.7.0.tgz",
-      "integrity": "sha512-DOSwCRqXirTOyheM+4d5YZOrWcdu0LNZ87ewUoywbcb2XR4wKgqiG8vNeYwhjFMbEkfju7wx2GYH0P2gevGvFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21012,8 +16850,6 @@
     },
     "node_modules/jest-get-type": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-29.6.3.tgz",
-      "integrity": "sha512-zrteXnqYxfQh7l5FHyL38jL39di8H8rHoecLH3JNxH3BwOrBsNeabdap5e0I23lD4HHI8W5VFBZqG4Eaq5LNcw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21022,8 +16858,6 @@
     },
     "node_modules/jest-haste-map": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-29.7.0.tgz",
-      "integrity": "sha512-fP8u2pyfqx0K1rGn1R9pyE0/KTn+G7PxktWidOBTqFPLYX0b9ksaMFkhK5vrS3DVun09pckLdlx90QthlW7AmA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21048,8 +16882,6 @@
     },
     "node_modules/jest-jasmine2": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-jasmine2/-/jest-jasmine2-28.1.3.tgz",
-      "integrity": "sha512-nlNWJY1u62w+WAVgnXOQTdxFdZhqlxpKvMTn1cOK1QHX2oRrkPV3JcIcJfXwcGcifttOJZhExcgDUqSHrYQ6Dw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21077,8 +16909,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/console": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-28.1.3.tgz",
-      "integrity": "sha512-QPAkP5EwKdK/bxIr6C1I4Vs0rm2nHiANzj/Z5X2JQkrZo6IqvC4ldZ9K95tF0HdidhA8Bo6egxSzUFPYKcEXLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21095,8 +16925,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/environment": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-28.1.3.tgz",
-      "integrity": "sha512-1bf40cMFTEkKyEf585R9Iz1WayDjHoHqvts0XFYEqyKM3cFWDpeMoqKKTAF9LSYQModPUlh8FKptoM2YcMWAXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21111,8 +16939,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/expect": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-28.1.3.tgz",
-      "integrity": "sha512-lzc8CpUbSoE4dqT0U+g1qODQjBRHPpCPXissXD4mS9+sWQdmmpeJ9zSH1rS1HEkrsMN0fb7nKrJ9giAR1d3wBw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21125,8 +16951,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/expect-utils": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-28.1.3.tgz",
-      "integrity": "sha512-wvbi9LUrHJLn3NlDW6wF2hvIMtd4JUl2QNVrjq+IBSHirgfrR3o9RnVtxzdEGO2n9JyIWwHnLfby5KzqBGg2YA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21138,8 +16962,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/fake-timers": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-28.1.3.tgz",
-      "integrity": "sha512-D/wOkL2POHv52h+ok5Oj/1gOG9HSywdoPtFsRCUmlCILXNn5eIWmcnd3DIiWlJnpGvQtmajqBP95Ei0EimxfLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21156,8 +16978,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/globals": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-28.1.3.tgz",
-      "integrity": "sha512-XFU4P4phyryCXu1pbcqMO0GSQcYe1IsalYCDzRNyhetyeyxMcIxa11qPNDpVNLeretItNqEmYYQn1UYz/5x1NA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21171,8 +16991,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/schemas": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-28.1.3.tgz",
-      "integrity": "sha512-/l/VWsdt/aBXgjshLWOFyFt3IVdYypu5y2Wn2rOO1un6nkqIn8SLXzgIMYXFyYsRWDyF5EthmKJMIdJvk08grg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21184,8 +17002,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/test-result": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-28.1.3.tgz",
-      "integrity": "sha512-kZAkxnSE+FqE8YjW8gNuoVkkC9I7S1qmenl8sGcDOLropASP+BkcGKwhXoyqQuGOGeYY0y/ixjrd/iERpEXHNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21200,8 +17016,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/transform": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-28.1.3.tgz",
-      "integrity": "sha512-u5dT5di+oFI6hfcLOHGTAfmUxFRrjK+vnaP0kkVow9Md/M7V/MxqQMOz/VV25UZO8pzeA9PjfTpOu6BDuwSPQA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21227,8 +17041,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@jest/types": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.3.tgz",
-      "integrity": "sha512-RyjiyMUZrKz/c+zlMFO1pm70DcIlST8AeWTkoUdZevew44wcNZQHsEVOiCVtgVnlFFD82FPaXycys58cf2muVQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21245,15 +17057,11 @@
     },
     "node_modules/jest-jasmine2/node_modules/@sinclair/typebox": {
       "version": "0.24.51",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.24.51.tgz",
-      "integrity": "sha512-1P1OROm/rdubP5aFDSZQILU0vrLCJ4fvHt6EoqHEM+2D/G5MK3bIaymUKLit8Js9gbns5UyJnkP/TZROLw4tUA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/jest-jasmine2/node_modules/@sinonjs/commons": {
       "version": "1.8.6",
-      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.8.6.tgz",
-      "integrity": "sha512-Ky+XkAkqPZSm3NLBeUng77EBQl3cmeJhITaGHdYH8kjVB+aun3S4XBRti2zt17mtt0mIUDiNxYeoJm6drVvBJQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -21262,8 +17070,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/@sinonjs/fake-timers": {
       "version": "9.1.2",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-9.1.2.tgz",
-      "integrity": "sha512-BPS4ynJW/o92PUR4wgriz2Ud5gpST5vz6GQfMixEDK0Z8ZCUv2M7SkBLykH56T++Xs+8ln9zTGbOvNGIe02/jw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -21272,8 +17078,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21283,8 +17087,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21300,8 +17102,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/diff-sequences": {
       "version": "28.1.1",
-      "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-28.1.1.tgz",
-      "integrity": "sha512-FU0iFaH/E23a+a718l8Qa/19bF9p06kgE0KipMOMadwa3SjnaElKzPaUC0vnibs6/B/9ni97s61mcejk8W1fQw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21310,8 +17110,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/execa": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21334,8 +17132,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/expect": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-28.1.3.tgz",
-      "integrity": "sha512-eEh0xn8HlsuOBxFgIss+2mX85VAS4Qy3OSkjV7rlBWljtA4oWH37glVGyOZSZvErDT/yBywZdPGwCXuTvSG85g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21351,8 +17147,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/get-stream": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21364,9 +17158,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -21386,8 +17177,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/human-signals": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -21396,8 +17185,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/is-stream": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21409,8 +17196,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-diff": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-28.1.3.tgz",
-      "integrity": "sha512-8RqP1B/OXzjjTWkqMX67iqgwBVJRgCyKD3L9nq+6ZqJMdvjE8RgHktqZ6jNrkdMT+dJuYNI3rhQpxaz7drJHfw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21425,8 +17210,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-each": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-28.1.3.tgz",
-      "integrity": "sha512-arT1z4sg2yABU5uogObVPvSlSMQlDA48owx07BDPAiasW0yYpYHYOo4HHLz9q0BVzDVU4hILFjzJw0So9aCL/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21442,8 +17225,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-get-type": {
       "version": "28.0.2",
-      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-28.0.2.tgz",
-      "integrity": "sha512-ioj2w9/DxSYHfOm5lJKCdcAmPJzQXmbM/Url3rhlghrPvT3tt+7a/+oXc9azkKmLvoiXjtV83bEWqi+vs5nlPA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21452,8 +17233,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-haste-map": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-28.1.3.tgz",
-      "integrity": "sha512-3S+RQWDXccXDKSWnkHa/dPwt+2qwA8CJzR61w3FoYCvoo3Pn8tvGcysmMF0Bj0EX5RYvAI2EIvC57OmotfdtKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21478,8 +17257,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-matcher-utils": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-28.1.3.tgz",
-      "integrity": "sha512-kQeJ7qHemKfbzKoGjHHrRKH6atgxMk8Enkk2iPQ3XwO6oE/KYD8lMYOziCkeSB9G4adPM4nR1DE8Tf5JeWH6Bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21494,8 +17271,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-message-util": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-28.1.3.tgz",
-      "integrity": "sha512-PFdn9Iewbt575zKPf1286Ht9EPoJmYT7P0kY+RibeYZ2XtOr53pDLEFoTWXbd1h4JiGiWpTBC84fc8xMXQMb7g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21515,8 +17290,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-mock": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-28.1.3.tgz",
-      "integrity": "sha512-o3J2jr6dMMWYVH4Lh/NKmDXdosrsJgi4AviS8oXLujcjpCMBb1FMsblDnOXKZKfSiHLxYub1eS0IHuRXsio9eA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21529,8 +17302,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-regex-util": {
       "version": "28.0.2",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-28.0.2.tgz",
-      "integrity": "sha512-4s0IgyNIy0y9FK+cjoVYoxamT7Zeo7MhzqRGx7YDYmaQn1wucY9rotiGkBzzcMXTtjrCAP/f7f+E0F7+fxPNdw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21539,8 +17310,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-resolve": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-28.1.3.tgz",
-      "integrity": "sha512-Z1W3tTjE6QaNI90qo/BJpfnvpxtaFTFw5CDgwpyE/Kz8U/06N1Hjf4ia9quUhCh39qIGWF1ZuxFiBiJQwSEYKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21560,8 +17329,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-runtime": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-28.1.3.tgz",
-      "integrity": "sha512-NU+881ScBQQLc1JHG5eJGU7Ui3kLKrmwCPPtYsJtBykixrM2OhVQlpMmFWJjMyDfdkGgBMNjXCGB/ebzsgNGQw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21594,8 +17361,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-snapshot": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-28.1.3.tgz",
-      "integrity": "sha512-4lzMgtiNlc3DU/8lZfmqxN3AYD6GGLbl+72rdBpXvcV+whX7mDrREzkPdp2RnmfIiWBg1YbuFSkXduF2JcafJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21629,8 +17394,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-util": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-28.1.3.tgz",
-      "integrity": "sha512-XdqfpHwpcSRko/C35uLYFM2emRAltIIKZiJ9eAmhjsj0CqZMa0p1ib0R5fWIqGhn1a103DebTbpqIaP1qCQ6tQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21647,8 +17410,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-validate": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-28.1.3.tgz",
-      "integrity": "sha512-SZbOGBWEsaTxBGCOpsRWlXlvNkvTkY0XxRfh7zYmvd8uL5Qzyg0CHAXiXKROflh801quA6+/DsT4ODDthOC/OA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21665,8 +17426,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-worker": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-28.1.3.tgz",
-      "integrity": "sha512-CqRA220YV/6jCo8VWvAt1KKx6eek1VIHMPeLEbpcfSfkEeWyBNppynM/o6q+Wmw+sOhos2ml34wZbSX3G13//g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21680,8 +17439,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/jest-worker/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21696,8 +17453,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -21709,8 +17464,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21722,8 +17475,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/pretty-format": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-28.1.3.tgz",
-      "integrity": "sha512-8gFb/To0OmxHR9+ZTb14Df2vNxdGCX8g1xWGUTqUw5TiZvcQf5sHKObd5UcPyLLyowNwDAMTF3XWOG1B6mxl1Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21738,8 +17489,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/pretty-format/node_modules/ansi-styles": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21751,8 +17500,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/resolve.exports": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-1.1.1.tgz",
-      "integrity": "sha512-/NtpHNDN7jWhAaQ9BvBUYZ6YTXsRBgfqWFWP7BZBaoMJO/I3G5OFzvTuWNlZC3aPjins1F+TNrLKsGbH4rfsRQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21761,15 +17508,11 @@
     },
     "node_modules/jest-jasmine2/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/jest-jasmine2/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21778,8 +17521,6 @@
     },
     "node_modules/jest-jasmine2/node_modules/type-detect": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21788,8 +17529,6 @@
     },
     "node_modules/jest-leak-detector": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-29.7.0.tgz",
-      "integrity": "sha512-kYA8IJcSYtST2BY9I+SMC32nDpBT3J2NvWJx8+JCuCdl/CR1I4EKUJROiP8XtCcxqgTTBGJNdbB1A8XRKbTetw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21802,8 +17541,6 @@
     },
     "node_modules/jest-matcher-utils": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-29.7.0.tgz",
-      "integrity": "sha512-sBkD+Xi9DtcChsI3L3u0+N0opgPYnCRPtGcQYrgXmR+hmt/fYfWAL0xRXYU8eWOdfuLgBe0YCW3AFtnRLagq/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21818,8 +17555,6 @@
     },
     "node_modules/jest-matcher-utils/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21835,8 +17570,6 @@
     },
     "node_modules/jest-message-util": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-29.7.0.tgz",
-      "integrity": "sha512-GBEV4GRADeP+qtB2+6u61stea8mGcOT4mCtrYISZwfu9/ISHFJ/5zOMXYbpBE9RsS5+Gb63DW4FgmnKJ79Kf6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21856,8 +17589,6 @@
     },
     "node_modules/jest-message-util/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21873,8 +17604,6 @@
     },
     "node_modules/jest-message-util/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21883,8 +17612,6 @@
     },
     "node_modules/jest-mock": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-29.7.0.tgz",
-      "integrity": "sha512-ITOMZn+UkYS4ZFh83xYAOzWStloNzJFO2s8DWrE4lhtGD+AorgnbkiKERe4wQVBydIGPx059g6riW5Btp6Llnw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21898,8 +17625,6 @@
     },
     "node_modules/jest-pnp-resolver": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
-      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21916,8 +17641,6 @@
     },
     "node_modules/jest-preset-angular": {
       "version": "14.2.4",
-      "resolved": "https://registry.npmjs.org/jest-preset-angular/-/jest-preset-angular-14.2.4.tgz",
-      "integrity": "sha512-xyhkaiBdn3keBgxxkcbqZu/my3ADU9NcDrz6DaMuGRaxz/bf6ZC1qxZ1eQuz5V1WuA3/rD64VA3Kke8P6E9qNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21945,8 +17668,6 @@
     },
     "node_modules/jest-regex-util": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-29.6.3.tgz",
-      "integrity": "sha512-KJJBsRCyyLNWCNBOvZyRDnAIfUiRJ8v+hOBQYGn8gDyF3UegwiP4gwRR3/SDa42g1YbVycTidUF3rKjyLFDWbg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -21955,8 +17676,6 @@
     },
     "node_modules/jest-resolve": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-29.7.0.tgz",
-      "integrity": "sha512-IOVhZSrg+UvVAshDSDtHyFCCBUl/Q3AAJv8iZ6ZjnZ74xzvwuzLXid9IIIPgTnY62SJjfuupMKZsZQRsCvxEgA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21976,8 +17695,6 @@
     },
     "node_modules/jest-resolve-dependencies": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-29.7.0.tgz",
-      "integrity": "sha512-un0zD/6qxJ+S0et7WxeI3H5XSe9lTBBR7bOHCHXkKR6luG5mwDDlIzVQ0V5cZCuoTgEdcdwzTghYkTWfubi+nA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -21990,8 +17707,6 @@
     },
     "node_modules/jest-resolve/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22007,8 +17722,6 @@
     },
     "node_modules/jest-resolve/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22017,8 +17730,6 @@
     },
     "node_modules/jest-runner": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-29.7.0.tgz",
-      "integrity": "sha512-fsc4N6cPCAahybGBfTRcq5wFR6fpLznMg47sY5aDpsoejOcVYFb07AHuSnR0liMcPTgBsA3ZJL6kFOjPdoNipQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22050,8 +17761,6 @@
     },
     "node_modules/jest-runner/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22067,8 +17776,6 @@
     },
     "node_modules/jest-runner/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -22077,8 +17784,6 @@
     },
     "node_modules/jest-runner/node_modules/source-map-support": {
       "version": "0.5.13",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
-      "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22088,8 +17793,6 @@
     },
     "node_modules/jest-runtime": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-29.7.0.tgz",
-      "integrity": "sha512-gUnLjgwdGqW7B4LvOIkbKs9WGbn+QLqRQQ9juC6HndeDiezIwhDP+mhMwHWCEcfQ5RUXa6OPnFF8BJh5xegwwQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22122,8 +17825,6 @@
     },
     "node_modules/jest-runtime/node_modules/@jest/source-map": {
       "version": "29.6.3",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-29.6.3.tgz",
-      "integrity": "sha512-MHjT95QuipcPrpLM+8JMSzFx6eHp5Bm+4XeFDJlwsvVBjmKNiIAvasGK2fxz2WbGRlnvqehFbh07MMa7n3YJnw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22137,8 +17838,6 @@
     },
     "node_modules/jest-runtime/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22148,8 +17847,6 @@
     },
     "node_modules/jest-runtime/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22165,9 +17862,6 @@
     },
     "node_modules/jest-runtime/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -22187,8 +17881,6 @@
     },
     "node_modules/jest-runtime/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -22200,8 +17892,6 @@
     },
     "node_modules/jest-runtime/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22210,8 +17900,6 @@
     },
     "node_modules/jest-silent-reporter": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/jest-silent-reporter/-/jest-silent-reporter-0.6.0.tgz",
-      "integrity": "sha512-4nmS+5o7ycVlvbQOTx7CnGdbBtP2646hnDgQpQLaVhjHcQNHD+gqBAetyjRDlgpZ8+8N82MWI59K+EX2LsVk7g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22221,8 +17909,6 @@
     },
     "node_modules/jest-silent-reporter/node_modules/@jest/types": {
       "version": "26.6.2",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-26.6.2.tgz",
-      "integrity": "sha512-fC6QCp7Sc5sX6g8Tvbmj4XUTbyrik0akgRy03yjXbQaBWWNWGE7SGtJk98m0N8nzegD/7SggrUlivxo5ax4KWQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22238,8 +17924,6 @@
     },
     "node_modules/jest-silent-reporter/node_modules/@types/yargs": {
       "version": "15.0.20",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-15.0.20.tgz",
-      "integrity": "sha512-KIkX+/GgfFitlASYCGoSF+T4XRXhOubJLhkLVtSfsRTe9jWMmuM2g28zQ41BtPTG7TRBb2xHW+LCNVE9QR/vsg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22248,8 +17932,6 @@
     },
     "node_modules/jest-silent-reporter/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22265,15 +17947,11 @@
     },
     "node_modules/jest-silent-reporter/node_modules/ci-info": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-2.0.0.tgz",
-      "integrity": "sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/jest-silent-reporter/node_modules/is-ci": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-2.0.0.tgz",
-      "integrity": "sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22285,8 +17963,6 @@
     },
     "node_modules/jest-silent-reporter/node_modules/jest-util": {
       "version": "26.6.2",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-26.6.2.tgz",
-      "integrity": "sha512-MDW0fKfsn0OI7MS7Euz6h8HNDXVQ0gaM9uW6RjfDmd1DAFcaxX9OqIakHIqhbnmF08Cf2DLDG+ulq8YQQ0Lp0Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22303,8 +17979,6 @@
     },
     "node_modules/jest-snapshot": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-29.7.0.tgz",
-      "integrity": "sha512-Rm0BMWtxBcioHr1/OX5YCP8Uov4riHvKPknOGs804Zg9JGZgmIBkbtlxJC/7Z4msKYVbIJtfU+tKb8xlYNfdkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22335,8 +18009,6 @@
     },
     "node_modules/jest-snapshot/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22352,8 +18024,6 @@
     },
     "node_modules/jest-util": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-29.7.0.tgz",
-      "integrity": "sha512-z6EbKajIpqGKU56y5KBUgy1dt1ihhQJgWzUlZHArA/+X2ad7Cb5iF+AK1EWVL/Bo7Rz9uurpqw6SiBCefUbCGA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22370,8 +18040,6 @@
     },
     "node_modules/jest-util/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22387,8 +18055,6 @@
     },
     "node_modules/jest-util/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22400,8 +18066,6 @@
     },
     "node_modules/jest-validate": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-29.7.0.tgz",
-      "integrity": "sha512-ZB7wHqaRGVw/9hST/OuFUReG7M8vKeq0/J2egIGLdvjHCmYqGARhzXmtgi+gVeZ5uXFF219aOc3Ls2yLg27tkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22418,8 +18082,6 @@
     },
     "node_modules/jest-validate/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22435,8 +18097,6 @@
     },
     "node_modules/jest-watcher": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-29.7.0.tgz",
-      "integrity": "sha512-49Fg7WXkU3Vl2h6LbLtMQ/HyB6rXSIX7SqvBLQmssRBGN9I0PNvPmAmCWSOY6SOvrjhI/F7/bGAv9RtnsPA03g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22455,8 +18115,6 @@
     },
     "node_modules/jest-watcher/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22472,8 +18130,6 @@
     },
     "node_modules/jest-worker": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-29.7.0.tgz",
-      "integrity": "sha512-eIz2msL/EzL9UFTFFx7jBTkeZfku0yUAyZZZmJ93H2TYEiroIx2PQjEXcwYtYl8zXCxb+PAmA2hLIt/6ZEkPHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22488,8 +18144,6 @@
     },
     "node_modules/jest-worker/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22504,8 +18158,6 @@
     },
     "node_modules/jiti": {
       "version": "1.21.7",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
-      "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -22514,8 +18166,6 @@
     },
     "node_modules/joi": {
       "version": "17.13.3",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz",
-      "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -22528,15 +18178,11 @@
     },
     "node_modules/jpeg-js": {
       "version": "0.4.4",
-      "resolved": "https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.4.4.tgz",
-      "integrity": "sha512-WZzeDOEtTOBK4Mdsar0IqEU5sMr3vSV2RqkAIzUEV2BHnUfKGyswWFPFwK5EeDo93K3FohSHbLAjj0s1Wzd+dg==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/js-string-escape": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/js-string-escape/-/js-string-escape-1.0.1.tgz",
-      "integrity": "sha512-Smw4xcfIQ5LVjAOuJCvN/zIodzA/BBSsluuoSykP+lUvScIi4U6RJLfwHet5cxFnCswUjISV8oAXaqaJDY3chg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22545,14 +18191,10 @@
     },
     "node_modules/js-tokens": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
       "license": "MIT"
     },
     "node_modules/js-yaml": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -22563,15 +18205,11 @@
     },
     "node_modules/jsbn": {
       "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz",
-      "integrity": "sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/jsdom": {
       "version": "20.0.3",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-20.0.3.tgz",
-      "integrity": "sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22616,8 +18254,6 @@
     },
     "node_modules/jsdom/node_modules/form-data": {
       "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22633,8 +18269,6 @@
     },
     "node_modules/jsdom/node_modules/https-proxy-agent": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22647,8 +18281,6 @@
     },
     "node_modules/jsesc": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
-      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
       "license": "MIT",
       "bin": {
         "jsesc": "bin/jsesc"
@@ -22659,22 +18291,16 @@
     },
     "node_modules/json-buffer": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-parse-better-errors": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz",
-      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-parse-even-better-errors": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-4.0.0.tgz",
-      "integrity": "sha512-lR4MXjGNgkJc7tkQ97kb2nuEMnNCyU//XYVH0MKTGcXEiSudQ5MKGKen3C5QubYy0vmq+JGitUg92uuywGEwIA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22683,15 +18309,11 @@
     },
     "node_modules/json-schema": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.4.0.tgz",
-      "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
       "dev": true,
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
     "node_modules/json-schema-ref-resolver": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-schema-ref-resolver/-/json-schema-ref-resolver-1.0.1.tgz",
-      "integrity": "sha512-EJAj1pgHc1hxF6vo2Z3s69fMjO1INq6eGHXZ8Z6wCQeldCuwxGK9Sxf4/cScGn3FZubCVUehfWtcDM/PLteCQw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22700,15 +18322,11 @@
     },
     "node_modules/json-schema-traverse": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-stable-stringify": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify/-/json-stable-stringify-0.0.1.tgz",
-      "integrity": "sha512-nKtD/Qxm7tWdZqJoldEC7fF0S41v0mWbeaXG3637stOWfyGxTgWTYE2wtfKmjzpvxv2MA2xzxsXOIiwUpkX6Qw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22717,22 +18335,16 @@
     },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-stringify-safe": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
-      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/json5": {
       "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "license": "MIT",
       "bin": {
         "json5": "lib/cli.js"
@@ -22743,15 +18355,11 @@
     },
     "node_modules/jsonc-parser": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
-      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/jsonfile": {
       "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
-      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22763,8 +18371,6 @@
     },
     "node_modules/jsonify": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/jsonify/-/jsonify-0.0.1.tgz",
-      "integrity": "sha512-2/Ki0GcmuqSrgFyelQq9M05y7PS0mEwuIzrf3f1fPqkVDVRvZrPZtVSMHxdgo8Aq0sxAOb/cr2aqqA3LeWHVPg==",
       "dev": true,
       "license": "Public Domain",
       "funding": {
@@ -22773,8 +18379,6 @@
     },
     "node_modules/jsonparse": {
       "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz",
-      "integrity": "sha512-POQXvpdL69+CluYsillJ7SUhKvytYjW9vG/GKpnf+xP8UWgYEM/RaMzHHofbALDiKbbP1W8UEYmgGl39WkPZsg==",
       "dev": true,
       "engines": [
         "node >= 0.2.0"
@@ -22783,8 +18387,6 @@
     },
     "node_modules/JSONStream": {
       "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/JSONStream/-/JSONStream-1.3.5.tgz",
-      "integrity": "sha512-E+iruNOY8VV9s4JEbe1aNEm6MiszPRr/UfcHMz0TQh1BXSxHK+ASV1R6W4HpjBhSeS+54PIsAMCBmwD06LLsqQ==",
       "dev": true,
       "license": "(MIT OR Apache-2.0)",
       "dependencies": {
@@ -22800,8 +18402,6 @@
     },
     "node_modules/jsprim": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/jsprim/-/jsprim-2.0.2.tgz",
-      "integrity": "sha512-gqXddjPqQ6G40VdnI6T6yObEC+pDNvyP95wdQhkWkg7crHH3km5qP1FsOXEkzEQwnz6gz5qGTn1c2Y52wP3OyQ==",
       "dev": true,
       "engines": [
         "node >=0.6.0"
@@ -22816,15 +18416,11 @@
     },
     "node_modules/jsprim/node_modules/core-util-is": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/jsprim/node_modules/verror": {
       "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
-      "integrity": "sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==",
       "dev": true,
       "engines": [
         "node >=0.6.0"
@@ -22838,8 +18434,6 @@
     },
     "node_modules/karma-source-map-support": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/karma-source-map-support/-/karma-source-map-support-1.4.0.tgz",
-      "integrity": "sha512-RsBECncGO17KAoJCYXjv+ckIz+Ii9NCi+9enk+rq6XC81ezYkb4/RHE6CTXdA7IOJqoF3wcaLfVG0CPmE5ca6A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22848,14 +18442,10 @@
     },
     "node_modules/keycharm": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/keycharm/-/keycharm-0.2.0.tgz",
-      "integrity": "sha512-i/XBRTiLqRConPKioy2oq45vbv04e8x59b0mnsIRQM+7Ec/8BC7UcL5pnC4FMeGb8KwG7q4wOMw7CtNZf5tiIg==",
       "dev": true
     },
     "node_modules/keyv": {
       "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22864,8 +18454,6 @@
     },
     "node_modules/kind-of": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
-      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22874,8 +18462,6 @@
     },
     "node_modules/kleur": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
-      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22884,15 +18470,11 @@
     },
     "node_modules/known-css-properties": {
       "version": "0.36.0",
-      "resolved": "https://registry.npmjs.org/known-css-properties/-/known-css-properties-0.36.0.tgz",
-      "integrity": "sha512-A+9jP+IUmuQsNdsLdcg6Yt7voiMF/D4K83ew0OpJtpu+l34ef7LaohWV0Rc6KNvzw6ZDizkqfyB5JznZnzuKQA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/knuth-shuffle-seeded": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/knuth-shuffle-seeded/-/knuth-shuffle-seeded-1.0.6.tgz",
-      "integrity": "sha512-9pFH0SplrfyKyojCLxZfMcvkhf5hH0d+UwR9nTVJ/DDQJGuzcXjTwB7TP7sDfehSudlGGaOLblmEWqv04ERVWg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -22901,8 +18483,6 @@
     },
     "node_modules/ky": {
       "version": "0.30.0",
-      "resolved": "https://registry.npmjs.org/ky/-/ky-0.30.0.tgz",
-      "integrity": "sha512-X/u76z4JtDVq10u1JA5UQfatPxgPaVDMYTrgHyiTpGN2z4TMEJkIHsoSBBSg9SWZEIXTKsi9kHgiQ9o3Y/4yog==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22914,8 +18494,6 @@
     },
     "node_modules/labeled-stream-splicer": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/labeled-stream-splicer/-/labeled-stream-splicer-2.0.2.tgz",
-      "integrity": "sha512-Ca4LSXFFZUjPScRaqOcFxneA0VpKZr4MMYCljyQr4LIewTLb3Y0IUTIsnBBsVubIeEfxeSZpSjSsRM8APEQaAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22925,8 +18503,6 @@
     },
     "node_modules/launch-editor": {
       "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.1.tgz",
-      "integrity": "sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -22936,8 +18512,6 @@
     },
     "node_modules/lazy-ass": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/lazy-ass/-/lazy-ass-1.6.0.tgz",
-      "integrity": "sha512-cc8oEVoctTvsFZ/Oje/kGnHbpWHYBe8IAJe4C0QNc3t8uM/0Y8+erSz/7Y1ALuXTEZTMvxXwO6YbX1ey3ujiZw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -22946,8 +18520,6 @@
     },
     "node_modules/less": {
       "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/less/-/less-4.2.2.tgz",
-      "integrity": "sha512-tkuLHQlvWUTeQ3doAqnHbNn8T6WX1KA8yvbKG9x4VtKtIjHsVKQZCH11zRgAfbDAXC2UNIg/K9BYAAcEzUIrNg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -22973,8 +18545,6 @@
     },
     "node_modules/less-loader": {
       "version": "12.2.0",
-      "resolved": "https://registry.npmjs.org/less-loader/-/less-loader-12.2.0.tgz",
-      "integrity": "sha512-MYUxjSQSBUQmowc0l5nPieOYwMzGPUaTzB6inNW/bdPEG9zOL3eAAD1Qw5ZxSPk7we5dMojHwNODYMV1hq4EVg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23000,8 +18570,6 @@
     },
     "node_modules/less/node_modules/make-dir": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-2.1.0.tgz",
-      "integrity": "sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -23015,8 +18583,6 @@
     },
     "node_modules/less/node_modules/pify": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-4.0.1.tgz",
-      "integrity": "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -23026,8 +18592,6 @@
     },
     "node_modules/less/node_modules/semver": {
       "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
-      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -23037,8 +18601,6 @@
     },
     "node_modules/less/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -23048,8 +18610,6 @@
     },
     "node_modules/leven": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23058,8 +18618,6 @@
     },
     "node_modules/levn": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23072,8 +18630,6 @@
     },
     "node_modules/license-webpack-plugin": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/license-webpack-plugin/-/license-webpack-plugin-4.0.2.tgz",
-      "integrity": "sha512-771TFWFD70G1wLTC4oU2Cw4qvtmNrIw+wRvBtn+okgHl7slJVi7zfNcdmqDL72BojM30VNJ2UHylr1o77U37Jw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -23090,8 +18646,6 @@
     },
     "node_modules/light-my-request": {
       "version": "5.14.0",
-      "resolved": "https://registry.npmjs.org/light-my-request/-/light-my-request-5.14.0.tgz",
-      "integrity": "sha512-aORPWntbpH5esaYpGOOmri0OHDOe3wC5M2MQxZ9dvMLZm6DnaAn0kJlcbU9hwsQgLzmZyReKwFwwPkR+nHu5kA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -23102,15 +18656,11 @@
     },
     "node_modules/lines-and-columns": {
       "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
-      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/listr2": {
       "version": "8.2.5",
-      "resolved": "https://registry.npmjs.org/listr2/-/listr2-8.2.5.tgz",
-      "integrity": "sha512-iyAZCeyD+c1gPyE9qpFu8af0Y+MRtmKOncdGoA2S5EY8iFq99dmmvkNnHiWo+pj0s7yH7l3KPIgee77tKpXPWQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23127,8 +18677,6 @@
     },
     "node_modules/listr2/node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23140,8 +18688,6 @@
     },
     "node_modules/listr2/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23153,22 +18699,16 @@
     },
     "node_modules/listr2/node_modules/emoji-regex": {
       "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
-      "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/listr2/node_modules/eventemitter3": {
       "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
-      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/listr2/node_modules/string-width": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23185,8 +18725,6 @@
     },
     "node_modules/listr2/node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23201,8 +18739,6 @@
     },
     "node_modules/listr2/node_modules/wrap-ansi": {
       "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz",
-      "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23219,8 +18755,6 @@
     },
     "node_modules/lmdb": {
       "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/lmdb/-/lmdb-3.2.6.tgz",
-      "integrity": "sha512-SuHqzPl7mYStna8WRotY8XX/EUZBjjv3QyKIByeCLFfC9uXT/OIHByEcA07PzbMfQAM0KYJtLgtpMRlIe5dErQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -23246,8 +18780,6 @@
     },
     "node_modules/load-json-file": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/load-json-file/-/load-json-file-4.0.0.tgz",
-      "integrity": "sha512-Kx8hMakjX03tiGTLAIdJ+lL0htKnXjEZN6hk/tozf/WOuYGdZBJrZ+rCJRbVCugsjB3jMLn9746NsQIf5VjBMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23262,8 +18794,6 @@
     },
     "node_modules/load-json-file/node_modules/parse-json": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz",
-      "integrity": "sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23276,8 +18806,6 @@
     },
     "node_modules/load-json-file/node_modules/pify": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz",
-      "integrity": "sha512-C3FsVNH1udSEX48gGX1xfvwTWfsYWj5U+8/uK15BGzIGrKoUpghX8hWZwa/OFnakBiiVNmBvemTJR5mcy7iPcg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23286,8 +18814,6 @@
     },
     "node_modules/load-json-file/node_modules/strip-bom": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23296,8 +18822,6 @@
     },
     "node_modules/loader-runner": {
       "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-4.3.2.tgz",
-      "integrity": "sha512-DFEqQ3ihfS9blba08cLfYf1NRAIEm+dDjic073DRDc3/JspI/8wYmtDsHwd3+4hwvdxSK7PGaElfTmm0awWJ4w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23310,8 +18834,6 @@
     },
     "node_modules/loader-utils": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-3.3.1.tgz",
-      "integrity": "sha512-FMJTLMXfCLMLfJxcX9PFqX5qD88Z5MRGaZCVzfuqeZSPsyiBzs+pahDQjbIWz2QIzPZz0NX9Zy4FX3lmK6YHIg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23320,8 +18842,6 @@
     },
     "node_modules/locate-path": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23336,62 +18856,44 @@
     },
     "node_modules/lodash": {
       "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash-es": {
       "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
-      "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
       "license": "MIT"
     },
     "node_modules/lodash.clonedeep": {
       "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz",
-      "integrity": "sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lodash.debounce": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
-      "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lodash.memoize": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-3.0.4.tgz",
-      "integrity": "sha512-eDn9kqrAmVUC1wmZvlQ6Uhde44n+tXpqPrN8olQJbttgh0oKclk+SF54P47VEGE9CEiMeRwAP8BaM7UHvBkz2A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lodash.once": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
-      "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lodash.truncate": {
       "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.truncate/-/lodash.truncate-4.4.2.tgz",
-      "integrity": "sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/log-symbols": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
-      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23407,8 +18909,6 @@
     },
     "node_modules/log-symbols/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23424,8 +18924,6 @@
     },
     "node_modules/log-update": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/log-update/-/log-update-6.1.0.tgz",
-      "integrity": "sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23444,8 +18942,6 @@
     },
     "node_modules/log-update/node_modules/ansi-escapes": {
       "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.3.0.tgz",
-      "integrity": "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23460,8 +18956,6 @@
     },
     "node_modules/log-update/node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23473,8 +18967,6 @@
     },
     "node_modules/log-update/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23486,8 +18978,6 @@
     },
     "node_modules/log-update/node_modules/cli-cursor": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
-      "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23502,15 +18992,11 @@
     },
     "node_modules/log-update/node_modules/emoji-regex": {
       "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
-      "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/log-update/node_modules/is-fullwidth-code-point": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz",
-      "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23525,8 +19011,6 @@
     },
     "node_modules/log-update/node_modules/onetime": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
-      "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23541,8 +19025,6 @@
     },
     "node_modules/log-update/node_modules/restore-cursor": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
-      "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23558,8 +19040,6 @@
     },
     "node_modules/log-update/node_modules/slice-ansi": {
       "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-7.1.2.tgz",
-      "integrity": "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23575,8 +19055,6 @@
     },
     "node_modules/log-update/node_modules/string-width": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23593,8 +19071,6 @@
     },
     "node_modules/log-update/node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23609,8 +19085,6 @@
     },
     "node_modules/log-update/node_modules/wrap-ansi": {
       "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz",
-      "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23627,8 +19101,6 @@
     },
     "node_modules/loglevel": {
       "version": "1.9.2",
-      "resolved": "https://registry.npmjs.org/loglevel/-/loglevel-1.9.2.tgz",
-      "integrity": "sha512-HgMmCqIJSAKqo68l0rS2AanEWfkxaZ5wNiEFb5ggm08lDs9Xl2KxBlX3PTcaD2chBM1gXAYf491/M2Rv8Jwayg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23641,22 +19113,16 @@
     },
     "node_modules/loglevel-plugin-prefix": {
       "version": "0.8.4",
-      "resolved": "https://registry.npmjs.org/loglevel-plugin-prefix/-/loglevel-plugin-prefix-0.8.4.tgz",
-      "integrity": "sha512-WpG9CcFAOjz/FtNht+QJeGpvVl/cdR6P0z6OcXSkr8wFJOsV2GRj2j10JLfjuA4aYkcKCNIEqRGCyTife9R8/g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/long": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/long/-/long-4.0.0.tgz",
-      "integrity": "sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/loupe": {
       "version": "2.3.7",
-      "resolved": "https://registry.npmjs.org/loupe/-/loupe-2.3.7.tgz",
-      "integrity": "sha512-zSMINGVYkdpYSOBmLi0D1Uo7JU9nVdQKrHxC8eYlV+9YKK9WePqAlL7lSlorG/U2Fw1w0hTBmaa/jrQ3UbPHtA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23665,15 +19131,11 @@
     },
     "node_modules/lower-case": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-1.1.4.tgz",
-      "integrity": "sha512-2Fgx1Ycm599x+WGpIYwJOvsjmXFzTSc34IwDWALRA/8AopUKAVPwfJ+h5+f85BCp0PWmmJcWzEpxOpoXycMpdA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/lowercase-keys": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/lowercase-keys/-/lowercase-keys-2.0.0.tgz",
-      "integrity": "sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23682,8 +19144,6 @@
     },
     "node_modules/lru-cache": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
-      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
       "license": "ISC",
       "dependencies": {
         "yallist": "^3.0.2"
@@ -23691,15 +19151,11 @@
     },
     "node_modules/lunr": {
       "version": "2.3.9",
-      "resolved": "https://registry.npmjs.org/lunr/-/lunr-2.3.9.tgz",
-      "integrity": "sha512-zTU3DaZaF3Rt9rhN3uBMGQD3dD2/vFQqnvZCDv4dl5iOzq2IZQqTxu90r4E5J+nP70J3ilqVCrbho2eWaeW8Ow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/macos-release": {
       "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/macos-release/-/macos-release-2.5.1.tgz",
-      "integrity": "sha512-DXqXhEM7gW59OjZO8NIjBCz9AQ1BEMrfiOAl4AYByHCtVHRF4KoGNO8mqQeM8lRCtQe/UnJ4imO/d2HdkKsd+A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23711,8 +19167,6 @@
     },
     "node_modules/magic-string": {
       "version": "0.30.17",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.17.tgz",
-      "integrity": "sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23721,8 +19175,6 @@
     },
     "node_modules/make-dir": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
-      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23737,15 +19189,11 @@
     },
     "node_modules/make-error": {
       "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/make-fetch-happen": {
       "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
-      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -23767,8 +19215,6 @@
     },
     "node_modules/makeerror": {
       "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -23777,15 +19223,11 @@
     },
     "node_modules/map-stream": {
       "version": "0.0.7",
-      "resolved": "https://registry.npmjs.org/map-stream/-/map-stream-0.0.7.tgz",
-      "integrity": "sha512-C0X0KQmGm3N2ftbTGBhSyuydQ+vV1LC3f3zPvT3RXHXNZrvfPZcoXp/N5DOa8vedX/rTMm2CjTtivFg2STJMRQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/marked": {
       "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-7.0.3.tgz",
-      "integrity": "sha512-ev2uM40p0zQ/GbvqotfKcSWEa59fJwluGZj5dcaUOwDRrB1F3dncdXy8NWUApk4fi8atU3kTBOwjyjZ0ud0dxw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -23797,8 +19239,6 @@
     },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23807,8 +19247,6 @@
     },
     "node_modules/mathml-tag-names": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/mathml-tag-names/-/mathml-tag-names-2.1.3.tgz",
-      "integrity": "sha512-APMBEanjybaPzUrfqU0IMU5I0AswKMH7k8OTLs0vvV4KZpExkTkY87nR/zpbuTPj+gARop7aGUbl11pnDfW6xg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -23818,8 +19256,6 @@
     },
     "node_modules/md5": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/md5/-/md5-2.3.0.tgz",
-      "integrity": "sha512-T1GITYmFaKuO91vxyoQMFETst+O71VUPEU3ze5GNzDm0OWdP8v1ziTaAEPUr/3kLsY3Sftgz242A1SetQiDL7g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -23830,8 +19266,6 @@
     },
     "node_modules/md5.js": {
       "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/md5.js/-/md5.js-1.3.5.tgz",
-      "integrity": "sha512-xitP+WxNPcTTOgnTJcrhM0xvdPepipPSf3I8EIpGKeFLjt3PlJLIDG3u8EX53ZIubkb+5U2+3rELYpEhHhzdkg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23842,15 +19276,11 @@
     },
     "node_modules/mdn-data": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.1.0.tgz",
-      "integrity": "sha512-dbAWH6A+2NGuVJlQFrTKHJc07Vqn5frnhyTOGz+7BsK7V2hHdoBcwoiyV3QVhLHYpM/zqe2OSUn5ZWbVXLBB8A==",
       "dev": true,
       "license": "CC0-1.0"
     },
     "node_modules/media-typer": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23859,8 +19289,6 @@
     },
     "node_modules/memfs": {
       "version": "4.57.8",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-4.57.8.tgz",
-      "integrity": "sha512-bApYhn8BLpFAnAQmFfEl/NPN+8qx5Ar3V4Qt3ek23mVwBEElzV7c6XoPkb/PCG8ZFpowCEpHcPwMFTwHS7tSMA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -23889,8 +19317,6 @@
     },
     "node_modules/memorystream": {
       "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/memorystream/-/memorystream-0.3.1.tgz",
-      "integrity": "sha512-S3UwM3yj5mtUSEfP41UZmt/0SCoVYUcU1rkXv+BQ5Ig8ndL4sPoJNBUJERafdPb5jjHJGuMgytgKvKIf58XNBw==",
       "dev": true,
       "engines": {
         "node": ">= 0.10.0"
@@ -23898,8 +19324,6 @@
     },
     "node_modules/meow": {
       "version": "13.2.0",
-      "resolved": "https://registry.npmjs.org/meow/-/meow-13.2.0.tgz",
-      "integrity": "sha512-pxQJQzB6djGPXh08dacEloMFopsOqGVRKFPYvPOt9XDZ1HasbgDZA74CJGreSU4G3Ak7EFJGoiH2auq+yXISgA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23911,8 +19335,6 @@
     },
     "node_modules/merge-descriptors": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
-      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -23921,15 +19343,11 @@
     },
     "node_modules/merge-stream": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/merge2": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
-      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
       "license": "MIT",
       "engines": {
         "node": ">= 8"
@@ -23937,8 +19355,6 @@
     },
     "node_modules/methods": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
-      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -23947,8 +19363,6 @@
     },
     "node_modules/micromatch": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
       "license": "MIT",
       "dependencies": {
         "braces": "^3.0.3",
@@ -23960,8 +19374,6 @@
     },
     "node_modules/micromatch/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "license": "MIT",
       "engines": {
         "node": ">=8.6"
@@ -23972,8 +19384,6 @@
     },
     "node_modules/miller-rabin": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/miller-rabin/-/miller-rabin-4.0.1.tgz",
-      "integrity": "sha512-115fLhvZVqWwHPbClyntxEVfVDfl9DLLTuJvq3g2O/Oxi8AiNouAHvDSzHS0viUJc+V5vm3eq91Xwqn9dp4jRA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -23986,15 +19396,11 @@
     },
     "node_modules/miller-rabin/node_modules/bn.js": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
-      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/mime": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
-      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -24006,8 +19412,6 @@
     },
     "node_modules/mime-db": {
       "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24016,8 +19420,6 @@
     },
     "node_modules/mime-types": {
       "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24029,8 +19431,6 @@
     },
     "node_modules/mimic-fn": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24039,8 +19439,6 @@
     },
     "node_modules/mimic-function": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/mimic-function/-/mimic-function-5.0.1.tgz",
-      "integrity": "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24052,8 +19450,6 @@
     },
     "node_modules/mimic-response": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-1.0.1.tgz",
-      "integrity": "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24062,8 +19458,6 @@
     },
     "node_modules/mini-css-extract-plugin": {
       "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/mini-css-extract-plugin/-/mini-css-extract-plugin-2.9.2.tgz",
-      "integrity": "sha512-GJuACcS//jtq4kCtd5ii/M0SZf7OZRH+BxdqXZHaJfb8TJiVl+NgQRPwiYt2EuqeSkNydn/7vP+bcE27C5mb9w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24083,22 +19477,16 @@
     },
     "node_modules/minimalistic-assert": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
-      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/minimalistic-crypto-utils": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/minimalistic-crypto-utils/-/minimalistic-crypto-utils-1.0.1.tgz",
-      "integrity": "sha512-JIYlbt6g8i5jKfJ3xz7rF0LXmv2TkDxBLUkiBeZ7bAx4GnnNMr8xFpGnOxn6GhTEHx3SjRrZEoU+j04prX1ktg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/minimatch": {
       "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24113,8 +19501,6 @@
     },
     "node_modules/minimist": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -24123,8 +19509,6 @@
     },
     "node_modules/minipass": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -24133,8 +19517,6 @@
     },
     "node_modules/minipass-collect": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
-      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24146,8 +19528,6 @@
     },
     "node_modules/minipass-fetch": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
-      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24164,8 +19544,6 @@
     },
     "node_modules/minipass-flush": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
-      "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -24177,8 +19555,6 @@
     },
     "node_modules/minipass-flush/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24190,15 +19566,11 @@
     },
     "node_modules/minipass-flush/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/minipass-pipeline": {
       "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
-      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24210,8 +19582,6 @@
     },
     "node_modules/minipass-pipeline/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24223,15 +19593,11 @@
     },
     "node_modules/minipass-pipeline/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/minipass-sized": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
-      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24243,8 +19609,6 @@
     },
     "node_modules/minipass-sized/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24256,15 +19620,11 @@
     },
     "node_modules/minipass-sized/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/minizlib": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
-      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24276,8 +19636,6 @@
     },
     "node_modules/mkdirp": {
       "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24289,15 +19647,11 @@
     },
     "node_modules/mkdirp-classic": {
       "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/mocha-junit-reporter": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mocha-junit-reporter/-/mocha-junit-reporter-2.1.0.tgz",
-      "integrity": "sha512-Zhz1J+XqJUaAOuSFtHgi2+b+W3rP1SZtaU3HHNNp1iEKMSeoC1/EQUVkGknkLNOBxJhXJ4xLgOr8TbYAZOkUIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24313,8 +19667,6 @@
     },
     "node_modules/mocha-junit-reporter/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24323,15 +19675,11 @@
     },
     "node_modules/mocha-junit-reporter/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/module-deps": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/module-deps/-/module-deps-6.2.3.tgz",
-      "integrity": "sha512-fg7OZaQBcL4/L+AK5f4iVqf9OMbCclXfy/znXRxTVhJSeW5AIlS9AwheYwDaXM3lVW7OBeaeUEY3gbaC6cLlSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24360,8 +19708,6 @@
     },
     "node_modules/moment": {
       "version": "2.29.4",
-      "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
-      "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -24369,8 +19715,6 @@
     },
     "node_modules/moo-color": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/moo-color/-/moo-color-1.0.3.tgz",
-      "integrity": "sha512-i/+ZKXMDf6aqYtBhuOcej71YSlbjT3wCO/4H1j8rPvxDJEifdwgg5MaFyu6iYAT8GBZJg2z0dkgK4YMzvURALQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24379,8 +19723,6 @@
     },
     "node_modules/morgan": {
       "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/morgan/-/morgan-1.10.1.tgz",
-      "integrity": "sha512-223dMRJtI/l25dJKWpgij2cMtywuG/WiUKXdvwfbhGKBhy1puASqXwFzmWZ7+K73vUPoR7SS2Qz2cI/g9MKw0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24396,8 +19738,6 @@
     },
     "node_modules/morgan/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24406,15 +19746,11 @@
     },
     "node_modules/morgan/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/mri": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
-      "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24423,8 +19759,6 @@
     },
     "node_modules/mrmime": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
-      "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24433,14 +19767,10 @@
     },
     "node_modules/ms": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
       "license": "MIT"
     },
     "node_modules/msgpackr": {
       "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.12.1.tgz",
-      "integrity": "sha512-4EUH9tQHnMmEgzW/MdAP0KIfa1T9AF+htl0ffe2n5vb2EKn9y2co8ccpgWko6S52Jy1PQZKwRnx5/KkYjtd9MQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -24450,8 +19780,6 @@
     },
     "node_modules/msgpackr-extract": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.4.tgz",
-      "integrity": "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -24473,8 +19801,6 @@
     },
     "node_modules/multicast-dns": {
       "version": "7.2.5",
-      "resolved": "https://registry.npmjs.org/multicast-dns/-/multicast-dns-7.2.5.tgz",
-      "integrity": "sha512-2eznPJP8z2BFLX50tf0LuODrpINqP1RVIm/CObbTcBRITQgmC/TjcREF1NeTBzIcR5XO/ukWo+YHOjBbFwIupg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24487,8 +19813,6 @@
     },
     "node_modules/multimatch": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/multimatch/-/multimatch-4.0.0.tgz",
-      "integrity": "sha512-lDmx79y1z6i7RNx0ZGCPq1bzJ6ZoDDKbvh7jxr9SJcWLkShMzXrHbYVpTdnhNM5MXpDUxCQ4DgqVttVXlBgiBQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24504,8 +19828,6 @@
     },
     "node_modules/multimatch/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24515,8 +19837,6 @@
     },
     "node_modules/multimatch/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24528,8 +19848,6 @@
     },
     "node_modules/mute-stream": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-2.0.0.tgz",
-      "integrity": "sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -24538,8 +19856,6 @@
     },
     "node_modules/mz": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
-      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24550,8 +19866,6 @@
     },
     "node_modules/nanoid": {
       "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "dev": true,
       "funding": [
         {
@@ -24569,15 +19883,11 @@
     },
     "node_modules/natural-compare": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/needle": {
       "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/needle/-/needle-3.5.0.tgz",
-      "integrity": "sha512-jaQyPKKk2YokHrEg+vFDYxXIHTCBgiZwSHOoVx/8V3GIBS8/VN6NdVRmg8q1ERtPkMvmOvebsgga4sAj5hls/w==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -24594,8 +19904,6 @@
     },
     "node_modules/needle/node_modules/iconv-lite": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -24608,8 +19916,6 @@
     },
     "node_modules/negotiator": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24618,15 +19924,11 @@
     },
     "node_modules/neo-async": {
       "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
-      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/neotraverse": {
       "version": "0.6.18",
-      "resolved": "https://registry.npmjs.org/neotraverse/-/neotraverse-0.6.18.tgz",
-      "integrity": "sha512-Z4SmBUweYa09+o6pG+eASabEpP6QkQ70yHj351pQoEXIs8uHbaU2DWVmzBANKgflPa47A50PtB2+NgRpQvr7vA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24635,15 +19937,11 @@
     },
     "node_modules/next-tick": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/next-tick/-/next-tick-1.1.0.tgz",
-      "integrity": "sha512-CXdUiJembsNjuToQvxayPZF9Vqht7hewsvy2sOWafLvi2awflj9mOC6bHIg50orX8IJvWKY9wYQ/zB2kogPslQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/ng-block-ui": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/ng-block-ui/-/ng-block-ui-4.0.1.tgz",
-      "integrity": "sha512-92pb5+NLBJfbjmjzHJG/rYriSUKqGTkI/zE7k62sp37lnh8WkWMoMQ14/JZHrTscAHggpemUaksY2rBj/in0bQ==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.3.0"
@@ -24660,8 +19958,6 @@
     },
     "node_modules/ng-mocks": {
       "version": "14.13.1",
-      "resolved": "https://registry.npmjs.org/ng-mocks/-/ng-mocks-14.13.1.tgz",
-      "integrity": "sha512-eyfnjXeC108SqVD09i/cBwCpKkK0JjBoAg8jp7oQS2HS081K3WJTttFpgLGeLDYKmZsZ6nYpI+HHNQ3OksaJ7A==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -24676,8 +19972,6 @@
     },
     "node_modules/ng2-charts": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/ng2-charts/-/ng2-charts-7.0.0.tgz",
-      "integrity": "sha512-HofyPPkz7yOX6Dr9JfV/SDddzmmqCFYCKbn71jeDiyWPRjrj99yTBCyqYtjzzNrnlTfWwbdvynYZ4GAhu/lbgQ==",
       "license": "MIT",
       "dependencies": {
         "lodash-es": "^4.17.15",
@@ -24694,8 +19988,6 @@
     },
     "node_modules/ngx-cookie-service": {
       "version": "19.1.2",
-      "resolved": "https://registry.npmjs.org/ngx-cookie-service/-/ngx-cookie-service-19.1.2.tgz",
-      "integrity": "sha512-4BFbc5BA7/ryuQVZUfDMHcjdgkHeW8obqfCCknoOEaplefjzlVvMQUx9Hywfjbc8POzZeZD2csS43Hs7rscJcA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.8.0"
@@ -24707,21 +19999,15 @@
     },
     "node_modules/ngx-cookie-service/node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
     "node_modules/nice-try": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/nice-try/-/nice-try-1.0.5.tgz",
-      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/no-case": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/no-case/-/no-case-2.3.2.tgz",
-      "integrity": "sha512-rmTZ9kz+f3rCvK2TD1Ue/oZlns7OGoIWP4fc3llxxRXlOkHKoWPPWJOfFYpITabSow43QJbRIoHQXtt10VldyQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24730,24 +20016,17 @@
     },
     "node_modules/node-addon-api": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-6.1.0.tgz",
-      "integrity": "sha512-+eawOlIgy680F0kBzPUNFhMZGtJ1YmqM6l4+Crf4IkImjYrO/mqPwRMh352g23uIaQKFItcQ64I7KMaJxHgAVA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/node-cleanup": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/node-cleanup/-/node-cleanup-2.1.2.tgz",
-      "integrity": "sha512-qN8v/s2PAJwGUtr1/hYTpNKlD6Y9rc4p8KSmJXyGdYGZsDGKXrGThikLFP9OCHFeLeEpQzPwiAtdIvBLqm//Hw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/node-domexception": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
-      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
-      "deprecated": "Use your platform's native DOMException instead",
       "dev": true,
       "funding": [
         {
@@ -24766,8 +20045,6 @@
     },
     "node_modules/node-fetch": {
       "version": "2.6.7",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
-      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24787,22 +20064,16 @@
     },
     "node_modules/node-fetch/node_modules/tr46": {
       "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/node-fetch/node_modules/webidl-conversions": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
     "node_modules/node-fetch/node_modules/whatwg-url": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24812,8 +20083,6 @@
     },
     "node_modules/node-forge": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
       "dev": true,
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
@@ -24822,8 +20091,6 @@
     },
     "node_modules/node-gyp": {
       "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
-      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -24847,8 +20114,6 @@
     },
     "node_modules/node-gyp-build-optional-packages": {
       "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
-      "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -24863,8 +20128,6 @@
     },
     "node_modules/node-gyp/node_modules/chownr": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -24873,8 +20136,6 @@
     },
     "node_modules/node-gyp/node_modules/isexe": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
-      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -24883,8 +20144,6 @@
     },
     "node_modules/node-gyp/node_modules/tar": {
       "version": "7.5.15",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
-      "integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -24900,8 +20159,6 @@
     },
     "node_modules/node-gyp/node_modules/which": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
-      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24916,8 +20173,6 @@
     },
     "node_modules/node-gyp/node_modules/yallist": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -24926,21 +20181,15 @@
     },
     "node_modules/node-int64": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
-      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/node-releases": {
       "version": "2.0.44",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
-      "integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
       "license": "MIT"
     },
     "node_modules/nopt": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
-      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -24955,8 +20204,6 @@
     },
     "node_modules/normalize-package-data": {
       "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -24968,15 +20215,11 @@
     },
     "node_modules/normalize-package-data/node_modules/hosted-git-info": {
       "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/normalize-package-data/node_modules/semver": {
       "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
-      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -24985,8 +20228,6 @@
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -24995,8 +20236,6 @@
     },
     "node_modules/normalize-range": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
-      "integrity": "sha512-bdok/XvKII3nUpklnV6P2hxtMNrCboOjAcyBuQnWEhO665FwrSNRxU+AqpsyvO6LgGYPspN+lu5CLtw4jPRKNA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25005,8 +20244,6 @@
     },
     "node_modules/normalize-url": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-6.1.0.tgz",
-      "integrity": "sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25018,8 +20255,6 @@
     },
     "node_modules/npm-bundled": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/npm-bundled/-/npm-bundled-4.0.0.tgz",
-      "integrity": "sha512-IxaQZDMsqfQ2Lz37VvyyEtKLe8FsRZuysmedy/N06TU1RyVppYKXrO4xIhR0F+7ubIBox6Q7nir6fQI3ej39iA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25031,8 +20266,6 @@
     },
     "node_modules/npm-install-checks": {
       "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-7.1.2.tgz",
-      "integrity": "sha512-z9HJBCYw9Zr8BqXcllKIs5nI+QggAImbBdHphOzVYrz2CB4iQ6FzWyKmlqDZua+51nAu7FcemlbTc9VgQN5XDQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -25044,8 +20277,6 @@
     },
     "node_modules/npm-normalize-package-bin": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-4.0.0.tgz",
-      "integrity": "sha512-TZKxPvItzai9kN9H/TkmCtx/ZN/hvr3vUycjlfmH0ootY9yFBzNOpiXAdIn1Iteqsvk4lQn6B5PTrt+n6h8k/w==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -25054,8 +20285,6 @@
     },
     "node_modules/npm-package-arg": {
       "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-12.0.2.tgz",
-      "integrity": "sha512-f1NpFjNI9O4VbKMOlA5QoBq/vSQPORHcTZ2feJpFkTHJ9eQkdlmZEKSjcAhxTGInC7RlEyScT9ui67NaOsjFWA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25070,8 +20299,6 @@
     },
     "node_modules/npm-packlist": {
       "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-9.0.0.tgz",
-      "integrity": "sha512-8qSayfmHJQTx3nJWYbbUmflpyarbLMBc6LCAjYsiGtXxDB68HaZpb8re6zeaLGxZzDuMdhsg70jryJe+RrItVQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25083,8 +20310,6 @@
     },
     "node_modules/npm-pick-manifest": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-10.0.0.tgz",
-      "integrity": "sha512-r4fFa4FqYY8xaM7fHecQ9Z2nE9hgNfJR+EmoKv0+chvzWkBcORX3r0FpTByP+CbOVJDladMXnPQGVN8PBLGuTQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25099,8 +20324,6 @@
     },
     "node_modules/npm-registry-fetch": {
       "version": "18.0.2",
-      "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-18.0.2.tgz",
-      "integrity": "sha512-LeVMZBBVy+oQb5R6FDV9OlJCcWDU+al10oKpe+nsvcHnG24Z3uM3SvJYKfGJlfGjVU8v9liejCrUR/M5HO5NEQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25119,8 +20342,6 @@
     },
     "node_modules/npm-run-all": {
       "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/npm-run-all/-/npm-run-all-4.1.5.tgz",
-      "integrity": "sha512-Oo82gJDAVcaMdi3nuoKFavkIHBRVqQ1qvMb+9LHk/cF4P6B2m8aP04hGf7oL6wZ9BuGwX1onlLhpuoofSyoQDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25145,8 +20366,6 @@
     },
     "node_modules/npm-run-all/node_modules/ansi-styles": {
       "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25158,8 +20377,6 @@
     },
     "node_modules/npm-run-all/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25169,8 +20386,6 @@
     },
     "node_modules/npm-run-all/node_modules/chalk": {
       "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25184,8 +20399,6 @@
     },
     "node_modules/npm-run-all/node_modules/color-convert": {
       "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25194,15 +20407,11 @@
     },
     "node_modules/npm-run-all/node_modules/color-name": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/npm-run-all/node_modules/cross-spawn": {
       "version": "6.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.6.tgz",
-      "integrity": "sha512-VqCUuhcd1iB+dsv8gxPttb5iZh/D0iubSP21g36KXdEuf6I5JiioesUVjpCdHV9MZRUfVFlvwtIUyPfxo5trtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25218,8 +20427,6 @@
     },
     "node_modules/npm-run-all/node_modules/has-flag": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25228,8 +20435,6 @@
     },
     "node_modules/npm-run-all/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25241,8 +20446,6 @@
     },
     "node_modules/npm-run-all/node_modules/path-key": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz",
-      "integrity": "sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25251,8 +20454,6 @@
     },
     "node_modules/npm-run-all/node_modules/semver": {
       "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
-      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -25261,8 +20462,6 @@
     },
     "node_modules/npm-run-all/node_modules/shebang-command": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz",
-      "integrity": "sha512-EV3L1+UQWGor21OmnvojK36mhg+TyIKDh3iFBKBohr5xeXIhNBcx8oWdgkTEEQ+BEFFYdLRuqMfd5L84N1V5Vg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25274,8 +20473,6 @@
     },
     "node_modules/npm-run-all/node_modules/shebang-regex": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-1.0.0.tgz",
-      "integrity": "sha512-wpoSFAxys6b2a2wHZ1XpDSgD7N9iVjg29Ph9uV/uaP9Ex/KXlkTZTeddxDPSYQpgvzKLGJke2UU0AzoGCjNIvQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25284,8 +20481,6 @@
     },
     "node_modules/npm-run-all/node_modules/supports-color": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25297,8 +20492,6 @@
     },
     "node_modules/npm-run-all/node_modules/which": {
       "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
-      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25310,8 +20503,6 @@
     },
     "node_modules/npm-run-path": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25323,8 +20514,6 @@
     },
     "node_modules/nth-check": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
-      "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -25336,8 +20525,6 @@
     },
     "node_modules/nwsapi": {
       "version": "2.2.23",
-      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.23.tgz",
-      "integrity": "sha512-7wfH4sLbt4M0gCDzGE6vzQBo0bfTKjU7Sfpqy/7gs1qBfYz2vEJH6vXcBKpO3+6Yu1telwd0t9HpyOoLEQQbIQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -25353,8 +20540,6 @@
     },
     "node_modules/object-inspect": {
       "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25366,8 +20551,6 @@
     },
     "node_modules/object-keys": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
-      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25376,8 +20559,6 @@
     },
     "node_modules/object.assign": {
       "version": "4.1.7",
-      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.7.tgz",
-      "integrity": "sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25397,22 +20578,16 @@
     },
     "node_modules/obuf": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
-      "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/omggif": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/omggif/-/omggif-1.0.10.tgz",
-      "integrity": "sha512-LMJTtvgc/nugXj0Vcrrs68Mn2D1r0zf630VNtqtpI1FEO7e+O9FP4gqs9AcnBaSEeoHIPm28u6qgPR0oyEpGSw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/on-exit-leak-free": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
-      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25421,8 +20596,6 @@
     },
     "node_modules/on-finished": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
-      "integrity": "sha512-ikqdkGAAyf/X/gPhXGvfgAytDZtDbr+bkNUJ0N9h5MI/dmdgCs3l6hoHrcUv41sRKew3jIwrp4qQDXiK99Utww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25434,8 +20607,6 @@
     },
     "node_modules/on-headers": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
-      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25444,8 +20615,6 @@
     },
     "node_modules/once": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25454,8 +20623,6 @@
     },
     "node_modules/onetime": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25470,8 +20637,6 @@
     },
     "node_modules/open": {
       "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/open/-/open-10.1.0.tgz",
-      "integrity": "sha512-mnkeQ1qP5Ue2wd+aivTD3NHd/lZ96Lu0jgf0pwktLPtx6cTZiH7tyeGRRHs0zX0rbrahXPnXlUnbeXyaBBuIaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25489,8 +20654,6 @@
     },
     "node_modules/opencollective-postinstall": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/opencollective-postinstall/-/opencollective-postinstall-2.0.3.tgz",
-      "integrity": "sha512-8AV/sCtuzUeTo8gQK5qDZzARrulB3egtLzFgteqB2tcT4Mw7B8Kt7JcDHmltjz6FOAHsvTevk70gZEbhM4ZS9Q==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -25499,8 +20662,6 @@
     },
     "node_modules/optionator": {
       "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25517,8 +20678,6 @@
     },
     "node_modules/ora": {
       "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
-      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25541,8 +20700,6 @@
     },
     "node_modules/ora/node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25558,23 +20715,17 @@
     },
     "node_modules/ordered-binary": {
       "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/ordered-binary/-/ordered-binary-1.6.1.tgz",
-      "integrity": "sha512-QkCdPooczexPLiXIrbVOPYkR3VO3T6v2OyKRkR1Xbhpy7/LAVXwahnRCgRp78Oe/Ehf0C/HATAxfSr6eA1oX+w==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/os-browserify": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/os-browserify/-/os-browserify-0.3.0.tgz",
-      "integrity": "sha512-gjcpUc3clBf9+210TRaDWbf+rZZZEshZ+DlXMRCeAjp0xhTrnQsKHypIy1J3d5hKdUzj69t708EHtU8P6bUn0A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/os-name": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/os-name/-/os-name-4.0.1.tgz",
-      "integrity": "sha512-xl9MAoU97MH1Xt5K9ERft2YfCAoaO6msy1OBA0ozxEC0x0TmIoE6K3QvgJMMZA9yKGLmHXNY/YZoDbiGDj4zYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25590,15 +20741,11 @@
     },
     "node_modules/ospath": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/ospath/-/ospath-1.2.2.tgz",
-      "integrity": "sha512-o6E5qJV5zkAbIDNhGSIlyOhScKXgQrSRMilfph0clDfM0nEnBOlKlH4sWDmG95BW/CvwNz0vmm7dJVtU2KlMiA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/outpipe": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/outpipe/-/outpipe-1.1.1.tgz",
-      "integrity": "sha512-BnNY/RwnDrkmQdUa9U+OfN/Y7AWmKuUPCCd+hbRclZnnANvYpO72zp/a6Q4n829hPbdqEac31XCcsvlEvb+rtA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25607,8 +20754,6 @@
     },
     "node_modules/own-keys": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/own-keys/-/own-keys-1.0.1.tgz",
-      "integrity": "sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25625,8 +20770,6 @@
     },
     "node_modules/p-cancelable": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/p-cancelable/-/p-cancelable-2.1.1.tgz",
-      "integrity": "sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25635,8 +20778,6 @@
     },
     "node_modules/p-iteration": {
       "version": "1.1.8",
-      "resolved": "https://registry.npmjs.org/p-iteration/-/p-iteration-1.1.8.tgz",
-      "integrity": "sha512-IMFBSDIYcPNnW7uWYGrBqmvTiq7W0uB0fJn6shQZs7dlF3OvrHOre+JT9ikSZ7gZS3vWqclVgoQSvToJrns7uQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25645,8 +20786,6 @@
     },
     "node_modules/p-limit": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25661,8 +20800,6 @@
     },
     "node_modules/p-locate": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25677,8 +20814,6 @@
     },
     "node_modules/p-map": {
       "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
-      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25690,8 +20825,6 @@
     },
     "node_modules/p-retry": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-4.6.2.tgz",
-      "integrity": "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25704,8 +20837,6 @@
     },
     "node_modules/p-try": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25714,15 +20845,11 @@
     },
     "node_modules/package-json-from-dist": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
       "dev": true,
       "license": "BlueOak-1.0.0"
     },
     "node_modules/pacote": {
       "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-20.0.0.tgz",
-      "integrity": "sha512-pRjC5UFwZCgx9kUFDVM9YEahv4guZ1nSLqwmWiLUnDbGsjs+U5w7z6Uc8HNR1a6x8qnu5y9xtGE6D1uAuYz+0A==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25753,8 +20880,6 @@
     },
     "node_modules/pad-right": {
       "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/pad-right/-/pad-right-0.2.2.tgz",
-      "integrity": "sha512-4cy8M95ioIGolCoMmm2cMntGR1lPLEbOMzOKu8bzjuJP6JpzEMQcDHmh7hHLYGgob+nKe1YHFMaG4V59HQa89g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25766,15 +20891,11 @@
     },
     "node_modules/pako": {
       "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
       "dev": true,
       "license": "(MIT AND Zlib)"
     },
     "node_modules/parent-module": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25786,8 +20907,6 @@
     },
     "node_modules/parents": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parents/-/parents-1.0.1.tgz",
-      "integrity": "sha512-mXKF3xkoUt5td2DoxpLmtOmZvko9VfFpwRwkKDHSNvgmpLAeBo18YDhcPbBzJq+QLCHMbGOfzia2cX4U+0v9Mg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25796,8 +20915,6 @@
     },
     "node_modules/parse-asn1": {
       "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.9.tgz",
-      "integrity": "sha512-fIYNuZ/HastSb80baGOuPRo1O9cf4baWw5WsAp7dBuUzeTD/BoaG8sVTdlPFksBE2lF21dN+A1AnrpIjSWqHHg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -25813,8 +20930,6 @@
     },
     "node_modules/parse-json": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
-      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25832,15 +20947,11 @@
     },
     "node_modules/parse-json/node_modules/json-parse-even-better-errors": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/parse-node-version": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parse-node-version/-/parse-node-version-1.0.1.tgz",
-      "integrity": "sha512-3YHlOa/JgH6Mnpr05jP9eDG254US9ek25LyIxZlDItp2iJtwyaXQb57lBYLdT3MowkUFYEV2XXNAYIPlESvJlA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25849,8 +20960,6 @@
     },
     "node_modules/parse5": {
       "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
-      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25862,8 +20971,6 @@
     },
     "node_modules/parse5-html-rewriting-stream": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/parse5-html-rewriting-stream/-/parse5-html-rewriting-stream-7.0.0.tgz",
-      "integrity": "sha512-mazCyGWkmCRWDI15Zp+UiCqMp/0dgEmkZRvhlsqqKYr4SsVm/TvnSpD9fCvqCA2zoWJcfRym846ejWBBHRiYEg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25877,8 +20984,6 @@
     },
     "node_modules/parse5-htmlparser2-tree-adapter": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz",
-      "integrity": "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25891,8 +20996,6 @@
     },
     "node_modules/parse5-sax-parser": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/parse5-sax-parser/-/parse5-sax-parser-7.0.0.tgz",
-      "integrity": "sha512-5A+v2SNsq8T6/mG3ahcz8ZtQ0OUFTatxPbeidoMB7tkJSGDY3tdfl4MHovtLQHkEn5CGxijNWRQHhRQ6IRpXKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -25904,8 +21007,6 @@
     },
     "node_modules/parse5/node_modules/entities": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
-      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -25917,8 +21018,6 @@
     },
     "node_modules/parseurl": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25927,15 +21026,11 @@
     },
     "node_modules/path-browserify": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-0.0.1.tgz",
-      "integrity": "sha512-BapA40NHICOS+USX9SN4tyhq+A2RrN/Ws5F0Z5aMHDp98Fl86lX8Oti8B7uN93L4Ifv4fHOEA+pQw87gmMO/lQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/path-exists": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25944,8 +21039,6 @@
     },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25954,8 +21047,6 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25964,15 +21055,11 @@
     },
     "node_modules/path-parse": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/path-platform": {
       "version": "0.11.15",
-      "resolved": "https://registry.npmjs.org/path-platform/-/path-platform-0.11.15.tgz",
-      "integrity": "sha512-Y30dB6rab1A/nfEKsZxmr01nUotHX0c/ZiIAsCTatEe1CmS5Pm5He7fZ195bPT7RdquoaL8lLxFCMQi/bS7IJg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -25981,8 +21068,6 @@
     },
     "node_modules/path-scurry": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -25998,8 +21083,6 @@
     },
     "node_modules/path-scurry/node_modules/lru-cache": {
       "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.4.0.tgz",
-      "integrity": "sha512-W+R+kFL4HgVxONq2bhXPi3bGpzGe/yEhVOp233qw9wCRtgncJ15P3bC+e4zZMu4Cq7d+WAJjXGW0uUkifhcatA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -26008,15 +21091,11 @@
     },
     "node_modules/path-to-regexp": {
       "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
-      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/path-type": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-6.0.0.tgz",
-      "integrity": "sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26028,8 +21107,6 @@
     },
     "node_modules/pathval": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.1.tgz",
-      "integrity": "sha512-Dp6zGqpTdETdR63lehJYPeIOqpiNBNtc7BpWSLrOje7UaIsE5aY92r/AunQA7rsXvet3lrJ3JnZX29UPTKXyKQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26038,8 +21115,6 @@
     },
     "node_modules/pause-stream": {
       "version": "0.0.11",
-      "resolved": "https://registry.npmjs.org/pause-stream/-/pause-stream-0.0.11.tgz",
-      "integrity": "sha512-e3FBlXLmN/D1S+zHzanP4E/4Z60oFAa3O051qt1pxa7DEJWKAyil6upYVXCWadEnuoqa4Pkc9oUx9zsxYeRv8A==",
       "dev": true,
       "license": [
         "MIT",
@@ -26051,8 +21126,6 @@
     },
     "node_modules/pbkdf2": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.1.5.tgz",
-      "integrity": "sha512-Q3CG/cYvCO1ye4QKkuH7EXxs3VC/rI1/trd+qX2+PolbaKG0H+bgcZzrTt96mMyRtejk+JMCiLUn3y29W8qmFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26069,28 +21142,20 @@
     },
     "node_modules/pend": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/performance-now": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
-      "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/picocolors": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "license": "ISC"
     },
     "node_modules/picomatch": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
-      "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26102,8 +21167,6 @@
     },
     "node_modules/pidtree": {
       "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/pidtree/-/pidtree-0.3.1.tgz",
-      "integrity": "sha512-qQbW94hLHEqCg7nhby4yRC7G2+jYHY4Rguc2bjw7Uug4GIJuu1tvf2uHaZv5Q8zdt+WKJ6qK1FOI6amaWUo5FA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -26115,8 +21178,6 @@
     },
     "node_modules/pify": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
-      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26125,8 +21186,6 @@
     },
     "node_modules/pino": {
       "version": "9.14.0",
-      "resolved": "https://registry.npmjs.org/pino/-/pino-9.14.0.tgz",
-      "integrity": "sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26148,8 +21207,6 @@
     },
     "node_modules/pino-abstract-transport": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-2.0.0.tgz",
-      "integrity": "sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26158,15 +21215,11 @@
     },
     "node_modules/pino-std-serializers": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
-      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/pino/node_modules/process-warning": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.0.0.tgz",
-      "integrity": "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==",
       "dev": true,
       "funding": [
         {
@@ -26182,8 +21235,6 @@
     },
     "node_modules/pirates": {
       "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz",
-      "integrity": "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26192,8 +21243,6 @@
     },
     "node_modules/piscina": {
       "version": "4.8.0",
-      "resolved": "https://registry.npmjs.org/piscina/-/piscina-4.8.0.tgz",
-      "integrity": "sha512-EZJb+ZxDrQf3dihsUL7p42pjNyrNIFJCrRHPMgxu/svsj+P3xS3fuEWp7k2+rfsavfl1N0G29b1HGs7J0m8rZA==",
       "dev": true,
       "license": "MIT",
       "optionalDependencies": {
@@ -26202,8 +21251,6 @@
     },
     "node_modules/pkg-dir": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-7.0.0.tgz",
-      "integrity": "sha512-Ie9z/WINcxxLp27BKOCHGde4ITq9UklYKDzVo1nhk5sqGEXU3FpkwP5GM2voTGJkGd9B3Otl+Q4uwSOeSUtOBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26218,8 +21265,6 @@
     },
     "node_modules/pkg-dir/node_modules/find-up": {
       "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-6.3.0.tgz",
-      "integrity": "sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26235,8 +21280,6 @@
     },
     "node_modules/pkg-dir/node_modules/locate-path": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz",
-      "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26251,8 +21294,6 @@
     },
     "node_modules/pkg-dir/node_modules/p-limit": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz",
-      "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26267,8 +21308,6 @@
     },
     "node_modules/pkg-dir/node_modules/p-locate": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz",
-      "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26283,8 +21322,6 @@
     },
     "node_modules/pkg-dir/node_modules/path-exists": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz",
-      "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26293,8 +21330,6 @@
     },
     "node_modules/pkg-dir/node_modules/yocto-queue": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.2.tgz",
-      "integrity": "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26306,15 +21341,11 @@
     },
     "node_modules/png-async": {
       "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/png-async/-/png-async-0.9.4.tgz",
-      "integrity": "sha512-B//AXX9TkneKfgtOpT1mdUnnhk2BImGD+a98vImsMU8uo1dBeHyW/kM2erWZ/CsYteTPU/xKG+t6T62heHkC3A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
-      "integrity": "sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26323,8 +21354,6 @@
     },
     "node_modules/postcss": {
       "version": "8.5.12",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
-      "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
       "dev": true,
       "funding": [
         {
@@ -26352,8 +21381,6 @@
     },
     "node_modules/postcss-loader": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-loader/-/postcss-loader-8.1.1.tgz",
-      "integrity": "sha512-0IeqyAsG6tYiDRCYKQJLAmgQr47DX6N7sFSWvQxt6AcupX8DIdmykuk/o/tx0Lze3ErGHJEp5OSRxrelC6+NdQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26384,15 +21411,11 @@
     },
     "node_modules/postcss-media-query-parser": {
       "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/postcss-media-query-parser/-/postcss-media-query-parser-0.2.3.tgz",
-      "integrity": "sha512-3sOlxmbKcSHMjlUXQZKQ06jOswE7oVkXPxmZdoB1r5l0q6gTFTQSHxNxOrCccElbW7dxNytifNEo8qidX2Vsig==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/postcss-modules-extract-imports": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-modules-extract-imports/-/postcss-modules-extract-imports-3.1.0.tgz",
-      "integrity": "sha512-k3kNe0aNFQDAZGbin48pL2VNidTF0w4/eASDsxlyspobzU3wZQLOGj7L9gfRe0Jo9/4uud09DsjFNH7winGv8Q==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -26404,8 +21427,6 @@
     },
     "node_modules/postcss-modules-local-by-default": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.2.0.tgz",
-      "integrity": "sha512-5kcJm/zk+GJDSfw+V/42fJ5fhjL5YbFDl8nVdXkJPLLW+Vf9mTD5Xe0wqIaDnLuL2U6cDNpTr+UQ+v2HWIBhzw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26422,8 +21443,6 @@
     },
     "node_modules/postcss-modules-scope": {
       "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/postcss-modules-scope/-/postcss-modules-scope-3.2.1.tgz",
-      "integrity": "sha512-m9jZstCVaqGjTAuny8MdgE88scJnCiQSlSrOWcTQgM2t32UBe+MUmFSO5t7VMSfAf/FJKImAxBav8ooCHJXCJA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -26438,8 +21457,6 @@
     },
     "node_modules/postcss-modules-values": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz",
-      "integrity": "sha512-RDxHkAiEGI78gS2ofyvCsu7iycRv7oqw5xMWn9iMoR0N/7mf9D50ecQqUo5BZ9Zh2vH4bCUR/ktCqbB9m8vJjQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -26454,15 +21471,11 @@
     },
     "node_modules/postcss-resolve-nested-selector": {
       "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/postcss-resolve-nested-selector/-/postcss-resolve-nested-selector-0.1.6.tgz",
-      "integrity": "sha512-0sglIs9Wmkzbr8lQwEyIzlDOOC9bGmfVKcJTaxv3vMmd3uo4o4DerC3En0bnmgceeql9BfC8hRkp7cg0fjdVqw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/postcss-safe-parser": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-7.0.1.tgz",
-      "integrity": "sha512-0AioNCJZ2DPYz5ABT6bddIqlhgwhpHZ/l65YAYo0BCIn0xiDpsnTHz0gnoTGk0OXZW0JRs+cDwL8u/teRdz+8A==",
       "dev": true,
       "funding": [
         {
@@ -26488,8 +21501,6 @@
     },
     "node_modules/postcss-scss": {
       "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/postcss-scss/-/postcss-scss-4.0.9.tgz",
-      "integrity": "sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A==",
       "dev": true,
       "funding": [
         {
@@ -26515,8 +21526,6 @@
     },
     "node_modules/postcss-selector-parser": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
-      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26529,15 +21538,11 @@
     },
     "node_modules/postcss-value-parser": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
-      "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/postcss/node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -26546,8 +21551,6 @@
     },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26555,22 +21558,23 @@
       }
     },
     "node_modules/prettier": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.1.2.tgz",
-      "integrity": "sha512-16c7K+x4qVlJg9rEbXl7HEGmQyZlG4R9AgP+oHKRMsMsuk8s+ATStlf1NpDqyBI1HpVyfjLOeMhH2LvuNvV5Vg==",
+      "version": "3.9.4",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz",
+      "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==",
       "dev": true,
       "license": "MIT",
       "bin": {
-        "prettier": "bin-prettier.js"
+        "prettier": "bin/prettier.cjs"
       },
       "engines": {
-        "node": ">=10.13.0"
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
       }
     },
     "node_modules/pretty-bytes": {
       "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-5.6.0.tgz",
-      "integrity": "sha512-FFw039TmrBqFK8ma/7OL3sDz/VytdtJr044/QUJtH0wK9lb9jLq9tJyIxUwtQJHwar2BqtiA4iCWSwo9JLkzFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26582,8 +21586,6 @@
     },
     "node_modules/pretty-format": {
       "version": "29.7.0",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-29.7.0.tgz",
-      "integrity": "sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26597,8 +21599,6 @@
     },
     "node_modules/pretty-format/node_modules/ansi-styles": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26610,8 +21610,6 @@
     },
     "node_modules/pretty-quick": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/pretty-quick/-/pretty-quick-3.0.2.tgz",
-      "integrity": "sha512-4rWOs/Ifdkg7G/YX7Xbco4jZkuXPx445KdhuMI6REnl3nXRDb9+zysb29c76R59jsJzcnkcpAaGi8D/RjAVfSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26634,8 +21632,6 @@
     },
     "node_modules/pretty-quick/node_modules/find-up": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26648,8 +21644,6 @@
     },
     "node_modules/pretty-quick/node_modules/locate-path": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26661,8 +21655,6 @@
     },
     "node_modules/pretty-quick/node_modules/p-limit": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26677,8 +21669,6 @@
     },
     "node_modules/pretty-quick/node_modules/p-locate": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26690,8 +21680,6 @@
     },
     "node_modules/prismjs": {
       "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.30.0.tgz",
-      "integrity": "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26700,8 +21688,6 @@
     },
     "node_modules/proc-log": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
-      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -26710,8 +21696,6 @@
     },
     "node_modules/process": {
       "version": "0.11.10",
-      "resolved": "https://registry.npmjs.org/process/-/process-0.11.10.tgz",
-      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26720,22 +21704,16 @@
     },
     "node_modules/process-nextick-args": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/process-warning": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-3.0.0.tgz",
-      "integrity": "sha512-mqn0kFRl0EoqhnL0GQ0veqFHyIN1yig9RHh/InzORTUiZHFRAur+aMtRkELNwGs9aNwKS6tg/An4NYBPGwvtzQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/progress": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
-      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26744,8 +21722,6 @@
     },
     "node_modules/promise-retry": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
-      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26758,8 +21734,6 @@
     },
     "node_modules/promise-retry/node_modules/retry": {
       "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26768,8 +21742,6 @@
     },
     "node_modules/prompts": {
       "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz",
-      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26782,8 +21754,6 @@
     },
     "node_modules/propagating-hammerjs": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/propagating-hammerjs/-/propagating-hammerjs-1.5.0.tgz",
-      "integrity": "sha512-3PUXWmomwutoZfydC+lJwK1bKCh6sK6jZGB31RUX6+4EXzsbkDZrK4/sVR7gBrvJaEIwpTVyxQUAd29FKkmVdw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26792,8 +21762,6 @@
     },
     "node_modules/protobufjs": {
       "version": "6.11.6",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-6.11.6.tgz",
-      "integrity": "sha512-k8BHqgPBOtrlougZZqF2uUk5Z7bN8f0wj+3e8M3hvtSv0NBAz4VBy5f6R5Nxq/l+i7mRFTgNZb2trxqTpHNY/A==",
       "dev": true,
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
@@ -26819,8 +21787,6 @@
     },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26833,8 +21799,6 @@
     },
     "node_modules/proxy-from-env": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.0.0.tgz",
-      "integrity": "sha512-F2JHgJQ1iqwnHDcQjVBsq3n/uoaFL+iPW/eAeL7kVxy/2RrWaN4WroKjjvbsoRtv0ftelNyC01bjRhn/bhcf4A==",
       "dev": true,
       "license": "MIT"
     },
@@ -26850,16 +21814,12 @@
     },
     "node_modules/prr": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/prr/-/prr-1.0.1.tgz",
-      "integrity": "sha512-yPw4Sng1gWghHQWj0B3ZggWUm4qVbPwPFcRG8KyxiU7J2OHFSoEHKS+EZ3fv5l1t9CyCiop6l/ZYeWbrgoQejw==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/ps-tree": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/ps-tree/-/ps-tree-1.2.0.tgz",
-      "integrity": "sha512-0VnamPPYHl4uaU/nSFeZZpR21QAWRz+sRv4iW9+v/GS/J5U5iZB5BNN6J0RMoOvdx2gWM2+ZFMIm58q24e4UYA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26874,8 +21834,6 @@
     },
     "node_modules/ps-tree/node_modules/event-stream": {
       "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/event-stream/-/event-stream-3.3.4.tgz",
-      "integrity": "sha512-QHpkERcGsR0T7Qm3HNJSyXKEEj8AHNxkY3PK8TS2KJvQ7NiSHe3DDpwVKKtoYprL/AreyzFBeIkBIWChAqn60g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26890,14 +21848,10 @@
     },
     "node_modules/ps-tree/node_modules/map-stream": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/map-stream/-/map-stream-0.1.0.tgz",
-      "integrity": "sha512-CkYQrPYZfWnu/DAmVCpTSX/xHpKZ80eKh2lAkyA6AJTef6bW+6JpbQZN5rofum7da+SyN1bi5ctTm+lTfcCW3g==",
       "dev": true
     },
     "node_modules/ps-tree/node_modules/split": {
       "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/split/-/split-0.3.3.tgz",
-      "integrity": "sha512-wD2AeVmxXRBoX44wAycgjVpMhvbwdI2aZjCkvfNcH1YqHQvJVa1duWc73OyVGJUc05fhFaTZeQ/PYsrmyH0JVA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26909,8 +21863,6 @@
     },
     "node_modules/ps-tree/node_modules/stream-combiner": {
       "version": "0.0.4",
-      "resolved": "https://registry.npmjs.org/stream-combiner/-/stream-combiner-0.0.4.tgz",
-      "integrity": "sha512-rT00SPnTVyRsaSz5zgSPma/aHSOic5U1prhYdRy5HS2kTZviFpmDgzilbtsJsxiroqACmayynDN/9VzIbX5DOw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26919,8 +21871,6 @@
     },
     "node_modules/psl": {
       "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/psl/-/psl-1.15.0.tgz",
-      "integrity": "sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26932,8 +21882,6 @@
     },
     "node_modules/psl/node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -26942,8 +21890,6 @@
     },
     "node_modules/public-encrypt": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/public-encrypt/-/public-encrypt-4.0.3.tgz",
-      "integrity": "sha512-zVpa8oKZSz5bTMTFClc1fQOnyyEzpl5ozpi1B5YcvBrdohMjH2rfsBtyXcuNuwjsDIXmBYlF2N5FlJYhR29t8Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26957,15 +21903,11 @@
     },
     "node_modules/public-encrypt/node_modules/bn.js": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
-      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/pump": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
-      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -26975,15 +21917,11 @@
     },
     "node_modules/punycode": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-1.4.1.tgz",
-      "integrity": "sha512-jmYNElW7yvO7TV33CjSmvSiE2yco3bV2czu/OzDKdMNVZQWfxCblURLhf+47syQRBntjfLdd/H0egrzIG+oaFQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/pure-rand": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
-      "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
       "dev": true,
       "funding": [
         {
@@ -26999,8 +21937,6 @@
     },
     "node_modules/qified": {
       "version": "0.10.1",
-      "resolved": "https://registry.npmjs.org/qified/-/qified-0.10.1.tgz",
-      "integrity": "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27012,15 +21948,11 @@
     },
     "node_modules/qified/node_modules/hookified": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
-      "integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/qs": {
       "version": "6.10.7",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.10.7.tgz",
-      "integrity": "sha512-SU8Tw69GDcmdCwqC8OksqrQ6w/TGMsKRWGOj5rOaFt1xVwLbReX87/icjHrGDVuS3yfZUHKo2Q26IoAVucBS3Q==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -27035,8 +21967,6 @@
     },
     "node_modules/querystring-es3": {
       "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/querystring-es3/-/querystring-es3-0.2.1.tgz",
-      "integrity": "sha512-773xhDQnZBMFobEiztv8LIl70ch5MSF/jUQVlhwFyBILqq96anmoctVIYz+ZRp0qbCKATTn6ev02M3r7Ga5vqA==",
       "dev": true,
       "engines": {
         "node": ">=0.4.x"
@@ -27044,15 +21974,11 @@
     },
     "node_modules/querystringify": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
-      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
-      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
       "funding": [
         {
           "type": "github",
@@ -27071,15 +21997,11 @@
     },
     "node_modules/quick-format-unescaped": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
-      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/quick-lru": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz",
-      "integrity": "sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27091,8 +22013,6 @@
     },
     "node_modules/randombytes": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
-      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27101,8 +22021,6 @@
     },
     "node_modules/randomfill": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/randomfill/-/randomfill-1.0.4.tgz",
-      "integrity": "sha512-87lcbR8+MhcWcUiQ+9e+Rwx8MyR2P7qnt15ynUlbm3TU/fjbgz4GsvfSUDTemtCCtVCqb4ZcEFlyPNTh9bBTLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27112,8 +22030,6 @@
     },
     "node_modules/range-parser": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27122,8 +22038,6 @@
     },
     "node_modules/raw-body": {
       "version": "2.5.3",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
-      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27138,8 +22052,6 @@
     },
     "node_modules/raw-body/node_modules/iconv-lite": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27151,15 +22063,11 @@
     },
     "node_modules/react-is": {
       "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/read-only-stream": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/read-only-stream/-/read-only-stream-2.0.0.tgz",
-      "integrity": "sha512-3ALe0bjBVZtkdWKIcThYpQCLbBMd/+Tbh2CDSrAIDO3UsZ4Xs+tnyjv2MjCOMMgBG+AsUOeuP1cgtY1INISc8w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27168,8 +22076,6 @@
     },
     "node_modules/read-pkg": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-3.0.0.tgz",
-      "integrity": "sha512-BLq/cCO9two+lBgiTYNqD6GdtK8s4NpaWrl6/rCO9w0TUS8oJl7cmToOZfRYllKTISY6nt1U7jQ53brmKqY6BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27183,8 +22089,6 @@
     },
     "node_modules/read-pkg/node_modules/path-type": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-3.0.0.tgz",
-      "integrity": "sha512-T2ZUsdZFHgA3u4e5PfPbjd7HDDpxPnQb5jN0SrDsjNSuVXHJqtwTnWqG0B1jZrgmJ/7lj1EmVIByWt1gxGkWvg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27196,8 +22100,6 @@
     },
     "node_modules/read-pkg/node_modules/pify": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz",
-      "integrity": "sha512-C3FsVNH1udSEX48gGX1xfvwTWfsYWj5U+8/uK15BGzIGrKoUpghX8hWZwa/OFnakBiiVNmBvemTJR5mcy7iPcg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27206,8 +22108,6 @@
     },
     "node_modules/readable-stream": {
       "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27222,15 +22122,11 @@
     },
     "node_modules/readable-stream/node_modules/safe-buffer": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/readable-stream/node_modules/string_decoder": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27239,8 +22135,6 @@
     },
     "node_modules/readdirp": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
-      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27253,8 +22147,6 @@
     },
     "node_modules/real-require": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
-      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27263,15 +22155,11 @@
     },
     "node_modules/reflect-metadata": {
       "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
-      "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/reflect.getprototypeof": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz",
-      "integrity": "sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27293,15 +22181,11 @@
     },
     "node_modules/regenerate": {
       "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
-      "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/regenerate-unicode-properties": {
       "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.2.2.tgz",
-      "integrity": "sha512-m03P+zhBeQd1RGnYxrGyDAPpWX/epKirLrp8e3qevZdVkKtnCrjjWczIbYc8+xd6vcTStVlqfycTx1KR4LOr0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27313,22 +22197,16 @@
     },
     "node_modules/regenerator-runtime": {
       "version": "0.14.1",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz",
-      "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/regex-parser": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/regex-parser/-/regex-parser-2.3.1.tgz",
-      "integrity": "sha512-yXLRqatcCuKtVHsWrNg0JL3l1zGfdXeEvDa0bdu4tCDQw0RpMDZsqbkyRTUnKMR0tXF627V2oEWjBEaEdqTwtQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/regexp.prototype.flags": {
       "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.4.tgz",
-      "integrity": "sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27348,8 +22226,6 @@
     },
     "node_modules/regexpu-core": {
       "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-6.4.0.tgz",
-      "integrity": "sha512-0ghuzq67LI9bLXpOX/ISfve/Mq33a4aFRzoQYhnnok1JOFpmE/A2TBGkNVenOGEeSBCjIiWcc6MVOG5HEQv0sA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27366,15 +22242,11 @@
     },
     "node_modules/regjsgen": {
       "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.8.0.tgz",
-      "integrity": "sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/regjsparser": {
       "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.13.1.tgz",
-      "integrity": "sha512-dLsljMd9sqwRkby8zhO1gSg3PnJIBFid8f4CQj/sXx+7cKx+E7u0PKhZ+U4wmhx7EfmtvnA318oVaIkAB1lRJw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -27386,8 +22258,6 @@
     },
     "node_modules/repeat-string": {
       "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
-      "integrity": "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27396,8 +22266,6 @@
     },
     "node_modules/request-progress": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/request-progress/-/request-progress-3.0.0.tgz",
-      "integrity": "sha512-MnWzEHHaxHO2iWiQuHrUPBi/1WeBf5PkxQqNyNvLl9VAYSdXkP8tQ3pBSeCPD+yw0v0Aq1zosWLz0BdeXpWwZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27406,8 +22274,6 @@
     },
     "node_modules/require-directory": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -27415,8 +22281,6 @@
     },
     "node_modules/require-from-string": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27425,15 +22289,11 @@
     },
     "node_modules/requires-port": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
-      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/resolve": {
       "version": "1.22.10",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.10.tgz",
-      "integrity": "sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27453,15 +22313,11 @@
     },
     "node_modules/resolve-alpn": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
-      "integrity": "sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/resolve-cwd": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
-      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27473,8 +22329,6 @@
     },
     "node_modules/resolve-cwd/node_modules/resolve-from": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27483,8 +22337,6 @@
     },
     "node_modules/resolve-from": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27493,8 +22345,6 @@
     },
     "node_modules/resolve-url-loader": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-url-loader/-/resolve-url-loader-5.0.0.tgz",
-      "integrity": "sha512-uZtduh8/8srhBoMx//5bwqjQ+rfYOUq8zC9NrMUGtjBiGTtFJM42s58/36+hTqeqINcnYe08Nj3LkK9lW4N8Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27510,8 +22360,6 @@
     },
     "node_modules/resolve-url-loader/node_modules/loader-utils": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
-      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27525,8 +22373,6 @@
     },
     "node_modules/resolve-url-loader/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -27535,8 +22381,6 @@
     },
     "node_modules/resolve.exports": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-2.0.3.tgz",
-      "integrity": "sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27545,8 +22389,6 @@
     },
     "node_modules/responselike": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/responselike/-/responselike-2.0.1.tgz",
-      "integrity": "sha512-4gl03wn3hj1HP3yzgdI7d3lCkF95F21Pz4BPGvKHinyQzALR5CapwC8yIi0Rh58DEMQ/SguC03wFj2k0M/mHhw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27558,8 +22400,6 @@
     },
     "node_modules/restore-cursor": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27572,15 +22412,11 @@
     },
     "node_modules/restore-cursor/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/ret": {
       "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/ret/-/ret-0.4.3.tgz",
-      "integrity": "sha512-0f4Memo5QP7WQyUEAYUO3esD/XjOc3Zjjg5CPsAq1p8sIu0XPeMbHJemKA0BO7tV0X7+A0FoEpbmHXWxPyD3wQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27589,8 +22425,6 @@
     },
     "node_modules/retry": {
       "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
-      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27599,8 +22433,6 @@
     },
     "node_modules/reusify": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
-      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
       "license": "MIT",
       "engines": {
         "iojs": ">=1.0.0",
@@ -27609,15 +22441,11 @@
     },
     "node_modules/rfdc": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
-      "integrity": "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/ripemd160": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.3.tgz",
-      "integrity": "sha512-5Di9UC0+8h1L6ZD2d7awM7E/T4uA1fJRlx6zk/NvdCCVEoAnFqvHmCuNeIKoCeIixBX/q8uM+6ycDvF8woqosA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27630,8 +22458,6 @@
     },
     "node_modules/ripemd160/node_modules/hash-base": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.1.2.tgz",
-      "integrity": "sha512-Bb33KbowVTIj5s7Ked1OsqHUeCpz//tPwR+E2zJgJKo9Z5XolZ9b6bdUgjmYlwnWhoOQKoTd1TYToZGn5mAYOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27646,14 +22472,10 @@
     },
     "node_modules/robust-predicates": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
-      "integrity": "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==",
       "license": "Unlicense"
     },
     "node_modules/rollup": {
       "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
-      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27697,15 +22519,11 @@
     },
     "node_modules/rollup/node_modules/@types/estree": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/run-applescript": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-7.1.0.tgz",
-      "integrity": "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27717,8 +22535,6 @@
     },
     "node_modules/run-parallel": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
-      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
       "funding": [
         {
           "type": "github",
@@ -27740,14 +22556,10 @@
     },
     "node_modules/rw": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/rw/-/rw-1.3.3.tgz",
-      "integrity": "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ==",
       "license": "BSD-3-Clause"
     },
     "node_modules/rxjs": {
       "version": "6.6.3",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.3.tgz",
-      "integrity": "sha512-trsQc+xYYXZ3urjOiJOuCOa5N3jAZ3eiSpQB5hIT8zGlL2QfnHLJ2r7GMkBGuIausdJN1OneaI6gQlsqNHHmZQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^1.9.0"
@@ -27758,14 +22570,10 @@
     },
     "node_modules/rxjs/node_modules/tslib": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
       "license": "0BSD"
     },
     "node_modules/safe-array-concat": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.4.tgz",
-      "integrity": "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27784,15 +22592,11 @@
     },
     "node_modules/safe-array-concat/node_modules/isarray": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
       "funding": [
         {
           "type": "github",
@@ -27811,8 +22615,6 @@
     },
     "node_modules/safe-push-apply": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-push-apply/-/safe-push-apply-1.0.0.tgz",
-      "integrity": "sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27828,15 +22630,11 @@
     },
     "node_modules/safe-push-apply/node_modules/isarray": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/safe-regex-test": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.1.0.tgz",
-      "integrity": "sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27853,8 +22651,6 @@
     },
     "node_modules/safe-regex2": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/safe-regex2/-/safe-regex2-3.1.0.tgz",
-      "integrity": "sha512-RAAZAGbap2kBfbVhvmnTFv73NWLMvDGOITFYTZBAaY8eR+Ir4ef7Up/e7amo+y1+AH+3PtLkrt9mvcTsG9LXug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27863,8 +22659,6 @@
     },
     "node_modules/safe-stable-stringify": {
       "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
-      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -27873,14 +22667,10 @@
     },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
     "node_modules/sass": {
       "version": "1.85.0",
-      "resolved": "https://registry.npmjs.org/sass/-/sass-1.85.0.tgz",
-      "integrity": "sha512-3ToiC1xZ1Y8aU7+CkgCI/tqyuPXEmYGJXO7H4uqp0xkLXUqp88rQQ4j1HmP37xSJLbCJPaIiv+cT1y+grssrww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27900,8 +22690,6 @@
     },
     "node_modules/sass-loader": {
       "version": "16.0.5",
-      "resolved": "https://registry.npmjs.org/sass-loader/-/sass-loader-16.0.5.tgz",
-      "integrity": "sha512-oL+CMBXrj6BZ/zOq4os+UECPL+bWqt6OAC6DWS8Ln8GZRcMDjlJ4JC3FBDuHJdYaFWIdKNIBYmtZtK2MaMkNIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27941,8 +22729,6 @@
     },
     "node_modules/sax": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.0.tgz",
-      "integrity": "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
@@ -27950,8 +22736,6 @@
     },
     "node_modules/saxes": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
-      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -27963,8 +22747,6 @@
     },
     "node_modules/schema-utils": {
       "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.3.tgz",
-      "integrity": "sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -27983,8 +22765,6 @@
     },
     "node_modules/schema-utils/node_modules/ajv-formats": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz",
-      "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28001,29 +22781,21 @@
     },
     "node_modules/secure-json-parse": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-2.7.0.tgz",
-      "integrity": "sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/seed-random": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/seed-random/-/seed-random-2.2.0.tgz",
-      "integrity": "sha512-34EQV6AAHQGhoc0tn/96a9Fsi6v2xdqe/dMUwljGRaFOzR3EgRmECvD0O8vi8X+/uQ50LGHfkNu/Eue5TPKZkQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/select-hose": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/select-hose/-/select-hose-2.0.0.tgz",
-      "integrity": "sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/selfsigned": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-2.4.1.tgz",
-      "integrity": "sha512-th5B4L2U+eGLq1TVh7zNRGBapioSORUeymIydxgFpwww9d2qyKvtuPU2jJuHvYAwwqi2Y596QBL3eEqcPEYL8Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28036,8 +22808,6 @@
     },
     "node_modules/semver": {
       "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -28076,8 +22846,6 @@
     },
     "node_modules/send/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28094,8 +22862,6 @@
     },
     "node_modules/send/node_modules/encodeurl": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28104,8 +22870,6 @@
     },
     "node_modules/send/node_modules/mime-db": {
       "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28114,8 +22878,6 @@
     },
     "node_modules/send/node_modules/mime-types": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28131,15 +22893,11 @@
     },
     "node_modules/send/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/send/node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28151,8 +22909,6 @@
     },
     "node_modules/send/node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28161,8 +22917,6 @@
     },
     "node_modules/serialize-error": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-2.1.0.tgz",
-      "integrity": "sha512-ghgmKt5o4Tly5yEG/UJp8qTd0AN7Xalw4XBtDEKP655B699qMEtra1WlXeE6WIvdEG481JvRxULKsInq/iNysw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28171,8 +22925,6 @@
     },
     "node_modules/serialize-javascript": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
-      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -28181,8 +22933,6 @@
     },
     "node_modules/serve-index": {
       "version": "1.9.2",
-      "resolved": "https://registry.npmjs.org/serve-index/-/serve-index-1.9.2.tgz",
-      "integrity": "sha512-KDj11HScOaLmrPxl70KYNW1PksP4Nb/CLL2yvC+Qd2kHMPEEpfc4Re2e4FOay+bC/+XQl/7zAcWON3JVo5v3KQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28204,8 +22954,6 @@
     },
     "node_modules/serve-index/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28214,8 +22962,6 @@
     },
     "node_modules/serve-index/node_modules/depd": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
-      "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28224,8 +22970,6 @@
     },
     "node_modules/serve-index/node_modules/http-errors": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
-      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28241,15 +22985,11 @@
     },
     "node_modules/serve-index/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/serve-static": {
       "version": "1.16.3",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
-      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28264,8 +23004,6 @@
     },
     "node_modules/serve-static/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28274,15 +23012,11 @@
     },
     "node_modules/serve-static/node_modules/debug/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/serve-static/node_modules/encodeurl": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28291,8 +23025,6 @@
     },
     "node_modules/serve-static/node_modules/fresh": {
       "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
-      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28301,15 +23033,11 @@
     },
     "node_modules/serve-static/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/serve-static/node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28321,8 +23049,6 @@
     },
     "node_modules/serve-static/node_modules/send": {
       "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
-      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28346,8 +23072,6 @@
     },
     "node_modules/serve-static/node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28356,15 +23080,11 @@
     },
     "node_modules/set-cookie-parser": {
       "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
-      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/set-function-length": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
-      "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28381,8 +23101,6 @@
     },
     "node_modules/set-function-name": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/set-function-name/-/set-function-name-2.0.2.tgz",
-      "integrity": "sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28397,8 +23115,6 @@
     },
     "node_modules/set-proto": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/set-proto/-/set-proto-1.0.0.tgz",
-      "integrity": "sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28412,21 +23128,15 @@
     },
     "node_modules/setimmediate": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
-      "integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==",
       "license": "MIT"
     },
     "node_modules/setprototypeof": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/sha.js": {
       "version": "2.4.12",
-      "resolved": "https://registry.npmjs.org/sha.js/-/sha.js-2.4.12.tgz",
-      "integrity": "sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==",
       "dev": true,
       "license": "(MIT AND BSD-3-Clause)",
       "dependencies": {
@@ -28446,8 +23156,6 @@
     },
     "node_modules/shallow-clone": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-3.0.1.tgz",
-      "integrity": "sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28459,8 +23167,6 @@
     },
     "node_modules/shasum": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/shasum/-/shasum-1.0.2.tgz",
-      "integrity": "sha512-UTzHm/+AzKfO9RgPgRpDIuMSNie1ubXRaljjlhFMNGYoG7z+rm9AHLPMf70R7887xboDH9Q+5YQbWKObFHEAtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28470,8 +23176,6 @@
     },
     "node_modules/shasum-object": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/shasum-object/-/shasum-object-1.0.1.tgz",
-      "integrity": "sha512-SsC+1tW7XKQ/94D4k1JhLmjDFpVGET/Nf54jVDtbavbALf8Zhp0Td9zTlxScjMW6nbEIrpADtPWfLk9iCXzHDQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -28483,8 +23187,6 @@
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28496,8 +23198,6 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28506,8 +23206,6 @@
     },
     "node_modules/shell-quote": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
-      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28519,8 +23217,6 @@
     },
     "node_modules/side-channel": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
-      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28539,8 +23235,6 @@
     },
     "node_modules/side-channel-list": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28556,8 +23250,6 @@
     },
     "node_modules/side-channel-map": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28575,8 +23267,6 @@
     },
     "node_modules/side-channel-weakmap": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28595,8 +23285,6 @@
     },
     "node_modules/signal-exit": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -28608,8 +23296,6 @@
     },
     "node_modules/sigstore": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-3.1.0.tgz",
-      "integrity": "sha512-ZpzWAFHIFqyFE56dXqgX/DkDRZdz+rRcjoIk/RQU4IX0wiCv1l8S7ZrXDHcCc+uaf+6o7w3h2l3g6GYG5TKN9Q==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -28626,8 +23312,6 @@
     },
     "node_modules/simple-concat": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
       "dev": true,
       "funding": [
         {
@@ -28647,8 +23331,6 @@
     },
     "node_modules/simple-swizzle": {
       "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/simple-swizzle/-/simple-swizzle-0.2.4.tgz",
-      "integrity": "sha512-nAu1WFPQSMNr2Zn9PGSZK9AGn4t/y97lEm+MXTtUDwfP0ksAIX4nO+6ruD9Jwut4C49SB1Ws+fbXsm/yScWOHw==",
       "license": "MIT",
       "dependencies": {
         "is-arrayish": "^0.3.1"
@@ -28656,14 +23338,10 @@
     },
     "node_modules/simple-swizzle/node_modules/is-arrayish": {
       "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.3.4.tgz",
-      "integrity": "sha512-m6UrgzFVUYawGBh1dUsWR5M2Clqic9RVXC/9f8ceNlv2IcO9j9J/z8UoCLPqtsPBFNzEpfR3xftohbfqDx8EQA==",
       "license": "MIT"
     },
     "node_modules/simplebar-angular": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/simplebar-angular/-/simplebar-angular-3.3.0.tgz",
-      "integrity": "sha512-8fR3asuG7MVSanuzxz1IqbFvKZRrDtby/29+olqKkR7DZs/Fs35eyCp/rQnIFM5yKwl3IuEq5upwkOco/q/MYw==",
       "license": "MIT",
       "dependencies": {
         "simplebar-core": "^1.3.0",
@@ -28676,8 +23354,6 @@
     },
     "node_modules/simplebar-core": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/simplebar-core/-/simplebar-core-1.3.2.tgz",
-      "integrity": "sha512-qKgTTuTqapjsFGkNhCjyPhysnbZGpQqNmjk0nOYjFN5ordC/Wjvg+RbYCyMSnW60l/Z0ZS82GbNltly6PMUH1w==",
       "license": "MIT",
       "dependencies": {
         "lodash": "^4.17.21",
@@ -28686,15 +23362,11 @@
     },
     "node_modules/sisteransi": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/slash": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-5.1.0.tgz",
-      "integrity": "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28706,8 +23378,6 @@
     },
     "node_modules/slice-ansi": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-5.0.0.tgz",
-      "integrity": "sha512-FC+lgizVPfie0kkhqUScwRu1O/lF6NOgJmlCgK+/LYxDCTk8sGelYaHDhFcDN+Sn3Cv+3VSa4Byeo+IMCzpMgQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28723,8 +23393,6 @@
     },
     "node_modules/slice-ansi/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28736,8 +23404,6 @@
     },
     "node_modules/smart-buffer": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28747,8 +23413,6 @@
     },
     "node_modules/sockjs": {
       "version": "0.3.24",
-      "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
-      "integrity": "sha512-GJgLTZ7vYb/JtPSSZ10hsOYIvEYsjbNU+zPdIHcUaWVNUEPivzxku31865sSSud0Da0W4lEeOPlmw93zLQchuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28759,8 +23423,6 @@
     },
     "node_modules/socks": {
       "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
-      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28774,8 +23436,6 @@
     },
     "node_modules/socks-proxy-agent": {
       "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28789,8 +23449,6 @@
     },
     "node_modules/socks-proxy-agent/node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -28799,8 +23457,6 @@
     },
     "node_modules/sonic-boom": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
-      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28809,8 +23465,6 @@
     },
     "node_modules/source-map": {
       "version": "0.7.4",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.4.tgz",
-      "integrity": "sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -28819,8 +23473,6 @@
     },
     "node_modules/source-map-js": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.1.tgz",
-      "integrity": "sha512-4+TN2b3tqOCd/kaGRJ/sTYA0tR0mdXx26ipdolxcwtJVqEnqNYvlCAt1q3ypy4QMlYus+Zh34RNtYLoq2oQ4IA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -28829,8 +23481,6 @@
     },
     "node_modules/source-map-loader": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/source-map-loader/-/source-map-loader-5.0.0.tgz",
-      "integrity": "sha512-k2Dur7CbSLcAH73sBcIkV5xjPV4SzqO1NJ7+XaQl8if3VODDUj3FNchNGpqgJSKbvUfJuhVdv8K2Eu8/TNl2eA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28850,8 +23500,6 @@
     },
     "node_modules/source-map-loader/node_modules/iconv-lite": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28863,8 +23511,6 @@
     },
     "node_modules/source-map-loader/node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -28873,8 +23519,6 @@
     },
     "node_modules/source-map-support": {
       "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
-      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28884,8 +23528,6 @@
     },
     "node_modules/source-map-support/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -28894,8 +23536,6 @@
     },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
-      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -28905,15 +23545,11 @@
     },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
-      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
       "dev": true,
       "license": "CC-BY-3.0"
     },
     "node_modules/spdx-expression-parse": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28923,15 +23559,11 @@
     },
     "node_modules/spdx-license-ids": {
       "version": "3.0.23",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
-      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "dev": true,
       "license": "CC0-1.0"
     },
     "node_modules/spdy": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/spdy/-/spdy-4.0.2.tgz",
-      "integrity": "sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28947,8 +23579,6 @@
     },
     "node_modules/spdy-transport": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/spdy-transport/-/spdy-transport-3.0.0.tgz",
-      "integrity": "sha512-hsLVFE5SjA6TCisWeJXFKniGGOpBgMLmerfO2aCyCU5s7nJ/rpAepqmFifv/GCbSbueEeAJJnmSQ2rKC/g8Fcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28962,8 +23592,6 @@
     },
     "node_modules/spdy-transport/node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28977,8 +23605,6 @@
     },
     "node_modules/split": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/split/-/split-1.0.1.tgz",
-      "integrity": "sha512-mTyOoPbrivtXnwnIxZRFYRrPNtEFKlpB2fvjSnCQUiAA6qAZzqwna5envK4uk6OIeP17CsdF3rSBGYVBsU0Tkg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -28990,8 +23616,6 @@
     },
     "node_modules/split2": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
-      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -29000,15 +23624,11 @@
     },
     "node_modules/sprintf-js": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/sshpk": {
       "version": "1.18.0",
-      "resolved": "https://registry.npmjs.org/sshpk/-/sshpk-1.18.0.tgz",
-      "integrity": "sha512-2p2KJZTSqQ/I3+HX42EpYOa2l3f8Erv8MWKsy2I9uf4wA7yFIkXRffYdsx86y6z4vHtV8u7g+pPlr8/4ouAxsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29033,8 +23653,6 @@
     },
     "node_modules/ssri": {
       "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
-      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -29046,15 +23664,11 @@
     },
     "node_modules/stack-chain": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/stack-chain/-/stack-chain-2.0.0.tgz",
-      "integrity": "sha512-GGrHXePi305aW7XQweYZZwiRwR7Js3MWoK/EHzzB9ROdc75nCnjSJVi21rdAGxFl+yCx2L2qdfl5y7NO4lTyqg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/stack-generator": {
       "version": "2.0.10",
-      "resolved": "https://registry.npmjs.org/stack-generator/-/stack-generator-2.0.10.tgz",
-      "integrity": "sha512-mwnua/hkqM6pF4k8SnmZ2zfETsRUpWXREfA/goT8SLCV4iOFa4bzOX2nDipWAZFPTjLvQB82f5yaodMVhK0yJQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29063,8 +23677,6 @@
     },
     "node_modules/stack-utils": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz",
-      "integrity": "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29076,8 +23688,6 @@
     },
     "node_modules/stack-utils/node_modules/escape-string-regexp": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
-      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29086,15 +23696,11 @@
     },
     "node_modules/stackframe": {
       "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/stackframe/-/stackframe-1.3.4.tgz",
-      "integrity": "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/stacktrace-gps": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/stacktrace-gps/-/stacktrace-gps-3.1.2.tgz",
-      "integrity": "sha512-GcUgbO4Jsqqg6RxfyTHFiPxdPqF+3LFmQhm7MgCuYQOYuWyqxo5pwRPz5d/u6/WYJdEnWfK4r+jGbyD8TSggXQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29104,8 +23710,6 @@
     },
     "node_modules/stacktrace-gps/node_modules/source-map": {
       "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.6.tgz",
-      "integrity": "sha512-MjZkVp0NHr5+TPihLcadqnlVoGIoWo4IBHptutGh9wI3ttUYvCG26HkSuDi+K6lsZ25syXJXcctwgyVCt//xqA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -29114,8 +23718,6 @@
     },
     "node_modules/stacktrace-js": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/stacktrace-js/-/stacktrace-js-2.0.2.tgz",
-      "integrity": "sha512-Je5vBeY4S1r/RnLydLl0TBTi3F2qdfWmYsGvtfZgEI+SCprPppaIhQf5nGcal4gI4cGpCV/duLcAzT1np6sQqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29126,8 +23728,6 @@
     },
     "node_modules/start-server-and-test": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/start-server-and-test/-/start-server-and-test-2.0.3.tgz",
-      "integrity": "sha512-QsVObjfjFZKJE6CS6bSKNwWZCKBG6975/jKRPPGFfFh+yOQglSeGXiNWjzgQNXdphcBI9nXbyso9tPfX4YAUhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29151,8 +23751,6 @@
     },
     "node_modules/start-server-and-test/node_modules/execa": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29175,8 +23773,6 @@
     },
     "node_modules/start-server-and-test/node_modules/get-stream": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29188,8 +23784,6 @@
     },
     "node_modules/start-server-and-test/node_modules/human-signals": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -29198,8 +23792,6 @@
     },
     "node_modules/start-server-and-test/node_modules/is-stream": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29211,15 +23803,11 @@
     },
     "node_modules/start-server-and-test/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/statuses": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
-      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29228,8 +23816,6 @@
     },
     "node_modules/stop-iteration-iterator": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz",
-      "integrity": "sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29242,8 +23828,6 @@
     },
     "node_modules/stream-browserify": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz",
-      "integrity": "sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==",
       "license": "MIT",
       "dependencies": {
         "inherits": "~2.0.4",
@@ -29252,8 +23836,6 @@
     },
     "node_modules/stream-browserify/node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.3",
@@ -29266,8 +23848,6 @@
     },
     "node_modules/stream-combiner": {
       "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/stream-combiner/-/stream-combiner-0.2.2.tgz",
-      "integrity": "sha512-6yHMqgLYDzQDcAkL+tjJDC5nSNuNIx0vZtRZeiPh7Saef7VHX9H5Ijn9l2VIol2zaNYlYEX6KyuT/237A58qEQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29277,8 +23857,6 @@
     },
     "node_modules/stream-combiner2": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/stream-combiner2/-/stream-combiner2-1.1.1.tgz",
-      "integrity": "sha512-3PnJbYgS56AeWgtKF5jtJRT6uFJe56Z0Hc5Ngg/6sI6rIt8iiMBTa9cvdyFfpMQjaVHr8dusbNeFGIIonxOvKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29288,8 +23866,6 @@
     },
     "node_modules/stream-http": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/stream-http/-/stream-http-3.2.0.tgz",
-      "integrity": "sha512-Oq1bLqisTyK3TSCXpPbT4sdeYNdmyZJv1LxpEm2vu1ZhK89kSE5YXwZc3cWk0MagGaKriBh9mCFbVGtO+vY29A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29301,8 +23877,6 @@
     },
     "node_modules/stream-http/node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29316,8 +23890,6 @@
     },
     "node_modules/stream-splicer": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/stream-splicer/-/stream-splicer-2.0.1.tgz",
-      "integrity": "sha512-Xizh4/NPuYSyAXyT7g8IvdJ9HJpxIGL9PjyhtywCZvvP0OPIdqyrr4dMikeuvY8xahpdKEBlBTySe583totajg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29327,8 +23899,6 @@
     },
     "node_modules/string_decoder": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.2.0"
@@ -29336,8 +23906,6 @@
     },
     "node_modules/string-argv": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/string-argv/-/string-argv-0.0.2.tgz",
-      "integrity": "sha512-p6/Mqq0utTQWUeGMi/m0uBtlLZEwXSY3+mXzeRRqw7fz5ezUb28Wr0R99NlfbWaMmL/jCyT9be4jpn7Yz8IO8w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29346,8 +23914,6 @@
     },
     "node_modules/string-length": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
-      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29360,8 +23926,6 @@
     },
     "node_modules/string-width": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -29375,8 +23939,6 @@
     "node_modules/string-width-cjs": {
       "name": "string-width",
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29390,8 +23952,6 @@
     },
     "node_modules/string-width-cjs/node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29400,8 +23960,6 @@
     },
     "node_modules/string-width/node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -29409,8 +23967,6 @@
     },
     "node_modules/string.prototype.padend": {
       "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.padend/-/string.prototype.padend-3.1.6.tgz",
-      "integrity": "sha512-XZpspuSB7vJWhvJc9DLSlrXl1mcA2BdoY5jjnS135ydXqLoqhs96JjDtCkjJEQHvfqZIp9hBuBMgI589peyx9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29428,8 +23984,6 @@
     },
     "node_modules/string.prototype.trim": {
       "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.10.tgz",
-      "integrity": "sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29450,8 +24004,6 @@
     },
     "node_modules/string.prototype.trimend": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.9.tgz",
-      "integrity": "sha512-G7Ok5C6E/j4SGfyLCloXTrngQIQU3PWtXGst3yM7Bea9FRURf1S42ZHlZZtsNque2FN2PoUhfZXYLNWwEr4dLQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29469,8 +24021,6 @@
     },
     "node_modules/string.prototype.trimstart": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.8.tgz",
-      "integrity": "sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29487,8 +24037,6 @@
     },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -29500,8 +24048,6 @@
     "node_modules/strip-ansi-cjs": {
       "name": "strip-ansi",
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29513,8 +24059,6 @@
     },
     "node_modules/strip-bom": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
-      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29523,8 +24067,6 @@
     },
     "node_modules/strip-final-newline": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29533,8 +24075,6 @@
     },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29546,8 +24086,6 @@
     },
     "node_modules/stylelint": {
       "version": "16.20.0",
-      "resolved": "https://registry.npmjs.org/stylelint/-/stylelint-16.20.0.tgz",
-      "integrity": "sha512-B5Myu9WRxrgKuLs3YyUXLP2H0mrbejwNxPmyADlACWwFsrL8Bmor/nTSh4OMae5sHjOz6gkSeccQH34gM4/nAw==",
       "dev": true,
       "funding": [
         {
@@ -29609,8 +24147,6 @@
     },
     "node_modules/stylelint-config-recommended": {
       "version": "16.0.0",
-      "resolved": "https://registry.npmjs.org/stylelint-config-recommended/-/stylelint-config-recommended-16.0.0.tgz",
-      "integrity": "sha512-4RSmPjQegF34wNcK1e1O3Uz91HN8P1aFdFzio90wNK9mjgAI19u5vsU868cVZboKzCaa5XbpvtTzAAGQAxpcXA==",
       "dev": true,
       "funding": [
         {
@@ -29632,8 +24168,6 @@
     },
     "node_modules/stylelint-config-standard": {
       "version": "38.0.0",
-      "resolved": "https://registry.npmjs.org/stylelint-config-standard/-/stylelint-config-standard-38.0.0.tgz",
-      "integrity": "sha512-uj3JIX+dpFseqd/DJx8Gy3PcRAJhlEZ2IrlFOc4LUxBX/PNMEQ198x7LCOE2Q5oT9Vw8nyc4CIL78xSqPr6iag==",
       "dev": true,
       "funding": [
         {
@@ -29658,8 +24192,6 @@
     },
     "node_modules/stylelint-scss": {
       "version": "6.12.1",
-      "resolved": "https://registry.npmjs.org/stylelint-scss/-/stylelint-scss-6.12.1.tgz",
-      "integrity": "sha512-UJUfBFIvXfly8WKIgmqfmkGKPilKB4L5j38JfsDd+OCg2GBdU0vGUV08Uw82tsRZzd4TbsUURVVNGeOhJVF7pA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29681,22 +24213,16 @@
     },
     "node_modules/stylelint-scss/node_modules/mdn-data": {
       "version": "2.28.1",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.28.1.tgz",
-      "integrity": "sha512-U9w+PzSZ00Z5m9rZ5ARVFL5xOfuCHdKYi/1RRwDCJsboFgJDNT3zT6PIPD7mZQYaQLhsZM3GfDRgSMRHhSmVng==",
       "dev": true,
       "license": "CC0-1.0"
     },
     "node_modules/stylelint/node_modules/balanced-match": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-2.0.0.tgz",
-      "integrity": "sha512-1ugUSr8BHXRnK23KfuYS+gVMC3LB8QGH9W1iGtDPsNWoQbgtXSExkBu2aDR4epiGWZOjZsj6lDl/N/AqqTC3UA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/stylelint/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29713,8 +24239,6 @@
     },
     "node_modules/stylelint/node_modules/file-entry-cache": {
       "version": "10.1.4",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-10.1.4.tgz",
-      "integrity": "sha512-5XRUFc0WTtUbjfGzEwXc42tiGxQHBmtbUG1h9L2apu4SulCGN3Hqm//9D6FAolf8MYNL7f/YlJl9vy08pj5JuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29723,8 +24247,6 @@
     },
     "node_modules/stylelint/node_modules/flat-cache": {
       "version": "6.1.22",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.22.tgz",
-      "integrity": "sha512-N2dnzVJIphnNsjHcrxGW7DePckJ6haPrSFqpsBUhHYgwtKGVq4JrBGielEGD2fCVnsGm1zlBVZ8wGhkyuetgug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29735,8 +24257,6 @@
     },
     "node_modules/stylelint/node_modules/globby": {
       "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
-      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29756,8 +24276,6 @@
     },
     "node_modules/stylelint/node_modules/globby/node_modules/ignore": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29766,8 +24284,6 @@
     },
     "node_modules/stylelint/node_modules/ignore": {
       "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29776,8 +24292,6 @@
     },
     "node_modules/stylelint/node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29786,15 +24300,11 @@
     },
     "node_modules/stylelint/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/stylelint/node_modules/postcss": {
       "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
       "dev": true,
       "funding": [
         {
@@ -29822,8 +24332,6 @@
     },
     "node_modules/stylelint/node_modules/resolve-from": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29832,8 +24340,6 @@
     },
     "node_modules/stylelint/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29842,8 +24348,6 @@
     },
     "node_modules/stylelint/node_modules/slice-ansi": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz",
-      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29860,8 +24364,6 @@
     },
     "node_modules/stylelint/node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -29870,8 +24372,6 @@
     },
     "node_modules/stylelint/node_modules/table": {
       "version": "6.9.0",
-      "resolved": "https://registry.npmjs.org/table/-/table-6.9.0.tgz",
-      "integrity": "sha512-9kY+CygyYM6j02t5YFHbNz2FN5QmYGv9zAjVp4lCDjlCw7amdckXlEt/bjMhUIfj4ThGRE4gCUH5+yGnNuPo5A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -29887,8 +24387,6 @@
     },
     "node_modules/stylelint/node_modules/write-file-atomic": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-5.0.1.tgz",
-      "integrity": "sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -29901,8 +24399,6 @@
     },
     "node_modules/subarg": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/subarg/-/subarg-1.0.0.tgz",
-      "integrity": "sha512-RIrIdRY0X1xojthNcVtgT9sjpOGagEUKpZdgBUi054OEPFo282yg+zE+t1Rj3+RqKq2xStL7uUHhY+AjbC4BXg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29911,8 +24407,6 @@
     },
     "node_modules/supports-color": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29924,8 +24418,6 @@
     },
     "node_modules/supports-hyperlinks": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-3.2.0.tgz",
-      "integrity": "sha512-zFObLMyZeEwzAoKCyu1B91U79K2t7ApXuQfo8OuxwXLDgcKxuwM+YvcbIhm6QWqz7mHUH1TVytR1PwVVjEuMig==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -29941,8 +24433,6 @@
     },
     "node_modules/supports-preserve-symlinks-flag": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29954,21 +24444,15 @@
     },
     "node_modules/svg-pan-zoom": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/svg-pan-zoom/-/svg-pan-zoom-3.6.2.tgz",
-      "integrity": "sha512-JwnvRWfVKw/Xzfe6jriFyfey/lWJLq4bUh2jwoR5ChWQuQoOH8FEh1l/bEp46iHHKHEJWIyFJETbazraxNWECg==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
     "node_modules/svg-tags": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/svg-tags/-/svg-tags-1.0.0.tgz",
-      "integrity": "sha512-ovssysQTa+luh7A5Weu3Rta6FJlFBBbInjOh722LIt6klpU2/HtdUbszju/G4devcvk8PGt7FCLv5wftu3THUA==",
       "dev": true
     },
     "node_modules/swagger-ui-dist": {
       "version": "5.31.0",
-      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.31.0.tgz",
-      "integrity": "sha512-zSUTIck02fSga6rc0RZP3b7J7wgHXwLea8ZjgLA3Vgnb8QeOl3Wou2/j5QkzSGeoz6HusP/coYuJl33aQxQZpg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@scarf/scarf": "=1.4.0"
@@ -29976,8 +24460,6 @@
     },
     "node_modules/symbol-observable": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/symbol-observable/-/symbol-observable-4.0.0.tgz",
-      "integrity": "sha512-b19dMThMV4HVFynSAM1++gBHAbk2Tc/osgLIBZMKsyqh34jb2e8Os7T6ZW/Bt3pJFdBTd2JwAnAAEQV7rSNvcQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -29986,15 +24468,11 @@
     },
     "node_modules/symbol-tree": {
       "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/syntax-error": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/syntax-error/-/syntax-error-1.4.0.tgz",
-      "integrity": "sha512-YPPlu67mdnHGTup2A8ff7BC2Pjq0e0Yp/IyTFN03zWO0RcK07uLcbi7C2KpGR2FvWbaB0+bfE27a+sBKebSo7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30003,8 +24481,6 @@
     },
     "node_modules/table": {
       "version": "6.8.0",
-      "resolved": "https://registry.npmjs.org/table/-/table-6.8.0.tgz",
-      "integrity": "sha512-s/fitrbVeEyHKFa7mFdkuQMWlH1Wgw/yEXMt5xACT4ZpzWFluehAxRtUUQKPuWhaLAWhFcVx6w3oC8VKaUfPGA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -30020,8 +24496,6 @@
     },
     "node_modules/table/node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30030,8 +24504,6 @@
     },
     "node_modules/table/node_modules/slice-ansi": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz",
-      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30048,8 +24520,6 @@
     },
     "node_modules/tablesort": {
       "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/tablesort/-/tablesort-5.7.1.tgz",
-      "integrity": "sha512-wm+xSponmlN1spiuwGlrvNGoG8fEso+y86OOjS+Pl0Qsje/cOVSfUvELcXILWc8/sgEdY/NGMPo0qhFGyYKnwQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30059,8 +24529,6 @@
     },
     "node_modules/tapable": {
       "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
-      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30073,9 +24541,6 @@
     },
     "node_modules/tar": {
       "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
-      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
-      "deprecated": "Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30092,8 +24557,6 @@
     },
     "node_modules/tar/node_modules/fs-minipass": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
-      "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30105,8 +24568,6 @@
     },
     "node_modules/tar/node_modules/fs-minipass/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30118,8 +24579,6 @@
     },
     "node_modules/tar/node_modules/minipass": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
-      "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -30128,8 +24587,6 @@
     },
     "node_modules/tar/node_modules/minizlib": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
-      "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30142,8 +24599,6 @@
     },
     "node_modules/tar/node_modules/minizlib/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30155,8 +24610,6 @@
     },
     "node_modules/tar/node_modules/mkdirp": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -30168,15 +24621,11 @@
     },
     "node_modules/tar/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/teen_process": {
       "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/teen_process/-/teen_process-1.16.0.tgz",
-      "integrity": "sha512-RnW7HHZD1XuhSTzD3djYOdIl1adE3oNEprE3HOFFxWs5m4FZsqYRhKJ4mDU2udtNGMLUS7jV7l8vVRLWAvmPDw==",
       "dev": true,
       "engines": [
         "node"
@@ -30193,8 +24642,6 @@
     },
     "node_modules/terser": {
       "version": "5.39.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.39.0.tgz",
-      "integrity": "sha512-LBAhFyLho16harJoWMg/nZsQYgTrg5jXOn2nCYjRUcZZEdE3qa2zb8QEDRUGVZBW4rlazf2fxkg8tztybTaqWw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -30212,8 +24659,6 @@
     },
     "node_modules/terser-webpack-plugin": {
       "version": "5.6.1",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz",
-      "integrity": "sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30273,8 +24718,6 @@
     },
     "node_modules/terser-webpack-plugin/node_modules/jest-worker": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-27.5.1.tgz",
-      "integrity": "sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30288,8 +24731,6 @@
     },
     "node_modules/terser-webpack-plugin/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30304,15 +24745,11 @@
     },
     "node_modules/terser/node_modules/commander": {
       "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/test-exclude": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30326,8 +24763,6 @@
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30337,9 +24772,6 @@
     },
     "node_modules/test-exclude/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30359,8 +24791,6 @@
     },
     "node_modules/test-exclude/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -30372,15 +24802,11 @@
     },
     "node_modules/text-table": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
-      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/thenify": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz",
-      "integrity": "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30389,8 +24815,6 @@
     },
     "node_modules/thenify-all": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
-      "integrity": "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30402,8 +24826,6 @@
     },
     "node_modules/thingies": {
       "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/thingies/-/thingies-2.6.0.tgz",
-      "integrity": "sha512-rMHRjmlFLM1R96UYPvpmnc3LYtdFrT33JIB7L9hetGue1qAPfn1N2LJeEjxUSidu1Iku+haLZXDuEXUHNGO/lg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30419,8 +24841,6 @@
     },
     "node_modules/thread-stream": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-3.1.0.tgz",
-      "integrity": "sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30429,15 +24849,11 @@
     },
     "node_modules/throat": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/throat/-/throat-6.0.2.tgz",
-      "integrity": "sha512-WKexMoJj3vEuK0yFEapj8y64V0A6xcuPuK9Gt1d0R+dzCSJc0lHqQytAbSB4cDAK0dWh4T0E2ETkoLE2WZ41OQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/throttleit": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/throttleit/-/throttleit-1.0.1.tgz",
-      "integrity": "sha512-vDZpf9Chs9mAdfY046mcPt8fg5QSZr37hEH4TXYBnDF+izxgrbRGUAAaBvIk/fJm9aOFCGFd1EsNg5AZCbnQCQ==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -30446,15 +24862,11 @@
     },
     "node_modules/through": {
       "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
-      "integrity": "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/through2": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.5.tgz",
-      "integrity": "sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30464,15 +24876,11 @@
     },
     "node_modules/thunky": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
-      "integrity": "sha512-eHY7nBftgThBqOyHGVN+l8gF0BucP09fMo0oO/Lb0w1OF80dJv+lDVpXG60WMQvkcxAkNybKsrEIE3ZtKGmPrA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/timers-browserify": {
       "version": "2.0.12",
-      "resolved": "https://registry.npmjs.org/timers-browserify/-/timers-browserify-2.0.12.tgz",
-      "integrity": "sha512-9phl76Cqm6FhSX9Xe1ZUAMLtm1BLkKj2Qd5ApyWkXzsMRaA7dgr81kf4wJmQf/hAvg8EEyJxDo3du/0KlhPiKQ==",
       "license": "MIT",
       "dependencies": {
         "setimmediate": "^1.0.4"
@@ -30483,8 +24891,6 @@
     },
     "node_modules/tinyglobby": {
       "version": "0.2.16",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
-      "integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30500,8 +24906,6 @@
     },
     "node_modules/tinyglobby/node_modules/picomatch": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30513,8 +24917,6 @@
     },
     "node_modules/title-case": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/title-case/-/title-case-2.1.1.tgz",
-      "integrity": "sha512-EkJoZ2O3zdCz3zJsYCsxyq2OC5hrxR9mfdd5I+w8h/tmFfeOxJ+vvkxsKxdmN0WtS9zLdHEgfgVOiMVgv+Po4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30524,8 +24926,6 @@
     },
     "node_modules/tmp": {
       "version": "0.2.5",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
-      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30534,15 +24934,11 @@
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/to-buffer": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/to-buffer/-/to-buffer-1.2.2.tgz",
-      "integrity": "sha512-db0E3UJjcFhpDhAF4tLo03oli3pwl3dbnzXOUIlRKrp+ldk/VUxzpWYZENsw2SZiuBjHAk7DfB0VU7NKdpb6sw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30556,15 +24952,11 @@
     },
     "node_modules/to-buffer/node_modules/isarray": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "license": "MIT",
       "dependencies": {
         "is-number": "^7.0.0"
@@ -30575,8 +24967,6 @@
     },
     "node_modules/toad-cache": {
       "version": "3.7.1",
-      "resolved": "https://registry.npmjs.org/toad-cache/-/toad-cache-3.7.1.tgz",
-      "integrity": "sha512-5DXWzE4Vz7xNHsv+xQ+MGfJYyC78Aok3tEr0MNwHoRf7vZnga1mQXZ4/Nsodld4VR6Wd+VhfmqnNrsRJyYPfrQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30585,8 +24975,6 @@
     },
     "node_modules/toidentifier": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30595,8 +24983,6 @@
     },
     "node_modules/topojson-client": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/topojson-client/-/topojson-client-3.1.0.tgz",
-      "integrity": "sha512-605uxS6bcYxGXw9qi62XyrV6Q3xwbndjachmNxu8HWTtVPxZfEJN9fd/SZS1Q54Sn2y0TMyMxFj/cJINqGHrKw==",
       "license": "ISC",
       "dependencies": {
         "commander": "2"
@@ -30609,14 +24995,10 @@
     },
     "node_modules/topojson-client/node_modules/commander": {
       "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
       "license": "MIT"
     },
     "node_modules/tough-cookie": {
       "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz",
-      "integrity": "sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -30631,8 +25013,6 @@
     },
     "node_modules/tough-cookie/node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30641,8 +25021,6 @@
     },
     "node_modules/tough-cookie/node_modules/universalify": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz",
-      "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30651,8 +25029,6 @@
     },
     "node_modules/tr46": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-3.0.0.tgz",
-      "integrity": "sha512-l7FvfAHlcmulp8kr+flpQZmVwtu7nfRV7NZujtN0OqES8EL4O4e0qqzL0DC5gAvx/ZC/9lk6rhcUwYvkBnBnYA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30664,8 +25040,6 @@
     },
     "node_modules/tr46/node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30674,18 +25048,11 @@
     },
     "node_modules/traverse": {
       "version": "0.3.9",
-      "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.3.9.tgz",
-      "integrity": "sha512-iawgk0hLP3SxGKDfnDJf8wTz4p2qImnyihM5Hh/sGvQ3K37dPi/w8sRhdNIxYA1TwFwc5mDhIJq+O0RsvXBKdQ==",
       "dev": true,
-      "license": "MIT/X11",
-      "engines": {
-        "node": "*"
-      }
+      "license": "MIT/X11"
     },
     "node_modules/tree-dump": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/tree-dump/-/tree-dump-1.1.0.tgz",
-      "integrity": "sha512-rMuvhU4MCDbcbnleZTFezWsaZXRFemSqAM+7jPnzUl1fo9w3YEKOxAeui0fz3OI4EU4hf23iyA7uQRVko+UaBA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -30701,8 +25068,6 @@
     },
     "node_modules/tree-kill": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/tree-kill/-/tree-kill-1.2.2.tgz",
-      "integrity": "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -30711,8 +25076,6 @@
     },
     "node_modules/ts-api-utils": {
       "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-1.4.3.tgz",
-      "integrity": "sha512-i3eMG77UTMD0hZhgRS562pv83RC6ukSAC2GMNWc+9dieh/+jDM5u5YG+NHX6VNDRHQcHwmsTHctP9LhbC3WxVw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30724,8 +25087,6 @@
     },
     "node_modules/ts-jest": {
       "version": "29.4.9",
-      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-29.4.9.tgz",
-      "integrity": "sha512-LTb9496gYPMCqjeDLdPrKuXtncudeV1yRZnF4Wo5l3SFi0RYEnYRNgMrFIdg+FHvfzjCyQk1cLncWVqiSX+EvQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30777,15 +25138,11 @@
     },
     "node_modules/ts-jest/node_modules/lodash.memoize": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
-      "integrity": "sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/ts-jest/node_modules/semver": {
       "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -30797,8 +25154,6 @@
     },
     "node_modules/ts-jest/node_modules/type-fest": {
       "version": "4.41.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
-      "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "engines": {
@@ -30810,8 +25165,6 @@
     },
     "node_modules/ts-morph": {
       "version": "24.0.0",
-      "resolved": "https://registry.npmjs.org/ts-morph/-/ts-morph-24.0.0.tgz",
-      "integrity": "sha512-2OAOg/Ob5yx9Et7ZX4CvTCc0UFoZHwLEJ+dpDPSUi5TgwwlTlX47w+iFRrEwzUZwYACjq83cgjS/Da50Ga37uw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30821,8 +25174,6 @@
     },
     "node_modules/ts-node": {
       "version": "10.9.2",
-      "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
-      "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30865,8 +25216,6 @@
     },
     "node_modules/ts-node/node_modules/acorn-walk": {
       "version": "8.3.5",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz",
-      "integrity": "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30878,15 +25227,11 @@
     },
     "node_modules/ts-node/node_modules/arg": {
       "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
-      "integrity": "sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/ts-node/node_modules/diff": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
-      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -30895,21 +25240,15 @@
     },
     "node_modules/tslib": {
       "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz",
-      "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==",
       "license": "0BSD"
     },
     "node_modules/tty-browserify": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/tty-browserify/-/tty-browserify-0.0.1.tgz",
-      "integrity": "sha512-C3TaO7K81YvjCgQH9Q1S3R3P3BtN3RIM8n+OvX4il1K1zgE8ZhI0op7kClgkxtutIE8hQrcrHBXvIheqKUUCxw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tuf-js": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/tuf-js/-/tuf-js-3.1.0.tgz",
-      "integrity": "sha512-3T3T04WzowbwV2FDiGXBbr81t64g1MUGGJRgT4x5o97N+8ArdhVCAF9IxFrxuSJmM3E5Asn7nKHkao0ibcZXAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30923,8 +25262,6 @@
     },
     "node_modules/tuf-js/node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30941,15 +25278,11 @@
     },
     "node_modules/tuf-js/node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tunnel-agent": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -30961,22 +25294,16 @@
     },
     "node_modules/tweetnacl": {
       "version": "0.14.5",
-      "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-0.14.5.tgz",
-      "integrity": "sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==",
       "dev": true,
       "license": "Unlicense"
     },
     "node_modules/type": {
       "version": "2.7.3",
-      "resolved": "https://registry.npmjs.org/type/-/type-2.7.3.tgz",
-      "integrity": "sha512-8j+1QmAbPvLZow5Qpi6NCaN8FB60p/6x8/vfNqOk/hC+HuvFZhL4+WfekuhQLiqFZXOgQdrs3B+XxEmCc6b3FQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/type-check": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -30988,8 +25315,6 @@
     },
     "node_modules/type-detect": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.1.0.tgz",
-      "integrity": "sha512-Acylog8/luQ8L7il+geoSxhEkazvkslg7PSNKOX59mbB9cOveP5aq9h74Y7YU8yDpJwetzQQrfIwtf4Wp4LKcw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -30998,8 +25323,6 @@
     },
     "node_modules/type-fest": {
       "version": "0.20.2",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
-      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "engines": {
@@ -31011,8 +25334,6 @@
     },
     "node_modules/type-is": {
       "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
-      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31025,8 +25346,6 @@
     },
     "node_modules/typed-array-buffer": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.3.tgz",
-      "integrity": "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31040,8 +25359,6 @@
     },
     "node_modules/typed-array-byte-length": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/typed-array-byte-length/-/typed-array-byte-length-1.0.3.tgz",
-      "integrity": "sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31060,8 +25377,6 @@
     },
     "node_modules/typed-array-byte-offset": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/typed-array-byte-offset/-/typed-array-byte-offset-1.0.4.tgz",
-      "integrity": "sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31082,8 +25397,6 @@
     },
     "node_modules/typed-array-length": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.7.tgz",
-      "integrity": "sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31103,22 +25416,16 @@
     },
     "node_modules/typed-assert": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/typed-assert/-/typed-assert-1.0.9.tgz",
-      "integrity": "sha512-KNNZtayBCtmnNmbo5mG47p1XsCyrx6iVqomjcZnec/1Y5GGARaxPs6r49RnSPeUP3YjNYiU9sQHAtY4BBvnZwg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/typedarray": {
       "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz",
-      "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/typescript": {
       "version": "5.8.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz",
-      "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -31129,10 +25436,326 @@
         "node": ">=14.17"
       }
     },
+    "node_modules/typescript-eslint": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.63.0.tgz",
+      "integrity": "sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "8.63.0",
+        "@typescript-eslint/parser": "8.63.0",
+        "@typescript-eslint/typescript-estree": "8.63.0",
+        "@typescript-eslint/utils": "8.63.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.63.0.tgz",
+      "integrity": "sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.63.0",
+        "@typescript-eslint/type-utils": "8.63.0",
+        "@typescript-eslint/utils": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0",
+        "ignore": "^7.0.5",
+        "natural-compare": "^1.4.0",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^8.63.0",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/parser": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.63.0.tgz",
+      "integrity": "sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "8.63.0",
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/typescript-estree": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz",
+      "integrity": "sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/type-utils": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.63.0.tgz",
+      "integrity": "sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/typescript-estree": "8.63.0",
+        "@typescript-eslint/utils": "8.63.0",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/types": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz",
+      "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz",
+      "integrity": "sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/project-service": "8.63.0",
+        "@typescript-eslint/tsconfig-utils": "8.63.0",
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/utils": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.63.0.tgz",
+      "integrity": "sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.63.0",
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/typescript-estree": "8.63.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz",
+      "integrity": "sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.63.0",
+        "eslint-visitor-keys": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/brace-expansion": {
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.5"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/typescript-eslint/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/typescript-eslint/node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
     "node_modules/uglify-js": {
       "version": "3.19.3",
-      "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.19.3.tgz",
-      "integrity": "sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "optional": true,
@@ -31145,8 +25768,6 @@
     },
     "node_modules/umd": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/umd/-/umd-3.0.3.tgz",
-      "integrity": "sha512-4IcGSufhFshvLNcMCV80UnQVlZ5pMOC8mvNPForqwA4+lzYQuetTESLDQkeLmihq8bRcnpbQa48Wb8Lh16/xow==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -31155,8 +25776,6 @@
     },
     "node_modules/unbox-primitive": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz",
-      "integrity": "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31174,8 +25793,6 @@
     },
     "node_modules/undeclared-identifiers": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/undeclared-identifiers/-/undeclared-identifiers-1.1.3.tgz",
-      "integrity": "sha512-pJOW4nxjlmfwKApE4zvxLScM/njmwj/DiUBv7EabwE4O8kRUy+HIwxQtZLBPll/jx1LJyBcqNfB3/cpv9EZwOw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -31191,15 +25808,11 @@
     },
     "node_modules/undici-types": {
       "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/unicode-canonical-property-names-ecmascript": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.1.tgz",
-      "integrity": "sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31208,8 +25821,6 @@
     },
     "node_modules/unicode-match-property-ecmascript": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
-      "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31222,8 +25833,6 @@
     },
     "node_modules/unicode-match-property-value-ecmascript": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.2.1.tgz",
-      "integrity": "sha512-JQ84qTuMg4nVkx8ga4A16a1epI9H6uTXAknqxkGF/aFfRLw1xC/Bp24HNLaZhHSkWd3+84t8iXnp1J0kYcZHhg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31232,8 +25841,6 @@
     },
     "node_modules/unicode-property-aliases-ecmascript": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.2.0.tgz",
-      "integrity": "sha512-hpbDzxUY9BFwX+UeBnxv3Sh1q7HFxj48DTmXchNgRa46lO8uj3/1iEn3MiNUYTg1g9ctIqXCCERn8gYZhHC5lQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31242,8 +25849,6 @@
     },
     "node_modules/unicorn-magic": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.3.0.tgz",
-      "integrity": "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31255,8 +25860,6 @@
     },
     "node_modules/unique-filename": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
-      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -31268,8 +25871,6 @@
     },
     "node_modules/unique-slug": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
-      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -31281,8 +25882,6 @@
     },
     "node_modules/universalify": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31291,15 +25890,11 @@
     },
     "node_modules/unix-crypt-td-js": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/unix-crypt-td-js/-/unix-crypt-td-js-1.1.4.tgz",
-      "integrity": "sha512-8rMeVYWSIyccIJscb9NdCfZKSRBKYTeVnwmiRYT2ulE3qd1RaDQ0xQDP+rI3ccIWbhu/zuo5cgN8z73belNZgw==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/unpipe": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31308,8 +25903,6 @@
     },
     "node_modules/untildify": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/untildify/-/untildify-4.0.0.tgz",
-      "integrity": "sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31318,8 +25911,6 @@
     },
     "node_modules/update-browserslist-db": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
       "funding": [
         {
           "type": "opencollective",
@@ -31348,15 +25939,11 @@
     },
     "node_modules/upper-case": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/upper-case/-/upper-case-1.1.3.tgz",
-      "integrity": "sha512-WRbjgmYzgXkCV7zNVpy5YgrHgbBv126rMALQQMrmzOVC4GM2waQ9x7xtm8VU+1yF2kWyPzI9zbZ48n4vSxwfSA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/uri-js": {
       "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -31365,8 +25952,6 @@
     },
     "node_modules/uri-js/node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31375,8 +25960,6 @@
     },
     "node_modules/url": {
       "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/url/-/url-0.11.4.tgz",
-      "integrity": "sha512-oCwdVC7mTuWiPyjLUz/COz5TLk6wgp0RCsN+wHZ2Ekneac9w8uuV0njcbbie2ME+Vs+d6duwmYuR3HgQXs1fOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31389,8 +25972,6 @@
     },
     "node_modules/url-parse": {
       "version": "1.5.10",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
-      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31400,8 +25981,6 @@
     },
     "node_modules/url/node_modules/qs": {
       "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -31416,8 +25995,6 @@
     },
     "node_modules/util": {
       "version": "0.10.4",
-      "resolved": "https://registry.npmjs.org/util/-/util-0.10.4.tgz",
-      "integrity": "sha512-0Pm9hTQ3se5ll1XihRic3FDIku70C+iHUdT/W926rSgHV5QgXsYbKZN8MSC3tJtSkhuROzvsQjAaFENRXr+19A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31426,28 +26003,20 @@
     },
     "node_modules/util-arity": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/util-arity/-/util-arity-1.1.0.tgz",
-      "integrity": "sha512-kkyIsXKwemfSy8ZEoaIz06ApApnWsk5hQO0vLjZS6UkBiGiW++Jsyb8vSBoc0WKlffGoGs5yYy/j5pp8zckrFA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
     "node_modules/util/node_modules/inherits": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-      "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/utils-merge": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31456,9 +26025,6 @@
     },
     "node_modules/uuid": {
       "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -31467,15 +26033,11 @@
     },
     "node_modules/v8-compile-cache-lib": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz",
-      "integrity": "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/v8-to-istanbul": {
       "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz",
-      "integrity": "sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -31489,15 +26051,11 @@
     },
     "node_modules/v8-to-istanbul/node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/validate-npm-package-license": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -31507,8 +26065,6 @@
     },
     "node_modules/validate-npm-package-name": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-6.0.2.tgz",
-      "integrity": "sha512-IUoow1YUtvoBBC06dXs8bR8B9vuA3aJfmQNKMoaPG/OFsPmoQvw8xh+6Ye25Gx9DQhoEom3Pcu9MKHerm/NpUQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -31517,8 +26073,6 @@
     },
     "node_modules/validator": {
       "version": "13.15.23",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.23.tgz",
-      "integrity": "sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31527,8 +26081,6 @@
     },
     "node_modules/vary": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -31537,8 +26089,6 @@
     },
     "node_modules/verror": {
       "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
-      "integrity": "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31552,16 +26102,11 @@
     },
     "node_modules/verror/node_modules/core-util-is": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/vis": {
       "version": "4.21.0",
-      "resolved": "https://registry.npmjs.org/vis/-/vis-4.21.0.tgz",
-      "integrity": "sha512-jonDXTGm2mFU/X6Kg9pvkZEQtXh2J6+NlDJD1tDP7TDCFy+qNeKlsTcXKQtv4nAtUIiKo6sphCt4kbRlEKw75A==",
-      "deprecated": "Please consider using https://github.com/visjs",
       "dev": true,
       "license": "(Apache-2.0 OR MIT)",
       "dependencies": {
@@ -31574,8 +26119,6 @@
     },
     "node_modules/vite": {
       "version": "6.4.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
-      "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -31647,282 +26190,8 @@
         }
       }
     },
-    "node_modules/vite/node_modules/@esbuild/aix-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/android-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/android-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/android-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/darwin-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-loong64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/linux-s390x": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/vite/node_modules/@esbuild/linux-x64": {
       "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
       "cpu": [
         "x64"
       ],
@@ -31936,163 +26205,8 @@
         "node": ">=18"
       }
     },
-    "node_modules/vite/node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/sunos-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/win32-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/win32-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vite/node_modules/@esbuild/win32-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/vite/node_modules/esbuild": {
       "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -32133,15 +26247,11 @@
     },
     "node_modules/vm-browserify": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vm-browserify/-/vm-browserify-1.1.2.tgz",
-      "integrity": "sha512-2ham8XPWTONajOR0ohOKOHXkm3+gaBmGut3SRuu75xLd/RRaY6vqgh8NBYYk7+RW3u5AtzPQZG8F10LHkl0lAQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/w3c-xmlserializer": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-4.0.0.tgz",
-      "integrity": "sha512-d+BFHzbiCx6zGfz0HyQ6Rg69w9k19nviJspaj4yNscGjrHu94sVP+aRm75yEbCh+r2/yR+7q6hux9LVtbuTGBw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32153,8 +26263,6 @@
     },
     "node_modules/wait-on": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/wait-on/-/wait-on-7.2.0.tgz",
-      "integrity": "sha512-wCQcHkRazgjG5XoAq9jbTMLpNIjoSlZslrJ2+N9MxDsGEv1HnFoVjOCexL0ESva7Y9cu350j+DWADdk54s4AFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32173,8 +26281,6 @@
     },
     "node_modules/wait-on/node_modules/rxjs": {
       "version": "7.8.2",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
-      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -32183,8 +26289,6 @@
     },
     "node_modules/walker": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -32193,8 +26297,6 @@
     },
     "node_modules/watchify": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/watchify/-/watchify-4.0.0.tgz",
-      "integrity": "sha512-2Z04dxwoOeNxa11qzWumBTgSAohTC0+ScuY7XMenPnH+W2lhTcpEOJP4g2EIG/SWeLadPk47x++Yh+8BqPM/lA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32215,8 +26317,6 @@
     },
     "node_modules/watchify/node_modules/brace-expansion": {
       "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32226,8 +26326,6 @@
     },
     "node_modules/watchify/node_modules/browserify": {
       "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/browserify/-/browserify-17.0.1.tgz",
-      "integrity": "sha512-pxhT00W3ylMhCHwG5yfqtZjNnFuX5h2IJdaBfSo4ChaaBsIp9VLrEMQ1bHV+Xr1uLPXuNDDM1GlJkjli0qkRsw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32289,8 +26387,6 @@
     },
     "node_modules/watchify/node_modules/browserify/node_modules/through2": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.5.tgz",
-      "integrity": "sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32300,8 +26396,6 @@
     },
     "node_modules/watchify/node_modules/chokidar": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
-      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32325,8 +26419,6 @@
     },
     "node_modules/watchify/node_modules/events": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32335,9 +26427,6 @@
     },
     "node_modules/watchify/node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -32357,8 +26446,6 @@
     },
     "node_modules/watchify/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -32370,8 +26457,6 @@
     },
     "node_modules/watchify/node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -32383,15 +26468,11 @@
     },
     "node_modules/watchify/node_modules/path-browserify": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-1.0.1.tgz",
-      "integrity": "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/watchify/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32403,8 +26484,6 @@
     },
     "node_modules/watchify/node_modules/readdirp": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32416,8 +26495,6 @@
     },
     "node_modules/watchify/node_modules/through2": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/through2/-/through2-4.0.2.tgz",
-      "integrity": "sha512-iOqSav00cVxEEICeD7TjLB1sueEL+81Wpzp2bY17uZjZN0pWZPuo4suZ/61VujxmqSGFfgOcNuTZ85QJwNZQpw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32426,8 +26503,6 @@
     },
     "node_modules/watchify/node_modules/through2/node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32441,8 +26516,6 @@
     },
     "node_modules/watchify/node_modules/timers-browserify": {
       "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/timers-browserify/-/timers-browserify-1.4.2.tgz",
-      "integrity": "sha512-PIxwAupJZiYU4JmVZYwXp9FKsHMXb5h0ZEFyuXTAn8WLHOlcij+FEcbrvDsom1o5dr1YggEtFbECvGCW2sT53Q==",
       "dev": true,
       "dependencies": {
         "process": "~0.11.0"
@@ -32453,8 +26526,6 @@
     },
     "node_modules/watchify/node_modules/util": {
       "version": "0.12.5",
-      "resolved": "https://registry.npmjs.org/util/-/util-0.12.5.tgz",
-      "integrity": "sha512-kZf/K6hEIrWHI6XqOFUiiMa+79wE/D8Q+NCNAWclkyg3b4d2k7s0QGepNjiABc+aR3N1PAyHL7p6UcLY6LmrnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32467,8 +26538,6 @@
     },
     "node_modules/watchpack": {
       "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.2.tgz",
-      "integrity": "sha512-TnbFSbcOCcDgjZ4piURLCbJ3nJhznVh9kw6F6iokjiFPl8ONxe9A6nMDVXDiNbrSfLILs6vB07F7wLBrwPYzJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32481,8 +26550,6 @@
     },
     "node_modules/wbuf": {
       "version": "1.7.3",
-      "resolved": "https://registry.npmjs.org/wbuf/-/wbuf-1.7.3.tgz",
-      "integrity": "sha512-O84QOnr0icsbFGLS0O3bI5FswxzRr8/gHwWkDlQFskhSPryQXvrTMxjxGP4+iWYoauLoBvfDpkrOauZ+0iZpDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32491,8 +26558,6 @@
     },
     "node_modules/wcwidth": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
-      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32501,16 +26566,12 @@
     },
     "node_modules/weak-lru-cache": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/weak-lru-cache/-/weak-lru-cache-1.2.2.tgz",
-      "integrity": "sha512-DEAoo25RfSYMuTGc9vPJzZcZullwIqRDSI9LOy+fkCJPi6hykCnfKaXTuPBDuXAUcqHXyOgFtHNp/kB2FjYHbw==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/web-streams-polyfill": {
       "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
-      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32519,8 +26580,6 @@
     },
     "node_modules/webdriver": {
       "version": "7.31.1",
-      "resolved": "https://registry.npmjs.org/webdriver/-/webdriver-7.31.1.tgz",
-      "integrity": "sha512-nCdJLxRnYvOMFqTEX7sqQtF/hV/Jgov0Y6ICeOm1DMTlZSRRDaUsBMlEAPkEwif9uBJYdM0znv8qzfX358AGqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32540,8 +26599,6 @@
     },
     "node_modules/webdriver/node_modules/@types/node": {
       "version": "18.19.130",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz",
-      "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32550,15 +26607,11 @@
     },
     "node_modules/webdriver/node_modules/undici-types": {
       "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/webidl-conversions": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
-      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -32567,8 +26620,6 @@
     },
     "node_modules/webpack": {
       "version": "5.105.0",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.0.tgz",
-      "integrity": "sha512-gX/dMkRQc7QOMzgTe6KsYFM7DxeIONQSui1s0n/0xht36HvrgbxtM1xBlgx596NbpHuQU8P7QpKwrZYwUX48nw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32616,8 +26667,6 @@
     },
     "node_modules/webpack-dev-middleware": {
       "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.2.tgz",
-      "integrity": "sha512-xOO8n6eggxnwYpy1NlzUKpvrjfJTvae5/D6WOK0S2LSo7vjmo5gCM1DbLUmFqrMTJP+W/0YZNctm7jasWvLuBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32646,8 +26695,6 @@
     },
     "node_modules/webpack-dev-middleware/node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32659,8 +26706,6 @@
     },
     "node_modules/webpack-dev-server": {
       "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.2.tgz",
-      "integrity": "sha512-QcQ72gh8a+7JO63TAx/6XZf/CWhgMzu5m0QirvPfGvptOusAxG12w2+aua1Jkjr7hzaWDnJ2n6JFeexMHI+Zjg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32717,15 +26762,11 @@
     },
     "node_modules/webpack-dev-server/node_modules/@types/retry": {
       "version": "0.12.2",
-      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.2.tgz",
-      "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/webpack-dev-server/node_modules/@types/ws": {
       "version": "8.18.1",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
-      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32734,8 +26775,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/chokidar": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
-      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32759,8 +26798,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -32772,8 +26809,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/http-proxy-middleware": {
       "version": "2.0.10",
-      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.10.tgz",
-      "integrity": "sha512-RKzRWNPxUZqbuk3BC5mGVJbBnWgr+diEnjJexIOytFbBzDy88Fbh/YvBr3DsNrl1jYAfjWfpATEv0NO35FDuPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32797,8 +26832,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/ipaddr.js": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.4.0.tgz",
-      "integrity": "sha512-9VGk3HGanVE6JoZXHiCpnGy5X0jYDnN4EA4lntFPj+1vIWlFhIylq2CrrCOJH9EAhc5CYhq18F2Av2tgoAPsYQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32807,8 +26840,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/p-retry": {
       "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-6.2.1.tgz",
-      "integrity": "sha512-hEt02O4hUct5wtwg4H4KcWgDdm+l1bOaEy/hWzd8xtXB9BqxTWBBhb+2ImAtH4Cv4rPjV76xN3Zumqk3k3AhhQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32825,8 +26856,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32838,8 +26867,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/readdirp": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32851,8 +26878,6 @@
     },
     "node_modules/webpack-dev-server/node_modules/ws": {
       "version": "8.21.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
-      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32873,8 +26898,6 @@
     },
     "node_modules/webpack-merge": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/webpack-merge/-/webpack-merge-6.0.1.tgz",
-      "integrity": "sha512-hXXvrjtx2PLYx4qruKl+kyRSLc52V+cCvMxRjmKwoA+CBbbF5GfIBtR6kCvl0fYGqTUPKB+1ktVmTHqMOzgCBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32888,8 +26911,6 @@
     },
     "node_modules/webpack-sources": {
       "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.4.1.tgz",
-      "integrity": "sha512-eACpxRN02yaawnt+uUNIF7Qje6A9zArxBbcAJjK1PK3S9Ycg5jIuJ8pW4q8EMnwNZCEGltcjkRx1QzOxOkKD8A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32898,8 +26919,6 @@
     },
     "node_modules/webpack-subresource-integrity": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/webpack-subresource-integrity/-/webpack-subresource-integrity-5.1.0.tgz",
-      "integrity": "sha512-sacXoX+xd8r4WKsy9MvH/q/vBtEHr86cpImXwyg74pFIpERKt6FmB8cXpeuh0ZLgclOlHI4Wcll7+R5L02xk9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32920,8 +26939,6 @@
     },
     "node_modules/webpack/node_modules/eslint-scope": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -32934,8 +26951,6 @@
     },
     "node_modules/webpack/node_modules/estraverse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -32944,8 +26959,6 @@
     },
     "node_modules/webpack/node_modules/events": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -32954,15 +26967,11 @@
     },
     "node_modules/webpack/node_modules/json-parse-even-better-errors": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/webpack/node_modules/watchpack": {
       "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.2.tgz",
-      "integrity": "sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -32974,8 +26983,6 @@
     },
     "node_modules/websocket-driver": {
       "version": "0.7.4",
-      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz",
-      "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -32989,8 +26996,6 @@
     },
     "node_modules/websocket-extensions": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.4.tgz",
-      "integrity": "sha512-OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -32999,9 +27004,6 @@
     },
     "node_modules/whatwg-encoding": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-2.0.0.tgz",
-      "integrity": "sha512-p41ogyeMUrw3jWclHWTQg1k05DSVXPLcVxRTYsXUk+ZooOCZLcoYgPZ/HL/D/N+uQPOtcp1me1WhBEaX02mhWg==",
-      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33013,8 +27015,6 @@
     },
     "node_modules/whatwg-encoding/node_modules/iconv-lite": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33026,8 +27026,6 @@
     },
     "node_modules/whatwg-mimetype": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-3.0.0.tgz",
-      "integrity": "sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33036,8 +27034,6 @@
     },
     "node_modules/whatwg-url": {
       "version": "11.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-11.0.0.tgz",
-      "integrity": "sha512-RKT8HExMpoYx4igMiVMY83lN6UeITKJlBQ+vR/8ZJ8OCdSiN3RwCq+9gH0+Xzj0+5IrM6i4j/6LuvzbZIQgEcQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33050,8 +27046,6 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -33066,8 +27060,6 @@
     },
     "node_modules/which-boxed-primitive": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.1.1.tgz",
-      "integrity": "sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33086,8 +27078,6 @@
     },
     "node_modules/which-builtin-type": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/which-builtin-type/-/which-builtin-type-1.2.1.tgz",
-      "integrity": "sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33114,15 +27104,11 @@
     },
     "node_modules/which-builtin-type/node_modules/isarray": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/which-collection": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.2.tgz",
-      "integrity": "sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33140,8 +27126,6 @@
     },
     "node_modules/which-typed-array": {
       "version": "1.1.20",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.20.tgz",
-      "integrity": "sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33162,8 +27146,6 @@
     },
     "node_modules/widest-line": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/widest-line/-/widest-line-3.1.0.tgz",
-      "integrity": "sha512-NsmoXalsWVDMGupxZ5R08ka9flZjjiLvHVAWYOKtiKM8ujtZWr9cRffak+uSE48+Ob8ObalXpwyeUiyDD6QFgg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33175,15 +27157,11 @@
     },
     "node_modules/wildcard": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/wildcard/-/wildcard-2.0.1.tgz",
-      "integrity": "sha512-CC1bOL87PIWSBhDcTrdeLo6eGT7mCFtrg0uIJtqJUFyK+eJnzl8A1niH56uu7KMa5XFrtiV+AQuHO3n7DsHnLQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/windows-release": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/windows-release/-/windows-release-4.0.0.tgz",
-      "integrity": "sha512-OxmV4wzDKB1x7AZaZgXMVsdJ1qER1ed83ZrTYd5Bwq2HfJVg3DJS8nqlAG4sMoJ7mu8cuRmLEYyU13BKwctRAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33198,8 +27176,6 @@
     },
     "node_modules/word-wrap": {
       "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33208,15 +27184,11 @@
     },
     "node_modules/wordwrap": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz",
-      "integrity": "sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/wrap-ansi": {
       "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33231,8 +27203,6 @@
     "node_modules/wrap-ansi-cjs": {
       "name": "wrap-ansi",
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33249,15 +27219,11 @@
     },
     "node_modules/wrappy": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/write-file-atomic": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-4.0.2.tgz",
-      "integrity": "sha512-7KxauUdBmSdWnmpaGFg+ppNjKF8uNLry8LyzjauQDOVONfFLNKrKvQOxZ/VuTIcS/gge/YNahf5RIIQWTSarlg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -33270,15 +27236,11 @@
     },
     "node_modules/write-file-atomic/node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/ws": {
       "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.17.1.tgz",
-      "integrity": "sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33299,15 +27261,11 @@
     },
     "node_modules/xml": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/xml/-/xml-1.0.1.tgz",
-      "integrity": "sha512-huCv9IH9Tcf95zuYCsQraZtWnJvBtLVE0QHMOs8bWyZAFZNDcYjsPq1nEx8jKA9y+Beo9v+7OBPRisQTjinQMw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/xml-js": {
       "version": "1.6.11",
-      "resolved": "https://registry.npmjs.org/xml-js/-/xml-js-1.6.11.tgz",
-      "integrity": "sha512-7rVi2KMfwfWFl+GpPg6m80IVMWXLRjO+PxTq7V2CDhoGak0wzYzFgUY2m4XJ47OGdXd8eLE8EmwfAmdjw7lC1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33319,8 +27277,6 @@
     },
     "node_modules/xml-name-validator": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-4.0.0.tgz",
-      "integrity": "sha512-ICP2e+jsHvAj2E2lIHxa5tjXRlKDJo4IdvPvCXbXQGdzSfmSpNVyIKMvoZHjDY9DP0zV17iI85o90vRFXNccRw==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -33329,8 +27285,6 @@
     },
     "node_modules/xml2js": {
       "version": "0.6.2",
-      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
-      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
       "license": "MIT",
       "dependencies": {
         "sax": ">=0.6.0",
@@ -33342,8 +27296,6 @@
     },
     "node_modules/xmlbuilder": {
       "version": "11.0.1",
-      "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
-      "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
       "license": "MIT",
       "engines": {
         "node": ">=4.0"
@@ -33351,15 +27303,11 @@
     },
     "node_modules/xmlchars": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/xtend": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33368,8 +27316,6 @@
     },
     "node_modules/y18n": {
       "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
       "license": "ISC",
       "engines": {
         "node": ">=10"
@@ -33377,14 +27323,10 @@
     },
     "node_modules/yallist": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
       "license": "ISC"
     },
     "node_modules/yargs": {
       "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
       "license": "MIT",
       "dependencies": {
         "cliui": "^8.0.1",
@@ -33401,8 +27343,6 @@
     },
     "node_modules/yargs-parser": {
       "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -33410,8 +27350,6 @@
     },
     "node_modules/yauzl": {
       "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -33421,8 +27359,6 @@
     },
     "node_modules/yn": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
-      "integrity": "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33431,8 +27367,6 @@
     },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33444,8 +27378,6 @@
     },
     "node_modules/yoctocolors-cjs": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/yoctocolors-cjs/-/yoctocolors-cjs-2.1.3.tgz",
-      "integrity": "sha512-U/PBtDf35ff0D8X8D0jfdzHYEPFxAI7jJlxZXwCSez5M3190m+QobIfh+sWDWSHMCWWJN2AWamkegn6vr6YBTw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -33457,8 +27389,6 @@
     },
     "node_modules/zone.js": {
       "version": "0.15.1",
-      "resolved": "https://registry.npmjs.org/zone.js/-/zone.js-0.15.1.tgz",
-      "integrity": "sha512-XE96n56IQpJM7NAoXswY3XRLcWFW83xe0BiAOeMD7K5k5xecOeul3Qcpx6GqEeeHNkW5DWL5zOyTbEfB4eti8w==",
       "license": "MIT"
     }
   }
diff --git a/src/pybind/mgr/dashboard/frontend/package.json b/src/pybind/mgr/dashboard/frontend/package.json
index 0d17c20e365..e51ce26cabe 100644
--- a/src/pybind/mgr/dashboard/frontend/package.json
+++ b/src/pybind/mgr/dashboard/frontend/package.json
@@ -27,7 +27,7 @@
     "lint:eslint": "ng lint",
     "lint:gherkin": "gherkin-lint -c .gherkin-lintrc cypress/e2e",
     "lint:prettier": "prettier --list-different \"{src,cypress}/**/*.{ts,scss,html}\"",
-    "lint:html": "prettier --check \"src/**/*.html\"",
+    "lint:html": "eslint \"src/**/*.html\" && prettier --check \"src/**/*.html\"",
     "lint:tsc": "tsc -p tsconfig.app.json --noEmit && tsc -p tsconfig.spec.json --noEmit && tsc -p cypress/tsconfig.json --noEmit",
     "lint:scss": "stylelint '**/*.scss'",
     "lint": "run-p -csl --aggregate-output lint:*",
@@ -88,11 +88,8 @@
     "@angular-devkit/build-angular": "19.2.27",
     "@angular-devkit/core": "19.2.27",
     "@angular-devkit/schematics": "19.2.27",
-    "@angular-eslint/builder": "18.4.0",
-    "@angular-eslint/eslint-plugin": "18.4.0",
-    "@angular-eslint/eslint-plugin-template": "18.4.0",
-    "@angular-eslint/schematics": "18.4.0",
-    "@angular-eslint/template-parser": "18.4.0",
+    "@angular-eslint/builder": "19.8.1",
+    "@angular-eslint/schematics": "19.8.1",
     "@angular/cli": "19.2.27",
     "@angular/compiler-cli": "19.2.25",
     "@angular/language-service": "19.2.25",
@@ -110,8 +107,7 @@
     "@types/node": "22.19.3",
     "@types/validator": "13.15.10",
     "@types/xml2js": "0.4.14",
-    "@typescript-eslint/eslint-plugin": "8.14.0",
-    "@typescript-eslint/parser": "8.14.0",
+    "angular-eslint": "19.8.1",
     "axe-core": "4.4.3",
     "cypress": "12.17.4",
     "cypress-axe": "1.5.0",
@@ -132,7 +128,7 @@
     "ng-mocks": "14.13.1",
     "npm-run-all": "4.1.5",
     "postcss-scss": "4.0.9",
-    "prettier": "2.1.2",
+    "prettier": "3.9.4",
     "pretty-quick": "3.0.2",
     "start-server-and-test": "2.0.3",
     "stylelint": "16.20.0",
@@ -141,6 +137,7 @@
     "table": "6.8.0",
     "ts-node": "10.9.2",
     "typescript": "5.8.3",
+    "typescript-eslint": "8.63.0",
     "validator": "13.15.23"
   },
   "cypress-cucumber-preprocessor": {

From ac187a8220de5c12465edda7d9028c2bb8ba7c69 Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Thu, 9 Jul 2026 13:22:58 +0530
Subject: [PATCH 592/596] mgr/dashboard: fix html lint errors according to new
 rules

mostly accessibility issues like

 - A label component must be associated with a form element
   Fixed by adding `for` to labels and sometimes replacing label with
legend

 - Elements with interaction handlers must be focusable
 - click must be accompanied by either keyup, keydown or keypress event for accessibility
 - <button> should have content

Fixes: https://tracker.ceph.com/issues/77112
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../iscsi-target-form.component.html          |  6 ++-
 ...target-image-settings-modal.component.html |  1 +
 ...ay-group-delete-guard-modal.component.html |  4 +-
 .../nvmeof-group-form.component.html          |  5 ++-
 .../nvmeof-namespaces-form.component.html     |  1 +
 .../nvmeof-subsystem-overview.component.html  |  4 ++
 .../nvmeof-subsystem-step-2.component.html    |  2 +
 .../rbd-configuration-form.component.html     |  4 +-
 .../cephfs-auth-modal.component.html          |  4 +-
 .../cephfs-directories.component.html         |  2 +
 .../cephfs-mirroring-error.component.html     |  1 +
 .../configuration-form.component.html         |  8 ++--
 .../create-cluster-step-2.component.html      |  1 +
 .../create-cluster.component.html             |  2 +
 .../app/ceph/cluster/logs/logs.component.html |  4 +-
 .../multi-cluster.component.html              |  3 +-
 .../osd-flags-indiv-modal.component.html      |  2 +
 .../osd-flags-modal.component.html            |  1 +
 .../osd-pg-scrub-modal.component.html         |  4 +-
 .../service-form/service-form.component.html  | 24 +++++++-----
 .../upgrade-progress.component.html           |  4 ++
 .../cluster/upgrade/upgrade.component.html    |  8 ++++
 .../overview-alerts-card.component.html       |  1 +
 .../overview-health-card.component.html       |  1 +
 .../overview-storage-card.component.html      |  1 +
 ...ultisite-zone-deletion-form.component.html | 12 +++---
 ...ite-zonegroup-deletion-form.component.html | 12 +++---
 .../rgw-bucket-form.component.html            |  8 +++-
 .../rgw-multisite-wizard.component.html       | 39 ++++++++++---------
 ...gw-multisite-zonegroup-form.component.html |  2 +
 .../rgw-storage-class-details.component.html  |  4 +-
 .../rgw-topic-form.component.html             |  3 ++
 .../login-password-form.component.html        |  6 ++-
 .../src/app/core/error/error.component.html   |  5 +++
 .../login-layout/login-layout.component.html  |  1 -
 .../administration.component.html             |  2 +
 .../identity/identity.component.html          |  2 +
 .../navigation/navigation.component.html      |  4 +-
 .../notification-area.component.html          |  3 +-
 .../notification-header.component.html        |  1 +
 .../alert-panel/alert-panel.component.html    |  1 +
 .../card-row/card-row.component.html          | 12 +++---
 .../copy2clipboard-button.component.html      |  1 +
 .../details-card/details-card.component.html  |  2 +-
 .../download-button.component.html            |  4 +-
 .../components/grafana/grafana.component.html |  2 +
 .../components/helper/helper.component.html   |  4 +-
 .../inline-message.component.html             |  3 +-
 .../notifications-sidebar.component.html      |  3 ++
 .../select-badges.component.html              |  4 +-
 .../components/select/select.component.html   |  8 +++-
 .../side-panel/side-panel.component.html      |  2 +
 .../tearsheet/tearsheet.component.html        |  8 ++++
 .../upgradable/upgradable.component.html      |  4 +-
 .../vertical-navigation.component.html        |  4 ++
 .../table-actions.component.html              |  9 +++--
 .../table-pagination.component.html           |  4 ++
 .../datatable/table/table.component.html      | 10 ++++-
 58 files changed, 207 insertions(+), 80 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
index cbffd558b6c..694eeb3c64c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
@@ -532,7 +532,8 @@
                       i18n>No items added.</span>
 
                 <button (click)="addInitiator(); false"
-                        class="btn btn-light float-end">
+                        class="btn btn-light float-end"
+                        type="button">
                   <svg [cdsIcon]="icons.add"
                        [size]="icons.size16"
                        ></svg>
@@ -668,7 +669,8 @@
                       i18n>No items added.</span>
 
                 <button (click)="addGroup(); false"
-                        class="btn btn-light float-end">
+                        class="btn btn-light float-end"
+                        type="button">
                   <svg [cdsIcon]="icons.add"
                        [size]="icons.size16"
                        ></svg>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html
index 9614ac7505f..f292bf624b1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html
@@ -55,6 +55,7 @@
         <div class="form-group row">
           <div class="col-sm-12">
             <label class="col-form-label"
+                   for="backstore"
                    i18n>Backstore</label>
             <select id="backstore"
                     name="backstore"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
index 433265ed544..4a231f214ff 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
@@ -20,7 +20,9 @@
       @for (sub of connectedSubsystems; track sub.nqn) {
       <div class="cds--mb-04">
         <a class="cds--link cds--type-body-01"
-           (click)="navigateToSubsystem(sub.nqn)">
+           tabindex="0"
+           (click)="navigateToSubsystem(sub.nqn)"
+           (keydown.enter)="navigateToSubsystem(sub.nqn)">
           <span class="cds--mr-03">{{ sub.nqn }}</span>
           <cd-icon type="launch"></cd-icon>
         </a>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 70dfb6453fb..7665b73915e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -79,6 +79,7 @@
               <div cdsCol>
                 <div class="cds--stack cds--stack-horizontal">
                   <label class="cds--type-label-01"
+                         for="enableEncryption"
                          i18n>Enable encryption</label>
                   <cds-tag type="green"
                            size="sm"
@@ -138,7 +139,7 @@
             <div cdsRow class="form-item">
               <div cdsCol>
                 <div class="cds--stack cds--stack-horizontal cds-mb-3">
-                  <label class="cds--type-label-01" i18n>Enable Mutual TLS (mTLS)</label>
+                  <label class="cds--type-label-01" for="enableMtls" i18n>Enable Mutual TLS (mTLS)</label>
                 </div>
                 <cds-checkbox id="enableMtls" formControlName="enableMtls">
                   <span
@@ -164,7 +165,7 @@
             @if (groupForm.controls.enableMtls.value) {
             <div cdsRow class="form-item">
               <div cdsCol>
-                <label class="cds--label fw-bold"
+                <label class="cds--label fw-bold" for="certificateType"
                 i18n>Choose Certificate Authority</label>
                 <cds-radio-group
                   formControlName="certificateType"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html
index 77c6700f724..54308a6c43e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html
@@ -248,6 +248,7 @@
 
           <div class="form-item">
             <label
+              for="rbd_image_name"
               class="cds--type-label-01"
               i18n>Image name (optional)</label>
             <cds-text-label
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
index 922b0d03990..d09dc0804b0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
@@ -33,7 +33,9 @@
               <a cdsLink
                  class="cds-ml-2"
                  (click)="openEditAuthModal()"
+                 (keydown.enter)="openEditAuthModal()"
                  [cdsStack]="'horizontal'"
+                 tabindex="0"
                  [gap]="1">
                 <span i18n>Edit</span>
                 <cd-icon type="edit"></cd-icon>
@@ -69,8 +71,10 @@
               <span>{{ detail.value ? 'Allow all hosts' : 'Restrict to specific hosts' }}</span>
               <a cdsLink
                  (click)="openEditHostAccessModal()"
+                 (keydown.enter)="openEditHostAccessModal()"
                  [cdsStack]="'horizontal'"
                  class="cds-ml-2"
+                 tabindex="0"
                  [gap]="1">
                 <span i18n>Edit</span>
                 <cd-icon type="edit"></cd-icon>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
index b06f9548b76..773f192b50e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
@@ -86,6 +86,7 @@
             [disabled]="host.isInvalid"
             size="md"
             class="cds-mt-3"
+            type="button"
             (click)="addHost()">
             <span i18n>Add</span>
             <cd-icon type="add"></cd-icon>
@@ -128,6 +129,7 @@
   <button
     i18n
     cdsButton="ghost"
+    type="button"
     (click)="removeAll($event)">
     Remove all
   </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html
index 6e704a0124f..85b830cf025 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html
@@ -5,7 +5,9 @@
   <div *ngFor="let section of rbdConfigurationService.sections">
     <h5 class="cd-header">
       <legend (click)="toggleSectionVisibility(section.class)"
-              class="collapsible">
+              class="collapsible"
+              tabindex="0"
+              (keydown.enter)="toggleSectionVisibility(section.class)">
         {{ section.heading }}&nbsp;
         <svg [cdsIcon]="!sectionVisibility[section.class] ? icons.addCircle : icons.minusCircle"
              [size]="icons.size20"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html
index 8eb79386c8d..6e1955c8508 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html
@@ -102,8 +102,8 @@
       <!-- Permissions -->
       <div class="form-item">
         <fieldset>
-          <label class="cds--label"
-                 i18n>Permissions</label>
+          <legend class="cds--label"
+                 i18n>Permissions</legend>
             <ng-container *ngFor="let permission of clientPermissions">
               <cds-checkbox i18n-label
                             [id]="permission.name"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html
index 314be40ce29..9acab5fde4f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html
@@ -72,5 +72,7 @@
              let-row="data.row"
              let-value="data.value">
   <span class="quota-origin"
+        tabindex="0"
+        (keydown.enter)="selectOrigin(value)"
         (click)="selectOrigin(value)">{{value}}</span>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html
index 5141bb2460d..d209a6cc9c0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html
@@ -15,6 +15,7 @@
      i18n>Turn on CephFS Mirroring to start creating mirror links and synchronizing data across clusters. After enabling, you can add mirror links.</p>
   <button cdsButton="primary"
           (click)="enableModule()"
+          type="button"
           i18n>Enable CephFS Mirroring</button>
 </cds-tile>
 <div cdsGrid
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
index 4c802c8fd07..873814adacc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
@@ -46,10 +46,10 @@
           cdsRow
           class="form-item"
         >
-          <label
+          <legend
             class="cds--label"
             i18n
-          >Description</label>
+          >Description</legend>
           <p class="cds--type-body-01 mb-0">{{ response.long_desc }}</p>
         </div>
         }
@@ -108,10 +108,10 @@
             cdsCol
             [columnNumbers]="{ sm: 2, md: 2, lg: 2 }"
           >
-            <label
+            <legend
               class="cds--label mb-0"
               i18n
-            >Services</label>
+            >Services</legend>
           </div>
           <div
             cdsCol
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
index b95d4092086..0b160412a79 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
@@ -27,6 +27,7 @@
             id="skipStepBtn"
             (click)="onSkip()"
             aria-label="Skip this step"
+            type="button"
             i18n>Skip</button>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
index 08dcae08f4f..7ade7992055 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
@@ -141,6 +141,7 @@
                 class="me-3"
                 (click)="createCluster()"
                 aria-label="Add Storage"
+                type="button"
                 i18n>
           Add storage
           <cd-icon
@@ -152,6 +153,7 @@
         <button cdsButton="tertiary"
                 (click)="skipClusterCreation()"
                 aria-label="View cluster overview"
+                type="button"
                 i18n>
           View cluster overview
           <cd-icon
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html
index 9fed18accfb..3af0f126eb3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html
@@ -185,8 +185,8 @@
     </div>
 
     <div class="col-md-5">
-      <label i18n
-             class="fw-bold">Time range:</label>
+      <legend i18n
+             class="cds--label fw-bold">Time range:</legend>
       <div class="d-flex">
       <ngb-timepicker [spinners]="false"
                       [(ngModel)]="startTime"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html
index 97e27b280c4..500ecc2c5f1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html
@@ -26,7 +26,8 @@
              *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length === 0">
           <div class="text-center">
             <button class="btn btn-primary"
-                    (click)="openConnectClusterForm()">
+                    (click)="openConnectClusterForm()"
+                    type="button">
               <i class="mx-auto"
                  [ngClass]="icons.add">
               </i> Connect Cluster
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html
index 69762c68197..1bc4a90cb61 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html
@@ -47,11 +47,13 @@
     <cds-button-set>
       <button cdsButton="secondary"
               (click)="closeModal()"
+              type="button"
               i18n>
         Cancel
       </button>
       <button cdsButton="secondary"
               (click)="resetSelection()"
+              type="button"
               i18n>
         Reset
       </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html
index 7b3aa5a4eb8..d8981bd41ce 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html
@@ -41,6 +41,7 @@
     <cds-button-set>
       <button cdsButton="secondary"
               (click)="closeModal()"
+              type="button"
               i18n>
         Cancel
       </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html
index fa263672246..e2c1fc2a4c5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html
@@ -19,8 +19,10 @@
           <div class="col-sm-12">
             <a class="pull-right margin-right-md"
                (click)="advancedEnabled = true"
+               (keydown.enter)="advancedEnabled = true"
                *ngIf="!advancedEnabled"
-               i18n>Advanced...</a>
+               i18n
+               tabindex="0">Advanced...</a>
           </div>
         </div>
         <div *ngIf="advancedEnabled">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index b6e9374e006..dad834e1537 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -16,6 +16,8 @@
                       spacingClass="mb-3"
                       i18n>
         <a class="text-decoration-underline"
+           tabindex="0"
+           (keydown.enter)="createMultisiteSetup()"
            (click)="createMultisiteSetup()">
           Click here</a> to create a new Realm/Zonegroup/Zone
       </cd-alert-panel>
@@ -1276,6 +1278,7 @@
       <div class="form-item">
         <fieldset class="cds--fieldset">
           <label class="cds--label"
+                 for="enable_mtls"
                  i18n>Encryption</label>
           <cds-checkbox i18n-label
                         id="enable_mtls"
@@ -1368,24 +1371,24 @@
   <!-- Current Certificate Section - Only shown in Edit mode when certificate exists -->
   @if (editing && currentCertificate?.has_certificate) {
   <div class="form-item">
-    <label class="cds--label cds--type-heading-compact-01"
-           i18n>Current Certificate</label>
+    <legend class="cds--label cds--type-heading-compact-01"
+           i18n>Current Certificate</legend>
     <div class="row">
       <div class="col-6">
-        <label class="cds--label"
-               i18n>Certificate</label>
+        <legend class="cds--label"
+               i18n>Certificate</legend>
         <div>{{ currentCertificate.cert_name }}</div>
       </div>
       <div class="col-6">
-        <label class="cds--label"
-               i18n>Valid Until</label>
+        <legend class="cds--label"
+               i18n>Valid Until</legend>
         <div>{{ currentCertificate.expiry_date | cdDate }} • {{ currentCertificate.days_to_expiration }} <span i18n>days left</span></div>
       </div>
     </div>
     <div class="row mt-3">
       <div class="col-6">
-        <label class="cds--label"
-               i18n>Status</label>
+        <legend class="cds--label"
+               i18n>Status</legend>
         <div class="align-items-center">
           <cd-icon [type]="statusIconMap[currentCertificate.status] || statusIconMap['default']"></cd-icon>
           @switch (currentCertificate.status) {
@@ -1399,8 +1402,8 @@
         </div>
       </div>
       <div class="col-6">
-        <label class="cds--label"
-               i18n>Issuer</label>
+        <legend class="cds--label"
+               i18n>Issuer</legend>
         <div>
           @if (currentCertificate.signed_by === 'cephadm') {
           <span i18n>Internal (Cephadm CA)</span>
@@ -1416,6 +1419,7 @@
   <!-- Certificate Authority Selection -->
   <div class="form-item">
     <label class="cds--label cds--type-heading-compact-01"
+           for="certificateType"
            i18n>Choose Certificate Authority</label>
     <cds-radio-group formControlName="certificateType"
                      orientation="horizontal"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html
index 162d031aede..5df12a3f307 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html
@@ -15,21 +15,25 @@
       <button class="btn btn-light"
               aria-label="Go back"
               routerLink="/upgrade"
+              type="button"
               i18n>Back</button>
       <button *ngIf="upgradeStatus.in_progress && !upgradeStatus.is_paused"
               (click)="pauseUpgrade()"
               class="btn btn-light m-2"
               aria-label="Pause Upgrade"
+              type="button"
               i18n>Pause</button>
       <button *ngIf="upgradeStatus.in_progress && upgradeStatus.is_paused"
               (click)="resumeUpgrade()"
               class="btn btn-light m-2"
               aria-label="Resume Upgrade"
+              type="button"
               i18n>Resume</button>
       <button *ngIf="upgradeStatus.in_progress"
               (click)="stopUpgradeModal()"
               class="btn btn-danger"
               aria-label="Stop Upgrade"
+              type="button"
               i18n>Stop</button>
     </div>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html
index 33023c7755b..aa037706538 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html
@@ -192,10 +192,13 @@
                     aria-label="Upgrade now"
                     (click)="upgradeNow(info.versions[info.versions.length - 1])"
                     [disabled]="(healthData.mgr_map | mgrSummary)?.total <= 1"
+                    type="button"
                     i18n>Upgrade to {{ info.versions[info.versions.length - 1] }}</button>
           </div>
           <a class="cds--link cds-mb-3"
              (click)="startUpgradeModal()"
+             tabindex="0"
+             (keydown.enter)="startUpgradeModal()"
              i18n>Select another version...</a>
         </ng-container>
       </div>
@@ -212,6 +215,8 @@
   </span>
   <a class="cds--link cds-mb-3"
      (click)="startUpgradeModal()"
+     tabindex="0"
+     (keydown.enter)="startUpgradeModal()"
      i18n>Upgrade using custom image...</a>
 </ng-template>
 
@@ -232,6 +237,7 @@
             id="upgrade"
             aria-label="Upgrade now"
             [disabled]="true"
+            type="button"
             i18n>Checking for upgrades
       <cds-inline-loading></cds-inline-loading>
     </button>
@@ -261,6 +267,8 @@
     </span>
     <a class="cds--link cds-mb-3"
        (click)="startUpgradeModal()"
+       tabindex="0"
+       (keydown.enter)="startUpgradeModal()"
        i18n>Upgrade using custom image...</a>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html
index af0faf51219..d7b89cd9d69 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html
@@ -10,6 +10,7 @@
       cdsButton="ghost"
       size="sm"
       [routerLink]="['/monitoring/active-alerts']"
+      type="button"
       i18n
     >
       View all
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html
index 0ecd3b5eb51..421e2140268 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html
@@ -305,6 +305,7 @@
           <button
             cdsButton="tertiary"
             size="sm"
+            type="button"
             (click)="onViewPGStatesClick()">
             <span
               i18n
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html
index f3505da166b..94f4f9b6b9b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html
@@ -67,6 +67,7 @@
         i18n
         size="sm"
         [routerLink]="['/add-storage']"
+        type="button"
         >
         Add storage
         <cd-icon
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html
index 58f64b0d8da..84cc7ccc23c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html
@@ -10,20 +10,20 @@
     <section cdsModalContent>
       <form [formGroup]="zoneForm"
             novalidate>
-        <label class="cds--label-description"
+        <legend class="cds--label-description"
                i18n>
           This will delete your <strong>{{ zone?.name }}</strong> Zone.
-        </label>
+        </legend>
         @if (includedPools.size) {
-        <label class="cds--label-description"
+        <legend class="cds--label-description"
                i18n>
           Do you want to delete the associated pools with the
           <strong>{{ zone?.name }}</strong> Zone?
-        </label>
-        <label class="cds--label-description"
+        </legend>
+        <legend class="cds--label-description"
                i18n>
           This will delete the following pools and any data stored in these pools:
-        </label>
+        </legend>
 
         <div class="scroll-list">
           @for (pool of includedPools; track pool) {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html
index aabd7735315..98ac65ddf6e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html
@@ -11,24 +11,24 @@
       <form name="zonegroupForm"
             [formGroup]="zonegroupForm"
             novalidate>
-        <label class="cds--label-description"
+        <legend class="cds--label-description"
                i18n>
           This will delete your <strong>{{ zonegroup?.name }}</strong> Zonegroup.
-        </label>
+        </legend>
 
       @if (zonesList.length > 0) {
         <ng-container>
-          <label class="cds--label-description"
+          <legend class="cds--label-description"
                  i18n>
             Do you want to delete the associated zones and pools with the <strong>{{zonegroup?.name}}</strong> Zonegroup?
-          </label>
+          </legend>
 
           @if (includedPools.size > 0) {
             <ng-container>
-              <label class="cds--label-description"
+              <legend class="cds--label-description"
                      i18n>
                 This will delete the following:
-              </label>
+              </legend>
             </ng-container>
           }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html
index 0325a18c7a7..5dc70c285c6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html
@@ -415,7 +415,8 @@
             <button cdsButton="tertiary"
                     id="add-tag"
                     [disabled]="tags.length > 19"
-                    (click)="showTagModal()">
+                    (click)="showTagModal()"
+                    type="button">
               <ng-container i18n>Add tag</ng-container>
               <svg [cdsIcon]="icons.add"
                    [size]="icons.size16"
@@ -459,6 +460,7 @@
               <button cdsButton="tertiary"
                       id="example-generator-button"
                       (click)="openUrl('https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html?icmpid=docs_amazons3_console')"
+                      type="button"
                       i18n>Policy examples
                 <svg [cdsIcon]="icons.launch"
                      [size]="icons.size16"
@@ -467,6 +469,7 @@
               <button cdsButton="tertiary"
                       id="example-generator-button"
                       (click)="openUrl('https://awspolicygen.s3.amazonaws.com/policygen.html')"
+                      type="button"
                       i18n>Policy generator
                 <svg [cdsIcon]="icons.launch"
                      [size]="icons.size16"
@@ -479,6 +482,7 @@
               <button cdsButton="tertiary"
                       id="clear-bucket-policy"
                       (click)="clearTextArea('bucket_policy', '{}')"
+                      type="button"
                       i18n>Clear
                 <svg [cdsIcon]="icons.destroy"
                      [size]="icons.size16"
@@ -519,6 +523,7 @@
               <button cdsButton="tertiary"
                       id="lifecycle-examples-button"
                       (click)="openUrl('https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-lifecycle.html#examples')"
+                      type="button"
                       i18n>Policy examples
                 <svg [cdsIcon]="icons.launch"
                      [size]="icons.size16"
@@ -531,6 +536,7 @@
               <button cdsButton="tertiary"
                       id="clear-lifecycle"
                       (click)="clearTextArea('lifecycle', '{}')"
+                      type="button"
                       i18n>Clear
                 <svg [cdsIcon]="icons.destroy"
                      [size]="icons.size16"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html
index dc11cfd1b82..94328d0bded 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html
@@ -310,16 +310,19 @@
             name="skip-cluster-selection"
             aria-label="Skip"
             (click)="onSkip()"
+            type="button"
             *ngIf="stepTitles[currentStep.stepIndex]['label'] === 'Select Cluster' && multisiteSetupForm.get('configType').value === 'newRealm'"
             i18n>Skip</button>
     <button cdsButton="secondary"
             (click)="onPreviousStep()"
             [attr.aria-label]="showCancelButtonLabel()"
+            type="button"
             i18n>{{ showCancelButtonLabel() }}</button>
     <button cdsButton="primary"
             (click)="onNextStep()"
             aria-label="Next"
             [disabled]="loading"
+            type="button"
             i18n>{{ showSubmitButtonLabel() }}
       <cds-loading [isActive]="loading"
                    [overlay]="false"
@@ -432,41 +435,41 @@
 
 <ng-template #newRealmInfo>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Realm Name:</label>
+    <legend class="cd-col-form-label"
+           i18n>Realm Name:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b id="realmName">{{ multisiteSetupForm.get('realmName').value }}</b></div>
   </div>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Zonegroup Name:</label>
+    <legend class="cd-col-form-label"
+           i18n>Zonegroup Name:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b id="zonegroupName">{{ multisiteSetupForm.get('zonegroupName').value }}</b></div>
   </div>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Zonegroup Endpoints:</label>
+    <legend class="cd-col-form-label"
+           i18n>Zonegroup Endpoints:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b>{{ rgwEndpoints.value.join(', ') }}</b></div>
   </div>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Zone Name:</label>
+    <legend class="cd-col-form-label"
+           i18n>Zone Name:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b id="zoneName">{{ multisiteSetupForm.get('zoneName').value }}</b></div>
   </div>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Zone Endpoints:</label>
+    <legend class="cd-col-form-label"
+           i18n>Zone Endpoints:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b>{{ rgwEndpoints.value.join(', ') }}</b></div>
   </div>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Username:</label>
+    <legend class="cd-col-form-label"
+           i18n>Username:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b>{{ multisiteSetupForm.get('username').value }}</b></div>
   </div>
 </ng-template>
 
 <ng-template #existingRealmInfo>
   <div class="form-group row">
-    <label class="cd-col-form-label"
-           i18n>Selected Realm:</label>
+    <legend class="cd-col-form-label"
+           i18n>Selected Realm:</legend>
     <div class="cd-col-form-input mt-2 text-muted"><b>{{ multisiteSetupForm.get('selectedRealm').value }}</b></div>
   </div>
 </ng-template>
@@ -474,13 +477,13 @@
 <ng-template #replicationInfo>
   <div *ngIf="isMultiClusterConfigured && !stepsToSkip['Select Cluster']">
     <div class="form-group row">
-      <label class="cd-col-form-label"
-             i18n>Selected Replication Cluster:</label>
+      <legend class="cd-col-form-label"
+             i18n>Selected Replication Cluster:</legend>
       <div class="cd-col-form-input mt-2 text-muted"><b>{{ selectedCluster }}</b></div>
     </div>
     <div class="form-group row">
-      <label class="cd-col-form-label"
-             i18n>Replication Zone Name:</label>
+      <legend class="cd-col-form-label"
+             i18n>Replication Zone Name:</legend>
       <div class="cd-col-form-input mt-2 text-muted"><b>{{ multisiteSetupForm.get('replicationZoneName').value }}</b></div>
     </div>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html
index 85c8a689067..d5813693335 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html
@@ -130,6 +130,8 @@
                 <span class="float-end clickable"
                       name="remove_placement_target"
                       (click)="removePlacementTarget(index)"
+                      tabindex="0"
+                      (keydown.enter)="removePlacementTarget(index)"
                       ngbTooltip="Remove">&times;</span>
               </div>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html
index 8f794c69222..04cef06411a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html
@@ -43,7 +43,9 @@
                 />
                 <button type="button"
                         class="btn btn-light"
-                        cdPasswordButton="access_key"></button>
+                        cdPasswordButton="access_key"
+                        aria-label="Toggle access key visibility"
+                        i18n-aria-label></button>
                 <cd-copy-2-clipboard-button source="access_key"> </cd-copy-2-clipboard-button>
               </div>
             </td>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html
index 115a408d5fa..7b6a51b86d5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html
@@ -509,6 +509,7 @@
                   <button cdsButton="tertiary"
                           id="example-generator-button"
                           (click)="openUrl('https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html?icmpid=docs_amazons3_console')"
+                          type="button"
                           i18n>
                     Policy examples
                     <svg cdsIcon="launch"
@@ -517,6 +518,7 @@
                   </button>
                   <button cdsButton="tertiary"
                           id="example-generator-button"
+                          type="button"
                           (click)="openUrl('https://awspolicygen.s3.amazonaws.com/policygen.html')"
                           i18n>
                     Policy generator
@@ -530,6 +532,7 @@
                 <cds-button-set class="float-end mt-1">
                   <button cdsButton="tertiary"
                           id="clear-bucket-policy"
+                          type="button"
                           (click)="clearTextArea('policy', '{}')"
                           i18n>
                     Clear
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
index 49746114137..f34e08c07a5 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
@@ -16,7 +16,8 @@
                autocomplete="new-password"
                autofocus>
         <button class="btn btn-outline-light btn-password"
-                cdPasswordButton="oldpassword">
+                cdPasswordButton="oldpassword"
+                type="button">
         </button>
       </div>
       <span class="invalid-feedback"
@@ -69,7 +70,8 @@
                id="confirmnewpassword"
                formControlName="confirmnewpassword">
         <button class="btn btn-outline-light btn-password"
-                cdPasswordButton="confirmnewpassword">
+                cdPasswordButton="confirmnewpassword"
+                type="button">
         </button>
       </div>
       <span class="invalid-feedback"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html
index 83626ab9d80..e0dcb07d542 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html
@@ -25,10 +25,12 @@
           <button class="btn btn-primary ms-1"
                   [routerLink]="buttonRoute"
                   *ngIf="!uiConfig; else configureButtonTpl"
+                  type="button"
                   i18n>{{ buttonName }}</button>
           <button class="btn btn-light ms-1"
                   [routerLink]="secondaryButtonRoute"
                   *ngIf="secondaryButtonName && secondaryButtonRoute"
+                  type="button"
                   i18n>{{ secondaryButtonName }}</button>
         </div>
       </div>
@@ -40,6 +42,7 @@
   <button class="btn btn-primary"
           (click)="doConfigure()"
           [attr.title]="buttonTitle"
+          type="button"
           *ngIf="uiConfig"
           i18n>{{ buttonName }}</button>
 </ng-template>
@@ -64,6 +67,7 @@
        *ngIf="!module_name; else enableButton">
     <button class="btn btn-primary"
             [routerLink]="'/overview'"
+            type="button"
             i18n>Go To Overview</button>
   </div>
 </ng-template>
@@ -73,6 +77,7 @@
        *ngIf="module_name && !(buttonName && buttonRoute)">
     <button class="btn btn-primary"
             (click)="enableModule()"
+            type="button"
             i18n>Enable {{ module_name | upperFirst }} module</button>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html
index 1222fcc2ad5..bd92995be2d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html
@@ -1,7 +1,6 @@
 <main class="login full-height">
   <header>
     <nav class="navbar p-4">
-      <a class="navbar-brand"></a>
       <div class="form-inline">
         <cd-language-selector></cd-language-selector>
       </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
index dfca9e84c40..5eac4142b6b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
@@ -4,12 +4,14 @@
   <li class="cds--overflow-menu-options__option mb-2">
     <button routerLink="/user-management"
             class="cds--overflow-menu-options__btn"
+            type="button"
             i18n>User management</button>
   </li>
   <li class="cds--overflow-menu-options__option mb-2"
       *ngIf="configOptPermission.read">
     <button routerLink="/telemetry"
             class="cds--overflow-menu-options__btn"
+            type="button"
             i18n>Telemetry configuration</button>
   </li>
 </cds-overflow-menu>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html
index 8b63e301aac..c68c88d25c6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html
@@ -11,6 +11,7 @@
     <button *ngIf="!sso"
             routerLink="/user-profile/edit"
             class="cds--overflow-menu-options__btn"
+            type="button"
             i18n>
     <svg cdsIcon="locked"
          class="me-2"
@@ -21,6 +22,7 @@
     <button (click)="logout()"
             data-testid="logout"
             class="cds--overflow-menu-options__btn"
+            type="button"
             i18n><svg cdsIcon="logout"
                       class="me-2"
                       size="16"></svg>Log out
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
index 003c48a8259..80726f4fe13 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
@@ -36,7 +36,9 @@
       </cds-header-navigation>
       <div class="cds--btn cds--btn--icon-only cds--header__action"
            data-testid="header-notification-icon"
-           (click)="onNotificationSelected($event)">
+           (click)="onNotificationSelected($event)"
+           tabindex="0"
+           (keydown.enter)="onNotificationSelected($event)">
         <cd-notifications></cd-notifications>
       </div>
       <div class="cds--btn cds--btn--icon-only cds--header__action">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html
index a8ac59e0d3c..623cae5cc2b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html
@@ -72,7 +72,8 @@
         cdsButton="ghost"
         size="sm"
         class="notification-close"
-        (click)="removeNotification(notification, $event)">
+        (click)="removeNotification(notification, $event)"
+        type="button">
         <cd-icon type="destroy"></cd-icon>
       </button>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html
index 2906f9bba1c..a7b765d9cd2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html
@@ -7,6 +7,7 @@
       class="notification-header__dismiss-btn"
       i18n
       cdsButton="ghost"
+      type="button"
       size="sm"
       (click)="onDismissAll()">
       Dismiss all
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html
index 51b218769bb..1ce838ceeda 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html
@@ -14,6 +14,7 @@
           [title]="actionName"
           (click)="onAction()"
           *ngIf="actionName"
+          type="button"
           i18n>{{ actionName }}
   </button>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html
index f69c55c18dc..e4976d6f61e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html
@@ -37,11 +37,13 @@
     </span>
     <span *ngIf="dropdownData && dropdownData.total.total.total > 0"
           class="position-absolute end-0 me-2">
-      <a (click)="toggleDropdown()"
-         class="dropdown-toggle"
-         [attr.aria-expanded]="dropdownToggled"
-         aria-controls="row-dropdwon"
-         role="button"></a>
+      <button type="button"
+          (click)="toggleDropdown()"
+          class="dropdown-toggle border-0 bg-transparent p-0"
+          [attr.aria-expanded]="dropdownToggled"
+          aria-controls="row-dropdown">
+        <span class="visually-hidden" i18n>Toggle dropdown</span>
+      </button>
     </span>
   </div>
 </li>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html
index 4046a4e2a21..0bf81d9bf4c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html
@@ -5,6 +5,7 @@
         [size]="size"
         description="Copy to Clipboard"
         i18n-description
+        type="button"
         (click)="onClick()">
   @if(text) {
   <span data-toggle="tooltip"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index b0d356e099b..c3a784214b6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -13,7 +13,7 @@
       @for (detail of getVisibleDetails(); track detail.label) {
       <div [cdsStack]="'vertical'"
            [gap]="2">
-        <label class="cds--type-label-01">{{ detail.label }}</label>
+        <legend class="cds--type-label-01">{{ detail.label }}</legend>
         <div class="cds--type-body-01">
           @switch (detail.type) {
             @case ('status') {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html
index 43c1d2d6542..21ce6a76343 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html
@@ -11,6 +11,7 @@
   <div ngbDropdownMenu>
     <button ngbDropdownItem
             (click)="download('json')"
+            type="button"
             *ngIf="objectItem">
       <svg [cdsIcon]="icons.code"
            size="16"
@@ -19,7 +20,8 @@
     </button>
     <button ngbDropdownItem
             (click)="download()"
-            *ngIf="textItem">
+            *ngIf="textItem"
+            type="button">
       <svg [cdsIcon]="icons.document"
            size="16"
            ></svg>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html
index cdb38fcf555..bb5b285602a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html
@@ -21,6 +21,7 @@
         <button class="btn btn-light ms-3"
                 i18n-title
                 title="Reset Settings"
+                type="button"
                 (click)="reset()">
           <i [ngClass]="[icons.undo]"></i>
         </button>
@@ -29,6 +30,7 @@
         <button class="btn btn-light ms-3"
                 i18n-title
                 title="Show hidden information"
+                type="button"
                 (click)="showMessage = !showMessage">
           <i [ngClass]="[icons.infoCircle, icons.size24]"></i>
         </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html
index 57f368f2456..c9e5b3f2ad6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html
@@ -30,7 +30,9 @@
       </div>
       <cds-popover-content>
         <div class="cds--popover-scroll-container"
-             (click)="$event.stopPropagation()">
+             (click)="$event.stopPropagation()"
+             tabindex="0"
+             (keydown.enter)="$event.stopPropagation()">
           <ng-container *ngTemplateOutlet="content"></ng-container>
         </div>
       </cds-popover-content>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html
index a6af7aace9b..ee382632f2d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html
@@ -36,7 +36,8 @@
         <button class="inline-tip-bg-color btn-toggle"
                 cdsButton="ghost"
                 size="md"
-                (click)="toggleContent()">
+                (click)="toggleContent()"
+                type="button">
           <span i18n>{{ isTruncated ? 'Read more' : 'Read less' }}</span>
         </button>
       }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html
index 70519a36af4..cca8ffc57bd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html
@@ -65,6 +65,7 @@
             <div class="card-body p-1">
               <button class="btn btn-link float-end mt-0 pt-0"
                       title="Remove notification"
+                      type="button"
                       i18n-title
                       (click)="remove(i); $event.stopPropagation()">
                 <svg [cdsIcon]="icons.trash"
@@ -74,6 +75,7 @@
               <button *ngIf="notification.application === 'Prometheus' && notification.type !== 2 && !notification.alertSilenced"
                       class="btn btn-link float-end text-muted mute m-0 p-0"
                       title="Silence Alert"
+                      type="button"
                       i18n-title
                       (click)="silence(notification)">
                 <svg [cdsIcon]="icons.mute"
@@ -83,6 +85,7 @@
               <button *ngIf="notification.application === 'Prometheus' && notification.type !== 2 && notification.alertSilenced"
                       class="btn btn-link float-end text-muted mute m-0 p-0"
                       title="Expire Silence"
+                      type="button"
                       i18n-title
                       (click)="expire(notification)">
                 <svg [cdsIcon]="icons.bell"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html
index 55b8e564c64..bef3e49b1ae 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html
@@ -16,7 +16,9 @@
   <cds-tag class="tag-dark me-2">
     <span class="me-2">{{ dataItem }}</span>
       <a  class="tags-remove"
-          (click)="cdSelect.removeItem(dataItem)">
+          (click)="cdSelect.removeItem(dataItem)"
+          tabindex="0"
+          (keydown.enter)="cdSelect.removeItem(dataItem)">
       <svg [cdsIcon]="icons.destroy"
            [size]="icons.size20"
            class="cds-white"></svg>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html
index 7d39e6f2d60..e6580017b97 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html
@@ -21,7 +21,9 @@
   <div *ngFor="let option of filteredOptions"
        class="select-menu-item"
        [ngClass]="{'help-block disabled': (data.length === selectionLimit || !option.enabled) && !option.selected}"
-       (click)="triggerSelection(option)">
+       (click)="triggerSelection(option)"
+       tabindex="0"
+       (keydown.enter)="triggerSelection(option)">
     <div class="select-menu-item-icon">
       <i [ngClass]="[icons.check]"
          aria-hidden="true"
@@ -40,7 +42,9 @@
   </div>
   <div *ngIf="isCreatable()"
        class="select-menu-item"
-       (click)="addCustomOption()">
+       (click)="addCustomOption()"
+       tabindex="0"
+       (keydown.enter)="addCustomOption()">
     <div class="select-menu-item-icon">
       <i [ngClass]="[icons.tag]"
          aria-hidden="true"></i>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html
index 0af5a25a402..a591e49fb7d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html
@@ -1,5 +1,7 @@
 <div class="overlay"
      (click)="close()"
+     tabindex="0"
+     (keydown.enter)="close()"
      *ngIf="expanded && overlay"></div>
 
 <cds-panel [expanded]="expanded"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
index c1bb0ac8c7a..53f974c1109 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
@@ -50,12 +50,14 @@
                   class="tearsheet-footer-cancel"
                   (click)="closeTearsheet()"
                   size="xl"
+                  type="button"
                   i18n>Cancel</button>
           @if (steps.length > 1) {
           <button cdsButton="secondary"
                   size="xl"
                   [disabled]="currentStep === 0"
                   (click)="onPrevious()"
+                  type="button"
                   i18n>Previous</button>
           }
           @if (currentStep === lastStep) {
@@ -64,6 +66,7 @@
                   class="tearsheet-footer-submit"
                   [disabled]="isSubmitLoading"
                   (click)="onSubmit()"
+                  type="button"
                   i18n>
             @if (isSubmitLoading) {
             <cds-loading
@@ -82,6 +85,7 @@
           <button cdsButton="primary"
                   size="xl"
                   [disabled]="steps[currentStep]?.invalid"
+                  type="button"
                   (click)="onNext()"
                   i18n>Next</button>
           }
@@ -164,12 +168,14 @@
         <button cdsButton="ghost"
                 (click)="closeTearsheet()"
                 size="xl"
+                type="button"
                 i18n>Cancel</button>
         @if (steps.length > 1) {
         <button cdsButton="secondary"
                 size="xl"
                 [disabled]="currentStep === 0"
                 (click)="onPrevious()"
+                type="button"
                 i18n>Previous</button>
         }
         @if (currentStep === lastStep) {
@@ -178,6 +184,7 @@
                 class="tearsheet-footer-submit"
                 [disabled]="isSubmitLoading"
                 (click)="onSubmit()"
+                type="button"
                 i18n>
           @if (isSubmitLoading) {
           <cds-loading
@@ -197,6 +204,7 @@
                 size="xl"
                 [disabled]="steps[currentStep]?.invalid"
                 (click)="onNext()"
+                type="button"
                 i18n>Next</button>
         }
       </cds-modal-footer>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html
index e356fbb5022..4a4f0a06c33 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html
@@ -18,7 +18,9 @@
   <div *ngIf="upgradeInfo$ | async as info"
        i18n>
     <h5 *ngIf="info.versions.length > 0"
-        (click)="upgradeModal()">
+        (click)="upgradeModal()"
+        tabindex="0"
+        (keydown.enter)="upgradeModal()">
       <i [ngClass]="icons.up"></i>
       Upgrade available
     </h5>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html
index ae48d7fd7fc..10695fbb010 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html
@@ -13,10 +13,14 @@
         <a class="nav-link"
            [class.active]="!activeItem"
            (click)="selectItem()"
+           tabindex="0"
+           (keydown.enter)="selectItem()"
            *ngIf="item === ''">_nogroup</a>
         <a class="nav-link text-decoration-none text-break"
            [class.active]="item === activeItem"
            (click)="selectItem(item)"
+           tabindex="0"
+           (keydown.enter)="selectItem(item)"
            *ngIf="item !== ''">{{item}}</a>
       </li>
     </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
index a4e9f0c22b6..1846c419b9d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
@@ -19,7 +19,8 @@
             [attr.aria-label]="dropDownOnly"
             [offset]="{ x: -210, y: 65 }"
             [cdsOverflowMenu]="overflowMenuTpl"
-            data-testid="table-action-btn">
+            data-testid="table-action-btn"
+            type="button">
       <svg
            [cdsIcon]="icons.chevronDown"></svg>
     </button>
@@ -44,7 +45,8 @@
 
 <ng-template #caret>
   <button [cdsButton]="currentAction.buttonKind"
-          class="caret-btn">
+          class="caret-btn"
+          type="button">
     <svg class="cds--btn__icon"
          [cdsIcon]="icons.chevronDown"></svg>
   </button>
@@ -74,7 +76,8 @@
 </ng-template>
 
 <ng-template #customTrigger>
-  <button [cdsButton]="dropDownOnlyBtnColor">
+  <button [cdsButton]="dropDownOnlyBtnColor"
+          type="button">
     <span i18n>{{ dropDownOnly }}</span>
     <svg class="override-position-static cds--btn__icon"
          [cdsIcon]="icons.chevronDown"></svg>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html
index 3be5322f2b1..30f7ebfa9ef 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html
@@ -7,6 +7,7 @@
     i18n-aria-label
     [disabled]="!canPrevious()"
     (click)="selectPage(1)"
+    type="button"
   >
     <cd-icon type="angleDoubleLeft"></cd-icon>
   </button>
@@ -15,6 +16,7 @@
     aria-label="Go to previous page"
     i18n-aria-label
     [disabled]="!canPrevious()"
+    type="button"
     (click)="prevPage()"
   >
     <cd-icon type="leftArrow"></cd-icon>
@@ -39,6 +41,7 @@
     i18n-aria-label
     (click)="nextPage()"
     [disabled]="!canNext()"
+    type="button"
   >
     <cd-icon type="rightArrow"></cd-icon>
   </button>
@@ -48,6 +51,7 @@
     i18n-aria-label
     [disabled]="!canNext()"
     (click)="selectPage(totalPages)"
+    type="button"
   >
     <cd-icon type="angleDoubleRight"></cd-icon>
   </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
index 51485d12c04..637da0ff771 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
@@ -34,6 +34,7 @@
                 [preserveFragment]="action.preserveFragment ? '' : null"
                 [disabled]="tableActions.disableSelectionAction(action)"
                 [attr.aria-label]="action.name"
+                type="button"
                 i18n>
           {{ action.name }}
         </button>
@@ -178,6 +179,7 @@
                 <button
                   cdsButton="tertiary"
                   size="md"
+                  type="button"
                   (click)="addCustomFilter()">Add new filter rule +</button>
               </div>
             </div>
@@ -189,6 +191,7 @@
             <button cdsButton="secondary"
                     size="lg"
                     data-testid="clear-filters"
+                    type="button"
                     (click)="onClearFilters()">
               <ng-container i18n>Clear all</ng-container>
             </button>
@@ -197,6 +200,7 @@
                     size="lg"
                     data-testid="apply-filters"
                     [disabled]="isApplyFilterDisabled"
+                    type="button"
                     (click)="onSubmitFilter()">
               <ng-container i18n>Apply</ng-container>
             </button>
@@ -225,6 +229,7 @@
       <!-- show hide columns -->
       <button cdsButton="ghost"
               class="toolbar-action"
+              type="button"
               [cdsOverflowMenu]="showHideColumnsRef"
               placement="bottom"
               [flip]="true"
@@ -236,6 +241,8 @@
       <ng-template #showHideColumnsRef>
         <div class="vstack gap-3 p-3"
              (click)="$event.stopPropagation()"
+             tabindex="0"
+             (keydown.enter)="$event.stopPropagation()"
              [cdsTheme]="theme">
           <ng-container *ngFor="let column of localColumns">
             <cds-checkbox *ngIf="!column?.isInvisible"
@@ -293,7 +300,8 @@
           </cds-tooltip>
         }
         <button cdsButton="ghost"
-                (click)="onClearFilters($event)">
+                (click)="onClearFilters($event)"
+                type="button">
           <ng-container i18n>Clear filters</ng-container>
         </button>
       </div>

From daa89763adf599320fb89bbb1bd4d404e947c1b1 Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Thu, 9 Jul 2026 13:44:05 +0530
Subject: [PATCH 593/596] mgr/dashboard: fix all prettier warnings

basically ran `npm run fix:html` and commited everything

Fixes: https://tracker.ceph.com/issues/77112
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../mgr/dashboard/frontend/.prettierignore    |    1 -
 src/pybind/mgr/dashboard/frontend/.prettierrc |    2 +-
 .../iscsi-setting.component.html              |  105 +-
 .../iscsi-tabs/iscsi-tabs.component.html      |   26 +-
 .../iscsi-target-details.component.html       |   56 +-
 ...scsi-target-discovery-modal.component.html |  212 +-
 .../iscsi-target-form.component.html          | 1071 +++--
 ...target-image-settings-modal.component.html |  138 +-
 ...i-target-iqn-settings-modal.component.html |   49 +-
 .../iscsi-target-list.component.html          |   83 +-
 .../app/ceph/block/iscsi/iscsi.component.html |   66 +-
 .../bootstrap-create-modal.component.html     |  167 +-
 .../bootstrap-import-modal.component.html     |  203 +-
 .../daemon-list/daemon-list.component.html    |   22 +-
 .../image-list/image-list.component.html      |  128 +-
 .../overview/overview.component.html          |   90 +-
 .../pool-edit-mode-modal.component.html       |   84 +-
 .../pool-edit-peer-modal.component.html       |  231 +-
 .../pool-list/pool-list.component.html        |   60 +-
 .../nvmeof-edit-authentication.component.html |   43 +-
 .../nvmeof-edit-host-key-modal.component.html |  146 +-
 ...nvmeof-gateway-group-filter.component.html |   25 +-
 ...ay-group-delete-guard-modal.component.html |   64 +-
 .../nvmeof-gateway-group.component.html       |   98 +-
 ...meof-gateway-node-add-modal.component.html |  109 +-
 .../nvmeof-gateway-node.component.html        |  127 +-
 .../nvmeof-gateway-subsystem.component.html   |   24 +-
 .../nvmeof-gateway.component.html             |   83 +-
 .../nvmeof-group-form.component.html          |  856 ++--
 .../nvmeof-initiators-form.component.html     |   24 +-
 .../nvmeof-initiators-list.component.html     |   77 +-
 .../nvmeof-listeners-form.component.html      |    9 +-
 .../nvmeof-listeners-list.component.html      |   55 +-
 ...meof-namespace-expand-modal.component.html |  101 +-
 .../nvmeof-namespaces-form.component.html     |  407 +-
 .../nvmeof-namespaces-list.component.html     |   60 +-
 .../nvmeof-setup-cards.component.html         |   55 +-
 ...f-subsystem-namespaces-list.component.html |   41 +-
 .../nvmeof-subsystem-overview.component.html  |  207 +-
 ...vmeof-subsystem-performance.component.html |   24 +-
 .../nvmeof-subsystems-details.component.html  |   49 +-
 .../nvmeof-subsystem-step-1.component.html    |  307 +-
 .../nvmeof-subsystem-step-2.component.html    |  317 +-
 .../nvmeof-subsystem-step-3.component.html    |  246 +-
 .../nvmeof-subsystem-step-4.component.html    |  276 +-
 .../nvmeof-subsystems-form.component.html     |   56 +-
 .../nvmeof-subsystems.component.html          |  148 +-
 .../nvmeof-tabs/nvmeof-tabs.component.html    |   71 +-
 .../rbd-configuration-form.component.html     |  148 +-
 .../rbd-configuration-list.component.html     |   46 +-
 .../rbd-details/rbd-details.component.html    |  277 +-
 .../block/rbd-form/rbd-form.component.html    |  777 ++--
 .../block/rbd-list/rbd-list.component.html    |  242 +-
 .../rbd-namespace-form-modal.component.html   |  188 +-
 .../rbd-namespace-list.component.html         |   28 +-
 .../rbd-performance.component.html            |   14 +-
 .../rbd-snapshot-form-modal.component.html    |  135 +-
 .../rbd-snapshot-list.component.html          |   31 +-
 .../block/rbd-tabs/rbd-tabs.component.html    |   66 +-
 .../rbd-trash-list.component.html             |   88 +-
 .../rbd-trash-move-modal.component.html       |  105 +-
 .../rbd-trash-purge-modal.component.html      |   77 +-
 .../rbd-trash-restore-modal.component.html    |   74 +-
 .../cephfs-auth-modal.component.html          |  269 +-
 .../cephfs-chart/cephfs-chart.component.html  |   18 +-
 .../cephfs-clients.component.html             |   26 +-
 .../cephfs-detail.component.html              |   47 +-
 .../cephfs-directories.component.html         |  111 +-
 .../cephfs-filesystem-selector.component.html |   90 +-
 .../cephfs-form/cephfs-form.component.html    |  506 ++-
 .../cephfs-list/cephfs-list.component.html    |   20 +-
 .../cephfs-mirroring-entity.component.html    |  361 +-
 .../cephfs-mirroring-error.component.html     |   57 +-
 .../cephfs-mirroring-list.component.html      |   13 +-
 .../cephfs-mirroring-wizard.component.html    |  119 +-
 .../cephfs-mount-details.component.html       |   62 +-
 ...ephfs-snapshotschedule-form.component.html |  305 +-
 ...ephfs-snapshotschedule-list.component.html |   21 +-
 .../cephfs-subvolume-form.component.html      |  347 +-
 .../cephfs-subvolume-group.component.html     |   83 +-
 .../cephfs-subvolume-list.component.html      |  173 +-
 ...fs-subvolume-snapshots-form.component.html |  170 +-
 ...fs-subvolume-snapshots-list.component.html |   76 +-
 .../cephfs-subvolumegroup-form.component.html |  275 +-
 .../cephfs-tabs/cephfs-tabs.component.html    |   53 +-
 .../configuration-details.component.html      |  153 +-
 .../configuration-form.component.html         |  329 +-
 .../configuration.component.html              |   42 +-
 .../create-cluster-review.component.html      |   68 +-
 .../create-cluster-step-1.component.html      |   34 +-
 .../create-cluster-step-2.component.html      |   57 +-
 .../create-cluster-step-3.component.html      |   27 +-
 .../create-cluster-step-4.component.html      |   18 +-
 .../create-cluster.component.html             |  454 ++-
 .../cluster/crushmap/crushmap.component.html  |   79 +-
 .../host-details-section.component.html       |   29 +-
 .../hosts/host-form/host-form.component.html  |  248 +-
 .../ceph/cluster/hosts/hosts.component.html   |  178 +-
 .../inventory-devices.component.html          |   32 +-
 .../inventory/inventory.component.html        |   12 +-
 .../app/ceph/cluster/logs/logs.component.html |  411 +-
 .../mgr-module-details.component.html         |    3 +-
 .../mgr-module-form.component.html            |  215 +-
 .../mgr-module-list.component.html            |   40 +-
 .../cluster/monitor/monitor.component.html    |   82 +-
 .../multi-cluster-details.component.html      |   41 +-
 .../multi-cluster-form.component.html         |  286 +-
 .../multi-cluster-list.component.html         |  148 +-
 .../multi-cluster.component.html              |  461 ++-
 .../osd-creation-preview-modal.component.html |   25 +-
 .../osd-details/osd-details.component.html    |  110 +-
 ...sd-devices-selection-groups.component.html |  251 +-
 ...osd-devices-selection-modal.component.html |   69 +-
 .../osd-flags-indiv-modal.component.html      |  109 +-
 .../osd-flags-modal.component.html            |   84 +-
 .../osd/osd-form/osd-form.component.html      |  984 +++--
 .../osd/osd-list/osd-list.component.html      |  244 +-
 .../osd-pg-scrub-modal.component.html         |   74 +-
 .../osd-recv-speed-modal.component.html       |  164 +-
 .../osd-reweight-modal.component.html         |   60 +-
 .../osd-scrub-modal.component.html            |   32 +-
 .../active-alert-list.component.html          |   84 +-
 .../prometheus-tabs.component.html            |   62 +-
 .../rules-list/rules-list.component.html      |   38 +-
 .../silence-form/silence-form.component.html  |  340 +-
 .../silence-list/silence-list.component.html  |   62 +-
 .../silence-matcher-modal.component.html      |  136 +-
 ...service-certificate-details.component.html |  175 +-
 .../service-daemon-list.component.html        |  130 +-
 .../service-details.component.html            |   27 +-
 .../service-form/service-form.component.html  | 3464 ++++++++++-------
 .../cluster/services/services.component.html  |  133 +-
 .../telemetry/telemetry.component.html        |  505 ++-
 .../upgrade-start-modal.component.html        |  171 +-
 .../upgrade-progress.component.html           |  105 +-
 .../cluster/upgrade/upgrade.component.html    |  431 +-
 .../dashboard-area-chart.component.html       |   51 +-
 .../dashboard-pie.component.html              |   24 +-
 .../dashboard-time-selector.component.html    |   19 +-
 .../nfs-cluster-details.component.html        |   14 +-
 .../nfs-cluster/nfs-cluster.component.html    |   82 +-
 .../nfs-details/nfs-details.component.html    |   44 +-
 .../nfs-form-client.component.html            |  160 +-
 .../ceph/nfs/nfs-form/nfs-form.component.html | 1012 +++--
 .../ceph/nfs/nfs-list/nfs-list.component.html |   91 +-
 .../overview-alerts-card.component.html       |  131 +-
 .../overview-health-card.component.html       |  633 +--
 .../app/ceph/overview/overview.component.html |  149 +-
 .../overview-storage-card.component.html      |  277 +-
 .../performance-counter.component.html        |    6 +-
 .../table-performance-counter.component.html  |   27 +-
 .../crush-rule-form-modal.component.html      |  119 +-
 ...ure-code-profile-form-modal.component.html |  971 +++--
 .../pool-details/pool-details.component.html  |   88 +-
 .../pool/pool-form/pool-form.component.html   | 1867 +++++----
 .../pool/pool-list/pool-list.component.html   |  108 +-
 .../bucket-tag-modal.component.html           |  139 +-
 ...create-rgw-service-entities.component.html |   59 +-
 ...ultisite-zone-deletion-form.component.html |  104 +-
 ...ite-zonegroup-deletion-form.component.html |  139 +-
 .../rgw-account-role-form.component.html      |  399 +-
 .../rgw-account-roles-list.component.html     |   28 +-
 .../rgw-bucket-details.component.html         |  336 +-
 .../rgw-bucket-form.component.html            | 1193 ++++--
 .../rgw-bucket-lifecycle-list.component.html  |   32 +-
 .../rgw-bucket-list.component.html            |   92 +-
 ...gw-bucket-notification-list.component.html |  101 +-
 .../rgw-bucket-tiering-form.component.html    |  531 +--
 .../rgw-config-details.component.html         |   22 +-
 .../rgw-config-modal.component.html           |  844 ++--
 .../rgw-configuration-page.component.html     |   57 +-
 .../rgw-daemon-details.component.html         |   63 +-
 .../rgw-daemon-list.component.html            |   89 +-
 .../rgw-multisite-details.component.html      |  280 +-
 .../rgw-multisite-export.component.html       |  102 +-
 .../rgw-multisite-import.component.html       |  492 ++-
 .../rgw-multisite-migrate.component.html      |  327 +-
 .../rgw-multisite-realm-form.component.html   |   28 +-
 ...w-multisite-sync-flow-modal.component.html |  193 +-
 ...w-multisite-sync-pipe-modal.component.html |  186 +-
 ...ltisite-sync-policy-details.component.html |   44 +-
 ...-multisite-sync-policy-form.component.html |  142 +-
 .../rgw-multisite-sync-policy.component.html  |   26 +-
 .../rgw-multisite-tabs.component.html         |   26 +-
 .../rgw-multisite-wizard.component.html       |  841 ++--
 .../rgw-multisite-zone-form.component.html    |  184 +-
 ...gw-multisite-zonegroup-form.component.html |  475 ++-
 .../rgw-notification-form.component.html      |  380 +-
 .../rgw-overview-dashboard.component.html     |  300 +-
 .../rgw-rate-limit-details.component.html     |  107 +-
 .../rgw-rate-limit.component.html             |  226 +-
 .../rgw-storage-class-details.component.html  |  491 +--
 .../rgw-storage-class-form.component.html     | 1177 +++---
 .../rgw-storage-class-list.component.html     |   22 +-
 .../rgw-sync-data-info.component.html         |  107 +-
 .../rgw-sync-metadata-info.component.html     |  123 +-
 .../rgw-sync-primary-zone.component.html      |   54 +-
 .../rgw-system-user.component.html            |   64 +-
 .../rgw-topic-details.component.html          |  128 +-
 .../rgw-topic-form.component.html             |  832 ++--
 .../rgw-topic-list.component.html             |   57 +-
 .../rgw-user-accounts-details.component.html  |   53 +-
 .../rgw-user-accounts-form.component.html     |  620 ++-
 .../rgw-user-accounts.component.html          |   47 +-
 .../rgw-user-capability-modal.component.html  |  163 +-
 .../rgw-user-details.component.html           |  224 +-
 .../rgw-user-form.component.html              | 1360 ++++---
 .../rgw-user-list.component.html              |  110 +-
 .../rgw-user-s3-key-modal.component.html      |  200 +-
 .../rgw-user-subuser-modal.component.html     |  198 +-
 .../rgw-user-swift-key-modal.component.html   |   70 +-
 .../rgw-user-tabs.component.html              |   31 +-
 .../device-list/device-list.component.html    |   99 +-
 .../shared/feedback/feedback.component.html   |  153 +-
 .../health-checks.component.html              |   28 +-
 .../smart-list/smart-list.component.html      |  192 +-
 .../smb-cluster-form.component.html           |  426 +-
 .../smb-cluster-list.component.html           |    3 +-
 .../smb-cluster-tabs.component.html           |    4 +-
 .../smb-domain-setting-modal.component.html   |  113 +-
 .../smb-join-auth-form.component.html         |   62 +-
 .../smb-join-auth-list.component.html         |    3 +-
 .../smb-overview/smb-overview.component.html  |    3 +-
 .../smb-share-form.component.html             |  298 +-
 .../smb-share-list.component.html             |   30 +-
 .../ceph/smb/smb-tabs/smb-tabs.component.html |   15 +-
 .../smb-usersgroups-details.component.html    |    3 +-
 .../smb-usersgroups-form.component.html       |  151 +-
 .../smb-usersgroups-list.component.html       |   25 +-
 .../login-password-form.component.html        |  163 +-
 .../app/core/auth/login/login.component.html  |  126 +-
 .../role-details/role-details.component.html  |   18 +-
 .../auth/role-form/role-form.component.html   |  115 +-
 .../auth/role-list/role-list.component.html   |   38 +-
 .../auth/user-form/user-form.component.html   |   78 +-
 .../auth/user-list/user-list.component.html   |   84 +-
 .../user-password-form.component.html         |  143 +-
 .../auth/user-tabs/user-tabs.component.html   |   30 +-
 .../app/core/context/context.component.html   |   61 +-
 .../src/app/core/error/error.component.html   |  134 +-
 .../login-layout/login-layout.component.html  |   29 +-
 .../workbench-layout.component.html           |   45 +-
 .../navigation/about/about.component.html     |   41 +-
 .../administration.component.html             |   55 +-
 .../api-docs/api-docs.component.html          |    7 +-
 .../breadcrumbs/breadcrumbs.component.html    |   18 +-
 .../dashboard-help.component.html             |   77 +-
 .../identity/identity.component.html          |   79 +-
 .../navigation/navigation.component.html      |  732 ++--
 .../notification-area.component.html          |  248 +-
 .../notification-footer.component.html        |    4 +-
 .../notification-header.component.html        |   12 +-
 .../notification-panel.component.html         |    3 +-
 .../notifications-page.component.html         |  186 +-
 .../notifications.component.html              |   32 +-
 .../alert-panel/alert-panel.component.html    |   29 +-
 .../area-chart/area-chart.component.html      |   44 +-
 .../back-button/back-button.component.html    |   18 +-
 .../card-group/card-group.component.html      |   13 +-
 .../card-row/card-row.component.html          |  352 +-
 .../components/card/card.component.html       |   54 +-
 .../cd-label/cd-label.component.html          |   14 +-
 .../code-block/code-block.component.html      |    6 +-
 .../config-option.component.html              |  128 +-
 .../confirmation-modal.component.html         |   47 +-
 .../copy2clipboard-button.component.html      |   30 +-
 .../custom-login-banner.component.html        |    8 +-
 .../date-time-picker.component.html           |   70 +-
 .../delete-confirmation-modal.component.html  |  216 +-
 .../details-card/details-card.component.html  |   62 +-
 .../shared/components/doc/doc.component.html  |    9 +-
 .../download-button.component.html            |   58 +-
 .../empty-state/empty-state.component.html    |   16 +-
 .../form-advanced-fieldset.component.html     |   24 +-
 .../form-button-panel.component.html          |   60 +-
 .../form-modal/form-modal.component.html      |  194 +-
 .../components/grafana/grafana.component.html |  112 +-
 .../help-text/help-text.component.html        |   20 +-
 .../components/helper/helper.component.html   |   43 +-
 .../components/icon/icon.component.html       |    9 +-
 .../inline-message.component.html             |   82 +-
 .../language-selector.component.html          |    1 -
 .../loading-panel.component.html              |   12 +-
 .../components/modal/modal.component.html     |   11 +-
 .../components/motd/motd.component.html       |   14 +-
 .../notification-toast.component.html         |   25 +-
 .../notifications-sidebar.component.html      |  184 +-
 .../number-with-unit.component.html           |    2 +-
 .../orchestrator-doc-panel.component.html     |   19 +-
 .../page-header/page-header.component.html    |    4 +-
 .../performance-card.component.html           |  155 +-
 .../pie-chart/pie-chart.component.html        |    3 +-
 .../productive-card.component.html            |   22 +-
 .../progress/progress.component.html          |   80 +-
 ...pwd-expiration-notification.component.html |   48 +-
 .../select-badges.component.html              |   46 +-
 .../components/select/select.component.html   |  120 +-
 .../setup-step-card.component.html            |   15 +-
 .../side-panel/side-panel.component.html      |   40 +-
 .../sidebar-layout.component.html             |   24 +-
 .../sparkline/sparkline.component.html        |   24 +-
 .../submit-button.component.html              |   30 +-
 .../tearsheet/tearsheet.component.html        |  431 +-
 .../telemetry-notification.component.html     |   35 +-
 .../text-label-list.component.html            |   36 +-
 .../time-picker/time-picker.component.html    |    3 +-
 .../upgradable/upgradable.component.html      |   30 +-
 .../usage-bar/usage-bar.component.html        |   10 +-
 .../vertical-navigation.component.html        |   56 +-
 .../components/wizard/wizard.component.html   |    3 +-
 .../checked-table-form.component.html         |  104 +-
 .../crud-table/crud-table.component.html      |  110 +-
 .../table-actions.component.html              |  133 +-
 .../table-key-value.component.html            |   35 +-
 .../table-pagination.component.html           |    8 +-
 .../datatable/table/table.component.html      | 1199 +++---
 .../forms/crud-form/crud-form.component.html  |   45 +-
 .../formly-array-type.component.html          |   72 +-
 .../formly-file-type.component.html           |    9 +-
 .../formly-input-type.component.html          |    8 +-
 .../formly-input-wrapper.component.html       |   38 +-
 .../formly-object-type.component.html         |   34 +-
 .../formly-textarea-type.component.html       |   19 +-
 .../mgr/dashboard/frontend/src/index.html     |   49 +-
 324 files changed, 32536 insertions(+), 21198 deletions(-)
 delete mode 100644 src/pybind/mgr/dashboard/frontend/.prettierignore

diff --git a/src/pybind/mgr/dashboard/frontend/.prettierignore b/src/pybind/mgr/dashboard/frontend/.prettierignore
deleted file mode 100644
index 2d19fc766d9..00000000000
--- a/src/pybind/mgr/dashboard/frontend/.prettierignore
+++ /dev/null
@@ -1 +0,0 @@
-*.html
diff --git a/src/pybind/mgr/dashboard/frontend/.prettierrc b/src/pybind/mgr/dashboard/frontend/.prettierrc
index d9e92822716..d92e8a2f46d 100644
--- a/src/pybind/mgr/dashboard/frontend/.prettierrc
+++ b/src/pybind/mgr/dashboard/frontend/.prettierrc
@@ -6,6 +6,6 @@
   "tabWidth": 2,
   "useTabs": false,
   "endOfLine": "lf",
-  "singleAttributePerLine": true, 
+  "singleAttributePerLine": true,
   "htmlWhitespaceSensitivity": "css"
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-setting/iscsi-setting.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-setting/iscsi-setting.component.html
index b19941ae0d5..813e3c42bf0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-setting/iscsi-setting.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-setting/iscsi-setting.component.html
@@ -1,57 +1,86 @@
-<div class="form-group"
-     [formGroup]="settingsForm">
-  <label class="col-form-label"
-         for="{{ setting }}">{{ setting }}</label>
-  <select id="{{ setting }}"
-          name="{{ setting }}"
-          *ngIf="limits['type'] === 'enum'"
-          class="form-control"
-          [formControlName]="setting">
+<div
+  class="form-group"
+  [formGroup]="settingsForm"
+>
+  <label
+    class="col-form-label"
+    for="{{ setting }}"
+    >{{ setting }}</label
+  >
+  <select
+    id="{{ setting }}"
+    name="{{ setting }}"
+    *ngIf="limits['type'] === 'enum'"
+    class="form-control"
+    [formControlName]="setting"
+  >
     <option [ngValue]="null"></option>
-    <option *ngFor="let opt of limits['values']"
-            [ngValue]="opt">{{ opt }}</option>
+    <option
+      *ngFor="let opt of limits['values']"
+      [ngValue]="opt"
+    >
+      {{ opt }}
+    </option>
   </select>
 
   <span *ngIf="limits['type'] !== 'enum'">
-    <input type="number"
-           *ngIf="limits['type'] === 'int'"
-           class="form-control"
-           [formControlName]="setting">
+    <input
+      type="number"
+      *ngIf="limits['type'] === 'int'"
+      class="form-control"
+      [formControlName]="setting"
+    />
 
-    <input type="text"
-           *ngIf="limits['type'] === 'str'"
-           class="form-control"
-           [formControlName]="setting">
+    <input
+      type="text"
+      *ngIf="limits['type'] === 'str'"
+      class="form-control"
+      [formControlName]="setting"
+    />
 
     <ng-container *ngIf="limits['type'] === 'bool'">
-      <br>
+      <br />
       <div class="custom-control custom-radio custom-control-inline">
-        <input type="radio"
-               [id]="setting + 'True'"
-               [value]="true"
-               [formControlName]="setting"
-               class="custom-control-input">
-        <label class="custom-control-label"
-               [for]="setting + 'True'">Yes</label>
+        <input
+          type="radio"
+          [id]="setting + 'True'"
+          [value]="true"
+          [formControlName]="setting"
+          class="custom-control-input"
+        />
+        <label
+          class="custom-control-label"
+          [for]="setting + 'True'"
+          >Yes</label
+        >
       </div>
       <div class="custom-control custom-radio custom-control-inline">
-        <input type="radio"
-               [id]="setting + 'False'"
-               [value]="false"
-               class="custom-control-input"
-               [formControlName]="setting">
-        <label class="custom-control-label"
-               [for]="setting + 'False'">No</label>
+        <input
+          type="radio"
+          [id]="setting + 'False'"
+          [value]="false"
+          class="custom-control-input"
+          [formControlName]="setting"
+        />
+        <label
+          class="custom-control-label"
+          [for]="setting + 'False'"
+          >No</label
+        >
       </div>
     </ng-container>
   </span>
 
-  <span class="invalid-feedback"
-        *ngIf="settingsForm.showError(setting, formDir, 'min')">
+  <span
+    class="invalid-feedback"
+    *ngIf="settingsForm.showError(setting, formDir, 'min')"
+  >
     <ng-container i18n>Must be greater than or equal to {{ limits['min'] }}.</ng-container>
   </span>
-  <span class="invalid-feedback"
-        *ngIf="settingsForm.showError(setting, formDir, 'max')">
+  <span
+    class="invalid-feedback"
+    *ngIf="settingsForm.showError(setting, formDir, 'max')"
+  >
     <ng-container i18n>Must be less than or equal to {{ limits['max'] }}.</ng-container>
   </span>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-tabs/iscsi-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-tabs/iscsi-tabs.component.html
index ec4d07e235a..bf8d2d43da6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-tabs/iscsi-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-tabs/iscsi-tabs.component.html
@@ -1,16 +1,22 @@
 <ul class="nav nav-tabs">
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/block/iscsi/overview"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       i18n>Overview</a>
+    <a
+      class="nav-link"
+      routerLink="/block/iscsi/overview"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      i18n
+      >Overview</a
+    >
   </li>
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/block/iscsi/targets"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       i18n>Targets</a>
+    <a
+      class="nav-link"
+      routerLink="/block/iscsi/targets"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      i18n
+      >Targets</a
+    >
   </li>
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-details/iscsi-target-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-details/iscsi-target-details.component.html
index 29937e48cd2..c7c6f0fabe4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-details/iscsi-target-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-details/iscsi-target-details.component.html
@@ -2,40 +2,56 @@
   <div class="col-6 card-tree">
     <legend i18n>iSCSI Topology</legend>
 
-    <cds-tree-view #tree
-                   [tree]="nodes"
-                   (select)="onNodeSelected($event)">
+    <cds-tree-view
+      #tree
+      [tree]="nodes"
+      (select)="onNodeSelected($event)"
+    >
     </cds-tree-view>
-    <ng-template #treeNodeTemplate
-                 let-node>
-                 {{node?.data?.cdIcon}}
-    <svg [cdsIcon]="node?.data?.cdIcon"
-         [size]="icons.size16"
-         ></svg>
+    <ng-template
+      #treeNodeTemplate
+      let-node
+    >
+      {{ node?.data?.cdIcon }}
+      <svg
+        [cdsIcon]="node?.data?.cdIcon"
+        [size]="icons.size16"
+      ></svg>
       <span>{{ node?.name }}</span>
       &nbsp;
-      <cds-tag [class]="{'tag-success': ['logged_in'].includes(node?.status), 'tag-danger': ['logged_out'].includes(node?.status)}">
+      <cds-tag
+        [class]="{
+          'tag-success': ['logged_in'].includes(node?.status),
+          'tag-danger': ['logged_out'].includes(node?.status)
+        }"
+      >
         {{ node?.status }}
       </cds-tag>
     </ng-template>
   </div>
 
-  <div class="col-6 metadata"
-       *ngIf="data">
+  <div
+    class="col-6 metadata"
+    *ngIf="data"
+  >
     <legend>{{ title }}</legend>
 
-    <cd-table #detailTable
-              [data]="data"
-              columnMode="flex"
-              [columns]="columns"
-              [limit]="0">
+    <cd-table
+      #detailTable
+      [data]="data"
+      columnMode="flex"
+      [columns]="columns"
+      [limit]="0"
+    >
     </cd-table>
   </div>
 </div>
 
-<ng-template #highlightTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #highlightTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <span *ngIf="row.default === undefined || row.default === row.current">{{ value }}</span>
   <strong *ngIf="row.default !== undefined && row.default !== row.current">{{ value }}</strong>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html
index 5bf720fe53e..90d700ed378 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html
@@ -1,127 +1,177 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container class="modal-title"
-                i18n>Discovery Authentication</ng-container>
+  <ng-container
+    class="modal-title"
+    i18n
+    >Discovery Authentication</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form name="discoveryForm"
-          #formDir="ngForm"
-          [formGroup]="discoveryForm"
-          novalidate>
+    <form
+      name="discoveryForm"
+      #formDir="ngForm"
+      [formGroup]="discoveryForm"
+      novalidate
+    >
       <div class="modal-body">
         <!-- User -->
         <div class="form-group row">
-          <label class="cd-col-form-label"
-                 for="user"
-                 i18n>User</label>
+          <label
+            class="cd-col-form-label"
+            for="user"
+            i18n
+            >User</label
+          >
           <div class="cd-col-form-input">
-            <input id="user"
-                   class="form-control"
-                   formControlName="user"
-                   type="text"
-                   autocomplete="off">
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('user', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <input
+              id="user"
+              class="form-control"
+              formControlName="user"
+              type="text"
+              autocomplete="off"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('user', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('user', formDir, 'pattern')"
-                  i18n>User names must have a length of 8 to 64 characters and can contain
-              alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('user', formDir, 'pattern')"
+              i18n
+              >User names must have a length of 8 to 64 characters and can contain alphanumeric
+              characters, '.', '&#64;', '-', '_' or ':'.</span
+            >
           </div>
         </div>
 
         <!-- Password -->
         <div class="form-group row">
-          <label class="cd-col-form-label"
-                 for="password"
-                 i18n>Password</label>
+          <label
+            class="cd-col-form-label"
+            for="password"
+            i18n
+            >Password</label
+          >
           <div class="cd-col-form-input">
             <div class="input-group">
-              <input id="password"
-                     class="form-control"
-                     formControlName="password"
-                     type="password"
-                     autocomplete="new-password">
+              <input
+                id="password"
+                class="form-control"
+                formControlName="password"
+                type="password"
+                autocomplete="new-password"
+              />
 
-              <button type="button"
-                      class="btn btn-light"
-                      cdPasswordButton="password">
-              </button>
-              <cd-copy-2-clipboard-button source="password">
-              </cd-copy-2-clipboard-button>
+              <button
+                type="button"
+                class="btn btn-light"
+                cdPasswordButton="password"
+              ></button>
+              <cd-copy-2-clipboard-button source="password"> </cd-copy-2-clipboard-button>
             </div>
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('password', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('password', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('password', formDir, 'pattern')"
-                  i18n>Passwords must have a length of 12 to 16 characters and can contain
-              alphanumeric characters, '&#64;', '-', '_' or '/'.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('password', formDir, 'pattern')"
+              i18n
+              >Passwords must have a length of 12 to 16 characters and can contain alphanumeric
+              characters, '&#64;', '-', '_' or '/'.</span
+            >
           </div>
         </div>
 
         <!-- mutual_user -->
         <div class="form-group row">
-          <label class="cd-col-form-label"
-                 for="mutual_user">
+          <label
+            class="cd-col-form-label"
+            for="mutual_user"
+          >
             <ng-container i18n>Mutual User</ng-container>
           </label>
           <div class="cd-col-form-input">
-            <input id="mutual_user"
-                   class="form-control"
-                   formControlName="mutual_user"
-                   type="text"
-                   autocomplete="off">
+            <input
+              id="mutual_user"
+              class="form-control"
+              formControlName="mutual_user"
+              type="text"
+              autocomplete="off"
+            />
 
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('mutual_user', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('mutual_user', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('mutual_user', formDir, 'pattern')"
-                  i18n>User names must have a length of 8 to 64 characters and can contain
-              alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('mutual_user', formDir, 'pattern')"
+              i18n
+              >User names must have a length of 8 to 64 characters and can contain alphanumeric
+              characters, '.', '&#64;', '-', '_' or ':'.</span
+            >
           </div>
         </div>
 
         <!-- mutual_password -->
         <div class="form-group row">
-          <label class="cd-col-form-label"
-                 for="mutual_password"
-                 i18n>Mutual Password</label>
+          <label
+            class="cd-col-form-label"
+            for="mutual_password"
+            i18n
+            >Mutual Password</label
+          >
           <div class="cd-col-form-input">
             <div class="input-group">
-              <input id="mutual_password"
-                     class="form-control"
-                     formControlName="mutual_password"
-                     type="password"
-                     autocomplete="new-password">
+              <input
+                id="mutual_password"
+                class="form-control"
+                formControlName="mutual_password"
+                type="password"
+                autocomplete="new-password"
+              />
 
-              <button type="button"
-                      class="btn btn-light"
-                      cdPasswordButton="mutual_password">
-              </button>
-              <cd-copy-2-clipboard-button source="mutual_password">
-              </cd-copy-2-clipboard-button>
+              <button
+                type="button"
+                class="btn btn-light"
+                cdPasswordButton="mutual_password"
+              ></button>
+              <cd-copy-2-clipboard-button source="mutual_password"> </cd-copy-2-clipboard-button>
             </div>
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('mutual_password', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('mutual_password', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="discoveryForm.showError('mutual_password', formDir, 'pattern')"
-                  i18n>Passwords must have a length of 12 to 16 characters and can contain
-              alphanumeric characters, '&#64;', '-', '_' or '/'.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="discoveryForm.showError('mutual_password', formDir, 'pattern')"
+              i18n
+              >Passwords must have a length of 12 to 16 characters and can contain alphanumeric
+              characters, '&#64;', '-', '_' or '/'.</span
+            >
           </div>
         </div>
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="submitAction()"
-                              [form]="discoveryForm"
-                              [showSubmit]="hasPermission"
-                              [submitText]="actionLabels.SUBMIT"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="submitAction()"
+          [form]="discoveryForm"
+          [showSubmit]="hasPermission"
+          [submitText]="actionLabels.SUBMIT"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
index 694eeb3c64c..50411519940 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
@@ -1,111 +1,160 @@
-<div class="cd-col-form"
-     *cdFormLoading="loading">
-  <form name="targetForm"
-        #formDir="ngForm"
-        [formGroup]="targetForm"
-        novalidate>
+<div
+  class="cd-col-form"
+  *cdFormLoading="loading"
+>
+  <form
+    name="targetForm"
+    #formDir="ngForm"
+    [formGroup]="targetForm"
+    novalidate
+  >
     <div class="card">
-      <div i18n="form title"
-           class="card-header">{{ action | titlecase }} {{ resource | upperFirst }}</div>
+      <div
+        i18n="form title"
+        class="card-header"
+      >
+        {{ action | titlecase }} {{ resource | upperFirst }}
+      </div>
 
       <div class="card-body">
         <!-- Target IQN -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="target_iqn"
-                 i18n>Target IQN</label>
+          <label
+            class="cd-col-form-label required"
+            for="target_iqn"
+            i18n
+            >Target IQN</label
+          >
           <div class="cd-col-form-input">
             <div class="input-group">
-              <input class="form-control"
-                     type="text"
-                     id="target_iqn"
-                     name="target_iqn"
-                     formControlName="target_iqn"
-                     cdTrim />
-              <button class="btn btn-light"
-                      id="ecp-info-button"
-                      type="button"
-                      (click)="targetSettingsModal()">
-                <svg [cdsIcon]="icons.deepCheck"
-                     [size]="icons.size16"
-                     ></svg>
+              <input
+                class="form-control"
+                type="text"
+                id="target_iqn"
+                name="target_iqn"
+                formControlName="target_iqn"
+                cdTrim
+              />
+              <button
+                class="btn btn-light"
+                id="ecp-info-button"
+                type="button"
+                (click)="targetSettingsModal()"
+              >
+                <svg
+                  [cdsIcon]="icons.deepCheck"
+                  [size]="icons.size16"
+                ></svg>
               </button>
             </div>
 
-            <span class="invalid-feedback"
-                  *ngIf="targetForm.showError('target_iqn', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="targetForm.showError('target_iqn', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="targetForm.showError('target_iqn', formDir, 'pattern')"
-                  i18n>IQN has wrong pattern.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="targetForm.showError('target_iqn', formDir, 'pattern')"
+              i18n
+              >IQN has wrong pattern.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="targetForm.showError('target_iqn', formDir, 'iqn')">
-              <ng-container i18n>An IQN has the following notation
-                'iqn.$year-$month.$reversedAddress:$definedName'</ng-container>
-              <br>
-              <ng-container i18n>For example: iqn.2016-06.org.dashboard:storage:disk.sn-a8675309</ng-container>
-              <br>
-              <a target="_blank"
-                 href="https://en.wikipedia.org/wiki/ISCSI#Addressing"
-                 i18n>More information</a>
+            <span
+              class="invalid-feedback"
+              *ngIf="targetForm.showError('target_iqn', formDir, 'iqn')"
+            >
+              <ng-container i18n
+                >An IQN has the following notation
+                'iqn.$year-$month.$reversedAddress:$definedName'</ng-container
+              >
+              <br />
+              <ng-container i18n
+                >For example: iqn.2016-06.org.dashboard:storage:disk.sn-a8675309</ng-container
+              >
+              <br />
+              <a
+                target="_blank"
+                href="https://en.wikipedia.org/wiki/ISCSI#Addressing"
+                i18n
+                >More information</a
+              >
             </span>
 
-            <span class="form-text text-muted"
-                  *ngIf="hasAdvancedSettings(targetForm.getValue('target_controls'))"
-                  i18n>This target has modified advanced settings.</span>
+            <span
+              class="form-text text-muted"
+              *ngIf="hasAdvancedSettings(targetForm.getValue('target_controls'))"
+              i18n
+              >This target has modified advanced settings.</span
+            >
             <hr />
           </div>
         </div>
 
         <!-- Portals -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="portals"
-                 i18n>Portals</label>
+          <label
+            class="cd-col-form-label required"
+            for="portals"
+            i18n
+            >Portals</label
+          >
           <div class="cd-col-form-input">
-
             <ng-container *ngFor="let portal of portals.value; let i = index">
               <div class="input-group cd-mb">
-                <input class="cd-form-control"
-                       type="text"
-                       [value]="portal"
-                       disabled />
-                <button class="btn btn-light"
-                        type="button"
-                        (click)="removePortal(i, portal)">
-                  <svg [cdsIcon]="icons.destroy"
-                       [size]="icons.size16"
-                       ></svg>
+                <input
+                  class="cd-form-control"
+                  type="text"
+                  [value]="portal"
+                  disabled
+                />
+                <button
+                  class="btn btn-light"
+                  type="button"
+                  (click)="removePortal(i, portal)"
+                >
+                  <svg
+                    [cdsIcon]="icons.destroy"
+                    [size]="icons.size16"
+                  ></svg>
                 </button>
               </div>
             </ng-container>
 
             <div class="row">
               <div class="col-md-12">
-                <cd-select [data]="portals.value"
-                           [options]="portalsSelections"
-                           [messages]="messages.portals"
-                           (selection)="onPortalSelection($event)"
-                           elemClass="btn btn-light float-end">
-                  <svg [cdsIcon]="icons.add"
-                       [size]="icons.size16"
-                       ></svg>
+                <cd-select
+                  [data]="portals.value"
+                  [options]="portalsSelections"
+                  [messages]="messages.portals"
+                  (selection)="onPortalSelection($event)"
+                  elemClass="btn btn-light float-end"
+                >
+                  <svg
+                    [cdsIcon]="icons.add"
+                    [size]="icons.size16"
+                  ></svg>
                   <ng-container i18n>Add portal</ng-container>
                 </cd-select>
               </div>
             </div>
 
-            <input class="form-control"
-                   type="hidden"
-                   id="portals"
-                   name="portals"
-                   formControlName="portals" />
+            <input
+              class="form-control"
+              type="hidden"
+              id="portals"
+              name="portals"
+              formControlName="portals"
+            />
 
-            <span class="invalid-feedback"
-                  *ngIf="targetForm.showError('portals', formDir, 'minGateways')"
-                  i18n>At least {{ minimum_gateways }} gateways are required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="targetForm.showError('portals', formDir, 'minGateways')"
+              i18n
+              >At least {{ minimum_gateways }} gateways are required.</span
+            >
 
             <hr />
           </div>
@@ -113,68 +162,102 @@
 
         <!-- Images -->
         <div class="form-group row">
-          <label class="cd-col-form-label"
-                 for="disks"
-                 i18n>Images</label>
+          <label
+            class="cd-col-form-label"
+            for="disks"
+            i18n
+            >Images</label
+          >
           <div class="cd-col-form-input">
             <ng-container *ngFor="let image of targetForm.getValue('disks'); let i = index">
               <div class="input-group cd-mb">
-                <input class="cd-form-control"
-                       type="text"
-                       [value]="image"
-                       disabled />
-                <div class="input-group-text"
-                     *ngIf="api_version >= 1">lun: {{ imagesSettings[image]['lun'] }}</div>
-                <button class="btn btn-light"
-                        type="button"
-                        (click)="imageSettingsModal(image)">
-                  <svg [cdsIcon]="icons.deepCheck"
-                       [size]="icons.size16"
-                       ></svg>
+                <input
+                  class="cd-form-control"
+                  type="text"
+                  [value]="image"
+                  disabled
+                />
+                <div
+                  class="input-group-text"
+                  *ngIf="api_version >= 1"
+                >
+                  lun: {{ imagesSettings[image]['lun'] }}
+                </div>
+                <button
+                  class="btn btn-light"
+                  type="button"
+                  (click)="imageSettingsModal(image)"
+                >
+                  <svg
+                    [cdsIcon]="icons.deepCheck"
+                    [size]="icons.size16"
+                  ></svg>
                 </button>
-                <button class="btn btn-light"
-                        type="button"
-                        (click)="removeImage(i, image)">
-                  <svg [cdsIcon]="icons.destroy"
-                       [size]="icons.size16"
-                       ></svg>
+                <button
+                  class="btn btn-light"
+                  type="button"
+                  (click)="removeImage(i, image)"
+                >
+                  <svg
+                    [cdsIcon]="icons.destroy"
+                    [size]="icons.size16"
+                  ></svg>
                 </button>
-
               </div>
 
               <span class="form-text text-muted">
-                <ng-container *ngIf="backstores.length > 1"
-                              i18n>Backstore: {{ imagesSettings[image].backstore | iscsiBackstore }}.&nbsp;</ng-container>
+                <ng-container
+                  *ngIf="backstores.length > 1"
+                  i18n
+                  >Backstore:
+                  {{ imagesSettings[image].backstore | iscsiBackstore }}.&nbsp;</ng-container
+                >
 
-                <ng-container *ngIf="hasAdvancedSettings(imagesSettings[image][imagesSettings[image].backstore])"
-                              i18n>This image has modified settings.</ng-container>
+                <ng-container
+                  *ngIf="
+                    hasAdvancedSettings(imagesSettings[image][imagesSettings[image].backstore])
+                  "
+                  i18n
+                  >This image has modified settings.</ng-container
+                >
               </span>
             </ng-container>
 
-            <input class="form-control"
-                   type="hidden"
-                   id="disks"
-                   name="disks"
-                   formControlName="disks" />
+            <input
+              class="form-control"
+              type="hidden"
+              id="disks"
+              name="disks"
+              formControlName="disks"
+            />
 
-            <span class="invalid-feedback"
-                  *ngIf="targetForm.showError('disks', formDir, 'dupLunId')"
-                  i18n>Duplicated LUN numbers.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="targetForm.showError('disks', formDir, 'dupLunId')"
+              i18n
+              >Duplicated LUN numbers.</span
+            >
 
-            <span class="invalid-feedback"
-                  *ngIf="targetForm.showError('disks', formDir, 'dupWwn')"
-                  i18n>Duplicated WWN.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="targetForm.showError('disks', formDir, 'dupWwn')"
+              i18n
+              >Duplicated WWN.</span
+            >
 
             <div class="row">
               <div class="col-md-12">
-                <cd-select [data]="disks.value"
-                           [options]="imagesSelections"
-                           [messages]="messages.images"
-                           (selection)="onImageSelection($event)"
-                           elemClass="btn btn-light float-end">
-                  <svg [cdsIcon]="icons.add"
-                       [size]="icons.size16"
-                       ></svg>
+                <cd-select
+                  [data]="disks.value"
+                  [options]="imagesSelections"
+                  [messages]="messages.images"
+                  (selection)="onImageSelection($event)"
+                  elemClass="btn btn-light float-end"
+                >
+                  <svg
+                    [cdsIcon]="icons.add"
+                    [size]="icons.size16"
+                  ></svg>
                   <ng-container i18n>Add image</ng-container>
                 </cd-select>
               </div>
@@ -188,14 +271,19 @@
         <div class="form-group row">
           <div class="cd-col-form-offset">
             <div class="custom-control custom-checkbox">
-              <input type="checkbox"
-                     class="custom-control-input"
-                     formControlName="acl_enabled"
-                     name="acl_enabled"
-                     id="acl_enabled">
-              <label for="acl_enabled"
-                     class="custom-control-label"
-                     i18n>ACL authentication</label>
+              <input
+                type="checkbox"
+                class="custom-control-input"
+                formControlName="acl_enabled"
+                name="acl_enabled"
+                id="acl_enabled"
+              />
+              <label
+                for="acl_enabled"
+                class="custom-control-label"
+                i18n
+                >ACL authentication</label
+              >
             </div>
 
             <hr />
@@ -203,319 +291,444 @@
         </div>
 
         <!-- Target level authentication was introduced in ceph-iscsi config v11 -->
-        <div formGroupName="auth"
-             *ngIf="cephIscsiConfigVersion > 10 && !targetForm.getValue('acl_enabled')">
-
+        <div
+          formGroupName="auth"
+          *ngIf="cephIscsiConfigVersion > 10 && !targetForm.getValue('acl_enabled')"
+        >
           <!-- Target user -->
           <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="target_user">
+            <label
+              class="cd-col-form-label"
+              for="target_user"
+            >
               <ng-container i18n>User</ng-container>
             </label>
             <div class="cd-col-form-input">
-              <input class="form-control"
-                     type="text"
-                     autocomplete="off"
-                     id="target_user"
-                     name="target_user"
-                     formControlName="user" />
+              <input
+                class="form-control"
+                type="text"
+                autocomplete="off"
+                id="target_user"
+                name="target_user"
+                formControlName="user"
+              />
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('user', formDir, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('user', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('user', formDir, 'pattern')"
-                    i18n>User names must have a length of 8 to 64 characters and can contain
-                alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('user', formDir, 'pattern')"
+                i18n
+                >User names must have a length of 8 to 64 characters and can contain alphanumeric
+                characters, '.', '&#64;', '-', '_' or ':'.</span
+              >
             </div>
           </div>
 
           <!-- Target password -->
           <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="target_password">
+            <label
+              class="cd-col-form-label"
+              for="target_password"
+            >
               <ng-container i18n>Password</ng-container>
             </label>
             <div class="cd-col-form-input">
               <div class="input-group">
-                <input class="form-control"
-                       type="password"
-                       autocomplete="new-password"
-                       id="target_password"
-                       name="target_password"
-                       formControlName="password" />
-                <button type="button"
-                        class="btn btn-light"
-                        cdPasswordButton="target_password">
-                </button>
-                <cd-copy-2-clipboard-button source="target_password">
-                </cd-copy-2-clipboard-button>
+                <input
+                  class="form-control"
+                  type="password"
+                  autocomplete="new-password"
+                  id="target_password"
+                  name="target_password"
+                  formControlName="password"
+                />
+                <button
+                  type="button"
+                  class="btn btn-light"
+                  cdPasswordButton="target_password"
+                ></button>
+                <cd-copy-2-clipboard-button source="target_password"> </cd-copy-2-clipboard-button>
               </div>
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('password', formDir, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('password', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('password', formDir, 'pattern')"
-                    i18n>Passwords must have a length of 12 to 16 characters and can contain
-                alphanumeric characters, '&#64;', '-', '_' or '/'.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('password', formDir, 'pattern')"
+                i18n
+                >Passwords must have a length of 12 to 16 characters and can contain alphanumeric
+                characters, '&#64;', '-', '_' or '/'.</span
+              >
             </div>
           </div>
 
           <!-- Target mutual_user -->
           <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="target_mutual_user">
+            <label
+              class="cd-col-form-label"
+              for="target_mutual_user"
+            >
               <ng-container i18n>Mutual User</ng-container>
             </label>
             <div class="cd-col-form-input">
-              <input class="form-control"
-                     type="text"
-                     autocomplete="off"
-                     id="target_mutual_user"
-                     name="target_mutual_user"
-                     formControlName="mutual_user" />
+              <input
+                class="form-control"
+                type="text"
+                autocomplete="off"
+                id="target_mutual_user"
+                name="target_mutual_user"
+                formControlName="mutual_user"
+              />
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('mutual_user', formDir, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('mutual_user', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('mutual_user', formDir, 'pattern')"
-                    i18n>User names must have a length of 8 to 64 characters and can contain
-                alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('mutual_user', formDir, 'pattern')"
+                i18n
+                >User names must have a length of 8 to 64 characters and can contain alphanumeric
+                characters, '.', '&#64;', '-', '_' or ':'.</span
+              >
             </div>
           </div>
 
           <!-- Target mutual_password -->
           <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="target_mutual_password">
+            <label
+              class="cd-col-form-label"
+              for="target_mutual_password"
+            >
               <ng-container i18n>Mutual Password</ng-container>
             </label>
             <div class="cd-col-form-input">
               <div class="input-group">
-                <input class="form-control"
-                       type="password"
-                       autocomplete="new-password"
-                       id="target_mutual_password"
-                       name="target_mutual_password"
-                       formControlName="mutual_password" />
+                <input
+                  class="form-control"
+                  type="password"
+                  autocomplete="new-password"
+                  id="target_mutual_password"
+                  name="target_mutual_password"
+                  formControlName="mutual_password"
+                />
 
-                <button type="button"
-                        class="btn btn-light"
-                        cdPasswordButton="target_mutual_password">
-                </button>
+                <button
+                  type="button"
+                  class="btn btn-light"
+                  cdPasswordButton="target_mutual_password"
+                ></button>
                 <cd-copy-2-clipboard-button source="target_mutual_password">
                 </cd-copy-2-clipboard-button>
               </div>
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('mutual_password', formDir, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('mutual_password', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
 
-              <span class="invalid-feedback"
-                    *ngIf="targetForm.showError('mutual_password', formDir, 'pattern')"
-                    i18n>Passwords must have a length of 12 to 16 characters and can contain
-                alphanumeric characters, '&#64;', '-', '_' or '/'.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="targetForm.showError('mutual_password', formDir, 'pattern')"
+                i18n
+                >Passwords must have a length of 12 to 16 characters and can contain alphanumeric
+                characters, '&#64;', '-', '_' or '/'.</span
+              >
             </div>
           </div>
-
         </div>
 
         <!-- Initiators -->
-        <div class="form-group row"
-             *ngIf="targetForm.getValue('acl_enabled')">
-          <label class="cd-col-form-label"
-                 for="initiators"
-                 i18n>Initiators</label>
-          <div class="cd-col-form-input"
-               formArrayName="initiators">
-            <div class="card mb-2"
-                 *ngFor="let initiator of initiators.controls; let ii = index"
-                 [formGroup]="initiator">
+        <div
+          class="form-group row"
+          *ngIf="targetForm.getValue('acl_enabled')"
+        >
+          <label
+            class="cd-col-form-label"
+            for="initiators"
+            i18n
+            >Initiators</label
+          >
+          <div
+            class="cd-col-form-input"
+            formArrayName="initiators"
+          >
+            <div
+              class="card mb-2"
+              *ngFor="let initiator of initiators.controls; let ii = index"
+              [formGroup]="initiator"
+            >
               <div class="card-header">
                 <ng-container i18n>Initiator</ng-container>: {{ initiator.getValue('client_iqn') }}
-                <button type="button"
-                        class="btn-close float-end"
-                        (click)="removeInitiator(ii)">
-                </button>
+                <button
+                  type="button"
+                  class="btn-close float-end"
+                  (click)="removeInitiator(ii)"
+                ></button>
               </div>
               <div class="card-body">
                 <!-- Initiator: Name -->
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="client_iqn"
-                         i18n>Client IQN</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="client_iqn"
+                    i18n
+                    >Client IQN</label
+                  >
                   <div class="cd-col-form-input">
-                    <input class="form-control"
-                           type="text"
-                           formControlName="client_iqn"
-                           cdTrim
-                           (blur)="updatedInitiatorSelector()">
+                    <input
+                      class="form-control"
+                      type="text"
+                      formControlName="client_iqn"
+                      cdTrim
+                      (blur)="updatedInitiatorSelector()"
+                    />
 
-                    <span class="invalid-feedback"
-                          *ngIf="initiator.showError('client_iqn', formDir, 'notUnique')"
-                          i18n>Initiator IQN needs to be unique.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="initiator.showError('client_iqn', formDir, 'notUnique')"
+                      i18n
+                      >Initiator IQN needs to be unique.</span
+                    >
 
-                    <span class="invalid-feedback"
-                          *ngIf="initiator.showError('client_iqn', formDir, 'required')"
-                          i18n>This field is required.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="initiator.showError('client_iqn', formDir, 'required')"
+                      i18n
+                      >This field is required.</span
+                    >
 
-                    <span class="invalid-feedback"
-                          *ngIf="initiator.showError('client_iqn', formDir, 'pattern')"
-                          i18n>IQN has wrong pattern.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="initiator.showError('client_iqn', formDir, 'pattern')"
+                      i18n
+                      >IQN has wrong pattern.</span
+                    >
                   </div>
                 </div>
 
                 <ng-container formGroupName="auth">
                   <!-- Initiator: User -->
                   <div class="form-group row">
-                    <label class="cd-col-form-label"
-                           for="user"
-                           i18n>User</label>
+                    <label
+                      class="cd-col-form-label"
+                      for="user"
+                      i18n
+                      >User</label
+                    >
                     <div class="cd-col-form-input">
-                      <input [id]="'user' + ii"
-                             class="form-control"
-                             formControlName="user"
-                             autocomplete="off"
-                             type="text">
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('user', formDir, 'required')"
-                            i18n>This field is required.</span>
+                      <input
+                        [id]="'user' + ii"
+                        class="form-control"
+                        formControlName="user"
+                        autocomplete="off"
+                        type="text"
+                      />
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('user', formDir, 'required')"
+                        i18n
+                        >This field is required.</span
+                      >
 
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('user', formDir, 'pattern')"
-                            i18n>User names must have a length of 8 to 64 characters and can contain
-                        alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('user', formDir, 'pattern')"
+                        i18n
+                        >User names must have a length of 8 to 64 characters and can contain
+                        alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span
+                      >
                     </div>
                   </div>
 
                   <!-- Initiator: Password -->
                   <div class="form-group row">
-                    <label class="cd-col-form-label"
-                           for="password"
-                           i18n>Password</label>
+                    <label
+                      class="cd-col-form-label"
+                      for="password"
+                      i18n
+                      >Password</label
+                    >
                     <div class="cd-col-form-input">
                       <div class="input-group">
-                        <input [id]="'password' + ii"
-                               class="form-control"
-                               formControlName="password"
-                               autocomplete="new-password"
-                               type="password">
+                        <input
+                          [id]="'password' + ii"
+                          class="form-control"
+                          formControlName="password"
+                          autocomplete="new-password"
+                          type="password"
+                        />
 
-                        <button type="button"
-                                class="btn btn-light"
-                                [cdPasswordButton]="'password' + ii">
-                        </button>
+                        <button
+                          type="button"
+                          class="btn btn-light"
+                          [cdPasswordButton]="'password' + ii"
+                        ></button>
                         <cd-copy-2-clipboard-button [source]="'password' + ii">
                         </cd-copy-2-clipboard-button>
                       </div>
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('password', formDir, 'required')"
-                            i18n>This field is required.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('password', formDir, 'required')"
+                        i18n
+                        >This field is required.</span
+                      >
 
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('password', formDir, 'pattern')"
-                            i18n>Passwords must have a length of 12 to 16 characters and can contain
-                        alphanumeric characters, '&#64;', '-', '_' or '/'.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('password', formDir, 'pattern')"
+                        i18n
+                        >Passwords must have a length of 12 to 16 characters and can contain
+                        alphanumeric characters, '&#64;', '-', '_' or '/'.</span
+                      >
                     </div>
                   </div>
 
-
                   <!-- Initiator: mutual_user -->
                   <div class="form-group row">
-                    <label class="cd-col-form-label"
-                           for="mutual_user">
+                    <label
+                      class="cd-col-form-label"
+                      for="mutual_user"
+                    >
                       <ng-container i18n>Mutual User</ng-container>
                     </label>
                     <div class="cd-col-form-input">
-                      <input [id]="'mutual_user' + ii"
-                             class="form-control"
-                             formControlName="mutual_user"
-                             autocomplete="off"
-                             type="text">
+                      <input
+                        [id]="'mutual_user' + ii"
+                        class="form-control"
+                        formControlName="mutual_user"
+                        autocomplete="off"
+                        type="text"
+                      />
 
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('mutual_user', formDir, 'required')"
-                            i18n>This field is required.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('mutual_user', formDir, 'required')"
+                        i18n
+                        >This field is required.</span
+                      >
 
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('mutual_user', formDir, 'pattern')"
-                            i18n>User names must have a length of 8 to 64 characters and can contain
-                        alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('mutual_user', formDir, 'pattern')"
+                        i18n
+                        >User names must have a length of 8 to 64 characters and can contain
+                        alphanumeric characters, '.', '&#64;', '-', '_' or ':'.</span
+                      >
                     </div>
                   </div>
 
                   <!-- Initiator: mutual_password -->
                   <div class="form-group row">
-                    <label class="cd-col-form-label"
-                           for="mutual_password"
-                           i18n>Mutual Password</label>
+                    <label
+                      class="cd-col-form-label"
+                      for="mutual_password"
+                      i18n
+                      >Mutual Password</label
+                    >
                     <div class="cd-col-form-input">
                       <div class="input-group">
-                        <input [id]="'mutual_password' + ii"
-                               class="form-control"
-                               formControlName="mutual_password"
-                               autocomplete="new-password"
-                               type="password">
+                        <input
+                          [id]="'mutual_password' + ii"
+                          class="form-control"
+                          formControlName="mutual_password"
+                          autocomplete="new-password"
+                          type="password"
+                        />
 
-                        <button type="button"
-                                class="btn btn-light"
-                                [cdPasswordButton]="'mutual_password' + ii">
-                        </button>
+                        <button
+                          type="button"
+                          class="btn btn-light"
+                          [cdPasswordButton]="'mutual_password' + ii"
+                        ></button>
                         <cd-copy-2-clipboard-button [source]="'mutual_password' + ii">
                         </cd-copy-2-clipboard-button>
                       </div>
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('mutual_password', formDir, 'required')"
-                            i18n>This field is required.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('mutual_password', formDir, 'required')"
+                        i18n
+                        >This field is required.</span
+                      >
 
-                      <span class="invalid-feedback"
-                            *ngIf="initiator.showError('mutual_password', formDir, 'pattern')"
-                            i18n>Passwords must have a length of 12 to 16 characters and can contain
-                        alphanumeric characters, '&#64;', '-', '_' or '/'.</span>
+                      <span
+                        class="invalid-feedback"
+                        *ngIf="initiator.showError('mutual_password', formDir, 'pattern')"
+                        i18n
+                        >Passwords must have a length of 12 to 16 characters and can contain
+                        alphanumeric characters, '&#64;', '-', '_' or '/'.</span
+                      >
                     </div>
                   </div>
                 </ng-container>
 
                 <!-- Initiator: Images -->
                 <div class="form-group row">
-                  <label class="cd-col-form-label"
-                         for="luns"
-                         i18n>Images</label>
+                  <label
+                    class="cd-col-form-label"
+                    for="luns"
+                    i18n
+                    >Images</label
+                  >
                   <div class="cd-col-form-input">
                     <ng-container *ngFor="let image of initiator.getValue('luns'); let li = index">
                       <div class="input-group cd-mb">
-                        <input class="cd-form-control"
-                               type="text"
-                               [value]="image"
-                               disabled />
-                        <button class="btn btn-light"
-                                type="button"
-                                (click)="removeInitiatorImage(initiator, li, ii, image)">
-                          <svg [cdsIcon]="icons.destroy"
-                               [size]="icons.size16"
-                               ></svg>
+                        <input
+                          class="cd-form-control"
+                          type="text"
+                          [value]="image"
+                          disabled
+                        />
+                        <button
+                          class="btn btn-light"
+                          type="button"
+                          (click)="removeInitiatorImage(initiator, li, ii, image)"
+                        >
+                          <svg
+                            [cdsIcon]="icons.destroy"
+                            [size]="icons.size16"
+                          ></svg>
                         </button>
                       </div>
                     </ng-container>
 
-                    <span *ngIf="initiator.getValue('cdIsInGroup')"
-                          i18n>Initiator belongs to a group. Images will be configure in the group.</span>
+                    <span
+                      *ngIf="initiator.getValue('cdIsInGroup')"
+                      i18n
+                      >Initiator belongs to a group. Images will be configure in the group.</span
+                    >
 
-                    <div class="row"
-                         *ngIf="!initiator.getValue('cdIsInGroup')">
+                    <div
+                      class="row"
+                      *ngIf="!initiator.getValue('cdIsInGroup')"
+                    >
                       <div class="col-md-12">
-                        <cd-select [data]="initiator.getValue('luns')"
-                                   [options]="imagesInitiatorSelections[ii]"
-                                   [messages]="messages.initiatorImage"
-                                   elemClass="btn btn-light float-end">
-                          <svg [cdsIcon]="icons.add"
-                               [size]="icons.size16"
-                               ></svg>
+                        <cd-select
+                          [data]="initiator.getValue('luns')"
+                          [options]="imagesInitiatorSelections[ii]"
+                          [messages]="messages.initiatorImage"
+                          elemClass="btn btn-light float-end"
+                        >
+                          <svg
+                            [cdsIcon]="icons.add"
+                            [size]="icons.size16"
+                          ></svg>
                           <ng-container i18n>Add image</ng-container>
                         </cd-select>
                       </div>
@@ -527,16 +740,22 @@
 
             <div class="row">
               <div class="col-md-12">
-                <span class="form-text text-muted"
-                      *ngIf="initiators.controls.length === 0"
-                      i18n>No items added.</span>
+                <span
+                  class="form-text text-muted"
+                  *ngIf="initiators.controls.length === 0"
+                  i18n
+                  >No items added.</span
+                >
 
-                <button (click)="addInitiator(); false"
-                        class="btn btn-light float-end"
-                        type="button">
-                  <svg [cdsIcon]="icons.add"
-                       [size]="icons.size16"
-                       ></svg>
+                <button
+                  (click)="addInitiator(); (false)"
+                  class="btn btn-light float-end"
+                  type="button"
+                >
+                  <svg
+                    [cdsIcon]="icons.add"
+                    [size]="icons.size16"
+                  ></svg>
                   <ng-container i18n>Add initiator</ng-container>
                 </button>
               </div>
@@ -547,69 +766,94 @@
         </div>
 
         <!-- Groups -->
-        <div class="form-group row"
-             *ngIf="targetForm.getValue('acl_enabled')">
-          <label class="cd-col-form-label"
-                 for="initiators"
-                 i18n>Groups</label>
-          <div class="cd-col-form-input"
-               formArrayName="groups">
-            <div class="card mb-2"
-                 *ngFor="let group of groups.controls; let gi = index"
-                 [formGroup]="group">
+        <div
+          class="form-group row"
+          *ngIf="targetForm.getValue('acl_enabled')"
+        >
+          <label
+            class="cd-col-form-label"
+            for="initiators"
+            i18n
+            >Groups</label
+          >
+          <div
+            class="cd-col-form-input"
+            formArrayName="groups"
+          >
+            <div
+              class="card mb-2"
+              *ngFor="let group of groups.controls; let gi = index"
+              [formGroup]="group"
+            >
               <div class="card-header">
                 <ng-container i18n>Group</ng-container>: {{ group.getValue('group_id') }}
-                <button type="button"
-                        class="btn-close float-end"
-                        (click)="removeGroup(gi)">
-                </button>
+                <button
+                  type="button"
+                  class="btn-close float-end"
+                  (click)="removeGroup(gi)"
+                ></button>
               </div>
               <div class="card-body">
                 <!-- Group: group_id -->
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="group_id"
-                         i18n>Name</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="group_id"
+                    i18n
+                    >Name</label
+                  >
                   <div class="cd-col-form-input">
-                    <input class="form-control"
-                           type="text"
-                           formControlName="group_id">
+                    <input
+                      class="form-control"
+                      type="text"
+                      formControlName="group_id"
+                    />
                   </div>
                 </div>
 
                 <!-- Group: members -->
                 <div class="form-group row">
-                  <label class="cd-col-form-label"
-                         for="members">
+                  <label
+                    class="cd-col-form-label"
+                    for="members"
+                  >
                     <ng-container i18n>Initiators</ng-container>
                   </label>
                   <div class="cd-col-form-input">
                     <ng-container *ngFor="let member of group.getValue('members'); let i = index">
                       <div class="input-group cd-mb">
-                        <input class="cd-form-control"
-                               type="text"
-                               [value]="member"
-                               disabled />
-                        <button class="btn btn-light"
-                                type="button"
-                                (click)="removeGroupInitiator(group, i, gi)">
-                          <svg [cdsIcon]="icons.destroy"
-                               [size]="icons.size16"
-                               ></svg>
+                        <input
+                          class="cd-form-control"
+                          type="text"
+                          [value]="member"
+                          disabled
+                        />
+                        <button
+                          class="btn btn-light"
+                          type="button"
+                          (click)="removeGroupInitiator(group, i, gi)"
+                        >
+                          <svg
+                            [cdsIcon]="icons.destroy"
+                            [size]="icons.size16"
+                          ></svg>
                         </button>
                       </div>
                     </ng-container>
 
                     <div class="row">
                       <div class="col-md-12">
-                        <cd-select [data]="group.getValue('members')"
-                                   [options]="groupMembersSelections[gi]"
-                                   [messages]="messages.groupInitiator"
-                                   (selection)="onGroupMemberSelection($event, gi)"
-                                   elemClass="btn btn-light float-end">
-                          <svg [cdsIcon]="icons.add"
-                               [size]="icons.size16"
-                               ></svg>
+                        <cd-select
+                          [data]="group.getValue('members')"
+                          [options]="groupMembersSelections[gi]"
+                          [messages]="messages.groupInitiator"
+                          (selection)="onGroupMemberSelection($event, gi)"
+                          elemClass="btn btn-light float-end"
+                        >
+                          <svg
+                            [cdsIcon]="icons.add"
+                            [size]="icons.size16"
+                          ></svg>
                           <ng-container i18n>Add initiator</ng-container>
                         </cd-select>
                       </div>
@@ -621,36 +865,46 @@
 
                 <!-- Group: disks -->
                 <div class="form-group row">
-                  <label class="cd-col-form-label"
-                         for="disks">
+                  <label
+                    class="cd-col-form-label"
+                    for="disks"
+                  >
                     <ng-container i18n>Images</ng-container>
                   </label>
                   <div class="cd-col-form-input">
                     <ng-container *ngFor="let disk of group.getValue('disks'); let i = index">
                       <div class="input-group cd-mb">
-                        <input class="cd-form-control"
-                               type="text"
-                               [value]="disk"
-                               disabled />
-                        <button class="btn btn-light"
-                                type="button"
-                                (click)="removeGroupDisk(group, i, gi)">
-                          <svg [cdsIcon]="icons.destroy"
-                               [size]="icons.size16"
-                               ></svg>
+                        <input
+                          class="cd-form-control"
+                          type="text"
+                          [value]="disk"
+                          disabled
+                        />
+                        <button
+                          class="btn btn-light"
+                          type="button"
+                          (click)="removeGroupDisk(group, i, gi)"
+                        >
+                          <svg
+                            [cdsIcon]="icons.destroy"
+                            [size]="icons.size16"
+                          ></svg>
                         </button>
                       </div>
                     </ng-container>
 
                     <div class="row">
                       <div class="col-md-12">
-                        <cd-select [data]="group.getValue('disks')"
-                                   [options]="groupDiskSelections[gi]"
-                                   [messages]="messages.initiatorImage"
-                                   elemClass="btn btn-light float-end">
-                          <svg [cdsIcon]="icons.add"
-                               [size]="icons.size16"
-                               ></svg>
+                        <cd-select
+                          [data]="group.getValue('disks')"
+                          [options]="groupDiskSelections[gi]"
+                          [messages]="messages.initiatorImage"
+                          elemClass="btn btn-light float-end"
+                        >
+                          <svg
+                            [cdsIcon]="icons.add"
+                            [size]="icons.size16"
+                          ></svg>
                           <ng-container i18n>Add image</ng-container>
                         </cd-select>
                       </div>
@@ -664,29 +918,36 @@
 
             <div class="row">
               <div class="col-md-12">
-                <span class="form-text text-muted"
-                      *ngIf="groups.controls.length === 0"
-                      i18n>No items added.</span>
+                <span
+                  class="form-text text-muted"
+                  *ngIf="groups.controls.length === 0"
+                  i18n
+                  >No items added.</span
+                >
 
-                <button (click)="addGroup(); false"
-                        class="btn btn-light float-end"
-                        type="button">
-                  <svg [cdsIcon]="icons.add"
-                       [size]="icons.size16"
-                       ></svg>
+                <button
+                  (click)="addGroup(); (false)"
+                  class="btn btn-light float-end"
+                  type="button"
+                >
+                  <svg
+                    [cdsIcon]="icons.add"
+                    [size]="icons.size16"
+                  ></svg>
                   <ng-container i18n>Add group</ng-container>
                 </button>
               </div>
             </div>
           </div>
         </div>
-
       </div>
       <div class="card-footer">
-        <cd-form-button-panel (submitActionEvent)="submit()"
-                              [form]="targetForm"
-                              [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                              wrappingClass="text-right"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="submit()"
+          [form]="targetForm"
+          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+          wrappingClass="text-right"
+        ></cd-form-button-panel>
       </div>
     </div>
   </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html
index f292bf624b1..db21e63ac6f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-image-settings-modal/iscsi-target-image-settings-modal.component.html
@@ -5,64 +5,100 @@
   </ng-container>
 
   <ng-container class="modal-content">
-    <form name="settingsForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="settingsForm"
-          novalidate>
+    <form
+      name="settingsForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="settingsForm"
+      novalidate
+    >
       <div class="modal-body">
-        <p class="alert-warning"
-           i18n>Changing these parameters from their default values is usually not necessary.</p>
+        <p
+          class="alert-warning"
+          i18n
+        >
+          Changing these parameters from their default values is usually not necessary.
+        </p>
 
         <span *ngIf="api_version >= 1">
-          <legend class="cd-header"
-                  i18n>Identifier</legend>
+          <legend
+            class="cd-header"
+            i18n
+          >
+            Identifier
+          </legend>
           <!-- LUN -->
           <div class="form-group row">
             <div class="col-sm-12">
-              <label class="col-form-label required"
-                     for="lun"
-                     i18n>lun</label>
-              <input type="number"
-                     class="form-control"
-                     id="lun"
-                     name="lun"
-                     formControlName="lun">
-              <span class="invalid-feedback"
-                    *ngIf="settingsForm.showError('lun', formDir, 'required')"
-                    i18n>This field is required.</span>
+              <label
+                class="col-form-label required"
+                for="lun"
+                i18n
+                >lun</label
+              >
+              <input
+                type="number"
+                class="form-control"
+                id="lun"
+                name="lun"
+                formControlName="lun"
+              />
+              <span
+                class="invalid-feedback"
+                *ngIf="settingsForm.showError('lun', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </div>
           </div>
           <!-- WWN -->
           <div class="form-group row">
             <div class="col-sm-12">
-              <label class="col-form-label"
-                     for="wwn"
-                     i18n>wwn</label>
-              <input type="text"
-                     class="form-control"
-                     id="wwn"
-                     name="wwn"
-                     formControlName="wwn">
+              <label
+                class="col-form-label"
+                for="wwn"
+                i18n
+                >wwn</label
+              >
+              <input
+                type="text"
+                class="form-control"
+                id="wwn"
+                name="wwn"
+                formControlName="wwn"
+              />
             </div>
           </div>
         </span>
 
-        <legend class="cd-header"
-                i18n>Settings</legend>
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Settings
+        </legend>
 
         <!-- BACKSTORE -->
         <div class="form-group row">
           <div class="col-sm-12">
-            <label class="col-form-label"
-                   for="backstore"
-                   i18n>Backstore</label>
-            <select id="backstore"
-                    name="backstore"
-                    class="form-select"
-                    formControlName="backstore">
-              <option *ngFor="let bs of backstores"
-                      [value]="bs">{{ bs | iscsiBackstore }}</option>
+            <label
+              class="col-form-label"
+              for="backstore"
+              i18n
+              >Backstore</label
+            >
+            <select
+              id="backstore"
+              name="backstore"
+              class="form-select"
+              formControlName="backstore"
+            >
+              <option
+                *ngFor="let bs of backstores"
+                [value]="bs"
+              >
+                {{ bs | iscsiBackstore }}
+              </option>
             </select>
           </div>
         </div>
@@ -70,13 +106,17 @@
         <!-- CONTROLS -->
         <ng-container *ngFor="let bs of backstores">
           <ng-container *ngIf="settingsForm.value['backstore'] === bs">
-            <div class="form-group row"
-                 *ngFor="let setting of disk_default_controls[bs] | keyvalue">
+            <div
+              class="form-group row"
+              *ngFor="let setting of disk_default_controls[bs] | keyvalue"
+            >
               <div class="col-sm-12">
-                <cd-iscsi-setting [settingsForm]="settingsForm"
-                                  [formDir]="formDir"
-                                  [setting]="setting.key"
-                                  [limits]="getDiskControlLimits(bs, setting.key)"></cd-iscsi-setting>
+                <cd-iscsi-setting
+                  [settingsForm]="settingsForm"
+                  [formDir]="formDir"
+                  [setting]="setting.key"
+                  [limits]="getDiskControlLimits(bs, setting.key)"
+                ></cd-iscsi-setting>
               </div>
             </div>
           </ng-container>
@@ -84,9 +124,11 @@
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="save()"
-                              [form]="settingsForm"
-                              [submitText]="actionLabels.UPDATE"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="save()"
+          [form]="settingsForm"
+          [submitText]="actionLabels.UPDATE"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-iqn-settings-modal/iscsi-target-iqn-settings-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-iqn-settings-modal/iscsi-target-iqn-settings-modal.component.html
index a5d1269f6df..2deaaf3d297 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-iqn-settings-modal/iscsi-target-iqn-settings-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-iqn-settings-modal/iscsi-target-iqn-settings-modal.component.html
@@ -1,31 +1,46 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container class="modal-title"
-                i18n>Advanced Settings</ng-container>
+  <ng-container
+    class="modal-title"
+    i18n
+    >Advanced Settings</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form name="settingsForm"
-          #formDir="ngForm"
-          [formGroup]="settingsForm"
-          novalidate>
+    <form
+      name="settingsForm"
+      #formDir="ngForm"
+      [formGroup]="settingsForm"
+      novalidate
+    >
       <div class="modal-body">
-        <p class="alert-warning"
-           i18n>Changing these parameters from their default values is usually not necessary.</p>
+        <p
+          class="alert-warning"
+          i18n
+        >
+          Changing these parameters from their default values is usually not necessary.
+        </p>
 
-        <div class="form-group row"
-             *ngFor="let setting of settingsForm.controls | keyvalue">
+        <div
+          class="form-group row"
+          *ngFor="let setting of settingsForm.controls | keyvalue"
+        >
           <div class="col-sm-12">
-            <cd-iscsi-setting [settingsForm]="settingsForm"
-                              [formDir]="formDir"
-                              [setting]="setting.key"
-                              [limits]="getTargetControlLimits(setting.key)"></cd-iscsi-setting>
+            <cd-iscsi-setting
+              [settingsForm]="settingsForm"
+              [formDir]="formDir"
+              [setting]="setting.key"
+              [limits]="getTargetControlLimits(setting.key)"
+            ></cd-iscsi-setting>
           </div>
         </div>
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="save()"
-                              [form]="settingsForm"
-                              [submitText]="actionLabels.UPDATE"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="save()"
+          [form]="settingsForm"
+          [submitText]="actionLabels.UPDATE"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-list/iscsi-target-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-list/iscsi-target-list.component.html
index 0d6e60f1e77..0be274520ec 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-list/iscsi-target-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-list/iscsi-target-list.component.html
@@ -1,54 +1,67 @@
 <cd-iscsi-tabs></cd-iscsi-tabs>
 
-<cd-alert-panel type="info"
-                *ngIf="available === false"
-                title="iSCSI Targets not available"
-                i18n-title>
-  <ng-container i18n>Please consult the&nbsp;<cd-doc section="iscsi"></cd-doc>&nbsp;on
-    how to configure and enable the iSCSI Targets management functionality.</ng-container>
+<cd-alert-panel
+  type="info"
+  *ngIf="available === false"
+  title="iSCSI Targets not available"
+  i18n-title
+>
+  <ng-container i18n
+    >Please consult the&nbsp;<cd-doc section="iscsi"></cd-doc>&nbsp;on how to configure and enable
+    the iSCSI Targets management functionality.</ng-container
+  >
 
   <ng-container *ngIf="status">
-    <br>
+    <br />
     <span i18n>Available information:</span>
     <pre>{{ status }}</pre>
   </ng-container>
 </cd-alert-panel>
 
-<cd-table #table
-          *ngIf="available === true"
-          [data]="targets"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="target_iqn"
-          forceIdentifier="true"
-          selectionType="single"
-          [hasDetails]="true"
-          [autoReload]="false"
-          [status]="tableStatus"
-          (fetchData)="getTargets()"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  #table
+  *ngIf="available === true"
+  [data]="targets"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="target_iqn"
+  forceIdentifier="true"
+  selectionType="single"
+  [hasDetails]="true"
+  [autoReload]="false"
+  [status]="tableStatus"
+  (fetchData)="getTargets()"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
-    <cd-table-actions class="btn-group"
-                      [permission]="permission"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      class="btn-group"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
 
-    <button class="btn btn-light"
-            type="button"
-            (click)="configureDiscoveryAuth()">
-      <svg [cdsIcon]="icons.key"
-           [size]="icons.size16"
-           ></svg>
+    <button
+      class="btn btn-light"
+      type="button"
+      (click)="configureDiscoveryAuth()"
+    >
+      <svg
+        [cdsIcon]="icons.key"
+        [size]="icons.size16"
+      ></svg>
       <ng-container i18n>Discovery authentication</ng-container>
     </button>
   </div>
 
   <ng-container *ngIf="expandedRow">
-    <cd-iscsi-target-details *cdTableDetail
-                             [cephIscsiConfigVersion]="cephIscsiConfigVersion"
-                             [selection]="expandedRow"
-                             [settings]="settings"></cd-iscsi-target-details>
+    <cd-iscsi-target-details
+      *cdTableDetail
+      [cephIscsiConfigVersion]="cephIscsiConfigVersion"
+      [selection]="expandedRow"
+      [settings]="settings"
+    ></cd-iscsi-target-details>
   </ng-container>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi/iscsi.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi/iscsi.component.html
index 4023c5c1ad8..2b5151ac2e4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi/iscsi.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi/iscsi.component.html
@@ -2,52 +2,68 @@
 
 <legend i18n>Gateways</legend>
 <div>
-  <cd-table [data]="gateways"
-            (fetchData)="refresh()"
-            [columns]="gatewaysColumns">
+  <cd-table
+    [data]="gateways"
+    (fetchData)="refresh()"
+    [columns]="gatewaysColumns"
+  >
   </cd-table>
 </div>
 
 <legend i18n>Images</legend>
 <div>
-  <cd-table [data]="images"
-            [columns]="imagesColumns">
+  <cd-table
+    [data]="images"
+    [columns]="imagesColumns"
+  >
   </cd-table>
 </div>
 
-<ng-template #iscsiSparklineTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #iscsiSparklineTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <span *ngIf="row.backstore === 'user:rbd'">
-    <cd-sparkline [data]="value"
-                  [isBinary]="row.cdIsBinary"></cd-sparkline>
+    <cd-sparkline
+      [data]="value"
+      [isBinary]="row.cdIsBinary"
+    ></cd-sparkline>
   </span>
-  <span *ngIf="row.backstore !== 'user:rbd'"
-        class="text-muted">
+  <span
+    *ngIf="row.backstore !== 'user:rbd'"
+    class="text-muted"
+  >
     n/a
   </span>
 </ng-template>
 
-<ng-template #iscsiPerSecondTpl
-             let-row="data.row"
-             let-value="data.value">
-  <span *ngIf="row.backstore === 'user:rbd'">
-    {{ value }} /s
-  </span>
-  <span *ngIf="row.backstore !== 'user:rbd'"
-        class="text-muted">
+<ng-template
+  #iscsiPerSecondTpl
+  let-row="data.row"
+  let-value="data.value"
+>
+  <span *ngIf="row.backstore === 'user:rbd'"> {{ value }} /s </span>
+  <span
+    *ngIf="row.backstore !== 'user:rbd'"
+    class="text-muted"
+  >
     n/a
   </span>
 </ng-template>
 
-<ng-template #iscsiRelativeDateTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #iscsiRelativeDateTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <span *ngIf="row.backstore === 'user:rbd'">
     {{ value | relativeDate | notAvailable }}
   </span>
-  <span *ngIf="row.backstore !== 'user:rbd'"
-        class="text-muted">
+  <span
+    *ngIf="row.backstore !== 'user:rbd'"
+    class="text-muted"
+  >
     n/a
   </span>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.html
index 706961df83a..29b99b292a7 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.html
@@ -1,93 +1,134 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Create Bootstrap Token</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Create Bootstrap Token
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="createBootstrapForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="createBootstrapForm"
-          novalidate>
+    <form
+      name="createBootstrapForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="createBootstrapForm"
+      novalidate
+    >
       <p>
-        <ng-container i18n>To create a bootstrap token which can be imported
-        by a peer site cluster, provide the local site's name, select
-        which pools will have mirroring enabled, and click&nbsp;
-        <kbd>Generate</kbd>.</ng-container>
+        <ng-container i18n
+          >To create a bootstrap token which can be imported by a peer site cluster, provide the
+          local site's name, select which pools will have mirroring enabled, and click&nbsp;
+          <kbd>Generate</kbd>.</ng-container
+        >
       </p>
 
       <div class="form-item">
-        <cds-text-label for="siteName"
-                        cdRequiredField="Site Name"
-                        [invalid]="!createBootstrapForm.controls['siteName'].valid && (createBootstrapForm.controls['siteName'].dirty || createBootstrapForm.controls['siteName'].touched)"
-                        [invalidText]="siteNameError"
-                        i18n>Site Name
-          <input cdsText
-                 placeholder="Name..."
-                 i18n-placeholder
-                 id="siteName"
-                 name="siteName"
-                 formControlName="siteName"
-                 [invalid]="!createBootstrapForm.controls['siteName'].valid && (createBootstrapForm.controls['siteName'].dirty || createBootstrapForm.controls['siteName'].touched)"
-                 autofocus>
+        <cds-text-label
+          for="siteName"
+          cdRequiredField="Site Name"
+          [invalid]="
+            !createBootstrapForm.controls['siteName'].valid &&
+            (createBootstrapForm.controls['siteName'].dirty ||
+              createBootstrapForm.controls['siteName'].touched)
+          "
+          [invalidText]="siteNameError"
+          i18n
+          >Site Name
+          <input
+            cdsText
+            placeholder="Name..."
+            i18n-placeholder
+            id="siteName"
+            name="siteName"
+            formControlName="siteName"
+            [invalid]="
+              !createBootstrapForm.controls['siteName'].valid &&
+              (createBootstrapForm.controls['siteName'].dirty ||
+                createBootstrapForm.controls['siteName'].touched)
+            "
+            autofocus
+          />
         </cds-text-label>
         <ng-template #siteNameError>
-          <span *ngIf="createBootstrapForm.showError('siteName', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
+          <span
+            *ngIf="createBootstrapForm.showError('siteName', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
-      <div class="form-item"
-           formGroupName="pools">
+      <div
+        class="form-item"
+        formGroupName="pools"
+      >
         <fieldset>
-          <label class="cds--label"
-                 for="pools"
-                 i18n>Pools</label>
+          <label
+            class="cds--label"
+            for="pools"
+            i18n
+            >Pools</label
+          >
           <ng-container *ngFor="let pool of pools">
-            <cds-checkbox i18n-label
-                          [id]="pool.name"
-                          [name]="pool.name"
-                          [formControlName]="pool.name">
+            <cds-checkbox
+              i18n-label
+              [id]="pool.name"
+              [name]="pool.name"
+              [formControlName]="pool.name"
+            >
               {{ pool.name }}
             </cds-checkbox>
           </ng-container>
         </fieldset>
-        <span *ngIf="createBootstrapForm.showError('pools', formDir, 'requirePool')"
-              class="invalid-feedback"
-              i18n>At least one pool is required.</span>
+        <span
+          *ngIf="createBootstrapForm.showError('pools', formDir, 'requirePool')"
+          class="invalid-feedback"
+          i18n
+          >At least one pool is required.</span
+        >
       </div>
 
-      <cd-submit-button i18n
-                        [form]="createBootstrapForm"
-                        (submitAction)="generate()">Generate</cd-submit-button>
+      <cd-submit-button
+        i18n
+        [form]="createBootstrapForm"
+        (submitAction)="generate()"
+        >Generate</cd-submit-button
+      >
 
       <div class="form-item mt-2">
-        <cds-textarea-label for="token"
-                            i18n>Token
-          <textarea cdsTextArea
-                    placeholder="Generated token..."
-                    i18n-placeholder
-                    id="token"
-                    formControlName="token"
-                    cols="200"
-                    rows="5"
-                    readonly>
+        <cds-textarea-label
+          for="token"
+          i18n
+          >Token
+          <textarea
+            cdsTextArea
+            placeholder="Generated token..."
+            i18n-placeholder
+            id="token"
+            formControlName="token"
+            cols="200"
+            rows="5"
+            readonly
+          >
           </textarea>
         </cds-textarea-label>
-        <cd-copy-2-clipboard-button source="token">
-        </cd-copy-2-clipboard-button>
+        <cd-copy-2-clipboard-button source="token"> </cd-copy-2-clipboard-button>
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (backAction)="closeModal()"
-                        [showSubmit]="false"
-                        [modalForm]="true"
-                        cancelText="Close"></cd-form-button-panel>
-
+  <cd-form-button-panel
+    (backAction)="closeModal()"
+    [showSubmit]="false"
+    [modalForm]="true"
+    cancelText="Close"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-import-modal/bootstrap-import-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-import-modal/bootstrap-import-modal.component.html
index 07b0bebe951..b61f8ac0a8e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-import-modal/bootstrap-import-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-import-modal/bootstrap-import-modal.component.html
@@ -1,109 +1,164 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()">
-
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Import Bootstrap Token</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Import Bootstrap Token
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="importBootstrapForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="importBootstrapForm"
-          novalidate>
+    <form
+      name="importBootstrapForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="importBootstrapForm"
+      novalidate
+    >
       <p>
-        <ng-container i18n>To import a bootstrap token which was created
-        by a peer site cluster, provide the local site's name, select
-        which pools will have mirroring enabled, provide the generated
-        token, and click&nbsp;<kbd>Import</kbd>.</ng-container>
+        <ng-container i18n
+          >To import a bootstrap token which was created by a peer site cluster, provide the local
+          site's name, select which pools will have mirroring enabled, provide the generated token,
+          and click&nbsp;<kbd>Import</kbd>.</ng-container
+        >
       </p>
 
       <div class="form-item">
-        <cds-text-label for="siteName"
-                        i18n
-                        cdRequiredField="Site Name"
-                        [invalid]="!importBootstrapForm.controls['siteName'].valid && importBootstrapForm.controls['siteName'].dirty"
-                        [invalidText]="siteNameError"
-                        i18n-invalidText>Site Name
-          <input cdsText
-                 placeholder="Name..."
-                 i18n-placeholder
-                 id="siteName"
-                 name="siteName"
-                 formControlName="siteName"
-                 [invalid]="!importBootstrapForm.controls['siteName'].valid && importBootstrapForm.controls['siteName'].dirty"
-                 autofocus>
+        <cds-text-label
+          for="siteName"
+          i18n
+          cdRequiredField="Site Name"
+          [invalid]="
+            !importBootstrapForm.controls['siteName'].valid &&
+            importBootstrapForm.controls['siteName'].dirty
+          "
+          [invalidText]="siteNameError"
+          i18n-invalidText
+          >Site Name
+          <input
+            cdsText
+            placeholder="Name..."
+            i18n-placeholder
+            id="siteName"
+            name="siteName"
+            formControlName="siteName"
+            [invalid]="
+              !importBootstrapForm.controls['siteName'].valid &&
+              importBootstrapForm.controls['siteName'].dirty
+            "
+            autofocus
+          />
         </cds-text-label>
         <ng-template #siteNameError>
-          <span *ngIf="importBootstrapForm.showError('siteName', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
+          <span
+            *ngIf="importBootstrapForm.showError('siteName', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <div class="form-item">
-        <cds-select label="Direction"
-                    for="direction"
-                    name="direction"
-                    id="direction"
-                    formControlName="direction">
-          <option *ngFor="let direction of directions"
-                  [value]="direction.key">{{ direction.desc }}</option>
+        <cds-select
+          label="Direction"
+          for="direction"
+          name="direction"
+          id="direction"
+          formControlName="direction"
+        >
+          <option
+            *ngFor="let direction of directions"
+            [value]="direction.key"
+          >
+            {{ direction.desc }}
+          </option>
         </cds-select>
       </div>
 
-      <div class="form-item"
-           formGroupName="pools">
+      <div
+        class="form-item"
+        formGroupName="pools"
+      >
         <fieldset>
-          <label class="cds--label"
-                 for="pools"
-                 i18n>Pools</label>
+          <label
+            class="cds--label"
+            for="pools"
+            i18n
+            >Pools</label
+          >
           <ng-container *ngFor="let pool of pools">
-            <cds-checkbox i18n-label
-                          [id]="pool.name"
-                          [name]="pool.name"
-                          [formControlName]="pool.name">
+            <cds-checkbox
+              i18n-label
+              [id]="pool.name"
+              [name]="pool.name"
+              [formControlName]="pool.name"
+            >
               {{ pool.name }}
             </cds-checkbox>
           </ng-container>
         </fieldset>
-        <span *ngIf="importBootstrapForm.showError('pools', formDir, 'requirePool')"
-              class="invalid-feedback"
-              i18n>At least one pool is required.</span>
+        <span
+          *ngIf="importBootstrapForm.showError('pools', formDir, 'requirePool')"
+          class="invalid-feedback"
+          i18n
+          >At least one pool is required.</span
+        >
       </div>
 
       <div class="form-item">
-        <cds-textarea-label for="token"
-                            [invalid]="importBootstrapForm.controls['token'].invalid && (importBootstrapForm.controls['token'].dirty)"
-                            [invalidText]="tokenError"
-                            cdRequiredField="Token"
-                            i18n>Token
-          <textarea cdsTextArea
-                    placeholder="Generated token..."
-                    i18n-placeholder
-                    id="token"
-                    formControlName="token"
-                    cols="200"
-                    rows="5"
-                    [invalid]="importBootstrapForm.controls['token'].invalid && (importBootstrapForm.controls['token'].dirty)">
+        <cds-textarea-label
+          for="token"
+          [invalid]="
+            importBootstrapForm.controls['token'].invalid &&
+            importBootstrapForm.controls['token'].dirty
+          "
+          [invalidText]="tokenError"
+          cdRequiredField="Token"
+          i18n
+          >Token
+          <textarea
+            cdsTextArea
+            placeholder="Generated token..."
+            i18n-placeholder
+            id="token"
+            formControlName="token"
+            cols="200"
+            rows="5"
+            [invalid]="
+              importBootstrapForm.controls['token'].invalid &&
+              importBootstrapForm.controls['token'].dirty
+            "
+          >
           </textarea>
         </cds-textarea-label>
         <ng-template #tokenError>
-          <span *ngIf="importBootstrapForm.showError('token', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
-          <span *ngIf="importBootstrapForm.showError('token', formDir, 'invalidToken')"
-                class="invalid-feedback"
-                i18n>The token is invalid.</span>
+          <span
+            *ngIf="importBootstrapForm.showError('token', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            *ngIf="importBootstrapForm.showError('token', formDir, 'invalidToken')"
+            class="invalid-feedback"
+            i18n
+            >The token is invalid.</span
+          >
         </ng-template>
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="import()"
-                        [form]="importBootstrapForm"
-                        [submitText]="actionLabels.SUBMIT"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="import()"
+    [form]="importBootstrapForm"
+    [submitText]="actionLabels.SUBMIT"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/daemon-list/daemon-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/daemon-list/daemon-list.component.html
index 749b2b40595..ac08deaf68a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/daemon-list/daemon-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/daemon-list/daemon-list.component.html
@@ -1,13 +1,17 @@
-<cd-table [data]="data"
-          columnMode="flex"
-          [columns]="columns"
-          [autoReload]="-1"
-          (fetchData)="refresh()"
-          [status]="tableStatus">
+<cd-table
+  [data]="data"
+  columnMode="flex"
+  [columns]="columns"
+  [autoReload]="-1"
+  (fetchData)="refresh()"
+  [status]="tableStatus"
+>
 </cd-table>
 
-<ng-template #healthTmpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #healthTmpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <cds-tag [class]="row.health_color | mirrorHealthColor">{{ value }}</cds-tag>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/image-list/image-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/image-list/image-list.component.html
index 77c03dd06ae..27e12cd0f7d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/image-list/image-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/image-list/image-list.component.html
@@ -1,43 +1,60 @@
-<nav ngbNav
-     #nav="ngbNav"
-     class="nav-tabs"
-     cdStatefulTab="image-list">
+<nav
+  ngbNav
+  #nav="ngbNav"
+  class="nav-tabs"
+  cdStatefulTab="image-list"
+>
   <ng-container ngbNavItem="issues">
-    <a ngbNavLink
-       i18n>Issues ({{ image_error.data.length }})</a>
+    <a
+      ngbNavLink
+      i18n
+      >Issues ({{ image_error.data.length }})</a
+    >
     <ng-template ngbNavContent>
-      <cd-table [data]="image_error.data"
-                columnMode="flex"
-                [columns]="image_error.columns"
-                [autoReload]="-1"
-                (fetchData)="refresh()"
-                [status]="tableStatus">
+      <cd-table
+        [data]="image_error.data"
+        columnMode="flex"
+        [columns]="image_error.columns"
+        [autoReload]="-1"
+        (fetchData)="refresh()"
+        [status]="tableStatus"
+      >
       </cd-table>
     </ng-template>
   </ng-container>
   <ng-container ngbNavItem="syncing">
-    <a ngbNavLink
-       i18n>Syncing ({{ image_syncing.data.length }})</a>
+    <a
+      ngbNavLink
+      i18n
+      >Syncing ({{ image_syncing.data.length }})</a
+    >
     <ng-template ngbNavContent>
-      <cd-table [data]="image_syncing.data"
-                columnMode="flex"
-                [columns]="image_syncing.columns"
-                [autoReload]="-1"
-                (fetchData)="refresh()"
-                [status]="tableStatus">
+      <cd-table
+        [data]="image_syncing.data"
+        columnMode="flex"
+        [columns]="image_syncing.columns"
+        [autoReload]="-1"
+        (fetchData)="refresh()"
+        [status]="tableStatus"
+      >
       </cd-table>
     </ng-template>
   </ng-container>
   <ng-container ngbNavItem="ready">
-    <a ngbNavLink
-       i18n>Ready ({{ image_ready.data.length }})</a>
+    <a
+      ngbNavLink
+      i18n
+      >Ready ({{ image_ready.data.length }})</a
+    >
     <ng-template ngbNavContent>
-      <cd-table [data]="image_ready.data"
-                columnMode="flex"
-                [columns]="image_ready.columns"
-                [autoReload]="-1"
-                (fetchData)="refresh()"
-                [status]="tableStatus">
+      <cd-table
+        [data]="image_ready.data"
+        columnMode="flex"
+        [columns]="image_ready.columns"
+        [autoReload]="-1"
+        (fetchData)="refresh()"
+        [status]="tableStatus"
+      >
       </cd-table>
     </ng-template>
   </ng-container>
@@ -45,35 +62,46 @@
 
 <div [ngbNavOutlet]="nav"></div>
 
-<ng-template #stateTmpl
-             let-row="data.row"
-             let-value="data.value">
-
-<cds-tag size="sm"
-         [class]="row.state_color | mirrorHealthColor">{{ value }}</cds-tag>
-
+<ng-template
+  #stateTmpl
+  let-row="data.row"
+  let-value="data.value"
+>
+  <cds-tag
+    size="sm"
+    [class]="row.state_color | mirrorHealthColor"
+    >{{ value }}</cds-tag
+  >
 </ng-template>
 
-<ng-template #progressTmpl
-             let-row="data.row"
-             let-value="data.value">
-  <div *ngIf="row.state === 'Replaying'">
-  </div>
+<ng-template
+  #progressTmpl
+  let-row="data.row"
+  let-value="data.value"
+>
+  <div *ngIf="row.state === 'Replaying'"></div>
   <div class="w-100 h-100 d-flex justify-content-center align-items-center">
-    <ngb-progressbar *ngIf="row.state === 'Replaying'"
-                     type="info"
-                     class="w-100"
-                     [value]="value"
-                     [showValue]="true"></ngb-progressbar>
+    <ngb-progressbar
+      *ngIf="row.state === 'Replaying'"
+      type="info"
+      class="w-100"
+      [value]="value"
+      [showValue]="true"
+    ></ngb-progressbar>
   </div>
 </ng-template>
 
-<ng-template #entriesBehindPrimaryTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #entriesBehindPrimaryTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <span *ngIf="row.mirror_mode === 'journal'">
     {{ value }}
   </span>
-  <span *ngIf="row.mirror_mode === 'snapshot'"
-        ngbTooltip="Not available with mirroring snapshot mode">-</span>
+  <span
+    *ngIf="row.mirror_mode === 'snapshot'"
+    ngbTooltip="Not available with mirroring snapshot mode"
+    >-</span
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html
index 440d6fb100a..44f6347b451 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/overview/overview.component.html
@@ -1,35 +1,51 @@
-<form name="rbdmirroringForm"
-      #formDir="ngForm"
-      [formGroup]="rbdmirroringForm"
-      novalidate>
+<form
+  name="rbdmirroringForm"
+  #formDir="ngForm"
+  [formGroup]="rbdmirroringForm"
+  novalidate
+>
   <div class="form-item">
-    <div cdsCol
-         [columnNumbers]="{md: 4}"
-         class="d-flex">
-      <cds-text-label for="siteName"
-                      i18n>Site Name
+    <div
+      cdsCol
+      [columnNumbers]="{ md: 4 }"
+      class="d-flex"
+    >
+      <cds-text-label
+        for="siteName"
+        i18n
+        >Site Name
         <div class="cds-input-group">
-          <input type="text"
-                 id="siteName"
-                 name="siteName"
-                 formControlName="siteName"
-                 [attr.disabled]="!editing ? true : null"
-                 cdsText>
-          <cds-icon-button kind="ghost"
-                           size="md"
-                           (click)="updateSiteName()"
-                           [title]="editing ? 'Save' : 'Edit'">
-            <svg [cdsIcon]="icons.edit"
-                 [size]="icons.size32"
-                 class="cds--btn__icon"
-                 *ngIf="!editing"></svg>
-            <svg [cdsIcon]="icons.check"
-                 [size]="icons.size32"
-                 class="cds--btn__icon"
-                 *ngIf="editing"></svg>
+          <input
+            type="text"
+            id="siteName"
+            name="siteName"
+            formControlName="siteName"
+            [attr.disabled]="!editing ? true : null"
+            cdsText
+          />
+          <cds-icon-button
+            kind="ghost"
+            size="md"
+            (click)="updateSiteName()"
+            [title]="editing ? 'Save' : 'Edit'"
+          >
+            <svg
+              [cdsIcon]="icons.edit"
+              [size]="icons.size32"
+              class="cds--btn__icon"
+              *ngIf="!editing"
+            ></svg>
+            <svg
+              [cdsIcon]="icons.check"
+              [size]="icons.size32"
+              class="cds--btn__icon"
+              *ngIf="editing"
+            ></svg>
           </cds-icon-button>
-          <cd-copy-2-clipboard-button [source]="siteName"
-                                      [byId]="false">
+          <cd-copy-2-clipboard-button
+            [source]="siteName"
+            [byId]="false"
+          >
           </cd-copy-2-clipboard-button>
         </div>
       </cds-text-label>
@@ -46,13 +62,14 @@
               [disabled]="action.disable()"
               [attr.aria-label]="action.name"
               [attr.data-testid]="action.name"
-              [preserveFragment]="action.preserveFragment ? '' : null">
+              [preserveFragment]="action.preserveFragment ? '' : null"
+            >
               <span i18n>{{ action.name }}</span>
               <svg
                 class="cds--btn__icon"
                 [cdsIcon]="action.icon"
-                size="16">
-              </svg>
+                size="16"
+              ></svg>
             </button>
           }
         </ng-container>
@@ -65,8 +82,7 @@
   <div class="col-sm-6">
     <legend i18n>Daemons</legend>
     <div>
-      <cd-mirroring-daemons>
-      </cd-mirroring-daemons>
+      <cd-mirroring-daemons> </cd-mirroring-daemons>
     </div>
   </div>
 
@@ -74,8 +90,7 @@
     <legend i18n>Pools</legend>
 
     <div>
-      <cd-mirroring-pools>
-      </cd-mirroring-pools>
+      <cd-mirroring-pools> </cd-mirroring-pools>
     </div>
   </div>
 </div>
@@ -84,8 +99,7 @@
   <div class="col-md-12">
     <legend i18n>Images</legend>
     <div>
-      <cd-mirroring-images>
-      </cd-mirroring-images>
+      <cd-mirroring-images> </cd-mirroring-images>
     </div>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-mode-modal/pool-edit-mode-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-mode-modal/pool-edit-mode-modal.component.html
index 8c25db39186..61fd62bf10f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-mode-modal/pool-edit-mode-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-mode-modal/pool-edit-mode-modal.component.html
@@ -1,47 +1,69 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Edit pool mirror mode</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Edit pool mirror mode
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="editModeForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="editModeForm"
-          novalidate>
+    <form
+      name="editModeForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="editModeForm"
+      novalidate
+    >
       <p>
-        <ng-container i18n>To edit the mirror mode for pool&nbsp;
-        <kbd>{{ poolName }}</kbd>, select a new mode from the list and click&nbsp;
-        <kbd>Update</kbd>.</ng-container>
+        <ng-container i18n
+          >To edit the mirror mode for pool&nbsp; <kbd>{{ poolName }}</kbd
+          >, select a new mode from the list and click&nbsp; <kbd>Update</kbd>.</ng-container
+        >
       </p>
 
       <div class="form-item">
-        <cds-select label="Mode"
-                    for="mirrorMode"
-                    formControlName="mirrorMode"
-                    name="mirrorMode"
-                    id="mirrorMode"
-                    [invalid]="editModeForm.controls['mirrorMode'].invalid && (editModeForm.controls['mirrorMode'].dirty)"
-                    [invalidText]="mirrorModeError"
-                    cdRequiredField="Mode"
-                    i18n>
-          <option *ngFor="let mirrorMode of mirrorModes"
-                  [value]="mirrorMode.id">{{ mirrorMode.name }}</option>
+        <cds-select
+          label="Mode"
+          for="mirrorMode"
+          formControlName="mirrorMode"
+          name="mirrorMode"
+          id="mirrorMode"
+          [invalid]="
+            editModeForm.controls['mirrorMode'].invalid && editModeForm.controls['mirrorMode'].dirty
+          "
+          [invalidText]="mirrorModeError"
+          cdRequiredField="Mode"
+          i18n
+        >
+          <option
+            *ngFor="let mirrorMode of mirrorModes"
+            [value]="mirrorMode.id"
+          >
+            {{ mirrorMode.name }}
+          </option>
         </cds-select>
         <ng-template #mirrorModeError>
-          <span class="invalid-feedback"
-                *ngIf="editModeForm.showError('mirrorMode', formDir, 'cannotDisable')"
-                i18n>Peer clusters must be removed prior to disabling mirror.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="editModeForm.showError('mirrorMode', formDir, 'cannotDisable')"
+            i18n
+            >Peer clusters must be removed prior to disabling mirror.</span
+          >
         </ng-template>
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="update()"
-                        [form]="editModeForm"
-                        [submitText]="actionLabels.UPDATE"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="update()"
+    [form]="editModeForm"
+    [submitText]="actionLabels.UPDATE"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-peer-modal/pool-edit-peer-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-peer-modal/pool-edit-peer-modal.component.html
index 9bbc298dd96..770adb762f2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-peer-modal/pool-edit-peer-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-edit-peer-modal/pool-edit-peer-modal.component.html
@@ -1,123 +1,180 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
       {mode, select, edit {Edit} other {Add}} pool mirror peer
     </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="editPeerForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="editPeerForm"
-          novalidate>
+    <form
+      name="editPeerForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="editPeerForm"
+      novalidate
+    >
       <p>
-        <span i18n>{mode, select, edit {Edit} other {Add}} the pool
-        mirror peer attributes for pool <kbd>{{ poolName }}</kbd> and click
-        <kbd>Submit</kbd>.</span>
+        <span i18n
+          >{mode, select, edit {Edit} other {Add}} the pool mirror peer attributes for pool
+          <kbd>{{ poolName }}</kbd> and click <kbd>Submit</kbd>.</span
+        >
       </p>
 
       <div class="form-item">
-        <cds-text-label for="clusterName"
-                        [invalid]="editPeerForm.controls['clusterName'].invalid && (editPeerForm.controls['clusterName'].dirty)"
-                        [invalidText]="clusterNameError"
-                        cdRequiredField="Cluster Name"
-                        i18n>Cluster Name
-          <input cdsText
-                 type="text"
-                 placeholder="Name..."
-                 i18n-placeholder
-                 id="clusterName"
-                 name="clusterName"
-                 formControlName="clusterName"
-                 [invalid]="editPeerForm.controls['clusterName'].invalid && (editPeerForm.controls['clusterName'].dirty)"
-                 autofocus>
+        <cds-text-label
+          for="clusterName"
+          [invalid]="
+            editPeerForm.controls['clusterName'].invalid &&
+            editPeerForm.controls['clusterName'].dirty
+          "
+          [invalidText]="clusterNameError"
+          cdRequiredField="Cluster Name"
+          i18n
+          >Cluster Name
+          <input
+            cdsText
+            type="text"
+            placeholder="Name..."
+            i18n-placeholder
+            id="clusterName"
+            name="clusterName"
+            formControlName="clusterName"
+            [invalid]="
+              editPeerForm.controls['clusterName'].invalid &&
+              editPeerForm.controls['clusterName'].dirty
+            "
+            autofocus
+          />
         </cds-text-label>
         <ng-template #clusterNameError>
-          <span class="invalid-feedback"
-                *ngIf="editPeerForm.showError('clusterName', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="editPeerForm.showError('clusterName', formDir, 'invalidClusterName')"
-                i18n>The cluster name is not valid.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="editPeerForm.showError('clusterName', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="editPeerForm.showError('clusterName', formDir, 'invalidClusterName')"
+            i18n
+            >The cluster name is not valid.</span
+          >
         </ng-template>
       </div>
 
       <div class="form-item">
-        <cds-text-label for="clientID"
-                        [invalid]="editPeerForm.controls['clientID'].invalid && (editPeerForm.controls['clientID'].dirty)"
-                        [invalidText]="clientIDError"
-                        cdRequiredField="CephX ID"
-                        i18n>CephX ID
-          <input cdsText
-                 type="text"
-                 placeholder="CephX ID..."
-                 i18n-placeholder
-                 id="clientID"
-                 name="clientID"
-                 formControlName="clientID"
-                 [invalid]="editPeerForm.controls['clientID'].invalid && (editPeerForm.controls['clientID'].dirty)">
+        <cds-text-label
+          for="clientID"
+          [invalid]="
+            editPeerForm.controls['clientID'].invalid && editPeerForm.controls['clientID'].dirty
+          "
+          [invalidText]="clientIDError"
+          cdRequiredField="CephX ID"
+          i18n
+          >CephX ID
+          <input
+            cdsText
+            type="text"
+            placeholder="CephX ID..."
+            i18n-placeholder
+            id="clientID"
+            name="clientID"
+            formControlName="clientID"
+            [invalid]="
+              editPeerForm.controls['clientID'].invalid && editPeerForm.controls['clientID'].dirty
+            "
+          />
         </cds-text-label>
         <ng-template #clientIDError>
-          <span class="invalid-feedback"
-                *ngIf="editPeerForm.showError('clientID', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="editPeerForm.showError('clientID', formDir, 'invalidClientID')"
-                i18n>The CephX ID is not valid.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="editPeerForm.showError('clientID', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="editPeerForm.showError('clientID', formDir, 'invalidClientID')"
+            i18n
+            >The CephX ID is not valid.</span
+          >
         </ng-template>
       </div>
 
       <div class="form-item">
-        <cds-text-label for="monAddr"
-                        [invalid]="editPeerForm.controls['monAddr'].invalid && (editPeerForm.controls['monAddr'].dirty)"
-                        [invalidText]="monAddrError"
-                        i18n>Monitor Addresses
-          <input cdsText
-                 type="text"
-                 placeholder="Comma-delimited addresses..."
-                 i18n-placeholder
-                 id="monAddr"
-                 name="monAddr"
-                 formControlName="monAddr"
-                 [invalid]="editPeerForm.controls['monAddr'].invalid && (editPeerForm.controls['monAddr'].dirty)">
+        <cds-text-label
+          for="monAddr"
+          [invalid]="
+            editPeerForm.controls['monAddr'].invalid && editPeerForm.controls['monAddr'].dirty
+          "
+          [invalidText]="monAddrError"
+          i18n
+          >Monitor Addresses
+          <input
+            cdsText
+            type="text"
+            placeholder="Comma-delimited addresses..."
+            i18n-placeholder
+            id="monAddr"
+            name="monAddr"
+            formControlName="monAddr"
+            [invalid]="
+              editPeerForm.controls['monAddr'].invalid && editPeerForm.controls['monAddr'].dirty
+            "
+          />
         </cds-text-label>
         <ng-template #monAddrError>
-          <span class="invalid-feedback"
-                *ngIf="editPeerForm.showError('monAddr', formDir, 'invalidMonAddr')"
-                i18n>The monitory address is not valid.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="editPeerForm.showError('monAddr', formDir, 'invalidMonAddr')"
+            i18n
+            >The monitory address is not valid.</span
+          >
         </ng-template>
       </div>
 
       <div class="form-item">
-        <cds-text-label for="key"
-                        [invalid]="editPeerForm.controls['key'].invalid && (editPeerForm.controls['key'].dirty)"
-                        [invalidText]="keyError"
-                        i18n>CephX Key
-          <input cdsText
-                 type="text"
-                 placeholder="Base64-encoded key..."
-                 i18n-placeholder
-                 id="key"
-                 name="key"
-                 formControlName="key"
-                 [invalid]="editPeerForm.controls['key'].invalid && (editPeerForm.controls['key'].dirty)">
+        <cds-text-label
+          for="key"
+          [invalid]="editPeerForm.controls['key'].invalid && editPeerForm.controls['key'].dirty"
+          [invalidText]="keyError"
+          i18n
+          >CephX Key
+          <input
+            cdsText
+            type="text"
+            placeholder="Base64-encoded key..."
+            i18n-placeholder
+            id="key"
+            name="key"
+            formControlName="key"
+            [invalid]="editPeerForm.controls['key'].invalid && editPeerForm.controls['key'].dirty"
+          />
         </cds-text-label>
         <ng-template #keyError>
-          <span class="invalid-feedback"
-                *ngIf="editPeerForm.showError('key', formDir, 'invalidKey')"
-                i18n>CephX key must be base64 encoded.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="editPeerForm.showError('key', formDir, 'invalidKey')"
+            i18n
+            >CephX key must be base64 encoded.</span
+          >
         </ng-template>
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="update()"
-                        [form]="editPeerForm"
-                        [submitText]="actionLabels.SUBMIT"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="update()"
+    [form]="editPeerForm"
+    [submitText]="actionLabels.SUBMIT"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-list/pool-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-list/pool-list.component.html
index f8aca866df3..d042ca94c6f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-list/pool-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/pool-list/pool-list.component.html
@@ -1,35 +1,47 @@
-<cd-table [data]="data"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="name"
-          forceIdentifier="true"
-          [autoReload]="-1"
-          (fetchData)="refresh()"
-          selectionType="single"
-          (updateSelection)="updateSelection($event)"
-          [status]="tableStatus">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="data"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="name"
+  forceIdentifier="true"
+  [autoReload]="-1"
+  (fetchData)="refresh()"
+  selectionType="single"
+  (updateSelection)="updateSelection($event)"
+  [status]="tableStatus"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
 
-<ng-template #healthTmpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #healthTmpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <cds-tag [class]="row.health_color | mirrorHealthColor">
-           {{ value }}
+    {{ value }}
   </cds-tag>
 </ng-template>
 <ng-template #localTmpl>
-  <span i18n
-        i18n-ngbTooltip
-        ngbTooltip="Local image count"># Local</span>
+  <span
+    i18n
+    i18n-ngbTooltip
+    ngbTooltip="Local image count"
+    ># Local</span
+  >
 </ng-template>
 <ng-template #remoteTmpl>
-  <span i18n
-        i18n-ngbTooltip
-        ngbTooltip="Remote image count"># Remote</span>
+  <span
+    i18n
+    i18n-ngbTooltip
+    ngbTooltip="Remote image count"
+    ># Remote</span
+  >
 </ng-template>
 <router-outlet name="modal"></router-outlet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html
index 4261e9c0c32..791390cd59d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.html
@@ -1,29 +1,34 @@
-<cd-tearsheet [steps]="steps"
-              [title]="title"
-              [description]="description"
-              size="md"
-              [isSubmitLoading]="isSubmitLoading"
-              [submitButtonLabel]="'Save changes'"
-              [submitButtonLoadingLabel]="'Saving'"
-              (submitRequested)="onSubmit()"
-              (closeRequested)="closeModal()">
+<cd-tearsheet
+  [steps]="steps"
+  [title]="title"
+  [description]="description"
+  size="md"
+  [isSubmitLoading]="isSubmitLoading"
+  [submitButtonLabel]="'Save changes'"
+  [submitButtonLoadingLabel]="'Saving'"
+  (submitRequested)="onSubmit()"
+  (closeRequested)="closeModal()"
+>
   <cd-tearsheet-step>
     @if (showAuthAlert) {
-    <cd-alert-panel type="warning"
-                    title="Subsystem DHCHAP Key will be deleted permanently"
-                    i18n-title
-                    class="cd-nvmeof-edit-auth-downgrade-alert">
-      <span i18n>
-        Switching from bidirectional authentication to unidirectional method will remove the subsystem authentication key,
-        exposing the subsystem to unauthorised access.
-      </span>
-    </cd-alert-panel>
+      <cd-alert-panel
+        type="warning"
+        title="Subsystem DHCHAP Key will be deleted permanently"
+        i18n-title
+        class="cd-nvmeof-edit-auth-downgrade-alert"
+      >
+        <span i18n>
+          Switching from bidirectional authentication to unidirectional method will remove the
+          subsystem authentication key, exposing the subsystem to unauthorised access.
+        </span>
+      </cd-alert-panel>
     }
     <cd-nvmeof-subsystem-step-three
       #tearsheetStep
       [group]="groupName"
       [initialAuthType]="initialAuthType"
-      [stepTwoValue]="stepTwoValue">
+      [stepTwoValue]="stepTwoValue"
+    >
     </cd-nvmeof-subsystem-step-three>
   </cd-tearsheet-step>
 </cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.html
index 0e4952bbf3a..a46daaf8c0a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.html
@@ -1,92 +1,126 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
     <h2
-        cdsModalHeaderLabel
-        i18n>
-      {{'Subsystem'}}
+      cdsModalHeaderLabel
+      i18n
+    >
+      {{ 'Subsystem' }}
     </h2>
 
-  <!-- Step 1: Enter DHCHAP key -->
-  <ng-container *ngIf="!showConfirmation">
-    <h2
+    <!-- Step 1: Enter DHCHAP key -->
+    <ng-container *ngIf="!showConfirmation">
+      <h2
         class="cds--type-heading-03"
         cdsModalHeaderHeading
-        i18n>Edit Host Key</h2>
-  </ng-container>
+        i18n
+      >
+        Edit Host Key
+      </h2>
+    </ng-container>
 
-  <!-- Step 2: Confirm changes -->
-  <ng-container *ngIf="showConfirmation">
-    <h2
+    <!-- Step 2: Confirm changes -->
+    <ng-container *ngIf="showConfirmation">
+      <h2
         class="cds--type-heading-03"
         cdsModalHeaderHeading
-        i18n>Confirm changes</h2>
-  </ng-container>
+        i18n
+      >
+        Confirm changes
+      </h2>
+    </ng-container>
   </cds-modal-header>
 
   <section cdsModalContent>
     <!-- Step 1: Enter DHCHAP key -->
     <ng-container *ngIf="!showConfirmation">
-      <p class="cds--type-body-01 cds-mb-5"
-         i18n>Update DHCHAP authentication key for the selected host.</p>
-      <form name="editForm"
-            #formDir="ngForm"
-            [formGroup]="editForm"
-            class="form-item "
-            novalidate>
+      <p
+        class="cds--type-body-01 cds-mb-5"
+        i18n
+      >
+        Update DHCHAP authentication key for the selected host.
+      </p>
+      <form
+        name="editForm"
+        #formDir="ngForm"
+        [formGroup]="editForm"
+        class="form-item"
+        novalidate
+      >
         <cds-text-label
           i18n
           helperText="Enter or update the authentication key for this host."
           i18n-helperText
           labelInputID="dhchapKey"
           [invalid]="dhchapKey.isInvalid"
-          [invalidText]="dhchapKeyError">
+          [invalidText]="dhchapKeyError"
+        >
           DHCHAP Key | {{ hostNQN }}
-          <input cdsPassword
-                 cdValidate
-                 #dhchapKey="cdValidate"
-                 [invalid]="dhchapKey.isInvalid"
-                 formControlName="dhchapKey"
-                 type="password"
-                 id="dhchap_key"
-                 placeholder="Enter Host DH-HMAC-CHAP key"
-                 i18n-placeholder
-                 modal-primary-focus
-                 autofocus
-                 autocomplete="off">
+          <input
+            cdsPassword
+            cdValidate
+            #dhchapKey="cdValidate"
+            [invalid]="dhchapKey.isInvalid"
+            formControlName="dhchapKey"
+            type="password"
+            id="dhchap_key"
+            placeholder="Enter Host DH-HMAC-CHAP key"
+            i18n-placeholder
+            modal-primary-focus
+            autofocus
+            autocomplete="off"
+          />
         </cds-text-label>
         <ng-template #dhchapKeyError>
-          <span *ngIf="editForm.controls.dhchapKey.hasError('required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
-          <span *ngIf="editForm.controls.dhchapKey.hasError('invalidBase64')"
-                class="invalid-feedback"
-                i18n>Invalid DH-HMAC-CHAP key. Please enter a valid Base64 encoded key.</span>
+          <span
+            *ngIf="editForm.controls.dhchapKey.hasError('required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            *ngIf="editForm.controls.dhchapKey.hasError('invalidBase64')"
+            class="invalid-feedback"
+            i18n
+            >Invalid DH-HMAC-CHAP key. Please enter a valid Base64 encoded key.</span
+          >
         </ng-template>
       </form>
     </ng-container>
 
     <!-- Step 2: Confirm changes -->
     <ng-container *ngIf="showConfirmation">
-      <p class="cds--type-body-01"
-         i18n>Modifying or removing the Host key can invalidate existing NVMe sessions and interrupt secure communication with hosts. Ensure new keys are configured on all connected systems before continuing.</p>
+      <p
+        class="cds--type-body-01"
+        i18n
+      >
+        Modifying or removing the Host key can invalidate existing NVMe sessions and interrupt
+        secure communication with hosts. Ensure new keys are configured on all connected systems
+        before continuing.
+      </p>
     </ng-container>
   </section>
 
   <!-- Step 1: Save button -->
-  <cd-form-button-panel *ngIf="!showConfirmation"
-                        (submitActionEvent)="onSave()"
-                        (backActionEvent)="closeModal()"
-                        [form]="editForm"
-                        [submitText]="'Save'"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    *ngIf="!showConfirmation"
+    (submitActionEvent)="onSave()"
+    (backActionEvent)="closeModal()"
+    [form]="editForm"
+    [submitText]="'Save'"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 
   <!-- Step 2: Confirm button -->
-  <cd-form-button-panel *ngIf="showConfirmation"
-                        (submitActionEvent)="onSubmit()"
-                        (backActionEvent)="goBack()"
-                        [form]="editForm"
-                        [submitText]="'Save changes'"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    *ngIf="showConfirmation"
+    (submitActionEvent)="onSubmit()"
+    (backActionEvent)="goBack()"
+    [form]="editForm"
+    [submitText]="'Save changes'"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
index 1d2b25733f2..f3b771f22c4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group-filter/nvmeof-gateway-group-filter.component.html
@@ -1,14 +1,19 @@
 <div class="nvmeof-gateway-group-filter cds-mt-3">
-  <span class="nvmeof-gateway-group-filter__label cds--type-body-compact-01"
-        i18n>Gateway group:</span>
-  <cds-combo-box type="single"
-                 size="sm"
-                 class="nvmeof-gateway-group-filter__combo"
-                 [placeholder]="placeholder"
-                 [items]="items"
-                 [disabled]="disabled"
-                 (selected)="onSelected($event)"
-                 (clear)="onClear()">
+  <span
+    class="nvmeof-gateway-group-filter__label cds--type-body-compact-01"
+    i18n
+    >Gateway group:</span
+  >
+  <cds-combo-box
+    type="single"
+    size="sm"
+    class="nvmeof-gateway-group-filter__combo"
+    [placeholder]="placeholder"
+    [items]="items"
+    [disabled]="disabled"
+    (selected)="onSelected($event)"
+    (clear)="onClear()"
+  >
     <cds-dropdown-list></cds-dropdown-list>
   </cds-combo-box>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
index 4a231f214ff..83151424e91 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group-delete-guard-modal.component.html
@@ -1,32 +1,50 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h2 cdsModalHeaderLabel
-        modal-primary-focus
-        i18n>Manage {{ gatewayName }}</h2>
-    <span class="cds--type-heading-03"
-        cdsModalHeaderHeading
-        i18n>Can't delete {{ gatewayName }}</span>
+    <h2
+      cdsModalHeaderLabel
+      modal-primary-focus
+      i18n
+    >
+      Manage {{ gatewayName }}
+    </h2>
+    <span
+      class="cds--type-heading-03"
+      cdsModalHeaderHeading
+      i18n
+      >Can't delete {{ gatewayName }}</span
+    >
   </cds-modal-header>
   <section cdsModalContent>
-    <p class="cds--type-body-01 cds--mb-05"
-       i18n>
-      This resource has connected items that must be deleted first. Delete the connected items, and try again.
+    <p
+      class="cds--type-body-01 cds--mb-05"
+      i18n
+    >
+      This resource has connected items that must be deleted first. Delete the connected items, and
+      try again.
+    </p>
+    <p
+      class="cds--type-label-01 cds--mb-04"
+      i18n
+    >
+      View connected items:
     </p>
-    <p class="cds--type-label-01 cds--mb-04"
-       i18n>View connected items:</p>
     <div>
       @for (sub of connectedSubsystems; track sub.nqn) {
-      <div class="cds--mb-04">
-        <a class="cds--link cds--type-body-01"
-           tabindex="0"
-           (click)="navigateToSubsystem(sub.nqn)"
-           (keydown.enter)="navigateToSubsystem(sub.nqn)">
-          <span class="cds--mr-03">{{ sub.nqn }}</span>
-          <cd-icon type="launch"></cd-icon>
-        </a>
-      </div>
+        <div class="cds--mb-04">
+          <a
+            class="cds--link cds--type-body-01"
+            tabindex="0"
+            (click)="navigateToSubsystem(sub.nqn)"
+            (keydown.enter)="navigateToSubsystem(sub.nqn)"
+          >
+            <span class="cds--mr-03">{{ sub.nqn }}</span>
+            <cd-icon type="launch"></cd-icon>
+          </a>
+        </div>
       }
     </div>
   </section>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
index 8d4007806bc..532b0b63848 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-group/nvmeof-gateway-group.component.html
@@ -11,63 +11,87 @@
     emptyStateTitle="No gateway group created"
     i18n-emptyStateTitle
     emptyStateMessage="Set up your first gateway group to start using NVMe over Fabrics. This will allow you to create high-performance block storage with NVMe/TCP protocol."
-    i18n-emptyStateMessage>
-
+    i18n-emptyStateMessage
+  >
     <div class="table-actions">
-      <cd-table-actions [permission]="permission"
-                        [selection]="selection"
-                        class="btn-group"
-                        [tableActions]="tableActions">
+      <cd-table-actions
+        [permission]="permission"
+        [selection]="selection"
+        class="btn-group"
+        [tableActions]="tableActions"
+      >
       </cd-table-actions>
     </div>
   </cd-table>
 </ng-container>
 
-<ng-template #dateTpl
-             let-created="data.value">
-  <span *ngIf="created">{{ created | date:'EEE d MMM, yyyy' }}</span>
+<ng-template
+  #dateTpl
+  let-created="data.value"
+>
+  <span *ngIf="created">{{ created | date: 'EEE d MMM, yyyy' }}</span>
 </ng-template>
 
-<ng-template #customTableItemTemplate
-             let-value="data.value">
-  <a cdsLink
-     [routerLink]="[viewUrl, value | encodeUri]"
-     (click)="$event.stopPropagation()">
+<ng-template
+  #customTableItemTemplate
+  let-value="data.value"
+>
+  <a
+    cdsLink
+    [routerLink]="[viewUrl, value | encodeUri]"
+    (click)="$event.stopPropagation()"
+  >
     {{ value }}
   </a>
 </ng-template>
 
-<ng-template #gatewayStatusTpl
-             let-gateway="data.value">
-  <div [cdsStack]="'horizontal'"
-       [gap]="4">
-
+<ng-template
+  #gatewayStatusTpl
+  let-gateway="data.value"
+>
+  <div
+    [cdsStack]="'horizontal'"
+    [gap]="4"
+  >
     @if (gateway.running > 0) {
-    <span [ngClass]="gateway.error > 0 ? 'cds-mr-3' : ''">
-      <cd-icon type="success"></cd-icon>
-      <span class="cds-ml-3">{{ gateway.running }}</span>
-    </span>
+      <span [ngClass]="gateway.error > 0 ? 'cds-mr-3' : ''">
+        <cd-icon type="success"></cd-icon>
+        <span class="cds-ml-3">{{ gateway.running }}</span>
+      </span>
     }
 
     @if (gateway.error > 0) {
-    <span>
-      <cd-icon type="error"></cd-icon>
-      <span class="cds-ml-3">{{ gateway.error }}</span>
-    </span>
+      <span>
+        <cd-icon type="error"></cd-icon>
+        <span class="cds-ml-3">{{ gateway.error }}</span>
+      </span>
     }
   </div>
 </ng-template>
 
-<ng-template #deleteTpl
-             let-groupName="groupName"
-             let-subsystemCount="subsystemCount">
+<ng-template
+  #deleteTpl
+  let-groupName="groupName"
+  let-subsystemCount="subsystemCount"
+>
   @if (subsystemCount > 0) {
-  <cd-alert-panel type="warning"
-                  spacingClass="cds-mb-3">
-    <h1 class="cds--type-heading-compact-01"
-        i18n>Cannot delete gateway group</h1>
-    <p class="cds--type-body-compact-01"
-       i18n>This gateway group includes dependent NVMe-oF resources. Remove the associated initiators and gateway targets before proceeding with deletion.</p>
-  </cd-alert-panel>
+    <cd-alert-panel
+      type="warning"
+      spacingClass="cds-mb-3"
+    >
+      <h1
+        class="cds--type-heading-compact-01"
+        i18n
+      >
+        Cannot delete gateway group
+      </h1>
+      <p
+        class="cds--type-body-compact-01"
+        i18n
+      >
+        This gateway group includes dependent NVMe-oF resources. Remove the associated initiators
+        and gateway targets before proceeding with deletion.
+      </p>
+    </cd-alert-panel>
   }
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
index ad98498ca6b..672383670ca 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node-add-modal/nvmeof-gateway-node-add-modal.component.html
@@ -1,68 +1,97 @@
-<cds-modal [open]="open" 
-           (overlaySelected)="closeModal()" 
-           [size]="'md'">
+<cds-modal
+  [open]="open"
+  (overlaySelected)="closeModal()"
+  [size]="'md'"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h4 class="cds--type-heading-04" 
-        i18n>
+    <h4
+      class="cds--type-heading-04"
+      i18n
+    >
       Add gateway nodes
     </h4>
-    <p class="cds--type-body-01" 
-       i18n>
+    <p
+      class="cds--type-body-01"
+      i18n
+    >
       Select NVMe-oF gateway nodes to associate with this gateway group.
     </p>
   </cds-modal-header>
   <section cdsModalContent>
-
     <div class="cds-ml-5 cds-mt-5">
-      <p class="cds--type-heading-01" i18n>Select gateway nodes</p>
-      <p class="cds--type-label-01" i18n>Nodes to run NVMe-oF target pods/services</p>
+      <p
+        class="cds--type-heading-01"
+        i18n
+      >
+        Select gateway nodes
+      </p>
+      <p
+        class="cds--type-label-01"
+        i18n
+      >
+        Nodes to run NVMe-oF target pods/services
+      </p>
     </div>
 
     <!-- Table on white background -->
-    <cd-table (fetchData)="getHosts($event)" 
-              selectionType="multiClick"
-              [searchableObjects]="true"
-              [data]="hosts"
-              [columns]="columns"
-              (updateSelection)="updateSelection($event)" 
-              [autoReload]="false">
+    <cd-table
+      (fetchData)="getHosts($event)"
+      selectionType="multiClick"
+      [searchableObjects]="true"
+      [data]="hosts"
+      [columns]="columns"
+      (updateSelection)="updateSelection($event)"
+      [autoReload]="false"
+    >
     </cd-table>
 
-    <ng-template #addrTemplate 
-                 let-value="data.value">
+    <ng-template
+      #addrTemplate
+      let-value="data.value"
+    >
       <span>{{ value || '-' }}</span>
     </ng-template>
 
-    <ng-template #statusTemplate 
-                 let-value="data.value" 
-                 let-row="data.row">
-      <div class="status-cell" 
-           cdsStack="horizontal"
-           gap="3">
+    <ng-template
+      #statusTemplate
+      let-value="data.value"
+      let-row="data.row"
+    >
+      <div
+        class="status-cell"
+        cdsStack="horizontal"
+        gap="3"
+      >
         @if (value === HostStatus.AVAILABLE) {
-        <cd-icon type="success"></cd-icon>
+          <cd-icon type="success"></cd-icon>
         }
         <span>{{ value | titlecase }}</span>
       </div>
     </ng-template>
 
-    <ng-template #labelsTemplate 
-                 let-value="data.value">
+    <ng-template
+      #labelsTemplate
+      let-value="data.value"
+    >
       @if (value && value.length > 0) {
-      <cds-tag *ngFor="let label of value" 
-                class="tag tag-dark">{{ label }}</cds-tag>
+        <cds-tag
+          *ngFor="let label of value"
+          class="tag tag-dark"
+          >{{ label }}</cds-tag
+        >
       } @else {
-      <span>-</span>
+        <span>-</span>
       }
     </ng-template>
-
   </section>
-  <cd-form-button-panel [modalForm]="true" 
-                        [showSubmit]="true" 
-                        submitText="Add" 
-                        i18n-submitText
-                        [disabled]="selection.selected.length === 0" 
-                        (submitActionEvent)="onSubmit()" 
-                        (backActionEvent)="closeModal()">
+  <cd-form-button-panel
+    [modalForm]="true"
+    [showSubmit]="true"
+    submitText="Add"
+    i18n-submitText
+    [disabled]="selection.selected.length === 0"
+    (submitActionEvent)="onSubmit()"
+    (backActionEvent)="closeModal()"
+  >
   </cd-form-button-panel>
-</cds-modal>
\ No newline at end of file
+</cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
index 0a97671fa3b..7f08cb01e35 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-node/nvmeof-gateway-node.component.html
@@ -1,69 +1,106 @@
 <div class="content-theme">
   @if (mode === 'details' && groupName) {
-  <cd-details-card cardTitle="Details" i18n-cardTitle [details]="gatewayDetails" [showEditButton]="false"
-    class="cds-mb-5">
-  </cd-details-card>
+    <cd-details-card
+      cardTitle="Details"
+      i18n-cardTitle
+      [details]="gatewayDetails"
+      [showEditButton]="false"
+      class="cds-mb-5"
+    >
+    </cd-details-card>
   }
 
   @if (mode === 'details') {
-  <div class="cds-mb-5">
-    <h2 class="cds--type-heading-03 cds-mt-5" i18n>Gateway nodes</h2>
-    <p class="cds--type-body-compact-01" i18n>Nodes running NVMe-oF target pods/services</p>
-  </div>
+    <div class="cds-mb-5">
+      <h2
+        class="cds--type-heading-03 cds-mt-5"
+        i18n
+      >
+        Gateway nodes
+      </h2>
+      <p
+        class="cds--type-body-compact-01"
+        i18n
+      >
+        Nodes running NVMe-oF target pods/services
+      </p>
+    </div>
   }
-  <cd-table #table 
-            [data]="hosts" 
-            [columns]="columns" 
-            columnMode="flex" 
-            (fetchData)="getHosts($event)"
-            [selectionType]="selectionType" 
-            [searchableObjects]="true" 
-            [serverSide]="false" 
-            [maxLimit]="25"
-            identifier="hostname" 
-            [forceIdentifier]="true" 
-            (updateSelection)="updateSelection($event)"
-            emptyStateTitle="No nodes available" i18n-emptyStateTitle
-            emptyStateMessage="Add your first gateway node to start using NVMe over Fabrics. Nodes provide the resources required to expose NVMe/TCP block storage."
-            i18n-emptyStateMessage>
-    <cd-table-actions class="table-actions" 
-                      [permission]="permission" 
-                      [selection]="selection"
-      [tableActions]="tableActions">
+  <cd-table
+    #table
+    [data]="hosts"
+    [columns]="columns"
+    columnMode="flex"
+    (fetchData)="getHosts($event)"
+    [selectionType]="selectionType"
+    [searchableObjects]="true"
+    [serverSide]="false"
+    [maxLimit]="25"
+    identifier="hostname"
+    [forceIdentifier]="true"
+    (updateSelection)="updateSelection($event)"
+    emptyStateTitle="No nodes available"
+    i18n-emptyStateTitle
+    emptyStateMessage="Add your first gateway node to start using NVMe over Fabrics. Nodes provide the resources required to expose NVMe/TCP block storage."
+    i18n-emptyStateMessage
+  >
+    <cd-table-actions
+      class="table-actions"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </cd-table>
 </div>
 
-<ng-template #hostNameTpl 
-             let-value="data.value">
+<ng-template
+  #hostNameTpl
+  let-value="data.value"
+>
   <span class="cds-ml-2">{{ value }}</span>
 </ng-template>
 
-<ng-template #addrTpl let-value="data.value">
+<ng-template
+  #addrTpl
+  let-value="data.value"
+>
   <span>{{ value || '-' }}</span>
 </ng-template>
 
-<ng-template #statusTpl 
-             let-value="data.value" 
-             let-row="data.row">
+<ng-template
+  #statusTpl
+  let-value="data.value"
+  let-row="data.row"
+>
   @if (value) {
-  <div [cdsStack]="'horizontal'" [gap]="4">
-    @if (value === HostStatus.AVAILABLE || value === HostStatus.RUNNING) {
-    <cd-icon type="success"></cd-icon>
-    } @else {
-    <cd-icon type="error"></cd-icon>
-    }
-    <span class="cds-ml-3">{{ value | titlecase }}</span>
-  </div>
+    <div
+      [cdsStack]="'horizontal'"
+      [gap]="4"
+    >
+      @if (value === HostStatus.AVAILABLE || value === HostStatus.RUNNING) {
+        <cd-icon type="success"></cd-icon>
+      } @else {
+        <cd-icon type="error"></cd-icon>
+      }
+      <span class="cds-ml-3">{{ value | titlecase }}</span>
+    </div>
   } @else {
-  <span>-</span>
+    <span>-</span>
   }
 </ng-template>
 
-<ng-template #labelsTpl let-value="data.value">
+<ng-template
+  #labelsTpl
+  let-value="data.value"
+>
   @if (value && value.length > 0) {
-  <cds-tag *ngFor="let label of value" class="tag tag-dark">{{ label }}</cds-tag>
+    <cds-tag
+      *ngFor="let label of value"
+      class="tag tag-dark"
+      >{{ label }}</cds-tag
+    >
   } @else {
-  <span>-</span>
+    <span>-</span>
   }
-</ng-template>
\ No newline at end of file
+</ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.html
index fe9ffaea57d..2afd676ca80 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.html
@@ -18,15 +18,19 @@
   </cd-table>
 </div>
 
-<ng-template #authTpl
-             let-row="data.row">
-  <div cdsStack="horizontal"
-       gap="4">
-  @if (row.auth === authType.NO_AUTH) {
-    <cd-icon type="warning"></cd-icon>
-  } @else {
-    <cd-icon type="success"></cd-icon>
-  }
-  <span class="cds-ml-3">{{ row.auth }}</span>
+<ng-template
+  #authTpl
+  let-row="data.row"
+>
+  <div
+    cdsStack="horizontal"
+    gap="4"
+  >
+    @if (row.auth === authType.NO_AUTH) {
+      <cd-icon type="warning"></cd-icon>
+    } @else {
+      <cd-icon type="success"></cd-icon>
+    }
+    <span class="cds-ml-3">{{ row.auth }}</span>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.html
index 6b2552078ac..d10655df5b8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway/nvmeof-gateway.component.html
@@ -1,51 +1,54 @@
 <fieldset>
   <legend>
     <h1 class="cds--type-heading-03">NVMe over Fabrics (TCP)</h1>
-  <cd-help-text>Monitor and manage NVMe-over-TCP resources for high-performance block storage.</cd-help-text>
+    <cd-help-text
+      >Monitor and manage NVMe-over-TCP resources for high-performance block storage.</cd-help-text
+    >
   </legend>
 </fieldset>
 <section>
-  <cds-tabs type="contained"
-            followFocus="true"
-            isNavigation="true"
-            [cacheActive]="false">
-  <cds-tab
-    heading="Gateway groups"
-    [tabContent]="gateways_content"
+  <cds-tabs
+    type="contained"
+    followFocus="true"
+    isNavigation="true"
+    [cacheActive]="false"
+  >
+    <cds-tab
+      heading="Gateway groups"
+      [tabContent]="gateways_content"
+      i18n-heading
+      [active]="activeTab === Tabs.gateways"
+      (selected)="onSelected(Tabs.gateways)"
+    >
+    </cds-tab>
+    <cds-tab
+      heading="Subsystem"
+      [tabContent]="subsystem_content"
+      i18n-heading
+      [active]="activeTab === Tabs.subsystem"
+      (selected)="onSelected(Tabs.subsystem)"
+    >
+    </cds-tab>
+    <cds-tab
+      heading="Namespace"
+      [tabContent]="namespace_content"
+      i18n-heading
+      [active]="activeTab === Tabs.namespace"
+      (selected)="onSelected(Tabs.namespace)"
+    >
+    </cds-tab>
+  </cds-tabs>
 
-    i18n-heading
-    [active]="activeTab === Tabs.gateways"
-    (selected)="onSelected(Tabs.gateways)">
-  </cds-tab>
-  <cds-tab
-    heading="Subsystem"
-    [tabContent]="subsystem_content"
+  <ng-template #gateways_content>
+    <cd-nvmeof-gateway-group></cd-nvmeof-gateway-group>
+  </ng-template>
 
-    i18n-heading
-    [active]="activeTab === Tabs.subsystem"
-    (selected)="onSelected(Tabs.subsystem)">
-  </cds-tab>
-  <cds-tab
-    heading="Namespace"
-    [tabContent]="namespace_content"
+  <ng-template #subsystem_content>
+    <cd-nvmeof-subsystems></cd-nvmeof-subsystems>
+  </ng-template>
 
-    i18n-heading
-    [active]="activeTab === Tabs.namespace"
-    (selected)="onSelected(Tabs.namespace)">
-  </cds-tab>
-</cds-tabs>
-
-<ng-template #gateways_content>
-  <cd-nvmeof-gateway-group></cd-nvmeof-gateway-group>
-</ng-template>
-
-<ng-template #subsystem_content>
-  <cd-nvmeof-subsystems></cd-nvmeof-subsystems>
-</ng-template>
-
-<ng-template #namespace_content>
-  <cd-nvmeof-namespaces-list></cd-nvmeof-namespaces-list>
-</ng-template>
+  <ng-template #namespace_content>
+    <cd-nvmeof-namespaces-list></cd-nvmeof-namespaces-list>
+  </ng-template>
 </section>
 <router-outlet name="modal"></router-outlet>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
index 7665b73915e..df323eb4f44 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-group-form/nvmeof-group-form.component.html
@@ -3,25 +3,34 @@
   [formGroup]="groupForm"
   novalidate
 >
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{ sm: 4, md: 8 }">
-      <div cdsRow
-           class="form-heading form-item cds-mt-5">
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8 }"
+    >
+      <div
+        cdsRow
+        class="form-heading form-item cds-mt-5"
+      >
         <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
       </div>
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <cds-text-label
             labelInputID="name"
             i18n
             i18n-helperText
             helperText="A unique name to identify this gateway group."
-            [invalid]="groupName.isInvalid">
+            [invalid]="groupName.isInvalid"
+          >
             Gateway group name
             <input
               cdsText
@@ -32,20 +41,33 @@
               autofocus
               formControlName="groupName"
               cdRequiredField="Gateway group name"
-              [invalid]="groupName.isInvalid" />
+              [invalid]="groupName.isInvalid"
+            />
           </cds-text-label>
           <span
             class="invalid-feedback"
             *ngIf="groupForm.showError('groupName', formDir, 'required')"
-            i18n>This field is required.</span>
+            i18n
+            >This field is required.</span
+          >
           <span
             class="invalid-feedback"
-            *ngIf="groupForm.get('groupName')?.hasError('notUnique') && (groupForm.get('groupName')?.dirty || groupForm.get('groupName')?.touched)"
-            i18n>Group name must be unique.</span>
+            *ngIf="
+              groupForm.get('groupName')?.hasError('notUnique') &&
+              (groupForm.get('groupName')?.dirty || groupForm.get('groupName')?.touched)
+            "
+            i18n
+            >Group name must be unique.</span
+          >
           <span
             class="invalid-feedback"
-            *ngIf="groupForm.get('groupName')?.hasError('invalidChars') && (groupForm.get('groupName')?.dirty || groupForm.get('groupName')?.touched)"
-            i18n>Special characters are not allowed.</span>
+            *ngIf="
+              groupForm.get('groupName')?.hasError('invalidChars') &&
+              (groupForm.get('groupName')?.dirty || groupForm.get('groupName')?.touched)
+            "
+            i18n
+            >Special characters are not allowed.</span
+          >
         </div>
       </div>
 
@@ -54,404 +76,532 @@
         cdsRow
         class="form-item"
       >
-      <div cdsCol>
-        <h1 class="cds--type-heading-02">Select target nodes</h1>
-      <cd-help-text>
-        <span i18n>
-          Gateway nodes to run NVMe-oF target pods/services
-        </span>
-      </cd-help-text>
+        <div cdsCol>
+          <h1 class="cds--type-heading-02">Select target nodes</h1>
+          <cd-help-text>
+            <span i18n> Gateway nodes to run NVMe-oF target pods/services </span>
+          </cd-help-text>
+        </div>
+        <div
+          cdsCol
+          class="cds-pt-3 cds-pb-3"
+        >
+          <cd-nvmeof-gateway-node (hostsLoaded)="onHostsLoaded($event)"></cd-nvmeof-gateway-node>
+        </div>
       </div>
       <div
-        cdsCol
-        class="cds-pt-3 cds-pb-3"
+        cdsRow
+        class="form-item cds-mb-0"
       >
-        <cd-nvmeof-gateway-node
-          (hostsLoaded)="onHostsLoaded($event)"
-        ></cd-nvmeof-gateway-node>
-      </div>
-      </div>
-      <div cdsRow class="form-item cds-mb-0">
         <div cdsCol>
           <cds-tile [cdsLayer]="1">
             <!-- Encryption -->
-            <div cdsRow class="form-item">
+            <div
+              cdsRow
+              class="form-item"
+            >
               <div cdsCol>
                 <div class="cds--stack cds--stack-horizontal">
-                  <label class="cds--type-label-01"
-                         for="enableEncryption"
-                         i18n>Enable encryption</label>
-                  <cds-tag type="green"
-                           size="sm"
-                           i18n>Recommended</cds-tag>
+                  <label
+                    class="cds--type-label-01"
+                    for="enableEncryption"
+                    i18n
+                    >Enable encryption</label
+                  >
+                  <cds-tag
+                    type="green"
+                    size="sm"
+                    i18n
+                    >Recommended</cds-tag
+                  >
                 </div>
-                <cds-checkbox id="enableEncryption"
-                              formControlName="enableEncryption">
+                <cds-checkbox
+                  id="enableEncryption"
+                  formControlName="enableEncryption"
+                >
                   <span
-                  class="cds--type-body-01"
-                  i18n>Secures group metadata and unlocks advanced authentication features.</span>
+                    class="cds--type-body-01"
+                    i18n
+                    >Secures group metadata and unlocks advanced authentication features.</span
+                  >
                 </cds-checkbox>
               </div>
             </div>
 
-        @if (!groupForm.controls.enableEncryption.value) {
-        <div cdsRow
-             class="cds-mt-2">
-          <div cdsCol>
-            <cd-alert-panel type="warning"
-                            spacingClass="mb-0"
-                            i18n>
-             <span class="cds--type-heading-01">Encryption is required if you plan to use DH-CHAP or mTLS authentication.</span>
-            </cd-alert-panel>
-          </div>
-        </div>
-        }
+            @if (!groupForm.controls.enableEncryption.value) {
+              <div
+                cdsRow
+                class="cds-mt-2"
+              >
+                <div cdsCol>
+                  <cd-alert-panel
+                    type="warning"
+                    spacingClass="mb-0"
+                    i18n
+                  >
+                    <span class="cds--type-heading-01"
+                      >Encryption is required if you plan to use DH-CHAP or mTLS
+                      authentication.</span
+                    >
+                  </cd-alert-panel>
+                </div>
+              </div>
+            }
 
             @if (groupForm.controls.enableEncryption.value) {
-            <div cdsRow class="form-item">
-              <div cdsCol>
-                <cds-textarea-label
-                  labelInputID="encryptionKey"
-                  helperText="Provide the encryption key used for securing the gateway group."
-                  i18n
-                  i18n-helperText>
-                  Encryption key
-                  <textarea
-                    cdsTextArea
-                    id="encryptionKey"
-                    formControlName="encryptionKey"
-                    rows="4"
-                    cols="100"
-                    cdsTheme="g10">
-                  </textarea>
-                </cds-textarea-label>
-                <span
-                  class="invalid-feedback"
-                  *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
-                  i18n>This field is required.</span>
+              <div
+                cdsRow
+                class="form-item"
+              >
+                <div cdsCol>
+                  <cds-textarea-label
+                    labelInputID="encryptionKey"
+                    helperText="Provide the encryption key used for securing the gateway group."
+                    i18n
+                    i18n-helperText
+                  >
+                    Encryption key
+                    <textarea
+                      cdsTextArea
+                      id="encryptionKey"
+                      formControlName="encryptionKey"
+                      rows="4"
+                      cols="100"
+                      cdsTheme="g10"
+                    >
+                    </textarea>
+                  </cds-textarea-label>
+                  <span
+                    class="invalid-feedback"
+                    *ngIf="groupForm.showError('encryptionKey', formDir, 'required')"
+                    i18n
+                    >This field is required.</span
+                  >
+                </div>
               </div>
-            </div>
             }
           </cds-tile>
 
-          <cds-tile [cdsLayer]="1"
-                    class="cds-mt-3">
-            <div cdsRow class="form-item">
+          <cds-tile
+            [cdsLayer]="1"
+            class="cds-mt-3"
+          >
+            <div
+              cdsRow
+              class="form-item"
+            >
               <div cdsCol>
                 <div class="cds--stack cds--stack-horizontal cds-mb-3">
-                  <label class="cds--type-label-01" for="enableMtls" i18n>Enable Mutual TLS (mTLS)</label>
+                  <label
+                    class="cds--type-label-01"
+                    for="enableMtls"
+                    i18n
+                    >Enable Mutual TLS (mTLS)</label
+                  >
                 </div>
-                <cds-checkbox id="enableMtls" formControlName="enableMtls">
+                <cds-checkbox
+                  id="enableMtls"
+                  formControlName="enableMtls"
+                >
                   <span
-                  class="cds--type-body-01"
-                  i18n>Use mutual TLS (mTLS) to encrypt control and monitoring commands exchanged with NVMe-oF gateways.</span>
+                    class="cds--type-body-01"
+                    i18n
+                    >Use mutual TLS (mTLS) to encrypt control and monitoring commands exchanged with
+                    NVMe-oF gateways.</span
+                  >
                 </cds-checkbox>
               </div>
             </div>
 
             @if (!groupForm.controls.enableMtls.value) {
-            <div cdsRow class="cds-mt-3">
-              <div cdsCol>
-                <cd-alert-panel type="warning"
-                                spacingClass="mb-0"
-                                class="cds--type-heading-01"
-                                i18n>
-                  Disabling mTLS leaves gateway control and monitoring communication unencrypted.
-                </cd-alert-panel>
+              <div
+                cdsRow
+                class="cds-mt-3"
+              >
+                <div cdsCol>
+                  <cd-alert-panel
+                    type="warning"
+                    spacingClass="mb-0"
+                    class="cds--type-heading-01"
+                    i18n
+                  >
+                    Disabling mTLS leaves gateway control and monitoring communication unencrypted.
+                  </cd-alert-panel>
+                </div>
               </div>
-            </div>
             }
 
             @if (groupForm.controls.enableMtls.value) {
-            <div cdsRow class="form-item">
-              <div cdsCol>
-                <label class="cds--label fw-bold" for="certificateType"
-                i18n>Choose Certificate Authority</label>
-                <cds-radio-group
-                  formControlName="certificateType"
-                  orientation="horizontal"
-                  helperText="Select how certificates will be signed for this service. Choose internal to use the cluster's CA, or external to upload certificates signed by your organization."
-                  i18n-helperText>
-                  <cds-radio
-                    value="internal"
-                    [checked]="groupForm.controls.certificateType.value === CertificateType.internal"
-                    (change)="onCertificateTypeChange(CertificateType.internal)"
-                    i18n>
-                    Internal
-                  </cds-radio>
-                  <cds-radio
-                    value="external"
-                    [checked]="groupForm.controls.certificateType.value === CertificateType.external"
-                    (change)="onCertificateTypeChange(CertificateType.external)"
-                    i18n>
-                    External
-                  </cds-radio>
-                </cds-radio-group>
+              <div
+                cdsRow
+                class="form-item"
+              >
+                <div cdsCol>
+                  <label
+                    class="cds--label fw-bold"
+                    for="certificateType"
+                    i18n
+                    >Choose Certificate Authority</label
+                  >
+                  <cds-radio-group
+                    formControlName="certificateType"
+                    orientation="horizontal"
+                    helperText="Select how certificates will be signed for this service. Choose internal to use the cluster's CA, or external to upload certificates signed by your organization."
+                    i18n-helperText
+                  >
+                    <cds-radio
+                      value="internal"
+                      [checked]="
+                        groupForm.controls.certificateType.value === CertificateType.internal
+                      "
+                      (change)="onCertificateTypeChange(CertificateType.internal)"
+                      i18n
+                    >
+                      Internal
+                    </cds-radio>
+                    <cds-radio
+                      value="external"
+                      [checked]="
+                        groupForm.controls.certificateType.value === CertificateType.external
+                      "
+                      (change)="onCertificateTypeChange(CertificateType.external)"
+                      i18n
+                    >
+                      External
+                    </cds-radio>
+                  </cds-radio-group>
+                </div>
               </div>
-            </div>
             }
           </cds-tile>
         </div>
       </div>
 
-      @if (groupForm.controls.enableMtls.value && groupForm.controls.certificateType.value === CertificateType.internal) {
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cd-alert-panel type="info"
-                          spacingClass="mb-3"
-                          i18n>
-            Certificate will be generated automatically by Cephadm CA for internal certificate type.
-          </cd-alert-panel>
-          <cd-text-label-list formControlName="custom_sans"
-                              label="Custom SAN Entries"
-                              i18n-label
-                              helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
-                              i18n-helperText>
-          </cd-text-label-list>
+      @if (
+        groupForm.controls.enableMtls.value &&
+        groupForm.controls.certificateType.value === CertificateType.internal
+      ) {
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cd-alert-panel
+              type="info"
+              spacingClass="mb-3"
+              i18n
+            >
+              Certificate will be generated automatically by Cephadm CA for internal certificate
+              type.
+            </cd-alert-panel>
+            <cd-text-label-list
+              formControlName="custom_sans"
+              label="Custom SAN Entries"
+              i18n-label
+              helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
+              i18n-helperText
+            >
+            </cd-text-label-list>
+          </div>
         </div>
-      </div>
       }
 
-      @if (groupForm.controls.enableMtls.value && groupForm.controls.certificateType.value === CertificateType.external) {
-      <!-- Root CA Certificate Input -->
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-text-label
-            labelInputID="rootCACert"
-            i18n
-            i18n-helperText
-            helperText="Upload a Root CA certificate file, or paste the Root CA certificate PEM content directly.">
-            Root CA Certificate Input
-          </cds-text-label>
-          <div class="cds-mb-2">
-            <button
-              cdsButton="tertiary"
-              type="button"
-              (click)="rootCAFileInput.click()"
-              i18n>
-              Upload File
-            </button>
-            <input
-              #rootCAFileInput
-              type="file"
-              accept=".pem,.crt,.cer"
-              style="display: none"
-              (change)="onFileUpload($event, 'rootCACert')"
-            />
+      @if (
+        groupForm.controls.enableMtls.value &&
+        groupForm.controls.certificateType.value === CertificateType.external
+      ) {
+        <!-- Root CA Certificate Input -->
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cds-text-label
+              labelInputID="rootCACert"
+              i18n
+              i18n-helperText
+              helperText="Upload a Root CA certificate file, or paste the Root CA certificate PEM content directly."
+            >
+              Root CA Certificate Input
+            </cds-text-label>
+            <div class="cds-mb-2">
+              <button
+                cdsButton="tertiary"
+                type="button"
+                (click)="rootCAFileInput.click()"
+                i18n
+              >
+                Upload File
+              </button>
+              <input
+                #rootCAFileInput
+                type="file"
+                accept=".pem,.crt,.cer"
+                style="display: none"
+                (change)="onFileUpload($event, 'rootCACert')"
+              />
+            </div>
+            <cds-textarea-label
+              labelInputID="rootCACertText"
+              helperText="Uploaded files will populate the Root CA certificate details automatically. Or paste the PEM content directly in the text area."
+              i18n-helperText
+            >
+              <textarea
+                cdsTextArea
+                id="rootCACertText"
+                formControlName="rootCACert"
+                placeholder="Paste certificate or private key PEM content"
+                i18n-placeholder
+                cols="100"
+                rows="4"
+              >
+              </textarea>
+            </cds-textarea-label>
+            <span
+              class="invalid-feedback"
+              *ngIf="groupForm.showError('rootCACert', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
-          <cds-textarea-label
-            labelInputID="rootCACertText"
-            helperText="Uploaded files will populate the Root CA certificate details automatically. Or paste the PEM content directly in the text area."
-            i18n-helperText>
-            <textarea cdsTextArea
-                      id="rootCACertText"
-                      formControlName="rootCACert"
-                      placeholder="Paste certificate or private key PEM content"
-                      i18n-placeholder
-                      cols="100"
-                      rows="4">
-            </textarea>
-          </cds-textarea-label>
-          <span class="invalid-feedback"
-                *ngIf="groupForm.showError('rootCACert', formDir, 'required')"
-                i18n>This field is required.</span>
         </div>
-      </div>
 
-      <!-- Client Certificate Input -->
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-text-label
-            labelInputID="clientCert"
-            i18n
-            i18n-helperText
-            helperText="Upload a client certificate file, or paste the client certificate PEM content directly.">
-            Client Certificate Input
-          </cds-text-label>
-          <div class="cds-mb-2">
-            <button
-              cdsButton="tertiary"
-              type="button"
-              (click)="clientCertFileInput.click()"
-              i18n>
-              Upload File
-            </button>
-            <input
-              #clientCertFileInput
-              type="file"
-              accept=".pem,.crt,.cer"
-              style="display: none"
-              (change)="onFileUpload($event, 'clientCert')"
-            />
+        <!-- Client Certificate Input -->
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cds-text-label
+              labelInputID="clientCert"
+              i18n
+              i18n-helperText
+              helperText="Upload a client certificate file, or paste the client certificate PEM content directly."
+            >
+              Client Certificate Input
+            </cds-text-label>
+            <div class="cds-mb-2">
+              <button
+                cdsButton="tertiary"
+                type="button"
+                (click)="clientCertFileInput.click()"
+                i18n
+              >
+                Upload File
+              </button>
+              <input
+                #clientCertFileInput
+                type="file"
+                accept=".pem,.crt,.cer"
+                style="display: none"
+                (change)="onFileUpload($event, 'clientCert')"
+              />
+            </div>
+            <cds-textarea-label
+              labelInputID="clientCertText"
+              helperText="Uploaded files will populate the client certificate details automatically. Or paste the PEM content directly in the text area."
+              i18n-helperText
+            >
+              <textarea
+                cdsTextArea
+                id="clientCertText"
+                formControlName="clientCert"
+                placeholder="Paste certificate or private key PEM content"
+                i18n-placeholder
+                cols="100"
+                rows="4"
+              >
+              </textarea>
+            </cds-textarea-label>
+            <span
+              class="invalid-feedback"
+              *ngIf="groupForm.showError('clientCert', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
-          <cds-textarea-label
-            labelInputID="clientCertText"
-            helperText="Uploaded files will populate the client certificate details automatically. Or paste the PEM content directly in the text area."
-            i18n-helperText>
-            <textarea cdsTextArea
-                      id="clientCertText"
-                      formControlName="clientCert"
-                      placeholder="Paste certificate or private key PEM content"
-                      i18n-placeholder
-                      cols="100"
-                      rows="4">
-            </textarea>
-          </cds-textarea-label>
-          <span class="invalid-feedback"
-                *ngIf="groupForm.showError('clientCert', formDir, 'required')"
-                i18n>This field is required.</span>
         </div>
-      </div>
 
-      <!-- Client Key Input -->
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-text-label
-            labelInputID="clientKey"
-            i18n
-            i18n-helperText
-            helperText="Upload a client key file, or paste the client key PEM content directly.">
-            Client Key Input
-          </cds-text-label>
-          <div class="cds-mb-2">
-            <button
-              cdsButton="tertiary"
-              type="button"
-              (click)="clientKeyFileInput.click()"
-              i18n>
-              Upload File
-            </button>
-            <input
-              #clientKeyFileInput
-              type="file"
-              accept=".pem,.key"
-              style="display: none"
-              (change)="onFileUpload($event, 'clientKey')"
-            />
+        <!-- Client Key Input -->
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cds-text-label
+              labelInputID="clientKey"
+              i18n
+              i18n-helperText
+              helperText="Upload a client key file, or paste the client key PEM content directly."
+            >
+              Client Key Input
+            </cds-text-label>
+            <div class="cds-mb-2">
+              <button
+                cdsButton="tertiary"
+                type="button"
+                (click)="clientKeyFileInput.click()"
+                i18n
+              >
+                Upload File
+              </button>
+              <input
+                #clientKeyFileInput
+                type="file"
+                accept=".pem,.key"
+                style="display: none"
+                (change)="onFileUpload($event, 'clientKey')"
+              />
+            </div>
+            <cds-textarea-label
+              labelInputID="clientKeyText"
+              helperText="Uploaded files will populate the client key details automatically. Or paste the PEM content directly in the text area."
+              i18n-helperText
+            >
+              <textarea
+                cdsTextArea
+                id="clientKeyText"
+                formControlName="clientKey"
+                placeholder="Paste certificate or private key PEM content"
+                i18n-placeholder
+                cols="100"
+                rows="4"
+              >
+              </textarea>
+            </cds-textarea-label>
+            <span
+              class="invalid-feedback"
+              *ngIf="groupForm.showError('clientKey', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
-          <cds-textarea-label
-            labelInputID="clientKeyText"
-            helperText="Uploaded files will populate the client key details automatically. Or paste the PEM content directly in the text area."
-            i18n-helperText>
-            <textarea cdsTextArea
-                      id="clientKeyText"
-                      formControlName="clientKey"
-                      placeholder="Paste certificate or private key PEM content"
-                      i18n-placeholder
-                      cols="100"
-                      rows="4">
-            </textarea>
-          </cds-textarea-label>
-          <span class="invalid-feedback"
-                *ngIf="groupForm.showError('clientKey', formDir, 'required')"
-                i18n>This field is required.</span>
         </div>
-      </div>
 
-      <!-- Server Certificate Input -->
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-text-label
-            labelInputID="serverCert"
-            i18n
-            i18n-helperText
-            helperText="Upload a server certificate file, or paste the server certificate PEM content directly.">
-            Server Certificate Input
-          </cds-text-label>
-          <div class="cds-mb-2">
-            <button
-              cdsButton="tertiary"
-              type="button"
-              (click)="serverCertFileInput.click()"
-              i18n>
-              Upload File
-            </button>
-            <input
-              #serverCertFileInput
-              type="file"
-              accept=".pem,.crt,.cer"
-              style="display: none"
-              (change)="onFileUpload($event, 'serverCert')"
-            />
+        <!-- Server Certificate Input -->
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cds-text-label
+              labelInputID="serverCert"
+              i18n
+              i18n-helperText
+              helperText="Upload a server certificate file, or paste the server certificate PEM content directly."
+            >
+              Server Certificate Input
+            </cds-text-label>
+            <div class="cds-mb-2">
+              <button
+                cdsButton="tertiary"
+                type="button"
+                (click)="serverCertFileInput.click()"
+                i18n
+              >
+                Upload File
+              </button>
+              <input
+                #serverCertFileInput
+                type="file"
+                accept=".pem,.crt,.cer"
+                style="display: none"
+                (change)="onFileUpload($event, 'serverCert')"
+              />
+            </div>
+            <cds-textarea-label
+              labelInputID="serverCertText"
+              helperText="Uploaded files will populate the server certificate details automatically. Or paste the PEM content directly in the text area."
+              i18n-helperText
+            >
+              <textarea
+                cdsTextArea
+                id="serverCertText"
+                formControlName="serverCert"
+                placeholder="Paste certificate or private key PEM content"
+                i18n-placeholder
+                cols="100"
+                rows="4"
+              >
+              </textarea>
+            </cds-textarea-label>
+            <span
+              class="invalid-feedback"
+              *ngIf="groupForm.showError('serverCert', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
-          <cds-textarea-label
-            labelInputID="serverCertText"
-            helperText="Uploaded files will populate the server certificate details automatically. Or paste the PEM content directly in the text area."
-            i18n-helperText>
-            <textarea cdsTextArea
-                      id="serverCertText"
-                      formControlName="serverCert"
-                      placeholder="Paste certificate or private key PEM content"
-                      i18n-placeholder
-                      cols="100"
-                      rows="4">
-            </textarea>
-          </cds-textarea-label>
-          <span class="invalid-feedback"
-                *ngIf="groupForm.showError('serverCert', formDir, 'required')"
-                i18n>This field is required.</span>
         </div>
-      </div>
 
-      <!-- Server Key Input -->
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-text-label
-            labelInputID="serverKey"
-            i18n
-            i18n-helperText
-            helperText="Upload a server key file, or paste the server key PEM content directly.">
-            Server Key Input
-          </cds-text-label>
-          <div class="cds-mb-2">
-            <button
-              cdsButton="tertiary"
-              type="button"
-              (click)="serverKeyFileInput.click()"
-              i18n>
-              Upload File
-            </button>
-            <input
-              #serverKeyFileInput
-              type="file"
-              accept=".pem,.key"
-              style="display: none"
-              (change)="onFileUpload($event, 'serverKey')"
-            />
+        <!-- Server Key Input -->
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cds-text-label
+              labelInputID="serverKey"
+              i18n
+              i18n-helperText
+              helperText="Upload a server key file, or paste the server key PEM content directly."
+            >
+              Server Key Input
+            </cds-text-label>
+            <div class="cds-mb-2">
+              <button
+                cdsButton="tertiary"
+                type="button"
+                (click)="serverKeyFileInput.click()"
+                i18n
+              >
+                Upload File
+              </button>
+              <input
+                #serverKeyFileInput
+                type="file"
+                accept=".pem,.key"
+                style="display: none"
+                (change)="onFileUpload($event, 'serverKey')"
+              />
+            </div>
+            <cds-textarea-label
+              labelInputID="serverKeyText"
+              helperText="Uploaded files will populate the server key details automatically. Or paste the PEM content directly in the text area."
+              i18n-helperText
+            >
+              <textarea
+                cdsTextArea
+                id="serverKeyText"
+                formControlName="serverKey"
+                placeholder="Paste certificate or private key PEM content"
+                i18n-placeholder
+                cols="100"
+                rows="4"
+              >
+              </textarea>
+            </cds-textarea-label>
+            <span
+              class="invalid-feedback"
+              *ngIf="groupForm.showError('serverKey', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
-          <cds-textarea-label
-            labelInputID="serverKeyText"
-            helperText="Uploaded files will populate the server key details automatically. Or paste the PEM content directly in the text area."
-            i18n-helperText>
-            <textarea cdsTextArea
-                      id="serverKeyText"
-                      formControlName="serverKey"
-                      placeholder="Paste certificate or private key PEM content"
-                      i18n-placeholder
-                      cols="100"
-                      rows="4">
-            </textarea>
-          </cds-textarea-label>
-          <span class="invalid-feedback"
-                *ngIf="groupForm.showError('serverKey', formDir, 'required')"
-                i18n>This field is required.</span>
         </div>
-      </div>
       }
 
-      <div cdsRow class="cds-mt-5">
+      <div
+        cdsRow
+        class="cds-mt-5"
+      >
         <cd-form-button-panel
           (submitActionEvent)="onSubmit()"
           [form]="groupForm"
-          [submitText]="(action | titlecase) + ' ' + (resource)"
+          [submitText]="(action | titlecase) + ' ' + resource"
           [disabled]="isCreateDisabled"
-          wrappingClass="text-right">
+          wrappingClass="text-right"
+        >
         </cd-form-button-panel>
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html
index a4c8a8a1a35..bbedd833c80 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.html
@@ -6,22 +6,24 @@
   (stepChanged)="onStepChanged()"
   [isSubmitLoading]="isSubmitLoading"
   submitButtonLabel="Add"
-  i18n-submitButtonLabel>
-
+  i18n-submitButtonLabel
+>
   <cd-tearsheet-step>
     <cd-nvmeof-subsystem-step-two
       #tearsheetStep
-               modal-primary-focus
+      modal-primary-focus
       [group]="group"
       [allowAllHosts]="allowAllHosts"
-      [existingHosts]="existingHosts"></cd-nvmeof-subsystem-step-two>
-  </cd-tearsheet-step>
-  @if(showAuthStep) {
-  <cd-tearsheet-step>
-    <cd-nvmeof-subsystem-step-three
-      #tearsheetStep
-      [stepTwoValue]="stepTwoValue"
-      [group]="group"></cd-nvmeof-subsystem-step-three>
+      [existingHosts]="existingHosts"
+    ></cd-nvmeof-subsystem-step-two>
   </cd-tearsheet-step>
+  @if (showAuthStep) {
+    <cd-tearsheet-step>
+      <cd-nvmeof-subsystem-step-three
+        #tearsheetStep
+        [stepTwoValue]="stepTwoValue"
+        [group]="group"
+      ></cd-nvmeof-subsystem-step-three>
+    </cd-tearsheet-step>
   }
 </cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
index b97d6684bad..197f82cede0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-list/nvmeof-initiators-list.component.html
@@ -1,44 +1,63 @@
 @if (allowAllHosts) {
   <cd-alert-panel
-  class="cds-mb-4"
-  type="warning"
-  [showTitle]="false">
-  <div cdsStack="vertical"
-       gap="1">
-    <strong class="cds-mb-1"
-            i18n>All hosts allowed</strong>
-    <p class="cds-mb-0"
-       i18n>
-      Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
-    </p>
-  </div>
-</cd-alert-panel>
+    class="cds-mb-4"
+    type="warning"
+    [showTitle]="false"
+  >
+    <div
+      cdsStack="vertical"
+      gap="1"
+    >
+      <strong
+        class="cds-mb-1"
+        i18n
+        >All hosts allowed</strong
+      >
+      <p
+        class="cds-mb-0"
+        i18n
+      >
+        Allowing all hosts grants access to every initiator on the network. Authentication is not
+        supported in this mode, which may expose the subsystem to unauthorized access.
+      </p>
+    </div>
+  </cd-alert-panel>
 }
 
-<cd-table [data]="initiators"
-          columnMode="flex"
-          (fetchData)="listInitiators()"
-          [columns]="initiatorColumns"
-          selectionType="multiClick"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  [data]="initiators"
+  columnMode="flex"
+  (fetchData)="listInitiators()"
+  [columns]="initiatorColumns"
+  selectionType="multiClick"
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
-    <cd-table-actions [permission]="permission"
-                      [selection]="selection"
-                      class="btn-group"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      [permission]="permission"
+      [selection]="selection"
+      class="btn-group"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
 </cd-table>
 
-<ng-template #hostNqnTpl
-             let-row="data.row">
+<ng-template
+  #hostNqnTpl
+  let-row="data.row"
+>
   {{ getDisplayedHostNqn(row.nqn) }}
 </ng-template>
 
-<ng-template #dhchapTpl
-             let-row="data.row">
-  <div cdsStack="horizontal"
-       gap="4">
+<ng-template
+  #dhchapTpl
+  let-row="data.row"
+>
+  <div
+    cdsStack="horizontal"
+    gap="4"
+  >
     @if (row.nqn === allowAllHost) {
       {{ '-' }}
     } @else {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-form/nvmeof-listeners-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-form/nvmeof-listeners-form.component.html
index c0775f727b3..e96630de2c1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-form/nvmeof-listeners-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-form/nvmeof-listeners-form.component.html
@@ -6,14 +6,15 @@
   (submitRequested)="onSubmit($event)"
   [isSubmitLoading]="isSubmitLoading"
   submitButtonLabel="Add"
-  i18n-submitButtonLabel>
-
+  i18n-submitButtonLabel
+>
   <cd-tearsheet-step>
     <cd-nvmeof-subsystem-step-one
       #tearsheetStep
-               modal-primary-focus
+      modal-primary-focus
       [group]="group"
       [subsystemNQN]="subsystemNQN"
-      [listenersOnly]="true"></cd-nvmeof-subsystem-step-one>
+      [listenersOnly]="true"
+    ></cd-nvmeof-subsystem-step-one>
   </cd-tearsheet-step>
 </cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-list/nvmeof-listeners-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-list/nvmeof-listeners-list.component.html
index e0d24d635e4..7e91024675e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-list/nvmeof-listeners-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-listeners-list/nvmeof-listeners-list.component.html
@@ -1,29 +1,38 @@
-<cd-alert-panel *ngIf="listeners && listeners.length === 0"
-                type="error"
-                title="No listeners exists"
-                spacingClass="cds-mb-3"
-                i18n-title>
-  <ng-container i18n>Currently, there are no listeners available in the NVMe subsystem. Please check your configuration or try again later.</ng-container>
+<cd-alert-panel
+  *ngIf="listeners && listeners.length === 0"
+  type="error"
+  title="No listeners exists"
+  spacingClass="cds-mb-3"
+  i18n-title
+>
+  <ng-container i18n
+    >Currently, there are no listeners available in the NVMe subsystem. Please check your
+    configuration or try again later.</ng-container
+  >
 </cd-alert-panel>
 
-<cd-table [data]="listeners"
-          columnMode="flex"
-          (fetchData)="listListeners()"
-          [columns]="listenerColumns"
-          identifier="id"
-          forceIdentifier="true"
-          selectionType="single"
-          emptyStateTitle="No listener found."
-          i18n-emptyStateTitle
-          emptyStateMessage="No listeners found. Add listeners to define network endpoints for hosts"
-          i18n-emptyStateMessage
-          [emptyStateImage]="emptyStateImage.search"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  [data]="listeners"
+  columnMode="flex"
+  (fetchData)="listListeners()"
+  [columns]="listenerColumns"
+  identifier="id"
+  forceIdentifier="true"
+  selectionType="single"
+  emptyStateTitle="No listener found."
+  i18n-emptyStateTitle
+  emptyStateMessage="No listeners found. Add listeners to define network endpoints for hosts"
+  i18n-emptyStateMessage
+  [emptyStateImage]="emptyStateImage.search"
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
-    <cd-table-actions [permission]="permission"
-                      [selection]="selection"
-                      class="btn-group"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      [permission]="permission"
+      [selection]="selection"
+      class="btn-group"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespace-expand-modal/nvmeof-namespace-expand-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespace-expand-modal/nvmeof-namespace-expand-modal.component.html
index 15aa4ce933c..2e36f740b89 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespace-expand-modal/nvmeof-namespace-expand-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespace-expand-modal/nvmeof-namespace-expand-modal.component.html
@@ -1,64 +1,89 @@
-<cds-modal size="sm"
-           [open]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h4 cdsModalHeaderLabel
-        class="cds--type-label-01"
-        i18n>Namespace</h4>
-    <h3 cdsModalHeaderHeading
-        class="cds--type-heading-03"
-        i18n>Expand namespace</h3>
+    <h4
+      cdsModalHeaderLabel
+      class="cds--type-label-01"
+      i18n
+    >
+      Namespace
+    </h4>
+    <h3
+      cdsModalHeaderHeading
+      class="cds--type-heading-03"
+      i18n
+    >
+      Expand namespace
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <div class="cds--type-body-01 cds-mb-3"
-         i18n>
+    <div
+      class="cds--type-body-01 cds-mb-3"
+      i18n
+    >
       Increase the NVMe namespace storage capacity by resizing the backing image.
     </div>
 
     <div class="cds--type-body-01 cds-mb-5">
       <div class="cds-mb-3">
-        <svg [cdsIcon]="icons.datastore"
-             size="16"
-             class="cds-mr-3"></svg>
+        <svg
+          [cdsIcon]="icons.datastore"
+          size="16"
+          class="cds-mr-3"
+        ></svg>
         <strong><span i18n>namespace</span>-{{ nsid }}</strong>
       </div>
-      <div class="cds--type-helper-text-01 cds-mb-1">
-        <span i18n>Image:</span> {{ imageName }}
-      </div>
+      <div class="cds--type-helper-text-01 cds-mb-1"><span i18n>Image:</span> {{ imageName }}</div>
       <div class="cds--type-helper-text-01">
         <span i18n>Current size:</span> {{ currentBytes | dimlessBinary }}
       </div>
     </div>
 
-    <form name="nsForm"
-          #formDir="ngForm"
-          [formGroup]="nsForm"
-          novalidate>
+    <form
+      name="nsForm"
+      #formDir="ngForm"
+      [formGroup]="nsForm"
+      novalidate
+    >
       <div class="form-item">
-        <cds-number label="Enter the new size of the namespace image (GiB)"
-                    i18n-label
-                    [formControlName]="'image_size'"
-                    [invalid]="nsForm.controls['image_size'].invalid && (nsForm.controls['image_size'].dirty || nsForm.controls['image_size'].touched)"
-                    [invalidText]="sizeErrorRef"
-                    [min]="minSize"
-                    required
-                    modal-primary-focus></cds-number>
+        <cds-number
+          label="Enter the new size of the namespace image (GiB)"
+          i18n-label
+          [formControlName]="'image_size'"
+          [invalid]="
+            nsForm.controls['image_size'].invalid &&
+            (nsForm.controls['image_size'].dirty || nsForm.controls['image_size'].touched)
+          "
+          [invalidText]="sizeErrorRef"
+          [min]="minSize"
+          required
+          modal-primary-focus
+        ></cds-number>
         <ng-template #sizeErrorRef>
-          <ng-container *ngTemplateOutlet="validationErrors; context: { control: nsForm.get('image_size') }"></ng-container>
+          <ng-container
+            *ngTemplateOutlet="validationErrors; context: { control: nsForm.get('image_size') }"
+          ></ng-container>
         </ng-template>
       </div>
     </form>
 
-    <ng-template #validationErrors
-                 let-control="control">
-    @for (err of control.errors | keyvalue; track err.key) {
-      <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
-    }
+    <ng-template
+      #validationErrors
+      let-control="control"
+    >
+      @for (err of control.errors | keyvalue; track err.key) {
+        <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+      }
     </ng-template>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                        [submitText]="expandText"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="onSubmit()"
+    [submitText]="expandText"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html
index 54308a6c43e..c4beb493e61 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.html
@@ -2,16 +2,22 @@
   name="nsForm"
   #formDir="ngForm"
   [formGroup]="nsForm"
-  novalidate>
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-
-    <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8}">
-      <div cdsRow
-           class="form-heading form-item">
+  novalidate
+>
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8 }"
+    >
+      <div
+        cdsRow
+        class="form-heading form-item"
+      >
         <h3>{{ title }}</h3>
         <cd-help-text>
           <span>
@@ -21,8 +27,10 @@
       </div>
 
       <!-- Subsystem -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <cds-select
             formControlName="subsystem"
@@ -32,34 +40,45 @@
             [invalid]="subsystemRef.isInvalid"
             invalidText="This field is required"
             i18n-label
-            i18n-invalidText>
+            i18n-invalidText
+          >
             @if (!subsystems) {
-            <option
-              [ngValue]="null"
-              disabled>Loading...</option>
+              <option
+                [ngValue]="null"
+                disabled
+              >
+                Loading...
+              </option>
             }
             @if (subsystems && subsystems.length === 0) {
-            <option
-              [ngValue]="null"
-              disabled>-- No subsystems available --</option>
+              <option
+                [ngValue]="null"
+                disabled
+              >
+                -- No subsystems available --
+              </option>
             }
             @if (subsystems && subsystems.length > 0) {
-            <option
-              selectionFeedback="top-after-reopen"
-              value=""
-              selected>Select a subsystem</option>
+              <option
+                selectionFeedback="top-after-reopen"
+                value=""
+                selected
+              >
+                Select a subsystem
+              </option>
             }
             @for (subsystem of subsystems; track subsystem.nqn) {
-            <option
-              [value]="subsystem.nqn">{{ subsystem.nqn }}</option>
+              <option [value]="subsystem.nqn">{{ subsystem.nqn }}</option>
             }
           </cds-select>
         </div>
       </div>
 
       <!-- Namespace Count (Create only) -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <cds-number
             cdValidate
@@ -70,19 +89,25 @@
             [min]="MIN_NAMESPACE_CREATE"
             [max]="MAX_NAMESPACE_CREATE"
             [invalid]="nsCountRef.isInvalid"
-            [invalidText]="nsForm.getError('required', 'nsCount') ? requiredInvalidText : nsCountInvalidText"
+            [invalidText]="
+              nsForm.getError('required', 'nsCount') ? requiredInvalidText : nsCountInvalidText
+            "
             i18n-label
-            i18n-helperText>
+            i18n-helperText
+          >
           </cds-number>
         </div>
       </div>
 
       <!-- Image Size -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div
           cdsCol
-          [columnNumbers]="{md: 4}">
+          [columnNumbers]="{ md: 4 }"
+        >
           <cds-text-label
             label="Image size (GiB)"
             helperText="The size of the namespace image."
@@ -90,57 +115,75 @@
             [invalidText]="sizeError"
             cdRequiredField="Image Size"
             i18n-label
-            i18n-helperText>
-            <input cdsText
-                   cdValidate
-                   #imageSize="cdValidate"
-                   type="text"
-                   placeholder="e.g. 100 GiB"
-                   id="image_size"
-                   formControlName="image_size"
-                   defaultUnit="GiB"
-                   [min]="0"
-                   [invalid]="imageSize.isInvalid"
-                   cdDimlessBinary>
+            i18n-helperText
+          >
+            <input
+              cdsText
+              cdValidate
+              #imageSize="cdValidate"
+              type="text"
+              placeholder="e.g. 100 GiB"
+              id="image_size"
+              formControlName="image_size"
+              defaultUnit="GiB"
+              [min]="0"
+              [invalid]="imageSize.isInvalid"
+              cdDimlessBinary
+            />
           </cds-text-label>
           <ng-template #sizeError>
-            <span
-              i18n>Enter a valid size (e.g., 10GiB).</span>
+            <span i18n>Enter a valid size (e.g., 10GiB).</span>
           </ng-template>
         </div>
       </div>
 
       <!-- Host Access (UI only) -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <legend
             class="cds--type-label-01"
-            i18n>Host access (Initiators)</legend>
+            i18n
+          >
+            Host access (Initiators)
+          </legend>
           <div class="form-item">
             <cds-radio-group
               formControlName="host_access"
-              orientation="horizontal">
+              orientation="horizontal"
+            >
               <cds-radio
                 value="all"
-                [checked]="true">
+                [checked]="true"
+              >
                 <div>
                   <span
                     class="cds--type-body-compact-01"
-                    i18n>All hosts on the subsystem</span>
+                    i18n
+                    >All hosts on the subsystem</span
+                  >
                   <span
                     class="cds--type-helper-text-01 cds-ml-1 d-block"
-                    i18n>Allow all hosts associated with the selected subsystem to access the namespace.</span>
+                    i18n
+                    >Allow all hosts associated with the selected subsystem to access the
+                    namespace.</span
+                  >
                 </div>
               </cds-radio>
               <cds-radio value="specific">
                 <div>
                   <span
                     class="cds--type-body-compact-01"
-                    i18n>Select specific hosts</span>
+                    i18n
+                    >Select specific hosts</span
+                  >
                   <span
                     class="cds--type-helper-text-01 cds-ml-1 d-block"
-                    i18n>Only the selected hosts will be able to access this namespace.</span>
+                    i18n
+                    >Only the selected hosts will be able to access this namespace.</span
+                  >
                 </div>
               </cds-radio>
             </cds-radio-group>
@@ -150,33 +193,41 @@
 
       <!-- Host Selection (Visible only when 'specific' is selected) -->
       @if (nsForm.getValue('host_access') === 'specific') {
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <div class="form-item">
-            <cds-combo-box
-              type="multi"
-              selectionFeedback="top-after-reopen"
-              label="Select hosts"
-              i18n-label
-              placeholder="Select one or more hosts"
-              [appendInline]="true"
-              [items]="initiatorCandidates"
-              (selected)="onInitiatorSelection($event)"
-              [invalid]="nsForm.controls['initiators'].invalid && (nsForm.controls['initiators'].dirty || nsForm.controls['initiators'].touched)"
-              invalidText="This field is required"
-              i18n-invalidText
-              i18n-placeholder>
-              <cds-dropdown-list></cds-dropdown-list>
-            </cds-combo-box>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <div class="form-item">
+              <cds-combo-box
+                type="multi"
+                selectionFeedback="top-after-reopen"
+                label="Select hosts"
+                i18n-label
+                placeholder="Select one or more hosts"
+                [appendInline]="true"
+                [items]="initiatorCandidates"
+                (selected)="onInitiatorSelection($event)"
+                [invalid]="
+                  nsForm.controls['initiators'].invalid &&
+                  (nsForm.controls['initiators'].dirty || nsForm.controls['initiators'].touched)
+                "
+                invalidText="This field is required"
+                i18n-invalidText
+                i18n-placeholder
+              >
+                <cds-dropdown-list></cds-dropdown-list>
+              </cds-combo-box>
+            </div>
           </div>
         </div>
-      </div>
       }
 
       <!-- Pool -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <cds-select
             formControlName="pool"
@@ -188,119 +239,166 @@
             helperText="Pool where the backing Ceph block device resides."
             i18n-label
             i18n-invalidText
-            i18n-helperText>
+            i18n-helperText
+          >
             @if (rbdPools === null) {
-            <option
-              [ngValue]="null"
-              disabled>Loading...</option>
+              <option
+                [ngValue]="null"
+                disabled
+              >
+                Loading...
+              </option>
             }
             @if (rbdPools && rbdPools.length === 0) {
-            <option
-              [ngValue]="null"
-              disabled>-- No block pools available --</option>
+              <option
+                [ngValue]="null"
+                disabled
+              >
+                -- No block pools available --
+              </option>
             }
             @if (rbdPools && rbdPools.length > 0) {
-            <option
-              value=""
-              selected>Select a RBD image pool</option>
+              <option
+                value=""
+                selected
+              >
+                Select a RBD image pool
+              </option>
             }
             @for (pool of rbdPools; track pool.pool_name) {
-            <option
-              [value]="pool.pool_name">{{ pool.pool_name }}</option>
+              <option [value]="pool.pool_name">{{ pool.pool_name }}</option>
             }
           </cds-select>
         </div>
       </div>
 
       <!-- RBD image creation (UI only) -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <legend
             class="cds--type-label-01"
-            i18n>RBD image creation</legend>
+            i18n
+          >
+            RBD image creation
+          </legend>
           <cds-radio-group
             formControlName="rbd_image_creation"
-            orientation="vertical">
+            orientation="vertical"
+          >
             <cds-radio
               value="gateway_provisioned"
-              i18n>Gateway-provisioned image</cds-radio>
+              i18n
+              >Gateway-provisioned image</cds-radio
+            >
             <cds-radio
               value="externally_managed"
               [disabled]="nsForm.getValue('nsCount') > 1"
-              [title]="nsForm.getValue('nsCount') > 1 ? 'Unavailable during bulk creation. RBD images are created automatically.' : ''"
-              i18n>Externally managed image</cds-radio>
+              [title]="
+                nsForm.getValue('nsCount') > 1
+                  ? 'Unavailable during bulk creation. RBD images are created automatically.'
+                  : ''
+              "
+              i18n
+              >Externally managed image</cds-radio
+            >
           </cds-radio-group>
         </div>
       </div>
 
       <!-- Image Name (Visible only when 'gateway_provisioned' is selected) -->
-      @if (nsForm.getValue('rbd_image_creation') === 'gateway_provisioned' && nsForm.getValue('nsCount') > 1) {
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cd-alert-panel
-            type="info"
-            [dismissible]="false"
-            [showTitle]="false">
-            <strong i18n>For bulk namespace creation, RBD images are provisioned automatically.</strong>
-          </cd-alert-panel>
+      @if (
+        nsForm.getValue('rbd_image_creation') === 'gateway_provisioned' &&
+        nsForm.getValue('nsCount') > 1
+      ) {
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cd-alert-panel
+              type="info"
+              [dismissible]="false"
+              [showTitle]="false"
+            >
+              <strong i18n
+                >For bulk namespace creation, RBD images are provisioned automatically.</strong
+              >
+            </cd-alert-panel>
 
-          <div class="form-item">
-            <label
-              for="rbd_image_name"
-              class="cds--type-label-01"
-              i18n>Image name (optional)</label>
-            <cds-text-label
-              helperText="Provide a name for the images. For bulk creation, this will be used as the base prefix with numeric suffixes (e.g., img-1, img-2). Leave blank to auto-generate."
-              [invalid]="rbdImageName.isInvalid"
-              [invalidText]="nsForm.getError('rbdImageName', 'rbd_image_name') ? 'Image name contains invalid characters' : ''"
-              i18n-helperText
-              i18n-invalidText>
-              <input cdsText
-                     cdValidate
-                     #rbdImageName="cdValidate"
-                     placeholder="Enter a name"
-                     formControlName="rbd_image_name"
-                     [invalid]="rbdImageName.isInvalid" />
-            </cds-text-label>
+            <div class="form-item">
+              <label
+                for="rbd_image_name"
+                class="cds--type-label-01"
+                i18n
+                >Image name (optional)</label
+              >
+              <cds-text-label
+                helperText="Provide a name for the images. For bulk creation, this will be used as the base prefix with numeric suffixes (e.g., img-1, img-2). Leave blank to auto-generate."
+                [invalid]="rbdImageName.isInvalid"
+                [invalidText]="
+                  nsForm.getError('rbdImageName', 'rbd_image_name')
+                    ? 'Image name contains invalid characters'
+                    : ''
+                "
+                i18n-helperText
+                i18n-invalidText
+              >
+                <input
+                  cdsText
+                  cdValidate
+                  #rbdImageName="cdValidate"
+                  placeholder="Enter a name"
+                  formControlName="rbd_image_name"
+                  [invalid]="rbdImageName.isInvalid"
+                />
+              </cds-text-label>
+            </div>
           </div>
         </div>
-      </div>
       }
 
       <!-- Image Selection (Visible only when 'externally_managed' is selected) -->
       @if (nsForm.getValue('rbd_image_creation') === 'externally_managed') {
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <cds-select
-            formControlName="rbd_image_name"
-            cdValidate
-            #rbdImageSelectRef="cdValidate"
-            label="RBD Image"
-            [invalid]="rbdImageSelectRef.isInvalid"
-            invalidText="This field is required"
-            helperText="Select an existing RBD image from the pool to expose as a namespace."
-            i18n-label
-            i18n-invalidText
-            i18n-helperText>
-            <option
-              [ngValue]="null"
-              disabled
-              selected>Select an image</option>
-            @for (img of rbdImages; track img.name) {
-            <option
-              [value]="img.name">{{ img.name }} ({{ img.size | dimlessBinary }})</option>
-            }
-          </cds-select>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <cds-select
+              formControlName="rbd_image_name"
+              cdValidate
+              #rbdImageSelectRef="cdValidate"
+              label="RBD Image"
+              [invalid]="rbdImageSelectRef.isInvalid"
+              invalidText="This field is required"
+              helperText="Select an existing RBD image from the pool to expose as a namespace."
+              i18n-label
+              i18n-invalidText
+              i18n-helperText
+            >
+              <option
+                [ngValue]="null"
+                disabled
+                selected
+              >
+                Select an image
+              </option>
+              @for (img of rbdImages; track img.name) {
+                <option [value]="img.name">{{ img.name }} ({{ img.size | dimlessBinary }})</option>
+              }
+            </cds-select>
+          </div>
         </div>
-      </div>
       }
 
       <!-- Namespace Block Size (bytes) -->
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <div cdsCol>
           <cds-number
             cdValidate
@@ -311,7 +409,8 @@
             [min]="0"
             [invalid]="namespaceSize.isInvalid"
             i18n-label
-            i18n-helperText>
+            i18n-helperText
+          >
           </cds-number>
         </div>
       </div>
@@ -321,10 +420,10 @@
           (submitActionEvent)="onSubmit()"
           [form]="nsForm"
           [submitText]="(action | titlecase) + ' ' + (resource | titlecase)"
-          wrappingClass="text-right form-button">
+          wrappingClass="text-right form-button"
+        >
         </cd-form-button-panel>
       </div>
-
     </div>
   </div>
 </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
index c8db104d65a..b38d58bec27 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-list/nvmeof-namespaces-list.component.html
@@ -1,35 +1,37 @@
 <div class="nvmeof-content-layout">
   <div class="nvmeof-content-main">
-<ng-container *ngIf="namespaces$ | async as namespaces">
-  <cd-table [data]="namespaces"
-            [compactSearchField]="true"
-            columnMode="flex"
-            (fetchData)="fetchData()"
-            [columns]="namespacesColumns"
-            identifier="unique_id"
-            [forceIdentifier]="true"
-            selectionType="single"
-            (updateSelection)="updateSelection($event)"
-            emptyStateTitle="No namespaces created."
-            i18n-emptyStateTitle
-            emptyStateMessage="Namespaces are storage volumes mapped to subsystems for host access. Create a namespace to start provisioning storage within a subsystem."
-            i18n-emptyStateMessage>
+    <ng-container *ngIf="namespaces$ | async as namespaces">
+      <cd-table
+        [data]="namespaces"
+        [compactSearchField]="true"
+        columnMode="flex"
+        (fetchData)="fetchData()"
+        [columns]="namespacesColumns"
+        identifier="unique_id"
+        [forceIdentifier]="true"
+        selectionType="single"
+        (updateSelection)="updateSelection($event)"
+        emptyStateTitle="No namespaces created."
+        i18n-emptyStateTitle
+        emptyStateMessage="Namespaces are storage volumes mapped to subsystems for host access. Create a namespace to start provisioning storage within a subsystem."
+        i18n-emptyStateMessage
+      >
+        <div class="table-filter">
+          <cd-nvmeof-gateway-group-filter (groupChange)="groupHandler.onGroupChange($event)">
+          </cd-nvmeof-gateway-group-filter>
+        </div>
 
-    <div class="table-filter">
-      <cd-nvmeof-gateway-group-filter
-        (groupChange)="groupHandler.onGroupChange($event)">
-      </cd-nvmeof-gateway-group-filter>
-    </div>
-
-  <div class="table-actions">
-    <cd-table-actions [permission]="permission"
-                      [selection]="selection"
-                      class="btn-group"
-                      [tableActions]="tableActions">
-    </cd-table-actions>
-  </div>
-</cd-table>
-</ng-container>
+        <div class="table-actions">
+          <cd-table-actions
+            [permission]="permission"
+            [selection]="selection"
+            class="btn-group"
+            [tableActions]="tableActions"
+          >
+          </cd-table-actions>
+        </div>
+      </cd-table>
+    </ng-container>
   </div>
 </div>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
index 5592a4aa107..f544a4989a0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-setup-cards/nvmeof-setup-cards.component.html
@@ -1,17 +1,28 @@
 <cd-productive-card>
   <ng-template #header>
-    <div cdsStack="vertical"
-         [gap]="3">
-      <h2 class="cds--type-heading-03"
-          i18n>Recommended first-time setup</h2>
-      <p class="cds--type-body-01"
-         i18n>
+    <div
+      cdsStack="vertical"
+      [gap]="3"
+    >
+      <h2
+        class="cds--type-heading-03"
+        i18n
+      >
+        Recommended first-time setup
+      </h2>
+      <p
+        class="cds--type-body-01"
+        i18n
+      >
         Start your NVMe over Fabrics configuration by creating the essential resources in sequence.
       </p>
     </div>
   </ng-template>
 
-  <div cdsStack="horizontal" [gap]="4">
+  <div
+    cdsStack="horizontal"
+    [gap]="4"
+  >
     <div>
       <cd-setup-step-card
         [stepNumber]="1"
@@ -19,39 +30,45 @@
         [description]="cards.gateway.description"
         [isConfigured]="hasGatewayGroups"
         [successMessage]="cards.gateway.successMessage"
-        [infoMessage]="cards.gateway.infoMessage">
+        [infoMessage]="cards.gateway.infoMessage"
+      >
       </cd-setup-step-card>
     </div>
 
-    <div >
+    <div>
       <cd-setup-step-card
         [stepNumber]="2"
         [title]="cards.subsystem.title"
         [description]="cards.subsystem.description"
         [isConfigured]="hasSubsystems"
         [successMessage]="cards.subsystem.successMessage"
-        [infoMessage]="cards.subsystem.infoMessage">
+        [infoMessage]="cards.subsystem.infoMessage"
+      >
       </cd-setup-step-card>
     </div>
 
-    <div >
+    <div>
       <cd-setup-step-card
         [stepNumber]="3"
         [title]="cards.namespace.title"
         [description]="cards.namespace.description"
         [isConfigured]="hasNamespaces"
         [successMessage]="cards.namespace.successMessage"
-        [infoMessage]="cards.namespace.infoMessage">
+        [infoMessage]="cards.namespace.infoMessage"
+      >
       </cd-setup-step-card>
     </div>
   </div>
 
   @if (isAllConfigured) {
-  <div class="nvmeof-setup-cards__completion">
-    <a cdsLink
-       class="cds--link--disabled"
-       aria-disabled="true"
-       i18n>Configuration complete. View status →</a>
-  </div>
+    <div class="nvmeof-setup-cards__completion">
+      <a
+        cdsLink
+        class="cds--link--disabled"
+        aria-disabled="true"
+        i18n
+        >Configuration complete. View status →</a
+      >
+    </div>
   }
-</cd-productive-card>
\ No newline at end of file
+</cd-productive-card>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.html
index 8913b850cf0..277979ed771 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-namespaces-list/nvmeof-subsystem-namespaces-list.component.html
@@ -1,19 +1,22 @@
-  <cd-table [data]="namespaces"
-            columnMode="flex"
-            (fetchData)="listNamespaces()"
-            [columns]="namespacesColumns"
-            selectionType="single"
-            (updateSelection)="updateSelection($event)"
-            emptyStateTitle="No namespaces created."
-            i18n-emptyStateTitle
-            emptyStateMessage="Namespaces are storage volumes mapped to subsystems for host access. Create a namespace to start provisioning storage within a subsystem."
-            i18n-emptyStateMessage>
-
-    <div class="table-actions">
-      <cd-table-actions [permission]="permission"
-                        [selection]="selection"
-                        class="btn-group"
-                        [tableActions]="tableActions">
-      </cd-table-actions>
-    </div>
-  </cd-table>
+<cd-table
+  [data]="namespaces"
+  columnMode="flex"
+  (fetchData)="listNamespaces()"
+  [columns]="namespacesColumns"
+  selectionType="single"
+  (updateSelection)="updateSelection($event)"
+  emptyStateTitle="No namespaces created."
+  i18n-emptyStateTitle
+  emptyStateMessage="Namespaces are storage volumes mapped to subsystems for host access. Create a namespace to start provisioning storage within a subsystem."
+  i18n-emptyStateMessage
+>
+  <div class="table-actions">
+    <cd-table-actions
+      [permission]="permission"
+      [selection]="selection"
+      class="btn-group"
+      [tableActions]="tableActions"
+    >
+    </cd-table-actions>
+  </div>
+</cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
index d09dc0804b0..55c2dee5937 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
@@ -1,108 +1,137 @@
 <cds-tile *ngIf="subsystem">
-  <div [cdsStack]="'vertical'"
-       [gap]="6">
-    <div cdsGrid
-         [useCssGrid]="true"
-         [condensed]="true"
-         [fullWidth]="true">
-      <div cdsCol
-           [columnNumbers]="{ sm: 4, md: 8, lg: 12 }">
-        <h3 class="cds--type-heading-03"
-            i18n>Subsystem details</h3>
+  <div
+    [cdsStack]="'vertical'"
+    [gap]="6"
+  >
+    <div
+      cdsGrid
+      [useCssGrid]="true"
+      [condensed]="true"
+      [fullWidth]="true"
+    >
+      <div
+        cdsCol
+        [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+      >
+        <h3
+          class="cds--type-heading-03"
+          i18n
+        >
+          Subsystem details
+        </h3>
       </div>
     </div>
 
     @for (row of getRows(); track row) {
-    <div cdsGrid
-         [useCssGrid]="true"
-         [condensed]="true"
-         [fullWidth]="true">
+      <div
+        cdsGrid
+        [useCssGrid]="true"
+        [condensed]="true"
+        [fullWidth]="true"
+      >
+        @for (detail of getDetailsForRow(row); track detail.label) {
+          @if (detail.type === 'auth') {
+            <div
+              cdsCol
+              [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+              [cdsStack]="'vertical'"
+              [gap]="2"
+            >
+              <span
+                class="cds--type-label-01"
+                i18n
+                >Authentication</span
+              >
+              <div>
+                <cd-icon
+                  [type]="getAuthStatusIcon(detail.value.toString())"
+                  class="cds-mr-3"
+                ></cd-icon>
+                <span class="cds--type-label-02">{{ detail.value }}</span>
+                <a
+                  cdsLink
+                  class="cds-ml-2"
+                  (click)="openEditAuthModal()"
+                  (keydown.enter)="openEditAuthModal()"
+                  [cdsStack]="'horizontal'"
+                  tabindex="0"
+                  [gap]="1"
+                >
+                  <span i18n>Edit</span>
+                  <cd-icon type="edit"></cd-icon>
+                </a>
+              </div>
+            </div>
 
-      @for (detail of getDetailsForRow(row); track detail.label) {
-        @if (detail.type === 'auth') {
-          <div cdsCol
-               [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-               [cdsStack]="'vertical'"
-               [gap]="2">
-            <span class="cds--type-label-01"
-                  i18n>Authentication</span>
-            <div>
-              <cd-icon [type]="getAuthStatusIcon(detail.value.toString())"
-                       class="cds-mr-3"></cd-icon>
+          } @else if (detail.type === 'listeners') {
+            <div
+              cdsCol
+              [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+              [cdsStack]="'vertical'"
+              [gap]="2"
+            >
+              <div>
+                <span class="cds--type-label-01">{{ detail.label }}</span>
+                @if (detail.tooltip) {
+                  <cd-icon
+                    type="infoCircle"
+                    class="cds-ml-2"
+                    [ngbTooltip]="detail.tooltip"
+                  ></cd-icon>
+                }
+              </div>
               <span class="cds--type-label-02">{{ detail.value }}</span>
-              <a cdsLink
-                 class="cds-ml-2"
-                 (click)="openEditAuthModal()"
-                 (keydown.enter)="openEditAuthModal()"
-                 [cdsStack]="'horizontal'"
-                 tabindex="0"
-                 [gap]="1">
-                <span i18n>Edit</span>
-                <cd-icon type="edit"></cd-icon>
-              </a>
             </div>
-          </div>
-        }
 
-        @else if (detail.type === 'listeners') {
-          <div cdsCol
-               [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-               [cdsStack]="'vertical'"
-               [gap]="2">
-            <div>
+          } @else if (detail.type === 'host-access') {
+            <div
+              cdsCol
+              [columnNumbers]="getColNumbers(detail)"
+              [cdsStack]="'vertical'"
+              [gap]="2"
+            >
               <span class="cds--type-label-01">{{ detail.label }}</span>
-              @if (detail.tooltip) {
-                <cd-icon type="infoCircle"
-                         class="cds-ml-2"
-                         [ngbTooltip]="detail.tooltip"></cd-icon>
-              }
+              <div class="cds--type-label-02">
+                <span>{{ detail.value ? 'Allow all hosts' : 'Restrict to specific hosts' }}</span>
+                <a
+                  cdsLink
+                  (click)="openEditHostAccessModal()"
+                  (keydown.enter)="openEditHostAccessModal()"
+                  [cdsStack]="'horizontal'"
+                  class="cds-ml-2"
+                  tabindex="0"
+                  [gap]="1"
+                >
+                  <span i18n>Edit</span>
+                  <cd-icon type="edit"></cd-icon>
+                </a>
+              </div>
             </div>
-            <span class="cds--type-label-02">{{ detail.value }}</span>
-          </div>
-        }
+          }
 
-        @else if (detail.type === 'host-access') {
-          <div cdsCol
-               [columnNumbers]="getColNumbers(detail)"
-               [cdsStack]="'vertical'"
-               [gap]="2">
-            <span class="cds--type-label-01">{{ detail.label }}</span>
-            <div class="cds--type-label-02">
-              <span>{{ detail.value ? 'Allow all hosts' : 'Restrict to specific hosts' }}</span>
-              <a cdsLink
-                 (click)="openEditHostAccessModal()"
-                 (keydown.enter)="openEditHostAccessModal()"
-                 [cdsStack]="'horizontal'"
-                 class="cds-ml-2"
-                 tabindex="0"
-                 [gap]="1">
-                <span i18n>Edit</span>
-                <cd-icon type="edit"></cd-icon>
-              </a>
+          <!-- Default: plain text row -->
+          @else {
+            <div
+              cdsCol
+              [columnNumbers]="getColNumbers(detail)"
+              [cdsStack]="'vertical'"
+              [gap]="2"
+            >
+              <span class="cds--type-label-01">{{ detail.label }}</span>
+              <span class="cds--type-label-02">{{ getDisplayValue(detail.value) }}</span>
             </div>
-          </div>
+          }
         }
 
-        <!-- Default: plain text row -->
-        @else {
-          <div cdsCol
-               [columnNumbers]="getColNumbers(detail)"
-               [cdsStack]="'vertical'"
-               [gap]="2">
-            <span class="cds--type-label-01">{{ detail.label }}</span>
-            <span class="cds--type-label-02">{{ getDisplayValue(detail.value) }}</span>
-          </div>
+        @if (getDetailsForRow(row).length < 3 && !isFullWidthRow(row)) {
+          @for (filler of getFillerCount(row); track filler) {
+            <div
+              cdsCol
+              [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+            ></div>
+          }
         }
-
-      }
-
-      @if (getDetailsForRow(row).length < 3 && !isFullWidthRow(row)) {
-        @for (filler of getFillerCount(row); track filler) {
-          <div cdsCol
-               [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"></div>
-        }
-      }
-    </div>
+      </div>
     }
   </div>
 </cds-tile>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.html
index 1a40ac4ed38..3301fdc38c2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.html
@@ -1,13 +1,19 @@
-<cd-grafana *ngIf="permissions.grafana.read && subsystemNQN && groupName"
-            i18n-title
-            title="Subsystem details"
-            grafanaPath="ceph-nvme-of-gateways-performance?var-group={{groupName}}&var-subsystem={{subsystemNQN}}"
-            [type]="'metrics'"
-            uid="feeuv1dno43r4deed"
-            grafanaStyle="three">
+<cd-grafana
+  *ngIf="permissions.grafana.read && subsystemNQN && groupName"
+  i18n-title
+  title="Subsystem details"
+  grafanaPath="ceph-nvme-of-gateways-performance?var-group={{ groupName }}&var-subsystem={{
+    subsystemNQN
+  }}"
+  [type]="'metrics'"
+  uid="feeuv1dno43r4deed"
+  grafanaStyle="three"
+>
 </cd-grafana>
 
-<cd-helper *ngIf="!permissions.grafana.read"
-           i18n>
+<cd-helper
+  *ngIf="!permissions.grafana.read"
+  i18n
+>
   Grafana permissions are required to view performance details.
 </cd-helper>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-details/nvmeof-subsystems-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-details/nvmeof-subsystems-details.component.html
index 14a75e15bcc..3f340f625be 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-details/nvmeof-subsystems-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-details/nvmeof-subsystems-details.component.html
@@ -1,27 +1,40 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="subsystem-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="subsystem-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value [data]="data">
-        </cd-table-key-value>
+        <cd-table-key-value [data]="data"> </cd-table-key-value>
       </ng-template>
     </ng-container>
-    <ng-container ngbNavItem="performance-details"
-                  *ngIf="permissions.grafana.read">
-      <a ngbNavLink
-         i18n>Performance Details</a>
+    <ng-container
+      ngbNavItem="performance-details"
+      *ngIf="permissions.grafana.read"
+    >
+      <a
+        ngbNavLink
+        i18n
+        >Performance Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="Subsystem details"
-                    grafanaPath="ceph-nvme-of-gateways-performance?var-group={{group}}&var-subsystem={{subsystemNQN}}"
-                    [type]="'metrics'"
-                    uid="feeuv1dno43r4deed"
-                    grafanaStyle="three">
+        <cd-grafana
+          i18n-title
+          title="Subsystem details"
+          grafanaPath="ceph-nvme-of-gateways-performance?var-group={{ group }}&var-subsystem={{
+            subsystemNQN
+          }}"
+          [type]="'metrics'"
+          uid="feeuv1dno43r4deed"
+          grafanaStyle="three"
+        >
         </cd-grafana>
       </ng-template>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
index 61de7d2648d..1496c01d963 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.html
@@ -1,153 +1,206 @@
-
-<form [formGroup]="formGroup"
-      novalidate>
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8}">
+<form
+  [formGroup]="formGroup"
+  novalidate
+>
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8 }"
+    >
       @if (!listenersOnly) {
-      <div cdsRow
-           class="form-heading">
-        <h3 class="cds--type-heading-03"
-            i18n>Subsystem details</h3>
-        <p class="cds--type-label-02"
-           i18n>Enter identifying and network details for this subsystem.</p>
-      </div>
+        <div
+          cdsRow
+          class="form-heading"
+        >
+          <h3
+            class="cds--type-heading-03"
+            i18n
+          >
+            Subsystem details
+          </h3>
+          <p
+            class="cds--type-label-02"
+            i18n
+          >
+            Enter identifying and network details for this subsystem.
+          </p>
+        </div>
       }
       @if (!listenersOnly) {
-      <div cdsRow
-           class="form-item">
-        <cds-text-label
-          i18n
-          [invalid]="nqnRef.isInvalid"
-          helperText="A unique identifier for the subsystem."
-          i18n-helperText>
-          Subsystem NQN (NVMe Qualified Name)
-          <input cdsText
-                 cdValidate
-                 #nqnRef="cdValidate"
-                 type="text"
-                 placeholder="nqn.2001-07.com.ceph:1722347201377"
-                 id="nqn"
-                 name="nqn"
-                 formControlName="nqn"
-                 [invalid]="nqnRef.isInvalid">
-        </cds-text-label>
-        @if (nqnRef.isInvalid) {
-          @for (err of formGroup.get('nqn')?.errors | keyvalue; track err.key) {
-            <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-text-label
+            i18n
+            [invalid]="nqnRef.isInvalid"
+            helperText="A unique identifier for the subsystem."
+            i18n-helperText
+          >
+            Subsystem NQN (NVMe Qualified Name)
+            <input
+              cdsText
+              cdValidate
+              #nqnRef="cdValidate"
+              type="text"
+              placeholder="nqn.2001-07.com.ceph:1722347201377"
+              id="nqn"
+              name="nqn"
+              formControlName="nqn"
+              [invalid]="nqnRef.isInvalid"
+            />
+          </cds-text-label>
+          @if (nqnRef.isInvalid) {
+            @for (err of formGroup.get('nqn')?.errors | keyvalue; track err.key) {
+              <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+            }
           }
-        }
-      </div>
-      <div cdsRow
-           class="form-item">
-        <cds-text-label
-          i18n
-          helperText="Gateway group routes traffic for this subsystem."
-          i18n-helperText
-          [disabled]="true">
-          Gateway group
-          <input cdsText
-                 type="text"
-                 disabled
-                 [value]="group"
-                 [skeleton]="!group">
-        </cds-text-label>
-      </div>
+        </div>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-text-label
+            i18n
+            helperText="Gateway group routes traffic for this subsystem."
+            i18n-helperText
+            [disabled]="true"
+          >
+            Gateway group
+            <input
+              cdsText
+              type="text"
+              disabled
+              [value]="group"
+              [skeleton]="!group"
+            />
+          </cds-text-label>
+        </div>
       }
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <fieldset class="cds--fieldset">
-          <legend class="cds--label" 
-                  i18n>Listeners</legend>
-          <p class="cds--form__helper-text" i18n>Determine where and how hosts can connect to the subsystem over the network.</p>
+          <legend
+            class="cds--label"
+            i18n
+          >
+            Listeners
+          </legend>
+          <p
+            class="cds--form__helper-text"
+            i18n
+          >
+            Determine where and how hosts can connect to the subsystem over the network.
+          </p>
           <cds-radio-group
             formControlName="listenerMode"
-            orientation="horizontal">
-            <cds-radio
-              [value]="LISTENER_MODE.AUTO_FETCH">
+            orientation="horizontal"
+          >
+            <cds-radio [value]="LISTENER_MODE.AUTO_FETCH">
               <span i18n>Auto-fetch</span>
             </cds-radio>
-            <cds-radio
-              [value]="LISTENER_MODE.MANUAL">
+            <cds-radio [value]="LISTENER_MODE.MANUAL">
               <span i18n>Add manually</span>
             </cds-radio>
           </cds-radio-group>
         </fieldset>
       </div>
       @if (listenerMode === LISTENER_MODE.AUTO_FETCH) {
-      <div cdsRow
-           class="form-item">
-        <cds-text-label
-          i18n
-          [invalid]="subnetMaskRef.isInvalid"
-          [invalidText]="subnetMaskInvalidText"
-          helperText="Listeners from this subnet-masks will be use."
-          i18n-helperText>
-          Subnet-mask
-          <input cdsText
-                 cdValidate
-                 #subnetMaskRef="cdValidate"
-                 type="text"
-                 placeholder="e.g. 255.0.0.0"
-                 i18n-placeholder
-                 id="subnetMask"
-                 name="subnetMask"
-                 formControlName="subnetMask"
-                 [invalid]="subnetMaskRef.isInvalid">
-        </cds-text-label>
-        <ng-template #subnetMaskInvalidText>
-          <span i18n>This field is required.</span>
-        </ng-template>
-      </div>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-text-label
+            i18n
+            [invalid]="subnetMaskRef.isInvalid"
+            [invalidText]="subnetMaskInvalidText"
+            helperText="Listeners from this subnet-masks will be use."
+            i18n-helperText
+          >
+            Subnet-mask
+            <input
+              cdsText
+              cdValidate
+              #subnetMaskRef="cdValidate"
+              type="text"
+              placeholder="e.g. 255.0.0.0"
+              i18n-placeholder
+              id="subnetMask"
+              name="subnetMask"
+              formControlName="subnetMask"
+              [invalid]="subnetMaskRef.isInvalid"
+            />
+          </cds-text-label>
+          <ng-template #subnetMaskInvalidText>
+            <span i18n>This field is required.</span>
+          </ng-template>
+        </div>
       }
       @if (listenerMode === LISTENER_MODE.MANUAL) {
-      <div cdsRow
-           class="form-item">
-        <cds-combo-box i18n
-                       [invalid]="formGroup.get('listeners')?.invalid && (formGroup.get('listeners')?.dirty || formGroup.get('listeners')?.touched)"
-                       [invalidText]="listenersInvalidText"
-                       [label]="listenersLabel"
-                       [helperText]="listenersHelperText"
-                       [title]="listenersLabel"
-                       [items]="hosts"
-                       [type]="'multi'"
-                       formControlName="listeners"
-                       name="listeners">
-          <cds-dropdown-list></cds-dropdown-list>
-        </cds-combo-box>
-        @if (formGroup.get('listeners').value?.length) {
-          <div>
-          @for (listener of formGroup.get('listeners').value; track listener.content; let i = $index) {
-            <cds-tag-filter type="blue"
-                            [title]="listener.content"
-                            (close)="removeListener(i)">
-              {{ listener.content }}
-            </cds-tag-filter>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <cds-combo-box
+            i18n
+            [invalid]="
+              formGroup.get('listeners')?.invalid &&
+              (formGroup.get('listeners')?.dirty || formGroup.get('listeners')?.touched)
+            "
+            [invalidText]="listenersInvalidText"
+            [label]="listenersLabel"
+            [helperText]="listenersHelperText"
+            [title]="listenersLabel"
+            [items]="hosts"
+            [type]="'multi'"
+            formControlName="listeners"
+            name="listeners"
+          >
+            <cds-dropdown-list></cds-dropdown-list>
+          </cds-combo-box>
+          @if (formGroup.get('listeners').value?.length) {
+            <div>
+              @for (
+                listener of formGroup.get('listeners').value;
+                track listener.content;
+                let i = $index
+              ) {
+                <cds-tag-filter
+                  type="blue"
+                  [title]="listener.content"
+                  (close)="removeListener(i)"
+                >
+                  {{ listener.content }}
+                </cds-tag-filter>
+              }
+            </div>
           }
-          </div>
-        }
-        <ng-template #listenersLabel>
-          <span i18n>Select listeners</span>
-        </ng-template>
-        <ng-template #listenersHelperText>
-          <span i18n>Select listeners for this subsystem.</span>
-        </ng-template>
-        <ng-template #listenersInvalidText>
-          <span i18n>This field is required.</span>
-        </ng-template>
-      </div>
+          <ng-template #listenersLabel>
+            <span i18n>Select listeners</span>
+          </ng-template>
+          <ng-template #listenersHelperText>
+            <span i18n>Select listeners for this subsystem.</span>
+          </ng-template>
+          <ng-template #listenersInvalidText>
+            <span i18n>This field is required.</span>
+          </ng-template>
+        </div>
       }
     </div>
   </div>
 </form>
 
 @if (!listenersOnly) {
-<ng-template #nqnInvalidTemplate>
-@for (err of formGroup.get('nqn').errors | keyvalue; track err.key) {
-<span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
-}
-</ng-template>
+  <ng-template #nqnInvalidTemplate>
+    @for (err of formGroup.get('nqn').errors | keyvalue; track err.key) {
+      <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+    }
+  </ng-template>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
index 773f192b50e..33f58c99057 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.html
@@ -1,125 +1,177 @@
-
-<form [formGroup]="formGroup"
-      novalidate>
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8, lg: 16}"
-         class="cd-nvmeof-subsystem-step-two">
-      <div cdsRow
-           class="form-item cds-mb-0">
-        <h3 class="cds--type-heading-03"
-            i18n>Host access (Initiators)</h3>
+<form
+  [formGroup]="formGroup"
+  novalidate
+>
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8, lg: 16 }"
+      class="cd-nvmeof-subsystem-step-two"
+    >
+      <div
+        cdsRow
+        class="form-item cds-mb-0"
+      >
+        <h3
+          class="cds--type-heading-03"
+          i18n
+        >
+          Host access (Initiators)
+        </h3>
         <p
           class="cds--type-label-02"
-          i18n>Select hosts that can initiate connections to this subsystem.</p>
+          i18n
+        >
+          Select hosts that can initiate connections to this subsystem.
+        </p>
       </div>
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-radio-group
           formControlName="hostType"
-          orientation="vertical">
+          orientation="vertical"
+        >
           <cds-radio
             [value]="HOST_TYPE.ALL"
             [disabled]="!allowAllHosts"
             class="cds-mb-2"
-            i18n>Allow all hosts</cds-radio>
-          <span class="cds--form__helper-text cds-mb-3"
-                i18n>Any host can connect to this subsystem without verification.</span>
-          @if(formGroup.get('hostType').value === HOST_TYPE.ALL) {
-          <cd-alert-panel
-            title="Caution"
-            type="warning"
-            class="cds-mb-3"
             i18n
-            i18n-title>
-            Allowing all hosts grants access to every initiator on the network. Authentication is not supported in this mode, which may expose the subsystem to unauthorized access.
-          </cd-alert-panel>
+            >Allow all hosts</cds-radio
+          >
+          <span
+            class="cds--form__helper-text cds-mb-3"
+            i18n
+            >Any host can connect to this subsystem without verification.</span
+          >
+          @if (formGroup.get('hostType').value === HOST_TYPE.ALL) {
+            <cd-alert-panel
+              title="Caution"
+              type="warning"
+              class="cds-mb-3"
+              i18n
+              i18n-title
+            >
+              Allowing all hosts grants access to every initiator on the network. Authentication is
+              not supported in this mode, which may expose the subsystem to unauthorized access.
+            </cd-alert-panel>
           }
           <cds-radio
             [value]="HOST_TYPE.SPECIFIC"
-            class="cds-mb-2">
+            class="cds-mb-2"
+          >
             <span
               class="cds-mr-3"
-              i18n>Restrict to specific hosts</span>
+              i18n
+              >Restrict to specific hosts</span
+            >
             <cds-tag
               type="blue"
               size="sm"
               class="cd-nvmeof-subsystem-step-two-specific-hosts-tag"
-              i18n>
+              i18n
+            >
               Recommended for secure environments
             </cds-tag>
           </cds-radio>
-          <span class="cds--form__helper-text cds-mb-3"
-                i18n>Add the specific hosts permitted to connect.</span>
+          <span
+            class="cds--form__helper-text cds-mb-3"
+            i18n
+            >Add the specific hosts permitted to connect.</span
+          >
         </cds-radio-group>
       </div>
-      @if(formGroup.get('hostType').value === HOST_TYPE.SPECIFIC) {
-      <div cdsRow
-           class="form-item">
-        <h1
-          class="cds--type-heading-compact-01"
-          i18n>Add host manually</h1>
-        <label class="cds--label"
-               for="hostname">
-          <span i18n>Host name</span>
-        </label>
-        <div class="cd-nvmeof-subsystem-step-two-manual-hosts">
-          <cds-text-label
-            [invalid]="host.isInvalid"
-            [invalidText]="hostNameInvalidTemplate"
-            class="cd-nvmeof-subsystem-step-two-manual-hosts-input">
-          <input
-            cdsText
-            cdValidate
-            id="hostname"
-            #host="cdValidate"
-            formControlName="hostname"
-            [invalid]="host.isInvalid"
-            placeholder="Enter host NQN"
-            i18n-placeholder/>
-          </cds-text-label>
-          <button
-            cdsButton="tertiary"
-            [disabled]="host.isInvalid"
-            size="md"
-            class="cds-mt-3"
-            type="button"
-            (click)="addHost()">
-            <span i18n>Add</span>
-            <cd-icon type="add"></cd-icon>
-          </button>
+      @if (formGroup.get('hostType').value === HOST_TYPE.SPECIFIC) {
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <h1
+            class="cds--type-heading-compact-01"
+            i18n
+          >
+            Add host manually
+          </h1>
+          <label
+            class="cds--label"
+            for="hostname"
+          >
+            <span i18n>Host name</span>
+          </label>
+          <div class="cd-nvmeof-subsystem-step-two-manual-hosts">
+            <cds-text-label
+              [invalid]="host.isInvalid"
+              [invalidText]="hostNameInvalidTemplate"
+              class="cd-nvmeof-subsystem-step-two-manual-hosts-input"
+            >
+              <input
+                cdsText
+                cdValidate
+                id="hostname"
+                #host="cdValidate"
+                formControlName="hostname"
+                [invalid]="host.isInvalid"
+                placeholder="Enter host NQN"
+                i18n-placeholder
+              />
+            </cds-text-label>
+            <button
+              cdsButton="tertiary"
+              [disabled]="host.isInvalid"
+              size="md"
+              class="cds-mt-3"
+              type="button"
+              (click)="addHost()"
+            >
+              <span i18n>Add</span>
+              <cd-icon type="add"></cd-icon>
+            </button>
+          </div>
         </div>
-      </div>
-      <div cdsRow
-           class="form-item">
-        <h1
-          class="cds--type-heading-compact-01"
-          i18n>Upload CSV file</h1>
-        <p
-          class="cds--type-body-01 cds-mb-3 cd-nvmeof-subsystem-step-two-added-hosts-text"
-          i18n>Upload a CSV file containing a list of host names.</p>
-        <div class="cd-nvmeof-subsystem-step-two-csv-container">
-          <cds-file-uploader
-            [drop]="true"
-            [dropText]="csvDropText"
-            [accept]="['csv']"
-            [multiple]="false"
-            size="md"
-            class="cd-nvmeof-subsystem-step-two-csv-input"
-            (filesChange)="onCsvUpload($event)"
-            (removeFile)="onCsvUploadRemove()"></cds-file-uploader>
-          @if(csvUploadError) {
-          <cd-alert-panel
-            type="danger"
-            [showTitle]="false"
-            size="slim"
-            class="cds-mt-3 cd-nvmeof-subsystem-step-two-csv-error-panel">{{ csvUploadError }}</cd-alert-panel>
-          }
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <h1
+            class="cds--type-heading-compact-01"
+            i18n
+          >
+            Upload CSV file
+          </h1>
+          <p
+            class="cds--type-body-01 cds-mb-3 cd-nvmeof-subsystem-step-two-added-hosts-text"
+            i18n
+          >
+            Upload a CSV file containing a list of host names.
+          </p>
+          <div class="cd-nvmeof-subsystem-step-two-csv-container">
+            <cds-file-uploader
+              [drop]="true"
+              [dropText]="csvDropText"
+              [accept]="['csv']"
+              [multiple]="false"
+              size="md"
+              class="cd-nvmeof-subsystem-step-two-csv-input"
+              (filesChange)="onCsvUpload($event)"
+              (removeFile)="onCsvUploadRemove()"
+            ></cds-file-uploader>
+            @if (csvUploadError) {
+              <cd-alert-panel
+                type="danger"
+                [showTitle]="false"
+                size="slim"
+                class="cds-mt-3 cd-nvmeof-subsystem-step-two-csv-error-panel"
+                >{{ csvUploadError }}</cd-alert-panel
+              >
+            }
+          </div>
         </div>
-      </div>
       }
     </div>
   </div>
@@ -130,53 +182,66 @@
     i18n
     cdsButton="ghost"
     type="button"
-    (click)="removeAll($event)">
+    (click)="removeAll($event)"
+  >
     Remove all
   </button>
 </ng-template>
 
 <ng-template
   #removeHostTemplate
-  let-host>
+  let-host
+>
   <cds-icon-button
     type="button"
     kind="ghost"
     description="Remove host"
     i18n-description
-    (click)="removeHost(host)">
-  <cd-icon type="destroy"></cd-icon>
-</cds-icon-button>
+    (click)="removeHost(host)"
+  >
+    <cd-icon type="destroy"></cd-icon>
+  </cds-icon-button>
 </ng-template>
 
 <ng-template #rightInfluencer>
-  @if(addedHostsLength === 0) {
-  <h1
-    class="cds--type-heading-compact-01"
-    i18n>Added hosts ({{addedHostsLength}})</h1>
-  <p
-    i18n
-    class="cds--type-body-01 cd-nvmeof-subsystem-step-two-added-hosts-text">No hosts added yet. Add hosts manually or upload a CSV file.</p>
+  @if (addedHostsLength === 0) {
+    <h1
+      class="cds--type-heading-compact-01"
+      i18n
+    >
+      Added hosts ({{ addedHostsLength }})
+    </h1>
+    <p
+      i18n
+      class="cds--type-body-01 cd-nvmeof-subsystem-step-two-added-hosts-text"
+    >
+      No hosts added yet. Add hosts manually or upload a CSV file.
+    </p>
   } @else {
-  <cds-contained-list
-    label="Added hosts ({{addedHostsLength}})"
-    [action]="removeAllTemplate"
-    class="cd-nvmeof-subsystem-step-two-influencer">
-    @for (host of formGroup.get('addedHosts')?.value ; track host) {
-    <cds-contained-list-item
-      [action]="removeHostTemplate"
-      [actionData]="host"
-      class="cd-nvmeof-subsystem-step-two-host-list-item-container">
-      <span
-        class="cds--text-truncate--end"
-        [title]="host">{{host}}</span>
-    </cds-contained-list-item>
-    }
-  </cds-contained-list>
+    <cds-contained-list
+      label="Added hosts ({{ addedHostsLength }})"
+      [action]="removeAllTemplate"
+      class="cd-nvmeof-subsystem-step-two-influencer"
+    >
+      @for (host of formGroup.get('addedHosts')?.value; track host) {
+        <cds-contained-list-item
+          [action]="removeHostTemplate"
+          [actionData]="host"
+          class="cd-nvmeof-subsystem-step-two-host-list-item-container"
+        >
+          <span
+            class="cds--text-truncate--end"
+            [title]="host"
+            >{{ host }}</span
+          >
+        </cds-contained-list-item>
+      }
+    </cds-contained-list>
   }
 </ng-template>
 
 <ng-template #hostNameInvalidTemplate>
-@for (err of formGroup.get('hostname').errors | keyvalue; track err.key) {
-<span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
-}
+  @for (err of formGroup.get('hostname').errors | keyvalue; track err.key) {
+    <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+  }
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.html
index 9ee61b903f8..dddafce9f86 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-3/nvmeof-subsystem-step-3.component.html
@@ -1,127 +1,185 @@
-
-<form [formGroup]="formGroup"
-      novalidate>
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{sm: 10, md: 10, lg: 12}">
-      <div cdsRow
-           class="form-heading">
-        <h3 class="cds--type-heading-03"
-            i18n>Authentication</h3>
+<form
+  [formGroup]="formGroup"
+  novalidate
+>
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 10, md: 10, lg: 12 }"
+    >
+      <div
+        cdsRow
+        class="form-heading"
+      >
+        <h3
+          class="cds--type-heading-03"
+          i18n
+        >
+          Authentication
+        </h3>
         <p
           class="cds--type-label-02"
-          i18n>Configure authentication to verify the identity of connecting hosts and protect the subsystem from unauthorized access.</p>
+          i18n
+        >
+          Configure authentication to verify the identity of connecting hosts and protect the
+          subsystem from unauthorized access.
+        </p>
       </div>
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-radio-group
           formControlName="authType"
           legend="Authentication type"
-          i18n-legend>
-          <cds-radio
-            [value]="AUTHENTICATION.Unidirectional">
+          i18n-legend
+        >
+          <cds-radio [value]="AUTHENTICATION.Unidirectional">
             <div class="auth-radio">
               <span>Unidirectional</span>
-              <span class="cds--form__helper-text"
-                    i18n>Each host can provide an optional DH-HMAC-CHAP key. The subsystem does not require its own key.</span>
+              <span
+                class="cds--form__helper-text"
+                i18n
+                >Each host can provide an optional DH-HMAC-CHAP key. The subsystem does not require
+                its own key.</span
+              >
             </div>
           </cds-radio>
-          <cds-radio
-            [value]="AUTHENTICATION.Bidirectional">
+          <cds-radio [value]="AUTHENTICATION.Bidirectional">
             <div class="auth-radio">
               <div cdsStack="horizontal">
                 <span i18n>Bidirectional</span>
                 <cds-tag
                   type="blue"
                   size="sm"
-                  i18n>
+                  i18n
+                >
                   Requires keys on both sides
                 </cds-tag>
               </div>
-              <span class="cds--form__helper-text"
-                    i18n>Both subsystem and hosts must provide DH-HMAC-CHAP keys. All connections will be verified in both directions.</span>
+              <span
+                class="cds--form__helper-text"
+                i18n
+                >Both subsystem and hosts must provide DH-HMAC-CHAP keys. All connections will be
+                verified in both directions.</span
+              >
             </div>
           </cds-radio>
         </cds-radio-group>
       </div>
-      @if(formGroup.get('authType').value === AUTHENTICATION.Bidirectional) {
-      <div cdsRow
-           class="form-item step-3-form-item">
-        <div class="step-3-heading">
-          <h1
-            class="cds--type-heading-compact-01"
-            i18n>Subsystem authentication detail</h1>
-          <p class="cds--type-label-01 text-helper"
-             i18n>Mandatory field.</p>
-        </div>
-        <cds-text-label
-          i18n
-          helperText="A secret key for the subsystem to authenticate itself to hosts."
-          i18n-helperText
-          [invalid]="subDK.isInvalid"
-          [invalidText]="
-            formGroup.get('subsystemDchapKey')?.errors?.invalidBase64
-              ? INVALID_TEXTS['invalidBase64']
-              : INVALID_TEXTS['required']
-          ">
-          Subsystem DH-HMAC-CHAP key
-          <input cdsPassword
-                 cdValidate
-                 #subDK="cdValidate"
-                 [invalid]="subDK.isInvalid"
-                 formControlName="subsystemDchapKey"
-                 type="password"
-                 class="step-3-form-item"
-                 placeholder="Enter subsystem DH-HMAC-CHAP key"
-                 i18n-placeholder
-                 autocomplete>
-        </cds-text-label>
-      </div>
-      }
-      <div cdsRow
-           class="form-item step-3-form-item"
-           formArrayName="hostDchapKeyList">
-        <div class="step-3-heading">
-          <h1
-            class="cds--type-heading-compact-01"
-            i18n>Host authentication details</h1>
-          <p class="cds--type-label-01 text-helper"
-             i18n>{{formGroup.get('authType').value === AUTHENTICATION.Bidirectional ? 'All fields are required.' : 'Optional fields.'}}</p>
-        </div>
-        @if (hostDchapKeyList.controls.length) {
-        @for (hostDchapKeyItem of hostDchapKeyList.controls; track $index; let i = $index) {
-        <div [formGroupName]="i">
+      @if (formGroup.get('authType').value === AUTHENTICATION.Bidirectional) {
+        <div
+          cdsRow
+          class="form-item step-3-form-item"
+        >
+          <div class="step-3-heading">
+            <h1
+              class="cds--type-heading-compact-01"
+              i18n
+            >
+              Subsystem authentication detail
+            </h1>
+            <p
+              class="cds--type-label-01 text-helper"
+              i18n
+            >
+              Mandatory field.
+            </p>
+          </div>
           <cds-text-label
-            class="cds-mb-3"
-            [invalid]="hostKey.isInvalid"
+            i18n
+            helperText="A secret key for the subsystem to authenticate itself to hosts."
+            i18n-helperText
+            [invalid]="subDK.isInvalid"
             [invalidText]="
-              hostDhchapKeyCtrl(i)?.errors?.invalidBase64
+              formGroup.get('subsystemDchapKey')?.errors?.invalidBase64
                 ? INVALID_TEXTS['invalidBase64']
                 : INVALID_TEXTS['required']
-            ">
-            <span
-              class="cds-mb-3"
-              i18n>DHCHAP Key | {{hostDchapKeyItem.get('host_nqn')?.value }}</span>
-            <input cdsPassword
-                   cdValidate
-                   #hostKey="cdValidate"
-                   formControlName="dhchap_key"
-                   type="password"
-                   placeholder="Enter DHCHAP key"
-                   class="step-3-form-item"
-                   i18n-placeholder
-                   autocomplete
-                   [invalid]="hostKey.isInvalid">
+            "
+          >
+            Subsystem DH-HMAC-CHAP key
+            <input
+              cdsPassword
+              cdValidate
+              #subDK="cdValidate"
+              [invalid]="subDK.isInvalid"
+              formControlName="subsystemDchapKey"
+              type="password"
+              class="step-3-form-item"
+              placeholder="Enter subsystem DH-HMAC-CHAP key"
+              i18n-placeholder
+              autocomplete
+            />
           </cds-text-label>
         </div>
-        }
+      }
+      <div
+        cdsRow
+        class="form-item step-3-form-item"
+        formArrayName="hostDchapKeyList"
+      >
+        <div class="step-3-heading">
+          <h1
+            class="cds--type-heading-compact-01"
+            i18n
+          >
+            Host authentication details
+          </h1>
+          <p
+            class="cds--type-label-01 text-helper"
+            i18n
+          >
+            {{
+              formGroup.get('authType').value === AUTHENTICATION.Bidirectional
+                ? 'All fields are required.'
+                : 'Optional fields.'
+            }}
+          </p>
+        </div>
+        @if (hostDchapKeyList.controls.length) {
+          @for (hostDchapKeyItem of hostDchapKeyList.controls; track $index; let i = $index) {
+            <div [formGroupName]="i">
+              <cds-text-label
+                class="cds-mb-3"
+                [invalid]="hostKey.isInvalid"
+                [invalidText]="
+                  hostDhchapKeyCtrl(i)?.errors?.invalidBase64
+                    ? INVALID_TEXTS['invalidBase64']
+                    : INVALID_TEXTS['required']
+                "
+              >
+                <span
+                  class="cds-mb-3"
+                  i18n
+                  >DHCHAP Key | {{ hostDchapKeyItem.get('host_nqn')?.value }}</span
+                >
+                <input
+                  cdsPassword
+                  cdValidate
+                  #hostKey="cdValidate"
+                  formControlName="dhchap_key"
+                  type="password"
+                  placeholder="Enter DHCHAP key"
+                  class="step-3-form-item"
+                  i18n-placeholder
+                  autocomplete
+                  [invalid]="hostKey.isInvalid"
+                />
+              </cds-text-label>
+            </div>
+          }
         } @else {
-        <p
-          class="cds--type-label-01 text-helper"
-          i18ns>No hosts selected.</p>
+          <p
+            class="cds--type-label-01 text-helper"
+            i18ns
+          >
+            No hosts selected.
+          </p>
         }
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.html
index f4dbcddba42..c1bb82eff09 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.html
@@ -1,118 +1,216 @@
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 12}">
-    <h3 class="cds--type-heading-03 cds-mb-5"
-        i18n>Review summary</h3>
+<div
+  cdsGrid
+  [useCssGrid]="true"
+  [narrow]="true"
+  [fullWidth]="true"
+>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+  >
+    <h3
+      class="cds--type-heading-03 cds-mb-5"
+      i18n
+    >
+      Review summary
+    </h3>
   </div>
 
   <!-- Subsystem details -->
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 12}"
-       class="cds-mt-5">
-    <h4 class="cds--type-heading-compact-01"
-        i18n>Subsystem details</h4>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+    class="cds-mt-5"
+  >
+    <h4
+      class="cds--type-heading-compact-01"
+      i18n
+    >
+      Subsystem details
+    </h4>
   </div>
 
-  <div cdsCol
-       [columnNumbers]="{sm: 2, md: 4, lg: 6}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Subsystem NQN</p>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+    class="cds-mt-5"
+  >
+    <p
+      class="cds--type-label-01"
+      i18n
+    >
+      Subsystem NQN
+    </p>
     <p class="cds--type-label-02 cds-mt-2">{{ nqn }}</p>
   </div>
-  <div cdsCol
-       [columnNumbers]="{sm: 2, md: 4, lg: 6}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Gateway group</p>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+    class="cds-mt-5"
+  >
+    <p
+      class="cds--type-label-01"
+      i18n
+    >
+      Gateway group
+    </p>
     <p class="cds--type-label-02 cds-mt-2">{{ group }}</p>
   </div>
 
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 12}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Listeners</p>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+    class="cds-mt-5"
+  >
+    <p
+      class="cds--type-label-01"
+      i18n
+    >
+      Listeners
+    </p>
     @if (listenerCount > 0) {
-    <p class="cds--type-label-02 cds-mt-2"
-       i18n>{{ listenerCount }} listener(s) added</p>
+      <p
+        class="cds--type-label-02 cds-mt-2"
+        i18n
+      >
+        {{ listenerCount }} listener(s) added
+      </p>
     } @else {
-    <p class="cds--type-label-02 cds-mt-2"
-       i18n>None selected</p>
+      <p
+        class="cds--type-label-02 cds-mt-2"
+        i18n
+      >
+        None selected
+      </p>
     }
   </div>
 
   <!-- Host access control (Initiators) -->
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 12}"
-       class="cds-mt-7">
-    <h4 class="cds--type-heading-compact-01"
-        i18n>Host access control (Initiators)</h4>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+    class="cds-mt-7"
+  >
+    <h4
+      class="cds--type-heading-compact-01"
+      i18n
+    >
+      Host access control (Initiators)
+    </h4>
   </div>
 
-  <div cdsCol
-       [columnNumbers]="{sm: 2, md: 4, lg: 6}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Host access</p>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+    class="cds-mt-5"
+  >
+    <p
+      class="cds--type-label-01"
+      i18n
+    >
+      Host access
+    </p>
     <p class="cds--type-label-02 cds-mt-2">{{ hostAccessLabel }}</p>
   </div>
   @if (hostType === HOST_TYPE.SPECIFIC) {
-  <div cdsCol
-       [columnNumbers]="{sm: 2, md: 4, lg: 6}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Specific hosts</p>
-    <p class="cds--type-label-02 cds-mt-2"
-       i18n>{{ hostCount }} hosts added.</p>
-  </div>
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+      class="cds-mt-5"
+    >
+      <p
+        class="cds--type-label-01"
+        i18n
+      >
+        Specific hosts
+      </p>
+      <p
+        class="cds--type-label-02 cds-mt-2"
+        i18n
+      >
+        {{ hostCount }} hosts added.
+      </p>
+    </div>
   }
 
   <!-- Authentication details -->
   @if (hostType === HOST_TYPE.SPECIFIC) {
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 12}"
-       class="cds-mt-7">
-    <h4 class="cds--type-heading-compact-01"
-        i18n>Authentication details</h4>
-  </div>
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+      class="cds-mt-7"
+    >
+      <h4
+        class="cds--type-heading-compact-01"
+        i18n
+      >
+        Authentication details
+      </h4>
+    </div>
 
-  <div cdsCol
-       [columnNumbers]="{sm: 2, md: 4, lg: 6}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Authentication type</p>
-    <p class="cds--type-label-02 cds-mt-2">{{ authTypeLabel }}</p>
-  </div>
-  @if (authType === AUTHENTICATION.Bidirectional) {
-  <div cdsCol
-       [columnNumbers]="{sm: 2, md: 4, lg: 6}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Subsystem DH-HMAC-CHAP key</p>
-    @if (hasSubsystemKey) {
-    <p class="cds--type-label-02 cds-mt-2">••••••••••••</p>
-    } @else {
-    <p class="cds--type-label-02 cds-mt-2"
-       i18n>Not set</p>
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+      class="cds-mt-5"
+    >
+      <p
+        class="cds--type-label-01"
+        i18n
+      >
+        Authentication type
+      </p>
+      <p class="cds--type-label-02 cds-mt-2">{{ authTypeLabel }}</p>
+    </div>
+    @if (authType === AUTHENTICATION.Bidirectional) {
+      <div
+        cdsCol
+        [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+        class="cds-mt-5"
+      >
+        <p
+          class="cds--type-label-01"
+          i18n
+        >
+          Subsystem DH-HMAC-CHAP key
+        </p>
+        @if (hasSubsystemKey) {
+          <p class="cds--type-label-02 cds-mt-2">••••••••••••</p>
+        } @else {
+          <p
+            class="cds--type-label-02 cds-mt-2"
+            i18n
+          >
+            Not set
+          </p>
+        }
+      </div>
     }
-  </div>
-  }
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 12}"
-       class="cds-mt-5">
-    <p class="cds--type-label-01"
-       i18n>Host key</p>
-    @if (hostDchapKeyCount > 0) {
-    <p class="cds--type-label-02 cds-mt-2"
-       i18n>{{ hostDchapKeyCount }} keys added</p>
-    } @else {
-    <p class="cds--type-label-02 cds-mt-2"
-       i18n>No keys added</p>
-    }
-  </div>
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+      class="cds-mt-5"
+    >
+      <p
+        class="cds--type-label-01"
+        i18n
+      >
+        Host key
+      </p>
+      @if (hostDchapKeyCount > 0) {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n
+        >
+          {{ hostDchapKeyCount }} keys added
+        </p>
+      } @else {
+        <p
+          class="cds--type-label-02 cds-mt-2"
+          i18n
+        >
+          No keys added
+        </p>
+      }
+    </div>
   }
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.html
index 57955f967d0..63d31fb1430 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystems-form.component.html
@@ -1,39 +1,43 @@
 <cd-tearsheet
- [steps]="steps"
- [title]="title"
- [description]="description"
- [isSubmitLoading]="isSubmitLoading"
- (submitRequested)="onSubmit($event)"
- (stepChanged)="populateReviewData()">
+  [steps]="steps"
+  [title]="title"
+  [description]="description"
+  [isSubmitLoading]="isSubmitLoading"
+  (submitRequested)="onSubmit($event)"
+  (stepChanged)="populateReviewData()"
+>
   <cd-tearsheet-step>
     <cd-nvmeof-subsystem-step-one
-     #tearsheetStep
-     [group]="group"></cd-nvmeof-subsystem-step-one>
+      #tearsheetStep
+      [group]="group"
+    ></cd-nvmeof-subsystem-step-one>
   </cd-tearsheet-step>
   <cd-tearsheet-step>
     <cd-nvmeof-subsystem-step-two
       #tearsheetStep
-      [group]="group"></cd-nvmeof-subsystem-step-two>
-  </cd-tearsheet-step>
-  @if(showAuthStep) {
-  <cd-tearsheet-step>
-    <cd-nvmeof-subsystem-step-three
-     #tearsheetStep
-     [stepTwoValue]="stepTwoValue"
-     [group]="group"></cd-nvmeof-subsystem-step-three>
+      [group]="group"
+    ></cd-nvmeof-subsystem-step-two>
   </cd-tearsheet-step>
+  @if (showAuthStep) {
+    <cd-tearsheet-step>
+      <cd-nvmeof-subsystem-step-three
+        #tearsheetStep
+        [stepTwoValue]="stepTwoValue"
+        [group]="group"
+      ></cd-nvmeof-subsystem-step-three>
+    </cd-tearsheet-step>
   }
   <cd-tearsheet-step>
     <cd-nvmeof-subsystem-step-four
-     #tearsheetStep
-     [group]="group"
-     [nqn]="reviewNqn"
-     [listeners]="reviewListeners"
-     [hostType]="reviewHostType"
-     [addedHosts]="reviewAddedHosts"
-     [authType]="reviewAuthType"
-     [subsystemDchapKey]="reviewSubsystemDchapKey"
-     [hostDchapKeyCount]="reviewHostDchapKeyCount"></cd-nvmeof-subsystem-step-four>
+      #tearsheetStep
+      [group]="group"
+      [nqn]="reviewNqn"
+      [listeners]="reviewListeners"
+      [hostType]="reviewHostType"
+      [addedHosts]="reviewAddedHosts"
+      [authType]="reviewAuthType"
+      [subsystemDchapKey]="reviewSubsystemDchapKey"
+      [hostDchapKeyCount]="reviewHostDchapKeyCount"
+    ></cd-nvmeof-subsystem-step-four>
   </cd-tearsheet-step>
 </cd-tearsheet>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
index 3b2e08dbdf8..060bbc7d846 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems/nvmeof-subsystems.component.html
@@ -1,80 +1,102 @@
 <div class="nvmeof-content-layout">
   <div class="nvmeof-content-main">
-<ng-container *ngIf="subsystems$ | async as subsystems">
-  <cd-table #table
-            [data]="subsystems"
-            [columns]="subsystemsColumns"
-            [compactSearchField]="true"
-            columnMode="flex"
-            selectionType="single"
-            (updateSelection)="updateSelection($event)"
-            (fetchData)="fetchData()"
-            emptyStateTitle="No subsystems created"
-            i18n-emptyStateTitle
-            emptyStateMessage="Subsystems group NVMe namespaces and manage host access. Create a subsystem to start mapping NVMe volumes to hosts."
-            i18n-emptyStateMessage>
+    <ng-container *ngIf="subsystems$ | async as subsystems">
+      <cd-table
+        #table
+        [data]="subsystems"
+        [columns]="subsystemsColumns"
+        [compactSearchField]="true"
+        columnMode="flex"
+        selectionType="single"
+        (updateSelection)="updateSelection($event)"
+        (fetchData)="fetchData()"
+        emptyStateTitle="No subsystems created"
+        i18n-emptyStateTitle
+        emptyStateMessage="Subsystems group NVMe namespaces and manage host access. Create a subsystem to start mapping NVMe volumes to hosts."
+        i18n-emptyStateMessage
+      >
+        <div class="table-filter">
+          <cd-nvmeof-gateway-group-filter (groupChange)="groupHandler.onGroupChange($event)">
+          </cd-nvmeof-gateway-group-filter>
+        </div>
 
-    <div class="table-filter">
-      <cd-nvmeof-gateway-group-filter
-        (groupChange)="groupHandler.onGroupChange($event)">
-      </cd-nvmeof-gateway-group-filter>
-    </div>
+        <div class="table-actions">
+          <cd-table-actions
+            [permission]="permissions.nvmeof"
+            [selection]="selection"
+            class="btn-group"
+            [tableActions]="tableActions"
+          >
+          </cd-table-actions>
+        </div>
 
-    <div class="table-actions">
-      <cd-table-actions [permission]="permissions.nvmeof"
-                        [selection]="selection"
-                        class="btn-group"
-                        [tableActions]="tableActions">
-      </cd-table-actions>
-    </div>
-
-    <cd-nvmeof-subsystems-details *cdTableDetail
-                                  [selection]="expandedRow"
-                                  [permissions]="permissions"
-                                  [group]="expandedRow?.gw_group">
-    </cd-nvmeof-subsystems-details>
-  </cd-table>
-</ng-container>
+        <cd-nvmeof-subsystems-details
+          *cdTableDetail
+          [selection]="expandedRow"
+          [permissions]="permissions"
+          [group]="expandedRow?.gw_group"
+        >
+        </cd-nvmeof-subsystems-details>
+      </cd-table>
+    </ng-container>
   </div>
 </div>
 
-<ng-template #customTableItemTemplate
-             let-value="data.value"
-             let-row="data.row">
-  <a cdsLink
-     [routerLink]="['/block/nvmeof/subsystems', value]"
-     [queryParams]="{ group: row.gw_group }"
-     (click)="$event.stopPropagation()">
+<ng-template
+  #customTableItemTemplate
+  let-value="data.value"
+  let-row="data.row"
+>
+  <a
+    cdsLink
+    [routerLink]="['/block/nvmeof/subsystems', value]"
+    [queryParams]="{ group: row.gw_group }"
+    (click)="$event.stopPropagation()"
+  >
     {{ value }}
   </a>
 </ng-template>
 
-<ng-template #authenticationTpl
-             let-row="data.row">
-  <div [cdsStack]="'horizontal'"
-       gap="4">
-  @if (row.auth === authType.NO_AUTH) {
-    <cd-icon type="warning"></cd-icon>
-  } @else {
-    <cd-icon type="success"></cd-icon>
-  }
-  <span class="cds-ml-3">{{ row.auth }}</span>
+<ng-template
+  #authenticationTpl
+  let-row="data.row"
+>
+  <div
+    [cdsStack]="'horizontal'"
+    gap="4"
+  >
+    @if (row.auth === authType.NO_AUTH) {
+      <cd-icon type="warning"></cd-icon>
+    } @else {
+      <cd-icon type="success"></cd-icon>
+    }
+    <span class="cds-ml-3">{{ row.auth }}</span>
   </div>
 </ng-template>
 
-<ng-template #encryptionTpl
-             let-row="data.row">
-  <div [cdsStack]="'horizontal'"
-       gap="4">
-  @if (row.enable_ha) {
-    <cd-icon type="success"></cd-icon>
-    <span class="cds-ml-3"
-          i18n>Enabled</span>
-  } @else {
-    <cd-icon type="error"></cd-icon>
-    <span class="cds-ml-3"
-          i18n>Disabled</span>
-  }
+<ng-template
+  #encryptionTpl
+  let-row="data.row"
+>
+  <div
+    [cdsStack]="'horizontal'"
+    gap="4"
+  >
+    @if (row.enable_ha) {
+      <cd-icon type="success"></cd-icon>
+      <span
+        class="cds-ml-3"
+        i18n
+        >Enabled</span
+      >
+    } @else {
+      <cd-icon type="error"></cd-icon>
+      <span
+        class="cds-ml-3"
+        i18n
+        >Disabled</span
+      >
+    }
   </div>
 </ng-template>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html
index a4f9f1e5241..5a07f86a454 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-tabs/nvmeof-tabs.component.html
@@ -2,43 +2,54 @@
   <fieldset>
     <legend class="cds-mb-5">
       <h1 class="cds--type-heading-04">NVMe over Fabrics (TCP)</h1>
-      <p class="cds--type-body-01" i18n>Monitor and manage NVMe-over-TCP resources for high-performance block storage.</p>
+      <p
+        class="cds--type-body-01"
+        i18n
+      >
+        Monitor and manage NVMe-over-TCP resources for high-performance block storage.
+      </p>
     </legend>
   </fieldset>
 
   @if (showSetupCards) {
-  <cd-nvmeof-setup-cards
-                         [hasGatewayGroups]="hasGatewayGroups"
-                         [hasSubsystems]="hasSubsystems"
-                         [hasNamespaces]="hasNamespaces"
-                         [isAllConfigured]="isAllConfigured">
-  </cd-nvmeof-setup-cards>
+    <cd-nvmeof-setup-cards
+      [hasGatewayGroups]="hasGatewayGroups"
+      [hasSubsystems]="hasSubsystems"
+      [hasNamespaces]="hasNamespaces"
+      [isAllConfigured]="isAllConfigured"
+    >
+    </cd-nvmeof-setup-cards>
   }
 
   <section class="cds-mt-5">
-    <cds-tabs type="contained"
-              followFocus="true"
-              isNavigation="true"
-              [cacheActive]="false">
-    <cds-tab
-      heading="Gateways"
-      i18n-heading
-      [active]="activeTab === Tabs.gateways"
-      (selected)="onSelected(Tabs.gateways)">
-    </cds-tab>
-    <cds-tab
-      heading="Subsystems"
-      i18n-heading
-      [active]="activeTab === Tabs.subsystems"
-      (selected)="onSelected(Tabs.subsystems)">
-    </cds-tab>
-    <cds-tab
-      heading="Namespaces"
-      i18n-heading
-      [active]="activeTab === Tabs.namespaces"
-      (selected)="onSelected(Tabs.namespaces)">
-    </cds-tab>
-  </cds-tabs>
+    <cds-tabs
+      type="contained"
+      followFocus="true"
+      isNavigation="true"
+      [cacheActive]="false"
+    >
+      <cds-tab
+        heading="Gateways"
+        i18n-heading
+        [active]="activeTab === Tabs.gateways"
+        (selected)="onSelected(Tabs.gateways)"
+      >
+      </cds-tab>
+      <cds-tab
+        heading="Subsystems"
+        i18n-heading
+        [active]="activeTab === Tabs.subsystems"
+        (selected)="onSelected(Tabs.subsystems)"
+      >
+      </cds-tab>
+      <cds-tab
+        heading="Namespaces"
+        i18n-heading
+        [active]="activeTab === Tabs.namespaces"
+        (selected)="onSelected(Tabs.namespaces)"
+      >
+      </cds-tab>
+    </cds-tabs>
   </section>
 }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html
index 85b830cf025..0e873731cc3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-form/rbd-configuration-form.component.html
@@ -1,80 +1,118 @@
-<fieldset #cfgFormGroup
-          [formGroup]="form.get('configuration')">
+<fieldset
+  #cfgFormGroup
+  [formGroup]="form.get('configuration')"
+>
   <legend i18n>RBD Configuration</legend>
 
   <div *ngFor="let section of rbdConfigurationService.sections">
     <h5 class="cd-header">
-      <legend (click)="toggleSectionVisibility(section.class)"
-              class="collapsible"
-              tabindex="0"
-              (keydown.enter)="toggleSectionVisibility(section.class)">
+      <legend
+        (click)="toggleSectionVisibility(section.class)"
+        class="collapsible"
+        tabindex="0"
+        (keydown.enter)="toggleSectionVisibility(section.class)"
+      >
         {{ section.heading }}&nbsp;
-        <svg [cdsIcon]="!sectionVisibility[section.class] ? icons.addCircle : icons.minusCircle"
-             [size]="icons.size20"
-             ></svg>
+        <svg
+          [cdsIcon]="!sectionVisibility[section.class] ? icons.addCircle : icons.minusCircle"
+          [size]="icons.size20"
+        ></svg>
       </legend>
     </h5>
-    <div class="{{ section.class }}"
-         [hidden]="!sectionVisibility[section.class]">
-      <div class="form-item"
-           *ngFor="let option of section.options">
-        <cds-text-label [helperText]="option.description"
-                        [invalid]="form.get('configuration').controls[option.name].invalid && (form.get('configuration').controls[option.name].dirty)"
-                        [invalidText]="formError">
+    <div
+      class="{{ section.class }}"
+      [hidden]="!sectionVisibility[section.class]"
+    >
+      <div
+        class="form-item"
+        *ngFor="let option of section.options"
+      >
+        <cds-text-label
+          [helperText]="option.description"
+          [invalid]="
+            form.get('configuration').controls[option.name].invalid &&
+            form.get('configuration').controls[option.name].dirty
+          "
+          [invalidText]="formError"
+        >
           {{ option.displayName }}
 
           <div class="cds-input-group">
             <ng-container [ngSwitch]="option.type">
               <ng-container *ngSwitchCase="configurationType.milliseconds">
-                <input [id]="option.name"
-                       [name]="option.name"
-                       [formControlName]="option.name"
-                       type="text"
-                       cdsText
-                       [ngDataReady]="ngDataReady"
-                       [invalid]="form.get('configuration').controls[option.name].invalid && (form.get('configuration').controls[option.name].dirty)"
-                       cdMilliseconds>
+                <input
+                  [id]="option.name"
+                  [name]="option.name"
+                  [formControlName]="option.name"
+                  type="text"
+                  cdsText
+                  [ngDataReady]="ngDataReady"
+                  [invalid]="
+                    form.get('configuration').controls[option.name].invalid &&
+                    form.get('configuration').controls[option.name].dirty
+                  "
+                  cdMilliseconds
+                />
               </ng-container>
               <ng-container *ngSwitchCase="configurationType.bps">
-                <input [id]="option.name"
-                       [name]="option.name"
-                       [formControlName]="option.name"
-                       type="text"
-                       cdsText
-                       defaultUnit="b"
-                       [ngDataReady]="ngDataReady"
-                       [invalid]="form.get('configuration').controls[option.name].invalid && (form.get('configuration').controls[option.name].dirty)"
-                       cdDimlessBinaryPerSecond>
+                <input
+                  [id]="option.name"
+                  [name]="option.name"
+                  [formControlName]="option.name"
+                  type="text"
+                  cdsText
+                  defaultUnit="b"
+                  [ngDataReady]="ngDataReady"
+                  [invalid]="
+                    form.get('configuration').controls[option.name].invalid &&
+                    form.get('configuration').controls[option.name].dirty
+                  "
+                  cdDimlessBinaryPerSecond
+                />
               </ng-container>
               <ng-container *ngSwitchCase="configurationType.iops">
-                <input [id]="option.name"
-                       [name]="option.name"
-                       [formControlName]="option.name"
-                       type="text"
-                       cdsText
-                       [ngDataReady]="ngDataReady"
-                       [invalid]="form.get('configuration').controls[option.name].invalid && (form.get('configuration').controls[option.name].dirty)"
-                       cdIops>
+                <input
+                  [id]="option.name"
+                  [name]="option.name"
+                  [formControlName]="option.name"
+                  type="text"
+                  cdsText
+                  [ngDataReady]="ngDataReady"
+                  [invalid]="
+                    form.get('configuration').controls[option.name].invalid &&
+                    form.get('configuration').controls[option.name].dirty
+                  "
+                  cdIops
+                />
               </ng-container>
             </ng-container>
-            <cds-icon-button kind="ghost"
-                             size="md"
-                             (click)="reset(option.name)"
-                             data-toggle="button">
-              <svg cdsIcon="close"
-                   size="32"
-                   class="cds--btn__icon"
-                   *ngIf="!form.get('configuration').get(option.name).disabled; else resetIcon"></svg>
+            <cds-icon-button
+              kind="ghost"
+              size="md"
+              (click)="reset(option.name)"
+              data-toggle="button"
+            >
+              <svg
+                cdsIcon="close"
+                size="32"
+                class="cds--btn__icon"
+                *ngIf="!form.get('configuration').get(option.name).disabled; else resetIcon"
+              ></svg>
               <ng-template #resetIcon>
-                <svg cdsIcon="reset"
-                     size="32"
-                     *ngIf="form.get('configuration').get(option.name).disabled"></svg>
+                <svg
+                  cdsIcon="reset"
+                  size="32"
+                  *ngIf="form.get('configuration').get(option.name).disabled"
+                ></svg>
               </ng-template>
             </cds-icon-button>
             <ng-template #formError>
-              <span class="invalid-feedback"
-                    *ngIf="form.showError('configuration.' + option.name, cfgFormGroup, 'min')"
-                    i18n>The minimum value is 0.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="form.showError('configuration.' + option.name, cfgFormGroup, 'min')"
+                i18n
+                >The minimum value is 0.</span
+              >
             </ng-template>
           </div>
         </cds-text-label>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-list/rbd-configuration-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-list/rbd-configuration-list.component.html
index cd688fd091f..e98296267c7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-list/rbd-configuration-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-configuration-list/rbd-configuration-list.component.html
@@ -1,25 +1,39 @@
-<cd-table #poolConfTable
-          [data]="data"
-          [columns]="poolConfigurationColumns"
-          identifier="name">
+<cd-table
+  #poolConfTable
+  [data]="data"
+  [columns]="poolConfigurationColumns"
+  identifier="name"
+>
 </cd-table>
 
-<ng-template #configurationSourceTpl
-             let-value="data.value">
-
+<ng-template
+  #configurationSourceTpl
+  let-value="data.value"
+>
   <div [ngSwitch]="value">
-    <span *ngSwitchCase="'global'"
-          i18n>Global</span>
-    <strong *ngSwitchCase="'image'"
-            i18n>Image</strong>
-    <strong *ngSwitchCase="'pool'"
-            i18n>Pool</strong>
+    <span
+      *ngSwitchCase="'global'"
+      i18n
+      >Global</span
+    >
+    <strong
+      *ngSwitchCase="'image'"
+      i18n
+      >Image</strong
+    >
+    <strong
+      *ngSwitchCase="'pool'"
+      i18n
+      >Pool</strong
+    >
   </div>
 </ng-template>
 
-<ng-template #configurationValueTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #configurationValueTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <div [ngSwitch]="row.type">
     <span *ngSwitchCase="typeField.bps">{{ value | dimlessBinaryPerSecond }}</span>
     <span *ngSwitchCase="typeField.milliseconds">{{ value | milliseconds }}</span>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-details/rbd-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-details/rbd-details.component.html
index 2e748ed4cb4..10c1d1a7985 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-details/rbd-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-details/rbd-details.component.html
@@ -1,59 +1,100 @@
 <ng-template #usageNotAvailableTooltipTpl>
-  <ng-container i18n>Only available for RBD images with <strong>fast-diff</strong> enabled</ng-container>
+  <ng-container i18n
+    >Only available for RBD images with <strong>fast-diff</strong> enabled</ng-container
+  >
 </ng-template>
 
 <ng-container *ngIf="selection && selection.source !== 'REMOVING'">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="rbd-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="rbd-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-        <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-               data-testid="rbd-details-table">
+        <table
+          class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+          data-testid="rbd-details-table"
+        >
           <tbody>
             <tr cdstablerow>
-              <td i18n
-                  class="bold w-25"
-                  cdstabledata>Name</td>
+              <td
+                i18n
+                class="bold w-25"
+                cdstabledata
+              >
+                Name
+              </td>
               <td class="w-75">{{ selection.name }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold"
-                  cdstabledata>Pool</td>
+              <td
+                i18n
+                class="bold"
+                cdstabledata
+              >
+                Pool
+              </td>
               <td>{{ selection.pool_name }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Data Pool</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Data Pool
+              </td>
               <td>{{ selection.data_pool | empty }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Created</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Created
+              </td>
               <td>{{ selection.timestamp | cdDate }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Size</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Size
+              </td>
               <td>{{ selection.size | dimlessBinary }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Objects</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Objects
+              </td>
               <td>{{ selection.num_objs | dimless }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Object size</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Object size
+              </td>
               <td>{{ selection.obj_size | dimlessBinary }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Features</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Features
+              </td>
               <td>
                 <span *ngFor="let feature of selection.features_name">
                   <cds-tag class="tag-dark me-2">{{ feature }}</cds-tag>
@@ -61,14 +102,21 @@
               </td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Provisioned</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Provisioned
+              </td>
               <td>
                 <span *ngIf="selection.features_name?.indexOf('fast-diff') === -1">
-                  <span class="form-text text-muted"
-                        [ngbTooltip]="usageNotAvailableTooltipTpl"
-                        placement="top"
-                        i18n>N/A</span>
+                  <span
+                    class="form-text text-muted"
+                    [ngbTooltip]="usageNotAvailableTooltipTpl"
+                    placement="top"
+                    i18n
+                    >N/A</span
+                  >
                 </span>
                 <span *ngIf="selection.features_name?.indexOf('fast-diff') !== -1">
                   {{ selection.disk_usage | dimlessBinary }}
@@ -76,14 +124,21 @@
               </td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Total provisioned</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Total provisioned
+              </td>
               <td>
                 <span *ngIf="selection.features_name?.indexOf('fast-diff') === -1">
-                  <span class="form-text text-muted"
-                        [ngbTooltip]="usageNotAvailableTooltipTpl"
-                        placement="top"
-                        i18n>N/A</span>
+                  <span
+                    class="form-text text-muted"
+                    [ngbTooltip]="usageNotAvailableTooltipTpl"
+                    placement="top"
+                    i18n
+                    >N/A</span
+                  >
                 </span>
                 <span *ngIf="selection.features_name?.indexOf('fast-diff') !== -1">
                   {{ selection.total_disk_usage | dimlessBinary }}
@@ -91,37 +146,65 @@
               </td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Striping unit</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Striping unit
+              </td>
               <td>{{ selection.stripe_unit | dimlessBinary }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Striping count</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Striping count
+              </td>
               <td>{{ selection.stripe_count }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Parent</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Parent
+              </td>
               <td>
-                <span *ngIf="selection.parent">{{ selection.parent.pool_name }}<span
-                        *ngIf="selection.parent.pool_namespace">/{{ selection.parent.pool_namespace }}</span>/{{ selection.parent.image_name }}&#64;{{ selection.parent.snap_name }}</span>
+                <span *ngIf="selection.parent"
+                  >{{ selection.parent.pool_name
+                  }}<span *ngIf="selection.parent.pool_namespace"
+                    >/{{ selection.parent.pool_namespace }}</span
+                  >/{{ selection.parent.image_name }}&#64;{{ selection.parent.snap_name }}</span
+                >
                 <span *ngIf="!selection.parent">-</span>
               </td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Block name prefix</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Block name prefix
+              </td>
               <td>{{ selection.block_name_prefix }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Order</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Order
+              </td>
               <td>{{ selection.order }}</td>
             </tr>
             <tr cdstablerow>
-              <td i18n
-                  class="bold">Format Version</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Format Version
+              </td>
               <td>{{ selection.image_format }}</td>
             </tr>
           </tbody>
@@ -129,36 +212,51 @@
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="snapshots">
-      <a ngbNavLink
-         i18n>Snapshots</a>
+      <a
+        ngbNavLink
+        i18n
+        >Snapshots</a
+      >
       <ng-template ngbNavContent>
-        <cd-rbd-snapshot-list [snapshots]="selection.snapshots"
-                              [featuresName]="selection.features_name"
-                              [poolName]="selection.pool_name"
-                              [primary]="selection.primary"
-                              [namespace]="selection.namespace"
-                              [mirroring]="selection.mirror_mode"
-                              [rbdName]="selection.name"></cd-rbd-snapshot-list>
+        <cd-rbd-snapshot-list
+          [snapshots]="selection.snapshots"
+          [featuresName]="selection.features_name"
+          [poolName]="selection.pool_name"
+          [primary]="selection.primary"
+          [namespace]="selection.namespace"
+          [mirroring]="selection.mirror_mode"
+          [rbdName]="selection.name"
+        ></cd-rbd-snapshot-list>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="configuration">
-      <a ngbNavLink
-         i18n>Configuration</a>
+      <a
+        ngbNavLink
+        i18n
+        >Configuration</a
+      >
       <ng-template ngbNavContent>
-        <cd-rbd-configuration-table [data]="selection['configuration']"></cd-rbd-configuration-table>
+        <cd-rbd-configuration-table
+          [data]="selection['configuration']"
+        ></cd-rbd-configuration-table>
       </ng-template>
     </ng-container>
 
     <ng-container ngbNavItem="performance">
-      <a ngbNavLink
-         i18n>Performance</a>
+      <a
+        ngbNavLink
+        i18n
+        >Performance</a
+      >
       <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="RBD details"
-                    [grafanaPath]="rbdDashboardUrl"
-                    [type]="'metrics'"
-                    uid="YhCYGcuZz"
-                    grafanaStyle="one">
+        <cd-grafana
+          i18n-title
+          title="RBD details"
+          [grafanaPath]="rbdDashboardUrl"
+          [type]="'metrics'"
+          uid="YhCYGcuZz"
+          grafanaStyle="one"
+        >
         </cd-grafana>
       </ng-template>
     </ng-container>
@@ -167,21 +265,32 @@
   <div [ngbNavOutlet]="nav"></div>
 </ng-container>
 <ng-container *ngIf="selection && selection.source === 'REMOVING'">
-  <cd-alert-panel type="warning"
-                  i18n>Information can not be displayed for RBD in status 'Removing'.</cd-alert-panel>
+  <cd-alert-panel
+    type="warning"
+    i18n
+    >Information can not be displayed for RBD in status 'Removing'.</cd-alert-panel
+  >
 </ng-container>
 
-<ng-template #poolConfigurationSourceTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #poolConfigurationSourceTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <ng-container *ngIf="+value; else global">
-    <strong i18n
-            i18n-ngbTooltip
-            ngbTooltip="This setting overrides the global value">Image</strong>
+    <strong
+      i18n
+      i18n-ngbTooltip
+      ngbTooltip="This setting overrides the global value"
+      >Image</strong
+    >
   </ng-container>
   <ng-template #global>
-    <span i18n
-          i18n-ngbTooltip
-          ngbTooltip="This is the global value. No value for this option has been set for this image.">Global</span>
+    <span
+      i18n
+      i18n-ngbTooltip
+      ngbTooltip="This is the global value. No value for this option has been set for this image."
+      >Global</span
+    >
   </ng-template>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.html
index 999c129ad06..55ce961fed9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.html
@@ -1,48 +1,63 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="rbdForm"
-          #formDir="ngForm"
-          [formGroup]="rbdForm"
-          novalidate>
-
-      <div i18n="form title"
-           class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}
+    <form
+      name="rbdForm"
+      #formDir="ngForm"
+      [formGroup]="rbdForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
+        {{ action | titlecase }} {{ resource | upperFirst }}
         <cd-help-text>
-          <div *ngIf="action === 'Copy'">{{copyMessage}}
-          </div>
+          <div *ngIf="action === 'Copy'">{{ copyMessage }}</div>
         </cd-help-text>
       </div>
 
       <!-- Parent -->
-      <div class="form-item"
-           *ngIf="rbdForm.getValue('parent')">
-        <cds-text-label for="parent"
-                        i18n>{{ action | titlecase }} from
-          <input cdsText
-                 type="text"
-                 id="parent"
-                 name="parent"
-                 formControlName="parent"
-                 autofocus>
+      <div
+        class="form-item"
+        *ngIf="rbdForm.getValue('parent')"
+      >
+        <cds-text-label
+          for="parent"
+          i18n
+          >{{ action | titlecase }} from
+          <input
+            cdsText
+            type="text"
+            id="parent"
+            name="parent"
+            formControlName="parent"
+            autofocus
+          />
         </cds-text-label>
       </div>
 
       <!-- Name -->
       <div class="form-item">
-        <cds-text-label [invalid]="!rbdForm.controls['name'].valid && (rbdForm.controls['name'].dirty)"
-                        [invalidText]="nameError"
-                        for="name"
-                        i18n
-                        cdRequiredField="Name">Name
-          <input cdsText
-                 type="text"
-                 placeholder="Name..."
-                 id="name"
-                 name="name"
-                 formControlName="name"
-                 [invalid]="!rbdForm.controls['name'].valid && (rbdForm.controls['name'].dirty)"
-                 autofocus>
+        <cds-text-label
+          [invalid]="!rbdForm.controls['name'].valid && rbdForm.controls['name'].dirty"
+          [invalidText]="nameError"
+          for="name"
+          i18n
+          cdRequiredField="Name"
+          >Name
+          <input
+            cdsText
+            type="text"
+            placeholder="Name..."
+            id="name"
+            name="name"
+            formControlName="name"
+            [invalid]="!rbdForm.controls['name'].valid && rbdForm.controls['name'].dirty"
+            autofocus
+          />
         </cds-text-label>
         <ng-template #nameError>
           <span *ngIf="rbdForm.showError('name', formDir, 'required')">
@@ -55,359 +70,537 @@
       </div>
 
       <!-- Pool -->
-      <div class="form-item"
-           (change)="onPoolChange($event.target.value)">
-        <cds-text-label for="pool"
-                        i18n
-                        *ngIf="mode === 'editing' || !poolPermission.read">Pool
-          <input cdsText
-                 type="text"
-                 placeholder="Pool name..."
-                 id="pool"
-                 name="pool"
-                 formControlName="pool">
+      <div
+        class="form-item"
+        (change)="onPoolChange($event.target.value)"
+      >
+        <cds-text-label
+          for="pool"
+          i18n
+          *ngIf="mode === 'editing' || !poolPermission.read"
+          >Pool
+          <input
+            cdsText
+            type="text"
+            placeholder="Pool name..."
+            id="pool"
+            name="pool"
+            formControlName="pool"
+          />
         </cds-text-label>
-        <cds-select label="Pool"
-                    for="pool"
-                    name="pool"
-                    id="pool"
-                    formControlName="pool"
-                    cdRequiredField="Pool"
-                    [invalid]="!rbdForm.controls['pool'].valid && (rbdForm.controls['pool'].dirty)"
-                    [invalidText]="poolError"
-                    (valueChange)="setPoolMirrorMode()"
-                    *ngIf="mode !== 'editing' && poolPermission.read">
-          <option *ngIf="pools === null"
-                  [ngValue]="null"
-                  i18n>Loading...</option>
-          <option *ngIf="pools !== null && pools.length === 0"
-                  [ngValue]="null"
-                  i18n>-- No block pools available --</option>
-          <option *ngIf="pools !== null && pools.length > 0"
-                  [ngValue]="null"
-                  i18n>-- Select a pool --</option>
-          <option *ngFor="let pool of pools"
-                  [value]="pool.pool_name">{{ pool.pool_name }}</option>
+        <cds-select
+          label="Pool"
+          for="pool"
+          name="pool"
+          id="pool"
+          formControlName="pool"
+          cdRequiredField="Pool"
+          [invalid]="!rbdForm.controls['pool'].valid && rbdForm.controls['pool'].dirty"
+          [invalidText]="poolError"
+          (valueChange)="setPoolMirrorMode()"
+          *ngIf="mode !== 'editing' && poolPermission.read"
+        >
+          <option
+            *ngIf="pools === null"
+            [ngValue]="null"
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="pools !== null && pools.length === 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- No block pools available --
+          </option>
+          <option
+            *ngIf="pools !== null && pools.length > 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- Select a pool --
+          </option>
+          <option
+            *ngFor="let pool of pools"
+            [value]="pool.pool_name"
+          >
+            {{ pool.pool_name }}
+          </option>
         </cds-select>
         <ng-template #poolError>
-          <span *ngIf="rbdForm.showError('pool', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
+          <span
+            *ngIf="rbdForm.showError('pool', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Size -->
       <div class="form-item">
-        <cds-text-label labelInputID="size"
-                        i18n
-                        [invalid]="!rbdForm.controls['size'].valid && (rbdForm.controls['size'].dirty)"
-                        [invalidText]="sizeError"
-                        cdRequiredField="Size">Size
-          <input cdsText
-                 type="text"
-                 placeholder="e.g., 10GiB"
-                 id="size"
-                 formControlName="size"
-                 defaultUnit="GiB"
-                 [invalid]="!rbdForm.controls['size'].valid && (rbdForm.controls['size'].dirty)"
-                 cdDimlessBinary>
+        <cds-text-label
+          labelInputID="size"
+          i18n
+          [invalid]="!rbdForm.controls['size'].valid && rbdForm.controls['size'].dirty"
+          [invalidText]="sizeError"
+          cdRequiredField="Size"
+          >Size
+          <input
+            cdsText
+            type="text"
+            placeholder="e.g., 10GiB"
+            id="size"
+            formControlName="size"
+            defaultUnit="GiB"
+            [invalid]="!rbdForm.controls['size'].valid && rbdForm.controls['size'].dirty"
+            cdDimlessBinary
+          />
         </cds-text-label>
         <ng-template #sizeError>
-          <span class="invalid-feedback"
-                *ngIf="rbdForm.showError('size', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="rbdForm.showError('size', formDir, 'invalidSizeObject')"
-                i18n>Size must be increased.</span>
-          <span *ngIf="rbdForm.showError('size', formDir, 'pattern')"
-                class="invalid-feedback"
-                i18n>Size must be a number or in a valid format. eg: 5 GiB</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="rbdForm.showError('size', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="rbdForm.showError('size', formDir, 'invalidSizeObject')"
+            i18n
+            >Size must be increased.</span
+          >
+          <span
+            *ngIf="rbdForm.showError('size', formDir, 'pattern')"
+            class="invalid-feedback"
+            i18n
+            >Size must be a number or in a valid format. eg: 5 GiB</span
+          >
         </ng-template>
       </div>
 
       <!-- Namespace -->
       <!-- Skeleton-->
-      <div class="form-item"
-           *ngIf="mode !== 'editing' && rbdForm.getValue('pool') && namespaces === null">
-        <cds-select label="Namespace"
-                    labelInputID="namespace"
-                    id="namespace"
-                    [skeleton]="true"
-                    formControlName="namespace">
-          <option [ngValue]="null"
-                  i18n>Loading...</option>
+      <div
+        class="form-item"
+        *ngIf="mode !== 'editing' && rbdForm.getValue('pool') && namespaces === null"
+      >
+        <cds-select
+          label="Namespace"
+          labelInputID="namespace"
+          id="namespace"
+          [skeleton]="true"
+          formControlName="namespace"
+        >
+          <option
+            [ngValue]="null"
+            i18n
+          >
+            Loading...
+          </option>
         </cds-select>
       </div>
 
-      <div class="form-item"
-           *ngIf="(mode === 'editing' && rbdForm.getValue('namespace')) || mode !== 'editing' && (namespaces && namespaces.length > 0 || !poolPermission.read)">
-        <cds-text-label label="Namespace"
-                        labelInputID="namespace"
-                        [helperText]="namespaceHelperTpl"
-                        *ngIf="mode === 'editing' || !poolPermission.read"
-                        i18n>Namespace
-          <input cdsText
-                 id="namespace"
-                 formControlName="namespace">
+      <div
+        class="form-item"
+        *ngIf="
+          (mode === 'editing' && rbdForm.getValue('namespace')) ||
+          (mode !== 'editing' && ((namespaces && namespaces.length > 0) || !poolPermission.read))
+        "
+      >
+        <cds-text-label
+          label="Namespace"
+          labelInputID="namespace"
+          [helperText]="namespaceHelperTpl"
+          *ngIf="mode === 'editing' || !poolPermission.read"
+          i18n
+          >Namespace
+          <input
+            cdsText
+            id="namespace"
+            formControlName="namespace"
+          />
         </cds-text-label>
 
-        <cds-select label="Namespace"
-                    [helperText]="namespaceHelperTpl"
-                    id="namespace"
-                    formControlName="namespace"
-                    (valueChange)="disableMirroring($event)"
-                    *ngIf="mode !== 'editing' && poolPermission.read">
-          <option *ngIf="namespaces === null"
-                  [ngValue]="null"
-                  i18n>Loading...</option>
-          <option *ngIf="namespaces !== null && namespaces.length === 0"
-                  [ngValue]="null"
-                  i18n>-- No namespaces available --</option>
-          <option *ngIf="namespaces !== null && namespaces.length > 0"
-                  value=""
-                  i18n>-- Select a namespace --</option>
-          <option *ngFor="let namespace of namespaces"
-                  [value]="namespace">{{ namespace }}</option>
+        <cds-select
+          label="Namespace"
+          [helperText]="namespaceHelperTpl"
+          id="namespace"
+          formControlName="namespace"
+          (valueChange)="disableMirroring($event)"
+          *ngIf="mode !== 'editing' && poolPermission.read"
+        >
+          <option
+            *ngIf="namespaces === null"
+            [ngValue]="null"
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="namespaces !== null && namespaces.length === 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- No namespaces available --
+          </option>
+          <option
+            *ngIf="namespaces !== null && namespaces.length > 0"
+            value=""
+            i18n
+          >
+            -- Select a namespace --
+          </option>
+          <option
+            *ngFor="let namespace of namespaces"
+            [value]="namespace"
+          >
+            {{ namespace }}
+          </option>
         </cds-select>
 
         <ng-template #namespaceHelperTpl>
-          Namespace allows you to logically group RBD images within your Ceph Cluster.Choosing a namespace makes it easier to locate and manage related RBD images efficiently.
+          Namespace allows you to logically group RBD images within your Ceph Cluster.Choosing a
+          namespace makes it easier to locate and manage related RBD images efficiently.
         </ng-template>
       </div>
 
       <!-- Mirroring -->
       <div class="form-item">
-        <cds-checkbox id="mirroring"
-                      name="mirroring"
-                      formControlName="mirroring"
-                      (checkedChange)="setMirrorMode()"
-                      i18n>Mirroring
-          <cd-help-text>Allow data to be asynchronously mirrored between two Ceph clusters</cd-help-text>
-
+        <cds-checkbox
+          id="mirroring"
+          name="mirroring"
+          formControlName="mirroring"
+          (checkedChange)="setMirrorMode()"
+          i18n
+          >Mirroring
+          <cd-help-text
+            >Allow data to be asynchronously mirrored between two Ceph clusters</cd-help-text
+          >
         </cds-checkbox>
-        <cd-alert-panel *ngIf="showMirrorDisableMessage"
-                        spacingClass="mt-2"
-                        [showTitle]="false"
-                        type="info">Mirroring can not be disabled on <b>&nbsp;Pool&nbsp;</b> mirror mode.
-                                    You need to change the mirror mode to enable this option.
+        <cd-alert-panel
+          *ngIf="showMirrorDisableMessage"
+          spacingClass="mt-2"
+          [showTitle]="false"
+          type="info"
+          >Mirroring can not be disabled on <b>&nbsp;Pool&nbsp;</b> mirror mode. You need to change
+          the mirror mode to enable this option.
         </cd-alert-panel>
-        <cd-alert-panel *ngIf="currentPoolMirrorMode === 'disabled'"
-                        type="info"
-                        [showTitle]="false"
-                        spacingClass="mt-2"
-                        actionName="Set mode"
-                        (action)="onAlertAction($event)">
-            You need to set&nbsp;<b>mirror mode</b>&nbsp;in the selected pool to enable mirroring.
+        <cd-alert-panel
+          *ngIf="currentPoolMirrorMode === 'disabled'"
+          type="info"
+          [showTitle]="false"
+          spacingClass="mt-2"
+          actionName="Set mode"
+          (action)="onAlertAction($event)"
+        >
+          You need to set&nbsp;<b>mirror mode</b>&nbsp;in the selected pool to enable mirroring.
         </cd-alert-panel>
       </div>
 
       <!-- Mirroring Modes -->
-      <div *ngIf="mirroring && currentPoolMirrorMode !== 'disabled'"
-           class="form-item">
-        <cds-radio-group formControlName="mirroringMode"
-                         name="mirroringMode">
-          <cds-radio *ngFor="let option of mirroringOptions"
-                     [value]="option.value"
-                     [id]="option.value"
-                     (change)="setExclusiveLock()"
-                     [disabled]="shouldDisable(option.value)">
+      <div
+        *ngIf="mirroring && currentPoolMirrorMode !== 'disabled'"
+        class="form-item"
+      >
+        <cds-radio-group
+          formControlName="mirroringMode"
+          name="mirroringMode"
+        >
+          <cds-radio
+            *ngFor="let option of mirroringOptions"
+            [value]="option.value"
+            [id]="option.value"
+            (change)="setExclusiveLock()"
+            [disabled]="shouldDisable(option.value)"
+          >
             {{ option.value | titlecase }}
-            <cd-helper> {{ option.text}} </cd-helper>
+            <cd-helper> {{ option.text }} </cd-helper>
           </cds-radio>
         </cds-radio-group>
-        <cd-alert-panel *ngIf="currentPoolMirrorMode === 'pool' && mode !== 'editing'"
-                        type="info"
-                        [showTitle]="false"
-                        spacingClass="mt-2"
-                        actionName="Set mode"
-                        (action)="onAlertAction($event)"
-                        i18n>
-          You need to set mode as&nbsp;<b>Image</b>&nbsp;in the selected pool to enable snapshot mirroring.
+        <cd-alert-panel
+          *ngIf="currentPoolMirrorMode === 'pool' && mode !== 'editing'"
+          type="info"
+          [showTitle]="false"
+          spacingClass="mt-2"
+          actionName="Set mode"
+          (action)="onAlertAction($event)"
+          i18n
+        >
+          You need to set mode as&nbsp;<b>Image</b>&nbsp;in the selected pool to enable snapshot
+          mirroring.
         </cd-alert-panel>
       </div>
 
       <!-- Snapshot Schedule Interval -->
-      <div class="form-item"
-           *ngIf="rbdForm.getValue('mirroringMode') === rbdMirrorModes.snapshot && mirroring">
-        <cds-text-label for="schedule"
-                        helperText="Create Mirror-Snapshots automatically on a periodic basis. The interval can be specified in days, hours, or minutes using d, h, m suffix respectively. To create mirror snapshots, you must import or create and have available peers to mirror"
-                        cdRequiredField="Schedule Interval"
-                        [invalid]="!rbdForm.controls['schedule'].valid && (rbdForm.controls['schedule'].dirty)"
-                        [invalidText]="scheduleError"
-                        i18n>Schedule Interval
-          <input cdsText
-                 type="text"
-                 placeholder="e.g., 12h or 1d or 10m"
-                 id="schedule"
-                 name="schedule"
-                 formControlName="schedule"
-                 [disabled]="(peerConfigured === false) ? true : null"
-                 [invalid]="!rbdForm.controls['schedule'].valid && (rbdForm.controls['schedule'].dirty)">
+      <div
+        class="form-item"
+        *ngIf="rbdForm.getValue('mirroringMode') === rbdMirrorModes.snapshot && mirroring"
+      >
+        <cds-text-label
+          for="schedule"
+          helperText="Create Mirror-Snapshots automatically on a periodic basis. The interval can be specified in days, hours, or minutes using d, h, m suffix respectively. To create mirror snapshots, you must import or create and have available peers to mirror"
+          cdRequiredField="Schedule Interval"
+          [invalid]="!rbdForm.controls['schedule'].valid && rbdForm.controls['schedule'].dirty"
+          [invalidText]="scheduleError"
+          i18n
+          >Schedule Interval
+          <input
+            cdsText
+            type="text"
+            placeholder="e.g., 12h or 1d or 10m"
+            id="schedule"
+            name="schedule"
+            formControlName="schedule"
+            [disabled]="peerConfigured === false ? true : null"
+            [invalid]="!rbdForm.controls['schedule'].valid && rbdForm.controls['schedule'].dirty"
+          />
         </cds-text-label>
         <ng-template #scheduleError>
-          <span *ngIf="rbdForm.showError('schedule', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
+          <span
+            *ngIf="rbdForm.showError('schedule', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Use a dedicated pool -->
-      <div class="form-item"
-           *ngIf="allDataPools.length > 1 || mode === 'editing'">
-        <cds-checkbox id="useDataPool"
-                      name="useDataPool"
-                      formControlName="useDataPool"
-                      (change)="onUseDataPoolChange()"
-                      i18n>
-                      Use a dedicated data pool
+      <div
+        class="form-item"
+        *ngIf="allDataPools.length > 1 || mode === 'editing'"
+      >
+        <cds-checkbox
+          id="useDataPool"
+          name="useDataPool"
+          formControlName="useDataPool"
+          (change)="onUseDataPoolChange()"
+          i18n
+        >
+          Use a dedicated data pool
 
-          <cd-help-text>Use a dedicated pool to store the image data. If not selected,
-            the image data will be stored in the same pool as the image metadata.
+          <cd-help-text
+            >Use a dedicated pool to store the image data. If not selected, the image data will be
+            stored in the same pool as the image metadata.
           </cd-help-text>
 
           <cd-helper *ngIf="allDataPools.length <= 1 && mode !== 'editing'">
-            <span>You need more than one pool with the rbd application label use to use a dedicated data pool.</span>
+            <span
+              >You need more than one pool with the rbd application label use to use a dedicated
+              data pool.</span
+            >
           </cd-helper>
         </cds-checkbox>
       </div>
 
       <!-- Data pools -->
-      <div class="form-item"
-           *ngIf="rbdForm.getValue('useDataPool')">
-        <cds-select label="Data pool"
-                    helperText="Dedicated pool that stores the object-data of the RBD"
-                    for="dataPool"
-                    name="dataPool"
-                    id="dataPool"
-                    [invalid]="!rbdForm.controls['dataPool'].valid && (rbdForm.controls['dataPool'].dirty)"
-                    [invalidText]="dataPoolError"
-                    formControlName="dataPool"
-                    cdRequiredField="Data pool"
-                    *ngIf="mode !== 'editing' && poolPermission.read">
-          <option *ngIf="dataPools === null"
-                  [ngValue]="null"
-                  i18n>Loading...</option>
-          <option *ngIf="dataPools !== null && dataPools.length === 0"
-                  [ngValue]="null"
-                  i18n>-- No data pools available --</option>
-          <option *ngIf="dataPools !== null && dataPools.length > 0"
-                  [ngValue]="null"
-                  i18n>-- Select a data pool --</option>
-          <option *ngFor="let dataPool of dataPools"
-                  [value]="dataPool.pool_name">{{ dataPool.pool_name }}</option>
+      <div
+        class="form-item"
+        *ngIf="rbdForm.getValue('useDataPool')"
+      >
+        <cds-select
+          label="Data pool"
+          helperText="Dedicated pool that stores the object-data of the RBD"
+          for="dataPool"
+          name="dataPool"
+          id="dataPool"
+          [invalid]="!rbdForm.controls['dataPool'].valid && rbdForm.controls['dataPool'].dirty"
+          [invalidText]="dataPoolError"
+          formControlName="dataPool"
+          cdRequiredField="Data pool"
+          *ngIf="mode !== 'editing' && poolPermission.read"
+        >
+          <option
+            *ngIf="dataPools === null"
+            [ngValue]="null"
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="dataPools !== null && dataPools.length === 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- No data pools available --
+          </option>
+          <option
+            *ngIf="dataPools !== null && dataPools.length > 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- Select a data pool --
+          </option>
+          <option
+            *ngFor="let dataPool of dataPools"
+            [value]="dataPool.pool_name"
+          >
+            {{ dataPool.pool_name }}
+          </option>
         </cds-select>
         <ng-template #dataPoolError>
-          <span *ngIf="rbdForm.showError('dataPool', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
+          <span
+            *ngIf="rbdForm.showError('dataPool', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Advanced Section -->
       <cd-form-advanced-fieldset>
         <!-- Features -->
-        <div class="form-item"
-             formGroupName="features">
+        <div
+          class="form-item"
+          formGroupName="features"
+        >
           <fieldset>
-            <label class="cds--label"
-                   for="features"
-                   i18n>Features</label>
+            <label
+              class="cds--label"
+              for="features"
+              i18n
+              >Features</label
+            >
             <ng-container *ngFor="let feature of featuresList">
-              <cds-checkbox [id]="feature.key"
-                            [name]="feature.key"
-                            [formControlName]="feature.key"
-                            class="spacing-03">
-                {{ feature.key | titlecase}}
+              <cds-checkbox
+                [id]="feature.key"
+                [name]="feature.key"
+                [formControlName]="feature.key"
+                class="spacing-03"
+              >
+                {{ feature.key | titlecase }}
                 <cd-help-text *ngIf="feature.helperText">
-                  {{ feature.helperText}}
+                  {{ feature.helperText }}
                 </cd-help-text>
-                <cd-alert-panel type="warning"
-                                spacingClass="mt-2"
-                                [showTitle]="false"
-                                *ngIf="feature.helperHtml && rbdForm.getValue(feature.key) === false">
-                {{ feature.helperHtml }}
+                <cd-alert-panel
+                  type="warning"
+                  spacingClass="mt-2"
+                  [showTitle]="false"
+                  *ngIf="feature.helperHtml && rbdForm.getValue(feature.key) === false"
+                >
+                  {{ feature.helperHtml }}
                 </cd-alert-panel>
               </cds-checkbox>
             </ng-container>
           </fieldset>
         </div>
 
-        <legend class="cd-header"
-                i18n>Striping</legend>
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Striping
+        </legend>
         <!-- Object Size -->
         <div class="form-item">
-          <cds-select i18n
-                      for="obj_size"
-                      label="Object size"
-                      helperText="Objects in the Ceph Storage Cluster have a maximum configurable size (e.g., 2MB, 4MB, etc.). The object size should be large enough to accommodate many stripe units, and should be a multiple of the stripe unit."
-                      id="obj_size"
-                      name="obj_size"
-                      formControlName="obj_size">
-            <option *ngFor="let objectSize of objectSizes"
-                    [value]="objectSize">{{ objectSize }}</option>
+          <cds-select
+            i18n
+            for="obj_size"
+            label="Object size"
+            helperText="Objects in the Ceph Storage Cluster have a maximum configurable size (e.g., 2MB, 4MB, etc.). The object size should be large enough to accommodate many stripe units, and should be a multiple of the stripe unit."
+            id="obj_size"
+            name="obj_size"
+            formControlName="obj_size"
+          >
+            <option
+              *ngFor="let objectSize of objectSizes"
+              [value]="objectSize"
+            >
+              {{ objectSize }}
+            </option>
           </cds-select>
         </div>
 
         <!-- stripingUnit -->
         <div class="form-item">
-          <cds-select i18n
-                      for="stripingUnit"
-                      label="Stripe unit"
-                      helperText="Stripes have a configurable unit size (e.g., 64kb). The Ceph Client divides the data it will write to objects into equally sized stripe units, except for the last stripe unit. A stripe width, should be a fraction of the Object Size so that an object may contain many stripe units"
-                      id="stripingUnit"
-                      name="stripingUnit"
-                      formControlName="stripingUnit"
-                      cdRequiredField="Striping Unit"
-                      [invalid]="!rbdForm.controls['stripingUnit'].valid && (rbdForm.controls['stripingUnit'].dirty)"
-                      [invalidText]="stripingUnitError">
+          <cds-select
+            i18n
+            for="stripingUnit"
+            label="Stripe unit"
+            helperText="Stripes have a configurable unit size (e.g., 64kb). The Ceph Client divides the data it will write to objects into equally sized stripe units, except for the last stripe unit. A stripe width, should be a fraction of the Object Size so that an object may contain many stripe units"
+            id="stripingUnit"
+            name="stripingUnit"
+            formControlName="stripingUnit"
+            cdRequiredField="Striping Unit"
+            [invalid]="
+              !rbdForm.controls['stripingUnit'].valid && rbdForm.controls['stripingUnit'].dirty
+            "
+            [invalidText]="stripingUnitError"
+          >
             <option [ngValue]="null">-- Select stripe unit --</option>
-            <option *ngFor="let objectSize of objectSizes"
-                    [value]="objectSize">{{ objectSize }}</option>
+            <option
+              *ngFor="let objectSize of objectSizes"
+              [value]="objectSize"
+            >
+              {{ objectSize }}
+            </option>
           </cds-select>
           <ng-template #stripingUnitError>
-            <span class="invalid-feedback"
-                  *ngIf="rbdForm.showError('stripingUnit', formDir, 'required')"
-                  i18n>This field is required because stripe count is defined!</span>
-            <span class="invalid-feedback"
-                  *ngIf="rbdForm.showError('stripingUnit', formDir, 'invalidStripingUnit')"
-                  i18n>Stripe unit is greater than object size.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="rbdForm.showError('stripingUnit', formDir, 'required')"
+              i18n
+              >This field is required because stripe count is defined!</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="rbdForm.showError('stripingUnit', formDir, 'invalidStripingUnit')"
+              i18n
+              >Stripe unit is greater than object size.</span
+            >
           </ng-template>
         </div>
 
         <!-- Stripe Count -->
         <div class="form-item">
-          <cds-number i18n
-                      for="stripingCount"
-                      label="Stripe count"
-                      helperText="The Ceph Client writes a sequence of stripe units over a series of objects determined by the stripe count. The series of objects is called an object set. After the Ceph Client writes to the last object in the object set, it returns to the first object in the object set."
-                      id="stripingCount"
-                      name="stripingCount"
-                      formControlName="stripingCount"
-                      cdRequiredField="Striping Count"
-                      [min]="1"
-                      [invalid]="!rbdForm.controls['stripingCount'].valid && (rbdForm.controls['stripingCount'].dirty)"
-                      [invalidText]="stripingCountError"
-                      [required]="true"></cds-number>
+          <cds-number
+            i18n
+            for="stripingCount"
+            label="Stripe count"
+            helperText="The Ceph Client writes a sequence of stripe units over a series of objects determined by the stripe count. The series of objects is called an object set. After the Ceph Client writes to the last object in the object set, it returns to the first object in the object set."
+            id="stripingCount"
+            name="stripingCount"
+            formControlName="stripingCount"
+            cdRequiredField="Striping Count"
+            [min]="1"
+            [invalid]="
+              !rbdForm.controls['stripingCount'].valid && rbdForm.controls['stripingCount'].dirty
+            "
+            [invalidText]="stripingCountError"
+            [required]="true"
+          ></cds-number>
           <ng-template #stripingCountError>
-            <span class="invalid-feedback"
-                  *ngIf="rbdForm.showError('stripingCount', formDir, 'required')"
-                  i18n>This field is required because stripe unit is defined!</span>
-            <span class="invalid-feedback"
-                  *ngIf="rbdForm.showError('stripingCount', formDir, 'min')"
-                  i18n>Stripe count must be greater than 0.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="rbdForm.showError('stripingCount', formDir, 'required')"
+              i18n
+              >This field is required because stripe unit is defined!</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="rbdForm.showError('stripingCount', formDir, 'min')"
+              i18n
+              >Stripe count must be greater than 0.</span
+            >
           </ng-template>
         </div>
 
-        <cd-rbd-configuration-form [form]="rbdForm"
-                                   [initializeData]="initializeConfigData"
-                                   (changes)="getDirtyConfigurationValues = $event"></cd-rbd-configuration-form>
+        <cd-rbd-configuration-form
+          [form]="rbdForm"
+          [initializeData]="initializeConfigData"
+          (changes)="getDirtyConfigurationValues = $event"
+        ></cd-rbd-configuration-form>
       </cd-form-advanced-fieldset>
 
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="formDir"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                            wrappingClass="text-right"></cd-form-button-panel>
-
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="formDir"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        wrappingClass="text-right"
+      ></cd-form-button-panel>
     </form>
   </ng-container>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-list/rbd-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-list/rbd-list.component.html
index e7fc966455b..c51b136350d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-list/rbd-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-list/rbd-list.component.html
@@ -1,94 +1,126 @@
 <cd-rbd-tabs></cd-rbd-tabs>
 
-<cd-table #table
-          [data]="images"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="unique_id"
-          [searchableObjects]="true"
-          [serverSide]="true"
-          [count]="count"
-          forceIdentifier="true"
-          selectionType="single"
-          [hasDetails]="true"
-          [status]="tableStatus"
-          [maxLimit]="25"
-          [autoReload]="-1"
-          (fetchData)="taskListService.fetch($event)"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [data]="images"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="unique_id"
+  [searchableObjects]="true"
+  [serverSide]="true"
+  [count]="count"
+  forceIdentifier="true"
+  selectionType="single"
+  [hasDetails]="true"
+  [status]="tableStatus"
+  [maxLimit]="25"
+  [autoReload]="-1"
+  (fetchData)="taskListService.fetch($event)"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-rbd-details *cdTableDetail
-                  [selection]="expandedRow">
+  <cd-rbd-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-rbd-details>
 </cd-table>
 
-<ng-template #parentTpl
-             let-value="data.value">
-  <span *ngIf="value">{{ value.pool_name }}<span
-          *ngIf="value.pool_namespace">/{{ value.pool_namespace }}</span>/{{ value.image_name }}&#64;{{ value.snap_name }}</span>
+<ng-template
+  #parentTpl
+  let-value="data.value"
+>
+  <span *ngIf="value"
+    >{{ value.pool_name }}<span *ngIf="value.pool_namespace">/{{ value.pool_namespace }}</span
+    >/{{ value.image_name }}&#64;{{ value.snap_name }}</span
+  >
   <span *ngIf="!value">-</span>
 </ng-template>
 
-<ng-template #mirroringTpl
-             let-value="data.value"
-             let-row="data.row">
-  <cds-tag *ngIf="value?.length === 3; else probb"
-           class="tag-info">
-    {{ value[0] }}
-  </cds-tag>&nbsp;
-  <cds-tag *ngIf="value?.length === 3"
-           class="tag-info">
-    {{ value[1] }}
-  </cds-tag>&nbsp;
-  <cds-tag *ngIf="row?.primary === true"
-           class="tag-info"
-           i18n>
+<ng-template
+  #mirroringTpl
+  let-value="data.value"
+  let-row="data.row"
+>
+  <cds-tag
+    *ngIf="value?.length === 3; else probb"
+    class="tag-info"
+  >
+    {{ value[0] }} </cds-tag
+  >&nbsp;
+  <cds-tag
+    *ngIf="value?.length === 3"
+    class="tag-info"
+  >
+    {{ value[1] }} </cds-tag
+  >&nbsp;
+  <cds-tag
+    *ngIf="row?.primary === true"
+    class="tag-info"
+    i18n
+  >
     primary
   </cds-tag>
-  <cds-tag *ngIf="row?.primary === false"
-           class="tag-info"
-           i18n>
+  <cds-tag
+    *ngIf="row?.primary === false"
+    class="tag-info"
+    i18n
+  >
     secondary
   </cds-tag>
   <ng-template #probb>
     <cds-tag class="tag-info">
       {{ value }}
-    </cds-tag >
+    </cds-tag>
   </ng-template>
 </ng-template>
 
-<ng-template #ScheduleTpl
-             let-value="data.value"
-             let-row="data.row">
-  <cds-tag *ngIf="value?.length === 3"
-           class="tag-info">
-  {{ value[2] | cdDate  }}
+<ng-template
+  #ScheduleTpl
+  let-value="data.value"
+  let-row="data.row"
+>
+  <cds-tag
+    *ngIf="value?.length === 3"
+    class="tag-info"
+  >
+    {{ value[2] | cdDate }}
   </cds-tag>
 </ng-template>
 
-<ng-template #flattenTpl
-             let-value>
+<ng-template
+  #flattenTpl
+  let-value
+>
   You are about to flatten
-  <strong>{{ value.child }}</strong>.
-  <br>
-  <br> All blocks will be copied from parent
-  <strong>{{ value.parent }}</strong> to child
-  <strong>{{ value.child }}</strong>.
+  <strong>{{ value.child }}</strong
+  >.
+  <br />
+  <br />
+  All blocks will be copied from parent <strong>{{ value.parent }}</strong> to child
+  <strong>{{ value.child }}</strong
+  >.
 </ng-template>
 
-<ng-template #deleteTpl
-             let-hasSnapshots="hasSnapshots"
-             let-snapshots="snapshots">
-  <div class="alert alert-warning"
-       *ngIf="hasSnapshots"
-       role="alert">
+<ng-template
+  #deleteTpl
+  let-hasSnapshots="hasSnapshots"
+  let-snapshots="snapshots"
+>
+  <div
+    class="alert alert-warning"
+    *ngIf="hasSnapshots"
+    role="alert"
+  >
     <span i18n>Deleting this image will also delete all its snapshots.</span>
-    <br>
+    <br />
     <ng-container *ngIf="snapshots.length > 0">
       <span i18n>The following snapshots are currently protected and will be removed:</span>
       <ul>
@@ -98,55 +130,71 @@
   </div>
 </ng-template>
 
-<ng-template #removingStatTpl
-             let-column="data.column"
-             let-value="data.value"
-             let-row="data.row">
+<ng-template
+  #removingStatTpl
+  let-column="data.column"
+  let-value="data.value"
+  let-row="data.row"
+>
   <cds-inline-loading *ngIf="row.cdExecuting"></cds-inline-loading>
-    <span [ngClass]="column?.customTemplateConfig?.valueClass">
+  <span [ngClass]="column?.customTemplateConfig?.valueClass">
     {{ value }}
   </span>
-  <span *ngIf="row.cdExecuting"
-        [ngClass]="column?.customTemplateConfig?.executingClass ?
-        column.customTemplateConfig.executingClass :
-        'text-muted italic'">
+  <span
+    *ngIf="row.cdExecuting"
+    [ngClass]="
+      column?.customTemplateConfig?.executingClass
+        ? column.customTemplateConfig.executingClass
+        : 'text-muted italic'
+    "
+  >
     ({{ row.cdExecuting }})
   </span>
-  <svg  *ngIf="row.source && row.source === 'REMOVING'"
-        i18n-title
-        title="RBD in status 'Removing'"
-        [cdsIcon]="icons.warning"
-        [size]="icons.size16"
-        class="cds-warning-color"></svg>
+  <svg
+    *ngIf="row.source && row.source === 'REMOVING'"
+    i18n-title
+    title="RBD in status 'Removing'"
+    [cdsIcon]="icons.warning"
+    [size]="icons.size16"
+    class="cds-warning-color"
+  ></svg>
 </ng-template>
 
 <ng-template #forcePromoteConfirmation>
   <cd-alert-panel type="warning">{{ errorMessage }}</cd-alert-panel>
-  <div class="m-4"
-       i18n>
-    <strong>
-       Do you want to force the operation?
-    </strong>
+  <div
+    class="m-4"
+    i18n
+  >
+    <strong> Do you want to force the operation? </strong>
   </div>
 </ng-template>
 
-<ng-template #imageUsageTpl
-             let-row="data.row">
-  <span *ngIf="row.features_name && !row.features_name.includes('fast-diff') ; else usageBar"
-        [ngbTooltip]="usageTooltip">
+<ng-template
+  #imageUsageTpl
+  let-row="data.row"
+>
+  <span
+    *ngIf="row.features_name && !row.features_name.includes('fast-diff'); else usageBar"
+    [ngbTooltip]="usageTooltip"
+  >
     <span>-</span>
   </span>
   <ng-template #usageBar>
-    <cd-usage-bar *ngIf="row"
-                  [total]="row.size"
-                  [used]="row.disk_usage"
-                  [title]="row.name"
-                  decimals="2">
-  </cd-usage-bar>
+    <cd-usage-bar
+      *ngIf="row"
+      [total]="row.size"
+      [used]="row.disk_usage"
+      [title]="row.name"
+      decimals="2"
+    >
+    </cd-usage-bar>
   </ng-template>
 </ng-template>
 
 <ng-template #usageTooltip>
-  <div i18n
-       [innerHtml]="'Only available for RBD images with <strong>fast-diff</strong> enabled and without snapshot mirroring'"></div>
+  <div
+    i18n
+    [innerHtml]="'Only available for RBD images with <strong>fast-diff</strong> enabled and without snapshot mirroring'"
+  ></div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-form/rbd-namespace-form-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-form/rbd-namespace-form-modal.component.html
index 9ee47bf738d..c31f75fcdfe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-form/rbd-namespace-form-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-form/rbd-namespace-form-modal.component.html
@@ -1,84 +1,122 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
       Create Namespace
-  </h3>
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
+    <form
+      name="namespaceForm"
+      #formDir="ngForm"
+      [formGroup]="namespaceForm"
+      novalidate
+    >
+      <!-- Pool -->
+      <div class="form-item">
+        <cds-select
+          label="Pool"
+          for="pool"
+          formControlName="pool"
+          name="pool"
+          id="pool"
+          [invalid]="namespaceForm.controls['pool'].invalid && namespaceForm.controls['pool'].dirty"
+          [invalidText]="poolError"
+          *ngIf="poolPermission.read"
+          cdRequiredField="Pool"
+          modal-primary-focus
+          i18n
+        >
+          <option
+            *ngIf="pools === null"
+            [ngValue]="null"
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="pools !== null && pools.length === 0"
+            [ngValue]="null"
+          >
+            -- No rbd pools available --
+          </option>
+          <option
+            *ngIf="pools !== null && pools.length > 0"
+            [ngValue]="null"
+          >
+            -- Select a pool --
+          </option>
+          <option
+            *ngFor="let pool of pools"
+            [value]="pool.pool_name"
+          >
+            {{ pool.pool_name }}
+          </option>
+        </cds-select>
+        <ng-template #poolError>
+          <span
+            *ngIf="namespaceForm.showError('pool', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
+        </ng-template>
+      </div>
 
-    <form name="namespaceForm"
-          #formDir="ngForm"
-          [formGroup]="namespaceForm"
-          novalidate>
-
-    <!-- Pool -->
-    <div class="form-item">
-      <cds-select label="Pool"
-                  for="pool"
-                  formControlName="pool"
-                  name="pool"
-                  id="pool"
-                  [invalid]="namespaceForm.controls['pool'].invalid && (namespaceForm.controls['pool'].dirty)"
-                  [invalidText]="poolError"
-                  *ngIf="poolPermission.read"
-                  cdRequiredField="Pool"
-                  modal-primary-focus
-                  i18n>
-
-        <option *ngIf="pools === null"
-                [ngValue]="null">Loading...</option>
-        <option *ngIf="pools !== null && pools.length === 0"
-                [ngValue]="null">-- No rbd pools available --</option>
-        <option *ngIf="pools !== null && pools.length > 0"
-                [ngValue]="null">-- Select a pool --</option>
-        <option *ngFor="let pool of pools"
-                [value]="pool.pool_name">{{ pool.pool_name }}</option>
-      </cds-select>
-      <ng-template #poolError>
-        <span *ngIf="namespaceForm.showError('pool', formDir, 'required')"
-              class="invalid-feedback"
-              i18n>This field is required.</span>
-      </ng-template>
-    </div>
-
-    <!-- Name -->
-    <div class="form-item">
-      <cds-text-label label="Name"
-                      for="namespace"
-                      [invalid]="namespaceForm.controls['namespace'].invalid && (namespaceForm.controls['namespace'].dirty)"
-                      [invalidText]="namespaceError"
-                      cdRequiredField="Namespace"
-                      i18n>Namespace
-        <input cdsText
-               type="text"
-               placeholder="Namespace name..."
-               id="namespace"
-               name="namespace"
-               formControlName="namespace"
-               [invalid]="namespaceForm.controls['namespace'].invalid && (namespaceForm.controls['namespace'].dirty)"
-               autofocus>
-      </cds-text-label>
-      <ng-template #namespaceError>
-        <span *ngIf="namespaceForm.showError('namespace', formDir, 'required')"
-              class="invalid-feedback"
-              i18n>This field is required.</span>
-        <span *ngIf="namespaceForm.showError('namespace', formDir, 'namespaceExists')"
-              class="invalid-feedback"
-              i18n>The namespace already exists.</span>
-      </ng-template>
-    </div>
-
-
+      <!-- Name -->
+      <div class="form-item">
+        <cds-text-label
+          label="Name"
+          for="namespace"
+          [invalid]="
+            namespaceForm.controls['namespace'].invalid && namespaceForm.controls['namespace'].dirty
+          "
+          [invalidText]="namespaceError"
+          cdRequiredField="Namespace"
+          i18n
+          >Namespace
+          <input
+            cdsText
+            type="text"
+            placeholder="Namespace name..."
+            id="namespace"
+            name="namespace"
+            formControlName="namespace"
+            [invalid]="
+              namespaceForm.controls['namespace'].invalid &&
+              namespaceForm.controls['namespace'].dirty
+            "
+            autofocus
+          />
+        </cds-text-label>
+        <ng-template #namespaceError>
+          <span
+            *ngIf="namespaceForm.showError('namespace', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            *ngIf="namespaceForm.showError('namespace', formDir, 'namespaceExists')"
+            class="invalid-feedback"
+            i18n
+            >The namespace already exists.</span
+          >
+        </ng-template>
+      </div>
     </form>
   </section>
-  <cd-form-button-panel (submitActionEvent)="submit()"
-                        [form]="namespaceForm"
-                        [submitText]="actionLabels.CREATE"
-                        [modalForm]="true"></cd-form-button-panel>
-
+  <cd-form-button-panel
+    (submitActionEvent)="submit()"
+    [form]="namespaceForm"
+    [submitText]="actionLabels.CREATE"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-list/rbd-namespace-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-list/rbd-namespace-list.component.html
index d37ac777d18..63ae939741b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-list/rbd-namespace-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-namespace-list/rbd-namespace-list.component.html
@@ -1,18 +1,22 @@
 <cd-rbd-tabs></cd-rbd-tabs>
 
-<cd-table [data]="namespaces"
-          (fetchData)="refresh()"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="id"
-          forceIdentifier="true"
-          selectionType="single"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  [data]="namespaces"
+  (fetchData)="refresh()"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="id"
+  forceIdentifier="true"
+  selectionType="single"
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
-    <cd-table-actions class="btn-group"
-                      [permission]="permission"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      class="btn-group"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-performance/rbd-performance.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-performance/rbd-performance.component.html
index b2de493e447..28d5ab47113 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-performance/rbd-performance.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-performance/rbd-performance.component.html
@@ -1,9 +1,11 @@
 <cd-rbd-tabs></cd-rbd-tabs>
 
-<cd-grafana i18n-title
-            title="RBD overview"
-            [grafanaPath]="'ceph-block-overview?'"
-            [type]="'metrics'"
-            uid="41FrpeUiz"
-            grafanaStyle="two">
+<cd-grafana
+  i18n-title
+  title="RBD overview"
+  [grafanaPath]="'ceph-block-overview?'"
+  [type]="'metrics'"
+  uid="41FrpeUiz"
+  grafanaStyle="two"
+>
 </cd-grafana>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.html
index 2819a9bac15..dfc229f32a7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.html
@@ -1,64 +1,107 @@
-<cds-modal size="md"
-           [open]="open"
-           (overalSelected)="closeModal()">
-
+<cds-modal
+  size="md"
+  [open]="open"
+  (overalSelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="snapshotForm"
-          #formDir="ngForm"
-          [formGroup]="snapshotForm"
-          novalidate>
+    <form
+      name="snapshotForm"
+      #formDir="ngForm"
+      [formGroup]="snapshotForm"
+      novalidate
+    >
       <!-- Name -->
       <div class="form-item">
-        <cds-text-label label="Name"
-                        i18n-label
-                        for="snapshotName"
-                        i18n
-                        cdRequiredField="Name"
-                        [invalid]="snapshotForm.controls['snapshotName'].invalid && (snapshotForm.controls['snapshotName'].dirty)"
-                        [invalidText]="snapshotError">
-          <input cdsText
-                 type="text"
-                 placeholder="Snapshot name..."
-                 id="snapshotName"
-                 name="snapshotName"
-                 formControlName="snapshotName"
-                 [attr.disabled]="((mirroring === 'snapshot') ? true : null) && (snapshotForm.getValue('mirrorImageSnapshot') === true) ? true: null"
-                 [invalid]="snapshotForm.controls['snapshotName'].invalid && (snapshotForm.controls['snapshotName'].dirty)"
-                 autofocus>
-          <span *ngIf="((mirroring === 'snapshot') ? true : null) && (snapshotForm.getValue('mirrorImageSnapshot') === true) ? true: null">
-            Snapshot mode is enabled on image <b>{{ imageName }}</b>: snapshot names are auto generated</span>
+        <cds-text-label
+          label="Name"
+          i18n-label
+          for="snapshotName"
+          i18n
+          cdRequiredField="Name"
+          [invalid]="
+            snapshotForm.controls['snapshotName'].invalid &&
+            snapshotForm.controls['snapshotName'].dirty
+          "
+          [invalidText]="snapshotError"
+        >
+          <input
+            cdsText
+            type="text"
+            placeholder="Snapshot name..."
+            id="snapshotName"
+            name="snapshotName"
+            formControlName="snapshotName"
+            [attr.disabled]="
+              (mirroring === 'snapshot' ? true : null) &&
+              snapshotForm.getValue('mirrorImageSnapshot') === true
+                ? true
+                : null
+            "
+            [invalid]="
+              snapshotForm.controls['snapshotName'].invalid &&
+              snapshotForm.controls['snapshotName'].dirty
+            "
+            autofocus
+          />
+          <span
+            *ngIf="
+              (mirroring === 'snapshot' ? true : null) &&
+              snapshotForm.getValue('mirrorImageSnapshot') === true
+                ? true
+                : null
+            "
+          >
+            Snapshot mode is enabled on image <b>{{ imageName }}</b
+            >: snapshot names are auto generated</span
+          >
         </cds-text-label>
         <ng-template #snapshotError>
-          <span *ngIf="snapshotForm.showError('snapshotName', formDir, 'required')"
-                class="invalid-feedback"
-                i18n>This field is required.</span>
-          <span *ngIf="snapshotForm.showError('snapshotName', formDir, 'pattern')"
-                class="invalid-feedback"
-                i18n>The snapshot name cannot start with "." and cannot contain "/" and "&#64;".</span>
+          <span
+            *ngIf="snapshotForm.showError('snapshotName', formDir, 'required')"
+            class="invalid-feedback"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            *ngIf="snapshotForm.showError('snapshotName', formDir, 'pattern')"
+            class="invalid-feedback"
+            i18n
+            >The snapshot name cannot start with "." and cannot contain "/" and "&#64;".</span
+          >
         </ng-template>
       </div>
 
       <ng-container *ngIf="mirroring === 'snapshot'">
-        <div class="form-item"
-             *ngIf="peerConfigured$ | async as peerConfigured">
-          <cds-checkbox id="mirrorImageSnapshot"
-                        formControlName="mirrorImageSnapshot"
-                        name="mirrorImageSnapshot"
-                        (checkedChange)="onMirrorCheckBoxChange()"
-                        [attr.disabled]="!peerConfigured.length > 0 ? true : null"
-                        i18n>Mirror Image Snapshot
+        <div
+          class="form-item"
+          *ngIf="peerConfigured$ | async as peerConfigured"
+        >
+          <cds-checkbox
+            id="mirrorImageSnapshot"
+            formControlName="mirrorImageSnapshot"
+            name="mirrorImageSnapshot"
+            (checkedChange)="onMirrorCheckBoxChange()"
+            [attr.disabled]="!peerConfigured.length > 0 ? true : null"
+            i18n
+            >Mirror Image Snapshot
           </cds-checkbox>
         </div>
       </ng-container>
     </form>
   </section>
-  <cd-form-button-panel (submitActionEvent)="submit()"
-                        [form]="snapshotForm"
-                        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="submit()"
+    [form]="snapshotForm"
+    [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-list/rbd-snapshot-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-list/rbd-snapshot-list.component.html
index 90fbf53841a..d7ad696f722 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-list/rbd-snapshot-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-list/rbd-snapshot-list.component.html
@@ -1,17 +1,24 @@
-<cd-table [data]="data"
-          columnMode="flex"
-          selectionType="single"
-          (updateSelection)="updateSelection($event)"
-          [columns]="columns">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="data"
+  columnMode="flex"
+  selectionType="single"
+  (updateSelection)="updateSelection($event)"
+  [columns]="columns"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
 
-<ng-template #rollbackTpl
-             let-value>
+<ng-template
+  #rollbackTpl
+  let-value
+>
   <ng-container i18n>You are about to rollback</ng-container>
-  <strong> {{ value.snapName }}</strong>.
+  <strong> {{ value.snapName }}</strong
+  >.
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-tabs/rbd-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-tabs/rbd-tabs.component.html
index e11beb9bd5e..ca02a9aef79 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-tabs/rbd-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-tabs/rbd-tabs.component.html
@@ -1,35 +1,49 @@
 <ul class="nav nav-tabs">
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/block/rbd"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Images</a>
+    <a
+      class="nav-link"
+      routerLink="/block/rbd"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Images</a
+    >
   </li>
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/block/rbd/namespaces"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Namespaces</a>
+    <a
+      class="nav-link"
+      routerLink="/block/rbd/namespaces"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Namespaces</a
+    >
   </li>
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/block/rbd/trash"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Trash</a>
+    <a
+      class="nav-link"
+      routerLink="/block/rbd/trash"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Trash</a
+    >
   </li>
-  <li class="nav-item"
-      *ngIf="grafanaPermission.read">
-    <a class="nav-link"
-       routerLink="/block/rbd/performance"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Overall Performance</a>
+  <li
+    class="nav-item"
+    *ngIf="grafanaPermission.read"
+  >
+    <a
+      class="nav-link"
+      routerLink="/block/rbd/performance"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Overall Performance</a
+    >
   </li>
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-list/rbd-trash-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-list/rbd-trash-list.component.html
index 7928d287b3e..fdc8921e741 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-list/rbd-trash-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-list/rbd-trash-list.component.html
@@ -1,51 +1,71 @@
 <cd-rbd-tabs></cd-rbd-tabs>
 
-<cd-table [data]="images"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="id"
-          forceIdentifier="true"
-          selectionType="single"
-          [status]="tableStatus"
-          [autoReload]="-1"
-          (fetchData)="taskListService.fetch()"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  [data]="images"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="id"
+  forceIdentifier="true"
+  selectionType="single"
+  [status]="tableStatus"
+  [autoReload]="-1"
+  (fetchData)="taskListService.fetch()"
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
-    <cd-table-actions class="btn-group"
-                      [permission]="permission"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      class="btn-group"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
-    <button cdsButton="tertiary"
-            type="button"
-            (click)="purgeModal()"
-            [disabled]="disablePurgeBtn"
-            *ngIf="permission.delete">
+    <button
+      cdsButton="tertiary"
+      type="button"
+      (click)="purgeModal()"
+      [disabled]="disablePurgeBtn"
+      *ngIf="permission.delete"
+    >
       <ng-container i18n>Purge Trash</ng-container>
-      <svg class="cds--btn__icon"
-           cdsIcon="close"
-           size="16"></svg>
+      <svg
+        class="cds--btn__icon"
+        cdsIcon="close"
+        size="16"
+      ></svg>
     </button>
   </div>
 </cd-table>
 
-<ng-template #expiresTpl
-             let-row="data.row"
-             let-value="data.value">
-  <ng-container *ngIf="row.cdIsExpired"
-                i18n>Expired at</ng-container>
+<ng-template
+  #expiresTpl
+  let-row="data.row"
+  let-value="data.value"
+>
+  <ng-container
+    *ngIf="row.cdIsExpired"
+    i18n
+    >Expired at</ng-container
+  >
 
-  <ng-container *ngIf="!row.cdIsExpired"
-                i18n>Protected until</ng-container>
+  <ng-container
+    *ngIf="!row.cdIsExpired"
+    i18n
+    >Protected until</ng-container
+  >
 
   {{ value | cdDate }}
 </ng-template>
 
-<ng-template #deleteTpl
-             let-expiresAt="expiresAt"
-             let-isExpired="isExpired">
-  <p class="text-danger"
-     *ngIf="!isExpired">
+<ng-template
+  #deleteTpl
+  let-expiresAt="expiresAt"
+  let-isExpired="isExpired"
+>
+  <p
+    class="text-danger"
+    *ngIf="!isExpired"
+  >
     <strong>
       <ng-container i18n>This image is protected until {{ expiresAt | cdDate }}.</ng-container>
     </strong>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-move-modal/rbd-trash-move-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-move-modal/rbd-trash-move-modal.component.html
index df119860ac0..0b37da79d41 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-move-modal/rbd-trash-move-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-move-modal/rbd-trash-move-modal.component.html
@@ -1,52 +1,81 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Move an image to trash</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Move an image to trash
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="moveForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="moveForm"
-          novalidate>
-      <cd-alert-panel type="warning"
-                      *ngIf="hasSnapshots"
-                      spacingClass="mb-2">
-        <span i18n>This image contains snapshot(s), which will prevent it
-          from being removed after moved to trash.</span>
+    <form
+      name="moveForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="moveForm"
+      novalidate
+    >
+      <cd-alert-panel
+        type="warning"
+        *ngIf="hasSnapshots"
+        spacingClass="mb-2"
+      >
+        <span i18n
+          >This image contains snapshot(s), which will prevent it from being removed after moved to
+          trash.</span
+        >
       </cd-alert-panel>
 
-      <p i18n>To move <kbd>{{ imageSpecStr }}</kbd> to trash,
-        click <kbd>Move</kbd>. Optionally, you can pick an expiration date.</p>
+      <p i18n>
+        To move <kbd>{{ imageSpecStr }}</kbd> to trash, click <kbd>Move</kbd>. Optionally, you can
+        pick an expiration date.
+      </p>
       <div class="form-item">
-        <cds-checkbox formControlName="setExpiry"
-                      id="setExpiry"
-                      name="setExpiry"
-                      (checkedChange)="toggleExpiration()"
-                      modal-primary-focus
-                      i18n>Set expiration date</cds-checkbox>
+        <cds-checkbox
+          formControlName="setExpiry"
+          id="setExpiry"
+          name="setExpiry"
+          (checkedChange)="toggleExpiration()"
+          modal-primary-focus
+          i18n
+          >Set expiration date</cds-checkbox
+        >
       </div>
-      <div class="form-item"
-           *ngIf="setExpirationDate">
-        <cd-date-time-picker [control]="moveForm.get('expiresAt')"
-                             name="Protection expires at"
-                             i18n-name></cd-date-time-picker>
+      <div
+        class="form-item"
+        *ngIf="setExpirationDate"
+      >
+        <cd-date-time-picker
+          [control]="moveForm.get('expiresAt')"
+          name="Protection expires at"
+          i18n-name
+        ></cd-date-time-picker>
 
-        <span class="invalid-feedback"
-              *ngIf="moveForm.showError('expiresAt', formDir, 'format')"
-              i18n>Wrong date format. Please use "YYYY-MM-DD HH:mm:ss".</span>
-        <span class="invalid-feedback"
-              *ngIf="moveForm.showError('expiresAt', formDir, 'expired')"
-              i18n>Protection has already expired. Please pick a future date or leave it empty.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="moveForm.showError('expiresAt', formDir, 'format')"
+          i18n
+          >Wrong date format. Please use "YYYY-MM-DD HH:mm:ss".</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="moveForm.showError('expiresAt', formDir, 'expired')"
+          i18n
+          >Protection has already expired. Please pick a future date or leave it empty.</span
+        >
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="moveImage()"
-                        [form]="moveForm"
-                        [submitText]="actionLabels.MOVE"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="moveImage()"
+    [form]="moveForm"
+    [submitText]="actionLabels.MOVE"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-purge-modal/rbd-trash-purge-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-purge-modal/rbd-trash-purge-modal.component.html
index 1d68a930930..03843f21f4c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-purge-modal/rbd-trash-purge-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-purge-modal/rbd-trash-purge-modal.component.html
@@ -1,41 +1,60 @@
-<cds-modal size="md"
-           [open]="true"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="true"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Purge Trash</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Purge Trash
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="purgeForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="purgeForm"
-          novalidate>
-      <p i18n>To purge, select&nbsp;
-        <kbd>All</kbd>&nbsp;
-        or one pool and click&nbsp;
-        <kbd>Purge</kbd>.&nbsp;</p>
+    <form
+      name="purgeForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="purgeForm"
+      novalidate
+    >
+      <p i18n>
+        To purge, select&nbsp; <kbd>All</kbd>&nbsp; or one pool and click&nbsp;
+        <kbd>Purge</kbd>.&nbsp;
+      </p>
 
       <div class="form-item">
-        <cds-select label="Pool"
-                    for="poolName"
-                    id="poolName"
-                    formControlName="poolName"
-                    *ngIf="poolPermission.read">
-          <option value=""
-                  i18n>All</option>
-          <option *ngFor="let pool of pools"
-                  [value]="pool">{{ pool }}</option>
+        <cds-select
+          label="Pool"
+          for="poolName"
+          id="poolName"
+          formControlName="poolName"
+          *ngIf="poolPermission.read"
+        >
+          <option
+            value=""
+            i18n
+          >
+            All
+          </option>
+          <option
+            *ngFor="let pool of pools"
+            [value]="pool"
+          >
+            {{ pool }}
+          </option>
         </cds-select>
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="purge()"
-                        [form]="purgeForm"
-                        [submitText]="actionLabels.PURGE"
-                        [modalForm]="true"></cd-form-button-panel>
-
+  <cd-form-button-panel
+    (submitActionEvent)="purge()"
+    [form]="purgeForm"
+    [submitText]="actionLabels.PURGE"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-restore-modal/rbd-trash-restore-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-restore-modal/rbd-trash-restore-modal.component.html
index 1cc353a7b65..8d97560826f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-restore-modal/rbd-trash-restore-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-trash-restore-modal/rbd-trash-restore-modal.component.html
@@ -1,43 +1,55 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
-
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Restore Image</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Restore Image
+    </h3>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="restoreForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="restoreForm"
-          novalidate>
-      <p i18n>To restore&nbsp;
-        <kbd>{{ imageSpec }}&#64;{{ imageId }}</kbd>,&nbsp;
-        type the image's new name and click&nbsp;
-        <kbd>Restore</kbd>.</p>
+    <form
+      name="restoreForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="restoreForm"
+      novalidate
+    >
+      <p i18n>
+        To restore&nbsp; <kbd>{{ imageSpec }}&#64;{{ imageId }}</kbd
+        >,&nbsp; type the image's new name and click&nbsp; <kbd>Restore</kbd>.
+      </p>
 
       <div class="form-item">
-        <cds-text-label for="name"
-                        i18n
-                        [invalid]="restoreForm.showError('name', formDir, 'required')"
-                        invalidText="The field is required"
-                        cdRequiredField="Name">Name
-          <input cdsText
-                 name="name"
-                 id="name"
-                 formControlName="name"
-                 autocomplete="off"
-                 autofocus>
+        <cds-text-label
+          for="name"
+          i18n
+          [invalid]="restoreForm.showError('name', formDir, 'required')"
+          invalidText="The field is required"
+          cdRequiredField="Name"
+          >Name
+          <input
+            cdsText
+            name="name"
+            id="name"
+            formControlName="name"
+            autocomplete="off"
+            autofocus
+          />
         </cds-text-label>
       </div>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="restore()"
-                        [form]="restoreForm"
-                        [submitText]="actionLabels.RESTORE"
-                        [modalForm]="true"></cd-form-button-panel>
-
+  <cd-form-button-panel
+    (submitActionEvent)="restore()"
+    [form]="restoreForm"
+    [submitText]="actionLabels.RESTORE"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html
index 6e1955c8508..c233a6f54d3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-auth-modal/cephfs-auth-modal.component.html
@@ -1,128 +1,169 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
   <ng-container *cdFormLoading="loading">
     <section class="cds--modal-content">
-      <form name="form"
-            #formDir="ngForm"
-            [formGroup]="form">
+      <form
+        name="form"
+        #formDir="ngForm"
+        [formGroup]="form"
+      >
+        <!-- FsName -->
+        <div class="form-item">
+          <cds-text-label
+            for="fsName"
+            i18n
+            cdRequiredField="FS name"
+            [invalid]="!form.controls['fsName'].valid && form.controls['fsName'].dirty"
+            [invalidText]="fsNameError"
+            i18n-invalidText
+            >FS name
+            <input
+              cdsText
+              placeholder="Name..."
+              i18n-placeholder
+              id="fsName"
+              name="fsName"
+              formControlName="fsName"
+              size="sm"
+              [invalid]="!form.controls['fsName'].valid && form.controls['fsName'].dirty"
+              autofocus
+            />
+          </cds-text-label>
+          <ng-template #fsNameError>
+            <span
+              class="invalid-feedback"
+              *ngIf="form.showError('fsName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+          </ng-template>
+        </div>
 
-      <!-- FsName -->
-      <div class="form-item">
-        <cds-text-label for="fsName"
-                        i18n
-                        cdRequiredField="FS name"
-                        [invalid]="!form.controls['fsName'].valid && (form.controls['fsName'].dirty)"
-                        [invalidText]="fsNameError"
-                        i18n-invalidText>FS name
-          <input cdsText
-                 placeholder="Name..."
-                 i18n-placeholder
-                 id="fsName"
-                 name="fsName"
-                 formControlName="fsName"
-                 size="sm"
-                 [invalid]="!form.controls['fsName'].valid && (form.controls['fsName'].dirty)"
-                 autofocus>
-        </cds-text-label>
-        <ng-template #fsNameError>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('fsName', formDir, 'required')"
-                i18n>This field is required.</span>
-        </ng-template>
-      </div>
+        <!-- UserId -->
+        <div class="form-item">
+          <cds-text-label
+            for="userId"
+            i18n
+            cdRequiredField="User ID"
+            [helperText]="userIdHelperText"
+            [invalid]="!form.controls['userId'].valid && form.controls['userId'].dirty"
+            [invalidText]="userIdError"
+            i18n-invalidText
+            >User ID
+            <input
+              cdsText
+              value="client."
+              readonly
+            />
 
-      <!-- UserId -->
-      <div class="form-item">
-        <cds-text-label for="userId"
-                        i18n
-                        cdRequiredField="User ID"
-                        [helperText]="userIdHelperText"
-                        [invalid]="!form.controls['userId'].valid && (form.controls['userId'].dirty)"
-                        [invalidText]="userIdError"
-                        i18n-invalidText>User ID
-          <input cdsText
-                 value="client."
-                 readonly>
+            <input
+              cdsText
+              placeholder="Name..."
+              i18n-placeholder
+              id="userId"
+              name="userId"
+              formControlName="userId"
+              [invalid]="!form.controls['userId'].valid && form.controls['userId'].dirty"
+            />
+          </cds-text-label>
+          <ng-template #userIdHelperText>
+            You can manage users from
+            <a
+              routerLink="/ceph-users"
+              (click)="closeModal()"
+              >Ceph Users</a
+            >
+            page
+          </ng-template>
+          <ng-template #userIdError>
+            <span
+              class="invalid-feedback"
+              *ngIf="form.showError('userId', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+          </ng-template>
+        </div>
 
-          <input cdsText
-                 placeholder="Name..."
-                 i18n-placeholder
-                 id="userId"
-                 name="userId"
-                 formControlName="userId"
-                 [invalid]="!form.controls['userId'].valid && (form.controls['userId'].dirty)">
-        </cds-text-label>
-        <ng-template #userIdHelperText>
-          You can manage users from
-          <a routerLink="/ceph-users"
-             (click)="closeModal()">Ceph Users</a>
-          page
-        </ng-template>
-        <ng-template #userIdError>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('userId', formDir, 'required')"
-                i18n>This field is required.</span>
-        </ng-template>
-      </div>
+        <!-- Directory -->
+        <div class="form-item">
+          <cds-text-label
+            for="directory"
+            i18n
+            cdRequiredField="Directory"
+            [invalid]="!form.controls['directory'].valid && form.controls['directory'].dirty"
+            [invalidText]="directoryError"
+            helperText="Path to restrict access to"
+            [skeleton]="directoryStore.isLoading"
+            i18n-invalidText
+            i18n-helperText
+            >Directory
+            <input
+              cdsText
+              type="text"
+              [placeholder]="directoryStore.isLoading ? '' : 'Directory path'"
+              i18n-placeholder
+              id="directory"
+              name="directory"
+              formControlName="directory"
+              [skeleton]="directoryStore.isLoading"
+              [invalid]="!form.controls['directory'].valid && form.controls['directory'].dirty"
+              [ngbTypeahead]="search"
+            />
+          </cds-text-label>
+          <ng-template #directoryError>
+            <span
+              class="invalid-feedback"
+              *ngIf="form.showError('directory', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+          </ng-template>
+        </div>
 
-      <!-- Directory -->
-      <div class="form-item">
-        <cds-text-label for="directory"
-                        i18n
-                        cdRequiredField="Directory"
-                        [invalid]="!form.controls['directory'].valid && (form.controls['directory'].dirty)"
-                        [invalidText]="directoryError"
-                        helperText="Path to restrict access to"
-                        [skeleton]="directoryStore.isLoading"
-                        i18n-invalidText
-                        i18n-helperText>Directory
-          <input cdsText
-                 type="text"
-                 [placeholder]="directoryStore.isLoading ? '' : 'Directory path'"
-                 i18n-placeholder
-                 id="directory"
-                 name="directory"
-                 formControlName="directory"
-                 [skeleton]="directoryStore.isLoading"
-                 [invalid]="!form.controls['directory'].valid && (form.controls['directory'].dirty)"
-                 [ngbTypeahead]="search">
-        </cds-text-label>
-        <ng-template #directoryError>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('directory', formDir, 'required')"
-                i18n>This field is required.</span>
-        </ng-template>
-      </div>
-
-      <!-- Permissions -->
-      <div class="form-item">
-        <fieldset>
-          <legend class="cds--label"
-                 i18n>Permissions</legend>
+        <!-- Permissions -->
+        <div class="form-item">
+          <fieldset>
+            <legend
+              class="cds--label"
+              i18n
+            >
+              Permissions
+            </legend>
             <ng-container *ngFor="let permission of clientPermissions">
-              <cds-checkbox i18n-label
-                            [id]="permission.name"
-                            [name]="permission.name"
-                            [formControlName]="permission.name"
-                            (checkedChange)="toggleFormControl($event, permission.name)">
-              {{ permission.name | titlecase }}
-              <cd-help-text *ngIf="permission.description">
-                {{ permission.description }}
-              </cd-help-text>
-            </cds-checkbox>
-          </ng-container>
-        </fieldset>
+              <cds-checkbox
+                i18n-label
+                [id]="permission.name"
+                [name]="permission.name"
+                [formControlName]="permission.name"
+                (checkedChange)="toggleFormControl($event, permission.name)"
+              >
+                {{ permission.name | titlecase }}
+                <cd-help-text *ngIf="permission.description">
+                  {{ permission.description }}
+                </cd-help-text>
+              </cds-checkbox>
+            </ng-container>
+          </fieldset>
         </div>
       </form>
     </section>
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          [form]="form"
-                          [submitText]="(action | titlecase)"
-                          [modalForm]="true"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="form"
+      [submitText]="action | titlecase"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-chart/cephfs-chart.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-chart/cephfs-chart.component.html
index e7a106d5507..864daac85ac 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-chart/cephfs-chart.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-chart/cephfs-chart.component.html
@@ -1,12 +1,16 @@
 <div class="chart-container">
-  <canvas baseChart
-          #chartCanvas
-          [datasets]="chart.datasets"
-          [options]="chart.options"
-          [type]="chart.chartType">
+  <canvas
+    baseChart
+    #chartCanvas
+    [datasets]="chart.datasets"
+    [options]="chart.options"
+    [type]="chart.chartType"
+  >
   </canvas>
-  <div class="chartjs-tooltip"
-       #chartTooltip>
+  <div
+    class="chartjs-tooltip"
+    #chartTooltip
+  >
     <table></table>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-clients/cephfs-clients.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-clients/cephfs-clients.component.html
index cb1ee364c26..efab438c5e2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-clients/cephfs-clients.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-clients/cephfs-clients.component.html
@@ -1,13 +1,17 @@
-<cd-table [data]="clients.data"
-          [columns]="columns"
-          [status]="clients.status"
-          [autoReload]="-1"
-          (fetchData)="triggerApiUpdate.emit()"
-          selectionType="single"
-          (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="clients.data"
+  [columns]="columns"
+  [status]="clients.status"
+  [autoReload]="-1"
+  (fetchData)="triggerApiUpdate.emit()"
+  selectionType="single"
+  (updateSelection)="updateSelection($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.html
index cbc11db138f..1d452b4d8b3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.html
@@ -1,43 +1,54 @@
 <div class="row">
   <div class="col-sm-8">
     <legend i18n>Ranks</legend>
-    <cd-table [data]="data.ranks"
-              [columns]="columns.ranks"
-              [toolHeader]="false">
+    <cd-table
+      [data]="data.ranks"
+      [columns]="columns.ranks"
+      [toolHeader]="false"
+    >
     </cd-table>
 
     <legend i18n>Pools</legend>
-    <cd-table [data]="data.pools"
-              [columns]="columns.pools"
-              [toolHeader]="false">
+    <cd-table
+      [data]="data.pools"
+      [columns]="columns.pools"
+      [toolHeader]="false"
+    >
     </cd-table>
   </div>
 
   <div class="col-sm-4">
     <legend i18n>Standbys</legend>
-    <cd-table-key-value [data]="standbys">
-    </cd-table-key-value>
+    <cd-table-key-value [data]="standbys"> </cd-table-key-value>
   </div>
 </div>
 
 <legend i18n>MDS performance counters</legend>
-<div class="row"
-     *ngFor="let mdsCounter of objectValues(data.mdsCounters); trackBy: trackByFn">
+<div
+  class="row"
+  *ngFor="let mdsCounter of objectValues(data.mdsCounters); trackBy: trackByFn"
+>
   <div class="col-md-12">
     <cd-cephfs-chart [mdsCounter]="mdsCounter"></cd-cephfs-chart>
   </div>
 </div>
 
 <!-- templates -->
-<ng-template #poolUsageTpl
-             let-row="data.row">
-  <cd-usage-bar [total]="row.size"
-                [used]="row.used"
-                [title]="row.pool_name"></cd-usage-bar>
+<ng-template
+  #poolUsageTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    [total]="row.size"
+    [used]="row.used"
+    [title]="row.pool_name"
+  ></cd-usage-bar>
 </ng-template>
 
-<ng-template #activityTmpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #activityTmpl
+  let-row="data.row"
+  let-value="data.value"
+>
   {{ row.state === 'standby-replay' ? 'Evts' : 'Reqs' }}: {{ value | dimless }} /s
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html
index 9acab5fde4f..9a0751f4bb9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.html
@@ -2,29 +2,39 @@
   <div class="col-sm-4 pe-0">
     <div class="card">
       <div class="card-header">
-        <button type="button"
-                [class.disabled]="loadingIndicator"
-                class="btn btn-light pull-right"
-                (click)="refreshAllDirectories()">
-          <svg [cdsIcon]="icons.refresh"
-               [size]="icons.size16"></svg>
+        <button
+          type="button"
+          [class.disabled]="loadingIndicator"
+          class="btn btn-light pull-right"
+          (click)="refreshAllDirectories()"
+        >
+          <svg
+            [cdsIcon]="icons.refresh"
+            [size]="icons.size16"
+          ></svg>
         </button>
       </div>
       <div class="card-body card-tree">
-        <cds-tree-view [tree]="nodes"
-                       (select)="selectNode($event)">
+        <cds-tree-view
+          [tree]="nodes"
+          (select)="selectNode($event)"
+        >
         </cds-tree-view>
         <div *ngIf="loadingIndicator">
-          <cds-loading [isActive]="true"
-                       [overlay]="false"
-                       size="sm"></cds-loading>
+          <cds-loading
+            [isActive]="true"
+            [overlay]="false"
+            size="sm"
+          ></cds-loading>
         </div>
       </div>
     </div>
   </div>
   <!-- Selection details -->
-  <div class="col-sm-8 metadata"
-       *ngIf="selectedDir">
+  <div
+    class="col-sm-8 metadata"
+    *ngIf="selectedDir"
+  >
     <div class="card">
       <div class="card-header">
         {{ selectedDir.path }}
@@ -32,35 +42,43 @@
       <div class="card-body">
         <ng-container *ngIf="selectedDir.path !== '/'">
           <legend i18n>Quotas</legend>
-          <cd-table [data]="settings"
-                    [columns]="quota.columns"
-                    [limit]="0"
-                    [footer]="false"
-                    selectionType="single"
-                    (updateSelection)="quota.updateSelection($event)"
-                    [onlyActionHeader]="true"
-                    identifier="quotaKey"
-                    [forceIdentifier]="true"
-                    [toolHeader]="false">
-            <cd-table-actions class="only-table-actions"
-                              [permission]="permission"
-                              [selection]="quota.selection"
-                              [tableActions]="quota.tableActions">
+          <cd-table
+            [data]="settings"
+            [columns]="quota.columns"
+            [limit]="0"
+            [footer]="false"
+            selectionType="single"
+            (updateSelection)="quota.updateSelection($event)"
+            [onlyActionHeader]="true"
+            identifier="quotaKey"
+            [forceIdentifier]="true"
+            [toolHeader]="false"
+          >
+            <cd-table-actions
+              class="only-table-actions"
+              [permission]="permission"
+              [selection]="quota.selection"
+              [tableActions]="quota.tableActions"
+            >
             </cd-table-actions>
           </cd-table>
         </ng-container>
 
         <legend i18n>Snapshots</legend>
-        <cd-table [data]="selectedDir.snapshots"
-                  [columns]="snapshot.columns"
-                  identifier="name"
-                  forceIdentifier="true"
-                  selectionType="single"
-                  (updateSelection)="snapshot.updateSelection($event)">
-          <cd-table-actions class="table-actions"
-                            [permission]="permission"
-                            [selection]="snapshot.selection"
-                            [tableActions]="snapshot.tableActions">
+        <cd-table
+          [data]="selectedDir.snapshots"
+          [columns]="snapshot.columns"
+          identifier="name"
+          forceIdentifier="true"
+          selectionType="single"
+          (updateSelection)="snapshot.updateSelection($event)"
+        >
+          <cd-table-actions
+            class="table-actions"
+            [permission]="permission"
+            [selection]="snapshot.selection"
+            [tableActions]="snapshot.tableActions"
+          >
           </cd-table-actions>
         </cd-table>
       </div>
@@ -68,11 +86,16 @@
   </div>
 </div>
 
-<ng-template #origin
-             let-row="data.row"
-             let-value="data.value">
-  <span class="quota-origin"
-        tabindex="0"
-        (keydown.enter)="selectOrigin(value)"
-        (click)="selectOrigin(value)">{{value}}</span>
+<ng-template
+  #origin
+  let-row="data.row"
+  let-value="data.value"
+>
+  <span
+    class="quota-origin"
+    tabindex="0"
+    (keydown.enter)="selectOrigin(value)"
+    (click)="selectOrigin(value)"
+    >{{ value }}</span
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.html
index 0a2a647b9a2..1ea5fa269d7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.html
@@ -1,13 +1,23 @@
 <div cds-mb="lg">
-  <div class="cds--type-heading-03"
-       i18n>Select filesystem</div>
+  <div
+    class="cds--type-heading-03"
+    i18n
+  >
+    Select filesystem
+  </div>
 </div>
 <div class="cds-mt-5">
   <cd-alert-panel type="info">
-    <div [cdsStack]="'vertical'"
-         [gap]="2">
-      <div class="cds--type-heading-compact-01"
-           i18n>Selection requirements</div>
+    <div
+      [cdsStack]="'vertical'"
+      [gap]="2"
+    >
+      <div
+        class="cds--type-heading-compact-01"
+        i18n
+      >
+        Selection requirements
+      </div>
       <ul class="cds--type-body-compact-01 requirements-list">
         <li i18n>Only one filesystem can be selected as the mirroring target</li>
         <li i18n>The selected filesystem must have an active MDS (Metadata Server)</li>
@@ -18,55 +28,67 @@
 </div>
 
 <div class="cds-mt-5">
-  <cd-table [data]="(filesystems$ | async) ?? []"
-            [columns]="columns"
-            columnMode="flex"
-            selectionType="singleRadio"
-            headerTitle="Select target filesystem"
-            headerDescription="Choose the filesystem that will receive mirrored data from the local cluster."
-            (updateSelection)="updateSelection($event)">
-    <ng-template #mdsStatus
-                 let-value="data.value"
-                 let-row="data.row">
-      <div [cdsStack]="'horizontal'"
-           gap="2">
+  <cd-table
+    [data]="(filesystems$ | async) ?? []"
+    [columns]="columns"
+    columnMode="flex"
+    selectionType="singleRadio"
+    headerTitle="Select target filesystem"
+    headerDescription="Choose the filesystem that will receive mirrored data from the local cluster."
+    (updateSelection)="updateSelection($event)"
+  >
+    <ng-template
+      #mdsStatus
+      let-value="data.value"
+      let-row="data.row"
+    >
+      <div
+        [cdsStack]="'horizontal'"
+        gap="2"
+      >
         @if (value === 'Active') {
-        <cd-icon type="success"></cd-icon>
+          <cd-icon type="success"></cd-icon>
         }
         @if (value === 'Warning') {
-        <cd-icon type="warning"></cd-icon>
+          <cd-icon type="warning"></cd-icon>
         }
         @if (value === 'Inactive') {
-        <cd-icon type="error"></cd-icon>
+          <cd-icon type="error"></cd-icon>
         }
         <span class="cds--type-body-compact-01 cds-pt-2px">{{ mdsStatusLabels[value] }}</span>
       </div>
     </ng-template>
 
-    <ng-template #mirroringStatus
-                 let-value="data.value"
-                 let-row="data.row">
-      <div [cdsStack]="'horizontal'"
-           gap="2">
+    <ng-template
+      #mirroringStatus
+      let-value="data.value"
+      let-row="data.row"
+    >
+      <div
+        [cdsStack]="'horizontal'"
+        gap="2"
+      >
         @if (value === 'Enabled') {
-        <cd-icon type="success"></cd-icon>
+          <cd-icon type="success"></cd-icon>
         }
         @if (value === 'Disabled') {
-        <cd-icon type="warning"></cd-icon>
+          <cd-icon type="warning"></cd-icon>
         }
         <span class="cds--type-body-compact-01 cds-pt-2px">{{ mirroringStatusLabels[value] }}</span>
       </div>
     </ng-template>
 
-    <ng-template let-row="row"
-                 let-col="col">
+    <ng-template
+      let-row="row"
+      let-col="col"
+    >
       <ng-container [ngSwitch]="col.prop">
         <ng-container *ngSwitchCase="'pools'">
           @for (pool of row.pools; track $index; let last = $last) {
-          <cd-badge>{{ pool }}</cd-badge>
-          @if (!last) {
-          <span>, </span>
-          }
+            <cd-badge>{{ pool }}</cd-badge>
+            @if (!last) {
+              <span>, </span>
+            }
           }
         </ng-container>
         <ng-container *ngSwitchDefault>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-form/cephfs-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-form/cephfs-form.component.html
index cb8f101a847..7a71bc5c08c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-form/cephfs-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-form/cephfs-form.component.html
@@ -1,231 +1,339 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}"
-     *ngIf="orchStatus$ | async as orchStatus">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+  *ngIf="orchStatus$ | async as orchStatus"
+>
   <ng-container *cdFormLoading="loading">
-    <form #frm="ngForm"
-          #formDir="ngForm"
-          [formGroup]="form"
-          novalidate>
-      <div i18n="form title|Example: Create Volume@@formTitle"
-           class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}</div>
+    <form
+      #frm="ngForm"
+      #formDir="ngForm"
+      [formGroup]="form"
+      novalidate
+    >
+      <div
+        i18n="form title|Example: Create Volume@@formTitle"
+        class="form-header"
+      >
+        {{ action | titlecase }} {{ resource | upperFirst }}
+      </div>
 
       <div class="form-item">
         <ng-container *ngIf="!orchStatus.available">
-          <cd-alert-panel type="info"
-                          spacingClass="mb-2"
-                          i18n
-                          *ngIf="!editing">Orchestrator is not configured. Deploy MDS daemons manually after creating the volume.</cd-alert-panel>
+          <cd-alert-panel
+            type="info"
+            spacingClass="mb-2"
+            i18n
+            *ngIf="!editing"
+            >Orchestrator is not configured. Deploy MDS daemons manually after creating the
+            volume.</cd-alert-panel
+          >
         </ng-container>
 
-        <cd-alert-panel type="info"
-                        spacingClass="mb-2"
-                        i18n
-                        *ngIf="editing && disableRename">
-          <p>The File System can only be renamed if it is shutdown and `refuse_client_session` is set to true.
-            Follow the steps below in the command line and refresh the page:</p>
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-2"
+          i18n
+          *ngIf="editing && disableRename"
+        >
+          <p>
+            The File System can only be renamed if it is shutdown and `refuse_client_session` is set
+            to true. Follow the steps below in the command line and refresh the page:
+          </p>
           <cd-code-block [codes]="[fsFailCmd]"></cd-code-block>
           <cd-code-block [codes]="[fsSetCmd]"></cd-code-block>
         </cd-alert-panel>
       </div>
-        <!-- Name -->
-        <div class="form-item">
-          <cds-text-label for="name"
-                          cdRequiredField="Name"
-                          [invalid]="!form.controls.name.valid && form.controls.name.dirty"
-                          [invalidText]="nameError"
-                          i18n>Name
-            <input cdsText
-                   placeholder="Name..."
-                   i18n-placeholder
-                   id="name"
-                   name="name"
-                   formControlName="name"
-                   [invalid]="!form.controls.name.valid && form.controls.name.dirty"
-                   autofocus>
-          </cds-text-label>
-          <ng-template #nameError>
-            <span class="invalid-feedback"
-                  *ngIf="form.showError('name', formDir, 'required')"
-                  i18n>This field is required!</span>
-            <span *ngIf="form.showError('name', formDir, 'pattern')"
-                  class="invalid-feedback"
-                  i18n>File System name should start with a letter or dot (.) and can only contain letters, numbers, '.', '-' or '_'</span>
-          </ng-template>
-        </div>
+      <!-- Name -->
+      <div class="form-item">
+        <cds-text-label
+          for="name"
+          cdRequiredField="Name"
+          [invalid]="!form.controls.name.valid && form.controls.name.dirty"
+          [invalidText]="nameError"
+          i18n
+          >Name
+          <input
+            cdsText
+            placeholder="Name..."
+            i18n-placeholder
+            id="name"
+            name="name"
+            formControlName="name"
+            [invalid]="!form.controls.name.valid && form.controls.name.dirty"
+            autofocus
+          />
+        </cds-text-label>
+        <ng-template #nameError>
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('name', formDir, 'required')"
+            i18n
+            >This field is required!</span
+          >
+          <span
+            *ngIf="form.showError('name', formDir, 'pattern')"
+            class="invalid-feedback"
+            i18n
+            >File System name should start with a letter or dot (.) and can only contain letters,
+            numbers, '.', '-' or '_'</span
+          >
+        </ng-template>
+      </div>
 
-        <div class="form-item"
-             *ngIf="!editing">
-          <cds-checkbox id="customPools"
-                        name="customPools"
-                        formControlName="customPools"
-                        i18n>Use existing pools
-            <cd-help-text>Allows you to use replicated pools with 'cephfs' application tag that are already created.</cd-help-text>
-          </cds-checkbox>
+      <div
+        class="form-item"
+        *ngIf="!editing"
+      >
+        <cds-checkbox
+          id="customPools"
+          name="customPools"
+          formControlName="customPools"
+          i18n
+          >Use existing pools
+          <cd-help-text
+            >Allows you to use replicated pools with 'cephfs' application tag that are already
+            created.</cd-help-text
+          >
+        </cds-checkbox>
 
-          <cd-alert-panel *ngIf="pools.length < 2"
-                          type="info"
-                          spacingClass="mt-1"
-                          i18n>
-            You need to have atleast 2 pools that are empty, applied with cephfs label and not erasure-coded.
-          </cd-alert-panel>
-        </div>
+        <cd-alert-panel
+          *ngIf="pools.length < 2"
+          type="info"
+          spacingClass="mt-1"
+          i18n
+        >
+          You need to have atleast 2 pools that are empty, applied with cephfs label and not
+          erasure-coded.
+        </cd-alert-panel>
+      </div>
 
-        <!-- Data pool -->
-        <div class="form-item"
-             *ngIf="form.get('customPools')?.value || editing">
-          <cds-text-label for="dataPool"
-                          i18n
-                          *ngIf="editing">Data pool
-            <input cdsText
-                   type="text"
-                   placeholder="Pool name..."
-                   id="dataPool"
-                   name="dataPool"
-                   formControlName="dataPool">
-          </cds-text-label>
-          <cds-select label="Data pool"
-                      for="dataPool"
-                      name="dataPool"
-                      id="dataPool"
-                      formControlName="dataPool"
-                      (valueChange)="onPoolChange($event)"
-                      cdRequiredField="Data pool"
-                      [invalid]="!form.controls.dataPool.valid && form.controls.dataPool.dirty"
-                      [invalidText]="dataPoolError"
-                      *ngIf="!editing">
-            <option *ngIf="dataPools === null"
-                    [ngValue]="null"
-                    i18n>Loading...</option>
-            <option *ngIf="dataPools !== null && dataPools?.length === 0"
-                    [ngValue]="null"
-                    i18n>-- No cephfs pools available --</option>
-            <option *ngIf="dataPools !== null && dataPools?.length > 0"
-                    [ngValue]="null"
-                    i18n>-- Select a pool --</option>
-            <option *ngFor="let pool of dataPools"
-                    [value]="pool?.pool_name">{{ pool?.pool_name }}</option>
+      <!-- Data pool -->
+      <div
+        class="form-item"
+        *ngIf="form.get('customPools')?.value || editing"
+      >
+        <cds-text-label
+          for="dataPool"
+          i18n
+          *ngIf="editing"
+          >Data pool
+          <input
+            cdsText
+            type="text"
+            placeholder="Pool name..."
+            id="dataPool"
+            name="dataPool"
+            formControlName="dataPool"
+          />
+        </cds-text-label>
+        <cds-select
+          label="Data pool"
+          for="dataPool"
+          name="dataPool"
+          id="dataPool"
+          formControlName="dataPool"
+          (valueChange)="onPoolChange($event)"
+          cdRequiredField="Data pool"
+          [invalid]="!form.controls.dataPool.valid && form.controls.dataPool.dirty"
+          [invalidText]="dataPoolError"
+          *ngIf="!editing"
+        >
+          <option
+            *ngIf="dataPools === null"
+            [ngValue]="null"
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="dataPools !== null && dataPools?.length === 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- No cephfs pools available --
+          </option>
+          <option
+            *ngIf="dataPools !== null && dataPools?.length > 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- Select a pool --
+          </option>
+          <option
+            *ngFor="let pool of dataPools"
+            [value]="pool?.pool_name"
+          >
+            {{ pool?.pool_name }}
+          </option>
+        </cds-select>
+        <ng-template #dataPoolError>
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('dataPool', formDir, 'required')"
+            i18n
+            >This field is required!</span
+          >
+        </ng-template>
+      </div>
+
+      <!-- Metadata pool -->
+      <div
+        class="form-item"
+        *ngIf="form.get('customPools')?.value || editing"
+      >
+        <cds-text-label
+          for="metadataPool"
+          i18n
+          *ngIf="editing"
+          >Metadata pool
+          <input
+            cdsText
+            type="text"
+            placeholder="Pool name..."
+            id="metadataPool"
+            name="metadataPool"
+            formControlName="metadataPool"
+          />
+        </cds-text-label>
+        <cds-select
+          label="Metadata pool"
+          for="metadataPool"
+          name="metadataPool"
+          id="metadataPool"
+          formControlName="metadataPool"
+          cdRequiredField="Metadata pool"
+          [invalid]="!form.controls.metadataPool.valid && form.controls.metadataPool.dirty"
+          [invalidText]="metadataPoolError"
+          (valueChange)="onPoolChange($event, true)"
+          *ngIf="!editing"
+        >
+          <option
+            *ngIf="metadatPools === null"
+            [ngValue]="null"
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="metadatPools !== null && metadatPools?.length === 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- No cephfs pools available --
+          </option>
+          <option
+            *ngIf="metadatPools !== null && metadatPools?.length > 0"
+            [ngValue]="null"
+            i18n
+          >
+            -- Select a pool --
+          </option>
+          <option
+            *ngFor="let pool of metadatPools"
+            [value]="pool?.pool_name"
+          >
+            {{ pool?.pool_name }}
+          </option>
+        </cds-select>
+        <ng-template #metadataPoolError>
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('metadataPool', formDir, 'required')"
+            i18n
+            >This field is required!</span
+          >
+        </ng-template>
+      </div>
+
+      <ng-container *ngIf="orchStatus.available">
+        <!-- Placement -->
+        <div
+          class="form-item"
+          *ngIf="!editing"
+        >
+          <cds-select
+            label="Placement"
+            for="placement"
+            formControlName="placement"
+            name="placement"
+            id="placement"
+            i18n
+          >
+            <option value="hosts">Hosts</option>
+            <option value="label">Labels</option>
           </cds-select>
-          <ng-template #dataPoolError>
-            <span class="invalid-feedback"
-                  *ngIf="form.showError('dataPool', formDir, 'required')"
-                  i18n>This field is required!</span>
-          </ng-template>
         </div>
 
-        <!-- Metadata pool -->
-        <div class="form-item"
-             *ngIf="form.get('customPools')?.value || editing">
-          <cds-text-label for="metadataPool"
-                          i18n
-                          *ngIf="editing">Metadata pool
-            <input cdsText
-                   type="text"
-                   placeholder="Pool name..."
-                   id="metadataPool"
-                   name="metadataPool"
-                   formControlName="metadataPool">
-          </cds-text-label>
-          <cds-select label="Metadata pool"
-                      for="metadataPool"
-                      name="metadataPool"
-                      id="metadataPool"
-                      formControlName="metadataPool"
-                      cdRequiredField="Metadata pool"
-                      [invalid]="!form.controls.metadataPool.valid && form.controls.metadataPool.dirty"
-                      [invalidText]="metadataPoolError"
-                      (valueChange)="onPoolChange($event, true)"
-                      *ngIf="!editing">
-            <option *ngIf="metadatPools === null"
-                    [ngValue]="null"
-                    i18n>Loading...</option>
-            <option *ngIf="metadatPools !== null && metadatPools?.length === 0"
-                    [ngValue]="null"
-                    i18n>-- No cephfs pools available --</option>
-            <option *ngIf="metadatPools !== null && metadatPools?.length > 0"
-                    [ngValue]="null"
-                    i18n>-- Select a pool --</option>
-            <option *ngFor="let pool of metadatPools"
-                    [value]="pool?.pool_name">{{ pool?.pool_name }}</option>
-          </cds-select>
-          <ng-template #metadataPoolError>
-            <span class="invalid-feedback"
-                  *ngIf="form.showError('metadataPool', formDir, 'required')"
-                  i18n>This field is required!</span>
-          </ng-template>
-        </div>
-
-        <ng-container *ngIf="orchStatus.available">
-          <!-- Placement -->
-          <div class="form-item"
-               *ngIf="!editing">
-            <cds-select label="Placement"
-                        for="placement"
-                        formControlName="placement"
-                        name="placement"
-                        id="placement"
-                        i18n>
-              <option value="hosts">Hosts</option>
-              <option value="label">Labels</option>
-            </cds-select>
-          </div>
-
-          <ng-container *ngIf="hostsAndLabels$ | async as data">
+        <ng-container *ngIf="hostsAndLabels$ | async as data">
           <!-- Label -->
-          <div *ngIf="form.controls.placement.value === 'label' && !editing"
-               class="form-item">
-            <cds-combo-box type="multi"
-                           selectionFeedback="top-after-reopen"
-                           label="Label"
-                           for="label"
-                           name="label"
-                           formControlName="label"
-                           id="label"
-                           placeholder="Select labels..."
-                           [appendInline]="true"
-                           [items]="data.labels"
-                           i18n-placeholder
-                           (selected)="multiSelector($event, 'label')"
-                           [invalid]="form.controls.label.invalid && (form.controls.label.dirty)"
-                           [invalidText]="labelError"
-                           cdRequiredField="Label"
-                           cdDynamicInputCombobox
-                           (updatedItems)="data.labels = $event"
-                           i18n>
+          <div
+            *ngIf="form.controls.placement.value === 'label' && !editing"
+            class="form-item"
+          >
+            <cds-combo-box
+              type="multi"
+              selectionFeedback="top-after-reopen"
+              label="Label"
+              for="label"
+              name="label"
+              formControlName="label"
+              id="label"
+              placeholder="Select labels..."
+              [appendInline]="true"
+              [items]="data.labels"
+              i18n-placeholder
+              (selected)="multiSelector($event, 'label')"
+              [invalid]="form.controls.label.invalid && form.controls.label.dirty"
+              [invalidText]="labelError"
+              cdRequiredField="Label"
+              cdDynamicInputCombobox
+              (updatedItems)="data.labels = $event"
+              i18n
+            >
               <cds-dropdown-list></cds-dropdown-list>
             </cds-combo-box>
             <ng-template #labelError>
-              <span class="invalid-feedback"
-                    *ngIf="form.showError('label', frm, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="form.showError('label', frm, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </ng-template>
           </div>
 
           <!-- Hosts -->
-          <div *ngIf="form.controls.placement.value === 'hosts' && !editing"
-               class="form-item">
-            <cds-combo-box type="multi"
-                           selectionFeedback="top-after-reopen"
-                           label="Hosts"
-                           for="hosts"
-                           name="hosts"
-                           formControlName="hosts"
-                           id="hosts"
-                           placeholder="Select hosts..."
-                           i18n-placeholder
-                           [appendInline]="true"
-                           [items]="data.hosts"
-                           (selected)="multiSelector($event, 'hosts')"
-                           i18n>
+          <div
+            *ngIf="form.controls.placement.value === 'hosts' && !editing"
+            class="form-item"
+          >
+            <cds-combo-box
+              type="multi"
+              selectionFeedback="top-after-reopen"
+              label="Hosts"
+              for="hosts"
+              name="hosts"
+              formControlName="hosts"
+              id="hosts"
+              placeholder="Select hosts..."
+              i18n-placeholder
+              [appendInline]="true"
+              [items]="data.hosts"
+              (selected)="multiSelector($event, 'hosts')"
+              i18n
+            >
               <cds-dropdown-list></cds-dropdown-list>
             </cds-combo-box>
           </div>
         </ng-container>
       </ng-container>
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="formDir"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                            [disabled]="editing ? disableRename: false"
-                            wrappingClass="text-right"></cd-form-button-panel>
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="formDir"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        [disabled]="editing ? disableRename : false"
+        wrappingClass="text-right"
+      ></cd-form-button-panel>
     </form>
   </ng-container>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-list/cephfs-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-list/cephfs-list.component.html
index 55688f9240b..87b60339ed8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-list/cephfs-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-list/cephfs-list.component.html
@@ -3,16 +3,18 @@
   [followFocus]="true"
   [isNavigation]="false"
   [cacheActive]="true"
-  >
+>
   <cds-tab
     heading="File systems"
     i18n-heading
-    [tabContent]="fileSystemListContent">
+    [tabContent]="fileSystemListContent"
+  >
   </cds-tab>
   <cds-tab
     heading="Overview"
     i18n-heading
-    [tabContent]="grafanaContent">
+    [tabContent]="grafanaContent"
+  >
   </cds-tab>
 </cds-tabs>
 
@@ -31,7 +33,8 @@
   >
     <cd-cephfs-tabs
       *cdTableDetail
-      [selection]="expandedRow">
+      [selection]="expandedRow"
+    >
     </cd-cephfs-tabs>
     <div class="table-actions">
       <cd-table-actions
@@ -47,9 +50,12 @@
 </ng-template>
 
 <ng-template #deleteTpl>
-  <cd-alert-panel type="danger"
-                  i18n>
-    This will remove its data and metadata pools. It'll also remove the MDS daemon associated with the volume.
+  <cd-alert-panel
+    type="danger"
+    i18n
+  >
+    This will remove its data and metadata pools. It'll also remove the MDS daemon associated with
+    the volume.
   </cd-alert-panel>
 </ng-template>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-entity/cephfs-mirroring-entity.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-entity/cephfs-mirroring-entity.component.html
index 6dd4aafb144..af49d77dcf3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-entity/cephfs-mirroring-entity.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-entity/cephfs-mirroring-entity.component.html
@@ -1,13 +1,18 @@
 <div class="scroll-overflow">
   <div
     [cdsStack]="'vertical'"
-    gap="3">
+    gap="3"
+  >
     <div
       class="cds--type-heading-03"
-      i18n>Create or select entity</div>
+      i18n
+    >
+      Create or select entity
+    </div>
     <p
       class="cds--type-body-01"
-      i18n>
+      i18n
+    >
       Choose an existing CephFS mirroring entity or create a new one to be used for mirroring.
     </p>
   </div>
@@ -17,177 +22,221 @@
         <cds-radio
           [value]="true"
           (click)="onCreateEntitySelected()"
-          i18n> Create new entity </cds-radio>
+          i18n
+        >
+          Create new entity
+        </cds-radio>
         <cds-radio
           [value]="false"
           (click)="onExistingEntitySelected()"
-          i18n> Use existing entity </cds-radio>
+          i18n
+        >
+          Use existing entity
+        </cds-radio>
       </cds-radio-group>
     </div>
 
     @if (isCreatingNewEntity) {
-    @if (showCreateRequirementsWarning) {
-    <cd-alert-panel
-      type="warning"
-      class="cds-ml-3 cds-mr-3"
-      dismissible="true"
-      (dismissed)="onDismissCreateRequirementsWarning()">
-      <div
-        [cdsStack]="'vertical'"
-        gap="2">
-        <div
-          class="cds--type-heading-compact-01"
-          i18n>Mirroring entity requirements</div>
-        <div
-          class="cds--type-body-compact-01"
-          i18n>
-          This entity will be used by the mirroring service to manage snapshots and replication.
-          It will require the proper permissions to replicate data.
-        </div>
-      </div>
-    </cd-alert-panel>
-    }
-
-    @if (showCreateCapabilitiesInfo) {
-    <cd-alert-panel
-      type="info"
-      dismissible="true"
-      (dismissed)="onDismissCreateCapabilitiesInfo()">
-      <div
-        [cdsStack]="'vertical'"
-        gap="1">
-        <div
-          class="cds--type-heading-compact-01"
-          i18n>Capabilities added automatically.</div>
-        <div
-          class="cds--type-body-compact-01 requirements-list"
-          i18n>
-          If you create a new entity, the following capabilities will be assigned automatically:
-        </div>
-        <ul class="list-disc">
-          @for (cap of capabilities; track cap.name) {
-          <li>
-            {{ cap.name }}: {{ cap.permission }}
-          </li>
-          }
-        </ul>
-      </div>
-    </cd-alert-panel>
-    }
-
-    <form
-      name="entityForm"
-      #formDir="ngForm"
-      [formGroup]="entityForm"
-      novalidate>
-      <div
-        [cdsStack]="'vertical'"
-        gap="5"
-        class="form-item form-item-append cds-mt-5">
-        <cds-text-label
-          labelInputID="user_entity"
-          i18n
-          cdRequiredField="Ceph entity"
-          [helperText]="userEntityHelperText"
-          [invalid]="!entityForm.controls['user_entity'].valid && (entityForm.controls['user_entity'].dirty)"
-          [invalidText]="userEntityError"
-          i18n-invalidText>
-          Ceph entity
+      @if (showCreateRequirementsWarning) {
+        <cd-alert-panel
+          type="warning"
+          class="cds-ml-3 cds-mr-3"
+          dismissible="true"
+          (dismissed)="onDismissCreateRequirementsWarning()"
+        >
           <div
-            [cdsStack]="'horizontal'"
-            gap="0">
-            <input
-              cdsText
-              value="client."
-              readonly
-              name="client_prefix" />
-            <input
-              cdsText
-              name="user_entity"
-              formControlName="user_entity"
-              [invalid]="!entityForm.controls['user_entity'].valid && (entityForm.controls['user_entity'].dirty)" />
+            [cdsStack]="'vertical'"
+            gap="2"
+          >
+            <div
+              class="cds--type-heading-compact-01"
+              i18n
+            >
+              Mirroring entity requirements
+            </div>
+            <div
+              class="cds--type-body-compact-01"
+              i18n
+            >
+              This entity will be used by the mirroring service to manage snapshots and replication.
+              It will require the proper permissions to replicate data.
+            </div>
           </div>
-        </cds-text-label>
+        </cd-alert-panel>
+      }
 
-        <ng-template #userEntityError>
-          @if (entityForm.showError('user_entity', formDir, 'required')) {
-          <span
-            class="invalid-feedback"
-            i18n>This field is required.</span>
-          }
-          @if (entityForm.showError('user_entity', formDir, 'forbiddenClientPrefix')) {
-          <span
-            class="invalid-feedback"
-            i18n>Do not include 'client.' prefix. Enter only the entity suffix.</span>
-          }
-        </ng-template>
-      </div>
-      <div>
-        <cd-form-button-panel
-          (submitActionEvent)="submitAction()"
-          [form]="entityForm"
-          submitText="Create entity"
-          i18n-submitText
-          [showCancel]="false">
-        </cd-form-button-panel>
-      </div>
-    </form>
+      @if (showCreateCapabilitiesInfo) {
+        <cd-alert-panel
+          type="info"
+          dismissible="true"
+          (dismissed)="onDismissCreateCapabilitiesInfo()"
+        >
+          <div
+            [cdsStack]="'vertical'"
+            gap="1"
+          >
+            <div
+              class="cds--type-heading-compact-01"
+              i18n
+            >
+              Capabilities added automatically.
+            </div>
+            <div
+              class="cds--type-body-compact-01 requirements-list"
+              i18n
+            >
+              If you create a new entity, the following capabilities will be assigned automatically:
+            </div>
+            <ul class="list-disc">
+              @for (cap of capabilities; track cap.name) {
+                <li>{{ cap.name }}: {{ cap.permission }}</li>
+              }
+            </ul>
+          </div>
+        </cd-alert-panel>
+      }
+
+      <form
+        name="entityForm"
+        #formDir="ngForm"
+        [formGroup]="entityForm"
+        novalidate
+      >
+        <div
+          [cdsStack]="'vertical'"
+          gap="5"
+          class="form-item form-item-append cds-mt-5"
+        >
+          <cds-text-label
+            labelInputID="user_entity"
+            i18n
+            cdRequiredField="Ceph entity"
+            [helperText]="userEntityHelperText"
+            [invalid]="
+              !entityForm.controls['user_entity'].valid && entityForm.controls['user_entity'].dirty
+            "
+            [invalidText]="userEntityError"
+            i18n-invalidText
+          >
+            Ceph entity
+            <div
+              [cdsStack]="'horizontal'"
+              gap="0"
+            >
+              <input
+                cdsText
+                value="client."
+                readonly
+                name="client_prefix"
+              />
+              <input
+                cdsText
+                name="user_entity"
+                formControlName="user_entity"
+                [invalid]="
+                  !entityForm.controls['user_entity'].valid &&
+                  entityForm.controls['user_entity'].dirty
+                "
+              />
+            </div>
+          </cds-text-label>
+
+          <ng-template #userEntityError>
+            @if (entityForm.showError('user_entity', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (entityForm.showError('user_entity', formDir, 'forbiddenClientPrefix')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Do not include 'client.' prefix. Enter only the entity suffix.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <div>
+          <cd-form-button-panel
+            (submitActionEvent)="submitAction()"
+            [form]="entityForm"
+            submitText="Create entity"
+            i18n-submitText
+            [showCancel]="false"
+          >
+          </cd-form-button-panel>
+        </div>
+      </form>
     }
 
     @if (!isCreatingNewEntity && showSelectRequirementsWarning) {
-    <cd-alert-panel
-      type="warning"
-      class="cds-ml-3 cds-mr-3"
-      dismissible="true"
-      (dismissed)="onDismissSelectRequirementsWarning()">
-      <div
-        [cdsStack]="'vertical'"
-        gap="2">
+      <cd-alert-panel
+        type="warning"
+        class="cds-ml-3 cds-mr-3"
+        dismissible="true"
+        (dismissed)="onDismissSelectRequirementsWarning()"
+      >
         <div
-          class="cds--type-heading-compact-01"
-          i18n>Mirroring entity requirements</div>
-        <div
-          class="cds--type-body-compact-01"
-          i18n>
-          This selected entity will be used by the mirroring service to manage snapshots and
-          replication. It must have rwps capabilities on MDS, MON, and OSD.
+          [cdsStack]="'vertical'"
+          gap="2"
+        >
+          <div
+            class="cds--type-heading-compact-01"
+            i18n
+          >
+            Mirroring entity requirements
+          </div>
+          <div
+            class="cds--type-body-compact-01"
+            i18n
+          >
+            This selected entity will be used by the mirroring service to manage snapshots and
+            replication. It must have rwps capabilities on MDS, MON, and OSD.
+          </div>
         </div>
-      </div>
-    </cd-alert-panel>
-    @if (showSelectEntityInfo) {
-    <cd-alert-panel
-      type="info"
-      class="cds-mb-3"
-      dismissible="true"
-      (dismissed)="onDismissSelectEntityInfo()">
-      <div
-        [cdsStack]="'vertical'"
-        gap="2">
-        <div
-          class="cds--type-heading-01"
-          i18n>Entity selection note</div>
-        <div
-          class="cds--type-body-compact-01"
-          i18n>
-          Only entities with valid rwps capabilities can be used for mirroring.
-        </div>
-      </div>
-    </cd-alert-panel>
-    }
+      </cd-alert-panel>
+      @if (showSelectEntityInfo) {
+        <cd-alert-panel
+          type="info"
+          class="cds-mb-3"
+          dismissible="true"
+          (dismissed)="onDismissSelectEntityInfo()"
+        >
+          <div
+            [cdsStack]="'vertical'"
+            gap="2"
+          >
+            <div
+              class="cds--type-heading-01"
+              i18n
+            >
+              Entity selection note
+            </div>
+            <div
+              class="cds--type-body-compact-01"
+              i18n
+            >
+              Only entities with valid rwps capabilities can be used for mirroring.
+            </div>
+          </div>
+        </cd-alert-panel>
+      }
     }
 
-    @let entities = (entities$ | async);
+    @let entities = entities$ | async;
     @if (!isCreatingNewEntity && entities) {
-    <cd-table
-      #table
-      [data]="entities"
-      [columns]="columns"
-      columnMode="flex"
-      selectionType="singleRadio"
-      (updateSelection)="updateSelection($event)"
-      (fetchData)="loadEntities($event)">
-    </cd-table>
+      <cd-table
+        #table
+        [data]="entities"
+        [columns]="columns"
+        columnMode="flex"
+        selectionType="singleRadio"
+        (updateSelection)="updateSelection($event)"
+        (fetchData)="loadEntities($event)"
+      >
+      </cd-table>
     }
   </cds-tile>
 </div>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html
index d209a6cc9c0..f257649b647 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-error/cephfs-mirroring-error.component.html
@@ -1,29 +1,48 @@
 <cds-inline-notification
   [notificationObj]="{
-                      type: 'warning',
-                      title: 'CephFS Mirroring module is not enabled',
-                      message: 'To create mirror links and configure replication, the CephFS Mirroring module must be enabled on this cluster.',
-                      lowContrast: true,
-                      showClose: false
-                    }"
+    type: 'warning',
+    title: 'CephFS Mirroring module is not enabled',
+    message:
+      'To create mirror links and configure replication, the CephFS Mirroring module must be enabled on this cluster.',
+    lowContrast: true,
+    showClose: false
+  }"
   class="mt-2 mb-2 full-width padding-inline-0"
-  i18n></cds-inline-notification>
+  i18n
+></cds-inline-notification>
 <cds-tile>
-  <p class="cds--type-heading-compact-01"
-     i18n>Enable CephFS Mirroring</p>
-  <p class="cds--type-body-compact-01"
-     i18n>Turn on CephFS Mirroring to start creating mirror links and synchronizing data across clusters. After enabling, you can add mirror links.</p>
-  <button cdsButton="primary"
-          (click)="enableModule()"
-          type="button"
-          i18n>Enable CephFS Mirroring</button>
+  <p
+    class="cds--type-heading-compact-01"
+    i18n
+  >
+    Enable CephFS Mirroring
+  </p>
+  <p
+    class="cds--type-body-compact-01"
+    i18n
+  >
+    Turn on CephFS Mirroring to start creating mirror links and synchronizing data across clusters.
+    After enabling, you can add mirror links.
+  </p>
+  <button
+    cdsButton="primary"
+    (click)="enableModule()"
+    type="button"
+    i18n
+  >
+    Enable CephFS Mirroring
+  </button>
 </cds-tile>
-<div cdsGrid
-     class="mt-5">
+<div
+  cdsGrid
+  class="mt-5"
+>
   <div cdsRow>
     <div cdsCol>
-      <img src="assets/empty-state.png"
-           alt="no-mirror-links" />
+      <img
+        src="assets/empty-state.png"
+        alt="no-mirror-links"
+      />
     </div>
   </div>
   <div cdsRow>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-list/cephfs-mirroring-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-list/cephfs-mirroring-list.component.html
index 2ba0db47e33..59f5d81a90d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-list/cephfs-mirroring-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-list/cephfs-mirroring-list.component.html
@@ -6,11 +6,14 @@
     columnMode="flex"
     selectionType="single"
     (updateSelection)="updateSelection($event)"
-    (fetchData)="loadDaemonStatus()">
-    <cd-table-actions class="table-actions"
-                      [permission]="permission"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+    (fetchData)="loadDaemonStatus()"
+  >
+    <cd-table-actions
+      class="table-actions"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </cd-table>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.html
index 5c0f99ec8a1..41342383e47 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.html
@@ -3,12 +3,17 @@
   [title]="title"
   [description]="description"
   (submitRequested)="onSubmit()"
-  (closeRequested)="onCancel()">
+  (closeRequested)="onCancel()"
+>
   <cd-tearsheet-step>
     <form [formGroup]="form">
       <div>
-        <div class="cds--type-heading-03"
-             i18n>Choose mirror peer role</div>
+        <div
+          class="cds--type-heading-03"
+          i18n
+        >
+          Choose mirror peer role
+        </div>
         <p i18n>Select how the cluster will participate in the CephFS mirroring relationship.</p>
       </div>
 
@@ -19,18 +24,25 @@
               <cds-radio
                 [value]="LOCAL_ROLE"
                 [checked]="form.get('localRole')?.value === LOCAL_ROLE"
-                (click)="onLocalRoleChange()">
+                (click)="onLocalRoleChange()"
+              >
                 <div>
-                  <div class="cds--type-heading-compact-02"
-                       i18n>Configure local peer</div>
-                  <div class="cds--type-label-01 cds-mt-3"
-                       i18n>
+                  <div
+                    class="cds--type-heading-compact-02"
+                    i18n
+                  >
+                    Configure local peer
+                  </div>
+                  <div
+                    class="cds--type-label-01 cds-mt-3"
+                    i18n
+                  >
                     This cluster will act as the initiating peer and send snapshots to a remote
                     peer.
                   </div>
                   <ul class="cds--type-body-compact-01 cds-mt-6">
                     @for (item of sourceList; track $index) {
-                    <li class="cds-mb-6 cds-mt-3">&rarr; {{ item }}</li>
+                      <li class="cds-mb-6 cds-mt-3">&rarr; {{ item }}</li>
                     }
                   </ul>
                 </div>
@@ -43,17 +55,24 @@
             <cds-radio
               [value]="REMOTE_ROLE"
               [checked]="form.get('remoteRole')?.value === REMOTE_ROLE"
-              (click)="onRemoteRoleChange()">
+              (click)="onRemoteRoleChange()"
+            >
               <div>
-                <div class="cds--type-heading-compact-02"
-                     i18n>Configure remote peer</div>
-                <div class="cds--type-label-01 cds-mt-3"
-                     i18n>
+                <div
+                  class="cds--type-heading-compact-02"
+                  i18n
+                >
+                  Configure remote peer
+                </div>
+                <div
+                  class="cds--type-label-01 cds-mt-3"
+                  i18n
+                >
                   A remote cluster will act as the receiving peer and store replicated snapshots.
                 </div>
                 <ul class="cds--type-body-compact-01 cds-mt-6">
                   @for (item of targetList; track $index) {
-                  <li class="cds-mb-6 cds-mt-3">&rarr; {{ item }}</li>
+                    <li class="cds-mb-6 cds-mt-3">&rarr; {{ item }}</li>
                   }
                 </ul>
               </div>
@@ -63,33 +82,41 @@
       </div>
 
       @if (form.get('localRole')?.value !== LOCAL_ROLE && showMessage) {
-      <cd-alert-panel
-        type="info"
-        spacingClass="mb-3 mt-3"
-        dismissible="true"
-        (dismissed)="showMessage = false">
-        <div>
-          <div
-            class="cds--type-heading-compact-01 cds-mb-2"
-            i18n>About remote peer setup</div>
-          <div
-            class="cds--type-body-compact-01 cds-mb-3"
-            i18n>
-            As a remote peer, this cluster prepares to receive mirrored data from an initiating
-            cluster. The setup includes environment validation, enabling filesystem mirroring,
-            creating required Ceph users, and generating a bootstrap token.
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-3 mt-3"
+          dismissible="true"
+          (dismissed)="showMessage = false"
+        >
+          <div>
+            <div
+              class="cds--type-heading-compact-01 cds-mb-2"
+              i18n
+            >
+              About remote peer setup
+            </div>
+            <div
+              class="cds--type-body-compact-01 cds-mb-3"
+              i18n
+            >
+              As a remote peer, this cluster prepares to receive mirrored data from an initiating
+              cluster. The setup includes environment validation, enabling filesystem mirroring,
+              creating required Ceph users, and generating a bootstrap token.
+            </div>
+            <div
+              class="cds--type-heading-compact-01 cds-mb-1 cds-mt-6"
+              i18n
+            >
+              What happens next:
+            </div>
+            <ul class="list-disc cds-ml-5 cds--type-body-compact-01">
+              <li i18n>Environment validation</li>
+              <li i18n>Ceph user creation</li>
+              <li i18n>Filesystem mirroring activation</li>
+              <li i18n>Bootstrap token generation</li>
+            </ul>
           </div>
-          <div
-            class="cds--type-heading-compact-01 cds-mb-1 cds-mt-6"
-            i18n>What happens next:</div>
-          <ul class="list-disc cds-ml-5 cds--type-body-compact-01">
-            <li i18n>Environment validation</li>
-            <li i18n>Ceph user creation</li>
-            <li i18n>Filesystem mirroring activation</li>
-            <li i18n>Bootstrap token generation</li>
-          </ul>
-        </div>
-      </cd-alert-panel>
+        </cd-alert-panel>
       }
     </form>
   </cd-tearsheet-step>
@@ -102,15 +129,15 @@
 
   <!-- Step 2 -->
   <cd-tearsheet-step>
-    <cd-cephfs-mirroring-entity [selectedFilesystem]="selectedFilesystem"
-                                (entitySelected)="onEntitySelected($event)">
+    <cd-cephfs-mirroring-entity
+      [selectedFilesystem]="selectedFilesystem"
+      (entitySelected)="onEntitySelected($event)"
+    >
     </cd-cephfs-mirroring-entity>
   </cd-tearsheet-step>
 
   <!-- Step 3 -->
   <cd-tearsheet-step>
-    <div>
-      Test 3
-    </div>
+    <div>Test 3</div>
   </cd-tearsheet-step>
 </cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mount-details/cephfs-mount-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mount-details/cephfs-mount-details.component.html
index de9ed376fc4..9caa80e4ad9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mount-details/cephfs-mount-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mount-details/cephfs-mount-details.component.html
@@ -1,37 +1,55 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
       Attach commands
     </h3>
   </cds-modal-header>
 
   <div class="cds--modal-content">
-    <h5 class="fw-bold"
-        i18n>
+    <h5
+      class="fw-bold"
+      i18n
+    >
       Using Mount command
     </h5>
-    <cd-code-block textWrap="true"
-                   [codes]="[mount]"></cd-code-block>
+    <cd-code-block
+      textWrap="true"
+      [codes]="[mount]"
+    ></cd-code-block>
 
-    <h5 class="fw-bold"
-        i18n>
+    <h5
+      class="fw-bold"
+      i18n
+    >
       Using FUSE command
     </h5>
-    <cd-code-block textWrap="true"
-                   [codes]="[fuse]"></cd-code-block>
+    <cd-code-block
+      textWrap="true"
+      [codes]="[fuse]"
+    ></cd-code-block>
 
-    <h5 class="fw-bold"
-        i18n>
-        Using NFS Command
+    <h5
+      class="fw-bold"
+      i18n
+    >
+      Using NFS Command
     </h5>
-    <cd-code-block textWrap="true"
-                   [codes]="[nfs]"></cd-code-block>
+    <cd-code-block
+      textWrap="true"
+      [codes]="[nfs]"
+    ></cd-code-block>
   </div>
-  <cd-form-button-panel [modalForm]="true"
-                        [showSubmit]="false"
-                        (backAction)="cancel()"
-                        i18n></cd-form-button-panel>
+  <cd-form-button-panel
+    [modalForm]="true"
+    [showSubmit]="false"
+    (backAction)="cancel()"
+    i18n
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.html
index f1a2dcb6b4b..e0fb14948de 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.html
@@ -1,46 +1,68 @@
-<cds-modal size="lg"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>
-    {{ action | titlecase }} {{ resource | upperFirst }}
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
     </h3>
   </cds-modal-header>
 
   <ng-container *cdFormLoading="loading">
     <div cdsModalContent>
-      <form name="snapScheduleForm"
-            #formDir="ngForm"
-            [formGroup]="snapScheduleForm"
-            novalidate>
+      <form
+        name="snapScheduleForm"
+        #formDir="ngForm"
+        [formGroup]="snapScheduleForm"
+        novalidate
+      >
         <!-- Directory -->
         <div class="form-item">
-          <cds-text-label for="directory"
-                          i18n
-                          cdRequiredField="Directory"
-                          [invalid]="snapScheduleForm.controls.directory.invalid && (snapScheduleForm.controls.directory.dirty)"
-                          [invalidText]="directoryError"
-                          [skeleton]="directoryStore.isLoading"
-                          modal-primary-focus>
+          <cds-text-label
+            for="directory"
+            i18n
+            cdRequiredField="Directory"
+            [invalid]="
+              snapScheduleForm.controls.directory.invalid &&
+              snapScheduleForm.controls.directory.dirty
+            "
+            [invalidText]="directoryError"
+            [skeleton]="directoryStore.isLoading"
+            modal-primary-focus
+          >
             <ng-container *ngIf="!directoryStore.isLoading">Directory (required)</ng-container>
-            <input cdsText
-                   type="text"
-                   formControlName="directory"
-                   name="directory"
-                   [ngbTypeahead]="search"
-                   [invalid]="snapScheduleForm.controls.directory.invalid && (snapScheduleForm.controls.directory.dirty)"
-                   [placeholder]="directoryStore.isLoading ? '' : 'Directory path'"
-                   [skeleton]="directoryStore.isLoading"/>
+            <input
+              cdsText
+              type="text"
+              formControlName="directory"
+              name="directory"
+              [ngbTypeahead]="search"
+              [invalid]="
+                snapScheduleForm.controls.directory.invalid &&
+                snapScheduleForm.controls.directory.dirty
+              "
+              [placeholder]="directoryStore.isLoading ? '' : 'Directory path'"
+              [skeleton]="directoryStore.isLoading"
+            />
           </cds-text-label>
           <ng-template #directoryError>
-            <span class="invalid-feedback"
-                  *ngIf="snapScheduleForm.showError('directory', formDir, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="snapScheduleForm.showError('directory', formDir, 'notUnique')"
-                  i18n>A snapshot schedule for this path already exists.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="snapScheduleForm.showError('directory', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="snapScheduleForm.showError('directory', formDir, 'notUnique')"
+              i18n
+              >A snapshot schedule for this path already exists.</span
+            >
           </ng-template>
         </div>
 
@@ -49,117 +71,178 @@
           name="Start Date"
           helperText="The time zone is assumed to be UTC"
           [control]="snapScheduleForm.get('startDate')"
-          [disabled]="isEdit"></cd-date-time-picker>
-          <span class="invalid-feedback"
-                *ngIf="snapScheduleForm.showError('startDate', formDir, 'required')"
-                i18n>This field is required.</span>
+          [disabled]="isEdit"
+        ></cd-date-time-picker>
+        <span
+          class="invalid-feedback"
+          *ngIf="snapScheduleForm.showError('startDate', formDir, 'required')"
+          i18n
+          >This field is required.</span
+        >
 
         <!-- Repeat interval -->
-        <div class="form-item form-item-append"
-             cdsRow>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <div cdsCol>
-            <cds-number [id]="'repeatInterval'"
-                        [name]="'repeatInterval'"
-                        [formControlName]="'repeatInterval'"
-                        [label]="'Schedule'"
-                        [min]="1"
-                        [invalid]="!snapScheduleForm.controls.repeatInterval.valid && (snapScheduleForm.controls.repeatInterval.dirty)"
-                        [invalidText]="repeatIntervalError"
-                        cdRequiredField="Schedule"></cds-number>
+            <cds-number
+              [id]="'repeatInterval'"
+              [name]="'repeatInterval'"
+              [formControlName]="'repeatInterval'"
+              [label]="'Schedule'"
+              [min]="1"
+              [invalid]="
+                !snapScheduleForm.controls.repeatInterval.valid &&
+                snapScheduleForm.controls.repeatInterval.dirty
+              "
+              [invalidText]="repeatIntervalError"
+              cdRequiredField="Schedule"
+            ></cds-number>
           </div>
           <div cdsCol>
-            <cds-select id="repeatFrequency"
-                        name="repeatFrequency"
-                        formControlName="repeatFrequency"
-                        label="Frequency"
-                        [invalid]="!snapScheduleForm.controls.repeatFrequency.valid && (snapScheduleForm.controls.repeatFrequency.dirty)"
-                        [invalidText]="repeatFrequencyError"
-                        *ngIf="repeatFrequencies">
-              <option *ngFor="let freq of repeatFrequencies"
-                      [value]="freq[1]">{{ freq[0] }}
+            <cds-select
+              id="repeatFrequency"
+              name="repeatFrequency"
+              formControlName="repeatFrequency"
+              label="Frequency"
+              [invalid]="
+                !snapScheduleForm.controls.repeatFrequency.valid &&
+                snapScheduleForm.controls.repeatFrequency.dirty
+              "
+              [invalidText]="repeatFrequencyError"
+              *ngIf="repeatFrequencies"
+            >
+              <option
+                *ngFor="let freq of repeatFrequencies"
+                [value]="freq[1]"
+              >
+                {{ freq[0] }}
               </option>
             </cds-select>
             <ng-template #repeatFrequencyError>
-              <span class="invalid-feedback"
-                    *ngIf="snapScheduleForm.showError('repeatFrequency', formDir, 'notUnique')"
-                    i18n>This schedule already exists for the selected directory.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="snapScheduleForm.showError('repeatFrequency', formDir, 'notUnique')"
+                i18n
+                >This schedule already exists for the selected directory.</span
+              >
             </ng-template>
             <ng-template #repeatIntervalError>
-              <span class="invalid-feedback"
-                    *ngIf="snapScheduleForm.showError('repeatInterval', formDir, 'required')"
-                    i18n>This field is required.</span>
-              <span class="invalid-feedback"
-                    *ngIf="snapScheduleForm.showError('repeatInterval', formDir, 'min')"
-                    i18n>Choose a value greater than 0.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="snapScheduleForm.showError('repeatInterval', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
+              <span
+                class="invalid-feedback"
+                *ngIf="snapScheduleForm.showError('repeatInterval', formDir, 'min')"
+                i18n
+                >Choose a value greater than 0.</span
+              >
             </ng-template>
           </div>
         </div>
 
         <!-- Retention policies -->
-        <ng-container formArrayName="retentionPolicies"
-                      *ngFor="let retentionPolicy of retentionPolicies.controls; index as i">
+        <ng-container
+          formArrayName="retentionPolicies"
+          *ngFor="let retentionPolicy of retentionPolicies.controls; index as i"
+        >
           <ng-container [formGroupName]="i">
-            <div cdsRow
-                 class="form-item form-item-append">
-              <div cdsCol
-                   [columnNumbers]="{lg: 8}">
-                <cds-number [id]="'retentionInterval' + i"
-                            [name]="'retentionInterval' + i"
-                            [formControlName]="'retentionInterval'"
-                            [label]="'Retention policy'"
-                            [min]="1"
-                            [invalid]="snapScheduleForm.controls['retentionPolicies'].controls[i].invalid && snapScheduleForm.controls['retentionPolicies'].dirty"
-                            [invalidText]="retentionPolicyError"></cds-number>
+            <div
+              cdsRow
+              class="form-item form-item-append"
+            >
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 8 }"
+              >
+                <cds-number
+                  [id]="'retentionInterval' + i"
+                  [name]="'retentionInterval' + i"
+                  [formControlName]="'retentionInterval'"
+                  [label]="'Retention policy'"
+                  [min]="1"
+                  [invalid]="
+                    snapScheduleForm.controls['retentionPolicies'].controls[i].invalid &&
+                    snapScheduleForm.controls['retentionPolicies'].dirty
+                  "
+                  [invalidText]="retentionPolicyError"
+                ></cds-number>
               </div>
-              <div cdsCol
-                   [columnNumbers]="{lg: 7}">
-                <cds-select id="retentionFrequency"
-                            name="retentionFrequency"
-                            formControlName="retentionFrequency"
-                            label="Frequency"
-                            *ngIf="retentionFrequencies">
-                  <option *ngFor="let freq of retentionFrequencies"
-                          [value]="freq[1]">{{ freq[0] }}</option>
-
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 7 }"
+              >
+                <cds-select
+                  id="retentionFrequency"
+                  name="retentionFrequency"
+                  formControlName="retentionFrequency"
+                  label="Frequency"
+                  *ngIf="retentionFrequencies"
+                >
+                  <option
+                    *ngFor="let freq of retentionFrequencies"
+                    [value]="freq[1]"
+                  >
+                    {{ freq[0] }}
+                  </option>
                 </cds-select>
               </div>
-              <div cdsCol
-                   [columnNumbers]="{lg: 1}"
-                   class="item-action-btn">
-                <cds-icon-button kind="danger"
-                                 size="sm"
-                                 (click)="removeRetentionPolicy(i)">
-                  <svg cdsIcon="trash-can"
-                       size="32"
-                       class="cds--btn__icon"></svg>
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 1 }"
+                class="item-action-btn"
+              >
+                <cds-icon-button
+                  kind="danger"
+                  size="sm"
+                  (click)="removeRetentionPolicy(i)"
+                >
+                  <svg
+                    cdsIcon="trash-can"
+                    size="32"
+                    class="cds--btn__icon"
+                  ></svg>
                 </cds-icon-button>
               </div>
             </div>
             <ng-template #retentionPolicyError>
-              <span class="invalid-feedback"
-                    *ngIf="snapScheduleForm.controls['retentionPolicies'].controls[i].invalid"
-                    i18n>This retention policy already exists for the selected directory.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="snapScheduleForm.controls['retentionPolicies'].controls[i].invalid"
+                i18n
+                >This retention policy already exists for the selected directory.</span
+              >
             </ng-template>
           </ng-container>
         </ng-container>
 
         <div class="form-item">
-          <button cdsButton="tertiary"
-                  type="button"
-                  (click)="addRetentionPolicy()"
-                  i18n>
+          <button
+            cdsButton="tertiary"
+            type="button"
+            (click)="addRetentionPolicy()"
+            i18n
+          >
             Add retention policy
-            <svg cdsIcon="add"
-                 size="32"
-                 class="cds--btn__icon"
-                 icon></svg>
+            <svg
+              cdsIcon="add"
+              size="32"
+              class="cds--btn__icon"
+              icon
+            ></svg>
           </button>
         </div>
       </form>
     </div>
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="snapScheduleForm"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [modalForm]="true"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="submit()"
+      [form]="snapScheduleForm"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.html
index 04800e44ac2..1c4c9aab812 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.html
@@ -12,16 +12,17 @@
 
 <ng-template
   #pathTpl
-  let-row="data.row">
+  let-row="data.row"
+>
   <span
     class="fw-bold"
     [ngbTooltip]="fullpathTpl"
-    triggers="click:blur">
-    {{ row.pathForSelection?.split?.("@")?.[0] | path }}
+    triggers="click:blur"
+  >
+    {{ row.pathForSelection?.split?.('@')?.[0] | path }}
   </span>
 
-  <span
-  *ngIf="row.active; else inactiveStatusTpl">
+  <span *ngIf="row.active; else inactiveStatusTpl">
     <i
       [ngClass]="[icons.success, icons.size24]"
       ngbTooltip="{{ row.pathForSelection?.split?.('@')?.[0] }} is active"
@@ -51,7 +52,8 @@
 
 <ng-template
   #retentionTpl
-  let-row="data.row">
+  let-row="data.row"
+>
   <ul *ngIf="row.retentionCopy.length; else noDataTpl">
     <li *ngFor="let ret of row.retentionCopy">{{ ret }}</li>
   </ul>
@@ -59,14 +61,13 @@
 
 <ng-template
   #subvolTpl
-  let-row="data.row">
+  let-row="data.row"
+>
   <span *ngIf="row.subvol; else noDataTpl">
-    {{row.subvol}}
+    {{ row.subvol }}
   </span>
 </ng-template>
 
-
-
 <ng-template #noDataTpl>-</ng-template>
 
 <cd-table
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.html
index c28e1f541d7..e8bc22e51f4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.html
@@ -1,121 +1,173 @@
-<cds-modal size="lg"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
 
   <ng-container *cdFormLoading="loading">
     <div cdsModalContent>
-      <form name="subvolumeForm"
-            #formDir="ngForm"
-            [formGroup]="subvolumeForm"
-            novalidate>
+      <form
+        name="subvolumeForm"
+        #formDir="ngForm"
+        [formGroup]="subvolumeForm"
+        novalidate
+      >
         <div class="form-item">
-          <cds-text-label label="Name"
-                          for="subvolumeName"
-                          [invalid]="subvolumeForm.controls.subvolumeName.invalid && (subvolumeForm.controls.subvolumeName.dirty)"
-                          [invalidText]="subvolumeNameError"
-                          cdRequiredField="Name"
-                          i18n>Name
-            <input cdsText
-                   type="text"
-                   placeholder="Subvolume name..."
-                   id="subvolumeName"
-                   name="subvolumeName"
-                   formControlName="subvolumeName"
-                   [invalid]="subvolumeForm.controls.subvolumeName.invalid && (subvolumeForm.controls.subvolumeName.dirty)"
-                   [autofocus]="true"
-                   modal-primary-focus>
+          <cds-text-label
+            label="Name"
+            for="subvolumeName"
+            [invalid]="
+              subvolumeForm.controls.subvolumeName.invalid &&
+              subvolumeForm.controls.subvolumeName.dirty
+            "
+            [invalidText]="subvolumeNameError"
+            cdRequiredField="Name"
+            i18n
+            >Name
+            <input
+              cdsText
+              type="text"
+              placeholder="Subvolume name..."
+              id="subvolumeName"
+              name="subvolumeName"
+              formControlName="subvolumeName"
+              [invalid]="
+                subvolumeForm.controls.subvolumeName.invalid &&
+                subvolumeForm.controls.subvolumeName.dirty
+              "
+              [autofocus]="true"
+              modal-primary-focus
+            />
           </cds-text-label>
           <ng-template #subvolumeNameError>
-            <span class="invalid-feedback"
-                  *ngIf="subvolumeForm.showError('subvolumeName', formDir, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="subvolumeForm.showError('subvolumeName', formDir, 'notUnique')"
-                  i18n>The subvolume already exists.</span>
-            <span *ngIf="subvolumeForm.showError('subvolumeName', formDir, 'pattern')"
-                  class="invalid-feedback"
-                  i18n>Subvolume name can only contain letters, numbers, '.', '-' or '_'</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="subvolumeForm.showError('subvolumeName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="subvolumeForm.showError('subvolumeName', formDir, 'notUnique')"
+              i18n
+              >The subvolume already exists.</span
+            >
+            <span
+              *ngIf="subvolumeForm.showError('subvolumeName', formDir, 'pattern')"
+              class="invalid-feedback"
+              i18n
+              >Subvolume name can only contain letters, numbers, '.', '-' or '_'</span
+            >
           </ng-template>
         </div>
 
         <!-- Volume name -->
         <div class="form-item">
-          <cds-text-label label="Volume name"
-                          for="volumeName"
-                          i18n>Volume name
-            <input cdsText
-                   type="text"
-                   id="volumeName"
-                   name="volumeName"
-                   formControlName="volumeName">
-            </cds-text-label>
-          </div>
+          <cds-text-label
+            label="Volume name"
+            for="volumeName"
+            i18n
+            >Volume name
+            <input
+              cdsText
+              type="text"
+              id="volumeName"
+              name="volumeName"
+              formControlName="volumeName"
+            />
+          </cds-text-label>
+        </div>
 
-          <!--Subvolume Group name -->
-          <div class="form-item">
-            <cds-select label="Subvolume group"
-                        for="subvolumeGroupName"
-                        formControlName="subvolumeGroupName"
-                        name="subvolumeGroupName"
-                        id="subvolumeGroupName"
-                        *ngIf="subVolumeGroups$ | async as subvolumeGroups">
-              <option value=""
-                      i18n>Default</option>
-              <option *ngFor="let subvolumegroup of subvolumeGroups"
-                      [value]="subvolumegroup.name">{{ subvolumegroup.name }}</option>
-            </cds-select>
-          </div>
+        <!--Subvolume Group name -->
+        <div class="form-item">
+          <cds-select
+            label="Subvolume group"
+            for="subvolumeGroupName"
+            formControlName="subvolumeGroupName"
+            name="subvolumeGroupName"
+            id="subvolumeGroupName"
+            *ngIf="subVolumeGroups$ | async as subvolumeGroups"
+          >
+            <option
+              value=""
+              i18n
+            >
+              Default
+            </option>
+            <option
+              *ngFor="let subvolumegroup of subvolumeGroups"
+              [value]="subvolumegroup.name"
+            >
+              {{ subvolumegroup.name }}
+            </option>
+          </cds-select>
+        </div>
 
         <!-- Size -->
         <div class="form-item">
-          <cds-text-label label="Size"
-                          for="size"
-                          helperText="The size of the subvolume is specified by setting a quota on it.
+          <cds-text-label
+            label="Size"
+            for="size"
+            helperText="The size of the subvolume is specified by setting a quota on it.
                           If left blank or put 0, then quota will be infinite"
-                          i18n-helperText
-                          [invalid]="subvolumeForm.controls.size.invalid && (subvolumeForm.controls.size.dirty)"
-                          [invalidText]="sizeError"
-                          i18n>Size
-            <input cdsText
-                   type="text"
-                   id="size"
-                   name="size"
-                   formControlName="size"
-                   i18n-placeholder
-                   placeholder="e.g., 10GiB"
-                   defaultUnit="GiB"
-                   [invalid]="subvolumeForm.controls.size.invalid && (subvolumeForm.controls.size.dirty)"
-                   cdDimlessBinary>
+            i18n-helperText
+            [invalid]="subvolumeForm.controls.size.invalid && subvolumeForm.controls.size.dirty"
+            [invalidText]="sizeError"
+            i18n
+            >Size
+            <input
+              cdsText
+              type="text"
+              id="size"
+              name="size"
+              formControlName="size"
+              i18n-placeholder
+              placeholder="e.g., 10GiB"
+              defaultUnit="GiB"
+              [invalid]="subvolumeForm.controls.size.invalid && subvolumeForm.controls.size.dirty"
+              cdDimlessBinary
+            />
           </cds-text-label>
           <ng-template #sizeError>
-            <span *ngIf="subvolumeForm.showError('size', formDir, 'pattern')"
-                  class="invalid-feedback"
-                  i18n>Size must be a number or in a valid format. eg: 5 GiB</span>
+            <span
+              *ngIf="subvolumeForm.showError('size', formDir, 'pattern')"
+              class="invalid-feedback"
+              i18n
+              >Size must be a number or in a valid format. eg: 5 GiB</span
+            >
           </ng-template>
         </div>
 
-        <cd-alert-panel *ngIf="!showSnapshotVisibility"
-                        type="warning"
-                        class="cds-mb-6"
-                        i18n>
-          To manage snapshot visibility, first enable
-          client_respect_subvolume_snapshot_visibility.
+        <cd-alert-panel
+          *ngIf="!showSnapshotVisibility"
+          type="warning"
+          class="cds-mb-6"
+          i18n
+        >
+          To manage snapshot visibility, first enable client_respect_subvolume_snapshot_visibility.
         </cd-alert-panel>
 
         <!-- Snapshot visibility -->
         <div class="form-item">
-          <cds-checkbox id="snapshotVisibility"
-                        name="snapshotVisibility"
-                        formControlName="snapshotVisibility">
+          <cds-checkbox
+            id="snapshotVisibility"
+            name="snapshotVisibility"
+            formControlName="snapshotVisibility"
+          >
             <span i18n>Allow snapshot browsing</span>
             <cd-help-text>
               <span i18n>
-                When enabled, snapshots will be visible inside the subvolume directory under ".snap".
+                When enabled, snapshots will be visible inside the subvolume directory under
+                ".snap".
               </span>
             </cd-help-text>
           </cds-checkbox>
@@ -123,80 +175,103 @@
 
         <!-- CephFS Pools -->
         <div class="form-item">
-          <cds-select label="CephFS Pools"
-                      for="pool"
-                      formControlName="pool"
-                      name="pool"
-                      id="pool"
-                      helperText="By default, the data_pool_layout of the parent directory is selected."
-                      i18n-helperText>
-            <option *ngFor="let pool of dataPools"
-                    [value]="pool.pool">{{ pool.pool }}</option>
+          <cds-select
+            label="CephFS Pools"
+            for="pool"
+            formControlName="pool"
+            name="pool"
+            id="pool"
+            helperText="By default, the data_pool_layout of the parent directory is selected."
+            i18n-helperText
+          >
+            <option
+              *ngFor="let pool of dataPools"
+              [value]="pool.pool"
+            >
+              {{ pool.pool }}
+            </option>
           </cds-select>
         </div>
 
         <!-- UID -->
         <div class="form-item">
-          <cds-text-label label="UID"
-                          for="uid"
-                          i18n>UID
-            <input cdsText
-                   type="number"
-                   placeholder="Subvolume UID..."
-                   id="uid"
-                   name="uid"
-                   formControlName="uid">
+          <cds-text-label
+            label="UID"
+            for="uid"
+            i18n
+            >UID
+            <input
+              cdsText
+              type="number"
+              placeholder="Subvolume UID..."
+              id="uid"
+              name="uid"
+              formControlName="uid"
+            />
           </cds-text-label>
         </div>
 
         <!-- GID -->
         <div class="form-item">
-          <cds-text-label label="GID"
-                          for="gid"
-                          i18n>GID
-            <input cdsText
-                   type="number"
-                   placeholder="Subvolume GID..."
-                   id="gid"
-                   name="gid"
-                   formControlName="gid">
+          <cds-text-label
+            label="GID"
+            for="gid"
+            i18n
+            >GID
+            <input
+              cdsText
+              type="number"
+              placeholder="Subvolume GID..."
+              id="gid"
+              name="gid"
+              formControlName="gid"
+            />
           </cds-text-label>
         </div>
 
         <!-- Mode -->
         <div class="form-item">
-          <label class="cds--label"
-                 for="mode"
-                 i18n>Mode
+          <label
+            class="cds--label"
+            for="mode"
+            i18n
+            >Mode
           </label>
-          <cd-help-text>Permissions for the directory. Default mode is 755 which is rwxr-xr-x</cd-help-text>
-          <cd-checked-table-form [data]="scopePermissions"
-                                 [columns]="columns"
-                                 [form]="subvolumeForm"
-                                 inputField="mode"
-                                 [isTableForOctalMode]="true"
-                                 [initialValue]="initialMode"
-                                 [scopes]="scopes"
-                                 [isDisabled]="isEdit">
+          <cd-help-text
+            >Permissions for the directory. Default mode is 755 which is rwxr-xr-x</cd-help-text
+          >
+          <cd-checked-table-form
+            [data]="scopePermissions"
+            [columns]="columns"
+            [form]="subvolumeForm"
+            inputField="mode"
+            [isTableForOctalMode]="true"
+            [initialValue]="initialMode"
+            [scopes]="scopes"
+            [isDisabled]="isEdit"
+          >
           </cd-checked-table-form>
         </div>
 
         <!-- Is namespace-isolated -->
         <div class="form-item">
-          <cds-checkbox id="isolatedNamespace"
-                        name="isolatedNamespace"
-                        formControlName="isolatedNamespace"
-                        i18n>Isolated Namespace
+          <cds-checkbox
+            id="isolatedNamespace"
+            name="isolatedNamespace"
+            formControlName="isolatedNamespace"
+            i18n
+            >Isolated Namespace
             <cd-help-text>To create subvolume in a separate RADOS namespace.</cd-help-text>
           </cds-checkbox>
         </div>
       </form>
     </div>
 
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="subvolumeForm"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [modalForm]="true"></cd-form-button-panel>
-
+    <cd-form-button-panel
+      (submitActionEvent)="submit()"
+      [form]="subvolumeForm"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-group/cephfs-subvolume-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-group/cephfs-subvolume-group.component.html
index 98630293b5e..166c7c02e41 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-group/cephfs-subvolume-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-group/cephfs-subvolume-group.component.html
@@ -1,50 +1,65 @@
-
 <ng-container *ngIf="subvolumeGroup$ | async as subvolumeGroup">
-  <cd-table *ngIf="subvolumeGroup"
-            [data]="subvolumeGroup"
-            columnMode="flex"
-            [columns]="columns"
-            selectionType="single"
-            [hasDetails]="false"
-            (fetchData)="fetchData()"
-            (updateSelection)="updateSelection($event)">
-
+  <cd-table
+    *ngIf="subvolumeGroup"
+    [data]="subvolumeGroup"
+    columnMode="flex"
+    [columns]="columns"
+    selectionType="single"
+    [hasDetails]="false"
+    (fetchData)="fetchData()"
+    (updateSelection)="updateSelection($event)"
+  >
     <div class="table-actions">
-      <cd-table-actions [permission]="permissions.cephfs"
-                        [selection]="selection"
-                        class="btn-group"
-                        id="cephfs-subvolumegropup-actions"
-                        [tableActions]="tableActions">
+      <cd-table-actions
+        [permission]="permissions.cephfs"
+        [selection]="selection"
+        class="btn-group"
+        id="cephfs-subvolumegropup-actions"
+        [tableActions]="tableActions"
+      >
       </cd-table-actions>
     </div>
   </cd-table>
 </ng-container>
 
-<ng-template #quotaUsageTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.info.bytes_pcent && row.info.bytes_pcent !== 'undefined'; else noLimitTpl"
-                [total]="row.info.bytes_quota"
-                [used]="row.info.bytes_used"
-                [title]="row.name"
-                decimals="2"></cd-usage-bar>
+<ng-template
+  #quotaUsageTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.info.bytes_pcent && row.info.bytes_pcent !== 'undefined'; else noLimitTpl"
+    [total]="row.info.bytes_quota"
+    [used]="row.info.bytes_used"
+    [title]="row.name"
+    decimals="2"
+  ></cd-usage-bar>
   <ng-template #noLimitTpl>
-    <span ngbTooltip="Quota limit is not set"
-          *ngIf="row.info.bytes_pcent === 'undefined'"
-          i18n-ngbTooltip>
-      {{row.info.bytes_used | dimlessBinary}}</span>
+    <span
+      ngbTooltip="Quota limit is not set"
+      *ngIf="row.info.bytes_pcent === 'undefined'"
+      i18n-ngbTooltip
+    >
+      {{ row.info.bytes_used | dimlessBinary }}</span
+    >
   </ng-template>
 </ng-template>
 
-<ng-template #typeTpl
-             let-value="data.value">
+<ng-template
+  #typeTpl
+  let-value="data.value"
+>
   <cd-label [value]="value"></cd-label>
 </ng-template>
 
-<ng-template #modeToHumanReadableTpl
-             let-value="data.value">
-  <cds-tag *ngFor="let result of (value | octalToHumanReadable)"
-           [class]="result.class"
-           [ngbTooltip]="result.toolTip">
+<ng-template
+  #modeToHumanReadableTpl
+  let-value="data.value"
+>
+  <cds-tag
+    *ngFor="let result of value | octalToHumanReadable"
+    [class]="result.class"
+    [ngbTooltip]="result.toolTip"
+  >
     {{ result.content }}
-</cds-tag>
+  </cds-tag>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-list/cephfs-subvolume-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-list/cephfs-subvolume-list.component.html
index ea5e7ce8080..f9610edae19 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-list/cephfs-subvolume-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-list/cephfs-subvolume-list.component.html
@@ -1,106 +1,143 @@
 <div class="row">
-  <div class="col-sm-2"
-       *ngIf="subVolumeGroups$ | async as subVolumeGroups">
-    <cd-vertical-navigation title="Groups"
-                            [items]="subvolumeGroupList"
-                            inputIdentifier="group-filter"
-                            (emitActiveItem)="selectSubVolumeGroup($event)"></cd-vertical-navigation>
+  <div
+    class="col-sm-2"
+    *ngIf="subVolumeGroups$ | async as subVolumeGroups"
+  >
+    <cd-vertical-navigation
+      title="Groups"
+      [items]="subvolumeGroupList"
+      inputIdentifier="group-filter"
+      (emitActiveItem)="selectSubVolumeGroup($event)"
+    ></cd-vertical-navigation>
   </div>
   <div class="col-10 vertical-line">
-    <cd-table [data]="subVolumes$ | async"
-              columnMode="flex"
-              [columns]="columns"
-              selectionType="single"
-              [hasDetails]="false"
-              (fetchData)="fetchData()"
-              (updateSelection)="updateSelection($event)">
-
+    <cd-table
+      [data]="subVolumes$ | async"
+      columnMode="flex"
+      [columns]="columns"
+      selectionType="single"
+      [hasDetails]="false"
+      (fetchData)="fetchData()"
+      (updateSelection)="updateSelection($event)"
+    >
       <div class="table-actions">
-        <cd-table-actions [permission]="permissions.cephfs"
-                          [selection]="selection"
-                          class="btn-group"
-                          id="cephfs-subvolume-actions"
-                          [tableActions]="tableActions">
+        <cd-table-actions
+          [permission]="permissions.cephfs"
+          [selection]="selection"
+          class="btn-group"
+          id="cephfs-subvolume-actions"
+          [tableActions]="tableActions"
+        >
         </cd-table-actions>
       </div>
     </cd-table>
   </div>
 </div>
 
-<ng-template #quotaUsageTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.info.bytes_pcent && row.info.bytes_pcent !== 'undefined'; else noLimitTpl"
-                [total]="row.info.bytes_quota"
-                [used]="row.info.bytes_used"
-                [title]="row.name"
-                decimals="2"></cd-usage-bar>
+<ng-template
+  #quotaUsageTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.info.bytes_pcent && row.info.bytes_pcent !== 'undefined'; else noLimitTpl"
+    [total]="row.info.bytes_quota"
+    [used]="row.info.bytes_used"
+    [title]="row.name"
+    decimals="2"
+  ></cd-usage-bar>
 
   <ng-template #noLimitTpl>
-    <span ngbTooltip="Quota limit is not set"
-          *ngIf="row.info.bytes_pcent === 'undefined'"
-          i18n-ngbTooltip>
-      {{row.info.bytes_used | dimlessBinary}}</span>
+    <span
+      ngbTooltip="Quota limit is not set"
+      *ngIf="row.info.bytes_pcent === 'undefined'"
+      i18n-ngbTooltip
+    >
+      {{ row.info.bytes_used | dimlessBinary }}</span
+    >
   </ng-template>
 </ng-template>
 
-<ng-template #typeTpl
-             let-value="data.value">
+<ng-template
+  #typeTpl
+  let-value="data.value"
+>
   <cd-label [value]="value"></cd-label>
 </ng-template>
 
-<ng-template #modeToHumanReadableTpl
-             let-value="data.value">
-  <cds-tag *ngFor="let result of (value | octalToHumanReadable)"
-           [class]="result.class"
-           [ngbTooltip]="result.toolTip">
+<ng-template
+  #modeToHumanReadableTpl
+  let-value="data.value"
+>
+  <cds-tag
+    *ngFor="let result of value | octalToHumanReadable"
+    [class]="result.class"
+    [ngbTooltip]="result.toolTip"
+  >
     {{ result.content }}
-</cds-tag>
+  </cds-tag>
 </ng-template>
 
-<ng-template #nameTpl
-             let-row="data.row">
-  <span class="fw-bold">{{row.name}}</span>
+<ng-template
+  #nameTpl
+  let-row="data.row"
+>
+  <span class="fw-bold">{{ row.name }}</span>
 
   <span *ngIf="row?.info?.state === 'complete'; else snapshotRetainedTpl">
-    <i [ngClass]="[icons.success, icons.size24]"
-       ngbTooltip="{{row.name}} is ready to use"
-       class="text-success"></i>
+    <i
+      [ngClass]="[icons.success, icons.size24]"
+      ngbTooltip="{{ row.name }} is ready to use"
+      class="text-success"
+    ></i>
   </span>
 
   <ng-template #snapshotRetainedTpl>
-    <i [ngClass]="[icons.warning, icons.size24]"
-       class="text-warning"
-       ngbTooltip="{{row.name}} is removed after retaining the snapshots"></i>
+    <i
+      [ngClass]="[icons.warning, icons.size24]"
+      class="text-warning"
+      ngbTooltip="{{ row.name }} is removed after retaining the snapshots"
+    ></i>
   </ng-template>
 
-  <cd-label [value]="row?.info?.type"
-            *ngIf="row?.info?.type !== 'subvolume'"></cd-label>
+  <cd-label
+    [value]="row?.info?.type"
+    *ngIf="row?.info?.type !== 'subvolume'"
+  ></cd-label>
 
-  <cd-label value="namespaced"
-            *ngIf="row?.info?.pool_namespace"
-            [tooltipText]="row?.info?.pool_namespace"></cd-label>
+  <cd-label
+    value="namespaced"
+    *ngIf="row?.info?.pool_namespace"
+    [tooltipText]="row?.info?.pool_namespace"
+  ></cd-label>
 </ng-template>
 
-<ng-template #removeTmpl
-             let-form="form">
+<ng-template
+  #removeTmpl
+  let-form="form"
+>
   <ng-container [formGroup]="form">
     <ng-container formGroupName="child">
-      <cd-alert-panel *ngIf="errorMessage.length > 1"
-                      type="error">
-              {{errorMessage}}
+      <cd-alert-panel
+        *ngIf="errorMessage.length > 1"
+        type="error"
+      >
+        {{ errorMessage }}
       </cd-alert-panel>
       <div class="form-item cds-pt-3">
-        <cds-checkbox id="retainSnapshots"
-                      formControlName="retainSnapshots"
-                      autofocus
-                      [required]="true"
-                      modal-primary-focus
-                      ariaLabel="confirmation"
-                      i18n>Retain snapshots
-          <cd-help-text>The subvolume can be removed retaining
-                  existing snapshots using this option.
-                   If snapshots are retained, the subvolume is considered empty for all
-                    operations not involving the retained snapshots.</cd-help-text>
+        <cds-checkbox
+          id="retainSnapshots"
+          formControlName="retainSnapshots"
+          autofocus
+          [required]="true"
+          modal-primary-focus
+          ariaLabel="confirmation"
+          i18n
+          >Retain snapshots
+          <cd-help-text
+            >The subvolume can be removed retaining existing snapshots using this option. If
+            snapshots are retained, the subvolume is considered empty for all operations not
+            involving the retained snapshots.</cd-help-text
+          >
         </cds-checkbox>
       </div>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-form/cephfs-subvolume-snapshots-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-form/cephfs-subvolume-snapshots-form.component.html
index 1498aaad644..caa5089ca08 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-form/cephfs-subvolume-snapshots-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-form/cephfs-subvolume-snapshots-form.component.html
@@ -1,93 +1,139 @@
-<cds-modal size="lg"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
 
   <ng-container *cdFormLoading="loading">
-    <form name="snapshotForm"
-          #formDir="ngForm"
-          [formGroup]="snapshotForm"
-          novalidate>
+    <form
+      name="snapshotForm"
+      #formDir="ngForm"
+      [formGroup]="snapshotForm"
+      novalidate
+    >
       <div cdsModalContent>
         <div class="form-item">
-          <cds-text-label label="Name"
-                          for="snapshotName"
-                          cdRequiredField="Name"
-                          [invalid]="snapshotForm.controls.snapshotName.invalid && (snapshotForm.controls.snapshotName.dirty)"
-                          [invalidText]="snapshotNameError"
-                          i18n>
-            <input cdsText
-                   type="text"
-                   placeholder="Snapshot name..."
-                   id="snapshotName"
-                   name="snapshotName"
-                   formControlName="snapshotName"
-                   [invalid]="snapshotForm.controls.snapshotName.invalid && (snapshotForm.controls.snapshotName.dirty)"
-                   autofocus
-                   modal-primary-focus>
+          <cds-text-label
+            label="Name"
+            for="snapshotName"
+            cdRequiredField="Name"
+            [invalid]="
+              snapshotForm.controls.snapshotName.invalid && snapshotForm.controls.snapshotName.dirty
+            "
+            [invalidText]="snapshotNameError"
+            i18n
+          >
+            <input
+              cdsText
+              type="text"
+              placeholder="Snapshot name..."
+              id="snapshotName"
+              name="snapshotName"
+              formControlName="snapshotName"
+              [invalid]="
+                snapshotForm.controls.snapshotName.invalid &&
+                snapshotForm.controls.snapshotName.dirty
+              "
+              autofocus
+              modal-primary-focus
+            />
           </cds-text-label>
           <ng-template #snapshotNameError>
-            <span class="invalid-feedback"
-                  *ngIf="snapshotForm.showError('snapshotName', formDir, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="snapshotForm.showError('snapshotName', formDir, 'notUnique')"
-                  i18n>The snapshot already exists.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="snapshotForm.showError('snapshotName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="snapshotForm.showError('snapshotName', formDir, 'notUnique')"
+              i18n
+              >The snapshot already exists.</span
+            >
           </ng-template>
         </div>
 
         <!-- Volume name -->
         <div class="form-item">
-          <cds-text-label label="Volume name"
-                          for="volumeName"
-                          i18n>Volume name
-            <input cdsText
-                   type="text"
-                   id="volumeName"
-                   name="volumeName"
-                   formControlName="volumeName">
+          <cds-text-label
+            label="Volume name"
+            for="volumeName"
+            i18n
+            >Volume name
+            <input
+              cdsText
+              type="text"
+              id="volumeName"
+              name="volumeName"
+              formControlName="volumeName"
+            />
           </cds-text-label>
         </div>
 
         <!--Subvolume Group name -->
         <div class="form-item">
-          <cds-select label="Subvolume group"
-                      for="subvolumeGroupName"
-                      formControlName="subvolumeGroupName"
-                      name="subvolumeGroupName"
-                      id="subvolumeGroupName"
-                      *ngIf="subVolumeGroups">
+          <cds-select
+            label="Subvolume group"
+            for="subvolumeGroupName"
+            formControlName="subvolumeGroupName"
+            name="subvolumeGroupName"
+            id="subvolumeGroupName"
+            *ngIf="subVolumeGroups"
+          >
             <ng-container *ngFor="let subvolumegroup of subVolumeGroups">
-              <option *ngIf="subvolumegroup == ''"
-                      value="">Default</option>
-              <option [value]="subvolumegroup"
-                      *ngIf="subvolumegroup !== ''">{{ subvolumegroup }}</option>
+              <option
+                *ngIf="subvolumegroup == ''"
+                value=""
+              >
+                Default
+              </option>
+              <option
+                [value]="subvolumegroup"
+                *ngIf="subvolumegroup !== ''"
+              >
+                {{ subvolumegroup }}
+              </option>
             </ng-container>
           </cds-select>
         </div>
 
         <!--Subvolume name -->
-        <div class="form-item"
-             *ngIf="subVolumes$ | async as subVolumes">
-          <cds-select label="Subvolume"
-                      id="subVolumeName"
-                      name="subVolumeName"
-                      formControlName="subVolumeName"
-                      (registerOnChange)="resetValidators(selection.value)">
-            <option *ngFor="let subVolume of subVolumes"
-                    [value]="subVolume.name">{{ subVolume.name }}</option>
+        <div
+          class="form-item"
+          *ngIf="subVolumes$ | async as subVolumes"
+        >
+          <cds-select
+            label="Subvolume"
+            id="subVolumeName"
+            name="subVolumeName"
+            formControlName="subVolumeName"
+            (registerOnChange)="resetValidators(selection.value)"
+          >
+            <option
+              *ngFor="let subVolume of subVolumes"
+              [value]="subVolume.name"
+            >
+              {{ subVolume.name }}
+            </option>
           </cds-select>
         </div>
       </div>
 
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="snapshotForm"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                            [modalForm]="true"></cd-form-button-panel>
-
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="snapshotForm"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        [modalForm]="true"
+      ></cd-form-button-panel>
     </form>
   </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-list.component.html
index a039411ee51..fd9a5dadf16 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-snapshots-list/cephfs-subvolume-snapshots-list.component.html
@@ -4,44 +4,60 @@
   </cd-loading-panel>
 </ng-container>
 
-<div class="row"
-     *ngIf="isSubVolumesAvailable; else noGroupsTpl">
+<div
+  class="row"
+  *ngIf="isSubVolumesAvailable; else noGroupsTpl"
+>
   <div class="col-sm-2">
-    <cd-vertical-navigation title="Groups"
-                            [items]="subvolumeGroupList"
-                            inputIdentifier="group-filter"
-                            (emitActiveItem)="selectSubVolumeGroup($event)"></cd-vertical-navigation>
+    <cd-vertical-navigation
+      title="Groups"
+      [items]="subvolumeGroupList"
+      inputIdentifier="group-filter"
+      (emitActiveItem)="selectSubVolumeGroup($event)"
+    ></cd-vertical-navigation>
   </div>
-  <div class="col-sm-2 vertical-line"
-       *ngIf="subVolumes$ | async">
-    <cd-vertical-navigation title="Subvolumes"
-                            [items]="subVolumesList"
-                            (emitActiveItem)="selectSubVolume($event)"
-                            inputIdentifier="subvol-filter"></cd-vertical-navigation>
+  <div
+    class="col-sm-2 vertical-line"
+    *ngIf="subVolumes$ | async"
+  >
+    <cd-vertical-navigation
+      title="Subvolumes"
+      [items]="subVolumesList"
+      (emitActiveItem)="selectSubVolume($event)"
+      inputIdentifier="subvol-filter"
+    ></cd-vertical-navigation>
   </div>
-  <div class="col-8 vertical-line"
-       *ngIf="isSubVolumesAvailable">
-    <cd-table [data]="snapshots$ | async"
-              columnMode="flex"
-              [columns]="columns"
-              selectionType="single"
-              [hasDetails]="false"
-              (fetchData)="fetchData()"
-              (updateSelection)="updateSelection($event)">
-
+  <div
+    class="col-8 vertical-line"
+    *ngIf="isSubVolumesAvailable"
+  >
+    <cd-table
+      [data]="snapshots$ | async"
+      columnMode="flex"
+      [columns]="columns"
+      selectionType="single"
+      [hasDetails]="false"
+      (fetchData)="fetchData()"
+      (updateSelection)="updateSelection($event)"
+    >
       <div class="table-actions">
-        <cd-table-actions [permission]="permissions.cephfs"
-                          [selection]="selection"
-                          class="btn-group"
-                          id="cephfs-snapshot-actions"
-                          [tableActions]="tableActions">
+        <cd-table-actions
+          [permission]="permissions.cephfs"
+          [selection]="selection"
+          class="btn-group"
+          id="cephfs-snapshot-actions"
+          [tableActions]="tableActions"
+        >
         </cd-table-actions>
       </div>
     </cd-table>
   </div>
 </div>
 <ng-template #noGroupsTpl>
-  <cd-alert-panel type="info"
-                  i18n
-                  *ngIf="!isLoading">No subvolumes are present. Please create subvolumes to manage snapshots.</cd-alert-panel>
+  <cd-alert-panel
+    type="info"
+    i18n
+    *ngIf="!isLoading"
+    >No subvolumes are present. Please create subvolumes to manage snapshots.</cd-alert-panel
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolumegroup-form/cephfs-subvolumegroup-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolumegroup-form/cephfs-subvolumegroup-form.component.html
index b7c08c36955..fa48ad3fdfe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolumegroup-form/cephfs-subvolumegroup-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolumegroup-form/cephfs-subvolumegroup-form.component.html
@@ -1,155 +1,218 @@
-<cds-modal size="lg"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
 
   <ng-container *cdFormLoading="loading">
     <div cdsModalContent>
-      <form name="subvolumegroupForm"
-            #formDir="ngForm"
-            [formGroup]="subvolumegroupForm"
-            novalidate>
+      <form
+        name="subvolumegroupForm"
+        #formDir="ngForm"
+        [formGroup]="subvolumegroupForm"
+        novalidate
+      >
         <div class="form-item">
-          <cds-text-label label="Name"
-                          for="subvolumegroupName"
-                          [invalid]="subvolumegroupForm.controls.subvolumegroupName.invalid && (subvolumegroupForm.controls.subvolumegroupName.dirty)"
-                          [invalidText]="subvolumegroupNameError"
-                          cdRequiredField="Name"
-                          i18n>Name
-            <input cdsText
-                   type="text"
-                   placeholder="Subvolume group name..."
-                   i18n-placeholder
-                   id="subvolumegroupName"
-                   name="subvolumegroupName"
-                   [invalid]="subvolumegroupForm.controls.subvolumegroupName.invalid && (subvolumegroupForm.controls.subvolumegroupName.dirty)"
-                   formControlName="subvolumegroupName"
-                   modal-primary-focus>
+          <cds-text-label
+            label="Name"
+            for="subvolumegroupName"
+            [invalid]="
+              subvolumegroupForm.controls.subvolumegroupName.invalid &&
+              subvolumegroupForm.controls.subvolumegroupName.dirty
+            "
+            [invalidText]="subvolumegroupNameError"
+            cdRequiredField="Name"
+            i18n
+            >Name
+            <input
+              cdsText
+              type="text"
+              placeholder="Subvolume group name..."
+              i18n-placeholder
+              id="subvolumegroupName"
+              name="subvolumegroupName"
+              [invalid]="
+                subvolumegroupForm.controls.subvolumegroupName.invalid &&
+                subvolumegroupForm.controls.subvolumegroupName.dirty
+              "
+              formControlName="subvolumegroupName"
+              modal-primary-focus
+            />
           </cds-text-label>
           <ng-template #subvolumegroupNameError>
-            <span class="invalid-feedback"
-                  *ngIf="subvolumegroupForm.showError('subvolumegroupName', formDir, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="subvolumegroupForm.showError('subvolumegroupName', formDir, 'notUnique')"
-                  i18n>The subvolume group already exists.</span>
-            <span *ngIf="subvolumegroupForm.showError('subvolumegroupName', formDir, 'pattern')"
-                  class="invalid-feedback"
-                  i18n>Subvolume name can only contain letters, numbers, '.', '-' or '_'</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="subvolumegroupForm.showError('subvolumegroupName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="subvolumegroupForm.showError('subvolumegroupName', formDir, 'notUnique')"
+              i18n
+              >The subvolume group already exists.</span
+            >
+            <span
+              *ngIf="subvolumegroupForm.showError('subvolumegroupName', formDir, 'pattern')"
+              class="invalid-feedback"
+              i18n
+              >Subvolume name can only contain letters, numbers, '.', '-' or '_'</span
+            >
           </ng-template>
         </div>
 
         <!-- Volume name -->
         <div class="form-item">
-          <cds-text-label label="Volume name"
-                          for="volumeName"
-                          i18n>Volume name
-            <input cdsText
-                   type="text"
-                   id="volumeName"
-                   name="volumeName"
-                   formControlName="volumeName">
+          <cds-text-label
+            label="Volume name"
+            for="volumeName"
+            i18n
+            >Volume name
+            <input
+              cdsText
+              type="text"
+              id="volumeName"
+              name="volumeName"
+              formControlName="volumeName"
+            />
           </cds-text-label>
         </div>
 
         <!-- Size -->
         <div class="form-item">
-          <cds-text-label label="Size"
-                          for="size"
-                          helperText="The size of the subvolume is specified by setting a quota on it.
+          <cds-text-label
+            label="Size"
+            for="size"
+            helperText="The size of the subvolume is specified by setting a quota on it.
                           If left blank or put 0, then quota will be infinite"
-                          i18n-helperText
-                          [invalid]="subvolumegroupForm.controls.size.invalid && (subvolumegroupForm.controls.size.dirty)"
-                          [invalidText]="sizeError"
-                          i18n>Size
-            <input cdsText
-                   type="text"
-                   id="size"
-                   name="size"
-                   formControlName="size"
-                   i18n-placeholder
-                   placeholder="e.g., 10GiB"
-                   defaultUnit="GiB"
-                   [invalid]="subvolumegroupForm.controls.size.invalid && (subvolumegroupForm.controls.size.dirty)"
-                   cdDimlessBinary>
+            i18n-helperText
+            [invalid]="
+              subvolumegroupForm.controls.size.invalid && subvolumegroupForm.controls.size.dirty
+            "
+            [invalidText]="sizeError"
+            i18n
+            >Size
+            <input
+              cdsText
+              type="text"
+              id="size"
+              name="size"
+              formControlName="size"
+              i18n-placeholder
+              placeholder="e.g., 10GiB"
+              defaultUnit="GiB"
+              [invalid]="
+                subvolumegroupForm.controls.size.invalid && subvolumegroupForm.controls.size.dirty
+              "
+              cdDimlessBinary
+            />
           </cds-text-label>
           <ng-template #sizeError>
-            <span *ngIf="subvolumegroupForm.showError('size', formDir, 'pattern')"
-                  class="invalid-feedback"
-                  i18n>Size must be a number or in a valid format. eg: 5 GiB</span>
+            <span
+              *ngIf="subvolumegroupForm.showError('size', formDir, 'pattern')"
+              class="invalid-feedback"
+              i18n
+              >Size must be a number or in a valid format. eg: 5 GiB</span
+            >
           </ng-template>
         </div>
 
         <!-- CephFS Pools -->
         <div class="form-item">
-          <cds-select label="CephFS Pools"
-                      for="pool"
-                      formControlName="pool"
-                      name="pool"
-                      id="pool"
-                      helperText="By default, the data_pool_layout of the parent directory is selected."
-                      i18n-helperText>
-            <option *ngFor="let pool of dataPools"
-                    [value]="pool.pool">{{ pool.pool }}</option>
+          <cds-select
+            label="CephFS Pools"
+            for="pool"
+            formControlName="pool"
+            name="pool"
+            id="pool"
+            helperText="By default, the data_pool_layout of the parent directory is selected."
+            i18n-helperText
+          >
+            <option
+              *ngFor="let pool of dataPools"
+              [value]="pool.pool"
+            >
+              {{ pool.pool }}
+            </option>
           </cds-select>
         </div>
 
         <!-- UID -->
         <div class="form-item">
-          <cds-text-label label="UID"
-                          for="uid"
-                          i18n>UID
-            <input cdsText
-                   type="number"
-                   placeholder="Subvolume UID..."
-                   id="uid"
-                   name="uid"
-                   formControlName="uid">
+          <cds-text-label
+            label="UID"
+            for="uid"
+            i18n
+            >UID
+            <input
+              cdsText
+              type="number"
+              placeholder="Subvolume UID..."
+              id="uid"
+              name="uid"
+              formControlName="uid"
+            />
           </cds-text-label>
         </div>
 
         <!-- GID -->
         <div class="form-item">
-          <cds-text-label label="GID"
-                          for="gid"
-                          i18n>GID
-            <input cdsText
-                   type="number"
-                   placeholder="Subvolume group GID..."
-                   id="gid"
-                   name="gid"
-                   formControlName="gid">
+          <cds-text-label
+            label="GID"
+            for="gid"
+            i18n
+            >GID
+            <input
+              cdsText
+              type="number"
+              placeholder="Subvolume group GID..."
+              id="gid"
+              name="gid"
+              formControlName="gid"
+            />
           </cds-text-label>
         </div>
 
         <!-- Mode -->
         <div class="form-item">
-          <label class="cds--label"
-                 for="mode"
-                 i18n>Mode
+          <label
+            class="cds--label"
+            for="mode"
+            i18n
+            >Mode
           </label>
-          <cd-help-text>Permissions for the directory. Default mode is 755 which is rwxr-xr-x</cd-help-text>
+          <cd-help-text
+            >Permissions for the directory. Default mode is 755 which is rwxr-xr-x</cd-help-text
+          >
 
-          <cd-checked-table-form [data]="scopePermissions"
-                                 [columns]="columns"
-                                 [form]="subvolumegroupForm"
-                                 inputField="mode"
-                                 [isTableForOctalMode]="true"
-                                 [initialValue]="initialMode"
-                                 [scopes]="scopes"
-                                 [isDisabled]="isEdit"></cd-checked-table-form>
+          <cd-checked-table-form
+            [data]="scopePermissions"
+            [columns]="columns"
+            [form]="subvolumegroupForm"
+            inputField="mode"
+            [isTableForOctalMode]="true"
+            [initialValue]="initialMode"
+            [scopes]="scopes"
+            [isDisabled]="isEdit"
+          ></cd-checked-table-form>
         </div>
       </form>
     </div>
 
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="subvolumegroupForm"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [modalForm]="true"></cd-form-button-panel>
-
+    <cd-form-button-panel
+      (submitActionEvent)="submit()"
+      [form]="subvolumegroupForm"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-tabs/cephfs-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-tabs/cephfs-tabs.component.html
index ff2febe714c..3bc95e17451 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-tabs/cephfs-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-tabs/cephfs-tabs.component.html
@@ -9,22 +9,29 @@
     <ng-container ngbNavItem="details">
       <a
         ngbNavLink
-        i18n>Details</a>
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
         <cd-cephfs-detail [data]="details"> </cd-cephfs-detail>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="directories">
-      <a ngbNavLink
-         i18n>Directories</a>
+      <a
+        ngbNavLink
+        i18n
+        >Directories</a
+      >
       <ng-template ngbNavContent>
         <cd-cephfs-directories [id]="id"></cd-cephfs-directories>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="subvolumes">
       <a
-      ngbNavLink
-      i18n>Subvolumes</a>
+        ngbNavLink
+        i18n
+        >Subvolumes</a
+      >
       <ng-template ngbNavContent>
         <cd-cephfs-subvolume-list
           [fsName]="selection.mdsmap.fs_name"
@@ -35,19 +42,24 @@
     </ng-container>
     <ng-container ngbNavItem="subvolume-groups">
       <a
-      ngbNavLink
-      i18n>Subvolume groups</a>
+        ngbNavLink
+        i18n
+        >Subvolume groups</a
+      >
       <ng-template ngbNavContent>
         <cd-cephfs-subvolume-group
-        [fsName]="selection.mdsmap.fs_name"
-        [pools]="details.pools">
+          [fsName]="selection.mdsmap.fs_name"
+          [pools]="details.pools"
+        >
         </cd-cephfs-subvolume-group>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="snapshots">
       <a
-      ngbNavLink
-      i18n>Snapshots</a>
+        ngbNavLink
+        i18n
+        >Snapshots</a
+      >
       <ng-template ngbNavContent>
         <cd-cephfs-subvolume-snapshots-list [fsName]="selection.mdsmap.fs_name">
         </cd-cephfs-subvolume-snapshots-list>
@@ -55,8 +67,10 @@
     </ng-container>
     <ng-container ngbNavItem="snapshot-schedules">
       <a
-      ngbNavLink
-      i18n>Snapshot schedules</a>
+        ngbNavLink
+        i18n
+        >Snapshot schedules</a
+      >
       <ng-template ngbNavContent>
         <cd-cephfs-snapshotschedule-list
           [fsName]="selection.mdsmap.fs_name"
@@ -71,16 +85,19 @@
       </a>
       <ng-template ngbNavContent>
         <cd-cephfs-clients
-        [id]="id"
-        [clients]="clients"
-        (triggerApiUpdate)="refresh()">
+          [id]="id"
+          [clients]="clients"
+          (triggerApiUpdate)="refresh()"
+        >
         </cd-cephfs-clients>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="performance-details">
       <a
-      ngbNavLink
-      i18n>Overview</a>
+        ngbNavLink
+        i18n
+        >Overview</a
+      >
       <ng-template ngbNavContent>
         <cd-grafana
           i18n-title
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-details/configuration-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-details/configuration-details.component.html
index ffd433dd635..25a0e5cbd87 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-details/configuration-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-details/configuration-details.component.html
@@ -1,59 +1,101 @@
 <ng-container *ngIf="selection">
-  <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-         data-testid="config-details-table">
+  <table
+    class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+    data-testid="config-details-table"
+  >
     <tbody>
       <tr>
-        <td i18n
-            class="bold w-25">Name</td>
+        <td
+          i18n
+          class="bold w-25"
+        >
+          Name
+        </td>
         <td class="w-75">{{ selection.name }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Description</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Description
+        </td>
         <td>{{ selection.desc }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Long description</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Long description
+        </td>
         <td>{{ selection.long_desc }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Current values</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Current values
+        </td>
         <td>
           <span *ngFor="let conf of selection.value; last as isLast">
-            {{ conf.section }}: {{ conf.value }}{{ !isLast ? "," : "" }}<br />
+            {{ conf.section }}: {{ conf.value }}{{ !isLast ? ',' : '' }}<br />
           </span>
         </td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Default</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Default
+        </td>
         <td>{{ selection.default }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Daemon default</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Daemon default
+        </td>
         <td>{{ selection.daemon_default }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Type</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Type
+        </td>
         <td>{{ selection.type }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Min</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Min
+        </td>
         <td>{{ selection.min }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Max</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Max
+        </td>
         <td>{{ selection.max }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Flags</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Flags
+        </td>
         <td>
           <span *ngFor="let flag of selection.flags">
             <span title="{{ flags[flag] }}">
@@ -63,48 +105,75 @@
         </td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">
-            Services
+        <td
+          i18n
+          class="bold"
+        >
+          Services
         </td>
         <td>
           <span *ngFor="let service of selection.services">
             <cds-tag
-                 *ngIf="service"
-                 class="tag-dark me-2">
-            {{ service }}
-          </cds-tag>
+              *ngIf="service"
+              class="tag-dark me-2"
+            >
+              {{ service }}
+            </cds-tag>
           </span>
         </td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Source</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Source
+        </td>
         <td>{{ selection.source }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Level</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Level
+        </td>
         <td>{{ selection.level }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Can be updated at runtime (editable)</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Can be updated at runtime (editable)
+        </td>
         <td>{{ selection.can_update_at_runtime | booleanText }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Tags</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Tags
+        </td>
         <td>{{ selection.tags }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">Enum values</td>
+        <td
+          i18n
+          class="bold"
+        >
+          Enum values
+        </td>
         <td>{{ selection.enum_values }}</td>
       </tr>
       <tr>
-        <td i18n
-            class="bold">See also</td>
+        <td
+          i18n
+          class="bold"
+        >
+          See also
+        </td>
         <td>{{ selection.see_also }}</td>
       </tr>
     </tbody>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
index 873814adacc..28089e5c5a3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration-form/configuration-form.component.html
@@ -42,91 +42,95 @@
 
         <!-- Long description -->
         @if (response?.long_desc) {
-        <div
-          cdsRow
-          class="form-item"
-        >
-          <legend
-            class="cds--label"
-            i18n
-          >Description</legend>
-          <p class="cds--type-body-01 mb-0">{{ response.long_desc }}</p>
-        </div>
+          <div
+            cdsRow
+            class="form-item"
+          >
+            <legend
+              class="cds--label"
+              i18n
+            >
+              Description
+            </legend>
+            <p class="cds--type-body-01 mb-0">{{ response.long_desc }}</p>
+          </div>
         }
 
         <!-- Default -->
         @if (configForm.getValue('default') !== '') {
-        <div
-          cdsRow
-          class="form-item"
-        >
-          <cds-text-label
-            labelInputID="default"
-            i18n
+          <div
+            cdsRow
+            class="form-item"
           >
-            Default
-            <input
-              cdsText
-              type="text"
-              id="default"
-              formControlName="default"
-              readonly
-            />
-          </cds-text-label>
-        </div>
+            <cds-text-label
+              labelInputID="default"
+              i18n
+            >
+              Default
+              <input
+                cdsText
+                type="text"
+                id="default"
+                formControlName="default"
+                readonly
+              />
+            </cds-text-label>
+          </div>
         }
 
         <!-- Daemon default -->
         @if (configForm.getValue('daemon_default') !== '') {
-        <div
-          cdsRow
-          class="form-item"
-        >
-          <cds-text-label
-            labelInputID="daemon_default"
-            i18n
+          <div
+            cdsRow
+            class="form-item"
           >
-            Daemon default
-            <input
-              cdsText
-              type="text"
-              id="daemon_default"
-              formControlName="daemon_default"
-              readonly
-            />
-          </cds-text-label>
-        </div>
+            <cds-text-label
+              labelInputID="daemon_default"
+              i18n
+            >
+              Daemon default
+              <input
+                cdsText
+                type="text"
+                id="daemon_default"
+                formControlName="daemon_default"
+                readonly
+              />
+            </cds-text-label>
+          </div>
         }
 
         <!-- Services -->
         @if (configForm.getValue('services')?.length > 0) {
-        <div
-          cdsRow
-          class="form-item form-item-append align-items-center"
-        >
           <div
-            cdsCol
-            [columnNumbers]="{ sm: 2, md: 2, lg: 2 }"
+            cdsRow
+            class="form-item form-item-append align-items-center"
           >
-            <legend
-              class="cds--label mb-0"
-              i18n
-            >Services</legend>
-          </div>
-          <div
-            cdsCol
-            [columnNumbers]="{ sm: 6, md: 6, lg: 6 }"
-          >
-            @for (service of configForm.getValue('services'); track service) {
-            <cds-tag
-              [size]="'md'"
-              class="tag-dark me-2"
+            <div
+              cdsCol
+              [columnNumbers]="{ sm: 2, md: 2, lg: 2 }"
             >
-              {{ service }}
-            </cds-tag>
-            }
+              <legend
+                class="cds--label mb-0"
+                i18n
+              >
+                Services
+              </legend>
+            </div>
+            <div
+              cdsCol
+              [columnNumbers]="{ sm: 6, md: 6, lg: 6 }"
+            >
+              @for (service of configForm.getValue('services'); track service) {
+                <cds-tag
+                  [size]="'md'"
+                  class="tag-dark me-2"
+                >
+                  {{ service }}
+                </cds-tag>
+              }
+            </div>
           </div>
-        </div>
         }
 
         <!-- Values -->
@@ -140,94 +144,109 @@
 
           @for (section of availSections; track section) {
             @if (type === 'bool') {
-            <div
-              cdsRow
-              class="form-item"
-            >
-              <cds-select
-                [formControlName]="section"
-                [label]="section"
-                [id]="section"
-                [labelInputID]="section"
-                cdValidate
-                #sectionValidate="cdValidate"
-                [invalid]="sectionValidate.isInvalid"
-                [invalidText]="sectionErrors"
+              <div
+                cdsRow
+                class="form-item"
               >
-                <option
-                  [ngValue]="null"
-                  i18n
-                >-- Default --</option>
-                <option
-                  [ngValue]="true"
-                  i18n
-                >true</option>
-                <option
-                  [ngValue]="false"
-                  i18n
-                >false</option>
-              </cds-select>
-              <ng-template #sectionErrors>
-                <ng-container
-                  *ngTemplateOutlet="validationErrors; context: { control: configForm.get(section) }"
-                ></ng-container>
-              </ng-template>
-            </div>
+                <cds-select
+                  [formControlName]="section"
+                  [label]="section"
+                  [id]="section"
+                  [labelInputID]="section"
+                  cdValidate
+                  #sectionValidate="cdValidate"
+                  [invalid]="sectionValidate.isInvalid"
+                  [invalidText]="sectionErrors"
+                >
+                  <option
+                    [ngValue]="null"
+                    i18n
+                  >
+                    -- Default --
+                  </option>
+                  <option
+                    [ngValue]="true"
+                    i18n
+                  >
+                    true
+                  </option>
+                  <option
+                    [ngValue]="false"
+                    i18n
+                  >
+                    false
+                  </option>
+                </cds-select>
+                <ng-template #sectionErrors>
+                  <ng-container
+                    *ngTemplateOutlet="
+                      validationErrors;
+                      context: { control: configForm.get(section) }
+                    "
+                  ></ng-container>
+                </ng-template>
+              </div>
             }
 
             @if (type !== 'bool' && inputType === 'number') {
-            <div
-              cdsRow
-              class="form-item"
-            >
-              <cds-number
-                [formControlName]="section"
-                [label]="section"
-                [id]="section"
-                [step]="getStep(type, configForm.getValue(section))"
-                [min]="minValue"
-                [max]="maxValue"
-                cdValidate
-                #sectionValidate="cdValidate"
-                [invalid]="sectionValidate.isInvalid"
-                [invalidText]="sectionErrors"
+              <div
+                cdsRow
+                class="form-item"
               >
-              </cds-number>
-              <ng-template #sectionErrors>
-                <ng-container
-                  *ngTemplateOutlet="validationErrors; context: { control: configForm.get(section) }"
-                ></ng-container>
-              </ng-template>
-            </div>
+                <cds-number
+                  [formControlName]="section"
+                  [label]="section"
+                  [id]="section"
+                  [step]="getStep(type, configForm.getValue(section))"
+                  [min]="minValue"
+                  [max]="maxValue"
+                  cdValidate
+                  #sectionValidate="cdValidate"
+                  [invalid]="sectionValidate.isInvalid"
+                  [invalidText]="sectionErrors"
+                >
+                </cds-number>
+                <ng-template #sectionErrors>
+                  <ng-container
+                    *ngTemplateOutlet="
+                      validationErrors;
+                      context: { control: configForm.get(section) }
+                    "
+                  ></ng-container>
+                </ng-template>
+              </div>
             }
 
             @if (type !== 'bool' && inputType !== 'number') {
-            <div
-              cdsRow
-              class="form-item"
-            >
-              <cds-text-label
-                [labelInputID]="section"
-                [invalid]="sectionValidate.isInvalid"
-                [invalidText]="sectionErrors"
+              <div
+                cdsRow
+                class="form-item"
               >
-                {{ section }}
-                <input
-                  cdsText
-                  cdValidate
-                  #sectionValidate="cdValidate"
-                  [type]="inputType"
-                  [id]="section"
-                  [formControlName]="section"
+                <cds-text-label
+                  [labelInputID]="section"
                   [invalid]="sectionValidate.isInvalid"
-                />
-              </cds-text-label>
-              <ng-template #sectionErrors>
-                <ng-container
-                  *ngTemplateOutlet="validationErrors; context: { control: configForm.get(section) }"
-                ></ng-container>
-              </ng-template>
-            </div>
+                  [invalidText]="sectionErrors"
+                >
+                  {{ section }}
+                  <input
+                    cdsText
+                    cdValidate
+                    #sectionValidate="cdValidate"
+                    [type]="inputType"
+                    [id]="section"
+                    [formControlName]="section"
+                    [invalid]="sectionValidate.isInvalid"
+                  />
+                </cds-text-label>
+                <ng-template #sectionErrors>
+                  <ng-container
+                    *ngTemplateOutlet="
+                      validationErrors;
+                      context: { control: configForm.get(section) }
+                    "
+                  ></ng-container>
+                </ng-template>
+              </div>
             }
           }
         </div>
@@ -251,19 +270,21 @@
 >
   @if (control?.invalid && (control.dirty || control.touched)) {
     @if (control.hasError('min')) {
-    <span
-      class="invalid-feedback"
-      i18n
-    >The entered value is too low! It must not be lower than {{ minValue }}.</span>
+      <span
+        class="invalid-feedback"
+        i18n
+        >The entered value is too low! It must not be lower than {{ minValue }}.</span
+      >
     }
     @if (control.hasError('max')) {
-    <span
-      class="invalid-feedback"
-      i18n
-    >The entered value is too high! It must not be greater than {{ maxValue }}.</span>
+      <span
+        class="invalid-feedback"
+        i18n
+        >The entered value is too high! It must not be greater than {{ maxValue }}.</span
+      >
     }
     @if (control.hasError('pattern') || control.hasError('invalidUuid')) {
-    <span class="invalid-feedback">{{ patternHelpText }}</span>
+      <span class="invalid-feedback">{{ patternHelpText }}</span>
     }
   }
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration.component.html
index 6574adba2f9..15699ebe0eb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/configuration/configuration.component.html
@@ -1,26 +1,34 @@
-<cd-table [data]="data"
-          (fetchData)="getConfigurationList($event)"
-          [columns]="columns"
-          [extraFilterableColumns]="filters"
-          selectionType="single"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="data"
+  (fetchData)="getConfigurationList($event)"
+  [columns]="columns"
+  [extraFilterableColumns]="filters"
+  selectionType="single"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-configuration-details *cdTableDetail
-                            [selection]="expandedRow">
+  <cd-configuration-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-configuration-details>
 </cd-table>
 
-<ng-template #confValTpl
-             let-value="data.value">
+<ng-template
+  #confValTpl
+  let-value="data.value"
+>
   <span *ngIf="value">
     <span *ngFor="let conf of value; last as isLast">
-      {{ conf.section }}: {{ conf.value }}{{ !isLast ? "," : "" }}<br />
+      {{ conf.section }}: {{ conf.value }}{{ !isLast ? ',' : '' }}<br />
     </span>
   </span>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-review.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-review.component.html
index 81e55da3e68..faad2b809be 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-review.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-review.component.html
@@ -1,13 +1,23 @@
 <div cdsRow>
   <div cdsCol>
     <fieldset>
-      <legend class="cd-header"
-              i18n>Cluster Resources</legend>
-      <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
+      <legend
+        class="cd-header"
+        i18n
+      >
+        Cluster Resources
+      </legend>
+      <table
+        class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+      >
         <tbody>
           <tr>
-            <td i18n
-                class="bold">Hosts</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Hosts
+            </td>
             <td>{{ hostsCount }}</td>
           </tr>
           <tr *ngIf="!isSimpleDeployment; else simpleDeploymentTextTpl">
@@ -24,17 +34,29 @@
                 </dd>
               </dl>
             </td>
-            <td class="pt-5"><p>{{ totalDevices }}</p><p>
-              {{ totalCapacity | dimlessBinary }}</p></td>
+            <td class="pt-5">
+              <p>{{ totalDevices }}</p>
+              <p>
+                {{ totalCapacity | dimlessBinary }}
+              </p>
+            </td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">CPUs</td>
+            <td
+              i18n
+              class="bold"
+            >
+              CPUs
+            </td>
             <td>{{ totalCPUs | empty }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Memory</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Memory
+            </td>
             <td>{{ totalMemory | empty }}</td>
           </tr>
         </tbody>
@@ -44,14 +66,20 @@
 </div>
 <div cdsRow>
   <div cdsCol>
-    <legend i18n
-            class="cd-header">Host Details</legend>
-    <cd-hosts [hiddenColumns]="['service_instances', 'status']"
-              [hideToolHeader]="true"
-              [hasTableDetails]="false"
-              [showGeneralActionsOnly]="true"
-              [showExpandClusterBtn]="false"
-              [showInlineActions]="false">
+    <legend
+      i18n
+      class="cd-header"
+    >
+      Host Details
+    </legend>
+    <cd-hosts
+      [hiddenColumns]="['service_instances', 'status']"
+      [hideToolHeader]="true"
+      [hasTableDetails]="false"
+      [showGeneralActionsOnly]="true"
+      [showExpandClusterBtn]="false"
+      [showInlineActions]="false"
+    >
     </cd-hosts>
   </div>
 </div>
@@ -61,7 +89,7 @@
       <span i18n>Storage Capacity</span>
     </td>
     <td>
-      <span i18n>{{deploymentDescText}}</span>
+      <span i18n>{{ deploymentDescText }}</span>
     </td>
   </tr>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-1/create-cluster-step-1.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-1/create-cluster-step-1.component.html
index 23ff0df4df1..8cd485292b0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-1/create-cluster-step-1.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-1/create-cluster-step-1.component.html
@@ -1,15 +1,21 @@
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8, lg: 16}">
-        <h4 i18n>Add Hosts</h4>
+<div
+  cdsGrid
+  [useCssGrid]="true"
+  [narrow]="true"
+  [fullWidth]="true"
+>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 16 }"
+  >
+    <h4 i18n>Add Hosts</h4>
 
-        <cd-hosts [hiddenColumns]="['service_instances']"
-                [hideMaintenance]="true"
-                [hasTableDetails]="false"
-                [showGeneralActionsOnly]="true"
-                [showExpandClusterBtn]="false"></cd-hosts>
-    </div>
-</div>    
\ No newline at end of file
+    <cd-hosts
+      [hiddenColumns]="['service_instances']"
+      [hideMaintenance]="true"
+      [hasTableDetails]="false"
+      [showGeneralActionsOnly]="true"
+      [showExpandClusterBtn]="false"
+    ></cd-hosts>
+  </div>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
index 0b160412a79..157cca6ed2f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-2/create-cluster-step-2.component.html
@@ -1,33 +1,44 @@
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 16}">
-
+<div
+  cdsGrid
+  [useCssGrid]="true"
+  [narrow]="true"
+  [fullWidth]="true"
+>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 16 }"
+  >
     <h4 i18n>Create OSDs</h4>
 
     <div>
       @if (showForm) {
-        <cd-osd-form [hideTitle]="true"
-                     (emitDriveGroup)="setDriveGroup($event)"
-                     (emitDeploymentOption)="setDeploymentOptions($event)"
-                     (emitMode)="setDeploymentMode($event)"
-                     (osdCreated)="onOsdCreated()"
-                     (cancelled)="onFormCancelled()"></cd-osd-form>
+        <cd-osd-form
+          [hideTitle]="true"
+          (emitDriveGroup)="setDriveGroup($event)"
+          (emitDeploymentOption)="setDeploymentOptions($event)"
+          (emitMode)="setDeploymentMode($event)"
+          (osdCreated)="onOsdCreated()"
+          (cancelled)="onFormCancelled()"
+        ></cd-osd-form>
       } @else {
-        <cd-osd-list [showTabs]="false"
-                     [inlineCreate]="true"
-                     (createAction)="onCreateAction()"></cd-osd-list>
+        <cd-osd-list
+          [showTabs]="false"
+          [inlineCreate]="true"
+          (createAction)="onCreateAction()"
+        ></cd-osd-list>
       }
     </div>
 
-    <button cdsButton="secondary"
-            class="cds-mt-4"
-            id="skipStepBtn"
-            (click)="onSkip()"
-            aria-label="Skip this step"
-            type="button"
-            i18n>Skip</button>
+    <button
+      type="button"
+      cdsButton="secondary"
+      class="cds-mt-4"
+      id="skipStepBtn"
+      (click)="onSkip()"
+      aria-label="Skip this step"
+      i18n
+    >
+      Skip
+    </button>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-3/create-cluster-step-3.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-3/create-cluster-step-3.component.html
index 4beaf46b679..a65580cd5af 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-3/create-cluster-step-3.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-3/create-cluster-step-3.component.html
@@ -1,15 +1,20 @@
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 16}">
-
+<div
+  cdsGrid
+  [useCssGrid]="true"
+  [narrow]="true"
+  [fullWidth]="true"
+>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 16 }"
+  >
     <h4 18n>Create Services</h4>
 
-    <cd-services [hasDetails]="false"
-                [hiddenServices]="['mon', 'mgr', 'crash', 'agent']"
-                [hiddenColumns]="['status.running', 'status.size', 'status.last_refresh']"
-                [routedModal]="false"></cd-services>
+    <cd-services
+      [hasDetails]="false"
+      [hiddenServices]="['mon', 'mgr', 'crash', 'agent']"
+      [hiddenColumns]="['status.running', 'status.size', 'status.last_refresh']"
+      [routedModal]="false"
+    ></cd-services>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-4/create-cluster-step-4.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-4/create-cluster-step-4.component.html
index 984b16bf9f5..a459831a1c6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-4/create-cluster-step-4.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster-step-4/create-cluster-step-4.component.html
@@ -1,9 +1,13 @@
-<div cdsGrid
-     [useCssGrid]="true"
-     [narrow]="true"
-     [fullWidth]="true">
-  <div cdsCol
-       [columnNumbers]="{sm: 4, md: 8, lg: 16}">
+<div
+  cdsGrid
+  [useCssGrid]="true"
+  [narrow]="true"
+  [fullWidth]="true"
+>
+  <div
+    cdsCol
+    [columnNumbers]="{ sm: 4, md: 8, lg: 16 }"
+  >
     <cd-create-cluster-review></cd-create-cluster-review>
   </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
index 7ade7992055..224ecef3b4f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
@@ -1,204 +1,282 @@
 @if (startClusterCreation) {
-<div class="container-fluid-main">
-  <div cdsRow
-       class="cds-ml-5 cds-mt-6">
-    <div cdsCol
-         [columnNumbers]="{'lg': 13, 'md': 8, 'sm': 8}">
-      <div class="mb-4">
-        <!-- htmllint img-req-src="false" -->
-        <img [src]="projectConstants.cephLogo"
-             alt="Ceph"
-             class="ceph-logo">
-      </div>
+  <div class="container-fluid-main">
+    <div
+      cdsRow
+      class="cds-ml-5 cds-mt-6"
+    >
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 13, md: 8, sm: 8 }"
+      >
+        <div class="mb-4">
+          <!-- htmllint img-req-src="false" -->
+          <img
+            [src]="projectConstants.cephLogo"
+            alt="Ceph"
+            class="ceph-logo"
+          />
+        </div>
 
-      <div class="mb-4">
-        <span class="cds--type-fluid-heading-05"
-              i18n>Welcome to {{ projectConstants.projectName }}
-        </span>
-      </div>
-
-      <div class="mb-2">
-        <span class="cds--type-fluid-heading-04"
-              i18n>Your Ceph cluster is initialized and running.
-        </span>
-      </div>
-
-      <div class="mb-5">
-        <span class="cds--type-body-compact-01"
-              i18n>
-          <cd-icon type="success"
-                   [size]="icons.size20">
-          </cd-icon>
-          The cluster control plane is ready.
-        </span>
-      </div>
-
-      <div class="mb-2">
-        <span class="cds--type-fluid-heading-03"
-              i18n>
-          <cd-icon type="ibmCloudBareMetalServer"
-                   [size]="icons.size20">
-          </cd-icon>
-          Add storage to begin using your cluster.
-        </span>
-      </div>
-
-      <div class="mb-2">
-        <span class="cds--type-body-01"
-              i18n>Set up storage for your cluster to run workloads and store data. You can configure storage and data services now, or skip and configure them later.</span>
-      </div>
-
-      <cds-tile class="border-subtle no-border-bottom"
-                [cdsLayer]="1">
-        <div cdsStack="horizontal"
-             gap="3">
-          <span class="cds--type-heading-compact-02"
-                i18n>
-            Storage requirements
+        <div class="mb-4">
+          <span
+            class="cds--type-fluid-heading-05"
+            i18n
+            >Welcome to {{ projectConstants.projectName }}
           </span>
-          <cd-icon type="infoCircle"
-                   [size]="icons.size20">
-          </cd-icon>
-        </div>
-      </cds-tile>
-
-      <cds-tile class="border-subtle mb-3"
-                [cdsLayer]="2">
-        <div cdsStack="horizontal"
-             gap="4">
-          <cd-icon type="ibmCloudDedicatedHost"
-                   [size]="icons.size20">
-          </cd-icon>
-          <div cdsStack="vertical"
-               gap="1">
-            <span class="cds--type-heading-compact-01"
-                  i18n>
-              Hosts
-            </span>
-            <span class="cds--type-body-compact-01 text-secondary"
-                  i18n>
-              Minimum 3 hosts required
-            </span>
-          </div>
         </div>
 
-        <hr/>
-
-        <div cdsStack="horizontal"
-             gap="4">
-          <cd-icon type="vmdkDisk"
-                   [size]="icons.size20">
-          </cd-icon>
-
-          <div cdsStack="vertical"
-               gap="1">
-            <span class="cds--type-heading-compact-01"
-                  i18n>
-              Disks
-            </span>
-
-            <span class="cds--type-body-compact-01 text-secondary"
-                  i18n>
-              At least 1 disk per host
-            </span>
-          </div>
-        </div>
-
-        <hr/>
-
-        <div cdsStack="horizontal"
-             gap="4">
-          <cd-icon type="clusterIcon"
-                   [size]="icons.size20">
-          </cd-icon>
-
-          <div cdsStack="vertical"
-               gap="1">
-            <span class="cds--type-heading-compact-01"
-                  i18n>
-              Data services (optional)
-            </span>
-
-            <span class="cds--type-body-compact-01 text-secondary"
-                  i18n>
-              Configure Object, Block, or File services
-            </span>
-          </div>
-        </div>
-      </cds-tile>
-
-      <div class="mb-3">
-        <cd-alert-panel type="info"
-                        [showTitle]="false">
-          <span class="cds--type-body-compact-01">
-              The cluster cannot store data until storage is added. If storage is already configured, continue to the cluster overview.
+        <div class="mb-2">
+          <span
+            class="cds--type-fluid-heading-04"
+            i18n
+            >Your Ceph cluster is initialized and running.
           </span>
-        </cd-alert-panel>
-      </div>
+        </div>
 
-      <div class="mb-5">
-        <button cdsButton="primary"
-                class="me-3"
-                (click)="createCluster()"
-                aria-label="Add Storage"
-                type="button"
-                i18n>
-          Add storage
-          <cd-icon
-            [cdsIcon]="icons.add"
-            [size]="icons.size20"
-            class="cds--btn__icon">
-          </cd-icon>
-        </button>
-        <button cdsButton="tertiary"
-                (click)="skipClusterCreation()"
-                aria-label="View cluster overview"
-                type="button"
-                i18n>
-          View cluster overview
-          <cd-icon
-            [cdsIcon]="icons.right"
-            [size]="icons.size20"
-            class="cds--btn__icon">
-          </cd-icon>
-        </button>
+        <div class="mb-5">
+          <span
+            class="cds--type-body-compact-01"
+            i18n
+          >
+            <cd-icon
+              type="success"
+              [size]="icons.size20"
+            >
+            </cd-icon>
+            The cluster control plane is ready.
+          </span>
+        </div>
+
+        <div class="mb-2">
+          <span
+            class="cds--type-fluid-heading-03"
+            i18n
+          >
+            <cd-icon
+              type="ibmCloudBareMetalServer"
+              [size]="icons.size20"
+            >
+            </cd-icon>
+            Add storage to begin using your cluster.
+          </span>
+        </div>
+
+        <div class="mb-2">
+          <span
+            class="cds--type-body-01"
+            i18n
+            >Set up storage for your cluster to run workloads and store data. You can configure
+            storage and data services now, or skip and configure them later.</span
+          >
+        </div>
+
+        <cds-tile
+          class="border-subtle no-border-bottom"
+          [cdsLayer]="1"
+        >
+          <div
+            cdsStack="horizontal"
+            gap="3"
+          >
+            <span
+              class="cds--type-heading-compact-02"
+              i18n
+            >
+              Storage requirements
+            </span>
+            <cd-icon
+              type="infoCircle"
+              [size]="icons.size20"
+            >
+            </cd-icon>
+          </div>
+        </cds-tile>
+
+        <cds-tile
+          class="border-subtle mb-3"
+          [cdsLayer]="2"
+        >
+          <div
+            cdsStack="horizontal"
+            gap="4"
+          >
+            <cd-icon
+              type="ibmCloudDedicatedHost"
+              [size]="icons.size20"
+            >
+            </cd-icon>
+            <div
+              cdsStack="vertical"
+              gap="1"
+            >
+              <span
+                class="cds--type-heading-compact-01"
+                i18n
+              >
+                Hosts
+              </span>
+              <span
+                class="cds--type-body-compact-01 text-secondary"
+                i18n
+              >
+                Minimum 3 hosts required
+              </span>
+            </div>
+          </div>
+
+          <hr />
+
+          <div
+            cdsStack="horizontal"
+            gap="4"
+          >
+            <cd-icon
+              type="vmdkDisk"
+              [size]="icons.size20"
+            >
+            </cd-icon>
+
+            <div
+              cdsStack="vertical"
+              gap="1"
+            >
+              <span
+                class="cds--type-heading-compact-01"
+                i18n
+              >
+                Disks
+              </span>
+
+              <span
+                class="cds--type-body-compact-01 text-secondary"
+                i18n
+              >
+                At least 1 disk per host
+              </span>
+            </div>
+          </div>
+
+          <hr />
+
+          <div
+            cdsStack="horizontal"
+            gap="4"
+          >
+            <cd-icon
+              type="clusterIcon"
+              [size]="icons.size20"
+            >
+            </cd-icon>
+
+            <div
+              cdsStack="vertical"
+              gap="1"
+            >
+              <span
+                class="cds--type-heading-compact-01"
+                i18n
+              >
+                Data services (optional)
+              </span>
+
+              <span
+                class="cds--type-body-compact-01 text-secondary"
+                i18n
+              >
+                Configure Object, Block, or File services
+              </span>
+            </div>
+          </div>
+        </cds-tile>
+
+        <div class="mb-3">
+          <cd-alert-panel
+            type="info"
+            [showTitle]="false"
+          >
+            <span class="cds--type-body-compact-01">
+              The cluster cannot store data until storage is added. If storage is already
+              configured, continue to the cluster overview.
+            </span>
+          </cd-alert-panel>
+        </div>
+
+        <div class="mb-5">
+          <button
+            cdsButton="primary"
+            class="me-3"
+            (click)="createCluster()"
+            aria-label="Add Storage"
+            type="button"
+            i18n
+          >
+            Add storage
+            <cd-icon
+              [cdsIcon]="icons.add"
+              [size]="icons.size20"
+              class="cds--btn__icon"
+            >
+            </cd-icon>
+          </button>
+          <button
+            cdsButton="tertiary"
+            (click)="skipClusterCreation()"
+            aria-label="View cluster overview"
+            type="button"
+            i18n
+          >
+            View cluster overview
+            <cd-icon
+              [cdsIcon]="icons.right"
+              [size]="icons.size20"
+              class="cds--btn__icon"
+            >
+            </cd-icon>
+          </button>
+        </div>
       </div>
     </div>
   </div>
-</div>
-}
 
-@else {
-<cd-tearsheet
-  type="full"
-  [steps]="steps"
-  [title]="title"
-  [description]="description"
-  [submitButtonLabel]="submitButtonLabel"
-  [isSubmitLoading]="isSubmitLoading"
-  (submitRequested)="onSubmit()"
-  [overflowScroll]="'auto'">
-  <cd-tearsheet-step>
-    <cd-create-cluster-step-1 #tearsheetStep></cd-create-cluster-step-1>
-  </cd-tearsheet-step>
-  <cd-tearsheet-step>
-    <cd-create-cluster-step-2
-      #tearsheetStep
-      (skipStep)="onSkipOsdStep()"></cd-create-cluster-step-2>
-  </cd-tearsheet-step>
-  <cd-tearsheet-step>
-    <cd-create-cluster-step-3 #tearsheetStep></cd-create-cluster-step-3>
-  </cd-tearsheet-step>
-  <cd-tearsheet-step>
-    <cd-create-cluster-step-4 #tearsheetStep></cd-create-cluster-step-4>
-  </cd-tearsheet-step>
-</cd-tearsheet>
+} @else {
+  <cd-tearsheet
+    type="full"
+    [steps]="steps"
+    [title]="title"
+    [description]="description"
+    [submitButtonLabel]="submitButtonLabel"
+    [isSubmitLoading]="isSubmitLoading"
+    (submitRequested)="onSubmit()"
+    [overflowScroll]="'auto'"
+  >
+    <cd-tearsheet-step>
+      <cd-create-cluster-step-1 #tearsheetStep></cd-create-cluster-step-1>
+    </cd-tearsheet-step>
+    <cd-tearsheet-step>
+      <cd-create-cluster-step-2
+        #tearsheetStep
+        (skipStep)="onSkipOsdStep()"
+      ></cd-create-cluster-step-2>
+    </cd-tearsheet-step>
+    <cd-tearsheet-step>
+      <cd-create-cluster-step-3 #tearsheetStep></cd-create-cluster-step-3>
+    </cd-tearsheet-step>
+    <cd-tearsheet-step>
+      <cd-create-cluster-step-4 #tearsheetStep></cd-create-cluster-step-4>
+    </cd-tearsheet-step>
+  </cd-tearsheet>
 }
 
 <ng-template #skipConfirmTpl>
-  <span i18n>You are about to skip the storage setup process.
-             You'll need to <strong>navigate through the menu to add hosts and services.</strong></span>
+  <span i18n
+    >You are about to skip the storage setup process. You'll need to
+    <strong>navigate through the menu to add hosts and services.</strong></span
+  >
 
-  <div class="cds-mt-4"
-       i18n>Are you sure you want to continue?</div>
+  <div
+    class="cds-mt-4"
+    i18n
+  >
+    Are you sure you want to continue?
+  </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.html
index 804728c35c2..19f2906485b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.html
@@ -1,51 +1,78 @@
 <div class="row">
   <div class="col-sm-12 col-lg-12">
     <div class="card">
-      <div class="card-header"
-           i18n>CRUSH map viewer</div>
+      <div
+        class="card-header"
+        i18n
+      >
+        CRUSH map viewer
+      </div>
       <div class="card-body">
         <div class="row">
           <div class="col-sm-6 col-lg-6 tree-container">
-            <cds-loading *ngIf="loadingIndicator"
-                         [isActive]="true"
-                         [overlay]="false"
-                         size="sm"></cds-loading>
-            <cds-tree-view #tree
-                           [isMultiSelect]="false"
-                           (select)="onNodeSelected($event)">
-              <ng-template #nodeTemplateRef
-                           let-node="node"
-                           let-depth="depth">
-                <cds-tree-node [node]="node"
-                               [depth]="depth">
+            <cds-loading
+              *ngIf="loadingIndicator"
+              [isActive]="true"
+              [overlay]="false"
+              size="sm"
+            ></cds-loading>
+            <cds-tree-view
+              #tree
+              [isMultiSelect]="false"
+              (select)="onNodeSelected($event)"
+            >
+              <ng-template
+                #nodeTemplateRef
+                let-node="node"
+                let-depth="depth"
+              >
+                <cds-tree-node
+                  [node]="node"
+                  [depth]="depth"
+                >
                   <ng-container *ngIf="node?.children && node?.children?.length">
-                    <ng-container *ngFor="let child of node.children; let i = index;">
+                    <ng-container *ngFor="let child of node.children; let i = index">
                       <!-- Increase the depth by 1 -->
-                      <ng-container *ngTemplateOutlet="nodeTemplateRef; context: { node: child, depth: depth + 1 };">
+                      <ng-container
+                        *ngTemplateOutlet="
+                          nodeTemplateRef;
+                          context: { node: child, depth: depth + 1 }
+                        "
+                      >
                       </ng-container>
                     </ng-container>
                   </ng-container>
                 </cds-tree-node>
               </ng-template>
-              <ng-template #tag
-                           let-data>
-                <cds-tag *ngIf="data?.status"
-                         [class]="getStatusClasses(data.status)">
+              <ng-template
+                #tag
+                let-data
+              >
+                <cds-tag
+                  *ngIf="data?.status"
+                  [class]="getStatusClasses(data.status)"
+                >
                   {{ data?.status }}
                 </cds-tag>
                 <span>&nbsp;</span>
-                <span class="node-name"
-                      [ngClass]="{'type-osd': data?.type === 'osd'}"
-                      [innerHTML]="data?.name"></span>
+                <span
+                  class="node-name"
+                  [ngClass]="{ 'type-osd': data?.type === 'osd' }"
+                  [innerHTML]="data?.name"
+                ></span>
               </ng-template>
               <ng-container *ngFor="let node of nodes">
-                <ng-container *ngTemplateOutlet="nodeTemplateRef; context: { node: node, depth: 0 };">
+                <ng-container
+                  *ngTemplateOutlet="nodeTemplateRef; context: { node: node, depth: 0 }"
+                >
                 </ng-container>
               </ng-container>
             </cds-tree-view>
           </div>
-          <div class="col-sm-6 col-lg-6 metadata"
-               *ngIf="metadata">
+          <div
+            class="col-sm-6 col-lg-6 metadata"
+            *ngIf="metadata"
+          >
             <legend>{{ metadataTitle }}</legend>
             <div>
               <cd-table-key-value [data]="metadata"></cd-table-key-value>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html
index 1c91b7deead..a9a70e31b40 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details-section.component.html
@@ -7,18 +7,22 @@
       <cd-inventory [hostname]="hostname"></cd-inventory>
     }
     @case ('daemons') {
-      <cd-service-daemon-list [hostname]="hostname"
-                              flag="hostDetails"
-                              [hiddenColumns]="['hostname']">
+      <cd-service-daemon-list
+        [hostname]="hostname"
+        flag="hostDetails"
+        [hiddenColumns]="['hostname']"
+      >
       </cd-service-daemon-list>
     }
     @case ('performance-details') {
-      <cd-grafana i18n-title
-                  title="Host details"
-                  [grafanaPath]="'ceph-host-details?var-ceph_hosts=' + hostname"
-                  [type]="'metrics'"
-                  uid="rtOg0AiWz"
-                  grafanaStyle="five">
+      <cd-grafana
+        i18n-title
+        title="Host details"
+        [grafanaPath]="'ceph-host-details?var-ceph_hosts=' + hostname"
+        [type]="'metrics'"
+        uid="rtOg0AiWz"
+        grafanaStyle="five"
+      >
       </cd-grafana>
     }
     @case ('device-health') {
@@ -26,6 +30,9 @@
     }
   }
 } @else {
-  <cd-alert-panel type="error"
-                  i18n>No hostname found.</cd-alert-panel>
+  <cd-alert-panel
+    type="error"
+    i18n
+    >No hostname found.</cd-alert-panel
+  >
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-form/host-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-form/host-form.component.html
index 99a7258edf9..963dc1affcb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-form/host-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-form/host-form.component.html
@@ -1,107 +1,151 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="true">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="true"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
   <ng-container *cdFormLoading="loading">
-  <form name="hostForm"
-        #formDir="ngForm"
-        [formGroup]="hostForm"
-        novalidate>
-    <div cdsModalContent>
-      <!-- Hostname -->
-      <div class="form-item">
-        <cds-text-label for="hostname"
-                        [invalid]="!hostForm.controls.hostname.valid && hostForm.controls.hostname.dirty"
-                        [invalidText]="hostnameError">
-          <ng-container i18n>Hostname (required)</ng-container>
-          <input cdsText
-                 type="text"
-                 placeholder="mon-123"
-                 id="hostname"
-                 name="hostname"
-                 formControlName="hostname"
-                 autofocus
-                 [invalid]="!hostForm.controls.hostname.valid && hostForm.controls.hostname.dirty"
-                 (keyup)="checkHostNameValue()">
-        </cds-text-label>
-        <ng-template #hostnameError>
-          <span *ngIf="hostForm.showError('hostname', formDir, 'required')"
-                class="invalid-feedback">
-            <ng-container i18n> This field is required. </ng-container>
-          </span>
-          <span *ngIf="hostForm.showError('hostname', formDir, 'uniqueName')"
-                class="invalid-feedback">
-            <ng-container i18n> The chosen hostname is already in use. </ng-container>
-          </span>
-        </ng-template>
-        <cd-help-text>
-          To add multiple hosts at once, you can enter:
-          <ul cdsList>
-            <li cdsListItem
-                i18n>a comma-separated list of hostnames <b>(e.g.: example-01,example-02,example-03)</b>,</li>
-            <li cdsListItem
-                i18n>a range expression <b>(e.g.: example-[01-03].ceph)</b>,</li>
-            <li cdsListItem
-                i18n>a comma separated range expression <b>(e.g.: example-[01-05].lab.com,example2-[1-4].lab.com,example3-[001-006].lab.com)</b></li>
-          </ul>
-        </cd-help-text>
+    <form
+      name="hostForm"
+      #formDir="ngForm"
+      [formGroup]="hostForm"
+      novalidate
+    >
+      <div cdsModalContent>
+        <!-- Hostname -->
+        <div class="form-item">
+          <cds-text-label
+            for="hostname"
+            [invalid]="!hostForm.controls.hostname.valid && hostForm.controls.hostname.dirty"
+            [invalidText]="hostnameError"
+          >
+            <ng-container i18n>Hostname (required)</ng-container>
+            <input
+              cdsText
+              type="text"
+              placeholder="mon-123"
+              id="hostname"
+              name="hostname"
+              formControlName="hostname"
+              autofocus
+              [invalid]="!hostForm.controls.hostname.valid && hostForm.controls.hostname.dirty"
+              (keyup)="checkHostNameValue()"
+            />
+          </cds-text-label>
+          <ng-template #hostnameError>
+            <span
+              *ngIf="hostForm.showError('hostname', formDir, 'required')"
+              class="invalid-feedback"
+            >
+              <ng-container i18n> This field is required. </ng-container>
+            </span>
+            <span
+              *ngIf="hostForm.showError('hostname', formDir, 'uniqueName')"
+              class="invalid-feedback"
+            >
+              <ng-container i18n> The chosen hostname is already in use. </ng-container>
+            </span>
+          </ng-template>
+          <cd-help-text>
+            To add multiple hosts at once, you can enter:
+            <ul cdsList>
+              <li
+                cdsListItem
+                i18n
+              >
+                a comma-separated list of hostnames <b>(e.g.: example-01,example-02,example-03)</b>,
+              </li>
+              <li
+                cdsListItem
+                i18n
+              >
+                a range expression <b>(e.g.: example-[01-03].ceph)</b>,
+              </li>
+              <li
+                cdsListItem
+                i18n
+              >
+                a comma separated range expression
+                <b
+                  >(e.g.:
+                  example-[01-05].lab.com,example2-[1-4].lab.com,example3-[001-006].lab.com)</b
+                >
+              </li>
+            </ul>
+          </cd-help-text>
+        </div>
+        <!-- Address -->
+        <div
+          class="form-item"
+          *ngIf="!hostPattern"
+        >
+          <cds-text-label
+            label="Network address"
+            for="addr"
+            i18n
+            >Network address
+            <input
+              cdsText
+              type="text"
+              placeholder="192.168.0.1"
+              id="addr"
+              name="addr"
+              formControlName="addr"
+            />
+          </cds-text-label>
+          <ng-template #hostaddrError>
+            <span *ngIf="hostForm.showError('addr', formDir, 'pattern')">
+              <ng-container i18n> The value is not a valid IP address. </ng-container>
+            </span>
+          </ng-template>
+        </div>
+        <!-- Labels -->
+        <div class="form-item">
+          <cds-combo-box
+            label="Labels"
+            type="multi"
+            selectionFeedback="top-after-reopen"
+            for="labels"
+            name="labels"
+            formControlName="labels"
+            placeholder="Select Labels..."
+            i18n-placeholder
+            [appendInline]="true"
+            [items]="labelsOption"
+            itemValueKey="content"
+            id="labels"
+            cdDynamicInputCombobox
+            (updatedItems)="labelsOption = $event"
+            i18n
+          >
+            <cds-dropdown-list></cds-dropdown-list>
+          </cds-combo-box>
+        </div>
+        <!-- Maintenance Mode -->
+        <div *ngIf="!hideMaintenance">
+          <cds-checkbox
+            id="maintenance"
+            type="checkbox"
+            formControlName="maintenance"
+            i18n
+            >Maintenance Mode
+          </cds-checkbox>
+        </div>
       </div>
-      <!-- Address -->
-      <div class="form-item"
-           *ngIf="!hostPattern">
-        <cds-text-label label="Network address"
-                        for="addr"
-                        i18n>Network address
-          <input cdsText
-                 type="text"
-                 placeholder="192.168.0.1"
-                 id="addr"
-                 name="addr"
-                 formControlName="addr"/>
-        </cds-text-label>
-        <ng-template #hostaddrError>
-          <span *ngIf="hostForm.showError('addr', formDir, 'pattern')">
-            <ng-container i18n> The value is not a valid IP address. </ng-container>
-          </span>
-        </ng-template>
-      </div>
-      <!-- Labels -->
-      <div class="form-item">
-        <cds-combo-box label="Labels"
-                       type="multi"
-                       selectionFeedback="top-after-reopen"
-                       for="labels"
-                       name="labels"
-                       formControlName="labels"
-                       placeholder="Select Labels..."
-                       i18n-placeholder
-                       [appendInline]="true"
-                       [items]="labelsOption"
-                       itemValueKey="content"
-                       id="labels"
-                       cdDynamicInputCombobox
-                       (updatedItems)="labelsOption = $event"
-                       i18n>
-          <cds-dropdown-list></cds-dropdown-list>
-        </cds-combo-box>
-      </div>
-      <!-- Maintenance Mode -->
-      <div *ngIf="!hideMaintenance">
-        <cds-checkbox id="maintenance"
-                      type="checkbox"
-                      formControlName="maintenance"
-                      i18n>Maintenance Mode
-        </cds-checkbox>
-      </div>
-    </div>
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="hostForm"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [modalForm]="true">
-    </cd-form-button-panel>
-  </form>
-</ng-container>
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="hostForm"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        [modalForm]="true"
+      >
+      </cd-form-button-panel>
+    </form>
+  </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html
index 8f85391c666..efc88f5fea8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/hosts.component.html
@@ -1,53 +1,73 @@
-<nav ngbNav
-     #nav="ngbNav"
-     class="nav-tabs">
+<nav
+  ngbNav
+  #nav="ngbNav"
+  class="nav-tabs"
+>
   <ng-container ngbNavItem>
-    <a ngbNavLink
-       i18n>Hosts List</a>
+    <a
+      ngbNavLink
+      i18n
+      >Hosts List</a
+    >
     <ng-template ngbNavContent>
-      <cd-table #table
-                [data]="hosts"
-                [columns]="columns"
-                columnMode="flex"
-                (fetchData)="getHosts($event)"
-                selectionType="single"
-                [searchableObjects]="true"
-                [serverSide]="true"
-                [count]="count"
-                [maxLimit]="25"
-                (updateSelection)="updateSelection($event)"
-                [toolHeader]="!hideToolHeader">
+      <cd-table
+        #table
+        [data]="hosts"
+        [columns]="columns"
+        columnMode="flex"
+        (fetchData)="getHosts($event)"
+        selectionType="single"
+        [searchableObjects]="true"
+        [serverSide]="true"
+        [count]="count"
+        [maxLimit]="25"
+        (updateSelection)="updateSelection($event)"
+        [toolHeader]="!hideToolHeader"
+      >
         <div class="table-actions">
-          <cd-table-actions [permission]="permissions.hosts"
-                            [selection]="selection"
-                            class="btn-group"
-                            id="host-actions"
-                            [tableActions]="tableActions">
+          <cd-table-actions
+            [permission]="permissions.hosts"
+            [selection]="selection"
+            class="btn-group"
+            id="host-actions"
+            [tableActions]="tableActions"
+          >
           </cd-table-actions>
-          <cd-table-actions [permission]="permissions.hosts"
-                            [selection]="selection"
-                            btnColor="light"
-                            class="btn-group"
-                            [tableActions]="expandClusterActions">
+          <cd-table-actions
+            [permission]="permissions.hosts"
+            [selection]="selection"
+            btnColor="light"
+            class="btn-group"
+            [tableActions]="expandClusterActions"
+          >
           </cd-table-actions>
         </div>
       </cd-table>
     </ng-template>
   </ng-container>
-  <ng-container ngbNavItem
-                *ngIf="permissions.grafana.read">
+  <ng-container
+    ngbNavItem
+    *ngIf="permissions.grafana.read"
+  >
   </ng-container>
-  <ng-container ngbNavItem
-                *ngIf="permissions.grafana.read">
-    <a ngbNavLink
-       i18n>Overall Performance</a>
+  <ng-container
+    ngbNavItem
+    *ngIf="permissions.grafana.read"
+  >
+    <a
+      ngbNavLink
+      i18n
+      >Overall Performance</a
+    >
     <ng-template ngbNavContent>
-      <cd-grafana i18n-title
-                  title="Host overview"
-                  [grafanaPath]="'ceph-hosts-overview?'"
-                  [type]="'metrics'"
-                  uid="y0KGL0iZz"
-                  grafanaStyle="two">
+      <cd-grafana
+        i18n-title
+        title="Host overview"
+        [grafanaPath]="'ceph-hosts-overview?'"
+        [type]="'metrics'"
+        uid="y0KGL0iZz"
+        grafanaStyle="two"
+      >
       </cd-grafana>
     </ng-template>
   </ng-container>
@@ -55,44 +75,58 @@
 
 <div [ngbNavOutlet]="nav"></div>
 
-<ng-template #servicesTpl
-             let-services="data.value">
+<ng-template
+  #servicesTpl
+  let-services="data.value"
+>
   <span *ngFor="let service of services">
-    <cd-label [key]="service['type']"
-              [value]="service['count']"
-              class="me-1"></cd-label>
+    <cd-label
+      [key]="service['type']"
+      [value]="service['count']"
+      class="me-1"
+    ></cd-label>
   </span>
 </ng-template>
 
-<ng-template #hostNameTpl
-             let-row="data.row">
+<ng-template
+  #hostNameTpl
+  let-row="data.row"
+>
   <span data-testid="hostname">
-    <a cdsLink
-       [routerLink]="[viewUrl, row.hostname | encodeUri]"
-       (click)="$event.stopPropagation()">
+    <a
+      cdsLink
+      [routerLink]="[viewUrl, row.hostname | encodeUri]"
+      (click)="$event.stopPropagation()"
+    >
       {{ row.hostname }}
-    </a>
-  </span><br>
-  <span class="text-muted fst-italic"
-        *ngIf="row.addr"
-        data-testid="ip-address">
+    </a> </span
+  ><br />
+  <span
+    class="text-muted fst-italic"
+    *ngIf="row.addr"
+    data-testid="ip-address"
+  >
     ({{ row.addr }})
   </span>
 </ng-template>
 
 <ng-template #maintenanceConfirmTpl>
-  <div *ngFor="let msg of errorMessage; let last=last">
+  <div *ngFor="let msg of errorMessage; let last = last">
     <ul *ngIf="!last || errorMessage.length === '1'">
       <li i18n>{{ msg }}</li>
     </ul>
   </div>
-  <ng-container i18n
-                *ngIf="showSubmit">Are you sure you want to continue?</ng-container>
+  <ng-container
+    i18n
+    *ngIf="showSubmit"
+    >Are you sure you want to continue?</ng-container
+  >
 </ng-template>
 
-
-<ng-template #hostMetricTmpl
-             let-value="data.value">
+<ng-template
+  #hostMetricTmpl
+  let-value="data.value"
+>
   <div *ngIf="validValue(value)">
     <span>{{ value }}</span>
   </div>
@@ -101,8 +135,10 @@
   </div>
 </ng-template>
 
-<ng-template #hostDimlessTmpl
-             let-value="data.value">
+<ng-template
+  #hostDimlessTmpl
+  let-value="data.value"
+>
   <div *ngIf="!validValue(value)">
     <span ngbTooltip="Not available. Data could not be fetched from Ceph">-</span>
   </div>
@@ -112,14 +148,20 @@
 </ng-template>
 
 <ng-template #orchTmpl>
-  <span i18n
-        i18n-ngbTooltip
-        ngbTooltip="Data will be available only if Orchestrator is available.">-</span>
+  <span
+    i18n
+    i18n-ngbTooltip
+    ngbTooltip="Data will be available only if Orchestrator is available."
+    >-</span
+  >
 </ng-template>
 
 <ng-template #flashTmpl>
-  <span i18n
-        i18n-ngbTooltip
-        ngbTooltip="SSD, NVMEs">Flash</span>
+  <span
+    i18n
+    i18n-ngbTooltip
+    ngbTooltip="SSD, NVMEs"
+    >Flash</span
+  >
 </ng-template>
 <router-outlet name="modal"></router-outlet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.html
index 54cee708d26..920bf8c77b3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory-devices/inventory-devices.component.html
@@ -1,16 +1,20 @@
-<cd-table [data]="devices"
-          [columns]="columns"
-          identifier="uid"
-          [forceIdentifier]="true"
-          [selectionType]="selectionType"
-          columnMode="flex"
-          (fetchData)="getDevices()"
-          [searchField]="false"
-          (updateSelection)="updateSelection($event)"
-          (columnFiltersChanged)="onColumnFiltersChanged($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="devices"
+  [columns]="columns"
+  identifier="uid"
+  [forceIdentifier]="true"
+  [selectionType]="selectionType"
+  columnMode="flex"
+  (fetchData)="getDevices()"
+  [searchField]="false"
+  (updateSelection)="updateSelection($event)"
+  (columnFiltersChanged)="onColumnFiltersChanged($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory.component.html
index 6ba0b700223..14b1c4ef4ee 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/inventory/inventory.component.html
@@ -3,11 +3,13 @@
   <legend i18n>Physical Disks</legend>
   <div class="row">
     <div class="col-md-12">
-      <cd-inventory-devices [devices]="devices"
-                            [hiddenColumns]="hostname === undefined ? [] : ['hostname']"
-                            selectionType="single"
-                            (fetchInventory)="refresh()"
-                            [orchStatus]="orchStatus">
+      <cd-inventory-devices
+        [devices]="devices"
+        [hiddenColumns]="hostname === undefined ? [] : ['hostname']"
+        selectionType="single"
+        (fetchInventory)="refresh()"
+        [orchStatus]="orchStatus"
+      >
       </cd-inventory-devices>
     </div>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html
index 3af0f126eb3..bf90c0612a4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/logs/logs.component.html
@@ -1,109 +1,145 @@
 <div *ngIf="contentData">
   <ng-container *ngTemplateOutlet="logFiltersTpl"></ng-container>
 
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="logs"
-       [cdStatefulTabDefault]="defaultTab"
-       [hidden]="!showNavLinks">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="logs"
+    [cdStatefulTabDefault]="defaultTab"
+    [hidden]="!showNavLinks"
+  >
     <ng-container ngbNavItem="cluster-logs">
-      <a ngbNavLink
-         i18n>Cluster Logs</a>
+      <a
+        ngbNavLink
+        i18n
+        >Cluster Logs</a
+      >
       <ng-template ngbNavContent>
         @if (clog) {
-        <div class="log-viewer"
-             [class.log-viewer--scrollable]="scrollable">
-          @if (clog.length && showClusterLogs && showDownloadCopyButton) {
-          <div class="log-actions">
-            <cd-download-button [objectItem]="clog"
-                                [textItem]="clogText"
-                                fileName="cluster_log">
-            </cd-download-button>
-            <cd-copy-2-clipboard-button [source]="clogText"
-                                        [byId]="false">
-            </cd-copy-2-clipboard-button>
-          </div>
-          }
-
-          <div class="log-entries">
-            @for (line of clog; track trackByLogEntry($index, line)) {
-            <div class="log-entry cds--type-code-01">
-              <span class="log-entry__timestamp ">{{ line.stamp | cdDate }}</span>
-              <span class="log-entry__priority"
-                    [ngClass]="'log-entry__priority--' + (line.priority | logPriority)">
-                {{ line.priority }}
-              </span>
-              <span class="log-entry__message"
-                    [innerHTML]="line.message | searchHighlight: search">
-              </span>
-            </div>
+          <div
+            class="log-viewer"
+            [class.log-viewer--scrollable]="scrollable"
+          >
+            @if (clog.length && showClusterLogs && showDownloadCopyButton) {
+              <div class="log-actions">
+                <cd-download-button
+                  [objectItem]="clog"
+                  [textItem]="clogText"
+                  fileName="cluster_log"
+                >
+                </cd-download-button>
+                <cd-copy-2-clipboard-button
+                  [source]="clogText"
+                  [byId]="false"
+                >
+                </cd-copy-2-clipboard-button>
+              </div>
             }
 
-            @if (clog.length === 0) {
-            <div class="log-viewer__empty">
-              <ng-container *ngTemplateOutlet="noEntriesTpl"></ng-container>
+            <div class="log-entries">
+              @for (line of clog; track trackByLogEntry($index, line)) {
+                <div class="log-entry cds--type-code-01">
+                  <span class="log-entry__timestamp">{{ line.stamp | cdDate }}</span>
+                  <span
+                    class="log-entry__priority"
+                    [ngClass]="'log-entry__priority--' + (line.priority | logPriority)"
+                  >
+                    {{ line.priority }}
+                  </span>
+                  <span
+                    class="log-entry__message"
+                    [innerHTML]="line.message | searchHighlight: search"
+                  >
+                  </span>
+                </div>
+              }
+
+              @if (clog.length === 0) {
+                <div class="log-viewer__empty">
+                  <ng-container *ngTemplateOutlet="noEntriesTpl"></ng-container>
+                </div>
+              }
             </div>
-            }
           </div>
-        </div>
         }
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="audit-logs">
-      <a ngbNavLink
-         i18n>Audit Logs</a>
+      <a
+        ngbNavLink
+        i18n
+        >Audit Logs</a
+      >
       <ng-template ngbNavContent>
         @if (audit_log && showAuditLogs) {
-        <div class="log-viewer">
-          @if (audit_log.length && showDownloadCopyButton) {
-          <div class="log-actions">
-            <cd-download-button [objectItem]="audit_log"
-                                [textItem]="auditLogText"
-                                fileName="audit_log">
-            </cd-download-button>
-            <cd-copy-2-clipboard-button [source]="auditLogText"
-                                        [byId]="false">
-            </cd-copy-2-clipboard-button>
-          </div>
-          }
-
-          <div class="log-entries">
-            @for (line of audit_log; track trackByLogEntry($index, line)) {
-            <div class="log-entry cds--type-code-01">
-              <span class="log-entry__timestamp">{{ line.stamp | cdDate }}</span>
-              <span class="log-entry__priority"
-                    [ngClass]="'log-entry__priority--' + (line.priority | logPriority)">
-                {{ line.priority }}
-              </span>
-              <span class="log-entry__message"
-                    [innerHTML]="line.message | searchHighlight: search">
-              </span>
-            </div>
+          <div class="log-viewer">
+            @if (audit_log.length && showDownloadCopyButton) {
+              <div class="log-actions">
+                <cd-download-button
+                  [objectItem]="audit_log"
+                  [textItem]="auditLogText"
+                  fileName="audit_log"
+                >
+                </cd-download-button>
+                <cd-copy-2-clipboard-button
+                  [source]="auditLogText"
+                  [byId]="false"
+                >
+                </cd-copy-2-clipboard-button>
+              </div>
             }
 
-            @if (audit_log.length === 0) {
-            <div class="log-viewer__empty">
-              <ng-container *ngTemplateOutlet="noEntriesTpl"></ng-container>
+            <div class="log-entries">
+              @for (line of audit_log; track trackByLogEntry($index, line)) {
+                <div class="log-entry cds--type-code-01">
+                  <span class="log-entry__timestamp">{{ line.stamp | cdDate }}</span>
+                  <span
+                    class="log-entry__priority"
+                    [ngClass]="'log-entry__priority--' + (line.priority | logPriority)"
+                  >
+                    {{ line.priority }}
+                  </span>
+                  <span
+                    class="log-entry__message"
+                    [innerHTML]="line.message | searchHighlight: search"
+                  >
+                  </span>
+                </div>
+              }
+
+              @if (audit_log.length === 0) {
+                <div class="log-viewer__empty">
+                  <ng-container *ngTemplateOutlet="noEntriesTpl"></ng-container>
+                </div>
+              }
             </div>
-            }
           </div>
-        </div>
         }
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="daemon-logs">
-      <a ngbNavLink
-         i18n>Daemon Logs</a>
+      <a
+        ngbNavLink
+        i18n
+        >Daemon Logs</a
+      >
       <ng-template ngbNavContent>
-        <ng-container *ngIf="showDaemonLogs && lokiServiceStatus$ | async as lokiServiceStatus ; else daemonLogsTpl ">
+        <ng-container
+          *ngIf="
+            showDaemonLogs && lokiServiceStatus$ | async as lokiServiceStatus;
+            else daemonLogsTpl
+          "
+        >
           <div *ngIf="alloyServiceStatus$ | async as alloyServiceStatus; else daemonLogsTpl">
-            <cd-grafana i18n-title
-                        title="Daemon logs"
-                        [grafanaPath]="'explore?'"
-                        [type]="'logs'"
-                        uid="CrAHE0iZz"
-                        grafanaStyle="three">
+            <cd-grafana
+              i18n-title
+              title="Daemon logs"
+              [grafanaPath]="'explore?'"
+              [type]="'logs'"
+              uid="CrAHE0iZz"
+              grafanaStyle="three"
+            >
             </cd-grafana>
           </div>
         </ng-container>
@@ -115,104 +151,147 @@
 </div>
 
 <ng-template #logFiltersTpl>
-  <div class="row mb-3"
-       *ngIf="showFilterTools">
-  <div class="col-lg-10 d-flex">
-    <div class="col-sm-1 me-3">
-      <label for="logs-priority"
-             class="fw-bold"
-             i18n>Priority:</label>
-      <select id="logs-priority"
-              class="form-select"
-              [(ngModel)]="priority"
-              (ngModelChange)="filterLogs()">
-        <option *ngFor="let prio of priorities"
-                [value]="prio.value">{{ prio.name }}</option>
-      </select>
-    </div>
+  <div
+    class="row mb-3"
+    *ngIf="showFilterTools"
+  >
+    <div class="col-lg-10 d-flex">
+      <div class="col-sm-1 me-3">
+        <label
+          for="logs-priority"
+          class="fw-bold"
+          i18n
+          >Priority:</label
+        >
+        <select
+          id="logs-priority"
+          class="form-select"
+          [(ngModel)]="priority"
+          (ngModelChange)="filterLogs()"
+        >
+          <option
+            *ngFor="let prio of priorities"
+            [value]="prio.value"
+          >
+            {{ prio.name }}
+          </option>
+        </select>
+      </div>
 
-    <div class="col-md-3 me-3">
-      <label for="logs-keyword"
-             class="fw-bold"
-             i18n>Keyword:</label>
-      <div class="input-group">
-        <span class="input-group-text">
-          <svg [cdsIcon]="icons.search"
-               [size]="icons.size16"
-               ></svg>
-        </span>
+      <div class="col-md-3 me-3">
+        <label
+          for="logs-keyword"
+          class="fw-bold"
+          i18n
+          >Keyword:</label
+        >
+        <div class="input-group">
+          <span class="input-group-text">
+            <svg
+              [cdsIcon]="icons.search"
+              [size]="icons.size16"
+            ></svg>
+          </span>
 
-        <input class="form-control"
-               id="logs-keyword"
-               type="text"
-               [(ngModel)]="search"
-               (keyup)="filterLogs()">
+          <input
+            class="form-control"
+            id="logs-keyword"
+            type="text"
+            [(ngModel)]="search"
+            (keyup)="filterLogs()"
+          />
 
-        <button type="button"
-                class="btn btn-light"
-                (click)="clearSearchKey()"
-                title="Clear">
-          <svg [cdsIcon]="icons.destroy"
-               [size]="icons.size16"
-               ></svg>
-        </button>
+          <button
+            type="button"
+            class="btn btn-light"
+            (click)="clearSearchKey()"
+            title="Clear"
+          >
+            <svg
+              [cdsIcon]="icons.destroy"
+              [size]="icons.size16"
+            ></svg>
+          </button>
+        </div>
+      </div>
+
+      <div class="col-md-3 me-3">
+        <label
+          for="logs-date"
+          class="fw-bold"
+          i18n
+          >Date:</label
+        >
+        <div class="input-group">
+          <input
+            class="form-control"
+            id="logs-date"
+            placeholder="YYYY-MM-DD"
+            ngbDatepicker
+            [maxDate]="maxDate"
+            #d="ngbDatepicker"
+            (click)="d.open()"
+            [(ngModel)]="selectedDate"
+            (ngModelChange)="filterLogs()"
+          />
+          <button
+            type="button"
+            class="btn btn-light"
+            (click)="clearDate()"
+            title="Clear"
+          >
+            <svg
+              [cdsIcon]="icons.destroy"
+              [size]="icons.size16"
+            ></svg>
+          </button>
+        </div>
+      </div>
+
+      <div class="col-md-5">
+        <legend
+          i18n
+          class="cds--label fw-bold"
+        >
+          Time range:
+        </legend>
+        <div class="d-flex">
+          <ngb-timepicker
+            [spinners]="false"
+            [(ngModel)]="startTime"
+            (ngModelChange)="filterLogs()"
+          ></ngb-timepicker>
+
+          <span class="mt-2">&nbsp;&mdash;&nbsp;</span>
+
+          <ngb-timepicker
+            [spinners]="false"
+            [(ngModel)]="endTime"
+            (ngModelChange)="filterLogs()"
+          ></ngb-timepicker>
+        </div>
       </div>
     </div>
-
-    <div class="col-md-3 me-3">
-      <label for="logs-date"
-             class="fw-bold"
-             i18n>Date:</label>
-      <div class="input-group">
-        <input class="form-control"
-               id="logs-date"
-               placeholder="YYYY-MM-DD"
-               ngbDatepicker
-               [maxDate]="maxDate"
-               #d="ngbDatepicker"
-               (click)="d.open()"
-               [(ngModel)]="selectedDate"
-               (ngModelChange)="filterLogs()">
-        <button type="button"
-                class="btn btn-light"
-                (click)="clearDate()"
-                title="Clear">
-          <svg [cdsIcon]="icons.destroy"
-               [size]="icons.size16"
-               ></svg>
-        </button>
-      </div>
-    </div>
-
-    <div class="col-md-5">
-      <legend i18n
-             class="cds--label fw-bold">Time range:</legend>
-      <div class="d-flex">
-      <ngb-timepicker [spinners]="false"
-                      [(ngModel)]="startTime"
-                      (ngModelChange)="filterLogs()"></ngb-timepicker>
-
-      <span class="mt-2">&nbsp;&mdash;&nbsp;</span>
-
-      <ngb-timepicker [spinners]="false"
-                      [(ngModel)]="endTime"
-                      (ngModelChange)="filterLogs()"></ngb-timepicker>
-    </div></div>
-  </div></div>
+  </div>
 </ng-template>
 
 <ng-template #noEntriesTpl>
   <span i18n>No log entries found. Please try to select different filter options.</span>
   <span>&nbsp;</span>
-  <a href="#"
-     (click)="resetFilter()"
-     i18n>Reset filter.</a>
+  <a
+    href="#"
+    (click)="resetFilter()"
+    i18n
+    >Reset filter.</a
+  >
 </ng-template>
 
 <ng-template #daemonLogsTpl>
-  <cd-alert-panel type="info"
-                  title="Loki/Alloy service not running"
-                  i18n-title>
-  <ng-container i18n>Please start the loki and alloy services to see these logs.</ng-container>
+  <cd-alert-panel
+    type="info"
+    title="Loki/Alloy service not running"
+    i18n-title
+  >
+    <ng-container i18n>Please start the loki and alloy services to see these logs.</ng-container>
   </cd-alert-panel>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-details/mgr-module-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-details/mgr-module-details.component.html
index 29cae36baff..c9da59b9404 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-details/mgr-module-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-details/mgr-module-details.component.html
@@ -1,4 +1,3 @@
 <ng-container *ngIf="selection">
-  <cd-table-key-value [data]="module_config">
-  </cd-table-key-value>
+  <cd-table-key-value [data]="module_config"> </cd-table-key-value>
 </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-form/mgr-module-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-form/mgr-module-form.component.html
index 693741120c2..dee4c862000 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-form/mgr-module-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-form/mgr-module-form.component.html
@@ -1,19 +1,30 @@
-<div class="cd-col-form"
-     *cdFormLoading="loading">
-  <form name="mgrModuleForm"
-        #frm="ngForm"
-        [formGroup]="mgrModuleForm"
-        novalidate>
+<div
+  class="cd-col-form"
+  *cdFormLoading="loading"
+>
+  <form
+    name="mgrModuleForm"
+    #frm="ngForm"
+    [formGroup]="mgrModuleForm"
+    novalidate
+  >
     <div class="card">
-      <div class="card-header"
-           i18n>Edit Manager module</div>
+      <div
+        class="card-header"
+        i18n
+      >
+        Edit Manager module
+      </div>
       <div class="card-body">
-        <div class="form-group row"
-             *ngFor="let moduleOption of moduleOptions | keyvalue">
-
+        <div
+          class="form-group row"
+          *ngFor="let moduleOption of moduleOptions | keyvalue"
+        >
           <!-- Field label -->
-          <label class="cd-col-form-label"
-                 for="{{ moduleOption.value.name }}">
+          <label
+            class="cd-col-form-label"
+            for="{{ moduleOption.value.name }}"
+          >
             {{ moduleOption.value.name }}
             <cd-helper *ngIf="moduleOption.value.long_desc || moduleOption.value.desc">
               {{ moduleOption.value.long_desc || moduleOption.value.desc | upperFirst }}
@@ -22,88 +33,138 @@
 
           <!-- Field control -->
           <!-- bool -->
-          <div class="cd-col-form-input"
-               *ngIf="moduleOption.value.type === 'bool'">
+          <div
+            class="cd-col-form-input"
+            *ngIf="moduleOption.value.type === 'bool'"
+          >
             <div class="custom-control custom-checkbox">
-              <input id="{{ moduleOption.value.name }}"
-                     type="checkbox"
-                     class="custom-control-input"
-                     formControlName="{{ moduleOption.value.name }}">
-              <label class="custom-control-label"
-                     for="{{ moduleOption.value.name }}"></label>
+              <input
+                id="{{ moduleOption.value.name }}"
+                type="checkbox"
+                class="custom-control-input"
+                formControlName="{{ moduleOption.value.name }}"
+              />
+              <label
+                class="custom-control-label"
+                for="{{ moduleOption.value.name }}"
+              ></label>
             </div>
           </div>
 
           <!-- addr|str|uuid -->
-          <div class="cd-col-form-input"
-               *ngIf="['addr', 'str', 'uuid'].includes(moduleOption.value.type)">
-            <input id="{{ moduleOption.value.name }}"
-                   class="form-control"
-                   type="text"
-                   formControlName="{{ moduleOption.value.name }}"
-                   *ngIf="moduleOption.value.enum_allowed.length === 0">
-            <select id="{{ moduleOption.value.name }}"
-                    class="form-select"
-                    formControlName="{{ moduleOption.value.name }}"
-                    *ngIf="moduleOption.value.enum_allowed.length > 0">
-              <option *ngFor="let value of moduleOption.value.enum_allowed"
-                      [ngValue]="value">
+          <div
+            class="cd-col-form-input"
+            *ngIf="['addr', 'str', 'uuid'].includes(moduleOption.value.type)"
+          >
+            <input
+              id="{{ moduleOption.value.name }}"
+              class="form-control"
+              type="text"
+              formControlName="{{ moduleOption.value.name }}"
+              *ngIf="moduleOption.value.enum_allowed.length === 0"
+            />
+            <select
+              id="{{ moduleOption.value.name }}"
+              class="form-select"
+              formControlName="{{ moduleOption.value.name }}"
+              *ngIf="moduleOption.value.enum_allowed.length > 0"
+            >
+              <option
+                *ngFor="let value of moduleOption.value.enum_allowed"
+                [ngValue]="value"
+              >
                 {{ value }}
               </option>
             </select>
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'invalidUuid')"
-                  i18n>The entered value is not a valid UUID, e.g.: 67dcac9f-2c03-4d6c-b7bd-1210b3a259a8</span>
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'pattern')"
-                  i18n>The entered value needs to be a valid IP address.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'invalidUuid')"
+              i18n
+              >The entered value is not a valid UUID, e.g.:
+              67dcac9f-2c03-4d6c-b7bd-1210b3a259a8</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'pattern')"
+              i18n
+              >The entered value needs to be a valid IP address.</span
+            >
           </div>
 
           <!-- uint|int|size|secs -->
-          <div class="cd-col-form-input"
-               *ngIf="['uint', 'int', 'size', 'secs'].includes(moduleOption.value.type)">
-            <input id="{{ moduleOption.value.name }}"
-                   class="form-control"
-                   type="number"
-                   formControlName="{{ moduleOption.value.name }}"
-                   min="{{ moduleOption.value.min }}"
-                   max="{{ moduleOption.value.max }}">
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'max')"
-                  i18n>The entered value is too high! It must be lower or equal to {{ moduleOption.value.max }}.</span>
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'min')"
-                  i18n>The entered value is too low! It must be greater or equal to {{ moduleOption.value.min }}.</span>
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'pattern')"
-                  i18n>The entered value needs to be a number.</span>
+          <div
+            class="cd-col-form-input"
+            *ngIf="['uint', 'int', 'size', 'secs'].includes(moduleOption.value.type)"
+          >
+            <input
+              id="{{ moduleOption.value.name }}"
+              class="form-control"
+              type="number"
+              formControlName="{{ moduleOption.value.name }}"
+              min="{{ moduleOption.value.min }}"
+              max="{{ moduleOption.value.max }}"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'max')"
+              i18n
+              >The entered value is too high! It must be lower or equal to
+              {{ moduleOption.value.max }}.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'min')"
+              i18n
+              >The entered value is too low! It must be greater or equal to
+              {{ moduleOption.value.min }}.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'pattern')"
+              i18n
+              >The entered value needs to be a number.</span
+            >
           </div>
 
           <!-- float -->
-          <div class="cd-col-form-input"
-               *ngIf="moduleOption.value.type === 'float'">
-            <input id="{{ moduleOption.value.name }}"
-                   class="form-control"
-                   type="number"
-                   formControlName="{{ moduleOption.value.name }}">
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'pattern')"
-                  i18n>The entered value needs to be a number or decimal.</span>
+          <div
+            class="cd-col-form-input"
+            *ngIf="moduleOption.value.type === 'float'"
+          >
+            <input
+              id="{{ moduleOption.value.name }}"
+              class="form-control"
+              type="number"
+              formControlName="{{ moduleOption.value.name }}"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="mgrModuleForm.showError(moduleOption.value.name, frm, 'pattern')"
+              i18n
+              >The entered value needs to be a number or decimal.</span
+            >
           </div>
-
         </div>
       </div>
       <div class="card-footer">
-        <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                              [form]="mgrModuleForm"
-                              [submitText]="actionLabels.UPDATE"
-                              wrappingClass="text-right"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [form]="mgrModuleForm"
+          [submitText]="actionLabels.UPDATE"
+          wrappingClass="text-right"
+        ></cd-form-button-panel>
       </div>
     </div>
   </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.html
index 8064b7ed2a4..86ce476f150 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/mgr-modules/mgr-module-list/mgr-module-list.component.html
@@ -1,20 +1,26 @@
-<cd-table #table
-          [autoReload]="false"
-          [data]="modules"
-          [columns]="columns"
-          columnMode="flex"
-          selectionType="single"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)"
-          identifier="module"
-          (fetchData)="getModuleList($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [autoReload]="false"
+  [data]="modules"
+  [columns]="columns"
+  columnMode="flex"
+  selectionType="single"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+  identifier="module"
+  (fetchData)="getModuleList($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-mgr-module-details *cdTableDetail
-                         [selection]="expandedRow">
+  <cd-mgr-module-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-mgr-module-details>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/monitor/monitor.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/monitor/monitor.component.html
index 72438079fb6..153825984d5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/monitor/monitor.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/monitor/monitor.component.html
@@ -1,45 +1,49 @@
 <fieldset>
-    @if(mon_status) {
-    <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
-        <tbody>
-          <tr>
-            <td i18n><B>Cluster ID</B></td>
-            <td>{{ mon_status.monmap.fsid }}</td>
-          </tr>
-          <tr>
-            <td i18n><B>monmap modified</B></td>
-            <td>{{ mon_status.monmap.modified | relativeDate }}</td>
-          </tr>
-          <tr>
-            <td i18n><B>monmap epoch</B></td>
-            <td>{{ mon_status.monmap.epoch }}</td>
-          </tr>
-          <tr>
-            <td i18n><B>quorum con</B></td>
-            <td>{{ mon_status.features.quorum_con }}</td>
-          </tr>
-          <tr>
-            <td i18n><B>quorum mon</B></td>
-            <td>{{ mon_status.features.quorum_mon }}</td>
-          </tr>
-          <tr>
-            <td i18n><B>required con</B></td>
-            <td>{{ mon_status.features.required_con }}</td>
-          </tr>
-          <tr>
-            <td i18n><B>required mon</B></td>
-            <td>{{ mon_status.features.required_mon }}</td>
-          </tr>
-        </tbody>
+  @if (mon_status) {
+    <table
+      class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+    >
+      <tbody>
+        <tr>
+          <td i18n><B>Cluster ID</B></td>
+          <td>{{ mon_status.monmap.fsid }}</td>
+        </tr>
+        <tr>
+          <td i18n><B>monmap modified</B></td>
+          <td>{{ mon_status.monmap.modified | relativeDate }}</td>
+        </tr>
+        <tr>
+          <td i18n><B>monmap epoch</B></td>
+          <td>{{ mon_status.monmap.epoch }}</td>
+        </tr>
+        <tr>
+          <td i18n><B>quorum con</B></td>
+          <td>{{ mon_status.features.quorum_con }}</td>
+        </tr>
+        <tr>
+          <td i18n><B>quorum mon</B></td>
+          <td>{{ mon_status.features.quorum_mon }}</td>
+        </tr>
+        <tr>
+          <td i18n><B>required con</B></td>
+          <td>{{ mon_status.features.required_con }}</td>
+        </tr>
+        <tr>
+          <td i18n><B>required mon</B></td>
+          <td>{{ mon_status.features.required_mon }}</td>
+        </tr>
+      </tbody>
     </table>
-    }
+  }
 </fieldset>
 
 <div class="cds-mt-4">
-    <cd-table [data]="quorum.data"
-            [columns]="quorum.columns"
-            [headerTitle]="title"
-            [headerDescription]="description"
-            (fetchData)="refresh()">
-    </cd-table>
+  <cd-table
+    [data]="quorum.data"
+    [columns]="quorum.columns"
+    [headerTitle]="title"
+    [headerDescription]="description"
+    (fetchData)="refresh()"
+  >
+  </cd-table>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-details/multi-cluster-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-details/multi-cluster-details.component.html
index 9209807d327..f836ad2628c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-details/multi-cluster-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-details/multi-cluster-details.component.html
@@ -1,21 +1,30 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       id="tabset-multi-cluster-details"
-       class="nav-tabs"
-       cdStatefulTab="multi-cluster-details">
-    <ng-container ngbNavItem="performance-details"
-                  *ngIf="permissions.grafana.read">
-      <a ngbNavLink
-         routerLink="performance-details"
-         i18n>Performance Details</a>
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    id="tabset-multi-cluster-details"
+    class="nav-tabs"
+    cdStatefulTab="multi-cluster-details"
+  >
+    <ng-container
+      ngbNavItem="performance-details"
+      *ngIf="permissions.grafana.read"
+    >
+      <a
+        ngbNavLink
+        routerLink="performance-details"
+        i18n
+        >Performance Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="Cluster details"
-                    [grafanaPath]="'ceph-cluster-overview?var-cluster=' + selectedClusterFsid"
-                    [type]="'metrics'"
-                    uid="edtb0oxdq"
-                    grafanaStyle="four">
+        <cd-grafana
+          i18n-title
+          title="Cluster details"
+          [grafanaPath]="'ceph-cluster-overview?var-cluster=' + selectedClusterFsid"
+          [type]="'metrics'"
+          uid="edtb0oxdq"
+          grafanaStyle="four"
+        >
         </cd-grafana>
       </ng-template>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-form/multi-cluster-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-form/multi-cluster-form.component.html
index a6b2b1bdad4..a7f22a65d07 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-form/multi-cluster-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-form/multi-cluster-form.component.html
@@ -1,61 +1,92 @@
-<form name="remoteClusterForm"
-      #frm="ngForm"
-      [formGroup]="remoteClusterForm"
-      novalidate>
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8}">
-      <div cdsRow
-           class="form-heading">
+<form
+  name="remoteClusterForm"
+  #frm="ngForm"
+  [formGroup]="remoteClusterForm"
+  novalidate
+>
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8 }"
+    >
+      <div
+        cdsRow
+        class="form-heading"
+      >
         <h3>{{ action | titlecase }} Cluster</h3>
       </div>
 
       <cds-inline-notification
-        *ngIf="connectionVerified !== undefined && !connectionVerified && connectionMessage !== 'Connection refused'"
+        *ngIf="
+          connectionVerified !== undefined &&
+          !connectionVerified &&
+          connectionMessage !== 'Connection refused'
+        "
         kind="error"
         title=""
-        [subtitle]="connectionMessage">
+        [subtitle]="connectionMessage"
+      >
       </cds-inline-notification>
 
       <cds-inline-notification
         *ngIf="connectionVerified !== undefined && connectionVerified"
         kind="success"
         title=""
-        [subtitle]="connectionMessage">
+        [subtitle]="connectionMessage"
+      >
       </cds-inline-notification>
 
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-text-label
           cdRequiredField="Cluster API URL"
-          [invalid]="remoteClusterForm.controls.remoteClusterUrl.invalid && remoteClusterForm.controls.remoteClusterUrl.dirty"
+          [invalid]="
+            remoteClusterForm.controls.remoteClusterUrl.invalid &&
+            remoteClusterForm.controls.remoteClusterUrl.dirty
+          "
           [invalidText]="urlErrorTpl"
           for="remoteClusterUrl"
-          i18n>
+          i18n
+        >
           Cluster API URL
-        <input cdsText
-               type="text"
-               id="remoteClusterUrl"
-               name="remoteClusterUrl"
-               placeholder="https://localhost:4202"
-               formControlName="remoteClusterUrl"
-               [invalid]="remoteClusterForm.controls.remoteClusterUrl.invalid && remoteClusterForm.controls.remoteClusterUrl.dirty">
+          <input
+            cdsText
+            type="text"
+            id="remoteClusterUrl"
+            name="remoteClusterUrl"
+            placeholder="https://localhost:4202"
+            formControlName="remoteClusterUrl"
+            [invalid]="
+              remoteClusterForm.controls.remoteClusterUrl.invalid &&
+              remoteClusterForm.controls.remoteClusterUrl.dirty
+            "
+          />
         </cds-text-label>
         <ng-template #urlErrorTpl>
-          <span class="invalid-feedback"
-                *ngIf="remoteClusterForm.showError('remoteClusterUrl', frm, 'required')"
-                i18n>This field is required.
+          <span
+            class="invalid-feedback"
+            *ngIf="remoteClusterForm.showError('remoteClusterUrl', frm, 'required')"
+            i18n
+            >This field is required.
           </span>
-          <span class="invalid-feedback"
-                *ngIf="remoteClusterForm.showError('remoteClusterUrl', frm, 'invalidURL')"
-                i18n>Please enter a valid URL.
+          <span
+            class="invalid-feedback"
+            *ngIf="remoteClusterForm.showError('remoteClusterUrl', frm, 'invalidURL')"
+            i18n
+            >Please enter a valid URL.
           </span>
-          <span class="invalid-feedback"
-                *ngIf="remoteClusterForm.showError('remoteClusterUrl', frm, 'hubUrlCheck')"
-                i18n>The hub cluster cannot be connected.
+          <span
+            class="invalid-feedback"
+            *ngIf="remoteClusterForm.showError('remoteClusterUrl', frm, 'hubUrlCheck')"
+            i18n
+            >The hub cluster cannot be connected.
           </span>
         </ng-template>
         <cd-help-text>
@@ -63,85 +94,113 @@
         </cd-help-text>
       </div>
 
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-text-label
           cdRequiredField="Alias Name"
           [invalid]="remoteClusterForm.showError('clusterAlias', frm)"
           [invalidText]="aliasErrorTpl"
           for="clusterAlias"
-          i18n>
+          i18n
+        >
           Alias Name
-          <input cdsText
-                 id="clusterAlias"
-                 name="clusterAlias"
-                 placeholder="Name/Text to uniquely identify cluster"
-                 formControlName="clusterAlias">
+          <input
+            cdsText
+            id="clusterAlias"
+            name="clusterAlias"
+            placeholder="Name/Text to uniquely identify cluster"
+            formControlName="clusterAlias"
+          />
         </cds-text-label>
         <ng-template #aliasErrorTpl>
-          <span *ngIf="remoteClusterForm.showError('clusterAlias', frm, 'required')"
-                i18n>
+          <span
+            *ngIf="remoteClusterForm.showError('clusterAlias', frm, 'required')"
+            i18n
+          >
             This field is required.
           </span>
-          <span *ngIf="remoteClusterForm.showError('clusterAlias', frm, 'uniqueName')"
-                i18n>
+          <span
+            *ngIf="remoteClusterForm.showError('clusterAlias', frm, 'uniqueName')"
+            i18n
+          >
             The chosen alias name is already in use.
           </span>
         </ng-template>
       </div>
 
-      <div cdsRow
-           class="form-item"
-           *ngIf="action !== 'edit'">
+      <div
+        cdsRow
+        class="form-item"
+        *ngIf="action !== 'edit'"
+      >
         <cds-text-label
           cdRequiredField="Username"
           [invalid]="remoteClusterForm.showError('username', frm)"
           [invalidText]="usernameErrorTpl"
           for="username"
-          i18n>
+          i18n
+        >
           Username
-          <input cdsText
-                 id="username"
-                 name="username"
-                 formControlName="username">
+          <input
+            cdsText
+            id="username"
+            name="username"
+            formControlName="username"
+          />
         </cds-text-label>
         <ng-template #usernameErrorTpl>
-          <span *ngIf="remoteClusterForm.showError('username', frm, 'required')"
-                i18n>
+          <span
+            *ngIf="remoteClusterForm.showError('username', frm, 'required')"
+            i18n
+          >
             This field is required.
           </span>
-          <span *ngIf="remoteClusterForm.showError('username', frm, 'uniqueUrlandUser')"
-                i18n>
+          <span
+            *ngIf="remoteClusterForm.showError('username', frm, 'uniqueUrlandUser')"
+            i18n
+          >
             A cluster with the chosen user is already connected.
           </span>
         </ng-template>
       </div>
 
-      <div cdsRow
-           class="form-item"
-           *ngIf="action !== 'edit'">
-        <cds-password-label labelInputID="password"
-                            label="Password..."
-                            i18n>Password
-          <input cdsPassword
-                 type="password"
-                 placeholder="Password..."
-                 id="password"
-                 name="password"
-                 autocomplete="new-password"
-                 formControlName="password">
+      <div
+        cdsRow
+        class="form-item"
+        *ngIf="action !== 'edit'"
+      >
+        <cds-password-label
+          labelInputID="password"
+          label="Password..."
+          i18n
+          >Password
+          <input
+            cdsPassword
+            type="password"
+            placeholder="Password..."
+            id="password"
+            name="password"
+            autocomplete="new-password"
+            formControlName="password"
+          />
         </cds-password-label>
       </div>
 
-      <div cdsRow
-           class="form-item"
-           *ngIf="action !== 'edit'">
-        <cds-select formControlName="ttl"
-                    name="ttl"
-                    for="ttl"
-                    label="Login Expiration"
-                    id="ttl"
-                    i18n>
+      <div
+        cdsRow
+        class="form-item"
+        *ngIf="action !== 'edit'"
+      >
+        <cds-select
+          formControlName="ttl"
+          name="ttl"
+          for="ttl"
+          label="Login Expiration"
+          id="ttl"
+          i18n
+        >
           <option value="1">1 day</option>
           <option value="7">1 week</option>
           <option value="15">15 days</option>
@@ -149,55 +208,72 @@
         </cds-select>
       </div>
 
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-checkbox
           formControlName="ssl"
           id="ssl"
-          i18n>
+          i18n
+        >
           SSL
         </cds-checkbox>
       </div>
 
-      <div cdsRow
-           class="form-item"
-           *ngIf="remoteClusterForm.get('ssl').value">
+      <div
+        cdsRow
+        class="form-item"
+        *ngIf="remoteClusterForm.get('ssl').value"
+      >
         <cds-text-label
           label="Certificate"
           [helperText]="sslHelpTpl"
           [invalid]="remoteClusterForm.showError('ssl_cert', frm)"
           [invalidText]="sslCertErrorTpl"
-          i18n>
-          <div cdsStack="vertical"
-               gap="3">
-            <textarea cdsTextArea
-                      id="ssl_cert"
-                      rows="5"
-                      formControlName="ssl_cert"></textarea>
-            <input type="file"
-                   (change)="fileUpload($event.target.files, 'ssl_cert')">
+          i18n
+        >
+          <div
+            cdsStack="vertical"
+            gap="3"
+          >
+            <textarea
+              cdsTextArea
+              id="ssl_cert"
+              rows="5"
+              formControlName="ssl_cert"
+            ></textarea>
+            <input
+              type="file"
+              (change)="fileUpload($event.target.files, 'ssl_cert')"
+            />
           </div>
         </cds-text-label>
         <ng-template #sslHelpTpl>
           <span i18n>The SSL certificate in PEM format.</span>
         </ng-template>
         <ng-template #sslCertErrorTpl>
-          <span *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'required')"
-                i18n>
+          <span
+            *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'required')"
+            i18n
+          >
             This field is required.
           </span>
-          <span *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'pattern')"
-                i18n>
+          <span
+            *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'pattern')"
+            i18n
+          >
             Invalid SSL certificate.
           </span>
         </ng-template>
       </div>
 
-      <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                            [form]="frm"
-                            [submitText]="(action | titlecase) + ' ' + 'Cluster'"
-                            wrappingClass="text-right"></cd-form-button-panel>
-
+      <cd-form-button-panel
+        (submitActionEvent)="onSubmit()"
+        [form]="frm"
+        [submitText]="(action | titlecase) + ' ' + 'Cluster'"
+        wrappingClass="text-right"
+      ></cd-form-button-panel>
     </div>
   </div>
 </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-list/multi-cluster-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-list/multi-cluster-list.component.html
index 1ccc51fdb05..7c5f9d43e81 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-list/multi-cluster-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-list/multi-cluster-list.component.html
@@ -1,20 +1,27 @@
 <ng-template #emptyCluster>
-  <ng-container class="container h-75"
-                *ngIf="managedByConfig$ | async as managedByConfig">
+  <ng-container
+    class="container h-75"
+    *ngIf="managedByConfig$ | async as managedByConfig"
+  >
     <div class="row h-100 justify-content-center align-items-center">
       <div class="blank-page">
-        <i class="mx-auto d-block"
-           [ngClass]="[icons.size24, icons.wrench]">
+        <i
+          class="mx-auto d-block"
+          [ngClass]="[icons.size24, icons.wrench]"
+        >
         </i>
-      <div class="mt-4 text-center">
-        <h4 class="mt-3">This cluster is already managed by cluster -
-          <a target="_blank"
-             [href]="managedByConfig['MANAGED_BY_CLUSTERS'][0]['url']">
-            {{ managedByConfig['MANAGED_BY_CLUSTERS'][0]['fsid'] }}
-            <cd-icon type="launch"></cd-icon>
-          </a>
-        </h4>
-      </div>
+        <div class="mt-4 text-center">
+          <h4 class="mt-3">
+            This cluster is already managed by cluster -
+            <a
+              target="_blank"
+              [href]="managedByConfig['MANAGED_BY_CLUSTERS'][0]['url']"
+            >
+              {{ managedByConfig['MANAGED_BY_CLUSTERS'][0]['fsid'] }}
+              <cd-icon type="launch"></cd-icon>
+            </a>
+          </h4>
+        </div>
       </div>
     </div>
   </ng-container>
@@ -22,32 +29,43 @@
 
 <ng-container *ngIf="managedByConfig$ | async as managedByConfig">
   <div *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length === 0; else emptyCluster">
-    <nav ngbNav
-         #nav="ngbNav"
-         class="nav-tabs">
+    <nav
+      ngbNav
+      #nav="ngbNav"
+      class="nav-tabs"
+    >
       <ng-container ngbNavItem>
-        <a ngbNavLink
-           i18n>Clusters List</a>
+        <a
+          ngbNavLink
+          i18n
+          >Clusters List</a
+        >
         <ng-template ngbNavContent>
-          <cd-table #table
-                    [data]="data"
-                    [columns]="columns"
-                    columnMode="flex"
-                    selectionType="single"
-                    (fetchData)="refresh()"
-                    [hasDetails]="true"
-                    (setExpandedRow)="setExpandedRow($event)"
-                    [maxLimit]="25"
-                    (updateSelection)="updateSelection($event)">
-            <cd-table-actions [permission]="permissions.user"
-                              [selection]="selection"
-                              class="table-actions"
-                              id="cluster-actions"
-                              [tableActions]="tableActions">
+          <cd-table
+            #table
+            [data]="data"
+            [columns]="columns"
+            columnMode="flex"
+            selectionType="single"
+            (fetchData)="refresh()"
+            [hasDetails]="true"
+            (setExpandedRow)="setExpandedRow($event)"
+            [maxLimit]="25"
+            (updateSelection)="updateSelection($event)"
+          >
+            <cd-table-actions
+              [permission]="permissions.user"
+              [selection]="selection"
+              class="table-actions"
+              id="cluster-actions"
+              [tableActions]="tableActions"
+            >
             </cd-table-actions>
-            <cd-multi-cluster-details *cdTableDetail
-                                      [permissions]="permissions"
-                                      [selection]="expandedRow">
+            <cd-multi-cluster-details
+              *cdTableDetail
+              [permissions]="permissions"
+              [selection]="expandedRow"
+            >
             </cd-multi-cluster-details>
           </cd-table>
         </ng-template>
@@ -57,32 +75,50 @@
   </div>
 </ng-container>
 
-<ng-template #urlTpl
-             let-row="data.row">
-  <a target="_blank"
-     [href]="row.url">
-      {{ row?.url?.endsWith('/') ? row?.url?.slice(0, -1) : row.url }}
+<ng-template
+  #urlTpl
+  let-row="data.row"
+>
+  <a
+    target="_blank"
+    [href]="row.url"
+  >
+    {{ row?.url?.endsWith('/') ? row?.url?.slice(0, -1) : row.url }}
     <cd-icon type="launch"></cd-icon>
   </a>
 </ng-template>
 
-<ng-template #durationTpl
-             let-column="data.column"
-             let-value="data.value"
-             let-row="data.row">
+<ng-template
+  #durationTpl
+  let-column="data.column"
+  let-value="data.value"
+  let-row="data.row"
+>
   <span *ngIf="row.remainingTimeWithoutSeconds > 0 && row.cluster_alias !== 'local-cluster'">
-    <i *ngIf="row.remainingDays < 8"
-       i18n-title
-       title="Cluster's token is about to expire"
-       [class.icon-danger-color]="row.remainingDays < 2"
-       [class.icon-warning-color]="row.remainingDays < 8"
-       class="{{ icons.warning }}"></i>
-    <span title="{{ row.expiryDate }}">{{ row.remainingTimeWithoutSeconds / 1000 | duration }}</span>
+    <i
+      *ngIf="row.remainingDays < 8"
+      i18n-title
+      title="Cluster's token is about to expire"
+      [class.icon-danger-color]="row.remainingDays < 2"
+      [class.icon-warning-color]="row.remainingDays < 8"
+      class="{{ icons.warning }}"
+    ></i>
+    <span title="{{ row.expiryDate }}">{{
+      row.remainingTimeWithoutSeconds / 1000 | duration
+    }}</span>
   </span>
-  <span *ngIf="row.remainingTimeWithoutSeconds <= 0 && row.remainingDays <=0 && row.cluster_alias !== 'local-cluster'">
-    <i i18n-title
-       title="Cluster's token has expired"
-       class="{{ icons.danger }}"></i>
+  <span
+    *ngIf="
+      row.remainingTimeWithoutSeconds <= 0 &&
+      row.remainingDays <= 0 &&
+      row.cluster_alias !== 'local-cluster'
+    "
+  >
+    <i
+      i18n-title
+      title="Cluster's token has expired"
+      class="{{ icons.danger }}"
+    ></i>
     <span class="text-danger">Token expired</span>
   </span>
   <span *ngIf="row.cluster_alias === 'local-cluster'">N/A</span>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html
index 500ecc2c5f1..a3f59ca1c75 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.html
@@ -1,36 +1,56 @@
 <ng-template #emptyCluster>
-  <ng-container class="container h-75"
-                *ngIf="managedByConfig$ | async as managedByConfig">
+  <ng-container
+    class="container h-75"
+    *ngIf="managedByConfig$ | async as managedByConfig"
+  >
     <div class="row h-100 justify-content-center align-items-center">
       <div class="blank-page">
-        <svg cdsIcon="connect"
-             size="32"
-             class="mx-auto d-block"></svg>
-        <div class="mt-4 text-center"
-             *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length === 0">
+        <svg
+          cdsIcon="connect"
+          size="32"
+          class="mx-auto d-block"
+        ></svg>
+        <div
+          class="mt-4 text-center"
+          *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length === 0"
+        >
           <h3 class="fw-bold">Connect Cluster</h3>
-          <h4 class="mt-3">Upgrade your current cluster to a multi-cluster setup effortlessly.
-              Click on the "Connect Cluster" button to begin the process.</h4>
+          <h4 class="mt-3">
+            Upgrade your current cluster to a multi-cluster setup effortlessly. Click on the
+            "Connect Cluster" button to begin the process.
+          </h4>
         </div>
-        <div class="mt-4 text-center"
-             *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length > 0">
-          <h4 class="mt-3">This cluster is already managed by cluster -
-            <a target="_blank"
-               [href]="managedByConfig['MANAGED_BY_CLUSTERS'][0]['url']">
-               {{ managedByConfig['MANAGED_BY_CLUSTERS'][0]['fsid'] }}
+        <div
+          class="mt-4 text-center"
+          *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length > 0"
+        >
+          <h4 class="mt-3">
+            This cluster is already managed by cluster -
+            <a
+              target="_blank"
+              [href]="managedByConfig['MANAGED_BY_CLUSTERS'][0]['url']"
+            >
+              {{ managedByConfig['MANAGED_BY_CLUSTERS'][0]['fsid'] }}
               <cd-icon type="launch"></cd-icon>
             </a>
           </h4>
         </div>
-        <div class="mt-4"
-             *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length === 0">
+        <div
+          class="mt-4"
+          *ngIf="managedByConfig['MANAGED_BY_CLUSTERS'].length === 0"
+        >
           <div class="text-center">
-            <button class="btn btn-primary"
-                    (click)="openConnectClusterForm()"
-                    type="button">
-              <i class="mx-auto"
-                 [ngClass]="icons.add">
-              </i> Connect Cluster
+            <button
+              class="btn btn-primary"
+              (click)="openConnectClusterForm()"
+              type="button"
+            >
+              <i
+                class="mx-auto"
+                [ngClass]="icons.add"
+              >
+              </i>
+              Connect Cluster
             </button>
           </div>
         </div>
@@ -41,9 +61,9 @@
 
 <ng-template #nametpl>
   <div cdstabledata>
-    <span title="{{cluster}}">
+    <span title="{{ cluster }}">
       <a href="#">
-        {{cluster}}
+        {{ cluster }}
       </a>
     </span>
   </div>
@@ -53,124 +73,179 @@
   <div class="container h-75">
     <div class="row h-100 justify-content-center align-items-center">
       <div class="blank-page">
-        <cds-loading class="mx-auto d-block"
-                     [isActive]="true"
-                     [overlay]="false"
-                     size="lg"></cds-loading>
-        <p class="text-center mt-3"
-           i18n>Loading data, Please wait...</p>
+        <cds-loading
+          class="mx-auto d-block"
+          [isActive]="true"
+          [overlay]="false"
+          size="lg"
+        ></cds-loading>
+        <p
+          class="text-center mt-3"
+          i18n
+        >
+          Loading data, Please wait...
+        </p>
       </div>
     </div>
   </div>
 </ng-template>
 
 <ng-container *ngIf="managedByConfig$ | async as managedByConfig">
-  <div class="container-fluid h-100 p-4"
-       *ngIf="isMultiCluster && managedByConfig['MANAGED_BY_CLUSTERS'].length === 0; else emptyCluster">
+  <div
+    class="container-fluid h-100 p-4"
+    *ngIf="isMultiCluster && managedByConfig['MANAGED_BY_CLUSTERS'].length === 0; else emptyCluster"
+  >
     <ng-container *ngIf="!loading; else loadingTpl">
-      <cd-alert-panel type="error"
-                      spacingClass="mb-3"
-                      [showTitle]="false"
-                      size="slim"
-                      *ngIf="prometheusConnectionErrors.length > 0"
-                      (dismissed)="onDismissed()"
-                      [dismissible]="true"
-                      i18n>
-      <div>
-        <p><strong>Could not retrieve metrics from the following clusters:</strong></p>
-        <div *ngFor="let cluster of prometheusConnectionErrors">
-          <p>
-            <strong>Cluster Name:</strong> {{ cluster['cluster_alias'] }}<br>
-            <strong>Cluster ID:</strong> {{ cluster['cluster_name'] }}<br>
-            <strong>Issue:</strong> {{ cluster.reconnectionError ? cluster.reconnectionError : 'Security configuration error' }}<br>
-          </p>
+      <cd-alert-panel
+        type="error"
+        spacingClass="mb-3"
+        [showTitle]="false"
+        size="slim"
+        *ngIf="prometheusConnectionErrors.length > 0"
+        (dismissed)="onDismissed()"
+        [dismissible]="true"
+        i18n
+      >
+        <div>
+          <p><strong>Could not retrieve metrics from the following clusters:</strong></p>
+          <div *ngFor="let cluster of prometheusConnectionErrors">
+            <p>
+              <strong>Cluster Name:</strong> {{ cluster['cluster_alias'] }}<br />
+              <strong>Cluster ID:</strong> {{ cluster['cluster_name'] }}<br />
+              <strong>Issue:</strong>
+              {{
+                cluster.reconnectionError
+                  ? cluster.reconnectionError
+                  : 'Security configuration error'
+              }}<br />
+            </p>
+          </div>
         </div>
-      </div>
       </cd-alert-panel>
-      <cd-alert-panel type="info"
-                      spacingClass="mb-3"
-                      [showTitle]="false"
-                      size="slim"
-                      *ngIf="showDeletionMessage"
-                      (dismissed)="onDismissed()"
-                      [dismissible]="true"
-                      i18n>
-        <p>Please note that the data for the disconnected cluster will be visible for a duration of ~ 5 minutes. After this period, it will be automatically removed.</p>
+      <cd-alert-panel
+        type="info"
+        spacingClass="mb-3"
+        [showTitle]="false"
+        size="slim"
+        *ngIf="showDeletionMessage"
+        (dismissed)="onDismissed()"
+        [dismissible]="true"
+        i18n
+      >
+        <p>
+          Please note that the data for the disconnected cluster will be visible for a duration of ~
+          5 minutes. After this period, it will be automatically removed.
+        </p>
       </cd-alert-panel>
       <cd-card-group>
         <div class="col-lg-4">
           <div class="row">
-            <cd-card cardTitle="Clusters"
-                     i18n-title
-                     class="col-sm-6 m-0 p-0 ps-4 pe-2"
-                     aria-label="Clusters"
-                     [fullHeight]="true"
-                     *ngIf="queriesResults.CLUSTER_COUNT && queriesResults.CLUSTER_COUNT[0]">
+            <cd-card
+              cardTitle="Clusters"
+              i18n-title
+              class="col-sm-6 m-0 p-0 ps-4 pe-2"
+              aria-label="Clusters"
+              [fullHeight]="true"
+              *ngIf="queriesResults.CLUSTER_COUNT && queriesResults.CLUSTER_COUNT[0]"
+            >
               <span class="text-center">
-                <h3 *ngIf="queriesResults['HEALTH_ERROR_COUNT'][0][1] === '0' && queriesResults['HEALTH_OK_COUNT'][0][1] === '0' && queriesResults['HEALTH_WARNING_COUNT'][0][1] === '0'">{{ queriesResults.CLUSTER_COUNT[0][1] }}</h3>
-                <h3 class="text-danger"
-                    *ngIf="queriesResults.HEALTH_ERROR_COUNT[0][1] !== '0'">
+                <h3
+                  *ngIf="
+                    queriesResults['HEALTH_ERROR_COUNT'][0][1] === '0' &&
+                    queriesResults['HEALTH_OK_COUNT'][0][1] === '0' &&
+                    queriesResults['HEALTH_WARNING_COUNT'][0][1] === '0'
+                  "
+                >
+                  {{ queriesResults.CLUSTER_COUNT[0][1] }}
+                </h3>
+                <h3
+                  class="text-danger"
+                  *ngIf="queriesResults.HEALTH_ERROR_COUNT[0][1] !== '0'"
+                >
                   <i [ngClass]="icons.danger"></i>
                   {{ queriesResults.HEALTH_ERROR_COUNT[0][1] }}
                 </h3>
-                <h3 class="text-warning"
-                    *ngIf="queriesResults.HEALTH_WARNING_COUNT[0][1] !== '0'">
+                <h3
+                  class="text-warning"
+                  *ngIf="queriesResults.HEALTH_WARNING_COUNT[0][1] !== '0'"
+                >
                   <i [ngClass]="icons.warning"></i>
-                    {{ queriesResults.HEALTH_WARNING_COUNT[0][1] }}
+                  {{ queriesResults.HEALTH_WARNING_COUNT[0][1] }}
                 </h3>
-                <h3 class="text-danger"
-                    *ngIf="queriesResults.HEALTH_ERROR_COUNT[0][1] !== '0'">
+                <h3
+                  class="text-danger"
+                  *ngIf="queriesResults.HEALTH_ERROR_COUNT[0][1] !== '0'"
+                >
                   <i [ngClass]="icons.danger"></i>
                   {{ queriesResults.HEALTH_ERROR_COUNT[0][1] }}
                 </h3>
-                <h3 class="text-success"
-                    *ngIf="queriesResults.HEALTH_OK_COUNT[0][1] !== '0'">
+                <h3
+                  class="text-success"
+                  *ngIf="queriesResults.HEALTH_OK_COUNT[0][1] !== '0'"
+                >
                   <i [ngClass]="icons.success"></i>
-                    {{ queriesResults.HEALTH_OK_COUNT[0][1] }}
+                  {{ queriesResults.HEALTH_OK_COUNT[0][1] }}
                 </h3>
               </span>
             </cd-card>
-            <cd-card cardTitle="Alerts"
-                     i18n-title
-                     class="col-sm-6 m-0 p-0 ps-2 pe-2"
-                     aria-label="Alerts"
-                     [fullHeight]="true"
-                     *ngIf="queriesResults['ALERTS_COUNT'] && queriesResults['ALERTS_COUNT'][0]">
+            <cd-card
+              cardTitle="Alerts"
+              i18n-title
+              class="col-sm-6 m-0 p-0 ps-2 pe-2"
+              aria-label="Alerts"
+              [fullHeight]="true"
+              *ngIf="queriesResults['ALERTS_COUNT'] && queriesResults['ALERTS_COUNT'][0]"
+            >
               <span class="text-center">
-                <h3 *ngIf="queriesResults['CRITICAL_ALERTS_COUNT'][0][1] === '0' && queriesResults['WARNING_ALERTS_COUNT'][0][1] === '0'">
-                    {{ queriesResults['ALERTS_COUNT'][0][1] }}
+                <h3
+                  *ngIf="
+                    queriesResults['CRITICAL_ALERTS_COUNT'][0][1] === '0' &&
+                    queriesResults['WARNING_ALERTS_COUNT'][0][1] === '0'
+                  "
+                >
+                  {{ queriesResults['ALERTS_COUNT'][0][1] }}
                 </h3>
-                <h3 class="text-danger"
-                    *ngIf="queriesResults['CRITICAL_ALERTS_COUNT'][0][1] !== '0'">
+                <h3
+                  class="text-danger"
+                  *ngIf="queriesResults['CRITICAL_ALERTS_COUNT'][0][1] !== '0'"
+                >
                   <i [ngClass]="icons.danger"></i>
                   {{ queriesResults['CRITICAL_ALERTS_COUNT'][0][1] }}
                 </h3>
-                <h3 class="text-warning"
-                    *ngIf="queriesResults['WARNING_ALERTS_COUNT'][0][1] !== '0'">
+                <h3
+                  class="text-warning"
+                  *ngIf="queriesResults['WARNING_ALERTS_COUNT'][0][1] !== '0'"
+                >
                   <i [ngClass]="icons.warning"></i>
-                    {{ queriesResults['WARNING_ALERTS_COUNT'][0][1] }}
+                  {{ queriesResults['WARNING_ALERTS_COUNT'][0][1] }}
                 </h3>
               </span>
             </cd-card>
           </div>
           <div class="row pt-3">
-            <cd-card cardTitle="Connection Errors"
-                     i18n-title
-                     class="col-sm-6 m-0 p-0 ps-4 pe-2"
-                     aria-label="Connection Errors">
+            <cd-card
+              cardTitle="Connection Errors"
+              i18n-title
+              class="col-sm-6 m-0 p-0 ps-4 pe-2"
+              aria-label="Connection Errors"
+            >
               <span class="text-center">
-                <h3 [ngClass]="{'text-danger': connectionErrorsCount > 0}">
-                  <i [ngClass]="icons.danger"
-                     *ngIf="connectionErrorsCount > 0"></i>
+                <h3 [ngClass]="{ 'text-danger': connectionErrorsCount > 0 }">
+                  <i
+                    [ngClass]="icons.danger"
+                    *ngIf="connectionErrorsCount > 0"
+                  ></i>
                   {{ connectionErrorsCount }}
                 </h3>
               </span>
             </cd-card>
-            <cd-card cardTitle="Hosts"
-                     i18n-title
-                     class="col-sm-6 m-0 p-0 ps-2 pe-2"
-                     aria-label="Total number of hosts"
-                     *ngIf="queriesResults['TOTAL_HOSTS'] && queriesResults['TOTAL_HOSTS'][0]">
+            <cd-card
+              cardTitle="Hosts"
+              i18n-title
+              class="col-sm-6 m-0 p-0 ps-2 pe-2"
+              aria-label="Total number of hosts"
+              *ngIf="queriesResults['TOTAL_HOSTS'] && queriesResults['TOTAL_HOSTS'][0]"
+            >
               <span class="text-center">
                 <h3>{{ queriesResults['TOTAL_HOSTS'][0][1] }}</h3>
               </span>
@@ -178,15 +253,27 @@
           </div>
 
           <div class="row pt-3">
-            <cd-card cardTitle="Capacity"
-                     i18n-title
-                     class="col-sm-12 m-0 p-0 ps-4 pe-2"
-                     aria-label="Capacity card"
-                     *ngIf="queriesResults['TOTAL_CLUSTERS_CAPACITY'] && queriesResults['TOTAL_CLUSTERS_CAPACITY'][0] && queriesResults['TOTAL_USED_CAPACITY'] && queriesResults['TOTAL_USED_CAPACITY'][0]">
+            <cd-card
+              cardTitle="Capacity"
+              i18n-title
+              class="col-sm-12 m-0 p-0 ps-4 pe-2"
+              aria-label="Capacity card"
+              *ngIf="
+                queriesResults['TOTAL_CLUSTERS_CAPACITY'] &&
+                queriesResults['TOTAL_CLUSTERS_CAPACITY'][0] &&
+                queriesResults['TOTAL_USED_CAPACITY'] &&
+                queriesResults['TOTAL_USED_CAPACITY'][0]
+              "
+            >
               <ng-container class="ms-4 me-4">
-                <cd-dashboard-pie [data]="{max: queriesResults['TOTAL_CLUSTERS_CAPACITY'][0][1], current: queriesResults['TOTAL_USED_CAPACITY'][0][1]}"
-                                  lowThreshold=".95"
-                                  highThreshold=".99">
+                <cd-dashboard-pie
+                  [data]="{
+                    max: queriesResults['TOTAL_CLUSTERS_CAPACITY'][0][1],
+                    current: queriesResults['TOTAL_USED_CAPACITY'][0][1]
+                  }"
+                  lowThreshold=".95"
+                  highThreshold=".99"
+                >
                 </cd-dashboard-pie>
               </ng-container>
             </cd-card>
@@ -194,39 +281,49 @@
         </div>
 
         <div class="col-sm-8 ps-2">
-          <cd-card [cardTitle]="'Top ' + COUNT_OF_UTILIZATION_CHARTS + ' Cluster Utilization'"
-                   i18n-title
-                   [fullHeight]="true"
-                   aria-label="Cluster Utilization card"
-                   *ngIf="clusters">
+          <cd-card
+            [cardTitle]="'Top ' + COUNT_OF_UTILIZATION_CHARTS + ' Cluster Utilization'"
+            i18n-title
+            [fullHeight]="true"
+            aria-label="Cluster Utilization card"
+            *ngIf="clusters"
+          >
             <div class="ms-4 me-4 mt-0">
-              <cd-dashboard-time-selector (selectedTime)="getPrometheusData($event, 'clusterUtilization')">
+              <cd-dashboard-time-selector
+                (selectedTime)="getPrometheusData($event, 'clusterUtilization')"
+              >
               </cd-dashboard-time-selector>
-              <cd-dashboard-area-chart  chartTitle="Capacity"
-                                        [labelsArray]="capacityLabels"
-                                        isMultiCluster="true"
-                                        dataUnits="B"
-                                        [dataArray]="capacityValues"
-                                        [truncateLabel]="true"
-                                        *ngIf="capacityLabels && capacityValues">
+              <cd-dashboard-area-chart
+                chartTitle="Capacity"
+                [labelsArray]="capacityLabels"
+                isMultiCluster="true"
+                dataUnits="B"
+                [dataArray]="capacityValues"
+                [truncateLabel]="true"
+                *ngIf="capacityLabels && capacityValues"
+              >
               </cd-dashboard-area-chart>
-              <cd-dashboard-area-chart chartTitle="IOPS"
-                                       [labelsArray]="iopsLabels"
-                                       isMultiCluster="true"
-                                       dataUnits=""
-                                       decimals="0"
-                                       [dataArray]="iopsValues"
-                                       [truncateLabel]="true"
-                                       *ngIf="iopsLabels && iopsValues">
+              <cd-dashboard-area-chart
+                chartTitle="IOPS"
+                [labelsArray]="iopsLabels"
+                isMultiCluster="true"
+                dataUnits=""
+                decimals="0"
+                [dataArray]="iopsValues"
+                [truncateLabel]="true"
+                *ngIf="iopsLabels && iopsValues"
+              >
               </cd-dashboard-area-chart>
-              <cd-dashboard-area-chart chartTitle="Throughput"
-                                       [labelsArray]="throughputLabels"
-                                       isMultiCluster="true"
-                                       dataUnits="B/s"
-                                       decimals="2"
-                                       [dataArray]="throughputValues"
-                                       [truncateLabel]="true"
-                                       *ngIf="throughputLabels && throughputLabels">
+              <cd-dashboard-area-chart
+                chartTitle="Throughput"
+                [labelsArray]="throughputLabels"
+                isMultiCluster="true"
+                dataUnits="B/s"
+                decimals="2"
+                [dataArray]="throughputValues"
+                [truncateLabel]="true"
+                *ngIf="throughputLabels && throughputLabels"
+              >
               </cd-dashboard-area-chart>
             </div>
           </cd-card>
@@ -235,10 +332,12 @@
 
       <cd-card-group>
         <div class="col-lg-12 mt-3 m-0 p-0 ps-4 pe-4">
-          <cd-table [data]="clusters"
-                    [columns]="columns"
-                    [limit]="5"
-                    *ngIf="clusters">
+          <cd-table
+            [data]="clusters"
+            [columns]="columns"
+            [limit]="5"
+            *ngIf="clusters"
+          >
           </cd-table>
         </div>
       </cd-card-group>
@@ -246,38 +345,48 @@
       <cd-card-group>
         <div class="col-lg-12 mb-4 m-0 p-0 ps-4 pe-4">
           <div class="row">
-            <cd-card [cardTitle]="'Top ' + COUNT_OF_UTILIZATION_CHARTS + ' Pools Utilization'"
-                     i18n-title
-                     aria-label="Pools Utilization card"
-                     *ngIf="clusters">
+            <cd-card
+              [cardTitle]="'Top ' + COUNT_OF_UTILIZATION_CHARTS + ' Pools Utilization'"
+              i18n-title
+              aria-label="Pools Utilization card"
+              *ngIf="clusters"
+            >
               <div class="ms-4 me-4 mt-0">
-                <cd-dashboard-time-selector (selectedTime)="getPrometheusData($event, 'poolUtilization')">
+                <cd-dashboard-time-selector
+                  (selectedTime)="getPrometheusData($event, 'poolUtilization')"
+                >
                 </cd-dashboard-time-selector>
-                <cd-dashboard-area-chart  chartTitle="Capacity"
-                                          [labelsArray]="poolCapacityLabels"
-                                          dataUnits="B"
-                                          isMultiCluster="true"
-                                          [dataArray]="poolCapacityValues"
-                                          *ngIf="poolCapacityLabels && poolCapacityValues"
-                                          [truncateLabel]="true">
+                <cd-dashboard-area-chart
+                  chartTitle="Capacity"
+                  [labelsArray]="poolCapacityLabels"
+                  dataUnits="B"
+                  isMultiCluster="true"
+                  [dataArray]="poolCapacityValues"
+                  *ngIf="poolCapacityLabels && poolCapacityValues"
+                  [truncateLabel]="true"
+                >
                 </cd-dashboard-area-chart>
-                <cd-dashboard-area-chart chartTitle="IOPS"
-                                         [labelsArray]="poolIOPSLabels"
-                                         dataUnits=""
-                                         decimals="0"
-                                         isMultiCluster="true"
-                                         [dataArray]="poolIOPSValues"
-                                         *ngIf="poolIOPSLabels && poolIOPSValues"
-                                         [truncateLabel]="true">
+                <cd-dashboard-area-chart
+                  chartTitle="IOPS"
+                  [labelsArray]="poolIOPSLabels"
+                  dataUnits=""
+                  decimals="0"
+                  isMultiCluster="true"
+                  [dataArray]="poolIOPSValues"
+                  *ngIf="poolIOPSLabels && poolIOPSValues"
+                  [truncateLabel]="true"
+                >
                 </cd-dashboard-area-chart>
-                <cd-dashboard-area-chart chartTitle="Client Throughput"
-                                         [labelsArray]="poolThroughputLabels"
-                                         dataUnits="B/s"
-                                         decimals="2"
-                                         isMultiCluster="true"
-                                         [dataArray]="poolThroughputValues"
-                                         *ngIf="poolThroughputLabels && poolThroughputValues"
-                                         [truncateLabel]="true">
+                <cd-dashboard-area-chart
+                  chartTitle="Client Throughput"
+                  [labelsArray]="poolThroughputLabels"
+                  dataUnits="B/s"
+                  decimals="2"
+                  isMultiCluster="true"
+                  [dataArray]="poolThroughputValues"
+                  *ngIf="poolThroughputLabels && poolThroughputValues"
+                  [truncateLabel]="true"
+                >
                 </cd-dashboard-area-chart>
               </div>
             </cd-card>
@@ -288,9 +397,13 @@
   </div>
 </ng-container>
 
-<ng-template #clusterUsageTpl
-             let-row="data.row">
-  <cd-usage-bar [total]="row.total_capacity"
-                [used]="row.used_capacity">
+<ng-template
+  #clusterUsageTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    [total]="row.total_capacity"
+    [used]="row.used_capacity"
+  >
   </cd-usage-bar>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-creation-preview-modal/osd-creation-preview-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-creation-preview-modal/osd-creation-preview-modal.component.html
index 9b442dbc78d..1335a37268c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-creation-preview-modal/osd-creation-preview-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-creation-preview-modal/osd-creation-preview-modal.component.html
@@ -1,19 +1,26 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container class="modal-title"
-                i18n>OSD creation preview</ng-container>
+  <ng-container
+    class="modal-title"
+    i18n
+    >OSD creation preview</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form #frm="ngForm"
-          [formGroup]="formGroup"
-          novalidate>
+    <form
+      #frm="ngForm"
+      [formGroup]="formGroup"
+      novalidate
+    >
       <div class="modal-body">
         <h4 i18n>DriveGroups</h4>
-        <pre>{{ driveGroups | json}}</pre>
+        <pre>{{ driveGroups | json }}</pre>
       </div>
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                              [form]="formGroup"
-                              [submitText]="action | titlecase"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [form]="formGroup"
+          [submitText]="action | titlecase"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.html
index 1f4f22e7cb5..925599994c6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.html
@@ -1,69 +1,101 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       id="tabset-osd-details"
-       class="nav-tabs"
-       cdStatefulTab="osd-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    id="tabset-osd-details"
+    class="nav-tabs"
+    cdStatefulTab="osd-details"
+  >
     <ng-container ngbNavItem="devices">
-      <a ngbNavLink
-         i18n>Devices</a>
+      <a
+        ngbNavLink
+        i18n
+        >Devices</a
+      >
       <ng-template ngbNavContent>
-        <cd-device-list [osdId]="osd?.id"
-                        [hostname]="selection?.host.name"
-                        [osdList]="true"></cd-device-list>
+        <cd-device-list
+          [osdId]="osd?.id"
+          [hostname]="selection?.host.name"
+          [osdList]="true"
+        ></cd-device-list>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="attributes">
-      <a ngbNavLink
-         i18n>Attributes (OSD map)</a>
+      <a
+        ngbNavLink
+        i18n
+        >Attributes (OSD map)</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value [data]="osd?.details?.osd_map">
-        </cd-table-key-value>
+        <cd-table-key-value [data]="osd?.details?.osd_map"> </cd-table-key-value>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="metadata">
-      <a ngbNavLink
-         i18n>Metadata</a>
+      <a
+        ngbNavLink
+        i18n
+        >Metadata</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value *ngIf="osd?.details?.osd_metadata; else noMetaData"
-                            (fetchData)="refresh()"
-                            [data]="osd?.details?.osd_metadata">
+        <cd-table-key-value
+          *ngIf="osd?.details?.osd_metadata; else noMetaData"
+          (fetchData)="refresh()"
+          [data]="osd?.details?.osd_metadata"
+        >
         </cd-table-key-value>
         <ng-template #noMetaData>
-          <cd-alert-panel type="warning"
-                          i18n>Metadata not available</cd-alert-panel>
+          <cd-alert-panel
+            type="warning"
+            i18n
+            >Metadata not available</cd-alert-panel
+          >
         </ng-template>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="device-health">
-      <a ngbNavLink
-         i18n>Device health</a>
+      <a
+        ngbNavLink
+        i18n
+        >Device health</a
+      >
       <ng-template ngbNavContent>
         <cd-smart-list [osdId]="osd?.id"></cd-smart-list>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="performance-counter">
-      <a ngbNavLink
-         i18n>Performance counter</a>
+      <a
+        ngbNavLink
+        i18n
+        >Performance counter</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-performance-counter *ngIf="osd?.details"
-                                      serviceType="osd"
-                                      [serviceId]="osd?.id">
+        <cd-table-performance-counter
+          *ngIf="osd?.details"
+          serviceType="osd"
+          [serviceId]="osd?.id"
+        >
         </cd-table-performance-counter>
       </ng-template>
     </ng-container>
-    <ng-container ngbNavItem="performance-details"
-                  *ngIf="grafanaPermission.read">
-      <a ngbNavLink
-         i18n>Performance Details</a>
+    <ng-container
+      ngbNavItem="performance-details"
+      *ngIf="grafanaPermission.read"
+    >
+      <a
+        ngbNavLink
+        i18n
+        >Performance Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="OSD details"
-                    [grafanaPath]="'ceph-osd-device-overview?var-osd=osd.' + osd['id']"
-                    [type]="'metrics'"
-                    uid="CrAHE0iZz"
-                    scrollable="no"
-                    grafanaStyle="three">
+        <cd-grafana
+          i18n-title
+          title="OSD details"
+          [grafanaPath]="'ceph-osd-device-overview?var-osd=osd.' + osd['id']"
+          [type]="'metrics'"
+          uid="CrAHE0iZz"
+          scrollable="no"
+          grafanaStyle="three"
+        >
         </cd-grafana>
       </ng-template>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
index 08ccc032996..5f30c565b0d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-groups/osd-devices-selection-groups.component.html
@@ -1,124 +1,169 @@
 <div class="form-group row osd-devices-selection-row">
-  <label class="cd-form-label"
-         for="createDeleteButton">
+  <label
+    class="cd-form-label"
+    for="createDeleteButton"
+  >
     <ng-container i18n>{{ name }} devices</ng-container>
     <cd-helper>
       @if (type === 'data') {
-      <span i18n>The primary storage devices. These devices contain all OSD data.</span>
+        <span i18n>The primary storage devices. These devices contain all OSD data.</span>
       }
       @if (type === 'wal') {
-      <span i18n>Write-Ahead-Log devices. These devices are used for BlueStore’s internal journal. It is only useful to use a WAL device if the device is faster than the primary device (e.g. NVME devices or SSDs). If there is only a small amount of fast storage available (e.g., less than a gigabyte), we recommend using it as a WAL device.</span>
+        <span i18n
+          >Write-Ahead-Log devices. These devices are used for BlueStore’s internal journal. It is
+          only useful to use a WAL device if the device is faster than the primary device (e.g. NVME
+          devices or SSDs). If there is only a small amount of fast storage available (e.g., less
+          than a gigabyte), we recommend using it as a WAL device.</span
+        >
       }
       @if (type === 'db') {
-      <span i18n>DB devices can be used for storing BlueStore’s internal metadata.  It is only helpful to provision a DB device if it is faster than the primary device (e.g. NVME devices or SSD).</span>
+        <span i18n
+          >DB devices can be used for storing BlueStore’s internal metadata. It is only helpful to
+          provision a DB device if it is faster than the primary device (e.g. NVME devices or
+          SSD).</span
+        >
       }
     </cd-helper>
   </label>
   <div class="cd-col-form-input">
     @if (inlineSelection) {
-    @if (showAddPrimaryFirstAlert) {
-    <cd-alert-panel type="info"
-                    size="slim"
-                    [showTitle]="false">
-      <ng-container i18n>{{ tooltips.addPrimaryFirst }}</ng-container>
-    </cd-alert-panel>
-    }
-    @if (showNoAvailDevicesAlert) {
-    <cd-alert-panel type="warning"
-                    size="slim"
-                    [showTitle]="false">
-      <ng-container i18n>No available devices</ng-container>
-    </cd-alert-panel>
-    }
-    @if (showFilterSection) {
-    @if (!canInlineSubmit) {
-    <cd-alert-panel type="warning"
-                    size="slim"
-                    [showTitle]="false">
-      <ng-container i18n>Select at least one of these filters to fetch the data:</ng-container>
-      @for (filter of requiredFilters; track filter) {
-      <cds-tag class="tag-dark ms-2">{{ filter }}</cds-tag>
+      @if (showAddPrimaryFirstAlert) {
+        <cd-alert-panel
+          type="info"
+          size="slim"
+          [showTitle]="false"
+        >
+          <ng-container i18n>{{ tooltips.addPrimaryFirst }}</ng-container>
+        </cd-alert-panel>
       }
-    </cd-alert-panel>
-    }
-    <div class="device-filter-form">
-      <div class="filter-dropdown-row">
-        @for (field of filterFields; track field.prop) {
-        <div class="filter-dropdown">
-          <cds-select (valueChange)="onFilterFieldChange(field.prop, $event)"
-                      [id]="'device_filter_' + field.prop"
-                      [label]="field.name"
-                      size="md"
-                      [attr.data-testid]="'device-filter-' + field.prop">
-            <option value=""
-                    i18n>Any</option>
-            @for (option of field.options; track option.raw) {
-            <option [value]="option.raw"
-                    [selected]="selectedFilters[field.prop] === option.raw">
-              {{ option.formatted }}
-            </option>
+      @if (showNoAvailDevicesAlert) {
+        <cd-alert-panel
+          type="warning"
+          size="slim"
+          [showTitle]="false"
+        >
+          <ng-container i18n>No available devices</ng-container>
+        </cd-alert-panel>
+      }
+      @if (showFilterSection) {
+        @if (!canInlineSubmit) {
+          <cd-alert-panel
+            type="warning"
+            size="slim"
+            [showTitle]="false"
+          >
+            <ng-container i18n
+              >Select at least one of these filters to fetch the data:</ng-container
+            >
+            @for (filter of requiredFilters; track filter) {
+              <cds-tag class="tag-dark ms-2">{{ filter }}</cds-tag>
             }
-          </cds-select>
-        </div>
+          </cd-alert-panel>
         }
-      </div>
-    </div>
-    @if (showSelectionSummary) {
-    <div class="selection-summary pb-2 my-2 border-bottom">
-      @for (filter of displayedFilters; track filter.prop) {
-      <cds-tag class="tag-dark me-2">{{ filter.name }}: {{ filter.value.formatted }}</cds-tag>
+        <div class="device-filter-form">
+          <div class="filter-dropdown-row">
+            @for (field of filterFields; track field.prop) {
+              <div class="filter-dropdown">
+                <cds-select
+                  (valueChange)="onFilterFieldChange(field.prop, $event)"
+                  [id]="'device_filter_' + field.prop"
+                  [label]="field.name"
+                  size="md"
+                  [attr.data-testid]="'device-filter-' + field.prop"
+                >
+                  <option
+                    value=""
+                    i18n
+                  >
+                    Any
+                  </option>
+                  @for (option of field.options; track option.raw) {
+                    <option
+                      [value]="option.raw"
+                      [selected]="selectedFilters[field.prop] === option.raw"
+                    >
+                      {{ option.formatted }}
+                    </option>
+                  }
+                </cds-select>
+              </div>
+            }
+          </div>
+        </div>
+        @if (showSelectionSummary) {
+          <div class="selection-summary pb-2 my-2 border-bottom">
+            @for (filter of displayedFilters; track filter.prop) {
+              <cds-tag class="tag-dark me-2"
+                >{{ filter.name }}: {{ filter.value.formatted }}</cds-tag
+              >
+            }
+            <a
+              class="tc_clearSelections"
+              href=""
+              (click)="clearDevices(); (false)"
+            >
+              <svg
+                [cdsIcon]="icons.clearFilters"
+                [size]="icons.size16"
+              ></svg>
+              <ng-container i18n>Clear</ng-container>
+            </a>
+            <div class="selection-capacity cds-mt-2">
+              <span i18n>Raw capacity: {{ inlineCapacity | dimlessBinary }}.</span>
+            </div>
+          </div>
+        }
+        <cd-inventory-devices
+          [devices]="tableDevices"
+          [hostname]="hostname"
+          [diskType]="name === 'Primary' ? 'hdd' : 'ssd'"
+          [hiddenColumns]="['available', 'osd_ids']"
+          [filterColumns]="[]"
+        >
+        </cd-inventory-devices>
       }
-      <a class="tc_clearSelections"
-         href=""
-         (click)="clearDevices(); false">
-        <svg [cdsIcon]="icons.clearFilters"
-             [size]="icons.size16"></svg>
-        <ng-container i18n>Clear</ng-container>
-      </a>
-      <div class="selection-capacity cds-mt-2">
-        <span i18n>Raw capacity: {{ inlineCapacity | dimlessBinary }}.</span>
-      </div>
-    </div>
-    }
-    <cd-inventory-devices [devices]="tableDevices"
-                          [hostname]="hostname"
-                          [diskType]="name === 'Primary' ? 'hdd' : 'ssd'"
-                          [hiddenColumns]="['available', 'osd_ids']"
-                          [filterColumns]="[]">
-    </cd-inventory-devices>
-    }
     } @else {
-    @if (devices.length === 0) {
-    <button type="button"
-            class="btn btn-light"
-            (click)="showSelectionModal()"
-            data-toggle="tooltip"
-            [title]="addButtonTooltip"
-            [disabled]="availDevices.length === 0 || !canSelect || expansionCanSelect">
-      <svg [cdsIcon]="icons.add"
-           [size]="icons.size16"></svg>
-      <ng-container i18n>Add</ng-container>
-    </button>
-    } @else {
-    <div class="pb-2 my-2 border-bottom">
-      <span *ngFor="let filter of appliedFilters">
-        <cds-tag class="tag-dark me-2">{{ filter.name }}: {{ filter.value.formatted }}</cds-tag>
-      </span>
-      <a class="tc_clearSelections"
-         href=""
-         (click)="clearDevices(); false">
-        <svg [cdsIcon]="icons.clearFilters"
-             [size]="icons.size16"></svg>
-        <ng-container i18n>Clear</ng-container>
-      </a>
-    </div>
-    <div>
-      <cd-inventory-devices [devices]="devices"
-                            [hiddenColumns]="['available', 'osd_ids']"
-                            [filterColumns]="[]">
-      </cd-inventory-devices>
-    </div>
-    }
+      @if (devices.length === 0) {
+        <button
+          type="button"
+          class="btn btn-light"
+          (click)="showSelectionModal()"
+          data-toggle="tooltip"
+          [title]="addButtonTooltip"
+          [disabled]="availDevices.length === 0 || !canSelect || expansionCanSelect"
+        >
+          <svg
+            [cdsIcon]="icons.add"
+            [size]="icons.size16"
+          ></svg>
+          <ng-container i18n>Add</ng-container>
+        </button>
+      } @else {
+        <div class="pb-2 my-2 border-bottom">
+          <span *ngFor="let filter of appliedFilters">
+            <cds-tag class="tag-dark me-2">{{ filter.name }}: {{ filter.value.formatted }}</cds-tag>
+          </span>
+          <a
+            class="tc_clearSelections"
+            href=""
+            (click)="clearDevices(); (false)"
+          >
+            <svg
+              [cdsIcon]="icons.clearFilters"
+              [size]="icons.size16"
+            ></svg>
+            <ng-container i18n>Clear</ng-container>
+          </a>
+        </div>
+        <div>
+          <cd-inventory-devices
+            [devices]="devices"
+            [hiddenColumns]="['available', 'osd_ids']"
+            [filterColumns]="[]"
+          >
+          </cd-inventory-devices>
+        </div>
+      }
     }
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-modal/osd-devices-selection-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-modal/osd-devices-selection-modal.component.html
index 2f56dae1ed3..0b632b2fcbb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-modal/osd-devices-selection-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-devices-selection-modal/osd-devices-selection-modal.component.html
@@ -1,42 +1,59 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container class="modal-title"
-                i18n>{{ deviceType }} devices</ng-container>
+  <ng-container
+    class="modal-title"
+    i18n
+    >{{ deviceType }} devices</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form #frm="ngForm"
-          [formGroup]="formGroup"
-          novalidate>
+    <form
+      #frm="ngForm"
+      [formGroup]="formGroup"
+      novalidate
+    >
       <div class="modal-body">
-        <cd-alert-panel *ngIf="!canSubmit"
-                        type="warning"
-                        size="slim"
-                        [showTitle]="false">
-          <ng-container i18n>At least one of these filters must be applied in order to proceed:</ng-container>
-          <cds-tag *ngFor="let filter of requiredFilters"
-                   class="tag-dark ms-2">
-              {{ filter }}
+        <cd-alert-panel
+          *ngIf="!canSubmit"
+          type="warning"
+          size="slim"
+          [showTitle]="false"
+        >
+          <ng-container i18n
+            >At least one of these filters must be applied in order to proceed:</ng-container
+          >
+          <cds-tag
+            *ngFor="let filter of requiredFilters"
+            class="tag-dark ms-2"
+          >
+            {{ filter }}
           </cds-tag>
         </cd-alert-panel>
-        <cd-inventory-devices #inventoryDevices
-                              [devices]="devices"
-                              [filterColumns]="filterColumns"
-                              [hostname]="hostname"
-                              [diskType]="diskType"
-                              [hiddenColumns]="['available', 'osd_ids']"
-                              (filterChange)="onFilterChange($event)">
+        <cd-inventory-devices
+          #inventoryDevices
+          [devices]="devices"
+          [filterColumns]="filterColumns"
+          [hostname]="hostname"
+          [diskType]="diskType"
+          [hiddenColumns]="['available', 'osd_ids']"
+          (filterChange)="onFilterChange($event)"
+        >
         </cd-inventory-devices>
         <div *ngIf="canSubmit">
           <p class="text-center">
-            <span i18n>Number of devices: {{ filteredDevices.length }}. Raw capacity:
-              {{ capacity | dimlessBinary }}.</span>
+            <span i18n
+              >Number of devices: {{ filteredDevices.length }}. Raw capacity:
+              {{ capacity | dimlessBinary }}.</span
+            >
           </p>
         </div>
       </div>
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                              [form]="formGroup"
-                              [disabled]="!canSubmit || filteredDevices.length === 0"
-                              [submitText]="action | titlecase"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [form]="formGroup"
+          [disabled]="!canSubmit || filteredDevices.length === 0"
+          [submitText]="action | titlecase"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html
index 1bc4a90cb61..c2b28ea2090 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-indiv-modal/osd-flags-indiv-modal.component.html
@@ -1,43 +1,54 @@
-<cds-modal size="sm"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        modal-primary-focus
-        i18n>Individual OSD flags</h3>
+    <h3
+      cdsModalHeaderHeading
+      modal-primary-focus
+      i18n
+    >
+      Individual OSD flags
+    </h3>
   </cds-modal-header>
 
   <div cdsModalContent>
-    <form name="osdFlagsForm"
-          [formGroup]="osdFlagsForm"
-          novalidate>
+    <form
+      name="osdFlagsForm"
+      [formGroup]="osdFlagsForm"
+      novalidate
+    >
       <div>
         @for (flag of flags; track flag.code; let last = $last) {
-        <div>
-          <cds-checkbox
-            [checked]="flag.value"
-            [indeterminate]="flag.indeterminate"
-            (checkedChange)="changeValue(flag)"
-            [name]="flag.code"
-            [id]="flag.code"
-          >
-            <strong>{{ flag.name }}</strong>
-            @if (flag.clusterWide) {
-            <cds-tag class="cds-ml-3"
-                     [cdsTooltip]="clusterWideTooltip"
-                     trigger="hover"
-                     i18n>Cluster-wide</cds-tag>
-            }
+          <div>
+            <cds-checkbox
+              [checked]="flag.value"
+              [indeterminate]="flag.indeterminate"
+              (checkedChange)="changeValue(flag)"
+              [name]="flag.code"
+              [id]="flag.code"
+            >
+              <strong>{{ flag.name }}</strong>
+              @if (flag.clusterWide) {
+                <cds-tag
+                  class="cds-ml-3"
+                  [cdsTooltip]="clusterWideTooltip"
+                  trigger="hover"
+                  i18n
+                  >Cluster-wide</cds-tag
+                >
+              }
 
-            <div class="cds-mt-4">
-              <cd-help-text>{{ flag.description }}</cd-help-text>
-            </div>
-          </cds-checkbox>
-          @if (!last) {
-          <hr class="cds-m-2" />
-          }
-        </div>
+              <div class="cds-mt-4">
+                <cd-help-text>{{ flag.description }}</cd-help-text>
+              </div>
+            </cds-checkbox>
+            @if (!last) {
+              <hr class="cds-m-2" />
+            }
+          </div>
         }
       </div>
     </form>
@@ -45,24 +56,30 @@
 
   <cds-modal-footer class="osd-footer">
     <cds-button-set>
-      <button cdsButton="secondary"
-              (click)="closeModal()"
-              type="button"
-              i18n>
+      <button
+        cdsButton="secondary"
+        (click)="closeModal()"
+        type="button"
+        i18n
+      >
         Cancel
       </button>
-      <button cdsButton="secondary"
-              (click)="resetSelection()"
-              type="button"
-              i18n>
+      <button
+        cdsButton="secondary"
+        (click)="resetSelection()"
+        type="button"
+        i18n
+      >
         Reset
       </button>
       @if (permissions.osd.update) {
-      <cd-submit-button
-        (submitAction)="submitAction()"
-        [form]="osdFlagsForm"
-        [submitText]="actionLabels.UPDATE">
-        {{ actionLabels.UPDATE }}</cd-submit-button>
+        <cd-submit-button
+          (submitAction)="submitAction()"
+          [form]="osdFlagsForm"
+          [submitText]="actionLabels.UPDATE"
+        >
+          {{ actionLabels.UPDATE }}</cd-submit-button
+        >
       }
     </cds-button-set>
   </cds-modal-footer>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html
index d8981bd41ce..386a2b48c47 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-flags-modal/osd-flags-modal.component.html
@@ -1,37 +1,45 @@
-<cds-modal size="sm"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        modal-primary-focus
-        i18n>Cluster-wide OSD Flags</h3>
+    <h3
+      cdsModalHeaderHeading
+      modal-primary-focus
+      i18n
+    >
+      Cluster-wide OSD Flags
+    </h3>
   </cds-modal-header>
 
   <div cdsModalContent>
-    <form name="osdFlagsForm"
-          [formGroup]="osdFlagsForm"
-          novalidate>
+    <form
+      name="osdFlagsForm"
+      [formGroup]="osdFlagsForm"
+      novalidate
+    >
       <div>
         @for (flag of flags; track flag.code; let last = $last) {
-        <div>
-          <cds-checkbox
-            [checked]="flag.value"
-            (checkedChange)="flag.value = !flag.value"
-            [name]="flag.code"
-            [id]="flag.code"
-            [disabled]="flag.disabled"
-          >
-            <strong>{{ flag.name }}</strong>
+          <div>
+            <cds-checkbox
+              [checked]="flag.value"
+              (checkedChange)="flag.value = !flag.value"
+              [name]="flag.code"
+              [id]="flag.code"
+              [disabled]="flag.disabled"
+            >
+              <strong>{{ flag.name }}</strong>
 
-            <div class="cds-mt-4">
-              <cd-help-text>{{ flag.description }}</cd-help-text>
-            </div>
-          </cds-checkbox>
-          @if (!last) {
-          <hr class="cds-m-2" />
-          }
-        </div>
+              <div class="cds-mt-4">
+                <cd-help-text>{{ flag.description }}</cd-help-text>
+              </div>
+            </cds-checkbox>
+            @if (!last) {
+              <hr class="cds-m-2" />
+            }
+          </div>
         }
       </div>
     </form>
@@ -39,18 +47,22 @@
 
   <cds-modal-footer>
     <cds-button-set>
-      <button cdsButton="secondary"
-              (click)="closeModal()"
-              type="button"
-              i18n>
+      <button
+        cdsButton="secondary"
+        (click)="closeModal()"
+        type="button"
+        i18n
+      >
         Cancel
       </button>
       @if (permissions.osd.update) {
-      <cd-submit-button
-        (submitAction)="submitAction()"
-        [form]="osdFlagsForm"
-        [submitText]="actionLabels.UPDATE">
-        {{ actionLabels.UPDATE }}</cd-submit-button>
+        <cd-submit-button
+          (submitAction)="submitAction()"
+          [form]="osdFlagsForm"
+          [submitText]="actionLabels.UPDATE"
+        >
+          {{ actionLabels.UPDATE }}</cd-submit-button
+        >
       }
     </cds-button-set>
   </cds-modal-footer>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
index 700c8af631e..73bb4bbbd2a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-form/osd-form.component.html
@@ -9,445 +9,560 @@
   (closeRequested)="onCancel()"
   (stepChanged)="populateReviewData()"
   [isSubmitLoading]="isSubmitLoading"
-  [submitButtonLabel]="createOsdsLabel">
+  [submitButtonLabel]="createOsdsLabel"
+>
   type="wide">
-<!-- [submitButtonLabel]="simpleDeployment ? createOsdsLabel : actionLabels.PREVIEW" -->
+  <!-- [submitButtonLabel]="simpleDeployment ? createOsdsLabel : actionLabels.PREVIEW" -->
   <cd-tearsheet-step>
-  <div class="osd-tearsheet-content">
-    <form
-    [formGroup]="form"
-    cdsStack="vertical"
-    [gap]="6">
-
-    @if (!hasEligibleDevices) {
-    <cd-alert-panel
-      type="warning"
-      class="osd-alert-block"
-      i18n>
-      <div
-      cdsStack="vertical"
-      [gap]="2">
-      <span class="cds--type-heading-compact-01">
-        No eligible devices found for OSD creation.
-      </span>
-      <span class="cds--type-body-compact-01">
-        Physical disks may be present, but none meet the requirements
-        (unused, unformatted, and not already configured by Ceph).
-      </span>
-      </div>
-    </cd-alert-panel>
-    }
-
-    <div>
-      <cds-text-label
-      class="cds--type-heading-compact-02 cds-mb-5"
-      i18n>
-      Deployment Options
-      </cds-text-label>
-
-      <div cdsStack="vertical"
-           [gap]="4">
-        <cds-radio-group
-          formControlName="deploymentMode"
-          orientation="vertical">
-
-          <cds-radio value="automatic"
-                     [disabled]="!hasEligibleDevices ? true : null">
-            <div class="osd-radio-label-wrapper">
-              <span
-              class="cds--type-body-short-01"
-              i18n>
-                Automatic
+    <div class="osd-tearsheet-content">
+      <form
+        [formGroup]="form"
+        cdsStack="vertical"
+        [gap]="6"
+      >
+        @if (!hasEligibleDevices) {
+          <cd-alert-panel
+            type="warning"
+            class="osd-alert-block"
+            i18n
+          >
+            <div
+              cdsStack="vertical"
+              [gap]="2"
+            >
+              <span class="cds--type-heading-compact-01">
+                No eligible devices found for OSD creation.
+              </span>
+              <span class="cds--type-body-compact-01">
+                Physical disks may be present, but none meet the requirements (unused, unformatted,
+                and not already configured by Ceph).
               </span>
-              <div
-              class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2"
-              i18n>
-                Choose a pre-configured profile for you.
-              </div>
             </div>
-          </cds-radio>
-
-        @if (form.get('deploymentMode').value !== 'manual') {
-        <div class="cds-pl-7 cds-mb-5"
-             cdsStack="vertical"
-             [gap]="4">
-          <cds-text-label
-            class="cds--type-heading-compact-02"
-            i18n>
-            Pre-configured profiles
-          </cds-text-label>
-
-          <cds-radio-group
-            formControlName="deploymentOption"
-            (change)="emitDeploymentSelection()"
-            orientation="vertical">
-
-            @for (optionName of optionNames; track optionName; let isLast = $last) {
-            <cds-radio
-              [value]="optionName"
-              [class.cds-mb-5]="!isLast"
-              [disabled]="!hasEligibleDevices || !deploymentOptions?.options[optionName].available ? true : null">
-
-              <div class="osd-radio-label-wrapper">
-              <span class="cds--type-body-short-01">
-                {{ deploymentOptions?.options[optionName].title }}
-                @if (deploymentOptions?.recommended_option === optionName) {
-                <strong i18n>(Recommended)</strong>
-                }
-              </span>
-
-              <div class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2">
-                {{ deploymentOptions?.options[optionName].desc }}
-              </div>
-              </div>
-            </cds-radio>
-            }
-          </cds-radio-group>
-        </div>
+          </cd-alert-panel>
         }
 
-          <cds-radio value="manual"
-                     [disabled]="!hasEligibleDevices ? true : null">
-            <div class="osd-radio-label-wrapper">
-              <span
-              class="cds--type-body-short-01"
-              i18n>
-                Manual selection
-              </span>
-              <div
-              class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2"
-              i18n>
-                Custom Configuration
-              </div>
-            </div>
-          </cds-radio>
-        </cds-radio-group>
-      </div>
+        <div>
+          <cds-text-label
+            class="cds--type-heading-compact-02 cds-mb-5"
+            i18n
+          >
+            Deployment Options
+          </cds-text-label>
+
+          <div
+            cdsStack="vertical"
+            [gap]="4"
+          >
+            <cds-radio-group
+              formControlName="deploymentMode"
+              orientation="vertical"
+            >
+              <cds-radio
+                value="automatic"
+                [disabled]="!hasEligibleDevices ? true : null"
+              >
+                <div class="osd-radio-label-wrapper">
+                  <span
+                    class="cds--type-body-short-01"
+                    i18n
+                  >
+                    Automatic
+                  </span>
+                  <div
+                    class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2"
+                    i18n
+                  >
+                    Choose a pre-configured profile for you.
+                  </div>
+                </div>
+              </cds-radio>
+
+              @if (form.get('deploymentMode').value !== 'manual') {
+                <div
+                  class="cds-pl-7 cds-mb-5"
+                  cdsStack="vertical"
+                  [gap]="4"
+                >
+                  <cds-text-label
+                    class="cds--type-heading-compact-02"
+                    i18n
+                  >
+                    Pre-configured profiles
+                  </cds-text-label>
+
+                  <cds-radio-group
+                    formControlName="deploymentOption"
+                    (change)="emitDeploymentSelection()"
+                    orientation="vertical"
+                  >
+                    @for (optionName of optionNames; track optionName; let isLast = $last) {
+                      <cds-radio
+                        [value]="optionName"
+                        [class.cds-mb-5]="!isLast"
+                        [disabled]="
+                          !hasEligibleDevices || !deploymentOptions?.options[optionName].available
+                            ? true
+                            : null
+                        "
+                      >
+                        <div class="osd-radio-label-wrapper">
+                          <span class="cds--type-body-short-01">
+                            {{ deploymentOptions?.options[optionName].title }}
+                            @if (deploymentOptions?.recommended_option === optionName) {
+                              <strong i18n>(Recommended)</strong>
+                            }
+                          </span>
+
+                          <div class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2">
+                            {{ deploymentOptions?.options[optionName].desc }}
+                          </div>
+                        </div>
+                      </cds-radio>
+                    }
+                  </cds-radio-group>
+                </div>
+              }
+
+              <cds-radio
+                value="manual"
+                [disabled]="!hasEligibleDevices ? true : null"
+              >
+                <div class="osd-radio-label-wrapper">
+                  <span
+                    class="cds--type-body-short-01"
+                    i18n
+                  >
+                    Manual selection
+                  </span>
+                  <div
+                    class="cds--type-helper-text-01 osd-radio-helper-text cds-mt-2"
+                    i18n
+                  >
+                    Custom Configuration
+                  </div>
+                </div>
+              </cds-radio>
+            </cds-radio-group>
+          </div>
+        </div>
+
+        <div formGroupName="features">
+          <cds-text-label
+            class="cds--type-heading-compact-02 cds-mb-5"
+            i18n
+          >
+            Features
+          </cds-text-label>
+
+          @for (feature of featureList; track feature.key) {
+            <cds-checkbox
+              [name]="feature.key"
+              formControlName="{{ feature.key }}"
+              (checkedChange)="emitDeploymentSelection()"
+            >
+              {{ feature.desc }}
+            </cds-checkbox>
+          }
+        </div>
+      </form>
     </div>
-
-    <div formGroupName="features">
-      <cds-text-label
-      class="cds--type-heading-compact-02 cds-mb-5"
-      i18n>
-      Features
-      </cds-text-label>
-
-    @for (feature of featureList; track feature.key) {
-      <cds-checkbox
-      [name]="feature.key"
-      formControlName="{{ feature.key }}"
-      (checkedChange)="emitDeploymentSelection()">
-      {{ feature.desc }}
-      </cds-checkbox>
-    }
-    </div>
-
-    </form>
-  </div>
   </cd-tearsheet-step>
 
   @if (form.get('deploymentMode').value === 'manual') {
-  <cd-tearsheet-step>
-  <div class="osd-tearsheet-content">
-    <form
-    [formGroup]="form"
-    cdsStack="vertical"
-    [gap]="7">
-
-      <div>
-        <cds-text-label
-        class="cds--type-heading-compact-02 cds-mb-5"
-        i18n>
-        Select data devices
-        </cds-text-label>
-        <cd-osd-devices-selection-groups
-        #dataDeviceSelectionGroups
-        name="Primary"
-        i18n-name
-        type="data"
-        [availDevices]="availDevices"
-        [canSelect]="availDevices.length !== 0"
-        [inlineSelection]="true"
-        (selected)="onDevicesSelected($event)"
-        (cleared)="onDevicesCleared($event)">
-        </cd-osd-devices-selection-groups>
-      </div>
-
-    </form>
-  </div>
-  </cd-tearsheet-step>
-
-  <cd-tearsheet-step>
-  <div class="osd-tearsheet-content">
-    <form
-    [formGroup]="form"
-    cdsStack="vertical"
-    [gap]="7">
-
-      <div>
-        <cds-text-label
-        class="cds--type-heading-compact-02 cds-mb-5"
-        i18n>
-        Select DB/WAL devices (optional)
-        </cds-text-label>
-
-        <div
-        cdsStack="vertical"
-        [gap]="6">
-        <cd-osd-devices-selection-groups
-          #walDeviceSelectionGroups
-          name="WAL"
-          i18n-name
-          type="wal"
-          [availDevices]="availDevices"
-          [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
-          [inlineSelection]="true"
-          (selected)="onDevicesSelected($event)"
-          (cleared)="onDevicesCleared($event)"
-          [hostname]="hostname">
-        </cd-osd-devices-selection-groups>
-
-        @if (walDeviceSelectionGroups.devices.length !== 0) {
+    <cd-tearsheet-step>
+      <div class="osd-tearsheet-content">
+        <form
+          [formGroup]="form"
+          cdsStack="vertical"
+          [gap]="7"
+        >
           <div>
-          <cds-number
-            label="WAL slots"
-            i18n-label
-            helperText="How many OSDs per WAL device. Specify 0 to let Orchestrator backend decide it."
-            i18n-helperText
-            id="walSlots"
-            formControlName="walSlots"
-            min="0">
-          </cds-number>
+            <cds-text-label
+              class="cds--type-heading-compact-02 cds-mb-5"
+              i18n
+            >
+              Select data devices
+            </cds-text-label>
+            <cd-osd-devices-selection-groups
+              #dataDeviceSelectionGroups
+              name="Primary"
+              i18n-name
+              type="data"
+              [availDevices]="availDevices"
+              [canSelect]="availDevices.length !== 0"
+              [inlineSelection]="true"
+              (selected)="onDevicesSelected($event)"
+              (cleared)="onDevicesCleared($event)"
+            >
+            </cd-osd-devices-selection-groups>
           </div>
-        }
-
-        <cd-osd-devices-selection-groups
-          #dbDeviceSelectionGroups
-          name="DB"
-          i18n-name
-          type="db"
-          [availDevices]="availDevices"
-          [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
-          [inlineSelection]="true"
-          (selected)="onDevicesSelected($event)"
-          (cleared)="onDevicesCleared($event)"
-          [hostname]="hostname">
-        </cd-osd-devices-selection-groups>
-
-        @if (dbDeviceSelectionGroups.devices.length !== 0) {
-          <div>
-          <cds-number
-            label="DB slots"
-            i18n-label
-            helperText="How many OSDs per DB device. Specify 0 to let Orchestrator backend decide it."
-            i18n-helperText
-            id="dbSlots"
-            formControlName="dbSlots"
-            min="0">
-          </cds-number>
-          </div>
-        }
-        </div>
-
+        </form>
       </div>
-    </form>
-  </div>
-  </cd-tearsheet-step>
-  }
-
+    </cd-tearsheet-step>
 
     <cd-tearsheet-step>
+      <div class="osd-tearsheet-content">
+        <form
+          [formGroup]="form"
+          cdsStack="vertical"
+          [gap]="7"
+        >
+          <div>
+            <cds-text-label
+              class="cds--type-heading-compact-02 cds-mb-5"
+              i18n
+            >
+              Select DB/WAL devices (optional)
+            </cds-text-label>
+
+            <div
+              cdsStack="vertical"
+              [gap]="6"
+            >
+              <cd-osd-devices-selection-groups
+                #walDeviceSelectionGroups
+                name="WAL"
+                i18n-name
+                type="wal"
+                [availDevices]="availDevices"
+                [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
+                [inlineSelection]="true"
+                (selected)="onDevicesSelected($event)"
+                (cleared)="onDevicesCleared($event)"
+                [hostname]="hostname"
+              >
+              </cd-osd-devices-selection-groups>
+
+              @if (walDeviceSelectionGroups.devices.length !== 0) {
+                <div>
+                  <cds-number
+                    label="WAL slots"
+                    i18n-label
+                    helperText="How many OSDs per WAL device. Specify 0 to let Orchestrator backend decide it."
+                    i18n-helperText
+                    id="walSlots"
+                    formControlName="walSlots"
+                    min="0"
+                  >
+                  </cds-number>
+                </div>
+              }
+
+              <cd-osd-devices-selection-groups
+                #dbDeviceSelectionGroups
+                name="DB"
+                i18n-name
+                type="db"
+                [availDevices]="availDevices"
+                [canSelect]="dataDeviceSelectionGroups.devices.length !== 0"
+                [inlineSelection]="true"
+                (selected)="onDevicesSelected($event)"
+                (cleared)="onDevicesCleared($event)"
+                [hostname]="hostname"
+              >
+              </cd-osd-devices-selection-groups>
+
+              @if (dbDeviceSelectionGroups.devices.length !== 0) {
+                <div>
+                  <cds-number
+                    label="DB slots"
+                    i18n-label
+                    helperText="How many OSDs per DB device. Specify 0 to let Orchestrator backend decide it."
+                    i18n-helperText
+                    id="dbSlots"
+                    formControlName="dbSlots"
+                    min="0"
+                  >
+                  </cds-number>
+                </div>
+              }
+            </div>
+          </div>
+        </form>
+      </div>
+    </cd-tearsheet-step>
+  }
+
+  <cd-tearsheet-step>
     <div class="osd-tearsheet-content">
       <div
         cdsGrid
         [useCssGrid]="true"
         [narrow]="true"
-        [fullWidth]="true">
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }">
-        <h3
-          class="cds--type-heading-03 cds-mb-5"
-          i18n>Review summary</h3>
-      </div>
-
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>Deployment mode</p>
-        <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentModeLabel }}</p>
-      </div>
-
-      @if (simpleDeployment) {
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>Profile</p>
-        <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentOptionTitle }}</p>
-      </div>
-
-      <div
+        [fullWidth]="true"
+      >
+        <div
           cdsCol
           [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>Profile details</p>
-        <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentOptionDescription }}</p>
-      </div>
-      } @else {
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>Host pattern</p>
-        <p class="cds--type-label-02 cds-mt-2">{{ reviewHostPattern }}</p>
-      </div>
-
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
-          class="cds-mt-7">
-        <h4
-          class="cds--type-heading-compact-01"
-          i18n>Device selections</h4>
-      </div>
-
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>Data devices</p>
-        @if (reviewDataSelection.hasSelection) {
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>{{ reviewDataSelection.count }} device(s) selected</p>
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>Total capacity: {{ reviewDataSelection.capacity }}</p>
-        @if (reviewDataSelection.filters.length > 0) {
-        <div class="osd-review-section cds-pl-4 cds-mt-3">
-         @for (filter of reviewDataSelection.filters; track filter.label + filter.value) {
-          <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
-          <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
-         }
-        </div>
-        }
-        } @else {
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>None selected</p>
-        }
-      </div>
-
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>WAL devices</p>
-        @if (reviewWalSelection.hasSelection) {
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>{{ reviewWalSelection.count }} device(s) selected</p>
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>Total capacity: {{ reviewWalSelection.capacity }}</p>
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>WAL slots: {{ reviewWalSelection.slots }}</p>
-        @if (reviewWalSelection.filters.length > 0) {
-        <div class="osd-review-section cds-pl-4 cds-mt-3">
-         @for (filter of reviewWalSelection.filters; track filter.label + filter.value) {
-          <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
-          <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
-         }
-        </div>
-        }
-        } @else {
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>None selected</p>
-        }
-      </div>
-
-      <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-          class="cds-mt-5">
-        <p
-          class="cds--type-label-01"
-          i18n>DB devices</p>
-        @if (reviewDbSelection.hasSelection) {
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>{{ reviewDbSelection.count }} device(s) selected</p>
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>Total capacity: {{ reviewDbSelection.capacity }}</p>
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>DB slots: {{ reviewDbSelection.slots }}</p>
-        @if (reviewDbSelection.filters.length > 0) {
-        <div class="osd-review-section cds-pl-4 cds-mt-3">
-         @for (filter of reviewDbSelection.filters; track filter.label + filter.value) {
-          <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
-          <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
-         }
-        </div>
-        }
-        } @else {
-        <p
-          class="cds--type-label-02 cds-mt-2"
-          i18n>None selected</p>
-        }
-      </div>
-
-       <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
-          class="cds-mt-7">
-        <h4
-          class="cds--type-heading-compact-01"
-          i18n>Device Groups</h4>
-      </div>
-
-       <div
-          cdsCol
-          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-          class="cds-mt-5">
-          <p
-            class="cds--type-label-01"
-            i18n>Service Type</p>
-          <p
-            class="cds--type-label-02 cds-mt-2"
-            i18n>{{driveGroup.spec.service_type}}</p>   
+        >
+          <h3
+            class="cds--type-heading-03 cds-mb-5"
+            i18n
+          >
+            Review summary
+          </h3>
         </div>
 
         <div
           cdsCol
-          [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
-          class="cds-mt-5">
+          [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+          class="cds-mt-5"
+        >
           <p
             class="cds--type-label-01"
-            i18n>Service ID</p>
-          <p
-            class="cds--type-label-02 cds-mt-2"
-            i18n>{{driveGroup.spec.service_id}}</p>       
+            i18n
+          >
+            Deployment mode
+          </p>
+          <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentModeLabel }}</p>
         </div>
 
-        <!-- <div
+        @if (simpleDeployment) {
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              Profile
+            </p>
+            <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentOptionTitle }}</p>
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              Profile details
+            </p>
+            <p class="cds--type-label-02 cds-mt-2">{{ reviewDeploymentOptionDescription }}</p>
+          </div>
+        } @else {
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 2, md: 4, lg: 6 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              Host pattern
+            </p>
+            <p class="cds--type-label-02 cds-mt-2">{{ reviewHostPattern }}</p>
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+            class="cds-mt-7"
+          >
+            <h4
+              class="cds--type-heading-compact-01"
+              i18n
+            >
+              Device selections
+            </h4>
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              Data devices
+            </p>
+            @if (reviewDataSelection.hasSelection) {
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                {{ reviewDataSelection.count }} device(s) selected
+              </p>
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                Total capacity: {{ reviewDataSelection.capacity }}
+              </p>
+              @if (reviewDataSelection.filters.length > 0) {
+                <div class="osd-review-section cds-pl-4 cds-mt-3">
+                  @for (filter of reviewDataSelection.filters; track filter.label + filter.value) {
+                    <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
+                    <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
+                  }
+                </div>
+              }
+            } @else {
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                None selected
+              </p>
+            }
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              WAL devices
+            </p>
+            @if (reviewWalSelection.hasSelection) {
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                {{ reviewWalSelection.count }} device(s) selected
+              </p>
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                Total capacity: {{ reviewWalSelection.capacity }}
+              </p>
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                WAL slots: {{ reviewWalSelection.slots }}
+              </p>
+              @if (reviewWalSelection.filters.length > 0) {
+                <div class="osd-review-section cds-pl-4 cds-mt-3">
+                  @for (filter of reviewWalSelection.filters; track filter.label + filter.value) {
+                    <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
+                    <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
+                  }
+                </div>
+              }
+            } @else {
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                None selected
+              </p>
+            }
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              DB devices
+            </p>
+            @if (reviewDbSelection.hasSelection) {
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                {{ reviewDbSelection.count }} device(s) selected
+              </p>
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                Total capacity: {{ reviewDbSelection.capacity }}
+              </p>
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                DB slots: {{ reviewDbSelection.slots }}
+              </p>
+              @if (reviewDbSelection.filters.length > 0) {
+                <div class="osd-review-section cds-pl-4 cds-mt-3">
+                  @for (filter of reviewDbSelection.filters; track filter.label + filter.value) {
+                    <p class="cds--type-label-01 cds-mb-2">{{ filter.label }}</p>
+                    <p class="cds--type-label-02 cds-mt-1">{{ filter.value }}</p>
+                  }
+                </div>
+              }
+            } @else {
+              <p
+                class="cds--type-label-02 cds-mt-2"
+                i18n
+              >
+                None selected
+              </p>
+            }
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
+            class="cds-mt-7"
+          >
+            <h4
+              class="cds--type-heading-compact-01"
+              i18n
+            >
+              Device Groups
+            </h4>
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              Service Type
+            </p>
+            <p
+              class="cds--type-label-02 cds-mt-2"
+              i18n
+            >
+              {{ driveGroup.spec.service_type }}
+            </p>
+          </div>
+
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
+            class="cds-mt-5"
+          >
+            <p
+              class="cds--type-label-01"
+              i18n
+            >
+              Service ID
+            </p>
+            <p
+              class="cds--type-label-02 cds-mt-2"
+              i18n
+            >
+              {{ driveGroup.spec.service_id }}
+            </p>
+          </div>
+
+          <!-- <div
           cdsCol
           [columnNumbers]="{ sm: 4, md: 4, lg: 4 }"
           class="cds-mt-5">
@@ -459,33 +574,40 @@
               <p class="cds--type-label-02 cds-mt-1">{{ driveGroup.spec.data_devices.rotational }}</p>
             </div>       
         </div> -->
+        }
 
-      }
-
-      <div
+        <div
           cdsCol
           [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
-          class="cds-mt-7">
-        <h4
-          class="cds--type-heading-compact-01"
-          i18n>Features</h4>
-      </div>
+          class="cds-mt-7"
+        >
+          <h4
+            class="cds--type-heading-compact-01"
+            i18n
+          >
+            Features
+          </h4>
+        </div>
 
-      <div
+        <div
           cdsCol
           [columnNumbers]="{ sm: 4, md: 8, lg: 12 }"
-          class="cds-mt-5">
-        @if (reviewEnabledFeatures.length > 0) {
-        @for (feature of reviewEnabledFeatures; track feature) {
-        <p class="cds--type-label-02 osd-review-item">{{ feature }}</p>
-        }
-        } @else {
-        <p
-          class="cds--type-label-02"
-          i18n>No features enabled</p>
-        }
-      </div>
+          class="cds-mt-5"
+        >
+          @if (reviewEnabledFeatures.length > 0) {
+            @for (feature of reviewEnabledFeatures; track feature) {
+              <p class="cds--type-label-02 osd-review-item">{{ feature }}</p>
+            }
+          } @else {
+            <p
+              class="cds--type-label-02"
+              i18n
+            >
+              No features enabled
+            </p>
+          }
+        </div>
       </div>
     </div>
-    </cd-tearsheet-step>
-  </cd-tearsheet>
+  </cd-tearsheet-step>
+</cd-tearsheet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
index ca7e1b800d2..390244a10b6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.html
@@ -1,68 +1,83 @@
 <ng-template #osdTableTpl>
-  <cd-table [data]="osds"
-            (fetchData)="getOsdList($event)"
-            [columns]="columns"
-            selectionType="multiClick"
-            [hasDetails]="true"
-            (setExpandedRow)="setExpandedRow($event)"
-            (updateSelection)="updateSelection($event)"
-            [updateSelectionOnRefresh]="'never'"
-            [serverSide]="true"
-            [count]="count">
-
+  <cd-table
+    [data]="osds"
+    (fetchData)="getOsdList($event)"
+    [columns]="columns"
+    selectionType="multiClick"
+    [hasDetails]="true"
+    (setExpandedRow)="setExpandedRow($event)"
+    (updateSelection)="updateSelection($event)"
+    [updateSelectionOnRefresh]="'never'"
+    [serverSide]="true"
+    [count]="count"
+  >
     <div class="table-actions">
-      <cd-table-actions [permission]="permissions.osd"
-                        [selection]="selection"
-                        class="btn-group"
-                        id="osd-actions"
-                        [tableActions]="tableActions">
+      <cd-table-actions
+        [permission]="permissions.osd"
+        [selection]="selection"
+        class="btn-group"
+        id="osd-actions"
+        [tableActions]="tableActions"
+      >
       </cd-table-actions>
-      <cd-table-actions [permission]="{read: true}"
-                        [selection]="selection"
-                        dropDownOnly="Cluster-wide configuration"
-                        [dropDownOnlyOffset]="{ x: 110, y: 0 }"
-                        [dropDownOnlyBtnColor]="'tertiary'"
-                        class="btn-group"
-                        id="cluster-wide-actions"
-                        [tableActions]="clusterWideActions">
+      <cd-table-actions
+        [permission]="{ read: true }"
+        [selection]="selection"
+        dropDownOnly="Cluster-wide configuration"
+        [dropDownOnlyOffset]="{ x: 110, y: 0 }"
+        [dropDownOnlyBtnColor]="'tertiary'"
+        class="btn-group"
+        id="cluster-wide-actions"
+        [tableActions]="clusterWideActions"
+      >
       </cd-table-actions>
     </div>
 
-    <cd-osd-details *cdTableDetail
-                    [selection]="expandedRow">
+    <cd-osd-details
+      *cdTableDetail
+      [selection]="expandedRow"
+    >
     </cd-osd-details>
   </cd-table>
 </ng-template>
 
 @if (showTabs) {
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+  >
     <ng-container ngbNavItem>
-      <a ngbNavLink
-         i18n>OSDs List</a>
+      <a
+        ngbNavLink
+        i18n
+        >OSDs List</a
+      >
       <ng-template ngbNavContent>
         <ng-container *ngTemplateOutlet="osdTableTpl"></ng-container>
       </ng-template>
     </ng-container>
 
-  @if (permissions.grafana.read) {
-    <ng-container ngbNavItem>
-      <a
-        ngbNavLink
-        i18n>Overall Performance</a>
-      <ng-template
-        ngbNavContent>
-        <cd-grafana i18n-title
-                    title="OSD list"
-                    [grafanaPath]="'ceph-osds-overview?'"
-                    [type]="'metrics'"
-                    uid="lo02I1Aiz"
-                    grafanaStyle="three">
-        </cd-grafana>
-      </ng-template>
-    </ng-container>
-  }
+    @if (permissions.grafana.read) {
+      <ng-container ngbNavItem>
+        <a
+          ngbNavLink
+          i18n
+          >Overall Performance</a
+        >
+        <ng-template ngbNavContent>
+          <cd-grafana
+            i18n-title
+            title="OSD list"
+            [grafanaPath]="'ceph-osds-overview?'"
+            [type]="'metrics'"
+            uid="lo02I1Aiz"
+            grafanaStyle="three"
+          >
+          </cd-grafana>
+        </ng-template>
+      </ng-container>
+    }
   </nav>
 
   <div [ngbNavOutlet]="nav"></div>
@@ -70,44 +85,58 @@
   <ng-container *ngTemplateOutlet="osdTableTpl"></ng-container>
 }
 
-<ng-template #markOsdConfirmationTpl
-             let-markActionDescription="markActionDescription"
-             let-osdIds="osdIds">
-  <ng-container i18n><strong>OSD(s) {{ osdIds | join }}</strong> will be marked
-  <strong>{{ markActionDescription }}</strong> if you proceed.</ng-container>
+<ng-template
+  #markOsdConfirmationTpl
+  let-markActionDescription="markActionDescription"
+  let-osdIds="osdIds"
+>
+  <ng-container i18n
+    ><strong>OSD(s) {{ osdIds | join }}</strong> will be marked
+    <strong>{{ markActionDescription }}</strong> if you proceed.</ng-container
+  >
 </ng-template>
 
-<ng-template #criticalConfirmationTpl
-             let-safeToPerform="safeToPerform"
-             let-message="message"
-             let-active="active"
-             let-missingStats="missingStats"
-             let-storedPgs="storedPgs"
-             let-actionDescription="actionDescription"
-             let-osdIds="osdIds">
-  <div *ngIf="!safeToPerform"
-       class="danger mb-3">
+<ng-template
+  #criticalConfirmationTpl
+  let-safeToPerform="safeToPerform"
+  let-message="message"
+  let-active="active"
+  let-missingStats="missingStats"
+  let-storedPgs="storedPgs"
+  let-actionDescription="actionDescription"
+  let-osdIds="osdIds"
+>
+  <div
+    *ngIf="!safeToPerform"
+    class="danger mb-3"
+  >
     <cd-alert-panel type="warning">
       <span i18n>
         The {selection.hasSingleSelection, select, true {OSD is} other {OSDs are}} not safe to be
         {{ actionDescription }}!
       </span>
-      <br>
+      <br />
       <ul class="mb-0 ps-4">
-        <li *ngIf="active.length > 0"
-             i18n>
-          {selection.hasSingleSelection, select, true {} other {{{ active | join }} : }}
+        <li
+          *ngIf="active.length > 0"
+          i18n
+        >
+          {selection.hasSingleSelection, select, true {} other {{{ active | join }} :}}
           Some PGs are currently mapped to
           {active.length === 1, select, true {it} other {them}}.
         </li>
-        <li *ngIf="missingStats.length > 0"
-             i18n>
-          {selection.hasSingleSelection, select, true {} other {{{ missingStats | join }} : }}
+        <li
+          *ngIf="missingStats.length > 0"
+          i18n
+        >
+          {selection.hasSingleSelection, select, true {} other {{{ missingStats | join }} :}}
           There are no reported stats and not all PGs are active and clean.
         </li>
-        <li *ngIf="storedPgs.length > 0"
-             i18n>
-          {selection.hasSingleSelection, select, true {OSD} other {{{ storedPgs | join }} : OSDs }}
+        <li
+          *ngIf="storedPgs.length > 0"
+          i18n
+        >
+          {selection.hasSingleSelection, select, true {OSD} other {{{ storedPgs | join }} : OSDs}}
           still store some PG data and not all PGs are active and clean.
         </li>
         <li *ngIf="message">
@@ -116,8 +145,10 @@
       </ul>
     </cd-alert-panel>
   </div>
-  <div *ngIf="safeToPerform"
-       class="danger mb-3">
+  <div
+    *ngIf="safeToPerform"
+    class="danger mb-3"
+  >
     <cd-alert-panel type="info">
       <span i18n>
         The {selection.hasSingleSelection, select, true {OSD is} other {OSDs are}}
@@ -125,42 +156,59 @@
       </span>
     </cd-alert-panel>
   </div>
-  <ng-container i18n><strong>OSD {{ osdIds | join }}</strong> will be
-  <strong>{{ actionDescription }}</strong> if you proceed.</ng-container>
+  <ng-container i18n
+    ><strong>OSD {{ osdIds | join }}</strong> will be <strong>{{ actionDescription }}</strong> if
+    you proceed.</ng-container
+  >
 </ng-template>
 
-<ng-template #flagsTpl
-             let-row="data.row">
-  <cds-tag *ngFor="let flag of row.cdClusterFlags;"
-           class="tag-hdd me-1">
+<ng-template
+  #flagsTpl
+  let-row="data.row"
+>
+  <cds-tag
+    *ngFor="let flag of row.cdClusterFlags"
+    class="tag-hdd me-1"
+  >
     {{ flag }}
   </cds-tag>
-  <cds-tag *ngFor="let flag of row.cdIndivFlags;"
-           class="tag-info me-1">
-        {{ flag }}
+  <cds-tag
+    *ngFor="let flag of row.cdIndivFlags"
+    class="tag-info me-1"
+  >
+    {{ flag }}
   </cds-tag>
 </ng-template>
 
-<ng-template #osdUsageTpl
-             let-row="data.row">
-  <cd-usage-bar [title]="'osd ' + row.osd"
-                [total]="row.stats.stat_bytes"
-                [used]="row.stats.stat_bytes_used"
-                [warningThreshold]="osdSettings.nearfull_ratio"
-                [errorThreshold]="osdSettings.full_ratio">
+<ng-template
+  #osdUsageTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    [title]="'osd ' + row.osd"
+    [total]="row.stats.stat_bytes"
+    [used]="row.stats.stat_bytes_used"
+    [warningThreshold]="osdSettings.nearfull_ratio"
+    [errorThreshold]="osdSettings.full_ratio"
+  >
   </cd-usage-bar>
 </ng-template>
 
-<ng-template #deleteOsdExtraTpl
-             let-form="form">
+<ng-template
+  #deleteOsdExtraTpl
+  let-form="form"
+>
   <ng-container [formGroup]="form">
     <ng-container formGroupName="child">
       <div class="form-item cds-pt-3">
-        <cds-checkbox id="preserve"
-                      formControlName="preserve"
-                      modal-primary-focus
-                      ariaLabel="preserve"
-                      i18n>Preserve OSD ID(s) for replacement.</cds-checkbox>
+        <cds-checkbox
+          id="preserve"
+          formControlName="preserve"
+          modal-primary-focus
+          ariaLabel="preserve"
+          i18n
+          >Preserve OSD ID(s) for replacement.</cds-checkbox
+        >
       </div>
     </ng-container>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html
index e2c1fc2a4c5..0cccdfd028c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-pg-scrub-modal/osd-pg-scrub-modal.component.html
@@ -1,45 +1,63 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container i18n="form title"
-                class="modal-title">{{ action | titlecase }} {{ resource | upperFirst }}</ng-container>
+  <ng-container
+    i18n="form title"
+    class="modal-title"
+    >{{ action | titlecase }} {{ resource | upperFirst }}</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form #formDir="ngForm"
-          [formGroup]="osdPgScrubForm"
-          novalidate
-          cdFormScope="osd">
+    <form
+      #formDir="ngForm"
+      [formGroup]="osdPgScrubForm"
+      novalidate
+      cdFormScope="osd"
+    >
       <div class="modal-body osd-modal">
         <!-- Basic -->
-        <cd-config-option [optionNames]="basicOptions"
-                          [optionsForm]="osdPgScrubForm"
-                          [optionsFormDir]="formDir"
-                          [optionsFormGroupName]="'basicFormGroup'"
-                          #basicOptionsValues></cd-config-option>
+        <cd-config-option
+          [optionNames]="basicOptions"
+          [optionsForm]="osdPgScrubForm"
+          [optionsFormDir]="formDir"
+          [optionsFormGroupName]="'basicFormGroup'"
+          #basicOptionsValues
+        ></cd-config-option>
         <!-- Advanced -->
         <div class="row">
           <div class="col-sm-12">
-            <a class="pull-right margin-right-md"
-               (click)="advancedEnabled = true"
-               (keydown.enter)="advancedEnabled = true"
-               *ngIf="!advancedEnabled"
-               i18n
-               tabindex="0">Advanced...</a>
+            <a
+              class="pull-right margin-right-md"
+              (click)="advancedEnabled = true"
+              (keydown.enter)="advancedEnabled = true"
+              *ngIf="!advancedEnabled"
+              i18n
+              tabindex="0"
+              >Advanced...</a
+            >
           </div>
         </div>
         <div *ngIf="advancedEnabled">
-          <h3 class="page-header"
-              i18n>Advanced configuration options</h3>
-          <cd-config-option [optionNames]="advancedOptions"
-                            [optionsForm]="osdPgScrubForm"
-                            [optionsFormDir]="formDir"
-                            [optionsFormGroupName]="'advancedFormGroup'"
-                            #advancedOptionsValues></cd-config-option>
+          <h3
+            class="page-header"
+            i18n
+          >
+            Advanced configuration options
+          </h3>
+          <cd-config-option
+            [optionNames]="advancedOptions"
+            [optionsForm]="osdPgScrubForm"
+            [optionsFormDir]="formDir"
+            [optionsFormGroupName]="'advancedFormGroup'"
+            #advancedOptionsValues
+          ></cd-config-option>
         </div>
       </div>
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="submitAction()"
-                              [form]="osdPgScrubForm"
-                              [showSubmit]="permissions.configOpt.update"
-                              [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)">
+        <cd-form-button-panel
+          (submitActionEvent)="submitAction()"
+          [form]="osdPgScrubForm"
+          [showSubmit]="permissions.configOpt.update"
+          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        >
         </cd-form-button-panel>
       </div>
     </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-recv-speed-modal/osd-recv-speed-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-recv-speed-modal/osd-recv-speed-modal.component.html
index ccfc58507aa..478d22b79dd 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-recv-speed-modal/osd-recv-speed-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-recv-speed-modal/osd-recv-speed-modal.component.html
@@ -1,31 +1,46 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container class="modal-title"
-                i18n>OSD Recovery Priority</ng-container>
+  <ng-container
+    class="modal-title"
+    i18n
+    >OSD Recovery Priority</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form #formDir="ngForm"
-          [formGroup]="osdRecvSpeedForm"
-          novalidate
-          cdFormScope="osd">
+    <form
+      #formDir="ngForm"
+      [formGroup]="osdRecvSpeedForm"
+      novalidate
+      cdFormScope="osd"
+    >
       <div class="modal-body">
         <!-- Priority -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="priority"
-                 i18n>Priority</label>
+          <label
+            class="cd-col-form-label required"
+            for="priority"
+            i18n
+            >Priority</label
+          >
           <div class="cd-col-form-input">
-            <select class="form-select"
-                    formControlName="priority"
-                    id="priority"
-                    (change)="onPriorityChange($event.target.value)">
-              <option *ngFor="let priority of priorities"
-                      [value]="priority.name">
+            <select
+              class="form-select"
+              formControlName="priority"
+              id="priority"
+              (change)="onPriorityChange($event.target.value)"
+            >
+              <option
+                *ngFor="let priority of priorities"
+                [value]="priority.name"
+              >
                 {{ priority.text }}
               </option>
             </select>
-            <span class="invalid-feedback"
-                  *ngIf="osdRecvSpeedForm.showError('priority', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="osdRecvSpeedForm.showError('priority', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
         </div>
 
@@ -33,59 +48,94 @@
         <div class="form-group row">
           <div class="cd-col-form-offset">
             <div class="custom-control custom-checkbox">
-              <input formControlName="customizePriority"
-                     class="custom-control-input"
-                     id="customizePriority"
-                     name="customizePriority"
-                     type="checkbox"
-                     (change)="onCustomizePriorityChange()">
-              <label class="custom-control-label"
-                     for="customizePriority"
-                     i18n>Customize priority values</label>
+              <input
+                formControlName="customizePriority"
+                class="custom-control-input"
+                id="customizePriority"
+                name="customizePriority"
+                type="checkbox"
+                (change)="onCustomizePriorityChange()"
+              />
+              <label
+                class="custom-control-label"
+                for="customizePriority"
+                i18n
+                >Customize priority values</label
+              >
             </div>
           </div>
         </div>
 
         <!-- Priority values -->
-        <div class="form-group row"
-             *ngFor="let attr of priorityAttrs | keyvalue">
-          <label class="cd-col-form-label"
-                 [for]="attr.key">
-            <span [ngClass]="{'required': osdRecvSpeedForm.getValue('customizePriority')}">
+        <div
+          class="form-group row"
+          *ngFor="let attr of priorityAttrs | keyvalue"
+        >
+          <label
+            class="cd-col-form-label"
+            [for]="attr.key"
+          >
+            <span [ngClass]="{ required: osdRecvSpeedForm.getValue('customizePriority') }">
               {{ attr.value.text }}
             </span>
             <cd-helper *ngIf="attr.value.desc">{{ attr.value.desc }}</cd-helper>
           </label>
           <div class="cd-col-form-input">
-            <input class="form-control"
-                   type="number"
-                   [id]="attr.key"
-                   [formControlName]="attr.key"
-                   [readonly]="!osdRecvSpeedForm.getValue('customizePriority')">
-            <span class="invalid-feedback"
-                  *ngIf="osdRecvSpeedForm.getValue('customizePriority') &&
-                  osdRecvSpeedForm.showError(attr.key, formDir, 'required')"
-                  i18n>This field is required!</span>
-            <span class="invalid-feedback"
-                  *ngIf="osdRecvSpeedForm.getValue('customizePriority') &&
-                  osdRecvSpeedForm.showError(attr.key, formDir, 'pattern')"
-                  i18n>{{ attr.value.patternHelpText }}</span>
-            <span class="invalid-feedback"
-                  *ngIf="osdRecvSpeedForm.getValue('customizePriority') &&
-                  osdRecvSpeedForm.showError(attr.key, formDir, 'max')"
-                  i18n>The entered value is too high! It must not be greater than {{ attr.value.maxValue }}.</span>
-            <span class="invalid-feedback"
-                  *ngIf="osdRecvSpeedForm.getValue('customizePriority') &&
-                  osdRecvSpeedForm.showError(attr.key, formDir, 'min')"
-                  i18n>The entered value is too low! It must not be lower than {{ attr.value.minValue }}.</span>
+            <input
+              class="form-control"
+              type="number"
+              [id]="attr.key"
+              [formControlName]="attr.key"
+              [readonly]="!osdRecvSpeedForm.getValue('customizePriority')"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="
+                osdRecvSpeedForm.getValue('customizePriority') &&
+                osdRecvSpeedForm.showError(attr.key, formDir, 'required')
+              "
+              i18n
+              >This field is required!</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="
+                osdRecvSpeedForm.getValue('customizePriority') &&
+                osdRecvSpeedForm.showError(attr.key, formDir, 'pattern')
+              "
+              i18n
+              >{{ attr.value.patternHelpText }}</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="
+                osdRecvSpeedForm.getValue('customizePriority') &&
+                osdRecvSpeedForm.showError(attr.key, formDir, 'max')
+              "
+              i18n
+              >The entered value is too high! It must not be greater than
+              {{ attr.value.maxValue }}.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="
+                osdRecvSpeedForm.getValue('customizePriority') &&
+                osdRecvSpeedForm.showError(attr.key, formDir, 'min')
+              "
+              i18n
+              >The entered value is too low! It must not be lower than
+              {{ attr.value.minValue }}.</span
+            >
           </div>
         </div>
       </div>
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="submitAction()"
-                              [form]="osdRecvSpeedForm"
-                              [submitText]="actionLabels.UPDATE"
-                              [showSubmit]="permissions.configOpt.update"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="submitAction()"
+          [form]="osdRecvSpeedForm"
+          [submitText]="actionLabels.UPDATE"
+          [showSubmit]="permissions.configOpt.update"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-reweight-modal/osd-reweight-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-reweight-modal/osd-reweight-modal.component.html
index e5aa22311f1..48cfc9eadfd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-reweight-modal/osd-reweight-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-reweight-modal/osd-reweight-modal.component.html
@@ -1,37 +1,55 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container class="modal-title"
-                i18n>Reweight OSD: {{ osdId }}</ng-container>
+  <ng-container
+    class="modal-title"
+    i18n
+    >Reweight OSD: {{ osdId }}</ng-container
+  >
 
   <ng-container class="modal-content">
     <form [formGroup]="reweightForm">
       <div class="modal-body">
         <div class="row">
-          <label for="weight"
-                 class="cd-col-form-label">Weight</label>
+          <label
+            for="weight"
+            class="cd-col-form-label"
+            >Weight</label
+          >
           <div class="cd-col-form-input">
-            <input id="weight"
-                   class="form-control"
-                   type="number"
-                   step="0.1"
-                   formControlName="weight"
-                   min="0"
-                   max="1"
-                   [value]="currentWeight">
-            <span class="invalid-feedback"
-                  *ngIf="weight.errors">
-              <span *ngIf="weight.errors?.required"
-                    i18n>This field is required.</span>
-              <span *ngIf="weight.errors?.max || weight.errors?.min"
-                    i18n>The value needs to be between 0 and 1.</span>
+            <input
+              id="weight"
+              class="form-control"
+              type="number"
+              step="0.1"
+              formControlName="weight"
+              min="0"
+              max="1"
+              [value]="currentWeight"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="weight.errors"
+            >
+              <span
+                *ngIf="weight.errors?.required"
+                i18n
+                >This field is required.</span
+              >
+              <span
+                *ngIf="weight.errors?.max || weight.errors?.min"
+                i18n
+                >The value needs to be between 0 and 1.</span
+              >
             </span>
           </div>
         </div>
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="reweight()"
-                              [form]="reweightForm"
-                              [submitText]="actionLabels.REWEIGHT"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="reweight()"
+          [form]="reweightForm"
+          [submitText]="actionLabels.REWEIGHT"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-scrub-modal/osd-scrub-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-scrub-modal/osd-scrub-modal.component.html
index 568c700fa69..4fcd483adbb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-scrub-modal/osd-scrub-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-scrub-modal/osd-scrub-modal.component.html
@@ -1,21 +1,31 @@
 <cd-modal [modalRef]="activeModal">
-  <span class="modal-title"
-        i18n>OSDs {deep, select, true {Deep } other {}}Scrub</span>
+  <span
+    class="modal-title"
+    i18n
+    >OSDs {deep, select, true {Deep} other {}}Scrub</span
+  >
 
   <ng-container class="modal-content">
-    <form name="scrubForm"
-          #formDir="ngForm"
-          [formGroup]="scrubForm"
-          novalidate>
+    <form
+      name="scrubForm"
+      #formDir="ngForm"
+      [formGroup]="scrubForm"
+      novalidate
+    >
       <div class="modal-body">
-        <p i18n>You are about to apply a {deep, select, true {deep } other {}}scrub to
-          the OSD(s): <strong>{{ selected | join }}</strong>.</p>
+        <p i18n>
+          You are about to apply a {deep, select, true {deep} other {}}scrub to the OSD(s):
+          <strong>{{ selected | join }}</strong
+          >.
+        </p>
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="scrub()"
-                              [form]="scrubForm"
-                              [submitText]="actionLabels.UPDATE"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="scrub()"
+          [form]="scrubForm"
+          [submitText]="actionLabels.UPDATE"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/active-alert-list/active-alert-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/active-alert-list/active-alert-list.component.html
index dfe87626209..1ea3e54a374 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/active-alert-list/active-alert-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/active-alert-list/active-alert-list.component.html
@@ -1,10 +1,12 @@
 <cd-prometheus-tabs></cd-prometheus-tabs>
 
 @if (!isAlertmanagerConfigured) {
-  <cd-alert-panel type="info"
-                  i18n>To see all active Prometheus alerts, please provide
-    the URL to the API of Prometheus' Alertmanager as described
-    in the&nbsp;<cd-doc section="prometheus"></cd-doc>.</cd-alert-panel>
+  <cd-alert-panel
+    type="info"
+    i18n
+    >To see all active Prometheus alerts, please provide the URL to the API of Prometheus'
+    Alertmanager as described in the&nbsp;<cd-doc section="prometheus"></cd-doc>.</cd-alert-panel
+  >
 }
 
 @if (isAlertmanagerConfigured) {
@@ -29,44 +31,50 @@
     </cd-table-actions>
 
     @if (expandedRow?.alert_count == 1) {
-    <cd-table-key-value
-      *cdTableDetail
-      [renderObjects]="true"
-      [hideEmpty]="true"
-      [appendParentKey]="false"
-      [data]="expandedRow"
-      [customCss]="customCss"
-      [autoReload]="false"
-      [showMultiLineText]="true"
-      [multilineTextKeys]="multilineTextKeys"
-    >
-    </cd-table-key-value>
+      <cd-table-key-value
+        *cdTableDetail
+        [renderObjects]="true"
+        [hideEmpty]="true"
+        [appendParentKey]="false"
+        [data]="expandedRow"
+        [customCss]="customCss"
+        [autoReload]="false"
+        [showMultiLineText]="true"
+        [multilineTextKeys]="multilineTextKeys"
+      >
+      </cd-table-key-value>
     } @else if (expandedRow?.alert_count > 1) {
-    <cd-table
-      *cdTableDetail
-      [data]="expandedRow?.subalerts"
-      [columns]="innerColumns"
-      identifier="fingerprint"
-      [forceIdentifier]="true"
-      columnMode="flex"
-      [toolHeader]="false"
-      [hasDetails]="false"
-      [showMultiLineText]="true"
-      [multilineTextKeys]="multilineTextKeys"
-      [scrollable]="false">
-    </cd-table>
+      <cd-table
+        *cdTableDetail
+        [data]="expandedRow?.subalerts"
+        [columns]="innerColumns"
+        identifier="fingerprint"
+        [forceIdentifier]="true"
+        columnMode="flex"
+        [toolHeader]="false"
+        [hasDetails]="false"
+        [showMultiLineText]="true"
+        [multilineTextKeys]="multilineTextKeys"
+        [scrollable]="false"
+      >
+      </cd-table>
     }
   </cd-table>
 }
 
-<ng-template #externalLinkTpl
-             let-row="data.row"
-             let-value="data.value">
-  <a [href]="value"
-     target="_blank">
-    <svg [cdsIcon]="icons.lineChart"
-         [size]="icons.size16"
-         >
-    </svg> Source
+<ng-template
+  #externalLinkTpl
+  let-row="data.row"
+  let-value="data.value"
+>
+  <a
+    [href]="value"
+    target="_blank"
+  >
+    <svg
+      [cdsIcon]="icons.lineChart"
+      [size]="icons.size16"
+    ></svg>
+    Source
   </a>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/prometheus-tabs/prometheus-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/prometheus-tabs/prometheus-tabs.component.html
index e23d0a96167..40f70bcadd4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/prometheus-tabs/prometheus-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/prometheus-tabs/prometheus-tabs.component.html
@@ -1,33 +1,49 @@
 <nav
   class="nav nav-tabs"
   ngbNav
-  #nav="ngbNav">
+  #nav="ngbNav"
+>
   <ng-container ngbNavItem>
-    <a class="nav-link"
-       routerLink="/monitoring/active-alerts"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Active Alerts
-    <cds-tag *ngIf="prometheusAlertService.activeCriticalAlerts > 0"
-        class="tag-danger ms-1">{{ prometheusAlertService.activeCriticalAlerts }}</cds-tag>
-    <cds-tag *ngIf="prometheusAlertService.activeWarningAlerts > 0"
-        class="tag-warning ms-1">{{ prometheusAlertService.activeWarningAlerts }}</cds-tag></a>
+    <a
+      class="nav-link"
+      routerLink="/monitoring/active-alerts"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Active Alerts
+      <cds-tag
+        *ngIf="prometheusAlertService.activeCriticalAlerts > 0"
+        class="tag-danger ms-1"
+        >{{ prometheusAlertService.activeCriticalAlerts }}</cds-tag
+      >
+      <cds-tag
+        *ngIf="prometheusAlertService.activeWarningAlerts > 0"
+        class="tag-warning ms-1"
+        >{{ prometheusAlertService.activeWarningAlerts }}</cds-tag
+      ></a
+    >
   </ng-container>
   <ng-container ngbNavItem>
-    <a class="nav-link"
-       routerLink="/monitoring/silences"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Silences</a>
+    <a
+      class="nav-link"
+      routerLink="/monitoring/silences"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Silences</a
+    >
   </ng-container>
   <ng-container ngbNavItem>
-    <a class="nav-link"
-       routerLink="/monitoring/alerts"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Alert Rules</a>
+    <a
+      class="nav-link"
+      routerLink="/monitoring/alerts"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Alert Rules</a
+    >
   </ng-container>
 </nav>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/rules-list/rules-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/rules-list/rules-list.component.html
index c602ac1c580..daab4d7dd51 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/rules-list/rules-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/rules-list/rules-list.component.html
@@ -1,23 +1,29 @@
 <cd-prometheus-tabs></cd-prometheus-tabs>
 
-<cd-alert-panel *ngIf="!isPrometheusConfigured"
-                type="info"
-                i18n>To see all configured Prometheus alerts, please
-  provide the URL to the API of Prometheus as described in
-  the &nbsp;<cd-doc section="prometheus"></cd-doc>.</cd-alert-panel>
+<cd-alert-panel
+  *ngIf="!isPrometheusConfigured"
+  type="info"
+  i18n
+  >To see all configured Prometheus alerts, please provide the URL to the API of Prometheus as
+  described in the &nbsp;<cd-doc section="prometheus"></cd-doc>.</cd-alert-panel
+>
 
-<cd-table *ngIf="isPrometheusConfigured"
-          [data]="rules"
-          [columns]="columns"
-          [selectionType]="'single'"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  *ngIf="isPrometheusConfigured"
+  [data]="rules"
+  [columns]="columns"
+  [selectionType]="'single'"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+>
   <ng-container *ngIf="expandedRow">
-    <cd-table-key-value *cdTableDetail
-                        [data]="expandedRow"
-                        [renderObjects]="true"
-                        [hideKeys]="hideKeys">
+    <cd-table-key-value
+      *cdTableDetail
+      [data]="expandedRow"
+      [renderObjects]="true"
+      [hideKeys]="hideKeys"
+    >
     </cd-table-key-value>
   </ng-container>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-form/silence-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-form/silence-form.component.html
index e7411a05a0a..f3b6c336d23 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-form/silence-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-form/silence-form.component.html
@@ -1,194 +1,275 @@
-<ng-template #matcherTpl
-             let-matcher="matcher"
-             let-index="index">
+<ng-template
+  #matcherTpl
+  let-matcher="matcher"
+  let-index="index"
+>
   <div class="input-group my-2">
     <ng-container *ngFor="let config of matcherConfig">
-      <span class="input-group-text"
-            *ngIf="config.attribute === 'isRegex'">
-        <i *ngIf="matcher[config.attribute]"
-           [ngbTooltip]="config.tooltip">~</i>
-        <i *ngIf="!matcher[config.attribute]"
-           ngbTooltip="Equals">=</i>
+      <span
+        class="input-group-text"
+        *ngIf="config.attribute === 'isRegex'"
+      >
+        <i
+          *ngIf="matcher[config.attribute]"
+          [ngbTooltip]="config.tooltip"
+          >~</i
+        >
+        <i
+          *ngIf="!matcher[config.attribute]"
+          ngbTooltip="Equals"
+          >=</i
+        >
       </span>
 
       <ng-container *ngIf="config.attribute !== 'isRegex'">
-        <input type="text"
-               id="matcher-{{config.attribute}}-{{index}}"
-               class="form-control"
-               [value]="matcher[config.attribute]"
-               disabled
-               readonly>
+        <input
+          type="text"
+          id="matcher-{{ config.attribute }}-{{ index }}"
+          class="form-control"
+          [value]="matcher[config.attribute]"
+          disabled
+          readonly
+        />
       </ng-container>
     </ng-container>
 
     <!-- Matcher actions -->
-    <button type="button"
-            class="btn btn-light"
-            id="matcher-edit-{{index}}"
-            i18n-ngbTooltip
-            ngbTooltip="Edit"
-            (click)="showMatcherModal(index)">
+    <button
+      type="button"
+      class="btn btn-light"
+      id="matcher-edit-{{ index }}"
+      i18n-ngbTooltip
+      ngbTooltip="Edit"
+      (click)="showMatcherModal(index)"
+    >
       <svg
-      [cdsIcon]="icons.edit"
-      [size]="icons.size16"
-      class="cds-info-color"></svg>
+        [cdsIcon]="icons.edit"
+        [size]="icons.size16"
+        class="cds-info-color"
+      ></svg>
     </button>
-    <button type="button"
-            class="btn btn-light"
-            id="matcher-delete-{{index}}"
-            i18n-ngbTooltip
-            ngbTooltip="Delete"
-            (click)="deleteMatcher(index)">
-      <svg [cdsIcon]="icons.trash"
-           [size]="icons.size16"
-           class="cds-info-color"></svg>
+    <button
+      type="button"
+      class="btn btn-light"
+      id="matcher-delete-{{ index }}"
+      i18n-ngbTooltip
+      ngbTooltip="Delete"
+      (click)="deleteMatcher(index)"
+    >
+      <svg
+        [cdsIcon]="icons.trash"
+        [size]="icons.size16"
+        class="cds-info-color"
+      ></svg>
     </button>
   </div>
   <span class="help-block"></span>
 </ng-template>
 
 <div class="cd-col-form">
-  <form #formDir="ngForm"
-        [formGroup]="form"
-        class="form"
-        name="form"
-        novalidate>
+  <form
+    #formDir="ngForm"
+    [formGroup]="form"
+    class="form"
+    name="form"
+    novalidate
+  >
     <div class="card">
       <div class="card-header">
         <span i18n>{{ action | titlecase }} {{ resource | upperFirst }}</span>
-        <cd-helper *ngIf="edit"
-                   i18n>Editing a silence will expire the old silence and recreate it as a new silence</cd-helper>
+        <cd-helper
+          *ngIf="edit"
+          i18n
+          >Editing a silence will expire the old silence and recreate it as a new silence</cd-helper
+        >
       </div>
 
       <!-- Creator -->
       <div class="card-body">
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="created-by"
-                 i18n>Creator</label>
+          <label
+            class="cd-col-form-label required"
+            for="created-by"
+            i18n
+            >Creator</label
+          >
           <div class="cd-col-form-input">
-            <input class="form-control"
-                   formControlName="createdBy"
-                   id="created-by"
-                   name="created-by"
-                   type="text">
-            <span *ngIf="form.showError('createdBy', formDir, 'required')"
-                  class="invalid-feedback"
-                  i18n>This field is required!</span>
+            <input
+              class="form-control"
+              formControlName="createdBy"
+              id="created-by"
+              name="created-by"
+              type="text"
+            />
+            <span
+              *ngIf="form.showError('createdBy', formDir, 'required')"
+              class="invalid-feedback"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
         <!-- Comment -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="comment"
-                 i18n>Comment</label>
+          <label
+            class="cd-col-form-label required"
+            for="comment"
+            i18n
+            >Comment</label
+          >
           <div class="cd-col-form-input">
-            <textarea class="form-control"
-                      formControlName="comment"
-                      id="comment"
-                      name="comment"
-                      type="text">
+            <textarea
+              class="form-control"
+              formControlName="comment"
+              id="comment"
+              name="comment"
+              type="text"
+            >
             </textarea>
-            <span *ngIf="form.showError('comment', formDir, 'required')"
-                  class="invalid-feedback"
-                  i18n>This field is required!</span>
+            <span
+              *ngIf="form.showError('comment', formDir, 'required')"
+              class="invalid-feedback"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
         <!-- Start time -->
         <div class="form-group row">
-          <label class="cd-col-form-label"
-                 for="starts-at">
-            <span class="required"
-                  i18n>Start time</span>
-            <cd-helper i18n>If the start time lies in the past the creation time will be used</cd-helper>
+          <label
+            class="cd-col-form-label"
+            for="starts-at"
+          >
+            <span
+              class="required"
+              i18n
+              >Start time</span
+            >
+            <cd-helper i18n
+              >If the start time lies in the past the creation time will be used</cd-helper
+            >
           </label>
           <div class="cd-col-form-input">
-            <input class="form-control"
-                   formControlName="startsAt"
-                   [ngbPopover]="popStart"
-                   triggers="manual"
-                   #ps="ngbPopover"
-                   (click)="ps.open()"
-                   (keypress)="ps.close()">
-            <span *ngIf="form.showError('startsAt', formDir, 'required')"
-                  class="invalid-feedback"
-                  i18n>This field is required!</span>
+            <input
+              class="form-control"
+              formControlName="startsAt"
+              [ngbPopover]="popStart"
+              triggers="manual"
+              #ps="ngbPopover"
+              (click)="ps.open()"
+              (keypress)="ps.close()"
+            />
+            <span
+              *ngIf="form.showError('startsAt', formDir, 'required')"
+              class="invalid-feedback"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
         <!-- Duration -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="duration"
-                 i18n>Duration</label>
+          <label
+            class="cd-col-form-label required"
+            for="duration"
+            i18n
+            >Duration</label
+          >
           <div class="cd-col-form-input">
-            <input class="form-control"
-                   formControlName="duration"
-                   id="duration"
-                   name="duration"
-                   type="text">
-            <span *ngIf="form.showError('duration', formDir, 'required')"
-                  class="invalid-feedback"
-                  i18n>This field is required!</span>
+            <input
+              class="form-control"
+              formControlName="duration"
+              id="duration"
+              name="duration"
+              type="text"
+            />
+            <span
+              *ngIf="form.showError('duration', formDir, 'required')"
+              class="invalid-feedback"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
         <!-- End time -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="ends-at"
-                 i18n>End time</label>
+          <label
+            class="cd-col-form-label required"
+            for="ends-at"
+            i18n
+            >End time</label
+          >
           <div class="cd-col-form-input">
-            <input class="form-control"
-                   formControlName="endsAt"
-                   [ngbPopover]="popEnd"
-                   triggers="manual"
-                   #pe="ngbPopover"
-                   (click)="pe.open()"
-                   (keypress)="pe.close()">
-            <span *ngIf="form.showError('endsAt', formDir, 'required')"
-                  class="invalid-feedback"
-                  i18n>This field is required!</span>
+            <input
+              class="form-control"
+              formControlName="endsAt"
+              [ngbPopover]="popEnd"
+              triggers="manual"
+              #pe="ngbPopover"
+              (click)="pe.open()"
+              (keypress)="pe.close()"
+            />
+            <span
+              *ngIf="form.showError('endsAt', formDir, 'required')"
+              class="invalid-feedback"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
         <!-- Matchers -->
         <fieldset>
-          <legend class="required"
-                  i18n>Matchers</legend>
+          <legend
+            class="required"
+            i18n
+          >
+            Matchers
+          </legend>
 
           <div class="cd-col-form-offset">
-            <h5 *ngIf="matchers.length === 0"
-                [ngClass]="{'text-warning': !formDir.submitted, 'text-danger': formDir.submitted}">
+            <h5
+              *ngIf="matchers.length === 0"
+              [ngClass]="{ 'text-warning': !formDir.submitted, 'text-danger': formDir.submitted }"
+            >
               <strong i18n>A silence requires at least one matcher</strong>
             </h5>
 
-            <span *ngFor="let matcher of matchers; let i=index;">
-              <ng-container *ngTemplateOutlet="matcherTpl; context:{index: i, matcher: matcher}"></ng-container>
+            <span *ngFor="let matcher of matchers; let i = index">
+              <ng-container
+                *ngTemplateOutlet="matcherTpl; context: { index: i, matcher: matcher }"
+              ></ng-container>
             </span>
 
             <div class="row">
               <div class="col-12">
-                <button type="button"
-                        id="add-matcher"
-                        class="btn btn-light float-end my-3"
-                        [ngClass]="{'btn-warning': formDir.submitted && matchers.length === 0 }"
-                        (click)="showMatcherModal()">
-                  <svg [cdsIcon]="icons.add"
-                       [size]="icons.size16"
-                       ></svg>
+                <button
+                  type="button"
+                  id="add-matcher"
+                  class="btn btn-light float-end my-3"
+                  [ngClass]="{ 'btn-warning': formDir.submitted && matchers.length === 0 }"
+                  (click)="showMatcherModal()"
+                >
+                  <svg
+                    [cdsIcon]="icons.add"
+                    [size]="icons.size16"
+                  ></svg>
                   <ng-container i18n>Add matcher</ng-container>
                 </button>
               </div>
             </div>
           </div>
 
-          <div *ngIf="matchers.length && matcherMatch"
-               class="cd-col-form-offset {{matcherMatch.cssClass}}"
-               id="match-state">
-            <span class="text-muted {{matcherMatch.cssClass}}">
+          <div
+            *ngIf="matchers.length && matcherMatch"
+            class="cd-col-form-offset {{ matcherMatch.cssClass }}"
+            id="match-state"
+          >
+            <span class="text-muted {{ matcherMatch.cssClass }}">
               {{ matcherMatch.status }}
             </span>
           </div>
@@ -197,9 +278,11 @@
 
       <div class="card-footer">
         <div class="text-right">
-          <cd-form-button-panel (submitActionEvent)="submit()"
-                                [form]="form"
-                                [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"></cd-form-button-panel>
+          <cd-form-button-panel
+            (submitActionEvent)="submit()"
+            [form]="form"
+            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+          ></cd-form-button-panel>
         </div>
       </div>
     </div>
@@ -207,12 +290,15 @@
 </div>
 
 <ng-template #popStart>
-  <cd-date-time-picker [control]="form.get('startsAt')"
-                       [hasSeconds]="false"></cd-date-time-picker>
+  <cd-date-time-picker
+    [control]="form.get('startsAt')"
+    [hasSeconds]="false"
+  ></cd-date-time-picker>
 </ng-template>
 
-
 <ng-template #popEnd>
-  <cd-date-time-picker [control]="form.get('endsAt')"
-                       [hasSeconds]="false"></cd-date-time-picker>
+  <cd-date-time-picker
+    [control]="form.get('endsAt')"
+    [hasSeconds]="false"
+  ></cd-date-time-picker>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-list/silence-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-list/silence-list.component.html
index ac3e0ddc578..35685a6475d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-list/silence-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-list/silence-list.component.html
@@ -1,35 +1,43 @@
 <cd-prometheus-tabs></cd-prometheus-tabs>
 
-<cd-alert-panel *ngIf="!isAlertmanagerConfigured"
-                type="info"
-                i18n>To enable Silences, please provide the URL to
-  the API of the Prometheus' Alertmanager as described in the&nbsp;
-  <cd-doc section="prometheus"></cd-doc>.</cd-alert-panel>
+<cd-alert-panel
+  *ngIf="!isAlertmanagerConfigured"
+  type="info"
+  i18n
+  >To enable Silences, please provide the URL to the API of the Prometheus' Alertmanager as
+  described in the&nbsp; <cd-doc section="prometheus"></cd-doc>.</cd-alert-panel
+>
 
-<cd-table *ngIf="isAlertmanagerConfigured"
-          [data]="silences"
-          [columns]="columns"
-          [forceIdentifier]="true"
-          [customCss]="customCss"
-          [sorts]="sorts"
-          selectionType="single"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (fetchData)="refresh()"
-          (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  *ngIf="isAlertmanagerConfigured"
+  [data]="silences"
+  [columns]="columns"
+  [forceIdentifier]="true"
+  [customCss]="customCss"
+  [sorts]="sorts"
+  selectionType="single"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (fetchData)="refresh()"
+  (updateSelection)="updateSelection($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
   <ng-container *ngIf="expandedRow">
-    <cd-table-key-value *cdTableDetail
-                        [renderObjects]="true"
-                        [hideEmpty]="true"
-                        [appendParentKey]="false"
-                        [data]="expandedRow"
-                        [customCss]="customCss"
-                        [autoReload]="false">
+    <cd-table-key-value
+      *cdTableDetail
+      [renderObjects]="true"
+      [hideEmpty]="true"
+      [appendParentKey]="false"
+      [data]="expandedRow"
+      [customCss]="customCss"
+      [autoReload]="false"
+    >
     </cd-table-key-value>
   </ng-container>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-matcher-modal/silence-matcher-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-matcher-modal/silence-matcher-modal.component.html
index 78f05b64607..db5beb6c2ff 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-matcher-modal/silence-matcher-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/prometheus/silence-matcher-modal/silence-matcher-modal.component.html
@@ -1,59 +1,88 @@
 <cd-modal [modalRef]="activeModal">
-  <span class="modal-title"
-        i18n>{editMode, select, true {Edit} other {Add}} Matcher</span>
+  <span
+    class="modal-title"
+    i18n
+    >{editMode, select, true {Edit} other {Add}} Matcher</span
+  >
 
   <ng-container class="modal-content">
-    <form class="form"
-          #formDir="ngForm"
-          [formGroup]="form"
-          novalidate>
+    <form
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="form"
+      novalidate
+    >
       <div class="modal-body">
         <!-- Name -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="name"
-                 i18n>Name</label>
+          <label
+            class="cd-col-form-label required"
+            for="name"
+            i18n
+            >Name</label
+          >
           <div class="cd-col-form-input">
-            <select class="form-select"
-                    id="name"
-                    formControlName="name"
-                    name="name">
-              <option [ngValue]="null"
-                      i18n>-- Select an attribute to match against --</option>
-              <option *ngFor="let attribute of nameAttributes"
-                      [value]="attribute">
+            <select
+              class="form-select"
+              id="name"
+              formControlName="name"
+              name="name"
+            >
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                -- Select an attribute to match against --
+              </option>
+              <option
+                *ngFor="let attribute of nameAttributes"
+                [value]="attribute"
+              >
                 {{ attribute }}
               </option>
             </select>
-            <span class="help-block"
-                  *ngIf="form.showError('name', formDir, 'required')"
-                  i18n>This field is required!</span>
+            <span
+              class="help-block"
+              *ngIf="form.showError('name', formDir, 'required')"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
         <!-- Value -->
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="value"
-                 i18n>Value</label>
+          <label
+            class="cd-col-form-label required"
+            for="value"
+            i18n
+            >Value</label
+          >
           <div class="cd-col-form-input">
-            <input id="value"
-                   (focus)="valueFocus.next($any($event).target.value)"
-                   (click)="valueClick.next($any($event).target.value)"
-                   class="form-control"
-                   type="text"
-                   [ngbTypeahead]="search"
-                   formControlName="value"
-                   #instance="ngbTypeahead">
-            <span *ngIf="form.showError('value', formDir, 'required')"
-                  class="help-block"
-                  i18n>This field is required!</span>
+            <input
+              id="value"
+              (focus)="valueFocus.next($any($event).target.value)"
+              (click)="valueClick.next($any($event).target.value)"
+              class="form-control"
+              type="text"
+              [ngbTypeahead]="search"
+              formControlName="value"
+              #instance="ngbTypeahead"
+            />
+            <span
+              *ngIf="form.showError('value', formDir, 'required')"
+              class="help-block"
+              i18n
+              >This field is required!</span
+            >
           </div>
-          <div *ngIf="form.getValue('value') && !form.getValue('isRegex') && matcherMatch"
-               class="cd-col-form-offset {{matcherMatch.cssClass}}"
-               id="match-state">
-            <span class="text-muted {{matcherMatch.cssClass}}">
-              {{matcherMatch.status}}
+          <div
+            *ngIf="form.getValue('value') && !form.getValue('isRegex') && matcherMatch"
+            class="cd-col-form-offset {{ matcherMatch.cssClass }}"
+            id="match-state"
+          >
+            <span class="text-muted {{ matcherMatch.cssClass }}">
+              {{ matcherMatch.status }}
             </span>
           </div>
         </div>
@@ -62,23 +91,30 @@
         <div class="form-group row">
           <div class="cd-col-form-offset">
             <div class="custom-control custom-checkbox">
-              <input type="checkbox"
-                     class="custom-control-input"
-                     formControlName="isRegex"
-                     name="is-regex"
-                     id="is-regex">
-              <label for="is-regex"
-                     class="custom-control-label"
-                     i18n>Use regular expression</label>
+              <input
+                type="checkbox"
+                class="custom-control-input"
+                formControlName="isRegex"
+                name="is-regex"
+                id="is-regex"
+              />
+              <label
+                for="is-regex"
+                class="custom-control-label"
+                i18n
+                >Use regular expression</label
+              >
             </div>
           </div>
         </div>
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                              [form]="form"
-                              [submitText]="getMode()"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [form]="form"
+          [submitText]="getMode()"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-cert-details/service-certificate-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-cert-details/service-certificate-details.component.html
index d57e0322277..77212a7215a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-cert-details/service-certificate-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-cert-details/service-certificate-details.component.html
@@ -1,109 +1,154 @@
 <cd-details-card>
-  <ng-container
-    class="details-body-content">
-    <div cdsStack="horizontal"
-         [gap]="6">
-      <div cdsStack="vertical"
-           [gap]="3">
-        <div cdsStack="vertical"
-             [gap]="1">
-          <span class="cds--type-label-01"
-                i18n>
+  <ng-container class="details-body-content">
+    <div
+      cdsStack="horizontal"
+      [gap]="6"
+    >
+      <div
+        cdsStack="vertical"
+        [gap]="3"
+      >
+        <div
+          cdsStack="vertical"
+          [gap]="1"
+        >
+          <span
+            class="cds--type-label-01"
+            i18n
+          >
             Certificate name
           </span>
-          <span class="cds--type-body-compact-01"
-                [title]="certificate?.cert_name || '-'">
+          <span
+            class="cds--type-body-compact-01"
+            [title]="certificate?.cert_name || '-'"
+          >
             {{ certificate?.cert_name || '-' }}
           </span>
         </div>
-        <div cdsStack="vertical"
-             [gap]="1">
-          <span class="cds--type-label-01"
-                i18n>
+        <div
+          cdsStack="vertical"
+          [gap]="1"
+        >
+          <span
+            class="cds--type-label-01"
+            i18n
+          >
             Valid until
           </span>
-          <span class="cds--type-body-compact-01"
-                [title]="formatDate(certificate?.expiry_date) || '-'">
+          <span
+            class="cds--type-body-compact-01"
+            [title]="formatDate(certificate?.expiry_date) || '-'"
+          >
             {{ formatDate(certificate?.expiry_date) || '-' }}
           </span>
         </div>
       </div>
 
-      <div cdsStack="vertical"
-           [gap]="3">
-        <div cdsStack="horizontal"
-             [gap]="1">
-          <div cdsStack="vertical"
-               [gap]="1">
-            <span class="cds--type-label-01"
-                  i18n>
+      <div
+        cdsStack="vertical"
+        [gap]="3"
+      >
+        <div
+          cdsStack="horizontal"
+          [gap]="1"
+        >
+          <div
+            cdsStack="vertical"
+            [gap]="1"
+          >
+            <span
+              class="cds--type-label-01"
+              i18n
+            >
               Status
             </span>
-            <ng-container *ngTemplateOutlet="statusTemplate; context: { status: certificate?.status }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="statusTemplate; context: { status: certificate?.status }"
+            ></ng-container>
           </div>
           @if (SERVICES_SUPPORTING_CERT_EDIT.includes(serviceType)) {
-          <cds-icon-button kind="ghost"
-                           size="sm"
-                           (click)="onEdit()"
-                           class="cds-mt-5">
-            <cd-icon type="edit">
-            </cd-icon>
-          </cds-icon-button>
+            <cds-icon-button
+              kind="ghost"
+              size="sm"
+              (click)="onEdit()"
+              class="cds-mt-5"
+            >
+              <cd-icon type="edit"> </cd-icon>
+            </cds-icon-button>
           }
-
         </div>
-        <div cdsStack="vertical"
-             [gap]="1">
-          <span class="cds--type-label-01"
-                i18n>
+        <div
+          cdsStack="vertical"
+          [gap]="1"
+        >
+          <span
+            class="cds--type-label-01"
+            i18n
+          >
             Days remaining
           </span>
-          <span class="cds--type-body-compact-01"
-                [title]="certificate?.days_to_expiration  ? certificate.days_to_expiration : '-'">
+          <span
+            class="cds--type-body-compact-01"
+            [title]="certificate?.days_to_expiration ? certificate.days_to_expiration : '-'"
+          >
             {{ certificate?.days_to_expiration ? certificate.days_to_expiration : '-' }}
           </span>
         </div>
       </div>
 
-      <div cdsStack="vertical"
-           [gap]="3">
-        <div cdsStack="vertical"
-             [gap]="1">
-          <span class="cds--type-label-01"
-                i18n>
+      <div
+        cdsStack="vertical"
+        [gap]="3"
+      >
+        <div
+          cdsStack="vertical"
+          [gap]="1"
+        >
+          <span
+            class="cds--type-label-01"
+            i18n
+          >
             Issuer
           </span>
-          <span class="cds--type-body-compact-01"
-                [title]="certificate?.issuer || certificate?.signed_by || '-'">
+          <span
+            class="cds--type-body-compact-01"
+            [title]="certificate?.issuer || certificate?.signed_by || '-'"
+          >
             {{ certificate?.issuer || certificate?.signed_by || '-' }}
           </span>
         </div>
-        <div cdsStack="vertical"
-             [gap]="1">
-          <span class="cds--type-label-01"
-                i18n>
+        <div
+          cdsStack="vertical"
+          [gap]="1"
+        >
+          <span
+            class="cds--type-label-01"
+            i18n
+          >
             Common name
           </span>
-          <span class="cds--type-body-compact-01"
-                [title]="certificate?.common_name || '-'">
+          <span
+            class="cds--type-body-compact-01"
+            [title]="certificate?.common_name || '-'"
+          >
             {{ certificate?.common_name || '-' }}
           </span>
         </div>
       </div>
     </div>
 
-    <ng-template #statusTemplate
-                 let-status="status">
-      <div cdsStack="horizontal"
-           [gap]="2"
-           class="status-row">
-        <cd-icon
-          [type]="statusIconMap[status] || statusIconMap['default']">
-        </cd-icon>
+    <ng-template
+      #statusTemplate
+      let-status="status"
+    >
+      <div
+        cdsStack="horizontal"
+        [gap]="2"
+        class="status-row"
+      >
+        <cd-icon [type]="statusIconMap[status] || statusIconMap['default']"> </cd-icon>
         <span class="cds--type-body-compact-01">{{ formatCertificateStatus(certificate) }}</span>
-
       </div>
     </ng-template>
-
   </ng-container>
 </cd-details-card>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-daemon-list/service-daemon-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-daemon-list/service-daemon-list.component.html
index 6e215916745..1f600a3aa36 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-daemon-list/service-daemon-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-daemon-list/service-daemon-list.component.html
@@ -5,49 +5,65 @@
 </div>
 
 <ng-template #serviceDetailsTpl>
-@switch (mode) {
-  @case ('daemons') {
-  <ng-container *ngTemplateOutlet="serviceDaemonDetailsTpl"></ng-container>
+  @switch (mode) {
+    @case ('daemons') {
+      <ng-container *ngTemplateOutlet="serviceDaemonDetailsTpl"></ng-container>
+    }
+    @case ('events') {
+      @if (hasOrchestrator) {
+        <cd-table
+          #serviceTable
+          [data]="services"
+          [columns]="serviceColumns"
+          columnMode="flex"
+          (fetchData)="getServices($event)"
+        >
+        </cd-table>
+      }
+    }
   }
-  @case ('events') {
-  @if (hasOrchestrator) {
-  <cd-table
-    #serviceTable
-    [data]="services"
-    [columns]="serviceColumns"
-    columnMode="flex"
-    (fetchData)="getServices($event)">
-  </cd-table>
-  }
-  }
-}
 </ng-template>
 
-<ng-template #statusTpl
-             let-row="data.row">
-  <cds-tag *ngIf="row.status_desc"
-           [class]="row | pipeFunction:getStatusClass">
+<ng-template
+  #statusTpl
+  let-row="data.row"
+>
+  <cds-tag
+    *ngIf="row.status_desc"
+    [class]="row | pipeFunction: getStatusClass"
+  >
     {{ row.status_desc }}
-</cds-tag>
+  </cds-tag>
 </ng-template>
 
-<ng-template #listTpl
-             let-events="data.value">
-  <ul class="list-group list-group-flush"
-      *ngIf="events?.length else noEventsAvailable">
-    <li class="list-group-item"
-        *ngFor="let event of events; trackBy:trackByFn">
+<ng-template
+  #listTpl
+  let-events="data.value"
+>
+  <ul
+    class="list-group list-group-flush"
+    *ngIf="events?.length; else noEventsAvailable"
+  >
+    <li
+      class="list-group-item"
+      *ngFor="let event of events; trackBy: trackByFn"
+    >
       <b>{{ event.created | relativeDate }} - </b>
-      <cds-tag class="tag-info">{{ event.subject }}</cds-tag><br>
+      <cds-tag class="tag-info">{{ event.subject }}</cds-tag
+      ><br />
       <span *ngIf="event.level === 'INFO'">
-        <svg [cdsIcon]="icons.infoCircle"
-             [size]="icons.size16"
-             class="cds-info-color"></svg>
+        <svg
+          [cdsIcon]="icons.infoCircle"
+          [size]="icons.size16"
+          class="cds-info-color"
+        ></svg>
       </span>
       <span *ngIf="event.level === 'ERROR'">
-        <svg [cdsIcon]="icons.warning"
-             [size]="icons.size16"
-             class="cds-warning-color"></svg>
+        <svg
+          [cdsIcon]="icons.warning"
+          [size]="icons.size16"
+          class="cds-warning-color"
+        ></svg>
       </span>
       {{ event.message }}
     </li>
@@ -60,29 +76,37 @@
 </ng-template>
 
 <ng-template #serviceDaemonDetailsTpl>
-  <cd-table *ngIf="hasOrchestrator"
-            #daemonsTable
-            [data]="daemons"
-            selectionType="single"
-            [columns]="columns"
-            columnMode="flex"
-            identifier="daemon_name"
-            (fetchData)="getDaemons($event)"
-            (updateSelection)="updateSelection($event)">
-    <cd-table-actions id="service-daemon-list-actions"
-                      class="table-actions"
-                      [selection]="selection"
-                      [permission]="permissions.hosts"
-                      [tableActions]="tableActions">
+  <cd-table
+    *ngIf="hasOrchestrator"
+    #daemonsTable
+    [data]="daemons"
+    selectionType="single"
+    [columns]="columns"
+    columnMode="flex"
+    identifier="daemon_name"
+    (fetchData)="getDaemons($event)"
+    (updateSelection)="updateSelection($event)"
+  >
+    <cd-table-actions
+      id="service-daemon-list-actions"
+      class="table-actions"
+      [selection]="selection"
+      [permission]="permissions.hosts"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </cd-table>
 </ng-template>
 
-<ng-template #cpuTpl
-             let-row="data.row">
-  <cd-usage-bar [total]="total"
-                [calculatePerc]="false"
-                [used]="row.cpu_percentage"
-                [isBinary]="false">
+<ng-template
+  #cpuTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    [total]="total"
+    [calculatePerc]="false"
+    [used]="row.cpu_percentage"
+    [isBinary]="false"
+  >
   </cd-usage-bar>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-details/service-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-details/service-details.component.html
index 104e7e21fc0..59b61b2a63d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-details/service-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-details/service-details.component.html
@@ -1,30 +1,39 @@
 @if (service) {
   <cds-tabs [cacheActive]="false">
-    <cds-tab heading="Daemons"
-             i18n-heading>
+    <cds-tab
+      heading="Daemons"
+      i18n-heading
+    >
       <cd-service-daemon-list
         [serviceName]="service?.service_name"
-        mode="daemons">
+        mode="daemons"
+      >
       </cd-service-daemon-list>
     </cds-tab>
 
     @if (hasCertificate) {
-      <cds-tab heading="Certificate"
-               i18n-heading>
+      <cds-tab
+        heading="Certificate"
+        i18n-heading
+      >
         <cd-service-certificate-details
           [certificate]="certificate"
           [serviceName]="service?.service_name"
           [serviceType]="service?.service_type"
-          (editService)="onEditService($event)">
+          (editService)="onEditService($event)"
+        >
         </cd-service-certificate-details>
       </cds-tab>
     }
 
-    <cds-tab heading="Service Events"
-             i18n-heading>
+    <cds-tab
+      heading="Service Events"
+      i18n-heading
+    >
       <cd-service-daemon-list
         [serviceName]="service?.service_name"
-        mode="events">
+        mode="events"
+      >
       </cd-service-daemon-list>
     </cds-tab>
   </cds-tabs>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
index dad834e1537..1122ccb134d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.html
@@ -1,267 +1,373 @@
-<cds-modal size="lg"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource }}
+    </h3>
     <cd-help-text></cd-help-text>
   </cds-modal-header>
-  <section cdsModalContent
-           hasForm="true">
-    <form #frm="ngForm"
-          [formGroup]="serviceForm"
-          novalidate>
+  <section
+    cdsModalContent
+    hasForm="true"
+  >
+    <form
+      #frm="ngForm"
+      [formGroup]="serviceForm"
+      novalidate
+    >
       @if (serviceForm.controls.service_type.value === 'rgw' && showRealmCreationForm) {
-      <cd-alert-panel type="info"
-                      spacingClass="mb-3"
-                      i18n>
-        <a class="text-decoration-underline"
-           tabindex="0"
-           (keydown.enter)="createMultisiteSetup()"
-           (click)="createMultisiteSetup()">
-          Click here</a> to create a new Realm/Zonegroup/Zone
-      </cd-alert-panel>
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-3"
+          i18n
+        >
+          <a
+            class="text-decoration-underline"
+            tabindex="0"
+            (keydown.enter)="createMultisiteSetup()"
+            (click)="createMultisiteSetup()"
+          >
+            Click here</a
+          >
+          to create a new Realm/Zonegroup/Zone
+        </cd-alert-panel>
       }
 
       @if (serviceForm.controls.service_type.value === 'oauth2-proxy') {
-      <cd-alert-panel type="info"
-                      spacingClass="mb-3"
-                      i18n>
-        Authentication must be enabled in an active `mgmt-gateway` service to enable Single Sign-On(SSO) with
-        `oauth2-proxy`
-      </cd-alert-panel>
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-3"
+          i18n
+        >
+          Authentication must be enabled in an active `mgmt-gateway` service to enable Single
+          Sign-On(SSO) with `oauth2-proxy`
+        </cd-alert-panel>
       }
       @if (serviceForm.controls.service_type.value === 'mgmt-gateway') {
-      <cd-alert-panel type="info"
-                      spacingClass="mb-3"
-                      i18n>
-        With an active mgmt-gateway service, the dashboard will continue to be served on {{currentURL}}:{{port}} and all
-        other services will be accessible from {{currentURL}}:{{port}}/service_name
-      </cd-alert-panel>
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-3"
+          i18n
+        >
+          With an active mgmt-gateway service, the dashboard will continue to be served on
+          {{ currentURL }}:{{ port }} and all other services will be accessible from
+          {{ currentURL }}:{{ port }}/service_name
+        </cd-alert-panel>
       }
 
       @if (serviceForm.controls.service_type.value === 'smb') {
-      <cd-alert-panel type="warning"
-                      spacingClass="mb-3"
-                      i18n>
-        SMB service management is intended for advanced users only.
-        For most scenarios, it is recommended to use the SMB module instead.
-        To manage SMB clusters and shares, please visit the <a routerLink="/cephfs/smb">SMB page</a>.
-      </cd-alert-panel>
+        <cd-alert-panel
+          type="warning"
+          spacingClass="mb-3"
+          i18n
+        >
+          SMB service management is intended for advanced users only. For most scenarios, it is
+          recommended to use the SMB module instead. To manage SMB clusters and shares, please visit
+          the <a routerLink="/cephfs/smb">SMB page</a>.
+        </cd-alert-panel>
       }
 
       <!-- Service type -->
       <div class="form-item">
-        <cds-select formControlName="service_type"
-                    label="Type"
-                    cdRequiredField="Type"
-                    id="service_type"
-                    [invalid]="serviceForm.controls.service_type.invalid && serviceForm.controls.service_type.dirty"
-                    [invalidText]="invalidServiceTypeError"
-                    (change)="onServiceTypeChange($event.target.value)">
-          <option i18n
-                  [ngValue]="null">
+        <cds-select
+          formControlName="service_type"
+          label="Type"
+          cdRequiredField="Type"
+          id="service_type"
+          [invalid]="
+            serviceForm.controls.service_type.invalid && serviceForm.controls.service_type.dirty
+          "
+          [invalidText]="invalidServiceTypeError"
+          (change)="onServiceTypeChange($event.target.value)"
+        >
+          <option
+            i18n
+            [ngValue]="null"
+          >
             -- Select a service type --
           </option>
           @for (serviceType of serviceTypes; track serviceType) {
-          <option [value]="serviceType">
-            {{ serviceType }}
-          </option>
+            <option [value]="serviceType">
+              {{ serviceType }}
+            </option>
           }
         </cds-select>
 
         <ng-template #invalidServiceTypeError>
           @if (serviceForm.showError('service_type', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              i18n
+              >This field is required.</span
+            >
           }
         </ng-template>
       </div>
 
       <!-- backend_service -->
       @if (serviceForm.controls.service_type.value === 'ingress') {
-      <div class="form-item">
-        <cds-select id="backend_service"
-                    formControlName="backend_service"
-                    label="Backend service"
-                    cdRequiredField="Backend service"
-                    [invalid]="serviceForm.controls.backend_service.invalid && serviceForm.controls.backend_service.dirty"
-                    [invalidText]="invalidBackendServiceError"
-                    (change)="prePopulateId()">
-          @if (services === null) {
-          <option [ngValue]="null"
-                  i18n>Loading...</option>
-          }
-          @if (services !== null && services.length === 0) {
-          <option [ngValue]="null"
-                  i18n>-- No service available --</option>
-          }
-          @if (services !== null && services.length > 0) {
-          <option [ngValue]="null"
-                  i18n>-- Select an existing service --</option>
-          }
-          @for (service of services; track service) {
-          <option [value]="service.service_name">{{ service.service_name }}</option>
-          }
-        </cds-select>
-        <ng-template #invalidBackendServiceError>
-          @if (serviceForm.showError('backend_service', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        <div class="form-item">
+          <cds-select
+            id="backend_service"
+            formControlName="backend_service"
+            label="Backend service"
+            cdRequiredField="Backend service"
+            [invalid]="
+              serviceForm.controls.backend_service.invalid &&
+              serviceForm.controls.backend_service.dirty
+            "
+            [invalidText]="invalidBackendServiceError"
+            (change)="prePopulateId()"
+          >
+            @if (services === null) {
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                Loading...
+              </option>
+            }
+            @if (services !== null && services.length === 0) {
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                -- No service available --
+              </option>
+            }
+            @if (services !== null && services.length > 0) {
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                -- Select an existing service --
+              </option>
+            }
+            @for (service of services; track service) {
+              <option [value]="service.service_name">{{ service.service_name }}</option>
+            }
+          </cds-select>
+          <ng-template #invalidBackendServiceError>
+            @if (serviceForm.showError('backend_service', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
       }
 
       <!-- Group Name -->
       @if (serviceForm.controls.service_type.value === 'nvmeof') {
-      <div class="form-item">
-        <cds-text-label helperText="The name of the gateway group."
-                        i18n-helperText
-                        label="Group name"
-                        cdRequiredField="Group name"
-                        [invalid]="serviceForm.controls.group.invalid && serviceForm.controls.group.dirty"
-                        [invalidText]="requiredFieldGroup">
-          <input cdsText
-                 type="text"
-                 id="group"
-                 formControlName="group"
-                 [invalid]="serviceForm.controls.group.invalid && serviceForm.controls.group.dirty"
-                 (change)="setNvmeServiceId()" />
-        </cds-text-label>
-        <ng-template #requiredFieldGroup>
-          @if (serviceForm.showError('service_id', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        <div class="form-item">
+          <cds-text-label
+            helperText="The name of the gateway group."
+            i18n-helperText
+            label="Group name"
+            cdRequiredField="Group name"
+            [invalid]="serviceForm.controls.group.invalid && serviceForm.controls.group.dirty"
+            [invalidText]="requiredFieldGroup"
+          >
+            <input
+              cdsText
+              type="text"
+              id="group"
+              formControlName="group"
+              [invalid]="serviceForm.controls.group.invalid && serviceForm.controls.group.dirty"
+              (change)="setNvmeServiceId()"
+            />
+          </cds-text-label>
+          <ng-template #requiredFieldGroup>
+            @if (serviceForm.showError('service_id', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
       }
 
       <!-- Service id -->
       @if (serviceForm.controls.service_type.value !== 'snmp-gateway') {
-      <div class="form-item">
-        @if (isPrefixedNamedService) {
-        <div class="cds-input-group">
-          <div class="fit-content">
-            <cds-text-label cdRequiredField="Service name"
-                            [disabled]="editing"
-                            i18n>
-              <input cdsText
-                     type="text"
-                     [value]="serviceForm.controls.service_type.value + '.'"
-                     disabled="true">
+        <div class="form-item">
+          @if (isPrefixedNamedService) {
+            <div class="cds-input-group">
+              <div class="fit-content">
+                <cds-text-label
+                  cdRequiredField="Service name"
+                  [disabled]="editing"
+                  i18n
+                >
+                  <input
+                    cdsText
+                    type="text"
+                    [value]="serviceForm.controls.service_type.value + '.'"
+                    disabled="true"
+                  />
+                </cds-text-label>
+              </div>
+              <cds-text-label
+                [invalid]="
+                  serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty
+                "
+                [disabled]="editing"
+                [invalidText]="serviceIdError"
+              >
+                <!-- Invisible character to set input fields on same line -->
+                &#8203;
+                <input
+                  cdsText
+                  type="text"
+                  id="service_id"
+                  formControlName="service_id"
+                  [invalid]="
+                    serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty
+                  "
+                />
+              </cds-text-label>
+            </div>
+          } @else {
+            <cds-text-label
+              [invalid]="
+                serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty
+              "
+              [disabled]="editing"
+              [invalidText]="serviceIdError"
+            >
+              Service name
+              <input
+                cdsText
+                type="text"
+                id="service_id"
+                formControlName="service_id"
+                [invalid]="
+                  serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty
+                "
+              />
             </cds-text-label>
-          </div>
-          <cds-text-label [invalid]="serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty"
-                          [disabled]="editing"
-                          [invalidText]="serviceIdError">
-            <!-- Invisible character to set input fields on same line -->
-            &#8203;
-            <input cdsText
-                   type="text"
-                   id="service_id"
-                   formControlName="service_id"
-                   [invalid]="serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty" />
-          </cds-text-label>
-        </div>
-        } @else {
-        <cds-text-label [invalid]="serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty"
-                        [disabled]="editing"
-                        [invalidText]="serviceIdError">
-          Service name
-          <input cdsText
-                 type="text"
-                 id="service_id"
-                 formControlName="service_id"
-                 [invalid]="serviceForm.controls.service_id.invalid && serviceForm.controls.service_id.dirty" />
-        </cds-text-label>
-        }
+          }
 
-        <ng-template #serviceIdError>
-          @if (serviceForm.showError('service_id', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('service_id', frm, 'uniqueName')) {
-          <span class="invalid-feedback"
-                i18n>This service id is already in use.</span>
-          }
-          @if (serviceForm.showError('service_id', frm, 'mdsPattern')) {
-          <span class="invalid-feedback"
-                i18n>MDS service id must start with a letter and contain alphanumeric characters or '.', '-', and
-            '_'</span>
-          }
-        </ng-template>
-      </div>
+          <ng-template #serviceIdError>
+            @if (serviceForm.showError('service_id', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (serviceForm.showError('service_id', frm, 'uniqueName')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This service id is already in use.</span
+              >
+            }
+            @if (serviceForm.showError('service_id', frm, 'mdsPattern')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >MDS service id must start with a letter and contain alphanumeric characters or '.',
+                '-', and '_'</span
+              >
+            }
+          </ng-template>
+        </div>
       }
 
       @if (serviceForm.controls.service_type.value === 'rgw') {
-      <div class="form-item">
-        <cds-select formControlName="realm_name"
-                    label="Realm"
-                    [invalid]="serviceForm.controls.realm_name.invalid && serviceForm.controls.realm_name.dirty"
-                    [invalidText]="authModeError"
-                    helperText="Active-directory authentication for domain member servers and User authentication for Stand-alone servers configuration."
-                    i18n-helperText>
-          @if (realmList.length === 0) {
-          <option i18n
-                  selected>-- No realm available --
-          </option>
-          }
-          @for (realm of realmList; track realm) {
-          <option [value]="realm.name">
-            {{ realm.name }}
-          </option>
-          }
-        </cds-select>
-        <ng-template #authModeError>
-          @if (serviceForm.showError('realm_name', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        <div class="form-item">
+          <cds-select
+            formControlName="realm_name"
+            label="Realm"
+            [invalid]="
+              serviceForm.controls.realm_name.invalid && serviceForm.controls.realm_name.dirty
+            "
+            [invalidText]="authModeError"
+            helperText="Active-directory authentication for domain member servers and User authentication for Stand-alone servers configuration."
+            i18n-helperText
+          >
+            @if (realmList.length === 0) {
+              <option
+                i18n
+                selected
+              >
+                -- No realm available --
+              </option>
+            }
+            @for (realm of realmList; track realm) {
+              <option [value]="realm.name">
+                {{ realm.name }}
+              </option>
+            }
+          </cds-select>
+          <ng-template #authModeError>
+            @if (serviceForm.showError('realm_name', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
 
-      <div class="form-item">
-        <cds-select id="zonegroup_name"
-                    formControlName="zonegroup_name"
-                    label="Zonegroup">
-          @for (zonegroup of zonegroupList; track zonegroup) {
-          <option [value]="zonegroup.name">
-            {{ zonegroup.name }}
-          </option>
-          }
-        </cds-select>
-      </div>
+        <div class="form-item">
+          <cds-select
+            id="zonegroup_name"
+            formControlName="zonegroup_name"
+            label="Zonegroup"
+          >
+            @for (zonegroup of zonegroupList; track zonegroup) {
+              <option [value]="zonegroup.name">
+                {{ zonegroup.name }}
+              </option>
+            }
+          </cds-select>
+        </div>
 
-      <div class="form-item">
-        <cds-select id="zone_name"
-                    formControlName="zone_name"
-                    label="Zone">
-          @for (zone of zoneList; track zone) {
-          <option [value]="zone.name">
-            {{ zone.name }}
-          </option>
-          }
-        </cds-select>
-      </div>
+        <div class="form-item">
+          <cds-select
+            id="zone_name"
+            formControlName="zone_name"
+            label="Zone"
+          >
+            @for (zone of zoneList; track zone) {
+              <option [value]="zone.name">
+                {{ zone.name }}
+              </option>
+            }
+          </cds-select>
+        </div>
       }
 
       <!-- unmanaged -->
       <div class="form-item">
         <fieldset>
-          <label class="cds--label"
-                 for="unmanaged"
-                 i18n>Unmanaged</label>
-          <cds-checkbox i18n-label
-                        id="unmanaged"
-                        formControlName="unmanaged">
+          <label
+            class="cds--label"
+            for="unmanaged"
+            i18n
+            >Unmanaged</label
+          >
+          <cds-checkbox
+            i18n-label
+            id="unmanaged"
+            formControlName="unmanaged"
+          >
             Enable
             <cd-help-text i18n>
-              If Unmanaged is selected, the orchestrator will not start or stop any daemons associated with this
-              service.
-              Placement and all other properties will be ignored.
+              If Unmanaged is selected, the orchestrator will not start or stop any daemons
+              associated with this service. Placement and all other properties will be ignored.
             </cd-help-text>
           </cds-checkbox>
         </fieldset>
@@ -269,1241 +375,1901 @@
 
       <!-- Placement -->
       @if (!serviceForm.controls.unmanaged.value) {
-      <div class="form-item">
-        <cds-select id="placement"
-                    formControlName="placement"
-                    label="Placement"
-                    (change)="onPlacementChange($event.target.value)">
-          <option i18n
-                  value="hosts">Hosts</option>
-          <option i18n
-                  value="label">Label</option>
-        </cds-select>
-      </div>
+        <div class="form-item">
+          <cds-select
+            id="placement"
+            formControlName="placement"
+            label="Placement"
+            (change)="onPlacementChange($event.target.value)"
+          >
+            <option
+              i18n
+              value="hosts"
+            >
+              Hosts
+            </option>
+            <option
+              i18n
+              value="label"
+            >
+              Label
+            </option>
+          </cds-select>
+        </div>
       }
 
       <!-- Label -->
       @if (hostsAndLabels$ | async; as data) {
-      @if (!serviceForm.controls.unmanaged.value && serviceForm.controls.placement.value === 'label') {
-      <div class="form-item">
-        <cds-combo-box type="single"
-                       selectionFeedback="top-after-reopen"
-                       label="Label"
-                       cdRequiredField="Label"
-                       formControlName="label"
-                       id="label"
-                       [appendInline]="true"
-                       [items]="data.labels"
-                       [invalid]="serviceForm.controls.label.invalid && serviceForm.controls.label.dirty"
-                       [invalidText]="requiredFieldLabel">
-          <cds-dropdown-list></cds-dropdown-list>
-        </cds-combo-box>
-        <ng-template #requiredFieldLabel>
-          @if (serviceForm.showError('label', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        @if (
+          !serviceForm.controls.unmanaged.value && serviceForm.controls.placement.value === 'label'
+        ) {
+          <div class="form-item">
+            <cds-combo-box
+              type="single"
+              selectionFeedback="top-after-reopen"
+              label="Label"
+              cdRequiredField="Label"
+              formControlName="label"
+              id="label"
+              [appendInline]="true"
+              [items]="data.labels"
+              [invalid]="serviceForm.controls.label.invalid && serviceForm.controls.label.dirty"
+              [invalidText]="requiredFieldLabel"
+            >
+              <cds-dropdown-list></cds-dropdown-list>
+            </cds-combo-box>
+            <ng-template #requiredFieldLabel>
+              @if (serviceForm.showError('label', frm, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >This field is required.</span
+                >
+              }
+            </ng-template>
+          </div>
+        }
+        <!-- Hosts -->
+        @if (
+          !serviceForm.controls.unmanaged.value && serviceForm.controls.placement.value === 'hosts'
+        ) {
+          <div class="form-item">
+            <cds-combo-box
+              type="multi"
+              selectionFeedback="top-after-reopen"
+              label="Hosts"
+              formControlName="hosts"
+              id="hosts"
+              [appendInline]="true"
+              [items]="data.hosts"
+              (selected)="multiSelector($event)"
+              i18n
+            >
+              <cds-dropdown-list></cds-dropdown-list>
+            </cds-combo-box>
+          </div>
+        }
       }
-      <!-- Hosts -->
-      @if (!serviceForm.controls.unmanaged.value && serviceForm.controls.placement.value === 'hosts') {
-      <div class="form-item">
-        <cds-combo-box type="multi"
-                       selectionFeedback="top-after-reopen"
-                       label="Hosts"
-                       formControlName="hosts"
-                       id="hosts"
-                       [appendInline]="true"
-                       [items]="data.hosts"
-                       (selected)="multiSelector($event)"
-                       i18n>
-          <cds-dropdown-list></cds-dropdown-list>
-        </cds-combo-box>
-      </div>
-      }
-      }
-
 
       <!-- Count -->
-      @if (!serviceForm.controls.unmanaged.value && serviceForm.controls.service_type.value !== 'nvmeof') {
-      <div class="form-item">
-        <cds-number label="Count"
-                    formControlName="count"
-                    id="count"
-                    min="1"
-                    helperText="Number of deamons that will be deployed"
-                    i18n-helperText>
-        </cds-number>
-      </div>
+      @if (
+        !serviceForm.controls.unmanaged.value &&
+        serviceForm.controls.service_type.value !== 'nvmeof'
+      ) {
+        <div class="form-item">
+          <cds-number
+            label="Count"
+            formControlName="count"
+            id="count"
+            min="1"
+            helperText="Number of deamons that will be deployed"
+            i18n-helperText
+          >
+          </cds-number>
+        </div>
       }
 
       <!-- RGW -->
-      @if (!serviceForm.controls.unmanaged.value && serviceForm.controls.service_type.value === 'rgw') {
-      <!-- rgw_frontend_port -->
-      <div class="form-item">
-        <cds-number label="Port"
-                    formControlName="rgw_frontend_port"
-                    id="rgw_frontend_port"
-                    min="1"
-                    max="65535"
-                    helperText="Number of deamons that will be deployed"
-                    i18n-helperText
-                    [invalid]="serviceForm.controls.rgw_frontend_port.invalid && serviceForm.controls.rgw_frontend_port.dirty"
-                    [invalidText]="invalidRgwFrontendPortError">
-        </cds-number>
-        <ng-template #invalidRgwFrontendPortError>
-          @if (serviceForm.showError('rgw_frontend_port', frm, 'min')) {
-          <span class="invalid-feedback"
-                i18n>The value must be at least 1.</span>
-          }
-          @if (serviceForm.showError('rgw_frontend_port', frm, 'max')) {
-          <span class="invalid-feedback"
-                i18n>The value cannot exceed 65535.</span>
-          }
-        </ng-template>
-      </div>
+      @if (
+        !serviceForm.controls.unmanaged.value && serviceForm.controls.service_type.value === 'rgw'
+      ) {
+        <!-- rgw_frontend_port -->
+        <div class="form-item">
+          <cds-number
+            label="Port"
+            formControlName="rgw_frontend_port"
+            id="rgw_frontend_port"
+            min="1"
+            max="65535"
+            helperText="Number of deamons that will be deployed"
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.rgw_frontend_port.invalid &&
+              serviceForm.controls.rgw_frontend_port.dirty
+            "
+            [invalidText]="invalidRgwFrontendPortError"
+          >
+          </cds-number>
+          <ng-template #invalidRgwFrontendPortError>
+            @if (serviceForm.showError('rgw_frontend_port', frm, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must be at least 1.</span
+              >
+            }
+            @if (serviceForm.showError('rgw_frontend_port', frm, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            }
+          </ng-template>
+        </div>
 
-      @if (!rgwModuleEnabled) {
-      <cd-alert-panel type="warning"
-                      spacingClass="mb-3"
-                      actionName="Enable"
-                      (action)="enableRgwModule()"
-                      i18n-actionName
-                      i18n>
-        The RGW mgr module must be enabled to configure S3 hostnames.
-        Enabling the module will cause temporary manager downtime while it loads.
-      </cd-alert-panel>
-      }
-      <div class="form-item">
-        <cds-checkbox i18n-label
-                      formControlName="virtual_host_enabled">
-          Enable virtual-host style bucket access
-          <cd-help-text i18n>
-            Allows bucket access via hostnames such as mybucket.s3.example.com.
-          </cd-help-text>
-        </cds-checkbox>
-      </div>
-      @if (serviceForm.controls.virtual_host_enabled.value) {
-      <div class="form-item">
-        <cd-text-label-list formControlName="zonegroup_hostnames"
-                            label="S3 hostname"
-                            i18n-label
-                            helperText="Domain names for S3 virtual-host bucket access (e.g., s3.example.com). Enables bucket URLs like bucket.s3.example.com instead of s3.example.com/bucket."
-                            i18n-helperText>
-        </cd-text-label-list>
-      </div>
-      }
+        @if (!rgwModuleEnabled) {
+          <cd-alert-panel
+            type="warning"
+            spacingClass="mb-3"
+            actionName="Enable"
+            (action)="enableRgwModule()"
+            i18n-actionName
+            i18n
+          >
+            The RGW mgr module must be enabled to configure S3 hostnames. Enabling the module will
+            cause temporary manager downtime while it loads.
+          </cd-alert-panel>
+        }
+        <div class="form-item">
+          <cds-checkbox
+            i18n-label
+            formControlName="virtual_host_enabled"
+          >
+            Enable virtual-host style bucket access
+            <cd-help-text i18n>
+              Allows bucket access via hostnames such as mybucket.s3.example.com.
+            </cd-help-text>
+          </cds-checkbox>
+        </div>
+        @if (serviceForm.controls.virtual_host_enabled.value) {
+          <div class="form-item">
+            <cd-text-label-list
+              formControlName="zonegroup_hostnames"
+              label="S3 hostname"
+              i18n-label
+              helperText="Domain names for S3 virtual-host bucket access (e.g., s3.example.com). Enables bucket URLs like bucket.s3.example.com instead of s3.example.com/bucket."
+              i18n-helperText
+            >
+            </cd-text-label-list>
+          </div>
+        }
       }
 
       <!-- iSCSI -->
       <!-- pool -->
       @if (serviceForm.controls.service_type.value === 'iscsi') {
-      <div class="form-item">
-        <cds-select label="Pool"
-                    formControlName="pool"
-                    cdRequiredField="Pool"
-                    id="pool"
-                    [invalid]="serviceForm.controls.pool.invalid && serviceForm.controls.pool.dirty"
-                    [invalidText]="invalidPoolError">
-          @if (pools === null) {
-          <option [ngValue]="null"
-                  i18n>Loading...</option>
-          }
-          @if (pools && pools.length === 0) {
-          <option [ngValue]="null"
-                  i18n>-- No pools available --</option>
-          }
-          @if (pools && pools.length > 0) {
-          <option [ngValue]="null"
-                  i18n>-- Select a pool --</option>
-          }
-          @for (pool of pools; track pool) {
-          <option [value]="pool.pool_name">{{ pool.pool_name }}</option>
-          }
-        </cds-select>
-        <ng-template #invalidPoolError>
-          @if (serviceForm.showError('pool', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        <div class="form-item">
+          <cds-select
+            label="Pool"
+            formControlName="pool"
+            cdRequiredField="Pool"
+            id="pool"
+            [invalid]="serviceForm.controls.pool.invalid && serviceForm.controls.pool.dirty"
+            [invalidText]="invalidPoolError"
+          >
+            @if (pools === null) {
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                Loading...
+              </option>
+            }
+            @if (pools && pools.length === 0) {
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                -- No pools available --
+              </option>
+            }
+            @if (pools && pools.length > 0) {
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                -- Select a pool --
+              </option>
+            }
+            @for (pool of pools; track pool) {
+              <option [value]="pool.pool_name">{{ pool.pool_name }}</option>
+            }
+          </cds-select>
+          <ng-template #invalidPoolError>
+            @if (serviceForm.showError('pool', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
       }
 
       <!-- fields in iSCSI which are hidden when unmanaged is true -->
-      @if (!serviceForm.controls.unmanaged.value && serviceForm.controls.service_type.value === 'iscsi') {
-      <!-- trusted_ip_list -->
-      <div class="form-item">
-        <cd-text-label-list formControlName="trusted_ip_list"
-                            label="Trusted IPs"
-                            helperText="List of trusted IP addresses. Add the Ceph Manager IP addresses so the iSCSI gateways can be reached.">
-        </cd-text-label-list>
-      </div>
-      <!-- api_port -->
-      <div class="form-item">
-        <cds-number label="Port"
-                    formControlName="api_port"
-                    id="api_port"
-                    min="1"
-                    max="65535"
-                    [invalid]="serviceForm.controls.api_port.invalid && serviceForm.controls.api_port.dirty"
-                    [invalidText]="invalidApiPortError">
-        </cds-number>
-        <ng-template #invalidApiPortError>
-          @if (serviceForm.showError('api_port', frm, 'min')) {
-          <span class="invalid-feedback"
-                i18n>The value must be at least 1.</span>
-          }
-          @if (serviceForm.showError('api_port', frm, 'max')) {
-          <span class="invalid-feedback"
-                i18n>The value cannot exceed 65535.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- api_user -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="User"
-                        [invalid]="serviceForm.controls.api_user.invalid && serviceForm.controls.api_user.dirty"
-                        [invalidText]="invalidUser">
-          <input cdsText
-                 type="text"
-                 id="api_user"
-                 formControlName="api_user"
-                 [invalid]="serviceForm.controls.api_user.invalid && serviceForm.controls.api_user.dirty" />
-        </cds-text-label>
-        <ng-template #invalidUser>
-          @if (serviceForm.showError('api_user', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+      @if (
+        !serviceForm.controls.unmanaged.value && serviceForm.controls.service_type.value === 'iscsi'
+      ) {
+        <!-- trusted_ip_list -->
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="trusted_ip_list"
+            label="Trusted IPs"
+            helperText="List of trusted IP addresses. Add the Ceph Manager IP addresses so the iSCSI gateways can be reached."
+          >
+          </cd-text-label-list>
+        </div>
+        <!-- api_port -->
+        <div class="form-item">
+          <cds-number
+            label="Port"
+            formControlName="api_port"
+            id="api_port"
+            min="1"
+            max="65535"
+            [invalid]="serviceForm.controls.api_port.invalid && serviceForm.controls.api_port.dirty"
+            [invalidText]="invalidApiPortError"
+          >
+          </cds-number>
+          <ng-template #invalidApiPortError>
+            @if (serviceForm.showError('api_port', frm, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must be at least 1.</span
+              >
+            }
+            @if (serviceForm.showError('api_port', frm, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- api_user -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="User"
+            [invalid]="serviceForm.controls.api_user.invalid && serviceForm.controls.api_user.dirty"
+            [invalidText]="invalidUser"
+          >
+            <input
+              cdsText
+              type="text"
+              id="api_user"
+              formControlName="api_user"
+              [invalid]="
+                serviceForm.controls.api_user.invalid && serviceForm.controls.api_user.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidUser>
+            @if (serviceForm.showError('api_user', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
 
-      <!-- api_password -->
-      <div class="form-item">
-        <cds-password-label cdRequiredField="Password"
-                            [invalid]="serviceForm.controls.api_password.invalid && serviceForm.controls.api_password.dirty"
-                            [invalidText]="invalidPassword">
-          <input cdsPassword
-                 type="password"
-                 id="api_password"
-                 formControlName="api_password"
-                 [invalid]="serviceForm.controls.api_password.invalid && serviceForm.controls.api_password.dirty" />
-        </cds-password-label>
-        <ng-template #invalidPassword>
-          @if (serviceForm.showError('api_password', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        <!-- api_password -->
+        <div class="form-item">
+          <cds-password-label
+            cdRequiredField="Password"
+            [invalid]="
+              serviceForm.controls.api_password.invalid && serviceForm.controls.api_password.dirty
+            "
+            [invalidText]="invalidPassword"
+          >
+            <input
+              cdsPassword
+              type="password"
+              id="api_password"
+              formControlName="api_password"
+              [invalid]="
+                serviceForm.controls.api_password.invalid && serviceForm.controls.api_password.dirty
+              "
+            />
+          </cds-password-label>
+          <ng-template #invalidPassword>
+            @if (serviceForm.showError('api_password', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
       }
 
       <!-- smb -->
       @if (serviceForm.controls.service_type.value === 'smb') {
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Cluster id"
-                        helperText="A short name identifying the SMB “cluster”. In this case a cluster is simply a management unit of one or more Samba services sharing a common configuration, and may not provide actual clustering or availability mechanisms."
-                        i18n-helperText
-                        [invalid]="serviceForm.controls.cluster_id.invalid && serviceForm.controls.cluster_id.dirty"
-                        [invalidText]="requiredFieldClusterId">
-          <input cdsText
-                 type="text"
-                 id="cluster_id"
-                 formControlName="cluster_id"
-                 placeholder="foo"
-                 [invalid]="serviceForm.controls.cluster_id.invalid && serviceForm.controls.cluster_id.dirty" />
-        </cds-text-label>
-        <ng-template #requiredFieldClusterId>
-          @if (serviceForm.showError('cluster_id', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Cluster id"
+            helperText="A short name identifying the SMB “cluster”. In this case a cluster is simply a management unit of one or more Samba services sharing a common configuration, and may not provide actual clustering or availability mechanisms."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.cluster_id.invalid && serviceForm.controls.cluster_id.dirty
+            "
+            [invalidText]="requiredFieldClusterId"
+          >
+            <input
+              cdsText
+              type="text"
+              id="cluster_id"
+              formControlName="cluster_id"
+              placeholder="foo"
+              [invalid]="
+                serviceForm.controls.cluster_id.invalid && serviceForm.controls.cluster_id.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #requiredFieldClusterId>
+            @if (serviceForm.showError('cluster_id', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
 
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Config URI"
-                        helperText="Configuration source that should be loaded by the samba-container as the primary configuration file."
-                        i18n-helperText
-                        [invalid]="serviceForm.controls.config_uri.invalid && serviceForm.controls.config_uri.dirty"
-                        [invalidText]="invalidConfigUriError">
-          <input cdsText
-                 type="text"
-                 id="config_uri"
-                 formControlName="config_uri"
-                 placeholder="rados://.smb/foo/scc.toml"
-                 [invalid]="serviceForm.controls.config_uri.invalid && serviceForm.controls.config_uri.dirty" />
-        </cds-text-label>
-        <ng-template #invalidConfigUriError>
-          @if (serviceForm.showError('config_uri', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('config_uri', frm, 'configUriPattern')) {
-          <span class="invalid-feedback"
-                i18n>The value must start with either 'http:', 'https:', 'rados:' or 'rados:mon-config-key:'</span>
-          }
-        </ng-template>
-      </div>
-      <div class="form-item">
-        <fieldset>
-          <label class="cds--label"
-                 for="features"
-                 i18n>Features
-            <cd-help-text>
-              Pre-defined terms enabling specific deployment characteristics.
-            </cd-help-text>
-          </label>
-          @for (feature of smbFeaturesList; track feature) {
-          <cds-checkbox i18n-label
-                        id="{{feature}}"
-                        name="{{feature}}"
-                        formControlName="{{feature}}">
-            Enable
-          </cds-checkbox>
-          }
-        </fieldset>
-      </div>
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Config URI"
+            helperText="Configuration source that should be loaded by the samba-container as the primary configuration file."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.config_uri.invalid && serviceForm.controls.config_uri.dirty
+            "
+            [invalidText]="invalidConfigUriError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="config_uri"
+              formControlName="config_uri"
+              placeholder="rados://.smb/foo/scc.toml"
+              [invalid]="
+                serviceForm.controls.config_uri.invalid && serviceForm.controls.config_uri.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidConfigUriError>
+            @if (serviceForm.showError('config_uri', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (serviceForm.showError('config_uri', frm, 'configUriPattern')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must start with either 'http:', 'https:', 'rados:' or
+                'rados:mon-config-key:'</span
+              >
+            }
+          </ng-template>
+        </div>
+        <div class="form-item">
+          <fieldset>
+            <label
+              class="cds--label"
+              for="features"
+              i18n
+              >Features
+              <cd-help-text>
+                Pre-defined terms enabling specific deployment characteristics.
+              </cd-help-text>
+            </label>
+            @for (feature of smbFeaturesList; track feature) {
+              <cds-checkbox
+                i18n-label
+                id="{{ feature }}"
+                name="{{ feature }}"
+                formControlName="{{ feature }}"
+              >
+                Enable
+              </cds-checkbox>
+            }
+          </fieldset>
+        </div>
 
-      <div class="form-item">
-        <cd-text-label-list formControlName="custom_dns"
-                            label="Custom DNS"
-                            helperText="IP addresses that will be used as the DNS servers for a Samba container."
-                            placeholder="192.168.76.204"
-                            i18n-placeholder>
-        </cd-text-label-list>
-      </div>
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="custom_dns"
+            label="Custom DNS"
+            helperText="IP addresses that will be used as the DNS servers for a Samba container."
+            placeholder="192.168.76.204"
+            i18n-placeholder
+          >
+          </cd-text-label-list>
+        </div>
 
-      <div class="form-item">
-        <cd-text-label-list formControlName="join_sources"
-                            label="Join sources"
-                            helperText="Identify where authentication data that will be used to perform domain joins is located."
-                            placeholder="rados:mon-config-key:smb/config/foo/join1.json"
-                            i18n-placeholder>
-        </cd-text-label-list>
-      </div>
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="join_sources"
+            label="Join sources"
+            helperText="Identify where authentication data that will be used to perform domain joins is located."
+            placeholder="rados:mon-config-key:smb/config/foo/join1.json"
+            i18n-placeholder
+          >
+          </cd-text-label-list>
+        </div>
 
-      <div class="form-item">
-        <cd-text-label-list formControlName="user_sources"
-                            label="User sources"
-                            helperText="Pseudo-uris containing data the samba-container can use to create users. A ceph based samba container may typically use a rados uri
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="user_sources"
+            label="User sources"
+            helperText="Pseudo-uris containing data the samba-container can use to create users. A ceph based samba container may typically use a rados uri
                             or a mon config-key store uri "
-                            placeholder="rados:mon-config-key:smb/config/foo/join2.json"
-                            i18n-placeholder>
-        </cd-text-label-list>
-      </div>
+            placeholder="rados:mon-config-key:smb/config/foo/join2.json"
+            i18n-placeholder
+          >
+          </cd-text-label-list>
+        </div>
 
-      <div class="form-item">
-        <cd-text-label-list formControlName="include_ceph_users"
-                            label="Ceph users"
-                            helperText="Cephx user names that the Samba containers may use."
-                            placeholder="client.smb.fs.cluster.foo"
-                            i18n-placeholder>
-        </cd-text-label-list>
-      </div>
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="include_ceph_users"
+            label="Ceph users"
+            helperText="Cephx user names that the Samba containers may use."
+            placeholder="client.smb.fs.cluster.foo"
+            i18n-placeholder
+          >
+          </cd-text-label-list>
+        </div>
       }
 
       <!-- Ingress -->
       @if (serviceForm.controls.service_type.value === 'ingress') {
-      <!-- virtual_ip -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Virtual IP"
-                        helperText="The virtual IP address and subnet (in CIDR notation) where the ingress service will be available."
-                        i18n-helperText
-                        [invalid]="serviceForm.controls.virtual_ip.invalid && serviceForm.controls.virtual_ip.dirty"
-                        [invalidText]="requiredFieldVirtualIp">
-          <input cdsText
-                 type="text"
-                 id="virtual_ip"
-                 formControlName="virtual_ip"
-                 [invalid]="serviceForm.controls.virtual_ip.invalid && serviceForm.controls.virtual_ip.dirty" />
-        </cds-text-label>
-        <ng-template #requiredFieldVirtualIp>
-          @if (serviceForm.showError('virtual_ip', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- frontend_port -->
-      <div class="form-item">
-        <cds-number cdRequiredField="Frontend port"
-                    label="Frontend port"
-                    formControlName="frontend_port"
-                    id="frontend_port"
-                    min="1"
-                    max="65535"
-                    helperText="The port used to access the ingress service."
-                    i18n-helperText
-                    [invalid]="serviceForm.controls.frontend_port.invalid && serviceForm.controls.frontend_port.dirty"
-                    [invalidText]="invalidFrontendPortError">
-        </cds-number>
-        <ng-template #invalidFrontendPortError>
-          @if (serviceForm.showError('frontend_port', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('frontend_port', frm, 'min')) {
-          <span class="invalid-feedback"
-                i18n>The value must be at least 1.</span>
-          }
-          @if (serviceForm.showError('frontend_port', frm, 'max')) {
-          <span class="invalid-feedback"
-                i18n>The value cannot exceed 65535.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- monitor_port -->
-      <div class="form-item">
-        <cds-number cdRequiredField="Monitor port"
-                    label="Monitor port"
-                    formControlName="monitor_port"
-                    id="monitor_port"
-                    min="1"
-                    max="65535"
-                    helperText="The port used by haproxy for load balancer status."
-                    i18n-helperText
-                    [invalid]="serviceForm.controls.monitor_port.invalid && serviceForm.controls.monitor_port.dirty"
-                    [invalidText]="invalidMonitorPortError">
-        </cds-number>
-        <ng-template #invalidMonitorPortError>
-          @if (serviceForm.showError('monitor_port', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('monitor_port', frm, 'min')) {
-          <span class="invalid-feedback"
-                i18n>The value must be at least 1.</span>
-          }
-          @if (serviceForm.showError('monitor_port', frm, 'max')) {
-          <span class="invalid-feedback"
-                i18n>The value cannot exceed 65535.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- virtual_interface_networks -->
-      @if (!serviceForm.controls.unmanaged.value) {
-      <div class="form-item">
-        <cd-text-label-list formControlName="virtual_interface_networks"
-                            label="CIDR Networks"
-                            helperText="A list of networks to identify which network interface to use for the virtual IP address.">
-        </cd-text-label-list>
-      </div>
-      }
+        <!-- virtual_ip -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Virtual IP"
+            helperText="The virtual IP address and subnet (in CIDR notation) where the ingress service will be available."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.virtual_ip.invalid && serviceForm.controls.virtual_ip.dirty
+            "
+            [invalidText]="requiredFieldVirtualIp"
+          >
+            <input
+              cdsText
+              type="text"
+              id="virtual_ip"
+              formControlName="virtual_ip"
+              [invalid]="
+                serviceForm.controls.virtual_ip.invalid && serviceForm.controls.virtual_ip.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #requiredFieldVirtualIp>
+            @if (serviceForm.showError('virtual_ip', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- frontend_port -->
+        <div class="form-item">
+          <cds-number
+            cdRequiredField="Frontend port"
+            label="Frontend port"
+            formControlName="frontend_port"
+            id="frontend_port"
+            min="1"
+            max="65535"
+            helperText="The port used to access the ingress service."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.frontend_port.invalid && serviceForm.controls.frontend_port.dirty
+            "
+            [invalidText]="invalidFrontendPortError"
+          >
+          </cds-number>
+          <ng-template #invalidFrontendPortError>
+            @if (serviceForm.showError('frontend_port', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (serviceForm.showError('frontend_port', frm, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must be at least 1.</span
+              >
+            }
+            @if (serviceForm.showError('frontend_port', frm, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- monitor_port -->
+        <div class="form-item">
+          <cds-number
+            cdRequiredField="Monitor port"
+            label="Monitor port"
+            formControlName="monitor_port"
+            id="monitor_port"
+            min="1"
+            max="65535"
+            helperText="The port used by haproxy for load balancer status."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.monitor_port.invalid && serviceForm.controls.monitor_port.dirty
+            "
+            [invalidText]="invalidMonitorPortError"
+          >
+          </cds-number>
+          <ng-template #invalidMonitorPortError>
+            @if (serviceForm.showError('monitor_port', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (serviceForm.showError('monitor_port', frm, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must be at least 1.</span
+              >
+            }
+            @if (serviceForm.showError('monitor_port', frm, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- virtual_interface_networks -->
+        @if (!serviceForm.controls.unmanaged.value) {
+          <div class="form-item">
+            <cd-text-label-list
+              formControlName="virtual_interface_networks"
+              label="CIDR Networks"
+              helperText="A list of networks to identify which network interface to use for the virtual IP address."
+            >
+            </cd-text-label-list>
+          </div>
+        }
       }
 
       <!-- SNMP-Gateway -->
       @if (serviceForm.controls.service_type.value === 'snmp-gateway') {
-      <!-- snmp-version -->
-      <div class="form-item">
-        <cds-select formControlName="snmp_version"
-                    id="snmp_version"
-                    label="Version"
-                    cdRequiredField="Version"
-                    helperText="Active-directory authentication for domain member servers and User authentication for Stand-alone servers configuration."
-                    i18n-helperText
-                    [invalid]="serviceForm.controls.snmp_version.invalid && serviceForm.controls.snmp_version.dirty"
-                    [invalidText]="requiredFieldSnmpVersion"
-                    (change)="clearValidations()">
-          <option i18n
-                  [ngValue]="null">-- Select SNMP version --</option>
-          @for (snmpVersion of ['V2c', 'V3']; track snmpVersion) {
-          <option [value]="snmpVersion">{{ snmpVersion }}</option>
-          }
-        </cds-select>
-        <ng-template #requiredFieldSnmpVersion>
-          @if (serviceForm.showError('snmp_version', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- Destination -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Destination"
-                        helperText="Must be of the format hostname:port."
-                        i18n-helperText
-                        [invalid]="serviceForm.controls.snmp_destination.invalid && serviceForm.controls.snmp_destination.dirty"
-                        [invalidText]="invalidSnmpDestinationError">
-          <input cdsText
-                 type="text"
-                 id="snmp_destination"
-                 formControlName="snmp_destination"
-                 [invalid]="serviceForm.controls.snmp_destination.invalid && serviceForm.controls.snmp_destination.dirty" />
-          <ng-template #invalidSnmpDestinationError>
-            @if (serviceForm.showError('snmp_destination', frm, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
+        <!-- snmp-version -->
+        <div class="form-item">
+          <cds-select
+            formControlName="snmp_version"
+            id="snmp_version"
+            label="Version"
+            cdRequiredField="Version"
+            helperText="Active-directory authentication for domain member servers and User authentication for Stand-alone servers configuration."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.snmp_version.invalid && serviceForm.controls.snmp_version.dirty
+            "
+            [invalidText]="requiredFieldSnmpVersion"
+            (change)="clearValidations()"
+          >
+            <option
+              i18n
+              [ngValue]="null"
+            >
+              -- Select SNMP version --
+            </option>
+            @for (snmpVersion of ['V2c', 'V3']; track snmpVersion) {
+              <option [value]="snmpVersion">{{ snmpVersion }}</option>
             }
-            @if (serviceForm.showError('snmp_destination', frm, 'snmpDestinationPattern')) {
-            <span class="invalid-feedback"
-                  i18n>The value does not match the pattern: <strong>hostname:port</strong></span>
+          </cds-select>
+          <ng-template #requiredFieldSnmpVersion>
+            @if (serviceForm.showError('snmp_version', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
             }
           </ng-template>
-        </cds-text-label>
-      </div>
-      <!-- Engine id for snmp V3 -->
-      @if (serviceForm.controls.snmp_version.value === 'V3') {
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Engine Id"
-                        helperText="Unique identifier for the device (in hex)."
-                        i18n-helperText
-                        [invalid]="serviceForm.controls.engine_id.invalid && serviceForm.controls.engine_id.dirty"
-                        [invalidText]="invalidEngineIdError">
-          <input cdsText
-                 type="text"
-                 id="engine_id"
-                 formControlName="engine_id"
-                 [invalid]="serviceForm.controls.engine_id.invalid && serviceForm.controls.engine_id.dirty" />
-        </cds-text-label>
-        <ng-template #invalidEngineIdError>
-          @if (serviceForm.showError('engine_id', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('engine_id', frm, 'snmpEngineIdPattern')) {
-          <span class="invalid-feedback"
-                i18n>The value does not match the pattern: <strong>Must be in hexadecimal and length must be multiple of
-              2
-              with min value = 10 and max value = 64.</strong></span>
-          }
-        </ng-template>
-      </div>
-      <!-- Auth protocol for snmp V3 -->
-      <div class="form-item">
-        <cds-select formControlName="auth_protocol"
-                    id="auth_protocol"
-                    label="Auth protocol"
-                    cdRequiredField="Auth protocol"
-                    [invalid]="serviceForm.controls.auth_protocol.invalid && serviceForm.controls.auth_protocol.dirty"
-                    [invalidText]="requiredFieldAuthProtocol">
-          <option i18n
-                  [ngValue]="null">-- Select auth protocol --</option>
-          @for (authProtocol of ['SHA', 'MD5']; track authProtocol) {
-          <option [value]="authProtocol">
-            {{ authProtocol }}
-          </option>
-          }
-        </cds-select>
-        <ng-template #requiredFieldAuthProtocol>
-          @if (serviceForm.showError('auth_protocol', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+        </div>
+        <!-- Destination -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Destination"
+            helperText="Must be of the format hostname:port."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.snmp_destination.invalid &&
+              serviceForm.controls.snmp_destination.dirty
+            "
+            [invalidText]="invalidSnmpDestinationError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="snmp_destination"
+              formControlName="snmp_destination"
+              [invalid]="
+                serviceForm.controls.snmp_destination.invalid &&
+                serviceForm.controls.snmp_destination.dirty
+              "
+            />
+            <ng-template #invalidSnmpDestinationError>
+              @if (serviceForm.showError('snmp_destination', frm, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >This field is required.</span
+                >
+              }
+              @if (serviceForm.showError('snmp_destination', frm, 'snmpDestinationPattern')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >The value does not match the pattern: <strong>hostname:port</strong></span
+                >
+              }
+            </ng-template>
+          </cds-text-label>
+        </div>
+        <!-- Engine id for snmp V3 -->
+        @if (serviceForm.controls.snmp_version.value === 'V3') {
+          <div class="form-item">
+            <cds-text-label
+              cdRequiredField="Engine Id"
+              helperText="Unique identifier for the device (in hex)."
+              i18n-helperText
+              [invalid]="
+                serviceForm.controls.engine_id.invalid && serviceForm.controls.engine_id.dirty
+              "
+              [invalidText]="invalidEngineIdError"
+            >
+              <input
+                cdsText
+                type="text"
+                id="engine_id"
+                formControlName="engine_id"
+                [invalid]="
+                  serviceForm.controls.engine_id.invalid && serviceForm.controls.engine_id.dirty
+                "
+              />
+            </cds-text-label>
+            <ng-template #invalidEngineIdError>
+              @if (serviceForm.showError('engine_id', frm, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >This field is required.</span
+                >
+              }
+              @if (serviceForm.showError('engine_id', frm, 'snmpEngineIdPattern')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >The value does not match the pattern:
+                  <strong
+                    >Must be in hexadecimal and length must be multiple of 2 with min value = 10 and
+                    max value = 64.</strong
+                  ></span
+                >
+              }
+            </ng-template>
+          </div>
+          <!-- Auth protocol for snmp V3 -->
+          <div class="form-item">
+            <cds-select
+              formControlName="auth_protocol"
+              id="auth_protocol"
+              label="Auth protocol"
+              cdRequiredField="Auth protocol"
+              [invalid]="
+                serviceForm.controls.auth_protocol.invalid &&
+                serviceForm.controls.auth_protocol.dirty
+              "
+              [invalidText]="requiredFieldAuthProtocol"
+            >
+              <option
+                i18n
+                [ngValue]="null"
+              >
+                -- Select auth protocol --
+              </option>
+              @for (authProtocol of ['SHA', 'MD5']; track authProtocol) {
+                <option [value]="authProtocol">
+                  {{ authProtocol }}
+                </option>
+              }
+            </cds-select>
+            <ng-template #requiredFieldAuthProtocol>
+              @if (serviceForm.showError('auth_protocol', frm, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >This field is required.</span
+                >
+              }
+            </ng-template>
+          </div>
 
-      <!-- Privacy protocol for snmp V3 -->
-      <div class="form-item">
-        <cds-select formControlName="privacy_protocol"
-                    id="privacy_protocol"
-                    label="Privacy protocol">
-          <option i18n
-                  [ngValue]="null">-- Select privacy protocol --</option>
-          @for (privacyProtocol of ['DES', 'AES']; track privacyProtocol) {
-          <option [value]="privacyProtocol">
-            {{ privacyProtocol }}
-          </option>
-          }
-        </cds-select>
-      </div>
-      }
-      <!-- Credentials -->
-      @if (['V2c', 'V3'].includes(serviceForm.controls.snmp_version?.value)) {
-      <fieldset>
-        <legend i18n>Credentials</legend>
-        <!-- snmp v2c snmp_community -->
-        @if (serviceForm.controls.snmp_version.value === 'V2c') {
-        <div class="form-item">
-          <cds-text-label cdRequiredField="SNMP community"
-                          [invalid]="serviceForm.controls.snmp_community.invalid && serviceForm.controls.snmp_community.dirty"
-                          [invalidText]="invalidSnmpCommunityError">
-            <input cdsText
-                   type="text"
-                   id="snmp_community"
-                   formControlName="snmp_community"
-                   [invalid]="serviceForm.controls.snmp_community.invalid && serviceForm.controls.snmp_community.dirty" />
-          </cds-text-label>
-          <ng-template #invalidSnmpCommunityError>
-            @if (serviceForm.showError('snmp_community', frm, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
-            }
-          </ng-template>
-        </div>
+          <!-- Privacy protocol for snmp V3 -->
+          <div class="form-item">
+            <cds-select
+              formControlName="privacy_protocol"
+              id="privacy_protocol"
+              label="Privacy protocol"
+            >
+              <option
+                i18n
+                [ngValue]="null"
+              >
+                -- Select privacy protocol --
+              </option>
+              @for (privacyProtocol of ['DES', 'AES']; track privacyProtocol) {
+                <option [value]="privacyProtocol">
+                  {{ privacyProtocol }}
+                </option>
+              }
+            </cds-select>
+          </div>
         }
-        <!-- snmp v3 auth username -->
-        @if (serviceForm.controls.snmp_version.value === 'V3') {
-        <div class="form-item">
-          <cds-text-label cdRequiredField="Username"
-                          [invalid]="serviceForm.controls.snmp_v3_auth_username.invalid && serviceForm.controls.snmp_v3_auth_username.dirty"
-                          [invalidText]="invalidSnmpV3AuthUsernameError">
-            <input cdsText
-                   type="text"
-                   id="snmp_v3_auth_username"
-                   formControlName="snmp_v3_auth_username"
-                   [invalid]="serviceForm.controls.snmp_v3_auth_username.invalid && serviceForm.controls.snmp_v3_auth_username.dirty" />
-          </cds-text-label>
-          <ng-template #invalidSnmpV3AuthUsernameError>
-            @if (serviceForm.showError('snmp_v3_auth_username', frm, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
+        <!-- Credentials -->
+        @if (['V2c', 'V3'].includes(serviceForm.controls.snmp_version?.value)) {
+          <fieldset>
+            <legend i18n>Credentials</legend>
+            <!-- snmp v2c snmp_community -->
+            @if (serviceForm.controls.snmp_version.value === 'V2c') {
+              <div class="form-item">
+                <cds-text-label
+                  cdRequiredField="SNMP community"
+                  [invalid]="
+                    serviceForm.controls.snmp_community.invalid &&
+                    serviceForm.controls.snmp_community.dirty
+                  "
+                  [invalidText]="invalidSnmpCommunityError"
+                >
+                  <input
+                    cdsText
+                    type="text"
+                    id="snmp_community"
+                    formControlName="snmp_community"
+                    [invalid]="
+                      serviceForm.controls.snmp_community.invalid &&
+                      serviceForm.controls.snmp_community.dirty
+                    "
+                  />
+                </cds-text-label>
+                <ng-template #invalidSnmpCommunityError>
+                  @if (serviceForm.showError('snmp_community', frm, 'required')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                      >This field is required.</span
+                    >
+                  }
+                </ng-template>
+              </div>
             }
-          </ng-template>
-        </div>
-        }
-        <!-- snmp v3 auth password -->
-        @if (serviceForm.controls.snmp_version.value === 'V3') {
-        <div class="form-item">
-          <cds-password-label cdRequiredField="Password"
-                              [invalid]="serviceForm.controls.snmp_v3_auth_password.invalid && serviceForm.controls.snmp_v3_auth_password.dirty"
-                              [invalidText]="invalidSnmpV3AuthPasswordError">
-            <input cdsPassword
-                   type="password"
-                   id="snmp_v3_auth_password"
-                   formControlName="snmp_v3_auth_password"
-                   [invalid]="serviceForm.controls.snmp_v3_auth_password.invalid && serviceForm.controls.snmp_v3_auth_password.dirty" />
-          </cds-password-label>
-          <ng-template #invalidSnmpV3AuthPasswordError>
-            @if (serviceForm.showError('snmp_v3_auth_password', frm, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
+            <!-- snmp v3 auth username -->
+            @if (serviceForm.controls.snmp_version.value === 'V3') {
+              <div class="form-item">
+                <cds-text-label
+                  cdRequiredField="Username"
+                  [invalid]="
+                    serviceForm.controls.snmp_v3_auth_username.invalid &&
+                    serviceForm.controls.snmp_v3_auth_username.dirty
+                  "
+                  [invalidText]="invalidSnmpV3AuthUsernameError"
+                >
+                  <input
+                    cdsText
+                    type="text"
+                    id="snmp_v3_auth_username"
+                    formControlName="snmp_v3_auth_username"
+                    [invalid]="
+                      serviceForm.controls.snmp_v3_auth_username.invalid &&
+                      serviceForm.controls.snmp_v3_auth_username.dirty
+                    "
+                  />
+                </cds-text-label>
+                <ng-template #invalidSnmpV3AuthUsernameError>
+                  @if (serviceForm.showError('snmp_v3_auth_username', frm, 'required')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                      >This field is required.</span
+                    >
+                  }
+                </ng-template>
+              </div>
             }
-          </ng-template>
-        </div>
-        }
-        <!-- snmp v3 priv password -->
-        @if (serviceForm.controls.snmp_version.value === 'V3' && serviceForm.controls.privacy_protocol.value !== null &&
-        serviceForm.controls.privacy_protocol.value !== undefined) {
-        <div class="form-item">
-          <cds-password-label cdRequiredField="Encryption"
-                              [invalid]="serviceForm.controls.snmp_v3_priv_password.invalid && serviceForm.controls.snmp_v3_priv_password.dirty"
-                              [invalidText]="invalidSnmpV3PrivPasswordError">
-            <input cdsPassword
-                   type="password"
-                   id="snmp_v3_priv_password"
-                   formControlName="snmp_v3_priv_password"
-                   [invalid]="serviceForm.controls.snmp_v3_priv_password.invalid && serviceForm.controls.snmp_v3_priv_password.dirty" />
-          </cds-password-label>
-          <ng-template #invalidSnmpV3PrivPasswordError>
-            @if (serviceForm.showError('snmp_v3_priv_password', frm, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
+            <!-- snmp v3 auth password -->
+            @if (serviceForm.controls.snmp_version.value === 'V3') {
+              <div class="form-item">
+                <cds-password-label
+                  cdRequiredField="Password"
+                  [invalid]="
+                    serviceForm.controls.snmp_v3_auth_password.invalid &&
+                    serviceForm.controls.snmp_v3_auth_password.dirty
+                  "
+                  [invalidText]="invalidSnmpV3AuthPasswordError"
+                >
+                  <input
+                    cdsPassword
+                    type="password"
+                    id="snmp_v3_auth_password"
+                    formControlName="snmp_v3_auth_password"
+                    [invalid]="
+                      serviceForm.controls.snmp_v3_auth_password.invalid &&
+                      serviceForm.controls.snmp_v3_auth_password.dirty
+                    "
+                  />
+                </cds-password-label>
+                <ng-template #invalidSnmpV3AuthPasswordError>
+                  @if (serviceForm.showError('snmp_v3_auth_password', frm, 'required')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                      >This field is required.</span
+                    >
+                  }
+                </ng-template>
+              </div>
             }
-          </ng-template>
-        </div>
+            <!-- snmp v3 priv password -->
+            @if (
+              serviceForm.controls.snmp_version.value === 'V3' &&
+              serviceForm.controls.privacy_protocol.value !== null &&
+              serviceForm.controls.privacy_protocol.value !== undefined
+            ) {
+              <div class="form-item">
+                <cds-password-label
+                  cdRequiredField="Encryption"
+                  [invalid]="
+                    serviceForm.controls.snmp_v3_priv_password.invalid &&
+                    serviceForm.controls.snmp_v3_priv_password.dirty
+                  "
+                  [invalidText]="invalidSnmpV3PrivPasswordError"
+                >
+                  <input
+                    cdsPassword
+                    type="password"
+                    id="snmp_v3_priv_password"
+                    formControlName="snmp_v3_priv_password"
+                    [invalid]="
+                      serviceForm.controls.snmp_v3_priv_password.invalid &&
+                      serviceForm.controls.snmp_v3_priv_password.dirty
+                    "
+                  />
+                </cds-password-label>
+                <ng-template #invalidSnmpV3PrivPasswordError>
+                  @if (serviceForm.showError('snmp_v3_priv_password', frm, 'required')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                      >This field is required.</span
+                    >
+                  }
+                </ng-template>
+              </div>
+            }
+          </fieldset>
         }
-      </fieldset>
-      }
       }
 
       <!-- oauth2-proxy -->
       @if (serviceForm.controls.service_type.value === 'oauth2-proxy') {
-      <!-- provider_display_name -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Provider display name"
-                        placeholder="My OIDC Provider"
-                        i18n-placeholder
-                        [invalid]="serviceForm.controls.provider_display_name.invalid && serviceForm.controls.provider_display_name.dirty"
-                        [invalidText]="invalidProviderDisplayNameError">
-          <input cdsText
-                 type="text"
-                 id="provider_display_name"
-                 formControlName="provider_display_name"
-                 [invalid]="serviceForm.controls.provider_display_name.invalid && serviceForm.controls.provider_display_name.dirty" />
-        </cds-text-label>
-        <ng-template #invalidProviderDisplayNameError>
-          @if (serviceForm.showError('provider_display_name', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- client_id -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Client ID"
-                        placeholder="oauth2-client"
-                        [invalid]="serviceForm.controls.client_id.invalid && serviceForm.controls.client_id.dirty"
-                        [invalidText]="invalidClientIdError">
-          <input cdsText
-                 type="text"
-                 id="client_id"
-                 formControlName="client_id"
-                 [invalid]="serviceForm.controls.client_id.invalid && serviceForm.controls.client_id.dirty" />
-        </cds-text-label>
-        <ng-template #invalidClientIdError>
-          @if (serviceForm.showError('client_id', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- client_secret -->
-      <div class="form-item form-item-append">
-        <cds-password-label cdRequiredField="Client secret"
-                            [invalid]="serviceForm.controls.client_secret.invalid && serviceForm.controls.client_secret.dirty"
-                            [invalidText]="invalidClientSecretError">
-          <input cdsPassword
-                 type="text"
-                 id="client_secret"
-                 formControlName="client_secret"
-                 [invalid]="serviceForm.controls.client_secret.invalid && serviceForm.controls.client_secret.dirty" />
-        </cds-password-label>
-        <cd-copy-2-clipboard-button source="client_secret"
-                                    class="mt-4">
-        </cd-copy-2-clipboard-button>
-        <ng-template #invalidClientSecretError>
-          @if (serviceForm.showError('client_secret', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- oidc_issuer_url -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="OIDC issuer URL"
-                        [invalid]="serviceForm.controls.oidc_issuer_url.invalid && serviceForm.controls.oidc_issuer_url.dirty"
-                        [invalidText]="invalidOidcIssuerUrlError">
-          <input cdsText
-                 type="text"
-                 id="oidc_issuer_url"
-                 formControlName="oidc_issuer_url"
-                 [invalid]="serviceForm.controls.oidc_issuer_url.invalid && serviceForm.controls.oidc_issuer_url.dirty" />
-        </cds-text-label>
-        <ng-template #invalidOidcIssuerUrlError>
-          @if (serviceForm.showError('oidc_issuer_url', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('oidc_issuer_url', frm, 'validUrl')) {
-          <span class="invalid-feedback"
-                i18n>Invalid url.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- https_address -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Https address"
-                        helperText="The address for HTTPS connections as [IP|Hostname]:port."
-                        i18n-helperText
-                        placeholder="0.0.0.0:4180"
-                        [invalid]="serviceForm.controls.https_address.invalid && serviceForm.controls.https_address.dirty"
-                        [invalidText]="invalidHttpsAddressError">
-          <input cdsText
-                 type="text"
-                 id="https_address"
-                 formControlName="https_address"
-                 [invalid]="serviceForm.controls.https_address.invalid && serviceForm.controls.https_address.dirty" />
-        </cds-text-label>
-        <ng-template #invalidHttpsAddressError>
-          @if (serviceForm.showError('https_address', frm, 'invalidAddress')) {
-          <span class="invalid-feedback"
-                i18n>Format must be [IP|Hostname]:port and the port between 0 and 65535</span>
-          }
-        </ng-template>
-      </div>
-      <!-- redirect_url -->
-      <div class="form-item">
-        <cds-text-label cdRequiredField="Redirect URL"
-                        placeholder="https://<IP|Hostname>:4180/oauth2/callback"
-                        helperText="The URL the oauth2-proxy service will redirect to after a successful login."
-                        i18n-helperText
-                        [invalid]="serviceForm.controls.redirect_url.invalid && serviceForm.controls.redirect_url.dirty"
-                        [invalidText]="invalidRedirectUrlError">
-          <input cdsText
-                 type="text"
-                 id="redirect_url"
-                 formControlName="redirect_url"
-                 [invalid]="serviceForm.controls.redirect_url.invalid && serviceForm.controls.redirect_url.dirty" />
-        </cds-text-label>
-        <ng-template #invalidRedirectUrlError>
-          @if (serviceForm.showError('redirect_url', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- Scope -->
-      <div class="form-item">
-        <cd-text-label-list formControlName="scope"
-                            label="Scope"
-                            helperText="OAuth scope specification."
-                            placeholder="openid profile email">
-        </cd-text-label-list>
-      </div>
-      <!-- Email_domains -->
-      <div class="form-item">
-        <cd-text-label-list formControlName="email_domains"
-                            label="Email domains"
-                            helperText="Email domains to be allowed."
-                            placeholder="*">
-        </cd-text-label-list>
-      </div>
-      <!-- Allowlist_domains -->
-      <div class="form-item">
-        <cd-text-label-list formControlName="allowlist_domains"
-                            label="Allowlist domains"
-                            helperText="Domains to be allowed to redirect to, used for login or logout."
-                            placeholder="192.168.100.1:8080">
-        </cd-text-label-list>
-      </div>
-      <!-- SSL Insecure Skip Verify -->
-      <div class="form-item">
-        <cds-checkbox i18n-label
-                      formControlName="ssl_insecure_skip_verify">
-          Skip TLS verification
-          <cd-help-text i18n>
-            Skip TLS certificate verification for the OIDC provider. Use only in non-production environments.
-          </cd-help-text>
-        </cds-checkbox>
-      </div>
-      }
-
-      @if (!serviceForm.controls.unmanaged.value && ['mgmt-gateway'].includes(serviceForm.controls.service_type.value))
-      {
-      <!-- port -->
-      <div class="form-item">
-        <cds-number label="Port"
-                    formControlName="port"
-                    id="port"
-                    min="1"
-                    max="65535"
-                    [invalid]="serviceForm.controls.port.invalid && serviceForm.controls.port.dirty"
-                    [invalidText]="invalidPortError">
-        </cds-number>
-        <ng-template #invalidPortError>
-          @if (serviceForm.showError('port', frm, 'min')) {
-          <span class="invalid-feedback"
-                i18n>The value must be at least 1.</span>
-          }
-          @if (serviceForm.showError('port', frm, 'max')) {
-          <span class="invalid-feedback"
-                i18n>The value cannot exceed 65535.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- enable_auth -->
-      <div class="form-item">
-        <fieldset>
-          <label class="cds--label"
-                 for="pools"
-                 i18n>Authentication</label>
-          <cds-checkbox i18n-label
-                        id="enable_auth"
-                        name="enable_auth"
-                        formControlName="enable_auth">
-            Enable
+        <!-- provider_display_name -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Provider display name"
+            placeholder="My OIDC Provider"
+            i18n-placeholder
+            [invalid]="
+              serviceForm.controls.provider_display_name.invalid &&
+              serviceForm.controls.provider_display_name.dirty
+            "
+            [invalidText]="invalidProviderDisplayNameError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="provider_display_name"
+              formControlName="provider_display_name"
+              [invalid]="
+                serviceForm.controls.provider_display_name.invalid &&
+                serviceForm.controls.provider_display_name.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidProviderDisplayNameError>
+            @if (serviceForm.showError('provider_display_name', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- client_id -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Client ID"
+            placeholder="oauth2-client"
+            [invalid]="
+              serviceForm.controls.client_id.invalid && serviceForm.controls.client_id.dirty
+            "
+            [invalidText]="invalidClientIdError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="client_id"
+              formControlName="client_id"
+              [invalid]="
+                serviceForm.controls.client_id.invalid && serviceForm.controls.client_id.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidClientIdError>
+            @if (serviceForm.showError('client_id', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- client_secret -->
+        <div class="form-item form-item-append">
+          <cds-password-label
+            cdRequiredField="Client secret"
+            [invalid]="
+              serviceForm.controls.client_secret.invalid && serviceForm.controls.client_secret.dirty
+            "
+            [invalidText]="invalidClientSecretError"
+          >
+            <input
+              cdsPassword
+              type="text"
+              id="client_secret"
+              formControlName="client_secret"
+              [invalid]="
+                serviceForm.controls.client_secret.invalid &&
+                serviceForm.controls.client_secret.dirty
+              "
+            />
+          </cds-password-label>
+          <cd-copy-2-clipboard-button
+            source="client_secret"
+            class="mt-4"
+          >
+          </cd-copy-2-clipboard-button>
+          <ng-template #invalidClientSecretError>
+            @if (serviceForm.showError('client_secret', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- oidc_issuer_url -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="OIDC issuer URL"
+            [invalid]="
+              serviceForm.controls.oidc_issuer_url.invalid &&
+              serviceForm.controls.oidc_issuer_url.dirty
+            "
+            [invalidText]="invalidOidcIssuerUrlError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="oidc_issuer_url"
+              formControlName="oidc_issuer_url"
+              [invalid]="
+                serviceForm.controls.oidc_issuer_url.invalid &&
+                serviceForm.controls.oidc_issuer_url.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidOidcIssuerUrlError>
+            @if (serviceForm.showError('oidc_issuer_url', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (serviceForm.showError('oidc_issuer_url', frm, 'validUrl')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Invalid url.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- https_address -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Https address"
+            helperText="The address for HTTPS connections as [IP|Hostname]:port."
+            i18n-helperText
+            placeholder="0.0.0.0:4180"
+            [invalid]="
+              serviceForm.controls.https_address.invalid && serviceForm.controls.https_address.dirty
+            "
+            [invalidText]="invalidHttpsAddressError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="https_address"
+              formControlName="https_address"
+              [invalid]="
+                serviceForm.controls.https_address.invalid &&
+                serviceForm.controls.https_address.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidHttpsAddressError>
+            @if (serviceForm.showError('https_address', frm, 'invalidAddress')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Format must be [IP|Hostname]:port and the port between 0 and 65535</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- redirect_url -->
+        <div class="form-item">
+          <cds-text-label
+            cdRequiredField="Redirect URL"
+            placeholder="https://<IP|Hostname>:4180/oauth2/callback"
+            helperText="The URL the oauth2-proxy service will redirect to after a successful login."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.redirect_url.invalid && serviceForm.controls.redirect_url.dirty
+            "
+            [invalidText]="invalidRedirectUrlError"
+          >
+            <input
+              cdsText
+              type="text"
+              id="redirect_url"
+              formControlName="redirect_url"
+              [invalid]="
+                serviceForm.controls.redirect_url.invalid && serviceForm.controls.redirect_url.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #invalidRedirectUrlError>
+            @if (serviceForm.showError('redirect_url', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- Scope -->
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="scope"
+            label="Scope"
+            helperText="OAuth scope specification."
+            placeholder="openid profile email"
+          >
+          </cd-text-label-list>
+        </div>
+        <!-- Email_domains -->
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="email_domains"
+            label="Email domains"
+            helperText="Email domains to be allowed."
+            placeholder="*"
+          >
+          </cd-text-label-list>
+        </div>
+        <!-- Allowlist_domains -->
+        <div class="form-item">
+          <cd-text-label-list
+            formControlName="allowlist_domains"
+            label="Allowlist domains"
+            helperText="Domains to be allowed to redirect to, used for login or logout."
+            placeholder="192.168.100.1:8080"
+          >
+          </cd-text-label-list>
+        </div>
+        <!-- SSL Insecure Skip Verify -->
+        <div class="form-item">
+          <cds-checkbox
+            i18n-label
+            formControlName="ssl_insecure_skip_verify"
+          >
+            Skip TLS verification
             <cd-help-text i18n>
-              Allows to enable authentication through an external Identity Provider (IdP) using Single Sign-On (SSO)
+              Skip TLS certificate verification for the OIDC provider. Use only in non-production
+              environments.
             </cd-help-text>
           </cds-checkbox>
-        </fieldset>
-      </div>
-      <!-- ssl_protocols -->
-      <div class="form-item">
-        <cds-combo-box type="multi"
-                       label="SSL protocols"
-                       selectionFeedback="top-after-reopen"
-                       for="ssl_protocols"
-                       name="ssl_protocols"
-                       formControlName="ssl_protocols"
-                       id="ssl_protocols"
-                       placeholder="Select protocols..."
-                       [appendInline]="true"
-                       [items]="sslProtocolsItems"
-                       i18n-placeholder
-                       i18n>
-          <cds-dropdown-list></cds-dropdown-list>
-        </cds-combo-box>
-      </div>
-      <!-- ssl_ciphers -->
-      <div class="form-item">
-        <cds-text-label placeholder="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
-                        [helperText]="cipherListLink"
-                        i18n-helperText>
-          SSL ciphers
-          <input cdsText
-                 type="text"
-                 id="ssl_ciphers"
-                 formControlName="ssl_ciphers" />
-          @if (serviceForm.showError('ssl_ciphers', frm, 'invalidPattern')) {
-          <span class="invalid-feedback"
-                i18n>Invalid cipher suite. Each cipher must be separated by '-' and each cipher suite must be separated
-            by
-            ':'</span>
-          }
-        </cds-text-label>
-      </div>
+        </div>
+      }
+
+      @if (
+        !serviceForm.controls.unmanaged.value &&
+        ['mgmt-gateway'].includes(serviceForm.controls.service_type.value)
+      ) {
+        <!-- port -->
+        <div class="form-item">
+          <cds-number
+            label="Port"
+            formControlName="port"
+            id="port"
+            min="1"
+            max="65535"
+            [invalid]="serviceForm.controls.port.invalid && serviceForm.controls.port.dirty"
+            [invalidText]="invalidPortError"
+          >
+          </cds-number>
+          <ng-template #invalidPortError>
+            @if (serviceForm.showError('port', frm, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must be at least 1.</span
+              >
+            }
+            @if (serviceForm.showError('port', frm, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <!-- enable_auth -->
+        <div class="form-item">
+          <fieldset>
+            <label
+              class="cds--label"
+              for="pools"
+              i18n
+              >Authentication</label
+            >
+            <cds-checkbox
+              i18n-label
+              id="enable_auth"
+              name="enable_auth"
+              formControlName="enable_auth"
+            >
+              Enable
+              <cd-help-text i18n>
+                Allows to enable authentication through an external Identity Provider (IdP) using
+                Single Sign-On (SSO)
+              </cd-help-text>
+            </cds-checkbox>
+          </fieldset>
+        </div>
+        <!-- ssl_protocols -->
+        <div class="form-item">
+          <cds-combo-box
+            type="multi"
+            label="SSL protocols"
+            selectionFeedback="top-after-reopen"
+            for="ssl_protocols"
+            name="ssl_protocols"
+            formControlName="ssl_protocols"
+            id="ssl_protocols"
+            placeholder="Select protocols..."
+            [appendInline]="true"
+            [items]="sslProtocolsItems"
+            i18n-placeholder
+            i18n
+          >
+            <cds-dropdown-list></cds-dropdown-list>
+          </cds-combo-box>
+        </div>
+        <!-- ssl_ciphers -->
+        <div class="form-item">
+          <cds-text-label
+            placeholder="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
+            [helperText]="cipherListLink"
+            i18n-helperText
+          >
+            SSL ciphers
+            <input
+              cdsText
+              type="text"
+              id="ssl_ciphers"
+              formControlName="ssl_ciphers"
+            />
+            @if (serviceForm.showError('ssl_ciphers', frm, 'invalidPattern')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Invalid cipher suite. Each cipher must be separated by '-' and each cipher suite
+                must be separated by ':'</span
+              >
+            }
+          </cds-text-label>
+        </div>
       }
       <!-- RGW, Ingress, iSCSI, Oauth2-proxy, NFS & mgmt-gateway -->
-      @if (!serviceForm.controls.unmanaged.value && ['rgw', 'iscsi', 'ingress', 'oauth2-proxy',
-      'mgmt-gateway', 'nfs'].includes(serviceForm.controls.service_type.value)) {
-      <!-- ssl -->
-      @if (!['mgmt-gateway'].includes(serviceForm.controls.service_type.value)) {
-      <div class="form-item">
-        <cds-checkbox formControlName="ssl"
-                      name="security_label"
-                      id="ssl"
-                      i18n>SSL
-        </cds-checkbox>
-      </div>
-      }
+      @if (
+        !serviceForm.controls.unmanaged.value &&
+        ['rgw', 'iscsi', 'ingress', 'oauth2-proxy', 'mgmt-gateway', 'nfs'].includes(
+          serviceForm.controls.service_type.value
+        )
+      ) {
+        <!-- ssl -->
+        @if (!['mgmt-gateway'].includes(serviceForm.controls.service_type.value)) {
+          <div class="form-item">
+            <cds-checkbox
+              formControlName="ssl"
+              name="security_label"
+              id="ssl"
+              i18n
+              >SSL
+            </cds-checkbox>
+          </div>
+        }
 
-      <!-- Certificate Management UI -->
-      @if (serviceForm.controls.ssl.value && ['rgw', 'ingress', 'iscsi', 'grafana', 'oauth2-proxy', 'mgmt-gateway', 'nfs'].includes(serviceForm.controls.service_type.value)) {
-      <ng-container *ngTemplateOutlet="certificateAuthorityManagement"></ng-container>
-      }
+        <!-- Certificate Management UI -->
+        @if (
+          serviceForm.controls.ssl.value &&
+          ['rgw', 'ingress', 'iscsi', 'grafana', 'oauth2-proxy', 'mgmt-gateway', 'nfs'].includes(
+            serviceForm.controls.service_type.value
+          )
+        ) {
+          <ng-container *ngTemplateOutlet="certificateAuthorityManagement"></ng-container>
+        }
 
-      <!-- ssl_cert - Only show when SSL is enabled AND certificate type is external -->
-      @if (showExternalSslCert) {
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'ssl_cert', title: 'Certificate Input', helperText: 'Uploaded files will populate the certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a .crt file, or paste the certificate PEM content directly.', invalidTemplate: invalidSslCertError, isRequired: false }"></ng-container>
-        <ng-template #invalidSslCertError>
-          @if (serviceForm.showError('ssl_cert', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
+        <!-- ssl_cert - Only show when SSL is enabled AND certificate type is external -->
+        @if (showExternalSslCert) {
+          <div class="form-item">
+            <ng-container
+              *ngTemplateOutlet="
+                fileUploaderTextarea;
+                context: {
+                  controlName: 'ssl_cert',
+                  title: 'Certificate Input',
+                  helperText:
+                    'Uploaded files will populate the certificate details automatically. Or paste the PEM content directly in the text area.',
+                  description: 'Upload a .crt file, or paste the certificate PEM content directly.',
+                  invalidTemplate: invalidSslCertError,
+                  isRequired: false
+                }
+              "
+            ></ng-container>
+            <ng-template #invalidSslCertError>
+              @if (serviceForm.showError('ssl_cert', frm, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >This field is required.</span
+                >
+              }
+              @if (serviceForm.showError('ssl_cert', frm, 'pattern')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >Invalid SSL certificate.</span
+                >
+              }
+            </ng-template>
+          </div>
+        }
+        @if (showExternalSslKey) {
+          <div class="form-item">
+            <ng-container
+              *ngTemplateOutlet="
+                fileUploaderTextarea;
+                context: {
+                  controlName: 'ssl_key',
+                  title: 'Private Key Input',
+                  helperText:
+                    'Uploaded files will populate the private key details automatically. Or paste the PEM content directly in the text area.',
+                  description: 'Upload a .key file, or paste the private key PEM content directly.',
+                  invalidTemplate: invalidSslKeyError,
+                  isRequired: false
+                }
+              "
+            ></ng-container>
+            <ng-template #invalidSslKeyError>
+              @if (serviceForm.showError('ssl_key', frm, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >This field is required.</span
+                >
+              }
+              @if (serviceForm.showError('ssl_key', frm, 'pattern')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >Invalid SSL private key.</span
+                >
+              }
+            </ng-template>
+          </div>
+          <!-- ssl_ca_cert - Only show for NFS when SSL is enabled AND certificate type is external -->
+          @if (
+            serviceForm.controls.ssl.value &&
+            serviceForm.controls.certificateType.value === CertificateType.external &&
+            serviceForm.controls.service_type.value === 'nfs'
+          ) {
+            <div class="form-item">
+              <ng-container
+                *ngTemplateOutlet="
+                  fileUploaderTextarea;
+                  context: {
+                    controlName: 'ssl_ca_cert',
+                    title: 'CA Certificate Input',
+                    helperText:
+                      'Uploaded files will populate the CA certificate details automatically. Or paste the PEM content directly in the text area.',
+                    description:
+                      'Upload a CA certificate file, or paste the CA certificate PEM content directly.',
+                    invalidTemplate: invalidSslCaCertError,
+                    isRequired: false
+                  }
+                "
+              ></ng-container>
+              <ng-template #invalidSslCaCertError>
+                @if (serviceForm.showError('ssl_ca_cert', frm, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+                @if (serviceForm.showError('ssl_ca_cert', frm, 'pattern')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >Invalid CA certificate.</span
+                  >
+                }
+              </ng-template>
+            </div>
           }
-          @if (serviceForm.showError('ssl_cert', frm, 'pattern')) {
-          <span class="invalid-feedback"
-                i18n>Invalid SSL certificate.</span>
-          }
-        </ng-template>
-      </div>
-      }
-      @if (showExternalSslKey) {
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'ssl_key', title: 'Private Key Input', helperText: 'Uploaded files will populate the private key details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a .key file, or paste the private key PEM content directly.', invalidTemplate: invalidSslKeyError, isRequired: false }"></ng-container>
-        <ng-template #invalidSslKeyError>
-          @if (serviceForm.showError('ssl_key', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('ssl_key', frm, 'pattern')) {
-          <span class="invalid-feedback"
-                i18n>Invalid SSL private key.</span>
-          }
-        </ng-template>
-      </div>
-      <!-- ssl_ca_cert - Only show for NFS when SSL is enabled AND certificate type is external -->
-      @if (serviceForm.controls.ssl.value && serviceForm.controls.certificateType.value === CertificateType.external && serviceForm.controls.service_type.value === 'nfs') {
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'ssl_ca_cert', title: 'CA Certificate Input', helperText: 'Uploaded files will populate the CA certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a CA certificate file, or paste the CA certificate PEM content directly.', invalidTemplate: invalidSslCaCertError, isRequired: false }"></ng-container>
-        <ng-template #invalidSslCaCertError>
-          @if (serviceForm.showError('ssl_ca_cert', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('ssl_ca_cert', frm, 'pattern')) {
-          <span class="invalid-feedback"
-                i18n>Invalid CA certificate.</span>
-          }
-        </ng-template>
-      </div>
-      }
-      }
+        }
 
-      <!-- RGW QAT Compression -->
-      @if(serviceForm.controls.service_type.value === 'rgw') {
-        <div class="form-item"
-             formGroupName="qat">
-          <cds-select formControlName="compression"
-                      name="compression"
-                      label="QAT compression mode"
-                      id="compression"
-                      helperText="QAT compression is optional. Choose Hardware or Software to enable compression, or select None to disable it."
-                      i18n-helperText>
-            <option *ngFor="let option of qatCompressionOptions"
-                    [value]="option.value"
-                    i18n>{{ option.label }}</option>
-          </cds-select>
-        </div>
+        <!-- RGW QAT Compression -->
+        @if (serviceForm.controls.service_type.value === 'rgw') {
+          <div
+            class="form-item"
+            formGroupName="qat"
+          >
+            <cds-select
+              formControlName="compression"
+              name="compression"
+              label="QAT compression mode"
+              id="compression"
+              helperText="QAT compression is optional. Choose Hardware or Software to enable compression, or select None to disable it."
+              i18n-helperText
+            >
+              <option
+                *ngFor="let option of qatCompressionOptions"
+                [value]="option.value"
+                i18n
+              >
+                {{ option.label }}
+              </option>
+            </cds-select>
+          </div>
         }
       }
       <!-- Grafana -->
       @if (serviceForm.controls.service_type.value === 'grafana') {
-      <div class="form-item">
-        <cds-number label="Grafana port"
-                    i18n-label
-                    formControlName="grafana_port"
-                    id="grafana_port"
-                    min="1"
-                    max="65535"
-                    helperText="The default port used by grafana."
-                    i18n-helperText
-                    [invalid]="serviceForm.controls.grafana_port.invalid && serviceForm.controls.grafana_port.dirty"
-                    [invalidText]="invalidGrafanaPortError">
-        </cds-number>
-        <ng-template #invalidGrafanaPortError>
-          @if (serviceForm.showError('grafana_port', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-          @if (serviceForm.showError('grafana_port', frm, 'min')) {
-          <span class="invalid-feedback"
-                i18n>The value must be at least 1.</span>
-          }
-          @if (serviceForm.showError('grafana_port', frm, 'max')) {
-          <span class="invalid-feedback"
-                i18n>The value cannot exceed 65535.</span>
-          }
-        </ng-template>
-      </div>
-      <div class="form-item form-item-append">
-        <cds-password-label for="grafana_admin_password">
-          Grafana password
-          <input cdsPassword
-                 type="password"
-                 id="grafana_admin_password"
-                 formControlName="grafana_admin_password" />
-        </cds-password-label>
-        <cd-copy-2-clipboard-button source="grafana_admin_password"
-                                    class="mt-4">
-        </cd-copy-2-clipboard-button>
-      </div>
+        <div class="form-item">
+          <cds-number
+            label="Grafana port"
+            i18n-label
+            formControlName="grafana_port"
+            id="grafana_port"
+            min="1"
+            max="65535"
+            helperText="The default port used by grafana."
+            i18n-helperText
+            [invalid]="
+              serviceForm.controls.grafana_port.invalid && serviceForm.controls.grafana_port.dirty
+            "
+            [invalidText]="invalidGrafanaPortError"
+          >
+          </cds-number>
+          <ng-template #invalidGrafanaPortError>
+            @if (serviceForm.showError('grafana_port', frm, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (serviceForm.showError('grafana_port', frm, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value must be at least 1.</span
+              >
+            }
+            @if (serviceForm.showError('grafana_port', frm, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            }
+          </ng-template>
+        </div>
+        <div class="form-item form-item-append">
+          <cds-password-label for="grafana_admin_password">
+            Grafana password
+            <input
+              cdsPassword
+              type="password"
+              id="grafana_admin_password"
+              formControlName="grafana_admin_password"
+            />
+          </cds-password-label>
+          <cd-copy-2-clipboard-button
+            source="grafana_admin_password"
+            class="mt-4"
+          >
+          </cd-copy-2-clipboard-button>
+        </div>
       }
 
       @if (serviceForm.controls.service_type.value === 'mgmt-gateway' && showMgmtGatewayMessage) {
-      <cd-alert-panel type="warning"
-                      spacingClass="mb-3"
-                      i18n>
-        Modifying the default settings could lead to a weaker security configuration
-      </cd-alert-panel>
+        <cd-alert-panel
+          type="warning"
+          spacingClass="mb-3"
+          i18n
+        >
+          Modifying the default settings could lead to a weaker security configuration
+        </cd-alert-panel>
       }
 
       <!-- NVMe/TCP -->
       <!-- mTLS -->
       @if (serviceForm.controls.service_type.value === 'nvmeof') {
-      <div class="form-item">
-        <fieldset class="cds--fieldset">
-          <label class="cds--label"
-                 for="enable_mtls"
-                 i18n>Encryption</label>
-          <cds-checkbox i18n-label
-                        id="enable_mtls"
-                        formControlName="enable_mtls">
-            Enable
-            <cd-help-text i18n>
-              Enables mutual TLS (mTLS) between the client and the gateway server.
-            </cd-help-text>
-          </cds-checkbox>
-        </fieldset>
-      </div>
-      @if (serviceForm.controls.enable_mtls.value) {
-      <ng-container *ngTemplateOutlet="certificateAuthorityManagement"></ng-container>
+        <div class="form-item">
+          <fieldset class="cds--fieldset">
+            <label
+              class="cds--label"
+              for="enable_mtls"
+              i18n
+              >Encryption</label
+            >
+            <cds-checkbox
+              i18n-label
+              id="enable_mtls"
+              formControlName="enable_mtls"
+            >
+              Enable
+              <cd-help-text i18n>
+                Enables mutual TLS (mTLS) between the client and the gateway server.
+              </cd-help-text>
+            </cds-checkbox>
+          </fieldset>
+        </div>
+        @if (serviceForm.controls.enable_mtls.value) {
+          <ng-container *ngTemplateOutlet="certificateAuthorityManagement"></ng-container>
 
-      @if (serviceForm.controls.certificateType.value === CertificateType.external) {
-      <!-- root_ca_cert -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'root_ca_cert', title: 'Root CA Certificate Input', helperText: 'Uploaded files will populate the Root CA certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a Root CA certificate file, or paste the Root CA certificate PEM content directly.', invalidTemplate: invalidRootCaCertError, isRequired: true }"></ng-container>
-        <ng-template #invalidRootCaCertError>
-          @if (serviceForm.showError('root_ca_cert', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+          @if (serviceForm.controls.certificateType.value === CertificateType.external) {
+            <!-- root_ca_cert -->
+            <div class="form-item">
+              <ng-container
+                *ngTemplateOutlet="
+                  fileUploaderTextarea;
+                  context: {
+                    controlName: 'root_ca_cert',
+                    title: 'Root CA Certificate Input',
+                    helperText:
+                      'Uploaded files will populate the Root CA certificate details automatically. Or paste the PEM content directly in the text area.',
+                    description:
+                      'Upload a Root CA certificate file, or paste the Root CA certificate PEM content directly.',
+                    invalidTemplate: invalidRootCaCertError,
+                    isRequired: true
+                  }
+                "
+              ></ng-container>
+              <ng-template #invalidRootCaCertError>
+                @if (serviceForm.showError('root_ca_cert', frm, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+              </ng-template>
+            </div>
 
-      <!-- client_cert -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'client_cert', title: 'Client Certificate Input', helperText: 'Uploaded files will populate the client certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a client certificate file, or paste the client certificate PEM content directly.', invalidTemplate: invalidClientCertError, isRequired: true }"></ng-container>
-        <ng-template #invalidClientCertError>
-          @if (serviceForm.showError('client_cert', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+            <!-- client_cert -->
+            <div class="form-item">
+              <ng-container
+                *ngTemplateOutlet="
+                  fileUploaderTextarea;
+                  context: {
+                    controlName: 'client_cert',
+                    title: 'Client Certificate Input',
+                    helperText:
+                      'Uploaded files will populate the client certificate details automatically. Or paste the PEM content directly in the text area.',
+                    description:
+                      'Upload a client certificate file, or paste the client certificate PEM content directly.',
+                    invalidTemplate: invalidClientCertError,
+                    isRequired: true
+                  }
+                "
+              ></ng-container>
+              <ng-template #invalidClientCertError>
+                @if (serviceForm.showError('client_cert', frm, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+              </ng-template>
+            </div>
 
-      <!-- client_key -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'client_key', title: 'Client Key Input', helperText: 'Uploaded files will populate the client key details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a client key file, or paste the client key PEM content directly.', invalidTemplate: invalidClientKeyError, isRequired: true }"></ng-container>
-        <ng-template #invalidClientKeyError>
-          @if (serviceForm.showError('client_key', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+            <!-- client_key -->
+            <div class="form-item">
+              <ng-container
+                *ngTemplateOutlet="
+                  fileUploaderTextarea;
+                  context: {
+                    controlName: 'client_key',
+                    title: 'Client Key Input',
+                    helperText:
+                      'Uploaded files will populate the client key details automatically. Or paste the PEM content directly in the text area.',
+                    description:
+                      'Upload a client key file, or paste the client key PEM content directly.',
+                    invalidTemplate: invalidClientKeyError,
+                    isRequired: true
+                  }
+                "
+              ></ng-container>
+              <ng-template #invalidClientKeyError>
+                @if (serviceForm.showError('client_key', frm, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+              </ng-template>
+            </div>
 
-      <!-- server_cert -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'server_cert', title: 'Gateway Server Certificate Input', helperText: 'Uploaded files will populate the gateway server certificate details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a gateway server certificate file, or paste the certificate PEM content directly.', invalidTemplate: invalidServerCertError, isRequired: true }"></ng-container>
-        <ng-template #invalidServerCertError>
-          @if (serviceForm.showError('server_cert', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+            <!-- server_cert -->
+            <div class="form-item">
+              <ng-container
+                *ngTemplateOutlet="
+                  fileUploaderTextarea;
+                  context: {
+                    controlName: 'server_cert',
+                    title: 'Gateway Server Certificate Input',
+                    helperText:
+                      'Uploaded files will populate the gateway server certificate details automatically. Or paste the PEM content directly in the text area.',
+                    description:
+                      'Upload a gateway server certificate file, or paste the certificate PEM content directly.',
+                    invalidTemplate: invalidServerCertError,
+                    isRequired: true
+                  }
+                "
+              ></ng-container>
+              <ng-template #invalidServerCertError>
+                @if (serviceForm.showError('server_cert', frm, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+              </ng-template>
+            </div>
 
-      <!-- server_key -->
-      <div class="form-item">
-        <ng-container *ngTemplateOutlet="fileUploaderTextarea; context: { controlName: 'server_key', title: 'Gateway Server Key Input', helperText: 'Uploaded files will populate the gateway server key details automatically. Or paste the PEM content directly in the text area.', description: 'Upload a gateway server key file, or paste the key PEM content directly.', invalidTemplate: invalidServerKeyError, isRequired: true }"></ng-container>
-        <ng-template #invalidServerKeyError>
-          @if (serviceForm.showError('server_key', frm, 'required')) {
-          <span class="invalid-feedback"
-                i18n>This field is required.</span>
+            <!-- server_key -->
+            <div class="form-item">
+              <ng-container
+                *ngTemplateOutlet="
+                  fileUploaderTextarea;
+                  context: {
+                    controlName: 'server_key',
+                    title: 'Gateway Server Key Input',
+                    helperText:
+                      'Uploaded files will populate the gateway server key details automatically. Or paste the PEM content directly in the text area.',
+                    description:
+                      'Upload a gateway server key file, or paste the key PEM content directly.',
+                    invalidTemplate: invalidServerKeyError,
+                    isRequired: true
+                  }
+                "
+              ></ng-container>
+              <ng-template #invalidServerKeyError>
+                @if (serviceForm.showError('server_key', frm, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+              </ng-template>
+            </div>
           }
-        </ng-template>
-      </div>
-      }
-      }
+        }
       }
     </form>
   </section>
-  <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                        [form]="serviceForm"
-                        [submitText]="(action | titlecase) + ' ' + (resource)"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="onSubmit()"
+    [form]="serviceForm"
+    [submitText]="(action | titlecase) + ' ' + resource"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
 
 <ng-template #cipherListLink>
   <span>
-    Default cipher list used: <a href="https://ssl-config.mozilla.org/#server=nginx"
-                                 target="_blank">https://ssl-config.mozilla.org/#server=nginx</a>
+    Default cipher list used:
+    <a
+      href="https://ssl-config.mozilla.org/#server=nginx"
+      target="_blank"
+      >https://ssl-config.mozilla.org/#server=nginx</a
+    >
   </span>
 </ng-template>
 
 <ng-template #certificateAuthorityManagement>
   <div [formGroup]="serviceForm">
-  <!-- Current Certificate Section - Only shown in Edit mode when certificate exists -->
-  @if (editing && currentCertificate?.has_certificate) {
-  <div class="form-item">
-    <legend class="cds--label cds--type-heading-compact-01"
-           i18n>Current Certificate</legend>
-    <div class="row">
-      <div class="col-6">
-        <legend class="cds--label"
-               i18n>Certificate</legend>
-        <div>{{ currentCertificate.cert_name }}</div>
-      </div>
-      <div class="col-6">
-        <legend class="cds--label"
-               i18n>Valid Until</legend>
-        <div>{{ currentCertificate.expiry_date | cdDate }} • {{ currentCertificate.days_to_expiration }} <span i18n>days left</span></div>
-      </div>
-    </div>
-    <div class="row mt-3">
-      <div class="col-6">
-        <legend class="cds--label"
-               i18n>Status</legend>
-        <div class="align-items-center">
-          <cd-icon [type]="statusIconMap[currentCertificate.status] || statusIconMap['default']"></cd-icon>
-          @switch (currentCertificate.status) {
-            @case ('valid') { <span i18n>Valid</span> }
-            @case ('expiring') { <span i18n>Expiring soon</span> }
-            @case ('expired') { <span i18n>Expired</span> }
-            @case ('not_configured') { <span i18n>Not configured</span> }
-            @case ('invalid') { <span i18n>Invalid</span> }
-            @default { {{ currentCertificate.status }} }
-          }
-        </div>
-      </div>
-      <div class="col-6">
-        <legend class="cds--label"
-               i18n>Issuer</legend>
-        <div>
-          @if (currentCertificate.signed_by === 'cephadm') {
-          <span i18n>Internal (Cephadm CA)</span>
-          } @else {
-          {{ currentCertificate.issuer || 'External' }}
-          }
+    <!-- Current Certificate Section - Only shown in Edit mode when certificate exists -->
+    @if (editing && currentCertificate?.has_certificate) {
+      <div class="form-item">
+        <legend
+          class="cds--label cds--type-heading-compact-01"
+          i18n
+        >
+          Current Certificate
+        </legend>
+        <div class="row">
+          <div class="col-6">
+            <legend
+              class="cds--label"
+              i18n
+            >
+              Certificate
+            </legend>
+            <div>{{ currentCertificate.cert_name }}</div>
+          </div>
+          <div class="col-6">
+            <legend
+              class="cds--label"
+              i18n
+            >
+              Valid Until
+            </legend>
+            <div>
+              {{ currentCertificate.expiry_date | cdDate }} •
+              {{ currentCertificate.days_to_expiration }} <span i18n>days left</span>
+            </div>
+          </div>
+        </div>
+        <div class="row mt-3">
+          <div class="col-6">
+            <legend
+              class="cds--label"
+              i18n
+            >
+              Status
+            </legend>
+            <div class="align-items-center">
+              <cd-icon
+                [type]="statusIconMap[currentCertificate.status] || statusIconMap['default']"
+              ></cd-icon>
+              @switch (currentCertificate.status) {
+                @case ('valid') {
+                  <span i18n>Valid</span>
+                }
+                @case ('expiring') {
+                  <span i18n>Expiring soon</span>
+                }
+                @case ('expired') {
+                  <span i18n>Expired</span>
+                }
+                @case ('not_configured') {
+                  <span i18n>Not configured</span>
+                }
+                @case ('invalid') {
+                  <span i18n>Invalid</span>
+                }
+                @default {
+                  {{ currentCertificate.status }}
+                }
+              }
+            </div>
+          </div>
+          <div class="col-6">
+            <legend
+              class="cds--label"
+              i18n
+            >
+              Issuer
+            </legend>
+            <div>
+              @if (currentCertificate.signed_by === 'cephadm') {
+                <span i18n>Internal (Cephadm CA)</span>
+              } @else {
+                {{ currentCertificate.issuer || 'External' }}
+              }
+            </div>
+          </div>
         </div>
       </div>
+    }
+
+    <!-- Certificate Authority Selection -->
+    <div class="form-item">
+      <label
+        class="cds--label cds--type-heading-compact-01"
+        for="certificateType"
+        i18n
+        >Choose Certificate Authority</label
+      >
+      <cds-radio-group
+        formControlName="certificateType"
+        orientation="horizontal"
+        helperText="Select how certificates will be signed for this service. Choose internal to use the cluster's CA, or external to upload certificates signed by your organization."
+        i18n-helperText
+      >
+        <cds-radio
+          [value]="CertificateType.internal"
+          (change)="onCertificateTypeChange(CertificateType.internal)"
+          i18n
+        >
+          Internal
+        </cds-radio>
+        <cds-radio
+          [value]="CertificateType.external"
+          (change)="onCertificateTypeChange(CertificateType.external)"
+          i18n
+        >
+          External
+        </cds-radio>
+      </cds-radio-group>
     </div>
-  </div>
-  }
 
-  <!-- Certificate Authority Selection -->
-  <div class="form-item">
-    <label class="cds--label cds--type-heading-compact-01"
-           for="certificateType"
-           i18n>Choose Certificate Authority</label>
-    <cds-radio-group formControlName="certificateType"
-                     orientation="horizontal"
-                     helperText="Select how certificates will be signed for this service. Choose internal to use the cluster's CA, or external to upload certificates signed by your organization."
-                     i18n-helperText>
-      <cds-radio [value]="CertificateType.internal"
-                 (change)="onCertificateTypeChange(CertificateType.internal)"
-                 i18n>
-        Internal
-      </cds-radio>
-      <cds-radio [value]="CertificateType.external"
-                 (change)="onCertificateTypeChange(CertificateType.external)"
-                 i18n>
-        External
-      </cds-radio>
-    </cds-radio-group>
-  </div>
+    @if (showCertSourceChangeWarning) {
+      <cd-alert-panel
+        type="warning"
+        spacingClass="mb-3"
+        i18n
+      >
+        Changing the certificate source will redeploy the service daemons to apply the new
+        certificate configuration.
+      </cd-alert-panel>
+    }
 
-  @if (showCertSourceChangeWarning) {
-    <cd-alert-panel type="warning"
-                    spacingClass="mb-3"
-                    i18n>
-      Changing the certificate source will redeploy the service daemons to apply the new certificate configuration.
-    </cd-alert-panel>
-  }
-
-  @if (serviceForm.controls.certificateType.value === CertificateType.internal) {
-  <cd-alert-panel type="info"
-                  spacingClass="mb-3"
-                  i18n>
-    Certificate will be generated automatically by Cephadm CA for internal certificate type.
-  </cd-alert-panel>
-  <div class="form-item">
-    <cd-text-label-list formControlName="custom_sans"
-                        label="Custom SAN Entries"
-                        i18n-label
-                        helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
-                        i18n-helperText>
-    </cd-text-label-list>
-  </div>
-  @if (serviceForm.controls.service_type.value === 'rgw'
-       && serviceForm.controls.virtual_host_enabled.value) {
-  <div class="form-item">
-    <cds-checkbox i18n-label
-                  formControlName="wildcard_enabled">
-      Include wildcard certificate for bucket subdomains
-      <cd-help-text i18n>
-        Add wildcard certificates (*.domain) to allow SSL for all bucket subdomains. Required for virtual-host style with SSL.
-      </cd-help-text>
-    </cds-checkbox>
-  </div>
-  }
-  }
+    @if (serviceForm.controls.certificateType.value === CertificateType.internal) {
+      <cd-alert-panel
+        type="info"
+        spacingClass="mb-3"
+        i18n
+      >
+        Certificate will be generated automatically by Cephadm CA for internal certificate type.
+      </cd-alert-panel>
+      <div class="form-item">
+        <cd-text-label-list
+          formControlName="custom_sans"
+          label="Custom SAN Entries"
+          i18n-label
+          helperText="Optional list of Subject Alternative Names (hostnames, IPs, or DNS names) to include in the auto-generated certificate."
+          i18n-helperText
+        >
+        </cd-text-label-list>
+      </div>
+      @if (
+        serviceForm.controls.service_type.value === 'rgw' &&
+        serviceForm.controls.virtual_host_enabled.value
+      ) {
+        <div class="form-item">
+          <cds-checkbox
+            i18n-label
+            formControlName="wildcard_enabled"
+          >
+            Include wildcard certificate for bucket subdomains
+            <cd-help-text i18n>
+              Add wildcard certificates (*.domain) to allow SSL for all bucket subdomains. Required
+              for virtual-host style with SSL.
+            </cd-help-text>
+          </cds-checkbox>
+        </div>
+      }
+    }
   </div>
 </ng-template>
 
-<ng-template #fileUploaderTextarea
-             let-controlName="controlName"
-             let-title="title"
-             let-helperText="helperText"
-             let-description="description"
-             let-invalidTemplate="invalidTemplate"
-             let-isRequired="isRequired">
-  <cds-textarea-label [attr.cdRequiredField]="isRequired ? title : null"
-                      [helperText]="helperText"
-                      [invalid]="serviceForm.controls[controlName].invalid && serviceForm.controls[controlName].dirty"
-                      [invalidText]="invalidTemplate">
-    <cds-file-uploader [title]="title"
-                       buttonText="Upload File"
-                       i18n-buttonText
-                       buttonType="tertiary"
-                       [multiple]="false"
-                       size="md"
-                       [description]="description"
-                       (filesChange)="fileUpload($event, controlName)"
-                       (removeFile)="clearText()"></cds-file-uploader>
-    <textarea cdsTextArea
-              [id]="controlName"
-              [theme]="'dark'"
-              placeholder="Paste certificate or private key PEM content"
-              [formControl]="serviceForm.controls[controlName]"
-              cols="50"
-              rows="5"
-              [invalid]="serviceForm.controls[controlName].invalid && serviceForm.controls[controlName].dirty">
+<ng-template
+  #fileUploaderTextarea
+  let-controlName="controlName"
+  let-title="title"
+  let-helperText="helperText"
+  let-description="description"
+  let-invalidTemplate="invalidTemplate"
+  let-isRequired="isRequired"
+>
+  <cds-textarea-label
+    [attr.cdRequiredField]="isRequired ? title : null"
+    [helperText]="helperText"
+    [invalid]="serviceForm.controls[controlName].invalid && serviceForm.controls[controlName].dirty"
+    [invalidText]="invalidTemplate"
+  >
+    <cds-file-uploader
+      [title]="title"
+      buttonText="Upload File"
+      i18n-buttonText
+      buttonType="tertiary"
+      [multiple]="false"
+      size="md"
+      [description]="description"
+      (filesChange)="fileUpload($event, controlName)"
+      (removeFile)="clearText()"
+    ></cds-file-uploader>
+    <textarea
+      cdsTextArea
+      [id]="controlName"
+      [theme]="'dark'"
+      placeholder="Paste certificate or private key PEM content"
+      [formControl]="serviceForm.controls[controlName]"
+      cols="50"
+      rows="5"
+      [invalid]="
+        serviceForm.controls[controlName].invalid && serviceForm.controls[controlName].dirty
+      "
+    >
     </textarea>
   </cds-textarea-label>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/services.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/services.component.html
index a979e34e5d6..1176de61b08 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/services.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/services.component.html
@@ -1,78 +1,103 @@
 <cd-orchestrator-doc-panel *ngIf="showDocPanel"></cd-orchestrator-doc-panel>
 <ng-container *ngIf="orchStatus?.available">
-  <cd-table [data]="services"
-            [columns]="columns"
-            identifier="service_name"
-            forceIdentifier="true"
-            columnMode="flex"
-            selectionType="single"
-            [autoReload]="5000"
-            (fetchData)="getServices($event)"
-            [hasDetails]="hasDetails"
-            [serverSide]="true"
-            [count]="count"
-            updateExpandedOnRefresh="always"
-            (setExpandedRow)="setExpandedRow($event)"
-            (updateSelection)="updateSelection($event)">
-    <cd-table-actions class="table-actions"
-                      [permission]="permissions.hosts"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+  <cd-table
+    [data]="services"
+    [columns]="columns"
+    identifier="service_name"
+    forceIdentifier="true"
+    columnMode="flex"
+    selectionType="single"
+    [autoReload]="5000"
+    (fetchData)="getServices($event)"
+    [hasDetails]="hasDetails"
+    [serverSide]="true"
+    [count]="count"
+    updateExpandedOnRefresh="always"
+    (setExpandedRow)="setExpandedRow($event)"
+    (updateSelection)="updateSelection($event)"
+  >
+    <cd-table-actions
+      class="table-actions"
+      [permission]="permissions.hosts"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
-    <cd-service-details *cdTableDetail
-                        [permissions]="permissions"
-                        [selection]="expandedRow"
-                        (editService)="openModal(true, $event)">
+    <cd-service-details
+      *cdTableDetail
+      [permissions]="permissions"
+      [selection]="expandedRow"
+      (editService)="openModal(true, $event)"
+    >
     </cd-service-details>
   </cd-table>
 </ng-container>
 <router-outlet name="modal"></router-outlet>
 
-
-<ng-template #runningTpl
-             let-value="data.value">
+<ng-template
+  #runningTpl
+  let-value="data.value"
+>
   <span ngbTooltip="Service instances running out of the total number of services requested.">
     {{ value.running }} / {{ value.size }}
   </span>
-  <svg  *ngIf="value.running == 0 || value.size == 0"
-        [cdsIcon]="icons.warning"
-        [size]="icons.size16"
-        class="cds-warning-color"></svg>
+  <svg
+    *ngIf="value.running == 0 || value.size == 0"
+    [cdsIcon]="icons.warning"
+    [size]="icons.size16"
+    class="cds-warning-color"
+  ></svg>
 </ng-template>
 
-<ng-template #urlTpl
-             let-row="data.row">
-  <ng-container *ngIf="serviceUrls[row.service_type] else noUrl">
-    <a *ngIf="!isMgmtGateway else mgmtGateway"
-       target="_blank"
-       [href]="serviceUrls[row.service_type]">
+<ng-template
+  #urlTpl
+  let-row="data.row"
+>
+  <ng-container *ngIf="serviceUrls[row.service_type]; else noUrl">
+    <a
+      *ngIf="!isMgmtGateway; else mgmtGateway"
+      target="_blank"
+      [href]="serviceUrls[row.service_type]"
+    >
       {{ row.service_name }}
-      <svg [cdsIcon]="icons.launch"
-           [size]="icons.size16"
-           class="cds-info-color"></svg>
+      <svg
+        [cdsIcon]="icons.launch"
+        [size]="icons.size16"
+        class="cds-info-color"
+      ></svg>
     </a>
 
     <ng-template #mgmtGateway>
-      <a target="_blank"
-         [href]="row.service_type">
+      <a
+        target="_blank"
+        [href]="row.service_type"
+      >
         {{ row.service_name }}
-        <svg [cdsIcon]="icons.launch"
-             [size]="icons.size16"
-             class="cds-info-color"></svg>
+        <svg
+          [cdsIcon]="icons.launch"
+          [size]="icons.size16"
+          class="cds-info-color"
+        ></svg>
       </a>
     </ng-template>
   </ng-container>
-  <ng-template #noUrl>{{row.service_name}}</ng-template>
+  <ng-template #noUrl>{{ row.service_name }}</ng-template>
 </ng-template>
 
-<ng-template #certificateStatusTpl
-             let-row="data.row">
-@if (row.certificate?.requires_certificate && row.certificate?.status && row.certificate?.status !== 'not_configured') {
-  <span class="d-flex align-items-center gap-1">
-    <cd-icon [type]="statusIconMap[row.certificate.status] || statusIconMap['default']"></cd-icon>
-    {{ formatCertificateStatus(row.certificate) }}
-  </span>
-} @else {
-  -
-}
+<ng-template
+  #certificateStatusTpl
+  let-row="data.row"
+>
+  @if (
+    row.certificate?.requires_certificate &&
+    row.certificate?.status &&
+    row.certificate?.status !== 'not_configured'
+  ) {
+    <span class="d-flex align-items-center gap-1">
+      <cd-icon [type]="statusIconMap[row.certificate.status] || statusIconMap['default']"></cd-icon>
+      {{ formatCertificateStatus(row.certificate) }}
+    </span>
+  } @else {
+    -
+  }
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/telemetry/telemetry.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/telemetry/telemetry.component.html
index 92eb6021d48..05f239d50a4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/telemetry/telemetry.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/telemetry/telemetry.component.html
@@ -1,69 +1,101 @@
-<div class="cd-col-form"
-     *cdFormLoading="loading">
+<div
+  class="cd-col-form"
+  *cdFormLoading="loading"
+>
   <ng-container [ngSwitch]="step">
     <!-- Configuration step -->
     <div *ngSwitchCase="1">
-      <form name="form"
-            #formDir="ngForm"
-            [formGroup]="configForm"
-            novalidate>
+      <form
+        name="form"
+        #formDir="ngForm"
+        [formGroup]="configForm"
+        novalidate
+      >
         <div class="card">
-          <div class="card-header"
-               i18n>Step {{ step }} of 2: Telemetry report configuration</div>
+          <div
+            class="card-header"
+            i18n
+          >
+            Step {{ step }} of 2: Telemetry report configuration
+          </div>
           <div class="card-body">
-            <p i18n>The telemetry module sends anonymous data about this Ceph cluster back to the Ceph developers
-              to help understand how Ceph is used and what problems users may be experiencing.<br/>
-              This data is visualized on <a href="https://telemetry-public.ceph.com/">public dashboards</a>
-              that allow the community to quickly see summary statistics on how many clusters are reporting,
-              their total capacity and OSD count, and version distribution trends.<br/><br/>
-              The data being reported does <b>not</b> contain any sensitive data like pool names, object names, object contents,
-              hostnames, or device serial numbers. It contains counters and statistics on how the cluster has been
-              deployed, the version of Ceph, the distribution of the hosts and other parameters which help the project
-              to gain a better understanding of the way Ceph is used. The data is sent secured to {{ sendToUrl }} and
-              {{ sendToDeviceUrl }} (device report).</p>
+            <p i18n>
+              The telemetry module sends anonymous data about this Ceph cluster back to the Ceph
+              developers to help understand how Ceph is used and what problems users may be
+              experiencing.<br />
+              This data is visualized on
+              <a href="https://telemetry-public.ceph.com/">public dashboards</a> that allow the
+              community to quickly see summary statistics on how many clusters are reporting, their
+              total capacity and OSD count, and version distribution trends.<br /><br />
+              The data being reported does <b>not</b> contain any sensitive data like pool names,
+              object names, object contents, hostnames, or device serial numbers. It contains
+              counters and statistics on how the cluster has been deployed, the version of Ceph, the
+              distribution of the hosts and other parameters which help the project to gain a better
+              understanding of the way Ceph is used. The data is sent secured to {{ sendToUrl }} and
+              {{ sendToDeviceUrl }} (device report).
+            </p>
             <div *ngIf="moduleEnabled">
               The plugin is already <b>enabled</b>. Click <b>Deactivate</b> to disable it.&nbsp;
-              <button type="button"
-                      class="btn btn-light"
-                      (click)="disableModule('The Telemetry module has been disabled successfully.')"
-                      i18n>Deactivate</button>
+              <button
+                type="button"
+                class="btn btn-light"
+                (click)="disableModule('The Telemetry module has been disabled successfully.')"
+                i18n
+              >
+                Deactivate
+              </button>
             </div>
             <legend i18n>Channels</legend>
-            <p i18n>The telemetry report is broken down into several "channels", each with a different type of information that can
-              be configured below.</p>
+            <p i18n>
+              The telemetry report is broken down into several "channels", each with a different
+              type of information that can be configured below.
+            </p>
 
             <!-- Channel basic -->
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="channel_basic">
+              <label
+                class="cd-col-form-label"
+                for="channel_basic"
+              >
                 <ng-container i18n>Basic</ng-container>
                 <cd-helper>
                   <ng-container i18n>Includes basic information about the cluster:</ng-container>
                   <ul>
                     <li i18n>Capacity of the cluster</li>
-                    <li i18n>Number of monitors, managers, OSDs, MDSs, object gateways, or other daemons</li>
+                    <li i18n>
+                      Number of monitors, managers, OSDs, MDSs, object gateways, or other daemons
+                    </li>
                     <li i18n>Software version currently being used</li>
                     <li i18n>Number and types of RADOS pools and CephFS file systems</li>
-                    <li i18n>Names of configuration options that have been changed from their default (but not their values)</li>
+                    <li i18n>
+                      Names of configuration options that have been changed from their default (but
+                      not their values)
+                    </li>
                   </ul>
                 </cd-helper>
               </label>
               <div class="cd-col-form-input">
                 <div class="custom-control custom-checkbox">
-                  <input type="checkbox"
-                         class="custom-control-input"
-                         id="channel_basic"
-                         formControlName="channel_basic">
-                  <label class="custom-control-label"
-                         for="channel_basic"></label>
+                  <input
+                    type="checkbox"
+                    class="custom-control-input"
+                    id="channel_basic"
+                    formControlName="channel_basic"
+                  />
+                  <label
+                    class="custom-control-label"
+                    for="channel_basic"
+                  ></label>
                 </div>
               </div>
             </div>
 
             <!-- Channel crash -->
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="channel_crash">
+              <label
+                class="cd-col-form-label"
+                for="channel_crash"
+              >
                 <ng-container i18n>Crash</ng-container>
                 <cd-helper>
                   <ng-container i18n>Includes information about daemon crashes:</ng-container>
@@ -77,44 +109,60 @@
               </label>
               <div class="cd-col-form-input">
                 <div class="custom-control custom-checkbox">
-                  <input type="checkbox"
-                         class="custom-control-input"
-                         id="channel_crash"
-                         formControlName="channel_crash">
-                  <label class="custom-control-label"
-                         for="channel_crash"></label>
+                  <input
+                    type="checkbox"
+                    class="custom-control-input"
+                    id="channel_crash"
+                    formControlName="channel_crash"
+                  />
+                  <label
+                    class="custom-control-label"
+                    for="channel_crash"
+                  ></label>
                 </div>
               </div>
             </div>
 
             <!-- Channel device -->
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="channel_device">
+              <label
+                class="cd-col-form-label"
+                for="channel_device"
+              >
                 <ng-container i18n>Device</ng-container>
-                <cd-helper i18n-html
-                           html="Includes information about device metrics like anonymized SMART metrics.">
+                <cd-helper
+                  i18n-html
+                  html="Includes information about device metrics like anonymized SMART metrics."
+                >
                 </cd-helper>
               </label>
               <div class="cd-col-form-input">
                 <div class="custom-control custom-checkbox">
-                  <input type="checkbox"
-                         class="custom-control-input"
-                         id="channel_device"
-                         formControlName="channel_device">
-                  <label class="custom-control-label"
-                         for="channel_device"></label>
+                  <input
+                    type="checkbox"
+                    class="custom-control-input"
+                    id="channel_device"
+                    formControlName="channel_device"
+                  />
+                  <label
+                    class="custom-control-label"
+                    for="channel_device"
+                  ></label>
                 </div>
               </div>
             </div>
 
             <!-- Channel ident -->
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="channel_ident">
+              <label
+                class="cd-col-form-label"
+                for="channel_ident"
+              >
                 <ng-container i18n>Ident</ng-container>
                 <cd-helper>
-                  <ng-container i18n>Includes user-provided identifying information about the cluster:</ng-container>
+                  <ng-container i18n
+                    >Includes user-provided identifying information about the cluster:</ng-container
+                  >
                   <ul>
                     <li>Cluster description</li>
                     <li>Contact email address</li>
@@ -123,129 +171,181 @@
               </label>
               <div class="cd-col-form-input">
                 <div class="custom-control custom-checkbox">
-                  <input type="checkbox"
-                         class="custom-control-input"
-                         id="channel_ident"
-                         formControlName="channel_ident"
-                         (click)="toggleIdent()">
-                  <label class="custom-control-label"
-                         for="channel_ident"></label>
+                  <input
+                    type="checkbox"
+                    class="custom-control-input"
+                    id="channel_ident"
+                    formControlName="channel_ident"
+                    (click)="toggleIdent()"
+                  />
+                  <label
+                    class="custom-control-label"
+                    for="channel_ident"
+                  ></label>
                 </div>
               </div>
             </div>
 
             <!-- Channel perf -->
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="channel_perf">
+              <label
+                class="cd-col-form-label"
+                for="channel_perf"
+              >
                 <ng-container i18n>Perf</ng-container>
                 <cd-helper>
-                  <ng-container i18n>Includes various performance metrics of a cluster.</ng-container>
+                  <ng-container i18n
+                    >Includes various performance metrics of a cluster.</ng-container
+                  >
                 </cd-helper>
               </label>
               <div class="cd-col-form-input">
                 <div class="custom-control custom-checkbox">
-                  <input type="checkbox"
-                         class="custom-control-input"
-                         id="channel_perf"
-                         formControlName="channel_perf">
-                  <label class="custom-control-label"
-                         for="channel_perf"></label>
+                  <input
+                    type="checkbox"
+                    class="custom-control-input"
+                    id="channel_perf"
+                    formControlName="channel_perf"
+                  />
+                  <label
+                    class="custom-control-label"
+                    for="channel_perf"
+                  ></label>
                 </div>
               </div>
             </div>
 
             <ng-container *ngIf="showContactInfo">
-            <legend>
-              <ng-container i18n>Contact Information</ng-container>
-              <cd-helper i18n>Submitting any contact information is completely optional and disabled by default.</cd-helper>
-            </legend>
-            <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="contact"
-                     i18n>Contact</label>
-              <div class="cd-col-form-input">
-                <input id="contact"
-                       class="form-control"
-                       type="text"
-                       formControlName="contact"
-                       placeholder="Example User <user@example.com>">
+              <legend>
+                <ng-container i18n>Contact Information</ng-container>
+                <cd-helper i18n
+                  >Submitting any contact information is completely optional and disabled by
+                  default.</cd-helper
+                >
+              </legend>
+              <div class="form-group row">
+                <label
+                  class="cd-col-form-label"
+                  for="contact"
+                  i18n
+                  >Contact</label
+                >
+                <div class="cd-col-form-input">
+                  <input
+                    id="contact"
+                    class="form-control"
+                    type="text"
+                    formControlName="contact"
+                    placeholder="Example User <user@example.com>"
+                  />
+                </div>
               </div>
-            </div>
-            <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="description"
-                     i18n>Description</label>
-              <div class="cd-col-form-input">
-                <input id="description"
-                       class="form-control"
-                       type="text"
-                       formControlName="description"
-                       placeholder="My first Ceph cluster"
-                       i18n-placeholder>
+              <div class="form-group row">
+                <label
+                  class="cd-col-form-label"
+                  for="description"
+                  i18n
+                  >Description</label
+                >
+                <div class="cd-col-form-input">
+                  <input
+                    id="description"
+                    class="form-control"
+                    type="text"
+                    formControlName="description"
+                    placeholder="My first Ceph cluster"
+                    i18n-placeholder
+                  />
+                </div>
               </div>
-            </div>
-            <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="organization"
-                     i18n>Organization</label>
-              <div class="cd-col-form-input">
-                <input id="organization"
-                       class="form-control"
-                       type="text"
-                       formControlName="organization"
-                       placeholder="Organization name"
-                       i18n-placeholder>
+              <div class="form-group row">
+                <label
+                  class="cd-col-form-label"
+                  for="organization"
+                  i18n
+                  >Organization</label
+                >
+                <div class="cd-col-form-input">
+                  <input
+                    id="organization"
+                    class="form-control"
+                    type="text"
+                    formControlName="organization"
+                    placeholder="Organization name"
+                    i18n-placeholder
+                  />
+                </div>
               </div>
-            </div>
-          </ng-container>
+            </ng-container>
             <legend i18n>Advanced Settings</legend>
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="interval">
+              <label
+                class="cd-col-form-label"
+                for="interval"
+              >
                 <ng-container i18n>Interval</ng-container>
-                <cd-helper i18n>The module compiles and sends a new report every 24 hours by default. You can
-                  adjust this interval by setting a different number of hours.</cd-helper>
+                <cd-helper i18n
+                  >The module compiles and sends a new report every 24 hours by default. You can
+                  adjust this interval by setting a different number of hours.</cd-helper
+                >
               </label>
               <div class="cd-col-form-input">
-                <input id="interval"
-                       class="form-control"
-                       type="number"
-                       formControlName="interval"
-                       min="8">
-                <span class="invalid-feedback"
-                      *ngIf="configForm.showError('interval', formDir, 'min')"
-                      i18n>The entered value is too low! It must be greater or equal to 8.</span>
+                <input
+                  id="interval"
+                  class="form-control"
+                  type="number"
+                  formControlName="interval"
+                  min="8"
+                />
+                <span
+                  class="invalid-feedback"
+                  *ngIf="configForm.showError('interval', formDir, 'min')"
+                  i18n
+                  >The entered value is too low! It must be greater or equal to 8.</span
+                >
               </div>
             </div>
             <div class="form-group row">
-              <label class="cd-col-form-label"
-                     for="proxy">
+              <label
+                class="cd-col-form-label"
+                for="proxy"
+              >
                 <ng-container i18n>Proxy</ng-container>
                 <cd-helper>
-                  <p i18n>If the cluster cannot directly connect to the configured telemetry endpoint
-                    (default telemetry.ceph.com), you can configure a HTTP/HTTPS proxy server by e.g. adding
-                    https://10.0.0.1:8080</p>
-                  <p i18n>You can also include a user:pass if needed e.g. https://ceph:telemetry&#64;10.0.0.1:8080</p>
+                  <p i18n>
+                    If the cluster cannot directly connect to the configured telemetry endpoint
+                    (default telemetry.ceph.com), you can configure a HTTP/HTTPS proxy server by
+                    e.g. adding https://10.0.0.1:8080
+                  </p>
+                  <p i18n>
+                    You can also include a user:pass if needed e.g.
+                    https://ceph:telemetry&#64;10.0.0.1:8080
+                  </p>
                 </cd-helper>
               </label>
               <div class="cd-col-form-input">
-                <input id="proxy"
-                       class="form-control"
-                       type="text"
-                       formControlName="proxy"
-                       placeholder="https://10.0.0.1:8080">
+                <input
+                  id="proxy"
+                  class="form-control"
+                  type="text"
+                  formControlName="proxy"
+                  placeholder="https://10.0.0.1:8080"
+                />
               </div>
             </div>
             <br />
-            <p i18n><b>Note:</b> By clicking 'Next' you will first see a preview of the report content before you
-              can activate the automatic submission of your data.</p>
+            <p i18n>
+              <b>Note:</b> By clicking 'Next' you will first see a preview of the report content
+              before you can activate the automatic submission of your data.
+            </p>
           </div>
           <div class="card-footer">
             <div class="button-group text-right">
-              <button type="button"
-                      class="btn btn-light"
-                      (click)="next()">
+              <button
+                type="button"
+                class="btn btn-light"
+                (click)="next()"
+              >
                 <ng-container>{{ actionLabels.NEXT }}</ng-container>
               </button>
             </div>
@@ -256,59 +356,82 @@
 
     <!-- Preview step -->
     <div *ngSwitchCase="2">
-      <form name="previewForm"
-            #frm="ngForm"
-            [formGroup]="previewForm"
-            novalidate>
+      <form
+        name="previewForm"
+        #frm="ngForm"
+        [formGroup]="previewForm"
+        novalidate
+      >
         <div class="card">
-          <div class="card-header"
-               i18n>Step {{ step }} of 2: Telemetry report preview</div>
+          <div
+            class="card-header"
+            i18n
+          >
+            Step {{ step }} of 2: Telemetry report preview
+          </div>
           <div class="card-body">
             <!-- Telemetry report ID -->
             <div class="form-group row">
-              <label i18n
-                     for="reportId"
-                     class="cd-col-form-label">Report ID
-              <cd-helper i18n-html
-                         html="A randomized UUID to identify a particular cluster over the course of several telemetry reports.">
-              </cd-helper>
+              <label
+                i18n
+                for="reportId"
+                class="cd-col-form-label"
+                >Report ID
+                <cd-helper
+                  i18n-html
+                  html="A randomized UUID to identify a particular cluster over the course of several telemetry reports."
+                >
+                </cd-helper>
               </label>
               <div class="cd-col-form-input">
-                <input class="form-control"
-                       type="text"
-                       id="reportId"
-                       formControlName="reportId"
-                       readonly>
+                <input
+                  class="form-control"
+                  type="text"
+                  id="reportId"
+                  formControlName="reportId"
+                  readonly
+                />
               </div>
             </div>
 
             <!-- Telemetry report -->
             <div class="form-group row">
-              <label i18n
-                     for="report"
-                     class="cd-col-form-label">Report preview
-                <cd-helper i18n-html
-                           html="The actual telemetry data that will be submitted."><em>Note: Please select 'Download' to
-                                   view the full report, including metrics from the perf channel.</em>
+              <label
+                i18n
+                for="report"
+                class="cd-col-form-label"
+                >Report preview
+                <cd-helper
+                  i18n-html
+                  html="The actual telemetry data that will be submitted."
+                  ><em
+                    >Note: Please select 'Download' to view the full report, including metrics from
+                    the perf channel.</em
+                  >
                 </cd-helper>
               </label>
               <div class="cd-col-form-input">
-                <textarea class="form-control"
-                          id="report"
-                          formControlName="report"
-                          rows="15"
-                          readonly></textarea>
+                <textarea
+                  class="form-control"
+                  id="report"
+                  formControlName="report"
+                  rows="15"
+                  readonly
+                ></textarea>
               </div>
             </div>
             <div class="form-group row">
               <div class="cd-col-form-offset">
-                <div class="btn-group"
-                     role="group">
-                  <cd-download-button [objectItem]="report"
-                                      fileName="telemetry_report">
+                <div
+                  class="btn-group"
+                  role="group"
+                >
+                  <cd-download-button
+                    [objectItem]="report"
+                    fileName="telemetry_report"
+                  >
                   </cd-download-button>
-                  <cd-copy-2-clipboard-button source="report">
-                  </cd-copy-2-clipboard-button>
+                  <cd-copy-2-clipboard-button source="report"> </cd-copy-2-clipboard-button>
                 </div>
               </div>
             </div>
@@ -317,25 +440,35 @@
             <div class="form-group row">
               <div class="cd-col-form-offset">
                 <div class="custom-control custom-checkbox">
-                  <input type="checkbox"
-                         class="custom-control-input"
-                         id="licenseAgrmt"
-                         name="licenseAgrmt"
-                         formControlName="licenseAgrmt">
-                  <label class="custom-control-label"
-                         for="licenseAgrmt"
-                         i18n>I agree to my telemetry data being submitted under the <a href="https://cdla.io/sharing-1-0/">Community Data License Agreement - Sharing - Version 1.0</a></label>
+                  <input
+                    type="checkbox"
+                    class="custom-control-input"
+                    id="licenseAgrmt"
+                    name="licenseAgrmt"
+                    formControlName="licenseAgrmt"
+                  />
+                  <label
+                    class="custom-control-label"
+                    for="licenseAgrmt"
+                    i18n
+                    >I agree to my telemetry data being submitted under the
+                    <a href="https://cdla.io/sharing-1-0/"
+                      >Community Data License Agreement - Sharing - Version 1.0</a
+                    ></label
+                  >
                 </div>
               </div>
             </div>
           </div>
           <div class="card-footer">
             <div class="button-group text-right">
-              <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                                    (backActionEvent)="back()"
-                                    [form]="previewForm"
-                                    [submitText]="actionLabels.UPDATE"
-                                    [cancelText]="actionLabels.BACK"></cd-form-button-panel>
+              <cd-form-button-panel
+                (submitActionEvent)="onSubmit()"
+                (backActionEvent)="back()"
+                [form]="previewForm"
+                [submitText]="actionLabels.UPDATE"
+                [cancelText]="actionLabels.BACK"
+              ></cd-form-button-panel>
             </div>
           </div>
         </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-form/upgrade-start-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-form/upgrade-start-modal.component.html
index aa8ab7e0ba1..72e32ac8227 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-form/upgrade-start-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-form/upgrade-start-modal.component.html
@@ -4,85 +4,136 @@
   </ng-container>
 
   <ng-container class="modal-content">
-    <form name="upgradeForm"
-          class="form"
-          #formDir="ngForm"
-          [formGroup]="upgradeForm"
-          novalidate>
+    <form
+      name="upgradeForm"
+      class="form"
+      #formDir="ngForm"
+      [formGroup]="upgradeForm"
+      novalidate
+    >
       <div class="modal-body">
-        <cd-alert-panel type="warning"
-                        spacingClass="mb-3"
-                        *ngIf="showImageField"
-                        i18n>Make sure to put the correct image. Passing an incorrect image can lead the cluster into an undesired state.</cd-alert-panel>
-        <div *ngIf="versions"
-             class="form-group row">
-          <label class="cd-col-form-label"
-                 [ngClass]="{'required': !showImageField}"
-                 for="availableVersions"
-                 i18n>New Version</label>
+        <cd-alert-panel
+          type="warning"
+          spacingClass="mb-3"
+          *ngIf="showImageField"
+          i18n
+          >Make sure to put the correct image. Passing an incorrect image can lead the cluster into
+          an undesired state.</cd-alert-panel
+        >
+        <div
+          *ngIf="versions"
+          class="form-group row"
+        >
+          <label
+            class="cd-col-form-label"
+            [ngClass]="{ required: !showImageField }"
+            for="availableVersions"
+            i18n
+            >New Version</label
+          >
           <div class="cd-col-form-input">
-            <select id="availableVersions"
-                    name="availableVersions"
-                    class="form-select"
-                    formControlName="availableVersions">
-              <option *ngIf="versions === null"
-                      ngValue="null"
-                      i18n>Loading...</option>
-              <option *ngIf="versions !== null && versions.length === 0"
-                      [ngValue]="null"
-                      i18n>-- No version available --</option>
-              <option *ngIf="versions !== null && versions.length > 0"
-                      [ngValue]="null"
-                      i18n>-- Select a version --</option>
-              <option *ngFor="let version of versions"
-                      [value]="version">{{ version }}</option>
+            <select
+              id="availableVersions"
+              name="availableVersions"
+              class="form-select"
+              formControlName="availableVersions"
+            >
+              <option
+                *ngIf="versions === null"
+                ngValue="null"
+                i18n
+              >
+                Loading...
+              </option>
+              <option
+                *ngIf="versions !== null && versions.length === 0"
+                [ngValue]="null"
+                i18n
+              >
+                -- No version available --
+              </option>
+              <option
+                *ngIf="versions !== null && versions.length > 0"
+                [ngValue]="null"
+                i18n
+              >
+                -- Select a version --
+              </option>
+              <option
+                *ngFor="let version of versions"
+                [value]="version"
+              >
+                {{ version }}
+              </option>
             </select>
-            <span class="invalid-feedback"
-                  *ngIf="upgradeForm.showError('availableVersions', formDir, 'required')"
-                  i18n>This field is required!</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="upgradeForm.showError('availableVersions', formDir, 'required')"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
 
-        <div *ngIf="versions"
-             class="form-group row">
+        <div
+          *ngIf="versions"
+          class="form-group row"
+        >
           <div class="cd-col-form-offset">
             <div class="custom-control custom-checkbox">
-              <input type="checkbox"
-                     class="custom-control-input"
-                     id="useImage"
-                     name="useImage"
-                     formControlName="useImage"
-                     (click)="useImage()">
-              <label class="custom-control-label"
-                     for="useImage"
-                     i18n>Use image</label>
+              <input
+                type="checkbox"
+                class="custom-control-input"
+                id="useImage"
+                name="useImage"
+                formControlName="useImage"
+                (click)="useImage()"
+              />
+              <label
+                class="custom-control-label"
+                for="useImage"
+                i18n
+                >Use image</label
+              >
             </div>
           </div>
         </div>
 
         <!-- Custom image name input-->
-        <div class="form-group row"
-             *ngIf="showImageField || !versions">
-          <label class="cd-col-form-label required"
-                 for="customImageName"
-                 i18n>Image</label>
+        <div
+          class="form-group row"
+          *ngIf="showImageField || !versions"
+        >
+          <label
+            class="cd-col-form-label required"
+            for="customImageName"
+            i18n
+            >Image</label
+          >
           <div class="cd-col-form-input">
-            <input type="text"
-                   class="form-control"
-                   id="customImageName"
-                   name="customImageName"
-                   formControlName="customImageName">
-            <span class="invalid-feedback"
-                  *ngIf="upgradeForm.showError('customImageName', formDir, 'required')"
-                  i18n>This field is required!</span>
+            <input
+              type="text"
+              class="form-control"
+              id="customImageName"
+              name="customImageName"
+              formControlName="customImageName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="upgradeForm.showError('customImageName', formDir, 'required')"
+              i18n
+              >This field is required!</span
+            >
           </div>
         </div>
       </div>
 
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="startUpgrade()"
-                              [form]="upgradeForm"
-                              [submitText]="actionLabels.START_UPGRADE"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="startUpgrade()"
+          [form]="upgradeForm"
+          [submitText]="actionLabels.START_UPGRADE"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html
index 5df12a3f307..c66965fa089 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade-progress/upgrade-progress.component.html
@@ -1,50 +1,73 @@
 <div *ngIf="upgradeStatus$ | async as upgradeStatus">
   <ng-container>
-    <cd-progress [value]="executingTask?.progress"
-                 [label]="executingTask?.description"
-                 [status]="upgradeStatus.in_progress ? 'in-progress' : 'paused'"
-                 [subLabel]="upgradeStatus.which"
-                 [completedItems]="upgradeStatus.services_complete"
-                 [actionName]="'upgrading'"
-                 [helperText]="upgradeStatus.progress"
-                 [footerText]="upgradeStatus.message"
-                 [isPaused]="upgradeStatus.is_paused">
+    <cd-progress
+      [value]="executingTask?.progress"
+      [label]="executingTask?.description"
+      [status]="upgradeStatus.in_progress ? 'in-progress' : 'paused'"
+      [subLabel]="upgradeStatus.which"
+      [completedItems]="upgradeStatus.services_complete"
+      [actionName]="'upgrading'"
+      [helperText]="upgradeStatus.progress"
+      [footerText]="upgradeStatus.message"
+      [isPaused]="upgradeStatus.is_paused"
+    >
     </cd-progress>
 
     <div class="text-center mt-3">
-      <button class="btn btn-light"
-              aria-label="Go back"
-              routerLink="/upgrade"
-              type="button"
-              i18n>Back</button>
-      <button *ngIf="upgradeStatus.in_progress && !upgradeStatus.is_paused"
-              (click)="pauseUpgrade()"
-              class="btn btn-light m-2"
-              aria-label="Pause Upgrade"
-              type="button"
-              i18n>Pause</button>
-      <button *ngIf="upgradeStatus.in_progress && upgradeStatus.is_paused"
-              (click)="resumeUpgrade()"
-              class="btn btn-light m-2"
-              aria-label="Resume Upgrade"
-              type="button"
-              i18n>Resume</button>
-      <button *ngIf="upgradeStatus.in_progress"
-              (click)="stopUpgradeModal()"
-              class="btn btn-danger"
-              aria-label="Stop Upgrade"
-              type="button"
-              i18n>Stop</button>
+      <button
+        class="btn btn-light"
+        aria-label="Go back"
+        routerLink="/upgrade"
+        type="button"
+        i18n
+      >
+        Back
+      </button>
+      <button
+        *ngIf="upgradeStatus.in_progress && !upgradeStatus.is_paused"
+        (click)="pauseUpgrade()"
+        class="btn btn-light m-2"
+        aria-label="Pause Upgrade"
+        type="button"
+        i18n
+      >
+        Pause
+      </button>
+      <button
+        *ngIf="upgradeStatus.in_progress && upgradeStatus.is_paused"
+        (click)="resumeUpgrade()"
+        class="btn btn-light m-2"
+        aria-label="Resume Upgrade"
+        type="button"
+        i18n
+      >
+        Resume
+      </button>
+      <button
+        *ngIf="upgradeStatus.in_progress"
+        (click)="stopUpgradeModal()"
+        class="btn btn-danger"
+        aria-label="Stop Upgrade"
+        type="button"
+        i18n
+      >
+        Stop
+      </button>
     </div>
   </ng-container>
 </div>
 
-<legend class="cd-header"
-        i18n>Cluster logs</legend>
-  <cd-logs [showAuditLogs]="false"
-           [showDaemonLogs]="false"
-           [showNavLinks]="false"
-           [showFilterTools]="false"
-           [showDownloadCopyButton]="false"
-           defaultTab="cluster-logs"
-           ></cd-logs>
+<legend
+  class="cd-header"
+  i18n
+>
+  Cluster logs
+</legend>
+<cd-logs
+  [showAuditLogs]="false"
+  [showDaemonLogs]="false"
+  [showNavLinks]="false"
+  [showFilterTools]="false"
+  [showDownloadCopyButton]="false"
+  defaultTab="cluster-logs"
+></cd-logs>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html
index aa037706538..75f9dd58309 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.html
@@ -1,107 +1,163 @@
-<main *cdScope="'configOpt'"
-      cdsGrid
-      [fullWidth]="true"
-      [narrow]="true"
-      class="cds-mt-5">
+<main
+  *cdScope="'configOpt'"
+  cdsGrid
+  [fullWidth]="true"
+  [narrow]="true"
+  class="cds-mt-5"
+>
   <ng-container *ngIf="healthData$ | async as healthData">
-    <div cdsRow
-         class="cds-mb-5">
-      <div cdsCol
-           [columnNumbers]="{lg: 16}">
-        <cds-tile aria-label="Cluster Information"
-                  i18n-aria-label>
-          <h4 class="cds--type-heading-03 tile-title"
-              i18n>Cluster Information</h4>
+    <div
+      cdsRow
+      class="cds-mb-5"
+    >
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 16 }"
+      >
+        <cds-tile
+          aria-label="Cluster Information"
+          i18n-aria-label
+        >
+          <h4
+            class="cds--type-heading-03 tile-title"
+            i18n
+          >
+            Cluster Information
+          </h4>
           <div class="details-grid">
             <!-- Current Version -->
             <div class="detail-item">
-              <span class="cds--type-label-01"
-                    i18n>Current Version</span>
+              <span
+                class="cds--type-label-01"
+                i18n
+                >Current Version</span
+              >
               <span class="cds--type-body-compact-01">{{ version }}</span>
             </div>
 
             <!-- New Version / Upgrade Status -->
-            <div class="detail-item"
-                 *ngIf="upgradeStatus$ | async as status"
-                 id="newVersionAvailable">
-              <span class="cds--type-label-01"
-                    i18n>New Version</span>
+            <div
+              class="detail-item"
+              *ngIf="upgradeStatus$ | async as status"
+              id="newVersionAvailable"
+            >
+              <span
+                class="cds--type-label-01"
+                i18n
+                >New Version</span
+              >
               <ng-container *ngIf="status.in_progress; else upgradeStatusTpl">
-                <div cdsStack
-                     orientation="vertical"
-                     gap="2">
-                  <span class="cds--type-body-compact-01"
-                        i18n
-                        *ngIf="status.is_paused; else inProgress">
+                <div
+                  cdsStack
+                  orientation="vertical"
+                  gap="2"
+                >
+                  <span
+                    class="cds--type-body-compact-01"
+                    i18n
+                    *ngIf="status.is_paused; else inProgress"
+                  >
                     <cds-inline-loading></cds-inline-loading>
-                    Upgrade is paused {{executingTasks?.progress}}%</span>
-                  <a class="cds--link"
-                     routerLink="/upgrade/progress"
-                     i18n>View Details...</a>
+                    Upgrade is paused {{ executingTasks?.progress }}%</span
+                  >
+                  <a
+                    class="cds--link"
+                    routerLink="/upgrade/progress"
+                    i18n
+                    >View Details...</a
+                  >
                 </div>
 
                 <ng-template #inProgress>
-                  <span class="cds--type-body-compact-01"
-                        i18n>
+                  <span
+                    class="cds--type-body-compact-01"
+                    i18n
+                  >
                     <cds-inline-loading></cds-inline-loading>
-                    Upgrading {{executingTasks?.progress}}%
+                    Upgrading {{ executingTasks?.progress }}%
                   </span>
                 </ng-template>
               </ng-container>
             </div>
 
             <!-- Cluster Status -->
-            <div class="detail-item"
-                 id="clusterStatus">
-              <span class="cds--type-label-01"
-                    i18n>Cluster Status</span>
+            <div
+              class="detail-item"
+              id="clusterStatus"
+            >
+              <span
+                class="cds--type-label-01"
+                i18n
+                >Cluster Status</span
+              >
               <ng-container *ngIf="healthData.health?.status !== 'HEALTH_OK'; else healthOk">
-                <a class="cds--link cds--type-body-compact-01"
-                   routerLink="/overview"
-                   [ngStyle]="healthData.health.status | healthColor">
+                <a
+                  class="cds--link cds--type-body-compact-01"
+                  routerLink="/overview"
+                  [ngStyle]="healthData.health.status | healthColor"
+                >
                   {{ healthData.health.status | healthLabel | titlecase }}
                   <cd-icon type="warning"></cd-icon>
                 </a>
               </ng-container>
               <ng-template #healthOk>
-                <span class="cds--type-body-compact-01"
-                      [ngStyle]="healthData.health.status | healthColor">
+                <span
+                  class="cds--type-body-compact-01"
+                  [ngStyle]="healthData.health.status | healthColor"
+                >
                   {{ healthData.health.status | healthLabel | titlecase }}
                 </span>
               </ng-template>
             </div>
 
             <!-- MGR Count -->
-            <div class="detail-item"
-                 id="mgrCount">
-              <span class="cds--type-label-01"
-                    i18n>MGR Count</span>
+            <div
+              class="detail-item"
+              id="mgrCount"
+            >
+              <span
+                class="cds--type-label-01"
+                i18n
+                >MGR Count</span
+              >
               <span class="cds--type-body-compact-01">
-                <cd-icon type="success"
-                         *ngIf="(healthData.mgr_map | mgrSummary)?.total > 1; else warningIcon">
+                <cd-icon
+                  type="success"
+                  *ngIf="(healthData.mgr_map | mgrSummary)?.total > 1; else warningIcon"
+                >
                 </cd-icon>
                 {{ (healthData.mgr_map | mgrSummary)?.total }}
               </span>
             </div>
 
             <!-- Cluster FSID -->
-            <div class="detail-item"
-                 *ngIf="fsid$ | async as fsid">
-              <span class="cds--type-label-01"
-                    i18n>Cluster FSID</span>
+            <div
+              class="detail-item"
+              *ngIf="fsid$ | async as fsid"
+            >
+              <span
+                class="cds--type-label-01"
+                i18n
+                >Cluster FSID</span
+              >
               <span class="cds--type-body-compact-01">{{ fsid }}</span>
             </div>
 
             <!-- Release Image -->
             <div class="detail-item">
-              <span class="cds--type-label-01"
-                    i18n>Release Image</span>
+              <span
+                class="cds--type-label-01"
+                i18n
+                >Release Image</span
+              >
               <ng-container *ngIf="info$ | async as info; else releaseImageError">
                 <span class="cds--type-body-compact-01">{{ info.image }}</span>
               </ng-container>
               <ng-template #releaseImageError>
-                <span class="cds--type-body-compact-01"
-                      *ngIf="!errorMessage; else showError">
+                <span
+                  class="cds--type-body-compact-01"
+                  *ngIf="!errorMessage; else showError"
+                >
                   <cds-inline-loading></cds-inline-loading>
                   <span i18n>Loading...</span>
                 </span>
@@ -116,14 +172,19 @@
 
             <!-- Registry -->
             <div class="detail-item">
-              <span class="cds--type-label-01"
-                    i18n>Registry</span>
+              <span
+                class="cds--type-label-01"
+                i18n
+                >Registry</span
+              >
               <ng-container *ngIf="info$ | async as info; else registryError">
                 <span class="cds--type-body-compact-01">{{ info.registry }}</span>
               </ng-container>
               <ng-template #registryError>
-                <span class="cds--type-body-compact-01"
-                      *ngIf="!errorMessage; else showRegistryError">
+                <span
+                  class="cds--type-body-compact-01"
+                  *ngIf="!errorMessage; else showRegistryError"
+                >
                   <cds-inline-loading></cds-inline-loading>
                   <span i18n>Loading...</span>
                 </span>
@@ -140,66 +201,101 @@
       </div>
     </div>
 
-    <div cdsRow
-         class="cds-mb-5">
-      <div cdsCol
-           [columnNumbers]="{lg: 16}">
+    <div
+      cdsRow
+      class="cds-mb-5"
+    >
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 16 }"
+      >
         <cds-tile *ngIf="daemons$ | async as daemons">
-          <h4 class="cds--type-heading-03 tile-title"
-              i18n>Daemon Versions</h4>
+          <h4
+            class="cds--type-heading-03 tile-title"
+            i18n
+          >
+            Daemon Versions
+          </h4>
           <div>
-            <cd-table #daemonsTable
-                      [data]="daemons"
-                      selectionType="single"
-                      [columns]="columns"
-                      columnMode="flex"
-                      [limit]="5">
+            <cd-table
+              #daemonsTable
+              [data]="daemons"
+              selectionType="single"
+              [columns]="columns"
+              columnMode="flex"
+              [limit]="5"
+            >
             </cd-table>
           </div>
         </cds-tile>
       </div>
     </div>
 
-    <div cdsRow
-         class="cds-mb-5">
-      <div cdsCol
-           [columnNumbers]="{lg: 16}">
+    <div
+      cdsRow
+      class="cds-mb-5"
+    >
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 16 }"
+      >
         <cds-tile>
-          <h4 class="cds--type-heading-03 tile-title"
-              i18n>Cluster Logs</h4>
-          <cd-logs [showAuditLogs]="false"
-                   [showDaemonLogs]="false"
-                   [showNavLinks]="false"
-                   [showFilterTools]="false"
-                   [showDownloadCopyButton]="false"
-                   defaultTab="cluster-logs"></cd-logs>
+          <h4
+            class="cds--type-heading-03 tile-title"
+            i18n
+          >
+            Cluster Logs
+          </h4>
+          <cd-logs
+            [showAuditLogs]="false"
+            [showDaemonLogs]="false"
+            [showNavLinks]="false"
+            [showFilterTools]="false"
+            [showDownloadCopyButton]="false"
+            defaultTab="cluster-logs"
+          ></cd-logs>
         </cds-tile>
       </div>
     </div>
 
     <ng-template #upgradeStatusTpl>
-      <div cdsStack
-           orientation="vertical"
-           gap="4"
-           class="cds-mt-3"
-           *ngIf="info$ | async as info; else checkingForUpgradeStatus">
+      <div
+        cdsStack
+        orientation="vertical"
+        gap="4"
+        class="cds-mt-3"
+        *ngIf="info$ | async as info; else checkingForUpgradeStatus"
+      >
         <ng-container *ngIf="info.versions.length > 0; else noUpgradesAvailable">
-          <div [cdsTip]="(healthData.mgr_map | mgrSummary)?.total <= 1 ? 'To upgrade, you need minimum 2 mgr daemons.' : ''"
-               i18n-cdsTip>
-            <button cdsButton="primary"
-                    class="cds-mt-3"
-                    id="upgrade"
-                    aria-label="Upgrade now"
-                    (click)="upgradeNow(info.versions[info.versions.length - 1])"
-                    [disabled]="(healthData.mgr_map | mgrSummary)?.total <= 1"
-                    type="button"
-                    i18n>Upgrade to {{ info.versions[info.versions.length - 1] }}</button>
+          <div
+            [cdsTip]="
+              (healthData.mgr_map | mgrSummary)?.total <= 1
+                ? 'To upgrade, you need minimum 2 mgr daemons.'
+                : ''
+            "
+            i18n-cdsTip
+          >
+            <button
+              cdsButton="primary"
+              class="cds-mt-3"
+              id="upgrade"
+              aria-label="Upgrade now"
+              (click)="upgradeNow(info.versions[info.versions.length - 1])"
+              [disabled]="(healthData.mgr_map | mgrSummary)?.total <= 1"
+              type="button"
+              i18n
+            >
+              Upgrade to {{ info.versions[info.versions.length - 1] }}
+            </button>
           </div>
-          <a class="cds--link cds-mb-3"
-             (click)="startUpgradeModal()"
-             tabindex="0"
-             (keydown.enter)="startUpgradeModal()"
-             i18n>Select another version...</a>
+          <a
+            class="cds--link cds-mb-3"
+            (click)="startUpgradeModal()"
+            tabindex="0"
+            (keydown.enter)="startUpgradeModal()"
+            i18n
+            >Select another version...</a
+          >
         </ng-container>
       </div>
     </ng-template>
@@ -207,83 +303,114 @@
 </main>
 
 <ng-template #noUpgradesAvailable>
-  <span class="cds--type-body-compact-01"
-        id="no-upgrades-available"
-        i18n>
+  <span
+    class="cds--type-body-compact-01"
+    id="no-upgrades-available"
+    i18n
+  >
     <cd-icon type="success"></cd-icon>
     Cluster is up-to-date
   </span>
-  <a class="cds--link cds-mb-3"
-     (click)="startUpgradeModal()"
-     tabindex="0"
-     (keydown.enter)="startUpgradeModal()"
-     i18n>Upgrade using custom image...</a>
+  <a
+    class="cds--link cds-mb-3"
+    (click)="startUpgradeModal()"
+    tabindex="0"
+    (keydown.enter)="startUpgradeModal()"
+    i18n
+    >Upgrade using custom image...</a
+  >
 </ng-template>
 
 <ng-template #warningIcon>
-  <cd-icon type="warning"
-           title="To upgrade, you need minimum 2 mgr daemons.">
+  <cd-icon
+    type="warning"
+    title="To upgrade, you need minimum 2 mgr daemons."
+  >
   </cd-icon>
 </ng-template>
 
 <ng-template #checkingForUpgradeStatus>
-  <div cdsStack
-       orientation="vertical"
-       gap="4"
-       class="cds-mt-3"
-       *ngIf="!errorMessage; else upgradeStatusError">
-    <button cdsButton="primary"
-            class="cds-mt-3 cds-mb-5"
-            id="upgrade"
-            aria-label="Upgrade now"
-            [disabled]="true"
-            type="button"
-            i18n>Checking for upgrades
+  <div
+    cdsStack
+    orientation="vertical"
+    gap="4"
+    class="cds-mt-3"
+    *ngIf="!errorMessage; else upgradeStatusError"
+  >
+    <button
+      cdsButton="primary"
+      class="cds-mt-3 cds-mb-5"
+      id="upgrade"
+      aria-label="Upgrade now"
+      [disabled]="true"
+      type="button"
+      i18n
+    >
+      Checking for upgrades
       <cds-inline-loading></cds-inline-loading>
     </button>
   </div>
 </ng-template>
 
 <ng-template #loadingDetails>
-  <div class="w-50"
-       *ngIf="!errorMessage; else upgradeInfoError">
-    <span class="text-info justify-content-center align-items-center"
-          i18n>Fetching registry information
+  <div
+    class="w-50"
+    *ngIf="!errorMessage; else upgradeInfoError"
+  >
+    <span
+      class="text-info justify-content-center align-items-center"
+      i18n
+      >Fetching registry information
       <cds-inline-loading></cds-inline-loading>
     </span>
   </div>
 </ng-template>
 
 <ng-template #upgradeStatusError>
-  <div cdsStack
-       orientation="vertical"
-       gap="4"
-       class="cds-mt-3 cds-mb-5">
-    <span class="cds--type-body-compact-01"
-          id="upgrade-status-error"
-          i18n>
+  <div
+    cdsStack
+    orientation="vertical"
+    gap="4"
+    class="cds-mt-3 cds-mb-5"
+  >
+    <span
+      class="cds--type-body-compact-01"
+      id="upgrade-status-error"
+      i18n
+    >
       <cd-icon type="danger"></cd-icon>
       {{ errorMessage }}
     </span>
-    <a class="cds--link cds-mb-3"
-       (click)="startUpgradeModal()"
-       tabindex="0"
-       (keydown.enter)="startUpgradeModal()"
-       i18n>Upgrade using custom image...</a>
+    <a
+      class="cds--link cds-mb-3"
+      (click)="startUpgradeModal()"
+      tabindex="0"
+      (keydown.enter)="startUpgradeModal()"
+      i18n
+      >Upgrade using custom image...</a
+    >
   </div>
 </ng-template>
 
 <ng-template #upgradeProgress>
-  <div cdsStack
-       orientation="vertical"
-       gap="4"
-       class="cds-mt-3">
-    <h5 class="cds--type-heading-compact-01"
-        i18n>
+  <div
+    cdsStack
+    orientation="vertical"
+    gap="4"
+    class="cds-mt-3"
+  >
+    <h5
+      class="cds--type-heading-compact-01"
+      i18n
+    >
       <cds-inline-loading></cds-inline-loading>
-      Upgrade in progress {{executingTasks?.progress}}%</h5>
-    <a class="cds--link cds-mb-3"
-       routerLink="/upgrade/progress"
-       i18n>View Details...</a>
+      Upgrade in progress {{ executingTasks?.progress }}%
+    </h5>
+    <a
+      class="cds--link cds-mb-3"
+      routerLink="/upgrade/progress"
+      i18n
+      >View Details...</a
+    >
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-area-chart/dashboard-area-chart.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-area-chart/dashboard-area-chart.component.html
index 99a71181b70..00c834a6260 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-area-chart/dashboard-area-chart.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-area-chart/dashboard-area-chart.component.html
@@ -1,19 +1,30 @@
 <div class="row mt-2">
   <div class="col-3 d-flex flex-column align-self-center">
-    <br>
-    <b class="chartTitle pb-2"
-       i18n>{{ chartTitle }}</b>
-    <div *ngFor="let data of currentChartData.dataset"
-         i18n>
-      <div *ngIf="data.data.length !== 0"
-           class="d-inline-flex align-items-center gap-1">
-        <div class="box"
-             [style.background-color]="data.pointBackgroundColor">
-        </div>
+    <br />
+    <b
+      class="chartTitle pb-2"
+      i18n
+      >{{ chartTitle }}</b
+    >
+    <div
+      *ngFor="let data of currentChartData.dataset"
+      i18n
+    >
+      <div
+        *ngIf="data.data.length !== 0"
+        class="d-inline-flex align-items-center gap-1"
+      >
+        <div
+          class="box"
+          [style.background-color]="data.pointBackgroundColor"
+        ></div>
         <ng-container *ngIf="!chartTitle.includes(data.label)">
-          <span [ngClass]="{'d-inline-block text-truncate': truncateLabel}"
-                [ngStyle]="{'width': truncateLabel ? '10rem' : 'auto'}"
-                [title]="data.label">{{ data.label }}</span>:
+          <span
+            [ngClass]="{ 'd-inline-block text-truncate': truncateLabel }"
+            [ngStyle]="{ width: truncateLabel ? '10rem' : 'auto' }"
+            [title]="data.label"
+            >{{ data.label }}</span
+          >:
         </ng-container>
         <span>{{ data?.currentData || 'N/A' }} {{ data?.currentDataUnits }}</span>
         <div *ngIf="maxValue && data.currentData">
@@ -24,12 +35,14 @@
   </div>
 
   <div class="col-9 d-flex flex-column">
-    <div [ngClass]="{'chart mt-3': !isMultiCluster, 'mt-3': isMultiCluster}">
-      <canvas baseChart
-              [datasets]="chartData.dataset"
-              [options]="options"
-              [type]="'line'"
-              [plugins]="chartAreaBorderPlugin">
+    <div [ngClass]="{ 'chart mt-3': !isMultiCluster, 'mt-3': isMultiCluster }">
+      <canvas
+        baseChart
+        [datasets]="chartData.dataset"
+        [options]="options"
+        [type]="'line'"
+        [plugins]="chartAreaBorderPlugin"
+      >
       </canvas>
     </div>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.html
index 25473cb0531..d492e2d33c3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.html
@@ -1,15 +1,19 @@
 <div class="chart-container d-flex align-items-center justify-content-center">
-  <canvas baseChart
-          #chartCanvas
-          [datasets]="chartConfig.dataset"
-          [type]="chartConfig.chartType"
-          [options]="chartConfig.options"
-          [labels]="chartConfig.labels"
-          [plugins]="doughnutChartPlugins"
-          class="chart-canvas">
+  <canvas
+    baseChart
+    #chartCanvas
+    [datasets]="chartConfig.dataset"
+    [type]="chartConfig.chartType"
+    [options]="chartConfig.options"
+    [labels]="chartConfig.labels"
+    [plugins]="doughnutChartPlugins"
+    class="chart-canvas"
+  >
   </canvas>
-  <div class="chartjs-tooltip"
-       #chartTooltip>
+  <div
+    class="chartjs-tooltip"
+    #chartTooltip
+  >
     <table></table>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-time-selector/dashboard-time-selector.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-time-selector/dashboard-time-selector.component.html
index cd960d07bd9..eb900200a78 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-time-selector/dashboard-time-selector.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-time-selector/dashboard-time-selector.component.html
@@ -1,11 +1,16 @@
 <div class="timeSelector">
-  <select id="timepicker"
-          name="timepicker"
-          [(ngModel)]="time"
-          (ngModelChange)="emitTime()"
-          class="form-select">
-    <option *ngFor="let key of times"
-            [ngValue]="key.value">{{ key.name }}
+  <select
+    id="timepicker"
+    name="timepicker"
+    [(ngModel)]="time"
+    (ngModelChange)="emitTime()"
+    class="form-select"
+  >
+    <option
+      *ngFor="let key of times"
+      [ngValue]="key.value"
+    >
+      {{ key.name }}
     </option>
   </select>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster-details/nfs-cluster-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster-details/nfs-cluster-details.component.html
index 5605ae92512..4ddcc6fd3e9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster-details/nfs-cluster-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster-details/nfs-cluster-details.component.html
@@ -1,11 +1,7 @@
-  <ng-container *ngIf="!!selection">
-  <legend
-  i18n
-  >
-  {{title | titlecase}}
-  <cd-help-text>
-    Lists shares for a cluster
-  </cd-help-text>
+<ng-container *ngIf="!!selection">
+  <legend i18n>
+    {{ title | titlecase }}
+    <cd-help-text> Lists shares for a cluster </cd-help-text>
   </legend>
   <cd-nfs-list [clusterId]="selection.name"></cd-nfs-list>
-  </ng-container>
+</ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster/nfs-cluster.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster/nfs-cluster.component.html
index bed22fb5628..599a35236a8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster/nfs-cluster.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-cluster/nfs-cluster.component.html
@@ -1,51 +1,55 @@
-  <ng-container *ngIf="orchStatus?.available && clusters$ | async as clusters">
-  <cd-table [autoReload]="true"
-            [data]="clusters"
-            columnMode="flex"
-            [columns]="columns"
-            selectionType="single"
-            [hasDetails]="true"
-            (setExpandedRow)="setExpandedRow($event)"
-            (fetchData)="loadData()"
-            (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [selection]="selection"
-                    [permission]="permission"
-                    [tableActions]="tableActions"></cd-table-actions>
-  <cd-nfs-cluster-details  *cdTableDetail
-                           [selection]="expandedRow"></cd-nfs-cluster-details>
+<ng-container *ngIf="orchStatus?.available && clusters$ | async as clusters">
+  <cd-table
+    [autoReload]="true"
+    [data]="clusters"
+    columnMode="flex"
+    [columns]="columns"
+    selectionType="single"
+    [hasDetails]="true"
+    (setExpandedRow)="setExpandedRow($event)"
+    (fetchData)="loadData()"
+    (updateSelection)="updateSelection($event)"
+  >
+    <cd-table-actions
+      class="table-actions"
+      [selection]="selection"
+      [permission]="permission"
+      [tableActions]="tableActions"
+    ></cd-table-actions>
+    <cd-nfs-cluster-details
+      *cdTableDetail
+      [selection]="expandedRow"
+    ></cd-nfs-cluster-details>
   </cd-table>
-  </ng-container>
+</ng-container>
 
-  <ng-template
+<ng-template
   #virtualIpTpl
   let-row="data.row"
-  >
+>
   <span *ngIf="row.virtual_ip || row.port">
-  <cds-tag size="md">
-    {{ row.virtual_ip }}:{{row.port}}
-  </cds-tag>
+    <cds-tag size="md"> {{ row.virtual_ip }}:{{ row.port }} </cds-tag>
   </span>
-  </ng-template>
+</ng-template>
 
-  <ng-template
+<ng-template
   #ipAddrTpl
   let-backends="data.value"
-  >
+>
   <span *ngFor="let backend of backends">
-  <span *ngIf="backend.ip || backend.port">
-  <cds-tag size="md">
-    {{ backend.ip }}:{{backend.port}}
-  </cds-tag>
-  </span>
-  </span>
-  </ng-template>
-
-  <ng-template #hostnameTpl
-               let-backends="data.value">
-  <span *ngFor="let backend of backends">
-    <span *ngIf="backend.hostname">
-      <cds-tag size="md">{{backend.hostname }}</cds-tag>
+    <span *ngIf="backend.ip || backend.port">
+      <cds-tag size="md"> {{ backend.ip }}:{{ backend.port }} </cds-tag>
     </span>
   </span>
-  </ng-template>
+</ng-template>
+
+<ng-template
+  #hostnameTpl
+  let-backends="data.value"
+>
+  <span *ngFor="let backend of backends">
+    <span *ngIf="backend.hostname">
+      <cds-tag size="md">{{ backend.hostname }}</cds-tag>
+    </span>
+  </span>
+</ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-details/nfs-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-details/nfs-details.component.html
index 042c9f66458..e8a6b04bf81 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-details/nfs-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-details/nfs-details.component.html
@@ -1,28 +1,36 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="nfs-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="nfs-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value [data]="data">
-        </cd-table-key-value>
+        <cd-table-key-value [data]="data"> </cd-table-key-value>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="clients">
-      <a ngbNavLink
-         i18n>Clients ({{ clients.length }})</a>
+      <a
+        ngbNavLink
+        i18n
+        >Clients ({{ clients.length }})</a
+      >
       <ng-template ngbNavContent>
-
-        <cd-table #table
-                  [data]="clients"
-                  columnMode="flex"
-                  [columns]="clientsColumns"
-                  identifier="addresses"
-                  forceIdentifier="true"
-                  selectionType="">
+        <cd-table
+          #table
+          [data]="clients"
+          columnMode="flex"
+          [columns]="clientsColumns"
+          identifier="addresses"
+          forceIdentifier="true"
+          selectionType=""
+        >
         </cd-table>
       </ng-template>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form-client/nfs-form-client.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form-client/nfs-form-client.component.html
index 5d2cef35e8a..96af53a0db3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form-client/nfs-form-client.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form-client/nfs-form-client.component.html
@@ -1,57 +1,81 @@
 <div class="form-item">
-  <legend class="cds--label"
-          i18n>Clients</legend>
+  <legend
+    class="cds--label"
+    i18n
+  >
+    Clients
+  </legend>
 
-  <div [formGroup]="form"
-       #formDir="ngForm">
-    <span *ngIf="form.get('clients').value.length === 0"
-          class="no-border text-muted">
-      <span class="form-text text-muted"
-            i18n>Any client can access</span>
+  <div
+    [formGroup]="form"
+    #formDir="ngForm"
+  >
+    <span
+      *ngIf="form.get('clients').value.length === 0"
+      class="no-border text-muted"
+    >
+      <span
+        class="form-text text-muted"
+        i18n
+        >Any client can access</span
+      >
     </span>
 
     <ng-container formArrayName="clients">
       <div *ngFor="let item of clientsFormArray.controls; let index = index; trackBy: trackByFn">
         <div [formGroup]="item">
           <h6>
-            Client {{ (index + 1) }}
-            <cds-icon-button kind="ghost"
-                             size="md"
-                             class="float-end"
-                             (click)="removeClient(index)"
-                             data-testid="remove_client"
-                             data-toggle="button"
-                             title="Remove Client">
-              <svg cdsIcon="close"
-                   size="32"
-                   class="cds--btn__icon"></svg>
+            Client {{ index + 1 }}
+            <cds-icon-button
+              kind="ghost"
+              size="md"
+              class="float-end"
+              (click)="removeClient(index)"
+              data-testid="remove_client"
+              data-toggle="button"
+              title="Remove Client"
+            >
+              <svg
+                cdsIcon="close"
+                size="32"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
           </h6>
 
           <div>
             <!-- Addresses -->
             <div class="form-item">
-              <cds-text-label for="addresses"
-                              i18n
-                              cdRequiredField="Addresses"
-                              [invalid]="!item.controls['addresses'].valid && (item.controls['addresses'].dirty)"
-                              [invalidText]="addressesError"
-                              i18n-invalidText>Addresses
-                <input cdsText
-                       name="addresses"
-                       id="addresses"
-                       formControlName="addresses"
-                       placeholder="e.g. 192.168.0.10, 192.168.1.0/8"
-                       [invalid]="!item.controls['addresses'].valid && (item.controls['addresses'].dirty)">
+              <cds-text-label
+                for="addresses"
+                i18n
+                cdRequiredField="Addresses"
+                [invalid]="!item.controls['addresses'].valid && item.controls['addresses'].dirty"
+                [invalidText]="addressesError"
+                i18n-invalidText
+                >Addresses
+                <input
+                  cdsText
+                  name="addresses"
+                  id="addresses"
+                  formControlName="addresses"
+                  placeholder="e.g. 192.168.0.10, 192.168.1.0/8"
+                  [invalid]="!item.controls['addresses'].valid && item.controls['addresses'].dirty"
+                />
               </cds-text-label>
               <ng-template #addressesError>
                 <span class="invalid-feedback">
-                  <span *ngIf="showError(index, 'addresses', formDir, 'required')"
-                        i18n>This field is required.</span>
+                  <span
+                    *ngIf="showError(index, 'addresses', formDir, 'required')"
+                    i18n
+                    >This field is required.</span
+                  >
 
                   <span *ngIf="showError(index, 'addresses', formDir, 'invalidAddress')">
-                    <ng-container i18n>Must contain one or more comma-separated valid addresses.</ng-container>
-                    <br>
+                    <ng-container i18n
+                      >Must contain one or more comma-separated valid addresses.</ng-container
+                    >
+                    <br />
                     <ng-container i18n>For example:</ng-container> 192.168.0.10, 192.168.1.0/8
                   </span>
                 </span>
@@ -60,16 +84,22 @@
 
             <!-- Access Type-->
             <div class="form-item">
-              <cds-select label="Access Type"
-                          for="access_type"
-                          formControlName="access_type"
-                          name="access_type"
-                          id="access_type"
-                          [helperText]="accessTypeHelper"
-                          i18n>Access Type
+              <cds-select
+                label="Access Type"
+                for="access_type"
+                formControlName="access_type"
+                name="access_type"
+                id="access_type"
+                [helperText]="accessTypeHelper"
+                i18n
+                >Access Type
                 <option value="">No Access Type</option>
-                <option *ngFor="let item of nfsAccessType"
-                        [value]="item.value">{{ item.value }}</option>
+                <option
+                  *ngFor="let item of nfsAccessType"
+                  [value]="item.value"
+                >
+                  {{ item.value }}
+                </option>
               </cds-select>
               <ng-template #accessTypeHelper>
                 <span *ngIf="getValue(index, 'access_type')">
@@ -80,16 +110,22 @@
 
             <!-- Squash -->
             <div class="form-group row">
-              <cds-select label="Squash"
-                          for="squash"
-                          formControlName="squash"
-                          name="squash"
-                          id="squash"
-                          [helperText]="squashHelperTpl"
-                          i18n>Squash
+              <cds-select
+                label="Squash"
+                for="squash"
+                formControlName="squash"
+                name="squash"
+                id="squash"
+                [helperText]="squashHelperTpl"
+                i18n
+                >Squash
                 <option value="">{{ getNoSquashDescr() }}</option>
-                <option *ngFor="let squash of nfsSquash"
-                        [value]="squash">{{ squash }}</option>
+                <option
+                  *ngFor="let squash of nfsSquash"
+                  [value]="squash"
+                >
+                  {{ squash }}
+                </option>
               </cds-select>
             </div>
           </div>
@@ -99,14 +135,18 @@
 
     <div cdsRow>
       <div cdsCol>
-        <button cdsButton="tertiary"
-                type="button"
-                (click)="addClient()"
-                name="add_client">
+        <button
+          cdsButton="tertiary"
+          type="button"
+          (click)="addClient()"
+          name="add_client"
+        >
           <ng-container i18n>Add clients</ng-container>
-          <svg cdsIcon="add"
-               size="32"
-               class="cds--btn__icon"></svg>
+          <svg
+            cdsIcon="add"
+            size="32"
+            class="cds--btn__icon"
+          ></svg>
         </button>
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.html
index b47afea1801..6bf4c915bde 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.html
@@ -1,360 +1,602 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="nfsForm"
-          #formDir="ngForm"
-          [formGroup]="nfsForm"
-          novalidate>
-      <div i18n="form title"
-           class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}</div>
+    <form
+      name="nfsForm"
+      #formDir="ngForm"
+      [formGroup]="nfsForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
+        {{ action | titlecase }} {{ resource | upperFirst }}
+      </div>
 
       <!-- cluster_id -->
       <div class="form-item">
-        <cds-select formControlName="cluster_id"
-                    name="cluster_id"
-                    for="cluster_id"
-                    label="Cluster"
-                    cdRequiredField="Cluster"
-                    id="cluster_id"
-                    [invalid]="nfsForm.controls.cluster_id.invalid && (nfsForm.controls.cluster_id.dirty)"
-                    [invalidText]="clusterError"
-                    [skeleton]="allClusters === null"
-                    [helperText]="clusterHelperText"
-                    i18n>
-          <option *ngIf="allClusters === null"
-                  value="">Loading...</option>
-          <option *ngIf="allClusters !== null && allClusters.length === 0"
-                  value="">-- No cluster available --</option>
-          <option *ngIf="allClusters !== null && allClusters.length > 0"
-                  value="">-- Select the cluster --</option>
-          <option *ngFor="let cluster of allClusters"
-                  [value]="cluster.cluster_id">{{ cluster.cluster_id }}</option>
+        <cds-select
+          formControlName="cluster_id"
+          name="cluster_id"
+          for="cluster_id"
+          label="Cluster"
+          cdRequiredField="Cluster"
+          id="cluster_id"
+          [invalid]="nfsForm.controls.cluster_id.invalid && nfsForm.controls.cluster_id.dirty"
+          [invalidText]="clusterError"
+          [skeleton]="allClusters === null"
+          [helperText]="clusterHelperText"
+          i18n
+        >
+          <option
+            *ngIf="allClusters === null"
+            value=""
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="allClusters !== null && allClusters.length === 0"
+            value=""
+          >
+            -- No cluster available --
+          </option>
+          <option
+            *ngIf="allClusters !== null && allClusters.length > 0"
+            value=""
+          >
+            -- Select the cluster --
+          </option>
+          <option
+            *ngFor="let cluster of allClusters"
+            [value]="cluster.cluster_id"
+          >
+            {{ cluster.cluster_id }}
+          </option>
         </cds-select>
-        <cd-alert-panel *ngIf="allClusters?.length === 0"
-                        type="info"
-                        actionName="Create"
-                        spacingClass="mt-2"
-                        (action)="(router.navigate(['/services', {outlets: {modal: ['create']}}]))"
-                        i18n>To create a new NFS cluster, you need to create an NFS Service.
+        <cd-alert-panel
+          *ngIf="allClusters?.length === 0"
+          type="info"
+          actionName="Create"
+          spacingClass="mt-2"
+          (action)="router.navigate(['/services', { outlets: { modal: ['create'] } }])"
+          i18n
+          >To create a new NFS cluster, you need to create an NFS Service.
         </cd-alert-panel>
         <ng-template #clusterHelperText>
-          <span i18n>
-          This is the ID of an NFS Service</span>
+          <span i18n> This is the ID of an NFS Service</span>
         </ng-template>
         <ng-template #clusterError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('cluster_id', formDir, 'required') || allClusters?.length === 0"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="
+              nfsForm.showError('cluster_id', formDir, 'required') || allClusters?.length === 0
+            "
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- RGW Share Type -->
-      <div *ngIf="storageBackend === 'RGW' && !isEdit"
-           class="form-item">
-        <cds-select formControlName="rgw_export_type"
-                    name="rgw_export_type"
-                    (valueChange)="onExportTypeChange()"
-                    label="Type">
-          <option value="bucket"
-                  i18n>Bucket</option>
-          <option value="user"
-                  i18n>User</option>
+      <div
+        *ngIf="storageBackend === 'RGW' && !isEdit"
+        class="form-item"
+      >
+        <cds-select
+          formControlName="rgw_export_type"
+          name="rgw_export_type"
+          (valueChange)="onExportTypeChange()"
+          label="Type"
+        >
+          <option
+            value="bucket"
+            i18n
+          >
+            Bucket
+          </option>
+          <option
+            value="user"
+            i18n
+          >
+            User
+          </option>
         </cds-select>
       </div>
 
       <!-- FSAL -->
       <div formGroupName="fsal">
         <!-- CephFS Volume -->
-        <div class="form-item"
-             *ngIf="storageBackend === 'CEPH'">
-          <cds-select formControlName="fs_name"
-                      name="fs_name"
-                      for="fs_name"
-                      label="Volume"
-                      cdRequiredField="Volume"
-                      id="fs_name"
-                      (change)="volumeChangeHandler()"
-                      [invalid]="nfsForm.controls.fsal.controls.fs_name.invalid && (nfsForm.controls.fsal.controls.fs_name.dirty)"
-                      [invalidText]="fsNameError"
-                      [skeleton]="allFsNames === null"
-                      i18n>
-            <option *ngIf="allFsNames === null"
-                    value="">Loading...</option>
-            <option *ngIf="allFsNames !== null && allFsNames.length === 0"
-                    value="">-- No CephFS filesystem available --</option>
-            <option *ngIf="allFsNames !== null && allFsNames.length > 0"
-                    value="">-- Select the CephFS filesystem --</option>
-            <option *ngFor="let filesystem of allFsNames"
-                    [value]="filesystem.name">{{ filesystem.name }}</option>
+        <div
+          class="form-item"
+          *ngIf="storageBackend === 'CEPH'"
+        >
+          <cds-select
+            formControlName="fs_name"
+            name="fs_name"
+            for="fs_name"
+            label="Volume"
+            cdRequiredField="Volume"
+            id="fs_name"
+            (change)="volumeChangeHandler()"
+            [invalid]="
+              nfsForm.controls.fsal.controls.fs_name.invalid &&
+              nfsForm.controls.fsal.controls.fs_name.dirty
+            "
+            [invalidText]="fsNameError"
+            [skeleton]="allFsNames === null"
+            i18n
+          >
+            <option
+              *ngIf="allFsNames === null"
+              value=""
+            >
+              Loading...
+            </option>
+            <option
+              *ngIf="allFsNames !== null && allFsNames.length === 0"
+              value=""
+            >
+              -- No CephFS filesystem available --
+            </option>
+            <option
+              *ngIf="allFsNames !== null && allFsNames.length > 0"
+              value=""
+            >
+              -- Select the CephFS filesystem --
+            </option>
+            <option
+              *ngFor="let filesystem of allFsNames"
+              [value]="filesystem.name"
+            >
+              {{ filesystem.name }}
+            </option>
           </cds-select>
           <ng-template #fsNameError>
-            <span class="invalid-feedback"
-                  *ngIf="nfsForm.showError('fs_name', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="nfsForm.showError('fs_name', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </ng-template>
         </div>
 
         <!-- RGW User -->
-        <div class="form-item"
-             *ngIf="storageBackend === 'RGW' && nfsForm.getValue('rgw_export_type') === 'user'">
-          <cds-select formControlName="user_id"
-                      name="user_id"
-                      for="user_id"
-                      label="User"
-                      cdRequiredField="User"
-                      id="user_id"
-                      [invalid]="nfsForm.controls.fsal.controls.user_id.invalid && (nfsForm.controls.fsal.controls.user_id.dirty)"
-                      [invalidText]="userIdError"
-                      [skeleton]="allRGWUsers === null"
-                      i18n>
-            <option *ngIf="allRGWUsers === null"
-                    value="">Loading...</option>
-            <option *ngIf="allRGWUsers !== null && allRGWUsers.length === 0"
-                    value="">-- No RGW User available --</option>
-            <option *ngIf="allRGWUsers !== null && allRGWUsers.length > 0"
-                    value="">-- Select the RGW User --</option>
-            <option *ngFor="let user of allRGWUsers"
-                    [value]="user.user_id">{{ user.user_id }}</option>
+        <div
+          class="form-item"
+          *ngIf="storageBackend === 'RGW' && nfsForm.getValue('rgw_export_type') === 'user'"
+        >
+          <cds-select
+            formControlName="user_id"
+            name="user_id"
+            for="user_id"
+            label="User"
+            cdRequiredField="User"
+            id="user_id"
+            [invalid]="
+              nfsForm.controls.fsal.controls.user_id.invalid &&
+              nfsForm.controls.fsal.controls.user_id.dirty
+            "
+            [invalidText]="userIdError"
+            [skeleton]="allRGWUsers === null"
+            i18n
+          >
+            <option
+              *ngIf="allRGWUsers === null"
+              value=""
+            >
+              Loading...
+            </option>
+            <option
+              *ngIf="allRGWUsers !== null && allRGWUsers.length === 0"
+              value=""
+            >
+              -- No RGW User available --
+            </option>
+            <option
+              *ngIf="allRGWUsers !== null && allRGWUsers.length > 0"
+              value=""
+            >
+              -- Select the RGW User --
+            </option>
+            <option
+              *ngFor="let user of allRGWUsers"
+              [value]="user.user_id"
+            >
+              {{ user.user_id }}
+            </option>
           </cds-select>
           <ng-template #userIdError>
-            <span class="invalid-feedback"
-                  *ngIf="nfsForm.showError('user_id', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="nfsForm.showError('user_id', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </ng-template>
         </div>
       </div>
 
       <!-- Security Label -->
-      <div class="form-item"
-           *ngIf="storageBackend === 'CEPH'">
-        <cds-checkbox formControlName="security_label"
-                      name="security_label"
-                      id="security_label"
-                      i18n>Enable security label</cds-checkbox>
+      <div
+        class="form-item"
+        *ngIf="storageBackend === 'CEPH'"
+      >
+        <cds-checkbox
+          formControlName="security_label"
+          name="security_label"
+          id="security_label"
+          i18n
+          >Enable security label</cds-checkbox
+        >
       </div>
 
-      <div class="form-item"
-           *ngIf="nfsForm.getValue('security_label')">
-        <cds-text-label for="sec_label_xattr"
-                        [invalid]="nfsForm.controls.sec_label_xattr.invalid && (nfsForm.controls.sec_label_xattr.dirty)"
-                        [invalidText]="secLabelError"
-                        i18n>Security Label
-          <input cdsText
-                 name="sec_label_xattr"
-                 id="sec_label_xattr"
-                 formControlName="sec_label_xattr"
-                 [invalid]="nfsForm.controls.sec_label_xattr.invalid && (nfsForm.controls.sec_label_xattr.dirty)">
+      <div
+        class="form-item"
+        *ngIf="nfsForm.getValue('security_label')"
+      >
+        <cds-text-label
+          for="sec_label_xattr"
+          [invalid]="
+            nfsForm.controls.sec_label_xattr.invalid && nfsForm.controls.sec_label_xattr.dirty
+          "
+          [invalidText]="secLabelError"
+          i18n
+          >Security Label
+          <input
+            cdsText
+            name="sec_label_xattr"
+            id="sec_label_xattr"
+            formControlName="sec_label_xattr"
+            [invalid]="
+              nfsForm.controls.sec_label_xattr.invalid && nfsForm.controls.sec_label_xattr.dirty
+            "
+          />
         </cds-text-label>
         <ng-template #secLabelError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('sec_label_xattr', formDir, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('sec_label_xattr', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
-      <div class="form-item"
-           *ngIf="storageBackend === 'CEPH' && nfsForm.getValue('fsal').fs_name">
-        <cds-select formControlName="subvolume_group"
-                    name="subvolume_group"
-                    for="subvolume_group"
-                    label="Subvolume Group"
-                    id="subvolume_group"
-                    (change)="getSubVol()"
-                    [skeleton]="allsubvolgrps === null"
-                    i18n>
-          <option *ngIf="allsubvolgrps === null"
-                  value="">Loading...</option>
-          <option *ngIf="allsubvolgrps !== null && allsubvolgrps.length >= 0"
-                  value="">-- Select the CephFS subvolume group --</option>
-          <option *ngFor="let subvol_grp of allsubvolgrps"
-                  [value]="subvol_grp.name"
-                  [selected]="subvol_grp.name === nfsForm.get('subvolume_group').value">{{ subvol_grp.name }}</option>
+      <div
+        class="form-item"
+        *ngIf="storageBackend === 'CEPH' && nfsForm.getValue('fsal').fs_name"
+      >
+        <cds-select
+          formControlName="subvolume_group"
+          name="subvolume_group"
+          for="subvolume_group"
+          label="Subvolume Group"
+          id="subvolume_group"
+          (change)="getSubVol()"
+          [skeleton]="allsubvolgrps === null"
+          i18n
+        >
+          <option
+            *ngIf="allsubvolgrps === null"
+            value=""
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="allsubvolgrps !== null && allsubvolgrps.length >= 0"
+            value=""
+          >
+            -- Select the CephFS subvolume group --
+          </option>
+          <option
+            *ngFor="let subvol_grp of allsubvolgrps"
+            [value]="subvol_grp.name"
+            [selected]="subvol_grp.name === nfsForm.get('subvolume_group').value"
+          >
+            {{ subvol_grp.name }}
+          </option>
           <option [value]="defaultSubVolGroup">{{ defaultSubVolGroup }}</option>
         </cds-select>
       </div>
 
-    <div class="form-group row"
-         *ngIf="storageBackend === 'CEPH' && nfsForm.getValue('fsal').fs_name">
-      <cds-select formControlName="subvolume"
-                  name="subvolume"
-                  for="subvolume"
-                  label="Subvolume"
-                  id="subvolume"
-                  [skeleton]="allsubvols === null"
-                  (change)="setSubVolPath()"
-                  [invalid]="nfsForm.controls.subvolume.invalid && (nfsForm.controls.subvolume.dirty)"
-                  [invalidText]="subvolumeError"
-                  i18n>
-        <option *ngIf="allsubvols === null"
-                value="">Loading...</option>
-        <option *ngIf="allsubvols !== null && allsubvols.length === 0"
-                value="">-- No CephFS subvolume available --</option>
-        <option *ngIf="allsubvols !== null && allsubvols.length > 0"
-                value="">-- Select the CephFS subvolume --</option>
-        <option *ngFor="let subvolume of allsubvols"
-                [value]="subvolume.name"
-                [selected]="subvolume.name === nfsForm.get('subvolume').value">{{ subvolume.name }}</option>
-      </cds-select>
-      <ng-template #subvolumeError>
-        <span
-                  *ngIf="nfsForm.getValue('subvolume_group') === defaultSubVolGroup && !nfsForm.getValue('subvolume')"
-                  class="invalid-feedback"
-                  i18n>
-                  This field is required.
-        </span>
-      </ng-template>
-    </div>
+      <div
+        class="form-group row"
+        *ngIf="storageBackend === 'CEPH' && nfsForm.getValue('fsal').fs_name"
+      >
+        <cds-select
+          formControlName="subvolume"
+          name="subvolume"
+          for="subvolume"
+          label="Subvolume"
+          id="subvolume"
+          [skeleton]="allsubvols === null"
+          (change)="setSubVolPath()"
+          [invalid]="nfsForm.controls.subvolume.invalid && nfsForm.controls.subvolume.dirty"
+          [invalidText]="subvolumeError"
+          i18n
+        >
+          <option
+            *ngIf="allsubvols === null"
+            value=""
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="allsubvols !== null && allsubvols.length === 0"
+            value=""
+          >
+            -- No CephFS subvolume available --
+          </option>
+          <option
+            *ngIf="allsubvols !== null && allsubvols.length > 0"
+            value=""
+          >
+            -- Select the CephFS subvolume --
+          </option>
+          <option
+            *ngFor="let subvolume of allsubvols"
+            [value]="subvolume.name"
+            [selected]="subvolume.name === nfsForm.get('subvolume').value"
+          >
+            {{ subvolume.name }}
+          </option>
+        </cds-select>
+        <ng-template #subvolumeError>
+          <span
+            *ngIf="
+              nfsForm.getValue('subvolume_group') === defaultSubVolGroup &&
+              !nfsForm.getValue('subvolume')
+            "
+            class="invalid-feedback"
+            i18n
+          >
+            This field is required.
+          </span>
+        </ng-template>
+      </div>
 
       <!-- Path -->
-      <div class="form-item"
-           *ngIf="storageBackend === 'CEPH'">
-        <cds-text-label for="path"
-                        i18n
-                        helperText="A path in a CephFS file system."
-                        cdRequiredField="Path"
-                        [invalid]="nfsForm.controls.path.invalid && (nfsForm.controls.path.dirty)"
-                        [invalidText]="pathError">Path
-          <input cdsText
-                 type="text"
-                 placeholder="Path..."
-                 i18n-placeholder
-                 id="path"
-                 name="path"
-                 formControlName="path"
-                 [ngbTypeahead]="pathDataSource"
-                 [invalid]="nfsForm.controls.path.invalid && (nfsForm.controls.path.dirty)">
+      <div
+        class="form-item"
+        *ngIf="storageBackend === 'CEPH'"
+      >
+        <cds-text-label
+          for="path"
+          i18n
+          helperText="A path in a CephFS file system."
+          cdRequiredField="Path"
+          [invalid]="nfsForm.controls.path.invalid && nfsForm.controls.path.dirty"
+          [invalidText]="pathError"
+          >Path
+          <input
+            cdsText
+            type="text"
+            placeholder="Path..."
+            i18n-placeholder
+            id="path"
+            name="path"
+            formControlName="path"
+            [ngbTypeahead]="pathDataSource"
+            [invalid]="nfsForm.controls.path.invalid && nfsForm.controls.path.dirty"
+          />
         </cds-text-label>
         <ng-template #pathError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('path', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.get('path').hasError('isIsolatedSlash') && nfsForm.get('path').touched"
-                i18n>Share on CephFS volume "<code>/</code>" not allowed.</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('path', formDir, 'pattern')"
-                i18n>Path need to start with a '/' and can be followed by a word</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('path', formDir, 'pathNameNotAllowed')"
-                i18n>The path does not exist in the selected volume.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('path', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.get('path').hasError('isIsolatedSlash') && nfsForm.get('path').touched"
+            i18n
+            >Share on CephFS volume "<code>/</code>" not allowed.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('path', formDir, 'pattern')"
+            i18n
+            >Path need to start with a '/' and can be followed by a word</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('path', formDir, 'pathNameNotAllowed')"
+            i18n
+            >The path does not exist in the selected volume.</span
+          >
         </ng-template>
       </div>
 
       <!-- Bucket -->
-      <div class="form-item"
-           *ngIf="storageBackend === 'RGW' && nfsForm.getValue('rgw_export_type') === 'bucket'">
-        <cds-text-label for="path"
-                        i18n
-                        cdRequiredField="Bucket"
-                        [invalid]="nfsForm.controls.path.invalid && (nfsForm.controls.path.dirty)"
-                        [invalidText]="bucketPathError">
-          <input cdsText
-                 type="text"
-                 placeholder="Bucket name..."
-                 i18n-placeholder
-                 id="path"
-                 name="path"
-                 formControlName="path"
-                 [ngbTypeahead]="bucketDataSource"
-                 [invalid]="nfsForm.controls.path.invalid && (nfsForm.controls.path.dirty)">
+      <div
+        class="form-item"
+        *ngIf="storageBackend === 'RGW' && nfsForm.getValue('rgw_export_type') === 'bucket'"
+      >
+        <cds-text-label
+          for="path"
+          i18n
+          cdRequiredField="Bucket"
+          [invalid]="nfsForm.controls.path.invalid && nfsForm.controls.path.dirty"
+          [invalidText]="bucketPathError"
+        >
+          <input
+            cdsText
+            type="text"
+            placeholder="Bucket name..."
+            i18n-placeholder
+            id="path"
+            name="path"
+            formControlName="path"
+            [ngbTypeahead]="bucketDataSource"
+            [invalid]="nfsForm.controls.path.invalid && nfsForm.controls.path.dirty"
+          />
         </cds-text-label>
         <ng-template #bucketPathError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('path', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('path', formDir, 'bucketNameNotAllowed')"
-                i18n>The bucket does not exist or is not in the default realm (if multiple realms are configured).
-                    To continue, <a routerLink="/rgw/bucket/create"
-                                    class="btn-link">create a new bucket</a>.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('path', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('path', formDir, 'bucketNameNotAllowed')"
+            i18n
+            >The bucket does not exist or is not in the default realm (if multiple realms are
+            configured). To continue,
+            <a
+              routerLink="/rgw/bucket/create"
+              class="btn-link"
+              >create a new bucket</a
+            >.</span
+          >
         </ng-template>
       </div>
 
       <!-- NFS Protocol -->
       <div class="form-item">
-        <legend class="cds--label"
-                cdRequiredField="NFS Protocol"
-                i18n>NFS Protocol (required)</legend>
-        <cds-checkbox formControlName="protocolNfsv3"
-                      name="protocolNfsv3"
-                      id="protocolNfsv3"
-                      [invalid]="nfsForm.controls.protocolNfsv3.invalid && (nfsForm.controls.protocolNfsv3.dirty)"
-                      [invalidText]="protocolError"
-                      i18n>NFSv3</cds-checkbox>
-        <cds-checkbox formControlName="protocolNfsv4"
-                      name="protocolNfsv4"
-                      id="protocolNfsv4"
-                      [invalid]="nfsForm.controls.protocolNfsv4.invalid && (nfsForm.controls.protocolNfsv4.dirty)"
-                      [invalidText]="protocolError"
-                      i18n>NFSv4</cds-checkbox>
-          <ng-template #protocolError>
-            <span class="invalid-feedback"
-                  *ngIf="nfsForm.showError('protocolNfsv3', formDir, 'required') ||
-                  nfsForm.showError('protocolNfsv4', formDir, 'required')"
-                  i18n>This field is required.</span>
-          </ng-template>
-        </div>
+        <legend
+          class="cds--label"
+          cdRequiredField="NFS Protocol"
+          i18n
+        >
+          NFS Protocol (required)
+        </legend>
+        <cds-checkbox
+          formControlName="protocolNfsv3"
+          name="protocolNfsv3"
+          id="protocolNfsv3"
+          [invalid]="nfsForm.controls.protocolNfsv3.invalid && nfsForm.controls.protocolNfsv3.dirty"
+          [invalidText]="protocolError"
+          i18n
+          >NFSv3</cds-checkbox
+        >
+        <cds-checkbox
+          formControlName="protocolNfsv4"
+          name="protocolNfsv4"
+          id="protocolNfsv4"
+          [invalid]="nfsForm.controls.protocolNfsv4.invalid && nfsForm.controls.protocolNfsv4.dirty"
+          [invalidText]="protocolError"
+          i18n
+          >NFSv4</cds-checkbox
+        >
+        <ng-template #protocolError>
+          <span
+            class="invalid-feedback"
+            *ngIf="
+              nfsForm.showError('protocolNfsv3', formDir, 'required') ||
+              nfsForm.showError('protocolNfsv4', formDir, 'required')
+            "
+            i18n
+            >This field is required.</span
+          >
+        </ng-template>
+      </div>
 
       <!-- Pseudo -->
-      <div class="form-item"
-           *ngIf="nfsForm.getValue('protocolNfsv4') || nfsForm.getValue('protocolNfsv3')">
-        <cds-text-label for="pseudo"
-                        i18n
-                        [helperText]="pseudoHelper"
-                        cdRequiredField="Pseudo"
-                        [invalid]="nfsForm.controls.pseudo.invalid && (nfsForm.controls.pseudo.dirty)"
-                        [invalidText]="pseudoError">
-          <input cdsText
-                 type="text"
-                 placeholder="Pseudo..."
-                 i18n-placeholder
-                 id="pseudo"
-                 name="pseudo"
-                 formControlName="pseudo"
-                 minlength="2"
-                 [invalid]="nfsForm.controls.pseudo.invalid && (nfsForm.controls.pseudo.dirty)">
+      <div
+        class="form-item"
+        *ngIf="nfsForm.getValue('protocolNfsv4') || nfsForm.getValue('protocolNfsv3')"
+      >
+        <cds-text-label
+          for="pseudo"
+          i18n
+          [helperText]="pseudoHelper"
+          cdRequiredField="Pseudo"
+          [invalid]="nfsForm.controls.pseudo.invalid && nfsForm.controls.pseudo.dirty"
+          [invalidText]="pseudoError"
+        >
+          <input
+            cdsText
+            type="text"
+            placeholder="Pseudo..."
+            i18n-placeholder
+            id="pseudo"
+            name="pseudo"
+            formControlName="pseudo"
+            minlength="2"
+            [invalid]="nfsForm.controls.pseudo.invalid && nfsForm.controls.pseudo.dirty"
+          />
         </cds-text-label>
         <ng-template #pseudoHelper>
-          <span i18n>The position this share occupies in the Pseudo FS. It must be unique.</span><br/>
-          <span i18n>By using different Pseudo options, the same Path may be shared multiple times.</span>
+          <span i18n>The position this share occupies in the Pseudo FS. It must be unique.</span
+          ><br />
+          <span i18n
+            >By using different Pseudo options, the same Path may be shared multiple times.</span
+          >
         </ng-template>
         <ng-template #pseudoError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('pseudo', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('pseudo', formDir, 'pseudoAlreadyExists')"
-                i18n>The pseudo is already in use by another share.</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('pseudo', formDir, 'pattern')"
-                i18n>Pseudo needs to start with a '/' and can't contain any of the following: &gt;, &lt;, |, &, ( or ).</span>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('pseudo', formDir, 'minlength') && nfsForm.getValue('pseudo') === '/'"
-                i18n>Pseudo path should be an absolute path and it cannot be just '/'</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('pseudo', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('pseudo', formDir, 'pseudoAlreadyExists')"
+            i18n
+            >The pseudo is already in use by another share.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('pseudo', formDir, 'pattern')"
+            i18n
+            >Pseudo needs to start with a '/' and can't contain any of the following: &gt;, &lt;, |,
+            &, ( or ).</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="
+              nfsForm.showError('pseudo', formDir, 'minlength') &&
+              nfsForm.getValue('pseudo') === '/'
+            "
+            i18n
+            >Pseudo path should be an absolute path and it cannot be just '/'</span
+          >
         </ng-template>
       </div>
 
       <!-- Access Type -->
       <div class="form-item">
-        <cds-select formControlName="access_type"
-                    name="access_type"
-                    for="access_type"
-                    label="Access Type"
-                    cdRequiredField="Access Type"
-                    id="access_type"
-                    [invalid]="nfsForm.controls.access_type.invalid && (nfsForm.controls.access_type.dirty)"
-                    [invalidText]="accessTypeError"
-                    [helperText]="accessTypeHelper"
-                    [warn]="nfsForm.getValue('access_type') === 'RW' && storageBackend === 'RGW'"
-                    [warnText]="accessTypeWarning"
-                    [skeleton]="nfsAccessType === null"
-                    i18n>
-          <option *ngIf="nfsAccessType === null"
-                  value="">Loading...</option>
-          <option *ngIf="nfsAccessType !== null && nfsAccessType.length === 0"
-                  value="">-- No access type available --</option>
-          <option *ngFor="let accessType of nfsAccessType"
-                  [value]="accessType.value">{{ accessType.value }}</option>
+        <cds-select
+          formControlName="access_type"
+          name="access_type"
+          for="access_type"
+          label="Access Type"
+          cdRequiredField="Access Type"
+          id="access_type"
+          [invalid]="nfsForm.controls.access_type.invalid && nfsForm.controls.access_type.dirty"
+          [invalidText]="accessTypeError"
+          [helperText]="accessTypeHelper"
+          [warn]="nfsForm.getValue('access_type') === 'RW' && storageBackend === 'RGW'"
+          [warnText]="accessTypeWarning"
+          [skeleton]="nfsAccessType === null"
+          i18n
+        >
+          <option
+            *ngIf="nfsAccessType === null"
+            value=""
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="nfsAccessType !== null && nfsAccessType.length === 0"
+            value=""
+          >
+            -- No access type available --
+          </option>
+          <option
+            *ngFor="let accessType of nfsAccessType"
+            [value]="accessType.value"
+          >
+            {{ accessType.value }}
+          </option>
         </cds-select>
         <ng-template #accessTypeHelper>
           <span *ngIf="nfsForm.getValue('access_type')">
@@ -362,100 +604,162 @@
           </span>
         </ng-template>
         <ng-template #accessTypeWarning>
-          <span *ngIf="nfsForm.getValue('access_type') === 'RW' && storageBackend === 'RGW'"
-                i18n>The Object Gateway NFS backend has a number of
-            limitations which will seriously affect applications writing to
-            the share. Please consult the&nbsp;<cd-doc section="rgw-nfs"></cd-doc>&nbsp;
-            for details before enabling write access.</span>
+          <span
+            *ngIf="nfsForm.getValue('access_type') === 'RW' && storageBackend === 'RGW'"
+            i18n
+            >The Object Gateway NFS backend has a number of limitations which will seriously affect
+            applications writing to the share. Please consult the&nbsp;<cd-doc
+              section="rgw-nfs"
+            ></cd-doc
+            >&nbsp; for details before enabling write access.</span
+          >
         </ng-template>
         <ng-template #accessTypeError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('access_type', formDir, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('access_type', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Squash -->
       <div class="form-item">
-        <cds-select formControlName="squash"
-                    name="squash"
-                    for="squash"
-                    label="Squash"
-                    cdRequiredField="Squash"
-                    id="squash"
-                    [invalid]="nfsForm.controls.squash.invalid && (nfsForm.controls.squash.dirty)"
-                    [invalidText]="squashError"
-                    [skeleton]="nfsSquash === null"
-                    [helperText]="squashHelper"
-                    i18n>
-          <option *ngIf="nfsSquash === null"
-                  value="">Loading...</option>
-          <option *ngIf="nfsSquash !== null && nfsSquash.length === 0"
-                  value="">-- No squash available --</option>
-          <option *ngFor="let squash of nfsSquash"
-                  [value]="squash">{{ squash }}</option>
+        <cds-select
+          formControlName="squash"
+          name="squash"
+          for="squash"
+          label="Squash"
+          cdRequiredField="Squash"
+          id="squash"
+          [invalid]="nfsForm.controls.squash.invalid && nfsForm.controls.squash.dirty"
+          [invalidText]="squashError"
+          [skeleton]="nfsSquash === null"
+          [helperText]="squashHelper"
+          i18n
+        >
+          <option
+            *ngIf="nfsSquash === null"
+            value=""
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="nfsSquash !== null && nfsSquash.length === 0"
+            value=""
+          >
+            -- No squash available --
+          </option>
+          <option
+            *ngFor="let squash of nfsSquash"
+            [value]="squash"
+          >
+            {{ squash }}
+          </option>
         </cds-select>
         <ng-template #squashHelper>
-          <span *ngIf="nfsForm.getValue('squash') === 'root_squash'"
-                i18n>Maps the root user on the NFS client to an anonymous user/group with limited privileges. This prevents a root client user from having total control over the NFS share.</span>
+          <span
+            *ngIf="nfsForm.getValue('squash') === 'root_squash'"
+            i18n
+            >Maps the root user on the NFS client to an anonymous user/group with limited
+            privileges. This prevents a root client user from having total control over the NFS
+            share.</span
+          >
 
-          <span *ngIf="nfsForm.getValue('squash') === 'root_id_squash'"
-                i18n>Maps the root user on the NFS client to an anonymous user/group with limited privileges, preventing root access but retaining non-root group privileges.</span>
+          <span
+            *ngIf="nfsForm.getValue('squash') === 'root_id_squash'"
+            i18n
+            >Maps the root user on the NFS client to an anonymous user/group with limited
+            privileges, preventing root access but retaining non-root group privileges.</span
+          >
 
-          <span *ngIf="nfsForm.getValue('squash') === 'all_squash'"
-                i18n>Maps all users on the NFS client to an anonymous user/group with limited privileges, ensuring that no user has special privileges on the NFS share.</span>
+          <span
+            *ngIf="nfsForm.getValue('squash') === 'all_squash'"
+            i18n
+            >Maps all users on the NFS client to an anonymous user/group with limited privileges,
+            ensuring that no user has special privileges on the NFS share.</span
+          >
 
-          <span *ngIf="nfsForm.getValue('squash') === 'no_root_squash'"
-                i18n>Allows the root user on the NFS client to retain full root privileges on the NFS server, which may pose security risks.</span>
+          <span
+            *ngIf="nfsForm.getValue('squash') === 'no_root_squash'"
+            i18n
+            >Allows the root user on the NFS client to retain full root privileges on the NFS
+            server, which may pose security risks.</span
+          >
         </ng-template>
         <ng-template #squashError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('squash', formDir,'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="nfsForm.showError('squash', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Transport Protocol -->
       <div class="form-item">
-        <legend class="cds--label"
-                cdRequiredField="Transport Protocol"
-                i18n>Transport Protocol (required)</legend>
-        <cds-checkbox formControlName="transportUDP"
-                      name="transportUDP"
-                      id="transportUDP"
-                      [invalid]="nfsForm.controls.transportUDP.invalid && (nfsForm.controls.transportUDP.dirty)"
-                      [invalidText]="transportError"
-                      i18n>UDP</cds-checkbox>
-        <cds-checkbox formControlName="transportTCP"
-                      name="transportTCP"
-                      id="transportTCP"
-                      [invalid]="nfsForm.controls.transportTCP.invalid && (nfsForm.controls.transportTCP.dirty)"
-                      [invalidText]="transportError"
-                      i18n>TCP</cds-checkbox>
+        <legend
+          class="cds--label"
+          cdRequiredField="Transport Protocol"
+          i18n
+        >
+          Transport Protocol (required)
+        </legend>
+        <cds-checkbox
+          formControlName="transportUDP"
+          name="transportUDP"
+          id="transportUDP"
+          [invalid]="nfsForm.controls.transportUDP.invalid && nfsForm.controls.transportUDP.dirty"
+          [invalidText]="transportError"
+          i18n
+          >UDP</cds-checkbox
+        >
+        <cds-checkbox
+          formControlName="transportTCP"
+          name="transportTCP"
+          id="transportTCP"
+          [invalid]="nfsForm.controls.transportTCP.invalid && nfsForm.controls.transportTCP.dirty"
+          [invalidText]="transportError"
+          i18n
+          >TCP</cds-checkbox
+        >
         <ng-template #transportError>
-          <span class="invalid-feedback"
-                *ngIf="nfsForm.showError('transportUDP', formDir, 'required') ||
-                nfsForm.showError('transportTCP', formDir, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="
+              nfsForm.showError('transportUDP', formDir, 'required') ||
+              nfsForm.showError('transportTCP', formDir, 'required')
+            "
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Clients -->
-      <cd-nfs-form-client [form]="nfsForm"
-                          [clients]="clients"
-                          #nfsClients>
+      <cd-nfs-form-client
+        [form]="nfsForm"
+        [clients]="clients"
+        #nfsClients
+      >
       </cd-nfs-form-client>
 
       <!-- Errors -->
-      <cd-alert-panel type="error"
-                      *ngIf="!!storageBackendError">
-        {{storageBackendError}}
+      <cd-alert-panel
+        type="error"
+        *ngIf="!!storageBackendError"
+      >
+        {{ storageBackendError }}
       </cd-alert-panel>
-      <cd-form-button-panel (submitActionEvent)="submitAction()"
-                            [form]="nfsForm"
-                            [disabled]="!!storageBackendError"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                            wrappingClass="text-right"></cd-form-button-panel>
+      <cd-form-button-panel
+        (submitActionEvent)="submitAction()"
+        [form]="nfsForm"
+        [disabled]="!!storageBackendError"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        wrappingClass="text-right"
+      ></cd-form-button-panel>
     </form>
   </ng-container>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-list/nfs-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-list/nfs-list.component.html
index 7ab6beda780..20156417ee2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-list/nfs-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-list/nfs-list.component.html
@@ -1,53 +1,76 @@
-<cd-table #table
-          [data]="exports"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="id"
-          forceIdentifier="true"
-          selectionType="single"
-          [hasDetails]="false"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)">
+<cd-table
+  #table
+  [data]="exports"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="id"
+  forceIdentifier="true"
+  selectionType="single"
+  [hasDetails]="false"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
-    <cd-table-actions class="btn-group"
-                      [permission]="permission"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      class="btn-group"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
 
-  <cd-nfs-details *cdTableDetail
-                  [selection]="expandedRow">
+  <cd-nfs-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-nfs-details>
 </cd-table>
 
-<ng-template #nfsFsal
-             let-value="data.value">
-  <ng-container *ngIf="value.name==='CEPH'"
-                i18n>CephFS</ng-container>
-  <ng-container *ngIf="value.name==='RGW'"
-                i18n>Object Gateway</ng-container>
+<ng-template
+  #nfsFsal
+  let-value="data.value"
+>
+  <ng-container
+    *ngIf="value.name === 'CEPH'"
+    i18n
+    >CephFS</ng-container
+  >
+  <ng-container
+    *ngIf="value.name === 'RGW'"
+    i18n
+    >Object Gateway</ng-container
+  >
 </ng-template>
 
-<ng-template #protocolTpl
-             let-protocols="data.value">
+<ng-template
+  #protocolTpl
+  let-protocols="data.value"
+>
   <span *ngFor="let protocol of protocols">
-    <cds-tag size="md">NFSv{{protocol}}</cds-tag>
+    <cds-tag size="md">NFSv{{ protocol }}</cds-tag>
   </span>
 </ng-template>
 
-<ng-template #transportTpl
-             let-transports="data.value">
+<ng-template
+  #transportTpl
+  let-transports="data.value"
+>
   <span *ngFor="let transport of transports">
-    <cds-tag size="md">{{transport}}</cds-tag>
+    <cds-tag size="md">{{ transport }}</cds-tag>
   </span>
 </ng-template>
 
-<ng-template #pathTmpl
-             let-value="data.value">
-  <span *ngIf="value === ''"
-        i18n
-        i18n-ngbTooltip
-        ngbTooltip="All buckets owned by user">*</span>
+<ng-template
+  #pathTmpl
+  let-value="data.value"
+>
+  <span
+    *ngIf="value === ''"
+    i18n
+    i18n-ngbTooltip
+    ngbTooltip="All buckets owned by user"
+    >*</span
+  >
   <span *ngIf="value !== ''">{{ value }}</span>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html
index d7b89cd9d69..57af99b0dc8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.html
@@ -1,67 +1,72 @@
 <cd-productive-card class="overview-alerts-card">
-@if (vm$ | async; as vm) {
-  <!-- HEADER -->
-  <ng-template #header>
-    <h2 class="cds--type-heading-compact-02"
-        i18n>
-      System alerts
-    </h2>
-    <button
-      cdsButton="ghost"
-      size="sm"
-      [routerLink]="['/monitoring/active-alerts']"
-      type="button"
-      i18n
-    >
-      View all
-    </button>
-  </ng-template>
-  <!-- TOTAL COUNT -->
-  @if (vm?.total || vm?.total === 0) {
-  <div>
-    <span class="cds--type-heading-07">{{ vm.total }}</span>
-    <cd-icon [type]="vm.icon"></cd-icon>
-  </div>
+  @if (vm$ | async; as vm) {
+    <!-- HEADER -->
+    <ng-template #header>
+      <h2
+        class="cds--type-heading-compact-02"
+        i18n
+      >
+        System alerts
+      </h2>
+      <button
+        cdsButton="ghost"
+        size="sm"
+        [routerLink]="['/monitoring/active-alerts']"
+        type="button"
+        i18n
+      >
+        View all
+      </button>
+    </ng-template>
+    <!-- TOTAL COUNT -->
+    @if (vm?.total || vm?.total === 0) {
+      <div>
+        <span class="cds--type-heading-07">{{ vm.total }}</span>
+        <cd-icon [type]="vm.icon"></cd-icon>
+      </div>
 
-  <small
-    class="cds--type-label-01 overview-alerts-card-need-attention"
-    i18n>
-    {{ vm.statusText }}
-  </small>
-  <!-- SUB TOTAL COUNTS -->
-  <div class="cds-mt-5">
-  @if (vm.badges.length) {
-    <div [cdsStack]="compact? 'horizontal' : 'vertical'">
-      @for (b of vm.badges; track b.key; let last = $last) {
-      <span
-        class="overview-alerts-card-badge cds-pr-4"
-        [class.cds-mr-4]="!last && compact"
-        [class.border-subtle-right]="!last && compact"
-        [class.overview-alerts-card-badge--compact]="!compact"
-        [class.border-subtle-bottom]="!compact">
-        <a
-          cdsLink
-          [routerLink]="['/monitoring/active-alerts']"
-          [queryParams]="{ severity: b.key }">
-          <cd-icon [type]="b.icon"></cd-icon>
-          <span class="cds-ml-3">
-          @if(compact) {
-          {{ b.count }}
-          } @else {
-           {{b.key | upperFirst}} ({{ b.count }})
-          }
-          </span>
-        </a>
-      </span>
-      }
-    </div>
+      <small
+        class="cds--type-label-01 overview-alerts-card-need-attention"
+        i18n
+      >
+        {{ vm.statusText }}
+      </small>
+      <!-- SUB TOTAL COUNTS -->
+      <div class="cds-mt-5">
+        @if (vm.badges.length) {
+          <div [cdsStack]="compact ? 'horizontal' : 'vertical'">
+            @for (b of vm.badges; track b.key; let last = $last) {
+              <span
+                class="overview-alerts-card-badge cds-pr-4"
+                [class.cds-mr-4]="!last && compact"
+                [class.border-subtle-right]="!last && compact"
+                [class.overview-alerts-card-badge--compact]="!compact"
+                [class.border-subtle-bottom]="!compact"
+              >
+                <a
+                  cdsLink
+                  [routerLink]="['/monitoring/active-alerts']"
+                  [queryParams]="{ severity: b.key }"
+                >
+                  <cd-icon [type]="b.icon"></cd-icon>
+                  <span class="cds-ml-3">
+                    @if (compact) {
+                      {{ b.count }}
+                    } @else {
+                      {{ b.key | upperFirst }} ({{ b.count }})
+                    }
+                  </span>
+                </a>
+              </span>
+            }
+          </div>
+        }
+      </div>
+    } @else {
+      <cds-skeleton-placeholder></cds-skeleton-placeholder>
+      <div class="cds-mt-3">
+        <cds-skeleton-text [lines]="1"></cds-skeleton-text>
+      </div>
+    }
   }
-  </div>
-  }@else {
-  <cds-skeleton-placeholder></cds-skeleton-placeholder>
-  <div class="cds-mt-3">
-    <cds-skeleton-text [lines]="1"></cds-skeleton-text>
-  </div>
-  }
-}
 </cd-productive-card>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html
index 421e2140268..bdb7045b7ec 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/health-card/overview-health-card.component.html
@@ -1,247 +1,292 @@
-@let data=(data$ | async);
-@let hwEnabled = (enabled$ | async);
-@let hwSections = (sections$ | async);
-@let telemetryEnabled = (telemetryEnabled$ | async);
-
-@let colorClass="overview-health-card-status--" + vm?.clusterHealth?.icon;
+@let data = data$ | async;
+@let hwEnabled = enabled$ | async;
+@let hwSections = sections$ | async;
+@let telemetryEnabled = telemetryEnabled$ | async;
 
+@let colorClass = 'overview-health-card-status--' + vm?.clusterHealth?.icon;
 
 <cd-productive-card class="overview-health-card">
   <!-- ----------------------HEALTH CARD HEADER ---------------->
-  @if(vm?.fsid) {
-  <ng-template #header>
-    <div class="overview-health-card-header">
-      <div class="cds-mb-4 cds-mr-3">
-        <cd-icon type="dataCenter"></cd-icon>
+  @if (vm?.fsid) {
+    <ng-template #header>
+      <div class="overview-health-card-header">
+        <div class="cds-mb-4 cds-mr-3">
+          <cd-icon type="dataCenter"></cd-icon>
+        </div>
+        <h2
+          class="cds--type-heading-compact-02"
+          id="fsid"
+        >
+          <span class="cds-mr-2">{{ vm?.fsid }}</span>
+        </h2>
+        <cd-copy-2-clipboard-button
+          size="sm"
+          title="Copy cluster fsid"
+          i18n-title
+          source="fsid"
+        >
+        </cd-copy-2-clipboard-button>
       </div>
-      <h2 class="cds--type-heading-compact-02"
-          id="fsid">
-        <span class="cds-mr-2">{{vm?.fsid}}</span>
-      </h2>
-      <cd-copy-2-clipboard-button
-        size="sm"
-        title="Copy cluster fsid"
-        i18n-title
-        source="fsid">
-      </cd-copy-2-clipboard-button>
-    </div>
-    <ng-template #telemetryDescription>
-      <div class="cds--type-heading-compact-01 cds-mb-2"
-           i18n>Support & diagnostics</div>
-      <div cdsStack="horizontal"
-           [gap]="10">
-        <span i18n>Telemetry</span>
-        <span>
-          @if (telemetryEnabled) {
-          <cd-icon type="success"></cd-icon>&nbsp;
-          <span i18n>on</span>
-          } @else {
-          <cd-icon type="infoCircle"></cd-icon>&nbsp;
-          <span i18n>off</span>
-          }
-        </span>
+      <ng-template #telemetryDescription>
+        <div
+          class="cds--type-heading-compact-01 cds-mb-2"
+          i18n
+        >
+          Support & diagnostics
+        </div>
+        <div
+          cdsStack="horizontal"
+          [gap]="10"
+        >
+          <span i18n>Telemetry</span>
+          <span>
+            @if (telemetryEnabled) {
+              <cd-icon type="success"></cd-icon>&nbsp;
+              <span i18n>on</span>
+            } @else {
+              <cd-icon type="infoCircle"></cd-icon>&nbsp;
+              <span i18n>off</span>
+            }
+          </span>
+        </div>
+      </ng-template>
+      <div
+        cdsStack="horizontal"
+        [gap]="2"
+      >
+        <cds-icon-button
+          type="button"
+          kind="ghost"
+          size="sm"
+          [description]="telemetryDescription"
+        >
+          <cd-icon type="cloudMonitoring"></cd-icon>
+        </cds-icon-button>
+        <cds-icon-button
+          type="button"
+          kind="ghost"
+          size="sm"
+          description="Check logs"
+          i18n-description
+          [routerLink]="['/logs']"
+        >
+          <cd-icon type="dataViewAlt"></cd-icon>
+        </cds-icon-button>
       </div>
     </ng-template>
-    <div cdsStack="horizontal"
-         [gap]="2">
-      <cds-icon-button
-        type="button"
-        kind="ghost"
-        size="sm"
-        [description]="telemetryDescription">
-        <cd-icon type="cloudMonitoring"></cd-icon>
-      </cds-icon-button>
-      <cds-icon-button
-        type="button"
-        kind="ghost"
-        size="sm"
-        description="Check logs"
-        i18n-description
-        [routerLink]="['/logs']">
-        <cd-icon type="dataViewAlt"></cd-icon>
-      </cds-icon-button>
-    </div>
-  </ng-template>
   } @else {
-  <cds-skeleton-text
-    [lines]="1"
-    [maxLineWidth]="400"
-    [minLineWidth]="400"></cds-skeleton-text>
+    <cds-skeleton-text
+      [lines]="1"
+      [maxLineWidth]="400"
+      [minLineWidth]="400"
+    ></cds-skeleton-text>
   }
   <!------------------------- HEALTH CARD CLUSTER STATUS ------------------>
-  @if(vm?.clusterHealth){
-  <p class="cds--type-heading-05 cds-mb-0"
-     [ngClass]="colorClass">
-    {{vm?.clusterHealth?.title}}
-    <cd-icon [type]="vm?.clusterHealth?.icon"></cd-icon>
-  </p>
-  <p class="cds--type-label-01 overview-health-card-secondary-text">{{vm?.clusterHealth?.message}}</p>
+  @if (vm?.clusterHealth) {
+    <p
+      class="cds--type-heading-05 cds-mb-0"
+      [ngClass]="colorClass"
+    >
+      {{ vm?.clusterHealth?.title }}
+      <cd-icon [type]="vm?.clusterHealth?.icon"></cd-icon>
+    </p>
+    <p class="cds--type-label-01 overview-health-card-secondary-text">
+      {{ vm?.clusterHealth?.message }}
+    </p>
   } @else {
-  <cds-skeleton-placeholder></cds-skeleton-placeholder>
+    <cds-skeleton-placeholder></cds-skeleton-placeholder>
   }
 
-  @if(data?.summary?.version) {
-  <!-- CEPH VERSION -->
-  <p class="cds--type-label-02">
-    <span i18n>Ceph version:&nbsp;</span>
-    <span class="cds--type-heading-compact-01">{{ data?.summary?.version | cephVersion  }}</span>&nbsp;
-    @if (data?.upgrade?.versions?.length) {
-    <a [routerLink]="['/upgrade']"
-       cdsLink
-       [inline]="true"
-       i18n>
-      Upgrade available
-      <cd-icon type="upgrade"></cd-icon>
-    </a>
-    }
-  </p>
+  @if (data?.summary?.version) {
+    <!-- CEPH VERSION -->
+    <p class="cds--type-label-02">
+      <span i18n>Ceph version:&nbsp;</span>
+      <span class="cds--type-heading-compact-01">{{ data?.summary?.version | cephVersion }}</span
+      >&nbsp;
+      @if (data?.upgrade?.versions?.length) {
+        <a
+          [routerLink]="['/upgrade']"
+          cdsLink
+          [inline]="true"
+          i18n
+        >
+          Upgrade available
+          <cd-icon type="upgrade"></cd-icon>
+        </a>
+      }
+    </p>
   } @else {
-  <cds-skeleton-text
-    [lines]="1"
-    [maxLineWidth]="250"></cds-skeleton-text>
+    <cds-skeleton-text
+      [lines]="1"
+      [maxLineWidth]="250"
+    ></cds-skeleton-text>
   }
 
   <!-----------------------------------TABS -------------------------------------->
 
-  <div cdsStack="horizontal"
-       [gap]="4">
-  <!-- HEALTH CHECKS -->
-  @if(vm?.incidents > 0) {
-  <div>
-    <cd-icon
-      type="incidentReporter"
-      [ngClass]="colorClass"></cd-icon>
-    <cds-tooltip-definition
-      [highContrast]="true"
-      [openOnHover]="true"
-      [dropShadow]="true"
-      [caret]="true"
-      (click)="onViewIncidentsClick()"
-      description="Click to view health incidents"
-      i18n-description>
-      <span
-        class="cds--type-heading-compact-01"
-        [ngClass]="colorClass"
-        i18n>
-        {{vm?.incidents}} Health incidents
-      </span>
-    </cds-tooltip-definition>
-    <cds-tooltip
-      class="cds-ml-3"
-      [caret]="true"
-      description="Health incidents represent Ceph health check warnings that indicate abnormal conditions requiring intervention and persist until the condition is resolved."
-      i8n-description
-    >
-      <cd-icon type="help"></cd-icon>&nbsp;|
-    </cds-tooltip>
-  </div>
-  }
-  <!-- SYSTEM TAB -->
-  @if(vm?.overallSystemSev) {
-    <div class="overview-health-card-tab"
-         [class.overview-health-card-tab-selected]="activeSection === 'system'">
-      <div class="cds-mb-1"><cd-icon
-        [type]="vm?.overallSystemSev"></cd-icon></div>
-      <cds-tooltip-definition
-        [highContrast]="true"
-        [openOnHover]="true"
-        [dropShadow]="true"
-        class="cds-ml-2"
-        [caret]="true"
-        (click)="toggleSection('system')"
-        data-test-id="systems-tab"
-        description=""
-        i18n-description>
-        <span
-          class="cds-mr-1"
-          [class.cds--type-heading-compact-01]="activeSection === 'system'"
-          i18n>
-          Systems
-        </span>
-      </cds-tooltip-definition>
-    </div>
-  } @else {
-  <cds-skeleton-text [lines]="1"></cds-skeleton-text>
-  }
-  <!-- HARDWARE TAB -->
-  @if(hwEnabled && hwSections) {
-    <div class="overview-health-card-tab"
-         [class.overview-health-card-tab-selected]="activeSection === 'hardware'">
-      <div class="cds-mb-1"><cd-icon
-        [type]="vm?.overallSystemSev"></cd-icon></div>
-      <cds-tooltip-definition
-        [highContrast]="true"
-        [openOnHover]="true"
-        [dropShadow]="true"
-        class="cds-ml-2"
-        [caret]="true"
-        (click)="toggleSection('hardware')"
-        description=""
-        i18n-description>
-        <span
-          class="cds-mr-1"
-          [class.cds--type-heading-compact-01]="activeSection === 'hardware'"
-          i18n>
-          Hardware
-        </span>
-      </cds-tooltip-definition>
-    </div>
-  }
-  <!-- RESILIENCY TAB -->
-   @if(vm?.overallSystemSev) {
-    <div class="overview-health-card-tab"
-         [class.overview-health-card-tab-selected]="activeSection === 'resiliency'">
-      <div class="cds-mb-1"><cd-icon
-        [type]="vm?.resiliencyHealth?.icon"></cd-icon></div>
-      <cds-tooltip-definition
-        [highContrast]="true"
-        [openOnHover]="true"
-        [dropShadow]="true"
-        class="cds-ml-2"
-        [caret]="true"
-        (click)="toggleSection('resiliency')"
-        description=""
-        i18n-description>
-        <span
-          class="cds-mr-1"
-          [class.cds--type-heading-compact-01]="activeSection === 'resiliency'"
-          i18n>
-          Data resiliency
-        </span>
-      </cds-tooltip-definition>
-    </div>
-  } @else {
-  <cds-skeleton-text [lines]="1"></cds-skeleton-text>
-  }
+  <div
+    cdsStack="horizontal"
+    [gap]="4"
+  >
+    <!-- HEALTH CHECKS -->
+    @if (vm?.incidents > 0) {
+      <div>
+        <cd-icon
+          type="incidentReporter"
+          [ngClass]="colorClass"
+        ></cd-icon>
+        <cds-tooltip-definition
+          [highContrast]="true"
+          [openOnHover]="true"
+          [dropShadow]="true"
+          [caret]="true"
+          (click)="onViewIncidentsClick()"
+          description="Click to view health incidents"
+          i18n-description
+        >
+          <span
+            class="cds--type-heading-compact-01"
+            [ngClass]="colorClass"
+            i18n
+          >
+            {{ vm?.incidents }} Health incidents
+          </span>
+        </cds-tooltip-definition>
+        <cds-tooltip
+          class="cds-ml-3"
+          [caret]="true"
+          description="Health incidents represent Ceph health check warnings that indicate abnormal conditions requiring intervention and persist until the condition is resolved."
+          i8n-description
+        >
+          <cd-icon type="help"></cd-icon>&nbsp;|
+        </cds-tooltip>
+      </div>
+    }
+    <!-- SYSTEM TAB -->
+    @if (vm?.overallSystemSev) {
+      <div
+        class="overview-health-card-tab"
+        [class.overview-health-card-tab-selected]="activeSection === 'system'"
+      >
+        <div class="cds-mb-1"><cd-icon [type]="vm?.overallSystemSev"></cd-icon></div>
+        <cds-tooltip-definition
+          [highContrast]="true"
+          [openOnHover]="true"
+          [dropShadow]="true"
+          class="cds-ml-2"
+          [caret]="true"
+          (click)="toggleSection('system')"
+          data-test-id="systems-tab"
+          description=""
+          i18n-description
+        >
+          <span
+            class="cds-mr-1"
+            [class.cds--type-heading-compact-01]="activeSection === 'system'"
+            i18n
+          >
+            Systems
+          </span>
+        </cds-tooltip-definition>
+      </div>
+    } @else {
+      <cds-skeleton-text [lines]="1"></cds-skeleton-text>
+    }
+    <!-- HARDWARE TAB -->
+    @if (hwEnabled && hwSections) {
+      <div
+        class="overview-health-card-tab"
+        [class.overview-health-card-tab-selected]="activeSection === 'hardware'"
+      >
+        <div class="cds-mb-1"><cd-icon [type]="vm?.overallSystemSev"></cd-icon></div>
+        <cds-tooltip-definition
+          [highContrast]="true"
+          [openOnHover]="true"
+          [dropShadow]="true"
+          class="cds-ml-2"
+          [caret]="true"
+          (click)="toggleSection('hardware')"
+          description=""
+          i18n-description
+        >
+          <span
+            class="cds-mr-1"
+            [class.cds--type-heading-compact-01]="activeSection === 'hardware'"
+            i18n
+          >
+            Hardware
+          </span>
+        </cds-tooltip-definition>
+      </div>
+    }
+    <!-- RESILIENCY TAB -->
+    @if (vm?.overallSystemSev) {
+      <div
+        class="overview-health-card-tab"
+        [class.overview-health-card-tab-selected]="activeSection === 'resiliency'"
+      >
+        <div class="cds-mb-1"><cd-icon [type]="vm?.resiliencyHealth?.icon"></cd-icon></div>
+        <cds-tooltip-definition
+          [highContrast]="true"
+          [openOnHover]="true"
+          [dropShadow]="true"
+          class="cds-ml-2"
+          [caret]="true"
+          (click)="toggleSection('resiliency')"
+          description=""
+          i18n-description
+        >
+          <span
+            class="cds-mr-1"
+            [class.cds--type-heading-compact-01]="activeSection === 'resiliency'"
+            i18n
+          >
+            Data resiliency
+          </span>
+        </cds-tooltip-definition>
+      </div>
+    } @else {
+      <cds-skeleton-text [lines]="1"></cds-skeleton-text>
+    }
   </div>
 
   <!-- TAB CONTENT -->
-  <div  [ngSwitch]="activeSection">
+  <div [ngSwitch]="activeSection">
     <!-- SYSTEM TAB CONTENT -->
     <ng-container *ngSwitchCase="'system'">
       <div class="overview-health-card-tab-content">
-        <p class="overview-health-card-secondary-text cds--type-body-compact-01"
-           i18n>Some cluster components are degraded and may require attention.</p>
-        <div cdsStack="horizontal"
-             [gap]="8">
+        <p
+          class="overview-health-card-secondary-text cds--type-body-compact-01"
+          i18n
+        >
+          Some cluster components are degraded and may require attention.
+        </p>
+        <div
+          cdsStack="horizontal"
+          [gap]="8"
+        >
           @for (item of healthItems; track item.key; let isLast = $last) {
-          <div class="cds-pr-8"
-               [class.overview-health-card-tab-content-item]="!isLast"
-               [class.border-subtle-right]="!isLast">
-            <span class="overview-health-card-icon-and-text">
-              <cd-icon [type]="vm?.[item.key]?.severity"></cd-icon>
-              <span
-                class="cds--type-body-compact-01"
-                [data-test-id]="item.label">
-                {{ item.label }}
+            <div
+              class="cds-pr-8"
+              [class.overview-health-card-tab-content-item]="!isLast"
+              [class.border-subtle-right]="!isLast"
+            >
+              <span class="overview-health-card-icon-and-text">
+                <cd-icon [type]="vm?.[item.key]?.severity"></cd-icon>
+                <span
+                  class="cds--type-body-compact-01"
+                  [data-test-id]="item.label"
+                >
+                  {{ item.label }}
+                </span>
               </span>
-            </span>
-            <p
-              class="cds--type-label-01 cds-mt-3 cds-mb-0 overview-health-card-secondary-text"
-              [data-test-id]="item.label+'-value'">
-              {{ vm?.[item.key]?.value }}
-            </p>
-          </div>
+              <p
+                class="cds--type-label-01 cds-mt-3 cds-mb-0 overview-health-card-secondary-text"
+                [data-test-id]="item.label + '-value'"
+              >
+                {{ vm?.[item.key]?.value }}
+              </p>
+            </div>
           }
         </div>
       </div>
@@ -249,44 +294,48 @@
     <!-- HARDWARE TAB CONTENT -->
     <ng-container *ngSwitchCase="'hardware'">
       <div class="overview-health-card-tab-content">
-        <p class="overview-health-card-secondary-text cds--type-body-compact-01"
-           i18n>
+        <p
+          class="overview-health-card-secondary-text cds--type-body-compact-01"
+          i18n
+        >
           Some cluster components are degraded and may require attention.
         </p>
 
         @if (hwEnabled && hwSections) {
           <div class="overview-health-card-hardware-sections">
-          @for (section of sections; track $index; let isLast = $last) {
-            <div class="overview-health-card-hardware-section"
-                 [class.border-subtle-right]="!isLast">
-            @for (row of section; track row.key) {
-            <div class="overview-health-card-hardware-row">
-              <span class="overview-health-card-icon-and-text">
-                <cd-icon [type]="row.key"></cd-icon>
-                <span class="cds--type-body-compact-01">
-                  {{ row.label }}
-                </span>
-              </span>
+            @for (section of sections; track $index; let isLast = $last) {
+              <div
+                class="overview-health-card-hardware-section"
+                [class.border-subtle-right]="!isLast"
+              >
+                @for (row of section; track row.key) {
+                  <div class="overview-health-card-hardware-row">
+                    <span class="overview-health-card-icon-and-text">
+                      <cd-icon [type]="row.key"></cd-icon>
+                      <span class="cds--type-body-compact-01">
+                        {{ row.label }}
+                      </span>
+                    </span>
 
-              <span class="overview-health-card-hardware-status">
-              @if (row.error > 0) {
-              <cd-icon type="warningAlt"></cd-icon>
-              <span class="cds--type-body-compact-01">
-                {{ row.error }}
-              </span>
-              }
-              <cd-icon type="checkMarkOutline"></cd-icon>
-              <span class="cds--type-body-compact-01">
-                {{ row.ok }}
-              </span>
-              </span>
-            </div>
+                    <span class="overview-health-card-hardware-status">
+                      @if (row.error > 0) {
+                        <cd-icon type="warningAlt"></cd-icon>
+                        <span class="cds--type-body-compact-01">
+                          {{ row.error }}
+                        </span>
+                      }
+                      <cd-icon type="checkMarkOutline"></cd-icon>
+                      <span class="cds--type-body-compact-01">
+                        {{ row.ok }}
+                      </span>
+                    </span>
+                  </div>
+                }
+              </div>
             }
-            </div>
-          }
           </div>
         } @else {
-        <cds-skeleton-placeholder></cds-skeleton-placeholder>
+          <cds-skeleton-placeholder></cds-skeleton-placeholder>
         }
       </div>
     </ng-container>
@@ -297,57 +346,77 @@
           <span class="overview-health-card-icon-and-text">
             <cd-icon [type]="vm?.resiliencyHealth?.icon"></cd-icon>
             <span class="cds--type-body-compact-01">
-              {{vm?.resiliencyHealth?.title}}
+              {{ vm?.resiliencyHealth?.title }}
             </span>
           </span>
           <p class="overview-health-card-secondary-text cds--type-label-01">
-            {{vm?.resiliencyHealth?.description}}</p>
+            {{ vm?.resiliencyHealth?.description }}
+          </p>
           <button
             cdsButton="tertiary"
             size="sm"
             type="button"
-            (click)="onViewPGStatesClick()">
+            (click)="onViewPGStatesClick()"
+          >
             <span
               i18n
-              class="cds-ml-3">See all PGs states</span>
+              class="cds-ml-3"
+              >See all PGs states</span
+            >
             <cd-icon type="arrowUpRight"></cd-icon>
           </button>
         </div>
         @if (vm?.pgs?.activeCleanChartData && vm?.pgs?.activeCleanChartOptions) {
-        <div class="overview-health-card-tab-content-item-row">
-          <ibm-gauge-chart
-            class="overview-health-card-resiliency-chart"
-            [options]="vm?.pgs?.activeCleanChartOptions"
-            [data]="vm?.pgs?.activeCleanChartData"></ibm-gauge-chart>
-          <div class="overview-health-card-resiliency-chart-text">
-            <p
-              i18n
-              class="cds--type-helper-text-01 overview-health-card-secondary-text"><em>Data resiliency</em> reflects data availability and replication (% of placement groups that are active and clean).
-            </p>
-            @if (vm?.pgs?.activeCleanChartReason?.length) {
-            <p
-              class="cds--type-helper-text-01 overview-health-card-secondary-text overview-health-card-bold cds-mb-2"
-              i18n>
-              {{vm?.resiliencyHealth?.severity === 'progress' ? 'Data cleanup in progress' : 'What is affecting resiliency?'}}
-            </p>
-            @for (item of vm?.pgs?.activeCleanChartReason; track item.state; let isLast =$last) {
-            @if(item.count) {
-            <p
-              [class.cds-mb-0]="isLast"
-              class="cds-mb-2">
-              <span class="cds--type-label-01 cds-mr-1">{{item?.state}}:</span>
-              <span class="cds--type-label-01 overview-health-card-bold">{{item.count}} %</span>
-              @if(!item?.state?.includes('Scrub') && item?.state !== 'Remapped') {
-              <cd-icon type="arrowDown"></cd-icon>
+          <div class="overview-health-card-tab-content-item-row">
+            <ibm-gauge-chart
+              class="overview-health-card-resiliency-chart"
+              [options]="vm?.pgs?.activeCleanChartOptions"
+              [data]="vm?.pgs?.activeCleanChartData"
+            ></ibm-gauge-chart>
+            <div class="overview-health-card-resiliency-chart-text">
+              <p
+                i18n
+                class="cds--type-helper-text-01 overview-health-card-secondary-text"
+              >
+                <em>Data resiliency</em> reflects data availability and replication (% of placement
+                groups that are active and clean).
+              </p>
+              @if (vm?.pgs?.activeCleanChartReason?.length) {
+                <p
+                  class="cds--type-helper-text-01 overview-health-card-secondary-text overview-health-card-bold cds-mb-2"
+                  i18n
+                >
+                  {{
+                    vm?.resiliencyHealth?.severity === 'progress'
+                      ? 'Data cleanup in progress'
+                      : 'What is affecting resiliency?'
+                  }}
+                </p>
+                @for (
+                  item of vm?.pgs?.activeCleanChartReason;
+                  track item.state;
+                  let isLast = $last
+                ) {
+                  @if (item.count) {
+                    <p
+                      [class.cds-mb-0]="isLast"
+                      class="cds-mb-2"
+                    >
+                      <span class="cds--type-label-01 cds-mr-1">{{ item?.state }}:</span>
+                      <span class="cds--type-label-01 overview-health-card-bold"
+                        >{{ item.count }} %</span
+                      >
+                      @if (!item?.state?.includes('Scrub') && item?.state !== 'Remapped') {
+                        <cd-icon type="arrowDown"></cd-icon>
+                      }
+                    </p>
+                  }
+                }
               }
-            </p>
-            }
-            }
-            }
+            </div>
           </div>
-        </div>
         } @else {
-        <cds-skeleton-placeholder></cds-skeleton-placeholder>
+          <cds-skeleton-placeholder></cds-skeleton-placeholder>
         }
       </div>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/overview.component.html
index 5cb5d2b06a2..22fd3a9b168 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/overview.component.html
@@ -6,36 +6,48 @@
 
 <!-- OVEVRIEW -->
 
-@let storageCard = (storageCardVm$ | async);
-@let health = (healthCardVm$ | async);
-@let storageEmptyState = (storageEmptyState$ | async);
-@let prometheusEmptyState = (prometheusEmptyState$ | async);
-<main cdsGrid
-      [fullWidth]="true"
-      [narrow]="true"
-      class="overview cds-mt-5">
-  <div cdsRow
-       class="cds-mb-5">
-    <div cdsCol
-         [columnNumbers]="{lg: 11}">
+@let storageCard = storageCardVm$ | async;
+@let health = healthCardVm$ | async;
+@let storageEmptyState = storageEmptyState$ | async;
+@let prometheusEmptyState = prometheusEmptyState$ | async;
+<main
+  cdsGrid
+  [fullWidth]="true"
+  [narrow]="true"
+  class="overview cds-mt-5"
+>
+  <div
+    cdsRow
+    class="cds-mb-5"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ lg: 11 }"
+    >
       <cd-overview-health-card
-          [vm]="health"
-          (viewIncidents)="toggleHealthPanel()"
-          (viewPGStates)="togglePGStatesPanel()"
-          (activeSectionChange)="activeHealthTab = $event"
-        ></cd-overview-health-card>
+        [vm]="health"
+        (viewIncidents)="toggleHealthPanel()"
+        (viewPGStates)="togglePGStatesPanel()"
+        (activeSectionChange)="activeHealthTab = $event"
+      ></cd-overview-health-card>
     </div>
-    <div cdsCol
-         class="overview-pr-0"
-         [columnNumbers]="{lg: 5}">
+    <div
+      cdsCol
+      class="overview-pr-0"
+      [columnNumbers]="{ lg: 5 }"
+    >
       <cd-overview-alerts-card [compact]="!activeHealthTab"></cd-overview-alerts-card>
     </div>
   </div>
-  <div cdsRow
-       class="cds-mb-5">
-    <div cdsCol
-         class="overview-pr-0"
-         [columnNumbers]="{lg: 16}">
+  <div
+    cdsRow
+    class="cds-mb-5"
+  >
+    <div
+      cdsCol
+      class="overview-pr-0"
+      [columnNumbers]="{ lg: 16 }"
+    >
       <cd-overview-storage-card
         [totalCapacity]="storageCard?.totalCapacity"
         [usedCapacity]="storageCard?.usedCapacity"
@@ -46,75 +58,94 @@
         [isBreakdownLoaded]="storageCard?.isBreakdownLoaded ?? false"
         [threshold]="storageCard?.threshold"
         [storageEmptyState]="storageEmptyState"
-        [prometheusEmptyState]="prometheusEmptyState">
+        [prometheusEmptyState]="prometheusEmptyState"
+      >
       </cd-overview-storage-card>
     </div>
   </div>
   <div cdsRow>
-    <div cdsCol
-         class="overview-pr-0"
-         [columnNumbers]="{ lg: 16 }">
+    <div
+      cdsCol
+      class="overview-pr-0"
+      [columnNumbers]="{ lg: 16 }"
+    >
       <cd-performance-card
         [prometheusEmptyState]="prometheusEmptyState"
-        [storageEmptyState]="storageEmptyState"></cd-performance-card>
+        [storageEmptyState]="storageEmptyState"
+      ></cd-performance-card>
     </div>
   </div>
 </main>
 @if (isHealthPanelOpen && health?.incidents > 0) {
   <cd-side-panel
-    [headerText]="'Health incidents ('+ health?.incidents +')'"
+    [headerText]="'Health incidents (' + health?.incidents + ')'"
     [expanded]="isHealthPanelOpen"
     size="md"
-    (closed)="toggleHealthPanel()">
-    <div panel-header-description
-         class="cds--type-body-01">
-      <span i18n>Health incidents are Ceph health checks warnings indicating conditions that require attention and remain until resolved.</span>
+    (closed)="toggleHealthPanel()"
+  >
+    <div
+      panel-header-description
+      class="cds--type-body-01"
+    >
+      <span i18n
+        >Health incidents are Ceph health checks warnings indicating conditions that require
+        attention and remain until resolved.</span
+      >
     </div>
     <div class="panel-content">
       @for (check of health?.checks; track check.name) {
-      <div>
-        <div class="overview-check-header">
-          <cd-icon [type]="check?.icon"></cd-icon>
-          <span class="cds--type-body-compact-01 overview-check-name">
-            {{ check?.name }}
-          </span>
+        <div>
+          <div class="overview-check-header">
+            <cd-icon [type]="check?.icon"></cd-icon>
+            <span class="cds--type-body-compact-01 overview-check-name">
+              {{ check?.name }}
+            </span>
+          </div>
+          <p class="cds--type-body-compact-01 overview-check-description">
+            {{ check?.description }}
+          </p>
         </div>
-        <p class="cds--type-body-compact-01 overview-check-description">{{ check?.description }}</p>
-      </div>
       }
     </div>
   </cd-side-panel>
 }
 @if (isPGStatePanelOpen) {
   <cd-side-panel
-    [headerText]="'Placement groups  ('+ health?.pgs?.total +')'"
+    [headerText]="'Placement groups  (' + health?.pgs?.total + ')'"
     [expanded]="isPGStatePanelOpen"
     size="md"
-    (closed)="togglePGStatesPanel()">
-    <div panel-header-description
-         class="cds--type-body-01">
+    (closed)="togglePGStatesPanel()"
+  >
+    <div
+      panel-header-description
+      class="cds--type-body-01"
+    >
       <span i18n>
-        Placement groups are how Ceph groups and distributes data across storage devices to manage replication, recovery, and performance.
+        Placement groups are how Ceph groups and distributes data across storage devices to manage
+        replication, recovery, and performance.
       </span>
     </div>
     <div class="panel-content">
       <div
         class="overview-pg-side-panel-rw cds-mb-4"
         cdsStack="horizontal"
-        gap="4">
-        @for (data of health?.pgs?.io; track $index ; let isLast = $last) {
-        <div
-          class="overview-pg-side-panel-rw-item"
-          [class.overview-pg-side-panel-rw-item--border]="!isLast">
-          <p class="cds--type-label-01 cds-mb-2">{{data.label}}</p>
-          <p class="cds--type-heading-03 cds-mb-0">{{data.value | dimlessBinary }} / s</p>
-        </div>
+        gap="4"
+      >
+        @for (data of health?.pgs?.io; track $index; let isLast = $last) {
+          <div
+            class="overview-pg-side-panel-rw-item"
+            [class.overview-pg-side-panel-rw-item--border]="!isLast"
+          >
+            <p class="cds--type-label-01 cds-mb-2">{{ data.label }}</p>
+            <p class="cds--type-heading-03 cds-mb-0">{{ data.value | dimlessBinary }} / s</p>
+          </div>
         }
       </div>
       <cd-table
-         [data]="health?.pgs?.states"
-         [columns]="pgTableColumns"
-         size="xs">
+        [data]="health?.pgs?.states"
+        [columns]="pgTableColumns"
+        size="xs"
+      >
       </cd-table>
     </div>
   </cd-side-panel>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html
index 94f4f9b6b9b..1bbb9d850ce 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/storage-card/overview-storage-card.component.html
@@ -1,153 +1,182 @@
 <cd-productive-card class="overview-storage-card">
   <!-- STORAGE CARD HEADER -->
   <ng-template #header>
-    <h2 class="cds--type-heading-compact-02"
-        i18n>Storage overview</h2>
+    <h2
+      class="cds--type-heading-compact-02"
+      i18n
+    >
+      Storage overview
+    </h2>
   </ng-template>
   <!-- CAPACITY USAGE TEXT -->
-   @if(!storageEmptyState) {
-  <div class="overview-storage-card-usage-text">
-    @if( usedRaw !== null && totalRaw !== null && usedRawUnit && totalRawUnit) {
-    <h5>
-      <span
-        class="cds--type-heading-05"
-        i18n>{{usedRaw}}&nbsp;</span>
-      <span
-        class="cds--type-body-02"
-        i18n>{{usedRawUnit}} of {{totalRaw}} {{totalRawUnit}} used</span>
-      <cds-tooltip
-        class="cds-ml-3 cds-mr-3"
-        [caret]="true"
-        description="Shows raw used and total capacity. Raw capacity includes all physical storage before replication or overhead."
-        i18n-description
-      >
-      <cd-icon type="help"></cd-icon>
-    </cds-tooltip>
-    @if(threshold === 'high') {
-    <cds-tag size="md">
-      <div cdsTagIcon>
-        <cd-icon
-          type="warningAltFilled"
-          useDefault="true"></cd-icon>
-      </div>
-      <span i18n>High storage usage</span>
-    </cds-tag>
-   }
-   @else if(threshold === 'critical') {
-    <cds-tag
-      type="red"
-      size="md">
-      <div cdsTagIcon>
-        <cd-icon
-          type="warningAltFilled"
-          useDefault="true"></cd-icon>
-      </div>
-      <span i18n>Capacity critically low</span>
-    </cds-tag>
-    }
-    </h5>
-    }
-    @else {
-    <cds-skeleton-text
-      [lines]="1"
-      [minLineWidth]="400"
-      [maxLineWidth]="400">
-    </cds-skeleton-text>
-    }
-  </div>
-  }
-  @else {
+  @if (!storageEmptyState) {
+    <div class="overview-storage-card-usage-text">
+      @if (usedRaw !== null && totalRaw !== null && usedRawUnit && totalRawUnit) {
+        <h5>
+          <span
+            class="cds--type-heading-05"
+            i18n
+            >{{ usedRaw }}&nbsp;</span
+          >
+          <span
+            class="cds--type-body-02"
+            i18n
+            >{{ usedRawUnit }} of {{ totalRaw }} {{ totalRawUnit }} used</span
+          >
+          <cds-tooltip
+            class="cds-ml-3 cds-mr-3"
+            [caret]="true"
+            description="Shows raw used and total capacity. Raw capacity includes all physical storage before replication or overhead."
+            i18n-description
+          >
+            <cd-icon type="help"></cd-icon>
+          </cds-tooltip>
+          @if (threshold === 'high') {
+            <cds-tag size="md">
+              <div cdsTagIcon>
+                <cd-icon
+                  type="warningAltFilled"
+                  useDefault="true"
+                ></cd-icon>
+              </div>
+              <span i18n>High storage usage</span>
+            </cds-tag>
+          } @else if (threshold === 'critical') {
+            <cds-tag
+              type="red"
+              size="md"
+            >
+              <div cdsTagIcon>
+                <cd-icon
+                  type="warningAltFilled"
+                  useDefault="true"
+                ></cd-icon>
+              </div>
+              <span i18n>Capacity critically low</span>
+            </cds-tag>
+          }
+        </h5>
+      } @else {
+        <cds-skeleton-text
+          [lines]="1"
+          [minLineWidth]="400"
+          [maxLineWidth]="400"
+        >
+        </cds-skeleton-text>
+      }
+    </div>
+  } @else {
     <cd-empty-state
       text="You can view capacity usage and related metrics here once you add storage."
       title="Storage is not configured yet"
       i18n-title
-      i18n-text>
+      i18n-text
+    >
       <button
         cdsButton="primary"
         i18n
         size="sm"
         [routerLink]="['/add-storage']"
         type="button"
-        >
+      >
         Add storage
         <cd-icon
           type="add"
-          class="cds--btn__icon"></cd-icon>
+          class="cds--btn__icon"
+        ></cd-icon>
       </button>
     </cd-empty-state>
   }
   <!-- CAPACITY BREAKDOWN CHART -->
   @if (!prometheusEmptyState && !storageEmptyState) {
-  @if(isBreakdownLoaded) {
-  <ibm-meter-chart
-    [options]="options"
-    [data]="breakdownData"
-    class="overview-storage-card-chart"></ibm-meter-chart>
-  } @else {
-  <cds-skeleton-text
-    [lines]="1"
-    [minLineWidth]="1200"
-    [maxLineWidth]="1200">
-  </cds-skeleton-text>
-}
-  <!-- DATA CONSUMPTION TREND -->
-  @if(consumptionTrendData.length) {
-  <div cdsRow
-       class="align-items-center cds-ml-2 cds-mt-6">
-    <div cdsCol
-         [columnNumbers]="{ lg: 14, md: 10, sm: 16 }">
-      <cd-area-chart chartTitle="Consumption trend"
-                     [chartKey]="'Consumption trend'"
-                     [dataUnit]="'B'"
-                     [legendEnabled]="false"
-                     [rawData]="consumptionTrendData"
-                     [subHeading]="'Shows last 7 days of storage consumption trends based on recent usage'"
-                     [height]="'200px'"
-                     [decimals]="2"
-                     [chartType]="'area'">
-      </cd-area-chart>
-    </div>
-    <div cdsCol
-         [columnNumbers]="{ lg: 2, md: 8, sm: 8 }">
-      <div cdsStack="vertical"
-           gap="4">
-        <div cdsStack="vertical"
-             gap="1">
-          <span class="cds--type-heading-03">{{ estimatedTimeUntilFull }}</span>
-          <div class="consumption-stats-wrapper">
-            <cds-tooltip-definition
-              [autoAlign]="true"
-              [highContrast]="true"
-              [openOnHover]="false"
-              [dropShadow]="true"
-              [caret]="true"
-              description="Based on recent average consumption. Actual time until full may vary based on changes in consumption patterns."
-              i18n-description
-              i18n>
-              Estimated time until full
-            </cds-tooltip-definition>
-          </div>
+    @if (isBreakdownLoaded) {
+      <ibm-meter-chart
+        [options]="options"
+        [data]="breakdownData"
+        class="overview-storage-card-chart"
+      ></ibm-meter-chart>
+    } @else {
+      <cds-skeleton-text
+        [lines]="1"
+        [minLineWidth]="1200"
+        [maxLineWidth]="1200"
+      >
+      </cds-skeleton-text>
+    }
+    <!-- DATA CONSUMPTION TREND -->
+    @if (consumptionTrendData.length) {
+      <div
+        cdsRow
+        class="align-items-center cds-ml-2 cds-mt-6"
+      >
+        <div
+          cdsCol
+          [columnNumbers]="{ lg: 14, md: 10, sm: 16 }"
+        >
+          <cd-area-chart
+            chartTitle="Consumption trend"
+            [chartKey]="'Consumption trend'"
+            [dataUnit]="'B'"
+            [legendEnabled]="false"
+            [rawData]="consumptionTrendData"
+            [subHeading]="'Shows last 7 days of storage consumption trends based on recent usage'"
+            [height]="'200px'"
+            [decimals]="2"
+            [chartType]="'area'"
+          >
+          </cd-area-chart>
         </div>
-        <div cdsStack="vertical"
-             gap="1">
-          <span class="cds--type-heading-03">{{ averageDailyConsumption }}</span>
-          <div class="consumption-stats-wrapper">
-            <cds-tooltip-definition
-              [autoAlign]="true"
-              [highContrast]="true"
-              [openOnHover]="false"
-              [dropShadow]="true"
-              [caret]="true"
-              description="Based on the average daily consumption over the last 7 days"
-              i18n-description
-              i18n>
-              Average consumption
-            </cds-tooltip-definition>
+        <div
+          cdsCol
+          [columnNumbers]="{ lg: 2, md: 8, sm: 8 }"
+        >
+          <div
+            cdsStack="vertical"
+            gap="4"
+          >
+            <div
+              cdsStack="vertical"
+              gap="1"
+            >
+              <span class="cds--type-heading-03">{{ estimatedTimeUntilFull }}</span>
+              <div class="consumption-stats-wrapper">
+                <cds-tooltip-definition
+                  [autoAlign]="true"
+                  [highContrast]="true"
+                  [openOnHover]="false"
+                  [dropShadow]="true"
+                  [caret]="true"
+                  description="Based on recent average consumption. Actual time until full may vary based on changes in consumption patterns."
+                  i18n-description
+                  i18n
+                >
+                  Estimated time until full
+                </cds-tooltip-definition>
+              </div>
+            </div>
+            <div
+              cdsStack="vertical"
+              gap="1"
+            >
+              <span class="cds--type-heading-03">{{ averageDailyConsumption }}</span>
+              <div class="consumption-stats-wrapper">
+                <cds-tooltip-definition
+                  [autoAlign]="true"
+                  [highContrast]="true"
+                  [openOnHover]="false"
+                  [dropShadow]="true"
+                  [caret]="true"
+                  description="Based on the average daily consumption over the last 7 days"
+                  i18n-description
+                  i18n
+                >
+                  Average consumption
+                </cds-tooltip-definition>
+              </div>
+            </div>
           </div>
         </div>
       </div>
-    </div>
-  </div>
+    }
   }
-}
 </cd-productive-card>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/performance-counter/performance-counter.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/performance-counter/performance-counter.component.html
index 988a8a25219..ab2abaa4222 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/performance-counter/performance-counter.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/performance-counter/performance-counter.component.html
@@ -1,4 +1,6 @@
 <legend>{{ serviceType }}.{{ serviceId }}</legend>
-<cd-table-performance-counter [serviceType]="serviceType"
-                              [serviceId]="serviceId">
+<cd-table-performance-counter
+  [serviceType]="serviceType"
+  [serviceId]="serviceId"
+>
 </cd-table-performance-counter>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/table-performance-counter/table-performance-counter.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/table-performance-counter/table-performance-counter.component.html
index e8e6624d802..33f026f2438 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/table-performance-counter/table-performance-counter.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/performance-counter/table-performance-counter/table-performance-counter.component.html
@@ -1,15 +1,22 @@
-<cd-table *ngIf="counters; else warning"
-          [data]="counters"
-          [columns]="columns"
-          columnMode="flex"
-          [autoSave]="false"
-          (fetchData)="getCounters($event)">
-  <ng-template #valueTpl
-               let-row="data.row">
+<cd-table
+  *ngIf="counters; else warning"
+  [data]="counters"
+  [columns]="columns"
+  columnMode="flex"
+  [autoSave]="false"
+  (fetchData)="getCounters($event)"
+>
+  <ng-template
+    #valueTpl
+    let-row="data.row"
+  >
     {{ row.value | dimless }} {{ row.unit }}
   </ng-template>
 </cd-table>
 <ng-template #warning>
-  <cd-alert-panel type="warning"
-                  i18n>Performance counters not available</cd-alert-panel>
+  <cd-alert-panel
+    type="warning"
+    i18n
+    >Performance counters not available</cd-alert-panel
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/crush-rule-form-modal/crush-rule-form-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/crush-rule-form-modal/crush-rule-form-modal.component.html
index 5699d556e0c..285a12265bd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/crush-rule-form-modal/crush-rule-form-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/crush-rule-form-modal/crush-rule-form-modal.component.html
@@ -4,9 +4,7 @@
   [hasScrollingContent]="false"
   (overlaySelected)="closeModal()"
 >
-  <cds-modal-header
-    (closeSelect)="closeModal()"
-  >
+  <cds-modal-header (closeSelect)="closeModal()">
     <h3
       cdsModalHeaderHeading
       i18n
@@ -15,9 +13,7 @@
     </h3>
   </cds-modal-header>
 
-  <ng-container
-    class="modal-content"
-  >
+  <ng-container class="modal-content">
     <form
       [formGroup]="form"
       novalidate
@@ -26,9 +22,7 @@
         cdsModalContent
         class="modal-wrapper"
       >
-        <div
-          class="form-item"
-        >
+        <div class="form-item">
           <cds-text-label
             [invalid]="!form.controls.name.valid && form.controls.name.dirty"
             [invalidText]="nameError"
@@ -43,40 +37,36 @@
             />
           </cds-text-label>
 
-          <ng-template
-            #nameError
-          >
+          <ng-template #nameError>
             @if (form.showError('name', formDir, 'required')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              This field is required!
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                This field is required!
+              </span>
             }
             @if (form.showError('name', formDir, 'pattern')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              The name can only consist of alphanumeric characters, dashes and underscores.
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                The name can only consist of alphanumeric characters, dashes and underscores.
+              </span>
             }
             @if (form.showError('name', formDir, 'uniqueName')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              The chosen erasure code profile name is already in use.
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                The chosen erasure code profile name is already in use.
+              </span>
             }
           </ng-template>
         </div>
 
         <!-- Root -->
-        <div
-          class="form-item"
-        >
+        <div class="form-item">
           <cds-dropdown
             label="Root"
             id="root"
@@ -86,29 +76,22 @@
             [invalidText]="rootError"
             i18n
           >
-            <cds-dropdown-list
-              [items]="buckets"
-            >
-            </cds-dropdown-list>
+            <cds-dropdown-list [items]="buckets"> </cds-dropdown-list>
           </cds-dropdown>
-          <ng-template
-            #rootError
-          >
+          <ng-template #rootError>
             @if (form.showError('root', formDir, 'required')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              This field is required!
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                This field is required!
+              </span>
             }
           </ng-template>
         </div>
 
         <!-- Failure Domain -->
-        <div
-          class="form-item"
-        >
+        <div class="form-item">
           <cds-select
             label="Failure domain type"
             id="failure_domain"
@@ -119,24 +102,14 @@
             i18n
           >
             @if (!failureDomains) {
-            <option
-              value=""
-            >
-              Loading...
-            </option>
+              <option value="">Loading...</option>
             }
             @for (domain of failureDomainKeys; track domain) {
-            <option
-              [value]="domain"
-            >
-              {{ domain }} ( {{failureDomains[domain].length}} )
-            </option>
+              <option [value]="domain">{{ domain }} ( {{ failureDomains[domain].length }} )</option>
             }
           </cds-select>
 
-          <ng-template
-            #failureDomainError
-          >
+          <ng-template #failureDomainError>
             <span
               class="invalid-feedback"
               i18n
@@ -147,9 +120,7 @@
         </div>
 
         <!-- Class -->
-        <div
-          class="form-item"
-        >
+        <div class="form-item">
           <cds-select
             label="Device class"
             id="device_class"
@@ -159,23 +130,15 @@
             [helperText]="tooltips.device_class"
             i18n
           >
-            <option
-              value=""
-            >
-              All devices
-            </option>
+            <option value="">All devices</option>
             @for (deviceClass of devices; track deviceClass) {
-            <option
-              [value]="deviceClass"
-            >
-              {{ deviceClass }}
-            </option>
+              <option [value]="deviceClass">
+                {{ deviceClass }}
+              </option>
             }
           </cds-select>
 
-          <ng-template
-            #deviceClassError
-          >
+          <ng-template #deviceClassError>
             <span
               class="invalid-feedback"
               i18n
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
index 3f58b19c88c..99a6fa77b0a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
@@ -4,9 +4,7 @@
   [hasScrollingContent]="true"
   (overlaySelected)="closeModal()"
 >
-  <cds-modal-header
-    (closeSelect)="closeModal()"
-  >
+  <cds-modal-header (closeSelect)="closeModal()">
     <h3
       cdsModalHeaderHeading
       i18n
@@ -25,9 +23,7 @@
       novalidate
     >
       <!-- Name -->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-text-label
           [invalid]="!form.controls.name.valid && form.controls.name.dirty"
           [invalidText]="nameError"
@@ -43,40 +39,36 @@
             placeholder="Add issue title"
           />
         </cds-text-label>
-        <ng-template
-          #nameError
-        >
+        <ng-template #nameError>
           @if (form.showError('name', formDir, 'required')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            This field is required!
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              This field is required!
+            </span>
           }
           @if (form.showError('name', formDir, 'pattern')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            The name can only consist of alphanumeric characters, dashes and underscores.
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              The name can only consist of alphanumeric characters, dashes and underscores.
+            </span>
           }
           @if (form.showError('name', formDir, 'uniqueName')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            The chosen erasure code profile name is already in use.
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              The chosen erasure code profile name is already in use.
+            </span>
           }
         </ng-template>
       </div>
 
       <!-- Plugin -->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-select
           [label]="pluginLabelTpl"
           id="plugin"
@@ -86,29 +78,23 @@
           i18n
         >
           @if (!plugins) {
-          <option
-            value=""
-          >
-            Loading...
-          </option>
+            <option value="">Loading...</option>
           }
           @for (plugin of plugins; track plugin) {
-          <option
-            [value]="plugin"
-            [selected]="plugin === PLUGIN.ISA"
-          >
-            @if(plugin === PLUGIN.JERASURE) {
-              {{ plugin | upperFirst }}
-            } @else {
-              {{ plugin | uppercase }}
-            }
-          </option>
+            <option
+              [value]="plugin"
+              [selected]="plugin === PLUGIN.ISA"
+            >
+              @if (plugin === PLUGIN.JERASURE) {
+                {{ plugin | upperFirst }}
+              } @else {
+                {{ plugin | uppercase }}
+              }
+            </option>
           }
         </cds-select>
 
-        <ng-template
-          #pluginError
-        >
+        <ng-template #pluginError>
           <span
             class="invalid-feedback"
             i18n
@@ -117,21 +103,14 @@
           </span>
         </ng-template>
 
-        <ng-template
-          #pluginLabelTpl
-        >
+        <ng-template #pluginLabelTpl>
           Plugin
-          <cd-helper
-            [html]="tooltips.plugins[plugin].description"
-          >
-          </cd-helper>
+          <cd-helper [html]="tooltips.plugins[plugin].description"> </cd-helper>
         </ng-template>
       </div>
 
       <!-- Data Chunk k -->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-number
           id="k"
           label="Data chunks (k)"
@@ -144,72 +123,74 @@
           i18n
         >
         </cds-number>
-        <ng-template
-          #dataChunkError
-        >
+        <ng-template #dataChunkError>
           @if (form.showError('k', formDir, 'required')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            This field is required!
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              This field is required!
+            </span>
           }
           @if (form.showError('k', formDir, 'min')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Must be equal to or greater than 2.
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Must be equal to or greater than 2.
+            </span>
           }
-          @if (form.showError('k', formDir, 'max') && form.getValue('crushFailureDomain') === CrushFailureDomains.Osd) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Chunks (k+m) have exceeded the available OSDs of {{deviceCount}}.
-          </span>
+          @if (
+            form.showError('k', formDir, 'max') &&
+            form.getValue('crushFailureDomain') === CrushFailureDomains.Osd
+          ) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Chunks (k+m) have exceeded the available OSDs of {{ deviceCount }}.
+            </span>
           }
-          @if (form.showError('k', formDir, 'max') && form.getValue('crushFailureDomain') === CrushFailureDomains.Host) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Chunks (k+m+1) have exceeded the available hosts of {{deviceCount}}.
-          </span>
+          @if (
+            form.showError('k', formDir, 'max') &&
+            form.getValue('crushFailureDomain') === CrushFailureDomains.Host
+          ) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Chunks (k+m+1) have exceeded the available hosts of {{ deviceCount }}.
+            </span>
           }
           @if (form.showError('k', formDir, 'unequal')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            For an equal distribution k has to be a multiple of (k+m)/l.
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              For an equal distribution k has to be a multiple of (k+m)/l.
+            </span>
           }
           @if (form.showError('k', formDir, 'kLowerM')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            K has to be equal to or greater than m in order to recover data correctly through c.
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              K has to be equal to or greater than m in order to recover data correctly through c.
+            </span>
           }
           @if (plugin === 'lrc') {
-          <span
-            class="form-text text-muted"
-            i18n
-          >
-            Distribution factor: {{lrcMultiK}}
-          </span>
+            <span
+              class="form-text text-muted"
+              i18n
+            >
+              Distribution factor: {{ lrcMultiK }}
+            </span>
           }
         </ng-template>
       </div>
 
       <!-- Coding chunks (m) -->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-number
           id="m"
           label="Coding chunks (m)"
@@ -223,273 +204,248 @@
         </cds-number>
         <ng-template #codeChunkError>
           @if (form.showError('m', formDir, 'required')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            This field is required!
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              This field is required!
+            </span>
           }
           @if (form.showError('m', formDir, 'min')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Must be equal to or greater than 1.
-          </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Must be equal to or greater than 1.
+            </span>
           }
-          @if (form.showError('m', formDir, 'max') && form.getValue('crushFailureDomain') ===  CrushFailureDomains.Osd) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Chunks (k+m) have exceeded the available OSDs of {{deviceCount}}.
-          </span>
+          @if (
+            form.showError('m', formDir, 'max') &&
+            form.getValue('crushFailureDomain') === CrushFailureDomains.Osd
+          ) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Chunks (k+m) have exceeded the available OSDs of {{ deviceCount }}.
+            </span>
           }
-          @if (form.showError('m', formDir, 'max') && form.getValue('crushFailureDomain') ===  CrushFailureDomains.Host) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Chunks (k+m+1) have exceeded the available hosts of {{deviceCount}}.
-          </span>
+          @if (
+            form.showError('m', formDir, 'max') &&
+            form.getValue('crushFailureDomain') === CrushFailureDomains.Host
+          ) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Chunks (k+m+1) have exceeded the available hosts of {{ deviceCount }}.
+            </span>
           }
         </ng-template>
       </div>
 
       <!-- Durability estimator (c) -->
       @if (plugin === 'shec') {
-      <div
-        class="form-item"
-      >
-        <cds-number
-          id="c"
-          label="Durability estimator (c)"
-          [helperText]="tooltips.c"
-          min="1"
-          [invalid]="!form.controls.c.valid && form.controls.c.dirty"
-          [invalidText]="durabilityError"
-          formControlName="c"
-          i18n
-        >
-        </cds-number>
-        <ng-template
-          #durabilityError
-        >
-          @if (form.showError('c', formDir, 'min')) {
-          <span
-            class="invalid-feedback"
+        <div class="form-item">
+          <cds-number
+            id="c"
+            label="Durability estimator (c)"
+            [helperText]="tooltips.c"
+            min="1"
+            [invalid]="!form.controls.c.valid && form.controls.c.dirty"
+            [invalidText]="durabilityError"
+            formControlName="c"
             i18n
           >
-            Must be equal to or greater than 1.
-          </span>
-          }
-          @if (form.showError('c', formDir, 'cGreaterM')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            C has to be equal to or lower than m as m defines the amount of chunks that can be used.
-          </span>
-          }
-        </ng-template>
-      </div>
+          </cds-number>
+          <ng-template #durabilityError>
+            @if (form.showError('c', formDir, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                Must be equal to or greater than 1.
+              </span>
+            }
+            @if (form.showError('c', formDir, 'cGreaterM')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                C has to be equal to or lower than m as m defines the amount of chunks that can be
+                used.
+              </span>
+            }
+          </ng-template>
+        </div>
       }
 
       <!--Helper chunks (d)-->
       @if (plugin === PLUGIN.CLAY) {
-      <div
-        cdsRow
-        class="form-item form-item-append"
-      >
         <div
-          cdsCol
-          [columnNumbers]="{ lg: 15 }"
+          cdsRow
+          class="form-item form-item-append"
         >
-          <cds-number
-            id="d"
-            [label]="labelTpl"
-            [helperText]="dCalc ? dCalcTooltip : dHelper"
-            [invalid]="form.controls.d.invalid && form.controls.d.dirty"
-            [invalidText]="dError"
-            formControlName="d"
-            i18n
+          <div
+            cdsCol
+            [columnNumbers]="{ lg: 15 }"
           >
-          </cds-number>
-        </div>
-
-        <div
-          cdsCol
-          [columnNumbers]="{ lg: 1 }"
-          class="item-action-btn"
-        >
-          @if(dCalc) {
-          <cds-icon-button
-            data-testid="d-calc-btn"
-            kind="primary"
-            size="sm"
-            (click)="toggleDCalc()"
-          >
-            <svg
-              cdsIcon="unlocked"
-              size="16"
-              class="cds--btn__icon"
-            >
-            </svg>
-          </cds-icon-button>
-          } @else {
-            <cds-icon-button
-            data-testid="d-calc-btn"
-            kind="primary"
-            size="sm"
-            (click)="toggleDCalc()"
-          >
-            <svg
-              cdsIcon="locked"
-              size="16"
-              class="cds--btn__icon"
-            >
-            </svg>
-          </cds-icon-button>
-          }
-        </div>
-        <ng-template
-          #dHelper
-        >
-          <span>
-            @if (!dCalc && (getDMin() < getDMax())) {
-            <p
-              class="form-text text-muted"
+            <cds-number
+              id="d"
+              [label]="labelTpl"
+              [helperText]="dCalc ? dCalcTooltip : dHelper"
+              [invalid]="form.controls.d.invalid && form.controls.d.dirty"
+              [invalidText]="dError"
+              formControlName="d"
               i18n
             >
-              D can be set from {{getDMin()}} to {{getDMax()}}
-            </p>
-            }
-            @if (!dCalc && getDMin() === getDMax()) {
-            <p
-              class="form-text text-muted"
-              i18n
-            >
-              D can only be set to {{getDMax()}}
-            </p>
-            }
-          </span>
-        </ng-template>
-        <ng-template
-          #dCalcTooltip
-        >
-          <span
-            i18n
-          >
-            D is automatically updated on k and m changes
-          </span>
-        </ng-template>
-        <ng-template
-          #dError
-        >
-          @if (form.showError('d', formDir, 'dMin')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            D has to be greater than k ( {{getDMin()}} ).
-          </span>
-          }
-          @if (form.showError('d', formDir, 'dMax')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            D has to be lower than k + m ( {{getDMax()}} ).
-          </span>
-          }
-        </ng-template>
+            </cds-number>
+          </div>
 
-        <ng-template
-          #labelTpl
-        >
-          Helper chunks (d)
-          <cd-helper
-            [html]="tooltips.plugins.clay.d"
+          <div
+            cdsCol
+            [columnNumbers]="{ lg: 1 }"
+            class="item-action-btn"
           >
-          </cd-helper>
-        </ng-template>
-      </div>
+            @if (dCalc) {
+              <cds-icon-button
+                data-testid="d-calc-btn"
+                kind="primary"
+                size="sm"
+                (click)="toggleDCalc()"
+              >
+                <svg
+                  cdsIcon="unlocked"
+                  size="16"
+                  class="cds--btn__icon"
+                ></svg>
+              </cds-icon-button>
+            } @else {
+              <cds-icon-button
+                data-testid="d-calc-btn"
+                kind="primary"
+                size="sm"
+                (click)="toggleDCalc()"
+              >
+                <svg
+                  cdsIcon="locked"
+                  size="16"
+                  class="cds--btn__icon"
+                ></svg>
+              </cds-icon-button>
+            }
+          </div>
+          <ng-template #dHelper>
+            <span>
+              @if (!dCalc && getDMin() < getDMax()) {
+                <p
+                  class="form-text text-muted"
+                  i18n
+                >
+                  D can be set from {{ getDMin() }} to {{ getDMax() }}
+                </p>
+              }
+              @if (!dCalc && getDMin() === getDMax()) {
+                <p
+                  class="form-text text-muted"
+                  i18n
+                >
+                  D can only be set to {{ getDMax() }}
+                </p>
+              }
+            </span>
+          </ng-template>
+          <ng-template #dCalcTooltip>
+            <span i18n> D is automatically updated on k and m changes </span>
+          </ng-template>
+          <ng-template #dError>
+            @if (form.showError('d', formDir, 'dMin')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                D has to be greater than k ( {{ getDMin() }} ).
+              </span>
+            }
+            @if (form.showError('d', formDir, 'dMax')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                D has to be lower than k + m ( {{ getDMax() }} ).
+              </span>
+            }
+          </ng-template>
+
+          <ng-template #labelTpl>
+            Helper chunks (d)
+            <cd-helper [html]="tooltips.plugins.clay.d"> </cd-helper>
+          </ng-template>
+        </div>
       }
 
       <!-- Locality (l) -->
       @if (plugin === PLUGIN.LRC) {
-      <div
-        cdsrow
-        class="form-item form-item-append"
-      >
-        <cds-number
-          id="l"
-          [label]="localityLabelTpl"
-          [helperText]="lHelper"
-          [invalid]="form.controls.l.invalid && (form.controls.l.dirty || form.controls.l.touched)"
-          [invalidText]="lError"
-          formControlName="l"
-          min="1"
-          placeholder="Coding chunks..."
-          i18n
-          i18n-helperText
+        <div
+          cdsrow
+          class="form-item form-item-append"
         >
-        </cds-number>
-
-        <ng-template
-          #lHelper
-        >
-          <span>
-            Locality groups: {{lrcGroups}}
-          </span>
-        </ng-template>
-
-        <ng-template
-          #lError
-        >
-          @if (form.showError('l', formDir, 'required')) {
-          <span
-            class="invalid-feedback"
+          <cds-number
+            id="l"
+            [label]="localityLabelTpl"
+            [helperText]="lHelper"
+            [invalid]="
+              form.controls.l.invalid && (form.controls.l.dirty || form.controls.l.touched)
+            "
+            [invalidText]="lError"
+            formControlName="l"
+            min="1"
+            placeholder="Coding chunks..."
             i18n
+            i18n-helperText
           >
-            This field is required!
-          </span>
-          }
-          @if (form.showError('l', formDir, 'min')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Must be equal to or greater than 1.
-          </span>
-          }
-          @if (form.showError('l', formDir, 'unequal')) {
-          <span
-            class="invalid-feedback"
-            i18n
-          >
-            Can't split up chunks (k+m) correctly with the current locality.
-          </span>
-          }
-        </ng-template>
+          </cds-number>
 
-        <ng-template
-          #localityLabelTpl
-        >
-          Locality (l)
-          <cd-helper
-            [html]="tooltips.plugins.lrc.l"
-          >
-          </cd-helper>
-        </ng-template>
-      </div>
+          <ng-template #lHelper>
+            <span> Locality groups: {{ lrcGroups }} </span>
+          </ng-template>
+
+          <ng-template #lError>
+            @if (form.showError('l', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                This field is required!
+              </span>
+            }
+            @if (form.showError('l', formDir, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                Must be equal to or greater than 1.
+              </span>
+            }
+            @if (form.showError('l', formDir, 'unequal')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                Can't split up chunks (k+m) correctly with the current locality.
+              </span>
+            }
+          </ng-template>
+
+          <ng-template #localityLabelTpl>
+            Locality (l)
+            <cd-helper [html]="tooltips.plugins.lrc.l"> </cd-helper>
+          </ng-template>
+        </div>
       }
 
       <!-- Crush failure domain-->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-select
           label="Crush failure domain"
           id="crushFailureDomain"
@@ -497,21 +453,17 @@
           [helperText]="tooltips.crushFailureDomain"
           i18n
         >
-        @if (!failureDomains) {
-          <option
-            value=""
-          >
-            Loading...
-          </option>
-        }
-        @for (domain of failureDomainKeys; track domain) {
-          <option
-            [value]="domain"
-            [selected]="domain.toLowerCase() === CrushFailureDomains.Host"
-          >
-            {{ domain }} ( {{failureDomains[domain].length}} )
-          </option>
-        }
+          @if (!failureDomains) {
+            <option value="">Loading...</option>
+          }
+          @for (domain of failureDomainKeys; track domain) {
+            <option
+              [value]="domain"
+              [selected]="domain.toLowerCase() === CrushFailureDomains.Host"
+            >
+              {{ domain }} ( {{ failureDomains[domain].length }} )
+            </option>
+          }
         </cds-select>
       </div>
 
@@ -532,15 +484,16 @@
           i18n
         >
         </cds-number>
-        <ng-template
-          #crushNumFailureDomainsError
-        >
+        <ng-template #crushNumFailureDomainsError>
           <ng-container
-            *ngTemplateOutlet="crushFailureDomainValidationErrors; context: {
-            control: form.get('crushNumFailureDomains'),
-            requiredText: 'This field is required when crush osds per failure domain is set!',
-            showMaxFailureDomains: true
-            }"
+            *ngTemplateOutlet="
+              crushFailureDomainValidationErrors;
+              context: {
+                control: form.get('crushNumFailureDomains'),
+                requiredText: 'This field is required when crush osds per failure domain is set!',
+                showMaxFailureDomains: true
+              }
+            "
           >
           </ng-container>
         </ng-template>
@@ -563,15 +516,16 @@
           i18n
         >
         </cds-number>
-        <ng-template
-          #crushOsdsPerFailureDomainError
-        >
+        <ng-template #crushOsdsPerFailureDomainError>
           <ng-container
-            *ngTemplateOutlet="crushFailureDomainValidationErrors; context: {
-            control: form.get('crushOsdsPerFailureDomain'),
-            requiredText: 'This field is required when crush num failure domain is set!',
-            showMaxFailureDomains: false
-            }"
+            *ngTemplateOutlet="
+              crushFailureDomainValidationErrors;
+              context: {
+                control: form.get('crushOsdsPerFailureDomain'),
+                requiredText: 'This field is required when crush num failure domain is set!',
+                showMaxFailureDomains: false
+              }
+            "
           >
           </ng-container>
         </ng-template>
@@ -584,173 +538,147 @@
         let-showMaxFailureDomains="showMaxFailureDomains"
       >
         @if (control?.errors) {
-        @if (control.hasError('required')) {
-        <span
-          class="invalid-feedback"
-          i18n
-        >
-          {{ requiredText }}
-        </span>
-        }
-        @if (showMaxFailureDomains && control.hasError('maxFailureDomains')) {
-        <span
-          class="invalid-feedback"
-          i18n
-        >
-          The number of failure domains ({{ form.controls.crushNumFailureDomains.value }}) cannot exceed the available count ({{ failureDomains[form.controls.crushFailureDomain.value]?.length || 0 }}) for the selected failure domain type ({{ form.controls.crushFailureDomain.value }}).
-        </span>
-        }
-        @if (control.hasError('pattern')) {
-        <span
-          class="invalid-feedback"
-          i18n
-        >
-          Enter a valid positive number
-        </span>
-        }
+          @if (control.hasError('required')) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              {{ requiredText }}
+            </span>
+          }
+          @if (showMaxFailureDomains && control.hasError('maxFailureDomains')) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              The number of failure domains ({{ form.controls.crushNumFailureDomains.value }})
+              cannot exceed the available count ({{
+                failureDomains[form.controls.crushFailureDomain.value]?.length || 0
+              }}) for the selected failure domain type ({{
+                form.controls.crushFailureDomain.value
+              }}).
+            </span>
+          }
+          @if (control.hasError('pattern')) {
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              Enter a valid positive number
+            </span>
+          }
         }
       </ng-template>
 
       <!-- Crush locality -->
       @if (plugin === PLUGIN.LRC) {
-      <div
-        class="form-item"
-      >
-        <cds-select
-          label="Crush Locality"
-          id="crushLocality"
-          [helperText]="tooltips.plugins.lrc.crushLocality"
-          formControlName="crushLocality"
-          i18n
-        >
-          @if (!failureDomains) {
-          <option
-            value=""
+        <div class="form-item">
+          <cds-select
+            label="Crush Locality"
+            id="crushLocality"
+            [helperText]="tooltips.plugins.lrc.crushLocality"
+            formControlName="crushLocality"
+            i18n
           >
-            Loading...
-          </option>
-          }
-          @if (failureDomainKeys.length > 0) {
-          <option
-            value=""
-          >
-            None
-          </option>
-          }
-          @for (domain of failureDomainKeys; track domain) {
-          <option
-            [value]="domain"
-          >
-            {{ domain }} ( {{failureDomains[domain].length}} )
-          </option>
-          }
-        </cds-select>
-      </div>
+            @if (!failureDomains) {
+              <option value="">Loading...</option>
+            }
+            @if (failureDomainKeys.length > 0) {
+              <option value="">None</option>
+            }
+            @for (domain of failureDomainKeys; track domain) {
+              <option [value]="domain">{{ domain }} ( {{ failureDomains[domain].length }} )</option>
+            }
+          </cds-select>
+        </div>
       }
 
       <!-- Scalar mds -->
       @if (PLUGIN.CLAY === plugin) {
-      <div
-        class="form-item"
-      >
-        <cds-select
-          label="Scalar mds"
-          id="scalar_mds"
-          formControlName="scalar_mds"
-          [helperText]="tooltips.plugins.clay.scalar_mds"
-          i18n
-        >
-          @for (plugin of [PLUGIN.JERASURE, PLUGIN.ISA, PLUGIN.SHEC]; track plugin) {
-          <option
-            [value]="plugin"
+        <div class="form-item">
+          <cds-select
+            label="Scalar mds"
+            id="scalar_mds"
+            formControlName="scalar_mds"
+            [helperText]="tooltips.plugins.clay.scalar_mds"
+            i18n
           >
-            {{ plugin }}
-          </option>
-          }
-        </cds-select>
-      </div>
+            @for (plugin of [PLUGIN.JERASURE, PLUGIN.ISA, PLUGIN.SHEC]; track plugin) {
+              <option [value]="plugin">
+                {{ plugin }}
+              </option>
+            }
+          </cds-select>
+        </div>
       }
 
       <!-- Technique -->
       @if ([PLUGIN.JERASURE, PLUGIN.ISA, PLUGIN.CLAY].includes(plugin)) {
-      <div
-        class="form-item"
-      >
-        <cds-select
-          label="Technique"
-          id="technique"
-          formControlName="technique"
-          [helperText]="tooltips.plugins[plugin]?.technique"
-          i18n
-        >
-          @for (technique of techniques; track technique) {
-          <option
-            [value]="technique"
+        <div class="form-item">
+          <cds-select
+            label="Technique"
+            id="technique"
+            formControlName="technique"
+            [helperText]="tooltips.plugins[plugin]?.technique"
+            i18n
           >
-            {{ technique }}
-          </option>
-          }
-        </cds-select>
-      </div>
+            @for (technique of techniques; track technique) {
+              <option [value]="technique">
+                {{ technique }}
+              </option>
+            }
+          </cds-select>
+        </div>
       }
 
       <!-- Packetsize -->
       @if (plugin === PLUGIN.JERASURE) {
-      <div
-        cdsrow
-        class="form-item"
-      >
-        <cds-number
-          id="packetSize"
-          label="Packetsize"
-          [helperText]="tooltips.plugins.jerasure.packetSize"
-          [invalid]="form.controls.packetSize.invalid && form.controls.packetSize.dirty"
-          [invalidText]="packetSizeError"
-          formControlName="packetSize"
-          min="1"
-          i18n
+        <div
+          cdsrow
+          class="form-item"
         >
-        </cds-number>
-        <ng-template
-          #packetSizeError
-        >
-          @if (form.showError('packetSize', formDir, 'min')) {
-          <span
-            class="invalid-feedback"
+          <cds-number
+            id="packetSize"
+            label="Packetsize"
+            [helperText]="tooltips.plugins.jerasure.packetSize"
+            [invalid]="form.controls.packetSize.invalid && form.controls.packetSize.dirty"
+            [invalidText]="packetSizeError"
+            formControlName="packetSize"
+            min="1"
             i18n
           >
-            Must be equal to or greater than 1.
-          </span>
-          }
-        </ng-template>
-      </div>
+          </cds-number>
+          <ng-template #packetSizeError>
+            @if (form.showError('packetSize', formDir, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                Must be equal to or greater than 1.
+              </span>
+            }
+          </ng-template>
+        </div>
       }
 
       <!-- Crush root -->
       @if ([PLUGIN.JERASURE, PLUGIN.ISA, PLUGIN.CLAY].includes(plugin)) {
-      <div
-        class="form-item"
-      >
-        <cds-dropdown
-          label="Crush root"
-          id="crushRoot"
-          formControlName="crushRoot"
-          [placeholder]="'Select crush root...'"
-          [helperText]="tooltips.crushRoot"
-          i18n-label
-        >
-          <cds-dropdown-list
-            [items]="buckets"
+        <div class="form-item">
+          <cds-dropdown
+            label="Crush root"
+            id="crushRoot"
+            formControlName="crushRoot"
+            [placeholder]="'Select crush root...'"
+            [helperText]="tooltips.crushRoot"
+            i18n-label
           >
-          </cds-dropdown-list>
-        </cds-dropdown>
-      </div>
+            <cds-dropdown-list [items]="buckets"> </cds-dropdown-list>
+          </cds-dropdown>
+        </div>
       }
 
       <!-- Crush device class -->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-select
           [label]="crushDeviceClassLabelTpl"
           id="crushDeviceClass"
@@ -759,17 +687,11 @@
           i18n
           i18n-helperText
         >
-          <option
-            value=""
-          >
-            All devices
-          </option>
+          <option value="">All devices</option>
           @for (deviceClass of devices; track deviceClass) {
-          <option
-            [value]="deviceClass"
-          >
-            {{ deviceClass }}
-          </option>
+            <option [value]="deviceClass">
+              {{ deviceClass }}
+            </option>
           }
         </cds-select>
 
@@ -778,20 +700,13 @@
           i18n
         >
           Crush device class
-          <cd-helper
-            [html]="tooltips.crushDeviceClass"
-          >
-          </cd-helper>
+          <cd-helper [html]="tooltips.crushDeviceClass"> </cd-helper>
         </ng-template>
       </div>
 
       <!-- Directory -->
-      <div
-        class="form-item"
-      >
-        <cds-text-label
-          [helperText]="tooltips.directory"
-        >
+      <div class="form-item">
+        <cds-text-label [helperText]="tooltips.directory">
           Directory
           <input
             cdsText
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.html
index 3052e1a440a..ac2ca68e915 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-details/pool-details.component.html
@@ -1,49 +1,75 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="pool-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="pool-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value [renderObjects]="true"
-                            [data]="poolDetails"
-                            [autoReload]="false">
+        <cd-table-key-value
+          [renderObjects]="true"
+          [data]="poolDetails"
+          [autoReload]="false"
+        >
         </cd-table-key-value>
       </ng-template>
     </ng-container>
-    <ng-container ngbNavItem="performance-details"
-                  *ngIf="permissions.grafana.read">
-      <a ngbNavLink
-         i18n>Performance Details</a>
+    <ng-container
+      ngbNavItem="performance-details"
+      *ngIf="permissions.grafana.read"
+    >
+      <a
+        ngbNavLink
+        i18n
+        >Performance Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="Pool details"
-                    grafanaPath="ceph-pool-details?var-pool_name={{selection.pool_name}}"
-                    [type]="'metrics'"
-                    uid="-xyV8KCiz"
-                    grafanaStyle="three">
+        <cd-grafana
+          i18n-title
+          title="Pool details"
+          grafanaPath="ceph-pool-details?var-pool_name={{ selection.pool_name }}"
+          [type]="'metrics'"
+          uid="-xyV8KCiz"
+          grafanaStyle="three"
+        >
         </cd-grafana>
       </ng-template>
     </ng-container>
-    <ng-container ngbNavItem="configuration"
-                  *ngIf="selection.type === 'replicated'">
-      <a ngbNavLink
-         i18n>Configuration</a>
+    <ng-container
+      ngbNavItem="configuration"
+      *ngIf="selection.type === 'replicated'"
+    >
+      <a
+        ngbNavLink
+        i18n
+        >Configuration</a
+      >
       <ng-template ngbNavContent>
         <cd-rbd-configuration-table [data]="selectedPoolConfiguration"></cd-rbd-configuration-table>
       </ng-template>
     </ng-container>
-    <ng-container ngbNavItem="cache-tiers-details"
-                  *ngIf="selection['tiers']?.length > 0">
-      <a ngbNavLink
-         i18n>Cache Tiers Details</a>
+    <ng-container
+      ngbNavItem="cache-tiers-details"
+      *ngIf="selection['tiers']?.length > 0"
+    >
+      <a
+        ngbNavLink
+        i18n
+        >Cache Tiers Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-table [data]="cacheTiers"
-                  [columns]="cacheTierColumns"
-                  [autoSave]="false"
-                  columnMode="flex">
+        <cd-table
+          [data]="cacheTiers"
+          [columns]="cacheTierColumns"
+          [autoSave]="false"
+          columnMode="flex"
+        >
         </cd-table>
       </ng-template>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.html
index dfcd7523a08..8543484f9ef 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.html
@@ -2,9 +2,7 @@
   cdsCol
   [columnNumbers]="{ md: 4 }"
 >
-  <ng-container
-    *cdFormLoading="loading"
-  >
+  <ng-container *cdFormLoading="loading">
     <form
       name="form"
       [formGroup]="form"
@@ -15,20 +13,18 @@
         class="form-header"
       >
         {{ action | titlecase }} {{ resource | upperFirst }}
-      @if (isStretchMode) {
-      <cd-help-text>
-        Stretch cluster is enabled. Only replicated pool type is supported in Stretch mode.
-      </cd-help-text>
-      }
+        @if (isStretchMode) {
+          <cd-help-text>
+            Stretch cluster is enabled. Only replicated pool type is supported in Stretch mode.
+          </cd-help-text>
+        }
       </div>
       <!-- Name -->
       <div
         class="form-item"
         cdsRow
       >
-        <div
-          cdsCol
-        >
+        <div cdsCol>
           <cds-text-label
             labelInputID="name"
             i18n
@@ -49,37 +45,37 @@
           </cds-text-label>
           <ng-template #nameError>
             @if (form.showError('name', formDir, 'required')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              This field is required!
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                This field is required!
+              </span>
             }
             @if (form.showError('name', formDir, 'uniqueName')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              The chosen Ceph pool name is already in use.
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                The chosen Ceph pool name is already in use.
+              </span>
             }
             @if (form.showError('name', formDir, 'rbdPool')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              It's not possible to create an RBD pool with '/' in the name. Please change the name
-              or remove 'rbd' from the applications list.
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                It's not possible to create an RBD pool with '/' in the name. Please change the name
+                or remove 'rbd' from the applications list.
+              </span>
             }
             @if (form.showError('name', formDir, 'pattern')) {
-            <span
-              class="invalid-feedback"
-              i18n
-            >
-              Pool name can only contain letters, numbers, '.', '-', '_' or '/'.
-            </span>
+              <span
+                class="invalid-feedback"
+                i18n
+              >
+                Pool name can only contain letters, numbers, '.', '-', '_' or '/'.
+              </span>
             }
           </ng-template>
         </div>
@@ -89,9 +85,7 @@
         class="form-item"
         cdsRow
       >
-        <div
-          cdsCol
-        >
+        <div cdsCol>
           <legend
             class="cds--label"
             i18n
@@ -99,233 +93,223 @@
             Pool type
           </legend>
           @if (isStretchMode) {
-          <cds-tooltip
-            description="In stretch mode, only replicated pool type is supported."
-            placement="right"
-            [highContrast]="true"
-            [caret]="true"
-          >
+            <cds-tooltip
+              description="In stretch mode, only replicated pool type is supported."
+              placement="right"
+              [highContrast]="true"
+              [caret]="true"
+            >
+              <cds-radio-group
+                formControlName="poolType"
+                cdRequiredField="Pool type"
+                data-testid="pool-type-select"
+              >
+                @for (poolType of data.poolTypes; track poolType) {
+                  <cds-radio
+                    [value]="poolType"
+                    [id]="poolType"
+                    [disabled]="isStretchMode && !editing && poolType === 'erasure'"
+                    (change)="data.erasureInfo = false; data.crushInfo = false"
+                    i18n
+                  >
+                    {{ poolType | upperFirst }}
+                  </cds-radio>
+                }
+              </cds-radio-group>
+            </cds-tooltip>
+          } @else {
             <cds-radio-group
               formControlName="poolType"
               cdRequiredField="Pool type"
               data-testid="pool-type-select"
             >
               @for (poolType of data.poolTypes; track poolType) {
-              <cds-radio
-                [value]="poolType"
-                [id]="poolType"
-                [disabled]="isStretchMode && !editing && poolType === 'erasure'"
-                (change)="data.erasureInfo = false; data.crushInfo = false;"
-                i18n
-              >
-                {{ poolType | upperFirst }}
-              </cds-radio>
+                <cds-radio
+                  [value]="poolType"
+                  [id]="poolType"
+                  [disabled]="isStretchMode && !editing && poolType === 'erasure'"
+                  (change)="data.erasureInfo = false; data.crushInfo = false"
+                  i18n
+                >
+                  {{ poolType | upperFirst }}
+                </cds-radio>
               }
             </cds-radio-group>
-          </cds-tooltip>
-          } @else {
-          <cds-radio-group
-            formControlName="poolType"
-            cdRequiredField="Pool type"
-            data-testid="pool-type-select"
-          >
-            @for (poolType of data.poolTypes; track poolType) {
-            <cds-radio
-              [value]="poolType"
-              [id]="poolType"
-              [disabled]="isStretchMode && !editing && poolType === 'erasure'"
-              (change)="data.erasureInfo = false; data.crushInfo = false;"
-              i18n
-            >
-              {{ poolType | upperFirst }}
-            </cds-radio>
-            }
-          </cds-radio-group>
           }
           @if (form.showError('poolType', formDir, 'required')) {
-          <span
-            class="cds--form-requirement invalid-feedback"
-            i18n
-          >
-            This field is required!
-          </span>
+            <span
+              class="cds--form-requirement invalid-feedback"
+              i18n
+            >
+              This field is required!
+            </span>
           }
         </div>
       </div>
       @if (isReplicated || isErasure) {
-      <div>
-        <!-- PG Autoscale Mode -->
-        <div
-          class="form-item"
-          cdsRow
-        >
+        <div>
+          <!-- PG Autoscale Mode -->
           <div
-            cdsCol
+            class="form-item"
+            cdsRow
           >
-            <cds-select
-              formControlName="pgAutoscaleMode"
-              [helperText]="poolService.formTooltips.pgAutoscaleModes[form.getValue('pgAutoscaleMode')]"
-              label="PG Autoscale"
-              i18n-label
-              id="pgAutoscaleMode"
-            >
-              @for (mode of pgAutoscaleModes; track mode) {
-              <option [value]="mode">
-                {{ mode }}
-              </option>
-              }
-            </cds-select>
-          </div>
-        </div>
-        <!-- Pg number -->
-        @if (form.getValue('pgAutoscaleMode') !== 'on') {
-        <div
-          class="form-item"
-          cdsRow
-        >
-          <div
-            cdsCol
-          >
-            <cds-number
-              label="Placement groups"
-              cdRequiredField="Placement groups"
-              [helperText]="calculationHelp"
-              min="1"
-              [invalid]="form.controls.pgNum.invalid && form.controls.pgNum.dirty"
-              [invalidText]="pgNumError"
-              formControlName="pgNum"
-              data-testid="pgNum"
-              (handleFocus)="externalPgChange = false"
-              (blur)="alignPgs()"
-              i18n
-            >
-            </cds-number>
-            <ng-template #pgNumError>
-              @if (form.showError('pgNum', formDir, 'required')) {
-              <span
-                class="invalid-feedback"
-                i18n
+            <div cdsCol>
+              <cds-select
+                formControlName="pgAutoscaleMode"
+                [helperText]="
+                  poolService.formTooltips.pgAutoscaleModes[form.getValue('pgAutoscaleMode')]
+                "
+                label="PG Autoscale"
+                i18n-label
+                id="pgAutoscaleMode"
               >
-                This field is required!
-              </span>
-              }
-              @if (form.showError('pgNum', formDir, 'min')) {
-              <span
-                class="invalid-feedback"
-                i18n
-              >
-                At least one placement group is needed!
-              </span>
-              }
-              @if (form.showError('pgNum', formDir, 'pgMax')) {
-              <span
-                class="invalid-feedback"
-                i18n
-              >
-                The specified PG is out of range. A value from {{ getMinPgs() }} to {{ getMaxPgs() }} is allowed.
-              </span>
-              }
-            </ng-template>
-            <ng-template #calculationHelp>
-              <span>
-                @if (externalPgChange) {
-                <span i18n>The current PGs settings were calculated for you, you should make sure the values suit your needs before submit. </span>
+                @for (mode of pgAutoscaleModes; track mode) {
+                  <option [value]="mode">
+                    {{ mode }}
+                  </option>
                 }
-                <cd-doc
-                  section="pgs"
-                  docText="Calculation help"
-                  i18n-docText
+              </cds-select>
+            </div>
+          </div>
+          <!-- Pg number -->
+          @if (form.getValue('pgAutoscaleMode') !== 'on') {
+            <div
+              class="form-item"
+              cdsRow
+            >
+              <div cdsCol>
+                <cds-number
+                  label="Placement groups"
+                  cdRequiredField="Placement groups"
+                  [helperText]="calculationHelp"
+                  min="1"
+                  [invalid]="form.controls.pgNum.invalid && form.controls.pgNum.dirty"
+                  [invalidText]="pgNumError"
+                  formControlName="pgNum"
+                  data-testid="pgNum"
+                  (handleFocus)="externalPgChange = false"
+                  (blur)="alignPgs()"
+                  i18n
                 >
-                </cd-doc>
-              </span>
-            </ng-template>
-          </div>
-        </div>
-        }
-        <!-- Replica Size -->
-        @if (isReplicated) {
-        <div
-          class="form-item"
-          cdsRow
-        >
-          <div
-            cdsCol
-          >
-            <cds-number
-              label="Replicated size"
-              cdRequiredField="Replicated size"
-              [invalid]="form.controls.size.invalid && form.controls.size.dirty"
-              [helperText]="sizeWarning"
-              [invalidText]="sizeError"
-              formControlName="size"
-              data-testid="size"
-              [max]="getMaxSize()"
-              [min]="getMinSize()"
-              (handleFocus)="externalPgChange = false"
-              (input)="alignPgs()"
-              i18n
-              i18n-helperText
+                </cds-number>
+                <ng-template #pgNumError>
+                  @if (form.showError('pgNum', formDir, 'required')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                    >
+                      This field is required!
+                    </span>
+                  }
+                  @if (form.showError('pgNum', formDir, 'min')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                    >
+                      At least one placement group is needed!
+                    </span>
+                  }
+                  @if (form.showError('pgNum', formDir, 'pgMax')) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                    >
+                      The specified PG is out of range. A value from {{ getMinPgs() }} to
+                      {{ getMaxPgs() }} is allowed.
+                    </span>
+                  }
+                </ng-template>
+                <ng-template #calculationHelp>
+                  <span>
+                    @if (externalPgChange) {
+                      <span i18n
+                        >The current PGs settings were calculated for you, you should make sure the
+                        values suit your needs before submit.
+                      </span>
+                    }
+                    <cd-doc
+                      section="pgs"
+                      docText="Calculation help"
+                      i18n-docText
+                    >
+                    </cd-doc>
+                  </span>
+                </ng-template>
+              </div>
+            </div>
+          }
+          <!-- Replica Size -->
+          @if (isReplicated) {
+            <div
+              class="form-item"
+              cdsRow
             >
-            </cds-number>
-            <ng-template #sizeError>
-              @if (form.showError('size', formDir)) {
-              <span
-                class="invalid-feedback"
-                i18n
-              >
-                Invalid input. Replicated size must be between {{ getMinSize() }} and
-                {{ getMaxSize() }}.
-              </span>
-              }
-            </ng-template>
-            <ng-template #sizeWarning>
-              @if (isStretchMode) {
-              <span i18n>
-                The replicated size value is predefined for stretch cluster
-              </span>
-              }
-              @if (form.getValue('size') === 1) {
-              <span
-                class="text-warning-dark"
-                i18n
-              >
-                A size of 1 will not create a replication of the object. The 'Replicated size'
-                includes the object itself.
-              </span>
-              }
-            </ng-template>
-          </div>
-        </div>
-        }
-        <!-- Flags -->
-        @if (info?.is_all_bluestore && isErasure) {
-        <div
-          class="form-item"
-          cdsRow
-        >
-          <div
-            cdsCol
-          >
-            <cds-checkbox
-              id="ec-overwrites"
-              formControlName="ecOverwrites"
+              <div cdsCol>
+                <cds-number
+                  label="Replicated size"
+                  cdRequiredField="Replicated size"
+                  [invalid]="form.controls.size.invalid && form.controls.size.dirty"
+                  [helperText]="sizeWarning"
+                  [invalidText]="sizeError"
+                  formControlName="size"
+                  data-testid="size"
+                  [max]="getMaxSize()"
+                  [min]="getMinSize()"
+                  (handleFocus)="externalPgChange = false"
+                  (input)="alignPgs()"
+                  i18n
+                  i18n-helperText
+                >
+                </cds-number>
+                <ng-template #sizeError>
+                  @if (form.showError('size', formDir)) {
+                    <span
+                      class="invalid-feedback"
+                      i18n
+                    >
+                      Invalid input. Replicated size must be between {{ getMinSize() }} and
+                      {{ getMaxSize() }}.
+                    </span>
+                  }
+                </ng-template>
+                <ng-template #sizeWarning>
+                  @if (isStretchMode) {
+                    <span i18n> The replicated size value is predefined for stretch cluster </span>
+                  }
+                  @if (form.getValue('size') === 1) {
+                    <span
+                      class="text-warning-dark"
+                      i18n
+                    >
+                      A size of 1 will not create a replication of the object. The 'Replicated size'
+                      includes the object itself.
+                    </span>
+                  }
+                </ng-template>
+              </div>
+            </div>
+          }
+          <!-- Flags -->
+          @if (info?.is_all_bluestore && isErasure) {
+            <div
+              class="form-item"
+              cdsRow
             >
-              <ng-container i18n>
-                Flags
-              </ng-container>
-              <cd-help-text i18n>
-                EC Overwrites
-              </cd-help-text>
-            </cds-checkbox>
-          </div>
+              <div cdsCol>
+                <cds-checkbox
+                  id="ec-overwrites"
+                  formControlName="ecOverwrites"
+                >
+                  <ng-container i18n> Flags </ng-container>
+                  <cd-help-text i18n> EC Overwrites </cd-help-text>
+                </cds-checkbox>
+              </div>
+            </div>
+          }
         </div>
-        }
-      </div>
       }
       <!-- Applications -->
-      <div
-        class="form-item"
-      >
+      <div class="form-item">
         <cds-combo-box
           type="multi"
           selectionFeedback="top-after-reopen"
@@ -337,7 +321,9 @@
           [appendInline]="true"
           [items]="data.applications.available"
           (selected)="appSelection($event)"
-          [invalid]="data.applications.selected.length === 0 && (formDir?.submitted || isFormSubmitted)"
+          [invalid]="
+            data.applications.selected.length === 0 && (formDir?.submitted || isFormSubmitted)
+          "
           [invalidText]="applicationsError"
           [helperText]="helperText"
           cdRequiredField="Applications"
@@ -346,8 +332,7 @@
           (updatedItems)="data.applications.available = $event"
           i18n-placeholder
         >
-          <cds-dropdown-list>
-          </cds-dropdown-list>
+          <cds-dropdown-list> </cds-dropdown-list>
         </cds-combo-box>
         <ng-template #applicationsError>
           <span
@@ -358,727 +343,715 @@
           </span>
         </ng-template>
         <ng-template #helperText>
-          <span i18n>
-            Pools need to be associated with an application before use
-          </span>
+          <span i18n> Pools need to be associated with an application before use </span>
         </ng-template>
       </div>
       <!-- Mirroring -->
-      @if ((permissions?.rbdMirroring?.create || (editing && permissions?.rbdMirroring?.update)) && data.applications.selected.includes('rbd')) {
-      <div
-        class="form-item"
-        cdsRow
-      >
+      @if (
+        (permissions?.rbdMirroring?.create || (editing && permissions?.rbdMirroring?.update)) &&
+        data.applications.selected.includes('rbd')
+      ) {
         <div
-          cdsCol
+          class="form-item"
+          cdsRow
         >
-          <cds-checkbox
-            id="rbdMirroring"
-            formControlName="rbdMirroring"
-            data-testid="rbd-mirroring-check"
-            i18n-label
-          >
-            Mirroring
-            <cd-help-text i18n>
-              Check this option to enable Pool based mirroring on a Block(RBD) pool.
-            </cd-help-text>
-          </cds-checkbox>
+          <div cdsCol>
+            <cds-checkbox
+              id="rbdMirroring"
+              formControlName="rbdMirroring"
+              data-testid="rbd-mirroring-check"
+              i18n-label
+            >
+              Mirroring
+              <cd-help-text i18n>
+                Check this option to enable Pool based mirroring on a Block(RBD) pool.
+              </cd-help-text>
+            </cds-checkbox>
+          </div>
         </div>
-      </div>
       }
       <!-- CRUSH -->
       @if (isErasure || isReplicated) {
-      <div>
-        <legend class="cd-header"
-                i18n>
-          CRUSH
-        </legend>
-        <!-- Erasure Profile select -->
-        @if (isErasure) {
-        <div
-          cdsRow
-          class="form-item form-item-append"
-        >
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 13 }"
+        <div>
+          <legend
+            class="cd-header"
+            i18n
           >
-            <cds-select
-              formControlName="erasureProfile"
-              label="Erasure code profile"
-              i18n-label
-              [helperText]="'Policy used for compression algorithm'"
-              id="erasureProfile"
-              i18n-helperText
+            CRUSH
+          </legend>
+          <!-- Erasure Profile select -->
+          @if (isErasure) {
+            <div
+              cdsRow
+              class="form-item form-item-append"
             >
-              @if (!ecProfiles) {
-              <option
-                value=""
-                i18n
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 13 }"
               >
-                Loading...
-              </option>
-              }
-              @if (ecProfiles && ecProfiles.length === 0) {
-              <option
-                [value]="null"
-                i18n
-              >
-                -- No erasure code profile available --
-              </option>
-              }
-              @for (ecp of ecProfiles; track ecp.name) {
-              <option [value]="ecp.name">
-                {{ ecp.name }}
-              </option>
-              }
-            </cds-select>
-          </div>
-
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 1}"
-            class="item-action-btn"
-          >
-            <cds-icon-button
-              kind="ghost"
-              size="md"
-              data-testid="ecp-info-button"
-              (click)="data.erasureInfo = !data.erasureInfo"
-            >
-              <svg
-                cdsIcon="help"
-                size="20"
-                class="cds--btn__icon-help"
-              >
-              </svg>
-            </cds-icon-button>
-          </div>
-          @if (!editing) {
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 1}"
-            class="item-action-btn"
-          >
-            <cds-icon-button
-              kind="primary"
-              size="md"
-              (click)="addErasureCodeProfile()"
-            >
-              <svg
-                cdsIcon="add"
-                size="32"
-                class="cds--btn__icon"
-              >
-              </svg>
-            </cds-icon-button>
-          </div>
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 1}"
-            class="item-action-btn "
-          >
-            @if (ecpUsage || ecProfiles?.length === 1) {
-            <cds-tooltip
-              [description]="ecpUsage ? 'This profile can\'t be deleted as it is in use.' : 'At least one erasure code profile must exist.'"
-              i18n-description
-              [highContrast]="true"
-              [caret]="true"
-            >
-              <cds-icon-button
-                kind="danger"
-                size="md"
-                [disabled]="true"
-              >
-                <svg
-                  cdsIcon="trash-can"
-                  size="32"
-                  class="cds--btn__icon"
+                <cds-select
+                  formControlName="erasureProfile"
+                  label="Erasure code profile"
+                  i18n-label
+                  [helperText]="'Policy used for compression algorithm'"
+                  id="erasureProfile"
+                  i18n-helperText
                 >
-                </svg>
-              </cds-icon-button>
-            </cds-tooltip>
-            } @else {
-            <cds-icon-button
-              kind="danger"
-              size="md"
-              (click)="deleteErasureCodeProfile()"
-            >
-              <svg
-                cdsIcon="trash-can"
-                size="32"
-                class="cds--btn__icon"
-              >
-              </svg>
-            </cds-icon-button>
-            }
-          </div>
-          }
-        </div>
-        }
-
-        <div
-          class="form-item"
-          cdsRow
-        >
-          <div
-            cdsCol
-          >
-            @if (data.erasureInfo) {
-            <span
-              class="form-text text-muted"
-              id="ecp-info-block"
-            >
-              <cds-tabs
-                [type]="'contained'"
-                [followFocus]="true"
-                [isNavigation]="false"
-                [cacheActive]="true"
-              >
-                <cds-tab
-                  heading="Profile"
-                  i18n-heading
-                  [tabContent]="profilTpl"
-                >
-                </cds-tab>
-                <cds-tab
-                  heading="Used by pools"
-                  i18n-heading
-                  [tabContent]="usedPoolTpl"
-                >
-                </cds-tab>
-              </cds-tabs>
-              <ng-template #profilTpl>
-                <cd-table-key-value
-                  [renderObjects]="true"
-                  [hideKeys]="['name']"
-                  [data]="selectedEcp"
-                  [autoReload]="false"
-                >
-                </cd-table-key-value>
-              </ng-template>
-              <ng-template #usedPoolTpl>
-                <ng-template #ecpIsNotUsed>
-                  <span i18n>
-                    Profile is not in use.
-                  </span>
-                </ng-template>
-                @if (ecpUsage) {
-                <ul>
-                  @for (pool of ecpUsage; track pool) {
-                  <li>
-                    {{ pool }}
-                  </li>
+                  @if (!ecProfiles) {
+                    <option
+                      value=""
+                      i18n
+                    >
+                      Loading...
+                    </option>
                   }
-                </ul>
-                } @else {
-                <ng-container *ngTemplateOutlet="ecpIsNotUsed"></ng-container>
-                }
-              </ng-template>
-            </span>
-            }
-          </div>
-        </div>
+                  @if (ecProfiles && ecProfiles.length === 0) {
+                    <option
+                      [value]="null"
+                      i18n
+                    >
+                      -- No erasure code profile available --
+                    </option>
+                  }
+                  @for (ecp of ecProfiles; track ecp.name) {
+                    <option [value]="ecp.name">
+                      {{ ecp.name }}
+                    </option>
+                  }
+                </cds-select>
+              </div>
+
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 1 }"
+                class="item-action-btn"
+              >
+                <cds-icon-button
+                  kind="ghost"
+                  size="md"
+                  data-testid="ecp-info-button"
+                  (click)="data.erasureInfo = !data.erasureInfo"
+                >
+                  <svg
+                    cdsIcon="help"
+                    size="20"
+                    class="cds--btn__icon-help"
+                  ></svg>
+                </cds-icon-button>
+              </div>
+              @if (!editing) {
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 1 }"
+                  class="item-action-btn"
+                >
+                  <cds-icon-button
+                    kind="primary"
+                    size="md"
+                    (click)="addErasureCodeProfile()"
+                  >
+                    <svg
+                      cdsIcon="add"
+                      size="32"
+                      class="cds--btn__icon"
+                    ></svg>
+                  </cds-icon-button>
+                </div>
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 1 }"
+                  class="item-action-btn"
+                >
+                  @if (ecpUsage || ecProfiles?.length === 1) {
+                    <cds-tooltip
+                      [description]="
+                        ecpUsage
+                          ? 'This profile can\'t be deleted as it is in use.'
+                          : 'At least one erasure code profile must exist.'
+                      "
+                      i18n-description
+                      [highContrast]="true"
+                      [caret]="true"
+                    >
+                      <cds-icon-button
+                        kind="danger"
+                        size="md"
+                        [disabled]="true"
+                      >
+                        <svg
+                          cdsIcon="trash-can"
+                          size="32"
+                          class="cds--btn__icon"
+                        ></svg>
+                      </cds-icon-button>
+                    </cds-tooltip>
+                  } @else {
+                    <cds-icon-button
+                      kind="danger"
+                      size="md"
+                      (click)="deleteErasureCodeProfile()"
+                    >
+                      <svg
+                        cdsIcon="trash-can"
+                        size="32"
+                        class="cds--btn__icon"
+                      ></svg>
+                    </cds-icon-button>
+                  }
+                </div>
+              }
+            </div>
+          }
 
-        <!-- Crush ruleset selection -->
-        @if (isErasure && !editing) {
-        <div
-          cdsRow
-          class="form-item"
-        >
           <div
-            cdsCol
+            class="form-item"
+            cdsRow
           >
-            <cds-label
-              for="crushRule"
-              i18n
+            <div cdsCol>
+              @if (data.erasureInfo) {
+                <span
+                  class="form-text text-muted"
+                  id="ecp-info-block"
+                >
+                  <cds-tabs
+                    [type]="'contained'"
+                    [followFocus]="true"
+                    [isNavigation]="false"
+                    [cacheActive]="true"
+                  >
+                    <cds-tab
+                      heading="Profile"
+                      i18n-heading
+                      [tabContent]="profilTpl"
+                    >
+                    </cds-tab>
+                    <cds-tab
+                      heading="Used by pools"
+                      i18n-heading
+                      [tabContent]="usedPoolTpl"
+                    >
+                    </cds-tab>
+                  </cds-tabs>
+                  <ng-template #profilTpl>
+                    <cd-table-key-value
+                      [renderObjects]="true"
+                      [hideKeys]="['name']"
+                      [data]="selectedEcp"
+                      [autoReload]="false"
+                    >
+                    </cd-table-key-value>
+                  </ng-template>
+                  <ng-template #usedPoolTpl>
+                    <ng-template #ecpIsNotUsed>
+                      <span i18n> Profile is not in use. </span>
+                    </ng-template>
+                    @if (ecpUsage) {
+                      <ul>
+                        @for (pool of ecpUsage; track pool) {
+                          <li>
+                            {{ pool }}
+                          </li>
+                        }
+                      </ul>
+                    } @else {
+                      <ng-container *ngTemplateOutlet="ecpIsNotUsed"></ng-container>
+                    }
+                  </ng-template>
+                </span>
+              }
+            </div>
+          </div>
+
+          <!-- Crush ruleset selection -->
+          @if (isErasure && !editing) {
+            <div
+              cdsRow
+              class="form-item"
             >
-              Crush ruleset
-            </cds-label>
-            <div class="cd-col-form-input">
-              @if (!msrCrush) {
-              <span
-                class="form-text text-muted"
-                i18n
-              >
-                A new crush ruleset will be implicitly created.
-              </span>
+              <div cdsCol>
+                <cds-label
+                  for="crushRule"
+                  i18n
+                >
+                  Crush ruleset
+                </cds-label>
+                <div class="cd-col-form-input">
+                  @if (!msrCrush) {
+                    <span
+                      class="form-text text-muted"
+                      i18n
+                    >
+                      A new crush ruleset will be implicitly created.
+                    </span>
+                  } @else {
+                    <span
+                      class="form-text text-muted"
+                      i18n
+                    >
+                      A new crush MSR ruleset will be implicitly created. When
+                      crush-osds-per-failure-domain or crush-num-failure-domains is specified
+                    </span>
+                  }
+                </div>
+              </div>
+            </div>
+          }
+
+          <!-- isReplicated -->
+          @if (isReplicated || editing) {
+            <div
+              cdsRow
+              fullWidth="true"
+              class="form-item form-item-append"
+            >
+              <ng-template #noRules>
+                <span class="form-text text-muted">
+                  <span i18n> There are no rules. </span>
+                  &nbsp;
+                </span>
+              </ng-template>
+              @if (current.rules.length > 0) {
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 13 }"
+                >
+                  <cds-select
+                    cdValidate
+                    #crushRuleRef="cdValidate"
+                    formControlName="crushRule"
+                    label="Crush ruleset"
+                    i18n-label
+                    id="crushRule"
+                    [invalid]="crushRuleRef.isInvalid"
+                    [invalidText]="crushRuleError"
+                  >
+                    @for (rule of current.rules; track rule.rule_name) {
+                      <option [value]="rule.rule_name">
+                        {{ rule.rule_name }}
+                      </option>
+                    }
+                  </cds-select>
+                  <ng-template #crushRuleError>
+                    @if (form.showError('crushRule', formDir, 'required')) {
+                      <span
+                        class="invalid-feedback"
+                        i18n
+                      >
+                        This field is required!
+                      </span>
+                    }
+                  </ng-template>
+                </div>
               } @else {
-              <span
-                class="form-text text-muted"
-                i18n
+                <div cdsCol>
+                  <ng-container *ngTemplateOutlet="noRules"></ng-container>
+                </div>
+              }
+
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 1 }"
+                class="item-action-btn"
               >
-                A new crush MSR ruleset will be implicitly created. When
-                crush-osds-per-failure-domain or crush-num-failure-domains is specified
-              </span>
+                <cds-tooltip
+                  description="Placement and
+                            replication strategies or distribution policies that allow to
+                            specify how CRUSH places data replicas."
+                  [highContrast]="true"
+                  [caret]="true"
+                >
+                  <cds-icon-button
+                    kind="ghost"
+                    size="md"
+                    data-testid="crush-info-button"
+                    (click)="data.crushInfo = !data.crushInfo"
+                  >
+                    <svg
+                      cdsIcon="help"
+                      size="20"
+                      class="cds--btn__icon-help"
+                    ></svg>
+                  </cds-icon-button>
+                </cds-tooltip>
+              </div>
+              @if (isReplicated && !editing) {
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 1 }"
+                  class="item-action-btn"
+                >
+                  <cds-icon-button
+                    kind="primary"
+                    size="md"
+                    (click)="addCrushRule()"
+                  >
+                    <svg
+                      cdsIcon="add"
+                      size="32"
+                      class="cds--btn__icon"
+                    ></svg>
+                  </cds-icon-button>
+                </div>
+              }
+              @if (!editing) {
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 1 }"
+                  class="item-action-btn"
+                >
+                  @if (crushUsage || current?.rules?.length === 1) {
+                    <cds-tooltip
+                      [description]="
+                        crushUsage
+                          ? 'This rule can\'t be deleted as it is in use.'
+                          : 'At least one crush rule must exist.'
+                      "
+                      i18n-description
+                      [highContrast]="true"
+                      [caret]="true"
+                    >
+                      <cds-icon-button
+                        kind="danger"
+                        size="md"
+                        [disabled]="true"
+                      >
+                        <svg
+                          cdsIcon="trash-can"
+                          size="32"
+                          class="cds--btn__icon"
+                        ></svg>
+                      </cds-icon-button>
+                    </cds-tooltip>
+                  } @else {
+                    <cds-icon-button
+                      kind="danger"
+                      size="md"
+                      (click)="deleteCrushRule()"
+                    >
+                      <svg
+                        cdsIcon="trash-can"
+                        size="32"
+                        class="cds--btn__icon"
+                      ></svg>
+                    </cds-icon-button>
+                  }
+                </div>
+              }
+            </div>
+          }
+
+          <div
+            class="form-item"
+            cdsRow
+          >
+            <div cdsCol>
+              @if (data.crushInfo && form.getValue('crushRule')) {
+                <span
+                  class="form-text text-muted"
+                  id="crush-info-block"
+                >
+                  <cds-tabs
+                    [type]="'contained'"
+                    [followFocus]="true"
+                    [isNavigation]="false"
+                    [cacheActive]="true"
+                  >
+                    <cds-tab
+                      heading="Crush rule"
+                      i18n-heading
+                      [tabContent]="crushRuleTpl"
+                    >
+                    </cds-tab>
+                    <cds-tab
+                      heading="Crush steps"
+                      i18n-heading
+                      [tabContent]="crushStepsTpl"
+                    >
+                    </cds-tab>
+                    <cds-tab
+                      heading="Used by pools"
+                      i18n-heading
+                      [tabContent]="usedPoolTpl"
+                    >
+                    </cds-tab>
+                  </cds-tabs>
+                  <ng-template #crushRuleTpl>
+                    <cd-table-key-value
+                      [renderObjects]="false"
+                      [hideKeys]="['steps', 'type', 'rule_name']"
+                      [data]="this.selectedCrushRule"
+                      [autoReload]="false"
+                    >
+                    </cd-table-key-value>
+                  </ng-template>
+                  <ng-template #crushStepsTpl>
+                    <ol>
+                      @for (step of this.selectedCrushRule?.steps; track $index) {
+                        <li>
+                          {{ describeCrushStep(step) }}
+                        </li>
+                      }
+                    </ol>
+                  </ng-template>
+                  <ng-template #usedPoolTpl>
+                    <ng-template #ruleIsNotUsed>
+                      <span i18n> Rule is not in use. </span>
+                    </ng-template>
+                    @if (crushUsage) {
+                      <ul>
+                        @for (pool of crushUsage; track pool) {
+                          <li>
+                            {{ pool }}
+                          </li>
+                        }
+                      </ul>
+                    } @else {
+                      <ng-container *ngTemplateOutlet="ruleIsNotUsed"></ng-container>
+                    }
+                  </ng-template>
+                </span>
               }
             </div>
           </div>
         </div>
-        }
-
-        <!-- isReplicated -->
-        @if (isReplicated || editing) {
-        <div
-          cdsRow
-          fullWidth="true"
-          class="form-item form-item-append"
-        >
-          <ng-template #noRules>
-            <span
-              class="form-text text-muted"
-            >
-              <span
-                i18n
-              >
-                There are no rules.
-              </span>
-              &nbsp;
-            </span>
-          </ng-template>
-          @if (current.rules.length > 0) {
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 13 }"
-          >
-            <cds-select
-              cdValidate
-              #crushRuleRef="cdValidate"
-              formControlName="crushRule"
-              label="Crush ruleset"
-              i18n-label
-              id="crushRule"
-              [invalid]="crushRuleRef.isInvalid"
-              [invalidText]="crushRuleError"
-            >
-              @for (rule of current.rules; track rule.rule_name) {
-              <option [value]="rule.rule_name">
-                {{ rule.rule_name }}
-              </option>
-              }
-            </cds-select>
-            <ng-template #crushRuleError>
-              @if (form.showError('crushRule', formDir, 'required')) {
-              <span
-                class="invalid-feedback"
-                i18n
-              >
-                This field is required!
-              </span>
-              }
-            </ng-template>
-          </div>
-          } @else {
-          <div cdsCol>
-            <ng-container *ngTemplateOutlet="noRules"></ng-container>
-          </div>
-          }
-
-          <div cdsCol
-               [columnNumbers]="{ lg: 1}"
-               class="item-action-btn">
-            <cds-tooltip
-              description="Placement and
-                            replication strategies or distribution policies that allow to
-                            specify how CRUSH places data replicas."
-              [highContrast]="true"
-              [caret]="true"
-            >
-              <cds-icon-button
-                kind="ghost"
-                size="md"
-                data-testid="crush-info-button"
-                (click)="data.crushInfo = !data.crushInfo"
-              >
-                <svg
-                  cdsIcon="help"
-                  size="20"
-                  class="cds--btn__icon-help"
-                >
-                </svg>
-              </cds-icon-button>
-            </cds-tooltip>
-          </div>
-          @if (isReplicated && !editing) {
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 1}"
-            class="item-action-btn"
-          >
-            <cds-icon-button
-              kind="primary"
-              size="md"
-              (click)="addCrushRule()"
-            >
-              <svg
-                cdsIcon="add"
-                size="32"
-                class="cds--btn__icon"
-              >
-              </svg>
-            </cds-icon-button>
-          </div>
-          }
-          @if (!editing) {
-          <div
-            cdsCol
-            [columnNumbers]="{ lg: 1}"
-            class="item-action-btn "
-          >
-            @if (crushUsage || current?.rules?.length === 1) {
-            <cds-tooltip
-              [description]="crushUsage ? 'This rule can\'t be deleted as it is in use.' : 'At least one crush rule must exist.'"
-              i18n-description
-              [highContrast]="true"
-              [caret]="true"
-            >
-              <cds-icon-button
-                kind="danger"
-                size="md"
-                [disabled]="true"
-              >
-                <svg
-                  cdsIcon="trash-can"
-                  size="32"
-                  class="cds--btn__icon"
-                >
-                </svg>
-              </cds-icon-button>
-            </cds-tooltip>
-            } @else {
-            <cds-icon-button
-              kind="danger"
-              size="md"
-              (click)="deleteCrushRule()"
-            >
-              <svg
-                cdsIcon="trash-can"
-                size="32"
-                class="cds--btn__icon"
-              >
-              </svg>
-            </cds-icon-button>
-            }
-          </div>
-          }
-        </div>
-        }
-
-        <div
-          class="form-item"
-          cdsRow
-        >
-          <div
-            cdsCol
-          >
-            @if (data.crushInfo && form.getValue('crushRule')) {
-            <span
-              class="form-text text-muted"
-              id="crush-info-block"
-            >
-              <cds-tabs
-                [type]="'contained'"
-                [followFocus]="true"
-                [isNavigation]="false"
-                [cacheActive]="true"
-              >
-                <cds-tab
-                  heading="Crush rule"
-                  i18n-heading
-                  [tabContent]="crushRuleTpl"
-                >
-                </cds-tab>
-                <cds-tab
-                  heading="Crush steps"
-                  i18n-heading
-                  [tabContent]="crushStepsTpl"
-                >
-                </cds-tab>
-                <cds-tab
-                  heading="Used by pools"
-                  i18n-heading
-                  [tabContent]="usedPoolTpl"
-                >
-                </cds-tab>
-              </cds-tabs>
-              <ng-template #crushRuleTpl>
-                <cd-table-key-value
-                  [renderObjects]="false"
-                  [hideKeys]="['steps', 'type', 'rule_name']"
-                  [data]="this.selectedCrushRule"
-                  [autoReload]="false"
-                >
-                </cd-table-key-value>
-              </ng-template>
-              <ng-template #crushStepsTpl>
-                <ol>
-                  @for (step of this.selectedCrushRule?.steps; track $index) {
-                  <li>
-                    {{ describeCrushStep(step) }}
-                  </li>
-                  }
-                </ol>
-              </ng-template>
-              <ng-template #usedPoolTpl>
-                <ng-template #ruleIsNotUsed>
-                  <span i18n>
-                    Rule is not in use.
-                  </span>
-                </ng-template>
-                @if (crushUsage) {
-                <ul>
-                  @for (pool of crushUsage; track pool) {
-                  <li>
-                    {{ pool }}
-                  </li>
-                  }
-                </ul>
-                } @else {
-                <ng-container *ngTemplateOutlet="ruleIsNotUsed"></ng-container>
-                }
-              </ng-template>
-            </span>
-            }
-          </div>
-        </div>
-      </div>
       }
       <!-- Compression -->
       @if (info?.is_all_bluestore) {
-      <div formGroupName="compression">
-        <legend class="cd-header"
-                i18n>
-          Compression
-        </legend>
-        <!-- Compression Mode -->
-        <div
-          class="form-item"
-          cdsRow
-        >
-          <div
-            cdsCol
+        <div formGroupName="compression">
+          <legend
+            class="cd-header"
+            i18n
           >
-            <cds-select
-              formControlName="mode"
-              label="Mode"
-              i18n-label
-              [helperText]="compressionModeHelperText"
-              id="mode"
-            >
-              @for (mode of info.compression_modes; track mode) {
-              <option [value]="mode">
-                {{ mode }}
-              </option>
-              }
-            </cds-select>
-            <ng-template #compressionModeHelperText>
-              <span>Policy used for compression algorithm. </span>
-              {{ poolService.formTooltips.compressionModes[form.controls.compression.controls.mode.value] }}
-            </ng-template>
-          </div>
-        </div>
-        @if (hasCompressionEnabled()) {
-        <div>
-          <!-- Compression algorithm selection -->
+            Compression
+          </legend>
+          <!-- Compression Mode -->
           <div
             class="form-item"
             cdsRow
           >
-            <div
-              cdsCol
-            >
+            <div cdsCol>
               <cds-select
-                formControlName="algorithm"
-                label="Algorithm"
+                formControlName="mode"
+                label="Mode"
                 i18n-label
-                [helperText]="'Compression algorithm used'"
-                id="algorithm"
+                [helperText]="compressionModeHelperText"
+                id="mode"
               >
-                @if (!info.compression_algorithms) {
-                <option
-                  value=""
-                  i18n
-                >
-                  Loading...
-                </option>
-                }
-                @if (info.compression_algorithms && info.compression_algorithms.length === 0) {
-                <option
-                  i18n
-                  value=""
-                >
-                  -- No erasure compression algorithm available --
-                </option>
-                }
-                @for (algorithm of info.compression_algorithms; track algorithm) {
-                <option [value]="algorithm">
-                  {{ algorithm }}
-                </option>
+                @for (mode of info.compression_modes; track mode) {
+                  <option [value]="mode">
+                    {{ mode }}
+                  </option>
                 }
               </cds-select>
-            </div>
-          </div>
-          <!-- Compression min blob size -->
-          <div
-            cdsRow
-            class="form-item form-item-append"
-          >
-            <div
-              cdsCol
-            >
-              <cds-number
-                label="Minimum blob size"
-                [helperText]="'Chunks smaller than Minimum blob size are never compressed'"
-                [invalid]="
-                  form.controls.compression.controls.minBlobSize.invalid &&
-                  form.controls.compression.controls.minBlobSize.dirty
-                "
-                [invalidText]="minBlobSizeError"
-                formControlName="minBlobSize"
-                min="0"
-                i18n
-                i18n-helperText
-              >
-              </cds-number>
-              <ng-template #minBlobSizeError>
-                @if (form.showError('minBlobSize', formDir, 'min')) {
-                <span
-                  class="invalid-feedback"
-                  i18n
-                >
-                  Value should be greater than or equal to 0
-                </span>
-                }
-                @if (form.showError('minBlobSize', formDir, 'maximum')) {
-                <span class="invalid-feedback"
-                      i18n>Value should be less than the maximum blob size
-                </span>
-                }
-              </ng-template>
-            </div>
-            <div
-              cdsCol
-            >
-              <cds-select
-                formControlName="minBlobSizeUnit"
-                label="Unit"
-                i18n-label
-                id="minBlobSizeUnit"
-              >
-                @for (minBlobSizeUnit of blobUnits; track minBlobSizeUnit) {
-                <option
-                  [value]="minBlobSizeUnit"
-                  i18n
-                >
-                  {{ minBlobSizeUnit }}
-                </option>
-                }
-              </cds-select>
-            </div>
-          </div>
-          <!-- Compression max blob size -->
-          <div
-            cdsRow
-            class="form-item form-item-append"
-          >
-            <div
-              cdsCol
-            >
-              <cds-number
-                label="Maximum blob size"
-                [helperText]="'Chunks larger than Maximum Blob Size are broken into smaller blobs of size mentioned before being compressed.'"
-                [invalid]="
-                  form.controls.compression.controls.maxBlobSize.invalid &&
-                  form.controls.compression.controls.maxBlobSize.dirty
-                "
-                [invalidText]="maxBlobSizeError"
-                formControlName="maxBlobSize"
-                min="0"
-                i18n
-                i18n-helperText
-              >
-              </cds-number>
-              <ng-template #maxBlobSizeError>
-                @if (form.showError('maxBlobSize', formDir, 'min')) {
-                <span
-                  class="invalid-feedback"
-                  i18n
-                >
-                  Value should be greater than or equal to 0
-                </span>
-                }
-                @if (form.showError('maxBlobSize', formDir, 'minimum')) {
-                <span class="invalid-feedback"
-                      i18n>
-                      Value should be greater than the minimum blob size
-                </span>
-                }
-              </ng-template>
-            </div>
-            <div
-              cdsCol
-            >
-              <cds-select
-                formControlName="maxBlobSizeUnit"
-                label="Unit"
-                i18n-label
-                id="maxBlobSizeUnit"
-              >
-                @for (maxBlobSizeUnit of blobUnits; track maxBlobSizeUnit) {
-                <option
-                  [value]="maxBlobSizeUnit"
-                  i18n
-                >
-                  {{ maxBlobSizeUnit }}
-                </option>
-                }
-              </cds-select>
-            </div>
-          </div>
-          <!-- Compression ratio -->
-          <div
-            class="form-item"
-            cdsRow
-          >
-            <div
-              cdsCol
-            >
-              <cds-number
-                label="Ratio"
-                [helperText]="'The ratio of the size of the data chunk after compression relative to the original size must be at least this small in order to store the compressed version'"
-                [invalid]="
-                  form.controls.compression.controls.ratio.invalid &&
-                  form.controls.compression.controls.ratio.dirty
-                "
-                [invalidText]="ratioError"
-                formControlName="ratio"
-                min="0"
-                max="1"
-                step="0.1"
-                i18n-placeholder
-                i18n-helperText
-              >
-              </cds-number>
-              <ng-template #ratioError>
-                @if (form.showError('ratio', formDir, 'min') || form.showError('ratio', formDir, 'max')) {
-                <span
-                  class="invalid-feedback"
-                  i18n
-                >
-                  Value should be between 0.0 and 1.0
-                </span>
-                }
+              <ng-template #compressionModeHelperText>
+                <span>Policy used for compression algorithm. </span>
+                {{
+                  poolService.formTooltips.compressionModes[
+                    form.controls.compression.controls.mode.value
+                  ]
+                }}
               </ng-template>
             </div>
           </div>
+          @if (hasCompressionEnabled()) {
+            <div>
+              <!-- Compression algorithm selection -->
+              <div
+                class="form-item"
+                cdsRow
+              >
+                <div cdsCol>
+                  <cds-select
+                    formControlName="algorithm"
+                    label="Algorithm"
+                    i18n-label
+                    [helperText]="'Compression algorithm used'"
+                    id="algorithm"
+                  >
+                    @if (!info.compression_algorithms) {
+                      <option
+                        value=""
+                        i18n
+                      >
+                        Loading...
+                      </option>
+                    }
+                    @if (info.compression_algorithms && info.compression_algorithms.length === 0) {
+                      <option
+                        i18n
+                        value=""
+                      >
+                        -- No erasure compression algorithm available --
+                      </option>
+                    }
+                    @for (algorithm of info.compression_algorithms; track algorithm) {
+                      <option [value]="algorithm">
+                        {{ algorithm }}
+                      </option>
+                    }
+                  </cds-select>
+                </div>
+              </div>
+              <!-- Compression min blob size -->
+              <div
+                cdsRow
+                class="form-item form-item-append"
+              >
+                <div cdsCol>
+                  <cds-number
+                    label="Minimum blob size"
+                    [helperText]="'Chunks smaller than Minimum blob size are never compressed'"
+                    [invalid]="
+                      form.controls.compression.controls.minBlobSize.invalid &&
+                      form.controls.compression.controls.minBlobSize.dirty
+                    "
+                    [invalidText]="minBlobSizeError"
+                    formControlName="minBlobSize"
+                    min="0"
+                    i18n
+                    i18n-helperText
+                  >
+                  </cds-number>
+                  <ng-template #minBlobSizeError>
+                    @if (form.showError('minBlobSize', formDir, 'min')) {
+                      <span
+                        class="invalid-feedback"
+                        i18n
+                      >
+                        Value should be greater than or equal to 0
+                      </span>
+                    }
+                    @if (form.showError('minBlobSize', formDir, 'maximum')) {
+                      <span
+                        class="invalid-feedback"
+                        i18n
+                        >Value should be less than the maximum blob size
+                      </span>
+                    }
+                  </ng-template>
+                </div>
+                <div cdsCol>
+                  <cds-select
+                    formControlName="minBlobSizeUnit"
+                    label="Unit"
+                    i18n-label
+                    id="minBlobSizeUnit"
+                  >
+                    @for (minBlobSizeUnit of blobUnits; track minBlobSizeUnit) {
+                      <option
+                        [value]="minBlobSizeUnit"
+                        i18n
+                      >
+                        {{ minBlobSizeUnit }}
+                      </option>
+                    }
+                  </cds-select>
+                </div>
+              </div>
+              <!-- Compression max blob size -->
+              <div
+                cdsRow
+                class="form-item form-item-append"
+              >
+                <div cdsCol>
+                  <cds-number
+                    label="Maximum blob size"
+                    [helperText]="'Chunks larger than Maximum Blob Size are broken into smaller blobs of size mentioned before being compressed.'"
+                    [invalid]="
+                      form.controls.compression.controls.maxBlobSize.invalid &&
+                      form.controls.compression.controls.maxBlobSize.dirty
+                    "
+                    [invalidText]="maxBlobSizeError"
+                    formControlName="maxBlobSize"
+                    min="0"
+                    i18n
+                    i18n-helperText
+                  >
+                  </cds-number>
+                  <ng-template #maxBlobSizeError>
+                    @if (form.showError('maxBlobSize', formDir, 'min')) {
+                      <span
+                        class="invalid-feedback"
+                        i18n
+                      >
+                        Value should be greater than or equal to 0
+                      </span>
+                    }
+                    @if (form.showError('maxBlobSize', formDir, 'minimum')) {
+                      <span
+                        class="invalid-feedback"
+                        i18n
+                      >
+                        Value should be greater than the minimum blob size
+                      </span>
+                    }
+                  </ng-template>
+                </div>
+                <div cdsCol>
+                  <cds-select
+                    formControlName="maxBlobSizeUnit"
+                    label="Unit"
+                    i18n-label
+                    id="maxBlobSizeUnit"
+                  >
+                    @for (maxBlobSizeUnit of blobUnits; track maxBlobSizeUnit) {
+                      <option
+                        [value]="maxBlobSizeUnit"
+                        i18n
+                      >
+                        {{ maxBlobSizeUnit }}
+                      </option>
+                    }
+                  </cds-select>
+                </div>
+              </div>
+              <!-- Compression ratio -->
+              <div
+                class="form-item"
+                cdsRow
+              >
+                <div cdsCol>
+                  <cds-number
+                    label="Ratio"
+                    [helperText]="'The ratio of the size of the data chunk after compression relative to the original size must be at least this small in order to store the compressed version'"
+                    [invalid]="
+                      form.controls.compression.controls.ratio.invalid &&
+                      form.controls.compression.controls.ratio.dirty
+                    "
+                    [invalidText]="ratioError"
+                    formControlName="ratio"
+                    min="0"
+                    max="1"
+                    step="0.1"
+                    i18n-placeholder
+                    i18n-helperText
+                  >
+                  </cds-number>
+                  <ng-template #ratioError>
+                    @if (
+                      form.showError('ratio', formDir, 'min') ||
+                      form.showError('ratio', formDir, 'max')
+                    ) {
+                      <span
+                        class="invalid-feedback"
+                        i18n
+                      >
+                        Value should be between 0.0 and 1.0
+                      </span>
+                    }
+                  </ng-template>
+                </div>
+              </div>
+            </div>
+          }
         </div>
-        }
-      </div>
       }
       <!-- Quotas -->
       <div>
-        <legend class="cd-header"
-                i18n>
+        <legend
+          class="cd-header"
+          i18n
+        >
           Quotas
         </legend>
         <!-- Max Bytes -->
@@ -1086,9 +1059,7 @@
           cdsRow
           class="form-item form-item-append"
         >
-          <div
-            cdsCol
-          >
+          <div cdsCol>
             <cds-number
               label="Max bytes"
               [helperText]="maxObjectsHelpText"
@@ -1101,17 +1072,15 @@
             </cds-number>
             <ng-template #maxBytesError>
               @if (form.showError('max_bytes', formDir, 'min')) {
-              <span
-                class="invalid-feedback"
-                i18n
-              >The value should be greater or equal to 0
-              </span>
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >The value should be greater or equal to 0
+                </span>
               }
             </ng-template>
           </div>
-          <div
-            cdsCol
-          >
+          <div cdsCol>
             <cds-select
               formControlName="maxBytesUnit"
               label="Unit"
@@ -1119,12 +1088,12 @@
               id="maxBytesUnit"
             >
               @for (maxBytesUnit of maxBytesUnits; track maxBytesUnit) {
-              <option
-                [value]="maxBytesUnit"
-                i18n
-              >
-                {{ maxBytesUnit }}
-              </option>
+                <option
+                  [value]="maxBytesUnit"
+                  i18n
+                >
+                  {{ maxBytesUnit }}
+                </option>
               }
             </cds-select>
           </div>
@@ -1134,9 +1103,7 @@
           cdsRow
           class="form-item"
         >
-          <div
-            cdsCol
-          >
+          <div cdsCol>
             <cds-number
               label="Max objects"
               [helperText]="maxObjectsHelpText"
@@ -1149,19 +1116,17 @@
             >
             </cds-number>
             <ng-template #maxObjectsHelpText>
-              <span i18n>
-                Leave it blank or specify 0 to disable this quota.
-              </span>
+              <span i18n> Leave it blank or specify 0 to disable this quota. </span>
               <br />
-              <span i18n>
-                A valid quota should be greater than 0.
-              </span>
+              <span i18n> A valid quota should be greater than 0. </span>
             </ng-template>
             <ng-template #maxObjectsError>
               @if (form.showError('max_objects', formDir, 'min')) {
-              <span class="invalid-feedback"
-                    i18n>The value should be greater or equal to 0
-              </span>
+                <span
+                  class="invalid-feedback"
+                  i18n
+                  >The value should be greater or equal to 0
+                </span>
               }
             </ng-template>
           </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-list/pool-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-list/pool-list.component.html
index 07b15e42f8b..76f32464202 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-list/pool-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-list/pool-list.component.html
@@ -1,48 +1,66 @@
-<nav ngbNav
-     #nav="ngbNav"
-     class="nav-tabs">
+<nav
+  ngbNav
+  #nav="ngbNav"
+  class="nav-tabs"
+>
   <ng-container ngbNavItem>
-    <a ngbNavLink
-       i18n>Pools List</a>
+    <a
+      ngbNavLink
+      i18n
+      >Pools List</a
+    >
     <ng-template ngbNavContent>
-      <cd-table #table
-                id="pool-list"
-                [data]="pools"
-                [columns]="columns"
-                selectionType="single"
-                [hasDetails]="true"
-                [status]="tableStatus"
-                [autoReload]="-1"
-                (fetchData)="taskListService.fetch()"
-                (setExpandedRow)="setExpandedRow($event)"
-                (updateSelection)="updateSelection($event)">
-        <cd-table-actions id="pool-list-actions"
-                          class="table-actions"
-                          [permission]="permissions.pool"
-                          [selection]="selection"
-                          [tableActions]="tableActions">
+      <cd-table
+        #table
+        id="pool-list"
+        [data]="pools"
+        [columns]="columns"
+        selectionType="single"
+        [hasDetails]="true"
+        [status]="tableStatus"
+        [autoReload]="-1"
+        (fetchData)="taskListService.fetch()"
+        (setExpandedRow)="setExpandedRow($event)"
+        (updateSelection)="updateSelection($event)"
+      >
+        <cd-table-actions
+          id="pool-list-actions"
+          class="table-actions"
+          [permission]="permissions.pool"
+          [selection]="selection"
+          [tableActions]="tableActions"
+        >
         </cd-table-actions>
-        <cd-pool-details *cdTableDetail
-                         id="pool-list-details"
-                         [selection]="expandedRow"
-                         [permissions]="permissions"
-                         [cacheTiers]="cacheTiers">
+        <cd-pool-details
+          *cdTableDetail
+          id="pool-list-details"
+          [selection]="expandedRow"
+          [permissions]="permissions"
+          [cacheTiers]="cacheTiers"
+        >
         </cd-pool-details>
       </cd-table>
     </ng-template>
   </ng-container>
 
-  <ng-container ngbNavItem
-                *cdScope="'grafana'">
-    <a ngbNavLink
-       i18n>Overall Performance</a>
+  <ng-container
+    ngbNavItem
+    *cdScope="'grafana'"
+  >
+    <a
+      ngbNavLink
+      i18n
+      >Overall Performance</a
+    >
     <ng-template ngbNavContent>
-      <cd-grafana i18n-title
-                  title="Ceph pools overview"
-                  [grafanaPath]="'ceph-pools-overview?'"
-                  [type]="'metrics'"
-                  uid="z99hzWtmk"
-                  grafanaStyle="three">
+      <cd-grafana
+        i18n-title
+        title="Ceph pools overview"
+        [grafanaPath]="'ceph-pools-overview?'"
+        [type]="'metrics'"
+        uid="z99hzWtmk"
+        grafanaStyle="three"
+      >
       </cd-grafana>
     </ng-template>
   </ng-container>
@@ -50,12 +68,16 @@
 
 <div [ngbNavOutlet]="nav"></div>
 
-<ng-template #poolUsageTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.stats?.avail_raw?.latest"
-                [total]="row.stats.bytes_used.latest + row.stats.avail_raw.latest"
-                [used]="row.stats.bytes_used.latest"
-                [title]="row.pool_name"
-                decimals="2">
+<ng-template
+  #poolUsageTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.stats?.avail_raw?.latest"
+    [total]="row.stats.bytes_used.latest + row.stats.avail_raw.latest"
+    [used]="row.stats.bytes_used.latest"
+    [title]="row.pool_name"
+    decimals="2"
+  >
   </cd-usage-bar>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.html
index fe4023f6dfe..c262ea979db 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.html
@@ -1,75 +1,106 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
-
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ getMode() }} Tag</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ getMode() }} Tag
+    </h3>
   </cds-modal-header>
 
-  <form class="form"
-        #formDir="ngForm"
-        [formGroup]="form">
+  <form
+    class="form"
+    #formDir="ngForm"
+    [formGroup]="form"
+  >
     <div cdsModalContent>
       <!-- Key -->
       <div class="form-item">
-        <cds-text-label label="Key"
-                        for="key"
-                        cdRequiredField="Key"
-                        [invalid]="form.controls.key.invalid && form.controls.key.dirty"
-                        [invalidText]="keyError">Key
-          <input cdsText
-                 type="text"
-                 id="key"
-                 name="key"
-                 formControlName="key"
-                 [invalid]="form.controls.key.invalid && form.controls.key.dirty"
-                 [autofocus]="true"
-                 modal-primary-focus>
+        <cds-text-label
+          label="Key"
+          for="key"
+          cdRequiredField="Key"
+          [invalid]="form.controls.key.invalid && form.controls.key.dirty"
+          [invalidText]="keyError"
+          >Key
+          <input
+            cdsText
+            type="text"
+            id="key"
+            name="key"
+            formControlName="key"
+            [invalid]="form.controls.key.invalid && form.controls.key.dirty"
+            [autofocus]="true"
+            modal-primary-focus
+          />
         </cds-text-label>
         <ng-template #keyError>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('key', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('key', formDir, 'unique')"
-                i18n>This key must be unique.</span>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('key', formDir, 'maxLength')"
-                i18n>Length of the key must be maximum of 128 characters</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('key', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('key', formDir, 'unique')"
+            i18n
+            >This key must be unique.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('key', formDir, 'maxLength')"
+            i18n
+            >Length of the key must be maximum of 128 characters</span
+          >
         </ng-template>
       </div>
 
       <!-- Value -->
       <div class="form-item">
-        <cds-text-label label="Value"
-                        for="value"
-                        cdRequiredField="Value"
-                        [invalid]="form.controls.value.invalid && form.controls.value.dirty"
-                        [invalidText]="valueError">Value
-          <input cdsText
-                 type="text"
-                 id="value"
-                 name="value"
-                 formControlName="value"
-                 [invalid]="form.controls.value.invalid && form.controls.value.dirty">
+        <cds-text-label
+          label="Value"
+          for="value"
+          cdRequiredField="Value"
+          [invalid]="form.controls.value.invalid && form.controls.value.dirty"
+          [invalidText]="valueError"
+          >Value
+          <input
+            cdsText
+            type="text"
+            id="value"
+            name="value"
+            formControlName="value"
+            [invalid]="form.controls.value.invalid && form.controls.value.dirty"
+          />
         </cds-text-label>
         <ng-template #valueError>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('value', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="form.showError('value', formDir, 'maxLength')"
-                i18n>Length of the value must be a maximum of 128 characters</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('value', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="form.showError('value', formDir, 'maxLength')"
+            i18n
+            >Length of the value must be a maximum of 128 characters</span
+          >
         </ng-template>
       </div>
-
     </div>
 
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          [form]="form"
-                          [submitText]="getMode()"
-                          [modalForm]="true"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="form"
+      [submitText]="getMode()"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </form>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.html
index 6bb030d29a6..5824aa5e200 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/create-rgw-service-entities/create-rgw-service-entities.component.html
@@ -1,10 +1,16 @@
-<cds-modal size="sm"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Create Realm/Zonegroup/Zone</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Create Realm/Zonegroup/Zone
+    </h3>
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
   <form
@@ -14,15 +20,19 @@
     novalidate
   >
     <div cdsModalContent>
-      <cd-alert-panel type="info"
-                      spacingClass="mt-3"
-                      i18n>The realm/zonegroup/zone created will be set as default and master.
+      <cd-alert-panel
+        type="info"
+        spacingClass="mt-3"
+        i18n
+        >The realm/zonegroup/zone created will be set as default and master.
       </cd-alert-panel>
       <div class="form-item">
         <cds-text-label
           labelInputID="realmName"
-          [invalid]="createMultisiteEntitiesForm.controls.realmName.invalid &&
-                     createMultisiteEntitiesForm.controls.realmName.dirty"
+          [invalid]="
+            createMultisiteEntitiesForm.controls.realmName.invalid &&
+            createMultisiteEntitiesForm.controls.realmName.dirty
+          "
           [invalidText]="realmNameError"
           i18n
           >Realm Name
@@ -33,7 +43,8 @@
             formControlName="realmName"
             [invalid]="
               createMultisiteEntitiesForm.controls.realmName.invalid &&
-              createMultisiteEntitiesForm.controls.realmName.dirty"
+              createMultisiteEntitiesForm.controls.realmName.dirty
+            "
             [autofocus]="true"
             modal-primary-focus
           />
@@ -51,8 +62,10 @@
       <div class="form-item">
         <cds-text-label
           labelInputID="zonegroupName"
-          [invalid]="createMultisiteEntitiesForm.controls.zonegroupName.invalid &&
-                     createMultisiteEntitiesForm.controls.zonegroupName.dirty"
+          [invalid]="
+            createMultisiteEntitiesForm.controls.zonegroupName.invalid &&
+            createMultisiteEntitiesForm.controls.zonegroupName.dirty
+          "
           [invalidText]="zoneGroupNameError"
           i18n
           >Zonegroup Name
@@ -63,8 +76,10 @@
             id="zonegroupName"
             name="zonegroupName"
             formControlName="zonegroupName"
-            [invalid]="createMultisiteEntitiesForm.controls.zonegroupName.invalid &&
-                       createMultisiteEntitiesForm.controls.zonegroupName.dirty"
+            [invalid]="
+              createMultisiteEntitiesForm.controls.zonegroupName.invalid &&
+              createMultisiteEntitiesForm.controls.zonegroupName.dirty
+            "
           />
         </cds-text-label>
         <ng-template #zoneGroupNameError>
@@ -80,8 +95,10 @@
       <div class="form-item">
         <cds-text-label
           labelInputID="zoneName"
-          [invalid]="createMultisiteEntitiesForm.controls.zoneName.invalid &&
-                     createMultisiteEntitiesForm.controls.zoneName.dirty"
+          [invalid]="
+            createMultisiteEntitiesForm.controls.zoneName.invalid &&
+            createMultisiteEntitiesForm.controls.zoneName.dirty
+          "
           [invalidText]="zoneNameError"
           i18n
           >Zone Name
@@ -92,8 +109,10 @@
             id="zoneName"
             name="zoneName"
             formControlName="zoneName"
-            [invalid]="createMultisiteEntitiesForm.controls.zoneName.invalid &&
-                       createMultisiteEntitiesForm.controls.zoneName.dirty"
+            [invalid]="
+              createMultisiteEntitiesForm.controls.zoneName.invalid &&
+              createMultisiteEntitiesForm.controls.zoneName.dirty
+            "
           />
         </cds-text-label>
         <ng-template #zoneNameError>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html
index 84cc7ccc23c..7fb090aefcc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zone-deletion-form/rgw-multisite-zone-deletion-form.component.html
@@ -1,60 +1,80 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Delete zone</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Delete zone
+    </h3>
   </cds-modal-header>
 
   <ng-container>
     <section cdsModalContent>
-      <form [formGroup]="zoneForm"
-            novalidate>
-        <legend class="cds--label-description"
-               i18n>
+      <form
+        [formGroup]="zoneForm"
+        novalidate
+      >
+        <legend
+          class="cds--label-description"
+          i18n
+        >
           This will delete your <strong>{{ zone?.name }}</strong> Zone.
         </legend>
         @if (includedPools.size) {
-        <legend class="cds--label-description"
-               i18n>
-          Do you want to delete the associated pools with the
-          <strong>{{ zone?.name }}</strong> Zone?
-        </legend>
-        <legend class="cds--label-description"
-               i18n>
-          This will delete the following pools and any data stored in these pools:
-        </legend>
+          <legend
+            class="cds--label-description"
+            i18n
+          >
+            Do you want to delete the associated pools with the
+            <strong>{{ zone?.name }}</strong> Zone?
+          </legend>
+          <legend
+            class="cds--label-description"
+            i18n
+          >
+            This will delete the following pools and any data stored in these pools:
+          </legend>
 
-        <div class="scroll-list">
-          @for (pool of includedPools; track pool) {
-          <div>
-            <strong>{{ pool }}</strong>
+          <div class="scroll-list">
+            @for (pool of includedPools; track pool) {
+              <div>
+                <strong>{{ pool }}</strong>
+              </div>
+            }
           </div>
+
+          <div class="form-item">
+            <cds-checkbox
+              id="deletePools"
+              formControlName="deletePools"
+              (checkedChange)="showDangerText()"
+              i18n
+              >Yes, I want to delete the pools.
+            </cds-checkbox>
+          </div>
+
+          @if (displayText) {
+            <cd-alert-panel
+              type="danger"
+              i18n
+            >
+              This will delete all the data in the pools!
+            </cd-alert-panel>
           }
-        </div>
-
-        <div class="form-item">
-          <cds-checkbox id="deletePools"
-                        formControlName="deletePools"
-                        (checkedChange)="showDangerText()"
-                        i18n>Yes, I want to delete the pools.
-          </cds-checkbox>
-        </div>
-
-        @if (displayText) {
-        <cd-alert-panel type="danger"
-                        i18n>
-          This will delete all the data in the pools!
-        </cd-alert-panel>
-        }
         }
       </form>
     </section>
   </ng-container>
 
-  <cd-form-button-panel (submitActionEvent)="submit()"
-                        [form]="zoneForm"
-                        [submitText]="actionLabels.DELETE"
-                        [modalForm]="true">
+  <cd-form-button-panel
+    (submitActionEvent)="submit()"
+    [form]="zoneForm"
+    [submitText]="actionLabels.DELETE"
+    [modalForm]="true"
+  >
   </cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html
index 98ac65ddf6e..2931daa4a79 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.html
@@ -1,74 +1,97 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Delete zonegroup</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Delete zonegroup
+    </h3>
   </cds-modal-header>
 
   <ng-container>
     <section cdsModalContent>
-      <form name="zonegroupForm"
-            [formGroup]="zonegroupForm"
-            novalidate>
-        <legend class="cds--label-description"
-               i18n>
+      <form
+        name="zonegroupForm"
+        [formGroup]="zonegroupForm"
+        novalidate
+      >
+        <legend
+          class="cds--label-description"
+          i18n
+        >
           This will delete your <strong>{{ zonegroup?.name }}</strong> Zonegroup.
         </legend>
 
-      @if (zonesList.length > 0) {
-        <ng-container>
-          <legend class="cds--label-description"
-                 i18n>
-            Do you want to delete the associated zones and pools with the <strong>{{zonegroup?.name}}</strong> Zonegroup?
-          </legend>
+        @if (zonesList.length > 0) {
+          <ng-container>
+            <legend
+              class="cds--label-description"
+              i18n
+            >
+              Do you want to delete the associated zones and pools with the
+              <strong>{{ zonegroup?.name }}</strong> Zonegroup?
+            </legend>
 
-          @if (includedPools.size > 0) {
-            <ng-container>
-              <legend class="cds--label-description"
-                     i18n>
-                This will delete the following:
-              </legend>
-            </ng-container>
-          }
-
-          <div><strong>Zones:</strong></div>
-          <div class="scroll-list">
-          @for (zone of zonesList; track zone) {
-            <div><strong>{{zone}}</strong></div>
-          }
-          </div>
-          @if (includedPools.size > 0) {
-            <ng-container>
-              <div><strong>Pools:</strong></div>
-              <div class="scroll-list">
-              @for (pool of includedPools; track pool) {
-                <div><strong>{{ pool }}</strong></div>
-              }
-              </div>
-            </ng-container>
-          }
-
-          <div class="form-item">
-            <cds-checkbox id="deletePools"
-                          formControlName="deletePools"
-                          (checkedChange)="showDangerText()">
             @if (includedPools.size > 0) {
-              <span i18n>Yes, I want to delete the zones and their pools.</span>
-            } @else {
-              <span i18n>Yes, I want to delete the zones.</span>
+              <ng-container>
+                <legend
+                  class="cds--label-description"
+                  i18n
+                >
+                  This will delete the following:
+                </legend>
+              </ng-container>
             }
-            </cds-checkbox>
-          </div>
 
-        @if (displayText) {
-          <cd-alert-panel type="danger"
-                          i18n>
-            This will delete all the data in the pools!
-          </cd-alert-panel>
+            <div><strong>Zones:</strong></div>
+            <div class="scroll-list">
+              @for (zone of zonesList; track zone) {
+                <div>
+                  <strong>{{ zone }}</strong>
+                </div>
+              }
+            </div>
+            @if (includedPools.size > 0) {
+              <ng-container>
+                <div><strong>Pools:</strong></div>
+                <div class="scroll-list">
+                  @for (pool of includedPools; track pool) {
+                    <div>
+                      <strong>{{ pool }}</strong>
+                    </div>
+                  }
+                </div>
+              </ng-container>
+            }
+
+            <div class="form-item">
+              <cds-checkbox
+                id="deletePools"
+                formControlName="deletePools"
+                (checkedChange)="showDangerText()"
+              >
+                @if (includedPools.size > 0) {
+                  <span i18n>Yes, I want to delete the zones and their pools.</span>
+                } @else {
+                  <span i18n>Yes, I want to delete the zones.</span>
+                }
+              </cds-checkbox>
+            </div>
+
+            @if (displayText) {
+              <cd-alert-panel
+                type="danger"
+                i18n
+              >
+                This will delete all the data in the pools!
+              </cd-alert-panel>
+            }
+          </ng-container>
         }
-        </ng-container>
-      }
       </form>
     </section>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
index 641b3c9c94e..8f76fca74a1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-role-form/rgw-account-role-form.component.html
@@ -1,175 +1,280 @@
-<cds-modal size="md" [open]="open" [hasScrollingContent]="false" (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
     @if (isEdit) {
-      <h4 cdsModalHeaderLabel class="cds--type-label-01" i18n>Role</h4>
-      <h3 cdsModalHeaderHeading i18n>Edit session duration</h3>
-      <p class="cds--modal-header__description cds--type-body-01 cds-mt-3" i18n>
+      <h4
+        cdsModalHeaderLabel
+        class="cds--type-label-01"
+        i18n
+      >
+        Role
+      </h4>
+      <h3
+        cdsModalHeaderHeading
+        i18n
+      >
+        Edit session duration
+      </h3>
+      <p
+        class="cds--modal-header__description cds--type-body-01 cds-mt-3"
+        i18n
+      >
         Update the maximum session duration for this role.
       </p>
     } @else {
-      <h4 cdsModalHeaderLabel class="cds--type-label-01" i18n>User account</h4>
-      <h3 cdsModalHeaderHeading i18n>Create role</h3>
-      <p class="cds--modal-header__description cds--type-body-01 cds-mt-3" i18n>
+      <h4
+        cdsModalHeaderLabel
+        class="cds--type-label-01"
+        i18n
+      >
+        User account
+      </h4>
+      <h3
+        cdsModalHeaderHeading
+        i18n
+      >
+        Create role
+      </h3>
+      <p
+        class="cds--modal-header__description cds--type-body-01 cds-mt-3"
+        i18n
+      >
         Role grants temporary permissions to trusted users, applications, or services.
       </p>
     }
   </cds-modal-header>
 
-  <form class="form" #formDir="ngForm" [formGroup]="form">
+  <form
+    class="form"
+    #formDir="ngForm"
+    [formGroup]="form"
+  >
     <div cdsModalContent>
       @if (!isEdit) {
-      <!-- Account -->
-      <div class="form-item">
-        <label class="cds--label cds--type-label-01" i18n>Account</label>
-        <p class="cds--type-body-01">{{ accountName }}</p>
-      </div>
-
-      <!-- Role Name -->
-      <div class="form-item">
-        <cds-text-label
-          label="Role name"
-          for="role_name"
-          [invalid]="roleName.isInvalid"
-          [invalidText]="roleNameError"
-          helperText="Unique name used to identify this role within the account."
-          i18n-helperText
-          >Role name
-          <input
-            cdsText
-            cdValidate
-            #roleName="cdValidate"
-            type="text"
-            id="role_name"
-            name="role_name"
-            formControlName="role_name"
-            placeholder="Enter a role name (e.g. BackupServiceRole)"
-            [invalid]="roleName.isInvalid"
-            [autofocus]="true"
-            modal-primary-focus
-          />
-        </cds-text-label>
-        <ng-template #roleNameError>
-          @if (form.showError('role_name', formDir, 'required')) {
-          <span class="invalid-feedback" i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
-
-      <!-- Role (Edit only) -->
-      } @else {
-      <div class="form-item">
-        <label class="cds--label cds--type-label-01" i18n>Role</label>
-        <p class="cds--type-body-01">
-          <cds-tooltip-definition
-            align="right"
-            [description]="accountTooltip"
-            [openOnHover]="true"
-            [caret]="true"
-            [highContrast]="true"
-            [dropShadow]="true"
-            [autoAlign]="true"
+        <!-- Account -->
+        <div class="form-item">
+          <legend
+            class="cds--label cds--type-label-01"
+            i18n
           >
-            {{ form.getValue('role_name') }}
-          </cds-tooltip-definition>
-        </p>
-        <ng-template #accountTooltip>
-          <div>
-            User account:<br />
-            <strong>{{ accountName }}</strong>
-          </div>
-        </ng-template>
-      </div>
+            Account
+          </legend>
+          <p class="cds--type-body-01">{{ accountName }}</p>
+        </div>
+
+        <!-- Role Name -->
+        <div class="form-item">
+          <cds-text-label
+            label="Role name"
+            for="role_name"
+            [invalid]="roleName.isInvalid"
+            [invalidText]="roleNameError"
+            helperText="Unique name used to identify this role within the account."
+            i18n-helperText
+            >Role name
+            <input
+              cdsText
+              cdValidate
+              #roleName="cdValidate"
+              type="text"
+              id="role_name"
+              name="role_name"
+              formControlName="role_name"
+              placeholder="Enter a role name (e.g. BackupServiceRole)"
+              [invalid]="roleName.isInvalid"
+              [autofocus]="true"
+              modal-primary-focus
+            />
+          </cds-text-label>
+          <ng-template #roleNameError>
+            @if (form.showError('role_name', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
+
+        <!-- Role (Edit only) -->
+      } @else {
+        <div class="form-item">
+          <legend
+            class="cds--label cds--type-label-01"
+            i18n
+          >
+            Role
+          </legend>
+          <p class="cds--type-body-01">
+            <cds-tooltip-definition
+              align="right"
+              [description]="accountTooltip"
+              [openOnHover]="true"
+              [caret]="true"
+              [highContrast]="true"
+              [dropShadow]="true"
+              [autoAlign]="true"
+            >
+              {{ form.getValue('role_name') }}
+            </cds-tooltip-definition>
+          </p>
+          <ng-template #accountTooltip>
+            <div>
+              User account:<br />
+              <strong>{{ accountName }}</strong>
+            </div>
+          </ng-template>
+        </div>
       }
 
       <!-- Path & Assume Role Policy Document (Create only) -->
       @if (!isEdit) {
-      <!-- Path -->
-      <div class="form-item">
-        <cds-text-label
-          label="Role path"
-          for="role_path"
-          [invalid]="rolePath.isInvalid"
-          [invalidText]="pathError"
-          helperText='Specifies the hierarchy or namespace for the role. Use "/" for the root path.'
-          i18n-helperText
-          >Role path
-          <input
-            cdsText
-            cdValidate
-            #rolePath="cdValidate"
-            type="text"
-            id="role_path"
-            name="role_path"
-            formControlName="role_path"
-            placeholder="Enter path (/applications/)"
+        <!-- Path -->
+        <div class="form-item">
+          <cds-text-label
+            label="Role path"
+            for="role_path"
             [invalid]="rolePath.isInvalid"
-          />
-        </cds-text-label>
-        <ng-template #pathError>
-          @if (form.showError('role_path', formDir, 'required')) {
-          <span class="invalid-feedback" i18n>This field is required.</span>
-          }
-        </ng-template>
-      </div>
+            [invalidText]="pathError"
+            helperText='Specifies the hierarchy or namespace for the role. Use "/" for the root path.'
+            i18n-helperText
+            >Role path
+            <input
+              cdsText
+              cdValidate
+              #rolePath="cdValidate"
+              type="text"
+              id="role_path"
+              name="role_path"
+              formControlName="role_path"
+              placeholder="Enter path (/applications/)"
+              [invalid]="rolePath.isInvalid"
+              [invalidText]="pathError"
+            />Path
+            <input
+              cdsText
+              cdValidate
+              #rolePath="cdValidate"
+              type="text"
+              id="role_path"
+              name="role_path"
+              formControlName="role_path"
+              placeholder="Placeholder text"
+              [invalid]="rolePath.isInvalid"
+            />
+          </cds-text-label>
+          <ng-template #pathError>
+            @if (form.showError('role_path', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+          </ng-template>
+        </div>
 
-      <!-- Assume Role Policy Document -->
-      <div class="form-item">
-        <cds-textarea-label
-          labelInputID="role_assume_policy_doc"
-          [invalid]="policyDoc.isInvalid"
-          [invalidText]="policyError"
-          helperText="Defines which principals can assume this role. Enter a valid JSON policy document."
-          i18n-helperText
-          >Trust policy
-          <textarea
-            cdsTextArea
-            cdValidate
-            #policyDoc="cdValidate"
-            id="role_assume_policy_doc"
-            name="role_assume_policy_doc"
-            formControlName="role_assume_policy_doc"
-            placeholder="Enter a JSON trust policy document"
-            rows="8"
-            cols="200"
+        <!-- Assume Role Policy Document -->
+        <div class="form-item">
+          <cds-textarea-label
+            labelInputID="role_assume_policy_doc"
             [invalid]="policyDoc.isInvalid"
             [invalidText]="policyError"
-          ></textarea>
-        </cds-textarea-label>
-        <ng-template #policyError>
-          @if (form.showError('role_assume_policy_doc', formDir, 'required')) {
-          <span class="invalid-feedback" i18n>This field is required.</span>
-          } @if (form.showError('role_assume_policy_doc', formDir, 'json')) {
-          <span class="invalid-feedback" i18n>Must be a valid JSON.</span>
-          }
-        </ng-template>
-      </div>
+            helperText="Defines which principals can assume this role. Enter a valid JSON policy document."
+            i18n-helperText
+            >Trust policy
+            <textarea
+              cdsTextArea
+              cdValidate
+              #policyDoc="cdValidate"
+              id="role_assume_policy_doc"
+              name="role_assume_policy_doc"
+              formControlName="role_assume_policy_doc"
+              placeholder="Enter a JSON trust policy document"
+              rows="8"
+              cols="200"
+              [invalid]="policyDoc.isInvalid"
+              [invalidText]="policyError"
+              cdRequiredField="Trust Policy"
+            >
+Trust policy
+            <textarea
+              cdsTextArea
+              cdValidate
+              #policyDoc="cdValidate"
+              id="role_assume_policy_doc"
+              name="role_assume_policy_doc"
+              formControlName="role_assume_policy_doc"
+              placeholder="Placeholder text"
+              rows="8"
+              cols="200"
+              [invalid]="policyDoc.isInvalid"
+              [invalidText]="policyError"
+            ></textarea>
+          </cds-textarea-label>
+          <ng-template #policyError>
+            @if (form.showError('role_assume_policy_doc', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (form.showError('role_assume_policy_doc', formDir, 'json')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Must be a valid JSON.</span
+              >
+            }
+          </ng-template>
+        </div>
       }
 
       <!-- Maximum Session Duration (Edit only) -->
       @if (isEdit) {
-      <div class="form-item">
-        <cds-number
-          label="Maximum session duration (hours)"
-          cdValidate
-          #maxSessionDuration="cdValidate"
-          [invalid]="maxSessionDuration.isInvalid"
-          [invalidText]="durationError"
-          formControlName="max_session_duration"
-          min="1"
-          max="12"
-          i18n-label
-        >
-        </cds-number>
-        <ng-template #durationError>
-          @if (form.showError('max_session_duration', formDir, 'required')) {
-          <span class="invalid-feedback" i18n>This field is required.</span>
-          } @if (form.showError('max_session_duration', formDir, 'min')) {
-          <span class="invalid-feedback" i18n>Minimum value is 1 hour.</span>
-          } @if (form.showError('max_session_duration', formDir, 'max')) {
-          <span class="invalid-feedback" i18n>Maximum value is 12 hours.</span>
-          }
-        </ng-template>
-      </div>
+        <div class="form-item">
+          <cds-number
+            label="Maximum session duration (hours)"
+            cdValidate
+            #maxSessionDuration="cdValidate"
+            [invalid]="maxSessionDuration.isInvalid"
+            [invalidText]="durationError"
+            formControlName="max_session_duration"
+            min="1"
+            max="12"
+            i18n-label
+          >
+          </cds-number>
+          <ng-template #durationError>
+            @if (form.showError('max_session_duration', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            }
+            @if (form.showError('max_session_duration', formDir, 'min')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Minimum value is 1 hour.</span
+              >
+            }
+            @if (form.showError('max_session_duration', formDir, 'max')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >Maximum value is 12 hours.</span
+              >
+            }
+          </ng-template>
+        </div>
       }
     </div>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html
index 209f15a6daa..d0cc9a34736 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-account-roles-list/rgw-account-roles-list.component.html
@@ -1,14 +1,18 @@
-<cd-table #table
-          [autoReload]="true"
-          [data]="data$ | async"
-          [columns]="columns"
-          selectionType="single"
-          columnMode="flex"
-          (updateSelection)="updateSelection($event)"
-          identifier="RoleName">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [autoReload]="true"
+  [data]="data$ | async"
+  [columns]="columns"
+  selectionType="single"
+  columnMode="flex"
+  (updateSelection)="updateSelection($event)"
+  identifier="RoleName"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.html
index 817088ad4b8..901a5acb730 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.html
@@ -1,49 +1,83 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="rgw-bucket-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="rgw-bucket-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-
-        <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-               data-testid="rgw-bucket-details">
+        <table
+          class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+          data-testid="rgw-bucket-details"
+        >
           <tbody>
             <tr>
-              <td i18n
-                  class="bold w-25">Versioning</td>
+              <td
+                i18n
+                class="bold w-25"
+              >
+                Versioning
+              </td>
               <td class="w-75">{{ selection.versioning }}</td>
             </tr>
             <tr>
-              <td i18n
-                  class="bold">Encryption</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Encryption
+              </td>
               <td>{{ selection.encryption }}</td>
             </tr>
             <tr>
-              <td i18n
-                  class="bold">Replication</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Replication
+              </td>
               <td>{{ replicationStatus }}</td>
             </tr>
             <tr>
-              <td i18n
-                  class="bold">MFA Delete</td>
+              <td
+                i18n
+                class="bold"
+              >
+                MFA Delete
+              </td>
               <td>{{ selection.mfa_delete }}</td>
             </tr>
             <tr>
-              <td i18n
-                  class="bold">Index type</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Index type
+              </td>
               <td>{{ selection.index_type }}</td>
             </tr>
             <tr>
-              <td i18n
-                  class="bold">Placement rule</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Placement rule
+              </td>
               <td>{{ selection.placement_rule }}</td>
             </tr>
             <tr>
-              <td i18n
-                  class="bold">Last modification time</td>
+              <td
+                i18n
+                class="bold"
+              >
+                Last modification time
+              </td>
               <td>{{ selection.mtime | cdDate }}</td>
             </tr>
           </tbody>
@@ -52,29 +86,51 @@
         <!-- Bucket quota -->
         <div>
           <legend i18n>Bucket quota</legend>
-          <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-                 data-testid="rgw-bucket-quota-details">
+          <table
+            class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+            data-testid="rgw-bucket-quota-details"
+          >
             <tbody>
               <tr>
-                <td i18n
-                    class="bold w-25">Enabled</td>
+                <td
+                  i18n
+                  class="bold w-25"
+                >
+                  Enabled
+                </td>
                 <td class="w-75">{{ selection.bucket_quota.enabled | booleanText }}</td>
               </tr>
               <ng-container *ngIf="selection.bucket_quota.enabled">
                 <tr>
-                  <td i18n
-                      class="bold">Maximum size</td>
-                  <td *ngIf="selection.bucket_quota.max_size <= -1"
-                      i18n>Unlimited</td>
+                  <td
+                    i18n
+                    class="bold"
+                  >
+                    Maximum size
+                  </td>
+                  <td
+                    *ngIf="selection.bucket_quota.max_size <= -1"
+                    i18n
+                  >
+                    Unlimited
+                  </td>
                   <td *ngIf="selection.bucket_quota.max_size > -1">
                     {{ selection.bucket_quota.max_size | dimless }}
                   </td>
                 </tr>
                 <tr>
-                  <td i18n
-                      class="bold">Maximum objects</td>
-                  <td *ngIf="selection.bucket_quota.max_objects <= -1"
-                      i18n>Unlimited</td>
+                  <td
+                    i18n
+                    class="bold"
+                  >
+                    Maximum objects
+                  </td>
+                  <td
+                    *ngIf="selection.bucket_quota.max_objects <= -1"
+                    i18n
+                  >
+                    Unlimited
+                  </td>
                   <td *ngIf="selection.bucket_quota.max_objects > -1">
                     {{ selection.bucket_quota.max_objects }}
                   </td>
@@ -86,23 +142,37 @@
 
         <!-- Locking -->
         <legend i18n>Locking</legend>
-        <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-               data-testid="rgw-bucket-locking-details">
+        <table
+          class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+          data-testid="rgw-bucket-locking-details"
+        >
           <tbody>
             <tr>
-              <td i18n
-                  class="bold w-25">Enabled</td>
+              <td
+                i18n
+                class="bold w-25"
+              >
+                Enabled
+              </td>
               <td class="w-75">{{ selection.lock_enabled | booleanText }}</td>
             </tr>
             <ng-container *ngIf="selection.lock_enabled">
               <tr>
-                <td i18n
-                    class="bold">Mode</td>
+                <td
+                  i18n
+                  class="bold"
+                >
+                  Mode
+                </td>
                 <td>{{ selection.lock_mode }}</td>
               </tr>
               <tr>
-                <td i18n
-                    class="bold">Days</td>
+                <td
+                  i18n
+                  class="bold"
+                >
+                  Days
+                </td>
                 <td>{{ selection.lock_retention_period_days }}</td>
               </tr>
             </ng-container>
@@ -112,101 +182,153 @@
         <!-- Tags -->
         <ng-container *ngIf="(selection.tagset | keyvalue)?.length">
           <legend i18n>Tags</legend>
-          <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
+          <table
+            class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+          >
             <tbody>
               <tr *ngFor="let tag of selection.tagset | keyvalue">
-                <td i18n
-                    class="bold w-25">{{tag.key}}</td>
+                <td
+                  i18n
+                  class="bold w-25"
+                >
+                  {{ tag.key }}
+                </td>
                 <td class="w-75">{{ tag.value }}</td>
               </tr>
             </tbody>
           </table>
         </ng-container>
 
-
         <!-- Bucket Rate Limit -->
         <ng-container *ngIf="!!bucketRateLimit">
-          <cd-rgw-rate-limit-details [rateLimitConfig]="bucketRateLimit"
-                                     [type]="'bucket'"></cd-rgw-rate-limit-details>
+          <cd-rgw-rate-limit-details
+            [rateLimitConfig]="bucketRateLimit"
+            [type]="'bucket'"
+          ></cd-rgw-rate-limit-details>
         </ng-container>
       </ng-template>
     </ng-container>
 
     <ng-container ngbNavItem="permissions">
-      <a ngbNavLink
-         i18n>Policies</a>
+      <a
+        ngbNavLink
+        i18n
+        >Policies</a
+      >
       <ng-template ngbNavContent>
         <div>
-          <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
+          <table
+            class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+          >
             <tbody>
               <tr>
-                <td i18n
-                    class="bold w-25">Bucket policy</td>
-                <td><pre>{{ selection.bucket_policy | json}}</pre></td>
+                <td
+                  i18n
+                  class="bold w-25"
+                >
+                  Bucket policy
+                </td>
+                <td>
+                  <pre>{{ selection.bucket_policy | json }}</pre>
+                </td>
               </tr>
               <tr>
-                <td i18n
-                    class="bold w-25">Lifecycle
-                  <div *ngIf="(selection.lifecycle | json) !== '{}'"
-                       class="input-group">
-                    <button type="button"
-                            class="btn btn-light"
-                            [ngClass]="{'active': lifecycleFormat === 'json'}"
-                            (click)="updateLifecycleFormatTo('json')">
-                          JSON
+                <td
+                  i18n
+                  class="bold w-25"
+                >
+                  Lifecycle
+                  <div
+                    *ngIf="(selection.lifecycle | json) !== '{}'"
+                    class="input-group"
+                  >
+                    <button
+                      type="button"
+                      class="btn btn-light"
+                      [ngClass]="{ active: lifecycleFormat === 'json' }"
+                      (click)="updateLifecycleFormatTo('json')"
+                    >
+                      JSON
                     </button>
-                    <button type="button"
-                            class="btn btn-light"
-                            [ngClass]="{'active': lifecycleFormat === 'xml'}"
-                            (click)="updateLifecycleFormatTo('xml')">
-                          XML
+                    <button
+                      type="button"
+                      class="btn btn-light"
+                      [ngClass]="{ active: lifecycleFormat === 'xml' }"
+                      (click)="updateLifecycleFormatTo('xml')"
+                    >
+                      XML
                     </button>
                   </div>
                 </td>
                 <td>
-                  <cds-code-snippet display="multi"
-                                    *ngIf="lifecycleFormat === 'json'">
-                    {{selection.lifecycle | json}}
+                  <cds-code-snippet
+                    display="multi"
+                    *ngIf="lifecycleFormat === 'json'"
+                  >
+                    {{ selection.lifecycle | json }}
                   </cds-code-snippet>
-                  <cds-code-snippet display="multi"
-                                    *ngIf="lifecycleFormat === 'xml'">
-                    {{ (selection.lifecycle | xml:{'Rules':'Rule'}) || '-'}}
+                  <cds-code-snippet
+                    display="multi"
+                    *ngIf="lifecycleFormat === 'xml'"
+                  >
+                    {{ (selection.lifecycle | xml: { Rules: 'Rule' }) || '-' }}
                   </cds-code-snippet>
                 </td>
               </tr>
               <tr *ngIf="selection.lifecycle_progress?.length > 0">
-                <td i18n
-                    class="bold w-25">
+                <td
+                  i18n
+                  class="bold w-25"
+                >
                   Lifecycle progress
                 </td>
                 <td>
-                  <cds-tooltip [description]="lifecycleProgressMap.get(lifecycleProgress.status)?.description"
-                               [align]="'top'">
-                    <cds-tag size="md"
-                             [type]="lifecycleProgressMap.get(lifecycleProgress.status)?.color">
+                  <cds-tooltip
+                    [description]="lifecycleProgressMap.get(lifecycleProgress.status)?.description"
+                    [align]="'top'"
+                  >
+                    <cds-tag
+                      size="md"
+                      [type]="lifecycleProgressMap.get(lifecycleProgress.status)?.color"
+                    >
                       {{ lifecycleProgress.status }}
                     </cds-tag>
                   </cds-tooltip>
-                  <div *ngIf="lifecycleProgress?.status !== 'UNINITIAL'"
-                       class="spacing-left">{{lifecycleProgress?.started}}</div>
+                  <div
+                    *ngIf="lifecycleProgress?.status !== 'UNINITIAL'"
+                    class="spacing-left"
+                  >
+                    {{ lifecycleProgress?.started }}
+                  </div>
                 </td>
               </tr>
               <tr>
-                <td i18n
-                    class="bold w-25">Replication policy</td>
+                <td
+                  i18n
+                  class="bold w-25"
+                >
+                  Replication policy
+                </td>
                 <td>
-                @if(hasSyncPolicyOnly) {
-                Sync policy configured. View on
-                <a routerLink="/rgw/multisite/sync-policy"
-                   i18n>Sync-policy page.</a>
-                } @else {
-                  <pre>{{ replicationData?.policy | json}}</pre>
-                }
+                  @if (hasSyncPolicyOnly) {
+                    Sync policy configured. View on
+                    <a
+                      routerLink="/rgw/multisite/sync-policy"
+                      i18n
+                      >Sync-policy page.</a
+                    >
+                  } @else {
+                    <pre>{{ replicationData?.policy | json }}</pre>
+                  }
                 </td>
               </tr>
               <tr>
-                <td i18n
-                    class="bold w-25">ACL</td>
+                <td
+                  i18n
+                  class="bold w-25"
+                >
+                  ACL
+                </td>
                 <td>
                   <table class="table">
                     <thead>
@@ -218,15 +340,15 @@
                     <tbody>
                       <tr i18n>
                         <td>Bucket Owner</td>
-                        <td>{{ aclPermissions.Owner || '-'}}</td>
+                        <td>{{ aclPermissions.Owner || '-' }}</td>
                       </tr>
                       <tr i18n>
                         <td>Everyone</td>
-                        <td>{{ aclPermissions.AllUsers || '-'}}</td>
+                        <td>{{ aclPermissions.AllUsers || '-' }}</td>
                       </tr>
                       <tr i18n>
                         <td>Authenticated users group</td>
-                        <td>{{ aclPermissions.AuthenticatedUsers || '-'}}</td>
+                        <td>{{ aclPermissions.AuthenticatedUsers || '-' }}</td>
                       </tr>
                     </tbody>
                   </table>
@@ -239,16 +361,24 @@
     </ng-container>
 
     <ng-container ngbNavItem="tiering">
-      <a ngbNavLink
-         i18n>Tiering</a>
+      <a
+        ngbNavLink
+        i18n
+        >Tiering</a
+      >
       <ng-template ngbNavContent>
-        <cd-rgw-bucket-lifecycle-list [bucket]="selection"
-                                      (updateBucketDetails)="updateBucketDetails(extractLifecycleDetails.bind(this))"></cd-rgw-bucket-lifecycle-list>
+        <cd-rgw-bucket-lifecycle-list
+          [bucket]="selection"
+          (updateBucketDetails)="updateBucketDetails(extractLifecycleDetails.bind(this))"
+        ></cd-rgw-bucket-lifecycle-list>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="notification">
-      <a ngbNavLink
-         i18n>Notification</a>
+      <a
+        ngbNavLink
+        i18n
+        >Notification</a
+      >
       <ng-template ngbNavContent>
         <cd-rgw-bucket-notification-list [bucket]="selection"></cd-rgw-bucket-notification-list>
       </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html
index 5dc70c285c6..fd7f13e1295 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.html
@@ -1,77 +1,121 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}"
-     *cdFormLoading="loading">
-  <form name="bucketForm"
-        #frm="ngForm"
-        [formGroup]="bucketForm"
-        novalidate>
-
-    <div i18n="form title"
-         class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}</div>
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+  *cdFormLoading="loading"
+>
+  <form
+    name="bucketForm"
+    #frm="ngForm"
+    [formGroup]="bucketForm"
+    novalidate
+  >
+    <div
+      i18n="form title"
+      class="form-header"
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </div>
 
     <!-- Id -->
-    <div class="form-item"
-         *ngIf="editing">
-      <cds-text-label for="id"
-                      i18n>Id
-        <input cdsText
-               id="id"
-               name="id"
-               formControlName="id"
-               readonly>
+    <div
+      class="form-item"
+      *ngIf="editing"
+    >
+      <cds-text-label
+        for="id"
+        i18n
+        >Id
+        <input
+          cdsText
+          id="id"
+          name="id"
+          formControlName="id"
+          readonly
+        />
       </cds-text-label>
     </div>
 
     <!-- Name -->
     <div class="form-item">
-      <cds-text-label for="bid"
-                      cdRequiredField="Name"
-                      [invalid]="!bucketForm.controls.bid.valid && bucketForm.controls.bid.dirty"
-                      [invalidText]="nameError"
-                      i18n>Name
-        <input cdsText
-               placeholder="Name..."
-               i18n-placeholder
-               id="bid"
-               name="bid"
-               formControlName="bid"
-               [readonly]="editing"
-               [autofocus]="!editing"
-               [invalid]="!bucketForm.controls.bid.valid && bucketForm.controls.bid.dirty">
+      <cds-text-label
+        for="bid"
+        cdRequiredField="Name"
+        [invalid]="!bucketForm.controls.bid.valid && bucketForm.controls.bid.dirty"
+        [invalidText]="nameError"
+        i18n
+        >Name
+        <input
+          cdsText
+          placeholder="Name..."
+          i18n-placeholder
+          id="bid"
+          name="bid"
+          formControlName="bid"
+          [readonly]="editing"
+          [autofocus]="!editing"
+          [invalid]="!bucketForm.controls.bid.valid && bucketForm.controls.bid.dirty"
+        />
       </cds-text-label>
       <ng-template #nameError>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'required')"
-              i18n>This field is required.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'bucketNameInvalid')"
-              i18n>Bucket names can only contain lowercase letters, numbers, periods and hyphens.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'bucketNameNotAllowed')"
-              i18n>The chosen name is already in use.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'containsUpperCase')"
-              i18n>Bucket names must not contain uppercase characters or underscores.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'lowerCaseOrNumber')"
-              i18n>Each label must start and end with a lowercase letter or a number.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'ipAddress')"
-              i18n>Bucket names cannot be formatted as IP address.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'onlyLowerCaseAndNumbers')"
-              i18n>Bucket labels cannot be empty and can only contain lowercase letters, numbers and hyphens.</span>
-        <span class="invalid-feedback"
-              *ngIf="bucketForm.showError('bid', frm, 'shouldBeInRange')"
-              i18n>Bucket names must be 3 to 63 characters long.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'required')"
+          i18n
+          >This field is required.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'bucketNameInvalid')"
+          i18n
+          >Bucket names can only contain lowercase letters, numbers, periods and hyphens.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'bucketNameNotAllowed')"
+          i18n
+          >The chosen name is already in use.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'containsUpperCase')"
+          i18n
+          >Bucket names must not contain uppercase characters or underscores.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'lowerCaseOrNumber')"
+          i18n
+          >Each label must start and end with a lowercase letter or a number.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'ipAddress')"
+          i18n
+          >Bucket names cannot be formatted as IP address.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'onlyLowerCaseAndNumbers')"
+          i18n
+          >Bucket labels cannot be empty and can only contain lowercase letters, numbers and
+          hyphens.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="bucketForm.showError('bid', frm, 'shouldBeInRange')"
+          i18n
+          >Bucket names must be 3 to 63 characters long.</span
+        >
       </ng-template>
     </div>
 
     <!-- Accounts -->
-    @if(accounts.length && accountUsers.length > 0){
+    @if (accounts.length && accountUsers.length > 0) {
       <div class="form-item">
-        <cds-checkbox formControlName="isAccountOwner"
-                      i18n>Select account user
+        <cds-checkbox
+          formControlName="isAccountOwner"
+          i18n
+          >Select account user
         </cds-checkbox>
       </div>
     }
@@ -79,54 +123,91 @@
     @if (bucketForm.get('isAccountOwner').value) {
       <!-- Account user -->
       <div class="form-item">
-        <cds-select label="Account user"
-                    id="acc_user"
-                    formControlName="accountUser"
-                    [invalidText]="accountUserError"
-                    [invalid]="!bucketForm.controls.accountUser.valid && bucketForm.controls.accountUser.dirty"
-                    cdRequiredField="Account user"
-                    i18n>Account user
-          <option *ngIf="accountusers === null"
-                  [ngValue]="null">Loading...</option>
-          <option *ngIf="accountusers !== null"
-                  value="">-- Select a user --</option>
-          <option *ngFor="let user of accountUsers"
-                  [value]="user.uid">{{ user.uid }}</option>
+        <cds-select
+          label="Account user"
+          id="acc_user"
+          formControlName="accountUser"
+          [invalidText]="accountUserError"
+          [invalid]="
+            !bucketForm.controls.accountUser.valid && bucketForm.controls.accountUser.dirty
+          "
+          cdRequiredField="Account user"
+          i18n
+          >Account user
+          <option
+            *ngIf="accountusers === null"
+            [ngValue]="null"
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="accountusers !== null"
+            value=""
+          >
+            -- Select a user --
+          </option>
+          <option
+            *ngFor="let user of accountUsers"
+            [value]="user.uid"
+          >
+            {{ user.uid }}
+          </option>
         </cds-select>
         <ng-template #accountUserError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('accountUser', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('accountUser', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
         <cd-alert-panel
           type="info"
           *ngIf="bucketForm.get('accountUser').disabled"
-          i18n>
-            The bucket is owned by an account. UI does not support changing
-            the ownership of bucket owned by an account.
+          i18n
+        >
+          The bucket is owned by an account. UI does not support changing the ownership of bucket
+          owned by an account.
         </cd-alert-panel>
       </div>
     } @else {
       <!-- Owner -->
       <div class="form-item">
-        <cds-select label="Owner"
-                    formControlName="owner"
-                    id="owner"
-                    [invalidText]="ownerError"
-                    [invalid]="!bucketForm.controls.owner.valid && bucketForm.controls.owner.dirty"
-                    cdRequiredField="Owner"
-                    i18n>Owner
-          <option *ngIf="owners === null"
-                  [ngValue]="null">Loading...</option>
-          <option *ngIf="owners !== null"
-                  value="">-- Select a user --</option>
-          <option *ngFor="let owner of owners"
-                  [value]="owner.uid">{{ owner.uid }}</option>
+        <cds-select
+          label="Owner"
+          formControlName="owner"
+          id="owner"
+          [invalidText]="ownerError"
+          [invalid]="!bucketForm.controls.owner.valid && bucketForm.controls.owner.dirty"
+          cdRequiredField="Owner"
+          i18n
+          >Owner
+          <option
+            *ngIf="owners === null"
+            [ngValue]="null"
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="owners !== null"
+            value=""
+          >
+            -- Select a user --
+          </option>
+          <option
+            *ngFor="let owner of owners"
+            [value]="owner.uid"
+          >
+            {{ owner.uid }}
+          </option>
         </cds-select>
         <ng-template #ownerError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('owner', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('owner', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
     }
@@ -134,14 +215,20 @@
     <!-- Versioning -->
     <fieldset *ngIf="editing">
       <div class="form-item">
-        <legend class="cd-header"
-                i18n>Versioning</legend>
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Versioning
+        </legend>
 
-        <cds-checkbox name="versioning"
-                      formControlName="versioning"
-                      id="versioning"
-                      (checkedChange)="setMfaDeleteValidators()"
-                      i18n>Enabled
+        <cds-checkbox
+          name="versioning"
+          formControlName="versioning"
+          id="versioning"
+          (checkedChange)="setMfaDeleteValidators()"
+          i18n
+          >Enabled
           <cd-help-text>
             <span>Enables versioning for the objects in the bucket.</span>
           </cd-help-text>
@@ -153,54 +240,90 @@
     <fieldset *ngIf="editing">
       <!-- MFA Delete -->
       <div class="form-item">
-        <legend class="cd-header"
-                i18n>Multi-Factor Authentication</legend>
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Multi-Factor Authentication
+        </legend>
 
-        <cds-checkbox name="mfa-delete"
-                      formControlName="mfa-delete"
-                      id="mfa-delete"
-                      (checkedChange)="setMfaDeleteValidators()"
-                      helperText="Enables MFA (multi-factor authentication) Delete, which requires additional authentication for changing the bucket versioning state."
-                      i18n-helperText
-                      i18n>Delete enabled
+        <cds-checkbox
+          name="mfa-delete"
+          formControlName="mfa-delete"
+          id="mfa-delete"
+          (checkedChange)="setMfaDeleteValidators()"
+          helperText="Enables MFA (multi-factor authentication) Delete, which requires additional authentication for changing the bucket versioning state."
+          i18n-helperText
+          i18n
+          >Delete enabled
         </cds-checkbox>
       </div>
-      <div *ngIf="areMfaCredentialsRequired()"
-           class="form-item">
-        <cds-text-label for="mfa-token-serial"
-                        cdRequiredField="MFA Serial Number"
-                        [invalid]="!bucketForm.controls['mfa-token-serial'].valid && bucketForm.controls['mfa-token-serial'].dirty"
-                        [invalidText]="mfaSerialError"
-                        i18n>Token Serial Number
-          <input cdsText
-                 id="mfa-token-serial"
-                 name="mfa-token-serial"
-                 formControlName="mfa-token-serial"
-                 [invalid]="!bucketForm.controls['mfa-token-serial'].valid && bucketForm.controls['mfa-token-serial'].dirty">
+      <div
+        *ngIf="areMfaCredentialsRequired()"
+        class="form-item"
+      >
+        <cds-text-label
+          for="mfa-token-serial"
+          cdRequiredField="MFA Serial Number"
+          [invalid]="
+            !bucketForm.controls['mfa-token-serial'].valid &&
+            bucketForm.controls['mfa-token-serial'].dirty
+          "
+          [invalidText]="mfaSerialError"
+          i18n
+          >Token Serial Number
+          <input
+            cdsText
+            id="mfa-token-serial"
+            name="mfa-token-serial"
+            formControlName="mfa-token-serial"
+            [invalid]="
+              !bucketForm.controls['mfa-token-serial'].valid &&
+              bucketForm.controls['mfa-token-serial'].dirty
+            "
+          />
         </cds-text-label>
         <ng-template #mfaSerialError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('mfa-token-serial', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('mfa-token-serial', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
-      <div *ngIf="areMfaCredentialsRequired()"
-           class="form-item">
-        <cds-text-label for="mfa-token-pin"
-                        cdRequiredField="MFA Token PIN"
-                        [invalid]="!bucketForm.controls['mfa-token-pin'].valid && (bucketForm.controls['mfa-token-pin'].dirty)"
-                        [invalidText]="mfaPinError"
-                        i18n>Token PIN
-          <input cdsText
-                 id="mfa-token-pin"
-                 name="mfa-token-pin"
-                 formControlName="mfa-token-pin"
-                 [invalid]="!bucketForm.controls['mfa-token-pin'].valid && (bucketForm.controls['mfa-token-pin'].dirty)">
+      <div
+        *ngIf="areMfaCredentialsRequired()"
+        class="form-item"
+      >
+        <cds-text-label
+          for="mfa-token-pin"
+          cdRequiredField="MFA Token PIN"
+          [invalid]="
+            !bucketForm.controls['mfa-token-pin'].valid &&
+            bucketForm.controls['mfa-token-pin'].dirty
+          "
+          [invalidText]="mfaPinError"
+          i18n
+          >Token PIN
+          <input
+            cdsText
+            id="mfa-token-pin"
+            name="mfa-token-pin"
+            formControlName="mfa-token-pin"
+            [invalid]="
+              !bucketForm.controls['mfa-token-pin'].valid &&
+              bucketForm.controls['mfa-token-pin'].dirty
+            "
+          />
         </cds-text-label>
         <ng-template #mfaPinError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('mfa-token-pin', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('mfa-token-pin', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
     </fieldset>
@@ -208,72 +331,103 @@
     <!-- Object Locking -->
     <fieldset *ngIf="!editing || (editing && bucketForm.getValue('lock_enabled'))">
       <div class="form-item">
-        <legend class="cd-header"
-                i18n>
+        <legend
+          class="cd-header"
+          i18n
+        >
           Object Locking
           <cd-help-text>
-              Store objects using a write-once-read-many (WORM) model to prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
-              Object Locking works only in versioned buckets.
+            Store objects using a write-once-read-many (WORM) model to prevent objects from being
+            deleted or overwritten for a fixed amount of time or indefinitely. Object Locking works
+            only in versioned buckets.
           </cd-help-text>
         </legend>
         <!-- Object Locking enable -->
-        <cds-checkbox name="lock_enabled"
-                      formControlName="lock_enabled"
-                      id="lock_enabled"
-                      [disabled]="editing"
-                      i18n>Enable
+        <cds-checkbox
+          name="lock_enabled"
+          formControlName="lock_enabled"
+          id="lock_enabled"
+          [disabled]="editing"
+          i18n
+          >Enable
 
           <cd-help-text>
-            <span>Enables locking for the objects in the bucket. Locking can only be enabled while creating a bucket.</span>
+            <span
+              >Enables locking for the objects in the bucket. Locking can only be enabled while
+              creating a bucket.</span
+            >
           </cd-help-text>
         </cds-checkbox>
       </div>
 
       <!-- Object Locking mode -->
-      <div *ngIf="bucketForm.getValue('lock_enabled')"
-           class="form-item">
-        <cds-select label="Mode"
-                    for="lock_mode"
-                    formControlName="lock_mode"
-                    name="lock_mode"
-                    [helperText]="lockModeHelper"
-                    id="lock_mode"
-                    i18n>
+      <div
+        *ngIf="bucketForm.getValue('lock_enabled')"
+        class="form-item"
+      >
+        <cds-select
+          label="Mode"
+          for="lock_mode"
+          formControlName="lock_mode"
+          name="lock_mode"
+          [helperText]="lockModeHelper"
+          id="lock_mode"
+          i18n
+        >
           <option value="COMPLIANCE">Compliance</option>
           <option value="GOVERNANCE">Governance</option>
         </cds-select>
         <ng-template #lockModeHelper>
-          <span *ngIf="bucketForm.getValue('lock_mode') === 'COMPLIANCE'"
-                i18n>
-            In COMPLIANCE an object version cannot be overwritten or deleted for the duration of the period.
+          <span
+            *ngIf="bucketForm.getValue('lock_mode') === 'COMPLIANCE'"
+            i18n
+          >
+            In COMPLIANCE an object version cannot be overwritten or deleted for the duration of the
+            period.
           </span>
-          <span *ngIf="bucketForm.getValue('lock_mode') === 'GOVERNANCE'"
-                i18n>
-            In GOVERNANCE mode, users cannot overwrite or delete an object version or alter its lock settings unless they have special permissions.
+          <span
+            *ngIf="bucketForm.getValue('lock_mode') === 'GOVERNANCE'"
+            i18n
+          >
+            In GOVERNANCE mode, users cannot overwrite or delete an object version or alter its lock
+            settings unless they have special permissions.
           </span>
         </ng-template>
       </div>
       <!-- Retention period (days) -->
-      <div *ngIf="bucketForm.getValue('lock_enabled')"
-           class="form-item">
-        <cds-number name="lock_retention_period_days"
-                    formControlName="lock_retention_period_days"
-                    id="lock_retention_period_days"
-                    min="1"
-                    label="Retention period (days)"
-                    helperText="The number of days that you want to specify for the default retention period that will be applied to new objects placed in this bucket."
-                    [invalid]="bucketForm.controls.lock_retention_period_days.invalid && (bucketForm.controls.lock_retention_period_days.dirty)"
-                    [invalidText]="retentionPeriodError"
-                    i18n-helperText
-                    i18n-label
-                    i18n></cds-number>
+      <div
+        *ngIf="bucketForm.getValue('lock_enabled')"
+        class="form-item"
+      >
+        <cds-number
+          name="lock_retention_period_days"
+          formControlName="lock_retention_period_days"
+          id="lock_retention_period_days"
+          min="1"
+          label="Retention period (days)"
+          helperText="The number of days that you want to specify for the default retention period that will be applied to new objects placed in this bucket."
+          [invalid]="
+            bucketForm.controls.lock_retention_period_days.invalid &&
+            bucketForm.controls.lock_retention_period_days.dirty
+          "
+          [invalidText]="retentionPeriodError"
+          i18n-helperText
+          i18n-label
+          i18n
+        ></cds-number>
         <ng-template #retentionPeriodError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('lock_retention_period_days', frm, 'pattern')"
-                i18n>The entered value must be a positive integer.</span>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('lock_retention_period_days', frm, 'lockDays')"
-                i18n>Retention Days must be a positive integer.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('lock_retention_period_days', frm, 'pattern')"
+            i18n
+            >The entered value must be a positive integer.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('lock_retention_period_days', frm, 'lockDays')"
+            i18n
+            >Retention Days must be a positive integer.</span
+          >
         </ng-template>
       </div>
       <!-- Alerts -->
@@ -281,31 +435,47 @@
         type="info"
         *ngIf="bucketForm.getValue('lock_enabled')"
         class="me-1"
-        i18n-title>
-          Bucket Versioning can't be disabled when Object Locking is enabled.
+        i18n-title
+      >
+        Bucket Versioning can't be disabled when Object Locking is enabled.
       </cd-alert-panel>
       <cd-alert-panel
         type="warning"
-        *ngIf="bucketForm.getValue('lock_enabled')">
-          Enabling Object Locking will allow the configuration of GOVERNANCE or COMPLIANCE modes, which will help ensure that an object version cannot be overwritten or deleted for the specified period.
+        *ngIf="bucketForm.getValue('lock_enabled')"
+      >
+        Enabling Object Locking will allow the configuration of GOVERNANCE or COMPLIANCE modes,
+        which will help ensure that an object version cannot be overwritten or deleted for the
+        specified period.
       </cd-alert-panel>
     </fieldset>
 
     <!-- Encryption -->
     <fieldset>
       <div class="form-item">
-        <legend class="cd-header"
-                i18n>Encryption</legend>
-        <cds-checkbox name="encryption_enabled"
-                      formControlName="encryption_enabled"
-                      id="encryption_enabled"
-                      [disabled]="!kmsConfigured && !s3Configured"
-                      i18n>Enable
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Encryption
+        </legend>
+        <cds-checkbox
+          name="encryption_enabled"
+          formControlName="encryption_enabled"
+          id="encryption_enabled"
+          [disabled]="!kmsConfigured && !s3Configured"
+          i18n
+          >Enable
           <cd-help-text aria-label="encryption helper">
-            <span>Enables encryption for the objects in the bucket.
-                To enable encryption on a bucket you need to set the configuration values for SSE-S3 or SSE-KMS.
-                To set the configuration values <a href="#/rgw/configuration"
-                                                   i18n-aria-label="click here">Click here</a></span>
+            <span
+              >Enables encryption for the objects in the bucket. To enable encryption on a bucket
+              you need to set the configuration values for SSE-S3 or SSE-KMS. To set the
+              configuration values
+              <a
+                href="#/rgw/configuration"
+                i18n-aria-label="click here"
+                >Click here</a
+              ></span
+            >
           </cd-help-text>
         </cds-checkbox>
       </div>
@@ -313,54 +483,86 @@
       <div *ngIf="bucketForm.getValue('encryption_enabled')">
         <div class="form-item">
           <cds-radio-group formControlName="encryption_type">
-          <cds-radio value="AES256"
-                     [disabled]="!s3Configured">SSE-S3</cds-radio>
-          <cds-radio value="aws:kms"
-                     [disabled]="!kmsConfigured">Connect to an external key management service</cds-radio>
+            <cds-radio
+              value="AES256"
+              [disabled]="!s3Configured"
+              >SSE-S3</cds-radio
+            >
+            <cds-radio
+              value="aws:kms"
+              [disabled]="!kmsConfigured"
+              >Connect to an external key management service</cds-radio
+            >
           </cds-radio-group>
         </div>
 
         <div *ngIf="bucketForm.getValue('encryption_type') === 'aws:kms'">
           <div class="form-item">
-            <cds-select label="KMS Provider"
-                        for="kms_provider"
-                        formControlName="kms_provider"
-                        name="kms_provider"
-                        id="kms_provider"
-                        [invalidText]="kmsProviderError"
-                        [invalid]="!bucketForm.controls.kms_provider.valid && (bucketForm.controls.kms_provider.dirty)"
-                        cdRequiredField="KMS Provider"
-                        i18n>KMS Provider
-              <option *ngIf="kmsProviders === null"
-                      [ngValue]="null">Loading...</option>
-              <option *ngIf="kmsProviders !== null"
-                      [ngValue]="null">-- Select a provider --</option>
-              <option *ngFor="let provider of kmsProviders"
-                      [value]="provider">{{ provider }}</option>
+            <cds-select
+              label="KMS Provider"
+              for="kms_provider"
+              formControlName="kms_provider"
+              name="kms_provider"
+              id="kms_provider"
+              [invalidText]="kmsProviderError"
+              [invalid]="
+                !bucketForm.controls.kms_provider.valid && bucketForm.controls.kms_provider.dirty
+              "
+              cdRequiredField="KMS Provider"
+              i18n
+              >KMS Provider
+              <option
+                *ngIf="kmsProviders === null"
+                [ngValue]="null"
+              >
+                Loading...
+              </option>
+              <option
+                *ngIf="kmsProviders !== null"
+                [ngValue]="null"
+              >
+                -- Select a provider --
+              </option>
+              <option
+                *ngFor="let provider of kmsProviders"
+                [value]="provider"
+              >
+                {{ provider }}
+              </option>
             </cds-select>
             <ng-template #kmsProviderError>
-              <span class="invalid-feedback"
-                    *ngIf="bucketForm.showError('kms_provider', frm, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="bucketForm.showError('kms_provider', frm, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </ng-template>
           </div>
 
           <div class="form-item">
-            <cds-text-label for="keyId"
-                            cdRequiredField="Key Id"
-                            [invalid]="!bucketForm.controls.keyId.valid && (bucketForm.controls.keyId.dirty)"
-                            [invalidText]="keyIdError"
-                            i18n>Key Id
-              <input cdsText
-                     id="keyId"
-                     name="keyId"
-                     formControlName="keyId"
-                     [invalid]="!bucketForm.controls.keyId.valid && (bucketForm.controls.keyId.dirty)">
+            <cds-text-label
+              for="keyId"
+              cdRequiredField="Key Id"
+              [invalid]="!bucketForm.controls.keyId.valid && bucketForm.controls.keyId.dirty"
+              [invalidText]="keyIdError"
+              i18n
+              >Key Id
+              <input
+                cdsText
+                id="keyId"
+                name="keyId"
+                formControlName="keyId"
+                [invalid]="!bucketForm.controls.keyId.valid && bucketForm.controls.keyId.dirty"
+              />
             </cds-text-label>
             <ng-template #keyIdError>
-              <span class="invalid-feedback"
-                    *ngIf="bucketForm.showError('keyId', frm, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="bucketForm.showError('keyId', frm, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </ng-template>
           </div>
         </div>
@@ -370,28 +572,48 @@
     <!-- Replication -->
     <fieldset>
       <div class="form-item">
-        <legend class="cd-header"
-                i18n>Replication</legend>
-        <ng-container *ngIf="{status: multisiteStatus$ | async, isDefaultZg: isDefaultZoneGroup$ | async} as multisiteStatus; else loadingTpl">
-          <cds-checkbox name="replication"
-                        formControlName="replication"
-                        id="replication"
-                        [disabled]="!multisiteStatus.isDefaultZg && !multisiteStatus?.status?.available"
-                        [title]="!multisiteStatus.isDefaultZg && !multisiteStatus?.status?.available ? 'Please enable the multisite configuration' : ''"
-                        i18n-title
-                        i18n-helperText
-                        i18n>Enable
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Replication
+        </legend>
+        <ng-container
+          *ngIf="
+            {
+              status: multisiteStatus$ | async,
+              isDefaultZg: isDefaultZoneGroup$ | async
+            } as multisiteStatus;
+            else loadingTpl
+          "
+        >
+          <cds-checkbox
+            name="replication"
+            formControlName="replication"
+            id="replication"
+            [disabled]="!multisiteStatus.isDefaultZg && !multisiteStatus?.status?.available"
+            [title]="
+              !multisiteStatus.isDefaultZg && !multisiteStatus?.status?.available
+                ? 'Please enable the multisite configuration'
+                : ''
+            "
+            i18n-title
+            i18n-helperText
+            i18n
+            >Enable
             <cd-help-text>Enables replication for the objects in the bucket.</cd-help-text>
           </cds-checkbox>
 
-          <cd-alert-panel type="info"
-                          class="me-1"
-                          id="replication-info"
-                          spacingClass="mt-1"
-                          *ngIf="!editing"
-                          i18n>
-            A bi-directional sync policy group will be created by the dashboard along with flows and pipes.
-            The pipe id will then be used for applying the replication policy to the bucket.
+          <cd-alert-panel
+            type="info"
+            class="me-1"
+            id="replication-info"
+            spacingClass="mt-1"
+            *ngIf="!editing"
+            i18n
+          >
+            A bi-directional sync policy group will be created by the dashboard along with flows and
+            pipes. The pipe id will then be used for applying the replication policy to the bucket.
           </cd-alert-panel>
         </ng-container>
       </div>
@@ -399,28 +621,37 @@
 
     <!-- Tags -->
     <fieldset>
-      <legend class="cd-header"
-              i18n>Tags
+      <legend
+        class="cd-header"
+        i18n
+      >
+        Tags
         <cd-help-text>Tagging provides a way to categorize storage</cd-help-text>
       </legend>
-      <span *ngFor="let tag of tags; let i=index;">
-        <ng-container *ngTemplateOutlet="tagTpl; context:{index: i, tag: tag}"></ng-container>
+      <span *ngFor="let tag of tags; let i = index">
+        <ng-container *ngTemplateOutlet="tagTpl; context: { index: i, tag: tag }"></ng-container>
       </span>
 
       <div cdsRow>
         <div cdsCol>
-          <cds-tooltip [description]="tags.length > 19 ? 'Maximum of 20 tags reached' : ''"
-                       [highContrast]="true"
-                       [caret]="true">
-            <button cdsButton="tertiary"
-                    id="add-tag"
-                    [disabled]="tags.length > 19"
-                    (click)="showTagModal()"
-                    type="button">
+          <cds-tooltip
+            [description]="tags.length > 19 ? 'Maximum of 20 tags reached' : ''"
+            [highContrast]="true"
+            [caret]="true"
+          >
+            <button
+              cdsButton="tertiary"
+              id="add-tag"
+              [disabled]="tags.length > 19"
+              (click)="showTagModal()"
+              type="button"
+            >
               <ng-container i18n>Add tag</ng-container>
-              <svg [cdsIcon]="icons.add"
-                   [size]="icons.size16"
-                   class="cds--btn__icon"></svg>
+              <svg
+                [cdsIcon]="icons.add"
+                [size]="icons.size16"
+                class="cds--btn__icon"
+              ></svg>
             </button>
           </cds-tooltip>
         </div>
@@ -430,63 +661,94 @@
     <!-- Policies -->
     <fieldset>
       <div class="form-item">
-        <legend class="cd-header"
-                i18n>Policies
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Policies
         </legend>
 
         <!-- Bucket policy -->
-        <cds-textarea-label for="id"
-                            [invalid]="!bucketForm.controls.bucket_policy.valid && (bucketForm.controls.bucket_policy.dirty)"
-                            [invalidText]="bucketPolicyError"
-                            helperText="Define access permissions for this bucket using an S3-compatible JSON policy. This controls who can access the bucket and what actions they can perform."
-                            i18n-helperText
-                            i18n>Bucket Policy
-          <textarea cdsTextArea
-                    class="textarea-field"
-                    id="bucket_policy"
-                    formControlName="bucket_policy"
-                    (change)="textAreaOnChange('bucket_policy')"
-                    cols="200"
-                    #bucketPolicyTextArea></textarea>
+        <cds-textarea-label
+          for="id"
+          [invalid]="
+            !bucketForm.controls.bucket_policy.valid && bucketForm.controls.bucket_policy.dirty
+          "
+          [invalidText]="bucketPolicyError"
+          helperText="Define access permissions for this bucket using an S3-compatible JSON policy. This controls who can access the bucket and what actions they can perform."
+          i18n-helperText
+          i18n
+          >Bucket Policy
+          <textarea
+            cdsTextArea
+            class="textarea-field"
+            id="bucket_policy"
+            formControlName="bucket_policy"
+            (change)="textAreaOnChange('bucket_policy')"
+            cols="200"
+            #bucketPolicyTextArea
+          ></textarea>
         </cds-textarea-label>
         <ng-template #bucketPolicyError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('bucket_policy', frm, 'invalidJson')"
-                i18n>Invalid json text.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('bucket_policy', frm, 'invalidJson')"
+            i18n
+            >Invalid json text.</span
+          >
         </ng-template>
         <div cdsRow>
           <div cdsCol>
             <cds-button-set class="mt-1">
-              <button cdsButton="tertiary"
-                      id="example-generator-button"
-                      (click)="openUrl('https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html?icmpid=docs_amazons3_console')"
-                      type="button"
-                      i18n>Policy examples
-                <svg [cdsIcon]="icons.launch"
-                     [size]="icons.size16"
-                     class="cds--btn__icon"></svg>
+              <button
+                cdsButton="tertiary"
+                id="example-generator-button"
+                (click)="
+                  openUrl(
+                    'https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html?icmpid=docs_amazons3_console'
+                  )
+                "
+                type="button"
+                i18n
+              >
+                Policy examples
+                <svg
+                  [cdsIcon]="icons.launch"
+                  [size]="icons.size16"
+                  class="cds--btn__icon"
+                ></svg>
               </button>
-              <button cdsButton="tertiary"
-                      id="example-generator-button"
-                      (click)="openUrl('https://awspolicygen.s3.amazonaws.com/policygen.html')"
-                      type="button"
-                      i18n>Policy generator
-                <svg [cdsIcon]="icons.launch"
-                     [size]="icons.size16"
-                     class="cds--btn__icon"></svg>
+              <button
+                cdsButton="tertiary"
+                id="example-generator-button"
+                (click)="openUrl('https://awspolicygen.s3.amazonaws.com/policygen.html')"
+                type="button"
+                i18n
+              >
+                Policy generator
+                <svg
+                  [cdsIcon]="icons.launch"
+                  [size]="icons.size16"
+                  class="cds--btn__icon"
+                ></svg>
               </button>
             </cds-button-set>
           </div>
           <div cdsCol>
             <cds-button-set class="float-end mt-1">
-              <button cdsButton="tertiary"
-                      id="clear-bucket-policy"
-                      (click)="clearTextArea('bucket_policy', '{}')"
-                      type="button"
-                      i18n>Clear
-                <svg [cdsIcon]="icons.destroy"
-                     [size]="icons.size16"
-                     class="cds--btn__icon"></svg>
+              <button
+                cdsButton="tertiary"
+                id="clear-bucket-policy"
+                (click)="clearTextArea('bucket_policy', '{}')"
+                type="button"
+                i18n
+              >
+                Clear
+                <svg
+                  [cdsIcon]="icons.destroy"
+                  [size]="icons.size16"
+                  class="cds--btn__icon"
+                ></svg>
               </button>
             </cds-button-set>
           </div>
@@ -494,53 +756,79 @@
       </div>
 
       <!-- Lifecycle -->
-      <div *ngIf="editing"
-           class="form-item">
-        <cds-textarea-label for="id"
-                            [invalid]="!bucketForm.controls.lifecycle.valid && bucketForm.controls.lifecycle.dirty"
-                            [invalidText]="lifecycleError"
-                            i18n>Lifecycle
-          <textarea cdsTextArea
-                    class="textarea-field"
-                    id="lifecycle"
-                    formControlName="lifecycle"
-                    (change)="textAreaOnChange('lifecycle')"
-                    cols="200"
-                    #lifecycleTextArea></textarea>
+      <div
+        *ngIf="editing"
+        class="form-item"
+      >
+        <cds-textarea-label
+          for="id"
+          [invalid]="!bucketForm.controls.lifecycle.valid && bucketForm.controls.lifecycle.dirty"
+          [invalidText]="lifecycleError"
+          i18n
+          >Lifecycle
+          <textarea
+            cdsTextArea
+            class="textarea-field"
+            id="lifecycle"
+            formControlName="lifecycle"
+            (change)="textAreaOnChange('lifecycle')"
+            cols="200"
+            #lifecycleTextArea
+          ></textarea>
           <cd-help-text>JSON or XML formatted document</cd-help-text>
         </cds-textarea-label>
         <ng-template #lifecycleError>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('lifecycle', frm, 'invalidJson')"
-                i18n>Invalid json text.</span>
-          <span class="invalid-feedback"
-                *ngIf="bucketForm.showError('lifecycle', frm, 'invalidXml')"
-                i18n>Invalid xml text.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('lifecycle', frm, 'invalidJson')"
+            i18n
+            >Invalid json text.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="bucketForm.showError('lifecycle', frm, 'invalidXml')"
+            i18n
+            >Invalid xml text.</span
+          >
         </ng-template>
         <div cdsRow>
           <div cdsCol>
             <cds-button-set class="mt-1">
-              <button cdsButton="tertiary"
-                      id="lifecycle-examples-button"
-                      (click)="openUrl('https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-lifecycle.html#examples')"
-                      type="button"
-                      i18n>Policy examples
-                <svg [cdsIcon]="icons.launch"
-                     [size]="icons.size16"
-                     class="cds--btn__icon"></svg>
+              <button
+                cdsButton="tertiary"
+                id="lifecycle-examples-button"
+                (click)="
+                  openUrl(
+                    'https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-lifecycle.html#examples'
+                  )
+                "
+                type="button"
+                i18n
+              >
+                Policy examples
+                <svg
+                  [cdsIcon]="icons.launch"
+                  [size]="icons.size16"
+                  class="cds--btn__icon"
+                ></svg>
               </button>
             </cds-button-set>
           </div>
           <div cdsCol>
             <cds-button-set class="float-end mt-1">
-              <button cdsButton="tertiary"
-                      id="clear-lifecycle"
-                      (click)="clearTextArea('lifecycle', '{}')"
-                      type="button"
-                      i18n>Clear
-                <svg [cdsIcon]="icons.destroy"
-                     [size]="icons.size16"
-                     class="cds--btn__icon"></svg>
+              <button
+                cdsButton="tertiary"
+                id="clear-lifecycle"
+                (click)="clearTextArea('lifecycle', '{}')"
+                type="button"
+                i18n
+              >
+                Clear
+                <svg
+                  [cdsIcon]="icons.destroy"
+                  [size]="icons.size16"
+                  class="cds--btn__icon"
+                ></svg>
               </button>
             </cds-button-set>
           </div>
@@ -548,49 +836,73 @@
       </div>
 
       <div class="form-item">
-
         <!-- ACL -->
-        <cds-text-label i18n>ACL
-          <cd-help-text>Any changes to the ACL will overwrite previous one.
-            You can choose any of the available options to modify the spcified user group.</cd-help-text>
+        <cds-text-label i18n
+          >ACL
+          <cd-help-text
+            >Any changes to the ACL will overwrite previous one. You can choose any of the available
+            options to modify the spcified user group.</cd-help-text
+          >
         </cds-text-label>
-        <div cdsRow
-             class="form-item-append">
+        <div
+          cdsRow
+          class="form-item-append"
+        >
           <div cdsCol>
-            <cds-select id="grantee"
-                        name="grantee"
-                        label="Grantee"
-                        formControlName="grantee"
-                        helperText="Select a grantee (user group) to modify it's permisions"
-                        [invalid]="!bucketForm.controls.grantee.valid && (bucketForm.controls.grantee.dirty)"
-                        [invalidText]="granteeError"
-                        (valueChange)="onSelectionFilter()"
-                        i18n>Grantee
-              <option *ngFor="let item of grantees"
-                      [value]="item">{{ item }}</option>
+            <cds-select
+              id="grantee"
+              name="grantee"
+              label="Grantee"
+              formControlName="grantee"
+              helperText="Select a grantee (user group) to modify it's permisions"
+              [invalid]="!bucketForm.controls.grantee.valid && bucketForm.controls.grantee.dirty"
+              [invalidText]="granteeError"
+              (valueChange)="onSelectionFilter()"
+              i18n
+              >Grantee
+              <option
+                *ngFor="let item of grantees"
+                [value]="item"
+              >
+                {{ item }}
+              </option>
             </cds-select>
             <ng-template #granteeError>
-              <span class="invalid-feedback"
-                    *ngIf="bucketForm.showError('grantee', frm, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="bucketForm.showError('grantee', frm, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </ng-template>
           </div>
           <div cdsCol>
-            <cds-select id="aclPermission"
-                        name="aclPermission"
-                        [invalid]="!bucketForm.controls.aclPermission.valid && (bucketForm.controls.aclPermission.dirty)"
-                        [invalidText]="aclPermissionError"
-                        label="Permissions"
-                        helperText="Select the permision to give to the selected grantee. Regardless, the owner of the bucket will always have FULL CONTROL access"
-                        formControlName="aclPermission">
-              <option *ngFor="let permission of aclPermissions"
-                      [value]="permission"
-                      i18n>{{ permission }}</option>
+            <cds-select
+              id="aclPermission"
+              name="aclPermission"
+              [invalid]="
+                !bucketForm.controls.aclPermission.valid && bucketForm.controls.aclPermission.dirty
+              "
+              [invalidText]="aclPermissionError"
+              label="Permissions"
+              helperText="Select the permision to give to the selected grantee. Regardless, the owner of the bucket will always have FULL CONTROL access"
+              formControlName="aclPermission"
+            >
+              <option
+                *ngFor="let permission of aclPermissions"
+                [value]="permission"
+                i18n
+              >
+                {{ permission }}
+              </option>
             </cds-select>
             <ng-template #aclPermissionError>
-              <span class="invalid-feedback"
-                    *ngIf="bucketForm.showError('aclPermission', frm, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="bucketForm.showError('aclPermission', frm, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </ng-template>
           </div>
         </div>
@@ -600,67 +912,99 @@
     <!--Advanced-->
     <cd-form-advanced-fieldset>
       <!-- Placement target -->
-      <div class="form-item"
-           *ngIf="!editing">
-        <cds-select label="Placement target"
-                    for="placement-target"
-                    formControlName="placement-target"
-                    name="placement-target"
-                    id="placement-target"
-                    helperText="When creating a bucket, a placement target can be provided as part of the LocationConstraint to override the default placement targets from the user and zonegroup."
-                    i18n-helperText
-                    i18n>Placement target
-          <option *ngIf="placementTargets === null"
-                  [ngValue]="null">Loading...</option>
-          <option *ngIf="placementTargets !== null"
-                  [ngValue]="null">-- Select a placement target --</option>
-          <option *ngFor="let placementTarget of placementTargets"
-                  [value]="placementTarget.name">{{ placementTarget.description }}</option>
+      <div
+        class="form-item"
+        *ngIf="!editing"
+      >
+        <cds-select
+          label="Placement target"
+          for="placement-target"
+          formControlName="placement-target"
+          name="placement-target"
+          id="placement-target"
+          helperText="When creating a bucket, a placement target can be provided as part of the LocationConstraint to override the default placement targets from the user and zonegroup."
+          i18n-helperText
+          i18n
+          >Placement target
+          <option
+            *ngIf="placementTargets === null"
+            [ngValue]="null"
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="placementTargets !== null"
+            [ngValue]="null"
+          >
+            -- Select a placement target --
+          </option>
+          <option
+            *ngFor="let placementTarget of placementTargets"
+            [value]="placementTarget.name"
+          >
+            {{ placementTarget.description }}
+          </option>
         </cds-select>
       </div>
 
       <!-- Bucket Rate Limit -->
-      <cd-rgw-rate-limit [type]="'bucket'"
-                         [isEditing]="editing"
-                         [allowBid]="bucketForm.getValue('bid')"
-                         (rateLimitFormGroup)="rateLimitFormInit($event)">
+      <cd-rgw-rate-limit
+        [type]="'bucket'"
+        [isEditing]="editing"
+        [allowBid]="bucketForm.getValue('bid')"
+        (rateLimitFormGroup)="rateLimitFormInit($event)"
+      >
       </cd-rgw-rate-limit>
     </cd-form-advanced-fieldset>
 
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="bucketForm"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          wrappingClass="text-right"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="submit()"
+      [form]="bucketForm"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      wrappingClass="text-right"
+    ></cd-form-button-panel>
   </form>
 </div>
 
-<ng-template #tagTpl
-             let-tag="tag"
-             let-index="index">
+<ng-template
+  #tagTpl
+  let-tag="tag"
+  let-index="index"
+>
   <div class="form-item form-item-append">
     <ng-container *ngFor="let config of tagConfig">
-      <input type="text"
-             id="tag-{{config.attribute}}-{{index}}"
-             cdsText
-             [ngbTooltip]="config.attribute"
-             [value]="tag[config.attribute]"
-             readonly>
+      <input
+        type="text"
+        id="tag-{{ config.attribute }}-{{ index }}"
+        cdsText
+        [ngbTooltip]="config.attribute"
+        [value]="tag[config.attribute]"
+        readonly
+      />
     </ng-container>
 
     <!-- Tag actions -->
-    <cds-icon-button kind="tertiary"
-                     size="md"
-                     (click)="showTagModal(index)">
-      <svg [cdsIcon]="icons.edit"
-           [size]="icons.size16"
-           class="cds-info-color cds--btn__icon"></svg>
+    <cds-icon-button
+      kind="tertiary"
+      size="md"
+      (click)="showTagModal(index)"
+    >
+      <svg
+        [cdsIcon]="icons.edit"
+        [size]="icons.size16"
+        class="cds-info-color cds--btn__icon"
+      ></svg>
     </cds-icon-button>
-    <cds-icon-button kind="danger"
-                     size="md"
-                     (click)="deleteTag(index)">
-      <svg [cdsIcon]="icons.trash"
-           [size]="icons.size16"
-           class="cds-info-color cds--btn__icon"></svg>
+    <cds-icon-button
+      kind="danger"
+      size="md"
+      (click)="deleteTag(index)"
+    >
+      <svg
+        [cdsIcon]="icons.trash"
+        [size]="icons.size16"
+        class="cds-info-color cds--btn__icon"
+      ></svg>
     </cds-icon-button>
   </div>
 </ng-template>
@@ -668,4 +1012,3 @@
 <ng-template #loadingTpl>
   <cd-loading-panel i18n>Checking multi-site status...</cd-loading-panel>
 </ng-template>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-lifecycle-list/rgw-bucket-lifecycle-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-lifecycle-list/rgw-bucket-lifecycle-list.component.html
index 7e7927f38b5..f3b7fd1841f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-lifecycle-list/rgw-bucket-lifecycle-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-lifecycle-list/rgw-bucket-lifecycle-list.component.html
@@ -1,20 +1,26 @@
 <legend i18n>
   Tiering Configuration
   <cd-help-text>
-    Configure a bucket tiering rule to automatically transition objects between storage classes after a specified number of days. Define the scope of the rule by applying it globally or to objects with specific prefixes and tags.
+    Configure a bucket tiering rule to automatically transition objects between storage classes
+    after a specified number of days. Define the scope of the rule by applying it globally or to
+    objects with specific prefixes and tags.
   </cd-help-text>
 </legend>
-<cd-table #table
-          [data]="filteredLifecycleRules$ | async"
-          [columns]="columns"
-          columnMode="flex"
-          selectionType="multiClick"
-          (updateSelection)="updateSelection($event)"
-          identifier="ID"
-          (fetchData)="loadLifecyclePolicies($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [data]="filteredLifecycleRules$ | async"
+  [columns]="columns"
+  columnMode="flex"
+  selectionType="multiClick"
+  (updateSelection)="updateSelection($event)"
+  identifier="ID"
+  (fetchData)="loadLifecyclePolicies($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-list/rgw-bucket-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-list/rgw-bucket-list.component.html
index 07feaca2624..adc3e427e2b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-list/rgw-bucket-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-list/rgw-bucket-list.component.html
@@ -1,51 +1,73 @@
-<cd-table #table
-          [autoReload]="false"
-          [data]="buckets"
-          [columns]="columns"
-          columnMode="flex"
-          selectionType="single"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)"
-          identifier="bid"
-          (fetchData)="getBucketList($event)"
-          [status]="tableStatus">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [autoReload]="false"
+  [data]="buckets"
+  [columns]="columns"
+  columnMode="flex"
+  selectionType="single"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+  identifier="bid"
+  (fetchData)="getBucketList($event)"
+  [status]="tableStatus"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-rgw-bucket-details *cdTableDetail
-                         [selection]="expandedRow">
+  <cd-rgw-bucket-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-rgw-bucket-details>
 </cd-table>
 
-<ng-template #bucketSizeTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.bucket_quota.max_size > 0 && row.bucket_quota.enabled; else noSizeQuota"
-                [total]="row.bucket_quota.max_size"
-                [used]="row.bucket_size">
+<ng-template
+  #bucketSizeTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.bucket_quota.max_size > 0 && row.bucket_quota.enabled; else noSizeQuota"
+    [total]="row.bucket_quota.max_size"
+    [used]="row.bucket_size"
+  >
   </cd-usage-bar>
 
-  <ng-template #noSizeQuota
-               i18n>No Limit</ng-template>
+  <ng-template
+    #noSizeQuota
+    i18n
+    >No Limit</ng-template
+  >
 </ng-template>
 
-<ng-template #bucketObjectTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.bucket_quota.max_objects > 0 && row.bucket_quota.enabled; else noObjectQuota"
-                [total]="row.bucket_quota.max_objects"
-                [used]="row.num_objects"
-                [isBinary]="false">
+<ng-template
+  #bucketObjectTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.bucket_quota.max_objects > 0 && row.bucket_quota.enabled; else noObjectQuota"
+    [total]="row.bucket_quota.max_objects"
+    [used]="row.num_objects"
+    [isBinary]="false"
+  >
   </cd-usage-bar>
 
-  <ng-template #noObjectQuota
-               i18n>No Limit</ng-template>
+  <ng-template
+    #noObjectQuota
+    i18n
+    >No Limit</ng-template
+  >
 </ng-template>
 
 <ng-template #deleteTpl>
-  <cd-alert-panel type="danger"
-                  i18n>
+  <cd-alert-panel
+    type="danger"
+    i18n
+  >
     Buckets might still have underlying data depending on your bucket configuration
   </cd-alert-panel>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-notification-list/rgw-bucket-notification-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-notification-list/rgw-bucket-notification-list.component.html
index 32560058723..fe4649a4c13 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-notification-list/rgw-bucket-notification-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-notification-list/rgw-bucket-notification-list.component.html
@@ -1,55 +1,70 @@
-  <fieldset>
-    <legend i18n
-            class="cd-header">
+<fieldset>
+  <legend
+    i18n
+    class="cd-header"
+  >
     Notification Configuration
     <cd-help-text>
-       Configure bucket notification to trigger alerts for specific events, such as object creation or transitions, based on prefixes or tags.
+      Configure bucket notification to trigger alerts for specific events, such as object creation
+      or transitions, based on prefixes or tags.
     </cd-help-text>
   </legend>
-  </fieldset>
-  <ng-container *ngIf="notification$ | async as notification">
-  <cd-table #table
-            [data]="notification"
-            [columns]="columns"
-            columnMode="flex"
-            selectionType="single"
-            identifier="Id"
-            [autoReload]="true"
-            (updateSelection)="updateSelection($event)"
-            (fetchData)="fetchData()">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
-  </cd-table-actions>
+</fieldset>
+<ng-container *ngIf="notification$ | async as notification">
+  <cd-table
+    #table
+    [data]="notification"
+    [columns]="columns"
+    columnMode="flex"
+    selectionType="single"
+    identifier="Id"
+    [autoReload]="true"
+    (updateSelection)="updateSelection($event)"
+    (fetchData)="fetchData()"
+  >
+    <cd-table-actions
+      class="table-actions"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
+    </cd-table-actions>
   </cd-table>
-  </ng-container>
-  <ng-template #filterTpl
-               let-config="data.value">
-    <ng-container *ngIf="config">
-      <ng-container *ngFor="let item of config | keyvalue">
-        <ng-container *ngIf="item.value?.FilterRule?.length">
-          <div class="cds--label">
-            {{ item.key }}:
-          </div>
-          <div [cdsStack]="'horizontal'"
-               *ngFor="let rule of item.value.FilterRule">
-            <cds-tag size="sm"
-                     class="tag-background-gray">{{ rule.Name }}: {{ rule.Value }}</cds-tag>
-          </div>
-          <br>
-        </ng-container>
+</ng-container>
+<ng-template
+  #filterTpl
+  let-config="data.value"
+>
+  <ng-container *ngIf="config">
+    <ng-container *ngFor="let item of config | keyvalue">
+      <ng-container *ngIf="item.value?.FilterRule?.length">
+        <div class="cds--label">{{ item.key }}:</div>
+        <div
+          [cdsStack]="'horizontal'"
+          *ngFor="let rule of item.value.FilterRule"
+        >
+          <cds-tag
+            size="sm"
+            class="tag-background-gray"
+            >{{ rule.Name }}: {{ rule.Value }}</cds-tag
+          >
+        </div>
+        <br />
       </ng-container>
     </ng-container>
-  </ng-template>
-  <ng-template #eventTpl
-               let-events="data.value">
+  </ng-container>
+</ng-template>
+<ng-template
+  #eventTpl
+  let-events="data.value"
+>
   <ng-container *ngIf="events && events.length">
-    <cds-tag *ngFor="let event of events"
-             size="sm"
-             class="tag-background-primary">
+    <cds-tag
+      *ngFor="let event of events"
+      size="sm"
+      class="tag-background-primary"
+    >
       {{ event }}
     </cds-tag>
   </ng-container>
 </ng-template>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.html
index 9750359ddb8..0a823883311 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.html
@@ -1,230 +1,319 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()">
-  <cds-modal-header (closeSelect)="closeModal()"
-                    i18n>{{editing ? 'Edit' : 'Create'}} Tiering configuration
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
+  <cds-modal-header
+    (closeSelect)="closeModal()"
+    i18n
+    >{{ editing ? 'Edit' : 'Create' }} Tiering configuration
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
 
-<ng-container *cdFormLoading="loading">
-  <section cdsModalContent>
-    <cd-alert-panel
-      *ngIf="(snapScheduleModuleStatus$ | async) === false"
-      type="info"
-      spacingClass="mb-3"
-      i18n
-      class="align-items-center"
-      actionName="Enable"
-      (action)="enableSnapshotSchedule()"
->
-  In order to access the snapshot scheduler feature, the snap_scheduler module must be enabled
-    </cd-alert-panel>
-      <cd-alert-panel *ngIf="storageClassList?.length === 0 &&
-                      isStorageClassFetched"
-                      type="info"
-                      spacingClass="mb-3"
-                      class="align-items-center"
-                      actionName="Create"
-                      i18n
-                      (action)="goToCreateStorageClass()">
-      No storage class found. Consider creating it first to proceed.
-    </cd-alert-panel>
-    <form name="tieringForm"
-          #formDir="ngForm"
-          [formGroup]="tieringForm"
-          novalidate>
-      <div class="form-item">
-        <cds-text-label
-          labelInputID="rule_name"
-          [invalid]="!tieringForm.controls.name.valid && tieringForm.controls.name.dirty"
-          [invalidText]="ruleNameError"
-          [helperText]="ruleHelper"
-          i18n
-          >Rule Name
-          <input
-            cdsText
-            type="text"
-            id="rule_name"
-            maxlength="255"
-            formControlName="name"
-          />
-        </cds-text-label>
-        <ng-template #ruleHelper>
-          <span i18n>Unique identifier for the rule. The value cannot be longer than 255 characters.
-          </span>
-        </ng-template>
-        <ng-template #ruleNameError>
-          <span *ngIf="tieringForm.showError('name', formDir, 'required')"
-                class="invalid-feedback">
-            <ng-container i18n>This field is required.</ng-container>
-          </span>
-          <span *ngIf="tieringForm.showError('name', formDir, 'duplicate')"
-                class="invalid-feedback">
-            <ng-container i18n>Please enter a unique name.</ng-container>
-          </span>
-        </ng-template>
-      </div>
-      <div class="form-item">
-        <cds-select id="storageClass"
-                    formControlName="storageClass"
-                    label="Storage Class"
-                    [helperText]="storageClassHelper">
-          <option *ngIf="storageClassList === null"
-                  value="">Loading...</option>
-          <option *ngIf="storageClassList !== null && storageClassList.length === 0"
-                  value="">-- No storage class available --</option>
-          <option *ngIf="storageClassList !== null && storageClassList.length > 0"
-                  value="">-- Select the storage class --</option>
-          <option *ngFor="let tier of storageClassList"
-                  [value]="tier.storage_class">
-            {{ tier.storage_class }}
-          </option>
-        </cds-select>
-        <ng-template #storageClassHelper>
-          <span i18n>The storage class to which you want the object to transition.
-          </span>
-        </ng-template>
-      </div>
-      <legend class="cds--label">Choose a configuration scope</legend>
-      <div class="form-item">
-        <cds-radio-group
-          formControlName="hasPrefix"
-        >
-        <cds-radio [value]="false"
-                   i18n>
-            {{ 'Apply to all objects in the bucket' }}
-          </cds-radio>
-          <cds-radio [value]="true"
-                     i18n>
-            {{ 'Limit the scope of this rule to selected filter criteria' }}
-          </cds-radio>
-        </cds-radio-group>
-      </div>
-      <div class="form-item"
-           *ngIf="tieringForm.controls.hasPrefix.value">
-        <cds-text-label labelInputID="prefix"
-                        [invalid]="!tieringForm.controls.prefix.valid && tieringForm.controls.prefix.dirty"
-                        [invalidText]="prefixError"
-                        [helperText]="prefixHelper"
-                        i18n>Prefix
-          <input cdsText
-                 type="text"
-                 id="prefix"
-                 formControlName="prefix"/>
-        </cds-text-label>
-        <ng-template #prefixHelper>
-          <span i18n>
-          Prefix identifying one or more objects to which the rule applies
-          </span>
-        </ng-template>
-        <ng-template #prefixError>
-          <span *ngIf="tieringForm.showError('prefix', formDir, 'required')"
-                class="invalid-feedback">
-            <ng-container i18n>This field is required.</ng-container>
-          </span>
-        </ng-template>
-      </div>
-
-      <!-- tags -->
-      <div class="form-item"
-           *ngIf="tieringForm.controls.hasPrefix.value">
-        <div class="form-group-header">Tags</div>
-        <div class="cds-mb-4">All the tags must exist in the object's tag set for the rule to apply.</div>
-        <ng-container formArrayName="tags"
-                      *ngFor="let tags of tags.controls; index as i">
-          <ng-container [formGroupName]="i">
-            <div cdsRow
-                 class="form-item form-item-append">
-              <div cdsCol>
-                <cds-text-label labelInputID="Key"
-                                [invalid]="!tieringForm.controls['tags'].controls[i].controls['Key'].valid && tieringForm.controls['tags'].controls[i].controls['Key'].dirty"
-                                [invalidText]="tagKeyError"
-                                i18n>Name of the object key
-                  <input cdsText
-                         type="text"
-                         placeholder="Enter name of the object key"
-                         formControlName="Key"
-                         i18n-placeholder
-                         [invalid]="tieringForm.controls['tags'].controls[i].controls['Key'].invalid && tieringForm.controls['tags'].controls[i].controls['Key'].dirty"/>
-                </cds-text-label>
-                <ng-template #tagKeyError>
-                  <ng-container i18n>This field is required.</ng-container>
-                </ng-template>
-              </div>
-              <div cdsCol>
-                <cds-text-label labelInputID="Value"
-                                [invalid]="!tieringForm.controls['tags'].controls[i].controls['Value'].valid && tieringForm.controls['tags'].controls[i].controls['Value'].dirty"
-                                [invalidText]="tagValueError"
-                                i18n>Value of the tag
-                  <input cdsText
-                         type="text"
-                         placeholder="Enter value of the tag"
-                         formControlName="Value"
-                         i18n-placeholder
-                         [invalid]="tieringForm.controls['tags'].controls[i].controls['Value'].invalid && tieringForm.controls['tags'].controls[i].controls['Value'].dirty"/>
-                </cds-text-label>
-                <ng-template #tagValueError>
-                  <ng-container i18n>This field is required.</ng-container>
-                </ng-template>
-              </div>
-              <div cdsCol
-                   [columnNumbers]="{ lg: 2, md: 2 }"
-                   class="item-action-btn">
-                <cds-icon-button kind="tertiary"
-                                 size="sm"
-                                 (click)="removeTags(i)">
-                  <svg cdsIcon="trash-can"
-                       size="32"
-                       class="cds--btn__icon"></svg>
-                </cds-icon-button>
-              </div>
-            </div>
-          </ng-container>
-        </ng-container>
+  <ng-container *cdFormLoading="loading">
+    <section cdsModalContent>
+      <cd-alert-panel
+        *ngIf="(snapScheduleModuleStatus$ | async) === false"
+        type="info"
+        spacingClass="mb-3"
+        i18n
+        class="align-items-center"
+        actionName="Enable"
+        (action)="enableSnapshotSchedule()"
+      >
+        In order to access the snapshot scheduler feature, the snap_scheduler module must be enabled
+      </cd-alert-panel>
+      <cd-alert-panel
+        *ngIf="storageClassList?.length === 0 && isStorageClassFetched"
+        type="info"
+        spacingClass="mb-3"
+        class="align-items-center"
+        actionName="Create"
+        i18n
+        (action)="goToCreateStorageClass()"
+      >
+        No storage class found. Consider creating it first to proceed.
+      </cd-alert-panel>
+      <form
+        name="tieringForm"
+        #formDir="ngForm"
+        [formGroup]="tieringForm"
+        novalidate
+      >
         <div class="form-item">
-          <button cdsButton="tertiary"
-                  type="button"
-                  (click)="addTags()"
-                  i18n>Add tags
-            <svg cdsIcon="add"
-                 size="32"
-                 class="cds--btn__icon"
-                 icon></svg>
-          </button>
+          <cds-text-label
+            labelInputID="rule_name"
+            [invalid]="!tieringForm.controls.name.valid && tieringForm.controls.name.dirty"
+            [invalidText]="ruleNameError"
+            [helperText]="ruleHelper"
+            i18n
+            >Rule Name
+            <input
+              cdsText
+              type="text"
+              id="rule_name"
+              maxlength="255"
+              formControlName="name"
+            />
+          </cds-text-label>
+          <ng-template #ruleHelper>
+            <span i18n
+              >Unique identifier for the rule. The value cannot be longer than 255 characters.
+            </span>
+          </ng-template>
+          <ng-template #ruleNameError>
+            <span
+              *ngIf="tieringForm.showError('name', formDir, 'required')"
+              class="invalid-feedback"
+            >
+              <ng-container i18n>This field is required.</ng-container>
+            </span>
+            <span
+              *ngIf="tieringForm.showError('name', formDir, 'duplicate')"
+              class="invalid-feedback"
+            >
+              <ng-container i18n>Please enter a unique name.</ng-container>
+            </span>
+          </ng-template>
+        </div>
+        <div class="form-item">
+          <cds-select
+            id="storageClass"
+            formControlName="storageClass"
+            label="Storage Class"
+            [helperText]="storageClassHelper"
+          >
+            <option
+              *ngIf="storageClassList === null"
+              value=""
+            >
+              Loading...
+            </option>
+            <option
+              *ngIf="storageClassList !== null && storageClassList.length === 0"
+              value=""
+            >
+              -- No storage class available --
+            </option>
+            <option
+              *ngIf="storageClassList !== null && storageClassList.length > 0"
+              value=""
+            >
+              -- Select the storage class --
+            </option>
+            <option
+              *ngFor="let tier of storageClassList"
+              [value]="tier.storage_class"
+            >
+              {{ tier.storage_class }}
+            </option>
+          </cds-select>
+          <ng-template #storageClassHelper>
+            <span i18n>The storage class to which you want the object to transition. </span>
+          </ng-template>
+        </div>
+        <legend class="cds--label">Choose a configuration scope</legend>
+        <div class="form-item">
+          <cds-radio-group formControlName="hasPrefix">
+            <cds-radio
+              [value]="false"
+              i18n
+            >
+              {{ 'Apply to all objects in the bucket' }}
+            </cds-radio>
+            <cds-radio
+              [value]="true"
+              i18n
+            >
+              {{ 'Limit the scope of this rule to selected filter criteria' }}
+            </cds-radio>
+          </cds-radio-group>
+        </div>
+        <div
+          class="form-item"
+          *ngIf="tieringForm.controls.hasPrefix.value"
+        >
+          <cds-text-label
+            labelInputID="prefix"
+            [invalid]="!tieringForm.controls.prefix.valid && tieringForm.controls.prefix.dirty"
+            [invalidText]="prefixError"
+            [helperText]="prefixHelper"
+            i18n
+            >Prefix
+            <input
+              cdsText
+              type="text"
+              id="prefix"
+              formControlName="prefix"
+            />
+          </cds-text-label>
+          <ng-template #prefixHelper>
+            <span i18n> Prefix identifying one or more objects to which the rule applies </span>
+          </ng-template>
+          <ng-template #prefixError>
+            <span
+              *ngIf="tieringForm.showError('prefix', formDir, 'required')"
+              class="invalid-feedback"
+            >
+              <ng-container i18n>This field is required.</ng-container>
+            </span>
+          </ng-template>
         </div>
-      </div>
 
-      <legend class="cds--label">Status</legend>
-      <div class="form-item">
-        <cds-radio-group
-          formControlName="status">
-        <cds-radio [value]="'Enabled'"
-                   i18n>Enabled </cds-radio>
-          <cds-radio [value]="'Disabled'"
-                     i18n>Disabled </cds-radio>
-        </cds-radio-group>
-      </div>
-      <div>
-        <cds-number formControlName="days"
-                    label="Number of days"
-                    [min]="1"
-                    [invalid]="!tieringForm.controls.days.valid && tieringForm.controls.days.dirty"
-                    [invalidText]="daysError"
-                    [helperText]="daysHelper"></cds-number>
-        <ng-template #daysHelper>
-          <span i18n>Select the number of days to transition the objects to the specified storage class. The value must be a positive integer.
-          </span>
-        </ng-template>
-        <ng-template #daysError>
-          <span *ngIf="tieringForm.showError('days', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span *ngIf="tieringForm.showError('days', formDir, 'pattern')"
-                i18n>Enter a valid positive number</span>
-        </ng-template>
-      </div>
-    </form>
-  </section>
-</ng-container>
+        <!-- tags -->
+        <div
+          class="form-item"
+          *ngIf="tieringForm.controls.hasPrefix.value"
+        >
+          <div class="form-group-header">Tags</div>
+          <div class="cds-mb-4">
+            All the tags must exist in the object's tag set for the rule to apply.
+          </div>
+          <ng-container
+            formArrayName="tags"
+            *ngFor="let tags of tags.controls; index as i"
+          >
+            <ng-container [formGroupName]="i">
+              <div
+                cdsRow
+                class="form-item form-item-append"
+              >
+                <div cdsCol>
+                  <cds-text-label
+                    labelInputID="Key"
+                    [invalid]="
+                      !tieringForm.controls['tags'].controls[i].controls['Key'].valid &&
+                      tieringForm.controls['tags'].controls[i].controls['Key'].dirty
+                    "
+                    [invalidText]="tagKeyError"
+                    i18n
+                    >Name of the object key
+                    <input
+                      cdsText
+                      type="text"
+                      placeholder="Enter name of the object key"
+                      formControlName="Key"
+                      i18n-placeholder
+                      [invalid]="
+                        tieringForm.controls['tags'].controls[i].controls['Key'].invalid &&
+                        tieringForm.controls['tags'].controls[i].controls['Key'].dirty
+                      "
+                    />
+                  </cds-text-label>
+                  <ng-template #tagKeyError>
+                    <ng-container i18n>This field is required.</ng-container>
+                  </ng-template>
+                </div>
+                <div cdsCol>
+                  <cds-text-label
+                    labelInputID="Value"
+                    [invalid]="
+                      !tieringForm.controls['tags'].controls[i].controls['Value'].valid &&
+                      tieringForm.controls['tags'].controls[i].controls['Value'].dirty
+                    "
+                    [invalidText]="tagValueError"
+                    i18n
+                    >Value of the tag
+                    <input
+                      cdsText
+                      type="text"
+                      placeholder="Enter value of the tag"
+                      formControlName="Value"
+                      i18n-placeholder
+                      [invalid]="
+                        tieringForm.controls['tags'].controls[i].controls['Value'].invalid &&
+                        tieringForm.controls['tags'].controls[i].controls['Value'].dirty
+                      "
+                    />
+                  </cds-text-label>
+                  <ng-template #tagValueError>
+                    <ng-container i18n>This field is required.</ng-container>
+                  </ng-template>
+                </div>
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 2, md: 2 }"
+                  class="item-action-btn"
+                >
+                  <cds-icon-button
+                    kind="tertiary"
+                    size="sm"
+                    (click)="removeTags(i)"
+                  >
+                    <svg
+                      cdsIcon="trash-can"
+                      size="32"
+                      class="cds--btn__icon"
+                    ></svg>
+                  </cds-icon-button>
+                </div>
+              </div>
+            </ng-container>
+          </ng-container>
+          <div class="form-item">
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="addTags()"
+              i18n
+            >
+              Add tags
+              <svg
+                cdsIcon="add"
+                size="32"
+                class="cds--btn__icon"
+                icon
+              ></svg>
+            </button>
+          </div>
+        </div>
+
+        <legend class="cds--label">Status</legend>
+        <div class="form-item">
+          <cds-radio-group formControlName="status">
+            <cds-radio
+              [value]="'Enabled'"
+              i18n
+              >Enabled
+            </cds-radio>
+            <cds-radio
+              [value]="'Disabled'"
+              i18n
+              >Disabled
+            </cds-radio>
+          </cds-radio-group>
+        </div>
+        <div>
+          <cds-number
+            formControlName="days"
+            label="Number of days"
+            [min]="1"
+            [invalid]="!tieringForm.controls.days.valid && tieringForm.controls.days.dirty"
+            [invalidText]="daysError"
+            [helperText]="daysHelper"
+          ></cds-number>
+          <ng-template #daysHelper>
+            <span i18n
+              >Select the number of days to transition the objects to the specified storage class.
+              The value must be a positive integer.
+            </span>
+          </ng-template>
+          <ng-template #daysError>
+            <span
+              *ngIf="tieringForm.showError('days', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              *ngIf="tieringForm.showError('days', formDir, 'pattern')"
+              i18n
+              >Enter a valid positive number</span
+            >
+          </ng-template>
+        </div>
+      </form>
+    </section>
+  </ng-container>
   <cd-form-button-panel
     (submitActionEvent)="submitTieringConfig()"
     [form]="tieringForm"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-details/rgw-config-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-details/rgw-config-details.component.html
index ed79ed27b60..edb277d1dc7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-details/rgw-config-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-details/rgw-config-details.component.html
@@ -1,15 +1,19 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       id="tabset-config-details"
-       class="nav-tabs"
-       cdStatefulTab="config-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    id="tabset-config-details"
+    class="nav-tabs"
+    cdStatefulTab="config-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value [data]="transformedData">
-        </cd-table-key-value>
+        <cd-table-key-value [data]="transformedData"> </cd-table-key-value>
       </ng-template>
     </ng-container>
   </nav>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html
index a88e35b6814..c88510a78ea 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-config-modal/rgw-config-modal.component.html
@@ -1,364 +1,566 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container i18n="form title"
-                class="modal-title">{{ action | titlecase }} RGW Encryption Configurations</ng-container>
+  <ng-container
+    i18n="form title"
+    class="modal-title"
+    >{{ action | titlecase }} RGW Encryption Configurations</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form name="configForm"
-          #frm="ngForm"
-          [formGroup]="configForm">
-    <div class="modal-body">
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="encryptionType"
-               i18n>Encryption Type</label>
-        <div class="col-md-auto custom-checkbox form-check-inline ms-3">
-          <input class="form-check-input"
-                 formControlName="encryptionType"
-                 id="s3Enabled"
-                 type="radio"
-                 (change)="checkKmsProviders()"
-                 [attr.disabled]="editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_S3 ? true : null"
-                 [value]="ENCRYPTION_TYPE.SSE_S3">
-          <label class="custom-check-label"
-                 [ngClass]="{'text-muted': editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_S3}"
-                 for="s3Enabled"
-                 i18n>SSE-S3</label>
-        </div>
-
-        <div class="col-md-auto custom-checkbox form-check-inline">
-          <input class="form-check-input"
-                 formControlName="encryptionType"
-                 id="kmsEnabled"
-                 (change)="checkKmsProviders()"
-                 [value]="ENCRYPTION_TYPE.SSE_KMS"
-                 [attr.disabled]="editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_KMS ? true : null"
-                 type="radio">
-          <label class="custom-check-label"
-                 [ngClass]="{'text-muted': editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_KMS}"
-                 for="kmsEnabled"
-                 i18n>SSE-KMS</label>
-        </div>
-      </div>
-
-      <div *ngIf="configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
+    <form
+      name="configForm"
+      #frm="ngForm"
+      [formGroup]="configForm"
+    >
+      <div class="modal-body">
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="kms_provider"
-                 i18n>Key management service provider</label>
-          <div class="cd-col-form-input">
-            <select id="kms_provider"
-                    class="form-select"
-                    (change)="setKmsProvider()"
-                    formControlName="kms_provider">
-              <option *ngIf="kmsProviders !== null && kmsProviders.length === 0"
-                      ngValue="null"
-                      i18n>-- No kms providers available --</option>
-              <option *ngIf="kmsProviders !== null && kmsProviders.length > 0"
-                      ngValue=""
-                      i18n>-- Select a provider --</option>
-              <option *ngFor="let provider of kmsProviders"
-                      [value]="provider">{{ provider }}</option>
-            </select>
-            <cd-help-text>
-              <span i18n>Where the encryption keys are stored.
-              </span>
-            </cd-help-text>
-            <span class="invalid-feedback"
-                  *ngIf="configForm.showError('kms_provider', frm, 'required')"
-                  i18n>This field is required.</span>
+          <label
+            class="cd-col-form-label required"
+            for="encryptionType"
+            i18n
+            >Encryption Type</label
+          >
+          <div class="col-md-auto custom-checkbox form-check-inline ms-3">
+            <input
+              class="form-check-input"
+              formControlName="encryptionType"
+              id="s3Enabled"
+              type="radio"
+              (change)="checkKmsProviders()"
+              [attr.disabled]="
+                editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_S3
+                  ? true
+                  : null
+              "
+              [value]="ENCRYPTION_TYPE.SSE_S3"
+            />
+            <label
+              class="custom-check-label"
+              [ngClass]="{
+                'text-muted':
+                  editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_S3
+              }"
+              for="s3Enabled"
+              i18n
+              >SSE-S3</label
+            >
+          </div>
+
+          <div class="col-md-auto custom-checkbox form-check-inline">
+            <input
+              class="form-check-input"
+              formControlName="encryptionType"
+              id="kmsEnabled"
+              (change)="checkKmsProviders()"
+              [value]="ENCRYPTION_TYPE.SSE_KMS"
+              [attr.disabled]="
+                editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_KMS
+                  ? true
+                  : null
+              "
+              type="radio"
+            />
+            <label
+              class="custom-check-label"
+              [ngClass]="{
+                'text-muted':
+                  editing && configForm.getValue('encryptionType') !== ENCRYPTION_TYPE.SSE_KMS
+              }"
+              for="kmsEnabled"
+              i18n
+              >SSE-KMS</label
+            >
           </div>
         </div>
-      </div>
 
-      <div *ngIf="kmsProviders.length !== 0 && configForm.getValue('kms_provider') !== ''">
-        <div *ngIf="(configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS && configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
+        <div
+          *ngIf="
+            configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS ||
+            configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+          "
+        >
           <div class="form-group row">
-            <label class="cd-col-form-label required"
-                   for="auth"
-                   i18n>Authentication Method</label>
+            <label
+              class="cd-col-form-label required"
+              for="kms_provider"
+              i18n
+              >Key management service provider</label
+            >
             <div class="cd-col-form-input">
-              <select class="form-select"
-                      id="auth"
-                      formControlName="auth">
-                <option *ngFor="let auth of authMethods"
-                        [value]="auth">{{ auth }}</option>
+              <select
+                id="kms_provider"
+                class="form-select"
+                (change)="setKmsProvider()"
+                formControlName="kms_provider"
+              >
+                <option
+                  *ngIf="kmsProviders !== null && kmsProviders.length === 0"
+                  ngValue="null"
+                  i18n
+                >
+                  -- No kms providers available --
+                </option>
+                <option
+                  *ngIf="kmsProviders !== null && kmsProviders.length > 0"
+                  ngValue=""
+                  i18n
+                >
+                  -- Select a provider --
+                </option>
+                <option
+                  *ngFor="let provider of kmsProviders"
+                  [value]="provider"
+                >
+                  {{ provider }}
+                </option>
               </select>
               <cd-help-text>
-                <span i18n>Type of authentication method to be used with Vault
-                </span>
+                <span i18n>Where the encryption keys are stored. </span>
               </cd-help-text>
-              <span class="invalid-feedback"
-                    *ngIf="configForm.showError('auth', frm, 'required')"
-                    i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="configForm.showError('kms_provider', frm, 'required')"
+                i18n
+                >This field is required.</span
+              >
             </div>
           </div>
         </div>
 
-        <div *ngIf="(configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS && configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label class="cd-col-form-label required"
-                   for="secret_engine"
-                   i18n>Secret Engine</label>
-            <div class="cd-col-form-input">
-              <select class="form-select"
-                      id="secret_engine"
-                      formControlName="secret_engine">
-                <option *ngFor="let secret_engine of secretEngines"
-                        [value]="secret_engine">{{ secret_engine }}</option>
-              </select>
-              <cd-help-text>
-                <span i18n>Vault Secret Engine to be used to retrieve encryption keys.
-                </span>
-              </cd-help-text>
-              <span class="invalid-feedback"
-                    *ngIf="configForm.showError('secret_engine', frm, 'required')"
-                    i18n>This field is required.</span>
-            </div>
-          </div>
-        </div>
-
-        <div *ngIf="(configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS && configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="secret_path"
-                   i18n>Secret Path
-            </label>
-            <div class="cd-col-form-input">
-              <input  class="form-control"
-                      type="text"
-                      id="secret_path"
-                      formControlName="secret_path"
-                      placeholder="/v1/secret/data">
+        <div *ngIf="kmsProviders.length !== 0 && configForm.getValue('kms_provider') !== ''">
+          <div
+            *ngIf="
+              (configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS &&
+                configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label required"
+                for="auth"
+                i18n
+                >Authentication Method</label
+              >
+              <div class="cd-col-form-input">
+                <select
+                  class="form-select"
+                  id="auth"
+                  formControlName="auth"
+                >
+                  <option
+                    *ngFor="let auth of authMethods"
+                    [value]="auth"
+                  >
+                    {{ auth }}
+                  </option>
+                </select>
                 <cd-help-text>
-                  <span i18n>Vault secret URL prefix, which can be used to restrict access to a particular subset of the Vault secret space.
+                  <span i18n>Type of authentication method to be used with Vault </span>
+                </cd-help-text>
+                <span
+                  class="invalid-feedback"
+                  *ngIf="configForm.showError('auth', frm, 'required')"
+                  i18n
+                  >This field is required.</span
+                >
+              </div>
+            </div>
+          </div>
+
+          <div
+            *ngIf="
+              (configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS &&
+                configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label required"
+                for="secret_engine"
+                i18n
+                >Secret Engine</label
+              >
+              <div class="cd-col-form-input">
+                <select
+                  class="form-select"
+                  id="secret_engine"
+                  formControlName="secret_engine"
+                >
+                  <option
+                    *ngFor="let secret_engine of secretEngines"
+                    [value]="secret_engine"
+                  >
+                    {{ secret_engine }}
+                  </option>
+                </select>
+                <cd-help-text>
+                  <span i18n>Vault Secret Engine to be used to retrieve encryption keys. </span>
+                </cd-help-text>
+                <span
+                  class="invalid-feedback"
+                  *ngIf="configForm.showError('secret_engine', frm, 'required')"
+                  i18n
+                  >This field is required.</span
+                >
+              </div>
+            </div>
+          </div>
+
+          <div
+            *ngIf="
+              (configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS &&
+                configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="secret_path"
+                i18n
+                >Secret Path
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  class="form-control"
+                  type="text"
+                  id="secret_path"
+                  formControlName="secret_path"
+                  placeholder="/v1/secret/data"
+                />
+                <cd-help-text>
+                  <span i18n
+                    >Vault secret URL prefix, which can be used to restrict access to a particular
+                    subset of the Vault secret space.
                   </span>
                 </cd-help-text>
-              <span class="invalid-feedback"
-                    *ngIf="configForm.showError('secret_path', frm, 'required')"
-                    i18n>This field is required.</span>
+                <span
+                  class="invalid-feedback"
+                  *ngIf="configForm.showError('secret_path', frm, 'required')"
+                  i18n
+                  >This field is required.</span
+                >
+              </div>
             </div>
           </div>
-        </div>
 
-        <div *ngIf="(configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS && configForm.getValue('kms_provider') == KMS_PROVIDER.VAULT) || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="namespace"
-                   i18n>Namespace
-            </label>
-            <div class="cd-col-form-input">
-              <input  class="form-control"
-                      id="namespace"
-                      type="text"
-                      placeholder="tenant1"
-                      formControlName="namespace">
-              <cd-help-text>
-                <span i18n>Vault Namespace to be used to select your tenant.
+          <div
+            *ngIf="
+              (configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS &&
+                configForm.getValue('kms_provider') == KMS_PROVIDER.VAULT) ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="namespace"
+                i18n
+                >Namespace
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  class="form-control"
+                  id="namespace"
+                  type="text"
+                  placeholder="tenant1"
+                  formControlName="namespace"
+                />
+                <cd-help-text>
+                  <span i18n>Vault Namespace to be used to select your tenant. </span>
+                </cd-help-text>
+              </div>
+            </div>
+          </div>
+
+          <div
+            *ngIf="
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label required"
+                for="addr"
+              >
+                <span
+                  i18n
+                  *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT"
+                  >Vault Address
                 </span>
-              </cd-help-text>
-            </div>
-          </div>
-        </div>
-
-        <div *ngIf="configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label  class="cd-col-form-label required"
-                    for="addr">
-              <span i18n
-                    *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT">Vault Address
-              </span>
-              <span i18n
-                    *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.KMIP">KMIP Address
-              </span>
-            </label>
-            <div class="cd-col-form-input">
-              <input  class="form-control"
-                      id="addr"
-                      formControlName="addr"
-                      placeholder="http://127.0.0.1:8000"
-                      i18n>
-                <cd-help-text >
-                  <span *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT"
-                        i18n>Vault server base address.
+                <span
+                  i18n
+                  *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.KMIP"
+                  >KMIP Address
+                </span>
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  class="form-control"
+                  id="addr"
+                  formControlName="addr"
+                  placeholder="http://127.0.0.1:8000"
+                  i18n
+                />
+                <cd-help-text>
+                  <span
+                    *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT"
+                    i18n
+                    >Vault server base address.
                   </span>
-                  <span *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.KMIP"
-                        i18n>Kmip server base address.
+                  <span
+                    *ngIf="configForm.getValue('kms_provider') === KMS_PROVIDER.KMIP"
+                    i18n
+                    >Kmip server base address.
                   </span>
                 </cd-help-text>
-              <span class="invalid-feedback"
-                    *ngIf="configForm.showError('addr', frm, 'required')"
-                    i18n>This field is required.</span>
+                <span
+                  class="invalid-feedback"
+                  *ngIf="configForm.showError('addr', frm, 'required')"
+                  i18n
+                  >This field is required.</span
+                >
+              </div>
             </div>
           </div>
-        </div>
 
-        <div *ngIf="(configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS && configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT)|| configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div  *ngIf="configForm.getValue('auth') === 'token'"
-                class="form-group row">
-          <label  class="cd-col-form-label required"
-                  for="token">
-          <span i18n>Token</span>
-          <cd-helper i18n>
-            The token authentication method expects a Vault token to be present in a plaintext file.
-          </cd-helper>
-          </label>
-          <div class="cd-col-form-input">
-            <input  type="file"
-                    id="token"
-                    formControlName="token"
-                    (change)="fileUpload($event.target.files, 'token')">
-              <cd-help-text>
-                <span i18n>If authentication method is 'token', provide a path to the token file.
-                </span>
-              </cd-help-text>
-            <span class="invalid-feedback"
+          <div
+            *ngIf="
+              (configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS &&
+                configForm.getValue('kms_provider') === KMS_PROVIDER.VAULT) ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div
+              *ngIf="configForm.getValue('auth') === 'token'"
+              class="form-group row"
+            >
+              <label
+                class="cd-col-form-label required"
+                for="token"
+              >
+                <span i18n>Token</span>
+                <cd-helper i18n>
+                  The token authentication method expects a Vault token to be present in a plaintext
+                  file.
+                </cd-helper>
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  type="file"
+                  id="token"
+                  formControlName="token"
+                  (change)="fileUpload($event.target.files, 'token')"
+                />
+                <cd-help-text>
+                  <span i18n
+                    >If authentication method is 'token', provide a path to the token file.
+                  </span>
+                </cd-help-text>
+                <span
+                  class="invalid-feedback"
                   *ngIf="configForm.showError('token', frm, 'required')"
-                  i18n>This field is required.</span>
-          </div>
-          </div>
-        </div>
-
-      <div *ngIf="configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS && configForm.getValue('kms_provider') === KMS_PROVIDER.KMIP">
-        <div class="form-group row">
-          <label  class="cd-col-form-label"
-                  for="kms_key_template"
-                  i18n>KMS Key Template
-          </label>
-          <div class="cd-col-form-input">
-            <input  class="form-control"
-                    id="kms_key_template"
-                    placeholder="$keyid"
-                    formControlName="kms_key_template">
-            <cd-help-text>
-              <span i18n>sse-kms; kmip key names
-              </span>
-            </cd-help-text>
-          </div>
-        </div>
-        <div class="form-group row">
-          <label  class="cd-col-form-label"
-                  for="s3_key_template"
-                  i18n>S3 Key Template
-          </label>
-          <div class="cd-col-form-input">
-            <input  class="form-control"
-                    id="s3_key_template"
-                    placeholder="$keyid"
-                    formControlName="s3_key_template">
-            <cd-help-text>
-              <span i18n>sse-s3; kmip key template
-              </span>
-            </cd-help-text>
-          </div>
-        </div>
-
-        <div class="form-group row">
-          <label  class="cd-col-form-label"
-                  for="username"
-                  i18n>Username
-          </label>
-          <div class="cd-col-form-input">
-            <input  id="username"
-                    class="form-control"
-                    [attr.disabled]="configForm.getValue('kms_provider') !== KMS_PROVIDER.KMIP ? true : null"
-                    formControlName="username">
-            <cd-help-text>
-              <span i18n>When authenticating via username
-              </span>
-            </cd-help-text>
-          </div>
-        </div>
-        <div class="form-group row">
-          <label  class="cd-col-form-label"
-                  for="password"
-                  i18n>Password
-          </label>
-          <div class="cd-col-form-input">
-            <input  id="password"
-                    class="form-control"
-                    type="password"
-                    [attr.disabled]="configForm.getValue('kms_provider') != KMS_PROVIDER.KMIP"
-                    formControlName="password">
-            <cd-help-text>
-              <span i18n>optional w/ username
-              </span>
-            </cd-help-text>
-          </div>
-        </div>
-      </div>
-
-        <div *ngIf="configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="ssl_cert">
-            <span i18n>CA Certificate Path</span>
-            <cd-helper i18n>The SSL certificate in PEM format. Please provide file path to the RGW host.</cd-helper>
-            </label>
-            <div class="cd-col-form-input">
-            <input  type="text"
-                    id="ssl_cert"
-                    class="form-control"
-                    formControlName="ssl_cert"
-                    placeholder="/path/to/ca_cert.pem">
-            <cd-help-text>
-              <span i18n>
-                Path for custom ca certificate for accessing server
-              </span>
-            </cd-help-text>
+                  i18n
+                  >This field is required.</span
+                >
+              </div>
             </div>
           </div>
-        </div>
 
-        <div *ngIf="configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="client_cert">
-            <span i18n>Client Certificate Path</span>
-            <cd-helper i18n>The Client certificate in PEM format. Please provide file path to the RGW host.</cd-helper>
-            </label>
-            <div class="cd-col-form-input">
-              <input  type="text"
-                      id="client_cert"
-                      class="form-control"
-                      formControlName="client_cert"
-                      placeholder="/path/to/client_cert.pem">
-              <cd-help-text>
-                <span i18n>
-                  Path for custom client certificate for accessing server
-                </span>
-              </cd-help-text>
+          <div
+            *ngIf="
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS &&
+              configForm.getValue('kms_provider') === KMS_PROVIDER.KMIP
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="kms_key_template"
+                i18n
+                >KMS Key Template
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  class="form-control"
+                  id="kms_key_template"
+                  placeholder="$keyid"
+                  formControlName="kms_key_template"
+                />
+                <cd-help-text>
+                  <span i18n>sse-kms; kmip key names </span>
+                </cd-help-text>
+              </div>
+            </div>
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="s3_key_template"
+                i18n
+                >S3 Key Template
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  class="form-control"
+                  id="s3_key_template"
+                  placeholder="$keyid"
+                  formControlName="s3_key_template"
+                />
+                <cd-help-text>
+                  <span i18n>sse-s3; kmip key template </span>
+                </cd-help-text>
+              </div>
+            </div>
+
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="username"
+                i18n
+                >Username
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  id="username"
+                  class="form-control"
+                  [attr.disabled]="
+                    configForm.getValue('kms_provider') !== KMS_PROVIDER.KMIP ? true : null
+                  "
+                  formControlName="username"
+                />
+                <cd-help-text>
+                  <span i18n>When authenticating via username </span>
+                </cd-help-text>
+              </div>
+            </div>
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="password"
+                i18n
+                >Password
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  id="password"
+                  class="form-control"
+                  type="password"
+                  [attr.disabled]="configForm.getValue('kms_provider') != KMS_PROVIDER.KMIP"
+                  formControlName="password"
+                />
+                <cd-help-text>
+                  <span i18n>optional w/ username </span>
+                </cd-help-text>
+              </div>
             </div>
           </div>
-        </div>
 
-        <div *ngIf="configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS || configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3">
-          <div class="form-group row">
-            <label class="cd-col-form-label"
-                   for="client_key">
-            <span i18n>Client Private Key Path</span>
-            <cd-helper i18n>The Client Private Key in PEM format. Please provide file path to the RGW host.</cd-helper>
-            </label>
-            <div class="cd-col-form-input">
-              <input  type="text"
-                      id="client_key"
-                      formControlName="client_key"
-                      placeholder="/path/to/client_key.pem"
-                      class="form-control">
-              <cd-help-text>
-                <span i18n>
-                  Path for private key required for client cert
-                </span>
-              </cd-help-text>
+          <div
+            *ngIf="
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="ssl_cert"
+              >
+                <span i18n>CA Certificate Path</span>
+                <cd-helper i18n
+                  >The SSL certificate in PEM format. Please provide file path to the RGW
+                  host.</cd-helper
+                >
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  type="text"
+                  id="ssl_cert"
+                  class="form-control"
+                  formControlName="ssl_cert"
+                  placeholder="/path/to/ca_cert.pem"
+                />
+                <cd-help-text>
+                  <span i18n> Path for custom ca certificate for accessing server </span>
+                </cd-help-text>
+              </div>
+            </div>
+          </div>
+
+          <div
+            *ngIf="
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="client_cert"
+              >
+                <span i18n>Client Certificate Path</span>
+                <cd-helper i18n
+                  >The Client certificate in PEM format. Please provide file path to the RGW
+                  host.</cd-helper
+                >
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  type="text"
+                  id="client_cert"
+                  class="form-control"
+                  formControlName="client_cert"
+                  placeholder="/path/to/client_cert.pem"
+                />
+                <cd-help-text>
+                  <span i18n> Path for custom client certificate for accessing server </span>
+                </cd-help-text>
+              </div>
+            </div>
+          </div>
+
+          <div
+            *ngIf="
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_KMS ||
+              configForm.getValue('encryptionType') === ENCRYPTION_TYPE.SSE_S3
+            "
+          >
+            <div class="form-group row">
+              <label
+                class="cd-col-form-label"
+                for="client_key"
+              >
+                <span i18n>Client Private Key Path</span>
+                <cd-helper i18n
+                  >The Client Private Key in PEM format. Please provide file path to the RGW
+                  host.</cd-helper
+                >
+              </label>
+              <div class="cd-col-form-input">
+                <input
+                  type="text"
+                  id="client_key"
+                  formControlName="client_key"
+                  placeholder="/path/to/client_key.pem"
+                  class="form-control"
+                />
+                <cd-help-text>
+                  <span i18n> Path for private key required for client cert </span>
+                </cd-help-text>
+              </div>
             </div>
           </div>
         </div>
       </div>
-    </div>
-    <div class="modal-footer">
-      <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                            [submitText]="actionLabels.SUBMIT"
-                            [form]="configForm"></cd-form-button-panel>
-    </div>
+      <div class="modal-footer">
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [submitText]="actionLabels.SUBMIT"
+          [form]="configForm"
+        ></cd-form-button-panel>
+      </div>
     </form>
   </ng-container>
 </cd-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-configuration-page/rgw-configuration-page.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-configuration-page/rgw-configuration-page.component.html
index a6b3e3287c5..ee584541036 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-configuration-page/rgw-configuration-page.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-configuration-page/rgw-configuration-page.component.html
@@ -1,29 +1,40 @@
-<nav ngbNav
-     #nav="ngbNav"
-     class="nav-tabs">
+<nav
+  ngbNav
+  #nav="ngbNav"
+  class="nav-tabs"
+>
   <ng-container ngbNavItem>
-    <a ngbNavLink
-       i18n>Server-side Encryption</a>
+    <a
+      ngbNavLink
+      i18n
+      >Server-side Encryption</a
+    >
     <ng-template ngbNavContent>
-      <cd-table #table
-                [data]="encryptionConfigValues"
-                [columns]="columns"
-                (fetchData)="fetchData()"
-                identifier="unique_id"
-                [forceIdentifier]="true"
-                [hasDetails]="true"
-                (updateSelection)="updateSelection($event)"
-                (setExpandedRow)="setExpandedRow($event)"
-                columnMode="flex"
-                selectionType="single">
-        <cd-table-actions class="table-actions"
-                          [permission]="permissions.configOpt"
-                          [selection]="selection"
-                          [tableActions]="tableActions">
+      <cd-table
+        #table
+        [data]="encryptionConfigValues"
+        [columns]="columns"
+        (fetchData)="fetchData()"
+        identifier="unique_id"
+        [forceIdentifier]="true"
+        [hasDetails]="true"
+        (updateSelection)="updateSelection($event)"
+        (setExpandedRow)="setExpandedRow($event)"
+        columnMode="flex"
+        selectionType="single"
+      >
+        <cd-table-actions
+          class="table-actions"
+          [permission]="permissions.configOpt"
+          [selection]="selection"
+          [tableActions]="tableActions"
+        >
         </cd-table-actions>
-        <cd-rgw-config-details *cdTableDetail
-                               [selection]="expandedRow"
-                               [excludeProps]="excludeProps">
+        <cd-rgw-config-details
+          *cdTableDetail
+          [selection]="expandedRow"
+          [excludeProps]="excludeProps"
+        >
         </cd-rgw-config-details>
       </cd-table>
     </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-details/rgw-daemon-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-details/rgw-daemon-details.component.html
index 7c6e8696f46..2a991335fe1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-details/rgw-daemon-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-details/rgw-daemon-details.component.html
@@ -1,37 +1,56 @@
 <ng-container *ngIf="selection">
-  <nav ngbNav
-       #nav="ngbNav"
-       class="nav-tabs"
-       cdStatefulTab="rgw-daemon-details">
+  <nav
+    ngbNav
+    #nav="ngbNav"
+    class="nav-tabs"
+    cdStatefulTab="rgw-daemon-details"
+  >
     <ng-container ngbNavItem="details">
-      <a ngbNavLink
-         i18n>Details</a>
+      <a
+        ngbNavLink
+        i18n
+        >Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-key-value [data]="metadata"
-                            (fetchData)="getMetaData()">
+        <cd-table-key-value
+          [data]="metadata"
+          (fetchData)="getMetaData()"
+        >
         </cd-table-key-value>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="performance-counters">
-      <a ngbNavLink
-         i18n>Performance Counters</a>
+      <a
+        ngbNavLink
+        i18n
+        >Performance Counters</a
+      >
       <ng-template ngbNavContent>
-        <cd-table-performance-counter serviceType="rgw"
-                                      [serviceId]="serviceMapId">
+        <cd-table-performance-counter
+          serviceType="rgw"
+          [serviceId]="serviceMapId"
+        >
         </cd-table-performance-counter>
       </ng-template>
     </ng-container>
-    <ng-container ngbNavItem="performance-details"
-                  *ngIf="grafanaPermission.read">
-      <a ngbNavLink
-         i18n>Performance Details</a>
+    <ng-container
+      ngbNavItem="performance-details"
+      *ngIf="grafanaPermission.read"
+    >
+      <a
+        ngbNavLink
+        i18n
+        >Performance Details</a
+      >
       <ng-template ngbNavContent>
-        <cd-grafana i18n-title
-                    title="RGW instance details"
-                    [grafanaPath]="'ceph-object-instance-details?var-rgw_servers=rgw.' + serviceId"
-                    [type]="'metrics'"
-                    uid="x5ARzZtmk"
-                    grafanaStyle="one">
+        <cd-grafana
+          i18n-title
+          title="RGW instance details"
+          [grafanaPath]="'ceph-object-instance-details?var-rgw_servers=rgw.' + serviceId"
+          [type]="'metrics'"
+          uid="x5ARzZtmk"
+          grafanaStyle="one"
+        >
         </cd-grafana>
       </ng-template>
     </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-list/rgw-daemon-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-list/rgw-daemon-list.component.html
index ed6521c4f18..ba64e39335f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-list/rgw-daemon-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-daemon-list/rgw-daemon-list.component.html
@@ -1,49 +1,72 @@
-<nav ngbNav
-     #nav="ngbNav"
-     class="nav-tabs">
+<nav
+  ngbNav
+  #nav="ngbNav"
+  class="nav-tabs"
+>
   <ng-container ngbNavItem>
-    <a ngbNavLink
-       i18n>Gateways List</a>
+    <a
+      ngbNavLink
+      i18n
+      >Gateways List</a
+    >
     <ng-template ngbNavContent>
-      <cd-table [data]="daemons"
-                [columns]="columns"
-                columnMode="flex"
-                [hasDetails]="true"
-                (setExpandedRow)="setExpandedRow($event)"
-                (fetchData)="getDaemonList($event)">
-        <cd-rgw-daemon-details *cdTableDetail
-                               [selection]="expandedRow">
+      <cd-table
+        [data]="daemons"
+        [columns]="columns"
+        columnMode="flex"
+        [hasDetails]="true"
+        (setExpandedRow)="setExpandedRow($event)"
+        (fetchData)="getDaemonList($event)"
+      >
+        <cd-rgw-daemon-details
+          *cdTableDetail
+          [selection]="expandedRow"
+        >
         </cd-rgw-daemon-details>
       </cd-table>
     </ng-template>
   </ng-container>
 
-  <ng-container ngbNavItem
-                *ngIf="grafanaPermission.read">
-    <a ngbNavLink
-       i18n>Overall Performance</a>
+  <ng-container
+    ngbNavItem
+    *ngIf="grafanaPermission.read"
+  >
+    <a
+      ngbNavLink
+      i18n
+      >Overall Performance</a
+    >
     <ng-template ngbNavContent>
-      <cd-grafana i18n-title
-                  title="RGW overview"
-                  [grafanaPath]="'ceph-object-overview?'"
-                  [type]="'metrics'"
-                  uid="WAkugZpiz"
-                  grafanaStyle="three">
+      <cd-grafana
+        i18n-title
+        title="RGW overview"
+        [grafanaPath]="'ceph-object-overview?'"
+        [type]="'metrics'"
+        uid="WAkugZpiz"
+        grafanaStyle="three"
+      >
       </cd-grafana>
     </ng-template>
   </ng-container>
 
-  <ng-container ngbNavItem
-                *ngIf="grafanaPermission.read && isMultiSite">
-    <a ngbNavLink
-       i18n>Sync Performance</a>
+  <ng-container
+    ngbNavItem
+    *ngIf="grafanaPermission.read && isMultiSite"
+  >
+    <a
+      ngbNavLink
+      i18n
+      >Sync Performance</a
+    >
     <ng-template ngbNavContent>
-      <cd-grafana i18n-title
-                  title="Radosgw sync overview"
-                  [grafanaPath]="'ceph-object-sync-overview?'"
-                  [type]="'metrics'"
-                  uid="rgw-sync-overview"
-                  grafanaStyle="two">
+      <cd-grafana
+        i18n-title
+        title="Radosgw sync overview"
+        [grafanaPath]="'ceph-object-sync-overview?'"
+        [type]="'metrics'"
+        uid="rgw-sync-overview"
+        grafanaStyle="two"
+      >
       </cd-grafana>
     </ng-template>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html
index d26f42e31cf..448acead01e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html
@@ -1,137 +1,200 @@
 <cd-rgw-multisite-tabs></cd-rgw-multisite-tabs>
 <div>
   <!-- Show the alert only when the user has the permission to configure -->
-  <cd-alert-panel *ngIf="permissions.configOpt.create && !rgwModuleStatus"
-                  type="info"
-                  spacingClass="mb-3"
-                  i18n
-                  class="align-items-center"
-                  actionName="Enable"
-                  (action)="enableRgwModule()">
-      In order to access the import/export feature, the rgw module must be enabled.
+  <cd-alert-panel
+    *ngIf="permissions.configOpt.create && !rgwModuleStatus"
+    type="info"
+    spacingClass="mb-3"
+    i18n
+    class="align-items-center"
+    actionName="Enable"
+    (action)="enableRgwModule()"
+  >
+    In order to access the import/export feature, the rgw module must be enabled.
   </cd-alert-panel>
-  <cd-alert-panel   *ngIf="restartGatewayMessage"
-                    type="warning"
-                    spacingClass="mb-3"
-                    i18n>Please restart all Ceph Object Gateway instances in all zones to ensure consistent multisite configuration updates.
-    <a class="text-decoration-underline"
-       routerLink="/services">
-       Cluster->Services</a>
+  <cd-alert-panel
+    *ngIf="restartGatewayMessage"
+    type="warning"
+    spacingClass="mb-3"
+    i18n
+    >Please restart all Ceph Object Gateway instances in all zones to ensure consistent multisite
+    configuration updates.
+    <a
+      class="text-decoration-underline"
+      routerLink="/services"
+    >
+      Cluster->Services</a
+    >
   </cd-alert-panel>
-  <div [cdsStack]="'horizontal'"
-       [gap]="4">
-    <cd-table-actions class="btn-group"
-                      [permission]="permissions.rgw"
-                      [selection]="selection"
-                      [tableActions]="multisiteReplicationActions">
+  <div
+    [cdsStack]="'horizontal'"
+    [gap]="4"
+  >
+    <cd-table-actions
+      class="btn-group"
+      [permission]="permissions.rgw"
+      [selection]="selection"
+      [tableActions]="multisiteReplicationActions"
+    >
     </cd-table-actions>
-    <cd-table-actions *ngIf="showMigrateAndReplicationActions"
-                      class="btn-group"
-                      [permission]="permissions.rgw"
-                      [selection]="selection"
-                      [tableActions]="migrateTableAction">
+    <cd-table-actions
+      *ngIf="showMigrateAndReplicationActions"
+      class="btn-group"
+      [permission]="permissions.rgw"
+      [selection]="selection"
+      [tableActions]="migrateTableAction"
+    >
     </cd-table-actions>
-    <cd-table-actions class="btn-group multisite-actions"
-                      [permission]="permissions.rgw"
-                      [selection]="selection"
-                      [tableActions]="createTableActions"
-                      dropDownOnly="Actions"
-                      [dropDownOnlyBtnColor]="'tertiary'"
-                      [dropDownOnlyOffset]="{ x: 45, y: 0 }">
+    <cd-table-actions
+      class="btn-group multisite-actions"
+      [permission]="permissions.rgw"
+      [selection]="selection"
+      [tableActions]="createTableActions"
+      dropDownOnly="Actions"
+      [dropDownOnlyBtnColor]="'tertiary'"
+      [dropDownOnlyOffset]="{ x: 45, y: 0 }"
+    >
     </cd-table-actions>
   </div>
 </div>
 <div class="card">
-  <div class="card-header"
-       data-testid="rgw-multisite-details-header"
-       i18n>Topology Viewer</div>
+  <div
+    class="card-header"
+    data-testid="rgw-multisite-details-header"
+    i18n
+  >
+    Topology Viewer
+  </div>
   <div class="row">
     <div class="col-sm-6 col-lg-6 tree-container">
-      <cds-loading *ngIf="loadingIndicator"
-                   [isActive]="true"
-                   [overlay]="false"
-                   size="sm"></cds-loading>
-      <cds-tree-view #tree
-                     [isMultiSelect]="false"
-                     (select)="onNodeSelected($event)">
-        <ng-template #nodeTemplateRef
-                     let-node="node"
-                     let-depth="depth">
-          <cds-tree-node [node]="node"
-                         [depth]="depth">
+      <cds-loading
+        *ngIf="loadingIndicator"
+        [isActive]="true"
+        [overlay]="false"
+        size="sm"
+      ></cds-loading>
+      <cds-tree-view
+        #tree
+        [isMultiSelect]="false"
+        (select)="onNodeSelected($event)"
+      >
+        <ng-template
+          #nodeTemplateRef
+          let-node="node"
+          let-depth="depth"
+        >
+          <cds-tree-node
+            [node]="node"
+            [depth]="depth"
+          >
             <ng-container *ngIf="node?.children && node?.children?.length">
-              <ng-container *ngFor="let child of node.children; let i = index;">
-                <ng-container *ngTemplateOutlet="nodeTemplateRef; context: { node: child, depth: depth + 1 };">
+              <ng-container *ngFor="let child of node.children; let i = index">
+                <ng-container
+                  *ngTemplateOutlet="nodeTemplateRef; context: { node: child, depth: depth + 1 }"
+                >
                 </ng-container>
               </ng-container>
             </ng-container>
           </cds-tree-node>
         </ng-template>
-        <ng-template #treeNodeTemplate
-                     let-node>
+        <ng-template
+          #treeNodeTemplate
+          let-node
+        >
           <div class="w-100 d-flex justify-content-between align-items-center pe-1">
             <div>
-              <span *ngIf="node?.data?.name"
-                    class="me-3">
-                <span *ngIf="(node?.data?.show_warning)">
-                  <svg [cdsIcon]="icons.danger"
-                       [size]="icons.size16"
-                       [title]="node?.data?.warning_message"
-                       class="cds-danger-color"></svg>
+              <span
+                *ngIf="node?.data?.name"
+                class="me-3"
+              >
+                <span *ngIf="node?.data?.show_warning">
+                  <svg
+                    [cdsIcon]="icons.danger"
+                    [size]="icons.size16"
+                    [title]="node?.data?.warning_message"
+                    class="cds-danger-color"
+                  ></svg>
                 </span>
-                <svg  *ngIf="node?.data?.icon === 'scales'"
-                      [cdsIcon]="icons.reweight"
-                      [size]="icons.size20"
-                      ></svg>
-                <svg *ngIf="node?.data?.icon === 'cube'"
-                     [cdsIcon]="icons.deploy"
-                     [size]="icons.size20"
-                     ></svg>
-                <svg *ngIf="node?.data?.icon === 'web-services--cluster'"
-                     [cdsIcon]="icons.clusterIcon"
-                     [size]="icons.size20"
-                     ></svg>
+                <svg
+                  *ngIf="node?.data?.icon === 'scales'"
+                  [cdsIcon]="icons.reweight"
+                  [size]="icons.size20"
+                ></svg>
+                <svg
+                  *ngIf="node?.data?.icon === 'cube'"
+                  [cdsIcon]="icons.deploy"
+                  [size]="icons.size20"
+                ></svg>
+                <svg
+                  *ngIf="node?.data?.icon === 'web-services--cluster'"
+                  [cdsIcon]="icons.clusterIcon"
+                  [size]="icons.size20"
+                ></svg>
                 {{ node?.data?.name }}
               </span>
-              <cds-tag class="tag-success me-2"
-                       *ngIf="node?.data?.is_default">
-                    default
+              <cds-tag
+                class="tag-success me-2"
+                *ngIf="node?.data?.is_default"
+              >
+                default
               </cds-tag>
-              <cds-tag class="tag-warning me-2"
-                       *ngIf="node?.data?.is_master"> master </cds-tag>
-              <cds-tag class="tag-warning me-2"
-                       *ngIf="node?.data?.secondary_zone">
-                  secondary-zone
+              <cds-tag
+                class="tag-warning me-2"
+                *ngIf="node?.data?.is_master"
+              >
+                master
               </cds-tag>
-              <cds-tag class="tag-info me-2"
-                       *ngIf="node?.data?.tier_type === 'archive'">
-                  archive
+              <cds-tag
+                class="tag-warning me-2"
+                *ngIf="node?.data?.secondary_zone"
+              >
+                secondary-zone
+              </cds-tag>
+              <cds-tag
+                class="tag-info me-2"
+                *ngIf="node?.data?.tier_type === 'archive'"
+              >
+                archive
               </cds-tag>
             </div>
-            <div class="btn-group align-inline-btns"
-                 [ngStyle]="{'visibility': activeNodeId === node?.data?.id ? 'visible' : 'hidden'}"
-                 role="group">
-              <div [title]="editTitle"
-                   i18n-title>
-                <button type="button"
-                        class="btn btn-light dropdown-toggle-split ms-1"
-                        (click)="openModal(node, true)"
-                        [disabled]="getDisable() || node?.data?.secondary_zone">
-                  <svg [cdsIcon]="icons.edit"
-                       [size]="icons.size16"
-                       class="cds-info-color"></svg>
+            <div
+              class="btn-group align-inline-btns"
+              [ngStyle]="{ visibility: activeNodeId === node?.data?.id ? 'visible' : 'hidden' }"
+              role="group"
+            >
+              <div
+                [title]="editTitle"
+                i18n-title
+              >
+                <button
+                  type="button"
+                  class="btn btn-light dropdown-toggle-split ms-1"
+                  (click)="openModal(node, true)"
+                  [disabled]="getDisable() || node?.data?.secondary_zone"
+                >
+                  <svg
+                    [cdsIcon]="icons.edit"
+                    [size]="icons.size16"
+                    class="cds-info-color"
+                  ></svg>
                 </button>
               </div>
               <ng-container *ngIf="isDeleteDisabled(node) as nodeDeleteData">
-                <div [title]="nodeDeleteData.deleteTitle"
-                     i18n-title>
-                  <button type="button"
-                          class="btn btn-light ms-1"
-                          [disabled]="nodeDeleteData.isDisabled || node?.data?.secondary_zone"
-                          (click)="delete(node)">
-                    <svg [cdsIcon]="icons.destroy"
-                         [size]="icons.size16"
-                         class="cds-info-color"></svg>
+                <div
+                  [title]="nodeDeleteData.deleteTitle"
+                  i18n-title
+                >
+                  <button
+                    type="button"
+                    class="btn btn-light ms-1"
+                    [disabled]="nodeDeleteData.isDisabled || node?.data?.secondary_zone"
+                    (click)="delete(node)"
+                  >
+                    <svg
+                      [cdsIcon]="icons.destroy"
+                      [size]="icons.size16"
+                      class="cds-info-color"
+                    ></svg>
                   </button>
                 </div>
               </ng-container>
@@ -139,17 +202,18 @@
           </div>
         </ng-template>
         <ng-container *ngFor="let node of nodes">
-          <ng-container *ngTemplateOutlet="nodeTemplateRef; context: { node: node, depth: 0 };">
+          <ng-container *ngTemplateOutlet="nodeTemplateRef; context: { node: node, depth: 0 }">
           </ng-container>
         </ng-container>
       </cds-tree-view>
     </div>
-    <div class="col-sm-6 col-lg-6 metadata"
-         *ngIf="metadata">
+    <div
+      class="col-sm-6 col-lg-6 metadata"
+      *ngIf="metadata"
+    >
       <legend>{{ metadataTitle }}</legend>
       <div>
-        <cd-table-key-value [data]="metadata">
-        </cd-table-key-value>
+        <cd-table-key-value [data]="metadata"> </cd-table-key-value>
       </div>
     </div>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html
index df49b0ea56d..0361c7fb496 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-export/rgw-multisite-export.component.html
@@ -8,7 +8,7 @@
     (closeSelect)="closeModal()"
     i18n
   >
-      Export multi-site realm token
+    Export multi-site realm token
   </cds-modal-header>
 
   <div cdsModalContent>
@@ -20,62 +20,62 @@
       <ng-container *cdFormLoading="loading">
         <div class="form-item">
           @if (!tokenValid) {
-          <cd-alert-panel
-            type="warning"
-            i18n
-          >
-            @for (realminfo of realms; track realminfo) {
-            <div>
-              <b>{{ realminfo.realm }}</b> - {{ realminfo.token }}
-            </div>
-            }
-          </cd-alert-panel>
+            <cd-alert-panel
+              type="warning"
+              i18n
+            >
+              @for (realminfo of realms; track realminfo) {
+                <div>
+                  <b>{{ realminfo.realm }}</b> - {{ realminfo.token }}
+                </div>
+              }
+            </cd-alert-panel>
           }
         </div>
 
         @for (realminfo of realms; track realminfo) {
-        <div>
-          <div class="form-item">
-            <cds-text-label
-              labelInputID="realmName"
-              i18n
-            >
-              Realm Name
-              <input
-                cdsText
-                readonly
-                type="text"
-                id="realmName"
-                [value]="realminfo.realm"
-                modal-primary-focus
-                [autofocus]="true"
-              />
-            </cds-text-label>
-          </div>
+          <div>
+            <div class="form-item">
+              <cds-text-label
+                labelInputID="realmName"
+                i18n
+              >
+                Realm Name
+                <input
+                  cdsText
+                  readonly
+                  type="text"
+                  id="realmName"
+                  [value]="realminfo.realm"
+                  modal-primary-focus
+                  [autofocus]="true"
+                />
+              </cds-text-label>
+            </div>
 
-          <div class="form-item form-item-append">
-            <cds-text-label
-              labelInputID="realmToken"
-              i18n
-            >
-              Token
-              <input
-                cdsText
-                readonly
-                type="text"
-                id="realmToken"
-                [value]="realminfo.token"
-              />
-            </cds-text-label>
-            <cd-copy-2-clipboard-button
-              class="clipboard"
-              [source]="realminfo.token"
-              [byId]="false"
-              size="md"
-            >
-            </cd-copy-2-clipboard-button>
+            <div class="form-item form-item-append">
+              <cds-text-label
+                labelInputID="realmToken"
+                i18n
+              >
+                Token
+                <input
+                  cdsText
+                  readonly
+                  type="text"
+                  id="realmToken"
+                  [value]="realminfo.token"
+                />
+              </cds-text-label>
+              <cd-copy-2-clipboard-button
+                class="clipboard"
+                [source]="realminfo.token"
+                [byId]="false"
+                size="md"
+              >
+              </cd-copy-2-clipboard-button>
+            </div>
           </div>
-        </div>
         }
       </ng-container>
     </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.html
index da95ab0ef60..378a0d0255a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.html
@@ -1,199 +1,313 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container i18n="form title"
-                class="modal-title">Import Multi-site Token</ng-container>
+  <ng-container
+    i18n="form title"
+    class="modal-title"
+    >Import Multi-site Token</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form name="importTokenForm"
-          #frm="ngForm"
-          [formGroup]="importTokenForm">
-    <div class="modal-body">
-      <cd-alert-panel type="info"
-                      spacingClass="mb-3">
-        <ul>
-          <li>This feature allows you to configure a connection between your primary and secondary Ceph clusters for data replication. By importing a token, you establish a link between the clusters, enabling data synchronization.</li>
-          <li>To obtain the token, generate it from your primary Ceph cluster. This token includes encoded information about the primary cluster's endpoint, access key, and secret key.</li>
-          <li>The secondary zone represents the destination cluster where your data will be replicated.</li>
-        </ul>
-      </cd-alert-panel>
-      <legend i18n>Zone Details</legend>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="realmToken"
-               i18n>Token
-        </label>
-        <div class="cd-col-form-input">
-          <input id="realmToken"
-                 name="realmToken"
-                 class="form-control"
-                 type="text"
-                 formControlName="realmToken">
-          <span class="invalid-feedback"
-                *ngIf="importTokenForm.showError('realmToken', frm, 'required')"
-                i18n>This field is required.</span>
-        </div>
-      </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zoneName"
-               i18n>Secondary Zone Name</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="Zone name..."
-                 id="zoneName"
-                 name="zoneName"
-                 formControlName="zoneName">
-          <span class="invalid-feedback"
-                *ngIf="importTokenForm.showError('zoneName', frm, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="importTokenForm.showError('zoneName', frm, 'uniqueName')"
-                i18n>The chosen zone name is already in use.</span>
-        </div>
-      </div>
-      <div class="form-group row">
-        <div class="cd-col-form-offset">
-          <div class="custom-control custom-checkbox">
-            <input class="custom-control-input"
-                   id="archive_zone"
-                   type="checkbox"
-                   formControlName="archive_zone">
-            <label class="custom-control-label cds-ml-2"
-                   for="archive_zone"
-                   i18n>Archive</label>
-            <cd-helper i18n>
-            <span
-              >Enable archival storage to keep all object versions and protect data from deletion or corruption.</span
-            >
-          </cd-helper>
-          </div>
-        </div>
-      </div>
-      <legend i18n>Service Details</legend>
-      <div class="form-group row">
-        <div class="cd-col-form-offset">
-          <div class="custom-control custom-checkbox">
-            <input class="custom-control-input"
-                   id="unmanaged"
-                   type="checkbox"
-                   formControlName="unmanaged">
-            <label class="custom-control-label cds-ml-2"
-                   for="unmanaged"
-                   i18n>Unmanaged</label>
-            <cd-helper i18n>If set to true, the orchestrator will not start nor stop any daemon associated with this service.
-               Placement and all other properties will be ignored.</cd-helper>
-          </div>
-        </div>
-      </div>
-
-      <!-- Placement -->
-      <div *ngIf="!importTokenForm.controls.unmanaged.value"
-           class="form-group row">
-        <label class="cd-col-form-label"
-               for="placement"
-               i18n>Placement</label>
-        <div class="cd-col-form-input">
-          <select id="placement"
-                  class="form-select"
-                  formControlName="placement">
-            <option i18n
-                    value="hosts">Hosts</option>
-            <option i18n
-                    value="label">Label</option>
-          </select>
-        </div>
-      </div>
-
-      <!-- Label -->
-      <div *ngIf="!importTokenForm.controls.unmanaged.value && importTokenForm.controls.placement.value === 'label'"
-           class="form-group row">
-        <label i18n
-               class="cd-col-form-label"
-               for="label">Label</label>
-        <div class="cd-col-form-input">
-          <input id="label"
-                 class="form-control"
-                 type="text"
-                 formControlName="label"
-                 [ngbTypeahead]="searchLabels"
-                 (focus)="labelFocus.next($any($event).target.value)"
-                 (click)="labelClick.next($any($event).target.value)">
-          <span class="invalid-feedback"
-                *ngIf="importTokenForm.showError('label', frm, 'required')"
-                i18n>This field is required.</span>
-        </div>
-      </div>
-
-      <!-- Hosts -->
-      <div *ngIf="!importTokenForm.controls.unmanaged.value && importTokenForm.controls.placement.value === 'hosts'"
-           class="form-group row">
-        <label class="cd-col-form-label"
-               for="hosts"
-               i18n>Hosts</label>
-        <div class="cd-col-form-input">
-          <cd-select-badges id="hosts"
-                            [data]="importTokenForm.controls.hosts.value"
-                            [options]="hosts.options"
-                            [messages]="hosts.messages">
-          </cd-select-badges>
-        </div>
-      </div>
-
-      <!-- count -->
-      <div *ngIf="!importTokenForm.controls.unmanaged.value"
-           class="form-group row">
-        <label class="cd-col-form-label"
-               for="count">
-          <span i18n>Count</span>
-          <cd-helper i18n>Only that number of daemons will be created.</cd-helper>
-        </label>
-        <div class="cd-col-form-input">
-          <input id="count"
-                 class="form-control"
-                 type="number"
-                 formControlName="count"
-                 min="1">
-          <span class="invalid-feedback"
-                *ngIf="importTokenForm.showError('count', frm, 'min')"
-                i18n>The value must be at least 1.</span>
-          <span class="invalid-feedback"
-                *ngIf="importTokenForm.showError('count', frm, 'pattern')"
-                i18n>The entered value needs to be a number.</span>
-        </div>
-      </div>
-
-      <!-- RGW -->
-      <ng-container *ngIf="!importTokenForm.controls.unmanaged.value">
-        <!-- rgw_frontend_port -->
+    <form
+      name="importTokenForm"
+      #frm="ngForm"
+      [formGroup]="importTokenForm"
+    >
+      <div class="modal-body">
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-3"
+        >
+          <ul>
+            <li>
+              This feature allows you to configure a connection between your primary and secondary
+              Ceph clusters for data replication. By importing a token, you establish a link between
+              the clusters, enabling data synchronization.
+            </li>
+            <li>
+              To obtain the token, generate it from your primary Ceph cluster. This token includes
+              encoded information about the primary cluster's endpoint, access key, and secret key.
+            </li>
+            <li>
+              The secondary zone represents the destination cluster where your data will be
+              replicated.
+            </li>
+          </ul>
+        </cd-alert-panel>
+        <legend i18n>Zone Details</legend>
         <div class="form-group row">
-          <label i18n
-                 class="cd-col-form-label"
-                 for="rgw_frontend_port">Port</label>
+          <label
+            class="cd-col-form-label required"
+            for="realmToken"
+            i18n
+            >Token
+          </label>
           <div class="cd-col-form-input">
-            <input id="rgw_frontend_port"
-                   class="form-control"
-                   type="number"
-                   formControlName="rgw_frontend_port"
-                   min="1"
-                   max="65535">
-            <span class="invalid-feedback"
-                  *ngIf="importTokenForm.showError('rgw_frontend_port', frm, 'pattern')"
-                  i18n>The entered value needs to be a number.</span>
-            <span class="invalid-feedback"
-                  *ngIf="importTokenForm.showError('rgw_frontend_port', frm, 'min')"
-                  i18n>The value must be at least 1.</span>
-            <span class="invalid-feedback"
-                  *ngIf="importTokenForm.showError('rgw_frontend_port', frm, 'max')"
-                  i18n>The value cannot exceed 65535.</span>
+            <input
+              id="realmToken"
+              name="realmToken"
+              class="form-control"
+              type="text"
+              formControlName="realmToken"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="importTokenForm.showError('realmToken', frm, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </div>
         </div>
-      </ng-container>
-    </div>
-    <div class="modal-footer">
-      <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                            [submitText]="actionLabels.IMPORT"
-                            [form]="importTokenForm"></cd-form-button-panel>
-    </div>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zoneName"
+            i18n
+            >Secondary Zone Name</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="Zone name..."
+              id="zoneName"
+              name="zoneName"
+              formControlName="zoneName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="importTokenForm.showError('zoneName', frm, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="importTokenForm.showError('zoneName', frm, 'uniqueName')"
+              i18n
+              >The chosen zone name is already in use.</span
+            >
+          </div>
+        </div>
+        <div class="form-group row">
+          <div class="cd-col-form-offset">
+            <div class="custom-control custom-checkbox">
+              <input
+                class="custom-control-input"
+                id="archive_zone"
+                type="checkbox"
+                formControlName="archive_zone"
+              />
+              <label
+                class="custom-control-label cds-ml-2"
+                for="archive_zone"
+                i18n
+                >Archive</label
+              >
+              <cd-helper i18n>
+                <span
+                  >Enable archival storage to keep all object versions and protect data from
+                  deletion or corruption.</span
+                >
+              </cd-helper>
+            </div>
+          </div>
+        </div>
+        <legend i18n>Service Details</legend>
+        <div class="form-group row">
+          <div class="cd-col-form-offset">
+            <div class="custom-control custom-checkbox">
+              <input
+                class="custom-control-input"
+                id="unmanaged"
+                type="checkbox"
+                formControlName="unmanaged"
+              />
+              <label
+                class="custom-control-label cds-ml-2"
+                for="unmanaged"
+                i18n
+                >Unmanaged</label
+              >
+              <cd-helper i18n
+                >If set to true, the orchestrator will not start nor stop any daemon associated with
+                this service. Placement and all other properties will be ignored.</cd-helper
+              >
+            </div>
+          </div>
+        </div>
+
+        <!-- Placement -->
+        <div
+          *ngIf="!importTokenForm.controls.unmanaged.value"
+          class="form-group row"
+        >
+          <label
+            class="cd-col-form-label"
+            for="placement"
+            i18n
+            >Placement</label
+          >
+          <div class="cd-col-form-input">
+            <select
+              id="placement"
+              class="form-select"
+              formControlName="placement"
+            >
+              <option
+                i18n
+                value="hosts"
+              >
+                Hosts
+              </option>
+              <option
+                i18n
+                value="label"
+              >
+                Label
+              </option>
+            </select>
+          </div>
+        </div>
+
+        <!-- Label -->
+        <div
+          *ngIf="
+            !importTokenForm.controls.unmanaged.value &&
+            importTokenForm.controls.placement.value === 'label'
+          "
+          class="form-group row"
+        >
+          <label
+            i18n
+            class="cd-col-form-label"
+            for="label"
+            >Label</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              id="label"
+              class="form-control"
+              type="text"
+              formControlName="label"
+              [ngbTypeahead]="searchLabels"
+              (focus)="labelFocus.next($any($event).target.value)"
+              (click)="labelClick.next($any($event).target.value)"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="importTokenForm.showError('label', frm, 'required')"
+              i18n
+              >This field is required.</span
+            >
+          </div>
+        </div>
+
+        <!-- Hosts -->
+        <div
+          *ngIf="
+            !importTokenForm.controls.unmanaged.value &&
+            importTokenForm.controls.placement.value === 'hosts'
+          "
+          class="form-group row"
+        >
+          <label
+            class="cd-col-form-label"
+            for="hosts"
+            i18n
+            >Hosts</label
+          >
+          <div class="cd-col-form-input">
+            <cd-select-badges
+              id="hosts"
+              [data]="importTokenForm.controls.hosts.value"
+              [options]="hosts.options"
+              [messages]="hosts.messages"
+            >
+            </cd-select-badges>
+          </div>
+        </div>
+
+        <!-- count -->
+        <div
+          *ngIf="!importTokenForm.controls.unmanaged.value"
+          class="form-group row"
+        >
+          <label
+            class="cd-col-form-label"
+            for="count"
+          >
+            <span i18n>Count</span>
+            <cd-helper i18n>Only that number of daemons will be created.</cd-helper>
+          </label>
+          <div class="cd-col-form-input">
+            <input
+              id="count"
+              class="form-control"
+              type="number"
+              formControlName="count"
+              min="1"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="importTokenForm.showError('count', frm, 'min')"
+              i18n
+              >The value must be at least 1.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="importTokenForm.showError('count', frm, 'pattern')"
+              i18n
+              >The entered value needs to be a number.</span
+            >
+          </div>
+        </div>
+
+        <!-- RGW -->
+        <ng-container *ngIf="!importTokenForm.controls.unmanaged.value">
+          <!-- rgw_frontend_port -->
+          <div class="form-group row">
+            <label
+              i18n
+              class="cd-col-form-label"
+              for="rgw_frontend_port"
+              >Port</label
+            >
+            <div class="cd-col-form-input">
+              <input
+                id="rgw_frontend_port"
+                class="form-control"
+                type="number"
+                formControlName="rgw_frontend_port"
+                min="1"
+                max="65535"
+              />
+              <span
+                class="invalid-feedback"
+                *ngIf="importTokenForm.showError('rgw_frontend_port', frm, 'pattern')"
+                i18n
+                >The entered value needs to be a number.</span
+              >
+              <span
+                class="invalid-feedback"
+                *ngIf="importTokenForm.showError('rgw_frontend_port', frm, 'min')"
+                i18n
+                >The value must be at least 1.</span
+              >
+              <span
+                class="invalid-feedback"
+                *ngIf="importTokenForm.showError('rgw_frontend_port', frm, 'max')"
+                i18n
+                >The value cannot exceed 65535.</span
+              >
+            </div>
+          </div>
+        </ng-container>
+      </div>
+      <div class="modal-footer">
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [submitText]="actionLabels.IMPORT"
+          [form]="importTokenForm"
+        ></cd-form-button-panel>
+      </div>
     </form>
   </ng-container>
 </cd-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-migrate/rgw-multisite-migrate.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-migrate/rgw-multisite-migrate.component.html
index aa3f59ae9d7..8e972ef83b0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-migrate/rgw-multisite-migrate.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-migrate/rgw-multisite-migrate.component.html
@@ -1,139 +1,212 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container i18n="form title"
-                class="modal-title">Migrate Single Site to Multi-site
+  <ng-container
+    i18n="form title"
+    class="modal-title"
+    >Migrate Single Site to Multi-site
     <cd-helper>
-      <span>Migrate from a single-site deployment with a default zonegroup and zone to a multi-site system</span>
+      <span
+        >Migrate from a single-site deployment with a default zonegroup and zone to a multi-site
+        system</span
+      >
     </cd-helper>
   </ng-container>
 
   <ng-container class="modal-content">
-    <form name="multisiteMigrateForm"
-          #formDir="ngForm"
-          [formGroup]="multisiteMigrateForm"
-          novalidate>
-    <div class="modal-body">
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="realmName"
-               i18n>Realm Name</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="Realm name..."
-                 id="realmName"
-                 name="realmName"
-                 formControlName="realmName">
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('realmName', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('realmName', formDir, 'uniqueName')"
-                i18n>The chosen realm name is already in use.</span>
+    <form
+      name="multisiteMigrateForm"
+      #formDir="ngForm"
+      [formGroup]="multisiteMigrateForm"
+      novalidate
+    >
+      <div class="modal-body">
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="realmName"
+            i18n
+            >Realm Name</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="Realm name..."
+              id="realmName"
+              name="realmName"
+              formControlName="realmName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('realmName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('realmName', formDir, 'uniqueName')"
+              i18n
+              >The chosen realm name is already in use.</span
+            >
+          </div>
+        </div>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zonegroupName"
+            i18n
+            >Rename default zonegroup</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="Zonegroup name..."
+              id="zonegroupName"
+              name="zonegroupName"
+              formControlName="zonegroupName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zonegroupName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zonegroupName', formDir, 'uniqueName')"
+              i18n
+              >The chosen zonegroup name is already in use.</span
+            >
+          </div>
+        </div>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zonegroup_endpoints"
+            i18n
+            >Zonegroup Endpoints
+          </label>
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="http://ceph-node-00.com:80"
+              id="zonegroup_endpoints"
+              name="zonegroup_endpoints"
+              formControlName="zonegroup_endpoints"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zonegroup_endpoints', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zonegroup_endpoints', formDir, 'invalidURL')"
+              i18n
+              >Please enter a valid URL.</span
+            >
+          </div>
+        </div>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zoneName"
+            i18n
+            >Rename default zone</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="Zone name..."
+              id="zoneName"
+              name="zoneName"
+              formControlName="zoneName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zoneName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zoneName', formDir, 'uniqueName')"
+              i18n
+              >The chosen zone name is already in use.</span
+            >
+          </div>
+        </div>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zone_endpoints"
+            i18n
+            >Zone Endpoints
+          </label>
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="http://ceph-node-00.com:80"
+              id="zone_endpoints"
+              name="zone_endpoints"
+              formControlName="zone_endpoints"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zone_endpoints', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('zone_endpoints', formDir, 'invalidURL')"
+              i18n
+              >Please enter a valid URL.</span
+            >
+          </div>
+        </div>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="username"
+            i18n
+            >Username</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="username"
+              id="username"
+              name="username"
+              formControlName="username"
+            />
+            <cd-help-text>
+              <span i18n
+                >Specify the username for the system user. This user will be created automatically
+                as part of the process.</span
+              >
+            </cd-help-text>
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteMigrateForm.showError('username', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+          </div>
         </div>
       </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zonegroupName"
-               i18n>Rename default zonegroup</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="Zonegroup name..."
-                 id="zonegroupName"
-                 name="zonegroupName"
-                 formControlName="zonegroupName">
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zonegroupName', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zonegroupName', formDir, 'uniqueName')"
-                i18n>The chosen zonegroup name is already in use.</span>
-        </div>
+      <div class="modal-footer">
+        <cd-form-button-panel
+          (submitActionEvent)="submit()"
+          [submitText]="actionLabels.MIGRATE + ' ' + 'to Multi-site'"
+          [form]="multisiteMigrateForm"
+        ></cd-form-button-panel>
       </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zonegroup_endpoints"
-               i18n>Zonegroup Endpoints
-        </label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="http://ceph-node-00.com:80"
-                 id="zonegroup_endpoints"
-                 name="zonegroup_endpoints"
-                 formControlName="zonegroup_endpoints">
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zonegroup_endpoints', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zonegroup_endpoints', formDir, 'invalidURL')"
-                i18n>Please enter a valid URL.</span>
-        </div>
-      </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zoneName"
-               i18n>Rename default zone</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="Zone name..."
-                 id="zoneName"
-                 name="zoneName"
-                 formControlName="zoneName">
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zoneName', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zoneName', formDir, 'uniqueName')"
-                i18n>The chosen zone name is already in use.</span>
-        </div>
-      </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zone_endpoints"
-               i18n>Zone Endpoints
-        </label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="http://ceph-node-00.com:80"
-                 id="zone_endpoints"
-                 name="zone_endpoints"
-                 formControlName="zone_endpoints">
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zone_endpoints', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('zone_endpoints', formDir, 'invalidURL')"
-                i18n>Please enter a valid URL.</span>
-        </div>
-      </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="username"
-               i18n>Username</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="username"
-                 id="username"
-                 name="username"
-                 formControlName="username">
-          <cd-help-text>
-            <span i18n>Specify the username for the system user. This user will be created automatically as part of the process.</span>
-          </cd-help-text>
-          <span class="invalid-feedback"
-                *ngIf="multisiteMigrateForm.showError('username', formDir, 'required')"
-                i18n>This field is required.</span>
-        </div>
-      </div>
-    </div>
-    <div class="modal-footer">
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [submitText]="actionLabels.MIGRATE + ' ' + 'to Multi-site'"
-                            [form]="multisiteMigrateForm"></cd-form-button-panel>
-    </div>
     </form>
   </ng-container>
 </cd-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-realm-form/rgw-multisite-realm-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-realm-form/rgw-multisite-realm-form.component.html
index c2c775d1282..a1ad11b6cb2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-realm-form/rgw-multisite-realm-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-realm-form/rgw-multisite-realm-form.component.html
@@ -1,17 +1,25 @@
-<cds-modal size="sm"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
 
   <div cdsModalContent>
-    <form name="multisiteRealmForm"
-          #formDir="ngForm"
-          [formGroup]="multisiteRealmForm"
-          novalidate>
+    <form
+      name="multisiteRealmForm"
+      #formDir="ngForm"
+      [formGroup]="multisiteRealmForm"
+      novalidate
+    >
       <div class="form-item">
         <cds-text-label
           labelInputID="realmName"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.html
index 4a18e14b5f8..e06aa4f1e8f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.html
@@ -1,113 +1,162 @@
-<cds-modal size="sm"
-           [open]="open">
+<cds-modal
+  size="sm"
+  [open]="open"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ groupType }} flow</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ groupType }} flow
+    </h3>
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
-  <form name="flowForm"
-        #frm="ngForm"
-        [formGroup]="currentFormGroupContext"
-        novalidate>
+  <form
+    name="flowForm"
+    #frm="ngForm"
+    [formGroup]="currentFormGroupContext"
+    novalidate
+  >
     <div cdsModalContent>
       <!-- Flow Name-->
       <div class="form-item">
-        <cds-text-label for="flow_id"
-                        [invalid]="!currentFormGroupContext.controls.flow_id.valid && currentFormGroupContext.controls.flow_id.dirty"
-                        [invalidText]="flowIdError">
+        <cds-text-label
+          for="flow_id"
+          [invalid]="
+            !currentFormGroupContext.controls.flow_id.valid &&
+            currentFormGroupContext.controls.flow_id.dirty
+          "
+          [invalidText]="flowIdError"
+        >
           <ng-container i18n>Name</ng-container>
-          <input cdsText
-                 type="text"
-                 id="flow_id"
-                 formControlName="flow_id"
-                 autofocus
-                 [invalid]="!currentFormGroupContext.controls.flow_id.valid && currentFormGroupContext.controls.flow_id.dirty">
+          <input
+            cdsText
+            type="text"
+            id="flow_id"
+            formControlName="flow_id"
+            autofocus
+            [invalid]="
+              !currentFormGroupContext.controls.flow_id.valid &&
+              currentFormGroupContext.controls.flow_id.dirty
+            "
+          />
         </cds-text-label>
         <ng-template #flowIdError>
-        @if (currentFormGroupContext.showError('flow_id', formDir, 'required')) {
-          <span class="invalid-feedback">
-            <ng-container i18n> This field is required. </ng-container>
-          </span>
-        }
+          @if (currentFormGroupContext.showError('flow_id', formDir, 'required')) {
+            <span class="invalid-feedback">
+              <ng-container i18n> This field is required. </ng-container>
+            </span>
+          }
         </ng-template>
       </div>
       <!-- Bucket Name-->
       @if (currentFormGroupContext.controls.bucket_name.value) {
-      <div class="form-item">
-        <cds-text-label for="bucket_name"
-                        cdOptionalField="Bucket name">
-          <ng-container i18n>Bucket name</ng-container>
-          <input cdsText
-                 type="text"
-                 id="bucket_name"
-                 formControlName="bucket_name"
-                 [readOnly]="true">
-        </cds-text-label>
-      </div>
+        <div class="form-item">
+          <cds-text-label
+            for="bucket_name"
+            cdOptionalField="Bucket name"
+          >
+            <ng-container i18n>Bucket name</ng-container>
+            <input
+              cdsText
+              type="text"
+              id="bucket_name"
+              formControlName="bucket_name"
+              [readOnly]="true"
+            />
+          </cds-text-label>
+        </div>
       }
       <!-- Symmetrical flow zones -->
       @if (groupType == flowType.symmetrical) {
         <div class="form-item">
-          <cds-combo-box label="Zones"
-                         type="multi"
-                         selectionFeedback="top-after-reopen"
-                         for="zones"
-                         formControlName="zones"
-                         [helperText]="'Flow need to be associated with atleast one zone'"
-                         i18n-helperText
-                         [appendInline]="true"
-                         [items]="zones"
-                         itemValueKey="content"
-                         id="zones"
-                         cdDynamicInputCombobox
-                         [invalid]="currentFormGroupContext.controls?.zones?.invalid && currentFormGroupContext.controls?.zones?.dirty"
-                         [invalidText]="'Zone selection is required!'"
-                         i18n>
+          <cds-combo-box
+            label="Zones"
+            type="multi"
+            selectionFeedback="top-after-reopen"
+            for="zones"
+            formControlName="zones"
+            [helperText]="'Flow need to be associated with atleast one zone'"
+            i18n-helperText
+            [appendInline]="true"
+            [items]="zones"
+            itemValueKey="content"
+            id="zones"
+            cdDynamicInputCombobox
+            [invalid]="
+              currentFormGroupContext.controls?.zones?.invalid &&
+              currentFormGroupContext.controls?.zones?.dirty
+            "
+            [invalidText]="'Zone selection is required!'"
+            i18n
+          >
             <cds-dropdown-list></cds-dropdown-list>
           </cds-combo-box>
         </div>
       } @else {
         <div class="form-item">
-          <ng-container *ngTemplateOutlet="sourceAndDestZone;context: { formControl: 'source_zone', zones: zones, name: 'Source zone' }"></ng-container>
+          <ng-container
+            *ngTemplateOutlet="
+              sourceAndDestZone;
+              context: { formControl: 'source_zone', zones: zones, name: 'Source zone' }
+            "
+          ></ng-container>
         </div>
         <div class="form-item">
-          <ng-container *ngTemplateOutlet="sourceAndDestZone;context: { formControl: 'destination_zone', zones: zones, name: 'Destination zone' }"></ng-container>
+          <ng-container
+            *ngTemplateOutlet="
+              sourceAndDestZone;
+              context: { formControl: 'destination_zone', zones: zones, name: 'Destination zone' }
+            "
+          ></ng-container>
         </div>
       }
       <!-- Directional flow zones -->
     </div>
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="currentFormGroupContext"
-                          [modalForm]="true"
-                          [submitText]="(action | titlecase)"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="submit()"
+      [form]="currentFormGroupContext"
+      [modalForm]="true"
+      [submitText]="action | titlecase"
+    ></cd-form-button-panel>
   </form>
 </cds-modal>
 
-<ng-template #sourceAndDestZone
-             let-name="name"
-             let-zones="zones"
-             let-formControl="formControl"
-             [formGroup]="currentFormGroupContext">
-  <cds-select [label]="name"
-              [formControlName]="formControl"
-              [id]="formControl"
-              [invalid]="currentFormGroupContext.controls[formControl].invalid && (currentFormGroupContext.controls[formControl].dirty)"
-              [invalidText]="zoneError"
-              i18n>
+<ng-template
+  #sourceAndDestZone
+  let-name="name"
+  let-zones="zones"
+  let-formControl="formControl"
+  [formGroup]="currentFormGroupContext"
+>
+  <cds-select
+    [label]="name"
+    [formControlName]="formControl"
+    [id]="formControl"
+    [invalid]="
+      currentFormGroupContext.controls[formControl].invalid &&
+      currentFormGroupContext.controls[formControl].dirty
+    "
+    [invalidText]="zoneError"
+    i18n
+  >
     @if (zones.length == 0) {
-    <option [ngValue]="null">Loading...</option>
+      <option [ngValue]="null">Loading...</option>
     }
     @if (zones.length > 0) {
-    <option [ngValue]="null">-- Select {{name}} --</option>
+      <option [ngValue]="null">-- Select {{ name }} --</option>
     }
     @for (zone of zones; track zone) {
-    <option [value]="zone.name">{{ zone.name }}</option>
+      <option [value]="zone.name">{{ zone.name }}</option>
     }
   </cds-select>
   <ng-template #zoneError>
-  @if (currentFormGroupContext.showError(formControl, frm, 'required')) {
-    <span class="invalid-feedback"
-          i18n>This field is required.</span>
-  }
+    @if (currentFormGroupContext.showError(formControl, frm, 'required')) {
+      <span
+        class="invalid-feedback"
+        i18n
+        >This field is required.</span
+      >
+    }
   </ng-template>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.html
index 95640b60ea3..b505d312810 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.html
@@ -1,112 +1,152 @@
-<cds-modal [open]="open"
-           size="md">
+<cds-modal
+  [open]="open"
+  size="md"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} pipe</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} pipe
+    </h3>
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
-  <form name="pipeForm"
-        #frm="ngForm"
-        [formGroup]="pipeForm"
-        novalidate>
+  <form
+    name="pipeForm"
+    #frm="ngForm"
+    [formGroup]="pipeForm"
+    novalidate
+  >
     <div cdsModalContent>
       <!-- Pipe Name -->
       <div class="form-item">
-        <cds-text-label for="pipe_id"
-                        [invalid]="!pipeForm.controls.pipe_id.valid && pipeForm.controls.pipe_id.dirty"
-                        [invalidText]="pipeIdError">
+        <cds-text-label
+          for="pipe_id"
+          [invalid]="!pipeForm.controls.pipe_id.valid && pipeForm.controls.pipe_id.dirty"
+          [invalidText]="pipeIdError"
+        >
           <ng-container i18n>Name</ng-container>
-          <input cdsText
-                 type="text"
-                 id="pipe_id"
-                 formControlName="pipe_id"
-                 autofocus
-                 [invalid]="!pipeForm.controls.pipe_id.valid && pipeForm.controls.pipe_id.dirty"
-                 [readonly]="editing">
+          <input
+            cdsText
+            type="text"
+            id="pipe_id"
+            formControlName="pipe_id"
+            autofocus
+            [invalid]="!pipeForm.controls.pipe_id.valid && pipeForm.controls.pipe_id.dirty"
+            [readonly]="editing"
+          />
         </cds-text-label>
         <ng-template #pipeIdError>
           @if (pipeForm.showError('pipe_id', formDir, 'required')) {
-          <span class="invalid-feedback">
-            <ng-container i18n> This field is required. </ng-container>
-          </span>
+            <span class="invalid-feedback">
+              <ng-container i18n> This field is required. </ng-container>
+            </span>
           }
         </ng-template>
       </div>
       <!-- Source and Destination Zones -->
       <div class="form-item">
-        <ng-container *ngTemplateOutlet="zoneMultiSelect;context: { formControl: 'source_zones', zone: sourceZones, name: 'Source zone' }"></ng-container>
+        <ng-container
+          *ngTemplateOutlet="
+            zoneMultiSelect;
+            context: { formControl: 'source_zones', zone: sourceZones, name: 'Source zone' }
+          "
+        ></ng-container>
       </div>
       <div class="form-item">
-        <ng-container *ngTemplateOutlet="zoneMultiSelect;context: { formControl: 'destination_zones', zone: destZones, name: 'Destination zone' }"></ng-container>
+        <ng-container
+          *ngTemplateOutlet="
+            zoneMultiSelect;
+            context: { formControl: 'destination_zones', zone: destZones, name: 'Destination zone' }
+          "
+        ></ng-container>
       </div>
       <!-- Bucket Name -->
       @if (pipeForm.controls.bucket_name.value) {
-      <div class="form-item">
-        <cds-text-label for="bucket_name"
-                        cdOptionalField="Bucket name">
-          <ng-container i18n>Bucket name</ng-container>
-          <input cdsText
-                 type="text"
-                 id="bucket_name"
-                 formControlName="bucket_name"
-                 autofocus
-                 [readonly]="true">
-        </cds-text-label>
-      </div>
+        <div class="form-item">
+          <cds-text-label
+            for="bucket_name"
+            cdOptionalField="Bucket name"
+          >
+            <ng-container i18n>Bucket name</ng-container>
+            <input
+              cdsText
+              type="text"
+              id="bucket_name"
+              formControlName="bucket_name"
+              autofocus
+              [readonly]="true"
+            />
+          </cds-text-label>
+        </div>
       }
       <!-- Source Bucket -->
       <div class="form-item">
-        <cds-text-label for="source_bucket"
-                        [helperText]="allBucketSelectedHelpText"
-                        i18n-helperText
-                        cdOptionalField="Source bucket">
+        <cds-text-label
+          for="source_bucket"
+          [helperText]="allBucketSelectedHelpText"
+          i18n-helperText
+          cdOptionalField="Source bucket"
+        >
           <ng-container i18n>Source bucket</ng-container>
-          <input cdsText
-                 type="text"
-                 id="source_bucket"
-                 formControlName="source_bucket">
+          <input
+            cdsText
+            type="text"
+            id="source_bucket"
+            formControlName="source_bucket"
+          />
         </cds-text-label>
       </div>
       <!-- Destination Bucket -->
       <div class="form-item">
-        <cds-text-label for="destination_bucket"
-                        [helperText]="allBucketSelectedHelpText"
-                        i18n-helperText
-                        cdOptionalField="Destination bucket">
+        <cds-text-label
+          for="destination_bucket"
+          [helperText]="allBucketSelectedHelpText"
+          i18n-helperText
+          cdOptionalField="Destination bucket"
+        >
           <ng-container i18n>Destination bucket</ng-container>
-          <input cdsText
-                 type="text"
-                 id="destination_bucket"
-                 formControlName="destination_bucket">
+          <input
+            cdsText
+            type="text"
+            id="destination_bucket"
+            formControlName="destination_bucket"
+          />
         </cds-text-label>
       </div>
     </div>
-    <cd-form-button-panel (submitActionEvent)="submit()"
-                          [form]="pipeForm"
-                          [modalForm]="true"
-                          [submitText]="(action | titlecase) + ' ' + 'Pipe'">
+    <cd-form-button-panel
+      (submitActionEvent)="submit()"
+      [form]="pipeForm"
+      [modalForm]="true"
+      [submitText]="(action | titlecase) + ' ' + 'Pipe'"
+    >
     </cd-form-button-panel>
   </form>
 </cds-modal>
 
-<ng-template #zoneMultiSelect
-             let-name="name"
-             let-zone="zone"
-             let-formControl="formControl"
-             [formGroup]="pipeForm">
-  <cds-combo-box [label]="name"
-                 type="multi"
-                 selectionFeedback="top-after-reopen"
-                 [for]="formControl"
-                 [formControlName]="formControl"
-                 [helperText]="'Pipe need to be associated with atleast one zone'"
-                 i18n-helperText
-                 [items]="zone"
-                 itemValueKey="content"
-                 [id]="formControl"
-                 [invalid]="pipeForm.controls[formControl].invalid && pipeForm.controls[formControl].dirty"
-                 [invalidText]="'Zone selection is required!'"
-                 i18n>
+<ng-template
+  #zoneMultiSelect
+  let-name="name"
+  let-zone="zone"
+  let-formControl="formControl"
+  [formGroup]="pipeForm"
+>
+  <cds-combo-box
+    [label]="name"
+    type="multi"
+    selectionFeedback="top-after-reopen"
+    [for]="formControl"
+    [formControlName]="formControl"
+    [helperText]="'Pipe need to be associated with atleast one zone'"
+    i18n-helperText
+    [items]="zone"
+    itemValueKey="content"
+    [id]="formControl"
+    [invalid]="pipeForm.controls[formControl].invalid && pipeForm.controls[formControl].dirty"
+    [invalidText]="'Zone selection is required!'"
+    i18n
+  >
     <cds-dropdown-list></cds-dropdown-list>
   </cds-combo-box>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-details/rgw-multisite-sync-policy-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-details/rgw-multisite-sync-policy-details.component.html
index e7cd302431b..1f0f5966f85 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-details/rgw-multisite-sync-policy-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-details/rgw-multisite-sync-policy-details.component.html
@@ -3,11 +3,14 @@
     ngbNav
     #nav="ngbNav"
     class="nav-tabs"
-    cdStatefulTab="sync-policy-details">
+    cdStatefulTab="sync-policy-details"
+  >
     <ng-container ngbNavItem="flow">
       <a
         ngbNavLink
-      i18n>Flow</a>
+        i18n
+        >Flow</a
+      >
       <ng-template ngbNavContent>
         <legend>
           Symmetrical
@@ -29,20 +32,23 @@
           [maxLimit]="25"
           [toolHeader]="true"
           (updateSelection)="updateSelection($event, flowType.symmetrical)"
-          (fetchData)="loadData($event)">
+          (fetchData)="loadData($event)"
+        >
           <div class="table-actions">
             <cd-table-actions
               [permission]="permission"
               [selection]="symFlowSelection"
               class="btn-group"
-              [tableActions]="symFlowTableActions" >
+              [tableActions]="symFlowTableActions"
+            >
             </cd-table-actions>
           </div>
         </cd-table>
         <legend>
           Directional
           <cd-help-text>
-            It can define directional data flow, in which the data moves in one way, from one zone to another.
+            It can define directional data flow, in which the data moves in one way, from one zone
+            to another.
           </cd-help-text>
         </legend>
         <cd-table
@@ -59,26 +65,32 @@
           [maxLimit]="25"
           [toolHeader]="true"
           (updateSelection)="updateSelection($event, flowType.directional)"
-          (fetchData)="loadData($event)">
+          (fetchData)="loadData($event)"
+        >
           <div class="table-actions">
             <cd-table-actions
               [permission]="permission"
               [selection]="dirFlowSelection"
               class="btn-group"
-              [tableActions]="dirFlowTableActions">
+              [tableActions]="dirFlowTableActions"
+            >
             </cd-table-actions>
           </div>
         </cd-table>
       </ng-template>
     </ng-container>
     <ng-container ngbNavItem="pipe">
-      <a ngbNavLink
-         i18n>Pipe</a>
+      <a
+        ngbNavLink
+        i18n
+        >Pipe</a
+      >
       <ng-template ngbNavContent>
         <legend i18n>
           Pipe
           <cd-help-text>
-            A pipe defines the actual buckets that can use these data flows, and the properties that are associated with it.
+            A pipe defines the actual buckets that can use these data flows, and the properties that
+            are associated with it.
           </cd-help-text>
         </legend>
         <cd-table
@@ -91,13 +103,15 @@
           [serverSide]="false"
           [toolHeader]="true"
           (updateSelection)="pipeSelection = $event"
-          (fetchData)="loadData($event)">
+          (fetchData)="loadData($event)"
+        >
           <div class="table-actions">
             <cd-table-actions
               [permission]="permission"
               [selection]="pipeSelection"
               class="btn-group"
-              [tableActions]="pipeTableActions">
+              [tableActions]="pipeTableActions"
+            >
             </cd-table-actions>
           </div>
         </cd-table>
@@ -108,8 +122,10 @@
 }
 
 <ng-template #deleteTpl>
-  <cd-alert-panel type="danger"
-                  i18n>
+  <cd-alert-panel
+    type="danger"
+    i18n
+  >
     Deleting {{ resourceType | upperFirst }} may disrupt data synchronization
   </cd-alert-panel>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-form/rgw-multisite-sync-policy-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-form/rgw-multisite-sync-policy-form.component.html
index 106715a4b08..6ad6d51a260 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-form/rgw-multisite-sync-policy-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy-form/rgw-multisite-sync-policy-form.component.html
@@ -1,85 +1,129 @@
-<cds-modal size="sm"
-           [open]="open">
+<cds-modal
+  size="sm"
+  [open]="open"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource }}
+    </h3>
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
   <ng-container *cdFormLoading="loading">
-    <form #frm="ngForm"
-          [formGroup]="syncPolicyForm"
-          *cdFormLoading="loading"
-          novalidate>
+    <form
+      #frm="ngForm"
+      [formGroup]="syncPolicyForm"
+      *cdFormLoading="loading"
+      novalidate
+    >
       <div cdsModalContent>
         <!-- Group Id -->
         <div class="form-item">
-          <cds-text-label for="group_id"
-                          [invalid]="!syncPolicyForm.controls.group_id.valid && syncPolicyForm.controls.group_id.dirty"
-                          [invalidText]="groupIdError">
+          <cds-text-label
+            for="group_id"
+            [invalid]="
+              !syncPolicyForm.controls.group_id.valid && syncPolicyForm.controls.group_id.dirty
+            "
+            [invalidText]="groupIdError"
+          >
             <ng-container i18n>Group name</ng-container>
-            <input cdsText
-                   type="text"
-                   id="group_id"
-                   formControlName="group_id"
-                   autofocus
-                   [invalid]="!syncPolicyForm.controls.group_id.valid && syncPolicyForm.controls.group_id.dirty"
-                   [readonly]="editing"/>
+            <input
+              cdsText
+              type="text"
+              id="group_id"
+              formControlName="group_id"
+              autofocus
+              [invalid]="
+                !syncPolicyForm.controls.group_id.valid && syncPolicyForm.controls.group_id.dirty
+              "
+              [readonly]="editing"
+            />
           </cds-text-label>
           <ng-template #groupIdError>
             @if (syncPolicyForm.showError('group_id', frm, 'required')) {
-            <span class="invalid-feedback">
-              <ng-container i18n> This field is required. </ng-container>
-            </span>
+              <span class="invalid-feedback">
+                <ng-container i18n> This field is required. </ng-container>
+              </span>
             }
           </ng-template>
         </div>
         <!-- Status -->
         <div class="form-item">
-          <cds-select label="Status"
-                      for="status"
-                      formControlName="status"
-                      id="status"
-                      [invalid]="syncPolicyForm.controls['status'].invalid && (syncPolicyForm.controls['status'].dirty)"
-                      [invalidText]="statusError"
-                      i18n>
+          <cds-select
+            label="Status"
+            for="status"
+            formControlName="status"
+            id="status"
+            [invalid]="
+              syncPolicyForm.controls['status'].invalid && syncPolicyForm.controls['status'].dirty
+            "
+            [invalidText]="statusError"
+            i18n
+          >
             <ng-container>Status</ng-container>
-            <option value="{{syncPolicyStatus.ENABLED}}">{{syncPolicyStatus.ENABLED | upperFirst }}</option>
-            <option value="{{syncPolicyStatus.ALLOWED}}">{{syncPolicyStatus.ALLOWED | upperFirst }}</option>
-            <option value="{{syncPolicyStatus.FORBIDDEN}}">{{syncPolicyStatus.FORBIDDEN | upperFirst }}</option>
+            <option value="{{ syncPolicyStatus.ENABLED }}">
+              {{ syncPolicyStatus.ENABLED | upperFirst }}
+            </option>
+            <option value="{{ syncPolicyStatus.ALLOWED }}">
+              {{ syncPolicyStatus.ALLOWED | upperFirst }}
+            </option>
+            <option value="{{ syncPolicyStatus.FORBIDDEN }}">
+              {{ syncPolicyStatus.FORBIDDEN | upperFirst }}
+            </option>
           </cds-select>
           <ng-template #statusError>
             @if (syncPolicyForm.showError('status', frm, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
             }
           </ng-template>
         </div>
         <!-- Bucket Name -->
         <div class="form-item">
-          <cds-text-label for="bucket_name"
-                          [invalid]="!syncPolicyForm.controls.bucket_name.valid && syncPolicyForm.controls.bucket_name.dirty"
-                          [invalidText]="bucketNameError"
-                          cdOptionalField="Bucket name">
+          <cds-text-label
+            for="bucket_name"
+            [invalid]="
+              !syncPolicyForm.controls.bucket_name.valid &&
+              syncPolicyForm.controls.bucket_name.dirty
+            "
+            [invalidText]="bucketNameError"
+            cdOptionalField="Bucket name"
+          >
             <ng-container i18n>Bucket name</ng-container>
-            <input cdsText
-                   type="text"
-                   id="bucket_name"
-                   formControlName="bucket_name"
-                   [invalid]="!syncPolicyForm.controls.bucket_name.valid && syncPolicyForm.controls.bucket_name.dirty"
-                   [readonly]="editing"/>
+            <input
+              cdsText
+              type="text"
+              id="bucket_name"
+              formControlName="bucket_name"
+              [invalid]="
+                !syncPolicyForm.controls.bucket_name.valid &&
+                syncPolicyForm.controls.bucket_name.dirty
+              "
+              [readonly]="editing"
+            />
           </cds-text-label>
           <ng-template #bucketNameError>
             @if (syncPolicyForm.showError('bucket_name', frm, 'bucketNameNotAllowed')) {
-            <span class="invalid-feedback"
-                  i18n>The bucket with chosen name does not exist.</span>
+              <span
+                class="invalid-feedback"
+                i18n
+                >The bucket with chosen name does not exist.</span
+              >
             }
           </ng-template>
         </div>
       </div>
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="syncPolicyForm"
-                            [modalForm]="true"
-                            [submitText]="(action | titlecase)"></cd-form-button-panel>
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="syncPolicyForm"
+        [modalForm]="true"
+        [submitText]="action | titlecase"
+      ></cd-form-button-panel>
     </form>
   </ng-container>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy/rgw-multisite-sync-policy.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy/rgw-multisite-sync-policy.component.html
index fe82858253a..1c86f2bc168 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy/rgw-multisite-sync-policy.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-policy/rgw-multisite-sync-policy.component.html
@@ -4,8 +4,9 @@
   Multisite Sync Policy
   <cd-help-text>
     Multisite bucket-granularity sync policy provides fine grained control of data movement between
-    buckets in different zones. Leveraging the bucket-granularity sync policy is possible for buckets to diverge,
-     and a bucket can pull data from other buckets (ones that don’t share its name or its ID) in different zone.
+    buckets in different zones. Leveraging the bucket-granularity sync policy is possible for
+    buckets to diverge, and a bucket can pull data from other buckets (ones that don’t share its
+    name or its ID) in different zone.
   </cd-help-text>
 </legend>
 <cd-table
@@ -21,27 +22,34 @@
   [toolHeader]="true"
   (setExpandedRow)="setExpandedRow($event)"
   (fetchData)="getPolicyList($event)"
-  (updateSelection)="updateSelection($event)">
+  (updateSelection)="updateSelection($event)"
+>
   <div class="table-actions">
     <cd-table-actions
       [permission]="permission"
       [selection]="selection"
       class="btn-group"
-      [tableActions]="tableActions">
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
   <cd-rgw-multisite-sync-policy-details
     *cdTableDetail
     [expandedRow]="expandedRow"
-    [permission]="permission">
+    [permission]="permission"
+  >
   </cd-rgw-multisite-sync-policy-details>
 </cd-table>
 
 <ng-template #deleteTpl>
-  <cd-alert-panel type="danger"
-                  i18n>
+  <cd-alert-panel
+    type="danger"
+    i18n
+  >
     Are you sure you want to delete these policy groups?
   </cd-alert-panel>
 </ng-template>
-<router-outlet name="modal"
-               (deactivate)="getPolicyList()"></router-outlet>
+<router-outlet
+  name="modal"
+  (deactivate)="getPolicyList()"
+></router-outlet>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-tabs/rgw-multisite-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-tabs/rgw-multisite-tabs.component.html
index 8cc420b39b3..cfa52fd483d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-tabs/rgw-multisite-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-tabs/rgw-multisite-tabs.component.html
@@ -1,16 +1,22 @@
 <ul class="nav nav-tabs">
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/rgw/multisite/configuration"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       i18n>Configuration</a>
+    <a
+      class="nav-link"
+      routerLink="/rgw/multisite/configuration"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      i18n
+      >Configuration</a
+    >
   </li>
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="//rgw/multisite/sync-policy"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       i18n>Sync Policy</a>
+    <a
+      class="nav-link"
+      routerLink="//rgw/multisite/sync-policy"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      i18n
+      >Sync Policy</a
+    >
   </li>
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html
index 94328d0bded..9443b1eca33 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.html
@@ -1,216 +1,350 @@
-
-<cds-modal size="lg"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        data-testid="rgw-multisite-wizard-header"
-        i18n>Set up Multi-site Replication</h3>
+    <h3
+      cdsModalHeaderHeading
+      data-testid="rgw-multisite-wizard-header"
+      i18n
+    >
+      Set up Multi-site Replication
+    </h3>
   </cds-modal-header>
 
   <div cdsModalContent>
     <div cdsRow>
-      <div cdsCol
-           [columnNumbers]="{'lg': 2, 'md': 2, 'sm': 2}"
-           class="indicator-wrapper">
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 2, md: 2, sm: 2 }"
+        class="indicator-wrapper"
+      >
         <cd-wizard [stepsTitle]="stepTitles"></cd-wizard>
       </div>
 
-      <div cdsCol
-           [columnNumbers]="{'lg': 14, 'md': 14, 'sm': 14}">
-        <form [formGroup]="multisiteSetupForm"
-              #formDir="ngForm"
-              novalidate>
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 14, md: 14, sm: 14 }"
+      >
+        <form
+          [formGroup]="multisiteSetupForm"
+          #formDir="ngForm"
+          novalidate
+        >
           <ng-container [ngSwitch]="currentStep?.stepIndex">
-            <div *ngSwitchCase="0"
-                 class="ms-5">
-              <cd-alert-panel type="info"
-                              spacingClass="mb-3">
-                  This wizard enables you to set up multi-site replication within your
-                  Ceph environment.If you have already added another cluster to your
-                  multi-cluster setup, you can select that cluster in the wizard to
-                  automate the replication process.If no additional cluster is currently
-                  added, the wizard will guide you through creating the necessary realm,
-                  zonegroup, and zone, and provide a realm token.This token can be used
-                  later to manually import into a desired cluster to establish replication
-                  between the clusters.
+            <div
+              *ngSwitchCase="0"
+              class="ms-5"
+            >
+              <cd-alert-panel
+                type="info"
+                spacingClass="mb-3"
+              >
+                This wizard enables you to set up multi-site replication within your Ceph
+                environment.If you have already added another cluster to your multi-cluster setup,
+                you can select that cluster in the wizard to automate the replication process.If no
+                additional cluster is currently added, the wizard will guide you through creating
+                the necessary realm, zonegroup, and zone, and provide a realm token.This token can
+                be used later to manually import into a desired cluster to establish replication
+                between the clusters.
               </cd-alert-panel>
-              <div class="form-group row"
-                   *ngIf="showConfigType && isMultiClusterConfigured">
-                <label class="cd-col-form-label required"
-                       for="configType"
-                       i18n>Realm configuration mode</label>
-                <div class="col-md-auto custom-checkbox form-check-inline  ms-3">
-                  <input class="form-check-input"
-                         formControlName="configType"
-                         id="newRealm"
-                         value="newRealm"
-                         (change)="onConfigTypeChange()"
-                         type="radio">
-                  <label class="custom-check-label"
-                         for="newRealm"
-                         i18n>Create new realm/zonegroup/zone</label>
+              <div
+                class="form-group row"
+                *ngIf="showConfigType && isMultiClusterConfigured"
+              >
+                <label
+                  class="cd-col-form-label required"
+                  for="configType"
+                  i18n
+                  >Realm configuration mode</label
+                >
+                <div class="col-md-auto custom-checkbox form-check-inline ms-3">
+                  <input
+                    class="form-check-input"
+                    formControlName="configType"
+                    id="newRealm"
+                    value="newRealm"
+                    (change)="onConfigTypeChange()"
+                    type="radio"
+                  />
+                  <label
+                    class="custom-check-label"
+                    for="newRealm"
+                    i18n
+                    >Create new realm/zonegroup/zone</label
+                  >
                 </div>
                 <div class="col-md-auto custom-checkbox form-check-inline">
-                  <input class="form-check-input"
-                         formControlName="configType"
-                         id="existingRealm"
-                         type="radio"
-                         (change)="onConfigTypeChange()"
-                         value="existingRealm">
-                  <label class="custom-check-label"
-                         for="existingRealm"
-                         i18n>Select existing realm</label>
+                  <input
+                    class="form-check-input"
+                    formControlName="configType"
+                    id="existingRealm"
+                    type="radio"
+                    (change)="onConfigTypeChange()"
+                    value="existingRealm"
+                  />
+                  <label
+                    class="custom-check-label"
+                    for="existingRealm"
+                    i18n
+                    >Select existing realm</label
+                  >
                 </div>
               </div>
-              <div class="form-group row"
-                   *ngIf="multisiteSetupForm.get('configType').value === 'existingRealm' && showConfigType && isMultiClusterConfigured">
-                <label class="cd-col-form-label"
-                       for="selectedRealm"
-                       i18n>Select Realm</label>
+              <div
+                class="form-group row"
+                *ngIf="
+                  multisiteSetupForm.get('configType').value === 'existingRealm' &&
+                  showConfigType &&
+                  isMultiClusterConfigured
+                "
+              >
+                <label
+                  class="cd-col-form-label"
+                  for="selectedRealm"
+                  i18n
+                  >Select Realm</label
+                >
                 <div class="cd-col-form-input">
-                  <select class="form-select"
-                          id="selectedRealm"
-                          formControlName="selectedRealm">
-                    <option *ngFor="let realm of realmList"
-                            [value]="realm">
-                        {{ realm }}
+                  <select
+                    class="form-select"
+                    id="selectedRealm"
+                    formControlName="selectedRealm"
+                  >
+                    <option
+                      *ngFor="let realm of realmList"
+                      [value]="realm"
+                    >
+                      {{ realm }}
                     </option>
                   </select>
                 </div>
               </div>
-              <div *ngIf="multisiteSetupForm.get('configType').value === 'newRealm' || !showConfigType">
+              <div
+                *ngIf="multisiteSetupForm.get('configType').value === 'newRealm' || !showConfigType"
+              >
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="realmName"
-                         i18n>Realm Name</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="realmName"
+                    i18n
+                    >Realm Name</label
+                  >
                   <div class="cd-col-form-input">
-                    <input class="form-control"
-                           type="text"
-                           id="realmName"
-                           formControlName="realmName">
+                    <input
+                      class="form-control"
+                      type="text"
+                      id="realmName"
+                      formControlName="realmName"
+                    />
                     <cd-help-text>
-                      <span i18n>Enter a unique name for the Realm. The Realm is a logical grouping of all your Zonegroups.</span>
+                      <span i18n
+                        >Enter a unique name for the Realm. The Realm is a logical grouping of all
+                        your Zonegroups.</span
+                      >
                     </cd-help-text>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('realmName', formDir, 'required')"
-                          i18n>This field is required.</span>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('realmName', formDir, 'uniqueName')"
-                          i18n>This realm name is already in use. Choose a unique name.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('realmName', formDir, 'required')"
+                      i18n
+                      >This field is required.</span
+                    >
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('realmName', formDir, 'uniqueName')"
+                      i18n
+                      >This realm name is already in use. Choose a unique name.</span
+                    >
                   </div>
                 </div>
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="zonegroupName"
-                         i18n>Zonegroup Name</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="zonegroupName"
+                    i18n
+                    >Zonegroup Name</label
+                  >
                   <div class="cd-col-form-input">
-                    <input class="form-control"
-                           type="text"
-                           id="zonegroupName"
-                           formControlName="zonegroupName">
+                    <input
+                      class="form-control"
+                      type="text"
+                      id="zonegroupName"
+                      formControlName="zonegroupName"
+                    />
                     <cd-help-text>
-                      <span i18n>Enter a name for the Zonegroup. Zonegroup will help you identify and manage the group of zones.</span>
+                      <span i18n
+                        >Enter a name for the Zonegroup. Zonegroup will help you identify and manage
+                        the group of zones.</span
+                      >
                     </cd-help-text>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('zonegroupName', formDir, 'required')"
-                          i18n>This field is required.</span>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('zonegroupName', formDir, 'uniqueName')"
-                          i18n>This zonegroup name is already in use. Choose a unique name.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('zonegroupName', formDir, 'required')"
+                      i18n
+                      >This field is required.</span
+                    >
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('zonegroupName', formDir, 'uniqueName')"
+                      i18n
+                      >This zonegroup name is already in use. Choose a unique name.</span
+                    >
                   </div>
                 </div>
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="zonegroup_endpoints"
-                         i18n>Zonegroup Endpoints</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="zonegroup_endpoints"
+                    i18n
+                    >Zonegroup Endpoints</label
+                  >
                   <div class="cd-col-form-input">
-                    <cd-select-badges id="zonegroup_endpoints"
-                                      [data]="rgwEndpoints.value"
-                                      [options]="rgwEndpoints.options"
-                                      [customBadges]="true">
+                    <cd-select-badges
+                      id="zonegroup_endpoints"
+                      [data]="rgwEndpoints.value"
+                      [options]="rgwEndpoints.options"
+                      [customBadges]="true"
+                    >
                     </cd-select-badges>
                     <cd-help-text>
-                      <span i18n>Select the endpoints for the Zonegroup. Endpoints are the URLs or IP addresses from which the rgw gateways in that zonegroup can be accessed. You can select multiple endpoints in case you have multiple rgw gateways in a zonegroup</span>
+                      <span i18n
+                        >Select the endpoints for the Zonegroup. Endpoints are the URLs or IP
+                        addresses from which the rgw gateways in that zonegroup can be accessed. You
+                        can select multiple endpoints in case you have multiple rgw gateways in a
+                        zonegroup</span
+                      >
                     </cd-help-text>
                   </div>
                 </div>
               </div>
             </div>
             <ng-container *ngSwitchCase="1">
-              <div *ngIf="multisiteSetupForm.get('configType').value === 'newRealm'"
-                   class="ms-5">
+              <div
+                *ngIf="multisiteSetupForm.get('configType').value === 'newRealm'"
+                class="ms-5"
+              >
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="zonegroupName"
-                         i18n>Zone Name</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="zonegroupName"
+                    i18n
+                    >Zone Name</label
+                  >
                   <div class="cd-col-form-input">
-                    <input class="form-control"
-                           type="text"
-                           id="zoneName"
-                           formControlName="zoneName">
+                    <input
+                      class="form-control"
+                      type="text"
+                      id="zoneName"
+                      formControlName="zoneName"
+                    />
                     <cd-help-text>
-                      <span i18n>Enter a unique name for the Zone. A Zone represents a distinct data center or geographical location within a Zonegroup.</span>
+                      <span i18n
+                        >Enter a unique name for the Zone. A Zone represents a distinct data center
+                        or geographical location within a Zonegroup.</span
+                      >
                     </cd-help-text>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('zoneName', formDir, 'required')"
-                          i18n>This field is required.</span>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('zoneName', formDir, 'uniqueName')"
-                          i18n>This zone name is already in use. Choose a unique name.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('zoneName', formDir, 'required')"
+                      i18n
+                      >This field is required.</span
+                    >
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('zoneName', formDir, 'uniqueName')"
+                      i18n
+                      >This zone name is already in use. Choose a unique name.</span
+                    >
                   </div>
                 </div>
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="zone_endpoints"
-                         i18n>Zone Endpoints</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="zone_endpoints"
+                    i18n
+                    >Zone Endpoints</label
+                  >
                   <div class="cd-col-form-input">
-                    <cd-select-badges id="zone_endpoints"
-                                      [data]="rgwEndpoints.value"
-                                      [options]="rgwEndpoints.options"
-                                      [customBadges]="true"></cd-select-badges>
+                    <cd-select-badges
+                      id="zone_endpoints"
+                      [data]="rgwEndpoints.value"
+                      [options]="rgwEndpoints.options"
+                      [customBadges]="true"
+                    ></cd-select-badges>
                     <cd-help-text>
-                      <span i18n>Select the endpoints for the Zone. Endpoints are the URLs or IP addresses from which the rgw gateways in that zone can be accessed. You can select multiple endpoints in case you have multiple rgw gateways in a zone</span>
+                      <span i18n
+                        >Select the endpoints for the Zone. Endpoints are the URLs or IP addresses
+                        from which the rgw gateways in that zone can be accessed. You can select
+                        multiple endpoints in case you have multiple rgw gateways in a zone</span
+                      >
                     </cd-help-text>
                   </div>
                 </div>
                 <div class="form-group row">
-                  <label class="cd-col-form-label required"
-                         for="username"
-                         i18n>Username</label>
+                  <label
+                    class="cd-col-form-label required"
+                    for="username"
+                    i18n
+                    >Username</label
+                  >
                   <div class="cd-col-form-input">
-                    <input class="form-control"
-                           type="text"
-                           id="username"
-                           formControlName="username"
-                           ngbTooltip="White spaces at the beginning and end will be trimmed"
-                           i18n-ngbTooltip
-                           cdTrim>
+                    <input
+                      class="form-control"
+                      type="text"
+                      id="username"
+                      formControlName="username"
+                      ngbTooltip="White spaces at the beginning and end will be trimmed"
+                      i18n-ngbTooltip
+                      cdTrim
+                    />
                     <cd-help-text>
                       <span i18n>Specify the username for the system user.</span>
                     </cd-help-text>
-                    <cd-alert-panel type="info"
-                                    [showTitle]="false">
-                      <span i18n>This user will be created automatically as part of the process, and it will have the necessary permissions to manage and synchronize resources across zones.</span>
+                    <cd-alert-panel
+                      type="info"
+                      [showTitle]="false"
+                    >
+                      <span i18n
+                        >This user will be created automatically as part of the process, and it will
+                        have the necessary permissions to manage and synchronize resources across
+                        zones.</span
+                      >
                     </cd-alert-panel>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('username', formDir, 'required')"
-                          i18n>This field is required.</span>
-                    <span class="invalid-feedback"
-                          *ngIf="multisiteSetupForm.showError('username', formDir, 'notUnique')"
-                          i18n>This username is already in use. Choose a unique name.</span>
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('username', formDir, 'required')"
+                      i18n
+                      >This field is required.</span
+                    >
+                    <span
+                      class="invalid-feedback"
+                      *ngIf="multisiteSetupForm.showError('username', formDir, 'notUnique')"
+                      i18n
+                      >This username is already in use. Choose a unique name.</span
+                    >
                   </div>
                 </div>
               </div>
-              <div *ngIf="isMultiClusterConfigured && (multisiteSetupForm.get('configType').value === 'existingRealm')"
-                   class="ms-5">
+              <div
+                *ngIf="
+                  isMultiClusterConfigured &&
+                  multisiteSetupForm.get('configType').value === 'existingRealm'
+                "
+                class="ms-5"
+              >
                 <ng-container *ngTemplateOutlet="replicationTemplate"></ng-container>
               </div>
             </ng-container>
             <ng-container *ngSwitchCase="2">
-              <div *ngIf="multisiteSetupForm.get('configType').value === 'newRealm' && !isMultiClusterConfigured"
-                   class="ms-5">
+              <div
+                *ngIf="
+                  multisiteSetupForm.get('configType').value === 'newRealm' &&
+                  !isMultiClusterConfigured
+                "
+                class="ms-5"
+              >
                 <ng-container *ngIf="loading; else nonMultiClusterFinal">
                   <ng-container *ngTemplateOutlet="progressTemplate"></ng-container>
                 </ng-container>
@@ -220,12 +354,22 @@
                   <ng-container *ngTemplateOutlet="reviewTemplate"></ng-container>
                 </ng-container>
               </ng-template>
-              <div *ngIf="multisiteSetupForm.get('configType').value === 'newRealm' && isMultiClusterConfigured"
-                   class="ms-5">
+              <div
+                *ngIf="
+                  multisiteSetupForm.get('configType').value === 'newRealm' &&
+                  isMultiClusterConfigured
+                "
+                class="ms-5"
+              >
                 <ng-container *ngTemplateOutlet="replicationTemplate"></ng-container>
               </div>
-              <div *ngIf="multisiteSetupForm.get('configType').value === 'existingRealm' && isMultiClusterConfigured"
-                   class="ms-5">
+              <div
+                *ngIf="
+                  multisiteSetupForm.get('configType').value === 'existingRealm' &&
+                  isMultiClusterConfigured
+                "
+                class="ms-5"
+              >
                 <ng-container *ngIf="!loading; else loadingTemplate">
                   <ng-container *ngIf="!setupCompleted; else progressCompleteTemplate">
                     <ng-container *ngTemplateOutlet="reviewTemplate"></ng-container>
@@ -235,63 +379,100 @@
             </ng-container>
             <ng-template #replicationTemplate>
               <div class="form-group row">
-                <label class="cd-col-form-label required"
-                       for="cluster"
-                       i18n>Replication Cluster</label>
+                <label
+                  class="cd-col-form-label required"
+                  for="cluster"
+                  i18n
+                  >Replication Cluster</label
+                >
                 <div class="cd-col-form-input">
-                  <select class="form-select"
-                          id="cluster"
-                          [(ngModel)]="selectedCluster"
-                          formControlName="cluster"
-                          name="cluster">
-                    <option *ngFor="let cluster_detail of clusterDetailsArray"
-                            [value]="cluster_detail.name">
+                  <select
+                    class="form-select"
+                    id="cluster"
+                    [(ngModel)]="selectedCluster"
+                    formControlName="cluster"
+                    name="cluster"
+                  >
+                    <option
+                      *ngFor="let cluster_detail of clusterDetailsArray"
+                      [value]="cluster_detail.name"
+                    >
                       {{ cluster_detail.cluster_alias }} - {{ cluster_detail.name }}
                     </option>
                   </select>
                   <cd-help-text>
-                    <span i18n>Choose the cluster where you want to apply this multisite configuration. The selected cluster will integrate the defined Realm, Zonegroup, and Zones, enabling data synchronization and management across the multisite setup.</span>
+                    <span i18n
+                      >Choose the cluster where you want to apply this multisite configuration. The
+                      selected cluster will integrate the defined Realm, Zonegroup, and Zones,
+                      enabling data synchronization and management across the multisite setup.</span
+                    >
                   </cd-help-text>
-                  <cd-alert-panel type="info"
-                                  [showTitle]="false">
-                    <span i18n>Before submitting this form, please verify that the selected cluster has an active RGW (Rados Gateway) service running.</span>
+                  <cd-alert-panel
+                    type="info"
+                    [showTitle]="false"
+                  >
+                    <span i18n
+                      >Before submitting this form, please verify that the selected cluster has an
+                      active RGW (Rados Gateway) service running.</span
+                    >
                   </cd-alert-panel>
                 </div>
               </div>
               <div class="form-group row">
-                <label class="cd-col-form-label required"
-                       for="replicationZoneName"
-                       i18n>Replication Zone Name</label>
+                <label
+                  class="cd-col-form-label required"
+                  for="replicationZoneName"
+                  i18n
+                  >Replication Zone Name</label
+                >
                 <div class="cd-col-form-input">
-                  <input class="form-control"
-                         type="text"
-                         id="replicationZoneName"
-                         name="replicationZoneName"
-                         formControlName="replicationZoneName">
+                  <input
+                    class="form-control"
+                    type="text"
+                    id="replicationZoneName"
+                    name="replicationZoneName"
+                    formControlName="replicationZoneName"
+                  />
                   <cd-help-text>
-                    <span i18n>Replication zone represents the zone to be created in the replication cluster where your data will be replicated.</span>
+                    <span i18n
+                      >Replication zone represents the zone to be created in the replication cluster
+                      where your data will be replicated.</span
+                    >
                   </cd-help-text>
-                  <span class="invalid-feedback"
-                        *ngIf="multisiteSetupForm.showError('replicationZoneName', formDir, 'required')"
-                        i18n>This field is required.</span>
+                  <span
+                    class="invalid-feedback"
+                    *ngIf="multisiteSetupForm.showError('replicationZoneName', formDir, 'required')"
+                    i18n
+                    >This field is required.</span
+                  >
                 </div>
               </div>
               <div class="form-group row">
                 <div class="cd-col-form-offset">
-                  <input type="checkbox"
-                         formControlName="secondary_archive_zone"
-                         id="secondary_archive_zone">
-                  <label for="secondary_archive_zone"
-                         class="custom-control-label cds-ml-3"
-                         i18n>Archive</label>
+                  <input
+                    type="checkbox"
+                    formControlName="secondary_archive_zone"
+                    id="secondary_archive_zone"
+                  />
+                  <label
+                    for="secondary_archive_zone"
+                    class="custom-control-label cds-ml-3"
+                    i18n
+                    >Archive</label
+                  >
                   <cd-help-text>
-                    <span i18n>Enable archival storage to keep all object versions and protect data from deletion or corruption.</span>
+                    <span i18n
+                      >Enable archival storage to keep all object versions and protect data from
+                      deletion or corruption.</span
+                    >
                   </cd-help-text>
                 </div>
               </div>
             </ng-template>
-            <div *ngSwitchCase="3"
-                 class="ms-5">
+            <div
+              *ngSwitchCase="3"
+              class="ms-5"
+            >
               <div *ngIf="isMultiClusterConfigured">
                 <ng-container *ngIf="!loading; else loadingTemplate">
                   <ng-container *ngIf="!setupCompleted; else progressCompleteTemplate">
@@ -306,37 +487,52 @@
     </div>
   </div>
   <cds-modal-footer>
-    <button cdsButton="secondary"
-            name="skip-cluster-selection"
-            aria-label="Skip"
-            (click)="onSkip()"
-            type="button"
-            *ngIf="stepTitles[currentStep.stepIndex]['label'] === 'Select Cluster' && multisiteSetupForm.get('configType').value === 'newRealm'"
-            i18n>Skip</button>
-    <button cdsButton="secondary"
-            (click)="onPreviousStep()"
-            [attr.aria-label]="showCancelButtonLabel()"
-            type="button"
-            i18n>{{ showCancelButtonLabel() }}</button>
-    <button cdsButton="primary"
-            (click)="onNextStep()"
-            aria-label="Next"
-            [disabled]="loading"
-            type="button"
-            i18n>{{ showSubmitButtonLabel() }}
-      <cds-loading [isActive]="loading"
-                   [overlay]="false"
-                   size="sm"
-                   *ngIf="loading">
+    <button
+      cdsButton="secondary"
+      name="skip-cluster-selection"
+      aria-label="Skip"
+      (click)="onSkip()"
+      type="button"
+      *ngIf="
+        stepTitles[currentStep.stepIndex]['label'] === 'Select Cluster' &&
+        multisiteSetupForm.get('configType').value === 'newRealm'
+      "
+      i18n
+    >
+      Skip
+    </button>
+    <button
+      cdsButton="secondary"
+      (click)="onPreviousStep()"
+      [attr.aria-label]="showCancelButtonLabel()"
+      type="button"
+      i18n
+    >
+      {{ showCancelButtonLabel() }}
+    </button>
+    <button
+      cdsButton="primary"
+      (click)="onNextStep()"
+      aria-label="Next"
+      [disabled]="loading"
+      type="button"
+      i18n
+    >
+      {{ showSubmitButtonLabel() }}
+      <cds-loading
+        [isActive]="loading"
+        [overlay]="false"
+        size="sm"
+        *ngIf="loading"
+      >
       </cds-loading>
     </button>
   </cds-modal-footer>
 </cds-modal>
 
-
 <ng-template #nonMultiClusterTemplate>
   <ng-container *ngIf="!loading; else loadingTemplate">
-    <ng-container *ngIf="!setupCompleted else exportTokenTemplate">
+    <ng-container *ngIf="!setupCompleted; else exportTokenTemplate">
       <ng-container *ngTemplateOutlet="reviewTemplate"></ng-container>
     </ng-container>
   </ng-container>
@@ -348,77 +544,88 @@
 
 <ng-template #progressCompleteTemplate>
   <div *ngIf="isMultiClusterConfigured && !stepsToSkip['Select Cluster']; else exportTokenTemplate">
-    <div class="text-center text-success"
-         i18n>
+    <div
+      class="text-center text-success"
+      i18n
+    >
       Multi-site replication setup is complete.
     </div>
   </div>
 </ng-template>
 
 <ng-template #progressTemplate>
-  <cd-progress [value]="executingTask?.progress"
-               [description]="executingTask?.name?.replace('progress/Multisite-Setup:', '')?.split('||')[0]?.trim()"
-               [subDescription]="executingTask?.name?.replace('progress/Multisite-Setup:', '')?.split('||')[1]?.trim()">
+  <cd-progress
+    [value]="executingTask?.progress"
+    [description]="
+      executingTask?.name?.replace('progress/Multisite-Setup:', '')?.split('||')[0]?.trim()
+    "
+    [subDescription]="
+      executingTask?.name?.replace('progress/Multisite-Setup:', '')?.split('||')[1]?.trim()
+    "
+  >
   </cd-progress>
 </ng-template>
 
 <ng-template #exportTokenTemplate>
   @for (realminfo of realms; track realminfo; let i = $index) {
-  <div class="form-item">
-    <cds-text-label
-      [labelInputID]="'wizard-export-realm-' + i"
-      i18n
-      helperText="Name of the realm that will be involved in replication."
-      i18n-helperText
-    >
-      Realm Name
-      <input
-        cdsText
-        readonly
-        type="text"
-        [id]="'wizard-export-realm-' + i"
-        [value]="realminfo.realm"
-      />
-    </cds-text-label>
-  </div>
+    <div class="form-item">
+      <cds-text-label
+        [labelInputID]="'wizard-export-realm-' + i"
+        i18n
+        helperText="Name of the realm that will be involved in replication."
+        i18n-helperText
+      >
+        Realm Name
+        <input
+          cdsText
+          readonly
+          type="text"
+          [id]="'wizard-export-realm-' + i"
+          [value]="realminfo.realm"
+        />
+      </cds-text-label>
+    </div>
 
-  <div class="form-item form-item-append">
-    <cds-text-label
-      [labelInputID]="'wizard-export-token-' + i"
-      i18n
-      helperText="This field displays the token needed to import the multisite configuration into a secondary cluster. Copy this token securely and use it on the secondary cluster to replicate the current multisite setup. Ensure that the token is handled securely to prevent unauthorized access."
-      i18n-helperText
-    >
-      Token
-      <input
-        cdsText
-        readonly
-        type="text"
-        [id]="'wizard-export-token-' + i"
-        [value]="realminfo.token"
-      />
-    </cds-text-label>
-    <cd-copy-2-clipboard-button
-      class="cds-mt-6"
-      [source]="realminfo.token"
-      [byId]="false"
-      size="md"
-    >
-    </cd-copy-2-clipboard-button>
-  </div>
+    <div class="form-item form-item-append">
+      <cds-text-label
+        [labelInputID]="'wizard-export-token-' + i"
+        i18n
+        helperText="This field displays the token needed to import the multisite configuration into a secondary cluster. Copy this token securely and use it on the secondary cluster to replicate the current multisite setup. Ensure that the token is handled securely to prevent unauthorized access."
+        i18n-helperText
+      >
+        Token
+        <input
+          cdsText
+          readonly
+          type="text"
+          [id]="'wizard-export-token-' + i"
+          [value]="realminfo.token"
+        />
+      </cds-text-label>
+      <cd-copy-2-clipboard-button
+        class="cds-mt-6"
+        [source]="realminfo.token"
+        [byId]="false"
+        size="md"
+      >
+      </cd-copy-2-clipboard-button>
+    </div>
 
-  @if (i < realms.length - 1) {
-  <hr />
-  }
+    @if (i < realms.length - 1) {
+      <hr />
+    }
   }
 </ng-template>
 
 <ng-template #reviewTemplate>
-  <cd-alert-panel type="warning"
-                  [showTitle]="false">
+  <cd-alert-panel
+    type="warning"
+    [showTitle]="false"
+  >
     <span i18n>
-      During the automation process, the RGW module will be enabled on both the source and target clusters, if it is not already enabled.
-      This action may cause a temporary downtime (5-10 seconds) on each cluster.
+      During the automation process, the RGW module will be enabled on both the source and target
+      clusters, if it is not already enabled. This action may cause a temporary downtime (5-10
+      seconds) on each cluster.
     </span>
   </cd-alert-panel>
   <ng-container [ngSwitch]="multisiteSetupForm.get('configType').value">
@@ -435,56 +642,110 @@
 
 <ng-template #newRealmInfo>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Realm Name:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b id="realmName">{{ multisiteSetupForm.get('realmName').value }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Realm Name:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b id="realmName">{{ multisiteSetupForm.get('realmName').value }}</b>
+    </div>
   </div>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Zonegroup Name:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b id="zonegroupName">{{ multisiteSetupForm.get('zonegroupName').value }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Zonegroup Name:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b id="zonegroupName">{{ multisiteSetupForm.get('zonegroupName').value }}</b>
+    </div>
   </div>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Zonegroup Endpoints:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b>{{ rgwEndpoints.value.join(', ') }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Zonegroup Endpoints:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b>{{ rgwEndpoints.value.join(', ') }}</b>
+    </div>
   </div>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Zone Name:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b id="zoneName">{{ multisiteSetupForm.get('zoneName').value }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Zone Name:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b id="zoneName">{{ multisiteSetupForm.get('zoneName').value }}</b>
+    </div>
   </div>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Zone Endpoints:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b>{{ rgwEndpoints.value.join(', ') }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Zone Endpoints:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b>{{ rgwEndpoints.value.join(', ') }}</b>
+    </div>
   </div>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Username:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b>{{ multisiteSetupForm.get('username').value }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Username:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b>{{ multisiteSetupForm.get('username').value }}</b>
+    </div>
   </div>
 </ng-template>
 
 <ng-template #existingRealmInfo>
   <div class="form-group row">
-    <legend class="cd-col-form-label"
-           i18n>Selected Realm:</legend>
-    <div class="cd-col-form-input mt-2 text-muted"><b>{{ multisiteSetupForm.get('selectedRealm').value }}</b></div>
+    <legend
+      class="cd-col-form-label"
+      i18n
+    >
+      Selected Realm:
+    </legend>
+    <div class="cd-col-form-input mt-2 text-muted">
+      <b>{{ multisiteSetupForm.get('selectedRealm').value }}</b>
+    </div>
   </div>
 </ng-template>
 
 <ng-template #replicationInfo>
   <div *ngIf="isMultiClusterConfigured && !stepsToSkip['Select Cluster']">
     <div class="form-group row">
-      <legend class="cd-col-form-label"
-             i18n>Selected Replication Cluster:</legend>
-      <div class="cd-col-form-input mt-2 text-muted"><b>{{ selectedCluster }}</b></div>
+      <legend
+        class="cd-col-form-label"
+        i18n
+      >
+        Selected Replication Cluster:
+      </legend>
+      <div class="cd-col-form-input mt-2 text-muted">
+        <b>{{ selectedCluster }}</b>
+      </div>
     </div>
     <div class="form-group row">
-      <legend class="cd-col-form-label"
-             i18n>Replication Zone Name:</legend>
-      <div class="cd-col-form-input mt-2 text-muted"><b>{{ multisiteSetupForm.get('replicationZoneName').value }}</b></div>
+      <legend
+        class="cd-col-form-label"
+        i18n
+      >
+        Replication Zone Name:
+      </legend>
+      <div class="cd-col-form-input mt-2 text-muted">
+        <b>{{ multisiteSetupForm.get('replicationZoneName').value }}</b>
+      </div>
     </div>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zone-form/rgw-multisite-zone-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zone-form/rgw-multisite-zone-form.component.html
index 5b8b68b657d..46f00226eae 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zone-form/rgw-multisite-zone-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zone-form/rgw-multisite-zone-form.component.html
@@ -1,17 +1,27 @@
-<cds-modal size="lg"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="lg"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource }}
+    </h3>
   </cds-modal-header>
-  <form name="multisiteZoneForm"
-        #formDir="ngForm"
-        [formGroup]="multisiteZoneForm"
-        novalidate>
-    <div cdsModalContent
-         class="modal-wrapper scroll-overflow">
+  <form
+    name="multisiteZoneForm"
+    #formDir="ngForm"
+    [formGroup]="multisiteZoneForm"
+    novalidate
+  >
+    <div
+      cdsModalContent
+      class="modal-wrapper scroll-overflow"
+    >
       <div class="form-item">
         <cds-select
           formControlName="selectedZonegroup"
@@ -73,7 +83,8 @@
           i18n
           [disabled]="action === actionLabels.EDIT ? true : null"
           >Mark as default zone
-          <cd-help-text *ngIf="disableDefault && action === actionLabels.CREATE">Default zone can only exist in a default zonegroup.
+          <cd-help-text *ngIf="disableDefault && action === actionLabels.CREATE"
+            >Default zone can only exist in a default zonegroup.
           </cd-help-text>
           <cd-help-text *ngIf="isDefaultZone">
             <span>You cannot unset the default flag.</span>
@@ -94,7 +105,8 @@
           [disabled]="action === actionLabels.EDIT ? true : null"
           i18n
           >Master
-          <cd-help-text *ngIf="disableMaster">Master zone already exist for the selected zonegroup.
+          <cd-help-text *ngIf="disableMaster"
+            >Master zone already exist for the selected zonegroup.
           </cd-help-text>
           <cd-help-text *ngIf="isMasterZone">
             <span>You cannot unset the master flag. </span>
@@ -107,8 +119,10 @@
           </cd-help-text>
         </cds-checkbox>
       </div>
-      <div *ngIf="multisiteZoneForm.get('master_zone')?.value === false"
-           class="form-item">
+      <div
+        *ngIf="multisiteZoneForm.get('master_zone')?.value === false"
+        class="form-item"
+      >
         <cds-checkbox
           id="archive_zone"
           formControlName="archive_zone"
@@ -118,7 +132,8 @@
           >Archive
           <cd-help-text>
             <span
-              >Enable archival storage to keep all object versions and protect data from deletion or corruption.</span
+              >Enable archival storage to keep all object versions and protect data from deletion or
+              corruption.</span
             >
           </cd-help-text>
         </cds-checkbox>
@@ -132,32 +147,40 @@
           i18n
           >Sync from all zones
           <cd-help-text>
-            <span
-              >Enable this option to synchronize data from all zones.</span
-            >
+            <span>Enable this option to synchronize data from all zones.</span>
           </cd-help-text>
           <div class="cds-mt-3">
-            <cd-alert-panel *ngIf="multisiteZoneForm.get('archive_zone')?.value === true"
-                            type="warning">
-                “Sync from all zones” is disabled to avoid duplicate objects in archive zones. Please select specific zones instead.
+            <cd-alert-panel
+              *ngIf="multisiteZoneForm.get('archive_zone')?.value === true"
+              type="warning"
+            >
+              “Sync from all zones” is disabled to avoid duplicate objects in archive zones. Please
+              select specific zones instead.
             </cd-alert-panel>
           </div>
         </cds-checkbox>
       </div>
-      <div *ngIf="multisiteZoneForm.get('sync_from_all')?.value === false"
-           class="form-item">
-        <cds-combo-box type="multi"
-                       selectionFeedback="top-after-reopen"
-                       label="Sync from zones"
-                       formControlName="sync_from_zones"
-                       id="sync_from_zones"
-                       [appendInline]="true"
-                       [items]="syncFromZonesOptions"
-                       i18n>
+      <div
+        *ngIf="multisiteZoneForm.get('sync_from_all')?.value === false"
+        class="form-item"
+      >
+        <cds-combo-box
+          type="multi"
+          selectionFeedback="top-after-reopen"
+          label="Sync from zones"
+          formControlName="sync_from_zones"
+          id="sync_from_zones"
+          [appendInline]="true"
+          [items]="syncFromZonesOptions"
+          i18n
+        >
           <cds-dropdown-list></cds-dropdown-list>
         </cds-combo-box>
         <cd-help-text>
-          <span i18n>Select specific zones to synchronize data from when "Sync from all zones" is disabled.</span>
+          <span i18n
+            >Select specific zones to synchronize data from when "Sync from all zones" is
+            disabled.</span
+          >
         </cd-help-text>
       </div>
       <div class="form-item">
@@ -169,9 +192,12 @@
           "
           cdRequiredField="Endpoints"
           [invalidText]="
-                            multisiteZoneForm.controls['zone_endpoints'].errors?.['required'] ? 'This field is required.' :
-                            multisiteZoneForm.controls['zone_endpoints'].errors?.['invalidURL'] ? 'Please enter a valid URL.' : ''
-                          "
+            multisiteZoneForm.controls['zone_endpoints'].errors?.['required']
+              ? 'This field is required.'
+              : multisiteZoneForm.controls['zone_endpoints'].errors?.['invalidURL']
+                ? 'Please enter a valid URL.'
+                : ''
+          "
           i18n-invalidText
           >Endpoints
           <input
@@ -187,9 +213,11 @@
       </div>
 
       <div class="form-item">
-        <cds-password-label labelInputID="access_key"
-                            [helperText]="AccessKeyText"
-                            i18n>S3 access key
+        <cds-password-label
+          labelInputID="access_key"
+          [helperText]="AccessKeyText"
+          i18n
+          >S3 access key
           <input
             cdsPassword
             type="password"
@@ -201,9 +229,11 @@
         </cds-password-label>
       </div>
       <div class="form-item">
-        <cds-password-label labelInputID="secret_key"
-                            [helperText]="SecretKeyText"
-                            i18n>S3 secret key
+        <cds-password-label
+          labelInputID="secret_key"
+          [helperText]="SecretKeyText"
+          i18n
+          >S3 secret key
           <input
             cdsPassword
             type="password"
@@ -215,8 +245,12 @@
         </cds-password-label>
       </div>
       <div *ngIf="action === actionLabels.EDIT">
-        <legend class="cd-header"
-                i18n>Placement Targets</legend>
+        <legend
+          class="cd-header"
+          i18n
+        >
+          Placement Targets
+        </legend>
         <div class="form-item">
           <cds-select
             formControlName="placementTarget"
@@ -236,9 +270,11 @@
           </cds-select>
         </div>
         <div class="form-item">
-          <cds-select formControlName="placementDataPool"
-                      label="Data pool"
-                      i18n>Data pool
+          <cds-select
+            formControlName="placementDataPool"
+            label="Data pool"
+            i18n
+            >Data pool
 
             <option
               *ngFor="let pool of poolList"
@@ -250,9 +286,11 @@
           </cds-select>
         </div>
         <div class="form-item">
-          <cds-select formControlName="placementIndexPool"
-                      label="Index pool"
-                      i18n>Index pool
+          <cds-select
+            formControlName="placementIndexPool"
+            label="Index pool"
+            i18n
+            >Index pool
 
             <option
               *ngFor="let pool of poolList"
@@ -264,9 +302,11 @@
           </cds-select>
         </div>
         <div class="form-item">
-          <cds-select formControlName="placementDataExtraPool"
-                      label="Data extra pool"
-                      i18n>Data extra pool
+          <cds-select
+            formControlName="placementDataExtraPool"
+            label="Data extra pool"
+            i18n
+            >Data extra pool
             <option
               *ngFor="let pool of poolList"
               [value]="pool.poolname"
@@ -278,8 +318,12 @@
         </div>
 
         <div>
-          <legend class="cd-header"
-                  i18n>Storage Classes</legend>
+          <legend
+            class="cd-header"
+            i18n
+          >
+            Storage Classes
+          </legend>
           <div class="form-item">
             <cds-select
               formControlName="storageClass"
@@ -288,16 +332,20 @@
               i18n
               >Storage class
 
-              <option *ngFor="let storageClass of storageClassList"
-                      [value]="storageClass.key">
+              <option
+                *ngFor="let storageClass of storageClassList"
+                [value]="storageClass.key"
+              >
                 {{ storageClass.key }}
               </option>
             </cds-select>
           </div>
           <div class="form-item">
-            <cds-select formControlName="storageDataPool"
-                        label="Data pool"
-                        i18n>Data pool
+            <cds-select
+              formControlName="storageDataPool"
+              label="Data pool"
+              i18n
+              >Data pool
               <option
                 *ngFor="let pool of poolList"
                 [value]="pool.poolname"
@@ -308,11 +356,15 @@
             </cds-select>
           </div>
           <div class="form-item">
-            <cds-select formControlName="storageCompression"
-                        label="Compression"
-                        i18n>Compression
-              <option *ngFor="let compression of compressionTypes"
-                      [value]="compression">
+            <cds-select
+              formControlName="storageCompression"
+              label="Compression"
+              i18n
+              >Compression
+              <option
+                *ngFor="let compression of compressionTypes"
+                [value]="compression"
+              >
                 {{ compression }}
               </option>
             </cds-select>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html
index d5813693335..6c606dadd1c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-zonegroup-form/rgw-multisite-zonegroup-form.component.html
@@ -1,210 +1,309 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container i18n="form title"
-                class="modal-title">{{ action | titlecase }} Zonegroup</ng-container>
+  <ng-container
+    i18n="form title"
+    class="modal-title"
+    >{{ action | titlecase }} Zonegroup</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form name="multisiteZonegroupForm"
-          #formDir="ngForm"
-          [formGroup]="multisiteZonegroupForm"
-          novalidate>
-    <div class="modal-body">
-      <div class="form-group row">
-        <label class="cd-col-form-label"
-               for="selectedRealm"
-               i18n>Select Realm</label>
-        <div class="cd-col-form-input">
-          <select class="form-select"
-                  id="selectedRealm"
-                  formControlName="selectedRealm"
-                  name="selectedRealm">
-          <option ngValue=""
-                  i18n>-- Select a realm --</option>
-          <option *ngFor="let realmName of realmList"
-                  [value]="realmName.name"
-                  [selected]="realmName.name === multisiteZonegroupForm.getValue('selectedRealm')">
+    <form
+      name="multisiteZonegroupForm"
+      #formDir="ngForm"
+      [formGroup]="multisiteZonegroupForm"
+      novalidate
+    >
+      <div class="modal-body">
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label"
+            for="selectedRealm"
+            i18n
+            >Select Realm</label
+          >
+          <div class="cd-col-form-input">
+            <select
+              class="form-select"
+              id="selectedRealm"
+              formControlName="selectedRealm"
+              name="selectedRealm"
+            >
+              <option
+                ngValue=""
+                i18n
+              >
+                -- Select a realm --
+              </option>
+              <option
+                *ngFor="let realmName of realmList"
+                [value]="realmName.name"
+                [selected]="realmName.name === multisiteZonegroupForm.getValue('selectedRealm')"
+              >
                 {{ realmName.name }}
-          </option>
-          </select>
+              </option>
+            </select>
+          </div>
         </div>
-      </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zonegroupName"
-               i18n>Zonegroup Name</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="Zonegroup name..."
-                 id="zonegroupName"
-                 name="zonegroupName"
-                 formControlName="zonegroupName">
-          <span class="invalid-feedback"
-                *ngIf="multisiteZonegroupForm.showError('zonegroupName', formDir, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="multisiteZonegroupForm.showError('zonegroupName', formDir, 'uniqueName')"
-                i18n>The chosen zonegroup name is already in use.</span>
-        <div class="custom-control custom-checkbox">
-          <input class="form-check-input"
-                 id="default_zonegroup"
-                 name="default_zonegroup"
-                 formControlName="default_zonegroup"
-                 [attr.disabled]="action === actionLabels.EDIT ? true : null"
-                 type="checkbox">
-          <label class="form-check-label"
-                 for="default_zonegroup"
-                 i18n>Default</label>
-          <span *ngIf="disableDefault && action === actionLabels.CREATE">
-            <cd-helper i18n>Zonegroup doesn't belong to the default realm.</cd-helper>
-          </span>
-          <cd-helper *ngIf="action === actionLabels.EDIT && !info.data.is_default">
-            <span i18n>Please consult the&nbsp;<cd-doc section="rgw-multisite"></cd-doc>&nbsp;to follow the failover mechanism</span>
-          </cd-helper>
-          <cd-helper *ngIf="action === actionLabels.EDIT && info.data.is_default">
-            <span i18n>You cannot unset the default flag.</span>
-          </cd-helper><br>
-          <input class="form-check-input"
-                 id="master_zonegroup"
-                 name="master_zonegroup"
-                 formControlName="master_zonegroup"
-                 [attr.disabled]="action === actionLabels.EDIT ? true : null"
-                 type="checkbox">
-          <label class="form-check-label"
-                 for="master_zonegroup"
-                 i18n>Master</label>
-          <span *ngIf="disableMaster && action === actionLabels.CREATE">
-            <cd-helper i18n>Multiple master zonegroups can't be configured. If you want to create a new zonegroup and make it the master zonegroup, you must delete the default zonegroup.</cd-helper>
-          </span>
-          <cd-helper *ngIf="action === actionLabels.EDIT && !info.data.is_master">
-            <span i18n>Please consult the&nbsp;<cd-doc section="rgw-multisite"></cd-doc>&nbsp;to follow the failover mechanism</span>
-          </cd-helper>
-          <cd-helper *ngIf="action === actionLabels.EDIT && info.data.is_master">
-            <span i18n>You cannot unset the master flag.</span>
-          </cd-helper>
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zonegroupName"
+            i18n
+            >Zonegroup Name</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="Zonegroup name..."
+              id="zonegroupName"
+              name="zonegroupName"
+              formControlName="zonegroupName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteZonegroupForm.showError('zonegroupName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteZonegroupForm.showError('zonegroupName', formDir, 'uniqueName')"
+              i18n
+              >The chosen zonegroup name is already in use.</span
+            >
+            <div class="custom-control custom-checkbox">
+              <input
+                class="form-check-input"
+                id="default_zonegroup"
+                name="default_zonegroup"
+                formControlName="default_zonegroup"
+                [attr.disabled]="action === actionLabels.EDIT ? true : null"
+                type="checkbox"
+              />
+              <label
+                class="form-check-label"
+                for="default_zonegroup"
+                i18n
+                >Default</label
+              >
+              <span *ngIf="disableDefault && action === actionLabels.CREATE">
+                <cd-helper i18n>Zonegroup doesn't belong to the default realm.</cd-helper>
+              </span>
+              <cd-helper *ngIf="action === actionLabels.EDIT && !info.data.is_default">
+                <span i18n
+                  >Please consult the&nbsp;<cd-doc section="rgw-multisite"></cd-doc>&nbsp;to follow
+                  the failover mechanism</span
+                >
+              </cd-helper>
+              <cd-helper *ngIf="action === actionLabels.EDIT && info.data.is_default">
+                <span i18n>You cannot unset the default flag.</span> </cd-helper
+              ><br />
+              <input
+                class="form-check-input"
+                id="master_zonegroup"
+                name="master_zonegroup"
+                formControlName="master_zonegroup"
+                [attr.disabled]="action === actionLabels.EDIT ? true : null"
+                type="checkbox"
+              />
+              <label
+                class="form-check-label"
+                for="master_zonegroup"
+                i18n
+                >Master</label
+              >
+              <span *ngIf="disableMaster && action === actionLabels.CREATE">
+                <cd-helper i18n
+                  >Multiple master zonegroups can't be configured. If you want to create a new
+                  zonegroup and make it the master zonegroup, you must delete the default
+                  zonegroup.</cd-helper
+                >
+              </span>
+              <cd-helper *ngIf="action === actionLabels.EDIT && !info.data.is_master">
+                <span i18n
+                  >Please consult the&nbsp;<cd-doc section="rgw-multisite"></cd-doc>&nbsp;to follow
+                  the failover mechanism</span
+                >
+              </cd-helper>
+              <cd-helper *ngIf="action === actionLabels.EDIT && info.data.is_master">
+                <span i18n>You cannot unset the master flag.</span>
+              </cd-helper>
+            </div>
+          </div>
         </div>
-        </div>
-      </div>
-      <div class="form-group row">
-        <label class="cd-col-form-label required"
-               for="zonegroup_endpoints"
-               i18n>Endpoints</label>
-        <div class="cd-col-form-input">
-          <input class="form-control"
-                 type="text"
-                 placeholder="http://ceph-node-00.com:80"
-                 id="zonegroup_endpoints"
-                 name="zonegroup_endpoints"
-                 formControlName="zonegroup_endpoints">
-        <span class="invalid-feedback"
+        <div class="form-group row">
+          <label
+            class="cd-col-form-label required"
+            for="zonegroup_endpoints"
+            i18n
+            >Endpoints</label
+          >
+          <div class="cd-col-form-input">
+            <input
+              class="form-control"
+              type="text"
+              placeholder="http://ceph-node-00.com:80"
+              id="zonegroup_endpoints"
+              name="zonegroup_endpoints"
+              formControlName="zonegroup_endpoints"
+            />
+            <span
+              class="invalid-feedback"
               *ngIf="multisiteZonegroupForm.showError('zonegroup_endpoints', formDir, 'required')"
-              i18n>This field is required.</span>
-        <span class="invalid-feedback"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
               *ngIf="multisiteZonegroupForm.showError('zonegroup_endpoints', formDir, 'invalidURL')"
-              i18n>Please enter a valid URL.</span>
+              i18n
+              >Please enter a valid URL.</span
+            >
+          </div>
         </div>
-      </div>
-      <div class="form-group row"
-           *ngIf="action === actionLabels.EDIT">
-        <label i18n
-               for="zones"
-               class="cd-col-form-label">Zones</label>
-        <div class="cd-col-form-input">
-          <cd-select-badges id="zones"
-                            [data]="zonegroupZoneNames"
-                            [options]="labelsOption"
-                            [customBadges]="true">
-          </cd-select-badges><br>
-          <span class="invalid-feedback"
-                *ngIf="isRemoveMasterZone"
-                i18n>Cannot remove master zone.</span>
+        <div
+          class="form-group row"
+          *ngIf="action === actionLabels.EDIT"
+        >
+          <label
+            i18n
+            for="zones"
+            class="cd-col-form-label"
+            >Zones</label
+          >
+          <div class="cd-col-form-input">
+            <cd-select-badges
+              id="zones"
+              [data]="zonegroupZoneNames"
+              [options]="labelsOption"
+              [customBadges]="true"
+            >
+            </cd-select-badges
+            ><br />
+            <span
+              class="invalid-feedback"
+              *ngIf="isRemoveMasterZone"
+              i18n
+              >Cannot remove master zone.</span
+            >
+          </div>
         </div>
-      </div>
-      <div *ngIf="action === actionLabels.EDIT">
-        <legend>Placement targets</legend>
-        <ng-container formArrayName="placementTargets">
-          <div *ngFor="let item of placementTargets.controls; let index = index; trackBy: trackByFn">
-            <div class="card"
-                 [formGroup]="item">
-              <div class="card-header">
-                {{ (index + 1) | ordinal }}
-                <span class="float-end clickable"
-                      name="remove_placement_target"
-                      (click)="removePlacementTarget(index)"
-                      tabindex="0"
-                      (keydown.enter)="removePlacementTarget(index)"
-                      ngbTooltip="Remove">&times;</span>
-              </div>
-
-              <div class="card-body">
-                <!-- Placement Id -->
-                <div class="form-group row">
-                  <label i18n
-                         class="cd-col-form-label required"
-                         for="placement_id">Placement Id</label>
-                  <div class="cd-col-form-input">
-                    <input type="text"
-                           class="form-control"
-                           name="placement_id"
-                           id="placement_id"
-                           formControlName="placement_id"
-                           placeholder="eg. default-placement">
-                    <span class="invalid-feedback">
-                      <span *ngIf="showError(index, 'placement_id', formDir, 'required')"
-                            i18n>This field is required.</span>
-                    </span>
-                  </div>
+        <div *ngIf="action === actionLabels.EDIT">
+          <legend>Placement targets</legend>
+          <ng-container formArrayName="placementTargets">
+            <div
+              *ngFor="let item of placementTargets.controls; let index = index; trackBy: trackByFn"
+            >
+              <div
+                class="card"
+                [formGroup]="item"
+              >
+                <div class="card-header">
+                  {{ index + 1 | ordinal }}
+                  <span
+                    class="float-end clickable"
+                    name="remove_placement_target"
+                    (click)="removePlacementTarget(index)"
+                    tabindex="0"
+                    (keydown.enter)="removePlacementTarget(index)"
+                    ngbTooltip="Remove"
+                    >&times;</span
+                  >
                 </div>
 
-                <!-- Tags-->
-                <div class="form-group row">
-                  <label i18n
-                         class="cd-col-form-label"
-                         for="tags">Tags</label>
-                  <div class="cd-col-form-input">
-                    <input type="text"
-                           class="form-control"
-                           name="tags"
-                           id="tags"
-                           formControlName="tags"
-                           placeholder="comma separated tags, eg. default-placement, ssd">
+                <div class="card-body">
+                  <!-- Placement Id -->
+                  <div class="form-group row">
+                    <label
+                      i18n
+                      class="cd-col-form-label required"
+                      for="placement_id"
+                      >Placement Id</label
+                    >
+                    <div class="cd-col-form-input">
+                      <input
+                        type="text"
+                        class="form-control"
+                        name="placement_id"
+                        id="placement_id"
+                        formControlName="placement_id"
+                        placeholder="eg. default-placement"
+                      />
+                      <span class="invalid-feedback">
+                        <span
+                          *ngIf="showError(index, 'placement_id', formDir, 'required')"
+                          i18n
+                          >This field is required.</span
+                        >
+                      </span>
+                    </div>
                   </div>
-                </div>
 
-                <!-- Storage Class -->
-                <div class="form-group row">
-                  <label i18n
-                         class="cd-col-form-label"
-                         for="storage_class">Storage Class</label>
-                  <div class="cd-col-form-input">
-                    <input type="text"
-                           class="form-control"
-                           name="storage_class"
-                           id="storage_class"
-                           formControlName="storage_class"
-                           placeholder="eg. Standard-tier">
+                  <!-- Tags-->
+                  <div class="form-group row">
+                    <label
+                      i18n
+                      class="cd-col-form-label"
+                      for="tags"
+                      >Tags</label
+                    >
+                    <div class="cd-col-form-input">
+                      <input
+                        type="text"
+                        class="form-control"
+                        name="tags"
+                        id="tags"
+                        formControlName="tags"
+                        placeholder="comma separated tags, eg. default-placement, ssd"
+                      />
+                    </div>
+                  </div>
+
+                  <!-- Storage Class -->
+                  <div class="form-group row">
+                    <label
+                      i18n
+                      class="cd-col-form-label"
+                      for="storage_class"
+                      >Storage Class</label
+                    >
+                    <div class="cd-col-form-input">
+                      <input
+                        type="text"
+                        class="form-control"
+                        name="storage_class"
+                        id="storage_class"
+                        formControlName="storage_class"
+                        placeholder="eg. Standard-tier"
+                      />
+                    </div>
                   </div>
                 </div>
               </div>
             </div>
-          </div>
-        </ng-container>
-        <button type="button"
-                id="add-plc"
-                class="btn btn-light float-end my-3"
-                (click)="addPlacementTarget()">
-          <svg [cdsIcon]="icons.add"
-               [size]="icons.size16"
-               class="cds-info-color">
-          </svg>
-          <ng-container i18n>Add placement target</ng-container>
-        </button>
+          </ng-container>
+          <button
+            type="button"
+            id="add-plc"
+            class="btn btn-light float-end my-3"
+            (click)="addPlacementTarget()"
+          >
+            <svg
+              [cdsIcon]="icons.add"
+              [size]="icons.size16"
+              class="cds-info-color"
+            ></svg>
+            <ng-container i18n>Add placement target</ng-container>
+          </button>
+        </div>
+      </div>
+      <div class="modal-footer">
+        <cd-form-button-panel
+          (submitActionEvent)="submit()"
+          [form]="multisiteZonegroupForm"
+          [submitText]="(action | titlecase) + ' ' + 'Zonegroup'"
+        ></cd-form-button-panel>
       </div>
-    </div>
-    <div class="modal-footer">
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="multisiteZonegroupForm"
-                            [submitText]="(action | titlecase) + ' ' + 'Zonegroup'"></cd-form-button-panel>
-    </div>
     </form>
   </ng-container>
 </cd-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.html
index 2724fb70006..fe5539ecda9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.html
@@ -1,80 +1,114 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()">
-  <cds-modal-header (closeSelect)="closeModal()"
-                    i18n>
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
+  <cds-modal-header
+    (closeSelect)="closeModal()"
+    i18n
+  >
     {{ editing ? 'Edit' : 'Create' }} Notification configuration
-    <cd-help-text [formAllFieldsRequired]="false">All fields are optional, except where marked required.</cd-help-text>
+    <cd-help-text [formAllFieldsRequired]="false"
+      >All fields are optional, except where marked required.</cd-help-text
+    >
   </cds-modal-header>
 
   <ng-container>
     <section cdsModalContent>
-      <form name="notificationForm"
-            #formDir="ngForm"
-            [formGroup]="notificationForm"
-            novalidate>
+      <form
+        name="notificationForm"
+        #formDir="ngForm"
+        [formGroup]="notificationForm"
+        novalidate
+      >
         <!-- Id-->
-        <div cdsRow
-             class="form-item form-item-append">
+        <div
+          cdsRow
+          class="form-item form-item-append"
+        >
           <div cdsCol>
-            <cds-text-label labelInputID="name"
-                            i18n
-                            i18n-helperText
-                            cdRequiredField="Name"
-                            [invalid]="notificationForm.controls.id.invalid && notificationForm.controls.id.dirty"
-                            [invalidText]="nameError"
-                            [helperText]="helpertext">Topic Name
-            <input cdsText
-                   type="text"
-                   placeholder="Name..."
-                   i18n-placeholder
-                   id="name"
-                   autoFocus
-                   formControlName="id"
-                   [invalid]="notificationForm.controls.id.invalid && notificationForm.controls.id.dirty"/>
+            <cds-text-label
+              labelInputID="name"
+              i18n
+              i18n-helperText
+              cdRequiredField="Name"
+              [invalid]="notificationForm.controls.id.invalid && notificationForm.controls.id.dirty"
+              [invalidText]="nameError"
+              [helperText]="helpertext"
+              >Topic Name
+              <input
+                cdsText
+                type="text"
+                placeholder="Name..."
+                i18n-placeholder
+                id="name"
+                autoFocus
+                formControlName="id"
+                [invalid]="
+                  notificationForm.controls.id.invalid && notificationForm.controls.id.dirty
+                "
+              />
             </cds-text-label>
             <ng-template #helpertext>
               <span i18n>Enter a unique notification name</span>
             </ng-template>
             <ng-template #nameError>
-              <span *ngIf="notificationForm.showError('id', formDir, 'required')"
-                    class="invalid-feedback">
+              <span
+                *ngIf="notificationForm.showError('id', formDir, 'required')"
+                class="invalid-feedback"
+              >
                 <ng-container i18n>This field is required.</ng-container>
               </span>
-              <span class="invalid-feedback"
-                    *ngIf="notificationForm.showError('id', formDir, 'duplicate')"
-                    i18n>The name is already in use. Please choose a different one</span>
+              <span
+                class="invalid-feedback"
+                *ngIf="notificationForm.showError('id', formDir, 'duplicate')"
+                i18n
+                >The name is already in use. Please choose a different one</span
+              >
             </ng-template>
           </div>
           <!-- Topic -->
           <div cdsCol>
-            <cds-select id="topic"
-                        formControlName="topic"
-                        cdRequiredField="Topic"
-                        label="Topic"
-                        i18n-label
-                        placeholder="Select a topic..."
-                        i18n-placeholder
-                        [invalid]="notificationForm.controls.topic.invalid && notificationForm.controls.topic.dirty"
-                        [invalidText]="topicError"
-                        helperText="This topic will define and control the notification settings"
-                        i18n-helperText>
-            <option *ngIf="topicArn === null"
-                    value="">Loading...
-            </option>
-            <option [ngValue]="null"
-                    i18n>
-              -- Select a topic --
-            </option>
-            <option *ngFor="let data of topicArn"
-                    i18n
-                    [ngValue]="data">
-              {{ data }}
-            </option>
-          </cds-select>
+            <cds-select
+              id="topic"
+              formControlName="topic"
+              cdRequiredField="Topic"
+              label="Topic"
+              i18n-label
+              placeholder="Select a topic..."
+              i18n-placeholder
+              [invalid]="
+                notificationForm.controls.topic.invalid && notificationForm.controls.topic.dirty
+              "
+              [invalidText]="topicError"
+              helperText="This topic will define and control the notification settings"
+              i18n-helperText
+            >
+              <option
+                *ngIf="topicArn === null"
+                value=""
+              >
+                Loading...
+              </option>
+              <option
+                [ngValue]="null"
+                i18n
+              >
+                -- Select a topic --
+              </option>
+              <option
+                *ngFor="let data of topicArn"
+                i18n
+                [ngValue]="data"
+              >
+                {{ data }}
+              </option>
+            </cds-select>
             <ng-template #topicError>
-              <span *ngIf="notificationForm.showError('topic', formDir, 'required')"
-                    class="invalid-feedback">
+              <span
+                *ngIf="notificationForm.showError('topic', formDir, 'required')"
+                class="invalid-feedback"
+              >
                 <ng-container i18n>This field is required.</ng-container>
               </span>
             </ng-template>
@@ -82,137 +116,174 @@
         </div>
 
         <!-- Events -->
-        <div cdsRow
-             class="form-item form-item-append">
-
+        <div
+          cdsRow
+          class="form-item form-item-append"
+        >
           <div cdsCol>
-            <cds-combo-box label="Event"
-                           type="multi"
-                           formControlName="event"
-                           placeholder="Select event..."
-                           [items]="eventOption"
-                           itemValueKey="content"
-                           id="event"
-                           cdDynamicInputCombobox
-                           (updatedItems)="eventOption = $event"
-                           i18n-placeholder
-                           helperText="Choose the S3 event type that will trigger the notification, such as object creation or deletion"
-                           i18n-helperText>
+            <cds-combo-box
+              label="Event"
+              type="multi"
+              formControlName="event"
+              placeholder="Select event..."
+              [items]="eventOption"
+              itemValueKey="content"
+              id="event"
+              cdDynamicInputCombobox
+              (updatedItems)="eventOption = $event"
+              i18n-placeholder
+              helperText="Choose the S3 event type that will trigger the notification, such as object creation or deletion"
+              i18n-helperText
+            >
               <cds-dropdown-list></cds-dropdown-list>
             </cds-combo-box>
           </div>
         </div>
         <cd-form-advanced-fieldset class="cd-header">
-        <ng-container *ngFor="let key of filterTypes">
-          <ng-container
-            *ngTemplateOutlet="
-              filterTemplate;
-              context: {
-                type: key,
-                controls: filterControls[key],
-                options: filterSettings[key].options,
-                isDropdown: filterSettings[key].isDropdown,
-                namePlaceholder: filterSettings[key].namePlaceholder,
-                valuePlaceholder: filterSettings[key].valuePlaceholder,
-                nameHelper: filterSettings[key].nameHelper,
-                valueHelper: filterSettings[key].valueHelper
-              }
-            ">
+          <ng-container *ngFor="let key of filterTypes">
+            <ng-container
+              *ngTemplateOutlet="
+                filterTemplate;
+                context: {
+                  type: key,
+                  controls: filterControls[key],
+                  options: filterSettings[key].options,
+                  isDropdown: filterSettings[key].isDropdown,
+                  namePlaceholder: filterSettings[key].namePlaceholder,
+                  valuePlaceholder: filterSettings[key].valuePlaceholder,
+                  nameHelper: filterSettings[key].nameHelper,
+                  valueHelper: filterSettings[key].valueHelper
+                }
+              "
+            >
+            </ng-container>
           </ng-container>
-        </ng-container>
-      </cd-form-advanced-fieldset>
+        </cd-form-advanced-fieldset>
       </form>
     </section>
   </ng-container>
 
   <!-- Submit Button -->
-  <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                        [form]="notificationForm"
-                        [submitText]="editing ? actionLabels.EDIT : actionLabels.CREATE"
-                        [modalForm]="true"> </cd-form-button-panel>
-  </cds-modal>
-
-
-  <ng-template #filterTemplate
-               let-type="type"
-               let-controls="controls"
-               let-options="options"
-               let-isDropdown="isDropdown"
-               let-namePlaceholder="namePlaceholder"
-               let-valuePlaceholder="valuePlaceholder"
-               let-nameHelper="nameHelper"
-               let-valueHelper="valueHelper">
+  <cd-form-button-panel
+    (submitActionEvent)="onSubmit()"
+    [form]="notificationForm"
+    [submitText]="editing ? actionLabels.EDIT : actionLabels.CREATE"
+    [modalForm]="true"
+  >
+  </cd-form-button-panel>
+</cds-modal>
 
+<ng-template
+  #filterTemplate
+  let-type="type"
+  let-controls="controls"
+  let-options="options"
+  let-isDropdown="isDropdown"
+  let-namePlaceholder="namePlaceholder"
+  let-valuePlaceholder="valuePlaceholder"
+  let-nameHelper="nameHelper"
+  let-valueHelper="valueHelper"
+>
   <h6 i18n>{{ typeLabels[type] }}</h6>
 
   <div [formGroup]="notificationForm.get('filter')">
     <div [formArrayName]="type">
-      <div *ngFor="let group of controls.controls; let i = index"
-           [formGroupName]="i">
-        <div cdsRow
-             class="form-item form-item-append">
+      <div
+        *ngFor="let group of controls.controls; let i = index"
+        [formGroupName]="i"
+      >
+        <div
+          cdsRow
+          class="form-item form-item-append"
+        >
           <div cdsCol>
             <ng-container *ngIf="isDropdown; else textInputName">
-              <cds-select [id]="type + '-name-' + i"
-                          formControlName="Name"
-                          label="Name"
-                          i18n-label
-                          [helperText]="nameHelper"
-                          i18n-helperText>
-                <option *ngFor="let filter of s3KeyFilterValue"
-                        [value]="filter">{{ filter }}</option>
+              <cds-select
+                [id]="type + '-name-' + i"
+                formControlName="Name"
+                label="Name"
+                i18n-label
+                [helperText]="nameHelper"
+                i18n-helperText
+              >
+                <option
+                  *ngFor="let filter of s3KeyFilterValue"
+                  [value]="filter"
+                >
+                  {{ filter }}
+                </option>
               </cds-select>
             </ng-container>
 
             <ng-template #textInputName>
-              <cds-text-label [labelInputID]="type + '-name-' + i"
-                              i18n-label
-                              [helperText]="nameHelper"
-                              i18n-helperText>
+              <cds-text-label
+                [labelInputID]="type + '-name-' + i"
+                i18n-label
+                [helperText]="nameHelper"
+                i18n-helperText
+              >
                 Name
-                <input cdsText
-                       type="text"
-                       [placeholder]="namePlaceholder"
-                       formControlName="Name"
-                       i18n />
+                <input
+                  cdsText
+                  type="text"
+                  [placeholder]="namePlaceholder"
+                  formControlName="Name"
+                  i18n
+                />
               </cds-text-label>
             </ng-template>
           </div>
 
           <div cdsCol>
-            <cds-text-label [labelInputID]="type + '-value-' + i"
-                            i18n-label
-                            [helperText]="valueHelper"
-                            i18n-helperText>
+            <cds-text-label
+              [labelInputID]="type + '-value-' + i"
+              i18n-label
+              [helperText]="valueHelper"
+              i18n-helperText
+            >
               Value
-              <input cdsText
-                     type="text"
-                     [placeholder]="valuePlaceholder"
-                     formControlName="Value"
-                     i18n />
+              <input
+                cdsText
+                type="text"
+                [placeholder]="valuePlaceholder"
+                formControlName="Value"
+                i18n
+              />
             </cds-text-label>
           </div>
-          <div cdsCol
-               [columnNumbers]="{ lg: 1, md: 1 }"
-               class="item-action-btn spacing">
-            <cds-icon-button kind="primary"
-                             size="sm"
-                             (click)="addRow(type, i)">
-              <svg cdsIcon="add"
-                   size="32"
-                   class="cds--btn__icon"></svg>
+          <div
+            cdsCol
+            [columnNumbers]="{ lg: 1, md: 1 }"
+            class="item-action-btn spacing"
+          >
+            <cds-icon-button
+              kind="primary"
+              size="sm"
+              (click)="addRow(type, i)"
+            >
+              <svg
+                cdsIcon="add"
+                size="32"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
           </div>
 
-          <div cdsCol
-               [columnNumbers]="{ lg: 1, md: 1 }"
-               class="item-action-btn spacing">
-            <cds-icon-button kind="danger"
-                             size="sm"
-                             (click)="removeRow(type, i)">
-              <svg cdsIcon="trash-can"
-                   size="32"
-                   class="cds--btn__icon"></svg>
+          <div
+            cdsCol
+            [columnNumbers]="{ lg: 1, md: 1 }"
+            class="item-action-btn spacing"
+          >
+            <cds-icon-button
+              kind="danger"
+              size="sm"
+              (click)="removeRow(type, i)"
+            >
+              <svg
+                cdsIcon="trash-can"
+                size="32"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
           </div>
         </div>
@@ -220,4 +291,3 @@
     </div>
   </div>
 </ng-template>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.html
index 60d6331a7d4..8351da006ec 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.html
@@ -1,67 +1,121 @@
-<main cdsGrid
-      [fullWidth]="true"
-      [narrow]="true"
-      class="rgw-overview cds-mt-5">
-  <div cdsRow
-       class="cds-mb-5">
-    <div cdsCol
-         [columnNumbers]="{lg: 16}">
-      <cd-productive-card
-        [applyShadow]="false">
+<main
+  cdsGrid
+  [fullWidth]="true"
+  [narrow]="true"
+  class="rgw-overview cds-mt-5"
+>
+  <div
+    cdsRow
+    class="cds-mb-5"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ lg: 16 }"
+    >
+      <cd-productive-card [applyShadow]="false">
         <ng-template #header>
-          <h2 class="cds--type-heading-compact-02"
-              i18n>Overview</h2>
+          <h2
+            class="cds--type-heading-compact-02"
+            i18n
+          >
+            Overview
+          </h2>
         </ng-template>
         <div class="rgw-overview-grid">
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Gateway</span>
-            <a class="cds--link cds--type-body-compact-01"
-               routerLink="/rgw/daemon">{{ rgwDaemonCount }}</a>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Gateway</span
+            >
+            <a
+              class="cds--link cds--type-body-compact-01"
+              routerLink="/rgw/daemon"
+              >{{ rgwDaemonCount }}</a
+            >
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Realm</span>
-            <a class="cds--link cds--type-body-compact-01"
-               routerLink="/rgw/multisite">{{ rgwRealmCount }}</a>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Realm</span
+            >
+            <a
+              class="cds--link cds--type-body-compact-01"
+              routerLink="/rgw/multisite"
+              >{{ rgwRealmCount }}</a
+            >
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Zonegroup</span>
-            <a class="cds--link cds--type-body-compact-01"
-               routerLink="/rgw/multisite">{{ rgwZonegroupCount }}</a>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Zonegroup</span
+            >
+            <a
+              class="cds--link cds--type-body-compact-01"
+              routerLink="/rgw/multisite"
+              >{{ rgwZonegroupCount }}</a
+            >
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Zone</span>
-            <a class="cds--link cds--type-body-compact-01"
-               routerLink="/rgw/multisite">{{ rgwZoneCount }}</a>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Zone</span
+            >
+            <a
+              class="cds--link cds--type-body-compact-01"
+              routerLink="/rgw/multisite"
+              >{{ rgwZoneCount }}</a
+            >
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Bucket</span>
-            <a class="cds--link cds--type-body-compact-01"
-               routerLink="/rgw/bucket">{{ rgwBucketCount }}</a>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Bucket</span
+            >
+            <a
+              class="cds--link cds--type-body-compact-01"
+              routerLink="/rgw/bucket"
+              >{{ rgwBucketCount }}</a
+            >
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>User</span>
-            <a class="cds--link cds--type-body-compact-01"
-               routerLink="/rgw/user">{{ UserCount }}</a>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >User</span
+            >
+            <a
+              class="cds--link cds--type-body-compact-01"
+              routerLink="/rgw/user"
+              >{{ UserCount }}</a
+            >
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Object</span>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Object</span
+            >
             <span class="cds--type-body-compact-01">{{ objectCount }}</span>
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Used Capacity</span>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Used Capacity</span
+            >
             <span class="cds--type-body-compact-01">{{ totalPoolUsedBytes | dimlessBinary }}</span>
           </div>
           <div class="rgw-overview-grid__item">
-            <span class="cds--type-label-01"
-                  i18n>Average Object Size</span>
+            <span
+              class="cds--type-label-01"
+              i18n
+              >Average Object Size</span
+            >
             <span class="cds--type-body-compact-01">{{ averageObjectSize | dimlessBinary }}</span>
           </div>
         </div>
@@ -69,56 +123,76 @@
     </div>
   </div>
 
-  <div cdsRow
-       class="cds-mb-5">
-    <div cdsCol
-         [columnNumbers]="{lg: 16}">
-      <cd-productive-card
-        [applyShadow]="false">
+  <div
+    cdsRow
+    class="cds-mb-5"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ lg: 16 }"
+    >
+      <cd-productive-card [applyShadow]="false">
         <ng-template #header>
-          <h2 class="cds--type-heading-compact-02"
-              i18n>Performance Statistics</h2>
+          <h2
+            class="cds--type-heading-compact-02"
+            i18n
+          >
+            Performance Statistics
+          </h2>
           <cd-time-picker
             [dropdownSize]="'sm'"
             [label]="'Time Span'"
             (selectedTime)="getPrometheusData($event)"
           ></cd-time-picker>
         </ng-template>
-        <div cdsGrid
-             [narrow]="true"
-             [condensed]="false"
-             [fullWidth]="true">
-          <div cdsRow
-               [narrow]="true">
-            <div cdsCol
-                 class="cds-mb-5"
-                 [columnNumbers]="{lg: 5, md: 8, sm: 12}">
+        <div
+          cdsGrid
+          [narrow]="true"
+          [condensed]="false"
+          [fullWidth]="true"
+        >
+          <div
+            cdsRow
+            [narrow]="true"
+          >
+            <div
+              cdsCol
+              class="cds-mb-5"
+              [columnNumbers]="{ lg: 5, md: 8, sm: 12 }"
+            >
               <cd-area-chart
                 chartTitle="Requests/sec"
                 i18n-chartTitle
                 [dataUnit]="''"
-                [rawData]="requestsChartData">
+                [rawData]="requestsChartData"
+              >
               </cd-area-chart>
             </div>
-            <div cdsCol
-                 class="cds-mb-5"
-                 [columnNumbers]="{lg: 5, md: 8, sm: 12}">
+            <div
+              cdsCol
+              class="cds-mb-5"
+              [columnNumbers]="{ lg: 5, md: 8, sm: 12 }"
+            >
               <cd-area-chart
                 chartTitle="Latency"
                 i18n-chartTitle
                 [dataUnit]="'ms'"
                 [decimals]="2"
-                [rawData]="latencyChartData">
+                [rawData]="latencyChartData"
+              >
               </cd-area-chart>
             </div>
-            <div cdsCol
-                 class="cds-mb-5"
-                 [columnNumbers]="{lg: 5, md: 8, sm: 12}">
+            <div
+              cdsCol
+              class="cds-mb-5"
+              [columnNumbers]="{ lg: 5, md: 8, sm: 12 }"
+            >
               <cd-area-chart
                 chartTitle="Bandwidth"
                 i18n-chartTitle
                 [dataUnit]="'B'"
-                [rawData]="bandwidthChartData">
+                [rawData]="bandwidthChartData"
+              >
               </cd-area-chart>
             </div>
           </div>
@@ -128,76 +202,105 @@
   </div>
 
   <div cdsRow>
-    <div cdsCol
-         [columnNumbers]="{lg: 16}">
-      <cd-productive-card
-        [applyShadow]="false">
+    <div
+      cdsCol
+      [columnNumbers]="{ lg: 16 }"
+    >
+      <cd-productive-card [applyShadow]="false">
         <ng-template #header>
-          <h2 class="cds--type-heading-compact-02"
-              i18n>Multi-Site Sync Status</h2>
+          <h2
+            class="cds--type-heading-compact-02"
+            i18n
+          >
+            Multi-Site Sync Status
+          </h2>
         </ng-template>
         <ng-template #notConfigured>
-          <cd-alert-panel type="info"
-                          i18n>
-            Multi-site needs to be configured in order to see the multi-site sync status.
-            Please consult the&nbsp;<cd-doc section="multisite"></cd-doc>&nbsp;on how to configure and enable the multi-site functionality.
+          <cd-alert-panel
+            type="info"
+            i18n
+          >
+            Multi-site needs to be configured in order to see the multi-site sync status. Please
+            consult the&nbsp;<cd-doc section="multisite"></cd-doc>&nbsp;on how to configure and
+            enable the multi-site functionality.
           </cd-alert-panel>
         </ng-template>
         @if (loading) {
           <div class="multisite-sync__loading">
-            <cds-loading [isActive]="true"
-                         size="sm"></cds-loading>
+            <cds-loading
+              [isActive]="true"
+              size="sm"
+            ></cds-loading>
           </div>
         }
         @if (multisiteSyncStatus$ | async) {
           @if (showMultisiteCard) {
             <div class="multisite-sync__layout">
               <div class="multisite-sync__primary">
-                <h4 class="cds--type-heading-compact-01 multisite-sync__section-title"
-                    i18n>Primary Source Zone</h4>
+                <h4
+                  class="cds--type-heading-compact-01 multisite-sync__section-title"
+                  i18n
+                >
+                  Primary Source Zone
+                </h4>
                 <div class="multisite-sync__primary-content">
                   @if (loading) {
                     <div class="multisite-sync__loading">
-                      <cds-loading [isActive]="true"
-                                   size="sm"></cds-loading>
+                      <cds-loading
+                        [isActive]="true"
+                        size="sm"
+                      ></cds-loading>
                     </div>
                   } @else {
-                    <cd-rgw-sync-primary-zone [realm]="realm"
-                                              [zonegroup]="zonegroup"
-                                              [zone]="zone">
+                    <cd-rgw-sync-primary-zone
+                      [realm]="realm"
+                      [zonegroup]="zonegroup"
+                      [zone]="zone"
+                    >
                     </cd-rgw-sync-primary-zone>
                   }
                 </div>
               </div>
               <div class="multisite-sync__source-zones">
-                <h4 class="cds--type-heading-compact-01 multisite-sync__section-title multisite-sync__section-title--centered"
-                    i18n>Source Zones</h4>
+                <h4
+                  class="cds--type-heading-compact-01 multisite-sync__section-title multisite-sync__section-title--centered"
+                  i18n
+                >
+                  Source Zones
+                </h4>
                 @if (loading) {
                   <div class="multisite-sync__loading">
-                    <cds-loading [isActive]="true"
-                                 size="sm"></cds-loading>
+                    <cds-loading
+                      [isActive]="true"
+                      size="sm"
+                    ></cds-loading>
                   </div>
                 } @else {
                   <div class="multisite-sync__zones-grid">
                     @for (zone of replicaZonesInfo; track zone) {
                       <cds-tile class="multisite-sync__zone-tile">
                         <h5 class="multisite-sync__zone-header">
-                          <svg [cdsIcon]="icons.deploy"
-                               [size]="icons.size20"></svg>
+                          <svg
+                            [cdsIcon]="icons.deploy"
+                            [size]="icons.size20"
+                          ></svg>
                           <cds-tag class="tag-info">{{ zone.name }}</cds-tag>
                         </h5>
                         <div class="multisite-sync__sync-columns">
                           @for (title of chartTitles; track title) {
-                            <div class="multisite-sync__sync-item"
-                                 [class.multisite-sync__sync-item--bordered]="title === 'Data Sync'">
-                              <span class="cds--type-body-compact-01 multisite-sync__sync-title">{{ title }}</span>
+                            <div
+                              class="multisite-sync__sync-item"
+                              [class.multisite-sync__sync-item--bordered]="title === 'Data Sync'"
+                            >
+                              <span class="cds--type-body-compact-01 multisite-sync__sync-title">{{
+                                title
+                              }}</span>
                               @if (title === 'Metadata Sync') {
                                 <cd-rgw-sync-metadata-info [metadataSyncInfo]="metadataSyncInfo">
                                 </cd-rgw-sync-metadata-info>
                               }
                               @if (title === 'Data Sync') {
-                                <cd-rgw-sync-data-info [zone]="zone">
-                                </cd-rgw-sync-data-info>
+                                <cd-rgw-sync-data-info [zone]="zone"> </cd-rgw-sync-data-info>
                               }
                             </div>
                           }
@@ -216,4 +319,3 @@
     </div>
   </div>
 </main>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit-details/rgw-rate-limit-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit-details/rgw-rate-limit-details.component.html
index 9d19bdba2e2..6a0e316e819 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit-details/rgw-rate-limit-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit-details/rgw-rate-limit-details.component.html
@@ -1,51 +1,86 @@
-<legend i18n>{{type === 'user'? 'User Rate Limit': 'Bucket Rate Limit'}}</legend>
+<legend i18n>{{ type === 'user' ? 'User Rate Limit' : 'Bucket Rate Limit' }}</legend>
 <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
   <tbody>
     <tr>
-    <td i18n
-        class="bold w-25">Enabled</td>
-    <td class="w-75">{{ rateLimitConfig.enabled | booleanText }}</td>
+      <td
+        i18n
+        class="bold w-25"
+      >
+        Enabled
+      </td>
+      <td class="w-75">{{ rateLimitConfig.enabled | booleanText }}</td>
     </tr>
     <tr>
-    <td i18n
-        class="bold">Maximum Read Ops</td>
-    <td *ngIf="!rateLimitConfig.enabled">-</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_ops <= 0"
-        i18n>Unlimited</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_ops > 0">
-        {{ rateLimitConfig.max_read_ops}}
-    </td>
+      <td
+        i18n
+        class="bold"
+      >
+        Maximum Read Ops
+      </td>
+      <td *ngIf="!rateLimitConfig.enabled">-</td>
+      <td
+        *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_ops <= 0"
+        i18n
+      >
+        Unlimited
+      </td>
+      <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_ops > 0">
+        {{ rateLimitConfig.max_read_ops }}
+      </td>
     </tr>
     <tr>
-    <td i18n
-        class="bold">Maximum Write Ops</td>
-    <td *ngIf="!rateLimitConfig.enabled">-</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_ops <= 0"
-        i18n>Unlimited</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_ops > 0">
+      <td
+        i18n
+        class="bold"
+      >
+        Maximum Write Ops
+      </td>
+      <td *ngIf="!rateLimitConfig.enabled">-</td>
+      <td
+        *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_ops <= 0"
+        i18n
+      >
+        Unlimited
+      </td>
+      <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_ops > 0">
         {{ rateLimitConfig.max_write_ops }}
-    </td>
+      </td>
     </tr>
     <tr>
-    <td i18n
-        class="bold">Maximum Read Bytes</td>
-    <td *ngIf="!rateLimitConfig.enabled">-</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_bytes <= 0"
-        i18n>Unlimited</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_bytes > 0">
-        {{ rateLimitConfig.max_read_bytes | dimlessBinaryPerMinute}}
-    </td>
+      <td
+        i18n
+        class="bold"
+      >
+        Maximum Read Bytes
+      </td>
+      <td *ngIf="!rateLimitConfig.enabled">-</td>
+      <td
+        *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_bytes <= 0"
+        i18n
+      >
+        Unlimited
+      </td>
+      <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_read_bytes > 0">
+        {{ rateLimitConfig.max_read_bytes | dimlessBinaryPerMinute }}
+      </td>
     </tr>
     <tr>
-    <td i18n
-        class="bold">Maximum Write Bytes</td>
-    <td *ngIf="!rateLimitConfig.enabled">-</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_bytes <= 0"
-        i18n>Unlimited</td>
-    <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_bytes > 0">
-        {{ rateLimitConfig.max_write_bytes | dimlessBinaryPerMinute}}
-    </td>
+      <td
+        i18n
+        class="bold"
+      >
+        Maximum Write Bytes
+      </td>
+      <td *ngIf="!rateLimitConfig.enabled">-</td>
+      <td
+        *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_bytes <= 0"
+        i18n
+      >
+        Unlimited
+      </td>
+      <td *ngIf="rateLimitConfig.enabled && rateLimitConfig.max_write_bytes > 0">
+        {{ rateLimitConfig.max_write_bytes | dimlessBinaryPerMinute }}
+      </td>
     </tr>
   </tbody>
 </table>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit/rgw-rate-limit.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit/rgw-rate-limit.component.html
index 4777d78b5ad..5d4c1ea3c37 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit/rgw-rate-limit.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-rate-limit/rgw-rate-limit.component.html
@@ -1,6 +1,8 @@
 <fieldset *ngIf="type">
-  <legend class="cd-header"
-          i18n>
+  <legend
+    class="cd-header"
+    i18n
+  >
     Rate Limit
     <cd-help-text *ngIf="type === 'user'">
       The User Rate Limit controls the max read/write operations and data per minute for each user.
@@ -10,19 +12,25 @@
       bucket.
     </cd-help-text>
   </legend>
-  <form name="form"
-        #frm="ngForm"
-        [formGroup]="form"
-        novalidate>
-    <div class="row"
-         *ngIf="!!globalRateLimit && globalRateLimit.enabled">
+  <form
+    name="form"
+    #frm="ngForm"
+    [formGroup]="form"
+    novalidate
+  >
+    <div
+      class="row"
+      *ngIf="!!globalRateLimit && globalRateLimit.enabled"
+    >
       <div class="col-3"></div>
       <div class="col-9">
         <div>
-          <cd-alert-panel type="info"
-                          class="me-1"
-                          id="global-ratelimit-info"
-                          i18n>
+          <cd-alert-panel
+            type="info"
+            class="me-1"
+            id="global-ratelimit-info"
+            i18n
+          >
             <div>
               <span class="bold">Global Rate Limit</span> <br />Max. read bytes :
               {{ globalRateLimit.max_read_bytes | dimlessBinaryPerMinute }} <br />Max. read ops :
@@ -37,18 +45,24 @@
 
     <!-- Enabled -->
     <div class="form-item">
-      <cds-checkbox id="rate_limit_enabled"
-                    formControlName="rate_limit_enabled">
+      <cds-checkbox
+        id="rate_limit_enabled"
+        formControlName="rate_limit_enabled"
+      >
         <ng-container i18n>Enabled</ng-container>
         <cd-help-text i18n>Toggle to enable or disable the rate limit settings.</cd-help-text>
       </cds-checkbox>
     </div>
 
     <!-- Unlimited read ops -->
-    <div class="form-item"
-         *ngIf="form.controls.rate_limit_enabled.value">
-      <cds-checkbox id="rate_limit_max_readOps_unlimited"
-                    formControlName="rate_limit_max_readOps_unlimited">
+    <div
+      class="form-item"
+      *ngIf="form.controls.rate_limit_enabled.value"
+    >
+      <cds-checkbox
+        id="rate_limit_max_readOps_unlimited"
+        formControlName="rate_limit_max_readOps_unlimited"
+      >
         <ng-container i18n>Unlimited read ops</ng-container>
         <cd-help-text i18n>Select this box to allow unlimited read operations.</cd-help-text>
       </cds-checkbox>
@@ -61,15 +75,19 @@
         form.controls.rate_limit_enabled.value && !form.getValue('rate_limit_max_readOps_unlimited')
       "
     >
-      <cds-number id="rate_limit_max_readOps"
-                  formControlName="rate_limit_max_readOps"
-                  label="Maximum read ops"
-                  i18n-label
-                  cdRequiredField="Maximum read ops"
-                  helperText="Limits the number of read operations per minute for a user."
-                  i18n-helperText
-                  [invalid]="form.controls.rate_limit_max_readOps.invalid && form.controls.rate_limit_max_readOps.dirty"
-                  [invalidText]="rateLimitMaxReadOpsError">
+      <cds-number
+        id="rate_limit_max_readOps"
+        formControlName="rate_limit_max_readOps"
+        label="Maximum read ops"
+        i18n-label
+        cdRequiredField="Maximum read ops"
+        helperText="Limits the number of read operations per minute for a user."
+        i18n-helperText
+        [invalid]="
+          form.controls.rate_limit_max_readOps.invalid && form.controls.rate_limit_max_readOps.dirty
+        "
+        [invalidText]="rateLimitMaxReadOpsError"
+      >
       </cds-number>
 
       <ng-template #rateLimitMaxReadOpsError>
@@ -95,10 +113,14 @@
     </div>
 
     <!-- Unlimited Write Ops -->
-    <div class="form-item"
-         *ngIf="form.controls.rate_limit_enabled.value">
-      <cds-checkbox id="rate_limit_max_writeOps_unlimited"
-                    formControlName="rate_limit_max_writeOps_unlimited">
+    <div
+      class="form-item"
+      *ngIf="form.controls.rate_limit_enabled.value"
+    >
+      <cds-checkbox
+        id="rate_limit_max_writeOps_unlimited"
+        formControlName="rate_limit_max_writeOps_unlimited"
+      >
         <ng-container i18n>Unlimited write ops</ng-container>
         <cd-help-text i18n>Select this box to allow unlimited write operations.</cd-help-text>
       </cds-checkbox>
@@ -112,15 +134,20 @@
         !form.getValue('rate_limit_max_writeOps_unlimited')
       "
     >
-      <cds-number id="rate_limit_max_writeOps"
-                  formControlName="rate_limit_max_writeOps"
-                  label="Maximum write ops"
-                  i18n-label
-                  cdRequiredField="Maximum write ops"
-                  helperText="Limits the number of write operations per minute for a user."
-                  i18n-helperText
-                  [invalid]="form.controls.rate_limit_max_writeOps.invalid && form.controls.rate_limit_max_writeOps.dirty"
-                  [invalidText]="rateLimitMaxWriteOpsError">
+      <cds-number
+        id="rate_limit_max_writeOps"
+        formControlName="rate_limit_max_writeOps"
+        label="Maximum write ops"
+        i18n-label
+        cdRequiredField="Maximum write ops"
+        helperText="Limits the number of write operations per minute for a user."
+        i18n-helperText
+        [invalid]="
+          form.controls.rate_limit_max_writeOps.invalid &&
+          form.controls.rate_limit_max_writeOps.dirty
+        "
+        [invalidText]="rateLimitMaxWriteOpsError"
+      >
       </cds-number>
 
       <ng-template #rateLimitMaxWriteOpsError>
@@ -146,10 +173,14 @@
     </div>
 
     <!-- Unlimited Read Bytes -->
-    <div class="form-item"
-         *ngIf="form.controls.rate_limit_enabled.value">
-      <cds-checkbox id="rate_limit_max_readBytes_unlimited"
-                    formControlName="rate_limit_max_readBytes_unlimited">
+    <div
+      class="form-item"
+      *ngIf="form.controls.rate_limit_enabled.value"
+    >
+      <cds-checkbox
+        id="rate_limit_max_readBytes_unlimited"
+        formControlName="rate_limit_max_readBytes_unlimited"
+      >
         <ng-container i18n>Unlimited read bytes</ng-container>
         <cd-help-text i18n>Select this box to allow unlimited read bytes.</cd-help-text>
       </cds-checkbox>
@@ -163,41 +194,61 @@
         !form.getValue('rate_limit_max_readBytes_unlimited')
       "
     >
-      <cds-text-label labelInputID="rate_limit_max_readBytes"
-                      cdRequiredField="Maximum read bytes"
-                      helperText="Limits the number of read bytes per minute for a user."
-                      i18n-helperText
-                      [invalid]="form.controls.rate_limit_max_readBytes.invalid && form.controls.rate_limit_max_readBytes.dirty"
-                      [invalidText]="maxReadBytesError">
-        <input cdsText
-               id="rate_limit_max_readBytes"
-               formControlName="rate_limit_max_readBytes"
-               defaultUnit="b"
-               [invalid]="form.controls.rate_limit_max_readBytes.invalid && form.controls.rate_limit_max_readBytes.dirty"
-               cdDimlessBinaryPerMinute>
+      <cds-text-label
+        labelInputID="rate_limit_max_readBytes"
+        cdRequiredField="Maximum read bytes"
+        helperText="Limits the number of read bytes per minute for a user."
+        i18n-helperText
+        [invalid]="
+          form.controls.rate_limit_max_readBytes.invalid &&
+          form.controls.rate_limit_max_readBytes.dirty
+        "
+        [invalidText]="maxReadBytesError"
+      >
+        <input
+          cdsText
+          id="rate_limit_max_readBytes"
+          formControlName="rate_limit_max_readBytes"
+          defaultUnit="b"
+          [invalid]="
+            form.controls.rate_limit_max_readBytes.invalid &&
+            form.controls.rate_limit_max_readBytes.dirty
+          "
+          cdDimlessBinaryPerMinute
+        />
       </cds-text-label>
 
       <ng-template #maxReadBytesError>
         <span
           class="invalid-feedback"
           *ngIf="form.showError('rate_limit_max_readBytes', frm, 'required')"
-          i18n>This field is required.</span>
+          i18n
+          >This field is required.</span
+        >
         <span
           class="invalid-feedback"
           *ngIf="form.showError('rate_limit_max_readBytes', frm, 'rateByteMaxSize')"
-          i18n>The value is not valid.</span>
+          i18n
+          >The value is not valid.</span
+        >
         <span
           class="invalid-feedback"
           *ngIf="form.showError('rate_limit_max_readBytes', frm, 'min')"
-          i18n>Enter a positive number.</span>
+          i18n
+          >Enter a positive number.</span
+        >
       </ng-template>
     </div>
 
     <!-- Unlimited Write Bytes -->
-    <div class="form-item"
-         *ngIf="form.controls.rate_limit_enabled.value">
-      <cds-checkbox id="rate_limit_max_writeBytes_unlimited"
-                    formControlName="rate_limit_max_writeBytes_unlimited">
+    <div
+      class="form-item"
+      *ngIf="form.controls.rate_limit_enabled.value"
+    >
+      <cds-checkbox
+        id="rate_limit_max_writeBytes_unlimited"
+        formControlName="rate_limit_max_writeBytes_unlimited"
+      >
         <ng-container i18n>Unlimited write bytes</ng-container>
         <cd-help-text i18n>Select this box to allow unlimited write bytes.</cd-help-text>
       </cds-checkbox>
@@ -209,34 +260,51 @@
       *ngIf="
         form.controls.rate_limit_enabled.value &&
         !form.getValue('rate_limit_max_writeBytes_unlimited')
-      ">
-      <cds-text-label labelInputID="rate_limit_max_writeBytes"
-                      cdRequiredField="Maximum write bytes"
-                      helperText="Limits the number of write bytes per minute for a user."
-                      i18n-helperText
-                      [invalid]="form.controls.rate_limit_max_writeBytes.invalid && form.controls.rate_limit_max_writeBytes.dirty"
-                      [invalidText]="maxWriteBytesError">
-        <input cdsText
-               id="rate_limit_max_writeBytes"
-               formControlName="rate_limit_max_writeBytes"
-               defaultUnit="b"
-               [invalid]="form.controls.rate_limit_max_writeBytes.invalid && form.controls.rate_limit_max_writeBytes.dirty"
-               cdDimlessBinaryPerMinute>
+      "
+    >
+      <cds-text-label
+        labelInputID="rate_limit_max_writeBytes"
+        cdRequiredField="Maximum write bytes"
+        helperText="Limits the number of write bytes per minute for a user."
+        i18n-helperText
+        [invalid]="
+          form.controls.rate_limit_max_writeBytes.invalid &&
+          form.controls.rate_limit_max_writeBytes.dirty
+        "
+        [invalidText]="maxWriteBytesError"
+      >
+        <input
+          cdsText
+          id="rate_limit_max_writeBytes"
+          formControlName="rate_limit_max_writeBytes"
+          defaultUnit="b"
+          [invalid]="
+            form.controls.rate_limit_max_writeBytes.invalid &&
+            form.controls.rate_limit_max_writeBytes.dirty
+          "
+          cdDimlessBinaryPerMinute
+        />
       </cds-text-label>
 
       <ng-template #maxWriteBytesError>
         <span
           class="invalid-feedback"
           *ngIf="form.showError('rate_limit_max_readBytes', frm, 'required')"
-          i18n>This field is required.</span>
+          i18n
+          >This field is required.</span
+        >
         <span
           class="invalid-feedback"
           *ngIf="form.showError('rate_limit_max_readBytes', frm, 'rateByteMaxSize')"
-          i18n>The value is not valid.</span>
+          i18n
+          >The value is not valid.</span
+        >
         <span
           class="invalid-feedback"
           *ngIf="form.showError('rate_limit_max_readBytes', frm, 'min')"
-          i18n>Enter a positive number.</span>
+          i18n
+          >Enter a positive number.</span
+        >
       </ng-template>
     </div>
   </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html
index 04cef06411a..eab1e9a5435 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-details/rgw-storage-class-details.component.html
@@ -1,234 +1,281 @@
 <ng-container *ngIf="!!selection">
-  <cds-tabs type="contained"
-            theme="light">
+  <cds-tabs
+    type="contained"
+    theme="light"
+  >
     <cds-tab heading="Details">
       <table
         class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
         data-testid="rgw-storage-details"
       >
         <tbody>
-        @if(isTierMatch( TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER)){
-          <tr>
-            <td class="bold"
-                i18n>
-              Target Path
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ targetPathText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.target_path }}</td>
-          </tr>
-          <tr>
-            <td class="bold"
-                i18n>
-              Access key
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ targetAccessKeyText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>
-              <div cdsCol
-                   [columnNumbers]="{ md: 4 }"
-                   class="d-flex">
-                <input
-                  cdsPassword
-                  type="password"
-                  readonly
-                  id="access_key"
-                  [value]="selection?.access_key"
-                />
-                <button type="button"
-                        class="btn btn-light"
-                        cdPasswordButton="access_key"
-                        aria-label="Toggle access key visibility"
-                        i18n-aria-label></button>
-                <cd-copy-2-clipboard-button source="access_key"> </cd-copy-2-clipboard-button>
-              </div>
-            </td>
-          </tr>
-        }
-        @if(isTierMatch( TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER)){
-          <tr>
-            <td class="bold"
-                i18n>
-              Host Style
-              <cd-helper class="text-pre-wrap">
-                <span>{{ hostStyleText }}</span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.host_style }}</td>
-          </tr>
-          <tr>
-            <td class="bold"
-                i18n>
-              Head Object (Stub File)
-              <cd-helper class="text-pre-wrap">
-                <span> {{ retainHeadObjectText }}</span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.retain_head_object ? 'Enabled' : 'Disabled' }}</td>
-          </tr>
-          <tr>
-            <td class="bold"
-                i18n>
-              Allow Read Through
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ allowReadThroughText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.allow_read_through ? 'Enabled' : 'Disabled' }}</td>
-          </tr>
-          } @if(isTierMatch(TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER) &&
-          (selection?.allow_read_through)) {
-          <tr>
-            <td class="bold"
-                i18n>
-              Read through Restore Days
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ readthroughrestoreDaysText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>
-              {{ selection?.read_through_restore_days }}
-              {{ selection?.read_through_restore_days === 1 ? 'Day' : 'Days' }}
-            </td>
-          </tr>
-          } @if(isTierMatch( TIER_TYPE_DISPLAY.GLACIER)){
-          <tr>
-            <td class="bold"
-                i18n>
-              Glacier Restore Days
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ glacierRestoreDayText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>  {{ selection?.glacier_restore_days }}
-              {{ selection?.glacier_restore_days === 1 ? 'Day' : 'Days' }}</td>
-          </tr>
-          <tr>
-            <td class="bold"
-                i18n>
-              Glacier Restore Tier Type
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ glacierRestoreTiertypeText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.glacier_restore_tier_type }}</td>
-          </tr>
-          } @if(isTierMatch( TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER)){
-          <tr>
-            <td class="bold"
-                i18n>
-              Restore Storage Class
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ restoreStorageClassText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.restore_storage_class }}</td>
-          </tr>
-          <tr>
-            <td class="bold"
-                i18n>
-              Multipart Minimum Part Size
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ multipartMinPartText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.multipart_min_part_size | dimlessBinary }}</td>
-          </tr>
-          <tr>
-            <td class="bold"
-                i18n>
-              Multipart Sync Threshold
-              <cd-helper class="text-pre-wrap">
-                <span>
-                  {{ multipartSyncThreholdText }}
-                </span>
-              </cd-helper>
-            </td>
-            <td>{{ selection?.multipart_sync_threshold | dimlessBinary }}</td>
-          </tr>
-          } @if(selection?.acl_mappings?.length > 0) {
-          <tr>
-            <td class="bold w-25"
-                i18n>ACLs</td>
-            <td>
-              <ng-container *ngFor="let type of groupedACLs | keyvalue">
-                <div class="mb-2">
-                  <div class="cds--label">{{ type.key }}:</div>
-                  <div *ngFor="let item of type.value"
-                       [cdsStack]="'horizontal'"
-                       class="mt-1">
-                    <cds-tag size="sm"
-                             class="tags-background-gray">
-                      {{ item.source_id }} : {{ item.dest_id }}
-                    </cds-tag>
-                  </div>
+          @if (isTierMatch(TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER)) {
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Target Path
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ targetPathText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.target_path }}</td>
+            </tr>
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Access key
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ targetAccessKeyText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>
+                <div
+                  cdsCol
+                  [columnNumbers]="{ md: 4 }"
+                  class="d-flex"
+                >
+                  <input
+                    cdsPassword
+                    type="password"
+                    readonly
+                    id="access_key"
+                    [value]="selection?.access_key"
+                  />
+                  <button
+                    type="button"
+                    class="btn btn-light"
+                    cdPasswordButton="access_key"
+                    aria-label="Toggle access key visibility"
+                    i18n-aria-label
+                  ></button>
+                  <cd-copy-2-clipboard-button source="access_key"> </cd-copy-2-clipboard-button>
                 </div>
-              </ng-container>
-            </td>
-          </tr>
-         }
-         @if (isTierMatch(TIER_TYPE.LOCAL)) {
-          <tr>
-            <td class="bold">
-              Zone
-              <cd-helper class="text-pre-wrap">
-                <span i18n>
-                  A zone defines a logical group that consists of one or more Ceph Object Gateway instances.
-                </span>
-              </cd-helper>
-            </td>
-            <td>
-@if (loading) {
-              <cds-skeleton-text
-                [lines]="1"
-                [minLineWidth]="100"
-                [maxLineWidth]="200">
-              </cds-skeleton-text>
-            } @else {
-              <span>{{ localStorageClassDetails?.zone_name }}</span>
-            }
-            </td>
-          </tr>
-          <tr>
-            <td class="bold">
-              Data Pool
-              <cd-helper class="text-pre-wrap">
-                <span i18n>
+              </td>
+            </tr>
+          }
+          @if (isTierMatch(TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER)) {
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Host Style
+                <cd-helper class="text-pre-wrap">
+                  <span>{{ hostStyleText }}</span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.host_style }}</td>
+            </tr>
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Head Object (Stub File)
+                <cd-helper class="text-pre-wrap">
+                  <span> {{ retainHeadObjectText }}</span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.retain_head_object ? 'Enabled' : 'Disabled' }}</td>
+            </tr>
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Allow Read Through
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ allowReadThroughText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.allow_read_through ? 'Enabled' : 'Disabled' }}</td>
+            </tr>
+          }
+          @if (
+            isTierMatch(TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER) &&
+            selection?.allow_read_through
+          ) {
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Read through Restore Days
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ readthroughrestoreDaysText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>
+                {{ selection?.read_through_restore_days }}
+                {{ selection?.read_through_restore_days === 1 ? 'Day' : 'Days' }}
+              </td>
+            </tr>
+          }
+          @if (isTierMatch(TIER_TYPE_DISPLAY.GLACIER)) {
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Glacier Restore Days
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ glacierRestoreDayText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>
+                {{ selection?.glacier_restore_days }}
+                {{ selection?.glacier_restore_days === 1 ? 'Day' : 'Days' }}
+              </td>
+            </tr>
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Glacier Restore Tier Type
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ glacierRestoreTiertypeText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.glacier_restore_tier_type }}</td>
+            </tr>
+          }
+          @if (isTierMatch(TIER_TYPE_DISPLAY.CLOUD_TIER, TIER_TYPE_DISPLAY.GLACIER)) {
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Restore Storage Class
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ restoreStorageClassText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.restore_storage_class }}</td>
+            </tr>
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Multipart Minimum Part Size
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ multipartMinPartText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.multipart_min_part_size | dimlessBinary }}</td>
+            </tr>
+            <tr>
+              <td
+                class="bold"
+                i18n
+              >
+                Multipart Sync Threshold
+                <cd-helper class="text-pre-wrap">
+                  <span>
+                    {{ multipartSyncThreholdText }}
+                  </span>
+                </cd-helper>
+              </td>
+              <td>{{ selection?.multipart_sync_threshold | dimlessBinary }}</td>
+            </tr>
+          }
+          @if (selection?.acl_mappings?.length > 0) {
+            <tr>
+              <td
+                class="bold w-25"
+                i18n
+              >
+                ACLs
+              </td>
+              <td>
+                <ng-container *ngFor="let type of groupedACLs | keyvalue">
+                  <div class="mb-2">
+                    <div class="cds--label">{{ type.key }}:</div>
+                    <div
+                      *ngFor="let item of type.value"
+                      [cdsStack]="'horizontal'"
+                      class="mt-1"
+                    >
+                      <cds-tag
+                        size="sm"
+                        class="tags-background-gray"
+                      >
+                        {{ item.source_id }} : {{ item.dest_id }}
+                      </cds-tag>
+                    </div>
+                  </div>
+                </ng-container>
+              </td>
+            </tr>
+          }
+          @if (isTierMatch(TIER_TYPE.LOCAL)) {
+            <tr>
+              <td class="bold">
+                Zone
+                <cd-helper class="text-pre-wrap">
+                  <span i18n>
+                    A zone defines a logical group that consists of one or more Ceph Object Gateway
+                    instances.
+                  </span>
+                </cd-helper>
+              </td>
+              <td>
+                @if (loading) {
+                  <cds-skeleton-text
+                    [lines]="1"
+                    [minLineWidth]="100"
+                    [maxLineWidth]="200"
+                  >
+                  </cds-skeleton-text>
+                } @else {
+                  <span>{{ localStorageClassDetails?.zone_name }}</span>
+                }
+              </td>
+            </tr>
+            <tr>
+              <td class="bold">
+                Data Pool
+                <cd-helper class="text-pre-wrap">
+                  <span i18n>
                     The data pool contains the objects associated with this storage class.
-                </span>
-              </cd-helper>
-            </td>
-            <td>
-              @if (loading) {
-              <cds-skeleton-text
-                [lines]="1"
-                [minLineWidth]="100"
-                [maxLineWidth]="200">
-              </cds-skeleton-text>
-            } @else {
-              <span>{{ localStorageClassDetails?.data_pool }}</span>
-            }
-            </td>
-          </tr>
-         }
+                  </span>
+                </cd-helper>
+              </td>
+              <td>
+                @if (loading) {
+                  <cds-skeleton-text
+                    [lines]="1"
+                    [minLineWidth]="100"
+                    [maxLineWidth]="200"
+                  >
+                  </cds-skeleton-text>
+                } @else {
+                  <span>{{ localStorageClassDetails?.data_pool }}</span>
+                }
+              </td>
+            </tr>
+          }
           <tr>
             <td class="bold">
               Placement Target
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-form/rgw-storage-class-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-form/rgw-storage-class-form.component.html
index ddd7ac68bcc..b2df4636e8a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-form/rgw-storage-class-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-form/rgw-storage-class-form.component.html
@@ -1,12 +1,18 @@
-<div cdsCol
-     [columnNumbers]="{ md: 4 }">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="storageClassForm"
-          #formDir="ngForm"
-          [formGroup]="storageClassForm"
-          novalidate>
-      <div i18n="form title"
-           class="form-header">
+    <form
+      name="storageClassForm"
+      #formDir="ngForm"
+      [formGroup]="storageClassForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
         {{ action | titlecase }} {{ resource | upperFirst }}
 
         <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
@@ -22,21 +28,29 @@
           [invalid]="storageClassForm.showError('storageClassType', formDir, 'required')"
           [invalidText]="storageError"
         >
-          <option *ngFor="let opt of storageClassOptions"
-                  [value]="opt.value"
-                  i18n>
+          <option
+            *ngFor="let opt of storageClassOptions"
+            [value]="opt.value"
+            i18n
+          >
             {{ opt.label }}
           </option>
         </cds-select>
         <ng-template #storageError>
           @if (storageClassForm.showError('storageClassType', formDir, 'required')) {
-          <span class="invalid-feedback"
-                i18n> This field is required. </span>
+            <span
+              class="invalid-feedback"
+              i18n
+            >
+              This field is required.
+            </span>
           }
         </ng-template>
       </div>
-      <div class="form-item form-item-append"
-           cdsRow>
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <!-- Zonegroup -->
         <div cdsCol>
           <cds-select
@@ -59,356 +73,440 @@
           </cds-select>
           <ng-template #zonegroupError>
             @if (storageClassForm.showError('zonegroup', formDir, 'required')) {
-            <span class="invalid-feedback"
-                  i18n>This field is required.</span>
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
             }
           </ng-template>
         </div>
-        @if( isTierMatch(TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER )){
+        @if (isTierMatch(TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER)) {
           <div cdsCol>
             <ng-container *ngTemplateOutlet="storageClassField"></ng-container>
           </div>
         }
-        @if( isTierMatch(TIER_TYPE.LOCAL )){
-        <div cdsCol>
-          <cds-select
-            label="Zone"
-            i18n-label
-            formControlName="zone"
-            id="zone"
-            [invalid]="storageClassForm.showError('zone', formDir, 'required')"
-            [invalidText]="zoneError"
+        @if (isTierMatch(TIER_TYPE.LOCAL)) {
+          <div cdsCol>
+            <cds-select
+              label="Zone"
+              i18n-label
+              formControlName="zone"
+              id="zone"
+              [invalid]="storageClassForm.showError('zone', formDir, 'required')"
+              [invalidText]="zoneError"
+            >
+              <option
+                [value]="''"
+                i18n
+              >
+                --Select--
+              </option>
+              <option
+                *ngFor="let zone of zones"
+                [value]="zone?.name"
+                [selected]="zone.name === storageClassForm.getValue('zone')"
+                i18n
+              >
+                {{ zone.name }}
+              </option>
+            </cds-select>
+            <ng-template #zoneError>
+              <span
+                class="invalid-feedback"
+                *ngIf="storageClassForm.showError('zone', formDir, 'required')"
+                i18n
+                >This field is required.</span
+              >
+            </ng-template>
+          </div>
+        }
+      </div>
+      @if (isTierMatch(TIER_TYPE.LOCAL)) {
+        <ng-container *ngTemplateOutlet="storageClassField"></ng-container>
+        <div class="form-item clipboard">
+          <cd-alert-panel
+            type="info"
+            [showTitle]="false"
+            spacingClass="mb-2"
+            (action)="navigateCreatePool()"
           >
-            <option [value]="''"
-                    i18n>--Select--</option>
-            <option *ngFor="let zone of zones"
-                    [value]="zone?.name"
-                    [selected]="zone.name === storageClassForm.getValue('zone')"
-                    i18n>
-              {{ zone.name }}
+            <span i18n>To create a new pool click <a [routerLink]="[POOL.PATH]">here</a></span>
+          </cd-alert-panel>
+          <cds-select
+            label="Pool"
+            i18n-label
+            formControlName="pool"
+            id="pool"
+            [invalid]="storageClassForm.showError('pool', formDir, 'required')"
+            [invalidText]="poolError"
+          >
+            <option
+              [value]="''"
+              i18n
+            >
+              --Select--
+            </option>
+            <option
+              *ngFor="let pool of rgwPools"
+              [value]="pool.pool_name"
+              i18n
+            >
+              {{ pool.pool_name }}
             </option>
           </cds-select>
-          <ng-template #zoneError>
+          <ng-template #poolError>
             <span
               class="invalid-feedback"
-              *ngIf="storageClassForm.showError('zone', formDir, 'required')"
+              *ngIf="storageClassForm.showError('pool', formDir, 'required')"
               i18n
               >This field is required.</span
             >
           </ng-template>
         </div>
-        }
-      </div>
-      @if( isTierMatch(TIER_TYPE.LOCAL )){
-        <ng-container *ngTemplateOutlet="storageClassField"></ng-container>
-        <div class="form-item clipboard">
-        <cd-alert-panel type="info"
-                        [showTitle]="false"
-                        spacingClass="mb-2"
-                        (action)="navigateCreatePool()">
-          <span i18n>To create a new pool click <a [routerLink]="[POOL.PATH]">here</a></span>
-        </cd-alert-panel>
-        <cds-select
-          label="Pool"
-          i18n-label
-          formControlName="pool"
-          id="pool"
-          [invalid]="storageClassForm.showError('pool', formDir, 'required')"
-          [invalidText]="poolError"
-        >
-          <option [value]="''"
-                  i18n>--Select--</option>
-          <option *ngFor="let pool of rgwPools"
-                  [value]="pool.pool_name"
-                  i18n>
-            {{ pool.pool_name }}
-          </option>
-        </cds-select>
-        <ng-template #poolError>
-          <span
-            class="invalid-feedback"
-            *ngIf="storageClassForm.showError('pool', formDir, 'required')"
-            i18n
-            >This field is required.</span
+      }
+      @if (isTierMatch(TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER)) {
+        <div>
+          <div
+            class="form-item form-item-append"
+            cdsRow
           >
-        </ng-template>
-      </div>
-      } @if( isTierMatch( TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER )){
-      <div>
-        <div class="form-item form-item-append"
-             cdsRow>
-          <div cdsCol>
-            <!-- Target Region -->
-            <cds-text-label
-              labelInputID="region"
-              i18n
-              [invalid]="storageClassForm.showError('region', formDir, 'required')"
-              [invalidText]="regionError"
-              [helperText]="helpTextLabels.targetRegionText"
-              >Target Region
-              <input
-                cdsText
-                type="text"
-                id="region"
-                formControlName="region"
-                placeholder="e.g, us-east-1"
-                i18n-placeholder
+            <div cdsCol>
+              <!-- Target Region -->
+              <cds-text-label
+                labelInputID="region"
+                i18n
                 [invalid]="storageClassForm.showError('region', formDir, 'required')"
-              />
-            </cds-text-label>
-            <ng-template #regionError>
-              @if (storageClassForm.showError('region', formDir, 'required')) {
-              <span class="invalid-feedback"
-                    i18n>This field is required.</span>
-              }
-            </ng-template>
-          </div>
-          <div cdsCol>
-            <!-- Target Endpoint -->
-            <cds-text-label
-              labelInputID="target_endpoint"
-              i18n
-              [invalid]="
-                storageClassForm.showError('target_endpoint', formDir, 'invalidURL') ||
-                storageClassForm.showError('target_endpoint', formDir, 'required')
-              "
-              [invalidText]="endpointError"
-              [helperText]="helpTextLabels.targetEndpointText"
-              >Target Endpoint
-              <input
-                cdsText
-                type="text"
-                placeholder="http://ceph-node-00.com:80"
-                i18n-placeholder
-                id="target_endpoint"
-                formControlName="target_endpoint"
+                [invalidText]="regionError"
+                [helperText]="helpTextLabels.targetRegionText"
+                >Target Region
+                <input
+                  cdsText
+                  type="text"
+                  id="region"
+                  formControlName="region"
+                  placeholder="e.g, us-east-1"
+                  i18n-placeholder
+                  [invalid]="storageClassForm.showError('region', formDir, 'required')"
+                />
+              </cds-text-label>
+              <ng-template #regionError>
+                @if (storageClassForm.showError('region', formDir, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                    >This field is required.</span
+                  >
+                }
+              </ng-template>
+            </div>
+            <div cdsCol>
+              <!-- Target Endpoint -->
+              <cds-text-label
+                labelInputID="target_endpoint"
+                i18n
                 [invalid]="
                   storageClassForm.showError('target_endpoint', formDir, 'invalidURL') ||
                   storageClassForm.showError('target_endpoint', formDir, 'required')
                 "
                 [invalidText]="endpointError"
+                [helperText]="helpTextLabels.targetEndpointText"
+                >Target Endpoint
+                <input
+                  cdsText
+                  type="text"
+                  placeholder="http://ceph-node-00.com:80"
+                  i18n-placeholder
+                  id="target_endpoint"
+                  formControlName="target_endpoint"
+                  [invalid]="
+                    storageClassForm.showError('target_endpoint', formDir, 'invalidURL') ||
+                    storageClassForm.showError('target_endpoint', formDir, 'required')
+                  "
+                  [invalidText]="endpointError"
+                />
+              </cds-text-label>
+              <ng-template #endpointError>
+                @if (storageClassForm.showError('target_endpoint', formDir, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    This field is required.
+                  </span>
+                } @else if (storageClassForm.showError('target_endpoint', formDir, 'invalidURL')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    Please enter a valid URL.</span
+                  >
+                }
+              </ng-template>
+            </div>
+          </div>
+          <!-- Access Key  -->
+          <div class="form-item">
+            <div
+              cdsCol
+              [columnNumbers]="{ md: 12 }"
+              class="d-flex"
+            >
+              <cds-password-label
+                labelInputID="access_key"
+                [invalid]="storageClassForm.showError('access_key', formDir, 'required')"
+                [invalidText]="accessError"
+                [helperText]="helpTextLabels.targetAccessKeyText"
+                i18n
+                >Target Access Key
+                <input
+                  cdsPassword
+                  type="password"
+                  id="access_key"
+                  formControlName="access_key"
+                  [invalid]="storageClassForm.showError('access_key', formDir, 'required')"
+                />
+              </cds-password-label>
+              <cd-copy-2-clipboard-button class="clipboard"></cd-copy-2-clipboard-button>
+              <ng-template #accessError>
+                @if (storageClassForm.showError('access_key', formDir, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    This field is required.
+                  </span>
+                }
+              </ng-template>
+            </div>
+          </div>
+          <!-- Secret Key  -->
+          <div class="form-item">
+            <div
+              cdsCol
+              [columnNumbers]="{ md: 12 }"
+              class="d-flex"
+            >
+              <cds-password-label
+                labelInputID="secret_key"
+                [helperText]="helpTextLabels.targetSecretKeyText"
+                [invalid]="storageClassForm.showError('secret_key', formDir, 'required')"
+                [invalidText]="secretError"
+                i18n
+                >Target Secret Key
+                <input
+                  cdsPassword
+                  type="password"
+                  id="secret_key"
+                  formControlName="secret_key"
+                  [invalid]="storageClassForm.showError('secret_key', formDir, 'required')"
+                />
+              </cds-password-label>
+              <cd-copy-2-clipboard-button class="clipboard"> </cd-copy-2-clipboard-button>
+              <ng-template #secretError>
+                @if (storageClassForm.showError('secret_key', formDir, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    This field is required.
+                  </span>
+                }
+              </ng-template>
+            </div>
+          </div>
+          <!-- Target Path -->
+          <div class="form-item">
+            <cds-text-label
+              labelInputID="target_path"
+              i18n
+              [invalid]="storageClassForm.showError('target_path', formDir, 'required')"
+              [invalidText]="targetError"
+              [helperText]="helpTextLabels.targetPathText"
+              >Target Path
+              <input
+                cdsText
+                type="text"
+                id="target_path"
+                formControlName="target_path"
+                [invalid]="storageClassForm.showError('target_path', formDir, 'required')"
               />
             </cds-text-label>
-            <ng-template #endpointError>
-              @if (storageClassForm.showError('target_endpoint', formDir, 'required')) {
-              <span class="invalid-feedback"
-                    i18n> This field is required. </span>
-              } @else if (storageClassForm.showError('target_endpoint', formDir, 'invalidURL')) {
-              <span class="invalid-feedback"
-                    i18n> Please enter a valid URL.</span>
+            <ng-template #targetError>
+              @if (storageClassForm.showError('target_path', formDir, 'required')) {
+                <span
+                  class="invalid-feedback"
+                  i18n
+                >
+                  This field is required.
+                </span>
               }
             </ng-template>
           </div>
-        </div>
-        <!-- Access Key  -->
-        <div class="form-item">
-          <div cdsCol
-               [columnNumbers]="{ md: 12 }"
-               class="d-flex">
-            <cds-password-label
-              labelInputID="access_key"
-              [invalid]="storageClassForm.showError('access_key', formDir, 'required')"
-              [invalidText]="accessError"
-              [helperText]="helpTextLabels.targetAccessKeyText"
+          <div class="form-item">
+            <cds-checkbox
+              id="allow_read_through"
+              formControlName="allow_read_through"
+              cdOptionalField="Allow Read Through"
               i18n
-              >Target Access Key
-              <input
-                cdsPassword
-                type="password"
-                id="access_key"
-                formControlName="access_key"
-                [invalid]="storageClassForm.showError('access_key', formDir, 'required')"
-              />
-            </cds-password-label>
-            <cd-copy-2-clipboard-button class="clipboard"></cd-copy-2-clipboard-button>
-            <ng-template #accessError>
-              @if (storageClassForm.showError('access_key', formDir, 'required')) {
-              <span class="invalid-feedback"
-                    i18n> This field is required. </span>
-              }
-            </ng-template>
+              (change)="onAllowReadThroughChange($event)"
+              >Allow Read Through
+              <cd-help-text>{{ helpTextLabels?.allowReadThroughText }}</cd-help-text>
+            </cds-checkbox>
           </div>
-        </div>
-        <!-- Secret Key  -->
-        <div class="form-item">
-          <div cdsCol
-               [columnNumbers]="{ md: 12 }"
-               class="d-flex">
-            <cds-password-label
-              labelInputID="secret_key"
-              [helperText]="helpTextLabels.targetSecretKeyText"
-              [invalid]="storageClassForm.showError('secret_key', formDir, 'required')"
-              [invalidText]="secretError"
+          <div class="form-item">
+            <cds-checkbox
+              id="retain_head_object"
+              formControlName="retain_head_object"
+              cdOptionalField="Head Object (Stub File)"
               i18n
-              >Target Secret Key
-              <input
-                cdsPassword
-                type="password"
-                id="secret_key"
-                formControlName="secret_key"
-                [invalid]="storageClassForm.showError('secret_key', formDir, 'required')"
-              />
-            </cds-password-label>
-            <cd-copy-2-clipboard-button class="clipboard"> </cd-copy-2-clipboard-button>
-            <ng-template #secretError>
-              @if (storageClassForm.showError('secret_key', formDir, 'required')) {
-              <span class="invalid-feedback"
-                    i18n> This field is required. </span>
-              }
-            </ng-template>
+              >Head Object (Stub File)
+              <cd-help-text>{{ helpTextLabels?.retainHeadObjectText }}</cd-help-text>
+            </cds-checkbox>
+          </div>
+          <div
+            class="form-item form-item-append"
+            cdsRow
+          >
+            <div cdsCol>
+              <cds-number
+                name="read_through_restore_days"
+                formControlName="read_through_restore_days"
+                id="read_through_restore_days"
+                min="1"
+                label="ReadThrough Restore Days"
+                [helperText]="helpTextLabels.readthroughrestoreDaysText"
+                i18n-helperText
+                i18n-label
+                i18n
+                [invalid]="
+                  storageClassForm.controls.read_through_restore_days.invalid &&
+                  storageClassForm.controls.read_through_restore_days.dirty
+                "
+                [invalidText]="readThroughError"
+              ></cds-number>
+              <ng-template #readThroughError>
+                @if (storageClassForm.showError('read_through_restore_days', formDir, 'pattern')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    ReadThrough Restore Days must be positive.
+                  </span>
+                }
+              </ng-template>
+            </div>
+            <div cdsCol>
+              <cds-select
+                formControlName="restore_storage_class"
+                label="Restore Storage Class"
+                id="restore_storage_class"
+                [helperText]="helpTextLabels.restoreStorageClassText"
+                i18n-label
+              >
+                <option
+                  [value]="''"
+                  i18n
+                >
+                  -- Select the glacier restore storage class --
+                </option>
+                <option
+                  [ngValue]="standard"
+                  i18n
+                >
+                  Standard
+                </option>
+              </cds-select>
+            </div>
           </div>
         </div>
-        <!-- Target Path -->
-        <div class="form-item">
-          <cds-text-label
-            labelInputID="target_path"
+      }
+      @if (isTierMatch(TIER_TYPE.GLACIER)) {
+        <div>
+          <legend
+            class="cd-header"
             i18n
-            [invalid]="storageClassForm.showError('target_path', formDir, 'required')"
-            [invalidText]="targetError"
-            [helperText]="helpTextLabels.targetPathText"
-            >Target Path
-            <input
-              cdsText
-              type="text"
-              id="target_path"
-              formControlName="target_path"
-              [invalid]="storageClassForm.showError('target_path', formDir, 'required')"
-            />
-          </cds-text-label>
-          <ng-template #targetError>
-            @if (storageClassForm.showError('target_path', formDir, 'required')) {
-            <span class="invalid-feedback"
-                  i18n> This field is required. </span>
-            }
-          </ng-template>
-        </div>
-        <div class="form-item">
-          <cds-checkbox
-            id="allow_read_through"
-            formControlName="allow_read_through"
-            cdOptionalField="Allow Read Through"
-            i18n
-            (change)="onAllowReadThroughChange($event)"
-            >Allow Read Through
-            <cd-help-text>{{ helpTextLabels?.allowReadThroughText }}</cd-help-text>
-          </cds-checkbox>
-        </div>
-        <div class="form-item">
-          <cds-checkbox
-            id="retain_head_object"
-            formControlName="retain_head_object"
-            cdOptionalField="Head Object (Stub File)"
-            i18n
-            >Head Object (Stub File)
-            <cd-help-text>{{ helpTextLabels?.retainHeadObjectText }}</cd-help-text>
-          </cds-checkbox>
-        </div>
-        <div class="form-item form-item-append"
-             cdsRow>
-          <div cdsCol>
-            <cds-number
-              name="read_through_restore_days"
-              formControlName="read_through_restore_days"
-              id="read_through_restore_days"
-              min="1"
-              label="ReadThrough Restore Days"
-              [helperText]="helpTextLabels.readthroughrestoreDaysText"
-              i18n-helperText
-              i18n-label
-              i18n
-              [invalid]="
-                storageClassForm.controls.read_through_restore_days.invalid &&
-                storageClassForm.controls.read_through_restore_days.dirty
-              "
-              [invalidText]="readThroughError"
-            ></cds-number>
-            <ng-template #readThroughError>
-              @if (storageClassForm.showError('read_through_restore_days', formDir, 'pattern')) {
-              <span class="invalid-feedback"
-                    i18n>
-                ReadThrough Restore Days must be positive.
-              </span>
-              }
-            </ng-template>
-          </div>
-          <div cdsCol>
-            <cds-select
-              formControlName="restore_storage_class"
-              label="Restore Storage Class"
-              id="restore_storage_class"
-              [helperText]="helpTextLabels.restoreStorageClassText"
-              i18n-label
-            >
-              <option [value]="''"
-                      i18n>-- Select the glacier restore storage class --</option>
-              <option [ngValue]="standard"
-                      i18n>Standard</option>
-            </cds-select>
+          >
+            Glacier Configuration
+          </legend>
+          <div
+            class="form-item form-item-append"
+            cdsRow
+          >
+            <div cdsCol>
+              <cds-select
+                formControlName="glacier_restore_tier_type"
+                label="Glacier Restore Tier Type"
+                cdRequiredField="Glacier Restore Tier Type"
+                id="glacier_restore_tier_type"
+                [invalid]="
+                  storageClassForm.controls.glacier_restore_tier_type.invalid &&
+                  storageClassForm.controls.glacier_restore_tier_type.dirty
+                "
+                [invalidText]="glacierError"
+                [helperText]="helpTextLabels.tiertypeText"
+                i18n-label
+              >
+                <option
+                  value="''"
+                  i18n
+                >
+                  -- Select the glacier restore tier type --
+                </option>
+                <option
+                  [ngValue]="standard"
+                  i18n
+                >
+                  Standard
+                </option>
+                <option
+                  [ngValue]="expedited"
+                  i18n
+                >
+                  Expedited
+                </option>
+              </cds-select>
+              <ng-template #glacierError>
+                @if (storageClassForm.showError('glacier_restore_tier_type', formDir, 'required')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    This field is required.
+                  </span>
+                }
+              </ng-template>
+            </div>
+            <div cdsCol>
+              <cds-number
+                [id]="'glacier_restore_days'"
+                [formControlName]="'glacier_restore_days'"
+                [label]="'Glacier Restore Days'"
+                [helperText]="helpTextLabels.restoreDaysText"
+                [min]="1"
+                i18n-helperText
+                i18n-label
+                i18n
+                [invalid]="
+                  storageClassForm.controls.glacier_restore_days.invalid &&
+                  storageClassForm.controls.glacier_restore_days.dirty
+                "
+                [invalidText]="glacierRestoreError"
+              >
+              </cds-number>
+              <ng-template #glacierRestoreError>
+                @if (storageClassForm.showError('glacier_restore_days', formDir, 'pattern')) {
+                  <span
+                    class="invalid-feedback"
+                    i18n
+                  >
+                    The entered value must be a positive integer.
+                  </span>
+                }
+              </ng-template>
+            </div>
           </div>
         </div>
-      </div>
-      } @if(isTierMatch(TIER_TYPE.GLACIER)){
-      <div>
-        <legend class="cd-header"
-                i18n>Glacier Configuration</legend>
-        <div class="form-item form-item-append"
-             cdsRow>
-          <div cdsCol>
-            <cds-select
-              formControlName="glacier_restore_tier_type"
-              label="Glacier Restore Tier Type"
-              cdRequiredField="Glacier Restore Tier Type"
-              id="glacier_restore_tier_type"
-              [invalid]="
-                storageClassForm.controls.glacier_restore_tier_type.invalid &&
-                storageClassForm.controls.glacier_restore_tier_type.dirty
-              "
-              [invalidText]="glacierError"
-              [helperText]="helpTextLabels.tiertypeText"
-              i18n-label
-            >
-              <option value="''"
-                      i18n>-- Select the glacier restore tier type --</option>
-              <option [ngValue]="standard"
-                      i18n>Standard</option>
-              <option [ngValue]="expedited"
-                      i18n>Expedited</option>
-            </cds-select>
-            <ng-template #glacierError>
-              @if (storageClassForm.showError('glacier_restore_tier_type', formDir, 'required')) {
-              <span class="invalid-feedback"
-                    i18n> This field is required. </span>
-              }
-            </ng-template>
-          </div>
-          <div cdsCol>
-            <cds-number
-              [id]="'glacier_restore_days'"
-              [formControlName]="'glacier_restore_days'"
-              [label]="'Glacier Restore Days'"
-              [helperText]="helpTextLabels.restoreDaysText"
-              [min]="1"
-              i18n-helperText
-              i18n-label
-              i18n
-              [invalid]="
-                storageClassForm.controls.glacier_restore_days.invalid &&
-                storageClassForm.controls.glacier_restore_days.dirty
-              "
-              [invalidText]="glacierRestoreError"
-            >
-            </cds-number>
-            <ng-template #glacierRestoreError>
-              @if (storageClassForm.showError('glacier_restore_days', formDir, 'pattern')) {
-              <span class="invalid-feedback"
-                    i18n>
-                The entered value must be a positive integer.
-              </span>
-              }
-            </ng-template>
-          </div>
-        </div>
-      </div>
       }
       <fieldset>
         <div>
@@ -416,161 +514,211 @@
             <h5 class="cds--accordion__title cd-header">Advanced</h5>
           </ng-template>
           <fieldset>
-            <cds-accordion size="lg"
-                           class="form-item">
+            <cds-accordion
+              size="lg"
+              class="form-item"
+            >
               <cds-accordion-item
                 [title]="title"
                 id="advanced-fieldset"
                 (selected)="showAdvanced = !showAdvanced"
               >
-                @if( isTierMatch( TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER )){
-                <!-- Multi Part Sync Threshold -->
-                <div class="form-item form-item-append"
-                     cdsRow>
-                  <div cdsCol>
-                    <cds-text-label
-                      labelInputID="multipart_sync_threshold"
-                      i18n
-                      [helperText]="helpTextLabels.multipartSyncThresholdText"
-                      cdOptionalField="Multipart Sync Threshold"
-                      >Multipart Sync Threshold
-                      <input
-                        cdsText
-                        type="text"
-                        id="multipart_sync_threshold"
-                        formControlName="multipart_sync_threshold"
-                        cdDimlessBinary
-                      />
-                    </cds-text-label>
+                @if (isTierMatch(TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER)) {
+                  <!-- Multi Part Sync Threshold -->
+                  <div
+                    class="form-item form-item-append"
+                    cdsRow
+                  >
+                    <div cdsCol>
+                      <cds-text-label
+                        labelInputID="multipart_sync_threshold"
+                        i18n
+                        [helperText]="helpTextLabels.multipartSyncThresholdText"
+                        cdOptionalField="Multipart Sync Threshold"
+                        >Multipart Sync Threshold
+                        <input
+                          cdsText
+                          type="text"
+                          id="multipart_sync_threshold"
+                          formControlName="multipart_sync_threshold"
+                          cdDimlessBinary
+                        />
+                      </cds-text-label>
+                    </div>
+                    <div cdsCol>
+                      <cds-text-label
+                        labelInputID="multipart_min_part_size"
+                        i18n
+                        [helperText]="helpTextLabels.multipartMinPartText"
+                        cdOptionalField="Multipart Minimum Part Size"
+                        >Multipart Minimum Part Size
+                        <input
+                          cdsText
+                          type="text"
+                          id="multipart_min_part_size"
+                          formControlName="multipart_min_part_size"
+                          cdDimlessBinary
+                        />
+                      </cds-text-label>
+                    </div>
                   </div>
-                  <div cdsCol>
-                    <cds-text-label
-                      labelInputID="multipart_min_part_size"
+                  <!-- ACLs -->
+                  <div>
+                    <legend
+                      class="cd-header"
                       i18n
-                      [helperText]="helpTextLabels.multipartMinPartText"
-                      cdOptionalField="Multipart Minimum Part Size"
-                      >Multipart Minimum Part Size
-                      <input
-                        cdsText
-                        type="text"
-                        id="multipart_min_part_size"
-                        formControlName="multipart_min_part_size"
-                        cdDimlessBinary
-                      />
-                    </cds-text-label>
-                  </div>
-                </div>
-                <!-- ACLs -->
-                <div>
-                  <legend class="cd-header"
-                          i18n>ACLs Mapping</legend>
-                  <ng-container formArrayName="acls">
-                    @for (acl of acls.controls; let i = $index; track acl) {
-                    <ng-container [formGroupName]="i">
-                      <div class="form-item form-item-append"
-                           cdsRow>
-                        <div cdsCol
-                             [columnNumbers]="{ lg: 7 }">
-                          <cds-select id="type"
-                                      formControlName="type"
-                                      i18n-label
-                                      label="Type">
-                            @for (type of typeOptions; track type.value) {
-                            <option [value]="type.value"
-                                    i18n>
-                              {{ type.label }}
-                            </option>
-                            }
-                          </cds-select>
-                        </div>
-                      </div>
-                      <div cdsRow
-                           class="form-item form-item-append">
-                        <div cdsCol>
-                          <cds-text-label
-                            labelInputID="source_id"
-                            i18n
-                            [helperText]="getAclHelperText(acl.get('type')?.value, 'source')"
-                            [invalid]="
-                              acl.get('source_id')?.invalid && acl.get('source_id')?.touched
-                            "
-                            [invalidText]="
-                            acl.get('source_id')?.errors?.['required'] ? 'This field is required.' :
-                            acl.get('source_id')?.errors?.['email'] ? 'Please enter a valid email address.' :
-                            acl.get('source_id')?.errors?.['invalidUrl'] ? 'Please enter a valid URL.' : ''
-                          "
+                    >
+                      ACLs Mapping
+                    </legend>
+                    <ng-container formArrayName="acls">
+                      @for (acl of acls.controls; let i = $index; track acl) {
+                        <ng-container [formGroupName]="i">
+                          <div
+                            class="form-item form-item-append"
+                            cdsRow
                           >
-                            {{ getAclLabel('source', acl.get('type')?.value) }}
-                            <input
-                              cdsText
-                              type="text"
-                              formControlName="source_id"
-                              [invalidText]="
-                            acl.get('source_id')?.errors?.['required'] ? 'This field is required.' :
-                            acl.get('source_id')?.errors?.['email'] ? 'Please enter a valid email address.' :
-                            acl.get('source_id')?.errors?.['invalidUrl'] ? 'Please enter a valid URL.' : ''
-                          "
-                            />
-                          </cds-text-label>
-                        </div>
-                        <div cdsCol>
-                          <cds-text-label
-                            labelInputID="dest_id"
-                            i18n
-                            [helperText]="getAclHelperText(acl.get('type')?.value, 'destination')"
-                            [invalid]="acl.get('dest_id')?.invalid && acl.get('dest_id')?.touched"
-                            [invalidText]="
-                              acl.get('dest_id')?.errors?.['required'] ? 'This field is required.' :
-                              acl.get('dest_id')?.errors?.['email'] ? 'Please enter a valid email address.' :
-                              acl.get('dest_id')?.errors?.['invalidUrl'] ? 'Please enter a valid URL.' : ''
-                            "
+                            <div
+                              cdsCol
+                              [columnNumbers]="{ lg: 7 }"
+                            >
+                              <cds-select
+                                id="type"
+                                formControlName="type"
+                                i18n-label
+                                label="Type"
+                              >
+                                @for (type of typeOptions; track type.value) {
+                                  <option
+                                    [value]="type.value"
+                                    i18n
+                                  >
+                                    {{ type.label }}
+                                  </option>
+                                }
+                              </cds-select>
+                            </div>
+                          </div>
+                          <div
+                            cdsRow
+                            class="form-item form-item-append"
                           >
-                            {{ getAclLabel('destination', acl.get('type')?.value) }}
-                            <input
-                              cdsText
-                              type="text"
-                              formControlName="dest_id"
-                              [invalidText]="
-                              acl.get('dest_id')?.errors?.['required'] ? 'This field is required.' :
-                              acl.get('dest_id')?.errors?.['email'] ? 'Please enter a valid email address.' :
-                              acl.get('dest_id')?.errors?.['invalidUrl'] ? 'Please enter a valid URL.' : ''
-                            "
-                            />
-                          </cds-text-label>
-                        </div>
+                            <div cdsCol>
+                              <cds-text-label
+                                labelInputID="source_id"
+                                i18n
+                                [helperText]="getAclHelperText(acl.get('type')?.value, 'source')"
+                                [invalid]="
+                                  acl.get('source_id')?.invalid && acl.get('source_id')?.touched
+                                "
+                                [invalidText]="
+                                  acl.get('source_id')?.errors?.['required']
+                                    ? 'This field is required.'
+                                    : acl.get('source_id')?.errors?.['email']
+                                      ? 'Please enter a valid email address.'
+                                      : acl.get('source_id')?.errors?.['invalidUrl']
+                                        ? 'Please enter a valid URL.'
+                                        : ''
+                                "
+                              >
+                                {{ getAclLabel('source', acl.get('type')?.value) }}
+                                <input
+                                  cdsText
+                                  type="text"
+                                  formControlName="source_id"
+                                  [invalidText]="
+                                    acl.get('source_id')?.errors?.['required']
+                                      ? 'This field is required.'
+                                      : acl.get('source_id')?.errors?.['email']
+                                        ? 'Please enter a valid email address.'
+                                        : acl.get('source_id')?.errors?.['invalidUrl']
+                                          ? 'Please enter a valid URL.'
+                                          : ''
+                                  "
+                                />
+                              </cds-text-label>
+                            </div>
+                            <div cdsCol>
+                              <cds-text-label
+                                labelInputID="dest_id"
+                                i18n
+                                [helperText]="
+                                  getAclHelperText(acl.get('type')?.value, 'destination')
+                                "
+                                [invalid]="
+                                  acl.get('dest_id')?.invalid && acl.get('dest_id')?.touched
+                                "
+                                [invalidText]="
+                                  acl.get('dest_id')?.errors?.['required']
+                                    ? 'This field is required.'
+                                    : acl.get('dest_id')?.errors?.['email']
+                                      ? 'Please enter a valid email address.'
+                                      : acl.get('dest_id')?.errors?.['invalidUrl']
+                                        ? 'Please enter a valid URL.'
+                                        : ''
+                                "
+                              >
+                                {{ getAclLabel('destination', acl.get('type')?.value) }}
+                                <input
+                                  cdsText
+                                  type="text"
+                                  formControlName="dest_id"
+                                  [invalidText]="
+                                    acl.get('dest_id')?.errors?.['required']
+                                      ? 'This field is required.'
+                                      : acl.get('dest_id')?.errors?.['email']
+                                        ? 'Please enter a valid email address.'
+                                        : acl.get('dest_id')?.errors?.['invalidUrl']
+                                          ? 'Please enter a valid URL.'
+                                          : ''
+                                  "
+                                />
+                              </cds-text-label>
+                            </div>
 
-                        <div
-                          cdsCol
-                          [columnNumbers]="{ lg: 1, md: 1 }"
-                          class="item-action-btn spacing"
-                        >
-                          <cds-icon-button kind="primary"
-                                           size="sm"
-                                           (click)="addAcls(acls, i)">
-                            <svg cdsIcon="add"
-                                 size="32"
-                                 class="cds--btn__icon"></svg>
-                          </cds-icon-button>
-                        </div>
-                        <div cdsCol
-                             [columnNumbers]="{ lg: 1, md: 1 }"
-                             class="item-action-btn">
-                          <cds-icon-button kind="danger"
-                                           size="sm"
-                                           (click)="removeAcl(i)">
-                            <svg cdsIcon="trash-can"
-                                 size="32"
-                                 class="cds--btn__icon"></svg>
-                          </cds-icon-button>
-                        </div>
-                      </div>
+                            <div
+                              cdsCol
+                              [columnNumbers]="{ lg: 1, md: 1 }"
+                              class="item-action-btn spacing"
+                            >
+                              <cds-icon-button
+                                kind="primary"
+                                size="sm"
+                                (click)="addAcls(acls, i)"
+                              >
+                                <svg
+                                  cdsIcon="add"
+                                  size="32"
+                                  class="cds--btn__icon"
+                                ></svg>
+                              </cds-icon-button>
+                            </div>
+                            <div
+                              cdsCol
+                              [columnNumbers]="{ lg: 1, md: 1 }"
+                              class="item-action-btn"
+                            >
+                              <cds-icon-button
+                                kind="danger"
+                                size="sm"
+                                (click)="removeAcl(i)"
+                              >
+                                <svg
+                                  cdsIcon="trash-can"
+                                  size="32"
+                                  class="cds--btn__icon"
+                                ></svg>
+                              </cds-icon-button>
+                            </div>
+                          </div>
+                        </ng-container>
+                      }
                     </ng-container>
-                    }
-                  </ng-container>
-                </div>
+                  </div>
                 }
-                <div class="form-item form-item-append"
-                     cdsRow>
+                <div
+                  class="form-item form-item-append"
+                  cdsRow
+                >
                   <div cdsCol>
                     <!-- Placement Target -->
                     <cds-select
@@ -583,21 +731,25 @@
                       [invalidText]="placementError"
                     >
                       @for (placementTarget of placementTargets; track placementTarget) {
-                      <option
-                        [value]="placementTarget"
-                        [selected]="
-                          placementTarget === storageClassForm.getValue('placement_target')
-                        "
-                        i18n
-                      >
-                        {{ placementTarget }}
-                      </option>
+                        <option
+                          [value]="placementTarget"
+                          [selected]="
+                            placementTarget === storageClassForm.getValue('placement_target')
+                          "
+                          i18n
+                        >
+                          {{ placementTarget }}
+                        </option>
                       }
                     </cds-select>
                     <ng-template #placementError>
                       @if (storageClassForm.showError('placement_target', formDir, 'required')) {
-                      <span class="invalid-feedback"
-                            i18n> This field is required. </span>
+                        <span
+                          class="invalid-feedback"
+                          i18n
+                        >
+                          This field is required.
+                        </span>
                       }
                     </ng-template>
                   </div>
@@ -607,11 +759,13 @@
           </fieldset>
         </div>
       </fieldset>
-      @if( isTierMatch( TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER )){
-      <cd-alert-panel type="warning"
-                      spacingClass="mb-2">
-        <span i18n>RGW service would be restarted after creating the storage class.</span>
-      </cd-alert-panel>
+      @if (isTierMatch(TIER_TYPE.CLOUD_TIER, TIER_TYPE.GLACIER)) {
+        <cd-alert-panel
+          type="warning"
+          spacingClass="mb-2"
+        >
+          <span i18n>RGW service would be restarted after creating the storage class.</span>
+        </cd-alert-panel>
       }
       <cd-form-button-panel
         (submitActionEvent)="submitAction()"
@@ -623,29 +777,40 @@
   </ng-container>
 </div>
 
-<ng-template #storageClassField
-             [formGroup]="storageClassForm">
-  <cds-text-label labelInputID="storage_class"
-                  i18n
-                  [disabled]="editing"
-                  [invalid]="storageClass.isInvalid"
-                  [invalidText]="storageClassError"
-                  >Name
-    <input cdsText
-           cdValidate
-           #storageClass="cdValidate"
-           type="text"
-           id="storage_class"
-           formControlName="storage_class"
-           [invalid]="storageClass.isInvalid"/>
+<ng-template
+  #storageClassField
+  [formGroup]="storageClassForm"
+>
+  <cds-text-label
+    labelInputID="storage_class"
+    i18n
+    [disabled]="editing"
+    [invalid]="storageClass.isInvalid"
+    [invalidText]="storageClassError"
+    >Name
+    <input
+      cdsText
+      cdValidate
+      #storageClass="cdValidate"
+      type="text"
+      id="storage_class"
+      formControlName="storage_class"
+      [invalid]="storageClass.isInvalid"
+    />
   </cds-text-label>
   <ng-template #storageClassError>
     @if (storageClassForm.showError('storage_class', formDir, 'required')) {
-    <span class="invalid-feedback"
-          i18n>This field is required.</span>
+      <span
+        class="invalid-feedback"
+        i18n
+        >This field is required.</span
+      >
     } @else if (storageClassForm.showError('storage_class', formDir, 'uniqueName')) {
-    <span class="invalid-feedback"
-          i18n>The Storage Class name is already in use.</span>
+      <span
+        class="invalid-feedback"
+        i18n
+        >The Storage Class name is already in use.</span
+      >
     }
   </ng-template>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-list/rgw-storage-class-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-list/rgw-storage-class-list.component.html
index c95e3005694..074bed99999 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-list/rgw-storage-class-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-storage-class-list/rgw-storage-class-list.component.html
@@ -1,6 +1,7 @@
 <legend>
   <cd-help-text i18n>
-    A storage class for tiering defines the policies for automatically moving objects between different storage tiers.
+    A storage class for tiering defines the policies for automatically moving objects between
+    different storage tiers.
   </cd-help-text>
 </legend>
 <cd-table
@@ -15,15 +16,20 @@
   [hasDetails]="true"
   (setExpandedRow)="setExpandedRow($event)"
   (updateSelection)="updateSelection($event)"
-  [autoReload]="false">
+  [autoReload]="false"
+>
   <div class="table-actions">
-    <cd-table-actions class="btn-group"
-                      [permission]="permission"
-                      [selection]="selection"
-                      [tableActions]="tableActions">
+    <cd-table-actions
+      class="btn-group"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
-  <cd-rgw-storage-class-details *cdTableDetail
-                                [selection]="expandedRow">
+  <cd-rgw-storage-class-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-rgw-storage-class-details>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-data-info/rgw-sync-data-info.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-data-info/rgw-sync-data-info.component.html
index 2e2db07843c..600ee81aa67 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-data-info/rgw-sync-data-info.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-data-info/rgw-sync-data-info.component.html
@@ -1,63 +1,102 @@
 <div class="sync-info">
-  <cds-toggletip [dropShadow]="true"
-                 [align]="align">
-    <div cdsToggletipButton
-         class="toggleTipBtn">
-      <span class="cds--type-label-01" i18n>Status:</span>
+  <cds-toggletip
+    [dropShadow]="true"
+    [align]="align"
+  >
+    <div
+      cdsToggletipButton
+      class="toggleTipBtn"
+    >
+      <span
+        class="cds--type-label-01"
+        i18n
+        >Status:</span
+      >
       @if (zone.syncstatus?.includes('failed') || zone.syncstatus?.includes('error')) {
         <span class="sync-info__status">
-          <svg [cdsIcon]="icons.danger"
-               [size]="icons.size16"
-               class="cds-danger-color"></svg>
-          <a class="cds--link cds--type-label-01 cds-danger-color sync-status-link"
-             i18n>Error</a>
+          <svg
+            [cdsIcon]="icons.danger"
+            [size]="icons.size16"
+            class="cds-danger-color"
+          ></svg>
+          <a
+            class="cds--link cds--type-label-01 cds-danger-color sync-status-link"
+            i18n
+            >Error</a
+          >
         </span>
       } @else {
         @if (zone.syncstatus === 'Not Syncing From Zone') {
-          <a class="cds--link cds--type-label-01 sync-status-link"
-             i18n>Not Syncing</a>
+          <a
+            class="cds--link cds--type-label-01 sync-status-link"
+            i18n
+            >Not Syncing</a
+          >
         } @else {
-          <a class="cds--link cds--type-label-01 sync-status-link"
-             i18n>{{ zone.syncstatus | titlecase }}</a>
+          <a
+            class="cds--link cds--type-label-01 sync-status-link"
+            i18n
+            >{{ zone.syncstatus | titlecase }}</a
+          >
         }
       }
     </div>
     <div cdsToggletipContent>
       <div class="cds--popover-scroll-container">
         <div class="toggletip-content">
-            @for (status of zone.fullSyncStatus; track status) {
-              @if (status?.includes('failed') || status?.includes('error')) {
+          @for (status of zone.fullSyncStatus; track status) {
+            @if (status?.includes('failed') || status?.includes('error')) {
+              <div class="toggletip-content__item">
+                <span class="cds--type-body-compact-01 cds-danger-color">{{
+                  status | titlecase
+                }}</span>
+              </div>
+            } @else if (
+              !status?.includes(zone.name) && !status?.includes(zone.syncstatus) && status?.trim()
+            ) {
+              @if (status?.includes(':')) {
                 <div class="toggletip-content__item">
-                  <span class="cds--type-body-compact-01 cds-danger-color">{{ status | titlecase }}</span>
+                  <span class="cds--type-label-01">{{ status.split(': ')[0] | titlecase }}</span>
+                  <span class="cds--type-body-compact-01">{{
+                    status.split(': ')[1] | titlecase
+                  }}</span>
+                </div>
+              } @else {
+                <div class="toggletip-content__item">
+                  <span
+                    class="cds--type-label-01"
+                    i18n
+                    >Summary</span
+                  >
+                  <span class="cds--type-body-compact-01">{{ status | titlecase }}</span>
                 </div>
-              } @else if (!status?.includes(zone.name) && !status?.includes(zone.syncstatus) && status?.trim()) {
-                @if (status?.includes(':')) {
-                  <div class="toggletip-content__item">
-                    <span class="cds--type-label-01">{{ status.split(': ')[0] | titlecase }}</span>
-                    <span class="cds--type-body-compact-01">{{ status.split(': ')[1] | titlecase }}</span>
-                  </div>
-                } @else {
-                  <div class="toggletip-content__item">
-                    <span class="cds--type-label-01" i18n>Summary</span>
-                    <span class="cds--type-body-compact-01">{{ status | titlecase }}</span>
-                  </div>
-                }
               }
             }
+          }
         </div>
       </div>
     </div>
   </cds-toggletip>
   <div class="sync-info__last-synced cds-mt-3">
-    <span class="cds--type-label-01" i18n>Last Synced:</span>
+    <span
+      class="cds--type-label-01"
+      i18n
+      >Last Synced:</span
+    >
     @if (zone.timestamp) {
-      <cds-tag class="tag-info" size="sm">
+      <cds-tag
+        class="tag-info"
+        size="sm"
+      >
         {{ zone.timestamp | relativeDate }}
       </cds-tag>
     } @else {
-      <cds-tag class="tag-success"
-               size="sm"
-               i18n>Up to Date</cds-tag>
+      <cds-tag
+        class="tag-success"
+        size="sm"
+        i18n
+        >Up to Date</cds-tag
+      >
     }
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-metadata-info/rgw-sync-metadata-info.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-metadata-info/rgw-sync-metadata-info.component.html
index 6db4caf3b37..c638fc4b7f7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-metadata-info/rgw-sync-metadata-info.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-metadata-info/rgw-sync-metadata-info.component.html
@@ -1,70 +1,117 @@
 @if (metadataSyncInfo === 'no sync (zone is master)') {
   <div class="sync-info">
-    <span class="cds--type-label-01" i18n>Status:</span>
-    <span class="cds--type-label-01"
-          style="color: var(--cds-text-secondary)">No Sync</span>
+    <span
+      class="cds--type-label-01"
+      i18n
+      >Status:</span
+    >
+    <span
+      class="cds--type-label-01"
+      style="color: var(--cds-text-secondary)"
+      >No Sync</span
+    >
   </div>
 } @else {
   <div class="sync-info">
-    <cds-toggletip [dropShadow]="true"
-                   [align]="align">
-      <div cdsToggletipButton
-           class="toggleTipBtn">
-        <span class="cds--type-label-01" i18n>Status:</span>
-        @if (metadataSyncInfo.syncstatus?.includes('failed') || metadataSyncInfo.syncstatus?.includes('error')) {
+    <cds-toggletip
+      [dropShadow]="true"
+      [align]="align"
+    >
+      <div
+        cdsToggletipButton
+        class="toggleTipBtn"
+      >
+        <span
+          class="cds--type-label-01"
+          i18n
+          >Status:</span
+        >
+        @if (
+          metadataSyncInfo.syncstatus?.includes('failed') ||
+          metadataSyncInfo.syncstatus?.includes('error')
+        ) {
           <span class="sync-info__status">
-            <svg [cdsIcon]="icons.danger"
-                 [size]="icons.size16"
-                 class="cds-danger-color"></svg>
-            <a class="cds--link cds--type-label-01 cds-danger-color sync-status-link"
-               i18n>Error</a>
+            <svg
+              [cdsIcon]="icons.danger"
+              [size]="icons.size16"
+              class="cds-danger-color"
+            ></svg>
+            <a
+              class="cds--link cds--type-label-01 cds-danger-color sync-status-link"
+              i18n
+              >Error</a
+            >
           </span>
         } @else {
           @if (metadataSyncInfo.syncstatus === 'Not Syncing From Zone') {
-            <a class="cds--link cds--type-label-01 sync-status-link"
-               i18n>Not Syncing</a>
+            <a
+              class="cds--link cds--type-label-01 sync-status-link"
+              i18n
+              >Not Syncing</a
+            >
           } @else {
-            <a class="cds--link cds--type-label-01 sync-status-link"
-               i18n>{{ metadataSyncInfo.syncstatus | titlecase }}</a>
+            <a
+              class="cds--link cds--type-label-01 sync-status-link"
+              i18n
+              >{{ metadataSyncInfo.syncstatus | titlecase }}</a
+            >
           }
         }
       </div>
       <div cdsToggletipContent>
         <div class="cds--popover-scroll-container">
           <div class="toggletip-content">
-              @for (status of metadataSyncInfo.fullSyncStatus; track status; let last = $last) {
-                @if (status?.includes('failed') || status?.includes('error')) {
+            @for (status of metadataSyncInfo.fullSyncStatus; track status; let last = $last) {
+              @if (status?.includes('failed') || status?.includes('error')) {
+                <div class="toggletip-content__item">
+                  <span class="cds--type-body-compact-01 cds-danger-color">{{
+                    status | titlecase
+                  }}</span>
+                </div>
+              } @else if (!status?.includes(metadataSyncInfo.syncstatus) && status?.trim()) {
+                @if (status?.includes(':')) {
                   <div class="toggletip-content__item">
-                    <span class="cds--type-body-compact-01 cds-danger-color">{{ status | titlecase }}</span>
+                    <span class="cds--type-label-01">{{ status.split(':')[0] | titlecase }}</span>
+                    <span class="cds--type-body-compact-01">{{
+                      status.split(':')[1] | titlecase
+                    }}</span>
+                  </div>
+                } @else {
+                  <div class="toggletip-content__item">
+                    <span
+                      class="cds--type-label-01"
+                      i18n
+                      >Summary</span
+                    >
+                    <span class="cds--type-body-compact-01">{{ status | titlecase }}</span>
                   </div>
-                } @else if (!status?.includes(metadataSyncInfo.syncstatus) && status?.trim()) {
-                  @if (status?.includes(':')) {
-                    <div class="toggletip-content__item">
-                      <span class="cds--type-label-01">{{ status.split(':')[0] | titlecase }}</span>
-                      <span class="cds--type-body-compact-01">{{ status.split(':')[1] | titlecase }}</span>
-                    </div>
-                  } @else {
-                    <div class="toggletip-content__item">
-                      <span class="cds--type-label-01" i18n>Summary</span>
-                      <span class="cds--type-body-compact-01">{{ status | titlecase }}</span>
-                    </div>
-                  }
                 }
               }
+            }
           </div>
         </div>
       </div>
     </cds-toggletip>
     <div class="sync-info__last-synced cds-mt-3">
-      <span class="cds--type-label-01" i18n>Last Synced:</span>
+      <span
+        class="cds--type-label-01"
+        i18n
+        >Last Synced:</span
+      >
       @if (metadataSyncInfo.timestamp) {
-        <cds-tag class="tag-info" size="sm">
+        <cds-tag
+          class="tag-info"
+          size="sm"
+        >
           {{ metadataSyncInfo.timestamp | relativeDate }}
         </cds-tag>
       } @else {
-        <cds-tag class="tag-success"
-                 size="sm"
-                 i18n>Up to Date</cds-tag>
+        <cds-tag
+          class="tag-success"
+          size="sm"
+          i18n
+          >Up to Date</cds-tag
+        >
       }
     </div>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-primary-zone/rgw-sync-primary-zone.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-primary-zone/rgw-sync-primary-zone.component.html
index fee54bd4ee8..2c851e01e3c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-primary-zone/rgw-sync-primary-zone.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-sync-primary-zone/rgw-sync-primary-zone.component.html
@@ -1,27 +1,43 @@
 <ul class="pb-5">
   <li>
-    <svg [cdsIcon]="icons.reweight"
-         [size]="icons.size20"
-         class="cds-icon--size-07"></svg>
-  </li>
-  <li class="mt-2"><cds-tag class="tag-info">{{realm}}</cds-tag></li>
-  <li>
-    <svg [cdsIcon]="icons.down"
-         class=" cds-icon--size-07"></svg>
+    <svg
+      [cdsIcon]="icons.reweight"
+      [size]="icons.size20"
+      class="cds-icon--size-07"
+    ></svg>
   </li>
   <li class="mt-2">
-    <cd-icon type="clusterIcon"
-             [size]="icons.size32"></cd-icon>
-  </li>
-  <p class="mt-2"> <cds-tag class="tag-info">{{zonegroup}}</cds-tag></p>
-  <li>
-    <svg [cdsIcon]="icons.down"
-         class="cds-icon--size-07"></svg>
+    <cds-tag class="tag-info">{{ realm }}</cds-tag>
   </li>
   <li>
-    <svg [cdsIcon]="icons.deploy"
-         [size]="icons.size20"
-         class="cds-icon--size-07 cds-icon"></svg>
+    <svg
+      [cdsIcon]="icons.down"
+      class="cds-icon--size-07"
+    ></svg>
+  </li>
+  <li class="mt-2">
+    <cd-icon
+      type="clusterIcon"
+      [size]="icons.size32"
+    ></cd-icon>
+  </li>
+  <p class="mt-2">
+    <cds-tag class="tag-info">{{ zonegroup }}</cds-tag>
+  </p>
+  <li>
+    <svg
+      [cdsIcon]="icons.down"
+      class="cds-icon--size-07"
+    ></svg>
+  </li>
+  <li>
+    <svg
+      [cdsIcon]="icons.deploy"
+      [size]="icons.size20"
+      class="cds-icon--size-07 cds-icon"
+    ></svg>
+  </li>
+  <li class="mt-2">
+    <cds-tag class="tag-info">{{ zone }}</cds-tag>
   </li>
-  <li class="mt-2"><cds-tag class="tag-info">{{zone}}</cds-tag></li>
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-system-user/rgw-system-user.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-system-user/rgw-system-user.component.html
index 86aa3d25568..1f167aed463 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-system-user/rgw-system-user.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-system-user/rgw-system-user.component.html
@@ -1,36 +1,54 @@
 <cd-modal [modalRef]="activeModal">
-  <ng-container i18n="form title"
-                class="modal-title">Create System User</ng-container>
+  <ng-container
+    i18n="form title"
+    class="modal-title"
+    >Create System User</ng-container
+  >
 
   <ng-container class="modal-content">
-    <form name="multisiteSystemUserForm"
-          #formDir="ngForm"
-          [formGroup]="multisiteSystemUserForm"
-          novalidate>
+    <form
+      name="multisiteSystemUserForm"
+      #formDir="ngForm"
+      [formGroup]="multisiteSystemUserForm"
+      novalidate
+    >
       <div class="modal-body">
         <div class="form-group row">
-          <label class="cd-col-form-label required"
-                 for="userName"
-                 i18n>User Name</label>
+          <label
+            class="cd-col-form-label required"
+            for="userName"
+            i18n
+            >User Name</label
+          >
           <div class="cd-col-form-input">
-            <input class="form-control"
-                   type="text"
-                   placeholder="User name..."
-                   id="userName"
-                   name="userName"
-                   formControlName="userName">
-            <span class="invalid-feedback"
-                  *ngIf="multisiteSystemUserForm.showError('userName', formDir, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="multisiteSystemUserForm.showError('userName', formDir, 'uniqueName')"
-                  i18n>The chosen realm name is already in use.</span>
+            <input
+              class="form-control"
+              type="text"
+              placeholder="User name..."
+              id="userName"
+              name="userName"
+              formControlName="userName"
+            />
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteSystemUserForm.showError('userName', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="multisiteSystemUserForm.showError('userName', formDir, 'uniqueName')"
+              i18n
+              >The chosen realm name is already in use.</span
+            >
           </div>
         </div>
       </div>
       <div class="modal-footer">
-        <cd-form-button-panel (submitActionEvent)="submit()"
-                              [form]="multisiteSystemUserForm"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="submit()"
+          [form]="multisiteSystemUserForm"
+        ></cd-form-button-panel>
       </div>
     </form>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-details/rgw-topic-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-details/rgw-topic-details.component.html
index 4c6c3ce69fe..21ea0b45512 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-details/rgw-topic-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-details/rgw-topic-details.component.html
@@ -1,76 +1,134 @@
 <ng-container *ngIf="!!selection">
-  <cds-tabs type="contained"
-            theme="light">
-    <cds-tab heading="Details"
-             i18n-heading>
-      <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-             data-testid="rgw-topic-details">
+  <cds-tabs
+    type="contained"
+    theme="light"
+  >
+    <cds-tab
+      heading="Details"
+      i18n-heading
+    >
+      <table
+        class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+        data-testid="rgw-topic-details"
+      >
         <tbody>
           <tr>
-            <td i18n
-                class="bold">Push endpoint arguments</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Push endpoint arguments
+            </td>
             <td>{{ selection?.dest?.push_endpoint_args }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold w-25">Stored secret</td>
-            <td class="w-75">{{ selection?.dest?.stored_secret}}</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Stored secret
+            </td>
+            <td class="w-75">{{ selection?.dest?.stored_secret }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Persistent</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Persistent
+            </td>
             <td>{{ selection?.dest?.persistent }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Persistent queue</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Persistent queue
+            </td>
             <td>{{ selection?.dest?.persistent_queue }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Time to live</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Time to live
+            </td>
             <td>{{ selection?.dest?.time_to_live }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Max retries</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Max retries
+            </td>
             <td>{{ selection?.dest?.max_retries }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Retry sleep duration</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Retry sleep duration
+            </td>
             <td>{{ selection?.dest?.retry_sleep_duration }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Opaque data</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Opaque data
+            </td>
             <td>{{ selection?.opaqueData }}</td>
           </tr>
         </tbody>
       </table>
     </cds-tab>
-    <cds-tab heading="Policies"
-             i18n-heading>
+    <cds-tab
+      heading="Policies"
+      i18n-heading
+    >
       <div>
-        <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
+        <table
+          class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+        >
           <tbody>
             <tr>
-              <td i18n
-                  class="bold w-25 ">Policy</td>
-              <td><pre>{{ policy | json  }}</pre></td>
+              <td
+                i18n
+                class="bold w-25"
+              >
+                Policy
+              </td>
+              <td>
+                <pre>{{ policy | json }}</pre>
+              </td>
             </tr>
           </tbody>
         </table>
       </div>
     </cds-tab>
-    <cds-tab heading="Subscribed buckets"
-             i18n-heading>
-      <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
+    <cds-tab
+      heading="Subscribed buckets"
+      i18n-heading
+    >
+      <table
+        class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+      >
         <tbody>
           <tr>
-            <td i18n
-                class="bold w-25">Subscribed buckets</td>
-            <td><pre>{{ selection.subscribed_buckets | json}}</pre></td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Subscribed buckets
+            </td>
+            <td>
+              <pre>{{ selection.subscribed_buckets | json }}</pre>
+            </td>
           </tr>
         </tbody>
       </table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html
index 7b6a51b86d5..e4c6b9d9cc7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.html
@@ -1,44 +1,70 @@
-<div cdsCol
-     *cdFormLoading="loading"
-     [columnNumbers]="{ md: 4 }">
-  <form name="topicForm"
-        #formDir="ngForm"
-        [formGroup]="topicForm"
-        novalidate>
+<div
+  cdsCol
+  *cdFormLoading="loading"
+  [columnNumbers]="{ md: 4 }"
+>
+  <form
+    name="topicForm"
+    #formDir="ngForm"
+    [formGroup]="topicForm"
+    novalidate
+  >
     <div class="form-header">
       {{ action | titlecase }} {{ resource | upperFirst }}
       <cd-help-text>
         <span i18n>
-            Configure the push endpoint parameters to send notifications. On successful creation, you'll receive the destination's unique Amazon Resource Name
+          Configure the push endpoint parameters to send notifications. On successful creation,
+          you'll receive the destination's unique Amazon Resource Name
         </span>
       </cd-help-text>
     </div>
 
-    <div class="form-item form-item-append"
-         cdsRow>
+    <div
+      class="form-item form-item-append"
+      cdsRow
+    >
       <!-- Destination Type-->
       <div cdsCol>
-        <cds-select formControlName="endpointType"
-                    label="Type"
-                    i18n-label
-                    cdRequiredField="Type"
-                    id="endpointType"
-                    (change)="onEndpointTypeChange();"
-                    [invalid]="topicForm.controls.endpointType.invalid && topicForm.controls.endpointType.dirty"
-                    [invalidText]="topicTypeError">
-          <option i18n
-                  *ngIf="endpointType === null"
-                  value="null">Loading... </option>
-          <option i18n
-                  *ngIf="endpointType !== null"
-                  value="">-- Select a destination type --</option>
-          <option *ngFor="let data of endpointType"
-                  i18n>{{ data | upperFirst }} </option>
+        <cds-select
+          formControlName="endpointType"
+          label="Type"
+          i18n-label
+          cdRequiredField="Type"
+          id="endpointType"
+          (change)="onEndpointTypeChange()"
+          [invalid]="
+            topicForm.controls.endpointType.invalid && topicForm.controls.endpointType.dirty
+          "
+          [invalidText]="topicTypeError"
+        >
+          <option
+            i18n
+            *ngIf="endpointType === null"
+            value="null"
+          >
+            Loading...
+          </option>
+          <option
+            i18n
+            *ngIf="endpointType !== null"
+            value=""
+          >
+            -- Select a destination type --
+          </option>
+          <option
+            *ngFor="let data of endpointType"
+            i18n
+          >
+            {{ data | upperFirst }}
+          </option>
         </cds-select>
         <ng-template #topicTypeError>
-          <span class="invalid-feedback"
-                *ngIf="topicForm.showError('endpointType', formDir, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="topicForm.showError('endpointType', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
@@ -51,29 +77,46 @@
           cdRequiredField="Owner"
           [invalid]="topicForm.controls.owner.invalid && topicForm.controls.owner.dirty"
           id="owner"
-          [invalidText]="ownerError">
-          <option i18n
-                  *ngIf="owners === null"
-                  value="null">Loading... </option>
-          <option i18n
-                  *ngIf="owners !== null"
-                  value="">-- Select a user --</option>
-          <option *ngFor="let data of owners"
-                  i18n
-                  [value]="data">{{ data }}</option>
+          [invalidText]="ownerError"
+        >
+          <option
+            i18n
+            *ngIf="owners === null"
+            value="null"
+          >
+            Loading...
+          </option>
+          <option
+            i18n
+            *ngIf="owners !== null"
+            value=""
+          >
+            -- Select a user --
+          </option>
+          <option
+            *ngFor="let data of owners"
+            i18n
+            [value]="data"
+          >
+            {{ data }}
+          </option>
         </cds-select>
         <ng-template #ownerError>
-          <span class="invalid-feedback"
-                *ngIf="topicForm.showError('owner', formDir, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="topicForm.showError('owner', formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
     </div>
 
     <ng-container *ngIf="selectedOption">
-      <div class="form-item form-item-append"
-           cdsRow>
-
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <!-- Destination Name -->
         <div cdsCol>
           <cds-text-label
@@ -82,67 +125,94 @@
             i18n-helperText
             cdRequiredField="Name"
             [invalid]="topicForm.controls.name.invalid && topicForm.controls.name.dirty"
-            [invalidText]="nameError">Name
+            [invalidText]="nameError"
+            >Name
 
-          <input cdsText
-                 type="text"
-                 id="name"
-                 autofocus
-                 formControlName="name"
-                 [invalid]="topicForm.controls.name.invalid && topicForm.controls.name.dirty"/>
+            <input
+              cdsText
+              type="text"
+              id="name"
+              autofocus
+              formControlName="name"
+              [invalid]="topicForm.controls.name.invalid && topicForm.controls.name.dirty"
+            />
           </cds-text-label>
 
           <ng-template #nameError>
-            <span class="invalid-feedback"
-                  *ngIf="topicForm.showError('name', formDir, 'required')"
-                  i18n>This field is required.</span>
-            <span class="invalid-feedback"
-                  *ngIf="topicForm.showError('name', formDir, 'notUnique')"
-                  i18n>The name is already in use. Please choose a different one</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="topicForm.showError('name', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="topicForm.showError('name', formDir, 'notUnique')"
+              i18n
+              >The name is already in use. Please choose a different one</span
+            >
           </ng-template>
         </div>
       </div>
-      <div class="form-item"
-           cdsRow>
+      <div
+        class="form-item"
+        cdsRow
+      >
         <fieldset>
-          <legend i18n
-                  cdsCol
-                  class="cd-header">
-                Generate push endpoint
+          <legend
+            i18n
+            cdsCol
+            class="cd-header"
+          >
+            Generate push endpoint
             <cd-help-text> Configure the endpoint URL to receive push notifications</cd-help-text>
           </legend>
 
           <!-- Enable SSL -->
-          <div cdsCol
-               [columnNumbers]="{sm: 4}">
-            <cds-checkbox id="enable_ssl"
-                          formControlName="enable_ssl"
-                          (checkedChange)="onSecureSSLChange($event)">
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4 }"
+          >
+            <cds-checkbox
+              id="enable_ssl"
+              formControlName="enable_ssl"
+              (checkedChange)="onSecureSSLChange($event)"
+            >
               <ng-container i18n>SSL</ng-container>
               <cd-help-text i18n>
-                Enabling SSL ensures that your connection is encrypted and secure. You must have a valid SSL certificate installed on your server.
+                Enabling SSL ensures that your connection is encrypted and secure. You must have a
+                valid SSL certificate installed on your server.
               </cd-help-text>
             </cds-checkbox>
           </div>
 
           <!-- Verify ssl -->
-          <div cdsCol
-               *ngIf="(selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.HTTP)"
-               [columnNumbers]="{sm: 4}">
-
-            <cds-checkbox id="verify_ssl"
-                          formControlName="verify_ssl">
+          <div
+            cdsCol
+            *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.HTTP"
+            [columnNumbers]="{ sm: 4 }"
+          >
+            <cds-checkbox
+              id="verify_ssl"
+              formControlName="verify_ssl"
+            >
               <ng-container i18n>Verify SSL</ng-container>
-              <cd-help-text i18n>Ensures that the server's SSL certificate is valid and trusted.</cd-help-text>
+              <cd-help-text i18n
+                >Ensures that the server's SSL certificate is valid and trusted.</cd-help-text
+              >
             </cds-checkbox>
           </div>
 
           <!-- Cloud Event-->
-          <div cdsCol
-               *ngIf="(selectedOption == hostProtocols.HTTP)"
-               [columnNumbers]="{sm: 4}">
-            <cds-checkbox id="cloud_events"
-                          formControlName="cloud_events">
+          <div
+            cdsCol
+            *ngIf="selectedOption == hostProtocols.HTTP"
+            [columnNumbers]="{ sm: 4 }"
+          >
+            <cds-checkbox
+              id="cloud_events"
+              formControlName="cloud_events"
+            >
               <ng-container i18n>Cloud events</ng-container>
               <cd-help-text i18n>Captures cloud events as triggers for notifications.</cd-help-text>
             </cds-checkbox>
@@ -150,9 +220,10 @@
         </fieldset>
       </div>
 
-      <div cdsRow
-           class="form-item form-item-append">
-
+      <div
+        cdsRow
+        class="form-item form-item-append"
+      >
         <!-- Fqdn-->
         <div cdsCol>
           <cds-text-label
@@ -162,19 +233,25 @@
             [invalidText]="fqdnError"
             helperText="Enter the FQDN/hostname/IP address for the push endpoint"
             i18n-helperText
-            i18n>
-           Destination address
-          <input cdsText
-                 type="text"
-                 id="fqdn"
-                 placeholder="e.g., 127.0.0.1 or localhost"
-                 formControlName="fqdn"
-                 [invalid]="topicForm.controls.fqdn.invalid && topicForm.controls.fqdn.dirty"
-                 (change)="generatePushEndpoint()"/>
+            i18n
+          >
+            Destination address
+            <input
+              cdsText
+              type="text"
+              id="fqdn"
+              placeholder="e.g., 127.0.0.1 or localhost"
+              formControlName="fqdn"
+              [invalid]="topicForm.controls.fqdn.invalid && topicForm.controls.fqdn.dirty"
+              (change)="generatePushEndpoint()"
+            />
           </cds-text-label>
           <ng-template #fqdnError>
-            <span class="invalid-feedback"
-                  *ngIf="topicForm.showError('fqdn', formDir, 'required')">This field is required</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="topicForm.showError('fqdn', formDir, 'required')"
+              >This field is required</span
+            >
           </ng-template>
         </div>
 
@@ -194,58 +271,80 @@
             i18n-helperText
           ></cds-number>
           <ng-template #portError>
-            <span class="invalid-feedback"
-                  *ngIf="topicForm.showError('port', formDir, 'required')"
-                  i18n>This field is required</span>
-            <span class="invalid-feedback"
-                  *ngIf="topicForm.controls.port.hasError('pattern') && topicForm.controls.port.touched"
-                  i18n> Port must be a valid integer</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="topicForm.showError('port', formDir, 'required')"
+              i18n
+              >This field is required</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="topicForm.controls.port.hasError('pattern') && topicForm.controls.port.touched"
+              i18n
+            >
+              Port must be a valid integer</span
+            >
           </ng-template>
         </div>
       </div>
 
-      <div cdsRow
-           *ngIf="(selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA)"
-           class="form-item form-item-append">
-
+      <div
+        cdsRow
+        *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA"
+        class="form-item form-item-append"
+      >
         <!-- User-->
         <div cdsCol>
-          <cds-text-label labelInputID="User"
-                          i18n
-                          helperText="Enter the user for the push endpoint"
-                          i18n-helperText>
+          <cds-text-label
+            labelInputID="User"
+            i18n
+            helperText="Enter the user for the push endpoint"
+            i18n-helperText
+          >
             User
-            <input cdsText
-                   type="text"
-                   id="user"
-                   formControlName="user"
-                   (change)="generatePushEndpoint()"/>
+            <input
+              cdsText
+              type="text"
+              id="user"
+              formControlName="user"
+              (change)="generatePushEndpoint()"
+            />
           </cds-text-label>
         </div>
 
         <!-- password-->
-        <div cdsCol
-             *ngIf="(selectedOption !==hostProtocols.HTTP)">
-          <cds-password-label labelInputID="password"
-                              [invalid]="!topicForm.controls.password.valid && topicForm.controls.password.dirty"
-                              [invalidText]="passwordError"
-                              i18n
-                              helperText="Enter the password for the push endpoint"
-                              i18n-helperText
-                              >
+        <div
+          cdsCol
+          *ngIf="selectedOption !== hostProtocols.HTTP"
+        >
+          <cds-password-label
+            labelInputID="password"
+            [invalid]="!topicForm.controls.password.valid && topicForm.controls.password.dirty"
+            [invalidText]="passwordError"
+            i18n
+            helperText="Enter the password for the push endpoint"
+            i18n-helperText
+          >
             Password
-            <input cdsPassword
-                   type="password"
-                   autocomplete="new-password"
-                   formControlName="password"
-                   (change)="generatePushEndpoint()"/>
+            <input
+              cdsPassword
+              type="password"
+              autocomplete="new-password"
+              formControlName="password"
+              (change)="generatePushEndpoint()"
+            />
           </cds-password-label>
           <ng-template #passwordError>
-            <span class="invalid-feedback"
-                  *ngIf="userForm.showError('password', formDir, 'required')"
-                  i18n>This field is required</span>
-            <span class="invalid-feedback"
-                  *ngIf="userForm.showError('password', formDir, 'passwordPolicy')">
+            <span
+              class="invalid-feedback"
+              *ngIf="userForm.showError('password', formDir, 'required')"
+              i18n
+              >This field is required</span
+            >
+            <span
+              class="invalid-feedback"
+              *ngIf="userForm.showError('password', formDir, 'passwordPolicy')"
+            >
               {{ passwordValuation }}
             </span>
           </ng-template>
@@ -253,37 +352,47 @@
       </div>
 
       <!--Vhost-->
-      <div cdsRow
-           class="form-item form-item-append"
-           *ngIf="(selectedOption === hostProtocols.AMQP)">
+      <div
+        cdsRow
+        class="form-item form-item-append"
+        *ngIf="selectedOption === hostProtocols.AMQP"
+      >
         <div cdsCol>
-          <cds-text-label labelInputID="Virtual Host(vhost)"
-                          i18n
-                          helperText="Enter the vhost for the push endpoint"
-                          i18n-helperText>
+          <cds-text-label
+            labelInputID="Virtual Host(vhost)"
+            i18n
+            helperText="Enter the vhost for the push endpoint"
+            i18n-helperText
+          >
             Virtual Host(vhost)
-          <input cdsText
-                 type="text"
-                 id="vhost"
-                 (change)="generatePushEndpoint()"
-                 formControlName="vhost" />
+            <input
+              cdsText
+              type="text"
+              id="vhost"
+              (change)="generatePushEndpoint()"
+              formControlName="vhost"
+            />
           </cds-text-label>
         </div>
       </div>
 
-      <div cdsRow
-           class="form-item form-item-append">
-
+      <div
+        cdsRow
+        class="form-item form-item-append"
+      >
         <!--push_endpoint -->
         <div cdsCol>
           <cds-text-label
             labelInputID="push_endpoint"
             i18n
             cdRequiredField="Push endpoint"
-            [invalid]="topicForm.controls.push_endpoint.invalid && topicForm.controls.push_endpoint.dirty"
+            [invalid]="
+              topicForm.controls.push_endpoint.invalid && topicForm.controls.push_endpoint.dirty
+            "
             [invalidText]="endpointError"
             helperText="Specify the endpoint URL for receiving push notifications"
-            i18n-helperText>
+            i18n-helperText
+          >
             Push endpoint
             <input
               cdsText
@@ -292,36 +401,51 @@
               i18n-placeholder
               id="push_endpoint"
               formControlName="push_endpoint"
-              [invalid]="topicForm.controls.push_endpoint.invalid && topicForm.controls.push_endpoint.dirty"
+              [invalid]="
+                topicForm.controls.push_endpoint.invalid && topicForm.controls.push_endpoint.dirty
+              "
             />
           </cds-text-label>
           <ng-template #endpointError>
-            <span class="invalid-feedback"
-                  *ngIf="topicForm.showError('push_endpoint', formDir, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="topicForm.showError('push_endpoint', formDir, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </ng-template>
         </div>
       </div>
-      <ng-container *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA">
+      <ng-container
+        *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA"
+      >
         <div class="form-item">
-        <fieldset>
-          <legend i18n
-                  class="cd-header">
-            {{ selectedOption === 'AMQP' ? 'AMQP attributes' : 'KAFKA attributes' }}
-            <cd-help-text> {{ attributeHelpText }}</cd-help-text>
-          </legend>
-        </fieldset>
+          <fieldset>
+            <legend
+              i18n
+              class="cd-header"
+            >
+              {{ selectedOption === 'AMQP' ? 'AMQP attributes' : 'KAFKA attributes' }}
+              <cd-help-text> {{ attributeHelpText }}</cd-help-text>
+            </legend>
+          </fieldset>
           <ng-container *ngIf="selectedOption === 'KAFKA'">
-            <div cdsRow
-                 class="form-item-append">
-
-              <div cdsCol
-                   *ngIf="selectedOption === 'KAFKA'">
-                <cds-checkbox id="use-ssl"
-                              formControlName="use_ssl">
+            <div
+              cdsRow
+              class="form-item-append"
+            >
+              <div
+                cdsCol
+                *ngIf="selectedOption === 'KAFKA'"
+              >
+                <cds-checkbox
+                  id="use-ssl"
+                  formControlName="use_ssl"
+                >
                   <ng-container i18n>Use SSL</ng-container>
                   <cd-help-text i18n>
-                    Enabling SSL encrypts communication between your Kafka client and broker, ensuring the confidentiality and integrity of your messages
+                    Enabling SSL encrypts communication between your Kafka client and broker,
+                    ensuring the confidentiality and integrity of your messages
                   </cd-help-text>
                 </cds-checkbox>
               </div>
@@ -329,146 +453,215 @@
           </ng-container>
         </div>
 
-        <div class="form-item form-item-append"
-             cdsRow>
-
-        <!---CA location--->
-          <div cdsCol
-               *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA">
-            <cds-text-label labelInputID="Ca-location"
-                            i18n
-                            helperText="The file path of the CA certificate used to verify the server"
-                            i18n-helperText>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
+          <!---CA location--->
+          <div
+            cdsCol
+            *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA"
+          >
+            <cds-text-label
+              labelInputID="Ca-location"
+              i18n
+              helperText="The file path of the CA certificate used to verify the server"
+              i18n-helperText
+            >
               CA location
-              <input cdsText
-                     type="text"
-                     id="ca_location"
-                     formControlName="ca_location"/>
+              <input
+                cdsText
+                type="text"
+                id="ca_location"
+                formControlName="ca_location"
+              />
             </cds-text-label>
           </div>
-          <div cdsCol
-               *ngIf="selectedOption === hostProtocols.AMQP">
-            <cds-text-label labelInputID="AMQP exchange"
-                            i18n
-                            helperText="Name of the AMQP exchange to publish messages to; must exist on the broker"
-                            i18n-helperText>
+          <div
+            cdsCol
+            *ngIf="selectedOption === hostProtocols.AMQP"
+          >
+            <cds-text-label
+              labelInputID="AMQP exchange"
+              i18n
+              helperText="Name of the AMQP exchange to publish messages to; must exist on the broker"
+              i18n-helperText
+            >
               AMQP exchange
-              <input cdsText
-                     type="text"
-                     id="amqp_exchange"
-                     formControlName="amqp_exchange"/>
+              <input
+                cdsText
+                type="text"
+                id="amqp_exchange"
+                formControlName="amqp_exchange"
+              />
             </cds-text-label>
           </div>
 
           <!-- mechanism-->
-          <div cdsCol
-               *ngIf="selectedOption ===hostProtocols.KAFKA">
-            <cds-select formControlName="mechanism"
-                        label="Mechanism"
-                        i18n-label
-                        id="mechanism"
-                        helperText="Select the authentication mechanism to connect to the Kafka broker"
-                        i18n-helperText>
-              <option i18n
-                      value="">-- Select a KAFKA mechanism --</option>
-              <option *ngFor="let data of kafkaMechanism"
-                      i18n>{{ data }}</option>
+          <div
+            cdsCol
+            *ngIf="selectedOption === hostProtocols.KAFKA"
+          >
+            <cds-select
+              formControlName="mechanism"
+              label="Mechanism"
+              i18n-label
+              id="mechanism"
+              helperText="Select the authentication mechanism to connect to the Kafka broker"
+              i18n-helperText
+            >
+              <option
+                i18n
+                value=""
+              >
+                -- Select a KAFKA mechanism --
+              </option>
+              <option
+                *ngFor="let data of kafkaMechanism"
+                i18n
+              >
+                {{ data }}
+              </option>
             </cds-select>
           </div>
         </div>
-        <div class="form-item form-item-append"
-             cdsRow>
-
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <!-- Ack level -->
-          <div cdsCol
-               *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA">
-            <cds-select formControlName="ack_level"
-                        label="Ack level"
-                        i18n-label
-                        id="ack_level"
-                        helperText="Select the acknowledgment level to control message delivery guarantees between client and broker"
-                        i18n-helperText>
-              <option i18n
-                      value="">-- Select the {{ selectedOption }} ack level --</option>
-              <option *ngFor="let level of ackLevels"
-                      [value]="level"
-                      i18n>{{ level }}</option>
+          <div
+            cdsCol
+            *ngIf="selectedOption === hostProtocols.AMQP || selectedOption === hostProtocols.KAFKA"
+          >
+            <cds-select
+              formControlName="ack_level"
+              label="Ack level"
+              i18n-label
+              id="ack_level"
+              helperText="Select the acknowledgment level to control message delivery guarantees between client and broker"
+              i18n-helperText
+            >
+              <option
+                i18n
+                value=""
+              >
+                -- Select the {{ selectedOption }} ack level --
+              </option>
+              <option
+                *ngFor="let level of ackLevels"
+                [value]="level"
+                i18n
+              >
+                {{ level }}
+              </option>
             </cds-select>
           </div>
 
           <!-- kafka-brokers-->
-          <div cdsCol
-               *ngIf="selectedOption === hostProtocols.KAFKA">
-            <cds-text-label labelInputID="kafka_brokers"
-                            i18n
-                            helperText="Specify the address of the Kafka broker (e.g., host:9092) "
-                            i18n-helperText>
+          <div
+            cdsCol
+            *ngIf="selectedOption === hostProtocols.KAFKA"
+          >
+            <cds-text-label
+              labelInputID="kafka_brokers"
+              i18n
+              helperText="Specify the address of the Kafka broker (e.g., host:9092) "
+              i18n-helperText
+            >
               Kafka brokers
-              <input cdsText
-                     type="text"
-                     id="kafka_brokers"
-                     formControlName="kafka_brokers"/>
+              <input
+                cdsText
+                type="text"
+                id="kafka_brokers"
+                formControlName="kafka_brokers"
+              />
             </cds-text-label>
           </div>
         </div>
       </ng-container>
       <ng-container>
-        <div cdsRow
-             class="form-item form-item-append">
-          <legend i18n
-                  cdsCol
-                  class="cd-header">
+        <div
+          cdsRow
+          class="form-item form-item-append"
+        >
+          <legend
+            i18n
+            cdsCol
+            class="cd-header"
+          >
             Additional common attributes
-            <cd-help-text>Configure additional attributes to customize the destination behavior and settings</cd-help-text>
+            <cd-help-text
+              >Configure additional attributes to customize the destination behavior and
+              settings</cd-help-text
+            >
           </legend>
 
           <!-- Persistent-->
-          <div cdsCol
-               [columnNumbers]="{sm: 4}">
-            <cds-checkbox id="persistent"
-                          formControlName="persistent">
+          <div
+            cdsCol
+            [columnNumbers]="{ sm: 4 }"
+          >
+            <cds-checkbox
+              id="persistent"
+              formControlName="persistent"
+            >
               <ng-container i18n>Persistent</ng-container>
-              <cd-help-text i18n> Select the checkbox to ensure notifications are retried.</cd-help-text>
+              <cd-help-text i18n>
+                Select the checkbox to ensure notifications are retried.</cd-help-text
+              >
             </cds-checkbox>
           </div>
         </div>
-        <div cdsRow
-             class="form-item form-item-append">
-
+        <div
+          cdsRow
+          class="form-item form-item-append"
+        >
           <!-- Opaque data-->
           <div cdsCol>
-            <cds-text-label labelInputID="opaque_data"
-                            i18n
-                            i18n-helperText
-                            helperText="A user-defined metadata added to all notifications that are triggered by the destination.">
+            <cds-text-label
+              labelInputID="opaque_data"
+              i18n
+              i18n-helperText
+              helperText="A user-defined metadata added to all notifications that are triggered by the destination."
+            >
               Opaque data
-              <input cdsText
-                     type="text"
-                     id="opaqueData"
-                     formControlName="OpaqueData"/>
+              <input
+                cdsText
+                type="text"
+                id="opaqueData"
+                formControlName="OpaqueData"
+              />
             </cds-text-label>
           </div>
 
           <!-- Time to live-->
           <div cdsCol>
-            <cds-number id="time_to_live"
-                        formControlName="time_to_live"
-                        label="Time to live"
-                        i18n-label
-                        [min]="1"
-                        helperText="Time limit (in seconds) for retaining notifications"
-                        i18n-helperText>Time to live </cds-number>
+            <cds-number
+              id="time_to_live"
+              formControlName="time_to_live"
+              label="Time to live"
+              i18n-label
+              [min]="1"
+              helperText="Time limit (in seconds) for retaining notifications"
+              i18n-helperText
+              >Time to live
+            </cds-number>
           </div>
 
           <!-- Max retries-->
           <div cdsCol>
-            <cds-number id="max_retries"
-                        label="Max retries"
-                        formControlName="max_retries"
-                        i18n-label
-                        [min]="1"
-                        helperText="Max retries before expiring notifications"
-                        i18n-helperText> Max retries </cds-number>
+            <cds-number
+              id="max_retries"
+              label="Max retries"
+              formControlName="max_retries"
+              i18n-label
+              [min]="1"
+              helperText="Max retries before expiring notifications"
+              i18n-helperText
+            >
+              Max retries
+            </cds-number>
           </div>
 
           <!-- Retry sleep duration-->
@@ -487,58 +680,77 @@
           </div>
         </div>
 
-        <div cdsRow
-             class="form-item form-item-append">
-
+        <div
+          cdsRow
+          class="form-item form-item-append"
+        >
           <!-- policy-->
           <div cdsCol>
             <cds-textarea-label i18n>
-              <span> {{'Policy'}}</span>
-              <textarea cdsTextArea
-                        #topicPolicyTextArea
-                        row="4"
-                        cols="200"
-                        formControlName="policy"
-                        aria-label="textarea"
-                        (change)="textAreaOnChange('topicPolicyTextArea')"></textarea>
+              <span> {{ 'Policy' }}</span>
+              <textarea
+                cdsTextArea
+                #topicPolicyTextArea
+                row="4"
+                cols="200"
+                formControlName="policy"
+                aria-label="textarea"
+                (change)="textAreaOnChange('topicPolicyTextArea')"
+              ></textarea>
             </cds-textarea-label>
             <cd-help-text i18n>JSON formatted document</cd-help-text>
             <div cdsRow>
               <div cdsCol>
                 <cds-button-set class="mt-1">
-                  <button cdsButton="tertiary"
-                          id="example-generator-button"
-                          (click)="openUrl('https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html?icmpid=docs_amazons3_console')"
-                          type="button"
-                          i18n>
+                  <button
+                    cdsButton="tertiary"
+                    id="example-generator-button"
+                    (click)="
+                      openUrl(
+                        'https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html?icmpid=docs_amazons3_console'
+                      )
+                    "
+                    type="button"
+                    i18n
+                  >
                     Policy examples
-                    <svg cdsIcon="launch"
-                         size="16"
-                         class="cds--btn__icon"></svg>
+                    <svg
+                      cdsIcon="launch"
+                      size="16"
+                      class="cds--btn__icon"
+                    ></svg>
                   </button>
-                  <button cdsButton="tertiary"
-                          id="example-generator-button"
-                          type="button"
-                          (click)="openUrl('https://awspolicygen.s3.amazonaws.com/policygen.html')"
-                          i18n>
+                  <button
+                    cdsButton="tertiary"
+                    id="example-generator-button"
+                    type="button"
+                    (click)="openUrl('https://awspolicygen.s3.amazonaws.com/policygen.html')"
+                    i18n
+                  >
                     Policy generator
-                    <svg cdsIcon="launch"
-                         size="16"
-                         class="cds--btn__icon"></svg>
+                    <svg
+                      cdsIcon="launch"
+                      size="16"
+                      class="cds--btn__icon"
+                    ></svg>
                   </button>
                 </cds-button-set>
               </div>
               <div cdsCol>
                 <cds-button-set class="float-end mt-1">
-                  <button cdsButton="tertiary"
-                          id="clear-bucket-policy"
-                          type="button"
-                          (click)="clearTextArea('policy', '{}')"
-                          i18n>
+                  <button
+                    cdsButton="tertiary"
+                    id="clear-bucket-policy"
+                    type="button"
+                    (click)="clearTextArea('policy', '{}')"
+                    i18n
+                  >
                     Clear
-                    <svg cdsIcon="close"
-                         size="32"
-                         class="cds--btn__icon"></svg>
+                    <svg
+                      cdsIcon="close"
+                      size="32"
+                      class="cds--btn__icon"
+                    ></svg>
                   </button>
                 </cds-button-set>
               </div>
@@ -548,10 +760,12 @@
       </ng-container>
     </ng-container>
     <div class="card-footer">
-      <cd-form-button-panel (submitActionEvent)="submitAction()"
-                            [form]="topicForm"
-                            [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                            wrappingClass="text-right"></cd-form-button-panel>
+      <cd-form-button-panel
+        (submitActionEvent)="submitAction()"
+        [form]="topicForm"
+        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+        wrappingClass="text-right"
+      ></cd-form-button-panel>
     </div>
   </form>
-  </div>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-list/rgw-topic-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-list/rgw-topic-list.component.html
index 56e805ede96..d353153fa48 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-list/rgw-topic-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-list/rgw-topic-list.component.html
@@ -1,28 +1,35 @@
-  <ng-container>
+<ng-container>
   <legend>
-  <cd-help-text i18n>
-   A topic specifies where and how event notifications from a bucket are delivered, including the target system (e.g., Kafka or HTTP) and its configuration.
-  </cd-help-text>
+    <cd-help-text i18n>
+      A topic specifies where and how event notifications from a bucket are delivered, including the
+      target system (e.g., Kafka or HTTP) and its configuration.
+    </cd-help-text>
   </legend>
-  <cd-table #table
-            headerTitle="Notification destination"
-            headerDescription="Delivers bucket and object change notifications to external services like Kafka or AMQP."
-            [autoReload]="true"
-            [data]="topics$ | async"
-            [columns]="columns"
-            columnMode="flex"
-            selectionType="single"
-            [hasDetails]="true"
-            id="key"
-            (setExpandedRow)="setExpandedRow($event)"
-            (updateSelection)="updateSelection($event)"
-            (fetchData)="fetchData()">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
-  </cd-table-actions>
-  <cd-rgw-topic-details *cdTableDetail
-                        [selection]="expandedRow"></cd-rgw-topic-details>
+  <cd-table
+    #table
+    headerTitle="Notification destination"
+    headerDescription="Delivers bucket and object change notifications to external services like Kafka or AMQP."
+    [autoReload]="true"
+    [data]="topics$ | async"
+    [columns]="columns"
+    columnMode="flex"
+    selectionType="single"
+    [hasDetails]="true"
+    id="key"
+    (setExpandedRow)="setExpandedRow($event)"
+    (updateSelection)="updateSelection($event)"
+    (fetchData)="fetchData()"
+  >
+    <cd-table-actions
+      class="table-actions"
+      [permission]="permission"
+      [selection]="selection"
+      [tableActions]="tableActions"
+    >
+    </cd-table-actions>
+    <cd-rgw-topic-details
+      *cdTableDetail
+      [selection]="expandedRow"
+    ></cd-rgw-topic-details>
   </cd-table>
-  </ng-container>
+</ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html
index f5511853d44..97c6a623e33 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-details/rgw-user-accounts-details.component.html
@@ -1,27 +1,34 @@
 @if (selection) {
-<cds-tabs>
-  <cds-tab heading="Quotas" i18n-heading>
-    <div class="row">
-      @if (selection.quota) {
-      <div class="col-sm-6">
-        <legend i18n>Account quota</legend>
-        <cd-table-key-value [data]="quota"> </cd-table-key-value>
+  <cds-tabs>
+    <cds-tab
+      heading="Quotas"
+      i18n-heading
+    >
+      <div class="row">
+        @if (selection.quota) {
+          <div class="col-sm-6">
+            <legend i18n>Account quota</legend>
+            <cd-table-key-value [data]="quota"> </cd-table-key-value>
+          </div>
+        }
+        @if (selection.bucket_quota) {
+          <div class="col-sm-6">
+            <legend i18n>Bucket quota</legend>
+            <cd-table-key-value [data]="bucket_quota"> </cd-table-key-value>
+          </div>
+        }
       </div>
-      } @if (selection.bucket_quota) {
-      <div class="col-sm-6">
-        <legend i18n>Bucket quota</legend>
-        <cd-table-key-value [data]="bucket_quota"> </cd-table-key-value>
+    </cds-tab>
+    <cds-tab
+      heading="Roles"
+      i18n-heading
+    >
+      <div class="mt-4">
+        <cd-rgw-account-roles-list
+          [accountId]="selection.id"
+          [accountName]="selection.name"
+        ></cd-rgw-account-roles-list>
       </div>
-      }
-    </div>
-  </cds-tab>
-  <cds-tab heading="Roles" i18n-heading>
-    <div class="mt-4">
-      <cd-rgw-account-roles-list
-        [accountId]="selection.id"
-        [accountName]="selection.name"
-      ></cd-rgw-account-roles-list>
-    </div>
-  </cds-tab>
-</cds-tabs>
+    </cds-tab>
+  </cds-tabs>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
index 581a4ad3bf6..d255ee09e13 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.html
@@ -1,79 +1,104 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="accountForm"
-          #formDir="ngForm"
-          [formGroup]="accountForm"
-          novalidate>
-
-      <div i18n="form title"
-           class="form-header cds--type-heading-04 cds-mb-5">{{ action | titlecase }} {{ resource | lowercase }}
+    <form
+      name="accountForm"
+      #formDir="ngForm"
+      [formGroup]="accountForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header cds--type-heading-04 cds-mb-5"
+      >
+        {{ action | titlecase }} {{ resource | lowercase }}
       </div>
 
-      <h4 class="cds--type-heading-03 cds-mb-4" i18n>Account details</h4>
+      <h4
+        class="cds--type-heading-03 cds-mb-4"
+        i18n
+      >
+        Account details
+      </h4>
 
       <!-- Account Name -->
       <div class="form-item">
-        <cds-text-label label="Account name"
-                        for="acc_name"
-                        [invalid]="!accountForm.controls.name.valid && accountForm.controls.name.dirty"
-                        [invalidText]="accountIdError"
-                        helperText="Name must start and end in alphanumeric characters (3 to 63). Characters allowed: lowercase, numbers and nonconsecutive dots and hyphens."
-                        i18n-helperText
-                        i18n>Account name
-          <input cdsText
-                 type="text"
-                 placeholder="for example, team-storage-01"
-                 id="acc_name"
-                 name="acc_name"
-                 cdValidate
-                 #accName="cdValidate"
-                 [invalid]="accName.isInvalid"
-                 formControlName="name"/>
+        <cds-text-label
+          label="Account name"
+          for="acc_name"
+          [invalid]="!accountForm.controls.name.valid && accountForm.controls.name.dirty"
+          [invalidText]="accountIdError"
+          helperText="Name must start and end in alphanumeric characters (3 to 63). Characters allowed: lowercase, numbers and nonconsecutive dots and hyphens."
+          i18n-helperText
+          i18n
+          >Account name
+          <input
+            cdsText
+            type="text"
+            placeholder="for example, team-storage-01"
+            id="acc_name"
+            name="acc_name"
+            cdValidate
+            #accName="cdValidate"
+            [invalid]="accName.isInvalid"
+            formControlName="name"
+          />
         </cds-text-label>
         <ng-template #accountIdError>
-          <span *ngIf="accountForm.showError('name', formDir, 'required')"
-                class="invalid-feedback">
+          <span
+            *ngIf="accountForm.showError('name', formDir, 'required')"
+            class="invalid-feedback"
+          >
             <ng-container i18n>This field is required.</ng-container>
           </span>
-          @if(accountForm.showError('name', formDir, 'notUnique')) {
+          @if (accountForm.showError('name', formDir, 'notUnique')) {
             <div class="invalid-feedback">
-          <ng-container i18n>An account with this name already exists.</ng-container>
+              <ng-container i18n>An account with this name already exists.</ng-container>
             </div>
           }
         </ng-template>
       </div>
       <!-- Tenant -->
       <div class="form-item">
-        <cds-text-label label="Tenant (optional)"
-                        for="tenant"
-                        helperText="Associates this account with an existing tenant namespace."
-                        i18n-helperText
-                        i18n>Tenant (optional)
-          <input cdsText
-                 type="text"
-                 placeholder="for example, finance-team"
-                 id="tenant"
-                 name="tenant"
-                 formControlName="tenant"/>
+        <cds-text-label
+          label="Tenant (optional)"
+          for="tenant"
+          helperText="Associates this account with an existing tenant namespace."
+          i18n-helperText
+          i18n
+          >Tenant (optional)
+          <input
+            cdsText
+            type="text"
+            placeholder="for example, finance-team"
+            id="tenant"
+            name="tenant"
+            formControlName="tenant"
+          />
         </cds-text-label>
       </div>
 
       <!-- Email -->
       <div class="form-item">
-        <cds-text-label label="Email address (optional)"
-                        for="email"
-                        [invalid]="!accountForm.controls.email.valid && accountForm.controls.email.dirty"
-                        [invalidText]="emailError"
-                        helperText="Contact for quota alerts and notifications."
-                        i18n-helperText
-                        i18n>Email address (optional)
-          <input cdsText
-                 type="text"
-                 placeholder="for example, admin@example.com"
-                 id="email"
-                 name="email"
-                 formControlName="email"/>
+        <cds-text-label
+          label="Email address (optional)"
+          for="email"
+          [invalid]="!accountForm.controls.email.valid && accountForm.controls.email.dirty"
+          [invalidText]="emailError"
+          helperText="Contact for quota alerts and notifications."
+          i18n-helperText
+          i18n
+          >Email address (optional)
+          <input
+            cdsText
+            type="text"
+            placeholder="for example, admin@example.com"
+            id="email"
+            name="email"
+            formControlName="email"
+          />
         </cds-text-label>
         <ng-template #emailError>
           <span *ngIf="accountForm.showError('email', formDir, 'email')">
@@ -83,244 +108,431 @@
       </div>
 
       <div class="form-item cds-mt-5 cds-mb-3">
-        <h4 class="cds--type-heading-03" i18n>Advanced settings</h4>
-        <p class="cds--type-body-01" i18n>Configure resource limits and quota for this account</p>
+        <h4
+          class="cds--type-heading-03"
+          i18n
+        >
+          Advanced settings
+        </h4>
+        <p
+          class="cds--type-body-01"
+          i18n
+        >
+          Configure resource limits and quota for this account
+        </p>
         <div class="cds-mt-3">
-          <button type="button" class="cds--btn cds--btn--ghost advanced-settings-btn" (click)="showAdvanced = !showAdvanced">
+          <button
+            type="button"
+            class="cds--btn cds--btn--ghost advanced-settings-btn"
+            (click)="showAdvanced = !showAdvanced"
+          >
             {{ showAdvanced ? 'Hide advanced settings' : 'Show advanced settings' }}
-            <svg cdsIcon="chevron--down" *ngIf="!showAdvanced" size="16" class="cds--btn__icon"></svg>
-            <svg cdsIcon="chevron--up" *ngIf="showAdvanced" size="16" class="cds--btn__icon"></svg>
+            <svg
+              cdsIcon="chevron--down"
+              *ngIf="!showAdvanced"
+              size="16"
+              class="cds--btn__icon"
+            ></svg>
+            <svg
+              cdsIcon="chevron--up"
+              *ngIf="showAdvanced"
+              size="16"
+              class="cds--btn__icon"
+            ></svg>
           </button>
         </div>
       </div>
 
       <div *ngIf="showAdvanced">
-        <h5 class="cds--type-heading-02 cds-mb-2" i18n>Resource limits</h5>
-        <p class="cds--type-body-01 cds-mb-4" i18n>Set the mode and maximum allowed values for each resource type. Select Custom to specify a limit.</p>
+        <h5
+          class="cds--type-heading-02 cds-mb-2"
+          i18n
+        >
+          Resource limits
+        </h5>
+        <p
+          class="cds--type-body-01 cds-mb-4"
+          i18n
+        >
+          Set the mode and maximum allowed values for each resource type. Select Custom to specify a
+          limit.
+        </p>
 
-        <div class="form-item form-item-append" cdsRow>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <div cdsCol>
             <!-- Max. bucket mode -->
-            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_buckets_mode' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="selectModeTemplate; context: { formControl: 'max_buckets_mode' }"
+            ></ng-container>
           </div>
           <div cdsCol>
             <!-- Max buckets -->
-            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_buckets' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="accountMaxValueTemplate; context: { formControl: 'max_buckets' }"
+            ></ng-container>
           </div>
         </div>
 
-        <div class="form-item form-item-append" cdsRow>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <div cdsCol>
             <!-- Max. users mode -->
-            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_users_mode' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="selectModeTemplate; context: { formControl: 'max_users_mode' }"
+            ></ng-container>
           </div>
           <div cdsCol>
             <!-- Max users -->
-            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_users' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="accountMaxValueTemplate; context: { formControl: 'max_users' }"
+            ></ng-container>
           </div>
         </div>
 
-        <div class="form-item form-item-append" cdsRow>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <div cdsCol>
             <!-- Max. roles mode -->
-            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_roles_mode' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="selectModeTemplate; context: { formControl: 'max_roles_mode' }"
+            ></ng-container>
           </div>
           <div cdsCol>
             <!-- Max roles -->
-            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_roles' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="accountMaxValueTemplate; context: { formControl: 'max_roles' }"
+            ></ng-container>
           </div>
         </div>
 
-        <div class="form-item form-item-append" cdsRow>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <div cdsCol>
             <!-- Max. group mode -->
-            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_groups_mode' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="selectModeTemplate; context: { formControl: 'max_groups_mode' }"
+            ></ng-container>
           </div>
           <div cdsCol>
             <!-- Max group -->
-            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_groups' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="accountMaxValueTemplate; context: { formControl: 'max_groups' }"
+            ></ng-container>
           </div>
         </div>
 
-        <div class="form-item form-item-append" cdsRow>
+        <div
+          class="form-item form-item-append"
+          cdsRow
+        >
           <div cdsCol>
             <!-- Max. access keys mode -->
-            <ng-container *ngTemplateOutlet="selectModeTemplate;context: { formControl: 'max_access_keys_mode' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="
+                selectModeTemplate;
+                context: { formControl: 'max_access_keys_mode' }
+              "
+            ></ng-container>
           </div>
           <div cdsCol>
             <!-- Max access keys -->
-            <ng-container *ngTemplateOutlet="accountMaxValueTemplate;context: { formControl: 'max_access_keys' }"></ng-container>
+            <ng-container
+              *ngTemplateOutlet="
+                accountMaxValueTemplate;
+                context: { formControl: 'max_access_keys' }
+              "
+            ></ng-container>
           </div>
         </div>
 
-        <h5 class="cds--type-heading-02 cds-mb-2 cds-mt-5" i18n>Quotas</h5>
-        <p class="cds--type-body-01 cds-mb-4" i18n>Define storage usage limits for the account and the buckets it owns. Quotas help control capacity consumption and enforce resource allocation policies.</p>
+        <h5
+          class="cds--type-heading-02 cds-mb-2 cds-mt-5"
+          i18n
+        >
+          Quotas
+        </h5>
+        <p
+          class="cds--type-body-01 cds-mb-4"
+          i18n
+        >
+          Define storage usage limits for the account and the buckets it owns. Quotas help control
+          capacity consumption and enforce resource allocation policies.
+        </p>
 
         <!-- Account Quota -->
         <div class="form-item">
-          <ng-container *ngTemplateOutlet="quotaTemplate;context: { formControl: {
-                        enabled: 'account_quota_enabled',
-                        unlimitedSize: 'account_quota_max_size_unlimited',
-                        maxSize: 'account_quota_max_size',
-                        unlimitedObjects: 'account_quota_max_objects_unlimited',
-                        maxObjects: 'account_quota_max_objects'
-                        },
-                        quotaType: 'account'
-                        }">
+          <ng-container
+            *ngTemplateOutlet="
+              quotaTemplate;
+              context: {
+                formControl: {
+                  enabled: 'account_quota_enabled',
+                  unlimitedSize: 'account_quota_max_size_unlimited',
+                  maxSize: 'account_quota_max_size',
+                  unlimitedObjects: 'account_quota_max_objects_unlimited',
+                  maxObjects: 'account_quota_max_objects'
+                },
+                quotaType: 'account'
+              }
+            "
+          >
           </ng-container>
         </div>
 
         <!-- Bucket Quota -->
         <div class="form-item">
-          <ng-container *ngTemplateOutlet="quotaTemplate;
-                        context: {
-                        formControl: {
-                        enabled: 'bucket_quota_enabled',
-                        unlimitedSize: 'bucket_quota_max_size_unlimited',
-                        maxSize: 'bucket_quota_max_size',
-                        unlimitedObjects: 'bucket_quota_max_objects_unlimited',
-                        maxObjects: 'bucket_quota_max_objects'
-                        },
-                        quotaType: 'bucket'
-                        }">
+          <ng-container
+            *ngTemplateOutlet="
+              quotaTemplate;
+              context: {
+                formControl: {
+                  enabled: 'bucket_quota_enabled',
+                  unlimitedSize: 'bucket_quota_max_size_unlimited',
+                  maxSize: 'bucket_quota_max_size',
+                  unlimitedObjects: 'bucket_quota_max_objects_unlimited',
+                  maxObjects: 'bucket_quota_max_objects'
+                },
+                quotaType: 'bucket'
+              }
+            "
+          >
           </ng-container>
         </div>
       </div>
-      <cd-form-button-panel (submitActionEvent)="submit()"
-                            [form]="formDir"
-                            [submitText]="(action | titlecase) + ' ' + (resource | lowercase)"
-                            wrappingClass="text-right"></cd-form-button-panel>
-
+      <cd-form-button-panel
+        (submitActionEvent)="submit()"
+        [form]="formDir"
+        [submitText]="(action | titlecase) + ' ' + (resource | lowercase)"
+        wrappingClass="text-right"
+      ></cd-form-button-panel>
     </form>
   </ng-container>
 </div>
 
-<ng-template #selectModeTemplate
-             [formGroup]="accountForm"
-             let-formControl="formControl">
-  <cds-select [formControlName]="formControl"
-              [name]="formControl"
-              [id]="formControl"
-              label="{{formControl.split('_')[1] | upperFirst}} mode"
-              (change)="onModeChange($event.target.value, formControl)"
-              [helperText]="getHelperTextForMode(formControl)">
+<ng-template
+  #selectModeTemplate
+  [formGroup]="accountForm"
+  let-formControl="formControl"
+>
+  <cds-select
+    [formControlName]="formControl"
+    [name]="formControl"
+    [id]="formControl"
+    label="{{ formControl.split('_')[1] | upperFirst }} mode"
+    (change)="onModeChange($event.target.value, formControl)"
+    [helperText]="getHelperTextForMode(formControl)"
+  >
     <option value="0">Unlimited</option>
     <option value="-1">Disabled</option>
     <option value="1">Custom</option>
   </cds-select>
 </ng-template>
 
-<ng-template #accountMaxValueTemplate
-             let-formControl="formControl"
-             [formGroup]="accountForm">
-  <cds-number *ngIf="accountForm.get(formControl + '_mode').value == '1'"
-              [id]="formControl"
-              [name]="formControl"
-              formControlName="{{formControl}}"
-              label="Maximum {{formControl.replace('max_', '').replace('_', ' ')}}"
-              [min]="1"
-              [invalid]="!accountForm.controls[formControl].valid && accountForm.controls[formControl].dirty"
-              [invalidText]="maxValError"></cds-number>
-  
-  <cds-text-label *ngIf="accountForm.get(formControl + '_mode').value != '1'"
-                  label="Maximum {{formControl.replace('max_', '').replace('_', ' ')}}"
-                  for="{{formControl}}_disabled">
-    Maximum {{formControl.replace('max_', '').replace('_', ' ')}}
-    <input cdsText
-           type="text"
-           [id]="formControl + '_disabled'"
-           name="{{formControl}}_disabled"
-           [ngModel]="'-'"
-           [ngModelOptions]="{standalone: true}"
-           [disabled]="true" />
+<ng-template
+  #accountMaxValueTemplate
+  let-formControl="formControl"
+  [formGroup]="accountForm"
+>
+  <cds-number
+    *ngIf="accountForm.get(formControl + '_mode').value == '1'"
+    [id]="formControl"
+    [name]="formControl"
+    formControlName="{{ formControl }}"
+    label="Maximum {{ formControl.replace('max_', '').replace('_', ' ') }}"
+    [min]="1"
+    [invalid]="!accountForm.controls[formControl].valid && accountForm.controls[formControl].dirty"
+    [invalidText]="maxValError"
+  ></cds-number>
+
+  <cds-text-label
+    *ngIf="accountForm.get(formControl + '_mode').value != '1'"
+    label="Maximum {{ formControl.replace('max_', '').replace('_', ' ') }}"
+    for="{{ formControl }}_disabled"
+  >
+    Maximum {{ formControl.replace('max_', '').replace('_', ' ') }}
+    <input
+      cdsText
+      type="text"
+      [id]="formControl + '_disabled'"
+      name="{{ formControl }}_disabled"
+      [ngModel]="'-'"
+      [ngModelOptions]="{ standalone: true }"
+      [disabled]="true"
+    />
   </cds-text-label>
 
-<ng-template #maxValError>
-  <span *ngIf="accountForm.showError(formControl, formDir, 'required')"
-        i18n>This field is required.</span>
-  <span *ngIf="accountForm.controls[formControl].value == 0 && accountForm.showError(formControl, formDir, 'min')"
-        i18n>Enter number greater than 0</span>
-  <span *ngIf="accountForm.showError(formControl, formDir, 'pattern')"
-        i18n>Enter a valid positive number</span>
-</ng-template>
+  <ng-template #maxValError>
+    <span
+      *ngIf="accountForm.showError(formControl, formDir, 'required')"
+      i18n
+      >This field is required.</span
+    >
+    <span
+      *ngIf="
+        accountForm.controls[formControl].value == 0 &&
+        accountForm.showError(formControl, formDir, 'min')
+      "
+      i18n
+      >Enter number greater than 0</span
+    >
+    <span
+      *ngIf="accountForm.showError(formControl, formDir, 'pattern')"
+      i18n
+      >Enter a valid positive number</span
+    >
+  </ng-template>
 </ng-template>
 
-<ng-template #quotaTemplate
-             let-quotaType="quotaType"
-             let-formControl="formControl"
-             [formGroup]="accountForm">
+<ng-template
+  #quotaTemplate
+  let-quotaType="quotaType"
+  let-formControl="formControl"
+  [formGroup]="accountForm"
+>
   <fieldset class="cds--fieldset cds-mb-4">
-    <legend class="cds--label">{{quotaType | upperFirst}} quota</legend>
+    <legend class="cds--label">{{ quotaType | upperFirst }} quota</legend>
     <!-- Enabled -->
-    <cds-checkbox *ngIf="quotaType == 'account'" [formControlName]="formControl.enabled"
-                  [id]="quotaType+'_checkbox'" class="cds-mb-3">
+    <cds-checkbox
+      *ngIf="quotaType == 'account'"
+      [formControlName]="formControl.enabled"
+      [id]="quotaType + '_checkbox'"
+      class="cds-mb-3"
+    >
       Enable account quota
-    </cds-checkbox >
-    <cds-checkbox *ngIf="quotaType == 'bucket'" [formControlName]="formControl.enabled"
-                  [id]="quotaType+'_checkbox'" class="cds-mb-3">
+    </cds-checkbox>
+    <cds-checkbox
+      *ngIf="quotaType == 'bucket'"
+      [formControlName]="formControl.enabled"
+      [id]="quotaType + '_checkbox'"
+      class="cds-mb-3"
+    >
       Enable bucket quota
-    </cds-checkbox >
-    <p class="cds--type-body-01 cds-mb-4" *ngIf="quotaType == 'account'">Applies a storage quota to each user account.</p>
-    <p class="cds--type-body-01 cds-mb-4" *ngIf="quotaType == 'bucket'">Limits the total storage available across all buckets in an account.</p>
-    <div class="quota-sub-block"
-         *ngIf="accountForm.controls[formControl.enabled].value">
+    </cds-checkbox>
+    <p
+      class="cds--type-body-01 cds-mb-4"
+      *ngIf="quotaType == 'account'"
+    >
+      Applies a storage quota to each user account.
+    </p>
+    <p
+      class="cds--type-body-01 cds-mb-4"
+      *ngIf="quotaType == 'bucket'"
+    >
+      Limits the total storage available across all buckets in an account.
+    </p>
+    <div
+      class="quota-sub-block"
+      *ngIf="accountForm.controls[formControl.enabled].value"
+    >
       <!-- Unlimited size -->
-      <cds-checkbox *ngIf="accountForm.controls[formControl.enabled].value"
-                    [formControlName]="formControl.unlimitedSize"
-                    [id]="quotaType+'unlimitedSize_checkbox'">
-                    Unlimited size
+      <cds-checkbox
+        *ngIf="accountForm.controls[formControl.enabled].value"
+        [formControlName]="formControl.unlimitedSize"
+        [id]="quotaType + 'unlimitedSize_checkbox'"
+      >
+        Unlimited size
       </cds-checkbox>
       <!-- Maximum size -->
-      <div class="input-wrapper"
-           *ngIf="accountForm.controls[formControl.enabled].value && !accountForm.getValue(formControl.unlimitedSize)">
-        <cds-text-label [label]="formControl.maxSize"
-                        [for]="formControl.maxSize"
-                        [invalid]="!accountForm.controls[formControl.maxSize].valid && accountForm.controls[formControl.maxSize].dirty"
-                        [invalidText]="quotaSizeError"
-                        i18n>Maximum size
-          <input cdsText
-                 type="text"
-                 placeholder="Enter size"
-                 [id]="formControl.maxSize"
-                 [name]="formControl.maxSize"
-                 [formControlName]="formControl.maxSize"
-                 cdDimlessBinary/>
+      <div
+        class="input-wrapper"
+        *ngIf="
+          accountForm.controls[formControl.enabled].value &&
+          !accountForm.getValue(formControl.unlimitedSize)
+        "
+      >
+        <cds-text-label
+          [label]="formControl.maxSize"
+          [for]="formControl.maxSize"
+          [invalid]="
+            !accountForm.controls[formControl.maxSize].valid &&
+            accountForm.controls[formControl.maxSize].dirty
+          "
+          [invalidText]="quotaSizeError"
+          i18n
+          >Maximum size
+          <input
+            cdsText
+            type="text"
+            placeholder="Enter size"
+            [id]="formControl.maxSize"
+            [name]="formControl.maxSize"
+            [formControlName]="formControl.maxSize"
+            cdDimlessBinary
+          />
         </cds-text-label>
         <ng-template #quotaSizeError>
-          <span *ngIf="accountForm.showError(formControl.maxSize, formDir, 'required')"
-                i18n>This field is required.</span>
-          <span *ngIf="accountForm.showError(formControl.maxSize, formDir, 'quotaMaxSize')"
-                i18n>Enter a valid value.</span>
-          <span *ngIf="accountForm.showError(formControl.maxSize, formDir, 'pattern')"
-                i18n>Size must be a number or in a valid format. eg: 5 GiB</span>
+          <span
+            *ngIf="accountForm.showError(formControl.maxSize, formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            *ngIf="accountForm.showError(formControl.maxSize, formDir, 'quotaMaxSize')"
+            i18n
+            >Enter a valid value.</span
+          >
+          <span
+            *ngIf="accountForm.showError(formControl.maxSize, formDir, 'pattern')"
+            i18n
+            >Size must be a number or in a valid format. eg: 5 GiB</span
+          >
         </ng-template>
       </div>
       <!-- Unlimited objects -->
-      <cds-checkbox *ngIf="accountForm.controls[formControl.enabled].value"
-                    [formControlName]="formControl.unlimitedObjects"
-                    [id]="quotaType+'unlimitedObjects_checkbox'">
-                    Unlimited objects
+      <cds-checkbox
+        *ngIf="accountForm.controls[formControl.enabled].value"
+        [formControlName]="formControl.unlimitedObjects"
+        [id]="quotaType + 'unlimitedObjects_checkbox'"
+      >
+        Unlimited objects
       </cds-checkbox>
-    <!-- Maximum objects -->
-      <div class="input-wrapper"
-           *ngIf="accountForm.controls[formControl.enabled].value && !accountForm.getValue(formControl.unlimitedObjects)">
-        <cds-text-label [label]="formControl.maxObjects"
-                        [for]="formControl.maxObjects"
-                        [invalid]="!accountForm.controls[formControl.maxObjects].valid && accountForm.controls[formControl.maxObjects].dirty"
-                        [invalidText]="quotaObjectError"
-                        i18n>Maximum objects
-          <input cdsText
-                 type="number"
-                 placeholder="Enter number of objects"
-                 [id]="formControl.maxObjects"
-                 [name]="formControl.maxObjects"
-                 [formControlName]="formControl.maxObjects"/>
+      <!-- Maximum objects -->
+      <div
+        class="input-wrapper"
+        *ngIf="
+          accountForm.controls[formControl.enabled].value &&
+          !accountForm.getValue(formControl.unlimitedObjects)
+        "
+      >
+        <cds-text-label
+          [label]="formControl.maxObjects"
+          [for]="formControl.maxObjects"
+          [invalid]="
+            !accountForm.controls[formControl.maxObjects].valid &&
+            accountForm.controls[formControl.maxObjects].dirty
+          "
+          [invalidText]="quotaObjectError"
+          i18n
+          >Maximum objects
+          <input
+            cdsText
+            type="number"
+            placeholder="Enter number of objects"
+            [id]="formControl.maxObjects"
+            [name]="formControl.maxObjects"
+            [formControlName]="formControl.maxObjects"
+          />
         </cds-text-label>
         <ng-template #quotaObjectError>
-          <span *ngIf="accountForm.showError(formControl.maxObjects, formDir, 'required')"
-                i18n>This field is required.</span>
-          <span *ngIf="accountForm.showError(formControl.maxObjects, formDir, 'pattern')"
-                i18n>Enter a valid positive number</span>
+          <span
+            *ngIf="accountForm.showError(formControl.maxObjects, formDir, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            *ngIf="accountForm.showError(formControl.maxObjects, formDir, 'pattern')"
+            i18n
+            >Enter a valid positive number</span
+          >
         </ng-template>
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html
index dddae94c99e..7e1b5acf9ef 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts/rgw-user-accounts.component.html
@@ -1,29 +1,32 @@
 <cd-rgw-user-tabs></cd-rgw-user-tabs>
 <legend i18n>
   User Accounts
-  <cd-help-text>
-    Create and manage accounts and their permissions.
-  </cd-help-text>
+  <cd-help-text> Create and manage accounts and their permissions. </cd-help-text>
 </legend>
-<cd-table #table
-          [autoReload]="false"
-          [data]="accounts"
-          [columns]="columns"
-          selectionType="single"
-          columnMode="flex"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)"
-          identifier="id"
-          (fetchData)="getAccountsList($event)"
-          [status]="tableStatus">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [autoReload]="false"
+  [data]="accounts"
+  [columns]="columns"
+  selectionType="single"
+  columnMode="flex"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+  identifier="id"
+  (fetchData)="getAccountsList($event)"
+  [status]="tableStatus"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-rgw-user-accounts-details *cdTableDetail
-                                [selection]="expandedRow">
+  <cd-rgw-user-accounts-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-rgw-user-accounts-details>
 </cd-table>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.html
index 2490fbdd175..b63da465fd8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.html
@@ -1,78 +1,107 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
 
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
 
-    <form #frm="ngForm"
-          [formGroup]="formGroup"
-          novalidate>
-      <div cdsModalContent>
-        <!-- Type -->
-        <div class="form-item">
-          <cds-text-label for="type"
-                          [invalid]="formGroup.controls.type.invalid && formGroup.controls.type.dirty"
-                          [invalidText]="typeError"
-                          *ngIf="editing"
-                          i18n>Type
-            <input cdsText
-                   id="type"
-                   name="type"
-                   formControlName="type"
-                   [readonly]="true"
-                   modal-primary-focus>
-          </cds-text-label>
+  <form
+    #frm="ngForm"
+    [formGroup]="formGroup"
+    novalidate
+  >
+    <div cdsModalContent>
+      <!-- Type -->
+      <div class="form-item">
+        <cds-text-label
+          for="type"
+          [invalid]="formGroup.controls.type.invalid && formGroup.controls.type.dirty"
+          [invalidText]="typeError"
+          *ngIf="editing"
+          i18n
+          >Type
+          <input
+            cdsText
+            id="type"
+            name="type"
+            formControlName="type"
+            [readonly]="true"
+            modal-primary-focus
+          />
+        </cds-text-label>
 
-          <cds-select *ngIf="!editing"
-                      label="Type"
-                      i18n-label
-                      for="type"
-                      formControlName="type"
-                      [invalid]="formGroup.controls.type.invalid && formGroup.controls.type.dirty"
-                      [invalidText]="typeError">
-            <option value="">--- Select a type ---</option>
-            <option *ngFor="let type of types"
-                    [value]="type">{{ type }}</option>
-          </cds-select>
-          <ng-template #typeError>
-            <span class="invalid-feedback"
-                  *ngIf="formGroup.showError('type', frm, 'required')"
-                  i18n>This field is required.</span>
-          </ng-template>
-        </div>
-
-        <!-- Permission -->
-        <div class="form-item">
-          <cds-select label="Permission"
-                      i18n-label
-                      for="perm"
-                      formControlName="perm"
-                      [invalid]="formGroup.controls.perm.invalid && formGroup.controls.perm.dirty"
-                      [invalidText]="permError">
-            <option value="">--- Select a permission ---</option>
-            <option *ngFor="let perm of ['read', 'write', '*']"
-                    [value]="perm">
-              {{ perm }}
-            </option>
-          </cds-select>
-
-          <ng-template #permError>
-            <span class="invalid-feedback"
-                  *ngIf="formGroup.showError('perm', frm, 'required')"
-                  i18n>This field is required.</span>
-          </ng-template>
-        </div>
+        <cds-select
+          *ngIf="!editing"
+          label="Type"
+          i18n-label
+          for="type"
+          formControlName="type"
+          [invalid]="formGroup.controls.type.invalid && formGroup.controls.type.dirty"
+          [invalidText]="typeError"
+        >
+          <option value="">--- Select a type ---</option>
+          <option
+            *ngFor="let type of types"
+            [value]="type"
+          >
+            {{ type }}
+          </option>
+        </cds-select>
+        <ng-template #typeError>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('type', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+        </ng-template>
       </div>
 
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          [form]="formGroup"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [modalForm]="true"></cd-form-button-panel>
+      <!-- Permission -->
+      <div class="form-item">
+        <cds-select
+          label="Permission"
+          i18n-label
+          for="perm"
+          formControlName="perm"
+          [invalid]="formGroup.controls.perm.invalid && formGroup.controls.perm.dirty"
+          [invalidText]="permError"
+        >
+          <option value="">--- Select a permission ---</option>
+          <option
+            *ngFor="let perm of ['read', 'write', '*']"
+            [value]="perm"
+          >
+            {{ perm }}
+          </option>
+        </cds-select>
 
+        <ng-template #permError>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('perm', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+        </ng-template>
+      </div>
+    </div>
+
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="formGroup"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </form>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.html
index c9d7719d6b6..9f1be3001b3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.html
@@ -25,55 +25,95 @@
     >
       <tbody>
         <tr>
-          <td i18n
-              class="bold w-25">Tenant</td>
+          <td
+            i18n
+            class="bold w-25"
+          >
+            Tenant
+          </td>
           <td class="w-75">{{ user.tenant }}</td>
         </tr>
         <tr>
-          <td i18n
-              class="bold w-25">User ID</td>
+          <td
+            i18n
+            class="bold w-25"
+          >
+            User ID
+          </td>
           <td class="w-75">{{ user.uid }}</td>
         </tr>
         <tr>
-          <td i18n
-              class="bold w-25">Username</td>
+          <td
+            i18n
+            class="bold w-25"
+          >
+            Username
+          </td>
           <td class="w-75">{{ user.uid }}</td>
         </tr>
         <tr>
-          <td i18n
-              class="bold">Full name</td>
+          <td
+            i18n
+            class="bold"
+          >
+            Full name
+          </td>
           <td>{{ user.display_name }}</td>
         </tr>
         <tr *ngIf="user.email?.length">
-          <td i18n
-              class="bold">Email address</td>
+          <td
+            i18n
+            class="bold"
+          >
+            Email address
+          </td>
           <td>{{ user.email }}</td>
         </tr>
         <tr>
-          <td i18n
-              class="bold">Suspended</td>
+          <td
+            i18n
+            class="bold"
+          >
+            Suspended
+          </td>
           <td>{{ user.suspended | booleanText }}</td>
         </tr>
         <tr>
-          <td i18n
-              class="bold">System user</td>
+          <td
+            i18n
+            class="bold"
+          >
+            System user
+          </td>
           <td>{{ user.system | booleanText }}</td>
         </tr>
         <tr>
-          <td i18n
-              class="bold">Maximum buckets</td>
+          <td
+            i18n
+            class="bold"
+          >
+            Maximum buckets
+          </td>
           <td>{{ user.max_buckets | map: maxBucketsMap }}</td>
         </tr>
-        @if (user.type === 'rgw' && selection.account?.id){
-        <tr>
-          <td i18n
-              class="bold">Managed policies</td>
-          <td i18n>{{ extractPolicyNamesFromArns(user.managed_user_policies) }}</td>
-        </tr>
+        @if (user.type === 'rgw' && selection.account?.id) {
+          <tr>
+            <td
+              i18n
+              class="bold"
+            >
+              Managed policies
+            </td>
+            <td i18n>{{ extractPolicyNamesFromArns(user.managed_user_policies) }}</td>
+          </tr>
         }
         <tr *ngIf="user.subusers && user.subusers.length">
-          <td i18n
-              class="bold">Subusers</td>
+          <td
+            i18n
+            class="bold"
+          >
+            Subusers
+          </td>
           <td>
             <div *ngFor="let subuser of user.subusers">
               {{ subuser.id }} ({{ subuser.permissions }})
@@ -81,15 +121,23 @@
           </td>
         </tr>
         <tr *ngIf="user.caps && user.caps.length">
-          <td i18n
-              class="bold">Capabilities</td>
+          <td
+            i18n
+            class="bold"
+          >
+            Capabilities
+          </td>
           <td>
             <div *ngFor="let cap of user.caps">{{ cap.type }} ({{ cap.perm }})</div>
           </td>
         </tr>
         <tr *ngIf="user.mfa_ids?.length">
-          <td i18n
-              class="bold">MFAs(Id)</td>
+          <td
+            i18n
+            class="bold"
+          >
+            MFAs(Id)
+          </td>
           <td>{{ user.mfa_ids | join }}</td>
         </tr>
       </tbody>
@@ -97,29 +145,51 @@
 
     <ng-container *ngIf="selection.account && selection.account?.id">
       <legend i18n>Account Details</legend>
-      <table class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
-             id="accountsDetails">
+      <table
+        class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+        id="accountsDetails"
+      >
         <tbody>
           <tr>
-            <td i18n
-                class="bold w-25">Account ID</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Account ID
+            </td>
             <td class="w-75">{{ selection.account?.id }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold w-25">Name</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Name
+            </td>
             <td class="w-75">{{ selection.account?.name }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold w-25">Tenant</td>
-            <td class="w-75">{{ selection.account?.tenant || '-'}}</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Tenant
+            </td>
+            <td class="w-75">{{ selection.account?.tenant || '-' }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold w-25">User type</td>
-            <td class="w-75"
-                i18n>{{ user?.type === 'root' ? 'Account root user' : 'rgw user' }}</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              User type
+            </td>
+            <td
+              class="w-75"
+              i18n
+            >
+              {{ user?.type === 'root' ? 'Account root user' : 'rgw user' }}
+            </td>
           </tr>
         </tbody>
       </table>
@@ -133,16 +203,26 @@
       >
         <tbody>
           <tr>
-            <td i18n
-                class="bold w-25">Enabled</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Enabled
+            </td>
             <td class="w-75">{{ user.user_quota.enabled | booleanText }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Maximum size</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Maximum size
+            </td>
             <td *ngIf="!user.user_quota.enabled">-</td>
-            <td *ngIf="user.user_quota.enabled && user.user_quota.max_size <= -1"
-                i18n>
+            <td
+              *ngIf="user.user_quota.enabled && user.user_quota.max_size <= -1"
+              i18n
+            >
               Unlimited
             </td>
             <td *ngIf="user.user_quota.enabled && user.user_quota.max_size > -1">
@@ -150,11 +230,17 @@
             </td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Maximum objects</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Maximum objects
+            </td>
             <td *ngIf="!user.user_quota.enabled">-</td>
-            <td *ngIf="user.user_quota.enabled && user.user_quota.max_objects <= -1"
-                i18n>
+            <td
+              *ngIf="user.user_quota.enabled && user.user_quota.max_objects <= -1"
+              i18n
+            >
               Unlimited
             </td>
             <td *ngIf="user.user_quota.enabled && user.user_quota.max_objects > -1">
@@ -173,16 +259,26 @@
       >
         <tbody>
           <tr>
-            <td i18n
-                class="bold w-25">Enabled</td>
+            <td
+              i18n
+              class="bold w-25"
+            >
+              Enabled
+            </td>
             <td class="w-75">{{ user.bucket_quota.enabled | booleanText }}</td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Maximum size</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Maximum size
+            </td>
             <td *ngIf="!user.bucket_quota.enabled">-</td>
-            <td *ngIf="user.bucket_quota.enabled && user.bucket_quota.max_size <= -1"
-                i18n>
+            <td
+              *ngIf="user.bucket_quota.enabled && user.bucket_quota.max_size <= -1"
+              i18n
+            >
               Unlimited
             </td>
             <td *ngIf="user.bucket_quota.enabled && user.bucket_quota.max_size > -1">
@@ -190,11 +286,17 @@
             </td>
           </tr>
           <tr>
-            <td i18n
-                class="bold">Maximum objects</td>
+            <td
+              i18n
+              class="bold"
+            >
+              Maximum objects
+            </td>
             <td *ngIf="!user.bucket_quota.enabled">-</td>
-            <td *ngIf="user.bucket_quota.enabled && user.bucket_quota.max_objects <= -1"
-                i18n>
+            <td
+              *ngIf="user.bucket_quota.enabled && user.bucket_quota.max_objects <= -1"
+              i18n
+            >
               Unlimited
             </td>
             <td *ngIf="user.bucket_quota.enabled && user.bucket_quota.max_objects > -1">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.html
index b016e0d2420..9daef795ab1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.html
@@ -1,51 +1,84 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}"
-     *cdFormLoading="loading">
-  <form #frm="ngForm"
-        [formGroup]="userForm"
-        novalidate>
-    <div i18n="form title"
-         class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}</div>
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+  *cdFormLoading="loading"
+>
+  <form
+    #frm="ngForm"
+    [formGroup]="userForm"
+    novalidate
+  >
+    <div
+      i18n="form title"
+      class="form-header"
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </div>
 
-    @if(accounts.length > 0){
+    @if (accounts.length > 0) {
       <!-- Link Account -->
       <div class="form-item">
-        <cds-select label="Link Account"
-                    i18n-label
-                    id="link_account"
-                    for="link_account"
-                    formControlName="account_id"
-                    [invalid]="userForm.controls.account_id.invalid && userForm.controls.account_id.dirty"
-                    [invalidText]="accountError"
-                    [helperText]="accountsHelper">
-          <option i18n
-                  *ngIf="accounts === null"
-                  [ngValue]="null">Loading...</option>
-          <option i18n
-                  *ngIf="accounts !== null"
-                  [value]="''">-- Select an Account --</option>
-          <option *ngFor="let account of accounts"
-                  [value]="account.id">{{ account.name }} {{account.tenant ? '- '+account.tenant : ''}}</option>
+        <cds-select
+          label="Link Account"
+          i18n-label
+          id="link_account"
+          for="link_account"
+          formControlName="account_id"
+          [invalid]="userForm.controls.account_id.invalid && userForm.controls.account_id.dirty"
+          [invalidText]="accountError"
+          [helperText]="accountsHelper"
+        >
+          <option
+            i18n
+            *ngIf="accounts === null"
+            [ngValue]="null"
+          >
+            Loading...
+          </option>
+          <option
+            i18n
+            *ngIf="accounts !== null"
+            [value]="''"
+          >
+            -- Select an Account --
+          </option>
+          <option
+            *ngFor="let account of accounts"
+            [value]="account.id"
+          >
+            {{ account.name }} {{ account.tenant ? '- ' + account.tenant : '' }}
+          </option>
         </cds-select>
         <ng-template #accountError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('account_id', frm, 'tenantedAccount')"
-                i18n>Only accounts with the same tenant name can be linked to a tenanted user.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('account_id', frm, 'tenantedAccount')"
+            i18n
+            >Only accounts with the same tenant name can be linked to a tenanted user.</span
+          >
         </ng-template>
         <ng-template #accountsHelper>
-          <div i18n>Account membership is permanent. Once added, users cannot be removed from their account.</div>
+          <div i18n>
+            Account membership is permanent. Once added, users cannot be removed from their account.
+          </div>
           <div i18n>Ownership of all of the user's buckets will be transferred to the account.</div>
         </ng-template>
       </div>
 
       <!-- Account Root user -->
-      <div *ngIf="userForm.getValue('account_id')"
-           class="form-item">
-        <cds-checkbox formControlName="account_root_user"
-                      id="account_root_user"
-                      i18n>Account Root user
-          <cd-help-text>The account root user has full access to all resources and manages the account.
-            It's recommended to use this account for management tasks only and create additional users with specific permissions.
+      <div
+        *ngIf="userForm.getValue('account_id')"
+        class="form-item"
+      >
+        <cds-checkbox
+          formControlName="account_root_user"
+          id="account_root_user"
+          i18n
+          >Account Root user
+          <cd-help-text
+            >The account root user has full access to all resources and manages the account. It's
+            recommended to use this account for management tasks only and create additional users
+            with specific permissions.
           </cd-help-text>
         </cds-checkbox>
       </div>
@@ -53,245 +86,360 @@
 
     <!-- User ID -->
     <div class="form-item">
-      <cds-text-label for="user_id"
-                      i18n
-                      cdRequiredField="User ID"
-                      [invalid]="userForm.controls.user_id.invalid && (userForm.controls.user_id.dirty)"
-                      [invalidText]="userError">User ID
-        <input cdsText
-               formControlName="user_id"
-               name="user_id"
-               id="user_id"
-               [invalid]="userForm.controls.user_id.invalid && (userForm.controls.user_id.dirty)"
-               [readonly]="editing"
-               [autofocus]="!editing"/>
+      <cds-text-label
+        for="user_id"
+        i18n
+        cdRequiredField="User ID"
+        [invalid]="userForm.controls.user_id.invalid && userForm.controls.user_id.dirty"
+        [invalidText]="userError"
+        >User ID
+        <input
+          cdsText
+          formControlName="user_id"
+          name="user_id"
+          id="user_id"
+          [invalid]="userForm.controls.user_id.invalid && userForm.controls.user_id.dirty"
+          [readonly]="editing"
+          [autofocus]="!editing"
+        />
       </cds-text-label>
       <ng-template #userError>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('user_id', frm, 'required')"
-              i18n>This field is required.</span>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('user_id', frm, 'pattern')"
-              i18n>The value is not valid.</span>
-        <span class="invalid-feedback"
-              *ngIf="!userForm.getValue('show_tenant') && userForm.showError('user_id', frm, 'notUnique')"
-              i18n>The chosen user ID is already in use.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('user_id', frm, 'required')"
+          i18n
+          >This field is required.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('user_id', frm, 'pattern')"
+          i18n
+          >The value is not valid.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="
+            !userForm.getValue('show_tenant') && userForm.showError('user_id', frm, 'notUnique')
+          "
+          i18n
+          >The chosen user ID is already in use.</span
+        >
       </ng-template>
     </div>
 
     <!-- Show Tenant -->
     <div class="form-item">
-      <cds-checkbox formControlName="show_tenant"
-                    id="show_tenant"
-                    [readonly]="true"
-                    (checkedChange)="updateFieldsWhenTenanted()">Show Tenant
+      <cds-checkbox
+        formControlName="show_tenant"
+        id="show_tenant"
+        [readonly]="true"
+        (checkedChange)="updateFieldsWhenTenanted()"
+        >Show Tenant
       </cds-checkbox>
     </div>
 
     <!-- Tenant -->
-    <div class="form-item"
-         *ngIf="userForm.getValue('show_tenant')">
-      <cds-text-label for="tenant"
-                      i18n
-                      [invalid]="userForm.controls.tenant.invalid && (userForm.controls.tenant.dirty)"
-                      [invalidText]="tenantError">Tenant
-        <input cdsText
-               formControlName="tenant"
-               name="tenant"
-               id="tenant"
-               [invalid]="userForm.controls.tenant.invalid && (userForm.controls.tenant.dirty)"
-               [readonly]="editing"
-               autofocus/>
+    <div
+      class="form-item"
+      *ngIf="userForm.getValue('show_tenant')"
+    >
+      <cds-text-label
+        for="tenant"
+        i18n
+        [invalid]="userForm.controls.tenant.invalid && userForm.controls.tenant.dirty"
+        [invalidText]="tenantError"
+        >Tenant
+        <input
+          cdsText
+          formControlName="tenant"
+          name="tenant"
+          id="tenant"
+          [invalid]="userForm.controls.tenant.invalid && userForm.controls.tenant.dirty"
+          [readonly]="editing"
+          autofocus
+        />
       </cds-text-label>
       <ng-template #tenantError>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('tenant', frm, 'pattern')"
-              i18n>The value is not valid.</span>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('tenant', frm, 'notUnique')"
-              i18n>The chosen user ID exists in this tenant.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('tenant', frm, 'pattern')"
+          i18n
+          >The value is not valid.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('tenant', frm, 'notUnique')"
+          i18n
+          >The chosen user ID exists in this tenant.</span
+        >
       </ng-template>
     </div>
 
     <!-- Full name -->
     <div class="form-item">
-      <cds-text-label  for="display_name"
-                       i18n
-                       cdRequiredField="Full name"
-                       [invalid]="userForm.controls.display_name.invalid && (userForm.controls.display_name.dirty)"
-                       [invalidText]="displayNameError">Full name
-        <input cdsText
-               formControlName="display_name"
-               name="display_name"
-               id="display_name"
-               [invalid]="userForm.showError('display_name', formDir)"/>
+      <cds-text-label
+        for="display_name"
+        i18n
+        cdRequiredField="Full name"
+        [invalid]="userForm.controls.display_name.invalid && userForm.controls.display_name.dirty"
+        [invalidText]="displayNameError"
+        >Full name
+        <input
+          cdsText
+          formControlName="display_name"
+          name="display_name"
+          id="display_name"
+          [invalid]="userForm.showError('display_name', formDir)"
+        />
       </cds-text-label>
       <ng-template #displayNameError>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('display_name', frm, 'required')"
-              i18n>This field is required.</span>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('display_name', frm, 'pattern')"
-              i18n>The value is not valid.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('display_name', frm, 'required')"
+          i18n
+          >This field is required.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('display_name', frm, 'pattern')"
+          i18n
+          >The value is not valid.</span
+        >
       </ng-template>
     </div>
 
     <!-- Email address -->
     <div class="form-item">
-      <cds-text-label for="email"
-                      i18n
-                      [invalid]="userForm.controls.email.invalid && (userForm.controls.email.dirty)"
-                      [invalidText]="emailError">Email address
-        <input cdsText
-               formControlName="email"
-               name="email"
-               id="email"
-               [invalid]="userForm.controls.email.invalid && (userForm.controls.email.dirty)"/>
+      <cds-text-label
+        for="email"
+        i18n
+        [invalid]="userForm.controls.email.invalid && userForm.controls.email.dirty"
+        [invalidText]="emailError"
+        >Email address
+        <input
+          cdsText
+          formControlName="email"
+          name="email"
+          id="email"
+          [invalid]="userForm.controls.email.invalid && userForm.controls.email.dirty"
+        />
       </cds-text-label>
       <ng-template #emailError>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('email', frm, 'email')"
-              i18n>This is not a valid email address.</span>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('email', frm, 'notUnique')"
-              i18n>The chosen email address is already in use.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('email', frm, 'email')"
+          i18n
+          >This is not a valid email address.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('email', frm, 'notUnique')"
+          i18n
+          >The chosen email address is already in use.</span
+        >
       </ng-template>
     </div>
 
     <!-- Max. buckets -->
     <div class="form-item">
-      <cds-select label="Maximum buckets"
-                  for="max_buckets_mode"
-                  formControlName="max_buckets_mode"
-                  id="max_buckets_mode"
-                  (valueChange)="onMaxBucketsModeChange($event)">
-        <option value="-1"
-                i18n>Disabled</option>
-        <option value="0"
-                i18n>Unlimited</option>
-        <option value="1"
-                i18n>Custom</option>
+      <cds-select
+        label="Maximum buckets"
+        for="max_buckets_mode"
+        formControlName="max_buckets_mode"
+        id="max_buckets_mode"
+        (valueChange)="onMaxBucketsModeChange($event)"
+      >
+        <option
+          value="-1"
+          i18n
+        >
+          Disabled
+        </option>
+        <option
+          value="0"
+          i18n
+        >
+          Unlimited
+        </option>
+        <option
+          value="1"
+          i18n
+        >
+          Custom
+        </option>
       </cds-select>
     </div>
-    <div *ngIf="1 == userForm.get('max_buckets_mode').value"
-         class="form-item">
-      <cds-number for="max_buckets"
-                  formControlName="max_buckets"
-                  id="max_buckets"
-                  min="1"
-                  [invalid]="userForm.controls.max_buckets.invalid && (userForm.controls.max_buckets.dirty)"
-                  [invalidText]="maxBucketsError"></cds-number>
+    <div
+      *ngIf="1 == userForm.get('max_buckets_mode').value"
+      class="form-item"
+    >
+      <cds-number
+        for="max_buckets"
+        formControlName="max_buckets"
+        id="max_buckets"
+        min="1"
+        [invalid]="userForm.controls.max_buckets.invalid && userForm.controls.max_buckets.dirty"
+        [invalidText]="maxBucketsError"
+      ></cds-number>
       <ng-template #maxBucketsError>
-        <span class="invalid-feedback"
-              *ngIf="userForm.showError('max_buckets', frm, 'required')"
-              i18n>This field is required.</span>
-        <span class="invalid-feedback"
-              i18n>The entered value must be >= 1.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="userForm.showError('max_buckets', frm, 'required')"
+          i18n
+          >This field is required.</span
+        >
+        <span
+          class="invalid-feedback"
+          i18n
+          >The entered value must be >= 1.</span
+        >
       </ng-template>
     </div>
 
     <!-- Suspended -->
     <div class="form-item">
-      <cds-checkbox formControlName="suspended"
-                    id="suspended"
-                    i18n>Suspended
+      <cds-checkbox
+        formControlName="suspended"
+        id="suspended"
+        i18n
+        >Suspended
         <cd-help-text>Suspending the user disables the user and subuser.</cd-help-text>
       </cds-checkbox>
     </div>
 
     <!-- System User -->
     <div class="form-item">
-      <cds-checkbox formControlName="system"
-                    id="system"
-                    i18n>System user
-        <cd-help-text>System users are distinct from regular users, they are used by the RGW service to perform administrative tasks, manage buckets and objects</cd-help-text>
+      <cds-checkbox
+        formControlName="system"
+        id="system"
+        i18n
+        >System user
+        <cd-help-text
+          >System users are distinct from regular users, they are used by the RGW service to perform
+          administrative tasks, manage buckets and objects</cd-help-text
+        >
       </cds-checkbox>
     </div>
 
-    @if(userForm.getValue('account_id') && !userForm.getValue('account_root_user')) {
-    <!-- Managed policies -->
-    <fieldset>
-      <div class="form-item">
-        <legend i18n
-                class="cd-header">Managed policies</legend>
-        <cds-combo-box label="Policies"
-                       type="multi"
-                       selectionFeedback="top-after-reopen"
-                       formControlName="account_policies"
-                       id="account_policies"
-                       placeholder="Select managed policies..."
-                       i18n-placeholder
-                       [appendInline]="true"
-                       [items]="managedPolicies"
-                       (selected)="multiSelector($event)"
-                       itemValueKey="name"
-                       i18n-label
-                       i18n>
-          <cds-dropdown-list></cds-dropdown-list>
-        </cds-combo-box>
-      </div>
-    </fieldset>
+    @if (userForm.getValue('account_id') && !userForm.getValue('account_root_user')) {
+      <!-- Managed policies -->
+      <fieldset>
+        <div class="form-item">
+          <legend
+            i18n
+            class="cd-header"
+          >
+            Managed policies
+          </legend>
+          <cds-combo-box
+            label="Policies"
+            type="multi"
+            selectionFeedback="top-after-reopen"
+            formControlName="account_policies"
+            id="account_policies"
+            placeholder="Select managed policies..."
+            i18n-placeholder
+            [appendInline]="true"
+            [items]="managedPolicies"
+            (selected)="multiSelector($event)"
+            itemValueKey="name"
+            i18n-label
+            i18n
+          >
+            <cds-dropdown-list></cds-dropdown-list>
+          </cds-combo-box>
+        </div>
+      </fieldset>
     }
 
     <!-- S3 key -->
     <fieldset *ngIf="!editing">
-      <legend i18n
-              class="cd-header">S3 key</legend>
+      <legend
+        i18n
+        class="cd-header"
+      >
+        S3 key
+      </legend>
 
       <!-- Auto-generate key -->
       <div class="form-item">
-        <cds-checkbox formControlName="generate_key"
-                      id="generate_key"
-                      i18n>Auto-generate key</cds-checkbox>
+        <cds-checkbox
+          formControlName="generate_key"
+          id="generate_key"
+          i18n
+          >Auto-generate key</cds-checkbox
+        >
       </div>
 
       <!-- Access key -->
-      <div class="form-item form-item-append"
-           *ngIf="!editing && !userForm.getValue('generate_key')">
-        <cds-password-label for="access_key"
-                            i18n
-                            cdRequiredField="Access key"
-                            [invalid]="userForm.controls.access_key.invalid && (userForm.controls.access_key.dirty)"
-                            [invalidText]="accessKeyError">Access key
-          <input cdsPassword
-                 type="password"
-                 formControlName="access_key"
-                 name="access_key"
-                 id="access_key"
-                 [invalid]="userForm.controls.access_key.invalid && (userForm.controls.access_key.dirty)"/>
+      <div
+        class="form-item form-item-append"
+        *ngIf="!editing && !userForm.getValue('generate_key')"
+      >
+        <cds-password-label
+          for="access_key"
+          i18n
+          cdRequiredField="Access key"
+          [invalid]="userForm.controls.access_key.invalid && userForm.controls.access_key.dirty"
+          [invalidText]="accessKeyError"
+          >Access key
+          <input
+            cdsPassword
+            type="password"
+            formControlName="access_key"
+            name="access_key"
+            id="access_key"
+            [invalid]="userForm.controls.access_key.invalid && userForm.controls.access_key.dirty"
+          />
         </cds-password-label>
-        <cd-copy-2-clipboard-button source="access_key"
-                                    class="mt-4">
+        <cd-copy-2-clipboard-button
+          source="access_key"
+          class="mt-4"
+        >
         </cd-copy-2-clipboard-button>
         <ng-template #accessKeyError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('access_key', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('access_key', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Secret key -->
-      <div class="form-item form-item-append"
-           *ngIf="!editing && !userForm.getValue('generate_key')">
-        <cds-password-label for="secret"
-                            i18n
-                            cdRequiredField="Secret key"
-                            [invalid]="userForm.controls.secret_key.invalid && (userForm.controls.secret_key.dirty)"
-                            [invalidText]="secretKeyError">Secret key
-          <input cdsPassword
-                 type="password"
-                 formControlName="secret_key"
-                 name="secret_key"
-                 id="secret_key"
-                 [invalid]="userForm.controls.secret_key.invalid && (userForm.controls.secret_key.dirty)"/>
+      <div
+        class="form-item form-item-append"
+        *ngIf="!editing && !userForm.getValue('generate_key')"
+      >
+        <cds-password-label
+          for="secret"
+          i18n
+          cdRequiredField="Secret key"
+          [invalid]="userForm.controls.secret_key.invalid && userForm.controls.secret_key.dirty"
+          [invalidText]="secretKeyError"
+          >Secret key
+          <input
+            cdsPassword
+            type="password"
+            formControlName="secret_key"
+            name="secret_key"
+            id="secret_key"
+            [invalid]="userForm.controls.secret_key.invalid && userForm.controls.secret_key.dirty"
+          />
         </cds-password-label>
-        <cd-copy-2-clipboard-button source="secret_key"
-                                    class="mt-4">
+        <cd-copy-2-clipboard-button
+          source="secret_key"
+          class="mt-4"
+        >
         </cd-copy-2-clipboard-button>
         <ng-template #secretKeyError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('secret_key', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('secret_key', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
     </fieldset>
@@ -299,168 +447,240 @@
     <!-- Subusers -->
     <fieldset *ngIf="editing">
       <div class="form-item">
-      <legend i18n
-              class="cd-header">Subusers</legend>
-      <span *ngIf="subusers.length === 0"
-            class="no-border">
-        <span class="form-text text-muted"
-              i18n>There are no subusers.</span>
-      </span>
+        <legend
+          i18n
+          class="cd-header"
+        >
+          Subusers
+        </legend>
+        <span
+          *ngIf="subusers.length === 0"
+          class="no-border"
+        >
+          <span
+            class="form-text text-muted"
+            i18n
+            >There are no subusers.</span
+          >
+        </span>
 
-      <ng-container *ngFor="let subuser of subusers; let i=index;">
-
-      <div cdsRow
-           class="form-item-append"
-           [ngClass]="{'form-item': i > 0}">
-        <div cdsCol>
-          <cds-text-label>Subuser id
-            <input cdsText
-                   [value]="subuser.id"
-                   readonly>
-          </cds-text-label>
+        <ng-container *ngFor="let subuser of subusers; let i = index">
+          <div
+            cdsRow
+            class="form-item-append"
+            [ngClass]="{ 'form-item': i > 0 }"
+          >
+            <div cdsCol>
+              <cds-text-label
+                >Subuser id
+                <input
+                  cdsText
+                  [value]="subuser.id"
+                  readonly
+                />
+              </cds-text-label>
+            </div>
+            <div cdsCol>
+              <cds-text-label
+                >Permissions
+                <input
+                  cdsText
+                  [value]="'full-control' === subuser.permissions ? 'full' : subuser.permissions"
+                  readonly
+                />
+              </cds-text-label>
+            </div>
+            <cds-icon-button
+              kind="tertiary"
+              size="md"
+              title="Edit"
+              class="mt-4 tc_showSubuserButton"
+              (click)="showSubuserModal(i)"
+            >
+              <svg
+                [cdsIcon]="icons.edit"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              ></svg>
+            </cds-icon-button>
+            <cds-icon-button
+              kind="danger"
+              size="md"
+              title="Delete"
+              class="mt-4 tc_deleteSubuserButton"
+              (click)="deleteSubuser(i)"
+            >
+              <svg
+                [cdsIcon]="icons.trash"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              >
+                >
+              </svg>
+            </cds-icon-button>
+          </div>
+        </ng-container>
+        <div
+          cdsRow
+          class="form-item"
+        >
+          <div cdsCol>
+            <button
+              cdsButton="tertiary"
+              type="button"
+              class="tc_addSubuserButton"
+              (click)="showSubuserModal()"
+            >
+              <ng-container i18n
+                >{{ actionLabels.CREATE | titlecase }} {{ subuserLabel | upperFirst }}</ng-container
+              >
+              <svg
+                [cdsIcon]="icons.add"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              ></svg>
+            </button>
+          </div>
         </div>
-        <div cdsCol>
-          <cds-text-label>Permissions
-            <input cdsText
-                   [value]="('full-control' === subuser.permissions) ? 'full' : subuser.permissions"
-                   readonly>
-          </cds-text-label>
-        </div>
-        <cds-icon-button kind="tertiary"
-                         size="md"
-                         title="Edit"
-                         class="mt-4 tc_showSubuserButton"
-                         (click)="showSubuserModal(i)">
-          <svg [cdsIcon]="icons.edit"
-               [size]="icons.size32"
-               class="cds--btn__icon"></svg>
-        </cds-icon-button>
-        <cds-icon-button kind="danger"
-                         size="md"
-                         title="Delete"
-                         class="mt-4 tc_deleteSubuserButton"
-                         (click)="deleteSubuser(i)">
-          <svg [cdsIcon]="icons.trash"
-               [size]="icons.size32"
-               class="cds--btn__icon">></svg>
-        </cds-icon-button>
-        </div>
-      </ng-container>
-      <div cdsRow
-           class="form-item">
-        <div cdsCol>
-          <button cdsButton="tertiary"
-                  type="button"
-                  class="tc_addSubuserButton"
-                  (click)="showSubuserModal()">
-            <ng-container i18n>{{ actionLabels.CREATE | titlecase }}
-              {{ subuserLabel | upperFirst }}</ng-container>
-            <svg [cdsIcon]="icons.add"
-                 [size]="icons.size32"
-                 class="cds--btn__icon"></svg>
-          </button>
-        </div>
-      </div>
       </div>
     </fieldset>
 
     <!-- Keys -->
     <fieldset *ngIf="editing">
       <div class="form-item">
-        <legend i18n
-                class="cd-header">Keys</legend>
+        <legend
+          i18n
+          class="cd-header"
+        >
+          Keys
+        </legend>
 
         <!-- S3 keys -->
         <h6>S3</h6>
-        <span *ngIf="s3Keys.length === 0"
-              class="no-border">
-          <span class="form-text text-muted"
-                i18n>There are no keys.</span>
+        <span
+          *ngIf="s3Keys.length === 0"
+          class="no-border"
+        >
+          <span
+            class="form-text text-muted"
+            i18n
+            >There are no keys.</span
+          >
         </span>
 
-        <span *ngFor="let key of s3Keys; let i=index;">
-          <div class="form-item-append"
-               cdsRow>
+        <span *ngFor="let key of s3Keys; let i = index">
+          <div
+            class="form-item-append"
+            cdsRow
+          >
             <div cdsCol>
               <cds-text-label>
-                <input cdsText
-                       [value]="key.user"
-                       readonly>
+                <input
+                  cdsText
+                  [value]="key.user"
+                  readonly
+                />
               </cds-text-label>
             </div>
-            <cds-icon-button kind="tertiary"
-                             size="md"
-                             title="Show"
-                             i18n-title
-                             class="mt-2 tc_showS3KeyButton"
-                             (click)="showS3KeyModal(i)">
-              <svg [cdsIcon]="icons.edit"
-                   [size]="icons.size16"
-                   class="cds--btn__icon"></svg>
+            <cds-icon-button
+              kind="tertiary"
+              size="md"
+              title="Show"
+              i18n-title
+              class="mt-2 tc_showS3KeyButton"
+              (click)="showS3KeyModal(i)"
+            >
+              <svg
+                [cdsIcon]="icons.edit"
+                [size]="icons.size16"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
-            <cds-icon-button kind="danger"
-                             size="md"
-                             title="Delete"
-                             class="mt-2 tc_deleteS3KeyButton"
-                             (click)="deleteS3Key(i)">
-              <svg [cdsIcon]="icons.trash"
-                   [size]="icons.size32"
-                   class="cds--btn__icon"></svg>
+            <cds-icon-button
+              kind="danger"
+              size="md"
+              title="Delete"
+              class="mt-2 tc_deleteS3KeyButton"
+              (click)="deleteS3Key(i)"
+            >
+              <svg
+                [cdsIcon]="icons.trash"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
           </div>
           <span class="form-text text-muted"></span>
         </span>
 
-        <div class="form-item"
-             cdsRow>
+        <div
+          class="form-item"
+          cdsRow
+        >
           <div cdsCol>
-            <button type="button"
-                    cdsButton="tertiary"
-                    class="tc_addS3KeyButton"
-                    (click)="showS3KeyModal()">
-              <ng-container i18n>{{ actionLabels.CREATE | titlecase }}
-                {{ s3keyLabel | upperFirst }}</ng-container>
-              <svg [cdsIcon]="icons.add"
-                   [size]="icons.size32"
-                   class="cds--btn__icon"></svg>
+            <button
+              type="button"
+              cdsButton="tertiary"
+              class="tc_addS3KeyButton"
+              (click)="showS3KeyModal()"
+            >
+              <ng-container i18n
+                >{{ actionLabels.CREATE | titlecase }} {{ s3keyLabel | upperFirst }}</ng-container
+              >
+              <svg
+                [cdsIcon]="icons.add"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              ></svg>
             </button>
           </div>
         </div>
 
-        <hr>
+        <hr />
       </div>
 
       <!-- Swift keys -->
       <div class="form-item">
-
         <h6>Swift</h6>
-        <span *ngIf="swiftKeys.length === 0"
-              class="no-border">
-          <span class="form-text text-muted"
-                i18n>There are no keys.</span>
+        <span
+          *ngIf="swiftKeys.length === 0"
+          class="no-border"
+        >
+          <span
+            class="form-text text-muted"
+            i18n
+            >There are no keys.</span
+          >
         </span>
 
-        <span *ngFor="let key of swiftKeys; let i=index;">
-          <div class="form-item-append"
-               cdsRow>
+        <span *ngFor="let key of swiftKeys; let i = index">
+          <div
+            class="form-item-append"
+            cdsRow
+          >
             <div cdsCol>
               <cds-text-label>
-                <input cdsText
-                       [value]="key.user"
-                       readonly>
+                <input
+                  cdsText
+                  [value]="key.user"
+                  readonly
+                />
               </cds-text-label>
             </div>
-          <cds-icon-button kind="tertiary"
-                           size="md"
-                           title="Show"
-                           i18n-title
-                           class="mt-2 tc_showSwiftKeyButton"
-                           (click)="showSwiftKeyModal(i)">
-            <svg [cdsIcon]="icons.show"
-                 [size]="icons.size16"
-                 class="cds--btn__icon">
-            </svg>
-          </cds-icon-button>
+            <cds-icon-button
+              kind="tertiary"
+              size="md"
+              title="Show"
+              i18n-title
+              class="mt-2 tc_showSwiftKeyButton"
+              (click)="showSwiftKeyModal(i)"
+            >
+              <svg
+                [cdsIcon]="icons.show"
+                [size]="icons.size16"
+                class="cds--btn__icon"
+              ></svg>
+            </cds-icon-button>
           </div>
         </span>
       </div>
@@ -468,73 +688,104 @@
 
     <!-- Capabilities -->
     <fieldset *ngIf="editing">
-
       <div class="form-item">
-        <legend i18n
-                class="cd-header">Capabilities</legend>
-        <span *ngIf="capabilities.length === 0"
-              class="no-border">
-          <span class="form-text text-muted"
-                i18n>There are no capabilities.</span>
+        <legend
+          i18n
+          class="cd-header"
+        >
+          Capabilities
+        </legend>
+        <span
+          *ngIf="capabilities.length === 0"
+          class="no-border"
+        >
+          <span
+            class="form-text text-muted"
+            i18n
+            >There are no capabilities.</span
+          >
         </span>
 
-        <span *ngFor="let cap of capabilities; let i=index;">
-          <div class="form-item-append"
-               [ngClass]="{'form-item': i > 0}"
-               cdsRow>
+        <span *ngFor="let cap of capabilities; let i = index">
+          <div
+            class="form-item-append"
+            [ngClass]="{ 'form-item': i > 0 }"
+            cdsRow
+          >
             <div cdsCol>
-              <cds-text-label i18n>Type
-                <input cdsText
-                       [value]="cap.type"
-                       readonly>
+              <cds-text-label i18n
+                >Type
+                <input
+                  cdsText
+                  [value]="cap.type"
+                  readonly
+                />
               </cds-text-label>
             </div>
             <div cdsCol>
-              <cds-text-label i18n>Permission
-                <input cdsText
-                       [value]="cap.perm"
-                       readonly>
+              <cds-text-label i18n
+                >Permission
+                <input
+                  cdsText
+                  [value]="cap.perm"
+                  readonly
+                />
               </cds-text-label>
             </div>
-            <cds-icon-button kind="tertiary"
-                             size="md"
-                             title="Edit"
-                             class="mt-4 tc_editCapButton"
-                             (click)="showCapabilityModal(i)">
-              <svg [cdsIcon]="icons.edit"
-                   [size]="icons.size16"
-                   class="cds--btn__icon"></svg>
+            <cds-icon-button
+              kind="tertiary"
+              size="md"
+              title="Edit"
+              class="mt-4 tc_editCapButton"
+              (click)="showCapabilityModal(i)"
+            >
+              <svg
+                [cdsIcon]="icons.edit"
+                [size]="icons.size16"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
-            <cds-icon-button kind="danger"
-                             size="md"
-                             title="Delete"
-                             class="mt-4 tc_deleteCapButton"
-                             (click)="deleteCapability(i)">
-              <svg [cdsIcon]="icons.trash"
-                   [size]="icons.size32"
-                   class="cds--btn__icon"></svg>
+            <cds-icon-button
+              kind="danger"
+              size="md"
+              title="Delete"
+              class="mt-4 tc_deleteCapButton"
+              (click)="deleteCapability(i)"
+            >
+              <svg
+                [cdsIcon]="icons.trash"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
           </div>
           <span class="form-text text-muted"></span>
         </span>
 
-        <div class="form-item"
-             cdsRow>
+        <div
+          class="form-item"
+          cdsRow
+        >
           <div cdsCol>
-            <button type="button"
-                    class="tc_addCapButton"
-                    cdsButton="tertiary"
-                    [disabled]="capabilities | pipeFunction:hasAllCapabilities"
-                    i18n-ngbTooltip
-                    ngbTooltip="All capabilities are already added."
-                    [disableTooltip]="!(capabilities | pipeFunction:hasAllCapabilities)"
-                    triggers="pointerenter:pointerleave"
-                    (click)="showCapabilityModal()">
-              <ng-container i18n>{{ actionLabels.ADD | titlecase }}
-                {{ capabilityLabel | upperFirst }}</ng-container>
-              <svg [cdsIcon]="icons.add"
-                   [size]="icons.size32"
-                   class="cds--btn__icon"></svg>
+            <button
+              type="button"
+              class="tc_addCapButton"
+              cdsButton="tertiary"
+              [disabled]="capabilities | pipeFunction: hasAllCapabilities"
+              i18n-ngbTooltip
+              ngbTooltip="All capabilities are already added."
+              [disableTooltip]="!(capabilities | pipeFunction: hasAllCapabilities)"
+              triggers="pointerenter:pointerleave"
+              (click)="showCapabilityModal()"
+            >
+              <ng-container i18n
+                >{{ actionLabels.ADD | titlecase }} {{ capabilityLabel | upperFirst }}</ng-container
+              >
+              <svg
+                [cdsIcon]="icons.add"
+                [size]="icons.size32"
+                class="cds--btn__icon"
+              ></svg>
             </button>
           </div>
         </div>
@@ -544,78 +795,134 @@
     <!-- User quota -->
     <fieldset>
       <div class="form-item">
-        <legend i18n
-                class="cd-header">User quota</legend>
+        <legend
+          i18n
+          class="cd-header"
+        >
+          User quota
+        </legend>
 
-      <!-- Enabled -->
-        <cds-checkbox formControlName="user_quota_enabled"
-                      id="user_quota_enabled"
-                      i18n>Enabled
+        <!-- Enabled -->
+        <cds-checkbox
+          formControlName="user_quota_enabled"
+          id="user_quota_enabled"
+          i18n
+          >Enabled
         </cds-checkbox>
       </div>
 
       <!-- Unlimited size -->
-      <div class="form-item"
-           *ngIf="userForm.controls.user_quota_enabled.value">
-        <cds-checkbox formControlName="user_quota_max_size_unlimited"
-                      id="user_quota_max_size_unlimited"
-                      i18n>Unlimited size</cds-checkbox>
+      <div
+        class="form-item"
+        *ngIf="userForm.controls.user_quota_enabled.value"
+      >
+        <cds-checkbox
+          formControlName="user_quota_max_size_unlimited"
+          id="user_quota_max_size_unlimited"
+          i18n
+          >Unlimited size</cds-checkbox
+        >
       </div>
 
       <!-- Maximum size -->
-      <div class="form-item"
-           *ngIf="userForm.controls.user_quota_enabled.value && !userForm.getValue('user_quota_max_size_unlimited')">
-        <cds-text-label for="user_quota_max_size"
-                        i18n
-                        cdRequiredField="Maximum size"
-                        [invalid]="userForm.controls.user_quota_max_size.invalid && (userForm.controls.user_quota_max_size.dirty)"
-                        [invalidText]="quotaMaxSizeError">Maximum size
-          <input cdsText
-                 formControlName="user_quota_max_size"
-                 name="user_quota_max_size"
-                 id="user_quota_max_size"
-                 [invalid]="userForm.controls.user_quota_max_size.invalid && (userForm.controls.user_quota_max_size.dirty)"
-                 cdDimlessBinary/>
+      <div
+        class="form-item"
+        *ngIf="
+          userForm.controls.user_quota_enabled.value &&
+          !userForm.getValue('user_quota_max_size_unlimited')
+        "
+      >
+        <cds-text-label
+          for="user_quota_max_size"
+          i18n
+          cdRequiredField="Maximum size"
+          [invalid]="
+            userForm.controls.user_quota_max_size.invalid &&
+            userForm.controls.user_quota_max_size.dirty
+          "
+          [invalidText]="quotaMaxSizeError"
+          >Maximum size
+          <input
+            cdsText
+            formControlName="user_quota_max_size"
+            name="user_quota_max_size"
+            id="user_quota_max_size"
+            [invalid]="
+              userForm.controls.user_quota_max_size.invalid &&
+              userForm.controls.user_quota_max_size.dirty
+            "
+            cdDimlessBinary
+          />
         </cds-text-label>
         <ng-template #quotaMaxSizeError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('user_quota_max_size', frm, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('user_quota_max_size', frm, 'quotaMaxSize')"
-                i18n>The value is not valid.</span>
-          <span *ngIf="userForm.showError('user_quota_max_size', formDir, 'pattern')"
-                class="invalid-feedback"
-                i18n>Size must be a number or in a valid format. eg: 5 GiB</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('user_quota_max_size', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('user_quota_max_size', frm, 'quotaMaxSize')"
+            i18n
+            >The value is not valid.</span
+          >
+          <span
+            *ngIf="userForm.showError('user_quota_max_size', formDir, 'pattern')"
+            class="invalid-feedback"
+            i18n
+            >Size must be a number or in a valid format. eg: 5 GiB</span
+          >
         </ng-template>
       </div>
 
       <!-- Unlimited objects -->
-      <div class="form-item"
-           *ngIf="userForm.controls.user_quota_enabled.value">
-        <cds-checkbox formControlName="user_quota_max_objects_unlimited"
-                      id="user_quota_max_objects_unlimited"
-                      i18n>Unlimited objects</cds-checkbox>
+      <div
+        class="form-item"
+        *ngIf="userForm.controls.user_quota_enabled.value"
+      >
+        <cds-checkbox
+          formControlName="user_quota_max_objects_unlimited"
+          id="user_quota_max_objects_unlimited"
+          i18n
+          >Unlimited objects</cds-checkbox
+        >
       </div>
 
       <!-- Maximum objects -->
-      <div class="form-item"
-           *ngIf="userForm.controls.user_quota_enabled.value && !userForm.getValue('user_quota_max_objects_unlimited')">
-        <cds-number for="user_quota_max_objects"
-                    formControlName="user_quota_max_objects"
-                    id="user_quota_max_objects"
-                    [min]="0"
-                    [invalid]="userForm.controls.user_quota_max_objects.invalid && (userForm.controls.user_quota_max_objects.dirty)"
-                    [invalidText]="maxObjectsError"
-                    label="Maximum Objects"
-                    cdRequiredField="Maximum Objects"></cds-number>
+      <div
+        class="form-item"
+        *ngIf="
+          userForm.controls.user_quota_enabled.value &&
+          !userForm.getValue('user_quota_max_objects_unlimited')
+        "
+      >
+        <cds-number
+          for="user_quota_max_objects"
+          formControlName="user_quota_max_objects"
+          id="user_quota_max_objects"
+          [min]="0"
+          [invalid]="
+            userForm.controls.user_quota_max_objects.invalid &&
+            userForm.controls.user_quota_max_objects.dirty
+          "
+          [invalidText]="maxObjectsError"
+          label="Maximum Objects"
+          cdRequiredField="Maximum Objects"
+        ></cds-number>
         <ng-template #maxObjectsError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('user_quota_max_objects', frm, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('user_quota_max_objects', frm, 'min')"
-                i18n>The entered value must be >= 0.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('user_quota_max_objects', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('user_quota_max_objects', frm, 'min')"
+            i18n
+            >The entered value must be >= 0.</span
+          >
         </ng-template>
       </div>
     </fieldset>
@@ -623,77 +930,134 @@
     <!-- Bucket quota -->
     <fieldset>
       <div class="form-item">
-        <legend i18n
-                class="cd-header">Bucket quota</legend>
+        <legend
+          i18n
+          class="cd-header"
+        >
+          Bucket quota
+        </legend>
 
-      <!-- Enabled -->
-        <cds-checkbox formControlName="bucket_quota_enabled"
-                      id="bucket_quota_enabled"
-                      i18n>Enabled</cds-checkbox>
+        <!-- Enabled -->
+        <cds-checkbox
+          formControlName="bucket_quota_enabled"
+          id="bucket_quota_enabled"
+          i18n
+          >Enabled</cds-checkbox
+        >
       </div>
 
       <!-- Unlimited size -->
-      <div class="form-item"
-           *ngIf="userForm.controls.bucket_quota_enabled.value">
-        <cds-checkbox formControlName="bucket_quota_max_size_unlimited"
-                      id="bucket_quota_max_size_unlimited"
-                      i18n>Unlimited size</cds-checkbox>
+      <div
+        class="form-item"
+        *ngIf="userForm.controls.bucket_quota_enabled.value"
+      >
+        <cds-checkbox
+          formControlName="bucket_quota_max_size_unlimited"
+          id="bucket_quota_max_size_unlimited"
+          i18n
+          >Unlimited size</cds-checkbox
+        >
       </div>
 
       <!-- Maximum size -->
-      <div class="form-item"
-           *ngIf="userForm.controls.bucket_quota_enabled.value && !userForm.getValue('bucket_quota_max_size_unlimited')">
-        <cds-text-label for="bucket_quota_max_size"
-                        i18n
-                        cdRequiredField="Maximum size"
-                        [invalid]="userForm.controls.bucket_quota_max_size.invalid && (userForm.controls.bucket_quota_max_size.dirty)"
-                        [invalidText]="bucketQuotaMaxSizeError">Maximum size
-          <input cdsText
-                 formControlName="bucket_quota_max_size"
-                 name="bucket_quota_max_size"
-                 id="bucket_quota_max_size"
-                 [invalid]="userForm.controls.bucket_quota_max_size.invalid && (userForm.controls.bucket_quota_max_size.dirty)"
-                 cdDimlessBinary/>
+      <div
+        class="form-item"
+        *ngIf="
+          userForm.controls.bucket_quota_enabled.value &&
+          !userForm.getValue('bucket_quota_max_size_unlimited')
+        "
+      >
+        <cds-text-label
+          for="bucket_quota_max_size"
+          i18n
+          cdRequiredField="Maximum size"
+          [invalid]="
+            userForm.controls.bucket_quota_max_size.invalid &&
+            userForm.controls.bucket_quota_max_size.dirty
+          "
+          [invalidText]="bucketQuotaMaxSizeError"
+          >Maximum size
+          <input
+            cdsText
+            formControlName="bucket_quota_max_size"
+            name="bucket_quota_max_size"
+            id="bucket_quota_max_size"
+            [invalid]="
+              userForm.controls.bucket_quota_max_size.invalid &&
+              userForm.controls.bucket_quota_max_size.dirty
+            "
+            cdDimlessBinary
+          />
         </cds-text-label>
         <ng-template #bucketQuotaMaxSizeError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('bucket_quota_max_size', frm, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('bucket_quota_max_size', frm, 'quotaMaxSize')"
-                i18n>The value is not valid.</span>
-          <span *ngIf="userForm.showError('bucket_quota_max_size', formDir, 'pattern')"
-                class="invalid-feedback"
-                i18n>Size must be a number or in a valid format. eg: 5 GiB</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('bucket_quota_max_size', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('bucket_quota_max_size', frm, 'quotaMaxSize')"
+            i18n
+            >The value is not valid.</span
+          >
+          <span
+            *ngIf="userForm.showError('bucket_quota_max_size', formDir, 'pattern')"
+            class="invalid-feedback"
+            i18n
+            >Size must be a number or in a valid format. eg: 5 GiB</span
+          >
         </ng-template>
       </div>
 
       <!-- Unlimited objects -->
-      <div class="form-item"
-           *ngIf="userForm.controls.bucket_quota_enabled.value">
-        <cds-checkbox formControlName="bucket_quota_max_objects_unlimited"
-                      id="bucket_quota_max_objects_unlimited"
-                      i18n>Unlimited objects</cds-checkbox>
+      <div
+        class="form-item"
+        *ngIf="userForm.controls.bucket_quota_enabled.value"
+      >
+        <cds-checkbox
+          formControlName="bucket_quota_max_objects_unlimited"
+          id="bucket_quota_max_objects_unlimited"
+          i18n
+          >Unlimited objects</cds-checkbox
+        >
       </div>
 
       <!-- Maximum objects -->
-      <div class="form-item"
-           *ngIf="userForm.controls.bucket_quota_enabled.value && !userForm.getValue('bucket_quota_max_objects_unlimited')">
-        <cds-number for="bucket_quota_max_objects"
-                    formControlName="bucket_quota_max_objects"
-                    id="bucket_quota_max_objects"
-                    [min]="0"
-                    [invalid]="userForm.controls.bucket_quota_max_objects.invalid && ( userForm.controls.bucket_quota_max_objects.dirty)"
-                    [invalidText]="bucketMaxObjectsError"
-                    label="Maximum objects"
-                    cdRequiredField="Maximum objects"></cds-number>
+      <div
+        class="form-item"
+        *ngIf="
+          userForm.controls.bucket_quota_enabled.value &&
+          !userForm.getValue('bucket_quota_max_objects_unlimited')
+        "
+      >
+        <cds-number
+          for="bucket_quota_max_objects"
+          formControlName="bucket_quota_max_objects"
+          id="bucket_quota_max_objects"
+          [min]="0"
+          [invalid]="
+            userForm.controls.bucket_quota_max_objects.invalid &&
+            userForm.controls.bucket_quota_max_objects.dirty
+          "
+          [invalidText]="bucketMaxObjectsError"
+          label="Maximum objects"
+          cdRequiredField="Maximum objects"
+        ></cds-number>
         <ng-template #bucketMaxObjectsError>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('bucket_quota_max_objects', frm, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="userForm.showError('bucket_quota_max_objects', frm, 'min')"
-                i18n>The entered value must be >= 0.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('bucket_quota_max_objects', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('bucket_quota_max_objects', frm, 'min')"
+            i18n
+            >The entered value must be >= 0.</span
+          >
         </ng-template>
       </div>
     </fieldset>
@@ -701,16 +1065,20 @@
     <!-- Advanced Section -->
     <cd-form-advanced-fieldset>
       <!-- User Rate Limit -->
-      <cd-rgw-rate-limit [type]="'user'"
-                         [isEditing]="editing"
-                         [id]="uid"
-                         (rateLimitFormGroup)="rateLimitFormInit($event)">
+      <cd-rgw-rate-limit
+        [type]="'user'"
+        [isEditing]="editing"
+        [id]="uid"
+        (rateLimitFormGroup)="rateLimitFormInit($event)"
+      >
       </cd-rgw-rate-limit>
     </cd-form-advanced-fieldset>
 
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          [form]="userForm"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          wrappingClass="text-right"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="userForm"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      wrappingClass="text-right"
+    ></cd-form-button-panel>
   </form>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-list/rgw-user-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-list/rgw-user-list.component.html
index daeff590c5f..87abe6acce6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-list/rgw-user-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-list/rgw-user-list.component.html
@@ -1,62 +1,88 @@
 <cd-rgw-user-tabs></cd-rgw-user-tabs>
 
-<cd-table #table
-          [autoReload]="false"
-          [data]="users"
-          [columns]="columns"
-          columnMode="flex"
-          selectionType="single"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (updateSelection)="updateSelection($event)"
-          identifier="uid"
-          (fetchData)="getUserList($event)"
-          [status]="tableStatus">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  #table
+  [autoReload]="false"
+  [data]="users"
+  [columns]="columns"
+  columnMode="flex"
+  selectionType="single"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (updateSelection)="updateSelection($event)"
+  identifier="uid"
+  (fetchData)="getUserList($event)"
+  [status]="tableStatus"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-rgw-user-details *cdTableDetail
-                       [selection]="expandedRow">
+  <cd-rgw-user-details
+    *cdTableDetail
+    [selection]="expandedRow"
+  >
   </cd-rgw-user-details>
 </cd-table>
 
-<ng-template #userSizeTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.user_quota.max_size > 0 && row.user_quota.enabled; else noSizeQuota"
-                [total]="row.user_quota.max_size"
-                [used]="row.stats.size_actual">
+<ng-template
+  #userSizeTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.user_quota.max_size > 0 && row.user_quota.enabled; else noSizeQuota"
+    [total]="row.user_quota.max_size"
+    [used]="row.stats.size_actual"
+  >
   </cd-usage-bar>
 
-  <ng-template #noSizeQuota
-               i18n>No Limit</ng-template>
+  <ng-template
+    #noSizeQuota
+    i18n
+    >No Limit</ng-template
+  >
 </ng-template>
 
-<ng-template #userObjectTpl
-             let-row="data.row">
-  <cd-usage-bar *ngIf="row.user_quota.max_objects > 0 && row.user_quota.enabled; else noObjectQuota"
-                [total]="row.user_quota.max_objects"
-                [used]="row.stats.num_objects"
-                [isBinary]="false">
+<ng-template
+  #userObjectTpl
+  let-row="data.row"
+>
+  <cd-usage-bar
+    *ngIf="row.user_quota.max_objects > 0 && row.user_quota.enabled; else noObjectQuota"
+    [total]="row.user_quota.max_objects"
+    [used]="row.stats.num_objects"
+    [isBinary]="false"
+  >
   </cd-usage-bar>
 
-  <ng-template #noObjectQuota
-               i18n>No Limit</ng-template>
+  <ng-template
+    #noObjectQuota
+    i18n
+    >No Limit</ng-template
+  >
 </ng-template>
 
-<ng-template #usernameTpl
-             let-row="data.row">
+<ng-template
+  #usernameTpl
+  let-row="data.row"
+>
   <div cdsRow>
     <span i18n>{{ row.uid }}</span>
     @if (row.type === 'root') {
-    <cds-tooltip [description]="'Account root user'"
-                 [align]="'top'"
-                 i18n-description>
-      <svg [cdsIcon]="icons.userAccessLocked"
-           [size]="icons.size16"
-           class="account-root-icon"></svg>
-    </cds-tooltip>
+      <cds-tooltip
+        [description]="'Account root user'"
+        [align]="'top'"
+        i18n-description
+      >
+        <svg
+          [cdsIcon]="icons.userAccessLocked"
+          [size]="icons.size16"
+          class="account-root-icon"
+        ></svg>
+      </cds-tooltip>
     }
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.html
index 37defe3d34d..8e58016266c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.html
@@ -1,118 +1,164 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <ng-container i18n="form title"
-                  class="modal-title">{{ action | titlecase }} {{ resource | upperFirst }}</ng-container>
+    <ng-container
+      i18n="form title"
+      class="modal-title"
+      >{{ action | titlecase }} {{ resource | upperFirst }}</ng-container
+    >
 
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
 
-  <form #frm="ngForm"
-        [formGroup]="formGroup"
-        novalidate>
+  <form
+    #frm="ngForm"
+    [formGroup]="formGroup"
+    novalidate
+  >
     <div cdsModalContent>
-
       <!-- Username -->
       <div class="form-item">
-        <cds-text-label for="user"
-                        [invalid]="formGroup.controls.user.invalid && formGroup.controls.user.dirty"
-                        [invalidText]="userError"
-                        *ngIf="viewing"
-                        i18n>Username
-          <input cdsText
-                 id="user"
-                 name="user"
-                 formControlName="user"
-                 [readonly]="true"
-                 modal-primary-focus>
+        <cds-text-label
+          for="user"
+          [invalid]="formGroup.controls.user.invalid && formGroup.controls.user.dirty"
+          [invalidText]="userError"
+          *ngIf="viewing"
+          i18n
+          >Username
+          <input
+            cdsText
+            id="user"
+            name="user"
+            formControlName="user"
+            [readonly]="true"
+            modal-primary-focus
+          />
         </cds-text-label>
 
-        <cds-select *ngIf="!viewing"
-                    label="Username"
-                    i18n-label
-                    for="user"
-                    formControlName="user"
-                    [invalid]="formGroup.controls.user.invalid && formGroup.controls.user.dirty"
-                    [invalidText]="userError">
+        <cds-select
+          *ngIf="!viewing"
+          label="Username"
+          i18n-label
+          for="user"
+          formControlName="user"
+          [invalid]="formGroup.controls.user.invalid && formGroup.controls.user.dirty"
+          [invalidText]="userError"
+        >
           <option value="">--- Select a username ---</option>
-          <option *ngFor="let userCandidate of userCandidates"
-                  [value]="userCandidate">{{ userCandidate }}</option>
+          <option
+            *ngFor="let userCandidate of userCandidates"
+            [value]="userCandidate"
+          >
+            {{ userCandidate }}
+          </option>
         </cds-select>
 
         <ng-template #userError>
-          <span class="invalid-feedback"
-                *ngIf="formGroup.showError('user', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('user', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Auto-generate key -->
-      <div class="form-item"
-           *ngIf="!viewing">
-        <cds-checkbox id="generate_key"
-                      formControlName="generate_key"
-                      i18n>Auto-generate key
+      <div
+        class="form-item"
+        *ngIf="!viewing"
+      >
+        <cds-checkbox
+          id="generate_key"
+          formControlName="generate_key"
+          i18n
+          >Auto-generate key
         </cds-checkbox>
       </div>
 
       <!-- Access key -->
-      <div class="form-item form-item-append"
-           *ngIf="!formGroup.getValue('generate_key')">
-        <cds-password-label for="access_key"
-                            [invalid]="formGroup.controls.access_key.invalid && formGroup.controls.access_key.dirty"
-                            [invalidText]="accessKeyError"
-                            i18n>Access key
-          <input cdsPassword
-                 id="access_key"
-                 name="access_key"
-                 formControlName="access_key"
-                 [readonly]="viewing">
+      <div
+        class="form-item form-item-append"
+        *ngIf="!formGroup.getValue('generate_key')"
+      >
+        <cds-password-label
+          for="access_key"
+          [invalid]="formGroup.controls.access_key.invalid && formGroup.controls.access_key.dirty"
+          [invalidText]="accessKeyError"
+          i18n
+          >Access key
+          <input
+            cdsPassword
+            id="access_key"
+            name="access_key"
+            formControlName="access_key"
+            [readonly]="viewing"
+          />
         </cds-password-label>
-        <cd-copy-2-clipboard-button source="access_key"
-                                    class="mt-4">
+        <cd-copy-2-clipboard-button
+          source="access_key"
+          class="mt-4"
+        >
         </cd-copy-2-clipboard-button>
 
         <ng-template #accessKeyError>
-          <span class="invalid-feedback"
-                *ngIf="formGroup.showError('access_key', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('access_key', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
       <!-- Secret key -->
-      <div class="form-item form-item-append"
-           *ngIf="!formGroup.getValue('generate_key')">
-        <cds-password-label for="secret_key"
-                            [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
-                            [invalidText]="secretKeyError"
-                            i18n>Secret key
-          <input cdsPassword
-                 id="secret_key"
-                 name="secret_key"
-                 formControlName="secret_key"
-                 [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
-                 [readonly]="viewing">
+      <div
+        class="form-item form-item-append"
+        *ngIf="!formGroup.getValue('generate_key')"
+      >
+        <cds-password-label
+          for="secret_key"
+          [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
+          [invalidText]="secretKeyError"
+          i18n
+          >Secret key
+          <input
+            cdsPassword
+            id="secret_key"
+            name="secret_key"
+            formControlName="secret_key"
+            [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
+            [readonly]="viewing"
+          />
         </cds-password-label>
 
-        <cd-copy-2-clipboard-button source="secret_key"
-                                    class="mt-4">
+        <cd-copy-2-clipboard-button
+          source="secret_key"
+          class="mt-4"
+        >
         </cd-copy-2-clipboard-button>
 
         <ng-template #secretKeyError>
-          <span class="invalid-feedback"
-                *ngIf="formGroup.showError('secret_key', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('secret_key', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
-
     </div>
 
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          [form]="formGroup"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [showSubmit]="!viewing"
-                          [modalForm]="true"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="formGroup"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      [showSubmit]="!viewing"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </form>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.html
index 5b1a2c3c6ca..c0404786830 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.html
@@ -1,76 +1,113 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
 
     <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
   </cds-modal-header>
 
-  <form #frm="ngForm"
-        [formGroup]="formGroup"
-        novalidate>
+  <form
+    #frm="ngForm"
+    [formGroup]="formGroup"
+    novalidate
+  >
     <div cdsModalContent>
       <!-- Username -->
       <div class="form-item">
-        <cds-text-label for="uid"
-                        i18n>Username
-          <input cdsText
-                 id="uid"
-                 name="uid"
-                 formControlName="uid"
-                 readonly
-                 modal-primary-focus>
+        <cds-text-label
+          for="uid"
+          i18n
+          >Username
+          <input
+            cdsText
+            id="uid"
+            name="uid"
+            formControlName="uid"
+            readonly
+            modal-primary-focus
+          />
         </cds-text-label>
       </div>
 
       <!-- Subuser -->
       <div class="form-item">
-        <cds-text-label for="subuid"
-                        [invalid]="formGroup.controls.subuid.invalid && formGroup.controls.subuid.dirty"
-                        [invalidText]="subuserHelper">Subuser
-          <input cdsText
-                 id="subuid"
-                 name="subuid"
-                 formControlName="subuid"
-                 [readonly]="editing"
-                 autofocus>
+        <cds-text-label
+          for="subuid"
+          [invalid]="formGroup.controls.subuid.invalid && formGroup.controls.subuid.dirty"
+          [invalidText]="subuserHelper"
+          >Subuser
+          <input
+            cdsText
+            id="subuid"
+            name="subuid"
+            formControlName="subuid"
+            [readonly]="editing"
+            autofocus
+          />
         </cds-text-label>
         <ng-template #subuserHelper>
-          <span class="invalid-feedback"
-                *ngIf="formGroup.showError('subuid', frm, 'required')"
-                i18n>This field is required.</span>
-          <span class="invalid-feedback"
-                *ngIf="formGroup.showError('subuid', frm, 'subuserIdExists')"
-                i18n>The chosen subuser ID is already in use.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('subuid', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('subuid', frm, 'subuserIdExists')"
+            i18n
+            >The chosen subuser ID is already in use.</span
+          >
         </ng-template>
       </div>
 
       <!-- Permission -->
       <div class="form-item">
-        <cds-select label="Permission"
-                    i18n-label
-                    for="perm"
-                    formControlName="perm"
-                    [invalid]="formGroup.controls.perm.invalid && formGroup.controls.perm.dirty"
-                    [invalidText]="permError">
+        <cds-select
+          label="Permission"
+          i18n-label
+          for="perm"
+          formControlName="perm"
+          [invalid]="formGroup.controls.perm.invalid && formGroup.controls.perm.dirty"
+          [invalidText]="permError"
+        >
           <option value="">--- Select a permission ---</option>
-          <option *ngFor="let perm of ['read', 'write']"
-                  [value]="perm">
+          <option
+            *ngFor="let perm of ['read', 'write']"
+            [value]="perm"
+          >
             {{ perm }}
           </option>
-          <option i18n
-                  value="read-write">read, write</option>
-          <option i18n
-                  value="full-control">full</option>
+          <option
+            i18n
+            value="read-write"
+          >
+            read, write
+          </option>
+          <option
+            i18n
+            value="full-control"
+          >
+            full
+          </option>
         </cds-select>
 
         <ng-template #permError>
-          <span class="invalid-feedback"
-                *ngIf="formGroup.showError('perm', frm, 'required')"
-                i18n>This field is required.</span>
+          <span
+            class="invalid-feedback"
+            *ngIf="formGroup.showError('perm', frm, 'required')"
+            i18n
+            >This field is required.</span
+          >
         </ng-template>
       </div>
 
@@ -80,44 +117,59 @@
 
         <!-- Auto-generate key -->
         <div class="form-item">
-          <cds-checkbox id="generate_secret"
-                        formControlName="generate_secret"
-                        i18n>Auto-generate key
+          <cds-checkbox
+            id="generate_secret"
+            formControlName="generate_secret"
+            i18n
+            >Auto-generate key
           </cds-checkbox>
         </div>
 
         <!-- Secret key -->
-        <div class="form-item form-item-append"
-             *ngIf="!editing && !formGroup.getValue('generate_secret')">
-          <cds-password-label for="secret_key"
-                              [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
-                              [invalidText]="secretKeyError"
-                              i18n>Secret key
-            <input cdsPassword
-                   id="secret_key"
-                   name="secret_key"
-                   formControlName="secret_key"
-                   [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
-                   [autofocus]="true">
+        <div
+          class="form-item form-item-append"
+          *ngIf="!editing && !formGroup.getValue('generate_secret')"
+        >
+          <cds-password-label
+            for="secret_key"
+            [invalid]="formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty"
+            [invalidText]="secretKeyError"
+            i18n
+            >Secret key
+            <input
+              cdsPassword
+              id="secret_key"
+              name="secret_key"
+              formControlName="secret_key"
+              [invalid]="
+                formGroup.controls.secret_key.invalid && formGroup.controls.secret_key.dirty
+              "
+              [autofocus]="true"
+            />
           </cds-password-label>
 
-          <cd-copy-2-clipboard-button source="secret_key"
-                                      class="mt-4">
+          <cd-copy-2-clipboard-button
+            source="secret_key"
+            class="mt-4"
+          >
           </cd-copy-2-clipboard-button>
 
           <ng-template #secretKeyError>
-            <span class="invalid-feedback"
-                  *ngIf="formGroup.showError('secret_key', frm, 'required')"
-                  i18n>This field is required.</span>
+            <span
+              class="invalid-feedback"
+              *ngIf="formGroup.showError('secret_key', frm, 'required')"
+              i18n
+              >This field is required.</span
+            >
           </ng-template>
         </div>
-
       </fieldset>
     </div>
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          [form]="formGroup"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          [modalForm]="true"></cd-form-button-panel>
-
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      [form]="formGroup"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </form>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-swift-key-modal/rgw-user-swift-key-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-swift-key-modal/rgw-user-swift-key-modal.component.html
index 3fede298cc8..9528afedfbe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-swift-key-modal/rgw-user-swift-key-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-swift-key-modal/rgw-user-swift-key-modal.component.html
@@ -1,44 +1,62 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="false"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="false"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
 
   <form novalidate>
     <div cdsModalContent>
       <!-- Username -->
       <div class="form-item">
-        <cds-text-label for="user"
-                        i18n>Username
-          <input cdsText
-                 id="user"
-                 name="user"
-                 readonly
-                 [(ngModel)]="user"
-                 modal-primary-focus>
+        <cds-text-label
+          for="user"
+          i18n
+          >Username
+          <input
+            cdsText
+            id="user"
+            name="user"
+            readonly
+            [(ngModel)]="user"
+            modal-primary-focus
+          />
         </cds-text-label>
       </div>
 
       <!-- Secret key -->
       <div class="form-item form-item-append">
-        <cds-password-label for="secret_key"
-                            i18n>Secret key
-          <input cdsPassword
-                 id="secret_key"
-                 name="secret_key"
-                 [(ngModel)]="secret_key"
-                 readonly>
+        <cds-password-label
+          for="secret_key"
+          i18n
+          >Secret key
+          <input
+            cdsPassword
+            id="secret_key"
+            name="secret_key"
+            [(ngModel)]="secret_key"
+            readonly
+          />
         </cds-password-label>
-        <cd-copy-2-clipboard-button source="secret_key"
-                                    class="mt-4">
+        <cd-copy-2-clipboard-button
+          source="secret_key"
+          class="mt-4"
+        >
         </cd-copy-2-clipboard-button>
       </div>
     </div>
-    <cd-form-button-panel [showSubmit]="false"
-                          (cancel)="closeModal()"
-                          [modalForm]="true"></cd-form-button-panel>
+    <cd-form-button-panel
+      [showSubmit]="false"
+      (cancel)="closeModal()"
+      [modalForm]="true"
+    ></cd-form-button-panel>
   </form>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html
index bca61be2c95..38595d7205b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-tabs/rgw-user-tabs.component.html
@@ -1,19 +1,24 @@
 <ul class="nav nav-tabs">
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/rgw/user"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Users</a>
+    <a
+      class="nav-link"
+      routerLink="/rgw/user"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Users</a
+    >
   </li>
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/rgw/accounts"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Accounts</a>
+    <a
+      class="nav-link"
+      routerLink="/rgw/accounts"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Accounts</a
+    >
   </li>
-
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/device-list/device-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/device-list/device-list.component.html
index 373ecfa4620..cac5ea679e6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/device-list/device-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/device-list/device-list.component.html
@@ -1,53 +1,86 @@
-<cd-table *ngIf="hostname || osdId !== null"
-          [data]="devices"
-          [columns]="columns"></cd-table>
+<cd-table
+  *ngIf="hostname || osdId !== null"
+  [data]="devices"
+  [columns]="columns"
+></cd-table>
 
-<cd-alert-panel type="warning"
-                *ngIf="hostname === '' && osdId === null"
-                i18n>Neither hostname nor OSD ID given</cd-alert-panel>
+<cd-alert-panel
+  type="warning"
+  *ngIf="hostname === '' && osdId === null"
+  i18n
+  >Neither hostname nor OSD ID given</cd-alert-panel
+>
 
-<ng-template #deviceLocation
-             let-value="data.value">
+<ng-template
+  #deviceLocation
+  let-value="data.value"
+>
   <ng-container *ngFor="let location of value">
-    <cd-label *ngIf="location.host === hostname"
-              [value]="location.dev"></cd-label>
+    <cd-label
+      *ngIf="location.host === hostname"
+      [value]="location.dev"
+    ></cd-label>
   </ng-container>
 </ng-template>
 
-<ng-template #daemonName
-             let-value="data.value">
-  <ng-container [ngTemplateOutlet]="osdId !== null ? osdIdDaemon : readableDaemons"
-                [ngTemplateOutletContext]="{daemons: value}">
+<ng-template
+  #daemonName
+  let-value="data.value"
+>
+  <ng-container
+    [ngTemplateOutlet]="osdId !== null ? osdIdDaemon : readableDaemons"
+    [ngTemplateOutletContext]="{ daemons: value }"
+  >
   </ng-container>
 </ng-template>
 
-<ng-template #osdIdDaemon
-             let-daemons="daemons">
+<ng-template
+  #osdIdDaemon
+  let-daemons="daemons"
+>
   <ng-container *ngFor="let daemon of daemons">
-    <cd-label *ngIf="daemon.includes(osdId)"
-              [value]="daemon"></cd-label>
+    <cd-label
+      *ngIf="daemon.includes(osdId)"
+      [value]="daemon"
+    ></cd-label>
   </ng-container>
 </ng-template>
 
-<ng-template #readableDaemons
-             let-daemons="daemons">
+<ng-template
+  #readableDaemons
+  let-daemons="daemons"
+>
   <ng-container *ngFor="let daemon of daemons">
-    <cd-label class="me-1"
-              [value]="daemon"></cd-label>
+    <cd-label
+      class="me-1"
+      [value]="daemon"
+    ></cd-label>
   </ng-container>
 </ng-template>
 
-
-<ng-template #lifeExpectancy
-             let-value="data.value">
-  <span *ngIf="!value?.life_expectancy_enabled"
-        i18n>{{ "" | notAvailable }}</span>
-  <span *ngIf="value?.min && !value?.max">&gt; {{value.min | i18nPlural: translationMapping}}</span>
-  <span *ngIf="value?.max && !value?.min">&lt; {{value.max | i18nPlural: translationMapping}}</span>
-  <span *ngIf="value?.max && value?.min">{{value.min}} to {{value.max | i18nPlural: translationMapping}}</span>
+<ng-template
+  #lifeExpectancy
+  let-value="data.value"
+>
+  <span
+    *ngIf="!value?.life_expectancy_enabled"
+    i18n
+    >{{ '' | notAvailable }}</span
+  >
+  <span *ngIf="value?.min && !value?.max"
+    >&gt; {{ value.min | i18nPlural: translationMapping }}</span
+  >
+  <span *ngIf="value?.max && !value?.min"
+    >&lt; {{ value.max | i18nPlural: translationMapping }}</span
+  >
+  <span *ngIf="value?.max && value?.min"
+    >{{ value.min }} to {{ value.max | i18nPlural: translationMapping }}</span
+  >
 </ng-template>
 
-<ng-template #lifeExpectancyTimestamp
-             let-value="data.value">
-  {{value}}
+<ng-template
+  #lifeExpectancyTimestamp
+  let-value="data.value"
+>
+  {{ value }}
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html
index 270f88c8443..65204929dd2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/feedback/feedback.component.html
@@ -3,67 +3,85 @@
   [open]="open"
   [hasScrollingContent]="false"
   (overlaySelected)="closeModal()"
-  >
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>Report an issue</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      Report an issue
+    </h3>
   </cds-modal-header>
 
-  <form name="feedbackForm"
-        [formGroup]="feedbackForm"
-        #formDir="ngForm">
+  <form
+    name="feedbackForm"
+    [formGroup]="feedbackForm"
+    #formDir="ngForm"
+  >
     <div
       cdsModalContent
       class="modal-wrapper"
     >
       @if (!isFeedbackEnabled) {
-      <cd-alert-panel type="info"
-                      spacingClass="mb-3"
-                      actionName="Enable feedback"
-                      class="align-items-center"
-                      (action)="enableFeedbackModule()"
-                      i18n-actionName>
-        Enable the feedback service to report issues.
-      </cd-alert-panel>
+        <cd-alert-panel
+          type="info"
+          spacingClass="mb-3"
+          actionName="Enable feedback"
+          class="align-items-center"
+          (action)="enableFeedbackModule()"
+          i18n-actionName
+        >
+          Enable the feedback service to report issues.
+        </cd-alert-panel>
       }
       <!-- api_key -->
       @if (!isAPIKeySet) {
-      <div class="form-item">
-        <cds-password-label
-          labelInputID="api_key"
-          [invalid]="!feedbackForm.controls.api_key.valid && feedbackForm.controls.api_key.dirty"
-          [invalidText]="apiKeyError"
-          [helperText]="apiKeyHelperTpl"
-          [disabled]="!isFeedbackEnabled"
-          i18n
-        >
-          API key
-          <input
-            cdsPassword
-            id="api_key"
-            type="password"
-            formControlName="api_key"
-          />
-        </cds-password-label>
+        <div class="form-item">
+          <cds-password-label
+            labelInputID="api_key"
+            [invalid]="!feedbackForm.controls.api_key.valid && feedbackForm.controls.api_key.dirty"
+            [invalidText]="apiKeyError"
+            [helperText]="apiKeyHelperTpl"
+            [disabled]="!isFeedbackEnabled"
+            i18n
+          >
+            API key
+            <input
+              cdsPassword
+              id="api_key"
+              type="password"
+              formControlName="api_key"
+            />
+          </cds-password-label>
 
-        <ng-template #apiKeyError>
-          @if (feedbackForm.showError('api_key', formDir, 'required')) {
-          <span class="invalid-feedback"
-                i18n>API key is required.</span>
-          } @if (feedbackForm.showError('api_key', formDir, 'invalidApiKey')) {
-          <span class="invalid-feedback"
-                i18n>API key is invalid.</span>
-          }
-        </ng-template>
+          <ng-template #apiKeyError>
+            @if (feedbackForm.showError('api_key', formDir, 'required')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >API key is required.</span
+              >
+            }
+            @if (feedbackForm.showError('api_key', formDir, 'invalidApiKey')) {
+              <span
+                class="invalid-feedback"
+                i18n
+                >API key is invalid.</span
+              >
+            }
+          </ng-template>
 
-        <ng-template #apiKeyHelperTpl>
-          <ng-container i18n>
-            Enter your Ceph Tracker API key. You can find your API key in your
-            <a href="https://tracker.ceph.com/my/account"
-               target="_blank">Ceph Tracker account</a>.
-          </ng-container>
-        </ng-template>
-      </div>
+          <ng-template #apiKeyHelperTpl>
+            <ng-container i18n>
+              Enter your Ceph Tracker API key. You can find your API key in your
+              <a
+                href="https://tracker.ceph.com/my/account"
+                target="_blank"
+                >Ceph Tracker account</a
+              >.
+            </ng-container>
+          </ng-template>
+        </div>
       }
 
       <!-- project -->
@@ -77,13 +95,13 @@
           i18n
         >
           @for (project of projects; track project) {
-          <option [value]="project">{{ project }}</option>
+            <option [value]="project">{{ project }}</option>
           }
         </cds-select>
 
         <ng-template #projectError>
           @if (feedbackForm.showError('project', formDir, 'required')) {
-          <span i18n>This field is required!</span>
+            <span i18n>This field is required!</span>
           }
         </ng-template>
       </div>
@@ -99,13 +117,13 @@
           i18n
         >
           @for (issueType of issueTypes; track issueType.value) {
-          <option [value]="issueType.value">{{ issueType.label }}</option>
+            <option [value]="issueType.value">{{ issueType.label }}</option>
           }
         </cds-select>
 
         <ng-template #trackerError>
           @if (feedbackForm.showError('tracker', formDir, 'required')) {
-          <span i18n>Issue type is required.</span>
+            <span i18n>Issue type is required.</span>
           }
         </ng-template>
       </div>
@@ -131,7 +149,7 @@
 
         <ng-template #subjectError>
           @if (feedbackForm.showError('subject', formDir, 'required')) {
-          <span i18n>Issue title is required.</span>
+            <span i18n>Issue title is required.</span>
           }
         </ng-template>
       </div>
@@ -139,7 +157,9 @@
       <!-- description -->
       <div class="form-item">
         <cds-text-label
-          [invalid]="!feedbackForm.controls.description.valid && feedbackForm.controls.description.dirty"
+          [invalid]="
+            !feedbackForm.controls.description.valid && feedbackForm.controls.description.dirty
+          "
           [invalidText]="descriptionError"
           [disabled]="!isFeedbackEnabled"
           i18n
@@ -157,24 +177,23 @@
 
         <ng-template #descriptionError>
           @if (feedbackForm.showError('description', formDir, 'required')) {
-          <span i18n>Description is required.</span>
+            <span i18n>Description is required.</span>
           }
         </ng-template>
       </div>
     </div>
     @if (isFeedbackEnabled) {
-    <cd-form-button-panel
-      (submitActionEvent)="onSubmit()"
-      [form]="feedbackForm"
-      [submitText]="submit"
-      [modalForm]="true"
-    ></cd-form-button-panel>
-    }
-    @else {
-    <cd-form-button-panel
-      [showSubmit]="false"
-      [modalForm]="true"
-    ></cd-form-button-panel>
+      <cd-form-button-panel
+        (submitActionEvent)="onSubmit()"
+        [form]="feedbackForm"
+        [submitText]="submit"
+        [modalForm]="true"
+      ></cd-form-button-panel>
+    } @else {
+      <cd-form-button-panel
+        [showSubmit]="false"
+        [modalForm]="true"
+      ></cd-form-button-panel>
     }
   </form>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/health-checks/health-checks.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/health-checks/health-checks.component.html
index c33632ebfac..1dfcb7b8a98 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/health-checks/health-checks.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/health-checks/health-checks.component.html
@@ -1,17 +1,21 @@
-<p i18n
-   *ngIf="permissions.log.read">
-  <cd-icon type="infoCircle"></cd-icon >
+<p
+  i18n
+  *ngIf="permissions.log.read"
+>
+  <cd-icon type="infoCircle"></cd-icon>
   See <a routerLink="/logs">Logs</a> for more details.
 </p>
 <ul>
-  <li *ngFor="let check of healthData |  keyvalue">
-    <span [ngStyle]="check.value.severity | healthColor"
-          [class.health-warn-description]="check.value.severity === 'HEALTH_WARN'">
-    @if (legacyHealthChecks) {
-    {{ check.value.type }}
-    } @else {
-    {{ check.key }}
-    }
-  </span>: {{ check.value.summary.message }} <br>
+  <li *ngFor="let check of healthData | keyvalue">
+    <span
+      [ngStyle]="check.value.severity | healthColor"
+      [class.health-warn-description]="check.value.severity === 'HEALTH_WARN'"
+    >
+      @if (legacyHealthChecks) {
+        {{ check.value.type }}
+      } @else {
+        {{ check.key }}
+      }</span
+    >: {{ check.value.summary.message }} <br />
   </li>
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.html
index 909f3e7ed6d..e654573ab2e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.html
@@ -1,96 +1,152 @@
 <ng-container *ngIf="!loading; else isLoading">
-  <cd-alert-panel *ngIf="error"
-                  type="error"
-                  i18n>Failed to retrieve SMART data.</cd-alert-panel>
-  <cd-alert-panel *ngIf="incompatible"
-                  type="warning"
-                  i18n>The data received has the JSON format version 2.x and is currently incompatible with the
-    dashboard.</cd-alert-panel>
+  <cd-alert-panel
+    *ngIf="error"
+    type="error"
+    i18n
+    >Failed to retrieve SMART data.</cd-alert-panel
+  >
+  <cd-alert-panel
+    *ngIf="incompatible"
+    type="warning"
+    i18n
+    >The data received has the JSON format version 2.x and is currently incompatible with the
+    dashboard.</cd-alert-panel
+  >
 
   <ng-container *ngIf="!error && !incompatible">
-    <cd-alert-panel *ngIf="data | pipeFunction:isEmpty"
-                    type="info"
-                    i18n>No SMART data available.</cd-alert-panel>
+    <cd-alert-panel
+      *ngIf="data | pipeFunction: isEmpty"
+      type="info"
+      i18n
+      >No SMART data available.</cd-alert-panel
+    >
 
-    <ng-container *ngIf="!(data | pipeFunction:isEmpty)">
-      <nav ngbNav
-           #nav="ngbNav"
-           class="nav-tabs">
-        <ng-container ngbNavItem
-                      *ngFor="let device of data | keyvalue">
+    <ng-container *ngIf="!(data | pipeFunction: isEmpty)">
+      <nav
+        ngbNav
+        #nav="ngbNav"
+        class="nav-tabs"
+      >
+        <ng-container
+          ngbNavItem
+          *ngFor="let device of data | keyvalue"
+        >
           <a ngbNavLink>{{ device.value.device }} ({{ device.value.identifier }})</a>
           <ng-template ngbNavContent>
             <ng-container *ngIf="device.value.error; else noError">
-              <cd-alert-panel id="alert-error"
-                              type="warning">{{ device.value.userMessage }}</cd-alert-panel>
+              <cd-alert-panel
+                id="alert-error"
+                type="warning"
+                >{{ device.value.userMessage }}</cd-alert-panel
+              >
             </ng-container>
 
             <ng-template #noError>
-              <cd-alert-panel *ngIf="device.value.info?.smart_status | pipeFunction:isEmpty; else hasSmartStatus"
-                              id="alert-self-test-unknown"
-                              size="slim"
-                              type="warning"
-                              i18n-title
-                              title="SMART overall-health self-assessment test result"
-                              i18n>unknown</cd-alert-panel>
+              <cd-alert-panel
+                *ngIf="device.value.info?.smart_status | pipeFunction: isEmpty; else hasSmartStatus"
+                id="alert-self-test-unknown"
+                size="slim"
+                type="warning"
+                i18n-title
+                title="SMART overall-health self-assessment test result"
+                i18n
+                >unknown</cd-alert-panel
+              >
               <ng-template #hasSmartStatus>
                 <!-- HDD/NVMe self test -->
                 <ng-container *ngIf="device.value.info.smart_status.passed; else selfTestFailed">
-                  <cd-alert-panel id="alert-self-test-passed"
-                                  size="slim"
-                                  type="info"
-                                  i18n-title
-                                  title="SMART overall-health self-assessment test result"
-                                  i18n>passed</cd-alert-panel>
+                  <cd-alert-panel
+                    id="alert-self-test-passed"
+                    size="slim"
+                    type="info"
+                    i18n-title
+                    title="SMART overall-health self-assessment test result"
+                    i18n
+                    >passed</cd-alert-panel
+                  >
                 </ng-container>
                 <ng-template #selfTestFailed>
-                  <cd-alert-panel id="alert-self-test-failed"
-                                  size="slim"
-                                  type="warning"
-                                  i18n-title
-                                  title="SMART overall-health self-assessment test result"
-                                  i18n>failed</cd-alert-panel>
+                  <cd-alert-panel
+                    id="alert-self-test-failed"
+                    size="slim"
+                    type="warning"
+                    i18n-title
+                    title="SMART overall-health self-assessment test result"
+                    i18n
+                    >failed</cd-alert-panel
+                  >
                 </ng-template>
               </ng-template>
             </ng-template>
 
-            <ng-container *ngIf="!(device.value.info | pipeFunction:isEmpty) || !(device.value.smart | pipeFunction:isEmpty)">
-              <nav ngbNav
-                   #innerNav="ngbNav"
-                   class="nav-tabs">
+            <ng-container
+              *ngIf="
+                !(device.value.info | pipeFunction: isEmpty) ||
+                !(device.value.smart | pipeFunction: isEmpty)
+              "
+            >
+              <nav
+                ngbNav
+                #innerNav="ngbNav"
+                class="nav-tabs"
+              >
                 <li [ngbNavItem]="1">
-                  <a ngbNavLink
-                     i18n>Device Information</a>
+                  <a
+                    ngbNavLink
+                    i18n
+                    >Device Information</a
+                  >
                   <ng-template ngbNavContent>
-                    <cd-table-key-value *ngIf="!(device.value.info | pipeFunction:isEmpty)"
-                                        [renderObjects]="true"
-                                        [data]="device.value.info"></cd-table-key-value>
-                    <cd-alert-panel *ngIf="device.value.info | pipeFunction:isEmpty"
-                                    id="alert-device-info-unavailable"
-                                    type="info"
-                                    i18n>No device information available for this device.</cd-alert-panel>
+                    <cd-table-key-value
+                      *ngIf="!(device.value.info | pipeFunction: isEmpty)"
+                      [renderObjects]="true"
+                      [data]="device.value.info"
+                    ></cd-table-key-value>
+                    <cd-alert-panel
+                      *ngIf="device.value.info | pipeFunction: isEmpty"
+                      id="alert-device-info-unavailable"
+                      type="info"
+                      i18n
+                      >No device information available for this device.</cd-alert-panel
+                    >
                   </ng-template>
                 </li>
                 <li [ngbNavItem]="2">
-                  <a ngbNavLink
-                     i18n>SMART</a>
+                  <a
+                    ngbNavLink
+                    i18n
+                    >SMART</a
+                  >
                   <ng-template ngbNavContent>
-                    <cd-table *ngIf="device.value.smart?.attributes"
-                              [data]="device.value.smart.attributes.table"
-                              updateSelectionOnRefresh="never"
-                              [columns]="smartDataColumns"></cd-table>
-                    <cd-table-key-value *ngIf="device.value.smart?.scsi_error_counter_log"
-                                        [renderObjects]="true"
-                                        [data]="device.value.smart"
-                                        updateSelectionOnRefresh="never"></cd-table-key-value>
-                    <cd-table-key-value *ngIf="device.value.smart?.nvmeData"
-                                        [renderObjects]="true"
-                                        [data]="device.value.smart.nvmeData"
-                                        updateSelectionOnRefresh="never"></cd-table-key-value>
-                    <cd-alert-panel *ngIf="!device.value.smart?.attributes && !device.value.smart?.nvmeData && !device.value.smart?.scsi_error_counter_log"
-                                    id="alert-device-smart-data-unavailable"
-                                    type="info"
-                                    i18n>No SMART data available for this device.</cd-alert-panel>
+                    <cd-table
+                      *ngIf="device.value.smart?.attributes"
+                      [data]="device.value.smart.attributes.table"
+                      updateSelectionOnRefresh="never"
+                      [columns]="smartDataColumns"
+                    ></cd-table>
+                    <cd-table-key-value
+                      *ngIf="device.value.smart?.scsi_error_counter_log"
+                      [renderObjects]="true"
+                      [data]="device.value.smart"
+                      updateSelectionOnRefresh="never"
+                    ></cd-table-key-value>
+                    <cd-table-key-value
+                      *ngIf="device.value.smart?.nvmeData"
+                      [renderObjects]="true"
+                      [data]="device.value.smart.nvmeData"
+                      updateSelectionOnRefresh="never"
+                    ></cd-table-key-value>
+                    <cd-alert-panel
+                      *ngIf="
+                        !device.value.smart?.attributes &&
+                        !device.value.smart?.nvmeData &&
+                        !device.value.smart?.scsi_error_counter_log
+                      "
+                      id="alert-device-smart-data-unavailable"
+                      type="info"
+                      i18n
+                      >No SMART data available for this device.</cd-alert-panel
+                    >
                   </ng-template>
                 </li>
               </nav>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-form/smb-cluster-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-form/smb-cluster-form.component.html
index 7263845999b..fa76060aab7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-form/smb-cluster-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-form/smb-cluster-form.component.html
@@ -1,13 +1,19 @@
-<div cdsCol
-     [columnNumbers]="{ md: 4 }"
-     *ngIf="orchStatus$ | async as orchStatus">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+  *ngIf="orchStatus$ | async as orchStatus"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="smbForm"
-          #formDir="ngForm"
-          [formGroup]="smbForm"
-          novalidate>
-      <div i18n="form title"
-           class="form-header">
+    <form
+      name="smbForm"
+      #formDir="ngForm"
+      [formGroup]="smbForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
         {{ action | titlecase }} {{ resource | upperFirst }}
       </div>
 
@@ -56,10 +62,18 @@
           Stand-alone servers configuration."
           i18n-helperText
         >
-          <option value="active-directory"
-                  i18n>Active Directory</option>
-          <option value="user"
-                  i18n>User</option>
+          <option
+            value="active-directory"
+            i18n
+          >
+            Active Directory
+          </option>
+          <option
+            value="user"
+            i18n
+          >
+            User
+          </option>
         </cds-select>
         <ng-template #authModeError>
           <span
@@ -72,14 +86,20 @@
       </div>
 
       <!-- Domain Settings -->
-      <div class="form-item"
-           *ngIf="smbForm.get('auth_mode').value === AUTHMODE.ActiveDirectory">
-        <div cdsCol
-             [columnNumbers]="{ md: 12 }"
-             class="d-flex">
-          <cds-text-label labelInputID="domain_settings"
-                          i18n
-                          cdRequiredField="Domain Settings">Active Directory (AD) Settings
+      <div
+        class="form-item"
+        *ngIf="smbForm.get('auth_mode').value === AUTHMODE.ActiveDirectory"
+      >
+        <div
+          cdsCol
+          [columnNumbers]="{ md: 12 }"
+          class="d-flex"
+        >
+          <cds-text-label
+            labelInputID="domain_settings"
+            i18n
+            cdRequiredField="Domain Settings"
+            >Active Directory (AD) Settings
             <div class="cds-input-group">
               <input
                 cdsText
@@ -94,22 +114,30 @@
                   smbForm.controls.domain_settings.touched
                 "
               />
-              <cds-icon-button kind="ghost"
-                               (click)="editDomainSettingsModal()"
-                               size="md">
-                <svg cdsIcon="edit"
-                     size="32"
-                     class="cds--btn__icon"
-                     icon></svg>
+              <cds-icon-button
+                kind="ghost"
+                (click)="editDomainSettingsModal()"
+                size="md"
+              >
+                <svg
+                  cdsIcon="edit"
+                  size="32"
+                  class="cds--btn__icon"
+                  icon
+                ></svg>
               </cds-icon-button>
 
-              <cds-icon-button kind="danger"
-                               (click)="deleteDomainSettingsModal()"
-                               size="md">
-                <svg cdsIcon="trash-can"
-                     size="32"
-                     class="cds--btn__icon"
-                     icon></svg>
+              <cds-icon-button
+                kind="danger"
+                (click)="deleteDomainSettingsModal()"
+                size="md"
+              >
+                <svg
+                  cdsIcon="trash-can"
+                  size="32"
+                  class="cds--btn__icon"
+                  icon
+                ></svg>
               </cds-icon-button>
             </div>
           </cds-text-label>
@@ -120,17 +148,22 @@
             smbForm.get('domain_settings').hasError('required') &&
             smbForm.controls.domain_settings.touched
           "
-          i18n>Specify the Realm and AD access resources in the Domain Settings field.</span
+          i18n
+          >Specify the Realm and AD access resources in the Domain Settings field.</span
         >
         <div></div>
       </div>
 
       <!-- User Group Settings -->
-      <ng-container formArrayName="joinSources"
-                    *ngFor="let _ of joinSources.controls; index as i">
+      <ng-container
+        formArrayName="joinSources"
+        *ngFor="let _ of joinSources.controls; index as i"
+      >
         <div
           cdsRow
-          *ngIf="smbForm.get('auth_mode').value === AUTHMODE.User && usersGroups$ | async as usersGroups"
+          *ngIf="
+            smbForm.get('auth_mode').value === AUTHMODE.User && usersGroups$ | async as usersGroups
+          "
           class="form-item form-item-append"
         >
           <div
@@ -141,22 +174,31 @@
               label="Standalone user access resources"
               i18n-label
               [formControlName]="i"
-              [invalid]="smbForm.controls.joinSources.controls[i].invalid && smbForm.controls.joinSources.controls[i].dirty"
+              [invalid]="
+                smbForm.controls.joinSources.controls[i].invalid &&
+                smbForm.controls.joinSources.controls[i].dirty
+              "
               [invalidText]="ugError"
             >
               <option
                 [value]="null"
                 i18n
-              >-- List of users and groups access resources --
+              >
+                -- List of users and groups access resources --
+              </option>
+              <option
+                *ngFor="let ug of usersGroups"
+                [value]="ug.users_groups_id"
+              >
+                {{ ug.users_groups_id }}
               </option>
-              <option *ngFor="let ug of usersGroups"
-                      [value]="ug.users_groups_id">{{ ug.users_groups_id }}</option>
             </cds-select>
             <ng-template #ugError>
               <span
                 class="invalid-feedback"
                 i18n
-              >This field is required.</span>
+                >This field is required.</span
+              >
             </ng-template>
           </div>
           <div
@@ -173,23 +215,30 @@
               <svg
                 cdsIcon="trash-can"
                 size="32"
-                class="cds--btn__icon"></svg>
+                class="cds--btn__icon"
+              ></svg>
             </cds-icon-button>
           </div>
         </div>
       </ng-container>
 
-      <div class="form-item"
-           *ngIf="smbForm.get('auth_mode').value === AUTHMODE.User">
-        <button cdsButton="tertiary"
-                type="button"
-                (click)="addUserGroupSetting()"
-                i18n>
+      <div
+        class="form-item"
+        *ngIf="smbForm.get('auth_mode').value === AUTHMODE.User"
+      >
+        <button
+          cdsButton="tertiary"
+          type="button"
+          (click)="addUserGroupSetting()"
+          i18n
+        >
           Add user group
-          <svg cdsIcon="add"
-               size="32"
-               class="cds--btn__icon"
-               icon></svg>
+          <svg
+            cdsIcon="add"
+            size="32"
+            class="cds--btn__icon"
+            icon
+          ></svg>
         </button>
 
         <button
@@ -199,10 +248,11 @@
           i18n
         >
           Create user group
-        <svg
-          cdsIcon="launch"
-          size="32"
-          class="cds--btn__icon"></svg>
+          <svg
+            cdsIcon="launch"
+            size="32"
+            class="cds--btn__icon"
+          ></svg>
         </button>
       </div>
 
@@ -215,16 +265,26 @@
               formControlName="placement"
               id="placement"
             >
-              <option value="hosts"
-                      i18n>Hosts</option>
-              <option value="label"
-                      i18n>Labels</option>
+              <option
+                value="hosts"
+                i18n
+              >
+                Hosts
+              </option>
+              <option
+                value="label"
+                i18n
+              >
+                Labels
+              </option>
             </cds-select>
           </div>
           <ng-container *ngIf="hostsAndLabels$ | async as data">
             <!-- Label -->
-            <div *ngIf="smbForm.controls.placement.value === 'label'"
-                 class="form-item">
+            <div
+              *ngIf="smbForm.controls.placement.value === 'label'"
+              class="form-item"
+            >
               <cds-combo-box
                 type="multi"
                 selectionFeedback="top-after-reopen"
@@ -254,8 +314,10 @@
             </div>
 
             <!-- Hosts -->
-            <div *ngIf="smbForm.controls.placement.value === 'hosts'"
-                 class="form-item">
+            <div
+              *ngIf="smbForm.controls.placement.value === 'hosts'"
+              class="form-item"
+            >
               <cds-combo-box
                 type="multi"
                 selectionFeedback="top-after-reopen"
@@ -286,19 +348,27 @@
 
         <!-- Custom DNS -->
         @if (smbForm.get('auth_mode').value === AUTHMODE.ActiveDirectory) {
-          <ng-container formArrayName="custom_dns"
-                        *ngFor="let _ of custom_dns.controls; index as i">
-            <div cdsRow
-                 class="form-item form-item-append">
-              <div cdsCol
-                   [columnNumbers]="{ lg: 14 }">
+          <ng-container
+            formArrayName="custom_dns"
+            *ngFor="let _ of custom_dns.controls; index as i"
+          >
+            <div
+              cdsRow
+              class="form-item form-item-append"
+            >
+              <div
+                cdsCol
+                [columnNumbers]="{ lg: 14 }"
+              >
                 <cds-text-label
                   for="custom_dns"
                   i18n
-                >DNS
-                <input cdsText
-                       [formControlName]="i"
-                       placeholder="192.168.76.204"/>
+                  >DNS
+                  <input
+                    cdsText
+                    [formControlName]="i"
+                    placeholder="192.168.76.204"
+                  />
                 </cds-text-label>
               </div>
               <div
@@ -315,31 +385,31 @@
                     cdsIcon="trash-can"
                     size="32"
                     class="cds--btn__icon"
-                  >
-                  </svg>
+                  ></svg>
                 </cds-icon-button>
               </div>
             </div>
           </ng-container>
 
           <div class="form-item">
-            <button cdsButton="tertiary"
-                    type="button"
-                    (click)="addCustomDns()"
-                    i18n>
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="addCustomDns()"
+              i18n
+            >
               Add custom DNS
               <svg
                 cdsIcon="add"
                 size="32"
                 class="cds--btn__icon"
-                icon></svg>
+                icon
+              ></svg>
             </button>
-            <cd-helper i18n>One or more IP Addresses that will be
-              applied to the Samba containers to override
-              the default DNS resolver(s). This option is
-              intended to be used when the host Ceph node
-              is not configured to resolve DNS entries within
-              AD domain(s).
+            <cd-helper i18n
+              >One or more IP Addresses that will be applied to the Samba containers to override the
+              default DNS resolver(s). This option is intended to be used when the host Ceph node is
+              not configured to resolve DNS entries within AD domain(s).
             </cd-helper>
           </div>
         }
@@ -354,98 +424,124 @@
             helperText="Default value indicates that clustering should be enabled if the placement count value is any value other than 1. Always value enables clustering regardless of the placement count. Never value disables clustering regardless of the placement count. "
             i18n-helperText
           >
-            <option *ngFor="let data of allClustering"
-                    i18n>{{ data | upperFirst }}</option>
+            <option
+              *ngFor="let data of allClustering"
+              i18n
+            >
+              {{ data | upperFirst }}
+            </option>
           </cds-select>
         </div>
 
         <div
-          *ngIf="(smbForm.get('count').value > 1 && smbForm.get('clustering').value.toLowerCase() == CLUSTERING.Default) || smbForm.get('clustering').value.toLowerCase() == CLUSTERING.Always"
+          *ngIf="
+            (smbForm.get('count').value > 1 &&
+              smbForm.get('clustering').value.toLowerCase() == CLUSTERING.Default) ||
+            smbForm.get('clustering').value.toLowerCase() == CLUSTERING.Always
+          "
           class="form-item"
         >
-
-        <!-- Public addrs -->
-        <ng-container formArrayName="public_addrs"
-                      *ngFor="let _ of public_addrs.controls; index as i">
-          <ng-container [formGroupName]="i">
-            <div cdsRow
-                 class="form-item form-item-append">
-              <!-- Address -->
-              <div cdsCol
-                   [columnNumbers]="{ lg: 7 }">
-                <cds-text-label
-                  for="address"
-                  i18n
-                  helperText="This address will be assigned to one of the host's network devices and managed automatically."
-                  i18n-helperText
-                  cdrequiredField
-                  [invalid]="smbForm?.controls['public_addrs']?.controls[i]?.controls?.address?.invalid && smbForm?.controls['public_addrs']?.controls[i]?.controls?.address?.dirty"
-                  [invalidText]="addressError"
-                >Address
-                  <input
-                    cdsText
-                    type="text"
-                    formControlName="address"
-                    placeholder="192.168.4.51/24"
-                    [invalid]="smbForm?.controls['public_addrs'].controls[i].controls?.address?.invalid && smbForm?.controls['public_addrs']?.controls[i]?.controls?.address?.dirty"
-                  />
-                </cds-text-label>
-                <ng-template #addressError>
-                  <span
-                    class="invalid-feedback"
-                  >
-                    <ng-container i18n> This field is required. </ng-container>
-                  </span>
-                </ng-template>
-              </div>
-              <!-- Destination -->
-              <div cdsCol
-                   [columnNumbers]="{ lg: 7 }">
-                <cds-text-label
-                  for="destination"
-                  i18n
-                  helperText="Defines where the system will assign the managed IPs. Each string value must be a network address."
-                  i18n-helperText
-                >Destination
-                <input
-                  cdsText
-                  type="text"
-                  formControlName="destination"
-                  placeholder="192.168.4.0/24"/>
-                </cds-text-label>
-              </div>
+          <!-- Public addrs -->
+          <ng-container
+            formArrayName="public_addrs"
+            *ngFor="let _ of public_addrs.controls; index as i"
+          >
+            <ng-container [formGroupName]="i">
               <div
-                cdsCol
-                [columnNumbers]="{ lg: 1 }"
-                class="item-action-btn spacing"
+                cdsRow
+                class="form-item form-item-append"
               >
-                <cds-icon-button
-                  kind="danger"
-                  size="sm"
-                  (click)="removePublicAddrs(i)"
+                <!-- Address -->
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 7 }"
                 >
-                  <svg cdsIcon="trash-can"
-                       size="32"
-                       class="cds--btn__icon"></svg>
-                </cds-icon-button>
+                  <cds-text-label
+                    for="address"
+                    i18n
+                    helperText="This address will be assigned to one of the host's network devices and managed automatically."
+                    i18n-helperText
+                    cdrequiredField
+                    [invalid]="
+                      smbForm?.controls['public_addrs']?.controls[i]?.controls?.address?.invalid &&
+                      smbForm?.controls['public_addrs']?.controls[i]?.controls?.address?.dirty
+                    "
+                    [invalidText]="addressError"
+                    >Address
+                    <input
+                      cdsText
+                      type="text"
+                      formControlName="address"
+                      placeholder="192.168.4.51/24"
+                      [invalid]="
+                        smbForm?.controls['public_addrs'].controls[i].controls?.address?.invalid &&
+                        smbForm?.controls['public_addrs']?.controls[i]?.controls?.address?.dirty
+                      "
+                    />
+                  </cds-text-label>
+                  <ng-template #addressError>
+                    <span class="invalid-feedback">
+                      <ng-container i18n> This field is required. </ng-container>
+                    </span>
+                  </ng-template>
+                </div>
+                <!-- Destination -->
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 7 }"
+                >
+                  <cds-text-label
+                    for="destination"
+                    i18n
+                    helperText="Defines where the system will assign the managed IPs. Each string value must be a network address."
+                    i18n-helperText
+                    >Destination
+                    <input
+                      cdsText
+                      type="text"
+                      formControlName="destination"
+                      placeholder="192.168.4.0/24"
+                    />
+                  </cds-text-label>
+                </div>
+                <div
+                  cdsCol
+                  [columnNumbers]="{ lg: 1 }"
+                  class="item-action-btn spacing"
+                >
+                  <cds-icon-button
+                    kind="danger"
+                    size="sm"
+                    (click)="removePublicAddrs(i)"
+                  >
+                    <svg
+                      cdsIcon="trash-can"
+                      size="32"
+                      class="cds--btn__icon"
+                    ></svg>
+                  </cds-icon-button>
+                </div>
               </div>
-            </div>
+            </ng-container>
           </ng-container>
-        </ng-container>
-          <button cdsButton="tertiary"
-                  type="button"
-                  (click)="addPublicAddrs()"
-                  i18n>
+          <button
+            cdsButton="tertiary"
+            type="button"
+            (click)="addPublicAddrs()"
+            i18n
+          >
             Add public address
             <svg
               cdsIcon="add"
               size="32"
               class="cds--btn__icon"
-              icon></svg>
+              icon
+            ></svg>
           </button>
-          <cd-helper i18n>Assign virtual IP addresses that will be managed
-            by the clustering subsystem and may automatically
-            move between nodes running Samba containers.</cd-helper>
+          <cd-helper i18n
+            >Assign virtual IP addresses that will be managed by the clustering subsystem and may
+            automatically move between nodes running Samba containers.</cd-helper
+          >
         </div>
       </cd-form-advanced-fieldset>
       <cd-form-button-panel
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-list/smb-cluster-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-list/smb-cluster-list.component.html
index 7c9f591fb38..abcb08e2850 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-list/smb-cluster-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-list/smb-cluster-list.component.html
@@ -24,7 +24,8 @@
     </div>
     <cd-smb-cluster-tabs
       *cdTableDetail
-      [selection]="expandedRow">
+      [selection]="expandedRow"
+    >
     </cd-smb-cluster-tabs>
   </cd-table>
 </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-tabs/smb-cluster-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-tabs/smb-cluster-tabs.component.html
index e57a5b92eea..bbd0bfd5dc6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-tabs/smb-cluster-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-cluster-tabs/smb-cluster-tabs.component.html
@@ -1,5 +1,3 @@
 <ng-container *ngIf="selection">
-  <cd-smb-share-list
-    [clusterId]="selection.cluster_id"
-  ></cd-smb-share-list>
+  <cd-smb-share-list [clusterId]="selection.cluster_id"></cd-smb-share-list>
 </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-domain-setting-modal/smb-domain-setting-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-domain-setting-modal/smb-domain-setting-modal.component.html
index 638680db6e5..376bf28f556 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-domain-setting-modal/smb-domain-setting-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-domain-setting-modal/smb-domain-setting-modal.component.html
@@ -1,17 +1,25 @@
-<cds-modal size="md"
-           [open]="open"
-           [hasScrollingContent]="true"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="md"
+  [open]="open"
+  [hasScrollingContent]="true"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ action | titlecase }} {{ resource | upperFirst }}
+    </h3>
   </cds-modal-header>
   <ng-container *cdFormLoading="loading">
     <div cdsModalContent>
-      <form name="domainSettingsForm"
-            #formDir="ngForm"
-            [formGroup]="domainSettingsForm"
-            novalidate>
+      <form
+        name="domainSettingsForm"
+        #formDir="ngForm"
+        [formGroup]="domainSettingsForm"
+        novalidate
+      >
         <div class="form-item">
           <cds-text-label
             label="realm"
@@ -40,7 +48,8 @@
 
         <div
           *ngIf="joinAuths$ | async as joinAuths"
-          class="form-item">
+          class="form-item"
+        >
           <ng-container
             formArrayName="join_sources"
             *ngFor="let _ of join_sources.controls; index as i"
@@ -48,7 +57,8 @@
             <ng-container [formGroupName]="i">
               <div
                 cdsRow
-                class="form-item form-item-append">
+                class="form-item form-item-append"
+              >
                 <div
                   cdsCol
                   [columnNumbers]="{ lg: 14 }"
@@ -57,60 +67,79 @@
                     label="Active Directory access resources"
                     i18n-label
                     formControlName="ref"
-                    [invalid]="domainSettingsForm.controls?.join_sources.controls[i].invalid && domainSettingsForm.controls?.join_sources.controls[i].controls.ref.dirty"
+                    [invalid]="
+                      domainSettingsForm.controls?.join_sources.controls[i].invalid &&
+                      domainSettingsForm.controls?.join_sources.controls[i].controls.ref.dirty
+                    "
                     [invalidText]="joinSourceError"
                   >
                     <option
                       [value]="null"
                       i18n
-                    >-- List of AD access resources --
+                    >
+                      -- List of AD access resources --
+                    </option>
+                    <option
+                      *ngFor="let jA of joinAuths"
+                      [value]="jA.auth_id"
+                    >
+                      {{ jA.auth_id }}
                     </option>
-                    <option *ngFor="let jA of joinAuths"
-                            [value]="jA.auth_id">{{ jA.auth_id }}</option>
                   </cds-select>
                   <ng-template #joinSourceError>
-                    <span
-                      class="invalid-feedback"
-                    >
+                    <span class="invalid-feedback">
                       <ng-container i18n> This field is required. </ng-container>
                     </span>
                   </ng-template>
                 </div>
-                <div cdsCol
-                     *ngIf="i > 0"
-                     [columnNumbers]="{ lg: 1 }"
-                     class="item-action-btn spacing">
-                  <cds-icon-button kind="danger"
-                                   size="sm"
-                                   (click)="removeJoinSource(i)">
-                    <svg cdsIcon="trash-can"
-                         size="32"
-                         class="cds--btn__icon"></svg>
+                <div
+                  cdsCol
+                  *ngIf="i > 0"
+                  [columnNumbers]="{ lg: 1 }"
+                  class="item-action-btn spacing"
+                >
+                  <cds-icon-button
+                    kind="danger"
+                    size="sm"
+                    (click)="removeJoinSource(i)"
+                  >
+                    <svg
+                      cdsIcon="trash-can"
+                      size="32"
+                      class="cds--btn__icon"
+                    ></svg>
                   </cds-icon-button>
                 </div>
               </div>
             </ng-container>
           </ng-container>
           <div class="form-item">
-            <button cdsButton="tertiary"
-                    type="button"
-                    (click)="addJoinSource()"
-                    i18n>
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="addJoinSource()"
+              i18n
+            >
               Add AD access resource
-              <svg cdsIcon="add"
-                   size="32"
-                   class="cds--btn__icon"
-                   icon></svg>
+              <svg
+                cdsIcon="add"
+                size="32"
+                class="cds--btn__icon"
+                icon
+              ></svg>
             </button>
-            <button cdsButton="tertiary"
-                    type="button"
-                    (click)="navigateCreateJoinSource()"
-                    i18n>
+            <button
+              cdsButton="tertiary"
+              type="button"
+              (click)="navigateCreateJoinSource()"
+              i18n
+            >
               Create AD access resource
               <svg
                 cdsIcon="launch"
                 size="16"
-                class="cds--btn__icon"></svg>
+                class="cds--btn__icon"
+              ></svg>
             </button>
           </div>
         </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-form/smb-join-auth-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-form/smb-join-auth-form.component.html
index 52b4c054124..2854d4ca5b5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-form/smb-join-auth-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-form/smb-join-auth-form.component.html
@@ -2,12 +2,16 @@
   cdsCol
   [columnNumbers]="{ md: 4 }"
 >
-  <form name="form"
-        #formDir="ngForm"
-        [formGroup]="form"
-        novalidate>
-    <div i18n="form title"
-         class="form-header">
+  <form
+    name="form"
+    #formDir="ngForm"
+    [formGroup]="form"
+    novalidate
+  >
+    <div
+      i18n="form title"
+      class="form-header"
+    >
       {{ action | titlecase }} {{ resource | upperFirst }}
     </div>
 
@@ -20,7 +24,7 @@
         i18n-helperText
         [invalid]="form.controls.authId.invalid && form.controls.authId.dirty"
         [invalidText]="jaError"
-      >Active directory access resource name
+        >Active directory access resource name
         <input
           cdsText
           type="text"
@@ -47,22 +51,22 @@
         i18n
         [invalid]="form.controls.username.invalid && form.controls.username.dirty"
         [invalidText]="usernameError"
-      >Username
-      <input
+        >Username
+        <input
           cdsText
           type="text"
           id="username"
           name="username"
           formControlName="username"
           [invalid]="form.controls.username.invalid && form.controls.username.dirty"
-      />
+        />
       </cds-text-label>
       <ng-template #usernameError>
         <span
-            class="invalid-feedback"
-            *ngIf="form.showError('username', form, 'required')"
-            i18n
-        >This field is required.
+          class="invalid-feedback"
+          *ngIf="form.showError('username', form, 'required')"
+          i18n
+          >This field is required.
         </span>
       </ng-template>
     </div>
@@ -74,7 +78,7 @@
         i18n
         [invalid]="form.controls.password.invalid && form.controls.password.dirty"
         [invalidText]="passwordError"
-      >Password
+        >Password
         <input
           cdsPassword
           type="password"
@@ -86,10 +90,10 @@
       </cds-password-label>
       <ng-template #passwordError>
         <span
-            class="invalid-feedback"
-            *ngIf="form.showError('password', form, 'required')"
-            i18n
-        >This field is required.
+          class="invalid-feedback"
+          *ngIf="form.showError('password', form, 'required')"
+          i18n
+          >This field is required.
         </span>
       </ng-template>
     </div>
@@ -111,16 +115,22 @@
         <option
           [value]="null"
           i18n
-        >-- List of clusters --
+        >
+          -- List of clusters --
+        </option>
+        <option
+          *ngFor="let cluster of clusters"
+          [value]="cluster.cluster_id"
+        >
+          {{ cluster.cluster_id }}
         </option>
-        <option *ngFor="let cluster of clusters"
-                [value]="cluster.cluster_id">{{ cluster.cluster_id }}</option>
       </cds-select>
     </div>
     <cd-form-button-panel
-        (submitActionEvent)="submit()"
-        [form]="form"
-        [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-        wrappingClass="text-right"></cd-form-button-panel>
+      (submitActionEvent)="submit()"
+      [form]="form"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      wrappingClass="text-right"
+    ></cd-form-button-panel>
   </form>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-list/smb-join-auth-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-list/smb-join-auth-list.component.html
index ad6f0e46179..9377c992d99 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-list/smb-join-auth-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-join-auth-list/smb-join-auth-list.component.html
@@ -15,7 +15,8 @@
     <cd-table-actions
       [permission]="permission"
       [selection]="selection"
-      [tableActions]="tableActions">
+      [tableActions]="tableActions"
+    >
     </cd-table-actions>
   </div>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-overview/smb-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-overview/smb-overview.component.html
index 7821842c9d5..aaaf430443a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-overview/smb-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-overview/smb-overview.component.html
@@ -6,5 +6,6 @@
   [grafanaPath]="'ceph-smb-overview?'"
   [type]="'metrics'"
   uid="feem6ehrmi2o0b"
-  grafanaStyle="three">
+  grafanaStyle="three"
+>
 </cd-grafana>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-form/smb-share-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-form/smb-share-form.component.html
index a9e3a662469..7340f26ffd1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-form/smb-share-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-form/smb-share-form.component.html
@@ -1,18 +1,26 @@
-<div cdsCol
-     [columnNumbers]="{ md: 4 }">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="smbShareForm"
-          #formDir="ngForm"
-          [formGroup]="smbShareForm"
-          novalidate>
-      <div i18n="form title"
-           class="form-header">
+    <form
+      name="smbShareForm"
+      #formDir="ngForm"
+      [formGroup]="smbShareForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
         {{ action | titlecase }} {{ resource | upperFirst }}
       </div>
 
       <!-- Share Id -->
-      <div class="form-item form-item-append"
-           cdsRow>
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <div cdsCol>
           <cds-text-label
             labelInputID="share_id"
@@ -48,14 +56,18 @@
 
         <!-- Share Name -->
         <div cdsCol>
-          <cds-text-label labelInputID="name"
-                          i18n
-                          helperText="Name of the Share"
-                          i18n-helperText>Share Name
-            <input cdsText
-                   type="text"
-                   id="name"
-                   formControlName="name" />
+          <cds-text-label
+            labelInputID="name"
+            i18n
+            helperText="Name of the Share"
+            i18n-helperText
+            >Share Name
+            <input
+              cdsText
+              type="text"
+              id="name"
+              formControlName="name"
+            />
           </cds-text-label>
         </div>
       </div>
@@ -72,19 +84,25 @@
           [invalidText]="volumeError"
           i18n-label
         >
-          <option *ngIf="allFsNames?.length === 0"
-                  value=""
-                  i18n>
+          <option
+            *ngIf="allFsNames?.length === 0"
+            value=""
+            i18n
+          >
             -- No filesystem available --
           </option>
-          <option *ngIf="allFsNames !== null && allFsNames?.length > 0"
-                  value=""
-                  i18n>
+          <option
+            *ngIf="allFsNames !== null && allFsNames?.length > 0"
+            value=""
+            i18n
+          >
             -- Select the filesystem --
           </option>
-          <option *ngFor="let filesystem of allFsNames"
-                  [value]="filesystem.name"
-                  i18n>
+          <option
+            *ngFor="let filesystem of allFsNames"
+            [value]="filesystem.name"
+            i18n
+          >
             {{ filesystem.name }}
           </option>
         </cds-select>
@@ -98,8 +116,10 @@
         </ng-template>
       </div>
 
-      <div class="form-item"
-           *ngIf="smbShareForm.getValue('volume')">
+      <div
+        class="form-item"
+        *ngIf="smbShareForm.getValue('volume')"
+      >
         <cds-select
           formControlName="subvolume_group"
           label="Subvolume Group"
@@ -108,12 +128,18 @@
           [skeleton]="allsubvolgrps === null"
           i18n-label
         >
-          <option *ngIf="allsubvolgrps === null"
-                  value=""
-                  i18n>Loading...</option>
-          <option *ngIf="allsubvolgrps !== null && allsubvolgrps.length >= 0"
-                  value=""
-                  i18n>
+          <option
+            *ngIf="allsubvolgrps === null"
+            value=""
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="allsubvolgrps !== null && allsubvolgrps.length >= 0"
+            value=""
+            i18n
+          >
             -- Select the CephFS subvolume group --
           </option>
           <option
@@ -127,8 +153,10 @@
         </cds-select>
       </div>
 
-      <div class="form-group row"
-           *ngIf="smbShareForm.getValue('volume')">
+      <div
+        class="form-group row"
+        *ngIf="smbShareForm.getValue('volume')"
+      >
         <cds-select
           formControlName="subvolume"
           label="Subvolume"
@@ -136,17 +164,25 @@
           (change)="setSubVolPath()"
           [skeleton]="allsubvols === null"
         >
-          <option *ngIf="allsubvols === null"
-                  value=""
-                  i18n>Loading...</option>
-          <option *ngIf="allsubvols !== null && allsubvols.length === 0"
-                  value=""
-                  i18n>
+          <option
+            *ngIf="allsubvols === null"
+            value=""
+            i18n
+          >
+            Loading...
+          </option>
+          <option
+            *ngIf="allsubvols !== null && allsubvols.length === 0"
+            value=""
+            i18n
+          >
             -- No SMB subvolume available --
           </option>
-          <option *ngIf="allsubvols !== null && allsubvols.length > 0"
-                  value=""
-                  i18n>
+          <option
+            *ngIf="allsubvols !== null && allsubvols.length > 0"
+            value=""
+            i18n
+          >
             -- Select the SMB subvolume --
           </option>
           <option
@@ -161,16 +197,22 @@
       </div>
 
       <!-- Path -->
-      <div class="form-item form-item-append"
-           cdsRow>
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <div cdsCol>
-          <cds-text-label labelInputID="prefixedPath"
-                          i18n
-                          helperText="A path is a relative path.">Prefixed Path
-            <input cdsText
-                   type="text"
-                   id="prefixedPath"
-                   formControlName="prefixedPath" />
+          <cds-text-label
+            labelInputID="prefixedPath"
+            i18n
+            helperText="A path is a relative path."
+            >Prefixed Path
+            <input
+              cdsText
+              type="text"
+              id="prefixedPath"
+              formControlName="prefixedPath"
+            />
           </cds-text-label>
         </div>
         <div cdsCol>
@@ -207,9 +249,11 @@
 
       <!-- Browseable -->
       <div class="form-item">
-        <cds-checkbox id="browseable"
-                      formControlName="browseable"
-                      i18n>Browseable
+        <cds-checkbox
+          id="browseable"
+          formControlName="browseable"
+          i18n
+          >Browseable
           <cd-help-text
             >If selected the share will be included in share listings visible to
             clients.</cd-help-text
@@ -219,51 +263,65 @@
 
       <!-- Readonly -->
       <div class="form-item">
-        <cds-checkbox id="readonly"
-                      formControlName="readonly"
-                      i18n>Readonly
+        <cds-checkbox
+          id="readonly"
+          formControlName="readonly"
+          i18n
+          >Readonly
           <cd-help-text>If selected no clients are permitted to write to the share.</cd-help-text>
         </cds-checkbox>
       </div>
 
       <!-- QoS rate limiting -->
-      <div class="form-header"
-           i18n>Rate limiting</div>
-      <div class="form-item form-item-append"
-           cdsRow>
+      <div
+        class="form-header"
+        i18n
+      >
+        Rate limiting
+      </div>
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <div cdsCol>
-          <cds-number formControlName="read_iops_limit"
-                      cdValidate
-                      #readIopsRef="cdValidate"
-                      label="Read IOPS limit"
-                      i18n-label
-                      [min]="0"
-                      [max]="1000000"
-                      helperText="Max read operations per second (0 = disabled)"
-                      i18n-helperText
-                      [invalid]="readIopsRef.isInvalid"
-                      invalidText="Value must be between 0 and 1,000,000"
-                      i18n-invalidText>
+          <cds-number
+            formControlName="read_iops_limit"
+            cdValidate
+            #readIopsRef="cdValidate"
+            label="Read IOPS limit"
+            i18n-label
+            [min]="0"
+            [max]="1000000"
+            helperText="Max read operations per second (0 = disabled)"
+            i18n-helperText
+            [invalid]="readIopsRef.isInvalid"
+            invalidText="Value must be between 0 and 1,000,000"
+            i18n-invalidText
+          >
           </cds-number>
         </div>
         <div cdsCol>
-          <cds-number formControlName="write_iops_limit"
-                      cdValidate
-                      #writeIopsRef="cdValidate"
-                      label="Write IOPS limit"
-                      i18n-label
-                      [min]="0"
-                      [max]="1000000"
-                      helperText="Max write operations per second (0 = disabled)"
-                      i18n-helperText
-                      [invalid]="writeIopsRef.isInvalid"
-                      invalidText="Value must be between 0 and 1,000,000"
-                      i18n-invalidText>
+          <cds-number
+            formControlName="write_iops_limit"
+            cdValidate
+            #writeIopsRef="cdValidate"
+            label="Write IOPS limit"
+            i18n-label
+            [min]="0"
+            [max]="1000000"
+            helperText="Max write operations per second (0 = disabled)"
+            i18n-helperText
+            [invalid]="writeIopsRef.isInvalid"
+            invalidText="Value must be between 0 and 1,000,000"
+            i18n-invalidText
+          >
           </cds-number>
         </div>
       </div>
-      <div class="form-item form-item-append"
-           cdsRow>
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <div cdsCol>
           <cd-number-with-unit
             [form]="smbShareForm"
@@ -297,36 +355,42 @@
           ></cd-number-with-unit>
         </div>
       </div>
-      <div class="form-item form-item-append"
-           cdsRow>
+      <div
+        class="form-item form-item-append"
+        cdsRow
+      >
         <div cdsCol>
-          <cds-number formControlName="read_delay_max"
-                      cdValidate
-                      #readDelayRef="cdValidate"
-                      label="Read delay max (s)"
-                      i18n-label
-                      [min]="0"
-                      [max]="300"
-                      helperText="Max allowed delay for read operations in seconds"
-                      i18n-helperText
-                      [invalid]="readDelayRef.isInvalid"
-                      invalidText="Value must be between 0 and 300"
-                      i18n-invalidText>
+          <cds-number
+            formControlName="read_delay_max"
+            cdValidate
+            #readDelayRef="cdValidate"
+            label="Read delay max (s)"
+            i18n-label
+            [min]="0"
+            [max]="300"
+            helperText="Max allowed delay for read operations in seconds"
+            i18n-helperText
+            [invalid]="readDelayRef.isInvalid"
+            invalidText="Value must be between 0 and 300"
+            i18n-invalidText
+          >
           </cds-number>
         </div>
         <div cdsCol>
-          <cds-number formControlName="write_delay_max"
-                      cdValidate
-                      #writeDelayRef="cdValidate"
-                      label="Write delay max (s)"
-                      i18n-label
-                      [min]="0"
-                      [max]="300"
-                      helperText="Max allowed delay for write operations in seconds"
-                      i18n-helperText
-                      [invalid]="writeDelayRef.isInvalid"
-                      invalidText="Value must be between 0 and 300"
-                      i18n-invalidText>
+          <cds-number
+            formControlName="write_delay_max"
+            cdValidate
+            #writeDelayRef="cdValidate"
+            label="Write delay max (s)"
+            i18n-label
+            [min]="0"
+            [max]="300"
+            helperText="Max allowed delay for write operations in seconds"
+            i18n-helperText
+            [invalid]="writeDelayRef.isInvalid"
+            invalidText="Value must be between 0 and 300"
+            i18n-invalidText
+          >
           </cds-number>
         </div>
       </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-list/smb-share-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-list/smb-share-list.component.html
index 709d88db126..4120baa52ac 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-list/smb-share-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-share-list/smb-share-list.component.html
@@ -22,20 +22,26 @@
   </cd-table>
 </ng-container>
 
-<ng-template #iopsLimitTpl
-             let-value="data.value">
-  R: {{ value?.read_iops_limit ? (value.read_iops_limit | number) : '-' }}
-  / W: {{ value?.write_iops_limit ? (value.write_iops_limit | number) : '-' }}
+<ng-template
+  #iopsLimitTpl
+  let-value="data.value"
+>
+  R: {{ value?.read_iops_limit ? (value.read_iops_limit | number) : '-' }} / W:
+  {{ value?.write_iops_limit ? (value.write_iops_limit | number) : '-' }}
 </ng-template>
 
-<ng-template #bwLimitTpl
-             let-value="data.value">
-  R: {{ value?.read_bw_limit ? (value.read_bw_limit | dimlessBinary) : '-' }}
-  / W: {{ value?.write_bw_limit ? (value.write_bw_limit | dimlessBinary) : '-' }}
+<ng-template
+  #bwLimitTpl
+  let-value="data.value"
+>
+  R: {{ value?.read_bw_limit ? (value.read_bw_limit | dimlessBinary) : '-' }} / W:
+  {{ value?.write_bw_limit ? (value.write_bw_limit | dimlessBinary) : '-' }}
 </ng-template>
 
-<ng-template #delayMaxTpl
-             let-value="data.value">
-  R: {{ value?.read_delay_max ? value.read_delay_max + 's' : '-' }}
-  / W: {{ value?.write_delay_max ? value.write_delay_max + 's' : '-' }}
+<ng-template
+  #delayMaxTpl
+  let-value="data.value"
+>
+  R: {{ value?.read_delay_max ? value.read_delay_max + 's' : '-' }} / W:
+  {{ value?.write_delay_max ? value.write_delay_max + 's' : '-' }}
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-tabs/smb-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-tabs/smb-tabs.component.html
index ce2469909eb..81a0fd2b894 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-tabs/smb-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-tabs/smb-tabs.component.html
@@ -2,29 +2,34 @@
   type="contained"
   followFocus="true"
   isNavigation="true"
-  [cacheActive]="false">
+  [cacheActive]="false"
+>
   <cds-tab
     heading="Cluster"
     i18n-heading
     [active]="activeTab === Tabs.cluster"
-    (selected)="onSelected(Tabs.cluster)">
+    (selected)="onSelected(Tabs.cluster)"
+  >
   </cds-tab>
   <cds-tab
     heading="Active Directory"
     i18n-heading
     [active]="activeTab === Tabs.activeDirectory"
-    (selected)="onSelected(Tabs.activeDirectory)">
+    (selected)="onSelected(Tabs.activeDirectory)"
+  >
   </cds-tab>
   <cds-tab
     heading="Standalone"
     i18n-heading
     [active]="activeTab === Tabs.standalone"
-    (selected)="onSelected(Tabs.standalone)">
+    (selected)="onSelected(Tabs.standalone)"
+  >
   </cds-tab>
   <cds-tab
     heading="Overview"
     i18n-heading
     [active]="activeTab === Tabs.overview"
-    (selected)="onSelected(Tabs.overview)">
+    (selected)="onSelected(Tabs.overview)"
+  >
   </cds-tab>
 </cds-tabs>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-details/smb-usersgroups-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-details/smb-usersgroups-details.component.html
index 49063b1bd33..3fca8cbe719 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-details/smb-usersgroups-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-details/smb-usersgroups-details.component.html
@@ -6,7 +6,8 @@
 >
   <cds-tab
     heading="Users"
-    i18n-heading>
+    i18n-heading
+  >
     <cd-table
       [data]="selection?.values.users"
       columnMode="flex"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-form/smb-usersgroups-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-form/smb-usersgroups-form.component.html
index f294d002e31..34592b2a51c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-form/smb-usersgroups-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-form/smb-usersgroups-form.component.html
@@ -2,10 +2,12 @@
   cdsCol
   [columnNumbers]="{ md: 4 }"
 >
-  <form name="form"
-        #formDir="ngForm"
-        [formGroup]="form"
-        novalidate>
+  <form
+    name="form"
+    #formDir="ngForm"
+    [formGroup]="form"
+    novalidate
+  >
     <div
       i18n="form title"
       class="form-header"
@@ -37,7 +39,7 @@
         i18n-helperText
         [invalid]="form.controls.usersGroupsId.invalid && form.controls.usersGroupsId.dirty"
         [invalidText]="usersgroupsError"
-      >Users and groups access resource name
+        >Users and groups access resource name
         <input
           cdsText
           type="text"
@@ -73,11 +75,14 @@
         <option
           [value]="null"
           i18n
-        >-- List of clusters --
+        >
+          -- List of clusters --
         </option>
         <option
           *ngFor="let cluster of clusters"
-          [value]="cluster.cluster_id">{{ cluster.cluster_id }}
+          [value]="cluster.cluster_id"
+        >
+          {{ cluster.cluster_id }}
         </option>
       </cds-select>
     </div>
@@ -99,16 +104,20 @@
             <cds-text-label
               for="name"
               i18n
-              [invalid]="form.controls['users'].controls[i].controls.name.invalid &&
-                          form.controls['users'].controls[i].controls.name.dirty"
+              [invalid]="
+                form.controls['users'].controls[i].controls.name.invalid &&
+                form.controls['users'].controls[i].controls.name.dirty
+              "
               [invalidText]="usersNameError"
-            >Username
+              >Username
               <input
                 cdsText
                 type="text"
                 formControlName="name"
-                [invalid]="form.controls['users'].controls[i].controls.name.invalid &&
-                          form.controls['users'].controls[i].controls.name.dirty"
+                [invalid]="
+                  form.controls['users'].controls[i].controls.name.invalid &&
+                  form.controls['users'].controls[i].controls.name.dirty
+                "
               />
             </cds-text-label>
             <ng-template #usersNameError>
@@ -126,26 +135,30 @@
             <cds-password-label
               for="password"
               i18n
-              [invalid]="form.controls['users'].controls[i].controls.password.invalid &&
-                          form.controls['users'].controls[i].controls.password.dirty"
+              [invalid]="
+                form.controls['users'].controls[i].controls.password.invalid &&
+                form.controls['users'].controls[i].controls.password.dirty
+              "
               [invalidText]="usersPasswordError"
-            >Password
-            <input
-              cdsPassword
-              type="password"
-              label="Password"
-              formControlName="password"
-              [invalid]="form.controls['users'].controls[i].controls.password.invalid &&
-                          form.controls['users'].controls[i].controls.password.dirty"
-            >
-          </cds-password-label>
-          <ng-template #usersPasswordError>
-            <span
-              class="invalid-feedback"
-              i18n
-              >This field is required.</span
-            >
-          </ng-template>
+              >Password
+              <input
+                cdsPassword
+                type="password"
+                label="Password"
+                formControlName="password"
+                [invalid]="
+                  form.controls['users'].controls[i].controls.password.invalid &&
+                  form.controls['users'].controls[i].controls.password.dirty
+                "
+              />
+            </cds-password-label>
+            <ng-template #usersPasswordError>
+              <span
+                class="invalid-feedback"
+                i18n
+                >This field is required.</span
+              >
+            </ng-template>
           </div>
           <div
             cdsCol
@@ -158,13 +171,13 @@
               size="sm"
               (click)="removeUser(i)"
             >
-            <svg
-              cdsIcon="trash-can"
-              size="32"
-              class="cds--btn__icon">
-            </svg>
-          </cds-icon-button>
-        </div>
+              <svg
+                cdsIcon="trash-can"
+                size="32"
+                class="cds--btn__icon"
+              ></svg>
+            </cds-icon-button>
+          </div>
         </div>
       </ng-container>
     </ng-container>
@@ -175,13 +188,14 @@
         type="button"
         (click)="addUser()"
         i18n
-      >Add User
+      >
+        Add User
         <svg
           cdsIcon="add"
           size="32"
           class="cds--btn__icon"
-          icon>
-        </svg>
+          icon
+        ></svg>
       </button>
     </div>
 
@@ -199,48 +213,52 @@
             cdsCol
             [columnNumbers]="{ lg: 14 }"
           >
-          <cds-text-label
-            for="name"
-            i18n
-          >Group
-            <input
-              cdsText
-              type="text"
-              formControlName="name"
-            />
-          </cds-text-label>
+            <cds-text-label
+              for="name"
+              i18n
+              >Group
+              <input
+                cdsText
+                type="text"
+                formControlName="name"
+              />
+            </cds-text-label>
           </div>
           <div
             cdsCol
             [columnNumbers]="{ lg: 1 }"
-            class="item-action-btn spacing">
+            class="item-action-btn spacing"
+          >
             <cds-icon-button
               kind="danger"
               size="sm"
               (click)="removeGroup(i)"
             >
-            <svg
-              cdsIcon="trash-can"
-              size="32"
-              class="cds--btn__icon">
-            </svg>
-          </cds-icon-button>
+              <svg
+                cdsIcon="trash-can"
+                size="32"
+                class="cds--btn__icon"
+              ></svg>
+            </cds-icon-button>
           </div>
         </div>
       </ng-container>
     </ng-container>
 
     <div class="form-item">
-      <button cdsButton="tertiary"
-              type="button"
-              (click)="addGroup()"
-              i18n>
+      <button
+        cdsButton="tertiary"
+        type="button"
+        (click)="addGroup()"
+        i18n
+      >
         Add Group
         <svg
           cdsIcon="add"
           size="32"
           class="cds--btn__icon"
-          icon></svg>
+          icon
+        ></svg>
       </button>
     </div>
 
@@ -248,6 +266,7 @@
       (submitActionEvent)="submit()"
       [form]="form"
       [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-      wrappingClass="text-right"></cd-form-button-panel>
-    </form>
-  </div>
+      wrappingClass="text-right"
+    ></cd-form-button-panel>
+  </form>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-list/smb-usersgroups-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-list/smb-usersgroups-list.component.html
index ea5ae0a958b..ec795bd2907 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-list/smb-usersgroups-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb-usersgroups-list/smb-usersgroups-list.component.html
@@ -13,18 +13,19 @@
     (fetchData)="loadUsersGroups()"
     (updateSelection)="updateSelection($event)"
   >
-  <div class="table-actions">
-    <cd-table-actions
-      [permission]="permission"
-      [selection]="selection"
-      [tableActions]="tableActions">
-    </cd-table-actions>
-  </div>
-  <cd-smb-usersgroups-details
-    *cdTableDetail
-    [selection]="expandedRow"
-  ></cd-smb-usersgroups-details>
-</cd-table>
+    <div class="table-actions">
+      <cd-table-actions
+        [permission]="permission"
+        [selection]="selection"
+        [tableActions]="tableActions"
+      >
+      </cd-table-actions>
+    </div>
+    <cd-smb-usersgroups-details
+      *cdTableDetail
+      [selection]="expandedRow"
+    ></cd-smb-usersgroups-details>
+  </cd-table>
 </ng-container>
 
 <ng-template
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
index f34e08c07a5..bcc66f68433 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
@@ -1,61 +1,83 @@
 <div>
   <h2 i18n>Please set a new password.</h2>
   <h4 i18n>You will be redirected to the login page afterwards.</h4>
-  <form #frm="ngForm"
-        [formGroup]="userForm"
-        novalidate>
-
+  <form
+    #frm="ngForm"
+    [formGroup]="userForm"
+    novalidate
+  >
     <!-- Old password -->
     <div class="form-group has-feedback">
       <div class="input-group">
-        <input class="form-control"
-               type="password"
-               placeholder="Old password..."
-               id="oldpassword"
-               formControlName="oldpassword"
-               autocomplete="new-password"
-               autofocus>
-        <button class="btn btn-outline-light btn-password"
-                cdPasswordButton="oldpassword"
-                type="button">
-        </button>
+        <input
+          class="form-control"
+          type="password"
+          placeholder="Old password..."
+          id="oldpassword"
+          formControlName="oldpassword"
+          autocomplete="new-password"
+          autofocus
+        />
+        <button
+          class="btn btn-outline-light btn-password"
+          cdPasswordButton="oldpassword"
+          type="button"
+        ></button>
       </div>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('oldpassword', frm, 'required')"
-            i18n>This field is required.</span>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('oldpassword', frm, 'notmatch')"
-            i18n>The old and new passwords must be different.</span>
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('oldpassword', frm, 'required')"
+        i18n
+        >This field is required.</span
+      >
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('oldpassword', frm, 'notmatch')"
+        i18n
+        >The old and new passwords must be different.</span
+      >
     </div>
 
     <!-- New password -->
     <div class="form-group has-feedback">
       <div class="input-group">
-        <input class="form-control"
-               type="password"
-               placeholder="New password..."
-               id="newpassword"
-               autocomplete="new-password"
-               formControlName="newpassword">
-        <button type="button"
-                class="btn btn-outline-light btn-password"
-                cdPasswordButton="newpassword">
-        </button>
+        <input
+          class="form-control"
+          type="password"
+          placeholder="New password..."
+          id="newpassword"
+          autocomplete="new-password"
+          formControlName="newpassword"
+        />
+        <button
+          type="button"
+          class="btn btn-outline-light btn-password"
+          cdPasswordButton="newpassword"
+        ></button>
       </div>
       <div class="password-strength-level">
-        <div class="{{ passwordStrengthLevelClass }}"
-             data-toggle="tooltip"
-             title="{{ passwordValuation }}">
-        </div>
+        <div
+          class="{{ passwordStrengthLevelClass }}"
+          data-toggle="tooltip"
+          title="{{ passwordValuation }}"
+        ></div>
       </div>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('newpassword', frm, 'required')"
-            i18n>This field is required.</span>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('newpassword', frm, 'notmatch')"
-            i18n>The old and new passwords must be different.</span>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('newpassword', frm, 'passwordPolicy')">
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('newpassword', frm, 'required')"
+        i18n
+        >This field is required.</span
+      >
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('newpassword', frm, 'notmatch')"
+        i18n
+        >The old and new passwords must be different.</span
+      >
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('newpassword', frm, 'passwordPolicy')"
+      >
         {{ passwordValuation }}
       </span>
     </div>
@@ -63,29 +85,40 @@
     <!-- Confirm new password -->
     <div class="form-group has-feedback">
       <div class="input-group">
-        <input class="form-control"
-               type="password"
-               autocomplete="new-password"
-               placeholder="Confirm new password..."
-               id="confirmnewpassword"
-               formControlName="confirmnewpassword">
-        <button class="btn btn-outline-light btn-password"
-                cdPasswordButton="confirmnewpassword"
-                type="button">
-        </button>
+        <input
+          class="form-control"
+          type="password"
+          autocomplete="new-password"
+          placeholder="Confirm new password..."
+          id="confirmnewpassword"
+          formControlName="confirmnewpassword"
+        />
+        <button
+          class="btn btn-outline-light btn-password"
+          cdPasswordButton="confirmnewpassword"
+          type="button"
+        ></button>
       </div>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('confirmnewpassword', frm, 'required')"
-            i18n>This field is required.</span>
-      <span class="invalid-feedback"
-            *ngIf="userForm.showError('confirmnewpassword', frm, 'match')"
-            i18n>Password confirmation doesn't match the new password.</span>
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('confirmnewpassword', frm, 'required')"
+        i18n
+        >This field is required.</span
+      >
+      <span
+        class="invalid-feedback"
+        *ngIf="userForm.showError('confirmnewpassword', frm, 'match')"
+        i18n
+        >Password confirmation doesn't match the new password.</span
+      >
     </div>
-    <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                          (backActionEvent)="onCancel()"
-                          [form]="userForm"
-                          [disabled]="userForm.invalid"
-                          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                          wrappingClass="text-right"></cd-form-button-panel>
+    <cd-form-button-panel
+      (submitActionEvent)="onSubmit()"
+      (backActionEvent)="onCancel()"
+      [form]="userForm"
+      [disabled]="userForm.invalid"
+      [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+      wrappingClass="text-right"
+    ></cd-form-button-panel>
   </form>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login/login.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login/login.component.html
index 32f16ef85df..39d01022a98 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login/login.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login/login.component.html
@@ -1,66 +1,92 @@
-<div class="container"
-     *ngIf="isLoginActive">
+<div
+  class="container"
+  *ngIf="isLoginActive"
+>
   <h1 class="cds--visually-hidden">Ceph login</h1>
-  <form name="loginForm"
-        (ngSubmit)="login()"
-        #loginForm="ngForm"
-        novalidate>
-
+  <form
+    name="loginForm"
+    (ngSubmit)="login()"
+    #loginForm="ngForm"
+    novalidate
+  >
     <!-- Username -->
     <div class="form-group has-feedback d-flex flex-column py-3">
-      <label class="ps-3"
-             for="username"
-             i18n>Username</label>
-      <input id="username"
-             name="username"
-             [(ngModel)]="model.username"
-             #username="ngModel"
-             type="text"
-             [attr.aria-invalid]="username.invalid"
-             aria-labelledby="username"
-             class="form-control ps-3"
-             required
-             autofocus>
-      <div class="invalid-feedback ps-3"
-           *ngIf="(loginForm.submitted || username.dirty) && username.invalid"
-           i18n>Username is required</div>
+      <label
+        class="ps-3"
+        for="username"
+        i18n
+        >Username</label
+      >
+      <input
+        id="username"
+        name="username"
+        [(ngModel)]="model.username"
+        #username="ngModel"
+        type="text"
+        [attr.aria-invalid]="username.invalid"
+        aria-labelledby="username"
+        class="form-control ps-3"
+        required
+        autofocus
+      />
+      <div
+        class="invalid-feedback ps-3"
+        *ngIf="(loginForm.submitted || username.dirty) && username.invalid"
+        i18n
+      >
+        Username is required
+      </div>
     </div>
 
     <!-- Password -->
-    <div class="form-group has-feedback"
-         id="password-div">
+    <div
+      class="form-group has-feedback"
+      id="password-div"
+    >
       <div class="input-group d-flex flex-nowrap">
         <div class="d-flex flex-column flex-grow-1 py-3">
-          <label class="ps-3"
-                 for="password"
-                 i18n>Password</label>
-          <input id="password"
-                 name="password"
-                 [(ngModel)]="model.password"
-                 #password="ngModel"
-                 type="password"
-                 [attr.aria-invalid]="password.invalid"
-                 aria-labelledby="password"
-                 class="form-control ps-3"
-                 required>
-          <div class="invalid-feedback ps-3"
-               *ngIf="(loginForm.submitted || password.dirty) && password.invalid"
-               i18n>Password is required</div>
+          <label
+            class="ps-3"
+            for="password"
+            i18n
+            >Password</label
+          >
+          <input
+            id="password"
+            name="password"
+            [(ngModel)]="model.password"
+            #password="ngModel"
+            type="password"
+            [attr.aria-invalid]="password.invalid"
+            aria-labelledby="password"
+            class="form-control ps-3"
+            required
+          />
+          <div
+            class="invalid-feedback ps-3"
+            *ngIf="(loginForm.submitted || password.dirty) && password.invalid"
+            i18n
+          >
+            Password is required
+          </div>
         </div>
         <span class="form-group-append">
-          <button type="button"
-                  class="btn btn-outline-light btn-password h-100 px-4"
-                  cdPasswordButton="password"
-                  aria-label="toggle-password">
-          </button>
+          <button
+            type="button"
+            class="btn btn-outline-light btn-password h-100 px-4"
+            cdPasswordButton="password"
+            aria-label="toggle-password"
+          ></button>
         </span>
       </div>
     </div>
 
-    <input type="submit"
-           class="btn btn-accent px-5 py-2"
-           [disabled]="loginForm.invalid"
-           value="Log in"
-           i18n-value>
+    <input
+      type="submit"
+      class="btn btn-accent px-5 py-2"
+      [disabled]="loginForm.invalid"
+      value="Log in"
+      i18n-value
+    />
   </form>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-details/role-details.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-details/role-details.component.html
index ca4b6781bbf..0ee614b6c43 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-details/role-details.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-details/role-details.component.html
@@ -1,11 +1,13 @@
 <ng-container *ngIf="selection">
-  <cd-table [data]="scopes_permissions"
-            [columns]="columns"
-            columnMode="flex"
-            [toolHeader]="false"
-            [autoReload]="false"
-            [autoSave]="false"
-            [footer]="false"
-            [limit]="0">
+  <cd-table
+    [data]="scopes_permissions"
+    [columns]="columns"
+    columnMode="flex"
+    [toolHeader]="false"
+    [autoReload]="false"
+    [autoSave]="false"
+    [footer]="false"
+    [limit]="0"
+  >
   </cd-table>
 </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-form/role-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-form/role-form.component.html
index 7f79f92464d..e24e718a5e1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-form/role-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-form/role-form.component.html
@@ -1,72 +1,87 @@
-<div cdsCol
-     [columnNumbers]="{md: 4}">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form name="roleForm"
-          #formDir="ngForm"
-          [formGroup]="roleForm"
-          novalidate>
-      <div i18n="form title"
-           class="form-header">{{ action | titlecase }} {{ resource | upperFirst }}
+    <form
+      name="roleForm"
+      #formDir="ngForm"
+      [formGroup]="roleForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
+        {{ action | titlecase }} {{ resource | upperFirst }}
       </div>
-        <!--Name -->
+      <!--Name -->
       <div class="form-item">
-        <cds-text-label for="name"
-                        cdRequiredField="Name"
-                        [invalid]="!roleForm.controls.name.valid && roleForm.controls.name.dirty"
-                        [invalidText]="nameError"
-                        i18n>Name
-          <span [ngClass]="{'required': mode !== roleFormMode.editing}"></span>
-          <input cdsText
-                 placeholder="Name..."
-                 i18n-placeholder
-                 id="name"
-                 name="name"
-                 formControlName="name"
-                 [invalid]="!roleForm.controls.name.valid && roleForm.controls.name.dirty"
-                 autofocus>
+        <cds-text-label
+          for="name"
+          cdRequiredField="Name"
+          [invalid]="!roleForm.controls.name.valid && roleForm.controls.name.dirty"
+          [invalidText]="nameError"
+          i18n
+          >Name
+          <span [ngClass]="{ required: mode !== roleFormMode.editing }"></span>
+          <input
+            cdsText
+            placeholder="Name..."
+            i18n-placeholder
+            id="name"
+            name="name"
+            formControlName="name"
+            [invalid]="!roleForm.controls.name.valid && roleForm.controls.name.dirty"
+            autofocus
+          />
         </cds-text-label>
         <ng-template #nameError>
           <span *ngIf="roleForm.showError('name', formDir, 'required')">
-            <ng-container i18n>
-               This field is required.
-            </ng-container>
+            <ng-container i18n> This field is required. </ng-container>
           </span>
           <span *ngIf="roleForm.showError('name', formDir, 'notUnique')">
-            <ng-container i18n>
-                The chosen name is already in use.
-            </ng-container>
+            <ng-container i18n> The chosen name is already in use. </ng-container>
           </span>
         </ng-template>
       </div>
-    <!-- Description -->
+      <!-- Description -->
       <div class="form-item">
-        <cds-text-label for="name"
-                        i18n>Description
-        <input cdsText
-               type="text"
-               class="input-field"
-               placeholder="Description.."
-               id="description"
-               name="description"
-               formControlName="description">
+        <cds-text-label
+          for="name"
+          i18n
+          >Description
+          <input
+            cdsText
+            type="text"
+            class="input-field"
+            placeholder="Description.."
+            id="description"
+            name="description"
+            formControlName="description"
+          />
         </cds-text-label>
       </div>
       <!-- Permissions -->
-      <div  class="form-item">
+      <div class="form-item">
         <cds-text-label>Permissions</cds-text-label>
-        <cd-checked-table-form [data]="scopes_permissions"
-                               [columns]="columns"
-                               [form]="roleForm"
-                               inputField="scopes_permissions"
-                               [scopes]="scopes"
-                               [initialValue]="initialValue"></cd-checked-table-form>
+        <cd-checked-table-form
+          [data]="scopes_permissions"
+          [columns]="columns"
+          [form]="roleForm"
+          inputField="scopes_permissions"
+          [scopes]="scopes"
+          [initialValue]="initialValue"
+        ></cd-checked-table-form>
       </div>
       <!--Submit Button-->
       <div class="form-item">
-        <cd-form-button-panel (submitActionEvent)="submit()"
-                              [form]="roleForm"
-                              [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                              wrappingClass="text-right">
+        <cd-form-button-panel
+          (submitActionEvent)="submit()"
+          [form]="roleForm"
+          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+          wrappingClass="text-right"
+        >
         </cd-form-button-panel>
       </div>
     </form>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-list/role-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-list/role-list.component.html
index 46b21c92638..72b1717fe1d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-list/role-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/role-list/role-list.component.html
@@ -1,21 +1,27 @@
 <cd-user-tabs></cd-user-tabs>
 
-<cd-table [data]="roles"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="name"
-          selectionType="single"
-          [hasDetails]="true"
-          (setExpandedRow)="setExpandedRow($event)"
-          (fetchData)="getRoles()"
-          (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="roles"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="name"
+  selectionType="single"
+  [hasDetails]="true"
+  (setExpandedRow)="setExpandedRow($event)"
+  (fetchData)="getRoles()"
+  (updateSelection)="updateSelection($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
-  <cd-role-details *cdTableDetail
-                   [selection]="expandedRow"
-                   [scopes]="scopes">
+  <cd-role-details
+    *cdTableDetail
+    [selection]="expandedRow"
+    [scopes]="scopes"
+  >
   </cd-role-details>
 </cd-table>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
index 843c08e5b5c..409b84d1f9a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
@@ -1,7 +1,18 @@
-<div cdsCol [columnNumbers]="{ md: 4 }">
+<div
+  cdsCol
+  [columnNumbers]="{ md: 4 }"
+>
   <ng-container *cdFormLoading="loading">
-    <form #frm="ngForm" #formDir="ngForm" [formGroup]="userForm" novalidate>
-      <div i18n="form title" class="form-header">
+    <form
+      #frm="ngForm"
+      #formDir="ngForm"
+      [formGroup]="userForm"
+      novalidate
+    >
+      <div
+        i18n="form title"
+        class="form-header"
+      >
         {{ action | titlecase }} {{ resource | upperFirst }}
       </div>
       <!-- UserName -->
@@ -119,10 +130,16 @@
         </ng-template>
       </div>
       <!-- Password expiration date -->
-      <div class="form-item" *ngIf="!isSSO">
+      <div
+        class="form-item"
+        *ngIf="!isSSO"
+      >
         <cds-text-label [ngClass]="{ required: pwdExpirationSettings.pwdExpirationSpan > 0 }"
           >{{ 'Password Expiration Date' }}
-          <cd-helper class="text-pre-wrap" *ngIf="pwdExpirationSettings.pwdExpirationSpan == 0">
+          <cd-helper
+            class="text-pre-wrap"
+            *ngIf="pwdExpirationSettings.pwdExpirationSpan == 0"
+          >
             <span>
               The Dashboard setting defining the expiration interval of passwords is currently set
               to <strong>0</strong>. This means if a date is set, the user password will only expire
@@ -130,7 +147,9 @@
             </span>
             <span
               >Consider configuring the Dashboard setting
-              <a routerLink="/mgr-modules/edit/dashboard" class="alert-link"
+              <a
+                routerLink="/mgr-modules/edit/dashboard"
+                class="alert-link"
                 >USER_PWD_EXPIRATION_SPAN</a
               >
               in order to let passwords expire periodically.
@@ -154,9 +173,18 @@
       </div>
       <!--Full Name-->
       <div class="form-item">
-        <cds-text-label for="name" i18n>
+        <cds-text-label
+          for="name"
+          i18n
+        >
           Full Name
-          <input cdsText type="text" placeholder="Full Name..." id="name" formControlName="name" />
+          <input
+            cdsText
+            type="text"
+            placeholder="Full Name..."
+            id="name"
+            formControlName="name"
+          />
         </cds-text-label>
       </div>
       <!-- Email -->
@@ -168,16 +196,28 @@
           i18n
         >
           Email
-          <input cdsText type="email" placeholder="Email..." id="email" formControlName="email" />
+          <input
+            cdsText
+            type="email"
+            placeholder="Email..."
+            id="email"
+            formControlName="email"
+          />
         </cds-text-label>
         <ng-template #emailError>
-          <span class="invalid-feedback" *ngIf="userForm.showError('email', formDir, 'email')" i18n
+          <span
+            class="invalid-feedback"
+            *ngIf="userForm.showError('email', formDir, 'email')"
+            i18n
             >Invalid email.
           </span>
         </ng-template>
       </div>
       <!-- Roles -->
-      <div class="form-item" *ngIf="allRoles">
+      <div
+        class="form-item"
+        *ngIf="allRoles"
+      >
         <cds-combo-box
           label="Roles"
           type="multi"
@@ -207,13 +247,23 @@
         </ng-template>
       </div>
       <!-- Enabled -->
-      <div class="form-item" *ngIf="!isCurrentUser()">
-        <cds-checkbox id="enabled" formControlName="enabled" name="enabled" i18n
+      <div
+        class="form-item"
+        *ngIf="!isCurrentUser()"
+      >
+        <cds-checkbox
+          id="enabled"
+          formControlName="enabled"
+          name="enabled"
+          i18n
           >Enabled
         </cds-checkbox>
       </div>
       <!-- Force change password -->
-      <div class="form-item" *ngIf="!isCurrentUser() && !isSSO">
+      <div
+        class="form-item"
+        *ngIf="!isCurrentUser() && !isSSO"
+      >
         <cds-checkbox
           id="pwdUpdateRequired"
           formControlName="pwdUpdateRequired"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-list/user-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-list/user-list.component.html
index 06cfcdad5fd..9c677c3a830 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-list/user-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-list/user-list.component.html
@@ -1,46 +1,62 @@
 <cd-user-tabs></cd-user-tabs>
 
-<cd-table [data]="users"
-          columnMode="flex"
-          [columns]="columns"
-          identifier="username"
-          selectionType="single"
-          (fetchData)="getUsers()"
-          (updateSelection)="updateSelection($event)">
-  <cd-table-actions class="table-actions"
-                    [permission]="permission"
-                    [selection]="selection"
-                    [tableActions]="tableActions">
+<cd-table
+  [data]="users"
+  columnMode="flex"
+  [columns]="columns"
+  identifier="username"
+  selectionType="single"
+  (fetchData)="getUsers()"
+  (updateSelection)="updateSelection($event)"
+>
+  <cd-table-actions
+    class="table-actions"
+    [permission]="permission"
+    [selection]="selection"
+    [tableActions]="tableActions"
+  >
   </cd-table-actions>
 </cd-table>
 
-<ng-template #userRolesTpl
-             let-value="data.value">
-  <span *ngFor="let role of value; last as isLast">
-    {{ role }}{{ !isLast ? ", " : "" }}
-  </span>
+<ng-template
+  #userRolesTpl
+  let-value="data.value"
+>
+  <span *ngFor="let role of value; last as isLast"> {{ role }}{{ !isLast ? ', ' : '' }} </span>
 </ng-template>
 
-<ng-template #warningTpl
-             let-column="data.column"
-             let-value="data.value"
-             let-row="data.row">
-  <div [class.border-danger]="row.remainingDays < expirationDangerAlert"
-       [class.border-warning]="row.remainingDays < expirationWarningAlert && row.remainingDays >= expirationDangerAlert"
-       class="border-margin">
-    <div class="warning-content"> {{ value }} </div>
+<ng-template
+  #warningTpl
+  let-column="data.column"
+  let-value="data.value"
+  let-row="data.row"
+>
+  <div
+    [class.border-danger]="row.remainingDays < expirationDangerAlert"
+    [class.border-warning]="
+      row.remainingDays < expirationWarningAlert && row.remainingDays >= expirationDangerAlert
+    "
+    class="border-margin"
+  >
+    <div class="warning-content">{{ value }}</div>
   </div>
 </ng-template>
 
-<ng-template #durationTpl
-             let-column="data.column"
-             let-value="data.value"
-             let-row="data.row">
-  <i *ngIf="row.remainingDays < expirationWarningAlert"
-     i18n-title
-     title="User's password is about to expire"
-     [class.icon-danger-color]="row.remainingDays < expirationDangerAlert"
-     [class.icon-warning-color]="row.remainingDays < expirationWarningAlert && row.remainingDays >= expirationDangerAlert"
-     class="{{ icons.warning }}"></i>
+<ng-template
+  #durationTpl
+  let-column="data.column"
+  let-value="data.value"
+  let-row="data.row"
+>
+  <i
+    *ngIf="row.remainingDays < expirationWarningAlert"
+    i18n-title
+    title="User's password is about to expire"
+    [class.icon-danger-color]="row.remainingDays < expirationDangerAlert"
+    [class.icon-warning-color]="
+      row.remainingDays < expirationWarningAlert && row.remainingDays >= expirationDangerAlert
+    "
+    class="{{ icons.warning }}"
+  ></i>
   <span title="{{ value | cdDate }}">{{ row.remainingTimeWithoutSeconds / 1000 | duration }}</span>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.html
index 2c0ea4461b2..1c092d849c2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.html
@@ -1,90 +1,123 @@
-<form [formGroup]="userForm"
-      novalidate>
-  <div cdsGrid
-       [useCssGrid]="true"
-       [narrow]="true"
-       [fullWidth]="true">
-    <div cdsCol
-         [columnNumbers]="{sm: 4, md: 8}">
-      <div cdsRow
-           class="form-heading">
+<form
+  [formGroup]="userForm"
+  novalidate
+>
+  <div
+    cdsGrid
+    [useCssGrid]="true"
+    [narrow]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      [columnNumbers]="{ sm: 4, md: 8 }"
+    >
+      <div
+        cdsRow
+        class="form-heading"
+      >
         <h3>{{ action | titlecase }} {{ resource | upperFirst }}</h3>
         <cd-help-text [formAllFieldsRequired]="true"></cd-help-text>
       </div>
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-password-label
           [invalid]="oldPwd.isInvalid"
-          [invalidText]="oldPasswordInvalid">
+          [invalidText]="oldPasswordInvalid"
+        >
           Old Password
-          <input cdsPassword
-                 cdValidate
-                 #oldPwd="cdValidate"
-                 formControlName="oldpassword"
-                 autocomplete="oldpassword"
-                 [invalid]="oldPwd.isInvalid"
-                 id="oldpassword"
-                 autofocus>
+          <input
+            cdsPassword
+            cdValidate
+            #oldPwd="cdValidate"
+            formControlName="oldpassword"
+            autocomplete="oldpassword"
+            [invalid]="oldPwd.isInvalid"
+            id="oldpassword"
+            autofocus
+          />
         </cds-password-label>
       </div>
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-password-label
           [invalid]="newPwd.isInvalid"
           [invalidText]="newPasswordInvalid"
-          [helperText]="passwordPolicyHelpText">
+          [helperText]="passwordPolicyHelpText"
+        >
           New Password
-          <input cdsPassword
-                 cdValidate
-                 #newPwd="cdValidate"
-                 formControlName="newpassword"
-                 autocomplete="newpassword"
-                 [invalid]="newPwd.isInvalid"
-                 id="newpassword">
+          <input
+            cdsPassword
+            cdValidate
+            #newPwd="cdValidate"
+            formControlName="newpassword"
+            autocomplete="newpassword"
+            [invalid]="newPwd.isInvalid"
+            id="newpassword"
+          />
         </cds-password-label>
       </div>
-      <div cdsRow
-           class="form-item">
+      <div
+        cdsRow
+        class="form-item"
+      >
         <cds-password-label
           [invalid]="confirmPwd.isInvalid"
-          [invalidText]="confirmNewPasswordInvalid">
+          [invalidText]="confirmNewPasswordInvalid"
+        >
           Confirm New Password
-          <input cdsPassword
-                 cdValidate
-                 #confirmPwd="cdValidate"
-                 formControlName="confirmnewpassword"
-                 autocomplete="confirmnewpassword"
-                 [invalid]="confirmPwd.isInvalid"
-                 id="confirmnewpassword">
+          <input
+            cdsPassword
+            cdValidate
+            #confirmPwd="cdValidate"
+            formControlName="confirmnewpassword"
+            autocomplete="confirmnewpassword"
+            [invalid]="confirmPwd.isInvalid"
+            id="confirmnewpassword"
+          />
         </cds-password-label>
       </div>
       <div cdsRow>
-        <cd-form-button-panel (submitActionEvent)="onSubmit()"
-                              [form]="userForm"
-                              [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
-                              wrappingClass="text-right form-button"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="onSubmit()"
+          [form]="userForm"
+          [submitText]="(action | titlecase) + ' ' + (resource | upperFirst)"
+          wrappingClass="text-right form-button"
+        ></cd-form-button-panel>
       </div>
     </div>
   </div>
 </form>
 
-<ng-template #validationErrors
-             let-control="control">
-@if (control.errors) {
-@for (err of control.errors | keyvalue; track err.key) {
-<span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
-}
-}
+<ng-template
+  #validationErrors
+  let-control="control"
+>
+  @if (control.errors) {
+    @for (err of control.errors | keyvalue; track err.key) {
+      <span class="invalid-feedback">{{ INVALID_TEXTS[err.key] }}</span>
+    }
+  }
 </ng-template>
 
 <ng-template #oldPasswordInvalid>
-  <ng-container *ngTemplateOutlet="validationErrors; context: { control: userForm.get('oldpassword') }"></ng-container>
+  <ng-container
+    *ngTemplateOutlet="validationErrors; context: { control: userForm.get('oldpassword') }"
+  ></ng-container>
 </ng-template>
 
 <ng-template #newPasswordInvalid>
-  <ng-container *ngTemplateOutlet="validationErrors; context: { control: userForm.get('newpassword') }"></ng-container>
+  <ng-container
+    *ngTemplateOutlet="validationErrors; context: { control: userForm.get('newpassword') }"
+  ></ng-container>
 </ng-template>
 
 <ng-template #confirmNewPasswordInvalid>
-  <ng-container *ngTemplateOutlet="validationErrors; context: { control: userForm.get('confirmnewpassword') }"></ng-container>
+  <ng-container
+    *ngTemplateOutlet="validationErrors; context: { control: userForm.get('confirmnewpassword') }"
+  ></ng-container>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-tabs/user-tabs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-tabs/user-tabs.component.html
index 1ab4e1743b3..66504fffbe0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-tabs/user-tabs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-tabs/user-tabs.component.html
@@ -1,18 +1,24 @@
 <ul class="nav nav-tabs">
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/user-management/users"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Users</a>
+    <a
+      class="nav-link"
+      routerLink="/user-management/users"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Users</a
+    >
   </li>
   <li class="nav-item">
-    <a class="nav-link"
-       routerLink="/user-management/roles"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>Roles</a>
+    <a
+      class="nav-link"
+      routerLink="/user-management/roles"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >Roles</a
+    >
   </li>
 </ul>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html
index bae77dfdbfd..9d7376310ed 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/context/context.component.html
@@ -1,25 +1,54 @@
-<ng-container *ngIf="{ ftMap: featureToggleMap$ | async, daemons: rgwDaemonService.daemons$ | async, selectedDaemon: rgwDaemonService.selectedDaemon$ | async } as data">
-  <ng-container *ngIf="data.ftMap && data.ftMap.rgw && permissions.rgw.read && isRgwRoute && data.daemons.length > 1">
+<ng-container
+  *ngIf="{
+    ftMap: featureToggleMap$ | async,
+    daemons: rgwDaemonService.daemons$ | async,
+    selectedDaemon: rgwDaemonService.selectedDaemon$ | async
+  } as data"
+>
+  <ng-container
+    *ngIf="
+      data.ftMap && data.ftMap.rgw && permissions.rgw.read && isRgwRoute && data.daemons.length > 1
+    "
+  >
     <div class="cd-context-bar pt-3 pb-3">
-      <span class="me-1"
-            i18n>Object gateway:</span>
-      <div ngbDropdown
-           placement="bottom-left"
-           class="d-inline-block ms-2">
-        <button ngbDropdownToggle
-                class="btn btn-outline-info ctx-bar-selected-rgw-daemon"
-                i18n-title
-                title="Object gateway">
+      <span
+        class="me-1"
+        i18n
+        >Object gateway:</span
+      >
+      <div
+        ngbDropdown
+        placement="bottom-left"
+        class="d-inline-block ms-2"
+      >
+        <button
+          ngbDropdownToggle
+          class="btn btn-outline-info ctx-bar-selected-rgw-daemon"
+          i18n-title
+          title="Object gateway"
+          type="button"
+        >
           {{ data.selectedDaemon.id }}
-          <cds-tag type="blue" size="sm">{{ data.selectedDaemon.zonegroup_name }}</cds-tag>
+          <cds-tag
+            type="blue"
+            size="sm"
+            >{{ data.selectedDaemon.zonegroup_name }}</cds-tag
+          >
         </button>
         <div ngbDropdownMenu>
           <ng-container *ngFor="let daemon of data.daemons">
-            <button ngbDropdownItem
-                    class="ctx-bar-available-rgw-daemon"
-                    (click)="onDaemonSelection(daemon)">
+            <button
+              ngbDropdownItem
+              class="ctx-bar-available-rgw-daemon"
+              (click)="onDaemonSelection(daemon)"
+              type="button"
+            >
               {{ daemon.id }}
-              <cds-tag type="blue" size="sm">{{ daemon.zonegroup_name }}</cds-tag>
+              <cds-tag
+                type="blue"
+                size="sm"
+                >{{ daemon.zonegroup_name }}</cds-tag
+              >
             </button>
           </ng-container>
         </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html
index e0dcb07d542..d6773ed3c5e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/error/error.component.html
@@ -1,37 +1,58 @@
 <head>
   <title>Error Page</title>
-  <base target="_blank">
+  <base target="_blank" />
 </head>
 <div class="container h-75">
   <div class="row h-100 justify-content-center align-items-center">
     <div class="blank-page">
       <div *ngIf="header && message; else elseBlock">
-        <svg [cdsIcon]="icon"
-             class="cds-info-color cds-icon--size-10"></svg>
+        <svg
+          [cdsIcon]="icon"
+          class="cds-info-color cds-icon--size-10"
+        ></svg>
         <div class="mt-4 text-center">
-          <h3><b>{{ header }}</b></h3>
-          <h4 class="mt-3"
-              *ngIf="header !== message">{{ message }}</h4>
-          <h4 *ngIf="section"
-              i18n>Please consult the&nbsp;<a href="{{ docUrl }}">documentation</a>&nbsp;on how to configure and enable
-                   the {{ sectionInfo }} management functionality.
+          <h3>
+            <b>{{ header }}</b>
+          </h3>
+          <h4
+            class="mt-3"
+            *ngIf="header !== message"
+          >
+            {{ message }}
+          </h4>
+          <h4
+            *ngIf="section"
+            i18n
+          >
+            Please consult the&nbsp;<a href="{{ docUrl }}">documentation</a>&nbsp;on how to
+            configure and enable the {{ sectionInfo }} management functionality.
           </h4>
         </div>
       </div>
 
       <div class="mt-4">
-        <div class="text-center"
-             *ngIf="(buttonName && buttonRoute) || uiConfig; else dashboardButton">
-          <button class="btn btn-primary ms-1"
-                  [routerLink]="buttonRoute"
-                  *ngIf="!uiConfig; else configureButtonTpl"
-                  type="button"
-                  i18n>{{ buttonName }}</button>
-          <button class="btn btn-light ms-1"
-                  [routerLink]="secondaryButtonRoute"
-                  *ngIf="secondaryButtonName && secondaryButtonRoute"
-                  type="button"
-                  i18n>{{ secondaryButtonName }}</button>
+        <div
+          class="text-center"
+          *ngIf="(buttonName && buttonRoute) || uiConfig; else dashboardButton"
+        >
+          <button
+            class="btn btn-primary ms-1"
+            [routerLink]="buttonRoute"
+            *ngIf="!uiConfig; else configureButtonTpl"
+            type="button"
+            i18n
+          >
+            {{ buttonName }}
+          </button>
+          <button
+            class="btn btn-light ms-1"
+            [routerLink]="secondaryButtonRoute"
+            *ngIf="secondaryButtonName && secondaryButtonRoute"
+            type="button"
+            i18n
+          >
+            {{ secondaryButtonName }}
+          </button>
         </div>
       </div>
     </div>
@@ -39,45 +60,66 @@
 </div>
 
 <ng-template #configureButtonTpl>
-  <button class="btn btn-primary"
-          (click)="doConfigure()"
-          [attr.title]="buttonTitle"
-          type="button"
-          *ngIf="uiConfig"
-          i18n>{{ buttonName }}</button>
+  <button
+    class="btn btn-primary"
+    (click)="doConfigure()"
+    [attr.title]="buttonTitle"
+    type="button"
+    *ngIf="uiConfig"
+    i18n
+  >
+    {{ buttonName }}
+  </button>
 </ng-template>
 
-
 <ng-template #elseBlock>
-  <cd-icon type="warningAltFilled"
-           customClass="mx-auto d-block text-danger"
-           size="32"></cd-icon>
+  <cd-icon
+    type="warningAltFilled"
+    customClass="mx-auto d-block text-danger"
+    size="32"
+  ></cd-icon>
 
   <div class="mt-4 text-center">
     <h3 i18n><b>Page not Found</b></h3>
 
-    <h4 class="mt-4"
-        i18n>Sorry, we couldn’t find what you were looking for.
-             The page you requested may have been changed or moved.</h4>
+    <h4
+      class="mt-4"
+      i18n
+    >
+      Sorry, we couldn’t find what you were looking for. The page you requested may have been
+      changed or moved.
+    </h4>
   </div>
 </ng-template>
 
 <ng-template #dashboardButton>
-  <div class="mt-4 text-center"
-       *ngIf="!module_name; else enableButton">
-    <button class="btn btn-primary"
-            [routerLink]="'/overview'"
-            type="button"
-            i18n>Go To Overview</button>
+  <div
+    class="mt-4 text-center"
+    *ngIf="!module_name; else enableButton"
+  >
+    <button
+      class="btn btn-primary"
+      [routerLink]="'/overview'"
+      type="button"
+      i18n
+    >
+      Go To Overview
+    </button>
   </div>
 </ng-template>
 
 <ng-template #enableButton>
-  <div class="mt-4 text-center"
-       *ngIf="module_name && !(buttonName && buttonRoute)">
-    <button class="btn btn-primary"
-            (click)="enableModule()"
-            type="button"
-            i18n>Enable {{ module_name | upperFirst }} module</button>
+  <div
+    class="mt-4 text-center"
+    *ngIf="module_name && !(buttonName && buttonRoute)"
+  >
+    <button
+      class="btn btn-primary"
+      (click)="enableModule()"
+      type="button"
+      i18n
+    >
+      Enable {{ module_name | upperFirst }} module
+    </button>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html
index bd92995be2d..5466a600c7c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/login-layout/login-layout.component.html
@@ -1,6 +1,11 @@
 <main class="login full-height">
   <header>
     <nav class="navbar p-4">
+      <a
+        class="navbar-brand"
+        aria-label="Ceph Dashboard"
+        i18n-aria-label
+      ></a>
       <div class="form-inline">
         <cd-language-selector></cd-language-selector>
       </div>
@@ -13,16 +18,22 @@
           <router-outlet></router-outlet>
         </div>
         <div class="col-sm-12 col-md-6 d-sm-block branding-info">
-          <img src="assets/Ceph_Ceph_Logo_with_text_white.svg"
-               alt="Ceph"
-               class="img-fluid pb-3">
+          <img
+            src="assets/Ceph_Ceph_Logo_with_text_white.svg"
+            alt="Ceph"
+            class="img-fluid pb-3"
+          />
           <ul class="list-inline">
-            <li class="list-inline-item p-3"
-                *ngFor="let docItem of docItems">
-              <cd-doc section="{{ docItem.section }}"
-                      docText="{{ docItem.text }}"
-                      noSubscribe="true"
-                      i18n-docText></cd-doc>
+            <li
+              class="list-inline-item p-3"
+              *ngFor="let docItem of docItems"
+            >
+              <cd-doc
+                section="{{ docItem.section }}"
+                docText="{{ docItem.text }}"
+                noSubscribe="true"
+                i18n-docText
+              ></cd-doc>
             </li>
           </ul>
           <cd-custom-login-banner></cd-custom-login-banner>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.html
index 95d610d26d3..b8c59ddf44b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.html
@@ -1,29 +1,46 @@
 <block-ui name="global">
   <cd-navigation>
-    <div class="container-fluid h-100"
-         [ngClass]="{'overview': (router.url == '/overview' || router.url == '/dashboard_3' || router.url == '/multi-cluster/overview'), 'rgw-dashboard': (router.url == '/rgw/overview')}">
+    <div
+      class="container-fluid h-100"
+      [ngClass]="{
+        overview:
+          router.url == '/overview' ||
+          router.url == '/dashboard_3' ||
+          router.url == '/multi-cluster/overview',
+        'rgw-dashboard': router.url == '/rgw/overview'
+      }"
+    >
       <!-- ************************ -->
       <!-- ALERTS BANNER     -->
       <!-- ************************ -->
-      <div class="cd-alert-container"
-           [ngClass]="{'ms-4 me-4': (router.url == '/overview' || router.url == '/dashboard_3' || router.url == '/multi-cluster/overview' || router.url == '/rgw/overview')}">
+      <div
+        class="cd-alert-container"
+        [ngClass]="{
+          'ms-4 me-4':
+            router.url == '/overview' ||
+            router.url == '/dashboard_3' ||
+            router.url == '/multi-cluster/overview' ||
+            router.url == '/rgw/overview'
+        }"
+      >
         @if (enabledFeature$ | async; as features) {
-        <cd-pwd-expiration-notification></cd-pwd-expiration-notification>
-        <cd-motd></cd-motd>
-        @if (features.dashboard) {
-        <cd-telemetry-notification></cd-telemetry-notification>
-        }
+          <cd-pwd-expiration-notification></cd-pwd-expiration-notification>
+          <cd-motd></cd-motd>
+          @if (features.dashboard) {
+            <cd-telemetry-notification></cd-telemetry-notification>
+          }
         }
       </div>
       <cd-context></cd-context>
       <div class="breadcrumbs--padding">
         <cd-breadcrumbs></cd-breadcrumbs>
       </div>
-      @if(pageHeaderTitle) {
-      <cd-page-header
-                      [title]="pageHeaderTitle"
-                      [description]="pageHeaderDescription">
-      </cd-page-header>
+      @if (pageHeaderTitle) {
+        <cd-page-header
+          [title]="pageHeaderTitle"
+          [description]="pageHeaderDescription"
+        >
+        </cd-page-header>
       }
       <router-outlet></router-outlet>
       <cds-placeholder></cds-placeholder>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/about/about.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/about/about.component.html
index 8e3346b8664..7bbb601f630 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/about/about.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/about/about.component.html
@@ -1,30 +1,35 @@
-<cds-modal [open]="open"
-           size="md"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  [open]="open"
+  size="md"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
     <div class="header-content">
-      <img src="assets/Ceph_Ceph_Logo_with_text_red_white.svg"
-           class="ceph-logo"
-           alt="{{ projectConstants.organization }}">
-    <h3 class="modal-title">
-      <strong>{{ projectConstants.projectName }}</strong>
-    </h3>
+      <img
+        src="assets/Ceph_Ceph_Logo_with_text_red_white.svg"
+        class="ceph-logo"
+        alt="{{ projectConstants.organization }}"
+      />
+      <h3 class="modal-title">
+        <strong>{{ projectConstants.projectName }}</strong>
+      </h3>
     </div>
-
   </cds-modal-header>
-    <section cdsModalContent
-             modal-primary-focus>
-    <div class="modal-body" >
+  <section
+    cdsModalContent
+    modal-primary-focus
+  >
+    <div class="modal-body">
       <div class="product-versions">
         <strong i18n>Version</strong>
-        <br>
+        <br />
         {{ versionNumber }}
         {{ versionHash }}
-        <br>
+        <br />
         {{ versionName }}
       </div>
 
-      <br>
+      <br />
 
       <dl>
         <dt i18n>Ceph Manager</dt>
@@ -41,7 +46,7 @@
         <dd>{{ modalVariables.browserOS }}</dd>
       </dl>
     </div>
-    </section>
+  </section>
 
   <cds-modal-footer>
     <div class="footer-content">
@@ -50,5 +55,3 @@
     </div>
   </cds-modal-footer>
 </cds-modal>
-
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
index 5eac4142b6b..d2d7b840707 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/administration/administration.component.html
@@ -1,26 +1,43 @@
-<cds-overflow-menu [customTrigger]="customTrigger"
-                   [flip]="true"
-                   description="">
+<cds-overflow-menu
+  [customTrigger]="customTrigger"
+  [flip]="true"
+  description=""
+>
   <li class="cds--overflow-menu-options__option mb-2">
-    <button routerLink="/user-management"
-            class="cds--overflow-menu-options__btn"
-            type="button"
-            i18n>User management</button>
+    <button
+      routerLink="/user-management"
+      class="cds--overflow-menu-options__btn"
+      type="button"
+      i18n
+    >
+      User management
+    </button>
   </li>
-  <li class="cds--overflow-menu-options__option mb-2"
-      *ngIf="configOptPermission.read">
-    <button routerLink="/telemetry"
-            class="cds--overflow-menu-options__btn"
-            type="button"
-            i18n>Telemetry configuration</button>
+  <li
+    class="cds--overflow-menu-options__option mb-2"
+    *ngIf="configOptPermission.read"
+  >
+    <button
+      routerLink="/telemetry"
+      class="cds--overflow-menu-options__btn"
+      type="button"
+      i18n
+    >
+      Telemetry configuration
+    </button>
   </li>
 </cds-overflow-menu>
 
 <ng-template #customTrigger>
-  <svg cdsIcon="settings"
-       size="20"
-       title="Settings"
-       *ngIf="userPermission.read"></svg>
-  <span i18n
-        class="d-md-none">Dashboard Settings</span>
+  <svg
+    cdsIcon="settings"
+    size="20"
+    title="Settings"
+    *ngIf="userPermission.read"
+  ></svg>
+  <span
+    i18n
+    class="d-md-none"
+    >Dashboard Settings</span
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/api-docs/api-docs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/api-docs/api-docs.component.html
index 2dd0ff424c0..5d38371cae2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/api-docs/api-docs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/api-docs/api-docs.component.html
@@ -1,3 +1,4 @@
-
-<div id="swagger-ui"
-     class="apiDocs"></div>
+<div
+  id="swagger-ui"
+  class="apiDocs"
+></div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/breadcrumbs/breadcrumbs.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/breadcrumbs/breadcrumbs.component.html
index 72d9cb8e1f6..fd912300e52 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/breadcrumbs/breadcrumbs.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/breadcrumbs/breadcrumbs.component.html
@@ -1,13 +1,19 @@
-<cds-breadcrumb [noTrailingSlash]="true"
-                *ngIf="crumbs.length">
+<cds-breadcrumb
+  [noTrailingSlash]="true"
+  *ngIf="crumbs.length"
+>
   <ng-container *ngFor="let crumb of crumbs; let last = last">
-    <cds-breadcrumb-item *ngIf="!last && crumb.path !== null"
-                         href="#/{{ crumb.path }}">
+    <cds-breadcrumb-item
+      *ngIf="!last && crumb.path !== null"
+      href="#/{{ crumb.path }}"
+    >
       {{ crumb.text }}
     </cds-breadcrumb-item>
 
-    <cds-breadcrumb-item *ngIf="last || crumb.path === null"
-                         data-testid="active-breadcrumb-item">
+    <cds-breadcrumb-item
+      *ngIf="last || crumb.path === null"
+      data-testid="active-breadcrumb-item"
+    >
       {{ crumb.text }}
     </cds-breadcrumb-item>
   </ng-container>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.html
index ea44b1057f3..7c43de237e6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.html
@@ -1,38 +1,59 @@
-<cds-overflow-menu [customTrigger]="customTrigger"
-                   [flip]="true"
-                   description="">
+<cds-overflow-menu
+  [customTrigger]="customTrigger"
+  [flip]="true"
+  description=""
+>
   <li>
-    <a [ngClass]="{'cds--overflow-menu-options__btn': true, 'disabled': !docsUrl}"
-       href="{{ docsUrl }}"
-       target="_blank"
-       i18n>Documentation
-      <svg cdsIcon="launch"
-           class="ms-2"
-           size="16"></svg>
+    <a
+      [ngClass]="{ 'cds--overflow-menu-options__btn': true, disabled: !docsUrl }"
+      href="{{ docsUrl }}"
+      target="_blank"
+      i18n
+      >Documentation
+      <svg
+        cdsIcon="launch"
+        class="ms-2"
+        size="16"
+      ></svg>
     </a>
   </li>
   <li>
-    <a routerLink="/api-docs"
-       target="_blank"
-       class="cds--overflow-menu-options__btn"
-       i18n>API
-      <svg cdsIcon="launch"
-           class="ms-2"
-           size="16"></svg>
+    <a
+      routerLink="/api-docs"
+      target="_blank"
+      class="cds--overflow-menu-options__btn"
+      i18n
+      >API
+      <svg
+        cdsIcon="launch"
+        class="ms-2"
+        size="16"
+      ></svg>
     </a>
   </li>
-  <cds-overflow-menu-option (click)="openAboutModal()"
-                            i18n>About</cds-overflow-menu-option>
-  <cds-overflow-menu-option (click)="openFeedbackModal()"
-                            i18n>Report an issue...</cds-overflow-menu-option>
+  <cds-overflow-menu-option
+    (click)="openAboutModal()"
+    i18n
+    >About</cds-overflow-menu-option
+  >
+  <cds-overflow-menu-option
+    (click)="openFeedbackModal()"
+    i18n
+    >Report an issue...</cds-overflow-menu-option
+  >
 </cds-overflow-menu>
 
 <ng-template #customTrigger>
-  <svg cdsIcon="help"
-       size="20"
-       i18n-title
-       title="Help"
-       role="button"></svg>
-  <span i18n
-        class="d-md-none">Help</span>
+  <svg
+    cdsIcon="help"
+    size="20"
+    i18n-title
+    title="Help"
+    role="button"
+  ></svg>
+  <span
+    i18n
+    class="d-md-none"
+    >Help</span
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html
index c68c88d25c6..d3d1201ea14 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.html
@@ -1,39 +1,58 @@
-<cds-overflow-menu [customTrigger]="customTrigger"
-                   [flip]="true"
-                   description="">
-  <li disabled="true"
-      class="show cds--overflow-menu-options__option cds--overflow-menu-options__option--disabled my-2"
-      i18n>
-    <div class="cds--overflow-menu-options__btn">Logged in as {{ username }}
-    </div>
+<cds-overflow-menu
+  [customTrigger]="customTrigger"
+  [flip]="true"
+  description=""
+>
+  <li
+    disabled="true"
+    class="show cds--overflow-menu-options__option cds--overflow-menu-options__option--disabled my-2"
+    i18n
+  >
+    <div class="cds--overflow-menu-options__btn">Logged in as {{ username }}</div>
   </li>
   <li class="cds--overflow-menu-options__option cds--overflow-menu--divider mb-2">
-    <button *ngIf="!sso"
-            routerLink="/user-profile/edit"
-            class="cds--overflow-menu-options__btn"
-            type="button"
-            i18n>
-    <svg cdsIcon="locked"
-         class="me-2"
-         size="16"></svg>Change password
-  </button>
+    <button
+      *ngIf="!sso"
+      routerLink="/user-profile/edit"
+      class="cds--overflow-menu-options__btn"
+      type="button"
+      i18n
+    >
+      <svg
+        cdsIcon="locked"
+        class="me-2"
+        size="16"
+      ></svg
+      >Change password
+    </button>
   </li>
   <li class="cds--overflow-menu-options__option mb-2">
-    <button (click)="logout()"
-            data-testid="logout"
-            class="cds--overflow-menu-options__btn"
-            type="button"
-            i18n><svg cdsIcon="logout"
-                      class="me-2"
-                      size="16"></svg>Log out
-  </button>
+    <button
+      (click)="logout()"
+      data-testid="logout"
+      class="cds--overflow-menu-options__btn"
+      type="button"
+      i18n
+    >
+      <svg
+        cdsIcon="logout"
+        class="me-2"
+        size="16"
+      ></svg
+      >Log out
+    </button>
   </li>
 </cds-overflow-menu>
 
 <ng-template #customTrigger>
-  <svg cdsIcon="user--filled"
-       size="20"
-       title="User settings"></svg>
-  <span i18n
-        class="d-md-none">Logged in user</span>
+  <svg
+    cdsIcon="user--filled"
+    size="20"
+    title="User settings"
+  ></svg>
+  <span
+    i18n
+    class="d-md-none"
+    >Logged in user</span
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
index 80726f4fe13..ba607adba74 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/navigation/navigation.component.html
@@ -2,30 +2,41 @@
   <!-- ************************ -->
   <!-- NOTIFICATION PANEL     -->
   <!-- ************************ -->
-   @if(notificationService.panelState$ | async; as isNotifPanelOpen) {
-  <cd-notification-panel></cd-notification-panel>
-   }
+  @if (notificationService.panelState$ | async; as isNotifPanelOpen) {
+    <cd-notification-panel></cd-notification-panel>
+  }
   <!-- ************************ -->
   <!-- HEADER                   -->
   <!-- ************************ -->
-  <cds-header name="Ceph Dashboard"
-              class="cd-navbar-top"
-              [brand]="brandTemplate">
-    <cds-hamburger [active]="showMenuSidebar"
-                   data-testid="main-menu-toggler"
-                   (selected)="showMenuSidebar = !showMenuSidebar"></cds-hamburger>
+  <cds-header
+    name="Ceph Dashboard"
+    class="cd-navbar-top"
+    [brand]="brandTemplate"
+  >
+    <cds-hamburger
+      [active]="showMenuSidebar"
+      data-testid="main-menu-toggler"
+      (selected)="showMenuSidebar = !showMenuSidebar"
+    ></cds-hamburger>
     <!-- ************************* -->
     <!-- CLUSTER SWITCHER TEMPLATE -->
     <!-- ************************* -->
-    <cds-header-navigation class="cluster-switcher"
-                           *ngIf="clustersMap?.size > 1">
-      <cds-header-menu [title]="currentClusterName"
-                       data-testid="selected-cluster">
-        <ng-container *ngFor="let cluster of clustersMap | keyvalue; trackBy:trackByFn ">
-          <cds-header-item (click)="onClusterSelection(cluster.value)"
-                           [class.disabled]="cluster.value.cluster_connection_status === 1"
-                           data-testid="select-a-cluster">
-              {{ cluster.value.name }} - {{ cluster.value?.cluster_alias }} - {{ cluster.value?.user }}
+    <cds-header-navigation
+      class="cluster-switcher"
+      *ngIf="clustersMap?.size > 1"
+    >
+      <cds-header-menu
+        [title]="currentClusterName"
+        data-testid="selected-cluster"
+      >
+        <ng-container *ngFor="let cluster of clustersMap | keyvalue; trackBy: trackByFn">
+          <cds-header-item
+            (click)="onClusterSelection(cluster.value)"
+            [class.disabled]="cluster.value.cluster_connection_status === 1"
+            data-testid="select-a-cluster"
+          >
+            {{ cluster.value.name }} - {{ cluster.value?.cluster_alias }} -
+            {{ cluster.value?.user }}
           </cds-header-item>
         </ng-container>
       </cds-header-menu>
@@ -34,18 +45,22 @@
       <cds-header-navigation>
         <cd-language-selector class="d-flex"></cd-language-selector>
       </cds-header-navigation>
-      <div class="cds--btn cds--btn--icon-only cds--header__action"
-           data-testid="header-notification-icon"
-           (click)="onNotificationSelected($event)"
-           tabindex="0"
-           (keydown.enter)="onNotificationSelected($event)">
+      <div
+        class="cds--btn cds--btn--icon-only cds--header__action"
+        data-testid="header-notification-icon"
+        (click)="onNotificationSelected($event)"
+        tabindex="0"
+        (keydown.enter)="onNotificationSelected($event)"
+      >
         <cd-notifications></cd-notifications>
       </div>
       <div class="cds--btn cds--btn--icon-only cds--header__action">
         <cd-dashboard-help></cd-dashboard-help>
       </div>
-      <div class="cds--btn cds--btn--icon-only cds--header__action"
-           *ngIf="permissions.user.read">
+      <div
+        class="cds--btn cds--btn--icon-only cds--header__action"
+        *ngIf="permissions.user.read"
+      >
         <cd-administration></cd-administration>
       </div>
       <div class="cds--btn cds--btn--icon-only cds--header__action">
@@ -57,10 +72,14 @@
   <!-- LOGO BRAND TEMPLATE  -->
   <!-- ***************************** -->
   <ng-template #brandTemplate>
-    <a class="cds--header__name navbar-brand ms-3"
-       routerLink="/overview">
-      <img src="assets/Ceph_Ceph_Logo_with_text_white.svg"
-           alt="Ceph" />
+    <a
+      class="cds--header__name navbar-brand ms-3"
+      routerLink="/overview"
+    >
+      <img
+        src="assets/Ceph_Ceph_Logo_with_text_white.svg"
+        alt="Ceph"
+      />
     </a>
   </ng-template>
   <!-- **************************************** -->
@@ -68,13 +87,17 @@
   <!-- **************************************** -->
   <div class="wrapper">
     <!-- Content -->
-    <nav id="sidebar"
-         [ngClass]="{'active': !showMenuSidebar}">
+    <nav
+      id="sidebar"
+      [ngClass]="{ active: !showMenuSidebar }"
+    >
       <ng-container *ngTemplateOutlet="cd_menu"></ng-container>
     </nav>
     <!-- Page Content -->
-    <div id="content"
-         [ngClass]="{'active': !showMenuSidebar, 'content-theme': true}">
+    <div
+      id="content"
+      [ngClass]="{ active: !showMenuSidebar, 'content-theme': true }"
+    >
       <ng-content></ng-content>
     </div>
   </div>
@@ -83,197 +106,306 @@
   <!-- ************************ -->
   <ng-template #cd_menu>
     <ng-container *ngIf="enabledFeature$ | async as enabledFeature">
-      <cds-sidenav [expanded]="showMenuSidebar"
-                   class="mt-5"
-                   (click)="onMenuClick($event)"
-                   #sidenavContainer>
+      <cds-sidenav
+        [expanded]="showMenuSidebar"
+        class="mt-5"
+        (click)="onMenuClick($event)"
+        #sidenavContainer
+      >
         <!-- Overview -->
-        <cds-sidenav-item route="/overview"
-                          [useRouter]="true"
-                          title="Overview"
-                          i18n-title
-                          class="nav-item tc_menuitem_overview">
-          <svg cdsIcon="template"
-               icon
-               size="20"></svg>
-          <span i18n>
-            Overview</span>
+        <cds-sidenav-item
+          route="/overview"
+          [useRouter]="true"
+          title="Overview"
+          i18n-title
+          class="nav-item tc_menuitem_overview"
+        >
+          <svg
+            cdsIcon="template"
+            icon
+            size="20"
+          ></svg>
+          <span i18n> Overview</span>
         </cds-sidenav-item>
         <!-- Multi-cluster Dashboard -->
-        <cds-sidenav-menu title="Multi-cluster"
-                          *ngIf="permissions.configOpt.read"
-                          i18n-title>
-          <svg cdsIcon="edge-cluster"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/multi-cluster/overview"
-                            title="Overview"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_multiCluster_overview"><span i18n>Overview</span></cds-sidenav-item>
-          <cds-sidenav-item route="/multi-cluster/manage-clusters"
-                            title="Manage clusters"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_multiCluster_manage_clusters"><span i18n>Manage clusters</span></cds-sidenav-item>
+        <cds-sidenav-menu
+          title="Multi-cluster"
+          *ngIf="permissions.configOpt.read"
+          i18n-title
+        >
+          <svg
+            cdsIcon="edge-cluster"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/multi-cluster/overview"
+            title="Overview"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_multiCluster_overview"
+            ><span i18n>Overview</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/multi-cluster/manage-clusters"
+            title="Manage clusters"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_multiCluster_manage_clusters"
+            ><span i18n>Manage clusters</span></cds-sidenav-item
+          >
         </cds-sidenav-menu>
         <!-- Cluster -->
-        <cds-sidenav-menu title="Cluster"
-                          i18n-title
-                          *ngIf="permissions.hosts.read || permissions.monitor.read || permissions.osd.read || permissions.pool.read"
-                          class="tc_menuitem_cluster">
-          <svg cdsIcon="web-services--cluster"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/pool"
-                            [useRouter]="true"
-                            title="Pools"
-                            i18n-title
-                            *ngIf="permissions.pool.read"
-                            class="tc_submenuitem tc_submenuitem_cluster_pool"><span i18n>Pools</span></cds-sidenav-item>
-          <cds-sidenav-item route="/hosts"
-                            [useRouter]="true"
-                            title="Hosts"
-                            i18n-title
-                            *ngIf="permissions.hosts.read"
-                            class="tc_submenuitem tc_submenuitem_cluster_hosts"><span i18n>Hosts</span></cds-sidenav-item>
-          <cds-sidenav-item route="/osd"
-                            [useRouter]="true"
-                            title="OSDs"
-                            i18n-title
-                            *ngIf="permissions.osd.read"
-                            class="tc_submenuitem tc_submenuitem_cluster_osds"><span i18n>OSDs</span></cds-sidenav-item>
-          <cds-sidenav-item route="/inventory"
-                            [useRouter]="true"
-                            title="Physical disks"
-                            i18n-title
-                            *ngIf="permissions.hosts.read"
-                            class="tc_submenuitem tc_submenuitem_cluster_inventory"><span i18n>Physical disks</span></cds-sidenav-item>
-          <cds-sidenav-item route="/crush-map"
-                            [useRouter]="true"
-                            title="CRUSH map"
-                            i18n-title
-                            *ngIf="permissions.osd.read"
-                            class="tc_submenuitem tc_submenuitem_cluster_crush"><span i18n>CRUSH map</span></cds-sidenav-item>
-          <cds-sidenav-item route="/monitor"
-                            [useRouter]="true"
-                            title="Monitors"
-                            i18n-title
-                            *ngIf="permissions.monitor.read"
-                            class="tc_submenuitem tc_submenuitem_cluster_monitor"><span i18n>Monitors</span></cds-sidenav-item>
+        <cds-sidenav-menu
+          title="Cluster"
+          i18n-title
+          *ngIf="
+            permissions.hosts.read ||
+            permissions.monitor.read ||
+            permissions.osd.read ||
+            permissions.pool.read
+          "
+          class="tc_menuitem_cluster"
+        >
+          <svg
+            cdsIcon="web-services--cluster"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/pool"
+            [useRouter]="true"
+            title="Pools"
+            i18n-title
+            *ngIf="permissions.pool.read"
+            class="tc_submenuitem tc_submenuitem_cluster_pool"
+            ><span i18n>Pools</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/hosts"
+            [useRouter]="true"
+            title="Hosts"
+            i18n-title
+            *ngIf="permissions.hosts.read"
+            class="tc_submenuitem tc_submenuitem_cluster_hosts"
+            ><span i18n>Hosts</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/osd"
+            [useRouter]="true"
+            title="OSDs"
+            i18n-title
+            *ngIf="permissions.osd.read"
+            class="tc_submenuitem tc_submenuitem_cluster_osds"
+            ><span i18n>OSDs</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/inventory"
+            [useRouter]="true"
+            title="Physical disks"
+            i18n-title
+            *ngIf="permissions.hosts.read"
+            class="tc_submenuitem tc_submenuitem_cluster_inventory"
+            ><span i18n>Physical disks</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/crush-map"
+            [useRouter]="true"
+            title="CRUSH map"
+            i18n-title
+            *ngIf="permissions.osd.read"
+            class="tc_submenuitem tc_submenuitem_cluster_crush"
+            ><span i18n>CRUSH map</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/monitor"
+            [useRouter]="true"
+            title="Monitors"
+            i18n-title
+            *ngIf="permissions.monitor.read"
+            class="tc_submenuitem tc_submenuitem_cluster_monitor"
+            ><span i18n>Monitors</span></cds-sidenav-item
+          >
         </cds-sidenav-menu>
         <!-- Block Storage -->
-        <cds-sidenav-menu title="Block"
-                          i18n-title
-                          *ngIf="(permissions.rbdImage.read || permissions.rbdMirroring.read|| permissions.iscsi.read) && (enabledFeature.rbd || enabledFeature.mirroring || enabledFeature.iscsi)"
-                          class="tc_menuitem_block">
-          <svg cdsIcon="datastore"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/block/rbd"
-                            [useRouter]="true"
-                            title="Images"
-                            i18n-title
-                            *ngIf="permissions.rbdImage.read && enabledFeature.rbd"
-                            class="tc_submenuitem tc_submenuitem_block_images"><span i18n>Images</span></cds-sidenav-item>
-          <cds-sidenav-item route="/block/mirroring"
-                            [useRouter]="true"
-                            title="Mirroring"
-                            i18n-title
-                            *ngIf="permissions.rbdMirroring.read && enabledFeature.mirroring"
-                            class="tc_submenuitem tc_submenuitem_block_mirroring">
-            <span i18n>Mirroring
-              <cds-tag *ngIf="summaryData?.rbd_mirroring?.warnings !== 0"
-                       class="tag-warning content-theme">
+        <cds-sidenav-menu
+          title="Block"
+          i18n-title
+          *ngIf="
+            (permissions.rbdImage.read ||
+              permissions.rbdMirroring.read ||
+              permissions.iscsi.read) &&
+            (enabledFeature.rbd || enabledFeature.mirroring || enabledFeature.iscsi)
+          "
+          class="tc_menuitem_block"
+        >
+          <svg
+            cdsIcon="datastore"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/block/rbd"
+            [useRouter]="true"
+            title="Images"
+            i18n-title
+            *ngIf="permissions.rbdImage.read && enabledFeature.rbd"
+            class="tc_submenuitem tc_submenuitem_block_images"
+            ><span i18n>Images</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/block/mirroring"
+            [useRouter]="true"
+            title="Mirroring"
+            i18n-title
+            *ngIf="permissions.rbdMirroring.read && enabledFeature.mirroring"
+            class="tc_submenuitem tc_submenuitem_block_mirroring"
+          >
+            <span i18n
+              >Mirroring
+              <cds-tag
+                *ngIf="summaryData?.rbd_mirroring?.warnings !== 0"
+                class="tag-warning content-theme"
+              >
                 {{ summaryData?.rbd_mirroring?.warnings }}
               </cds-tag>
-              <cds-tag *ngIf="summaryData?.rbd_mirroring?.errors !== 0"
-                       class="tag-danger content-theme">
+              <cds-tag
+                *ngIf="summaryData?.rbd_mirroring?.errors !== 0"
+                class="tag-danger content-theme"
+              >
                 {{ summaryData?.rbd_mirroring?.errors }}
               </cds-tag>
             </span>
           </cds-sidenav-item>
-          <cds-sidenav-item route="/block/iscsi"
-                            [useRouter]="true"
-                            title="iSCSI"
-                            i18n-title
-                            *ngIf="permissions.iscsi.read && enabledFeature.iscsi"
-                            class="tc_submenuitem tc_submenuitem_block_iscsi"><span i18n>iSCSI</span></cds-sidenav-item>
-          <cds-sidenav-item route="/block/nvmeof"
-                            [useRouter]="true"
-                            title="NVMe/TCP"
-                            i18n-title
-                            class="tc_submenuitem tc_submenuitem_block_nvme"><span i18n>NVMe/TCP</span></cds-sidenav-item>
+          <cds-sidenav-item
+            route="/block/iscsi"
+            [useRouter]="true"
+            title="iSCSI"
+            i18n-title
+            *ngIf="permissions.iscsi.read && enabledFeature.iscsi"
+            class="tc_submenuitem tc_submenuitem_block_iscsi"
+            ><span i18n>iSCSI</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/block/nvmeof"
+            [useRouter]="true"
+            title="NVMe/TCP"
+            i18n-title
+            class="tc_submenuitem tc_submenuitem_block_nvme"
+            ><span i18n>NVMe/TCP</span></cds-sidenav-item
+          >
         </cds-sidenav-menu>
         <!-- Object Storage -->
-        <cds-sidenav-menu title="Object"
-                          i18n-title
-                          *ngIf="permissions.rgw.read && enabledFeature.rgw"
-                          class="nav-item tc_menuitem_rgw">
-          <svg cdsIcon="object-storage"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/rgw/overview"
-                            title="Overview"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_rgw_overview"><span i18n>Overview</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/user"
-                            title="User management"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_rgw_users"><span i18n>User management</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/bucket"
-                            title="Buckets"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_rgw_buckets"><span i18n>Buckets</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/destination"
-                            [useRouter]="true"
-                            title="Notification destination"
-                            i18n-title
-                            class="tc_submenuitem tc_submenuitem_rgw_notification"><span i18n>Notification destination</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/storage-class"
-                            title="Storage class"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_rgw_storage_class"><span i18n>Storage class</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/multisite"
-                            title="Multi-site"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_rgw_multi-site"><span i18n>Multi-site</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/daemon"
-                            title="Gateways"
-                            i18n-title
-                            [useRouter]="true"
-                            class="tc_submenuitem tc_submenuitem_rgw_daemons"><span i18n>Gateways</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/nfs"
-                            [useRouter]="true"
-                            title="NFS"
-                            i18n-title
-                            *ngIf="permissions.nfs.read && enabledFeature.nfs"
-                            class="tc_submenuitem tc_submenuitem_rgw_nfs"><span i18n>NFS</span></cds-sidenav-item>
-          <cds-sidenav-item route="/rgw/configuration"
-                            [useRouter]="true"
-                            title="Configuration"
-                            i18n-title
-                            class="tc_submenuitem tc_submenuitem_rgw_configuration"><span i18n>Configuration</span></cds-sidenav-item>
+        <cds-sidenav-menu
+          title="Object"
+          i18n-title
+          *ngIf="permissions.rgw.read && enabledFeature.rgw"
+          class="nav-item tc_menuitem_rgw"
+        >
+          <svg
+            cdsIcon="object-storage"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/rgw/overview"
+            title="Overview"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_rgw_overview"
+            ><span i18n>Overview</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/user"
+            title="User management"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_rgw_users"
+            ><span i18n>User management</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/bucket"
+            title="Buckets"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_rgw_buckets"
+            ><span i18n>Buckets</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/destination"
+            [useRouter]="true"
+            title="Notification destination"
+            i18n-title
+            class="tc_submenuitem tc_submenuitem_rgw_notification"
+            ><span i18n>Notification destination</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/storage-class"
+            title="Storage class"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_rgw_storage_class"
+            ><span i18n>Storage class</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/multisite"
+            title="Multi-site"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_rgw_multi-site"
+            ><span i18n>Multi-site</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/daemon"
+            title="Gateways"
+            i18n-title
+            [useRouter]="true"
+            class="tc_submenuitem tc_submenuitem_rgw_daemons"
+            ><span i18n>Gateways</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/nfs"
+            [useRouter]="true"
+            title="NFS"
+            i18n-title
+            *ngIf="permissions.nfs.read && enabledFeature.nfs"
+            class="tc_submenuitem tc_submenuitem_rgw_nfs"
+            ><span i18n>NFS</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/rgw/configuration"
+            [useRouter]="true"
+            title="Configuration"
+            i18n-title
+            class="tc_submenuitem tc_submenuitem_rgw_configuration"
+            ><span i18n>Configuration</span></cds-sidenav-item
+          >
         </cds-sidenav-menu>
         <!-- Filesystem -->
-        <cds-sidenav-menu title="File"
-                          i18n-title
-                          *ngIf="permissions.nfs.read && enabledFeature.nfs || permissions.cephfs.read && enabledFeature.cephfs || permissions?.smb?.read"
-                          class="tc_menuitem_file">
-          <svg cdsIcon="file-storage"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/cephfs/fs"
-                            [useRouter]="true"
-                            title="File systems"
-                            i18n-title
-                            *ngIf="permissions.cephfs.read && enabledFeature.cephfs"
-                            class="tc_submenuitem tc_submenuitem_file_cephfs"><span i18n>File systems</span></cds-sidenav-item>
+        <cds-sidenav-menu
+          title="File"
+          i18n-title
+          *ngIf="
+            (permissions.nfs.read && enabledFeature.nfs) ||
+            (permissions.cephfs.read && enabledFeature.cephfs) ||
+            permissions?.smb?.read
+          "
+          class="tc_menuitem_file"
+        >
+          <svg
+            cdsIcon="file-storage"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/cephfs/fs"
+            [useRouter]="true"
+            title="File systems"
+            i18n-title
+            *ngIf="permissions.cephfs.read && enabledFeature.cephfs"
+            class="tc_submenuitem tc_submenuitem_file_cephfs"
+            ><span i18n>File systems</span></cds-sidenav-item
+          >
           <!-- Removed for umbrella release, will be re-enabled in next release
           <cds-sidenav-item route="/cephfs/mirroring"
                             [useRouter]="true"
@@ -282,88 +414,128 @@
                             *ngIf="permissions.cephfs.read && enabledFeature.cephfs"
                             class="tc_submenuitem tc_submenuitem_file_cephfs"><span i18n>Mirroring</span></cds-sidenav-item>
           -->
-          <cds-sidenav-item route="/cephfs/nfs"
-                            [useRouter]="true"
-                            title="NFS"
-                            i18n-title
-                            *ngIf="permissions.nfs.read && enabledFeature.nfs"
-                            class="tc_submenuitem tc_submenuitem_file_nfs"><span i18n>NFS</span></cds-sidenav-item>
-          <cds-sidenav-item route="/cephfs/smb"
-                            [useRouter]="true"
-                            title="SMB"
-                            i18n-title
-                            *ngIf="permissions?.smb?.read"
-                            class="tc_submenuitem tc_submenuitem_file_smb"><span i18n>SMB</span></cds-sidenav-item>
+          <cds-sidenav-item
+            route="/cephfs/nfs"
+            [useRouter]="true"
+            title="NFS"
+            i18n-title
+            *ngIf="permissions.nfs.read && enabledFeature.nfs"
+            class="tc_submenuitem tc_submenuitem_file_nfs"
+            ><span i18n>NFS</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/cephfs/smb"
+            [useRouter]="true"
+            title="SMB"
+            i18n-title
+            *ngIf="permissions?.smb?.read"
+            class="tc_submenuitem tc_submenuitem_file_smb"
+            ><span i18n>SMB</span></cds-sidenav-item
+          >
         </cds-sidenav-menu>
         <!-- Observability -->
-        <cds-sidenav-menu title="Observability"
-                          i18n-title
-                          *ngIf="permissions.log.read || permissions.prometheus.read"
-                          class="tc_menuitem_observe">
-          <svg cdsIcon="observed--hail"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/logs"
-                            [useRouter]="true"
-                            title="Logs"
-                            i18n-title
-                            *ngIf="permissions.log.read"
-                            class="tc_submenuitem tc_submenuitem_observe_log"><span i18n>Logs</span></cds-sidenav-item>
-          <cds-sidenav-item route="/monitoring"
-                            [useRouter]="true"
-                            title="Alerts"
-                            i18n-title
-                            *ngIf="permissions.prometheus.read"
-                            class="tc_submenuitem tc_submenuitem_observe_monitoring">
+        <cds-sidenav-menu
+          title="Observability"
+          i18n-title
+          *ngIf="permissions.log.read || permissions.prometheus.read"
+          class="tc_menuitem_observe"
+        >
+          <svg
+            cdsIcon="observed--hail"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/logs"
+            [useRouter]="true"
+            title="Logs"
+            i18n-title
+            *ngIf="permissions.log.read"
+            class="tc_submenuitem tc_submenuitem_observe_log"
+            ><span i18n>Logs</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/monitoring"
+            [useRouter]="true"
+            title="Alerts"
+            i18n-title
+            *ngIf="permissions.prometheus.read"
+            class="tc_submenuitem tc_submenuitem_observe_monitoring"
+          >
             <span i18n>
               <ng-container>Alerts</ng-container>
-              <cds-tag *ngIf="prometheusAlertService.activeCriticalAlerts > 0"
-                     class="tag-danger ms-1 content-theme">{{ prometheusAlertService.activeCriticalAlerts }}</cds-tag>
-              <cds-tag *ngIf="prometheusAlertService.activeWarningAlerts > 0"
-                     class="tag-warning ms-1 content-theme">{{ prometheusAlertService.activeWarningAlerts }}</cds-tag>
+              <cds-tag
+                *ngIf="prometheusAlertService.activeCriticalAlerts > 0"
+                class="tag-danger ms-1 content-theme"
+                >{{ prometheusAlertService.activeCriticalAlerts }}</cds-tag
+              >
+              <cds-tag
+                *ngIf="prometheusAlertService.activeWarningAlerts > 0"
+                class="tag-warning ms-1 content-theme"
+                >{{ prometheusAlertService.activeWarningAlerts }}</cds-tag
+              >
             </span>
           </cds-sidenav-item>
         </cds-sidenav-menu>
         <!-- Administration -->
-        <cds-sidenav-menu title="Administration"
-                          i18n-title
-                          *ngIf="permissions.configOpt.read || permissions.hosts.read"
-                          class="tc_menuitem_admin">
-          <svg cdsIcon="network--admin-control"
-               icon
-               size="20"></svg>
-          <cds-sidenav-item route="/services/"
-                            [useRouter]="true"
-                            title="Services"
-                            i18n-title
-                            *ngIf="permissions.hosts.read"
-                            class="tc_submenuitem tc_submenuitem_admin_services"><span i18n>Services</span></cds-sidenav-item>
-          <cds-sidenav-item route="/upgrade"
-                            [useRouter]="true"
-                            title="Upgrade"
-                            i18n-title
-                            *ngIf="permissions.configOpt.read"
-                            class="tc_submenuitem tc_submenuitem_admin_upgrade"><span i18n>Upgrade</span></cds-sidenav-item>
-          <cds-sidenav-item route="/ceph-users"
-                            [useRouter]="true"
-                            title="Ceph users"
-                            i18n-title
-                            *ngIf="permissions.configOpt.read"
-                            class="tc_submenuitem tc_submenuitem_admin_users"><span i18n>Ceph users</span></cds-sidenav-item>
-          <cds-sidenav-item route="/mgr-modules"
-                            [useRouter]="true"
-                            title="Manager modules"
-                            i18n-title
-                            *ngIf="permissions.configOpt.read"
-                            class="tc_submenuitem tc_submenuitem_admin_modules"><span i18n>Manager modules</span></cds-sidenav-item>
-          <cds-sidenav-item route="/configuration"
-                            [useRouter]="true"
-                            title="Configuration"
-                            i18n-title
-                            *ngIf="permissions.configOpt.read"
-                            class="tc_submenuitem tc_submenuitem_admin_configuration"><span i18n>Configuration</span></cds-sidenav-item>
+        <cds-sidenav-menu
+          title="Administration"
+          i18n-title
+          *ngIf="permissions.configOpt.read || permissions.hosts.read"
+          class="tc_menuitem_admin"
+        >
+          <svg
+            cdsIcon="network--admin-control"
+            icon
+            size="20"
+          ></svg>
+          <cds-sidenav-item
+            route="/services/"
+            [useRouter]="true"
+            title="Services"
+            i18n-title
+            *ngIf="permissions.hosts.read"
+            class="tc_submenuitem tc_submenuitem_admin_services"
+            ><span i18n>Services</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/upgrade"
+            [useRouter]="true"
+            title="Upgrade"
+            i18n-title
+            *ngIf="permissions.configOpt.read"
+            class="tc_submenuitem tc_submenuitem_admin_upgrade"
+            ><span i18n>Upgrade</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/ceph-users"
+            [useRouter]="true"
+            title="Ceph users"
+            i18n-title
+            *ngIf="permissions.configOpt.read"
+            class="tc_submenuitem tc_submenuitem_admin_users"
+            ><span i18n>Ceph users</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/mgr-modules"
+            [useRouter]="true"
+            title="Manager modules"
+            i18n-title
+            *ngIf="permissions.configOpt.read"
+            class="tc_submenuitem tc_submenuitem_admin_modules"
+            ><span i18n>Manager modules</span></cds-sidenav-item
+          >
+          <cds-sidenav-item
+            route="/configuration"
+            [useRouter]="true"
+            title="Configuration"
+            i18n-title
+            *ngIf="permissions.configOpt.read"
+            class="tc_submenuitem tc_submenuitem_admin_configuration"
+            ><span i18n>Configuration</span></cds-sidenav-item
+          >
         </cds-sidenav-menu>
       </cds-sidenav>
     </ng-container>
   </ng-template>
-  </div>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html
index 623cae5cc2b..b0f26ee11a1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-area/notification-area.component.html
@@ -1,122 +1,138 @@
 <div
-  [ngClass]="{'empty-body': todayNotifications.length === 0 && previousNotifications.length === 0}"
-  class="notification-area">
-@if (executingTasks.length > 0) {
-<div
-  class="notification-section-heading"
-  i18n>
-  Running tasks
-</div>
-
-@for (task of executingTasks; track task.begin_time) {
-<div class="notification-wrapper">
-  <div class="notification-item task-item">
-    <cd-icon type="infoCircle"></cd-icon>
-
-    <div class="notification-content">
-      <div class="notification-title">
-        {{ task.description }}
-      </div>
-
-      <cds-progress-bar
-        [max]="100"
-        [value]="task.progress || 0"
-        status="active"
-        type="inline"
-        size="small">
-      </cds-progress-bar>
-
-      <div class="task-row">
-        <span class="notification-timestamp">
-          {{ task.begin_time | relativeDate }}
-        </span>
-
-        <span class="task-progress">
-          {{ task.progress || 0 }} %
-        </span>
-      </div>
-    </div>
-  </div>
-
-  <div class="notification-divider"></div>
-</div>
-}
-}
-
-<ng-template
-  #notificationItemTemplate
-  let-notification="notification"
-  let-last="last">
-  <div class="notification-wrapper">
-    <div class="notification-item"
-         data-testid="notification-item">
-      <cd-icon
-        id="notification-icon"
-        [type]="notificationIconMap[notification.type] || notificationIconMap['default']">
-      </cd-icon>
-
-      <div class="notification-content">
-        <div class="notification-timestamp">
-          {{ notification.timestamp | relativeDate }}
-        </div>
-        <div class="notification-title">
-          {{ notification.title }}
-        </div>
-        <div
-          class="notification-message"
-          [innerHTML]="notification.message | sanitizeHtml">
-        </div>
-      </div>
-
-      <button
-        cdsButton="ghost"
-        size="sm"
-        class="notification-close"
-        (click)="removeNotification(notification, $event)"
-        type="button">
-        <cd-icon type="destroy"></cd-icon>
-      </button>
+  [ngClass]="{
+    'empty-body': todayNotifications.length === 0 && previousNotifications.length === 0
+  }"
+  class="notification-area"
+>
+  @if (executingTasks.length > 0) {
+    <div
+      class="notification-section-heading"
+      i18n
+    >
+      Running tasks
     </div>
 
-    @if (!last) {
-    <div class="notification-divider"></div>
+    @for (task of executingTasks; track task.begin_time) {
+      <div class="notification-wrapper">
+        <div class="notification-item task-item">
+          <cd-icon type="infoCircle"></cd-icon>
+
+          <div class="notification-content">
+            <div class="notification-title">
+              {{ task.description }}
+            </div>
+
+            <cds-progress-bar
+              [max]="100"
+              [value]="task.progress || 0"
+              status="active"
+              type="inline"
+              size="small"
+            >
+            </cds-progress-bar>
+
+            <div class="task-row">
+              <span class="notification-timestamp">
+                {{ task.begin_time | relativeDate }}
+              </span>
+
+              <span class="task-progress"> {{ task.progress || 0 }} % </span>
+            </div>
+          </div>
+        </div>
+
+        <div class="notification-divider"></div>
+      </div>
     }
-  </div>
-</ng-template>
+  }
 
-@if (todayNotifications.length > 0) {
-<div
-  class="notification-section-heading"
-  i18n>
-  Today
-</div>
-
-@for (notification of todayNotifications; track notification.id; let last = $last) {
-<ng-container
-  *ngTemplateOutlet="notificationItemTemplate;
-    context: { notification: notification, last: last }">
-</ng-container>
-}
-}
-
-@if (previousNotifications.length > 0) {
-<div
-  class="notification-section-heading"
-  i18n>
-  Previous
-</div>
-
-@for (notification of previousNotifications; track notification.id; let last = $last) {
-<ng-container
-  *ngTemplateOutlet="notificationItemTemplate;
-    context: { notification: notification, last: last }">
-</ng-container>
-}
-}
-
-@if (todayNotifications.length === 0 && previousNotifications.length === 0) {
-<div class="notification-empty">
-  <div i18n>No notifications</div>
-</div>
-}
+  <ng-template
+    #notificationItemTemplate
+    let-notification="notification"
+    let-last="last"
+  >
+    <div class="notification-wrapper">
+      <div
+        class="notification-item"
+        data-testid="notification-item"
+      >
+        <cd-icon
+          id="notification-icon"
+          [type]="notificationIconMap[notification.type] || notificationIconMap['default']"
+        >
+        </cd-icon>
+
+        <div class="notification-content">
+          <div class="notification-timestamp">
+            {{ notification.timestamp | relativeDate }}
+          </div>
+          <div class="notification-title">
+            {{ notification.title }}
+          </div>
+          <div
+            class="notification-message"
+            [innerHTML]="notification.message | sanitizeHtml"
+          ></div>
+        </div>
+
+        <button
+          cdsButton="ghost"
+          size="sm"
+          class="notification-close"
+          (click)="removeNotification(notification, $event)"
+          type="button"
+        >
+          <cd-icon type="destroy"></cd-icon>
+        </button>
+      </div>
+
+      @if (!last) {
+        <div class="notification-divider"></div>
+      }
+    </div>
+  </ng-template>
+
+  @if (todayNotifications.length > 0) {
+    <div
+      class="notification-section-heading"
+      i18n
+    >
+      Today
+    </div>
+
+    @for (notification of todayNotifications; track notification.id; let last = $last) {
+      <ng-container
+        *ngTemplateOutlet="
+          notificationItemTemplate;
+          context: { notification: notification, last: last }
+        "
+      >
+      </ng-container>
+    }
+  }
+
+  @if (previousNotifications.length > 0) {
+    <div
+      class="notification-section-heading"
+      i18n
+    >
+      Previous
+    </div>
+
+    @for (notification of previousNotifications; track notification.id; let last = $last) {
+      <ng-container
+        *ngTemplateOutlet="
+          notificationItemTemplate;
+          context: { notification: notification, last: last }
+        "
+      >
+      </ng-container>
+    }
+  }
+
+  @if (todayNotifications.length === 0 && previousNotifications.length === 0) {
+    <div class="notification-empty">
+      <div i18n>No notifications</div>
+    </div>
+  }
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-footer/notification-footer.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-footer/notification-footer.component.html
index 3afd57c71bd..d7ef7a30631 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-footer/notification-footer.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-footer/notification-footer.component.html
@@ -5,5 +5,7 @@
     class="notification-footer__view-all-button"
     [routerLink]="['/notifications']"
     (click)="closePanel($event)"
-    i18n>View all</cds-button>
+    i18n
+    >View all</cds-button
+  >
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html
index a7b765d9cd2..9698aeb2991 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-header/notification-header.component.html
@@ -2,14 +2,18 @@
   <div class="notification-header__heading-and-button">
     <h1
       i18n
-      class="cds--type-heading-compact-01">Tasks and Notifications</h1>
+      class="cds--type-heading-compact-01"
+    >
+      Tasks and Notifications
+    </h1>
     <button
       class="notification-header__dismiss-btn"
       i18n
       cdsButton="ghost"
       type="button"
       size="sm"
-      (click)="onDismissAll()">
+      (click)="onDismissAll()"
+    >
       Dismiss all
     </button>
   </div>
@@ -19,6 +23,8 @@
     (checkedChange)="onToggleMute()"
     label="Mute notifications"
     i18n-label
-    hideLabel="true"> <!--hides the toggle state values (like "On/Off" in the toggle button)-->
+    hideLabel="true"
+  >
+    <!--hides the toggle state values (like "On/Off" in the toggle button)-->
   </cds-toggle>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-panel/notification-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-panel/notification-panel.component.html
index b9165ba7e2a..4b614761a3c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-panel/notification-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notification-panel/notification-panel.component.html
@@ -1,6 +1,7 @@
 <div
   class="notification-panel"
-  cdsTheme="g10">
+  cdsTheme="g10"
+>
   <cd-notification-header></cd-notification-header>
   <cd-notification-area></cd-notification-area>
   <cd-notification-footer></cd-notification-footer>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notifications-page/notifications-page.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notifications-page/notifications-page.component.html
index 92a8ea42442..d81e7dd6fd8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notifications-page/notifications-page.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notification-panel/notifications-page/notifications-page.component.html
@@ -2,37 +2,49 @@
   cdsGrid
   [useCssGrid]="false"
   [fullWidth]="true"
-  class="notifications-page__container">
+  class="notifications-page__container"
+>
   <!-- Left Panel - Notifications List -->
   <div cdsRow>
     <div
       cdsCol
-      [columnNumbers]="{sm: 4, md: 4, lg: 6}">
+      [columnNumbers]="{ sm: 4, md: 4, lg: 6 }"
+    >
       <cds-search
         [size]="'md'"
         placeholder="Search notifications..."
         i18n-placeholder
         [(ngModel)]="searchText"
-        (valueChange)="onSearch($event)">
+        (valueChange)="onSearch($event)"
+      >
       </cds-search>
       <cds-structured-list
         class="notifications-list"
-        *ngIf="filteredNotifications.length > 0">
+        *ngIf="filteredNotifications.length > 0"
+      >
         <cds-list-row
-          *ngFor="let notification of filteredNotifications; trackBy trackByNotificationId"
+          *ngFor="let notification of filteredNotifications; trackBy: trackByNotificationId"
           [class.active]="selectedNotificationID === notification.id"
           (click)="onNotificationSelect(notification)"
-          class="notification-row">
+          class="notification-row"
+        >
           <cds-list-column>
             <div class="notification-item-content">
               <h6 class="notification-title">
                 <ng-container *ngIf="notification.prometheusAlert; else regularTitle">
                   {{ notification.prometheusAlert.alertName }}
                   <cds-tag
-                    [type]="notification.prometheusAlert.status === 'active' || notification.prometheusAlert.status === 'firing'?'red':
-                            notification.prometheusAlert.status === 'resolved' ? 'green' : 'blue'"
+                    [type]="
+                      notification.prometheusAlert.status === 'active' ||
+                      notification.prometheusAlert.status === 'firing'
+                        ? 'red'
+                        : notification.prometheusAlert.status === 'resolved'
+                          ? 'green'
+                          : 'blue'
+                    "
                     [size]="'sm'"
-                    class="ml-2">
+                    class="ml-2"
+                  >
                     {{ notification.prometheusAlert.status }}
                   </cds-tag>
                 </ng-container>
@@ -59,11 +71,13 @@
       <div
         *ngIf="filteredNotifications.length === 0"
         class="empty-state"
-        cdsRow>
+        cdsRow
+      >
         <svg
           cdsIcon="notification"
           size="20"
-          class="empty-icon"></svg>
+          class="empty-icon"
+        ></svg>
         <p *ngIf="searchText">No notifications match your search</p>
         <p *ngIf="!searchText">No notifications available</p>
       </div>
@@ -71,50 +85,76 @@
     <!-- Right Panel - Notifications Details -->
     <div
       cdsCol
-      [columnNumbers]="{sm: 12, md: 12, lg: 10}">
+      [columnNumbers]="{ sm: 12, md: 12, lg: 10 }"
+    >
       <div
         cdsGrid
         [fullWidth]="true"
         *ngIf="selectedNotification"
-        class="notification-details">
-        <div cdsCol
-             [columnNumbers]="{sm: 16, md: 16, lg: 16}">
+        class="notification-details"
+      >
+        <div
+          cdsCol
+          [columnNumbers]="{ sm: 16, md: 16, lg: 16 }"
+        >
           <h3 cdsRow>{{ selectedNotification.title }}</h3>
           <cds-structured-list
             cdsRow
-            class="details-list mt-4">
+            class="details-list mt-4"
+          >
             <cds-list-row>
               <cds-list-column
                 nowrap="true"
-                class="detail-label">Application:</cds-list-column>
+                class="detail-label"
+                >Application:</cds-list-column
+              >
               <cds-list-column>{{ selectedNotification.application }}</cds-list-column>
             </cds-list-row>
             <cds-list-row>
               <cds-list-column
                 nowrap="true"
-                class="detail-label">Type:</cds-list-column>
+                class="detail-label"
+                >Type:</cds-list-column
+              >
               <cds-list-column>
                 <cds-tag
-                  [type]="selectedNotification.type === 0 ? 'red' :
-                          selectedNotification.type === 1 ? 'blue' :
-                          selectedNotification.type === 2 ? 'green' : 'yellow'"
-                  [size]="'sm'">
-                  {{ selectedNotification.type === 0 ? 'Error' :
-                    selectedNotification.type === 1 ? 'Info' :
-                    selectedNotification.type === 2 ? 'Success' : 'Warning' }}
+                  [type]="
+                    selectedNotification.type === 0
+                      ? 'red'
+                      : selectedNotification.type === 1
+                        ? 'blue'
+                        : selectedNotification.type === 2
+                          ? 'green'
+                          : 'yellow'
+                  "
+                  [size]="'sm'"
+                >
+                  {{
+                    selectedNotification.type === 0
+                      ? 'Error'
+                      : selectedNotification.type === 1
+                        ? 'Info'
+                        : selectedNotification.type === 2
+                          ? 'Success'
+                          : 'Warning'
+                  }}
                 </cds-tag>
               </cds-list-column>
             </cds-list-row>
             <cds-list-row>
               <cds-list-column
                 nowrap="true"
-                class="detail-label">Date:</cds-list-column>
+                class="detail-label"
+                >Date:</cds-list-column
+              >
               <cds-list-column>{{ formatDate(selectedNotification.timestamp) }}</cds-list-column>
             </cds-list-row>
             <cds-list-row>
               <cds-list-column
                 nowrap="true"
-                class="detail-label">Time:</cds-list-column>
+                class="detail-label"
+                >Time:</cds-list-column
+              >
               <cds-list-column>{{ formatTime(selectedNotification.timestamp) }}</cds-list-column>
             </cds-list-row>
             <!-- Prometheus-specific metadata fields -->
@@ -122,19 +162,33 @@
               <cds-list-row>
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Alert Name:</cds-list-column>
-                <cds-list-column>{{ selectedNotification.prometheusAlert.alertName }}</cds-list-column>
+                  class="detail-label"
+                  >Alert Name:</cds-list-column
+                >
+                <cds-list-column>{{
+                  selectedNotification.prometheusAlert.alertName
+                }}</cds-list-column>
               </cds-list-row>
               <cds-list-row>
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Status:</cds-list-column>
+                  class="detail-label"
+                  >Status:</cds-list-column
+                >
                 <cds-list-column>
                   <cds-tag
-                    [type]="selectedNotification.prometheusAlert.status === 'active' || selectedNotification.prometheusAlert.status === 'firing' ? 'red' :
-                            selectedNotification.prometheusAlert.status === 'resolved' ? 'green' :
-                            selectedNotification.prometheusAlert.status === 'suppressed' ? 'gray' : 'blue'"
-                    [size]="'sm'">
+                    [type]="
+                      selectedNotification.prometheusAlert.status === 'active' ||
+                      selectedNotification.prometheusAlert.status === 'firing'
+                        ? 'red'
+                        : selectedNotification.prometheusAlert.status === 'resolved'
+                          ? 'green'
+                          : selectedNotification.prometheusAlert.status === 'suppressed'
+                            ? 'gray'
+                            : 'blue'
+                    "
+                    [size]="'sm'"
+                  >
                     {{ selectedNotification.prometheusAlert.status }}
                   </cds-tag>
                 </cds-list-column>
@@ -142,13 +196,22 @@
               <cds-list-row>
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Severity:</cds-list-column>
+                  class="detail-label"
+                  >Severity:</cds-list-column
+                >
                 <cds-list-column>
                   <cds-tag
-                    [type]="selectedNotification.prometheusAlert.severity === 'critical' ? 'red' :
-                            selectedNotification.prometheusAlert.severity === 'warning' ? 'yellow' :
-                            selectedNotification.prometheusAlert.severity === 'resolved' ? 'green' : 'blue'"
-                    [size]="'sm'">
+                    [type]="
+                      selectedNotification.prometheusAlert.severity === 'critical'
+                        ? 'red'
+                        : selectedNotification.prometheusAlert.severity === 'warning'
+                          ? 'yellow'
+                          : selectedNotification.prometheusAlert.severity === 'resolved'
+                            ? 'green'
+                            : 'blue'
+                    "
+                    [size]="'sm'"
+                  >
                     {{ selectedNotification.prometheusAlert.severity }}
                   </cds-tag>
                 </cds-list-column>
@@ -156,35 +219,49 @@
               <cds-list-row *ngIf="selectedNotification.prometheusAlert.instance">
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Instance:</cds-list-column>
-                <cds-list-column>{{ selectedNotification.prometheusAlert.instance }}</cds-list-column>
+                  class="detail-label"
+                  >Instance:</cds-list-column
+                >
+                <cds-list-column>{{
+                  selectedNotification.prometheusAlert.instance
+                }}</cds-list-column>
               </cds-list-row>
               <cds-list-row *ngIf="selectedNotification.prometheusAlert.job">
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Job:</cds-list-column>
+                  class="detail-label"
+                  >Job:</cds-list-column
+                >
                 <cds-list-column>{{ selectedNotification.prometheusAlert.job }}</cds-list-column>
               </cds-list-row>
               <cds-list-row>
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Description:</cds-list-column>
+                  class="detail-label"
+                  >Description:</cds-list-column
+                >
                 <cds-list-column>
-                  <p class="message-content">{{ selectedNotification.prometheusAlert.description }}</p>
+                  <p class="message-content">
+                    {{ selectedNotification.prometheusAlert.description }}
+                  </p>
                 </cds-list-column>
               </cds-list-row>
               <cds-list-row *ngIf="selectedNotification.prometheusAlert.sourceUrl">
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Source:</cds-list-column>
+                  class="detail-label"
+                  >Source:</cds-list-column
+                >
                 <cds-list-column>
                   <a
                     [href]="selectedNotification.prometheusAlert.sourceUrl"
                     target="_blank"
-                    class="source-link">
+                    class="source-link"
+                  >
                     <svg
                       cdsIcon="launch"
-                      size="16"></svg>
+                      size="16"
+                    ></svg>
                     View in Prometheus
                   </a>
                 </cds-list-column>
@@ -192,19 +269,26 @@
               <cds-list-row *ngIf="selectedNotification.prometheusAlert.fingerprint">
                 <cds-list-column
                   nowrap="true"
-                  class="detail-label">Fingerprint:</cds-list-column>
+                  class="detail-label"
+                  >Fingerprint:</cds-list-column
+                >
                 <cds-list-column>
-                  <code class="fingerprint">{{ selectedNotification.prometheusAlert.fingerprint }}</code>
+                  <code class="fingerprint">{{
+                    selectedNotification.prometheusAlert.fingerprint
+                  }}</code>
                 </cds-list-column>
               </cds-list-row>
             </ng-container>
             <!-- Regular message for non-Prometheus notifications -->
             <cds-list-row
               cdsRow
-              *ngIf="selectedNotification.message && !selectedNotification.prometheusAlert">
+              *ngIf="selectedNotification.message && !selectedNotification.prometheusAlert"
+            >
               <cds-list-column
                 nowrap="true"
-                class="detail-label">Message:</cds-list-column>
+                class="detail-label"
+                >Message:</cds-list-column
+              >
               <cds-list-column>
                 <p class="message-content">{{ selectedNotification.message }}</p>
               </cds-list-column>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notifications/notifications.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notifications/notifications.component.html
index ea5dcc95386..ee41505a363 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notifications/notifications.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/notifications/notifications.component.html
@@ -1,15 +1,19 @@
-@if(isMuted) {
-<cd-icon type="notificationOff"
-         [size]="iconSize">
-</cd-icon>
-}
-@else if(!isMuted && ( hasRunningTasks || hasNotifications)) {
-<cd-icon type="notificationNew"
-         [size]="iconSize">
-</cd-icon>
-}
-@else {
-<cd-icon type="notification"
-         [size]="iconSize">
-</cd-icon>
+@if (isMuted) {
+  <cd-icon
+    type="notificationOff"
+    [size]="iconSize"
+  >
+  </cd-icon>
+} @else if (!isMuted && (hasRunningTasks || hasNotifications)) {
+  <cd-icon
+    type="notificationNew"
+    [size]="iconSize"
+  >
+  </cd-icon>
+} @else {
+  <cd-icon
+    type="notification"
+    [size]="iconSize"
+  >
+  </cd-icon>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html
index 1ce838ceeda..bbc1790da0c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/alert-panel/alert-panel.component.html
@@ -1,20 +1,25 @@
-<cds-actionable-notification class="mb-1 content-theme"
-                             [ngClass]="spacingClass"
-                             [notificationObj]="notificationContent"
-                             (close)="onClose()"></cds-actionable-notification>
+<cds-actionable-notification
+  class="mb-1 content-theme"
+  [ngClass]="spacingClass"
+  [notificationObj]="notificationContent"
+  (close)="onClose()"
+></cds-actionable-notification>
 
 <ng-template #content>
   <ng-content></ng-content>
 </ng-template>
 
 <ng-template #actionTpl>
-  <button cdsActionableButton
-          cdsButton="ghost"
-          size="md"
-          [title]="actionName"
-          (click)="onAction()"
-          *ngIf="actionName"
-          type="button"
-          i18n>{{ actionName }}
+  <button
+    cdsActionableButton
+    cdsButton="ghost"
+    size="md"
+    [title]="actionName"
+    (click)="onAction()"
+    *ngIf="actionName"
+    type="button"
+    i18n
+  >
+    {{ actionName }}
   </button>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/area-chart/area-chart.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/area-chart/area-chart.component.html
index 248f6a19e8d..290255c689e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/area-chart/area-chart.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/area-chart/area-chart.component.html
@@ -1,25 +1,27 @@
-@if(chartData && chartOptions){
-<div class="chart-container">
-  <div class="chart-header">
-    <div class="cds--type-heading-compact-02">
-      {{ chartTitle }}
-    </div>
-    @if(subHeading) {
-    <div class="cds--type-body-compact-01 chart-subheading cds-mb-3">
-      {{ subHeading }}
+@if (chartData && chartOptions) {
+  <div class="chart-container">
+    <div class="chart-header">
+      <div class="cds--type-heading-compact-02">
+        {{ chartTitle }}
+      </div>
+      @if (subHeading) {
+        <div class="cds--type-body-compact-01 chart-subheading cds-mb-3">
+          {{ subHeading }}
+        </div>
+      }
     </div>
+    @if (chartType === 'area') {
+      <ibm-area-chart
+        [data]="chartData"
+        [options]="chartOptions"
+      >
+      </ibm-area-chart>
+    } @else {
+      <ibm-line-chart
+        [data]="chartData"
+        [options]="chartOptions"
+      >
+      </ibm-line-chart>
     }
   </div>
-  @if(chartType === 'area') {
-  <ibm-area-chart
-    [data]="chartData"
-    [options]="chartOptions">
-  </ibm-area-chart>
-  } @else {
-  <ibm-line-chart
-    [data]="chartData"
-    [options]="chartOptions">
-  </ibm-line-chart>
-  }
-</div>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/back-button/back-button.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/back-button/back-button.component.html
index 7eb83751f95..24a5e7c6ab8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/back-button/back-button.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/back-button/back-button.component.html
@@ -1,10 +1,12 @@
-<button class="w-100 tc_backButton"
-        [ngClass]="{'w-100': modalForm && showSubmit, 'w-50 float-end': modalForm && !showSubmit}"
-        aria-label="Back"
-        (click)="back()"
-        [disabled]="disabled"
-        type="button"
-        size="lg"
-        cdsButton="secondary">
+<button
+  class="w-100 tc_backButton"
+  [ngClass]="{ 'w-100': modalForm && showSubmit, 'w-50 float-end': modalForm && !showSubmit }"
+  aria-label="Back"
+  (click)="back()"
+  [disabled]="disabled"
+  type="button"
+  size="lg"
+  cdsButton="secondary"
+>
   {{ name }}
 </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-group/card-group.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-group/card-group.component.html
index df4ffa89a99..3b5d225e310 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-group/card-group.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-group/card-group.component.html
@@ -1,8 +1,13 @@
-<div class="row"
-     *ngIf="groupTitle">
+<div
+  class="row"
+  *ngIf="groupTitle"
+>
   <div class="info-group-title">
-    <span i18n
-          data-testid="group-title">{{ groupTitle }}</span>
+    <span
+      i18n
+      data-testid="group-title"
+      >{{ groupTitle }}</span
+    >
   </div>
 </div>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html
index e4976d6f61e..e57aa48b3e2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card-row/card-row.component.html
@@ -1,23 +1,27 @@
-<hr>
+<hr />
 <li class="list-group-item">
   <div class="d-flex pl-1 pb-2 pt-2 position-relative">
     <div class="ms-4 me-auto">
-    @if (link && data !== null || total) {
-    <a [routerLink]="link"
-       *ngIf="link && total > 0; else noLinkTitle"
-       [ngPlural]="total"
-       data-testid="title"
-      i18n>
-        {{ total }}
-      <ng-template ngPluralCase="=0">{{ title }}</ng-template>
-      <ng-template ngPluralCase="=1">{{ title }}</ng-template>
-      <ng-template ngPluralCase="other">{{ title }}s</ng-template>
-    </a>
-    } @else {
-      <a [routerLink]="link"
-         *ngIf="link; else noLinkTitle">{{title}}
-      </a>
-    }
+      @if ((link && data !== null) || total) {
+        <a
+          [routerLink]="link"
+          *ngIf="link && total > 0; else noLinkTitle"
+          [ngPlural]="total"
+          data-testid="title"
+          i18n
+        >
+          {{ total }}
+          <ng-template ngPluralCase="=0">{{ title }}</ng-template>
+          <ng-template ngPluralCase="=1">{{ title }}</ng-template>
+          <ng-template ngPluralCase="other">{{ title }}s</ng-template>
+        </a>
+      } @else {
+        <a
+          [routerLink]="link"
+          *ngIf="link; else noLinkTitle"
+          >{{ title }}
+        </a>
+      }
     </div>
     <span class="me-4">
       <ng-container [ngSwitch]="summaryType">
@@ -35,177 +39,186 @@
         </ng-container>
       </ng-container>
     </span>
-    <span *ngIf="dropdownData && dropdownData.total.total.total > 0"
-          class="position-absolute end-0 me-2">
-      <button type="button"
-          (click)="toggleDropdown()"
-          class="dropdown-toggle border-0 bg-transparent p-0"
-          [attr.aria-expanded]="dropdownToggled"
-          aria-controls="row-dropdown">
-        <span class="visually-hidden" i18n>Toggle dropdown</span>
+    <span
+      *ngIf="dropdownData && dropdownData.total.total.total > 0"
+      class="position-absolute end-0 me-2"
+    >
+      <button
+        type="button"
+        (click)="toggleDropdown()"
+        class="dropdown-toggle border-0 bg-transparent p-0"
+        [attr.aria-expanded]="dropdownToggled"
+        aria-controls="row-dropdown"
+      >
+        <span
+          class="visually-hidden"
+          i18n
+          >Toggle dropdown</span
+        >
       </button>
     </span>
   </div>
 </li>
 
 <div *ngIf="dropdownToggled">
-  <hr>
+  <hr />
   <ng-container *ngTemplateOutlet="dropdownTemplate"></ng-container>
 </div>
 
 <ng-template #defaultSummary>
   @if (data === null) {
-  <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
+    <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
   } @else {
-    <span *ngIf="data.success || data.categoryPgAmount?.clean || (data.success === 0 && data.total === 0)">
-    <span *ngIf="data.success || (data.success === 0 && data.total === 0)">
-      {{ data.success }}
+    <span
+      *ngIf="
+        data.success || data.categoryPgAmount?.clean || (data.success === 0 && data.total === 0)
+      "
+    >
+      <span *ngIf="data.success || (data.success === 0 && data.total === 0)">
+        {{ data.success }}
+      </span>
+      <span *ngIf="data.categoryPgAmount?.clean">
+        {{ data.categoryPgAmount?.clean }}
+      </span>
+      <cd-icon type="success"> </cd-icon>
     </span>
-    <span *ngIf="data.categoryPgAmount?.clean">
-      {{ data.categoryPgAmount?.clean }}
+    <span
+      *ngIf="data.info"
+      class="ms-2"
+    >
+      <span *ngIf="data.info">
+        {{ data.info }}
+      </span>
+      <cd-icon type="infoCircle"> </cd-icon>
     </span>
-    <cd-icon
-       type="success">
-    </cd-icon >
-  </span>
-  <span *ngIf="data.info"
-        class="ms-2">
-    <span *ngIf="data.info">
-      {{ data.info }}
+    <span
+      *ngIf="data.warn || data.categoryPgAmount?.warning"
+      class="ms-2"
+    >
+      <span *ngIf="data.warn">
+        {{ data.warn }}
+      </span>
+      <span *ngIf="data.categoryPgAmount?.warning">
+        {{ data.categoryPgAmount?.warning }}
+      </span>
+      <cd-icon type="warning"> </cd-icon>
     </span>
-    <cd-icon
-       type="infoCircle">
-    </cd-icon >
-  </span>
-  <span *ngIf="data.warn || data.categoryPgAmount?.warning"
-        class="ms-2">
-    <span *ngIf="data.warn">
-      {{ data.warn }}
+    <span
+      *ngIf="data.error || data.categoryPgAmount?.unknown"
+      class="ms-2"
+    >
+      <span *ngIf="data.error">
+        {{ data.error }}
+      </span>
+      <span *ngIf="data.categoryPgAmount?.unknown">
+        {{ data.categoryPgAmount?.unknown }}
+      </span>
+      <cd-icon type="danger"> </cd-icon>
     </span>
-    <span *ngIf="data.categoryPgAmount?.warning">
-      {{ data.categoryPgAmount?.warning }}
+    <span
+      *ngIf="data.categoryPgAmount?.working"
+      class="ms-2"
+    >
+      <span *ngIf="data.categoryPgAmount?.working">
+        {{ data.categoryPgAmount?.working }}
+      </span>
+      <cds-inline-loading
+        class="text-warning"
+        state="active"
+      ></cds-inline-loading>
     </span>
-    <cd-icon
-       type="warning">
-    </cd-icon >
-  </span>
-  <span *ngIf="data.error || data.categoryPgAmount?.unknown"
-        class="ms-2">
-    <span *ngIf="data.error">
-      {{ data.error }}
-    </span>
-    <span *ngIf="data.categoryPgAmount?.unknown">
-      {{ data.categoryPgAmount?.unknown }}
-    </span>
-    <cd-icon
-       type="danger">
-    </cd-icon >
-  </span>
-  <span *ngIf="data.categoryPgAmount?.working"
-        class="ms-2">
-    <span *ngIf="data.categoryPgAmount?.working">
-      {{ data.categoryPgAmount?.working }}
-    </span>
-    <cds-inline-loading class="text-warning"
-                        state="active"></cds-inline-loading>
-  </span>
   }
 </ng-template>
 
 <ng-template #osdSummary>
   @if (data === null) {
-  <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
+    <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
   } @else {
-  <span *ngIf="data.up === data.in">
-    {{ data.up }}
-    <cd-icon
-       type="success">
-    </cd-icon >
-  </span>
-  <span *ngIf="data.up !== data.in">
-    {{ data.up }}
-    <span class="fw-bold text-success">
-        up
+    <span *ngIf="data.up === data.in">
+      {{ data.up }}
+      <cd-icon type="success"> </cd-icon>
     </span>
-  </span>
-  <span *ngIf="data.in !== data.up"
-        class="ms-2">
-    {{ data.in }}
-    <span class="fw-bold text-success">
-        in
+    <span *ngIf="data.up !== data.in">
+      {{ data.up }}
+      <span class="fw-bold text-success"> up </span>
     </span>
-  </span>
-  <span *ngIf="data.down"
-        class="ms-2">
-    {{ data.down }}
-    <span class="fw-bold text-danger me-2">
-        down
+    <span
+      *ngIf="data.in !== data.up"
+      class="ms-2"
+    >
+      {{ data.in }}
+      <span class="fw-bold text-success"> in </span>
     </span>
-  </span>
-  <span *ngIf="data.out"
-        class="ms-2">
-    {{ data.out }}
-    <span class="fw-bold text-danger me-2">
-        out
+    <span
+      *ngIf="data.down"
+      class="ms-2"
+    >
+      {{ data.down }}
+      <span class="fw-bold text-danger me-2"> down </span>
     </span>
-  </span>
-  <span *ngIf="data.nearfull"
-        class="ms-2">
-        {{ data.nearfull }}
-    <span class="fw-bold text-warning me-2">
-      nearfull</span></span>
-  <span *ngIf="data.full"
-        class="ms-2">
-        {{ data.full }}
-    <span class="fw-bold text-danger">
-      full
+    <span
+      *ngIf="data.out"
+      class="ms-2"
+    >
+      {{ data.out }}
+      <span class="fw-bold text-danger me-2"> out </span>
+    </span>
+    <span
+      *ngIf="data.nearfull"
+      class="ms-2"
+    >
+      {{ data.nearfull }}
+      <span class="fw-bold text-warning me-2"> nearfull</span></span
+    >
+    <span
+      *ngIf="data.full"
+      class="ms-2"
+    >
+      {{ data.full }}
+      <span class="fw-bold text-danger"> full </span>
     </span>
-  </span>
   }
 </ng-template>
 
 <ng-template #iscsiSummary>
   @if (data === null || total === null) {
-  <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
+    <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
   } @else {
-  <span>
-    {{ data?.up }}
-    <cd-icon
-       *ngIf="data?.up || data?.up === 0"
-       type="success">
-    </cd-icon >
-  </span>
-  <span *ngIf="data?.down"
-        class="ms-2">
-        {{ data?.down }}
-    <cd-icon
-       type="danger">
-    </cd-icon >
-  </span>
-
+    <span>
+      {{ data?.up }}
+      <cd-icon
+        *ngIf="data?.up || data?.up === 0"
+        type="success"
+      >
+      </cd-icon>
+    </span>
+    <span
+      *ngIf="data?.down"
+      class="ms-2"
+    >
+      {{ data?.down }}
+      <cd-icon type="danger"> </cd-icon>
+    </span>
   }
 </ng-template>
 
 <ng-template #simplifiedSummary>
   @if (data === 0 || data) {
-  <span *ngIf="!dropdownTotalError else showErrorNum">
-    {{ data }}
-    <cd-icon
-      type="success"></cd-icon >
-  </span>
+    <span *ngIf="!dropdownTotalError; else showErrorNum">
+      {{ data }}
+      <cd-icon type="success"></cd-icon>
+    </span>
   } @else {
     <ng-container *ngTemplateOutlet="loadingTpl"></ng-container>
   }
   <ng-template #showErrorNum>
-    <span *ngIf="data - dropdownTotalError  > 0">
-      {{ data - dropdownTotalError  }}
-    <cd-icon
-      type="success"></cd-icon >
+    <span *ngIf="data - dropdownTotalError > 0">
+      {{ data - dropdownTotalError }}
+      <cd-icon type="success"></cd-icon>
     </span>
     <span>
-      {{ dropdownTotalError  }}
-      <cd-icon
-        type="danger"></cd-icon >
+      {{ dropdownTotalError }}
+      <cd-icon type="danger"></cd-icon>
     </span>
   </ng-template>
 </ng-template>
@@ -215,17 +228,19 @@
 </ng-template>
 
 <ng-template #noLinkTitle>
-@if (data !== null || total) {
-<span *ngIf="total || total === 0"
-      [ngPlural]="total">
-  {{ total }}
-  <ng-template ngPluralCase="=0">{{ title }}</ng-template>
-  <ng-template ngPluralCase="=1">{{ title }}</ng-template>
-  <ng-template ngPluralCase="other">{{ title }}s</ng-template>
-</span>
-} @else {
-  <span>{{ title }}</span>
-}
+  @if (data !== null || total) {
+    <span
+      *ngIf="total || total === 0"
+      [ngPlural]="total"
+    >
+      {{ total }}
+      <ng-template ngPluralCase="=0">{{ title }}</ng-template>
+      <ng-template ngPluralCase="=1">{{ title }}</ng-template>
+      <ng-template ngPluralCase="other">{{ title }}s</ng-template>
+    </span>
+  } @else {
+    <span>{{ title }}</span>
+  }
 </ng-template>
 
 <ng-template #dropdownTemplate>
@@ -233,10 +248,12 @@
     <li class="list-group-item">
       <div class="d-flex pb-2 pt-2">
         <div class="ms-5 me-auto">
-          <span *ngIf="data.value.total"
-                [ngPlural]="data.value.total"
-                i18n>
-              {{ data.value.total }}
+          <span
+            *ngIf="data.value.total"
+            [ngPlural]="data.value.total"
+            i18n
+          >
+            {{ data.value.total }}
             <ng-template ngPluralCase="=0">{{ hwNames[data.key] }}</ng-template>
             <ng-template ngPluralCase="=1">{{ hwNames[data.key] }}</ng-template>
             <ng-template ngPluralCase="other">{{ hwNames[data.key] | pluralize }}</ng-template>
@@ -245,16 +262,17 @@
         <span [ngClass]="data.value.error ? 'me-2' : 'me-4'">
           {{ data.value.ok }}
           <cd-icon
-             *ngIf="data.value.ok"
-             type="success">
-          </cd-icon >
+            *ngIf="data.value.ok"
+            type="success"
+          >
+          </cd-icon>
         </span>
-        <span *ngIf="data.value.error"
-              class="me-4 ms-2">
-              {{ data.value.error }}
-          <cd-icon
-             type="danger">
-          </cd-icon >
+        <span
+          *ngIf="data.value.error"
+          class="me-4 ms-2"
+        >
+          {{ data.value.error }}
+          <cd-icon type="danger"> </cd-icon>
         </span>
       </div>
     </li>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card/card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card/card.component.html
index deb4bc366f9..94c5145bd99 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card/card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/card/card.component.html
@@ -1,26 +1,48 @@
-<div class="card flex-fill"
-     [ngClass]="{'border-0': removeBorder, 'bg-color': cardType === 'Sync Status Card', 'shadow': shadow, 'shadow-sm': !shadow && cardType !== 'syncCards', 'h-100': fullHeight}">
-  <h4 class="card-title mt-4 ms-4 mb-0"
-      *ngIf="cardType !== 'zone'">
+<div
+  class="card flex-fill"
+  [ngClass]="{
+    'border-0': removeBorder,
+    'bg-color': cardType === 'Sync Status Card',
+    shadow: shadow,
+    'shadow-sm': !shadow && cardType !== 'syncCards',
+    'h-100': fullHeight
+  }"
+>
+  <h4
+    class="card-title mt-4 ms-4 mb-0"
+    *ngIf="cardType !== 'zone'"
+  >
     <span *ngIf="cardType === ''">{{ cardTitle }}</span>
   </h4>
-  <h4 *ngIf="cardType === 'zone'"
-      class="text-center mt-4 mb-0">
-    <svg [cdsIcon]="icons.deploy"
-         [size]="icons.size20"
-         ></svg>
+  <h4
+    *ngIf="cardType === 'zone'"
+    class="text-center mt-4 mb-0"
+  >
+    <svg
+      [cdsIcon]="icons.deploy"
+      [size]="icons.size20"
+    ></svg>
     <cds-tag class="tag-info">{{ cardTitle }}</cds-tag>
   </h4>
-  <h5 *ngIf="cardType === 'syncCards'"
-      class="text-center card-title">
-      {{ cardTitle }}
+  <h5
+    *ngIf="cardType === 'syncCards'"
+    class="text-center card-title"
+  >
+    {{ cardTitle }}
   </h5>
-  <div class="card-body ps-0 pe-0"
-       [ngClass]="{'d-flex align-items-center': alignItemsCenter, 'justify-content-center': justifyContentCenter}">
+  <div
+    class="card-body ps-0 pe-0"
+    [ngClass]="{
+      'd-flex align-items-center': alignItemsCenter,
+      'justify-content-center': justifyContentCenter
+    }"
+  >
     <ng-content></ng-content>
   </div>
-  <div class="card-footer p-0 bg-white"
-       *ngIf="cardFooter">
+  <div
+    class="card-footer p-0 bg-white"
+    *ngIf="cardFooter"
+  >
     <ng-content select=".footer"></ng-content>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/cd-label/cd-label.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/cd-label/cd-label.component.html
index 72819d55298..1d9fe1890e1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/cd-label/cd-label.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/cd-label/cd-label.component.html
@@ -1,12 +1,14 @@
-<cds-tag *ngIf="!key; else key_value"
-         class="tags-{{value}}"
-         ngClass="{{value | colorClassFromText}}"
-         [ngbTooltip]="tooltipText">
+<cds-tag
+  *ngIf="!key; else key_value"
+  class="tags-{{ value }}"
+  ngClass="{{ value | colorClassFromText }}"
+  [ngbTooltip]="tooltipText"
+>
   {{ value }}
 </cds-tag>
 
 <ng-template #key_value>
-  <cds-tag class="tag-background-primary badge-{{key}}-{{value}}">
-        {{ key }}: {{ value }}
+  <cds-tag class="tag-background-primary badge-{{ key }}-{{ value }}">
+    {{ key }}: {{ value }}
   </cds-tag>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/code-block/code-block.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/code-block/code-block.component.html
index 47eac6364e4..9e14043f37c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/code-block/code-block.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/code-block/code-block.component.html
@@ -11,8 +11,10 @@
 </ng-container>
 
 <ng-template #singleCodeBlock>
-  <pre class="d-flex px-2 py-3 align-items-center justify-content-between text-dark"
-       id="singleCodeBlock">
+  <pre
+    class="d-flex px-2 py-3 align-items-center justify-content-between text-dark"
+    id="singleCodeBlock"
+  >
     <span [ngClass]="{'text-wrap': textWrap}">{{codes}}</span>
     <cd-copy-2-clipboard-button
       [source]="codes"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.html
index 9c88b5b7135..df121c8970b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.html
@@ -1,75 +1,105 @@
 <div [formGroup]="optionsFormGroup">
   <div *ngFor="let option of options; let last = last">
-    <div class="form-group row pt-2"
-         *ngIf="option.type === 'bool'">
-      <label class="cd-col-form-label"
-             [for]="option.name">
+    <div
+      class="form-group row pt-2"
+      *ngIf="option.type === 'bool'"
+    >
+      <label
+        class="cd-col-form-label"
+        [for]="option.name"
+      >
         <b>{{ option.text }}</b>
-        <br>
+        <br />
         <span class="text-muted">
           {{ option.desc }}
-          <cd-helper *ngIf="option.long_desc">
-            {{ option.long_desc }}</cd-helper>
+          <cd-helper *ngIf="option.long_desc"> {{ option.long_desc }}</cd-helper>
         </span>
       </label>
 
       <div class="cd-col-form-input">
         <div class="custom-control custom-checkbox">
-          <input class="custom-control-input"
-                 type="checkbox"
-                 [id]="option.name"
-                 [formControlName]="option.name">
-          <label class="custom-control-label"
-                 [for]="option.name"></label>
+          <input
+            class="custom-control-input"
+            type="checkbox"
+            [id]="option.name"
+            [formControlName]="option.name"
+          />
+          <label
+            class="custom-control-label"
+            [for]="option.name"
+          ></label>
         </div>
       </div>
     </div>
 
-    <div class="form-group row pt-2"
-         *ngIf="option.type !== 'bool'">
-      <label class="cd-col-form-label"
-             [for]="option.name">{{ option.text }}
-        <br>
+    <div
+      class="form-group row pt-2"
+      *ngIf="option.type !== 'bool'"
+    >
+      <label
+        class="cd-col-form-label"
+        [for]="option.name"
+        >{{ option.text }}
+        <br />
         <span class="text-muted">
           {{ option.desc }}
-          <cd-helper *ngIf="option.long_desc">
-            {{ option.long_desc }}</cd-helper>
+          <cd-helper *ngIf="option.long_desc"> {{ option.long_desc }}</cd-helper>
         </span>
       </label>
       <div class="cd-col-form-input">
         <div class="input-group">
-          <input class="form-control"
-                 [type]="option.additionalTypeInfo.inputType"
-                 [id]="option.name"
-                 [placeholder]="option.additionalTypeInfo.humanReadable"
-                 [formControlName]="option.name"
-                 [step]="getStep(option.type, optionsForm.getValue(option.name))">
-          <button class="btn btn-light"
-                  type="button"
-                  data-toggle="button"
-                  title="Remove the custom configuration value. The default configuration will be inherited and used instead."
-                  (click)="resetValue(option.name)"
-                  i18n-title
-                  *ngIf="optionsFormShowReset">
-            <i [ngClass]="[icons.erase]"
-               aria-hidden="true"></i>
+          <input
+            class="form-control"
+            [type]="option.additionalTypeInfo.inputType"
+            [id]="option.name"
+            [placeholder]="option.additionalTypeInfo.humanReadable"
+            [formControlName]="option.name"
+            [step]="getStep(option.type, optionsForm.getValue(option.name))"
+          />
+          <button
+            class="btn btn-light"
+            type="button"
+            data-toggle="button"
+            title="Remove the custom configuration value. The default configuration will be inherited and used instead."
+            (click)="resetValue(option.name)"
+            i18n-title
+            *ngIf="optionsFormShowReset"
+          >
+            <i
+              [ngClass]="[icons.erase]"
+              aria-hidden="true"
+            ></i>
           </button>
         </div>
-        <span class="invalid-feedback"
-              *ngIf="optionsForm.showError(option.name, optionsFormDir, 'pattern')">
-          {{ option.additionalTypeInfo.patternHelpText }}</span>
-        <span class="invalid-feedback"
-              *ngIf="optionsForm.showError(option.name, optionsFormDir, 'invalidUuid')">
-          {{ option.additionalTypeInfo.patternHelpText }}</span>
-        <span class="invalid-feedback"
-              *ngIf="optionsForm.showError(option.name, optionsFormDir, 'max')"
-              i18n>The entered value is too high! It must not be greater than {{ option.maxValue }}.</span>
-        <span class="invalid-feedback"
-              *ngIf="optionsForm.showError(option.name, optionsFormDir, 'min')"
-              i18n>The entered value is too low! It must not be lower than {{ option.minValue }}.</span>
+        <span
+          class="invalid-feedback"
+          *ngIf="optionsForm.showError(option.name, optionsFormDir, 'pattern')"
+        >
+          {{ option.additionalTypeInfo.patternHelpText }}</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="optionsForm.showError(option.name, optionsFormDir, 'invalidUuid')"
+        >
+          {{ option.additionalTypeInfo.patternHelpText }}</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="optionsForm.showError(option.name, optionsFormDir, 'max')"
+          i18n
+          >The entered value is too high! It must not be greater than {{ option.maxValue }}.</span
+        >
+        <span
+          class="invalid-feedback"
+          *ngIf="optionsForm.showError(option.name, optionsFormDir, 'min')"
+          i18n
+          >The entered value is too low! It must not be lower than {{ option.minValue }}.</span
+        >
       </div>
     </div>
-    <hr *ngIf="!last"
-        class="my-2">
+    <hr
+      *ngIf="!last"
+      class="my-2"
+    />
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/confirmation-modal/confirmation-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/confirmation-modal/confirmation-modal.component.html
index 423d92838bb..e4e82fa3df8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/confirmation-modal/confirmation-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/confirmation-modal/confirmation-modal.component.html
@@ -1,29 +1,38 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        i18n>{{ titleText }}</h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ titleText }}
+    </h3>
   </cds-modal-header>
   <section cdsModalContent>
-    <form name="confirmationForm"
-          #formDir="ngForm"
-          [formGroup]="confirmationForm"
-          novalidate>
+    <form
+      name="confirmationForm"
+      #formDir="ngForm"
+      [formGroup]="confirmationForm"
+      novalidate
+    >
       <ng-container *ngTemplateOutlet="bodyTpl; context: bodyContext"></ng-container>
       <p *ngIf="description">
-        {{description}}
+        {{ description }}
       </p>
     </form>
   </section>
 
-  <cd-form-button-panel (submitActionEvent)="onSubmit(confirmationForm.value)"
-                        [form]="confirmationForm"
-                        [submitText]="buttonText"
-                        [cancelText]="cancelText"
-                        [showCancel]="showCancel"
-                        [showSubmit]="showSubmit"
-                        [submitBtnType]="submitBtnType"
-                        [modalForm]="true"></cd-form-button-panel>
-
+  <cd-form-button-panel
+    (submitActionEvent)="onSubmit(confirmationForm.value)"
+    [form]="confirmationForm"
+    [submitText]="buttonText"
+    [cancelText]="cancelText"
+    [showCancel]="showCancel"
+    [showSubmit]="showSubmit"
+    [submitBtnType]="submitBtnType"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html
index 0bf81d9bf4c..c0e965360f8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/copy2clipboard-button/copy2clipboard-button.component.html
@@ -1,16 +1,20 @@
-
-<button cdsButton="ghost"
-        class="clipboard-btn"
-        [ngClass]="{'clipboard-btn-with-text': text}"
-        [size]="size"
-        description="Copy to Clipboard"
-        i18n-description
-        type="button"
-        (click)="onClick()">
-  @if(text) {
-  <span data-toggle="tooltip"
-        [title]="text"
-        class="cds--type-mono">{{text}}</span>
+<button
+  cdsButton="ghost"
+  class="clipboard-btn"
+  [ngClass]="{ 'clipboard-btn-with-text': text }"
+  [size]="size"
+  description="Copy to Clipboard"
+  i18n-description
+  type="button"
+  (click)="onClick()"
+>
+  @if (text) {
+    <span
+      data-toggle="tooltip"
+      [title]="text"
+      class="cds--type-mono"
+      >{{ text }}</span
+    >
   }
   <cd-icon type="copy"></cd-icon>
 </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/custom-login-banner/custom-login-banner.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/custom-login-banner/custom-login-banner.component.html
index 7bb087c3f07..1cb0ececd2f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/custom-login-banner/custom-login-banner.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/custom-login-banner/custom-login-banner.component.html
@@ -1,2 +1,6 @@
-<p class="login-text"
-   *ngIf="bannerText$ | async as bannerText">{{ bannerText }}</p>
+<p
+  class="login-text"
+  *ngIf="bannerText$ | async as bannerText"
+>
+  {{ bannerText }}
+</p>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/date-time-picker/date-time-picker.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/date-time-picker/date-time-picker.component.html
index ccdb70e39e4..44455e4322e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/date-time-picker/date-time-picker.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/date-time-picker/date-time-picker.component.html
@@ -1,31 +1,45 @@
 <div cdsCol>
-  <div cdsRow
-       class="form-item-append">
-    <cds-text-label>{{name}}
-      <cds-date-picker  i18n-label
-                        [placeholder]="placeHolder"
-                        formControlname="expiresAt"
-                        dateFormat="Y/m/d"
-                        [value]="date"
-                        (valueChange)="onModelChange($event)"
-                        [helperText]="helperText"
-                        [disabled]="disabled"
-                        cdsTheme="theme"></cds-date-picker>
+  <div
+    cdsRow
+    class="form-item-append"
+  >
+    <cds-text-label
+      >{{ name }}
+      <cds-date-picker
+        i18n-label
+        [placeholder]="placeHolder"
+        formControlname="expiresAt"
+        dateFormat="Y/m/d"
+        [value]="date"
+        (valueChange)="onModelChange($event)"
+        [helperText]="helperText"
+        [disabled]="disabled"
+        cdsTheme="theme"
+      ></cds-date-picker>
     </cds-text-label>
-  <cds-text-label *ngIf="hasTime">Select a time
-  <cds-timepicker (valueChange)="onModelChange($event)"
-                  [(ngModel)]="time"
-                  [disabled]="disabled"
-                  pattern="(1[012]|[0-9]):[0-5][0-9]"
-                  *ngIf="hasTime">
-  <cds-timepicker-select [(ngModel)]="ampm"
-                         [disabled]="disabled"
-                         (valueChange)="onModelChange($event)">
-    <option selected
-            value="AM">AM</option>
-    <option value="PM">PM</option>
-  </cds-timepicker-select>
-</cds-timepicker>
-</cds-text-label>
-</div>
+    <cds-text-label *ngIf="hasTime"
+      >Select a time
+      <cds-timepicker
+        (valueChange)="onModelChange($event)"
+        [(ngModel)]="time"
+        [disabled]="disabled"
+        pattern="(1[012]|[0-9]):[0-5][0-9]"
+        *ngIf="hasTime"
+      >
+        <cds-timepicker-select
+          [(ngModel)]="ampm"
+          [disabled]="disabled"
+          (valueChange)="onModelChange($event)"
+        >
+          <option
+            selected
+            value="AM"
+          >
+            AM
+          </option>
+          <option value="PM">PM</option>
+        </cds-timepicker-select>
+      </cds-timepicker>
+    </cds-text-label>
+  </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.html
index 9a7c5b02468..3787dd2077f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.html
@@ -1,126 +1,186 @@
-<cds-modal size="sm"
-           [open]="open"
-           (overlaySelected)="closeModal()">
+<cds-modal
+  size="sm"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+>
   <cds-modal-header (closeSelect)="closeModal()">
     <ng-container *ngTemplateOutlet="deletionHeading"></ng-container>
   </cds-modal-header>
 
   <section cdsModalContent>
-    <form name="deletionForm"
-          #formDir="ngForm"
-          [formGroup]="deletionForm"
-          novalidate>
-      <cd-alert-panel *ngIf="infoMessage"
-                      type="info"
-                      spacingClass="cds-mb-3"
-                      i18n>
+    <form
+      name="deletionForm"
+      #formDir="ngForm"
+      [formGroup]="deletionForm"
+      novalidate
+    >
+      <cd-alert-panel
+        *ngIf="infoMessage"
+        type="info"
+        spacingClass="cds-mb-3"
+        i18n
+      >
         <p>{{ infoMessage }}</p>
       </cd-alert-panel>
       <ng-container *ngTemplateOutlet="bodyTemplate; context: bodyContext"></ng-container>
       <div class="question">
         <span *ngIf="itemNames; else noNames">
           <ng-container *ngIf="itemNames.length === 1; else manyNames">
-            <p *ngIf="impact == impactEnum.medium"
-               i18n>Are you sure that you want to {{ actionDescription | lowercase }} <strong>{{ itemNames[0] }}</strong>?</p>
+            <p
+              *ngIf="impact == impactEnum.medium"
+              i18n
+            >
+              Are you sure that you want to {{ actionDescription | lowercase }}
+              <strong>{{ itemNames[0] }}</strong
+              >?
+            </p>
           </ng-container>
           <ng-template #manyNames>
-            <p i18n>Are you sure that you want to {{ actionDescription | lowercase }} the selected items?</p>
+            <p i18n>
+              Are you sure that you want to {{ actionDescription | lowercase }} the selected items?
+            </p>
             <ul>
-              <li *ngFor="let itemName of itemNames"><strong>{{ itemName }}</strong></li>
+              <li *ngFor="let itemName of itemNames">
+                <strong>{{ itemName }}</strong>
+              </li>
             </ul>
           </ng-template>
         </span>
         <ng-template #noNames>
-          <p *ngIf="impact == impactEnum.medium"
-             i18n>Are you sure that you want to {{ actionDescription | lowercase }} the selected {{ itemDescription }}?</p>
+          <p
+            *ngIf="impact == impactEnum.medium"
+            i18n
+          >
+            Are you sure that you want to {{ actionDescription | lowercase }} the selected
+            {{ itemDescription }}?
+          </p>
         </ng-template>
-        <ng-container *ngTemplateOutlet="childFormGroupTemplate; context:{form:deletionForm}"></ng-container>
+        <ng-container
+          *ngTemplateOutlet="childFormGroupTemplate; context: { form: deletionForm }"
+        ></ng-container>
         <div class="form-item">
           <ng-container *ngIf="impact == impactEnum.medium; else highImpactDeletion">
-            <cds-checkbox id="confirmation"
-                          formControlName="confirmation"
-                          autofocus
-                          [required]="true"
-                          modal-primary-focus
-                          ariaLabel="confirmation"
-                          i18n>Yes, I am sure.</cds-checkbox>
+            <cds-checkbox
+              id="confirmation"
+              formControlName="confirmation"
+              autofocus
+              [required]="true"
+              modal-primary-focus
+              ariaLabel="confirmation"
+              i18n
+              >Yes, I am sure.</cds-checkbox
+            >
           </ng-container>
           <ng-template #highImpactDeletion>
             <p class="cds--type-body-01">
-            @if (bodyContext?.deletionMessage) {
-            <span [innerHTML]="bodyContext.deletionMessage"></span>
-            } @else {
-            <ng-container i18n>Deleting <strong>{{ itemNames[0] }}</strong> will remove all associated {{itemDescription}}.This action cannot be undone.</ng-container>
-            }
+              @if (bodyContext?.deletionMessage) {
+                <span [innerHTML]="bodyContext.deletionMessage"></span>
+              } @else {
+                <ng-container i18n
+                  >Deleting <strong>{{ itemNames[0] }}</strong> will remove all associated
+                  {{ itemDescription }}.This action cannot be undone.</ng-container
+                >
+              }
             </p>
             <ng-template #labelTemplate>
-              <span i18n
-                    class="cds--type-label-01">Type <strong>{{ itemNames[0] }}</strong> to confirm (required)</span>
+              <span
+                i18n
+                class="cds--type-label-01"
+                >Type <strong>{{ itemNames[0] }}</strong> to confirm (required)</span
+              >
             </ng-template>
-            <cds-text-label [labelTemplate]="labelTemplate"
-                            labelInputID="resource_name"
-                            [cdRequiredField]="'Type ' + itemNames[0] + ' to confirm'"
-                            [invalid]="!deletionForm.controls.confirmInput.valid && deletionForm.controls.confirmInput.touched"
-                            [invalidText]="ResourceError"
-                            [disabled]="deletionForm.controls.confirmInput.disabled">
-              <input cdsText
-                     type="text"
-                     [placeholder]="'Name of resource'"
-                     id="resource_name"
-                     formControlName="confirmInput"
-                     [attr.disabled]="deletionForm.controls.confirmInput.disabled ? true : null"
-                     i18n-placeholder
-                     autofocus/>
+            <cds-text-label
+              [labelTemplate]="labelTemplate"
+              labelInputID="resource_name"
+              [cdRequiredField]="'Type ' + itemNames[0] + ' to confirm'"
+              [invalid]="
+                !deletionForm.controls.confirmInput.valid &&
+                deletionForm.controls.confirmInput.touched
+              "
+              [invalidText]="ResourceError"
+              [disabled]="deletionForm.controls.confirmInput.disabled"
+            >
+              <input
+                cdsText
+                type="text"
+                [placeholder]="'Name of resource'"
+                id="resource_name"
+                formControlName="confirmInput"
+                [attr.disabled]="deletionForm.controls.confirmInput.disabled ? true : null"
+                i18n-placeholder
+                autofocus
+              />
             </cds-text-label>
             <ng-template #ResourceError>
-              <span *ngIf="deletionForm.controls.confirmInput.hasError('required')"
-                    class="invalid-feedback">
+              <span
+                *ngIf="deletionForm.controls.confirmInput.hasError('required')"
+                class="invalid-feedback"
+              >
                 <ng-container i18n>This field is required.</ng-container>
               </span>
-              <span *ngIf="deletionForm.controls.confirmInput.hasError('matchResource')"
-                    class="invalid-feedback">
+              <span
+                *ngIf="deletionForm.controls.confirmInput.hasError('matchResource')"
+                class="invalid-feedback"
+              >
                 <ng-container i18n>Enter the correct resource name.</ng-container>
               </span>
             </ng-template>
             @if (bodyContext?.forceDeleteAcknowledgementMessage) {
-            <div class="form-item cds-mt-3">
-              <cds-checkbox id="force_delete_ack"
-                            formControlName="forceDeleteAck"
-                            [required]="true"
-                            ariaLabel="Forced delete acknowledgement">
-                {{ bodyContext.forceDeleteAcknowledgementMessage }}
-              </cds-checkbox>
-            </div>
+              <div class="form-item cds-mt-3">
+                <cds-checkbox
+                  id="force_delete_ack"
+                  formControlName="forceDeleteAck"
+                  [required]="true"
+                  ariaLabel="Forced delete acknowledgement"
+                >
+                  {{ bodyContext.forceDeleteAcknowledgementMessage }}
+                </cds-checkbox>
+              </div>
             }
           </ng-template>
         </div>
       </div>
     </form>
   </section>
-  <cd-form-button-panel (submitActionEvent)="callSubmitAction()"
-                        (backActionEvent)="backAction ? callBackAction() : hideModal()"
-                        [form]="deletionForm"
-                        [submitText]="(actionDescription | titlecase) + ' ' + itemDescription"
-                        [modalForm]="true"
-                        [disabled]="(submitDisabled$ | async) || deletionForm.disabled || (impact === impactEnum.high ? (!deletionForm.controls.confirmInput.value || !forceDeleteAckSatisfied) : !deletionForm.controls.confirmation.value)"
-                        [submitBtnType]="(actionDescription === 'delete' || actionDescription === 'remove') ? 'danger' : 'primary'"></cd-form-button-panel>
-
+  <cd-form-button-panel
+    (submitActionEvent)="callSubmitAction()"
+    (backActionEvent)="backAction ? callBackAction() : hideModal()"
+    [form]="deletionForm"
+    [submitText]="(actionDescription | titlecase) + ' ' + itemDescription"
+    [modalForm]="true"
+    [disabled]="
+      (submitDisabled$ | async) ||
+      deletionForm.disabled ||
+      (impact === impactEnum.high
+        ? !deletionForm.controls.confirmInput.value || !forceDeleteAckSatisfied
+        : !deletionForm.controls.confirmation.value)
+    "
+    [submitBtnType]="
+      actionDescription === 'delete' || actionDescription === 'remove' ? 'danger' : 'primary'
+    "
+  ></cd-form-button-panel>
 </cds-modal>
 <ng-template #deletionHeading>
   @if (impact === impactEnum.high) {
-  <h2 cdsModalHeaderLabel
-      i18n>
-      {{(actionDescription | titlecase) + ' ' + itemDescription}}
-  </h2>
-  <h2 class="cds--type-heading-03"
+    <h2
+      cdsModalHeaderLabel
+      i18n
+    >
+      {{ (actionDescription | titlecase) + ' ' + itemDescription }}
+    </h2>
+    <h2
+      class="cds--type-heading-03"
       cdsModalHeaderHeading
-      i18n>
-    Confirm {{ actionDescription }}
-  </h2>
+      i18n
+    >
+      Confirm {{ actionDescription }}
+    </h2>
   } @else {
-  <h3 cdsModalHeaderHeading
-      i18n>
-      {{(actionDescription | titlecase) + ' ' + itemDescription}}
-  </h3>
+    <h3
+      cdsModalHeaderHeading
+      i18n
+    >
+      {{ (actionDescription | titlecase) + ' ' + itemDescription }}
+    </h3>
   }
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
index c3a784214b6..b227ff0ae68 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/details-card/details-card.component.html
@@ -1,36 +1,50 @@
 <cd-productive-card>
   <ng-template #header>
     @if (cardTitle) {
-    <h3 class="cds--type-heading-03" i18n>{{ cardTitle }}</h3>
+      <h3
+        class="cds--type-heading-03"
+        i18n
+      >
+        {{ cardTitle }}
+      </h3>
     }
   </ng-template>
 
-  <div [cdsStack]="'vertical'"
-       [gap]="0">
+  <div
+    [cdsStack]="'vertical'"
+    [gap]="0"
+  >
     @if (details && details.length > 0) {
-    <div [cdsStack]="'horizontal'"
-         [gap]="5">
-      @for (detail of getVisibleDetails(); track detail.label) {
-      <div [cdsStack]="'vertical'"
-           [gap]="2">
-        <legend class="cds--type-label-01">{{ detail.label }}</legend>
-        <div class="cds--type-body-01">
-          @switch (detail.type) {
-            @case ('status') {
-              <div [cdsStack]="'horizontal'" [gap]="3">
-                <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
-                <span>{{ getDisplayValue(detail.value) }}</span>
-              </div>
-            }
+      <div
+        [cdsStack]="'horizontal'"
+        [gap]="5"
+      >
+        @for (detail of getVisibleDetails(); track detail.label) {
+          <div
+            [cdsStack]="'vertical'"
+            [gap]="2"
+          >
+            <legend class="cds--type-label-01">{{ detail.label }}</legend>
+            <div class="cds--type-body-01">
+              @switch (detail.type) {
+                @case ('status') {
+                  <div
+                    [cdsStack]="'horizontal'"
+                    [gap]="3"
+                  >
+                    <cd-icon [type]="getStatusIcon(detail)"></cd-icon>
+                    <span>{{ getDisplayValue(detail.value) }}</span>
+                  </div>
+                }
 
-            @default {
-              <span>{{ getDisplayValue(detail.value) }}</span>
-            }
-          }
-        </div>
+                @default {
+                  <span>{{ getDisplayValue(detail.value) }}</span>
+                }
+              }
+            </div>
+          </div>
+        }
       </div>
-      }
-    </div>
     }
     <ng-content></ng-content>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/doc/doc.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/doc/doc.component.html
index c6b43418815..128056c55af 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/doc/doc.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/doc/doc.component.html
@@ -1,3 +1,6 @@
-<a href="{{ docUrl }}"
-   target="_blank"
-   class="ps-1 pe-1">{{ docText }}</a>
+<a
+  href="{{ docUrl }}"
+  target="_blank"
+  class="ps-1 pe-1"
+  >{{ docText }}</a
+>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html
index 21ce6a76343..482ad63c2d2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/download-button/download-button.component.html
@@ -1,30 +1,42 @@
-<div ngbDropdown
-     placement="bottom-right">
-  <button type="button"
-          [title]="title"
-          class="btn btn-light dropdown-toggle-split"
-          ngbDropdownToggle>
-    <svg [cdsIcon]="icons.download"
-         size="16"
-         ></svg>&nbsp;
+<div
+  ngbDropdown
+  placement="bottom-right"
+>
+  <button
+    type="button"
+    [title]="title"
+    class="btn btn-light dropdown-toggle-split"
+    ngbDropdownToggle
+  >
+    <svg
+      [cdsIcon]="icons.download"
+      size="16"
+    ></svg
+    >&nbsp;
   </button>
   <div ngbDropdownMenu>
-    <button ngbDropdownItem
-            (click)="download('json')"
-            type="button"
-            *ngIf="objectItem">
-      <svg [cdsIcon]="icons.code"
-           size="16"
-           ></svg>
+    <button
+      ngbDropdownItem
+      (click)="download('json')"
+      type="button"
+      *ngIf="objectItem"
+    >
+      <svg
+        [cdsIcon]="icons.code"
+        size="16"
+      ></svg>
       <span>&nbsp;JSON</span>
     </button>
-    <button ngbDropdownItem
-            (click)="download()"
-            *ngIf="textItem"
-            type="button">
-      <svg [cdsIcon]="icons.document"
-           size="16"
-           ></svg>
+    <button
+      ngbDropdownItem
+      (click)="download()"
+      *ngIf="textItem"
+      type="button"
+    >
+      <svg
+        [cdsIcon]="icons.document"
+        size="16"
+      ></svg>
       <span>&nbsp;Text</span>
     </button>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/empty-state/empty-state.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/empty-state/empty-state.component.html
index c2ca9930cc1..52477970b4b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/empty-state/empty-state.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/empty-state/empty-state.component.html
@@ -1,14 +1,18 @@
 <div
   class="empty-state"
-  [class.empty-state-title]="title">
+  [class.empty-state-title]="title"
+>
   <img
     src="{{ imgSrc }}"
-    [alt]="text"/>
-  @if(title) {
-  <p class="cds--type-body-compact-02 cds-mb-0">{{title}}</p>
+    [alt]="text"
+  />
+  @if (title) {
+    <p class="cds--type-body-compact-02 cds-mb-0">{{ title }}</p>
   }
-  <p class="cds--type-label-01 empty-state-text"
-     i18n>
+  <p
+    class="cds--type-label-01 empty-state-text"
+    i18n
+  >
     {{ text }}
   </p>
   <ng-content></ng-content>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-advanced-fieldset/form-advanced-fieldset.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-advanced-fieldset/form-advanced-fieldset.component.html
index 5e59c032a8c..e3f3cddd904 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-advanced-fieldset/form-advanced-fieldset.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-advanced-fieldset/form-advanced-fieldset.component.html
@@ -1,16 +1,24 @@
 <fieldset>
-  <cds-accordion size="lg"
-                 class="form-item">
-    <cds-accordion-item [title]="titleTpl"
-                        i18n
-                        id="advanced-fieldset"
-                        (selected)="showAdvanced = !showAdvanced">
+  <cds-accordion
+    size="lg"
+    class="form-item"
+  >
+    <cds-accordion-item
+      [title]="titleTpl"
+      i18n
+      id="advanced-fieldset"
+      (selected)="showAdvanced = !showAdvanced"
+    >
       <ng-content></ng-content>
     </cds-accordion-item>
   </cds-accordion>
 
   <ng-template #titleTpl>
-    <h5 class="cds--accordion__title cd-header"
-        i18n>{{title}}</h5>
+    <h5
+      class="cds--accordion__title cd-header"
+      i18n
+    >
+      {{ title }}
+    </h5>
   </ng-template>
 </fieldset>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-button-panel/form-button-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-button-panel/form-button-panel.component.html
index aa161811b12..938ce1d8518 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-button-panel/form-button-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-button-panel/form-button-panel.component.html
@@ -1,34 +1,44 @@
 <ng-container *ngIf="!modalForm; else modalFooter">
   <div [ngClass]="wrappingClass">
-    <cd-back-button *ngIf="showCancel"
-                    (backAction)="backAction()"
-                    [name]="cancelText"></cd-back-button>
-    <cd-submit-button *ngIf="showSubmit"
-                      (submitAction)="submitAction()"
-                      [disabled]="disabled"
-                      [form]="form"
-                      [ariaLabel]="submitText"
-                      data-testid="submitBtn"
-                      [buttonType]="submitBtnType">{{ submitText }}</cd-submit-button>
+    <cd-back-button
+      *ngIf="showCancel"
+      (backAction)="backAction()"
+      [name]="cancelText"
+    ></cd-back-button>
+    <cd-submit-button
+      *ngIf="showSubmit"
+      (submitAction)="submitAction()"
+      [disabled]="disabled"
+      [form]="form"
+      [ariaLabel]="submitText"
+      data-testid="submitBtn"
+      [buttonType]="submitBtnType"
+      >{{ submitText }}</cd-submit-button
+    >
   </div>
 </ng-container>
 
 <ng-template #modalFooter>
   <cds-modal-footer>
-    <cd-back-button *ngIf="showCancel"
-                    (backAction)="backAction()"
-                    [name]="cancelText"
-                    [modalForm]="modalForm"
-                    [showSubmit]="showSubmit"
-                    class="w-100"></cd-back-button>
-    <cd-submit-button *ngIf="showSubmit"
-                      (submitAction)="submitAction()"
-                      [disabled]="disabled"
-                      [form]="form"
-                      [ariaLabel]="submitText"
-                      data-testid="submitBtn"
-                      [modalForm]="modalForm"
-                      [buttonType]="submitBtnType"
-                      class="w-100">{{ submitText }}</cd-submit-button>
+    <cd-back-button
+      *ngIf="showCancel"
+      (backAction)="backAction()"
+      [name]="cancelText"
+      [modalForm]="modalForm"
+      [showSubmit]="showSubmit"
+      class="w-100"
+    ></cd-back-button>
+    <cd-submit-button
+      *ngIf="showSubmit"
+      (submitAction)="submitAction()"
+      [disabled]="disabled"
+      [form]="form"
+      [ariaLabel]="submitText"
+      data-testid="submitBtn"
+      [modalForm]="modalForm"
+      [buttonType]="submitBtnType"
+      class="w-100"
+      >{{ submitText }}</cd-submit-button
+    >
   </cds-modal-footer>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-modal/form-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-modal/form-modal.component.html
index 7cda7800b86..db778dcb087 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-modal/form-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/form-modal/form-modal.component.html
@@ -1,104 +1,136 @@
-<cds-modal size="md"
-           [open]="open"
-           (overlaySelected)="closeModal()"
-           [hasScrollingContent]="true">
+<cds-modal
+  size="md"
+  [open]="open"
+  (overlaySelected)="closeModal()"
+  [hasScrollingContent]="true"
+>
   <cds-modal-header (closeSelect)="closeModal()">
-    <h3 cdsModalHeaderHeading
-        *ngIf="titleText">
+    <h3
+      cdsModalHeaderHeading
+      *ngIf="titleText"
+    >
       {{ titleText }}
     </h3>
   </cds-modal-header>
-    <div cdsModalContent
-         data-testid="modal-content">
-      <form [formGroup]="formGroup"
-            #formDir="ngForm"
-            novalidate>
-      <p *ngIf="message"
-         id="description">{{ message }}</p>
+  <div
+    cdsModalContent
+    data-testid="modal-content"
+  >
+    <form
+      [formGroup]="formGroup"
+      #formDir="ngForm"
+      novalidate
+    >
+      <p
+        *ngIf="message"
+        id="description"
+      >
+        {{ message }}
+      </p>
       <ng-container *ngFor="let field of fields">
         <div class="form-item">
-          <cds-text-label *ngIf="field.type === 'text'"
-                          [labelInputID]="field.name"
-                          [invalid]="getError(field)"
-                          [invalidText]="getError(field)"
-                          [cdRequiredField]="field?.required === true ? field.label : ''"
-                          i18n>
+          <cds-text-label
+            *ngIf="field.type === 'text'"
+            [labelInputID]="field.name"
+            [invalid]="getError(field)"
+            [invalidText]="getError(field)"
+            [cdRequiredField]="field?.required === true ? field.label : ''"
+            i18n
+          >
             {{ field.label }}
-            <input cdsText
-                   type="text"
-                   [id]="field.name"
-                   [name]="field.name"
-                   [formControlName]="field.name"
-                   [invalid]="getError(field)"
-                   autofocus>
+            <input
+              cdsText
+              type="text"
+              [id]="field.name"
+              [name]="field.name"
+              [formControlName]="field.name"
+              [invalid]="getError(field)"
+              autofocus
+            />
           </cds-text-label>
-          <cds-number *ngIf="field.type === 'number'"
-                      [invalid]="getError(field)"
-                      [invalidText]="getError(field)"
-                      [label]="field.label"
-                      [cdRequiredField]="field?.required === true ? field.label : ''"
-                      [formControlName]="field.name"
-                      [id]="field.name"
-                      i18n></cds-number>
-          <cds-text-label *ngIf="field.type === 'binary'"
-                          [labelInputID]="field.name"
-                          [invalid]="getError(field)"
-                          [invalidText]="getError(field)"
-                          [cdRequiredField]="field?.required === true ? field.label : ''"
-                          i18n>
+          <cds-number
+            *ngIf="field.type === 'number'"
+            [invalid]="getError(field)"
+            [invalidText]="getError(field)"
+            [label]="field.label"
+            [cdRequiredField]="field?.required === true ? field.label : ''"
+            [formControlName]="field.name"
+            [id]="field.name"
+            i18n
+          ></cds-number>
+          <cds-text-label
+            *ngIf="field.type === 'binary'"
+            [labelInputID]="field.name"
+            [invalid]="getError(field)"
+            [invalidText]="getError(field)"
+            [cdRequiredField]="field?.required === true ? field.label : ''"
+            i18n
+          >
             {{ field.label }}
-            <input type="text"
-                   [id]="field.name"
-                   [name]="field.name"
-                   [formControlName]="field.name"
-                   cdsText
-                   cdDimlessBinary>
+            <input
+              type="text"
+              [id]="field.name"
+              [name]="field.name"
+              [formControlName]="field.name"
+              cdsText
+              cdDimlessBinary
+            />
           </cds-text-label>
-          <cds-select *ngIf="field.type === 'select'"
-                      [label]="field.label"
-                      [for]="field.name"
-                      [id]="field.name"
-                      [formControlName]="field.name"
-                      [options]="field?.typeConfig?.options"
-                      [placeholder]="field?.typeConfig?.placeholder"
-                      [invalid]="getError(field)"
-                      [invalidText]="getError(field)"
-                      [cdRequiredField]="field?.required === true ? field.label : ''"
-                      i18n>
-            <option *ngIf="field?.typeConfig?.placeholder"
-                    [ngValue]="null">
+          <cds-select
+            *ngIf="field.type === 'select'"
+            [label]="field.label"
+            [for]="field.name"
+            [id]="field.name"
+            [formControlName]="field.name"
+            [options]="field?.typeConfig?.options"
+            [placeholder]="field?.typeConfig?.placeholder"
+            [invalid]="getError(field)"
+            [invalidText]="getError(field)"
+            [cdRequiredField]="field?.required === true ? field.label : ''"
+            i18n
+          >
+            <option
+              *ngIf="field?.typeConfig?.placeholder"
+              [ngValue]="null"
+            >
               {{ field?.typeConfig?.placeholder }}
             </option>
-            <option *ngFor="let option of field?.typeConfig?.options"
-                    [value]="option.value">
+            <option
+              *ngFor="let option of field?.typeConfig?.options"
+              [value]="option.value"
+            >
               {{ option.text }}
             </option>
           </cds-select>
 
-          <cds-combo-box *ngIf="field.type === 'select-badges'"
-                         type="multi"
-                         selectionFeedback="top-after-reopen"
-                         [label]="field.label"
-                         [for]="field.name"
-                         [formControlName]="field.name"
-                         itemValueKey="content"
-                         [id]="field.name"
-                         [invalid]="getError(field)"
-                         [invalidText]="getError(field)"
-                         [appendInline]="false"
-                         cdDynamicInputCombobox
-                         (updatedItems)="onLabelsUpdated(field, $event)"
-                         [items]="field?.typeConfig?.options"
-                         [cdRequiredField]="field?.required === true ? field.label : ''"
-                         i18n>
+          <cds-combo-box
+            *ngIf="field.type === 'select-badges'"
+            type="multi"
+            selectionFeedback="top-after-reopen"
+            [label]="field.label"
+            [for]="field.name"
+            [formControlName]="field.name"
+            itemValueKey="content"
+            [id]="field.name"
+            [invalid]="getError(field)"
+            [invalidText]="getError(field)"
+            [appendInline]="false"
+            cdDynamicInputCombobox
+            (updatedItems)="onLabelsUpdated(field, $event)"
+            [items]="field?.typeConfig?.options"
+            [cdRequiredField]="field?.required === true ? field.label : ''"
+            i18n
+          >
             <cds-dropdown-list></cds-dropdown-list>
           </cds-combo-box>
         </div>
       </ng-container>
     </form>
   </div>
-  <cd-form-button-panel (submitActionEvent)="onSubmitForm(formGroup.value)"
-                        [form]="formGroup"
-                        [submitText]="submitButtonText"
-                        [modalForm]="true"></cd-form-button-panel>
+  <cd-form-button-panel
+    (submitActionEvent)="onSubmitForm(formGroup.value)"
+    [form]="formGroup"
+    [submitText]="submitButtonText"
+    [modalForm]="true"
+  ></cd-form-button-panel>
 </cds-modal>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html
index bb5b285602a..d191303aed3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.html
@@ -1,37 +1,52 @@
 <!-- Embed dashboard -->
-<cd-loading-panel *ngIf="loading && grafanaExist"
-                  i18n>Loading panel data...</cd-loading-panel>
+<cd-loading-panel
+  *ngIf="loading && grafanaExist"
+  i18n
+  >Loading panel data...</cd-loading-panel
+>
 
-<cd-alert-panel type="info"
-                *ngIf="!grafanaExist"
-                i18n>Please consult the&nbsp;<cd-doc section="grafana"></cd-doc>&nbsp;on
-  how to configure and enable the monitoring functionality.</cd-alert-panel>
+<cd-alert-panel
+  type="info"
+  *ngIf="!grafanaExist"
+  i18n
+  >Please consult the&nbsp;<cd-doc section="grafana"></cd-doc>&nbsp;on how to configure and enable
+  the monitoring functionality.</cd-alert-panel
+>
 
-<cd-alert-panel type="info"
-                *ngIf="!dashboardExist"
-                i18n>Grafana Dashboard doesn't exist. Please refer to
-  &nbsp;<cd-doc section="grafana"></cd-doc>&nbsp;on how to add dashboards to Grafana.</cd-alert-panel>
+<cd-alert-panel
+  type="info"
+  *ngIf="!dashboardExist"
+  i18n
+  >Grafana Dashboard doesn't exist. Please refer to &nbsp;<cd-doc section="grafana"></cd-doc
+  >&nbsp;on how to add dashboards to Grafana.</cd-alert-panel
+>
 
 <ng-container *ngIf="grafanaExist && dashboardExist">
   <!--Start : UI row hidden intentionally; code retained as dead code for potential future use. -->
-  <div class="row mb-3"
-       *ngIf="showMessage">
-    <div class="col-lg-5 d-flex" >
+  <div
+    class="row mb-3"
+    *ngIf="showMessage"
+  >
+    <div class="col-lg-5 d-flex">
       <div class="col-sm-1">
-        <button class="btn btn-light ms-3"
-                i18n-title
-                title="Reset Settings"
-                type="button"
-                (click)="reset()">
+        <button
+          class="btn btn-light ms-3"
+          i18n-title
+          title="Reset Settings"
+          type="button"
+          (click)="reset()"
+        >
           <i [ngClass]="[icons.undo]"></i>
         </button>
       </div>
       <div class="col-sm-1">
-        <button class="btn btn-light ms-3"
-                i18n-title
-                title="Show hidden information"
-                type="button"
-                (click)="showMessage = !showMessage">
+        <button
+          class="btn btn-light ms-3"
+          i18n-title
+          title="Show hidden information"
+          type="button"
+          (click)="showMessage = !showMessage"
+        >
           <i [ngClass]="[icons.infoCircle, icons.size24]"></i>
         </button>
       </div>
@@ -40,32 +55,43 @@
   <!-- end -->
 
   <div class="row">
-    <div class="col my-2"
-         *ngIf="showMessage">
-      <cd-alert-panel type="info"
-                      class="mb-3"
-                      *ngIf="showMessage"
-                      dismissible="true"
-                      (dismissed)="showMessage = false"
-                      i18n>If no embedded Grafana Dashboard appeared below, please follow&nbsp;<a [href]="grafanaSrc"
-                      target="_blank"
-                      noopener
-                      noreferrer>this link </a>&nbsp;to check if Grafana is reachable and there are no HTTPS certificate issues. You may need to reload this page after accepting any Browser certificate exceptions</cd-alert-panel>
+    <div
+      class="col my-2"
+      *ngIf="showMessage"
+    >
+      <cd-alert-panel
+        type="info"
+        class="mb-3"
+        *ngIf="showMessage"
+        dismissible="true"
+        (dismissed)="showMessage = false"
+        i18n
+        >If no embedded Grafana Dashboard appeared below, please follow&nbsp;<a
+          [href]="grafanaSrc"
+          target="_blank"
+          noopener
+          noreferrer
+          >this link </a
+        >&nbsp;to check if Grafana is reachable and there are no HTTPS certificate issues. You may
+        need to reload this page after accepting any Browser certificate exceptions</cd-alert-panel
+      >
     </div>
   </div>
 
   <div class="row">
     <div class="col">
       <div class="grafana-container">
-        <iframe #iframe
-                id="iframe"
-                [src]="grafanaSrc"
-                class="grafana"
-                [ngClass]="panelStyle"
-                frameborder="0"
-                [(scrolling)]="scrollable"
-                [title]="title"
-                i18n-title>
+        <iframe
+          #iframe
+          id="iframe"
+          [src]="grafanaSrc"
+          class="grafana"
+          [ngClass]="panelStyle"
+          frameborder="0"
+          [(scrolling)]="scrollable"
+          [title]="title"
+          i18n-title
+        >
         </iframe>
       </div>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/help-text/help-text.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/help-text/help-text.component.html
index 65b889b060a..085ed6bb356 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/help-text/help-text.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/help-text/help-text.component.html
@@ -1,10 +1,12 @@
-  <div class="form-text text-muted">
-    <ng-container *ngIf="formAllFieldsRequired; else contentTpl"
-                  i18n>
-      All fields are required, except where marked optional.
-    </ng-container>
+<div class="form-text text-muted">
+  <ng-container
+    *ngIf="formAllFieldsRequired; else contentTpl"
+    i18n
+  >
+    All fields are required, except where marked optional.
+  </ng-container>
 
-    <ng-template #contentTpl>
-      <ng-content></ng-content>
-    </ng-template>
-  </div>
+  <ng-template #contentTpl>
+    <ng-content></ng-content>
+  </ng-template>
+</div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html
index c9e5b3f2ad6..62a485a6d61 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/helper/helper.component.html
@@ -1,38 +1,49 @@
 <ng-template #tooltipTemplate>
   <div class="cds--popover-scroll-container">
-    <div [class]="class"
-         [innerHtml]="html">
-    </div>
+    <div
+      [class]="class"
+      [innerHtml]="html"
+    ></div>
     <ng-container *ngTemplateOutlet="content"></ng-container>
   </div>
 </ng-template>
 @if (type === helperType.tooltip) {
-  <cds-tooltip [description]="tooltipTemplate"
-               [autoAlign]="true"
-               [id]="tooltipId">
-    <svg [cdsIcon]="iconType"
-         [size]="iconSize"></svg>
+  <cds-tooltip
+    [description]="tooltipTemplate"
+    [autoAlign]="true"
+    [id]="tooltipId"
+  >
+    <svg
+      [cdsIcon]="iconType"
+      [size]="iconSize"
+    ></svg>
   </cds-tooltip>
 } @else {
-  <div class="inline-block"
-       [ngClass]="class">
+  <div
+    class="inline-block"
+    [ngClass]="class"
+  >
     <div
       cdsPopover
       [isOpen]="isPopoverOpen"
       [autoAlign]="true"
       (click)="togglePopover()"
       (keydown.enter)="togglePopover()"
-      tabindex="0">
+      tabindex="0"
+    >
       <div class="popover-trigger">
         <svg
           [cdsIcon]="iconType"
-          [size]="iconSize"></svg>
+          [size]="iconSize"
+        ></svg>
       </div>
       <cds-popover-content>
-        <div class="cds--popover-scroll-container"
-             (click)="$event.stopPropagation()"
-             tabindex="0"
-             (keydown.enter)="$event.stopPropagation()">
+        <div
+          class="cds--popover-scroll-container"
+          (click)="$event.stopPropagation()"
+          tabindex="0"
+          (keydown.enter)="$event.stopPropagation()"
+        >
           <ng-container *ngTemplateOutlet="content"></ng-container>
         </div>
       </cds-popover-content>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.html
index b393d255e1d..a805c8a9793 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/icon/icon.component.html
@@ -1,4 +1,5 @@
-<svg  [cdsIcon]="icon"
-      [size]="size"
-      [ngClass]="!useDefault ? [type + '-icon', customClass] : []">
-</svg>
+<svg
+  [cdsIcon]="icon"
+  [size]="size"
+  [ngClass]="!useDefault ? [type + '-icon', customClass] : []"
+></svg>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html
index ee382632f2d..01d180a8736 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/inline-message/inline-message.component.html
@@ -1,46 +1,62 @@
 @if (!isDismissed) {
-  <div class="inline-tip-container"
-       [cdsStack]="'horizontal'"
-       [gap]="4">
+  <div
+    class="inline-tip-container"
+    [cdsStack]="'horizontal'"
+    [gap]="4"
+  >
     <div class="close-btn-position">
-      <cds-icon-button class="close-btn inline-tip-bg-color"
-                       type="button"
-                       kind="ghost"
-                       size="sm"
-                       description="Close"
-                       i18n-description
-                       (click)="close()">
-        <svg [size]="icons.size16"
-             [cdsIcon]="icons.destroy"></svg>
+      <cds-icon-button
+        class="close-btn inline-tip-bg-color"
+        type="button"
+        kind="ghost"
+        size="sm"
+        description="Close"
+        i18n-description
+        (click)="close()"
+      >
+        <svg
+          [size]="icons.size16"
+          [cdsIcon]="icons.destroy"
+        ></svg>
       </cds-icon-button>
     </div>
 
-    <div class="inline-tip-body"
-         [cdsStack]="'horizontal'"
-         [gap]="4">
-      <svg [cdsIcon]="icons.idea"
-           [size]="icons.size20"></svg>
+    <div
+      class="inline-tip-body"
+      [cdsStack]="'horizontal'"
+      [gap]="4"
+    >
+      <svg
+        [cdsIcon]="icons.idea"
+        [size]="icons.size20"
+      ></svg>
 
-      <div [cdsStack]="'vertical'"
-           [gap]="1"
-           class="inline-tip-body-content">
-      @if (title) {
-        <h1 class="cds--type-heading-compact-01">{{ title }}</h1>
-      }
+      <div
+        [cdsStack]="'vertical'"
+        [gap]="1"
+        class="inline-tip-body-content"
+      >
+        @if (title) {
+          <h1 class="cds--type-heading-compact-01">{{ title }}</h1>
+        }
 
-        <div class="cds--type-body-01"
-             [class.cds--text-truncate--end]="isTruncated">
+        <div
+          class="cds--type-body-01"
+          [class.cds--text-truncate--end]="isTruncated"
+        >
           <ng-content></ng-content>
         </div>
         @if (collapsible) {
-        <button class="inline-tip-bg-color btn-toggle"
-                cdsButton="ghost"
-                size="md"
-                (click)="toggleContent()"
-                type="button">
-          <span i18n>{{ isTruncated ? 'Read more' : 'Read less' }}</span>
-        </button>
-      }
+          <button
+            class="inline-tip-bg-color btn-toggle"
+            cdsButton="ghost"
+            size="md"
+            (click)="toggleContent()"
+            type="button"
+          >
+            <span i18n>{{ isTruncated ? 'Read more' : 'Read less' }}</span>
+          </button>
+        }
       </div>
     </div>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/language-selector.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/language-selector.component.html
index 649b8b45a4d..71c8c55a3be 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/language-selector.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/language-selector.component.html
@@ -3,4 +3,3 @@
     <cds-header-item (click)="changeLanguage(lang.key)">{{ lang.value }}</cds-header-item>
   </ng-container>
 </cds-header-menu>
-
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/loading-panel/loading-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/loading-panel/loading-panel.component.html
index 2c8ca2e0151..b4ac3db8620 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/loading-panel/loading-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/loading-panel/loading-panel.component.html
@@ -1,8 +1,12 @@
-<ngb-alert type="info"
-           [dismissible]="false">
+<ngb-alert
+  type="info"
+  [dismissible]="false"
+>
   <strong>
-    <cds-inline-loading aria-hidden="true"
-                        class="me-2"></cds-inline-loading>
+    <cds-inline-loading
+      aria-hidden="true"
+      class="me-2"
+    ></cds-inline-loading>
   </strong>
   <ng-content></ng-content>
 </ngb-alert>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/modal/modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/modal/modal.component.html
index 6f1cf42cea2..62004e2298b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/modal/modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/modal/modal.component.html
@@ -5,11 +5,12 @@
         <h4 class="modal-title float-start">
           <ng-content select=".modal-title"></ng-content>
         </h4>
-        <button type="button"
-                class="btn-close float-end"
-                aria-label="Close"
-                (click)="close()">
-        </button>
+        <button
+          type="button"
+          class="btn-close float-end"
+          aria-label="Close"
+          (click)="close()"
+        ></button>
       </div>
 
       <ng-content select=".modal-content"></ng-content>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/motd/motd.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/motd/motd.component.html
index 2fbe5d7f87d..c0a76aa9c9c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/motd/motd.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/motd/motd.component.html
@@ -1,8 +1,10 @@
-<cd-alert-panel *ngIf="motd"
-                size="slim"
-                [showTitle]="false"
-                [type]="motd.severity"
-                [dismissible]="motd.severity !== 'danger'"
-                (dismissed)="onDismissed()">
+<cd-alert-panel
+  *ngIf="motd"
+  size="slim"
+  [showTitle]="false"
+  [type]="motd.severity"
+  [dismissible]="motd.severity !== 'danger'"
+  (dismissed)="onDismissed()"
+>
   <span [innerHTML]="motd.message | sanitizeHtml"></span>
 </cd-alert-panel>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notification-toast/notification-toast.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notification-toast/notification-toast.component.html
index 205972ad1c6..c4357632aca 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notification-toast/notification-toast.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notification-toast/notification-toast.component.html
@@ -1,16 +1,17 @@
 <div class="cds--toast-notification-container">
   @for (toast of activeToasts$ | async; track $index) {
-  <cds-toast
-    [@toastAnimation]="'in'"
-    [notificationObj]="{
-      type: toast.type,
-      title: toast.title,
-      subtitle: toast.subtitle,
-      caption: toast.caption,
-      lowContrast: toast.lowContrast,
-      showClose: toast.showClose
-    }"
-    (close)="onToastClose(toast)">
-  </cds-toast>
+    <cds-toast
+      [@toastAnimation]="'in'"
+      [notificationObj]="{
+        type: toast.type,
+        title: toast.title,
+        subtitle: toast.subtitle,
+        caption: toast.caption,
+        lowContrast: toast.lowContrast,
+        showClose: toast.showClose
+      }"
+      (close)="onToastClose(toast)"
+    >
+    </cds-toast>
   }
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html
index cca8ffc57bd..bd0eb2ba47f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/notifications-sidebar/notifications-sidebar.component.html
@@ -1,144 +1,182 @@
 <ng-template #tasksTpl>
   <!-- Executing -->
-  <div *ngFor="let executingTask of executingTasks; trackBy:trackByFn">
+  <div *ngFor="let executingTask of executingTasks; trackBy: trackByFn">
     <div class="card tc_task border-0">
       <div class="row no-gutters">
         <div class="col-md-2 text-center">
           <span class="text-info">
-            <svg [cdsIcon]="icons.circle"
-                 [size]="icons.size16"
-                 ></svg>
+            <svg
+              [cdsIcon]="icons.circle"
+              [size]="icons.size16"
+            ></svg>
           </span>
         </div>
         <div class="col-md-9">
           <div class="card-body p-1">
             <h6 class="card-title bold">{{ executingTask.description }}</h6>
             <div class="mb-1">
-              <ngb-progressbar type="info"
-                               [value]="executingTask?.progress"
-                               [striped]="true"
-                               [animated]="true"></ngb-progressbar>
+              <ngb-progressbar
+                type="info"
+                [value]="executingTask?.progress"
+                [striped]="true"
+                [animated]="true"
+              ></ngb-progressbar>
             </div>
             <p class="card-text text-muted">
               <small class="date float-start">
                 {{ executingTask.begin_time | cdDate }}
               </small>
 
-              <span class="float-end">
-                {{ executingTask.progress || 0 }} %
-              </span>
+              <span class="float-end"> {{ executingTask.progress || 0 }} % </span>
             </p>
-
           </div>
         </div>
       </div>
     </div>
 
-    <hr>
+    <hr />
   </div>
 </ng-template>
 
 <ng-template #notificationsTpl>
   <ng-container *ngIf="notifications.length > 0">
-    <button type="button"
-            class="btn btn-light btn-block"
-            (click)="removeAll(); $event.stopPropagation()">
-      <svg [cdsIcon]="icons.trash"
-           [size]="icons.size16"
-           ></svg>
+    <button
+      type="button"
+      class="btn btn-light btn-block"
+      (click)="removeAll(); $event.stopPropagation()"
+    >
+      <svg
+        [cdsIcon]="icons.trash"
+        [size]="icons.size16"
+      ></svg>
       &nbsp;
       <ng-container i18n>Clear notifications</ng-container>
     </button>
 
-    <hr>
+    <hr />
 
-    <div *ngFor="let notification of notifications; let i = index"
-         [ngClass]="notification.borderClass">
+    <div
+      *ngFor="let notification of notifications; let i = index"
+      [ngClass]="notification.borderClass"
+    >
       <div class="card tc_notification border-0">
         <div class="row no-gutters">
           <div class="col-md-2 text-center">
-            <cd-icon [type]="notification.iconClass"
-                     [size]="icons.size24"
-                     [customClass]="notification.textClass"></cd-icon>
+            <cd-icon
+              [type]="notification.iconClass"
+              [size]="icons.size24"
+              [customClass]="notification.textClass"
+            ></cd-icon>
           </div>
           <div class="col-md-10">
             <div class="card-body p-1">
-              <button class="btn btn-link float-end mt-0 pt-0"
-                      title="Remove notification"
-                      type="button"
-                      i18n-title
-                      (click)="remove(i); $event.stopPropagation()">
-                <svg [cdsIcon]="icons.trash"
-                     [size]="icons.size16"
-                     ></svg>
+              <button
+                class="btn btn-link float-end mt-0 pt-0"
+                title="Remove notification"
+                type="button"
+                i18n-title
+                (click)="remove(i); $event.stopPropagation()"
+              >
+                <svg
+                  [cdsIcon]="icons.trash"
+                  [size]="icons.size16"
+                ></svg>
               </button>
-              <button *ngIf="notification.application === 'Prometheus' && notification.type !== 2 && !notification.alertSilenced"
-                      class="btn btn-link float-end text-muted mute m-0 p-0"
-                      title="Silence Alert"
-                      type="button"
-                      i18n-title
-                      (click)="silence(notification)">
-                <svg [cdsIcon]="icons.mute"
-                     [size]="icons.size16"
-                     ></svg>
+              <button
+                *ngIf="
+                  notification.application === 'Prometheus' &&
+                  notification.type !== 2 &&
+                  !notification.alertSilenced
+                "
+                class="btn btn-link float-end text-muted mute m-0 p-0"
+                title="Silence Alert"
+                type="button"
+                i18n-title
+                (click)="silence(notification)"
+              >
+                <svg
+                  [cdsIcon]="icons.mute"
+                  [size]="icons.size16"
+                ></svg>
               </button>
-              <button *ngIf="notification.application === 'Prometheus' && notification.type !== 2 && notification.alertSilenced"
-                      class="btn btn-link float-end text-muted mute m-0 p-0"
-                      title="Expire Silence"
-                      type="button"
-                      i18n-title
-                      (click)="expire(notification)">
-                <svg [cdsIcon]="icons.bell"
-                     [size]="icons.size16"
-                     ></svg>
+              <button
+                *ngIf="
+                  notification.application === 'Prometheus' &&
+                  notification.type !== 2 &&
+                  notification.alertSilenced
+                "
+                class="btn btn-link float-end text-muted mute m-0 p-0"
+                title="Expire Silence"
+                type="button"
+                i18n-title
+                (click)="expire(notification)"
+              >
+                <svg
+                  [cdsIcon]="icons.bell"
+                  [size]="icons.size16"
+                ></svg>
               </button>
 
-
               <h6 class="card-title bold">{{ notification.title }}</h6>
-              <p class="card-text"
-                 [innerHtml]="notification.message"></p>
+              <p
+                class="card-text"
+                [innerHtml]="notification.message"
+              ></p>
               <p class="card-text text-muted">
                 <ng-container *ngIf="notification.duration">
                   <small>
-                    <ng-container i18n>Duration:</ng-container> {{ notification.duration | duration }}
+                    <ng-container i18n>Duration:</ng-container>
+                    {{ notification.duration | duration }}
                   </small>
-                  <br>
+                  <br />
                 </ng-container>
-                <small class="date"
-                       [title]="notification.timestamp | cdDate">{{ notification.timestamp | relativeDate }}</small>
-                <i class="float-end custom-icon"
-                   [ngClass]="[notification.applicationClass]"
-                   [title]="notification.application"></i>
+                <small
+                  class="date"
+                  [title]="notification.timestamp | cdDate"
+                  >{{ notification.timestamp | relativeDate }}</small
+                >
+                <i
+                  class="float-end custom-icon"
+                  [ngClass]="[notification.applicationClass]"
+                  [title]="notification.application"
+                ></i>
               </p>
             </div>
           </div>
         </div>
       </div>
 
-      <hr>
+      <hr />
     </div>
   </ng-container>
 </ng-template>
 
 <ng-template #emptyTpl>
   <div *ngIf="notifications.length === 0 && executingTasks.length === 0">
-    <div class="message text-center"
-         i18n>There are no notifications.</div>
+    <div
+      class="message text-center"
+      i18n
+    >
+      There are no notifications.
+    </div>
   </div>
 </ng-template>
 
-<div class="card"
-     (clickOutside)="closeSidebar()"
-     [clickOutsideEnabled]="isSidebarOpened">
+<div
+  class="card"
+  (clickOutside)="closeSidebar()"
+  [clickOutsideEnabled]="isSidebarOpened"
+>
   <div class="card-header">
     <ng-container i18n>Tasks and Notifications</ng-container>
 
-    <button class="btn-close float-end"
-            tabindex="-1"
-            type="button"
-            title="close"
-            (click)="closeSidebar()">
-    </button>
+    <button
+      class="btn-close float-end"
+      tabindex="-1"
+      type="button"
+      title="close"
+      (click)="closeSidebar()"
+    ></button>
   </div>
 
   <ngx-simplebar [options]="simplebar">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/number-with-unit/number-with-unit.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/number-with-unit/number-with-unit.component.html
index 768f87e5cde..8a1ddb57d36 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/number-with-unit/number-with-unit.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/number-with-unit/number-with-unit.component.html
@@ -23,7 +23,7 @@
       [id]="unitControlName"
     >
       @for (unit of units; track unit) {
-      <option [value]="unit">{{ unit }}</option>
+        <option [value]="unit">{{ unit }}</option>
       }
     </cds-select>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/orchestrator-doc-panel/orchestrator-doc-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/orchestrator-doc-panel/orchestrator-doc-panel.component.html
index 3b6d9cfa3af..7b952c48123 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/orchestrator-doc-panel/orchestrator-doc-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/orchestrator-doc-panel/orchestrator-doc-panel.component.html
@@ -1,10 +1,15 @@
-<cd-alert-panel *ngIf="missingFeatures; else elseBlock"
-                type="info"
-                i18n>The feature is not supported in the current Orchestrator.</cd-alert-panel>
+<cd-alert-panel
+  *ngIf="missingFeatures; else elseBlock"
+  type="info"
+  i18n
+  >The feature is not supported in the current Orchestrator.</cd-alert-panel
+>
 
 <ng-template #elseBlock>
-  <cd-alert-panel type="info"
-                  i18n>Orchestrator is not available.
-    Please consult the&nbsp;<cd-doc section="orch"></cd-doc>&nbsp;on how to configure and
-    enable the functionality.</cd-alert-panel>
+  <cd-alert-panel
+    type="info"
+    i18n
+    >Orchestrator is not available. Please consult the&nbsp;<cd-doc section="orch"></cd-doc>&nbsp;on
+    how to configure and enable the functionality.</cd-alert-panel
+  >
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/page-header/page-header.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/page-header/page-header.component.html
index 3b51bd5a7e1..872447c163e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/page-header/page-header.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/page-header/page-header.component.html
@@ -2,8 +2,8 @@
   <div>
     <cds-tile class="border-top padding-inline-0">
       <p class="cds--type-heading-04">{{ title }}</p>
-      @if(description) {
-      <p class="cds--type-body-01">{{ description }}</p>
+      @if (description) {
+        <p class="cds--type-body-01">{{ description }}</p>
       }
     </cds-tile>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/performance-card/performance-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/performance-card/performance-card.component.html
index 166247ecc22..41b7259aac5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/performance-card/performance-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/performance-card/performance-card.component.html
@@ -4,74 +4,93 @@
     i18n-headerTitle
     [applyShadow]="false"
   >
-  <ng-template #header>
-    <h2 class="cds--type-heading-compact-02"
-        i18n>Performance</h2>
-     @if(!prometheusEmptyState && !storageEmptyState) {
-    <div cdsStack="horizontal"
-         gap="2">
-      <cd-time-picker
-        [dropdownSize]="'sm'"
-        [label]="'Time Span'"
-        (selectedTime)="loadCharts($event)"
-      ></cd-time-picker>
-    </div>
+    <ng-template #header>
+      <h2
+        class="cds--type-heading-compact-02"
+        i18n
+      >
+        Performance
+      </h2>
+      @if (!prometheusEmptyState && !storageEmptyState) {
+        <div
+          cdsStack="horizontal"
+          gap="2"
+        >
+          <cd-time-picker
+            [dropdownSize]="'sm'"
+            [label]="'Time Span'"
+            (selectedTime)="loadCharts($event)"
+          ></cd-time-picker>
+        </div>
+      }
+    </ng-template>
+    @if (storageEmptyState) {
+      <cd-empty-state
+        text="You must have storage configured to access this capability."
+        i18n-text
+      ></cd-empty-state>
+    } @else if (prometheusEmptyState) {
+      <cd-empty-state
+        text="You must have Prometheus configured to access this capability."
+        i18n-text
+        [imgSrc]="emptyState.locked"
+      ></cd-empty-state>
+    } @else {
+      <div
+        cdsGrid
+        [narrow]="true"
+        [condensed]="false"
+        [fullWidth]="true"
+        class="cds-mt-5 cds-mb-5"
+      >
+        <div
+          cdsRow
+          [narrow]="true"
+        >
+          <div
+            cdsCol
+            class="cds-mb-5"
+            [columnNumbers]="{ lg: 5, md: 8, sm: 12 }"
+          >
+            <cd-area-chart
+              chartTitle="IOPS"
+              i18n-chartTitle
+              [chartKey]="performanceTypes?.IOPS"
+              [dataUnit]="metricUnitMap?.iops"
+              [rawData]="chartDataSignal()?.iops"
+            >
+            </cd-area-chart>
+          </div>
+          <div
+            cdsCol
+            [columnNumbers]="{ lg: 5, md: 8, sm: 12 }"
+            class="cds-mb-5 performance-card-latency-chart"
+          >
+            <cd-area-chart
+              chartTitle="Latency"
+              i18n-chartTitle
+              [chartKey]="performanceTypes?.Latency"
+              [dataUnit]="metricUnitMap?.latency"
+              [rawData]="chartDataSignal()?.latency"
+            >
+            </cd-area-chart>
+          </div>
+          <div
+            cdsCol
+            class="cds-mb-5"
+            [columnNumbers]="{ lg: 5, md: 8, sm: 12 }"
+          >
+            <cd-area-chart
+              chartTitle="Throughput"
+              i18n-chartTitle
+              [chartKey]="performanceTypes?.Throughput"
+              [dataUnit]="metricUnitMap?.throughput"
+              [rawData]="chartDataSignal()?.throughput"
+            >
+            </cd-area-chart>
+          </div>
+        </div>
+      </div>
     }
-  </ng-template>
-  @if(storageEmptyState) {
-    <cd-empty-state
-      text="You must have storage configured to access this capability."
-      i18n-text></cd-empty-state>
-  }
-  @else if(prometheusEmptyState) {
-    <cd-empty-state
-      text="You must have Prometheus configured to access this capability."
-      i18n-text
-      [imgSrc]="emptyState.locked"></cd-empty-state>
-  }
-  @else {
-  <div cdsGrid
-       [narrow]="true"
-       [condensed]="false"
-       [fullWidth]="true"
-       class="cds-mt-5 cds-mb-5">
-    <div cdsRow
-         [narrow]="true">
-      <div cdsCol
-           class="cds-mb-5"
-           [columnNumbers]="{lg: 5, md: 8, sm: 12}">
-        <cd-area-chart
-          chartTitle="IOPS"
-          i18n-chartTitle
-          [chartKey]="performanceTypes?.IOPS"
-          [dataUnit]="metricUnitMap?.iops"
-          [rawData]="chartDataSignal()?.iops">
-        </cd-area-chart>
-      </div>
-      <div cdsCol
-           [columnNumbers]="{lg: 5, md: 8, sm: 12}"
-           class="cds-mb-5 performance-card-latency-chart">
-        <cd-area-chart
-          chartTitle="Latency"
-          i18n-chartTitle
-          [chartKey]="performanceTypes?.Latency"
-          [dataUnit]="metricUnitMap?.latency"
-          [rawData]="chartDataSignal()?.latency">
-        </cd-area-chart>
-      </div>
-      <div cdsCol
-           class="cds-mb-5"
-           [columnNumbers]="{lg: 5, md: 8, sm: 12}">
-        <cd-area-chart
-          chartTitle="Throughput"
-          i18n-chartTitle
-          [chartKey]="performanceTypes?.Throughput"
-          [dataUnit]="metricUnitMap?.throughput"
-          [rawData]="chartDataSignal()?.throughput">
-        </cd-area-chart>
-      </div>
-    </div>
-  </div>
-  }
   </cd-productive-card>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pie-chart/pie-chart.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pie-chart/pie-chart.component.html
index 3013e1307a2..7fd2da0561a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pie-chart/pie-chart.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pie-chart/pie-chart.component.html
@@ -1,5 +1,6 @@
 <ibm-pie-chart
   *ngIf="chartData && chartOptions"
   [data]="chartData"
-  [options]="chartOptions">
+  [options]="chartOptions"
+>
 </ibm-pie-chart>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html
index 1304bb4bc29..beb40f53ea8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.html
@@ -1,16 +1,20 @@
-<cds-tile class="productive-card"
-          [ngClass]="{'productive-card--shadow': applyShadow}"
-          [cdsLayer]="0">
+<cds-tile
+  class="productive-card"
+  [ngClass]="{ 'productive-card--shadow': applyShadow }"
+  [cdsLayer]="0"
+>
   <div class="productive-card-header">
     <ng-container *ngTemplateOutlet="headerTemplate || null"></ng-container>
   </div>
-  <section class="productive-card-section cds--type-body-compact-01"
-           [ngClass]="{'productive-card-section--footer': footerTemplate}">
+  <section
+    class="productive-card-section cds--type-body-compact-01"
+    [ngClass]="{ 'productive-card-section--footer': footerTemplate }"
+  >
     <ng-content></ng-content>
   </section>
-  @if(!!footerTemplate) {
-  <footer class="productive-card-footer">
-    <ng-container *ngTemplateOutlet="footerTemplate || null"></ng-container>
-  </footer>
+  @if (!!footerTemplate) {
+    <footer class="productive-card-footer">
+      <ng-container *ngTemplateOutlet="footerTemplate || null"></ng-container>
+    </footer>
   }
 </cds-tile>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/progress/progress.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/progress/progress.component.html
index 377a903edf5..0692f5c4b62 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/progress/progress.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/progress/progress.component.html
@@ -1,45 +1,61 @@
 <div class="d-flex flex-column justify-content-center align-items-center bold">
   <ng-container>
-    <h3 class="text-center"
-        [ngClass]="{ 'mt-3': status === 'in-progress' && isPaused }"
-        *ngIf="!value || actionName === 'upgrading'">
-      <cds-loading *ngIf="status === 'in-progress' && isPaused; else spinningIcon"
-                   [isActive]="false"
-                   [overlay]="false"
-                   size="sm"></cds-loading>
+    <h3
+      class="text-center"
+      [ngClass]="{ 'mt-3': status === 'in-progress' && isPaused }"
+      *ngIf="!value || actionName === 'upgrading'"
+    >
+      <cds-loading
+        *ngIf="status === 'in-progress' && isPaused; else spinningIcon"
+        [isActive]="false"
+        [overlay]="false"
+        size="sm"
+      ></cds-loading>
       <ng-template #spinningIcon>
-        <cds-loading [isActive]="true"
-                     [overlay]="false"
-                     size="sm"></cds-loading>
+        <cds-loading
+          [isActive]="true"
+          [overlay]="false"
+          size="sm"
+        ></cds-loading>
       </ng-template>
     </h3>
 
-    <h3 class="text-center"
-        [ngClass]="status === 'in-progress' && isPaused ? ['mt-3', 'mb-4'] : 'mt-2'"
-        *ngIf="label">
+    <h3
+      class="text-center"
+      [ngClass]="status === 'in-progress' && isPaused ? ['mt-3', 'mb-4'] : 'mt-2'"
+      *ngIf="label"
+    >
       {{ label }}
     </h3>
 
-    <h5 class="text-center mt-3"
-        *ngIf="subLabel && status === 'in-progress' && !isPaused">
+    <h5
+      class="text-center mt-3"
+      *ngIf="subLabel && status === 'in-progress' && !isPaused"
+    >
       {{ subLabel }}
     </h5>
 
-    <h5 class="text-center mt-3"
-        *ngIf="description">
+    <h5
+      class="text-center mt-3"
+      *ngIf="description"
+    >
       {{ description }}
     </h5>
 
-    <p class="text-center text-muted mt-3"
-       *ngIf="subDescription">
+    <p
+      class="text-center text-muted mt-3"
+      *ngIf="subDescription"
+    >
       {{ subDescription }}
     </p>
   </ng-container>
 
   <div class="w-50 row h-100 d-flex justify-content-center align-items-center mt-4">
     <div class="text-center w-75">
-      <ng-container *ngIf="completedItems && completedItems.length > 0"
-                    i18n>
+      <ng-container
+        *ngIf="completedItems && completedItems.length > 0"
+        i18n
+      >
         Finished {{ actionName }}:
         <span class="text-success">
           {{ completedItems }}
@@ -48,23 +64,29 @@
 
       <!-- Progress Bar -->
       <div class="mt-2">
-        <ngb-progressbar type="info"
-                         [value]="value"
-                         [striped]="true"
-                         [animated]="!isPaused"></ngb-progressbar>
+        <ngb-progressbar
+          type="info"
+          [value]="value"
+          [striped]="true"
+          [animated]="!isPaused"
+        ></ngb-progressbar>
       </div>
       <p class="card-text text-muted">
         <span class="float-end">{{ value || 0 }} %</span>
       </p>
     </div>
 
-    <h4 class="text-center m-2"
-        *ngIf="helperText">
+    <h4
+      class="text-center m-2"
+      *ngIf="helperText"
+    >
       {{ helperText }}
     </h4>
 
-    <h5 class="text-center mt-2"
-        *ngIf="footerText">
+    <h5
+      class="text-center mt-2"
+      *ngIf="footerText"
+    >
       {{ footerText }}
     </h5>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pwd-expiration-notification/pwd-expiration-notification.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pwd-expiration-notification/pwd-expiration-notification.component.html
index b1bc5150ab2..d891abbc138 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pwd-expiration-notification/pwd-expiration-notification.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/pwd-expiration-notification/pwd-expiration-notification.component.html
@@ -1,16 +1,34 @@
-<cd-alert-panel class="no-margin-bottom"
-                [type]="alertType"
-                *ngIf="displayNotification"
-                [showTitle]="false"
-                size="slim"
-                [dismissible]="alertType !== 'danger'"
-                (dismissed)="onDismissed()">
-  <div *ngIf="expirationDays === 0"
-       i18n>Your password will expire in <strong>less than 1</strong> day. Click
-    <a routerLink="/user-profile/edit"
-       class="alert-link">here</a> to change it now.</div>
-  <div *ngIf="expirationDays > 0"
-       i18n>Your password will expire in <strong>{{ expirationDays }}</strong> day(s). Click
-  <a routerLink="/user-profile/edit"
-     class="alert-link">here</a> to change it now.</div>
+<cd-alert-panel
+  class="no-margin-bottom"
+  [type]="alertType"
+  *ngIf="displayNotification"
+  [showTitle]="false"
+  size="slim"
+  [dismissible]="alertType !== 'danger'"
+  (dismissed)="onDismissed()"
+>
+  <div
+    *ngIf="expirationDays === 0"
+    i18n
+  >
+    Your password will expire in <strong>less than 1</strong> day. Click
+    <a
+      routerLink="/user-profile/edit"
+      class="alert-link"
+      >here</a
+    >
+    to change it now.
+  </div>
+  <div
+    *ngIf="expirationDays > 0"
+    i18n
+  >
+    Your password will expire in <strong>{{ expirationDays }}</strong> day(s). Click
+    <a
+      routerLink="/user-profile/edit"
+      class="alert-link"
+      >here</a
+    >
+    to change it now.
+  </div>
 </cd-alert-panel>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html
index bef3e49b1ae..0d9e9d61caf 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select-badges/select-badges.component.html
@@ -1,27 +1,35 @@
-<cd-select #cdSelect
-           [data]="data"
-           [options]="options"
-           [messages]="messages"
-           [selectionLimit]="selectionLimit"
-           [customBadges]="customBadges"
-           [customBadgeValidators]="customBadgeValidators"
-           elemClass="me-2 select-menu-edit"
-           (selection)="selection.emit($event)">
-  <svg [cdsIcon]="icons.edit"
-       [size]="icons.size20"
-       class="cds-info-color"></svg>
+<cd-select
+  #cdSelect
+  [data]="data"
+  [options]="options"
+  [messages]="messages"
+  [selectionLimit]="selectionLimit"
+  [customBadges]="customBadges"
+  [customBadgeValidators]="customBadgeValidators"
+  elemClass="me-2 select-menu-edit"
+  (selection)="selection.emit($event)"
+>
+  <svg
+    [cdsIcon]="icons.edit"
+    [size]="icons.size20"
+    class="cds-info-color"
+  ></svg>
 </cd-select>
 
 <span *ngFor="let dataItem of data">
   <cds-tag class="tag-dark me-2">
     <span class="me-2">{{ dataItem }}</span>
-      <a  class="tags-remove"
-          (click)="cdSelect.removeItem(dataItem)"
-          tabindex="0"
-          (keydown.enter)="cdSelect.removeItem(dataItem)">
-      <svg [cdsIcon]="icons.destroy"
-           [size]="icons.size20"
-           class="cds-white"></svg>
+    <a
+      class="tags-remove"
+      (click)="cdSelect.removeItem(dataItem)"
+      tabindex="0"
+      (keydown.enter)="cdSelect.removeItem(dataItem)"
+    >
+      <svg
+        [cdsIcon]="icons.destroy"
+        [size]="icons.size20"
+        class="cds-white"
+      ></svg>
     </a>
   </cds-tag>
 </span>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html
index e6580017b97..2ec03bc93a6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/select/select.component.html
@@ -1,83 +1,105 @@
 <ng-template #popTemplate>
-  <form name="form"
-        #formDir="ngForm"
-        [formGroup]="form"
-        novalidate>
+  <form
+    name="form"
+    #formDir="ngForm"
+    [formGroup]="form"
+    novalidate
+  >
     <div>
-      <input type="text"
-             formControlName="filter"
-             i18n-placeholder
-             [placeholder]="messages.filter"
-             (keyup)="$event.keyCode === 13 ? selectOption() : updateFilter()"
-             class="form-control text-center" />
+      <input
+        type="text"
+        formControlName="filter"
+        i18n-placeholder
+        [placeholder]="messages.filter"
+        (keyup)="$event.keyCode === 13 ? selectOption() : updateFilter()"
+        class="form-control text-center"
+      />
       <ng-container *ngFor="let error of Object.keys(messages.customValidations)">
-        <span class="invalid-feedback text-center d-block"
-              *ngIf="form.showError('filter', formDir) && filter.hasError(error)">
+        <span
+          class="invalid-feedback text-center d-block"
+          *ngIf="form.showError('filter', formDir) && filter.hasError(error)"
+        >
           {{ messages.customValidations[error] }}
         </span>
       </ng-container>
     </div>
   </form>
-  <div *ngFor="let option of filteredOptions"
-       class="select-menu-item"
-       [ngClass]="{'help-block disabled': (data.length === selectionLimit || !option.enabled) && !option.selected}"
-       (click)="triggerSelection(option)"
-       tabindex="0"
-       (keydown.enter)="triggerSelection(option)">
+  <div
+    *ngFor="let option of filteredOptions"
+    class="select-menu-item"
+    [ngClass]="{
+      'help-block disabled': (data.length === selectionLimit || !option.enabled) && !option.selected
+    }"
+    (click)="triggerSelection(option)"
+    tabindex="0"
+    (keydown.enter)="triggerSelection(option)"
+  >
     <div class="select-menu-item-icon">
-      <i [ngClass]="[icons.check]"
-         aria-hidden="true"
-         *ngIf="option.selected"></i>
+      <i
+        [ngClass]="[icons.check]"
+        aria-hidden="true"
+        *ngIf="option.selected"
+      ></i>
       &nbsp;
     </div>
     <div class="select-menu-item-content">
       {{ option.name }}
       <ng-container *ngIf="option.description">
-        <br>
-        <small class="form-text text-muted">
-          {{ option.description }}&nbsp;
-        </small>
+        <br />
+        <small class="form-text text-muted"> {{ option.description }}&nbsp; </small>
       </ng-container>
     </div>
   </div>
-  <div *ngIf="isCreatable()"
-       class="select-menu-item"
-       (click)="addCustomOption()"
-       tabindex="0"
-       (keydown.enter)="addCustomOption()">
+  <div
+    *ngIf="isCreatable()"
+    class="select-menu-item"
+    (click)="addCustomOption()"
+    tabindex="0"
+    (keydown.enter)="addCustomOption()"
+  >
     <div class="select-menu-item-icon">
-      <i [ngClass]="[icons.tag]"
-         aria-hidden="true"></i>
+      <i
+        [ngClass]="[icons.tag]"
+        aria-hidden="true"
+      ></i>
       &nbsp;
     </div>
-    <div class="select-menu-item-content">
-      {{ messages.add }} '{{ filter.value }}'
-    </div>
+    <div class="select-menu-item-content">{{ messages.add }} '{{ filter.value }}'</div>
   </div>
-  <div class="is-invalid"
-       *ngIf="data.length === selectionLimit">
-    <span class="form-text text-muted text-center text-warning"
-          [ngbTooltip]="messages.selectionLimit.tooltip"
-          *ngIf="data.length === selectionLimit">
+  <div
+    class="is-invalid"
+    *ngIf="data.length === selectionLimit"
+  >
+    <span
+      class="form-text text-muted text-center text-warning"
+      [ngbTooltip]="messages.selectionLimit.tooltip"
+      *ngIf="data.length === selectionLimit"
+    >
       {{ messages.selectionLimit.text }}
     </span>
   </div>
 </ng-template>
 
-<a class="select-menu-edit float-start"
-   [ngClass]="elemClass"
-   [ngbPopover]="popTemplate"
-   data-testid="select-menu-edit"
-   *ngIf="customBadges || options.length > 0">
+<a
+  class="select-menu-edit float-start"
+  [ngClass]="elemClass"
+  [ngbPopover]="popTemplate"
+  data-testid="select-menu-edit"
+  *ngIf="customBadges || options.length > 0"
+>
   <ng-content></ng-content>
 </a>
 
-<span class="form-text text-muted float-start"
-      *ngIf="data.length === 0 && !(!customBadges && options.length === 0)">
+<span
+  class="form-text text-muted float-start"
+  *ngIf="data.length === 0 && !(!customBadges && options.length === 0)"
+>
   {{ messages.empty }}
 </span>
 
-<span class="form-text text-muted  float-start"
-      *ngIf="!customBadges && options.length === 0">
+<span
+  class="form-text text-muted float-start"
+  *ngIf="!customBadges && options.length === 0"
+>
   {{ messages.noOptions }}
 </span>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html
index d2cd4c23f30..9d258fe5623 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/setup-step-card/setup-step-card.component.html
@@ -1,4 +1,7 @@
-<div class="setup-step-card" [class.setup-step-card--loading]="isLoading">
+<div
+  class="setup-step-card"
+  [class.setup-step-card--loading]="isLoading"
+>
   <div class="setup-step-card__step-row">
     <span class="cds--type-heading-compact-01">{{ stepNumber }}.</span>
     <span class="cds--type-heading-compact-01">{{ title }}</span>
@@ -8,13 +11,13 @@
   </p>
   <div class="setup-step-card__info">
     @if (isLoading) {
-    <cd-loading-panel></cd-loading-panel>
+      <cd-loading-panel></cd-loading-panel>
     } @else if (isConfigured) {
-    <cd-icon type="success"></cd-icon>
-    <span class="cds--type-label-01">{{ statusMessage }}</span>
+      <cd-icon type="success"></cd-icon>
+      <span class="cds--type-label-01">{{ statusMessage }}</span>
     } @else {
-    <cd-icon type="infoCircle"></cd-icon>
-    <span class="cds--type-label-01">{{ statusMessage }}</span>
+      <cd-icon type="infoCircle"></cd-icon>
+      <span class="cds--type-label-01">{{ statusMessage }}</span>
     }
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html
index a591e49fb7d..61fa5ee37c0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/side-panel/side-panel.component.html
@@ -1,23 +1,31 @@
-<div class="overlay"
-     (click)="close()"
-     tabindex="0"
-     (keydown.enter)="close()"
-     *ngIf="expanded && overlay"></div>
+<div
+  class="overlay"
+  (click)="close()"
+  tabindex="0"
+  (keydown.enter)="close()"
+  *ngIf="expanded && overlay"
+></div>
 
-<cds-panel [expanded]="expanded"
-           [attr.panel-size]="size"
-           [cdsLayer]="layer"
-           [cdsTheme]="theme">
+<cds-panel
+  [expanded]="expanded"
+  [attr.panel-size]="size"
+  [cdsLayer]="layer"
+  [cdsTheme]="theme"
+>
   <div>
-    <cds-icon-button kind="ghost"
-                     class="float-end"
-                     title="Close"
-                     i18n-title
-                     (click)="close()">
+    <cds-icon-button
+      kind="ghost"
+      class="float-end"
+      title="Close"
+      i18n-title
+      (click)="close()"
+    >
       <svg cdsIcon="close"></svg>
     </cds-icon-button>
-    <div class="panel-header"
-         *ngIf="headerText">
+    <div
+      class="panel-header"
+      *ngIf="headerText"
+    >
       <p class="cds--type-heading-03">{{ headerText }}</p>
       <ng-content select="[panel-header-description]"></ng-content>
     </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html
index 493b776f4b1..cdacb9dd738 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sidebar-layout/sidebar-layout.component.html
@@ -1,21 +1,23 @@
 @if (title) {
-<header class="sidebar-header">
-  <h2 class="cds--type-heading-05">{{ title }}</h2>
-</header>
+  <header class="sidebar-header">
+    <h2 class="cds--type-heading-05">{{ title }}</h2>
+  </header>
 }
 <div class="sidebar-layout-container sidebar-layout--full">
   <div class="sidebar-layout-shell">
     <cds-sidenav
       [expanded]="true"
-      class="sidebar-layout-nav cds--side-nav--fixed">
+      class="sidebar-layout-nav cds--side-nav--fixed"
+    >
       @for (item of items; track item.label) {
-      <cds-sidenav-item
-        [route]="item.route"
-        [routeExtras]="item.routeExtras"
-        [useRouter]="true"
-        [routerLinkActiveOptions]="item.routerLinkActiveOptions || { exact: false }">
-        <span class="cds--type-heading-compact-01">{{ item.label }}</span>
-      </cds-sidenav-item>
+        <cds-sidenav-item
+          [route]="item.route"
+          [routeExtras]="item.routeExtras"
+          [useRouter]="true"
+          [routerLinkActiveOptions]="item.routerLinkActiveOptions || { exact: false }"
+        >
+          <span class="cds--type-heading-compact-01">{{ item.label }}</span>
+        </cds-sidenav-item>
       }
     </cds-sidenav>
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sparkline/sparkline.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sparkline/sparkline.component.html
index d66efd2d006..331be5fed0d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sparkline/sparkline.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/sparkline/sparkline.component.html
@@ -1,13 +1,19 @@
-<div class="chart-container"
-     [ngStyle]="style">
-  <canvas baseChart
-          #sparkCanvas
-          [data]="chartData"
-          [options]="options"
-          [type]="'line'">
+<div
+  class="chart-container"
+  [ngStyle]="style"
+>
+  <canvas
+    baseChart
+    #sparkCanvas
+    [data]="chartData"
+    [options]="options"
+    [type]="'line'"
+  >
   </canvas>
-  <div class="chartjs-tooltip"
-       #sparkTooltip>
+  <div
+    class="chartjs-tooltip"
+    #sparkTooltip
+  >
     <table></table>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/submit-button/submit-button.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/submit-button/submit-button.component.html
index f871b22e7f5..9ba7877fd7e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/submit-button/submit-button.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/submit-button/submit-button.component.html
@@ -1,15 +1,19 @@
-<button [type]="type"
-        class="tc_submitButton"
-        [ngClass]="{'w-100': modalForm}"
-        [disabled]="loading || disabled"
-        (click)="submit($event)"
-        [attr.aria-label]="ariaLabel"
-        size="lg"
-        [cdsButton]="buttonType"
-        modal-primary-focus>
+<button
+  [type]="type"
+  class="tc_submitButton"
+  [ngClass]="{ 'w-100': modalForm }"
+  [disabled]="loading || disabled"
+  (click)="submit($event)"
+  [attr.aria-label]="ariaLabel"
+  size="lg"
+  [cdsButton]="buttonType"
+  modal-primary-focus
+>
   <ng-content></ng-content>
-  <cds-loading [isActive]="loading"
-               [overlay]="false"
-               size="sm"
-               *ngIf="loading"></cds-loading>
+  <cds-loading
+    [isActive]="loading"
+    [overlay]="false"
+    size="sm"
+    *ngIf="loading"
+  ></cds-loading>
 </button>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
index 53f974c1109..11e86406a67 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/tearsheet/tearsheet.component.html
@@ -1,214 +1,261 @@
 <!-- Full Tearsheet -->
- @if(type === 'full') {
-<div
-  cdsGrid
-  class="tearsheet--full"
-  [useCssGrid]="true"
-  [fullWidth]="true">
-  <div cdsCol
-       class="tearsheet-cols--full"
-       [columnNumbers]="{'lg': 16, 'md': 16, 'sm': 16}">
-    <!-- Tearsheet Header -->
-    <header
-      class="tearsheet-header tearsheet-header--full border-subtle-block-end">
-      <h4 class="cds--type-heading-04 tearsheet-header-title">
-        {{title}}
-      </h4>
-      <p class="cds--type-body-02 tearsheet-header-description">
-        {{description}}
-      </p>
-    </header>
-    <section cdsGrid
-             class="tearsheet-body"
-             [useCssGrid]="true"
-             [fullWidth]="true">
-      <!-- Tearsheet Influencer-->
-      <div cdsCol
-           [columnNumbers]="{'lg': 3, 'md': 3, 'sm': 3}"
-           class="tearsheet-left-influencer border-subtle-inline-end">
-        <cds-progress-indicator
-          orientation="vertical"
-          [steps]="steps"
-          [current]="currentStep"
-          spacing="equal"
-          (stepSelected)="onStepSelect($event)">
-        </cds-progress-indicator>
-      </div>
-      <div cdsCol
-           [columnNumbers]="{'lg': 13, 'md': 13, 'sm': 13}"
-           class="tearsheet-main">
-        <!-- Tearsheet Content Area -->
-        <div class="tearsheet-content tearsheet-content--full"
-             [ngStyle]="contentOverflowStyle">
-        <ng-container
-          *ngTemplateOutlet="activeStepTemplate">
-        </ng-container>
-        </div>
-        <!-- Tearsheet Footer -->
-        <cds-modal-footer class="tearsheet-footer tearsheet-footer--full border-subtle-top">
-          <button cdsButton="ghost"
-                  class="tearsheet-footer-cancel"
-                  (click)="closeTearsheet()"
-                  size="xl"
-                  type="button"
-                  i18n>Cancel</button>
-          @if (steps.length > 1) {
-          <button cdsButton="secondary"
-                  size="xl"
-                  [disabled]="currentStep === 0"
-                  (click)="onPrevious()"
-                  type="button"
-                  i18n>Previous</button>
-          }
-          @if (currentStep === lastStep) {
-          <button cdsButton="primary"
-                  size="xl"
-                  class="tearsheet-footer-submit"
-                  [disabled]="isSubmitLoading"
-                  (click)="onSubmit()"
-                  type="button"
-                  i18n>
-            @if (isSubmitLoading) {
-            <cds-loading
-              [isActive]="isSubmitLoading"
-              [overlay]="false"
-              size="sm">
-            </cds-loading>
-              {{submitButtonLoadingLabel}}...
-            }
-            @else {
-              {{submitButtonLabel}}
-            }
-          </button>
-          }
-          @else {
-          <button cdsButton="primary"
-                  size="xl"
-                  [disabled]="steps[currentStep]?.invalid"
-                  type="button"
-                  (click)="onNext()"
-                  i18n>Next</button>
-          }
-        </cds-modal-footer>
-      </div>
-    </section>
-  </div>
-</div>
-}
-@else {
-<!-- Wide Tearsheet -->
-<cds-modal
-  [size]="size"
-  [open]="isOpen"
-  (overlaySelected)="closeTearsheet()">
-  <!-- Tearsheet Header -->
-  <header
-    class="tearsheet-header border-subtle-block-end">
-    <h4 cdsModalHeaderHeading
-        class="cds--type-heading-04 tearsheet-header-title">
-        {{title}}
-    </h4>
-    <p class="cds--type-body-02 tearsheet-header-description">
-      {{description}}
-    </p>
-  </header>
-  <section cdsGrid
-           class="tearsheet-body"
-           [condensed]="true"
-           [useCssGrid]="true"
-           [fullWidth]="true">
-    <!-- Tearsheet Left Influencer-->
-    @if (steps.length > 1) {
-    <div cdsCol
-         [columnNumbers]="{lg: 3, md: 3, sm: 3}"
-         class="tearsheet-left-influencer border-subtle-inline-end">
-      <cds-progress-indicator
-        orientation="vertical"
-        [steps]="steps"
-        [current]="currentStep"
-        spacing="equal"
-        (stepSelected)="onStepSelect($event)">
-      </cds-progress-indicator>
-    </div>
-    }
-    <div cdsCol
-         [columnNumbers]="steps.length > 1 ? {lg: 13, md: 13, sm: 13} : {lg: 16, md: 16, sm: 16}"
-         class="tearsheet-main">
-      @if (showRightInfluencer) {
-      <!-- Tearsheet content with right influencer  -->
-      <div
+@if (type === 'full') {
+  <div
+    cdsGrid
+    class="tearsheet--full"
+    [useCssGrid]="true"
+    [fullWidth]="true"
+  >
+    <div
+      cdsCol
+      class="tearsheet-cols--full"
+      [columnNumbers]="{ lg: 16, md: 16, sm: 16 }"
+    >
+      <!-- Tearsheet Header -->
+      <header class="tearsheet-header tearsheet-header--full border-subtle-block-end">
+        <h4 class="cds--type-heading-04 tearsheet-header-title">
+          {{ title }}
+        </h4>
+        <p class="cds--type-body-02 tearsheet-header-description">
+          {{ description }}
+        </p>
+      </header>
+      <section
         cdsGrid
-        [condensed]="true"
+        class="tearsheet-body"
         [useCssGrid]="true"
-        [fullWidth]="true">
+        [fullWidth]="true"
+      >
+        <!-- Tearsheet Influencer-->
         <div
           cdsCol
-          class="tearsheet-content"
-          [columnNumbers]="{ lg: 10 }"
-          [ngStyle]="contentOverflowStyle">
-          <ng-container *ngTemplateOutlet="activeStepTemplate"></ng-container>
+          [columnNumbers]="{ lg: 3, md: 3, sm: 3 }"
+          class="tearsheet-left-influencer border-subtle-inline-end"
+        >
+          <cds-progress-indicator
+            orientation="vertical"
+            [steps]="steps"
+            [current]="currentStep"
+            spacing="equal"
+            (stepSelected)="onStepSelect($event)"
+          >
+          </cds-progress-indicator>
         </div>
-        <aside
+        <div
           cdsCol
-          [columnNumbers]="{ lg: 3 }"
-          class="tearsheet-right-influencer">
-          <ng-container *ngTemplateOutlet="rightInfluencerTemplate"></ng-container>
-        </aside>
-      </div>
-      }
-      @else {
-      <!-- Tearsheet content without right influencer -->
-      <div class="tearsheet-content"
-           [ngStyle]="contentOverflowStyle">
-        <ng-container *ngTemplateOutlet="activeStepTemplate"></ng-container>
-      </div>
-      }
-      <!-- Tearsheet Footer -->
-      <cds-modal-footer class="tearsheet-footer border-subtle-top">
-        <button cdsButton="ghost"
-                (click)="closeTearsheet()"
-                size="xl"
+          [columnNumbers]="{ lg: 13, md: 13, sm: 13 }"
+          class="tearsheet-main"
+        >
+          <!-- Tearsheet Content Area -->
+          <div
+            class="tearsheet-content tearsheet-content--full"
+            [ngStyle]="contentOverflowStyle"
+          >
+            <ng-container *ngTemplateOutlet="activeStepTemplate"> </ng-container>
+          </div>
+          <!-- Tearsheet Footer -->
+          <cds-modal-footer class="tearsheet-footer tearsheet-footer--full border-subtle-top">
+            <button
+              type="button"
+              cdsButton="ghost"
+              class="tearsheet-footer-cancel"
+              (click)="closeTearsheet()"
+              size="xl"
+              i18n
+            >
+              Cancel
+            </button>
+            @if (steps.length > 1) {
+              <button
                 type="button"
-                i18n>Cancel</button>
-        @if (steps.length > 1) {
-        <button cdsButton="secondary"
+                cdsButton="secondary"
                 size="xl"
                 [disabled]="currentStep === 0"
                 (click)="onPrevious()"
+                i18n
+              >
+                Previous
+              </button>
+            }
+            @if (currentStep === lastStep) {
+              <button
                 type="button"
-                i18n>Previous</button>
-        }
-        @if (currentStep === lastStep) {
-        <button cdsButton="primary"
+                cdsButton="primary"
                 size="xl"
                 class="tearsheet-footer-submit"
                 [disabled]="isSubmitLoading"
                 (click)="onSubmit()"
+                i18n
+              >
+                @if (isSubmitLoading) {
+                  <cds-loading
+                    [isActive]="isSubmitLoading"
+                    [overlay]="false"
+                    size="sm"
+                  >
+                  </cds-loading>
+                  {{ submitButtonLoadingLabel }}...
+                } @else {
+                  {{ submitButtonLabel }}
+                }
+              </button>
+            } @else {
+              <button
                 type="button"
-                i18n>
-          @if (isSubmitLoading) {
-          <cds-loading
-            [isActive]="isSubmitLoading"
-            [overlay]="false"
-            size="sm">
-          </cds-loading>
-            {{submitButtonLoadingLabel}}...
-          }
-          @else {
-            {{submitButtonLabel}}
-          }
-        </button>
-        }
-        @else {
-        <button cdsButton="primary"
+                cdsButton="primary"
                 size="xl"
                 [disabled]="steps[currentStep]?.invalid"
                 (click)="onNext()"
-                type="button"
-                i18n>Next</button>
-        }
-      </cds-modal-footer>
+                i18n
+              >
+                Next
+              </button>
+            }
+          </cds-modal-footer>
+        </div>
+      </section>
     </div>
-  </section>
-</cds-modal>
+  </div>
+} @else {
+  <!-- Wide Tearsheet -->
+  <cds-modal
+    [size]="size"
+    [open]="isOpen"
+    (overlaySelected)="closeTearsheet()"
+  >
+    <!-- Tearsheet Header -->
+    <header class="tearsheet-header border-subtle-block-end">
+      <h4
+        cdsModalHeaderHeading
+        class="cds--type-heading-04 tearsheet-header-title"
+      >
+        {{ title }}
+      </h4>
+      <p class="cds--type-body-02 tearsheet-header-description">
+        {{ description }}
+      </p>
+    </header>
+    <section
+      cdsGrid
+      class="tearsheet-body"
+      [condensed]="true"
+      [useCssGrid]="true"
+      [fullWidth]="true"
+    >
+      <!-- Tearsheet Left Influencer-->
+      @if (steps.length > 1) {
+        <div
+          cdsCol
+          [columnNumbers]="{ lg: 3, md: 3, sm: 3 }"
+          class="tearsheet-left-influencer border-subtle-inline-end"
+        >
+          <cds-progress-indicator
+            orientation="vertical"
+            [steps]="steps"
+            [current]="currentStep"
+            spacing="equal"
+            (stepSelected)="onStepSelect($event)"
+          >
+          </cds-progress-indicator>
+        </div>
+      }
+      <div
+        cdsCol
+        [columnNumbers]="steps.length > 1 ? { lg: 13, md: 13, sm: 13 } : { lg: 16, md: 16, sm: 16 }"
+        class="tearsheet-main"
+      >
+        @if (showRightInfluencer) {
+          <!-- Tearsheet content with right influencer  -->
+          <div
+            cdsGrid
+            [condensed]="true"
+            [useCssGrid]="true"
+            [fullWidth]="true"
+          >
+            <div
+              cdsCol
+              class="tearsheet-content"
+              [columnNumbers]="{ lg: 10 }"
+              [ngStyle]="contentOverflowStyle"
+            >
+              <ng-container *ngTemplateOutlet="activeStepTemplate"></ng-container>
+            </div>
+            <aside
+              cdsCol
+              [columnNumbers]="{ lg: 3 }"
+              class="tearsheet-right-influencer"
+            >
+              <ng-container *ngTemplateOutlet="rightInfluencerTemplate"></ng-container>
+            </aside>
+          </div>
+        } @else {
+          <!-- Tearsheet content without right influencer -->
+          <div
+            class="tearsheet-content"
+            [ngStyle]="contentOverflowStyle"
+          >
+            <ng-container *ngTemplateOutlet="activeStepTemplate"></ng-container>
+          </div>
+        }
+        <!-- Tearsheet Footer -->
+        <cds-modal-footer class="tearsheet-footer border-subtle-top">
+          <button
+            type="button"
+            cdsButton="ghost"
+            (click)="closeTearsheet()"
+            size="xl"
+            i18n
+          >
+            Cancel
+          </button>
+          @if (steps.length > 1) {
+            <button
+              type="button"
+              cdsButton="secondary"
+              size="xl"
+              [disabled]="currentStep === 0"
+              (click)="onPrevious()"
+              i18n
+            >
+              Previous
+            </button>
+          }
+          @if (currentStep === lastStep) {
+            <button
+              type="button"
+              cdsButton="primary"
+              size="xl"
+              class="tearsheet-footer-submit"
+              [disabled]="isSubmitLoading"
+              (click)="onSubmit()"
+              i18n
+            >
+              @if (isSubmitLoading) {
+                <cds-loading
+                  [isActive]="isSubmitLoading"
+                  [overlay]="false"
+                  size="sm"
+                >
+                </cds-loading>
+                {{ submitButtonLoadingLabel }}...
+              } @else {
+                {{ submitButtonLabel }}
+              }
+            </button>
+          } @else {
+            <button
+              type="button"
+              cdsButton="primary"
+              size="xl"
+              [disabled]="steps[currentStep]?.invalid"
+              (click)="onNext()"
+              i18n
+            >
+              Next
+            </button>
+          }
+        </cds-modal-footer>
+      </div>
+    </section>
+  </cds-modal>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/telemetry-notification/telemetry-notification.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/telemetry-notification/telemetry-notification.component.html
index 444724d6723..05ab3fd49b3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/telemetry-notification/telemetry-notification.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/telemetry-notification/telemetry-notification.component.html
@@ -1,16 +1,23 @@
-<cd-alert-panel *ngIf="displayNotification"
-                class="no-margin-bottom"
-                [showTitle]="false"
-                size="slim"
-                [type]="notificationSeverity"
-                [dismissible]="notificationSeverity !== 'danger'"
-                [actionName]="'Configure Telemetry'"
-                (action)="onConfigure()"
-                (dismissed)="onDismissed()">
-  <span i18n>Activate
-    <a href="https://docs.ceph.com/en/latest/mgr/telemetry/"
-       target="_blank"
-       rel="noopener"> Telemetry
-    </a>: The Ceph community welcomes your support in enhancing our efforts. Please activate the telemetry module.
+<cd-alert-panel
+  *ngIf="displayNotification"
+  class="no-margin-bottom"
+  [showTitle]="false"
+  size="slim"
+  [type]="notificationSeverity"
+  [dismissible]="notificationSeverity !== 'danger'"
+  [actionName]="'Configure Telemetry'"
+  (action)="onConfigure()"
+  (dismissed)="onDismissed()"
+>
+  <span i18n
+    >Activate
+    <a
+      href="https://docs.ceph.com/en/latest/mgr/telemetry/"
+      target="_blank"
+      rel="noopener"
+    >
+      Telemetry </a
+    >: The Ceph community welcomes your support in enhancing our efforts. Please activate the
+    telemetry module.
   </span>
 </cd-alert-panel>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/text-label-list/text-label-list.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/text-label-list/text-label-list.component.html
index 0a3a2016a78..37c2da3cf85 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/text-label-list/text-label-list.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/text-label-list/text-label-list.component.html
@@ -1,21 +1,27 @@
 @for (value of values; track $index) {
-  <cds-text-label [helperText]="helperText && $index === values.length - 1 ? helperText : null"
-                  i18n-helperText
-                  i18n>
+  <cds-text-label
+    [helperText]="helperText && $index === values.length - 1 ? helperText : null"
+    i18n-helperText
+    i18n
+  >
     <div class="cds-input-group">
-      <input cdsText
-             type="text"
-             [placeholder]="placeholder"
-             [value]="value"
-             (input)="onInputChange($index, $event.target.value)" />
-      @if ($index > 0 ) {
-      <cds-icon-button kind="ghost"
-                       (click)="deleteInput($index)"
-                       size="md">
-        <cd-icon type="trash"></cd-icon>
-      </cds-icon-button>
+      <input
+        cdsText
+        type="text"
+        [placeholder]="placeholder"
+        [value]="value"
+        (input)="onInputChange($index, $event.target.value)"
+      />
+      @if ($index > 0) {
+        <cds-icon-button
+          kind="ghost"
+          (click)="deleteInput($index)"
+          size="md"
+        >
+          <cd-icon type="trash"></cd-icon>
+        </cds-icon-button>
       }
     </div>
-    {{$index === 0 ? label : ''}}
+    {{ $index === 0 ? label : '' }}
   </cds-text-label>
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/time-picker/time-picker.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/time-picker/time-picker.component.html
index c1089b2cb8c..ccb43682fd6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/time-picker/time-picker.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/time-picker/time-picker.component.html
@@ -5,6 +5,7 @@
   [inline]="true"
   class="timepicker-dropdown"
   [label]="label"
-  i18n>
+  i18n
+>
   <cds-dropdown-list [items]="timeOptions"></cds-dropdown-list>
 </cds-dropdown>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html
index 4a4f0a06c33..417eeb0192c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/upgradable/upgradable.component.html
@@ -1,26 +1,34 @@
 <div *ngIf="upgradeStatus$ | async as status; else isUpgradable">
   <ng-container *ngIf="status.is_paused || status.in_progress; else isUpgradable">
-    <h5 *ngIf="status.is_paused; else inProgress"
-        i18n>
+    <h5
+      *ngIf="status.is_paused; else inProgress"
+      i18n
+    >
       Upgrade is paused
     </h5>
     <ng-template #inProgress>
-      <a href="#/upgrade/progress"
-         i18n>
+      <a
+        href="#/upgrade/progress"
+        i18n
+      >
         <cds-inline-loading></cds-inline-loading>
-          Upgrading {{executingTask?.progress}}%
+        Upgrading {{ executingTask?.progress }}%
       </a>
     </ng-template>
   </ng-container>
 </div>
 
 <ng-template #isUpgradable>
-  <div *ngIf="upgradeInfo$ | async as info"
-       i18n>
-    <h5 *ngIf="info.versions.length > 0"
-        (click)="upgradeModal()"
-        tabindex="0"
-        (keydown.enter)="upgradeModal()">
+  <div
+    *ngIf="upgradeInfo$ | async as info"
+    i18n
+  >
+    <h5
+      *ngIf="info.versions.length > 0"
+      (click)="upgradeModal()"
+      tabindex="0"
+      (keydown.enter)="upgradeModal()"
+    >
       <i [ngClass]="icons.up"></i>
       Upgrade available
     </h5>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/usage-bar/usage-bar.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/usage-bar/usage-bar.component.html
index fc9990b7422..a42843002ff 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/usage-bar/usage-bar.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/usage-bar/usage-bar.component.html
@@ -6,10 +6,12 @@
     <ng-container i18n>{{ customLabel }}</ng-container>
   </ng-template>
 </ng-container>
-<ibm-meter-chart *ngIf="used >=0 && total > 0; else noDataFound"
-                 [data]="data"
-                 [options]="options">
+<ibm-meter-chart
+  *ngIf="used >= 0 && total > 0; else noDataFound"
+  [data]="data"
+  [options]="options"
+>
 </ibm-meter-chart>
 <ng-template #noDataFound>
-  <span i18n>{{noDataText}}</span>
+  <span i18n>{{ noDataText }}</span>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html
index 10695fbb010..7d7b33a6ff1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.html
@@ -1,27 +1,41 @@
 <ng-container *ngIf="items.length">
-  <h3 i18n
-      *ngIf="title">{{title}}</h3>
-  <input type="text"
-         placeholder="Filter by name..."
-         (keyup)="updateFilter()"
-         [id]="inputIdentifier"
-         class="form-control text-center mb-2">
+  <h3
+    i18n
+    *ngIf="title"
+  >
+    {{ title }}
+  </h3>
+  <input
+    type="text"
+    placeholder="Filter by name..."
+    (keyup)="updateFilter()"
+    [id]="inputIdentifier"
+    class="form-control text-center mb-2"
+  />
   <div class="overflow-auto">
     <ul class="nav flex-column nav-pills">
-      <li class="nav-item"
-          *ngFor="let item of filteredItems; trackBy: trackByFn">
-        <a class="nav-link"
-           [class.active]="!activeItem"
-           (click)="selectItem()"
-           tabindex="0"
-           (keydown.enter)="selectItem()"
-           *ngIf="item === ''">_nogroup</a>
-        <a class="nav-link text-decoration-none text-break"
-           [class.active]="item === activeItem"
-           (click)="selectItem(item)"
-           tabindex="0"
-           (keydown.enter)="selectItem(item)"
-           *ngIf="item !== ''">{{item}}</a>
+      <li
+        class="nav-item"
+        *ngFor="let item of filteredItems; trackBy: trackByFn"
+      >
+        <a
+          class="nav-link"
+          [class.active]="!activeItem"
+          (click)="selectItem()"
+          tabindex="0"
+          (keydown.enter)="selectItem()"
+          *ngIf="item === ''"
+          >_nogroup</a
+        >
+        <a
+          class="nav-link text-decoration-none text-break"
+          [class.active]="item === activeItem"
+          (click)="selectItem(item)"
+          tabindex="0"
+          (keydown.enter)="selectItem(item)"
+          *ngIf="item !== ''"
+          >{{ item }}</a
+        >
       </li>
     </ul>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/wizard/wizard.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/wizard/wizard.component.html
index e5efa0b1e62..3480c7f4c04 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/wizard/wizard.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/wizard/wizard.component.html
@@ -2,6 +2,7 @@
   <cds-progress-indicator
     orientation="vertical"
     [steps]="stepsTitle"
-    [current]="currentStep?.stepIndex">
+    [current]="currentStep?.stepIndex"
+  >
   </cds-progress-indicator>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.html
index da5080f3cc2..e55dcd5aca8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.html
@@ -1,54 +1,76 @@
-<cd-table [data]="data"
-          [columns]="columns"
-          columnMode="flex"
-          [toolHeader]="false"
-          [autoReload]="false"
-          [autoSave]="false"
-          [footer]="false"
-          size="xs"
-          [layer]="0"
-          [limit]="0">
+<cd-table
+  [data]="data"
+  [columns]="columns"
+  columnMode="flex"
+  [toolHeader]="false"
+  [autoReload]="false"
+  [autoSave]="false"
+  [footer]="false"
+  size="xs"
+  [layer]="0"
+  [limit]="0"
+>
 </cd-table>
-<ng-template #cellScopeCheckboxTpl
-             let-column="data.column"
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #cellScopeCheckboxTpl
+  let-column="data.column"
+  let-row="data.row"
+  let-value="data.value"
+>
   <div class="m-2">
-    <cds-checkbox id="scope_{{ row.scope }}"
-                  [checked]="isRowChecked(row.scope)"
-                  [disabled]="isDisabled"
-                  (checkedChange)="onClickCellCheckbox(row.scope, column.prop, $event)"
-                  i18n>
-    <span class="datatable-permissions-scope-cell-label custom-control-label"
-          for="scope_{{ row.scope }}">{{ value }}</span>
+    <cds-checkbox
+      id="scope_{{ row.scope }}"
+      [checked]="isRowChecked(row.scope)"
+      [disabled]="isDisabled"
+      (checkedChange)="onClickCellCheckbox(row.scope, column.prop, $event)"
+      i18n
+    >
+      <span
+        class="datatable-permissions-scope-cell-label custom-control-label"
+        for="scope_{{ row.scope }}"
+        >{{ value }}</span
+      >
     </cds-checkbox>
   </div>
 </ng-template>
-<ng-template #cellPermissionCheckboxTpl
-             let-column="data.column"
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #cellPermissionCheckboxTpl
+  let-column="data.column"
+  let-row="data.row"
+  let-value="data.value"
+>
   <div class="m-2">
-    <cds-checkbox [id]="row.scope + '-' + column.prop"
-                  [checked]="value"
-                  [disabled]="isDisabled"
-                  (checkedChange)="onClickCellCheckbox(row.scope, column.prop, $event)"
-                  i18n>
-    <span class="custom-control-label"
-          [for]="row.scope + '-' + column.prop"></span>
+    <cds-checkbox
+      [id]="row.scope + '-' + column.prop"
+      [checked]="value"
+      [disabled]="isDisabled"
+      (checkedChange)="onClickCellCheckbox(row.scope, column.prop, $event)"
+      i18n
+    >
+      <span
+        class="custom-control-label"
+        [for]="row.scope + '-' + column.prop"
+      ></span>
     </cds-checkbox>
   </div>
 </ng-template>
-<ng-template #headerPermissionCheckboxTpl
-             let-column="data">
+<ng-template
+  #headerPermissionCheckboxTpl
+  let-column="data"
+>
   <div class="m-2">
-    <cds-checkbox id="header_{{ column.prop }}"
-                  [disabled]="isDisabled"
-                  [checked]="isHeaderChecked(column.prop)"
-                  (checkedChange)="onClickHeaderCheckbox(column.prop, $event)"
-                  i18n>
-    <span class="datatable-permissions-header-cell-label custom-control-label"
-          for="header_{{ column.prop }}">{{ column.name }}</span>
+    <cds-checkbox
+      id="header_{{ column.prop }}"
+      [disabled]="isDisabled"
+      [checked]="isHeaderChecked(column.prop)"
+      (checkedChange)="onClickHeaderCheckbox(column.prop, $event)"
+      i18n
+    >
+      <span
+        class="datatable-permissions-header-cell-label custom-control-label"
+        for="header_{{ column.prop }}"
+        >{{ column.name }}</span
+      >
     </cds-checkbox>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/crud-table/crud-table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/crud-table/crud-table.component.html
index 4abcd7ca69a..ca5dadee2a6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/crud-table/crud-table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/crud-table/crud-table.component.html
@@ -1,76 +1,102 @@
-<ul class="nav nav-tabs"
-    *ngIf="tabs">
-  <li class="nav-item"
-      *ngFor="let tab of tabs; keyvalue">
-    <a class="nav-link"
-       [routerLink]="tab.url"
-       routerLinkActive="active"
-       ariaCurrentWhenActive="page"
-       [routerLinkActiveOptions]="{exact: true}"
-       i18n>{{tab.name}}</a>
+<ul
+  class="nav nav-tabs"
+  *ngIf="tabs"
+>
+  <li
+    class="nav-item"
+    *ngFor="let tab of tabs; keyvalue"
+  >
+    <a
+      class="nav-link"
+      [routerLink]="tab.url"
+      routerLinkActive="active"
+      ariaCurrentWhenActive="page"
+      [routerLinkActiveOptions]="{ exact: true }"
+      i18n
+      >{{ tab.name }}</a
+    >
   </li>
 </ul>
 
 <ng-container *ngIf="meta">
   <cd-table
-      [data]="data$ | async"
-      [columns]="meta.table.columns"
-      [columnMode]="meta.table.columnMode"
-      (setExpandedRow)="setExpandedRow($event)"
-      [hasDetails]="meta.detail_columns.length > 0"
-      [selectionType]="meta.table.selectionType"
-      (updateSelection)="updateSelection($event)"
-      [toolHeader]="meta.table.toolHeader">
+    [data]="data$ | async"
+    [columns]="meta.table.columns"
+    [columnMode]="meta.table.columnMode"
+    (setExpandedRow)="setExpandedRow($event)"
+    [hasDetails]="meta.detail_columns.length > 0"
+    [selectionType]="meta.table.selectionType"
+    (updateSelection)="updateSelection($event)"
+    [toolHeader]="meta.table.toolHeader"
+  >
     <div class="table-actions">
-      <cd-table-actions [permission]="permission"
-                        [selection]="selection"
-                        class="btn-group"
-                        id="crud-table-actions"
-                        [tableActions]="meta.actions">
+      <cd-table-actions
+        [permission]="permission"
+        [selection]="selection"
+        class="btn-group"
+        id="crud-table-actions"
+        [tableActions]="meta.actions"
+      >
       </cd-table-actions>
     </div>
     <ng-container *ngIf="expandedRow && meta.detail_columns.length > 0">
-      <table *cdTableDetail
-             class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md">
+      <table
+        *cdTableDetail
+        class="cds--data-table--sort cds--data-table--no-border cds--data-table cds--data-table--md"
+      >
         <tbody>
           <tr *ngFor="let column of meta.detail_columns">
-            <td i18n
-                class="bold">{{ column }}</td>
-            <td><pre>{{ expandedRow[column] }}</pre></td>
+            <td
+              i18n
+              class="bold"
+            >
+              {{ column }}
+            </td>
+            <td>
+              <pre>{{ expandedRow[column] }}</pre>
+            </td>
           </tr>
         </tbody>
       </table>
     </ng-container>
-
   </cd-table>
 </ng-container>
 
-<ng-template #tagDictTpl
-             let-value="data.value">
+<ng-template
+  #tagDictTpl
+  let-value="data.value"
+>
   <span *ngFor="let instance of value | keyvalue; last as isLast">
-    <cds-tag class="tag-background-primary" >{{ instance.key }}: {{ instance.value }}</cds-tag>
+    <cds-tag class="tag-background-primary">{{ instance.key }}: {{ instance.value }}</cds-tag>
     <ng-container *ngIf="!isLast">&nbsp;</ng-container>
   </span>
 </ng-template>
 
-<ng-template #dateTpl
-             let-value="data.value">
+<ng-template
+  #dateTpl
+  let-value="data.value"
+>
   <span>{{ value | cdDate }}</span>
 </ng-template>
 
-<ng-template #durationTpl
-             let-value="data.value">
+<ng-template
+  #durationTpl
+  let-value="data.value"
+>
   <span>{{ value | duration }}</span>
 </ng-template>
 
 <ng-template #exportDataModalTpl>
   <div class="d-flex flex-column align-items-center w-100 gap-3">
-    <textarea readonly
-              class="form-control w-100 bg-light height-400"
-              id="authExportArea">{{ modalState.authExportData }}</textarea>
-    <cd-copy-2-clipboard-button class="align-self-end"
-                                source="authExportArea">
-
+    <textarea
+      readonly
+      class="form-control w-100 bg-light height-400"
+      id="authExportArea"
+      >{{ modalState.authExportData }}</textarea>
+    <cd-copy-2-clipboard-button
+      class="align-self-end"
+      source="authExportArea"
+    >
     </cd-copy-2-clipboard-button>
   </div>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
index 1846c419b9d..6021cfa1f5d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
@@ -1,42 +1,49 @@
 <ng-container *ngIf="!dropDownOnly; else dropDownOnlyTpl">
-  <button *ngIf="currentAction && tableActions.length > 0"
-          type="button"
-          [cdsButton]="currentAction.buttonKind"
-          title="{{ useDisableDesc(currentAction) }}"
-          (click)="useClickAction(currentAction)"
-          [disabled]="disableSelectionAction(currentAction)"
-          [routerLink]="useRouterLink(currentAction)"
-          [attr.aria-label]="currentAction.name"
-          [preserveFragment]="currentAction.preserveFragment ? '' : null"
-          data-testid="primary-action">
+  <button
+    *ngIf="currentAction && tableActions.length > 0"
+    type="button"
+    [cdsButton]="currentAction.buttonKind"
+    title="{{ useDisableDesc(currentAction) }}"
+    (click)="useClickAction(currentAction)"
+    [disabled]="disableSelectionAction(currentAction)"
+    [routerLink]="useRouterLink(currentAction)"
+    [attr.aria-label]="currentAction.name"
+    [preserveFragment]="currentAction.preserveFragment ? '' : null"
+    data-testid="primary-action"
+  >
     <span i18n>{{ currentAction.name }}</span>
-    <svg class="cds--btn__icon"
-         cdsIcon="add"
-         size="16"></svg>
+    <svg
+      class="cds--btn__icon"
+      cdsIcon="add"
+      size="16"
+    ></svg>
   </button>
   <ng-container *ngIf="primaryDropDown">
-    <button class="primary-dropdown-btn"
-            [attr.aria-label]="dropDownOnly"
-            [offset]="{ x: -210, y: 65 }"
-            [cdsOverflowMenu]="overflowMenuTpl"
-            data-testid="table-action-btn"
-            type="button">
-      <svg
-           [cdsIcon]="icons.chevronDown"></svg>
+    <button
+      class="primary-dropdown-btn"
+      [attr.aria-label]="dropDownOnly"
+      [offset]="{ x: -210, y: 65 }"
+      [cdsOverflowMenu]="overflowMenuTpl"
+      data-testid="table-action-btn"
+      type="button"
+    >
+      <svg [cdsIcon]="icons.chevronDown"></svg>
     </button>
     <ng-template #overflowMenuTpl>
       <ng-container *ngFor="let action of dropDownActions">
-        <cds-overflow-menu-option *ngIf="currentAction !== action"
-                                  class="{{ toClassName(action) }}"
-                                  title="{{ useDisableDesc(action) }}"
-                                  (click)="useClickAction(action)"
-                                  [routerLink]="useRouterLink(action)"
-                                  [preserveFragment]="action.preserveFragment ? '' : null"
-                                  [disabled]="disableSelectionAction(action)"
-                                  [attr.aria-label]="action.name"
-                                  data-testid="table-action-option-btn"
-                                  i18n>
-        {{ action.name }}
+        <cds-overflow-menu-option
+          *ngIf="currentAction !== action"
+          class="{{ toClassName(action) }}"
+          title="{{ useDisableDesc(action) }}"
+          (click)="useClickAction(action)"
+          [routerLink]="useRouterLink(action)"
+          [preserveFragment]="action.preserveFragment ? '' : null"
+          [disabled]="disableSelectionAction(action)"
+          [attr.aria-label]="action.name"
+          data-testid="table-action-option-btn"
+          i18n
+        >
+          {{ action.name }}
         </cds-overflow-menu-option>
       </ng-container>
     </ng-template>
@@ -44,42 +51,54 @@
 </ng-container>
 
 <ng-template #caret>
-  <button [cdsButton]="currentAction.buttonKind"
-          class="caret-btn"
-          type="button">
-    <svg class="cds--btn__icon"
-         [cdsIcon]="icons.chevronDown"></svg>
+  <button
+    [cdsButton]="currentAction.buttonKind"
+    class="caret-btn"
+    type="button"
+  >
+    <svg
+      class="cds--btn__icon"
+      [cdsIcon]="icons.chevronDown"
+    ></svg>
   </button>
 </ng-template>
 
 <ng-template #dropDownOnlyTpl>
-  <cds-overflow-menu [customTrigger]="customTrigger"
-                     [flip]="true"
-                     [offset]="dropDownOnlyOffset"
-                     data-testid="table-action-btn"
-                     class="d-flex justify-content-end">
+  <cds-overflow-menu
+    [customTrigger]="customTrigger"
+    [flip]="true"
+    [offset]="dropDownOnlyOffset"
+    data-testid="table-action-btn"
+    class="d-flex justify-content-end"
+  >
     <ng-container *ngFor="let action of dropDownActions">
-      <cds-overflow-menu-option *ngIf="currentAction !== action"
-                                class="{{ toClassName(action) }}"
-                                title="{{ useDisableDesc(action) }}"
-                                (click)="useClickAction(action)"
-                                [routerLink]="useRouterLink(action)"
-                                [preserveFragment]="action.preserveFragment ? '' : null"
-                                [disabled]="disableSelectionAction(action)"
-                                [attr.aria-label]="action.name"
-                                data-testid="table-action-option-btn"
-                                i18n>
-      {{ action.name }}
+      <cds-overflow-menu-option
+        *ngIf="currentAction !== action"
+        class="{{ toClassName(action) }}"
+        title="{{ useDisableDesc(action) }}"
+        (click)="useClickAction(action)"
+        [routerLink]="useRouterLink(action)"
+        [preserveFragment]="action.preserveFragment ? '' : null"
+        [disabled]="disableSelectionAction(action)"
+        [attr.aria-label]="action.name"
+        data-testid="table-action-option-btn"
+        i18n
+      >
+        {{ action.name }}
       </cds-overflow-menu-option>
     </ng-container>
   </cds-overflow-menu>
 </ng-template>
 
 <ng-template #customTrigger>
-  <button [cdsButton]="dropDownOnlyBtnColor"
-          type="button">
+  <button
+    [cdsButton]="dropDownOnlyBtnColor"
+    type="button"
+  >
     <span i18n>{{ dropDownOnly }}</span>
-    <svg class="override-position-static cds--btn__icon"
-         [cdsIcon]="icons.chevronDown"></svg>
+    <svg
+      class="override-position-static cds--btn__icon"
+      [cdsIcon]="icons.chevronDown"
+    ></svg>
   </button>
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-key-value/table-key-value.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-key-value/table-key-value.component.html
index faa517c768c..505ced9c2f2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-key-value/table-key-value.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-key-value/table-key-value.component.html
@@ -1,25 +1,30 @@
 <div class="key-value-table">
-  <cd-table #table
-            [data]="tableData || []"
-            [columns]="columns"
-            columnMode="flex"
-            [toolHeader]="false"
-            [autoReload]="autoReload"
-            [customCss]="customCss"
-            [autoSave]="false"
-            [header]="false"
-            [footer]="false"
-            [limit]="0">
+  <cd-table
+    #table
+    [data]="tableData || []"
+    [columns]="columns"
+    columnMode="flex"
+    [toolHeader]="false"
+    [autoReload]="autoReload"
+    [customCss]="customCss"
+    [autoSave]="false"
+    [header]="false"
+    [footer]="false"
+    [limit]="0"
+  >
   </cd-table>
 </div>
 
-<ng-template #valueCellTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #valueCellTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <span
     class="pre-wrap"
     *ngIf="row.key in multilineTextKeys; else normalText"
-  >{{ value }}</span>
+    >{{ value }}</span
+  >
   <ng-template #normalText>
     <span>{{ value }}</span>
   </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html
index 30f7ebfa9ef..4b0511bdd75 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-pagination/table-pagination.component.html
@@ -1,6 +1,8 @@
-<nav class="pagination"
-     aria-label="Pagination"
-     i18n-aria-label>
+<nav
+  class="pagination"
+  aria-label="Pagination"
+  i18n-aria-label
+>
   <button
     class="pagination__btn pagination__btn_first"
     aria-label="Go to first page"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
index 637da0ff771..745c00aaef4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table/table.component.html
@@ -1,41 +1,51 @@
-<cds-table-container [cdsLayer]="layer"
-                     [cdsTheme]="theme"
-                     class="content-theme">
+<cds-table-container
+  [cdsLayer]="layer"
+  [cdsTheme]="theme"
+  class="content-theme"
+>
   <cds-table-header *ngIf="headerTitle">
-    <h4 cdsTableHeaderTitle
-        i18n>
+    <h4
+      cdsTableHeaderTitle
+      i18n
+    >
       @if (isHeaderTitleString) {
         {{ headerTitle }}
-    } @else {
-      <ng-container *ngTemplateOutlet="headerTitle"></ng-container>
-    }
+      } @else {
+        <ng-container *ngTemplateOutlet="headerTitle"></ng-container>
+      }
     </h4>
-    <p cdsTableHeaderDescription
-       i18n
-       *ngIf="headerDescription">
-      {{headerDescription}}
+    <p
+      cdsTableHeaderDescription
+      i18n
+      *ngIf="headerDescription"
+    >
+      {{ headerDescription }}
     </p>
   </cds-table-header>
-  <cds-table-toolbar #toolbar
-                     *ngIf="toolHeader"
-                     (cancel)="onBatchActionsCancel()"
-                     [model]="selectionType === 'multiClick' ? model : []"
-                     [batchText]="{ SINGLE: '1 item selected', MULTIPLE: '{{count}} items selected' }">
+  <cds-table-toolbar
+    #toolbar
+    *ngIf="toolHeader"
+    (cancel)="onBatchActionsCancel()"
+    [model]="selectionType === 'multiClick' ? model : []"
+    [batchText]="{ SINGLE: '1 item selected', MULTIPLE: '{{count}} items selected' }"
+  >
     <!-- batch actions -->
     <cds-table-toolbar-actions *ngIf="tableActions?.dropDownActions.length > 0">
       <ng-container *ngFor="let action of tableActions?.dropDownActions">
-        <button *ngIf="tableActions.currentAction !== action"
-                cdsButton="primary"
-                [tabindex]="toolbar.selected ? 0 : -1"
-                class="{{ tableActions.toClassName(action) }}"
-                title="{{ tableActions.useDisableDesc(action) }}"
-                (click)="tableActions.useClickAction(action)"
-                [routerLink]="tableActions.useRouterLink(action)"
-                [preserveFragment]="action.preserveFragment ? '' : null"
-                [disabled]="tableActions.disableSelectionAction(action)"
-                [attr.aria-label]="action.name"
-                type="button"
-                i18n>
+        <button
+          *ngIf="tableActions.currentAction !== action"
+          cdsButton="primary"
+          [tabindex]="toolbar.selected ? 0 : -1"
+          class="{{ tableActions.toClassName(action) }}"
+          title="{{ tableActions.useDisableDesc(action) }}"
+          (click)="tableActions.useClickAction(action)"
+          [routerLink]="tableActions.useRouterLink(action)"
+          [preserveFragment]="action.preserveFragment ? '' : null"
+          [disabled]="tableActions.disableSelectionAction(action)"
+          [attr.aria-label]="action.name"
+          type="button"
+          i18n
+        >
           {{ action.name }}
         </button>
       </ng-container>
@@ -46,35 +56,51 @@
       <ng-content select=".table-filter"></ng-content>
       <!-- end custom filter slot -->
       <!-- search -->
-      <cds-table-toolbar-search *ngIf="searchField"
-                                [expandable]="false"
-                                [(ngModel)]="search"
-                                aria-label="search"
-                                (valueChange)="updateFilter($event)"
-                                (clear)="onClearSearch()">
+      <cds-table-toolbar-search
+        *ngIf="searchField"
+        [expandable]="false"
+        [(ngModel)]="search"
+        aria-label="search"
+        (valueChange)="updateFilter($event)"
+        (clear)="onClearSearch()"
+      >
       </cds-table-toolbar-search>
       <!-- end search -->
       <!-- column filters -->
-       @if (columnFilters.length !== 0 || customFilter) {
-        <div cdsPopover
-             [isOpen]="openFilterPopover"
-             [autoAlign]="true"
-             [caret]="false">
+      @if (columnFilters.length !== 0 || customFilter) {
+        <div
+          cdsPopover
+          [isOpen]="openFilterPopover"
+          [autoAlign]="true"
+          [caret]="false"
+        >
           <cds-icon-button
             kind="ghost"
             class="toolbar-action"
             (click)="toggleFilterPopover()"
-            data-testid="filter-button">
-            <svg [cdsIcon]="icons.filter"
-                 [size]="icons.size16"
-                 class="cds--toolbar-action__icon"></svg>
+            data-testid="filter-button"
+          >
+            <svg
+              [cdsIcon]="icons.filter"
+              [size]="icons.size16"
+              class="cds--toolbar-action__icon"
+            ></svg>
           </cds-icon-button>
           <cds-popover-content [cdsLayer]="0">
-            <div cdsStack="horizontal" class="filter--header">
-              <span class="cds--type-heading-03" i18n>Filters</span>
-              <cds-icon-button kind="ghost"
-                              size="sm"
-                              (click)="toggleFilterPopover()">
+            <div
+              cdsStack="horizontal"
+              class="filter--header"
+            >
+              <span
+                class="cds--type-heading-03"
+                i18n
+                >Filters</span
+              >
+              <cds-icon-button
+                kind="ghost"
+                size="sm"
+                (click)="toggleFilterPopover()"
+              >
                 <cd-icon type="destroy"></cd-icon>
               </cds-icon-button>
             </div>
@@ -82,175 +108,223 @@
               cdsGrid
               [fullWidth]="true"
               [condensed]="true"
-              [narrow]="true">
-            @if (columnFilters.length !== 0) {
-            @for (filter of columnFilters; track filter.column.name; let i = $index) {
-            <div
-              cdsRow
-              [cdsLayer]="2"
-              class="cds-mt-4">
+              [narrow]="true"
+            >
+              @if (columnFilters.length !== 0) {
+                @for (filter of columnFilters; track filter.column.name; let i = $index) {
+                  <div
+                    cdsRow
+                    [cdsLayer]="2"
+                    class="cds-mt-4"
+                  >
+                    <!-- filter names column -->
+                    <div
+                      cdsCol
+                      [columnNumbers]="{ sm: 4, md: 4 }"
+                    >
+                      <cds-text-label
+                        >Filter
+                        <input
+                          cdsText
+                          readonly
+                          size="md"
+                          [id]="'filter_key_' + i"
+                          [name]="'filter_key_' + i"
+                          [value]="filter.column.name"
+                        />
+                      </cds-text-label>
+                    </div>
 
-              <!-- filter names column -->
-              <div
-                cdsCol
-                [columnNumbers]="{sm: 4, md: 4}">
-                <cds-text-label>Filter
-                  <input cdsText
-                         readonly
-                         size="md"
-                         [id]="'filter_key_' + i"
-                         [name]="'filter_key_' + i"
-                         [value]="filter.column.name">
-                </cds-text-label>
-              </div>
-
-              <!-- filter values column -->
-              <div
-                cdsCol
-                [columnNumbers]="{sm: 4, md: 4}">
-                <cds-select (valueChange)="onChangeFilter($event, filter)"
-                            [id]="'filter_value_' + i"
-                            label="Value"
-                            size="md"
-                            [attr.data-testid]="'filter-select-' + filter.column.name"
-                            i18n-label>
-                  <option i18n>Any</option>
-                  @for (option of filter.options; track option.raw) {
-                    <option [value]="option.raw"
-                            [selected]="option.raw === selectedFilters[filter.column.name]">
-                      {{ option.formatted }}
-                    </option>
+                    <!-- filter values column -->
+                    <div
+                      cdsCol
+                      [columnNumbers]="{ sm: 4, md: 4 }"
+                    >
+                      <cds-select
+                        (valueChange)="onChangeFilter($event, filter)"
+                        [id]="'filter_value_' + i"
+                        label="Value"
+                        size="md"
+                        [attr.data-testid]="'filter-select-' + filter.column.name"
+                        i18n-label
+                      >
+                        <option i18n>Any</option>
+                        @for (option of filter.options; track option.raw) {
+                          <option
+                            [value]="option.raw"
+                            [selected]="option.raw === selectedFilters[filter.column.name]"
+                          >
+                            {{ option.formatted }}
+                          </option>
+                        }
+                      </cds-select>
+                    </div>
+                  </div>
+                }
+              }
+              @if (customFilter) {
+                @for (filter of stagedCustomFilters; track filter.id; let i = $index) {
+                  @if (isCustomFilterString) {
+                    <div
+                      cdsRow
+                      class="cds-mt-4 cds--type-body-02"
+                    >
+                      Filter {{ customFilter }}:
+                    </div>
                   }
+                  <div
+                    cdsRow
+                    [cdsLayer]="1"
+                    class="cds-mt-4"
+                  >
+                    <div
+                      cdsCol
+                      [columnNumbers]="{ sm: 4, md: 3, lg: 7 }"
+                    >
+                      <cds-text-label
+                        >Key
+                        <input
+                          cdsText
+                          size="md"
+                          [id]="'filter_key_' + i"
+                          [value]="filter.key"
+                          (input)="filter.key = $any($event.target).value"
+                        />
+                      </cds-text-label>
+                    </div>
 
-                </cds-select>
-              </div>
-            </div>
-          }}
-          @if (customFilter) {
-          @for (filter of stagedCustomFilters; track filter.id; let i = $index) {
-            @if (isCustomFilterString) {
-              <div cdsRow
-                   class="cds-mt-4 cds--type-body-02">
-                Filter {{ customFilter }}:
-              </div>
-            }
-            <div cdsRow
-                 [cdsLayer]="1"
-                 class="cds-mt-4">
-              <div cdsCol
-                   [columnNumbers]="{sm: 4, md: 3, lg: 7}">
-                <cds-text-label>Key
-                  <input cdsText
-                         size="md"
-                         [id]="'filter_key_' + i"
-                         [value]="filter.key"
-                         (input)="filter.key = $any($event.target).value">
-                </cds-text-label>
-              </div>
+                    <div
+                      cdsCol
+                      [columnNumbers]="{ sm: 4, md: 3, lg: 7 }"
+                    >
+                      <cds-text-label
+                        >Value
+                        <input
+                          cdsText
+                          size="md"
+                          [id]="'filter_value_' + i"
+                          [value]="filter.value"
+                          (input)="filter.value = $any($event.target).value"
+                        />
+                      </cds-text-label>
+                    </div>
 
-              <div cdsCol
-                   [columnNumbers]="{sm: 4, md: 3, lg: 7}">
-                <cds-text-label>Value
-                  <input cdsText
-                         size="md"
-                         [id]="'filter_value_' + i"
-                         [value]="filter.value"
-                         (input)="filter.value = $any($event.target).value">
-                </cds-text-label>
+                    @if (i !== 0) {
+                      <div
+                        cdsCol
+                        [columnNumbers]="{ sm: 2, md: 2, lg: 2 }"
+                        class="cds-mt-6"
+                      >
+                        <cds-icon-button
+                          kind="ghost"
+                          size="sm"
+                          (click)="removeCustomFilter(filter.id)"
+                        >
+                          <cd-icon type="trash"></cd-icon>
+                        </cds-icon-button>
+                      </div>
+                    }
+                  </div>
+                }
+                @if (stagedCustomFilters.length < 5) {
+                  <div
+                    cdsRow
+                    class="cds-mt-4"
+                  >
+                    <div cdsCol>
+                      <button
+                        cdsButton="tertiary"
+                        size="md"
+                        type="button"
+                        (click)="addCustomFilter()"
+                      >
+                        Add new filter rule +
+                      </button>
+                    </div>
+                  </div>
+                }
+              }
             </div>
 
-            @if (i !== 0) {
-            <div cdsCol
-                 [columnNumbers]="{sm: 2, md: 2, lg: 2}"
-                class="cds-mt-6">
-              <cds-icon-button kind="ghost"
-                               size="sm"
-                               (click)="removeCustomFilter(filter.id)">
-                <cd-icon type="trash"></cd-icon>
-              </cds-icon-button>
-            </div>
-            }
-          </div>
-          }
-            @if (stagedCustomFilters.length < 5) {
-            <div cdsRow
-                class="cds-mt-4">
-              <div cdsCol>
-                <button
-                  cdsButton="tertiary"
-                  size="md"
-                  type="button"
-                  (click)="addCustomFilter()">Add new filter rule +</button>
-              </div>
-            </div>
-            }
-          }
-          </div>
+            <div class="filter--footer">
+              <button
+                cdsButton="secondary"
+                size="lg"
+                data-testid="clear-filters"
+                type="button"
+                (click)="onClearFilters()"
+              >
+                <ng-container i18n>Clear all</ng-container>
+              </button>
 
-          <div class="filter--footer">
-            <button cdsButton="secondary"
-                    size="lg"
-                    data-testid="clear-filters"
-                    type="button"
-                    (click)="onClearFilters()">
-              <ng-container i18n>Clear all</ng-container>
-            </button>
-
-            <button cdsButton="primary"
-                    size="lg"
-                    data-testid="apply-filters"
-                    [disabled]="isApplyFilterDisabled"
-                    type="button"
-                    (click)="onSubmitFilter()">
-              <ng-container i18n>Apply</ng-container>
-            </button>
-          </div>
+              <button
+                cdsButton="primary"
+                size="lg"
+                data-testid="apply-filters"
+                [disabled]="isApplyFilterDisabled"
+                type="button"
+                (click)="onSubmitFilter()"
+              >
+                <ng-container i18n>Apply</ng-container>
+              </button>
+            </div>
           </cds-popover-content>
         </div>
       }
       <!-- end column filters -->
       <!-- refresh button -->
       <cds-icon-button
-              [kind]="status.type"
-              [disabled]="!fetchData?.observers?.length"
-              (click)="refreshBtn()"
-              [title]="status.msg"
-              [description]="status.msg"
-              i18n-title
-              i18n-description
-              class="toolbar-action"
-              placement="bottom"
-              *ngIf="fetchData?.observers?.length > 0">
-        <svg [cdsIcon]="icons.refresh"
-             [size]="icons.size16"
-             [ngClass]="{ 'cds--toolbar-action__icon': true, 'reload': loadingIndicator }"></svg>
+        [kind]="status.type"
+        [disabled]="!fetchData?.observers?.length"
+        (click)="refreshBtn()"
+        [title]="status.msg"
+        [description]="status.msg"
+        i18n-title
+        i18n-description
+        class="toolbar-action"
+        placement="bottom"
+        *ngIf="fetchData?.observers?.length > 0"
+      >
+        <svg
+          [cdsIcon]="icons.refresh"
+          [size]="icons.size16"
+          [ngClass]="{ 'cds--toolbar-action__icon': true, reload: loadingIndicator }"
+        ></svg>
       </cds-icon-button>
       <!-- end refresh button -->
       <!-- show hide columns -->
-      <button cdsButton="ghost"
-              class="toolbar-action"
-              type="button"
-              [cdsOverflowMenu]="showHideColumnsRef"
-              placement="bottom"
-              [flip]="true"
-              [offset]="{ x: 3, y: 0 }">
-        <svg [cdsIcon]="icons.dataTable"
-             [size]="icons.size16"
-             class="cds--toolbar-action__icon"></svg>
+      <button
+        cdsButton="ghost"
+        class="toolbar-action"
+        type="button"
+        [cdsOverflowMenu]="showHideColumnsRef"
+        placement="bottom"
+        [flip]="true"
+        [offset]="{ x: 3, y: 0 }"
+      >
+        <svg
+          [cdsIcon]="icons.dataTable"
+          [size]="icons.size16"
+          class="cds--toolbar-action__icon"
+        ></svg>
       </button>
       <ng-template #showHideColumnsRef>
-        <div class="vstack gap-3 p-3"
-             (click)="$event.stopPropagation()"
-             tabindex="0"
-             (keydown.enter)="$event.stopPropagation()"
-             [cdsTheme]="theme">
+        <div
+          class="vstack gap-3 p-3"
+          (click)="$event.stopPropagation()"
+          tabindex="0"
+          (keydown.enter)="$event.stopPropagation()"
+          [cdsTheme]="theme"
+        >
           <ng-container *ngFor="let column of localColumns">
-            <cds-checkbox *ngIf="!column?.isInvisible"
-                          id="{{ column.prop }}{{ tableName }}"
-                          name="{{ column.prop }}{{ tableName }}"
-                          [checked]="!column?.isHidden"
-                          (checkedChange)="toggleColumn(column);">{{ column.name }}
-          </cds-checkbox>
+            <cds-checkbox
+              *ngIf="!column?.isInvisible"
+              id="{{ column.prop }}{{ tableName }}"
+              name="{{ column.prop }}{{ tableName }}"
+              [checked]="!column?.isHidden"
+              (checkedChange)="toggleColumn(column)"
+              >{{ column.name }}
+            </cds-checkbox>
           </ng-container>
         </div>
       </ng-template>
@@ -261,139 +335,170 @@
     </cds-table-toolbar-content>
   </cds-table-toolbar>
   <!-- filter chips for column filters -->
-   @if (toolHeader && columnFiltered) {
+  @if (toolHeader && columnFiltered) {
     <div class="filter-tags">
       <div
         class="align-items-center"
         cdsStack="horizontal"
-        [gap]="2">
-        @for (filter of activeFilters | slice:0:3; track filter.id) {
+        [gap]="2"
+      >
+        @for (filter of activeFilters | slice: 0 : 3; track filter.id) {
           @if (filter.value) {
             <cds-tag-filter
               closeButtonLabel="Clear"
               i18n-closeButtonLabel
-              (close)="onRemoveFilter(filter)">
+              (close)="onRemoveFilter(filter)"
+            >
               {{ filter.name }}={{ filter.value }}
             </cds-tag-filter>
           }
         }
         @if (activeFilters.length > 3) {
           <cds-tooltip [description]="remainingFiltersTpl">
-            <cds-tag>
-              +{{ activeFilters.length - 3 }}
-            </cds-tag>
+            <cds-tag> +{{ activeFilters.length - 3 }} </cds-tag>
 
             <ng-template #remainingFiltersTpl>
               <div
                 cdsStack="vertical"
-                [gap]="2">
-              @for (filter of activeFilters | slice:3; track filter.id) {
-                <cds-tag-filter
-                  closeButtonLabel="Clear"
-                  i18n-closeButtonLabel
-                  (close)="onRemoveFilter(filter)">
-                  {{ filter.name }}={{ filter.value }}
-                </cds-tag-filter>
-              }
+                [gap]="2"
+              >
+                @for (filter of activeFilters | slice: 3; track filter.id) {
+                  <cds-tag-filter
+                    closeButtonLabel="Clear"
+                    i18n-closeButtonLabel
+                    (close)="onRemoveFilter(filter)"
+                  >
+                    {{ filter.name }}={{ filter.value }}
+                  </cds-tag-filter>
+                }
               </div>
             </ng-template>
           </cds-tooltip>
         }
-        <button cdsButton="ghost"
-                (click)="onClearFilters($event)"
-                type="button">
+        <button
+          cdsButton="ghost"
+          (click)="onClearFilters($event)"
+          type="button"
+        >
           <ng-container i18n>Clear filters</ng-container>
         </button>
       </div>
     </div>
   }
   <!-- end filter chips for column filters -->
-  <table cdsTable
-         [sortable]="sortable"
-         [noBorder]="false"
-         [size]="size"
-         [striped]="false"
-         [skeleton]="loadingIndicator">
-    <thead cdsTableHead
-           [sortable]="sortable"
-           (deselectAll)="onDeselectAll()"
-           (selectAll)="onSelectAll()"
-           (sort)="changeSorting($event)"
-           [model]="model"
-           [selectAllCheckbox]="selectAllCheckbox"
-           [selectAllCheckboxSomeSelected]="selectAllCheckboxSomeSelected"
-           [showSelectionColumn]="showSelectionColumn"
-           [enableSingleSelect]="enableSingleSelect"
-           [skeleton]="loadingIndicator"
-           [stickyHeader]="false">
-    </thead>
-    <tbody cdsTableBody
-           *ngIf="!noData; else noDataTemplate"
-           [enableSingleSelect]="enableSingleSelect"
-           [skeleton]="loadingIndicator">
-      <ng-container *ngFor="let row of model.data; let i = index; trackBy: trackByFn.bind(this, identifier)">
-        <tr	cdsTableRow
+  <table
+    cdsTable
+    [sortable]="sortable"
+    [noBorder]="false"
+    [size]="size"
+    [striped]="false"
+    [skeleton]="loadingIndicator"
+  >
+    <thead
+      cdsTableHead
+      [sortable]="sortable"
+      (deselectAll)="onDeselectAll()"
+      (selectAll)="onSelectAll()"
+      (sort)="changeSorting($event)"
+      [model]="model"
+      [selectAllCheckbox]="selectAllCheckbox"
+      [selectAllCheckboxSomeSelected]="selectAllCheckboxSomeSelected"
+      [showSelectionColumn]="showSelectionColumn"
+      [enableSingleSelect]="enableSingleSelect"
+      [skeleton]="loadingIndicator"
+      [stickyHeader]="false"
+    ></thead>
+    <tbody
+      cdsTableBody
+      *ngIf="!noData; else noDataTemplate"
+      [enableSingleSelect]="enableSingleSelect"
+      [skeleton]="loadingIndicator"
+    >
+      <ng-container
+        *ngFor="let row of model.data; let i = index; trackBy: trackByFn.bind(this, identifier)"
+      >
+        <tr
+          cdsTableRow
+          [model]="model"
+          [row]="row"
+          [size]="size"
+          [selected]="model.isRowSelected(i)"
+          [expandable]="model.isRowExpandable(i)"
+          [expanded]="model.isRowExpanded(i)"
+          [showSelectionColumn]="showSelectionColumn"
+          [enableSingleSelect]="enableSingleSelect"
+          [skeleton]="loadingIndicator"
+          (selectRow)="onSelect(i)"
+          (deselectRow)="onDeselect(i)"
+          (expandRow)="model.expandRow(i, !model.isRowExpanded(i))"
+          (rowClick)="onSelect(i)"
+          *ngIf="!model.isRowFiltered(i)"
+        ></tr>
+        <tr
+          cdsTableExpandedRow
+          cdsExpandedRowHover
+          *ngIf="model.isRowExpandable(i) && !shouldExpandAsTable(row) && !model.isRowFiltered(i)"
+          [row]="row"
+          [expanded]="model.isRowExpanded(i)"
+          [skeleton]="loadingIndicator"
+        ></tr>
+        <ng-container
+          *ngIf="
+            model.isRowExpandable(i) &&
+            shouldExpandAsTable(row) &&
+            model.isRowExpanded(i) &&
+            !model.isRowFiltered(i)
+          "
+        >
+          <tr
+            cdsTableRow
+            *ngFor="let expandedDataRow of firstExpandedDataInRow(row)"
             [model]="model"
-            [row]="row"
+            [showSelectionColumnCheckbox]="false"
+            [showSelectionColumn]="showSelectionColumn"
+            [row]="expandedDataRow"
             [size]="size"
             [selected]="model.isRowSelected(i)"
-            [expandable]="model.isRowExpandable(i)"
-            [expanded]="model.isRowExpanded(i)"
-            [showSelectionColumn]="showSelectionColumn"
-            [enableSingleSelect]="enableSingleSelect"
             [skeleton]="loadingIndicator"
-            (selectRow)="onSelect(i)"
-            (deselectRow)="onDeselect(i)"
-            (expandRow)="model.expandRow(i, !model.isRowExpanded(i))"
-            (rowClick)="onSelect(i)"
-            *ngIf="!model.isRowFiltered(i)">
-        </tr>
-        <tr	cdsTableExpandedRow
-            cdsExpandedRowHover
-            *ngIf="model.isRowExpandable(i) && !shouldExpandAsTable(row) && !model.isRowFiltered(i)"
-            [row]="row"
-            [expanded]="model.isRowExpanded(i)"
-            [skeleton]="loadingIndicator">
-        </tr>
-        <ng-container	*ngIf="model.isRowExpandable(i) && shouldExpandAsTable(row) && model.isRowExpanded(i) && !model.isRowFiltered(i)">
-          <tr	cdsTableRow
-              *ngFor="let expandedDataRow of firstExpandedDataInRow(row)"
-              [model]="model"
-              [showSelectionColumnCheckbox]="false"
-              [showSelectionColumn]="showSelectionColumn"
-              [row]="expandedDataRow"
-              [size]="size"
-              [selected]="model.isRowSelected(i)"
-              [skeleton]="loadingIndicator">
-          </tr>
+          ></tr>
         </ng-container>
       </ng-container>
     </tbody>
   </table>
-  <cds-pagination [model]="model"
-                  (selectPage)="onPageChange($event)"
-                  [disabled]="limit === 0"
-                  [skeleton]="loadingIndicator"
-                  [pageInputDisabled]="limit === 0">
+  <cds-pagination
+    [model]="model"
+    (selectPage)="onPageChange($event)"
+    [disabled]="limit === 0"
+    [skeleton]="loadingIndicator"
+    [pageInputDisabled]="limit === 0"
+  >
   </cds-pagination>
 </cds-table-container>
 
 <ng-template #noDataTemplate>
   <tbody>
     <tr cdstablerow>
-      <td *ngIf="!rows?.length && !loadingIndicator"
-          class="no-data"
-          cdstabledata
-          [attr.colspan]="visibleColumns.length + 2">
-        <div class="empty-state cds-ml-3"
-             cdsStack="vertical"
-             gap="11">
+      <td
+        *ngIf="!rows?.length && !loadingIndicator"
+        class="no-data"
+        cdstabledata
+        [attr.colspan]="visibleColumns.length + 2"
+      >
+        <div
+          class="empty-state cds-ml-3"
+          cdsStack="vertical"
+          gap="11"
+        >
           <div></div>
-          <div cdsStack="vertical"
-               gap="1">
+          <div
+            cdsStack="vertical"
+            gap="1"
+          >
             <div>
-              <img src="{{ emptyStateImage }}"
-                   alt="No data available" />
+              <img
+                src="{{ emptyStateImage }}"
+                alt="No data available"
+              />
             </div>
             <legend class="cds--type-body-compact-02">
               <ng-container>{{ emptyStateTitle }}</ng-container>
@@ -408,93 +513,119 @@
   </tbody>
 </ng-template>
 
-<ng-template #rowDetailTpl
-             let-row="data">
+<ng-template
+  #rowDetailTpl
+  let-row="data"
+>
   @if (row[identifier] === expanded?.[identifier] && !scrollable) {
-  <div
-    (mouseenter)="onRowDetailHover($event)"
-    data-testid="datatable-row-detail">
-    <ng-template [ngTemplateOutlet]="rowDetail.template"></ng-template>
-  </div>
+    <div
+      (mouseenter)="onRowDetailHover($event)"
+      data-testid="datatable-row-detail"
+    >
+      <ng-template [ngTemplateOutlet]="rowDetail.template"></ng-template>
+    </div>
   } @else if (row[identifier] === expanded?.[identifier] && scrollable) {
-  <div
-    (mouseenter)="onRowDetailHover($event)"
-    data-testid="datatable-row-detail"
-    class="scrollable-expanded-row">
-    <ng-template [ngTemplateOutlet]="rowDetail.template"></ng-template>
-  </div>
+    <div
+      (mouseenter)="onRowDetailHover($event)"
+      data-testid="datatable-row-detail"
+      class="scrollable-expanded-row"
+    >
+      <ng-template [ngTemplateOutlet]="rowDetail.template"></ng-template>
+    </div>
   }
 </ng-template>
 
-<ng-template #defaultValueTpl
-             let-value="data.value"
-             let-expanded="expanded"
-             let-column="data.column">
+<ng-template
+  #defaultValueTpl
+  let-value="data.value"
+  let-expanded="expanded"
+  let-column="data.column"
+>
   <span [ngClass]="column?.cellClass">{{ value }}</span>
 </ng-template>
 
 <ng-template #tableActionTpl>
-  <cds-overflow-menu *ngIf="tableActions?.dropDownActions.length > 1 && selectionType !== 'multiClick'"
-                     [flip]="true"
-                     data-testid="table-action-btn"
-                     class="d-flex justify-content-end">
+  <cds-overflow-menu
+    *ngIf="tableActions?.dropDownActions.length > 1 && selectionType !== 'multiClick'"
+    [flip]="true"
+    data-testid="table-action-btn"
+    class="d-flex justify-content-end"
+  >
     <ng-container *ngFor="let action of tableActions?.dropDownActions">
-      <cds-overflow-menu-option *ngIf="tableActions.currentAction !== action"
-                                class="{{ tableActions.toClassName(action) }}"
-                                title="{{ tableActions.useDisableDesc(action) }}"
-                                (click)="tableActions.useClickAction(action)"
-                                [routerLink]="tableActions.useRouterLink(action)"
-                                [preserveFragment]="action.preserveFragment ? '' : null"
-                                [disabled]="tableActions.disableSelectionAction(action)"
-                                [attr.aria-label]="action.name"
-                                data-testid="table-action-option-btn"
-                                i18n>
+      <cds-overflow-menu-option
+        *ngIf="tableActions.currentAction !== action"
+        class="{{ tableActions.toClassName(action) }}"
+        title="{{ tableActions.useDisableDesc(action) }}"
+        (click)="tableActions.useClickAction(action)"
+        [routerLink]="tableActions.useRouterLink(action)"
+        [preserveFragment]="action.preserveFragment ? '' : null"
+        [disabled]="tableActions.disableSelectionAction(action)"
+        [attr.aria-label]="action.name"
+        data-testid="table-action-option-btn"
+        i18n
+      >
         {{ action.name }}
       </cds-overflow-menu-option>
     </ng-container>
   </cds-overflow-menu>
 </ng-template>
 
-
 <!-- cell templates that can be accessed from outside -->
-<ng-template #tableCellBoldTpl
-             let-value="data.value">
+<ng-template
+  #tableCellBoldTpl
+  let-value="data.value"
+>
   <strong>{{ value }}</strong>
 </ng-template>
 
-<ng-template #sparklineTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #sparklineTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   <div class="position-relative">
-    <cd-sparkline [data]="value"
-                  [isBinary]="row.cdIsBinary"></cd-sparkline>
+    <cd-sparkline
+      [data]="value"
+      [isBinary]="row.cdIsBinary"
+    ></cd-sparkline>
   </div>
 </ng-template>
 
-<ng-template #routerLinkTpl
-             let-row="data.row"
-             let-value="data.value">
-  <a [routerLink]="[row.cdLink]"
-     [queryParams]="row.cdParams">{{ value }}</a>
+<ng-template
+  #routerLinkTpl
+  let-row="data.row"
+  let-value="data.value"
+>
+  <a
+    [routerLink]="[row.cdLink]"
+    [queryParams]="row.cdParams"
+    >{{ value }}</a
+  >
 </ng-template>
 
-<ng-template #checkIconTpl
-             let-value="data.value">
+<ng-template
+  #checkIconTpl
+  let-value="data.value"
+>
   @if (value | boolean) {
-  <cd-icon type="check"></cd-icon>
-}
+    <cd-icon type="check"></cd-icon>
+  }
 </ng-template>
 
-<ng-template #perSecondTpl
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #perSecondTpl
+  let-row="data.row"
+  let-value="data.value"
+>
   {{ value | dimless }} /s
 </ng-template>
 
-<ng-template #executingTpl
-             let-column="data.column"
-             let-row="data.row"
-             let-value="data.value">
+<ng-template
+  #executingTpl
+  let-column="data.column"
+  let-row="data.row"
+  let-value="data.value"
+>
   @if (row.cdExecuting) {
     <cds-inline-loading></cds-inline-loading>
   }
@@ -502,181 +633,295 @@
     {{ value }}
   </span>
   @if (row.cdExecuting) {
-    <span [ngClass]="column?.customTemplateConfig?.executingClass ? column?.customTemplateConfig.executingClass : 'text-muted italic'">({{ row.cdExecuting }})</span>
+    <span
+      [ngClass]="
+        column?.customTemplateConfig?.executingClass
+          ? column?.customTemplateConfig.executingClass
+          : 'text-muted italic'
+      "
+      >({{ row.cdExecuting }})</span
+    >
   }
 </ng-template>
-<ng-template #classAddingTpl
-             let-value="data.value">
+<ng-template
+  #classAddingTpl
+  let-value="data.value"
+>
   <span *ngIf="value">
-    <span *ngIf="!(value=='active')||(value=='expired')||(value=='pending')">
+    <span *ngIf="!(value == 'active') || value == 'expired' || value == 'pending'">
       {{ value }}
     </span>
-    <cds-tag *ngIf="(value==='active')||(value=== 'expired')||(value=== 'pending')"
-             class="{{ value | pipeFunction:useCustomClass:this }}">
-       {{value}}
+    <cds-tag
+      *ngIf="value === 'active' || value === 'expired' || value === 'pending'"
+      class="{{ value | pipeFunction: useCustomClass : this }}"
+    >
+      {{ value }}
     </cds-tag>
   </span>
 </ng-template>
 
-<ng-template #tagTpl
-             let-column="data.column"
-             let-value="data.value">
-  <span *ngFor="let item of (value | array); last as last">
-    <cds-tag [size]="'md'"
-             [class]="'table-tag ' + ((column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.class) ? column.customTemplateConfig.map[item].class : (column?.customTemplateConfig?.class ? column.customTemplateConfig.class : 'tag-primary'))"
-             *ngIf="(column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.value) ? column.customTemplateConfig.map[item].value : column?.customTemplateConfig?.prefix ? column.customTemplateConfig.prefix + item : item">
-      {{(column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.value) ? column.customTemplateConfig.map[item].value : column?.customTemplateConfig?.prefix ? column.customTemplateConfig.prefix + item : item }}
+<ng-template
+  #tagTpl
+  let-column="data.column"
+  let-value="data.value"
+>
+  <span *ngFor="let item of value | array; last as last">
+    <cds-tag
+      [size]="'md'"
+      [class]="
+        'table-tag ' +
+        (column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.class
+          ? column.customTemplateConfig.map[item].class
+          : column?.customTemplateConfig?.class
+            ? column.customTemplateConfig.class
+            : 'tag-primary')
+      "
+      *ngIf="
+        column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.value
+          ? column.customTemplateConfig.map[item].value
+          : column?.customTemplateConfig?.prefix
+            ? column.customTemplateConfig.prefix + item
+            : item
+      "
+    >
+      {{
+        column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.value
+          ? column.customTemplateConfig.map[item].value
+          : column?.customTemplateConfig?.prefix
+            ? column.customTemplateConfig.prefix + item
+            : item
+      }}
     </cds-tag>
     <span *ngIf="!last">&nbsp;</span>
   </span>
 </ng-template>
 
-<ng-template #mapTpl
-             let-column="data.column"
-             let-value="data.value">
-  <span>{{ value | map:column?.customTemplateConfig }}</span>
+<ng-template
+  #mapTpl
+  let-column="data.column"
+  let-value="data.value"
+>
+  <span>{{ value | map: column?.customTemplateConfig }}</span>
 </ng-template>
 
-<ng-template #tooltipTpl
-             let-column="data.column"
-             let-value="data.value">
-  <span *ngFor="let item of (value | array);">
+<ng-template
+  #tooltipTpl
+  let-column="data.column"
+  let-value="data.value"
+>
+  <span *ngFor="let item of value | array">
     <cds-tag
       i18n
       i18n-ngbTooltip
-      class="{{(column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.class) ? column.customTemplateConfig.map[item].class : ''}}"
-      ngbTooltip="{{(column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.tooltip) ? column.customTemplateConfig.map[item].tooltip : ''}}">
-      {{value}}
-  </cds-tag>
+      class="{{
+        column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.class
+          ? column.customTemplateConfig.map[item].class
+          : ''
+      }}"
+      ngbTooltip="{{
+        column?.customTemplateConfig?.map && column?.customTemplateConfig?.map[item]?.tooltip
+          ? column.customTemplateConfig.map[item].tooltip
+          : ''
+      }}"
+    >
+      {{ value }}
+    </cds-tag>
   </span>
 </ng-template>
 
-<ng-template #truncateTpl
-             let-column="data.column"
-             let-value="data.value">
-  <span data-toggle="tooltip"
-        [title]="value">{{ value | truncate:column?.customTemplateConfig?.length:column?.customTemplateConfig?.omission }}</span>
+<ng-template
+  #truncateTpl
+  let-column="data.column"
+  let-value="data.value"
+>
+  <span
+    data-toggle="tooltip"
+    [title]="value"
+    >{{
+      value
+        | truncate: column?.customTemplateConfig?.length : column?.customTemplateConfig?.omission
+    }}</span
+  >
 </ng-template>
 
-<ng-template #rowDetailsTpl
-             let-row="data.row"
-             let-isExpanded="data.expanded"
-             ngx-datatable-cell-template>
-  <a href="javascript:void(0)"
-     [class.expand-collapse-icon-right]="!isExpanded"
-     [class.expand-collapse-icon-down]="isExpanded"
-     class="expand-collapse-icon tc_expand-collapse"
-     title="Expand/Collapse Row"
-     i18n-title
-     (click)="toggleExpandRow(row, isExpanded, $event)">
+<ng-template
+  #rowDetailsTpl
+  let-row="data.row"
+  let-isExpanded="data.expanded"
+  ngx-datatable-cell-template
+>
+  <a
+    href="javascript:void(0)"
+    [class.expand-collapse-icon-right]="!isExpanded"
+    [class.expand-collapse-icon-down]="isExpanded"
+    class="expand-collapse-icon tc_expand-collapse"
+    title="Expand/Collapse Row"
+    i18n-title
+    (click)="toggleExpandRow(row, isExpanded, $event)"
+  >
   </a>
 </ng-template>
 
-<ng-template #timeAgoTpl
-             let-value="data.value">
-  <span data-toggle="tooltip"
-        [title]="value | cdDate">{{ value | relativeDate }}</span>
+<ng-template
+  #timeAgoTpl
+  let-value="data.value"
+>
+  <span
+    data-toggle="tooltip"
+    [title]="value | cdDate"
+    >{{ value | relativeDate }}</span
+  >
 </ng-template>
 
-<ng-template #pathTpl
-             let-value="data.value">
-  <cd-copy-2-clipboard-button *ngIf="value"
-                              [source]="value"
-                              [byId]="false"
-                              size="lg"
-                              text="{{ value | path }}">
+<ng-template
+  #pathTpl
+  let-value="data.value"
+>
+  <cd-copy-2-clipboard-button
+    *ngIf="value"
+    [source]="value"
+    [byId]="false"
+    size="lg"
+    text="{{ value | path }}"
+  >
   </cd-copy-2-clipboard-button>
 </ng-template>
 
-<ng-template #copyTpl
-             let-value="data.value">
-  <cd-copy-2-clipboard-button *ngIf="value"
-                              [source]="value"
-                              [byId]="false"
-                              [size]="lg"
-                              [text]="value">
+<ng-template
+  #copyTpl
+  let-value="data.value"
+>
+  <cd-copy-2-clipboard-button
+    *ngIf="value"
+    [source]="value"
+    [byId]="false"
+    [size]="lg"
+    [text]="value"
+  >
   </cd-copy-2-clipboard-button>
 </ng-template>
 
-<ng-template #editingTpl
-             let-value="data.value"
-             let-row="data.row"
-             let-column="data.column">
+<ng-template
+  #editingTpl
+  let-value="data.value"
+  let-row="data.row"
+  let-column="data.column"
+>
   @if (isCellEditing(row?.[identifier], column?.prop)) {
-  <form [formGroup]="formGroup"
-        #formDir="ngForm">
-    <div cdsRow>
-      <div cdsCol>
-        <cds-text-label [invalid]="formGroup.controls[row?.[identifier] + '-' + column?.prop]?.invalid && formGroup.controls[row?.[identifier] + '-' + column?.prop]?.dirty"
-                        [invalidText]="errorTpl">
-          <input type="text"
-                 cdsText
-                 size="sm"
-                 [id]="row?.[identifier] + '-' + column?.prop"
-                 [formControlName]="row?.[identifier] + '-' + column?.prop"
-                 (input)="valueChange(row?.[identifier], column?.prop, $event.target.value)"
-                 [invalid]="formGroup.controls[row?.[identifier] + '-' + column?.prop]?.invalid && formGroup.controls[row?.[identifier] + '-' + column?.prop]?.dirty">
-        </cds-text-label>
-        <ng-template #errorTpl>
-          @for (errorKey of formGroup?.get(row?.[identifier] + '-' + column?.prop)?.errors | keyvalue; track $index) {
-          @if (formGroup?.showError(row?.[identifier] + '-' + column?.prop, formDir, errorKey.key)) {
-          <ng-container i18n>
-            {{ column.customTemplateConfig?.errorMessages?.[errorKey.key] || ('Invalid ' + column.name) }}
-          </ng-container>
-          }}
-        </ng-template>
-      </div>
-      <div cdsCol
-           [columnNumbers]="{sm:1}"
-           class="cds-p-0 cds-pt-3">
-        <div cdsRow>
-        <cds-icon-button kind="tertiary"
-                         size="sm"
-                         id="cell-inline-save-btn"
-                         type="button"
-                         (click)="saveCellItem(row, column?.prop)">
-          <cd-icon type="check"></cd-icon>
-        </cds-icon-button>
-        <cds-icon-button kind="ghost"
-                         size="sm"
-                         id="cell-inline-cancel-btn"
-                         type="button"
-                         (click)="cancelCellEdit(row[identifier], column?.prop)">
-          <cd-icon type="destroy"></cd-icon>
-        </cds-icon-button>
+    <form
+      [formGroup]="formGroup"
+      #formDir="ngForm"
+    >
+      <div cdsRow>
+        <div cdsCol>
+          <cds-text-label
+            [invalid]="
+              formGroup.controls[row?.[identifier] + '-' + column?.prop]?.invalid &&
+              formGroup.controls[row?.[identifier] + '-' + column?.prop]?.dirty
+            "
+            [invalidText]="errorTpl"
+          >
+            <input
+              type="text"
+              cdsText
+              size="sm"
+              [id]="row?.[identifier] + '-' + column?.prop"
+              [formControlName]="row?.[identifier] + '-' + column?.prop"
+              (input)="valueChange(row?.[identifier], column?.prop, $event.target.value)"
+              [invalid]="
+                formGroup.controls[row?.[identifier] + '-' + column?.prop]?.invalid &&
+                formGroup.controls[row?.[identifier] + '-' + column?.prop]?.dirty
+              "
+            />
+          </cds-text-label>
+          <ng-template #errorTpl>
+            @for (
+              errorKey of formGroup?.get(row?.[identifier] + '-' + column?.prop)?.errors | keyvalue;
+              track $index
+            ) {
+              @if (
+                formGroup?.showError(row?.[identifier] + '-' + column?.prop, formDir, errorKey.key)
+              ) {
+                <ng-container i18n>
+                  {{
+                    column.customTemplateConfig?.errorMessages?.[errorKey.key] ||
+                      'Invalid ' + column.name
+                  }}
+                </ng-container>
+              }
+            }
+          </ng-template>
+        </div>
+        <div
+          cdsCol
+          [columnNumbers]="{ sm: 1 }"
+          class="cds-p-0 cds-pt-3"
+        >
+          <div cdsRow>
+            <cds-icon-button
+              kind="tertiary"
+              size="sm"
+              id="cell-inline-save-btn"
+              type="button"
+              (click)="saveCellItem(row, column?.prop)"
+            >
+              <cd-icon type="check"></cd-icon>
+            </cds-icon-button>
+            <cds-icon-button
+              kind="ghost"
+              size="sm"
+              id="cell-inline-cancel-btn"
+              type="button"
+              (click)="cancelCellEdit(row[identifier], column?.prop)"
+            >
+              <cd-icon type="destroy"></cd-icon>
+            </cds-icon-button>
+          </div>
         </div>
       </div>
-    </div>
-  </form>
+    </form>
   } @else {
-  <div cdsRow>
-    <div cdsCol
-         class="cds-pt-3">
-      {{ value }}
+    <div cdsRow>
+      <div
+        cdsCol
+        class="cds-pt-3"
+      >
+        {{ value }}
+      </div>
+      <div
+        cdsCol
+        [columnNumbers]="{ lg: 5 }"
+        class="edit-btn"
+      >
+        <cds-icon-button
+          kind="ghost"
+          size="sm"
+          id="cell-inline-edit-btn"
+          (click)="editCellItem(row[identifier], column, value)"
+        >
+          <cd-icon type="edit"></cd-icon>
+        </cds-icon-button>
+      </div>
     </div>
-    <div cdsCol
-         [columnNumbers]="{lg: 5}"
-         class="edit-btn">
-      <cds-icon-button kind="ghost"
-                       size="sm"
-                       id="cell-inline-edit-btn"
-                       (click)="editCellItem(row[identifier], column, value)">
-        <cd-icon type="edit"></cd-icon>
-      </cds-icon-button>
-    </div>
-  </div>
   }
 </ng-template>
 
-<ng-template #redirectTpl
-             let-value="data.value"
-             let-row="data.row"
-             let-column="data.column">
-@if (column.customTemplateConfig?.customRowProperty && row[column.customTemplateConfig?.customRowProperty]) {
-  <a [routerLink]="row[column.customTemplateConfig?.customRowProperty]">{{value}}</a>
-} @else if (column.customTemplateConfig?.redirectLink) {
-  <a [routerLink]="column.customTemplateConfig?.redirectLink | redirectLinkResolver:value">{{value}}</a>
-} @else {
-  {{ value }}
-}
+<ng-template
+  #redirectTpl
+  let-value="data.value"
+  let-row="data.row"
+  let-column="data.column"
+>
+  @if (
+    column.customTemplateConfig?.customRowProperty &&
+    row[column.customTemplateConfig?.customRowProperty]
+  ) {
+    <a [routerLink]="row[column.customTemplateConfig?.customRowProperty]">{{ value }}</a>
+  } @else if (column.customTemplateConfig?.redirectLink) {
+    <a [routerLink]="column.customTemplateConfig?.redirectLink | redirectLinkResolver: value">{{
+      value
+    }}</a>
+  } @else {
+    {{ value }}
+  }
 </ng-template>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/crud-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/crud-form.component.html
index 002acb51e77..2dac4529402 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/crud-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/crud-form.component.html
@@ -1,24 +1,35 @@
 <div class="cd-col-form">
-  <div class="card pb-0"
-       *ngIf="formUISchema$ | async as formUISchema">
-    <div i18n="form title"
-         class="card-header">{{ formUISchema.title }}</div>
-    <form *ngIf="formUISchema.uiSchema"
-          [formGroup]="form"
-          (ngSubmit)="submit(model, formUISchema.taskInfo)">
-
+  <div
+    class="card pb-0"
+    *ngIf="formUISchema$ | async as formUISchema"
+  >
+    <div
+      i18n="form title"
+      class="card-header"
+    >
+      {{ formUISchema.title }}
+    </div>
+    <form
+      *ngIf="formUISchema.uiSchema"
+      [formGroup]="form"
+      (ngSubmit)="submit(model, formUISchema.taskInfo)"
+    >
       <div class="card-body position-relative">
-        <formly-form [form]="form"
-                     [fields]="formUISchema.controlSchema"
-                     [model]="model"
-                     [options]="{formState: formUISchema.uiSchema}"></formly-form>
+        <formly-form
+          [form]="form"
+          [fields]="formUISchema.controlSchema"
+          [model]="model"
+          [options]="{ formState: formUISchema.uiSchema }"
+        ></formly-form>
       </div>
       <div class="card-footer">
-        <cd-form-button-panel (submitActionEvent)="submit(model, formUISchema.taskInfo)"
-                              [form]="formDir"
-                              [submitText]="formUISchema.title"
-                              [disabled]="!form.valid"
-                              wrappingClass="text-right"></cd-form-button-panel>
+        <cd-form-button-panel
+          (submitActionEvent)="submit(model, formUISchema.taskInfo)"
+          [form]="formDir"
+          [submitText]="formUISchema.title"
+          [disabled]="!form.valid"
+          wrappingClass="text-right"
+        ></cd-form-button-panel>
       </div>
     </form>
   </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.html
index 71083238d37..a31de4da424 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.html
@@ -1,42 +1,64 @@
 <div class="mb-3">
-  <legend *ngIf="props.label"
-          class="cd-header mt-1"
-          i18n>{{ props.label }}</legend>
-  <p *ngIf="props.description"
-     i18n>{{ props.description }}</p>
+  <legend
+    *ngIf="props.label"
+    class="cd-header mt-1"
+    i18n
+  >
+    {{ props.label }}
+  </legend>
+  <p
+    *ngIf="props.description"
+    i18n
+  >
+    {{ props.description }}
+  </p>
 
-  <div *ngFor="let field of field.fieldGroup; let i = index"
-       class="d-flex">
-    <formly-field class="col"
-                  [field]="field"></formly-field>
+  <div
+    *ngFor="let field of field.fieldGroup; let i = index"
+    class="d-flex"
+  >
+    <formly-field
+      class="col"
+      [field]="field"
+    ></formly-field>
     <div class="action-btn">
-      <button class="btn btn-light ms-1"
-              type="button"
-              (click)="addWrapper()">
+      <button
+        class="btn btn-light ms-1"
+        type="button"
+        (click)="addWrapper()"
+      >
         <i [ngClass]="icons.add"></i>
       </button>
-      <button class="btn btn-light ms-1"
-              type="button"
-              (click)="remove(i)"
-              *ngIf="field.props.removable !== false">
+      <button
+        class="btn btn-light ms-1"
+        type="button"
+        (click)="remove(i)"
+        *ngIf="field.props.removable !== false"
+      >
         <i [ngClass]="icons.trash"></i>
       </button>
     </div>
   </div>
-  <div *ngIf="field.fieldGroup.length === 0"
-       class="text-right">
-    <button class="btn btn-light"
-            type="button"
-            (click)="addWrapper()"
-            i18n>
+  <div
+    *ngIf="field.fieldGroup.length === 0"
+    class="text-right"
+  >
+    <button
+      class="btn btn-light"
+      type="button"
+      (click)="addWrapper()"
+      i18n
+    >
       <i [ngClass]="icons.add"></i>
       Add {{ props.label }}
     </button>
   </div>
 
-  <span class="invalid-feedback"
-        role="alert"
-        *ngIf="showError && formControl.errors">
+  <span
+    class="invalid-feedback"
+    role="alert"
+    *ngIf="showError && formControl.errors"
+  >
     <formly-validation-message [field]="field"></formly-validation-message>
   </span>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-file-type/formly-file-type.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-file-type/formly-file-type.component.html
index bf6dc6e89d9..ac77f989083 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-file-type/formly-file-type.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-file-type/formly-file-type.component.html
@@ -1,4 +1,5 @@
-<input type="file"
-       [formControl]="formControl"
-       [formlyAttributes]="field"
-       />
+<input
+  type="file"
+  [formControl]="formControl"
+  [formlyAttributes]="field"
+/>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.html
index 2d807d02b82..23d2e0e61b3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.html
@@ -1,3 +1,5 @@
-<input [formControl]="formControl"
-       [formlyAttributes]="field"
-       class="form-control col-form-input"/>
+<input
+  [formControl]="formControl"
+  [formlyAttributes]="field"
+  class="form-control col-form-input"
+/>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.html
index b8f1a478602..6968e6d3d66 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.html
@@ -1,11 +1,16 @@
 <ng-template #labelTemplate>
   <div class="d-flex align-items-center">
-    <label *ngIf="props.label && props.hideLabel !== true"
-           [attr.for]="id"
-           class="form-label">
+    <label
+      *ngIf="props.label && props.hideLabel !== true"
+      [attr.for]="id"
+      class="form-label"
+    >
       {{ props.label }}
-      <span *ngIf="props.required && props.hideRequiredMarker !== true"
-            aria-hidden="true">*</span>
+      <span
+        *ngIf="props.required && props.hideRequiredMarker !== true"
+        aria-hidden="true"
+        >*</span
+      >
       <cd-helper *ngIf="helper">
         <span [innerHTML]="helper"></span>
       </cd-helper>
@@ -13,9 +18,11 @@
   </div>
 </ng-template>
 
-<div class="mb-3"
-     [class.form-floating]="props.labelPosition === 'floating'"
-     [class.has-error]="showError">
+<div
+  class="mb-3"
+  [class.form-floating]="props.labelPosition === 'floating'"
+  [class.has-error]="showError"
+>
   <ng-container *ngIf="props.labelPosition !== 'floating'">
     <ng-container [ngTemplateOutlet]="labelTemplate"></ng-container>
   </ng-container>
@@ -26,12 +33,17 @@
     <ng-container [ngTemplateOutlet]="labelTemplate"></ng-container>
   </ng-container>
 
-  <div *ngIf="showError"
-       class="invalid-feedback"
-       [style.display]="'block'">
+  <div
+    *ngIf="showError"
+    class="invalid-feedback"
+    [style.display]="'block'"
+  >
     <formly-validation-message [field]="field"></formly-validation-message>
   </div>
 
-  <small *ngIf="props.description"
-         class="form-text text-muted">{{ props.description }}</small>
+  <small
+    *ngIf="props.description"
+    class="form-text text-muted"
+    >{{ props.description }}</small
+  >
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.html
index 84ec2ab6750..97d68342604 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.html
@@ -1,17 +1,29 @@
 <div class="mb-3">
-  <legend *ngIf="props.label"
-          class="cd-col-form-label"
-          i18n>{{ props.label }}</legend>
-  <p *ngIf="props.description"
-     i18n>{{ props.description }}</p>
-  <div class="alert alert-danger"
-       role="alert"
-       *ngIf="showError && formControl.errors">
+  <legend
+    *ngIf="props.label"
+    class="cd-col-form-label"
+    i18n
+  >
+    {{ props.label }}
+  </legend>
+  <p
+    *ngIf="props.description"
+    i18n
+  >
+    {{ props.description }}
+  </p>
+  <div
+    class="alert alert-danger"
+    role="alert"
+    *ngIf="showError && formControl.errors"
+  >
     <formly-validation-message [field]="field"></formly-validation-message>
   </div>
   <div [ngClass]="inputClass">
-    <formly-field *ngFor="let f of field.fieldGroup"
-                  [field]="f"
-                  class="flex-grow-1"></formly-field>
+    <formly-field
+      *ngFor="let f of field.fieldGroup"
+      [field]="f"
+      class="flex-grow-1"
+    ></formly-field>
   </div>
 </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.html b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.html
index 603a3dd6033..2e505c7403e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.html
@@ -1,9 +1,10 @@
-<textarea #textArea
-          [formControl]="formControl"
-          [cols]="props.cols"
-          [rows]="props.rows"
-          class="form-control"
-          [class.is-invalid]="showError"
-          [formlyAttributes]="field"
-          (change)="onChange()">
-</textarea>
+<textarea
+  #textArea
+  [formControl]="formControl"
+  [cols]="props.cols"
+  [rows]="props.rows"
+  class="form-control"
+  [class.is-invalid]="showError"
+  [formlyAttributes]="field"
+  (change)="onChange()"
+></textarea>
diff --git a/src/pybind/mgr/dashboard/frontend/src/index.html b/src/pybind/mgr/dashboard/frontend/src/index.html
index 183202cfed4..150565f6574 100644
--- a/src/pybind/mgr/dashboard/frontend/src/index.html
+++ b/src/pybind/mgr/dashboard/frontend/src/index.html
@@ -1,24 +1,37 @@
 <!doctype html>
 <html lang="en">
-<head>
-  <meta charset="utf-8">
-  <title>Ceph</title>
+  <head>
+    <meta charset="utf-8" />
+    <title>Ceph</title>
 
-  <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-  <link rel="icon" type="image/x-icon" id="cdFavicon" href="favicon.ico">
-</head>
-<body>
-  <noscript>
-    <div class="noscript container"
-         ng-if="false">
-      <div class="jumbotron alert alert-danger">
-        <h2 i18n>JavaScript required!</h2>
-        <p i18n>A browser with JavaScript enabled is required in order to use this service.</p>
-        <p i18n>When using Internet Explorer, please check your security settings and add this address to your trusted sites.</p>
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1, shrink-to-fit=no"
+    />
+    <link
+      rel="icon"
+      type="image/x-icon"
+      id="cdFavicon"
+      href="favicon.ico"
+    />
+  </head>
+  <body>
+    <noscript>
+      <div
+        class="noscript container"
+        ng-if="false"
+      >
+        <div class="jumbotron alert alert-danger">
+          <h2 i18n>JavaScript required!</h2>
+          <p i18n>A browser with JavaScript enabled is required in order to use this service.</p>
+          <p i18n>
+            When using Internet Explorer, please check your security settings and add this address
+            to your trusted sites.
+          </p>
+        </div>
       </div>
-    </div>
-  </noscript>
+    </noscript>
 
-  <cd-root></cd-root>
-</body>
+    <cd-root></cd-root>
+  </body>
 </html>

From 9603feb31d433fd377f886cc196926a7d3320886 Mon Sep 17 00:00:00 2001
From: Nizamudeen A <nia@redhat.com>
Date: Thu, 9 Jul 2026 15:31:27 +0530
Subject: [PATCH 594/596] mgr/dashboard: fix all ts eslint errors

as per the newer eslint rules. i limited it to only prettifying the code
instead of changing anything functional. running `npm run fix` did the
magic

Fixes: https://tracker.ceph.com/issues/77112
Signed-off-by: Nizamudeen A <nia@redhat.com>
---
 .../cypress/e2e/cluster/crush-map.e2e-spec.ts |  2 +-
 .../cypress/e2e/cluster/crush-map.po.ts       |  2 +-
 .../workflow/08-hosts.e2e-spec.ts             |  8 +-
 .../frontend/cypress/e2e/rgw/multisite.po.ts  |  4 +-
 .../frontend/cypress/e2e/rgw/users.po.ts      | 42 ++++-----
 .../mgr/dashboard/frontend/eslint.config.mjs  | 86 +++++++++----------
 ...scsi-target-discovery-modal.component.html |  4 +
 .../iscsi-target-form.component.html          | 12 +++
 .../bootstrap-create-modal.component.ts       |  3 +-
 .../nvme-gateway-view.component.spec.ts       | 16 ++--
 .../nvme-subsystem-view.component.spec.ts     | 18 ++--
 ...meof-edit-authentication.component.spec.ts | 67 +++++++--------
 ...meof-edit-host-key-modal.component.spec.ts | 30 +++----
 .../nvmeof-gateway-subsystem.component.ts     |  5 +-
 .../nvmeof-initiators-form.component.ts       |  4 +-
 .../nvmeof-namespaces-form.component.ts       |  2 +-
 .../nvmeof-subsystem-overview.component.html  |  2 -
 .../nvmeof-subsystem-overview.component.ts    |  3 +-
 .../nvmeof-subsystem-performance.component.ts |  5 +-
 .../nvmeof-subsystem-step-1.component.ts      |  6 +-
 .../nvmeof-subsystem-step-2.component.ts      |  6 +-
 .../nvmeof-subsystem-step-4.component.ts      |  5 +-
 .../block/rbd-form/rbd-form.component.spec.ts |  9 +-
 .../rbd-snapshot-form-modal.component.spec.ts |  8 +-
 .../cephfs-detail/cephfs-detail.component.ts  |  5 +-
 .../cephfs-directories.component.ts           |  4 +-
 .../cephfs-filesystem-selector.component.ts   |  5 +-
 .../cephfs-mirroring-wizard.component.spec.ts |  8 +-
 .../cephfs-snapshotschedule-form.component.ts | 13 +--
 .../cephfs-snapshotschedule-list.component.ts |  3 +-
 .../cephfs-subvolume-form.component.ts        |  5 +-
 .../create-cluster.component.html             |  1 -
 .../create-cluster.component.spec.ts          |  2 +-
 .../crushmap/crushmap.component.spec.ts       |  2 +-
 .../cluster/crushmap/crushmap.component.ts    |  5 +-
 .../host-details/host-details.component.ts    |  5 +-
 .../multi-cluster/multi-cluster.component.ts  |  5 +-
 .../osd/osd-details/osd-details.component.ts  |  5 +-
 .../osd/osd-list/osd-list.component.spec.ts   |  8 +-
 .../service-form/service-form.component.ts    |  3 +-
 .../cluster/upgrade/upgrade.component.spec.ts |  5 +-
 .../dashboard-pie/dashboard-pie.component.ts  |  5 +-
 .../nfs/nfs-form/nfs-form.component.spec.ts   |  4 +-
 .../ceph/nfs/nfs-form/nfs-form.component.ts   |  5 +-
 .../overview-alerts-card.component.ts         |  4 +-
 ...-code-profile-form-modal.component.spec.ts | 21 ++---
 ...asure-code-profile-form-modal.component.ts |  3 +-
 .../pool-form/pool-form.component.spec.ts     | 12 +--
 .../bucket-tag-modal.component.ts             |  5 +-
 ...isite-zonegroup-deletion-form.component.ts |  3 +-
 .../rgw/models/rgw-storage-class.model.ts     |  2 +-
 .../rgw-bucket-details.component.ts           |  5 +-
 .../rgw-bucket-form.component.spec.ts         | 15 ++--
 .../rgw-bucket-tiering-form.component.spec.ts |  2 +-
 .../rgw-multisite-import.component.ts         |  3 +-
 ...ultisite-sync-flow-modal.component.spec.ts |  2 +-
 ...ultisite-sync-pipe-modal.component.spec.ts |  2 +-
 .../rgw-multisite-wizard.component.ts         |  7 +-
 .../rgw-notification-form.component.spec.ts   |  4 +-
 .../rgw-overview-dashboard.component.spec.ts  |  5 +-
 .../rgw-topic-form.component.ts               |  6 +-
 .../rgw-user-accounts-form.component.spec.ts  |  4 +-
 .../rgw-user-capability-modal.component.ts    |  5 +-
 .../rgw-user-details.component.spec.ts        | 10 +--
 .../rgw-user-details.component.ts             |  5 +-
 .../rgw-user-form.component.spec.ts           | 15 ++--
 .../rgw-user-s3-key-modal.component.ts        |  5 +-
 .../rgw-user-subuser-modal.component.ts       |  5 +-
 .../shared/smart-list/smart-list.component.ts |  5 +-
 .../frontend/src/app/ceph/smb/smb.model.ts    |  2 +-
 .../login-password-form.component.html        |  6 ++
 .../auth/user-form/user-form.component.ts     |  5 +-
 .../user-password-form.component.ts           |  5 +-
 .../workbench-layout.component.ts             |  3 +-
 .../dashboard-help.component.ts               |  5 +-
 .../navigation/identity/identity.component.ts |  5 +-
 .../src/app/shared/api/host.service.ts        |  5 +-
 .../src/app/shared/api/osd.service.ts         |  5 +-
 .../src/app/shared/api/pool.service.ts        |  5 +-
 .../app/shared/api/rbd-mirroring.service.ts   |  5 +-
 .../src/app/shared/api/rbd.service.ts         |  5 +-
 .../src/app/shared/api/rgw-bucket.service.ts  |  5 +-
 .../src/app/shared/api/rgw-realm.service.ts   |  5 +-
 .../src/app/shared/api/rgw-site.service.ts    |  5 +-
 .../src/app/shared/api/rgw-topic.service.ts   |  5 +-
 .../shared/api/rgw-user-accounts.service.ts   |  5 +-
 .../src/app/shared/api/rgw-user.service.ts    |  5 +-
 .../src/app/shared/api/smb.service.ts         |  5 +-
 .../config-option.component.spec.ts           |  3 +-
 ...elete-confirmation-modal.component.spec.ts | 12 ++-
 .../delete-confirmation-modal.component.ts    |  6 +-
 .../components/grafana/grafana.component.ts   |  5 +-
 .../supported-languages.enum.ts               | 20 ++---
 .../productive-card.component.scss            |  8 +-
 .../vertical-navigation.component.spec.ts     |  2 +-
 .../checked-table-form.component.spec.ts      |  4 +-
 .../directives/auth-storage.directive.spec.ts |  5 +-
 .../directives/autofocus.directive.spec.ts    | 38 +++++---
 .../dynamic-input-combobox.directive.spec.ts  |  5 +-
 .../directives/form-loading.directive.ts      |  5 +-
 .../app/shared/directives/iops.directive.ts   |  5 +-
 .../directives/milliseconds.directive.ts      |  5 +-
 .../directives/optional-field.directive.ts    |  5 +-
 .../directives/password-button.directive.ts   |  5 +-
 .../directives/required-field.directive.ts    |  5 +-
 .../shared/directives/trim.directive.spec.ts  | 11 ++-
 .../directives/validate.directive.spec.ts     | 11 ++-
 .../src/app/shared/forms/cd-validators.ts     | 32 ++++---
 .../formly-array-type.component.spec.ts       |  7 +-
 .../formly-input-type.component.spec.ts       |  7 +-
 .../formly-input-wrapper.component.spec.ts    |  7 +-
 .../formly-object-type.component.spec.ts      |  7 +-
 .../formly-textarea-type.component.spec.ts    |  7 +-
 .../src/app/shared/models/image-spec.ts       |  6 +-
 .../frontend/src/app/shared/models/nvmeof.ts  |  3 +-
 .../src/app/shared/models/overview.ts         |  6 +-
 .../src/app/shared/pipes/ordinal.pipe.ts      | 12 +--
 .../services/api-interceptor.service.spec.ts  |  2 +-
 .../app/shared/services/auth-guard.service.ts |  5 +-
 .../services/change-password-guard.service.ts |  5 +-
 .../shared/services/data-gateway.service.ts   |  5 +-
 .../services/feature-toggles.service.ts       |  5 +-
 .../services/js-error-handler.service.ts      |  5 +-
 .../app/shared/services/language.service.ts   |  5 +-
 .../services/ngzone-scheduler.service.ts      |  5 +-
 .../app/shared/services/summary.service.ts    |  5 +-
 .../frontend/src/styles/_carbon-defaults.scss |  6 +-
 127 files changed, 599 insertions(+), 396 deletions(-)

diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.e2e-spec.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.e2e-spec.ts
index 23497bbd579..7b4b651b6ca 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.e2e-spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.e2e-spec.ts
@@ -17,7 +17,7 @@ describe('CRUSH map page', () => {
   describe('fields check', () => {
     it('should check that title & table appears', () => {
       // Check that title (CRUSH map viewer) appears
-      crushmap.getPageTitle().should('equal', 'CRUSH map viewer');
+      crushmap.getPageTitle().should('contain.text', 'CRUSH map viewer');
 
       // Check that title appears once OSD is clicked
       crushmap.getCrushNode(0).click();
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.po.ts
index a5d2d591ce0..9f41d21dd56 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/cluster/crush-map.po.ts
@@ -4,7 +4,7 @@ export class CrushMapPageHelper extends PageHelper {
   pages = { index: { url: '#/crush-map', id: 'cd-crushmap' } };
 
   getPageTitle() {
-    return cy.get('cd-crushmap .card-header').text();
+    return cy.get('cd-crushmap .card-header');
   }
 
   getCrushNode(idx: number) {
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/08-hosts.e2e-spec.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/08-hosts.e2e-spec.ts
index 41a50cb2e28..e7a14e85b38 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/08-hosts.e2e-spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/orchestrator/workflow/08-hosts.e2e-spec.ts
@@ -15,14 +15,14 @@ describe('Host Page', () => {
   });
 
   describe('should have all host details', () => {
-    it('should have hostname'),
+    (it('should have hostname'),
       () => {
         cy.get('[data-testid="hostname"]').should('not.be.empty');
-      };
-    it('should have IP address'),
+      });
+    (it('should have IP address'),
       () => {
         cy.get('[data-testid="ip-address"]').should('not.be.empty');
-      };
+      });
   });
 
   // rgw is needed for testing the force maintenance
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/multisite.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/multisite.po.ts
index 6240c0c9fea..b180cffff06 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/multisite.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/multisite.po.ts
@@ -308,14 +308,14 @@ export class MultisitePageHelper extends PageHelper {
   @PageHelper.restrictTo(pages.topology.url)
   topologyViewerExist() {
     cy.get(pages.topology.id).should('be.visible');
-    cy.get('[data-testid=rgw-multisite-details-header]').should('have.text', 'Topology Viewer');
+    cy.get('[data-testid=rgw-multisite-details-header]').should('contain.text', 'Topology Viewer');
   }
 
   @PageHelper.restrictTo(pages.wizard.url)
   replicationWizardExist() {
     cy.get('cds-modal').then(() => {
       cy.get('[data-testid=rgw-multisite-wizard-header]').should(
-        'have.text',
+        'contain.text',
         'Set up Multi-site Replication'
       );
     });
diff --git a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/users.po.ts b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/users.po.ts
index 9652d9d75e5..e31dee68f9a 100644
--- a/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/users.po.ts
+++ b/src/pybind/mgr/dashboard/frontend/cypress/e2e/rgw/users.po.ts
@@ -75,13 +75,13 @@ export class UsersPageHelper extends PageHelper {
     cy.get('#tenant').type(tenant).should('have.class', 'ng-invalid');
     cy.get('cds-text-label[for=tenant]')
       .find('.invalid-feedback')
-      .should('have.text', 'The chosen user ID exists in this tenant.');
+      .should('contain.text', 'The chosen user ID exists in this tenant.');
 
     // check that username field is marked invalid if username has been cleared off
     cy.get('#user_id').clear().blur().should('have.class', 'ng-invalid');
     cy.get('cds-text-label[for=user_id]')
       .find('.invalid-feedback')
-      .should('have.text', 'This field is required.');
+      .should('contain.text', 'This field is required.');
 
     // Full name
     cy.get('#display_name')
@@ -94,13 +94,13 @@ export class UsersPageHelper extends PageHelper {
       .should('have.class', 'ng-invalid');
     cy.get('cds-text-label[for=display_name]')
       .find('.invalid-feedback')
-      .should('have.text', 'This field is required.');
+      .should('contain.text', 'This field is required.');
 
     // put invalid email to make field invalid
     cy.get('#email').type('a').blur().should('have.class', 'ng-invalid');
     cy.get('cds-text-label[for=email]')
       .find('.invalid-feedback')
-      .should('have.text', 'This is not a valid email address.');
+      .should('contain.text', 'This is not a valid email address.');
 
     // put negative max buckets to make field invalid
     this.expectSelectOption('max_buckets_mode', 'Custom');
@@ -108,7 +108,7 @@ export class UsersPageHelper extends PageHelper {
     cy.get('#max_buckets').should('have.class', 'ng-invalid');
     cy.get('cds-number[for=max_buckets]')
       .find('.invalid-feedback')
-      .should('have.text', 'The entered value must be >= 1.');
+      .should('contain.text', 'The entered value must be >= 1.');
 
     this.navigateTo();
     this.delete(tenant + '$' + uname, null, null, true, false, false, true);
@@ -133,13 +133,13 @@ export class UsersPageHelper extends PageHelper {
 
     cy.get('cds-text-label[for=email]')
       .find('.invalid-feedback')
-      .should('have.text', 'This is not a valid email address.');
+      .should('contain.text', 'This is not a valid email address.');
 
     // empty the display name field making it invalid
     cy.get('#display_name').clear({ force: true }).blur().should('have.class', 'ng-invalid');
     cy.get('cds-text-label[for=display_name]')
       .find('.invalid-feedback')
-      .should('have.text', 'This field is required.');
+      .should('contain.text', 'This field is required.');
 
     // put negative max buckets to make field invalid
     this.selectOption('max_buckets_mode', 'Disabled');
@@ -150,7 +150,7 @@ export class UsersPageHelper extends PageHelper {
     cy.get('#max_buckets').should('have.class', 'ng-invalid');
     cy.get('cds-number[for=max_buckets]')
       .find('.invalid-feedback')
-      .should('have.text', 'The entered value must be >= 1.');
+      .should('contain.text', 'The entered value must be >= 1.');
 
     this.navigateTo();
     this.delete(tenant + '$' + uname, null, null, true, false, false, true);
@@ -178,13 +178,13 @@ export class UsersPageHelper extends PageHelper {
     cy.get(`select[id=${selection_name}]`).should('exist');
     cy.get(`select[id=${selection_name}]`).select(account_id);
     cy.get(`select[id=${selection_name}] option:checked`).should(
-      'have.text',
+      'contain.text',
       `${account_name} - ${tenant}`
     );
     cy.contains('button', 'Edit User').click();
 
     this.getTableRow(tenant + '$' + user_id).as('AccountUser');
-    cy.get('@AccountUser').find('td').eq(3).should('have.text', `${account_name}`);
+    cy.get('@AccountUser').find('td').eq(3).should('contain.text', `${account_name}`);
 
     // check table details if we have all the details there
     this.getExpandCollapseElement(username).should('be.visible').click();
@@ -198,29 +198,29 @@ export class UsersPageHelper extends PageHelper {
         .eq(0)
         .within(() => {
           cy.wait(500);
-          cy.get('td').eq(0).should('have.text', 'Account ID');
-          cy.get('td').eq(1).should('have.text', account_id);
+          cy.get('td').eq(0).should('contain.text', 'Account ID');
+          cy.get('td').eq(1).should('contain.text', account_id);
         });
       cy.get('tr')
         .eq(1)
         .within(() => {
           cy.wait(500);
-          cy.get('td').eq(0).should('have.text', 'Name');
-          cy.get('td').eq(1).should('have.text', account_name);
+          cy.get('td').eq(0).should('contain.text', 'Name');
+          cy.get('td').eq(1).should('contain.text', account_name);
         });
       cy.get('tr')
         .eq(2)
         .within(() => {
           cy.wait(500);
-          cy.get('td').eq(0).should('have.text', 'Tenant');
-          cy.get('td').eq(1).should('have.text', tenant);
+          cy.get('td').eq(0).should('contain.text', 'Tenant');
+          cy.get('td').eq(1).should('contain.text', tenant);
         });
       cy.get('tr')
         .eq(3)
         .within(() => {
           cy.wait(500);
-          cy.get('td').eq(0).should('have.text', 'User type');
-          cy.get('td').eq(1).should('have.text', 'rgw user');
+          cy.get('td').eq(0).should('contain.text', 'User type');
+          cy.get('td').eq(1).should('contain.text', 'rgw user');
         });
     });
   }
@@ -231,7 +231,7 @@ export class UsersPageHelper extends PageHelper {
     this.navigateEdit(username);
     cy.get(`select[id=${selection_name}]`).should('exist').should('be.disabled');
     cy.get(`select[id=${selection_name}] option:checked`).should(
-      'have.text',
+      'contain.text',
       `${account_name} - ${tenant}`
     );
     cy.get('input#account_root_user_input').check({ force: true });
@@ -250,8 +250,8 @@ export class UsersPageHelper extends PageHelper {
         .eq(3)
         .within(() => {
           cy.wait(500);
-          cy.get('td').eq(0).should('have.text', 'User type');
-          cy.get('td').eq(1).should('have.text', 'Account root user');
+          cy.get('td').eq(0).should('contain.text', 'User type');
+          cy.get('td').eq(1).should('contain.text', 'Account root user');
         });
     });
   }
diff --git a/src/pybind/mgr/dashboard/frontend/eslint.config.mjs b/src/pybind/mgr/dashboard/frontend/eslint.config.mjs
index 9809a42a9e5..b2bd6c18603 100644
--- a/src/pybind/mgr/dashboard/frontend/eslint.config.mjs
+++ b/src/pybind/mgr/dashboard/frontend/eslint.config.mjs
@@ -11,7 +11,6 @@ export default tseslint.config(
     extends: [
       eslint.configs.recommended,
       ...tseslint.configs.recommended,
-      ...tseslint.configs.recommendedTypeChecked,
       ...angular.configs.tsRecommended
     ],
     processor: angular.processInlineTemplates,
@@ -21,63 +20,58 @@ export default tseslint.config(
         createDefaultProgram: true
       }
     },
+    linterOptions: {
+      reportUnusedDisableDirectives: false
+    }
+  },
+  {
+    files: ['**/*.ts'],
     rules: {
-      'no-multiple-empty-lines': [
-        'error',
-        {
-          max: 2,
-          maxEOF: 1
-        }
-      ],
-      'spaced-comment': [
-        'error',
-        'always',
-        {
-          exceptions: ['-', '+', '*']
-        }
-      ],
-      curly: ['error', 'multi-line'],
+      'no-multiple-empty-lines': ['error', { max: 2, maxEOF: 1 }],
+      'spaced-comment': ['error', 'always', { exceptions: ['-', '+', '*'] }],
+      'curly': ['error', 'multi-line'],
       'guard-for-in': 'error',
       'no-restricted-imports': [
         'error',
         {
-          paths: [
-            'rxjs/Rx',
-            {
-              name: '@angular/core/testing',
-              importNames: ['async']
-            }
-          ],
+          paths: ['rxjs/Rx', { name: '@angular/core/testing', importNames: ['async'] }],
           patterns: ['(\\.{1,2}/){2,}']
         }
       ],
-      'no-console': [
-        'error',
-        {
-          allow: ['debug', 'info', 'time', 'timeEnd', 'trace']
-        }
-      ],
+      'no-console': ['error', { allow: ['debug', 'info', 'time', 'timeEnd', 'trace'] }],
       'no-trailing-spaces': 'error',
       'no-caller': 'error',
       'no-bitwise': 'error',
       'no-duplicate-imports': 'error',
       'no-eval': 'error',
-      '@angular-eslint/directive-selector': [
-        'error',
-        {
-          type: 'attribute',
-          prefix: 'cd',
-          style: 'camelCase'
-        }
-      ],
-      '@angular-eslint/component-selector': [
-        'error',
-        {
-          type: 'element',
-          prefix: 'cd',
-          style: 'kebab-case'
-        }
-      ]
+      '@angular-eslint/directive-selector': ['error', { type: 'attribute', prefix: 'cd', style: 'camelCase' }],
+      '@angular-eslint/component-selector': ['error', { type: 'element', prefix: 'cd', style: 'kebab-case' }],
+
+      // @TODO: revisit and remove them by fixing the respective errors in ts files
+      '@angular-eslint/prefer-standalone': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-unused-vars': 'off',
+      '@typescript-eslint/no-unsafe-function-type': 'off',
+      '@typescript-eslint/no-this-alias': 'off',
+      '@typescript-eslint/no-wrapper-object-types': 'off',
+      '@typescript-eslint/no-unused-expressions': 'off',
+      '@typescript-eslint/no-empty-object-type': 'off',
+      '@typescript-eslint/no-require-imports': 'off',
+      '@typescript-eslint/no-array-constructor': 'off',
+      '@typescript-eslint/no-duplicate-enum-values': 'off',
+      '@typescript-eslint/ban-ts-comment': 'off',
+      '@typescript-eslint/unbound-method': 'off',
+      'no-useless-escape': 'off',
+      'no-empty': 'off',
+      'prefer-const': 'off',
+      'no-prototype-builtins': 'off',
+      'no-case-declarations': 'off',
+      'no-extra-boolean-cast': 'off',
+      'prefer-spread': 'off',
+      'prefer-rest-params': 'off',
+      'no-constant-binary-expression': 'off',
+      'no-sparse-arrays': 'off',
+      'no-var': 'off'
     }
   },
   {
@@ -97,7 +91,7 @@ export default tseslint.config(
       '@angular-eslint/template/interactive-supports-focus': 'error',
       '@angular-eslint/template/click-events-have-key-events': 'error',
       '@angular-eslint/template/label-has-associated-control': 'error',
-      '@angular-eslint/template/elements-content': 'error'
+      '@angular-eslint/template/elements-content': 'error',
     }
   }
 );
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html
index 90d700ed378..e3706249c3c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-discovery-modal/iscsi-target-discovery-modal.component.html
@@ -68,6 +68,8 @@
                 type="button"
                 class="btn btn-light"
                 cdPasswordButton="password"
+                aria-label="Toggle visibility"
+                i18n-aria-label
               ></button>
               <cd-copy-2-clipboard-button source="password"> </cd-copy-2-clipboard-button>
             </div>
@@ -144,6 +146,8 @@
                 type="button"
                 class="btn btn-light"
                 cdPasswordButton="mutual_password"
+                aria-label="Toggle visibility"
+                i18n-aria-label
               ></button>
               <cd-copy-2-clipboard-button source="mutual_password"> </cd-copy-2-clipboard-button>
             </div>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
index 50411519940..dd33d4edfaa 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/iscsi-target-form/iscsi-target-form.component.html
@@ -352,6 +352,8 @@
                   type="button"
                   class="btn btn-light"
                   cdPasswordButton="target_password"
+                  aria-label="Toggle visibility"
+                  i18n-aria-label
                 ></button>
                 <cd-copy-2-clipboard-button source="target_password"> </cd-copy-2-clipboard-button>
               </div>
@@ -431,6 +433,8 @@
                   type="button"
                   class="btn btn-light"
                   cdPasswordButton="target_mutual_password"
+                  aria-label="Toggle visibility"
+                  i18n-aria-label
                 ></button>
                 <cd-copy-2-clipboard-button source="target_mutual_password">
                 </cd-copy-2-clipboard-button>
@@ -480,6 +484,8 @@
                   type="button"
                   class="btn-close float-end"
                   (click)="removeInitiator(ii)"
+                  aria-label="Remove initiator"
+                  i18n-aria-label
                 ></button>
               </div>
               <div class="card-body">
@@ -579,6 +585,8 @@
                           type="button"
                           class="btn btn-light"
                           [cdPasswordButton]="'password' + ii"
+                          aria-label="Toggle visibility"
+                          i18n-aria-label
                         ></button>
                         <cd-copy-2-clipboard-button [source]="'password' + ii">
                         </cd-copy-2-clipboard-button>
@@ -656,6 +664,8 @@
                           type="button"
                           class="btn btn-light"
                           [cdPasswordButton]="'mutual_password' + ii"
+                          aria-label="Toggle visibility"
+                          i18n-aria-label
                         ></button>
                         <cd-copy-2-clipboard-button [source]="'mutual_password' + ii">
                         </cd-copy-2-clipboard-button>
@@ -791,6 +801,8 @@
                   type="button"
                   class="btn-close float-end"
                   (click)="removeGroup(gi)"
+                  aria-label="Remove group"
+                  i18n-aria-label
                 ></button>
               </div>
               <div class="card-body">
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.ts
index 0ba9663ef18..51dde679da9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/mirroring/bootstrap-create-modal/bootstrap-create-modal.component.ts
@@ -28,7 +28,8 @@ import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 })
 export class BootstrapCreateModalComponent
   extends BaseModal
-  implements OnDestroy, OnInit, AfterViewInit {
+  implements OnDestroy, OnInit, AfterViewInit
+{
   pools: any[] = [];
   token: string;
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.spec.ts
index 5893c72414a..d2e532526c5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-gateway-view/nvme-gateway-view.component.spec.ts
@@ -9,15 +9,13 @@ describe('NvmeGatewayViewComponent', () => {
   let component: NvmeGatewayViewComponent;
   let fixture: ComponentFixture<NvmeGatewayViewComponent>;
 
-  beforeEach(
-    waitForAsync(() => {
-      TestBed.configureTestingModule({
-        declarations: [NvmeGatewayViewComponent],
-        imports: [RouterTestingModule, SideNavModule, ThemeModule],
-        schemas: [CUSTOM_ELEMENTS_SCHEMA]
-      }).compileComponents();
-    })
-  );
+  beforeEach(waitForAsync(() => {
+    TestBed.configureTestingModule({
+      declarations: [NvmeGatewayViewComponent],
+      imports: [RouterTestingModule, SideNavModule, ThemeModule],
+      schemas: [CUSTOM_ELEMENTS_SCHEMA]
+    }).compileComponents();
+  }));
 
   beforeEach(() => {
     fixture = TestBed.createComponent(NvmeGatewayViewComponent);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-subsystem-view/nvme-subsystem-view.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-subsystem-view/nvme-subsystem-view.component.spec.ts
index 7e6c5cba673..c1c216825a2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-subsystem-view/nvme-subsystem-view.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvme-subsystem-view/nvme-subsystem-view.component.spec.ts
@@ -20,16 +20,14 @@ describe('NvmeSubsystemViewComponent', () => {
     queryParams: of(mockQueryParams)
   };
 
-  beforeEach(
-    waitForAsync(() => {
-      TestBed.configureTestingModule({
-        declarations: [NvmeSubsystemViewComponent],
-        imports: [RouterTestingModule, HttpClientTestingModule],
-        providers: [{ provide: ActivatedRoute, useValue: mockActivatedRoute }],
-        schemas: [CUSTOM_ELEMENTS_SCHEMA]
-      }).compileComponents();
-    })
-  );
+  beforeEach(waitForAsync(() => {
+    TestBed.configureTestingModule({
+      declarations: [NvmeSubsystemViewComponent],
+      imports: [RouterTestingModule, HttpClientTestingModule],
+      providers: [{ provide: ActivatedRoute, useValue: mockActivatedRoute }],
+      schemas: [CUSTOM_ELEMENTS_SCHEMA]
+    }).compileComponents();
+  }));
 
   beforeEach(() => {
     fixture = TestBed.createComponent(NvmeSubsystemViewComponent);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts
index a60fe0d3e81..d5979b9658e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-authentication/nvmeof-edit-authentication.component.spec.ts
@@ -21,10 +21,9 @@ import { NvmeofSubsystemsStepThreeComponent } from '../nvmeof-subsystems-form/nv
 describe('NvmeofEditAuthenticationComponent', () => {
   let component: NvmeofEditAuthenticationComponent;
   let fixture: ComponentFixture<NvmeofEditAuthenticationComponent>;
-  let nvmeofService: jest.Mocked<Pick<
-    NvmeofService,
-    'getInitiators' | 'getSubsystem' | 'updateAuthenticationKey'
-  >>;
+  let nvmeofService: jest.Mocked<
+    Pick<NvmeofService, 'getInitiators' | 'getSubsystem' | 'updateAuthenticationKey'>
+  >;
   let notificationService: { show: jest.Mock };
   let modalService: { dismissAll: jest.Mock };
 
@@ -36,38 +35,36 @@ describe('NvmeofEditAuthenticationComponent', () => {
   ];
   const mockHostsWithKey = [{ nqn: 'nqn.2014-08.org.nvmexpress:uuid:host-1', use_dhchap: true }];
 
-  beforeEach(
-    waitForAsync(() => {
-      nvmeofService = {
-        getInitiators: jest.fn().mockReturnValue(of([])),
-        getSubsystem: jest.fn().mockReturnValue(of({ has_dhchap_key: false })),
-        updateAuthenticationKey: jest.fn().mockReturnValue(of(undefined))
-      };
-      notificationService = { show: jest.fn() };
-      modalService = { dismissAll: jest.fn() };
+  beforeEach(waitForAsync(() => {
+    nvmeofService = {
+      getInitiators: jest.fn().mockReturnValue(of([])),
+      getSubsystem: jest.fn().mockReturnValue(of({ has_dhchap_key: false })),
+      updateAuthenticationKey: jest.fn().mockReturnValue(of(undefined))
+    };
+    notificationService = { show: jest.fn() };
+    modalService = { dismissAll: jest.fn() };
 
-      TestBed.configureTestingModule({
-        declarations: [NvmeofEditAuthenticationComponent, NvmeofSubsystemsStepThreeComponent],
-        imports: [
-          ReactiveFormsModule,
-          HttpClientTestingModule,
-          RouterTestingModule,
-          SharedModule,
-          GridModule,
-          InputModule,
-          RadioModule,
-          TagModule
-        ],
-        providers: [
-          { provide: NvmeofService, useValue: nvmeofService },
-          { provide: NotificationService, useValue: notificationService },
-          { provide: ModalCdsService, useValue: modalService },
-          { provide: SUBSYSTEM_NQN_TOKEN, useValue: mockSubsystemNQN },
-          { provide: GROUP_NAME_TOKEN, useValue: mockGroupName }
-        ]
-      }).compileComponents();
-    })
-  );
+    TestBed.configureTestingModule({
+      declarations: [NvmeofEditAuthenticationComponent, NvmeofSubsystemsStepThreeComponent],
+      imports: [
+        ReactiveFormsModule,
+        HttpClientTestingModule,
+        RouterTestingModule,
+        SharedModule,
+        GridModule,
+        InputModule,
+        RadioModule,
+        TagModule
+      ],
+      providers: [
+        { provide: NvmeofService, useValue: nvmeofService },
+        { provide: NotificationService, useValue: notificationService },
+        { provide: ModalCdsService, useValue: modalService },
+        { provide: SUBSYSTEM_NQN_TOKEN, useValue: mockSubsystemNQN },
+        { provide: GROUP_NAME_TOKEN, useValue: mockGroupName }
+      ]
+    }).compileComponents();
+  }));
 
   beforeEach(() => {
     fixture = TestBed.createComponent(NvmeofEditAuthenticationComponent);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.spec.ts
index 6a497e36cc3..6fd5cd2a454 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-edit-host-key-modal/nvmeof-edit-host-key-modal.component.spec.ts
@@ -29,22 +29,20 @@ describe('NvmeofEditHostKeyModalComponent', () => {
     wrapTaskAroundCall: jasmine.createSpy('wrapTaskAroundCall').and.callFake(({ call }) => call)
   };
 
-  beforeEach(
-    waitForAsync(() => {
-      TestBed.configureTestingModule({
-        declarations: [NvmeofEditHostKeyModalComponent],
-        imports: [ReactiveFormsModule, HttpClientTestingModule, RouterTestingModule, SharedModule],
-        providers: [
-          { provide: NvmeofService, useValue: nvmeofServiceSpy },
-          { provide: TaskWrapperService, useValue: taskWrapperServiceSpy },
-          { provide: 'subsystemNQN', useValue: mockSubsystemNQN },
-          { provide: 'hostNQN', useValue: mockHostNQN },
-          { provide: 'group', useValue: mockGroup },
-          { provide: 'dhchapKey', useValue: '' }
-        ]
-      }).compileComponents();
-    })
-  );
+  beforeEach(waitForAsync(() => {
+    TestBed.configureTestingModule({
+      declarations: [NvmeofEditHostKeyModalComponent],
+      imports: [ReactiveFormsModule, HttpClientTestingModule, RouterTestingModule, SharedModule],
+      providers: [
+        { provide: NvmeofService, useValue: nvmeofServiceSpy },
+        { provide: TaskWrapperService, useValue: taskWrapperServiceSpy },
+        { provide: 'subsystemNQN', useValue: mockSubsystemNQN },
+        { provide: 'hostNQN', useValue: mockHostNQN },
+        { provide: 'group', useValue: mockGroup },
+        { provide: 'dhchapKey', useValue: '' }
+      ]
+    }).compileComponents();
+  }));
 
   beforeEach(() => {
     fixture = TestBed.createComponent(NvmeofEditHostKeyModalComponent);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts
index de6732de69e..65c48edd367 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-gateway-subsystem/nvmeof-gateway-subsystem.component.ts
@@ -36,7 +36,10 @@ export class NvmeofGatewaySubsystemComponent implements OnInit {
   authType = NvmeofSubsystemAuthType;
   emptyStateImage = EMPTY_STATE_IMAGE;
 
-  constructor(private nvmeofService: NvmeofService, private route: ActivatedRoute) {}
+  constructor(
+    private nvmeofService: NvmeofService,
+    private route: ActivatedRoute
+  ) {}
 
   ngOnInit(): void {
     this.columns = [
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
index 789054cc746..1f16cf609eb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-initiators-form/nvmeof-initiators-form.component.ts
@@ -133,8 +133,8 @@ export class NvmeofInitiatorsFormComponent implements OnInit {
         this.tearsheet?.getStepIndexByLabel(STEP_LABELS.HOSTS) ?? 0,
         0
       );
-      const hostStepForm = this.tearsheet?.stepContents?.toArray()?.[hostStepIndex]?.stepComponent
-        ?.formGroup;
+      const hostStepForm =
+        this.tearsheet?.stepContents?.toArray()?.[hostStepIndex]?.stepComponent?.formGroup;
 
       hostStepForm?.markAllAsTouched();
       hostStepForm?.get('hostname')?.markAsTouched();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.ts
index 57c3aaa913c..b5b8fb26647 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-namespaces-form/nvmeof-namespaces-form.component.ts
@@ -178,7 +178,7 @@ export class NvmeofNamespacesFormComponent implements OnInit {
     this.nvmeofService.listNamespaces(this.group).subscribe((response: any) => {
       const namespaces: NvmeofSubsystemNamespace[] = Array.isArray(response)
         ? response
-        : response?.namespaces ?? [];
+        : (response?.namespaces ?? []);
       this.usedRbdImages = namespaces.reduce((map, ns) => {
         if (!map.has(ns.rbd_pool_name)) {
           map.set(ns.rbd_pool_name, new Set<string>());
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
index 55c2dee5937..285b83069e7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.html
@@ -62,7 +62,6 @@
                 </a>
               </div>
             </div>
-
           } @else if (detail.type === 'listeners') {
             <div
               cdsCol
@@ -82,7 +81,6 @@
               </div>
               <span class="cds--type-label-02">{{ detail.value }}</span>
             </div>
-
           } @else if (detail.type === 'host-access') {
             <div
               cdsCol
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
index 84e1abee4a8..8a414db1ef5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-overview/nvmeof-subsystem-overview.component.ts
@@ -87,8 +87,7 @@ export class NvmeofSubsystemOverviewComponent implements OnInit, OnDestroy {
     }).subscribe(({ subsystem, initiators }) => {
       this.subsystem = subsystem as NvmeofSubsystem;
       const initiatorList = initiators as
-        | NvmeofSubsystemInitiator[]
-        | { hosts?: NvmeofSubsystemInitiator[] };
+        NvmeofSubsystemInitiator[] | { hosts?: NvmeofSubsystemInitiator[] };
       this.buildDetails(getSubsystemAuthStatus(this.subsystem, initiatorList));
     });
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.ts
index e54087c7bcb..2f0fb0195d1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystem-performance/nvmeof-subsystem-performance.component.ts
@@ -14,7 +14,10 @@ export class NvmeofSubsystemPerformanceComponent implements OnInit {
   groupName: string;
   permissions: Permissions;
 
-  constructor(private route: ActivatedRoute, private authStorageService: AuthStorageService) {
+  constructor(
+    private route: ActivatedRoute,
+    private authStorageService: AuthStorageService
+  ) {
     this.permissions = this.authStorageService.getPermissions();
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts
index 8894178b9d6..09ae0a6473e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-1/nvmeof-subsystem-step-1.component.ts
@@ -46,8 +46,10 @@ export class NvmeofSubsystemsStepOneComponent implements OnInit, TearsheetStep {
   ) {}
 
   DEFAULT_NQN = 'nqn.2001-07.com.ceph:' + Date.now();
-  NQN_REGEX = /^nqn\.(19|20)\d\d-(0[1-9]|1[0-2])\.\D{2,3}(\.[A-Za-z0-9-]+)+(:[A-Za-z0-9-\.]+(:[A-Za-z0-9-\.]+)*)$/;
-  NQN_REGEX_UUID = /^nqn\.2014-08\.org\.nvmexpress:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+  NQN_REGEX =
+    /^nqn\.(19|20)\d\d-(0[1-9]|1[0-2])\.\D{2,3}(\.[A-Za-z0-9-]+)+(:[A-Za-z0-9-\.]+(:[A-Za-z0-9-\.]+)*)$/;
+  NQN_REGEX_UUID =
+    /^nqn\.2014-08\.org\.nvmexpress:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 
   customNQNValidator = CdValidators.custom(
     'nqnPattern',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts
index 3829ed3d201..70420ec7d1f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-2/nvmeof-subsystem-step-2.component.ts
@@ -35,8 +35,10 @@ export class NvmeofSubsystemsStepTwoComponent implements OnInit, TearsheetStep {
   addedHostsLength: number = 0;
   csvUploadError = '';
   csvDropText: string = $localize`Drag and drop files here or click to upload`;
-  NQN_REGEX = /^nqn\.(19|20)\d\d-(0[1-9]|1[0-2])\.\D{2,3}(\.[A-Za-z0-9-]+)+(:[A-Za-z0-9-\.]+(:[A-Za-z0-9-\.]+)*)$/;
-  NQN_REGEX_UUID = /^nqn\.2014-08\.org\.nvmexpress:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+  NQN_REGEX =
+    /^nqn\.(19|20)\d\d-(0[1-9]|1[0-2])\.\D{2,3}(\.[A-Za-z0-9-]+)+(:[A-Za-z0-9-\.]+(:[A-Za-z0-9-\.]+)*)$/;
+  NQN_REGEX_UUID =
+    /^nqn\.2014-08\.org\.nvmexpress:uuid:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
   uploadedHosts = new Set<string>();
 
   constructor(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.ts
index 1a3d2c11449..d827e35c882 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/nvmeof-subsystems-form/nvmeof-subsystem-step-4/nvmeof-subsystem-step-4.component.ts
@@ -26,7 +26,10 @@ export class NvmeofSubsystemsStepFourComponent implements OnInit, TearsheetStep
   HOST_TYPE = HOST_TYPE;
   AUTHENTICATION = AUTHENTICATION;
 
-  constructor(public actionLabels: ActionLabelsI18n, public activeModal: NgbActiveModal) {}
+  constructor(
+    public actionLabels: ActionLabelsI18n,
+    public activeModal: NgbActiveModal
+  ) {}
 
   ngOnInit() {
     this.formGroup = new CdFormGroup({});
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.spec.ts
index 29a37b3b752..f42b5dcaf4f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-form/rbd-form.component.spec.ts
@@ -114,7 +114,7 @@ describe('RbdFormComponent', () => {
         flags_names,
         application_metadata,
         type
-      } as Pool);
+      }) as Pool;
 
     beforeEach(() => {
       createAction = spyOn(component, 'createAction').and.returnValue(of(null));
@@ -133,7 +133,7 @@ describe('RbdFormComponent', () => {
       ];
       spyOn(TestBed.inject(PoolService), 'list').and.callFake(() => of(mock.pools));
       rbdServiceGetSpy = spyOn(TestBed.inject(RbdService), 'get');
-      mock.rbd = ({ pool_name: 'foo', pool_image: 'bar' } as any) as RbdFormResponseModel;
+      mock.rbd = { pool_name: 'foo', pool_image: 'bar' } as any as RbdFormResponseModel;
       rbdServiceGetSpy.and.returnValue(of(mock.rbd));
       component.mode = undefined;
     });
@@ -487,8 +487,9 @@ describe('RbdFormComponent', () => {
         const journal = fixture.debugElement.query(By.css('#journal')).nativeElement;
         journal.click();
         fixture.detectChanges();
-        const exclusiveLocks = fixture.debugElement.query(By.css('#exclusive-lock_input'))
-          .nativeElement;
+        const exclusiveLocks = fixture.debugElement.query(
+          By.css('#exclusive-lock_input')
+        ).nativeElement;
         expect(exclusiveLocks.checked).toBe(true);
         expect(exclusiveLocks.disabled).toBe(true);
       });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.spec.ts
index bdeefe34b4d..056ad5eda53 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/block/rbd-snapshot-form/rbd-snapshot-form-modal.component.spec.ts
@@ -48,10 +48,10 @@ describe('RbdSnapshotFormModalComponent', () => {
     fixture.detectChanges();
 
     const header = fixture.debugElement.nativeElement.querySelector('cds-modal-header h3');
-    expect(header.textContent).toBe('Create RBD Snapshot');
+    expect(header.textContent.trim()).toBe('Create RBD Snapshot');
 
     const button = fixture.debugElement.nativeElement.querySelector('cd-submit-button');
-    expect(button.textContent).toBe('Create RBD Snapshot');
+    expect(button.textContent.trim()).toBe('Create RBD Snapshot');
   });
 
   it('should show "Rename" text', () => {
@@ -60,10 +60,10 @@ describe('RbdSnapshotFormModalComponent', () => {
     fixture.detectChanges();
 
     const header = fixture.debugElement.nativeElement.querySelector('cds-modal-header h3');
-    expect(header.textContent).toBe('Rename RBD Snapshot');
+    expect(header.textContent.trim()).toBe('Rename RBD Snapshot');
 
     const button = fixture.debugElement.nativeElement.querySelector('cd-submit-button');
-    expect(button.textContent).toBe('Rename RBD Snapshot');
+    expect(button.textContent.trim()).toBe('Rename RBD Snapshot');
   });
 
   it('should enable the mirror image snapshot creation when peer is configured', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.ts
index 80dd7560dc2..9b9545d81ce 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-detail/cephfs-detail.component.ts
@@ -33,7 +33,10 @@ export class CephfsDetailComponent implements OnChanges, OnInit {
 
   objectValues = Object.values;
 
-  constructor(private dimlessBinary: DimlessBinaryPipe, private dimless: DimlessPipe) {}
+  constructor(
+    private dimlessBinary: DimlessBinaryPipe,
+    private dimless: DimlessPipe
+  ) {}
 
   ngOnChanges() {
     this.setStandbys();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.ts
index 82d6bf2caad..c31e2af2a25 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-directories/cephfs-directories.component.ts
@@ -499,8 +499,8 @@ export class CephfsDirectoriesComponent implements OnInit, OnChanges {
       this.selectedDir.quotas[key] === 0
         ? this.actionLabels.SET
         : values[key] === 0
-        ? this.actionLabels.UNSET
-        : $localize`Updated`;
+          ? this.actionLabels.UNSET
+          : $localize`Updated`;
     this.cephfsService.quota(this.id, path, values).subscribe(() => {
       if (onSuccess) {
         onSuccess();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.ts
index d22fb82c2c3..54611bed9b0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-filesystem-selector/cephfs-filesystem-selector.component.ts
@@ -82,9 +82,8 @@ export class CephfsFilesystemSelectorComponent implements OnInit {
         if (!listResponse?.length) {
           return of([]);
         }
-        const detailRequests = listResponse.map(
-          (fs): Observable<CephfsDetail | null> =>
-            this.cephfsService.getCephfs(fs.id).pipe(catchError(() => of(null)))
+        const detailRequests = listResponse.map((fs): Observable<CephfsDetail | null> =>
+          this.cephfsService.getCephfs(fs.id).pipe(catchError(() => of(null)))
         );
         return forkJoin(detailRequests).pipe(
           map((details: Array<CephfsDetail | null>) =>
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.spec.ts
index 67397af8de5..6406f138eff 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-mirroring-wizard/cephfs-mirroring-wizard.component.spec.ts
@@ -25,15 +25,15 @@ describe('CephfsMirroringWizardComponent', () => {
   ];
 
   beforeEach(async () => {
-    wizardStepsService = ({
+    wizardStepsService = {
       setTotalSteps: jest.fn(),
       setCurrentStep: jest.fn(),
       steps$: new BehaviorSubject<WizardStepModel[]>(mockSteps)
-    } as unknown) as jest.Mocked<WizardStepsService>;
+    } as unknown as jest.Mocked<WizardStepsService>;
 
-    router = ({
+    router = {
       navigate: jest.fn()
-    } as unknown) as jest.Mocked<Router>;
+    } as unknown as jest.Mocked<Router>;
 
     await TestBed.configureTestingModule({
       imports: [ReactiveFormsModule, RadioModule],
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.ts
index 91a6deb95d8..9f5951277a6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-form/cephfs-snapshotschedule-form.component.ts
@@ -187,9 +187,10 @@ export class CephfsSnapshotscheduleFormComponent extends CdForm implements OnIni
         // retention policies
         schedule.retention &&
           Object.entries(schedule.retention).forEach(([frequency, interval], idx) => {
-            const freqKey = Object.keys(RetentionFrequency)[
-              Object.values(RetentionFrequency).indexOf(frequency as any)
-            ];
+            const freqKey =
+              Object.keys(RetentionFrequency)[
+                Object.values(RetentionFrequency).indexOf(frequency as any)
+              ];
             this.retentionPolicies.push(
               new FormGroup({
                 retentionInterval: new FormControl(interval),
@@ -284,9 +285,9 @@ export class CephfsSnapshotscheduleFormComponent extends CdForm implements OnIni
         const values = this.snapScheduleForm.value as SnapshotScheduleFormValue;
 
         if (this.isEdit) {
-          const retentionPoliciesToAdd = (this.snapScheduleForm.get(
-            'retentionPolicies'
-          ) as FormArray).controls
+          const retentionPoliciesToAdd = (
+            this.snapScheduleForm.get('retentionPolicies') as FormArray
+          ).controls
             ?.filter(
               (ctrl) =>
                 !ctrl.get('retentionInterval').disabled && !ctrl.get('retentionFrequency').disabled
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.ts
index 6cb73db368e..e940ddf83bb 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-snapshotschedule-list/cephfs-snapshotschedule-list.component.ts
@@ -37,7 +37,8 @@ import { ModalCdsService } from '~/app/shared/services/modal-cds.service';
 })
 export class CephfsSnapshotscheduleListComponent
   extends CdForm
-  implements OnInit, OnChanges, OnDestroy {
+  implements OnInit, OnChanges, OnDestroy
+{
   @Input() fsName!: string;
   @Input() id!: number;
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.ts
index 813d64e5310..f1b5dd23c03 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cephfs/cephfs-subvolume-form/cephfs-subvolume-form.component.ts
@@ -129,8 +129,9 @@ export class CephfsSubvolumeFormComponent extends CdForm implements OnInit {
 
   private isSnapshotVisibilityEnabled(option?: ConfigFormModel) {
     const values = option?.value ?? [];
-    const clientValue = values.find((entry) => entry.section === SNAPSHOT_VISIBILITY_CONFIG_SECTION)
-      ?.value;
+    const clientValue = values.find(
+      (entry) => entry.section === SNAPSHOT_VISIBILITY_CONFIG_SECTION
+    )?.value;
     return String(clientValue).toLowerCase() === 'true';
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
index 224ecef3b4f..b0a47a83de1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.html
@@ -237,7 +237,6 @@
       </div>
     </div>
   </div>
-
 } @else {
   <cd-tearsheet
     type="full"
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.spec.ts
index 7ee0b057494..3ea00bc1837 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/create-cluster/create-cluster.component.spec.ts
@@ -125,7 +125,7 @@ describe('CreateClusterComponent', () => {
     stepFixture.detectChanges();
     const skipBtn = stepFixture.debugElement.query(By.css('#skipStepBtn')).nativeElement;
     expect(skipBtn).not.toBe(null);
-    expect(skipBtn.innerHTML).toBe('Skip');
+    expect(skipBtn.textContent.trim()).toBe('Skip');
   });
 
   it('should skip the Create OSDs step', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.spec.ts
index a75b6766b0c..b18d10387fd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.spec.ts
@@ -34,7 +34,7 @@ describe('CrushmapComponent', () => {
 
   it('should display right title', () => {
     const span = debugElement.nativeElement.querySelector('.card-header');
-    expect(span.textContent).toBe('CRUSH map viewer');
+    expect(span.textContent.trim()).toBe('CRUSH map viewer');
   });
 
   it('should display "No nodes!" if ceph tree nodes is empty array', fakeAsync(() => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.ts
index 716576798ae..296806be5d9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/crushmap/crushmap.component.ts
@@ -52,7 +52,10 @@ export class CrushmapComponent implements OnDestroy, OnInit {
   metadataKeyMap: { [key: number]: any } = {};
   data$: Observable<object>;
 
-  constructor(private crushRuleService: CrushRuleService, private timerService: TimerService) {}
+  constructor(
+    private crushRuleService: CrushRuleService,
+    private timerService: TimerService
+  ) {}
 
   ngOnInit() {
     this.sub = this.timerService
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts
index 9384acdca68..28a7602e133 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/hosts/host-details/host-details.component.ts
@@ -19,7 +19,10 @@ export class HostDetailsComponent implements OnInit, OnDestroy {
   hostname = '';
   sidebarItems: SidebarItem[] = [];
 
-  constructor(private route: ActivatedRoute, private authStorageService: AuthStorageService) {}
+  constructor(
+    private route: ActivatedRoute,
+    private authStorageService: AuthStorageService
+  ) {}
 
   ngOnInit(): void {
     const permissions = this.authStorageService.getPermissions();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.ts
index dcd232d9a7f..cb87db30c4b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster.component.ts
@@ -446,9 +446,8 @@ export class MultiClusterComponent implements OnInit, OnDestroy {
                     (errorEntry) => errorEntry.url === clusterDetails.url
                   );
                   if (errorIndex !== -1) {
-                    this.prometheusConnectionErrors[
-                      errorIndex
-                    ].reconnectionError = reconnectionError;
+                    this.prometheusConnectionErrors[errorIndex].reconnectionError =
+                      reconnectionError;
                   }
                 },
                 next: (response: any) => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.ts
index 97ec8c7b3f4..a00b6898115 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-details/osd-details.component.ts
@@ -23,7 +23,10 @@ export class OsdDetailsComponent implements OnChanges {
   };
   grafanaPermission: Permission;
 
-  constructor(private osdService: OsdService, private authStorageService: AuthStorageService) {
+  constructor(
+    private osdService: OsdService,
+    private authStorageService: AuthStorageService
+  ) {
     this.grafanaPermission = this.authStorageService.getPermissions().grafana;
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.spec.ts
index 21f3b36dea5..a021853e16c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/osd/osd-list/osd-list.component.spec.ts
@@ -517,13 +517,7 @@ describe('OsdListComponent', () => {
     const expectOsdServiceMethodCalled = (
       actionName: string,
       osdServiceMethodName:
-        | 'markOut'
-        | 'markIn'
-        | 'markDown'
-        | 'markLost'
-        | 'purge'
-        | 'destroy'
-        | 'delete'
+        'markOut' | 'markIn' | 'markDown' | 'markLost' | 'purge' | 'destroy' | 'delete'
     ): void => {
       const osdServiceSpy = spyOn(osdService, osdServiceMethodName).and.callFake(() => EMPTY);
       openActionModal(actionName);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
index 1e213685305..7cdd9abb7b2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/services/service-form/service-form.component.ts
@@ -62,7 +62,8 @@ export class ServiceFormComponent extends CdForm implements OnInit {
   readonly SNMP_ENGINE_ID_PATTERN = /^[0-9A-Fa-f]{10,64}/g;
   readonly INGRESS_SUPPORTED_SERVICE_TYPES = ['rgw', 'nfs'];
   readonly SMB_CONFIG_URI_PATTERN = /^(http:|https:|rados:|rados:mon-config-key:)/;
-  readonly OAUTH2_ISSUER_URL_PATTERN = /^(https?:\/\/)?([a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)+)(:[0-9]{1,5})?(\/.*)?$/;
+  readonly OAUTH2_ISSUER_URL_PATTERN =
+    /^(https?:\/\/)?([a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)+)(:[0-9]{1,5})?(\/.*)?$/;
   readonly SSL_CIPHERS_PATTERN = /^[a-zA-Z0-9\-:]+$/;
   readonly DEFAULT_SSL_PROTOCOL_ITEM = [{ content: 'TLSv1.3', selected: true }];
   @ViewChild(NgbTypeahead, { static: false })
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.spec.ts
index 89ba7e06187..e77e3b5d767 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/upgrade/upgrade.component.spec.ts
@@ -116,9 +116,8 @@ describe('UpgradeComponent', () => {
     upgradeInfoSpy.and.returnValue(of(upgradeInfoPayload));
     component.ngOnInit();
     fixture.detectChanges();
-    const noUpgradesSpan = fixture.debugElement.nativeElement.querySelector(
-      '#no-upgrades-available'
-    );
+    const noUpgradesSpan =
+      fixture.debugElement.nativeElement.querySelector('#no-upgrades-available');
     expect(noUpgradesSpan.textContent).toBe(' Cluster is up-to-date ');
   });
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.ts
index 93f4fbb25a1..e8082ef1fdc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/dashboard-v3/dashboard-pie/dashboard-pie.component.ts
@@ -57,7 +57,10 @@ export class DashboardPieComponent implements OnChanges, OnInit {
     }
   ];
 
-  constructor(private cssHelper: CssHelper, private dimlessBinary: DimlessBinaryPipe) {
+  constructor(
+    private cssHelper: CssHelper,
+    private dimlessBinary: DimlessBinaryPipe
+  ) {
     this.chartConfig = {
       chartType: 'doughnut',
       labels: [],
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.spec.ts
index bb64ce3af95..e8a5ada4bfc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.spec.ts
@@ -222,8 +222,8 @@ describe('NfsFormComponent', () => {
 
   describe('pathExistence', () => {
     beforeEach(() => {
-      component['nfsService']['lsDir'] = jest.fn(
-        (): Observable<Directory> => of({ paths: ['/path1'] })
+      component['nfsService']['lsDir'] = jest.fn((): Observable<Directory> =>
+        of({ paths: ['/path1'] })
       );
       component.nfsForm.get('name').setValue('CEPH');
       component.setPathValidation();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.ts
index b4cd2840fdc..5b214b873f9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/nfs/nfs-form/nfs-form.component.ts
@@ -498,8 +498,9 @@ export class NfsFormComponent extends CdForm implements OnInit {
         )
         .subscribe({
           error: (error) => {
-            const fsalDescr = this.nfsService.nfsFsal.find((f) => f.value === this.storageBackend)
-              .descr;
+            const fsalDescr = this.nfsService.nfsFsal.find(
+              (f) => f.value === this.storageBackend
+            ).descr;
             this.storageBackendError = $localize`${fsalDescr} backend is not available. ${error}`;
           }
         });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.ts
index 4200b2f2b2e..903044d9abd 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/overview/alerts-card/overview-alerts-card.component.ts
@@ -72,8 +72,8 @@ export class OverviewAlertsCardComponent implements OnInit {
       const icon = !hasAlerts
         ? AlertIcon.success
         : hasCritical
-        ? AlertIcon.error
-        : AlertIcon.warning;
+          ? AlertIcon.error
+          : AlertIcon.warning;
 
       const statusText = hasAlerts ? $localize`Need attention` : $localize`No active alerts`;
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.spec.ts
index 3ed8e7df2bb..b4900c5080b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.spec.ts
@@ -69,20 +69,13 @@ describe('ErasureCodeProfileFormModalComponent', () => {
        */
       nodes: [
         // Root node
-        Mocks.getCrushNode('default', -1, 'root', 11, [
-          -2,
-          -3,
-          -6,
-          -7,
-          -8,
-          -9,
-          -10,
-          -11,
-          -12,
-          -13,
-          -14,
-          -15
-        ]),
+        Mocks.getCrushNode(
+          'default',
+          -1,
+          'root',
+          11,
+          [-2, -3, -6, -7, -8, -9, -10, -11, -12, -13, -14, -15]
+        ),
         // SSD host
         Mocks.getCrushNode('ssd-host', -2, 'host', 1, [1, 0, 2]),
         Mocks.getCrushNode('osd.0', 0, 'osd', 0, undefined, 'ssd'),
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.ts
index 73df23f78c4..448175b4553 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.ts
@@ -30,7 +30,8 @@ import { TaskWrapperService } from '~/app/shared/services/task-wrapper.service';
 })
 export class ErasureCodeProfileFormModalComponent
   extends CrushNodeSelectionClass
-  implements OnInit {
+  implements OnInit
+{
   @ViewChild(FormGroupDirective)
   formDir: FormGroupDirective;
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.spec.ts
index af791f8c927..c6779becfb2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/pool-form/pool-form.component.spec.ts
@@ -1498,15 +1498,9 @@ describe('PoolFormComponent', () => {
           form.get(controlName).markAsPristine();
 
         beforeEach(() => {
-          [
-            'algorithm',
-            'maxBlobSize',
-            'minBlobSize',
-            'mode',
-            'pgNum',
-            'ratio',
-            'name'
-          ].forEach((name) => markControlAsPreviouslySet(name));
+          ['algorithm', 'maxBlobSize', 'minBlobSize', 'mode', 'pgNum', 'ratio', 'name'].forEach(
+            (name) => markControlAsPreviouslySet(name)
+          );
           fixture.detectChanges();
         });
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.ts
index e888af4759e..74b9b17d7ee 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/bucket-tag-modal/bucket-tag-modal.component.ts
@@ -22,7 +22,10 @@ export class BucketTagModalComponent extends BaseModal {
   currentKeyTags: string[];
   storedKey: string;
 
-  constructor(private formBuilder: CdFormBuilder, public actionLabels: ActionLabelsI18n) {
+  constructor(
+    private formBuilder: CdFormBuilder,
+    public actionLabels: ActionLabelsI18n
+  ) {
     super();
     this.createForm();
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.ts
index ccb17bed8ac..76bd9db986f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-multisite-zonegroup-deletion-form/rgw-multisite-zonegroup-deletion-form.component.ts
@@ -19,7 +19,8 @@ import { NotificationService } from '~/app/shared/services/notification.service'
 })
 export class RgwMultisiteZonegroupDeletionFormComponent
   extends CdForm
-  implements OnInit, AfterViewInit {
+  implements OnInit, AfterViewInit
+{
   zonegroupData$: any;
   poolList$: any;
   zonesPools: Array<any> = [];
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-storage-class.model.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-storage-class.model.ts
index bb9cb0143e0..de216e293db 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-storage-class.model.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/models/rgw-storage-class.model.ts
@@ -226,7 +226,7 @@ export const STORAGE_CLASS_CONSTANTS = {
 
 export const DEFAULT_PLACEMENT = 'default-placement';
 
-export type TIER_TYPE = typeof TIER_TYPE[keyof typeof TIER_TYPE];
+export type TIER_TYPE = (typeof TIER_TYPE)[keyof typeof TIER_TYPE];
 
 export const TIER_TYPE_DISPLAY = {
   LOCAL: 'Local',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.ts
index a138b9d91a6..e8c04744be9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-details/rgw-bucket-details.component.ts
@@ -28,7 +28,10 @@ export class RgwBucketDetailsComponent implements OnChanges {
   replicationData: RgwBucketReplication;
   bucketRateLimit: RgwRateLimitConfig;
 
-  constructor(private rgwBucketService: RgwBucketService, private cd: ChangeDetectorRef) {}
+  constructor(
+    private rgwBucketService: RgwBucketService,
+    private cd: ChangeDetectorRef
+  ) {}
 
   ngOnChanges() {
     this.updateBucketDetails(this.extraxtDetailsfromResponse.bind(this));
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.spec.ts
index 75a3e5d0dd6..ff9ed509c84 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-form/rgw-bucket-form.component.spec.ts
@@ -93,9 +93,8 @@ describe('RgwBucketFormComponent', () => {
       expect(component.zonegroup).toBe(payload.zonegroup);
       const placementTargets = [];
       for (const placementTarget of payload['placement_targets']) {
-        placementTarget[
-          'description'
-        ] = `${placementTarget['name']} (pool: ${placementTarget['data_pool']})`;
+        placementTarget['description'] =
+          `${placementTarget['name']} (pool: ${placementTarget['data_pool']})`;
         placementTargets.push(placementTarget);
       }
       expect(component.placementTargets).toEqual(placementTargets);
@@ -166,9 +165,8 @@ describe('RgwBucketFormComponent', () => {
       });
       fixture.detectChanges();
       fixture.whenStable().then(() => {
-        const mfaTokenSerial = fixture.debugElement.nativeElement.querySelector(
-          '#mfa-token-serial'
-        );
+        const mfaTokenSerial =
+          fixture.debugElement.nativeElement.querySelector('#mfa-token-serial');
         const mfaTokenPin = fixture.debugElement.nativeElement.querySelector('#mfa-token-pin');
         if (expectedVisibility) {
           expect(mfaTokenSerial).toBeTruthy();
@@ -349,8 +347,9 @@ describe('RgwBucketFormComponent', () => {
     beforeEach(() => {
       component.loading = LoadingStatus.Ready;
       fixture.detectChanges();
-      childComponent = fixture.debugElement.query(By.directive(RgwRateLimitComponent))
-        .componentInstance;
+      childComponent = fixture.debugElement.query(
+        By.directive(RgwRateLimitComponent)
+      ).componentInstance;
     });
     it('Scenario 1: tenanted owner with tenanted bucket name', () => {
       const rateLimitSpy = spyOn(rgwBucketService, 'updateBucketRateLimit').and.returnValue(
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.spec.ts
index 6bfe176a6a0..dff6fccae34 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-bucket-tiering-form/rgw-bucket-tiering-form.component.spec.ts
@@ -52,7 +52,7 @@ describe('RgwBucketTieringFormComponent', () => {
     fixture = TestBed.createComponent(RgwBucketTieringFormComponent);
     component = fixture.componentInstance;
     fixture.detectChanges();
-    rgwBucketService = (TestBed.inject(RgwBucketService) as unknown) as MockRgwBucketService;
+    rgwBucketService = TestBed.inject(RgwBucketService) as unknown as MockRgwBucketService;
   });
 
   it('should create', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.ts
index 20bc2a911b8..2714bf65942 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-import/rgw-multisite-import.component.ts
@@ -23,7 +23,8 @@ import { debounceTime, distinctUntilChanged, filter, map } from 'rxjs/operators'
 })
 export class RgwMultisiteImportComponent implements OnInit {
   readonly endpoints = /^((https?:\/\/)|(www.))(?:([a-zA-Z]+)|(\d+\.\d+.\d+.\d+)):\d{2,4}$/;
-  readonly ipv4Rgx = /^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/i;
+  readonly ipv4Rgx =
+    /^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/i;
   readonly ipv6Rgx = /^(?:[a-f0-9]{1,4}:){7}[a-f0-9]{1,4}$/i;
   @ViewChild(NgbTypeahead, { static: false })
   typeahead: NgbTypeahead;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.spec.ts
index a991659e347..0af104c85e4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-flow-modal/rgw-multisite-sync-flow-modal.component.spec.ts
@@ -50,7 +50,7 @@ describe('RgwMultisiteSyncFlowModalComponent', () => {
     }).compileComponents();
 
     fixture = TestBed.createComponent(RgwMultisiteSyncFlowModalComponent);
-    multisiteServiceMock = (TestBed.inject(RgwMultisiteService) as unknown) as MultisiteServiceMock;
+    multisiteServiceMock = TestBed.inject(RgwMultisiteService) as unknown as MultisiteServiceMock;
     component = fixture.componentInstance;
     component.groupType = FlowType.symmetrical;
     component.groupExpandedRow = { groupName: 'new', bucket: 'bucket1' };
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.spec.ts
index 83ec05914f6..d0b244332a8 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-sync-pipe-modal/rgw-multisite-sync-pipe-modal.component.spec.ts
@@ -52,7 +52,7 @@ describe('RgwMultisiteSyncPipeModalComponent', () => {
     }).compileComponents();
 
     fixture = TestBed.createComponent(RgwMultisiteSyncPipeModalComponent);
-    multisiteServiceMock = (TestBed.inject(RgwMultisiteService) as unknown) as MultisiteServiceMock;
+    multisiteServiceMock = TestBed.inject(RgwMultisiteService) as unknown as MultisiteServiceMock;
     component = fixture.componentInstance;
     fixture.detectChanges();
   });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.ts
index 44e1131746d..fd6ec99edd7 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-wizard/rgw-multisite-wizard.component.ts
@@ -133,9 +133,10 @@ export class RgwMultisiteWizardComponent extends BaseModal implements OnInit {
         .flat()
         .filter((cluster) => cluster['url'] !== currentUrl);
       this.isMultiClusterConfigured = this.clusterDetailsArray.length > 0;
-      this.stepTitles = (this.isMultiClusterConfigured
-        ? STEP_TITLES_MULTI_CLUSTER_CONFIGURED
-        : STEP_TITLES_SINGLE_CLUSTER
+      this.stepTitles = (
+        this.isMultiClusterConfigured
+          ? STEP_TITLES_MULTI_CLUSTER_CONFIGURED
+          : STEP_TITLES_SINGLE_CLUSTER
       ).map((label, index) => ({
         label,
         onClick: () => (this.currentStep.stepIndex = index)
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.spec.ts
index 9f16d6b40d2..aac07b9f0db 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-notification-form/rgw-notification-form.component.spec.ts
@@ -58,7 +58,7 @@ describe('RgwNotificationFormComponent', () => {
 
     fixture = TestBed.createComponent(RgwNotificationFormComponent);
     component = fixture.componentInstance;
-    rgwBucketService = (TestBed.inject(RgwBucketService) as unknown) as MockRgwBucketService;
+    rgwBucketService = TestBed.inject(RgwBucketService) as unknown as MockRgwBucketService;
     fixture.detectChanges();
   });
 
@@ -66,7 +66,7 @@ describe('RgwNotificationFormComponent', () => {
     expect(component).toBeTruthy();
   });
   it('should call setNotification when submitting form', () => {
-    rgwBucketService = (TestBed.inject(RgwBucketService) as unknown) as MockRgwBucketService;
+    rgwBucketService = TestBed.inject(RgwBucketService) as unknown as MockRgwBucketService;
     component['notificationList'] = [];
     component.notificationForm.patchValue({
       id: 'notif-1',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.spec.ts
index 3fde88d9c12..7a7bd3d549b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-overview-dashboard/rgw-overview-dashboard.component.spec.ts
@@ -119,9 +119,8 @@ describe('RgwOverviewDashboardComponent', () => {
   });
 
   it('should render all cards', () => {
-    const productiveCards = fixture.debugElement.nativeElement.querySelectorAll(
-      'cd-productive-card'
-    );
+    const productiveCards =
+      fixture.debugElement.nativeElement.querySelectorAll('cd-productive-card');
     expect(productiveCards.length).toBe(3);
   });
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.ts
index ae67b26770f..9b8c46ef2d5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-topic-form/rgw-topic-form.component.ts
@@ -309,7 +309,7 @@ export class RgwTopicFormComponent extends CdForm implements OnInit, AfterViewCh
 
     const defaults: typeof this.topicForm.value = _.clone(this.topicForm.value);
     const keys = Object.keys(this.topicForm.value) as (keyof typeof topic)[];
-    let value: Pick<typeof topic, typeof keys[number]> = _.pick(topic, keys);
+    let value: Pick<typeof topic, (typeof keys)[number]> = _.pick(topic, keys);
 
     value = _.merge(defaults, value);
     if (!this.owners.includes(value['owner'])) {
@@ -371,8 +371,8 @@ export class RgwTopicFormComponent extends CdForm implements OnInit, AfterViewCh
         urlObj.protocol === UrlProtocol.HTTPS
           ? URLPort.HTTPS
           : urlObj.protocol === UrlProtocol.HTTP
-          ? URLPort.HTTP
-          : '';
+            ? URLPort.HTTP
+            : '';
     }
     return port;
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts
index c138789b473..73031ea9518 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-accounts-form/rgw-user-accounts-form.component.spec.ts
@@ -41,9 +41,9 @@ describe('RgwUserAccountsFormComponent', () => {
     }).compileComponents();
 
     fixture = TestBed.createComponent(RgwUserAccountsFormComponent);
-    rgwUserAccountsService = (TestBed.inject(
+    rgwUserAccountsService = TestBed.inject(
       RgwUserAccountsService
-    ) as unknown) as MockRgwUserAccountsService;
+    ) as unknown as MockRgwUserAccountsService;
     component = fixture.componentInstance;
     fixture.detectChanges();
   });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.ts
index 438e4af2f5a..23a1adb5053 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-capability-modal/rgw-user-capability-modal.component.ts
@@ -30,7 +30,10 @@ export class RgwUserCapabilityModalComponent extends BaseModal {
   resource: string;
   action: string;
 
-  constructor(private formBuilder: CdFormBuilder, public actionLabels: ActionLabelsI18n) {
+  constructor(
+    private formBuilder: CdFormBuilder,
+    public actionLabels: ActionLabelsI18n
+  ) {
     super();
     this.resource = $localize`capability`;
     this.createForm();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.spec.ts
index 4267f6c03b6..d26a67e42a5 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.spec.ts
@@ -39,14 +39,14 @@ describe('RgwUserDetailsComponent', () => {
     const detailsTab = fixture.debugElement.nativeElement.querySelectorAll(
       '.cds--data-table--sort.cds--data-table--no-border tr td'
     );
-    expect(detailsTab[10].textContent).toEqual('System user');
-    expect(detailsTab[11].textContent).toEqual('Yes');
+    expect(detailsTab[10].textContent.trim()).toEqual('System user');
+    expect(detailsTab[11].textContent.trim()).toEqual('Yes');
 
     component.selection.system = false;
     component.ngOnChanges();
     fixture.detectChanges();
 
-    expect(detailsTab[11].textContent).toEqual('No');
+    expect(detailsTab[11].textContent.trim()).toEqual('No');
   });
 
   it('should show mfa ids only if length > 0', () => {
@@ -67,8 +67,8 @@ describe('RgwUserDetailsComponent', () => {
     const detailsTab = fixture.debugElement.nativeElement.querySelectorAll(
       '.cds--data-table--sort.cds--data-table--no-border tr td'
     );
-    expect(detailsTab[16].textContent).toEqual('MFAs(Id)');
-    expect(detailsTab[17].textContent).toEqual('testMFA1, testMFA2');
+    expect(detailsTab[16].textContent.trim()).toEqual('MFAs(Id)');
+    expect(detailsTab[17].textContent.trim()).toEqual('testMFA1, testMFA2');
   });
   it('should test updateKeysSelection', () => {
     component.selection = {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.ts
index 959b4cea865..4932911ca61 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-details/rgw-user-details.component.ts
@@ -44,7 +44,10 @@ export class RgwUserDetailsComponent implements OnChanges, OnInit {
 
   icons = Icons;
 
-  constructor(private rgwUserService: RgwUserService, private cdsModalService: ModalCdsService) {}
+  constructor(
+    private rgwUserService: RgwUserService,
+    private cdsModalService: ModalCdsService
+  ) {}
 
   ngOnInit() {
     this.keysColumns = [
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.spec.ts
index b93adfae175..ca0f88cbcd4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-form/rgw-user-form.component.spec.ts
@@ -213,8 +213,9 @@ describe('RgwUserFormComponent', () => {
     beforeEach(() => {
       component.loading = LoadingStatus.Ready;
       fixture.detectChanges();
-      childComponent = fixture.debugElement.query(By.directive(RgwRateLimitComponent))
-        .componentInstance;
+      childComponent = fixture.debugElement.query(
+        By.directive(RgwRateLimitComponent)
+      ).componentInstance;
     });
     it('disable creation (create)', () => {
       spyOn(rgwUserService, 'create');
@@ -334,8 +335,9 @@ describe('RgwUserFormComponent', () => {
       notificationService = TestBed.inject(NotificationService);
       spyOn(notificationService, 'show');
       fixture.detectChanges();
-      let childComponent = fixture.debugElement.query(By.directive(RgwRateLimitComponent))
-        .componentInstance;
+      let childComponent = fixture.debugElement.query(
+        By.directive(RgwRateLimitComponent)
+      ).componentInstance;
       jest.spyOn(childComponent, 'getRateLimitFormValue');
     });
 
@@ -706,8 +708,9 @@ describe('RgwUserFormComponent', () => {
     beforeEach(() => {
       component.loading = LoadingStatus.Ready;
       fixture.detectChanges();
-      childComponent = fixture.debugElement.query(By.directive(RgwRateLimitComponent))
-        .componentInstance;
+      childComponent = fixture.debugElement.query(
+        By.directive(RgwRateLimitComponent)
+      ).componentInstance;
     });
     it('create with account id & account root user', () => {
       spyOn(rgwUserService, 'create');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.ts
index 95bb177e2fe..02bc25fb454 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-s3-key-modal/rgw-user-s3-key-modal.component.ts
@@ -29,7 +29,10 @@ export class RgwUserS3KeyModalComponent extends BaseModal {
   resource: string;
   action: string;
 
-  constructor(private formBuilder: CdFormBuilder, public actionLabels: ActionLabelsI18n) {
+  constructor(
+    private formBuilder: CdFormBuilder,
+    public actionLabels: ActionLabelsI18n
+  ) {
     super();
     this.resource = $localize`S3 Key`;
     this.createForm();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.ts
index 9ea8603681e..4280df80e4b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-user-subuser-modal/rgw-user-subuser-modal.component.ts
@@ -30,7 +30,10 @@ export class RgwUserSubuserModalComponent extends BaseModal {
   resource: string;
   action: string;
 
-  constructor(private formBuilder: CdFormBuilder, private actionLabels: ActionLabelsI18n) {
+  constructor(
+    private formBuilder: CdFormBuilder,
+    private actionLabels: ActionLabelsI18n
+  ) {
     super();
     this.resource = $localize`Subuser`;
     this.createForm();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.ts
index 66ee5d61b34..63b6ad26906 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/shared/smart-list/smart-list.component.ts
@@ -41,7 +41,10 @@ export class SmartListComponent implements OnInit, OnChanges {
 
   isEmpty = _.isEmpty;
 
-  constructor(private osdService: OsdService, private hostService: HostService) {}
+  constructor(
+    private osdService: OsdService,
+    private hostService: HostService
+  ) {}
 
   isSmartError(data: any): data is SmartError {
     return _.get(data, 'error') !== undefined;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb.model.ts b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb.model.ts
index 25c09205efe..0a0e7055864 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb.model.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/ceph/smb/smb.model.ts
@@ -4,7 +4,7 @@ import { USER } from '~/app/shared/constants/app.constants';
 export interface SMBCluster {
   resource_type: typeof CLUSTER_RESOURCE;
   cluster_id: string;
-  auth_mode: typeof AUTHMODE[keyof typeof AUTHMODE];
+  auth_mode: (typeof AUTHMODE)[keyof typeof AUTHMODE];
   domain_settings?: DomainSettings;
   user_group_settings?: JoinSource[];
   custom_dns?: string[];
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
index bcc66f68433..9fe7ad723a6 100755
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/login-password-form/login-password-form.component.html
@@ -22,6 +22,8 @@
           class="btn btn-outline-light btn-password"
           cdPasswordButton="oldpassword"
           type="button"
+          aria-label="Toggle visibility"
+          i18n-aria-label
         ></button>
       </div>
       <span
@@ -53,6 +55,8 @@
           type="button"
           class="btn btn-outline-light btn-password"
           cdPasswordButton="newpassword"
+          aria-label="Toggle visibility"
+          i18n-aria-label
         ></button>
       </div>
       <div class="password-strength-level">
@@ -97,6 +101,8 @@
           class="btn btn-outline-light btn-password"
           cdPasswordButton="confirmnewpassword"
           type="button"
+          aria-label="Toggle visibility"
+          i18n-aria-label
         ></button>
       </div>
       <span
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
index 6ee9b986525..2f33440f2e9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
@@ -105,9 +105,8 @@ export class UserFormComponent extends CdForm implements OnInit {
               this.userService,
               () => this.userForm.getValue('username'),
               (_valid: boolean, credits: number, valuation: string) => {
-                this.passwordStrengthLevelClass = this.passwordPolicyService.mapCreditsToCssClass(
-                  credits
-                );
+                this.passwordStrengthLevelClass =
+                  this.passwordPolicyService.mapCreditsToCssClass(credits);
                 this.passwordValuation = _.defaultTo(valuation, '');
               }
             )
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.ts
index 9b07dbaada2..22b4cc41e90 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-password-form/user-password-form.component.ts
@@ -88,9 +88,8 @@ export class UserPasswordFormComponent {
                  * These values are not needed in this component after carbonization.
                  * @TODO: Need to remove once the LoginPasswordFormComponent is carbonized.
                  */
-                this.passwordStrengthLevelClass = this.passwordPolicyService.mapCreditsToCssClass(
-                  credits
-                );
+                this.passwordStrengthLevelClass =
+                  this.passwordPolicyService.mapCreditsToCssClass(credits);
                 this.passwordValuation = _.defaultTo(valuation, '');
 
                 this.INVALID_TEXTS['passwordPolicy'] = _.defaultTo(valuation, '');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.ts
index d7983d6247f..496c4b1e15d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/layouts/workbench-layout/workbench-layout.component.ts
@@ -91,8 +91,7 @@ export class WorkbenchLayoutComponent implements OnInit, OnDestroy {
       route = route.firstChild;
     }
     const pageHeader = route?.routeConfig?.data?.['pageHeader'] as
-      | { title?: string; description?: string }
-      | undefined;
+      { title?: string; description?: string } | undefined;
     this.pageHeaderTitle = pageHeader?.title ?? null;
     this.pageHeaderDescription = pageHeader?.description ?? null;
   }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.ts
index 11c6c938c5e..6a85bb4564e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/dashboard-help/dashboard-help.component.ts
@@ -17,7 +17,10 @@ export class DashboardHelpComponent implements OnInit {
   docsUrl: string;
   icons = Icons;
 
-  constructor(private docService: DocService, private modalCdsService: ModalCdsService) {}
+  constructor(
+    private docService: DocService,
+    private modalCdsService: ModalCdsService
+  ) {}
 
   ngOnInit() {
     this.docService.subscribeOnce('dashboard', (url: string) => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.ts
index 8f3f452ad5f..3eff23b1898 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/navigation/identity/identity.component.ts
@@ -15,7 +15,10 @@ export class IdentityComponent implements OnInit {
   username: string;
   icons = Icons;
 
-  constructor(private authStorageService: AuthStorageService, private authService: AuthService) {}
+  constructor(
+    private authStorageService: AuthStorageService,
+    private authService: AuthService
+  ) {}
 
   ngOnInit() {
     this.username = this.authStorageService.getUsername();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/host.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/host.service.ts
index b9233e0a461..57a10ba7296 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/host.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/host.service.ts
@@ -25,7 +25,10 @@ export class HostService extends ApiClient {
 
   predefinedLabels = ['mon', 'mgr', 'osd', 'mds', 'rgw', 'nfs', 'iscsi', 'rbd', 'grafana'];
 
-  constructor(private http: HttpClient, private deviceService: DeviceService) {
+  constructor(
+    private http: HttpClient,
+    private deviceService: DeviceService
+  ) {
     super();
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/osd.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/osd.service.ts
index 85a75073dea..d21bf139521 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/osd.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/osd.service.ts
@@ -72,7 +72,10 @@ export class OsdService {
     ]
   };
 
-  constructor(private http: HttpClient, private deviceService: DeviceService) {}
+  constructor(
+    private http: HttpClient,
+    private deviceService: DeviceService
+  ) {}
 
   create(driveGroups: Object[], trackingId: string, method = 'drive_groups') {
     const request = {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/pool.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/pool.service.ts
index 44616cdb3e6..29b6898c0db 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/pool.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/pool.service.ts
@@ -29,7 +29,10 @@ export class PoolService {
     }
   };
 
-  constructor(private http: HttpClient, private rbdConfigurationService: RbdConfigurationService) {}
+  constructor(
+    private http: HttpClient,
+    private rbdConfigurationService: RbdConfigurationService
+  ) {}
 
   create(pool: any) {
     return this.http.post(this.apiPath, pool, { observe: 'response' });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd-mirroring.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd-mirroring.service.ts
index 9dc574e4875..53ae0656e9b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd-mirroring.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd-mirroring.service.ts
@@ -19,7 +19,10 @@ export class RbdMirroringService {
   // Observable streams
   summaryData$ = this.summaryDataSource.asObservable();
 
-  constructor(private http: HttpClient, private timerService: TimerService) {}
+  constructor(
+    private http: HttpClient,
+    private timerService: TimerService
+  ) {}
 
   startPolling(): Subscription {
     return this.timerService
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd.service.ts
index 0ffa8fcff1c..848e7d2048c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rbd.service.ts
@@ -15,7 +15,10 @@ import { RbdPool } from './rbd.model';
   providedIn: 'root'
 })
 export class RbdService extends ApiClient {
-  constructor(private http: HttpClient, private rbdConfigurationService: RbdConfigurationService) {
+  constructor(
+    private http: HttpClient,
+    private rbdConfigurationService: RbdConfigurationService
+  ) {
     super();
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-bucket.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-bucket.service.ts
index cb7f7023d39..e702717a4b9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-bucket.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-bucket.service.ts
@@ -27,7 +27,10 @@ export class RgwBucketService extends ApiClient {
   totalUsedCapacity$ = this.totalUsedCapacitySubject.asObservable();
   averageObjectSize$ = this.averageObjectSizeSubject.asObservable();
 
-  constructor(private http: HttpClient, private rgwDaemonService: RgwDaemonService) {
+  constructor(
+    private http: HttpClient,
+    private rgwDaemonService: RgwDaemonService
+  ) {
     super();
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-realm.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-realm.service.ts
index b2e0f1afe2a..aa1bb812c9a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-realm.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-realm.service.ts
@@ -11,7 +11,10 @@ import { RgwDaemonService } from './rgw-daemon.service';
 export class RgwRealmService {
   private url = 'api/rgw/realm';
 
-  constructor(private http: HttpClient, public rgwDaemonService: RgwDaemonService) {}
+  constructor(
+    private http: HttpClient,
+    public rgwDaemonService: RgwDaemonService
+  ) {}
 
   create(realm: RgwRealm, defaultRealm: boolean) {
     let requestBody = {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-site.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-site.service.ts
index 49589c83f4e..18b71dfecd9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-site.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-site.service.ts
@@ -15,7 +15,10 @@ import { cdEncode } from '~/app/shared/decorators/cd-encode';
 export class RgwSiteService {
   private url = 'api/rgw/site';
 
-  constructor(private http: HttpClient, private rgwDaemonService: RgwDaemonService) {}
+  constructor(
+    private http: HttpClient,
+    private rgwDaemonService: RgwDaemonService
+  ) {}
 
   get(query?: string) {
     return this.rgwDaemonService.request((params: HttpParams) => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-topic.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-topic.service.ts
index 6dcc48882f4..23a62a5844a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-topic.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-topic.service.ts
@@ -13,7 +13,10 @@ import { RgwDaemonService } from './rgw-daemon.service';
 export class RgwTopicService extends ApiClient {
   baseURL = 'api/rgw/topic';
 
-  constructor(private http: HttpClient, private rgwDaemonService: RgwDaemonService) {
+  constructor(
+    private http: HttpClient,
+    private rgwDaemonService: RgwDaemonService
+  ) {
     super();
   }
 
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts
index 4c53a46c054..209be1aa9d1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user-accounts.service.ts
@@ -10,7 +10,10 @@ import { Account } from '~/app/ceph/rgw/models/rgw-user-accounts';
 export class RgwUserAccountsService {
   private url = 'api/rgw/accounts';
 
-  constructor(private http: HttpClient, private rgwDaemonService: RgwDaemonService) {}
+  constructor(
+    private http: HttpClient,
+    private rgwDaemonService: RgwDaemonService
+  ) {}
 
   list(detailed?: boolean): Observable<any> {
     return this.rgwDaemonService.request((params: HttpParams) => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user.service.ts
index 118467619de..aaa0b70e4b1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/rgw-user.service.ts
@@ -16,7 +16,10 @@ import { cdEncode } from '~/app/shared/decorators/cd-encode';
 export class RgwUserService {
   private url = 'api/rgw/user';
 
-  constructor(private http: HttpClient, private rgwDaemonService: RgwDaemonService) {}
+  constructor(
+    private http: HttpClient,
+    private rgwDaemonService: RgwDaemonService
+  ) {}
 
   /**
    * Get the list of users.
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/smb.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/smb.service.ts
index 2b984f4a5c4..854c5e6fc70 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/api/smb.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/api/smb.service.ts
@@ -28,7 +28,10 @@ export class SmbService {
   modalData$ = this.modalDataSubject.asObservable();
   dataUploader = signal<SMBResource | null>(null);
 
-  constructor(private http: HttpClient, private notificationService: NotificationService) {}
+  constructor(
+    private http: HttpClient,
+    private notificationService: NotificationService
+  ) {}
 
   passData(data: DomainSettings) {
     this.modalDataSubject.next(data);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.spec.ts
index 200a2761567..b57df61273c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/config-option/config-option.component.spec.ts
@@ -51,8 +51,7 @@ describe('ConfigOptionComponent', () => {
         name: 'osd_debug_deep_scrub_sleep',
         type: 'float',
         level: 'dev',
-        desc:
-          'Inject an expensive sleep during deep scrub IO to make it easier to induce preemption',
+        desc: 'Inject an expensive sleep during deep scrub IO to make it easier to induce preemption',
         long_desc: '',
         default: 0,
         daemon_default: '',
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.spec.ts
index a3c5c97d5ab..0ed00099349 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.spec.ts
@@ -18,7 +18,11 @@ export class MockModule {}
 
 @Component({
   template: `
-    <button type="button" class="btn btn-danger" (click)="openCtrlDriven()">
+    <button
+      type="button"
+      class="btn btn-danger"
+      (click)="openCtrlDriven()"
+    >
       <i class="fa fa-times"></i>Deletion Ctrl-Test
       <ng-template #ctrlDescription>
         The spinner is handled by the controller if you have use the modal as ViewChild in order to
@@ -26,7 +30,11 @@ export class MockModule {}
       </ng-template>
     </button>
 
-    <button type="button" class="btn btn-danger" (click)="openModalDriven()">
+    <button
+      type="button"
+      class="btn btn-danger"
+      (click)="openModalDriven()"
+    >
       <i class="fa fa-times"></i>Deletion Modal-Test
       <ng-template #modalDescription>
         The spinner is handled by the modal if your given deletion function returns a Observable.
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.ts
index 9e89bce06f7..658de582ff2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/delete-confirmation-modal/delete-confirmation-modal.component.ts
@@ -104,9 +104,9 @@ export class DeleteConfirmationModalComponent extends BaseModal implements OnIni
   }
 
   get forceDeleteAckSatisfied(): boolean {
-    if (
-      !(this.impact === this.impactEnum.high && this.bodyContext?.forceDeleteAcknowledgementMessage)
-    ) {
+    if (!(
+      this.impact === this.impactEnum.high && this.bodyContext?.forceDeleteAcknowledgementMessage
+    )) {
       return true;
     }
     const c = this.deletionForm?.get('forceDeleteAck');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.ts
index 8365c5b87f5..231f16cce41 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/grafana/grafana.component.ts
@@ -43,7 +43,10 @@ export class GrafanaComponent implements OnInit, OnChanges {
   @Input()
   scrollable: string = 'yes';
 
-  constructor(private sanitizer: DomSanitizer, private settingsService: SettingsService) {
+  constructor(
+    private sanitizer: DomSanitizer,
+    private settingsService: SettingsService
+  ) {
     this.grafanaTimes = [
       {
         name: $localize`Last 5 minutes`,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/supported-languages.enum.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/supported-languages.enum.ts
index 8b573cf6456..6415dcbb42a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/supported-languages.enum.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/language-selector/supported-languages.enum.ts
@@ -1,17 +1,17 @@
 // When adding a new supported language make sure to add a test for it in:
 // language-selector.component.spec.ts
 export enum SupportedLanguages {
-  'cs' = 'Čeština',
-  'de' = 'Deutsch',
+  cs = 'Čeština',
+  de = 'Deutsch',
   'en-US' = 'English',
-  'es' = 'Español',
-  'fr' = 'Français',
-  'id' = 'Bahasa Indonesia',
-  'it' = 'Italiano',
-  'ja' = '日本語',
-  'ko' = '한국어',
-  'pl' = 'Polski',
-  'pt' = 'Português (brasileiro)',
+  es = 'Español',
+  fr = 'Français',
+  id = 'Bahasa Indonesia',
+  it = 'Italiano',
+  ja = '日本語',
+  ko = '한국어',
+  pl = 'Polski',
+  pt = 'Português (brasileiro)',
   'zh-Hans' = '中文 (简体)',
   'zh-Hant' = '中文 (繁體）'
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss
index 1a672579f5e..47b0975f97f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/productive-card/productive-card.component.scss
@@ -35,9 +35,11 @@
       // cyan left edge
       radial-gradient(120% 60% at -15% 100%, rgba(colors.$cyan-60, 0.13) 0%, transparent 65%),
       /* cyan right edge*/
-        radial-gradient(120% 60% at 115% 100%, rgba(colors.$cyan-60, 0.1) 0%, transparent 65%),
+      radial-gradient(120% 60% at 115% 100%, rgba(colors.$cyan-60, 0.1) 0%, transparent 65%),
       /* pink center*/
-        radial-gradient(120% 60% at 50% 100%, rgba(colors.$magenta-60, 0.11) 0%, transparent 70%);
-    box-shadow: var(--cds-ai-drop-shadow), inset 0 0 0 1px var(--cds-ai-inner-shadow);
+      radial-gradient(120% 60% at 50% 100%, rgba(colors.$magenta-60, 0.11) 0%, transparent 70%);
+    box-shadow:
+      var(--cds-ai-drop-shadow),
+      inset 0 0 0 1px var(--cds-ai-inner-shadow);
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.spec.ts
index 0d45b339a20..92fa364c7d6 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/components/vertical-navigation/vertical-navigation.component.spec.ts
@@ -27,7 +27,7 @@ describe('VerticalNavigationComponent', () => {
     component.title = 'testTitle';
     fixture.detectChanges();
     const title = fixture.debugElement.query(By.css('h3'));
-    expect(title.nativeElement.textContent).toEqual('testTitle');
+    expect(title.nativeElement.textContent.trim()).toEqual('testTitle');
   });
 
   it('should select the first item as active if no item is selected', () => {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.spec.ts
index fbd2c63fc48..3a87d1b58fe 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/checked-table-form/checked-table-form.component.spec.ts
@@ -93,9 +93,9 @@ describe('CheckedTableFormComponent', () => {
       owner: ['read', 'execute'],
       group: ['write']
     });
-    component.onClickHeaderCheckbox('scope', ({
+    component.onClickHeaderCheckbox('scope', {
       target: { checked: false }
-    } as unknown) as Event);
+    } as unknown as Event);
     const scopes_permissions = form.getValue('scopes_permissions');
     expect(scopes_permissions).toEqual({});
   });
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/auth-storage.directive.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/auth-storage.directive.spec.ts
index b21afc2160a..9f46218ba0f 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/auth-storage.directive.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/auth-storage.directive.spec.ts
@@ -6,7 +6,10 @@ import { AuthStorageService } from '~/app/shared/services/auth-storage.service';
 import { configureTestBed } from '~/testing/unit-test-helper';
 import { AuthStorageDirective } from './auth-storage.directive';
 @Component({
-  template: `<div id="permitted" *cdScope="condition; matchAll: matchAll"></div>`,
+  template: `<div
+    id="permitted"
+    *cdScope="condition; matchAll: matchAll"
+  ></div>`,
   standalone: false
 })
 export class AuthStorageDirectiveTestComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/autofocus.directive.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/autofocus.directive.spec.ts
index 4959deabfdb..c2268c514b1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/autofocus.directive.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/autofocus.directive.spec.ts
@@ -8,8 +8,15 @@ import { AutofocusDirective } from './autofocus.directive';
 @Component({
   template: `
     <form>
-      <input id="x" type="text" />
-      <input id="y" type="password" autofocus />
+      <input
+        id="x"
+        type="text"
+      />
+      <input
+        id="y"
+        type="password"
+        autofocus
+      />
     </form>
   `,
   standalone: false
@@ -19,8 +26,15 @@ export class PasswordFormComponent {}
 @Component({
   template: `
     <form>
-      <input id="x" type="checkbox" [autofocus]="edit" />
-      <input id="y" type="text" />
+      <input
+        id="x"
+        type="checkbox"
+        [autofocus]="edit"
+      />
+      <input
+        id="y"
+        type="text"
+      />
     </form>
   `,
   standalone: false
@@ -32,7 +46,11 @@ export class CheckboxFormComponent {
 @Component({
   template: `
     <form>
-      <input id="x" type="text" [autofocus]="foo" />
+      <input
+        id="x"
+        type="text"
+        [autofocus]="foo"
+      />
     </form>
   `,
   standalone: false
@@ -59,9 +77,8 @@ describe('AutofocusDirective', () => {
   });
 
   it('should focus the password form field', () => {
-    const fixture: ComponentFixture<PasswordFormComponent> = TestBed.createComponent(
-      PasswordFormComponent
-    );
+    const fixture: ComponentFixture<PasswordFormComponent> =
+      TestBed.createComponent(PasswordFormComponent);
     fixture.detectChanges();
     const focused = fixture.debugElement.query(By.css(':focus'));
     expect(focused.attributes.id).toBe('y');
@@ -71,9 +88,8 @@ describe('AutofocusDirective', () => {
   });
 
   it('should focus the checkbox form field', () => {
-    const fixture: ComponentFixture<CheckboxFormComponent> = TestBed.createComponent(
-      CheckboxFormComponent
-    );
+    const fixture: ComponentFixture<CheckboxFormComponent> =
+      TestBed.createComponent(CheckboxFormComponent);
     fixture.detectChanges();
     const focused = fixture.debugElement.query(By.css(':focus'));
     expect(focused.attributes.id).toBe('x');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/dynamic-input-combobox.directive.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/dynamic-input-combobox.directive.spec.ts
index 61417a60115..89070e30e3a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/dynamic-input-combobox.directive.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/dynamic-input-combobox.directive.spec.ts
@@ -5,7 +5,10 @@ import { Component, EventEmitter } from '@angular/core';
 import { ComboBoxItem } from '../models/combo-box.model';
 
 @Component({
-  template: `<div cdDynamicInputCombobox [items]="[]"></div>`,
+  template: `<div
+    cdDynamicInputCombobox
+    [items]="[]"
+  ></div>`,
   standalone: false
 })
 class MockComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/form-loading.directive.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/form-loading.directive.ts
index 8d3f050244b..a3914835261 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/form-loading.directive.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/form-loading.directive.ts
@@ -9,7 +9,10 @@ import { LoadingStatus } from '../forms/cd-form';
   standalone: false
 })
 export class FormLoadingDirective {
-  constructor(private templateRef: TemplateRef<any>, private viewContainer: ViewContainerRef) {}
+  constructor(
+    private templateRef: TemplateRef<any>,
+    private viewContainer: ViewContainerRef
+  ) {}
 
   @Input() set cdFormLoading(condition: LoadingStatus) {
     let content: any;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/iops.directive.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/iops.directive.ts
index db1e38df7cb..013e18c12ee 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/iops.directive.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/iops.directive.ts
@@ -11,7 +11,10 @@ export class IopsDirective implements OnInit {
   @Input()
   ngDataReady: EventEmitter<any>;
 
-  constructor(private formatter: FormatterService, private ngControl: NgControl) {}
+  constructor(
+    private formatter: FormatterService,
+    private ngControl: NgControl
+  ) {}
 
   setValue(value: string): void {
     const iops = this.formatter.toIops(value);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/milliseconds.directive.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/milliseconds.directive.ts
index 24c4525ee2e..9cfae511921 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/milliseconds.directive.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/milliseconds.directive.ts
@@ -11,7 +11,10 @@ export class MillisecondsDirective implements OnInit {
   @Input()
   ngDataReady: EventEmitter<any>;
 
-  constructor(private control: NgControl, private formatter: FormatterService) {}
+  constructor(
+    private control: NgControl,
+    private formatter: FormatterService
+  ) {}
 
   setValue(value: string): void {
     const ms = this.formatter.toMilliseconds(value);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/optional-field.directive.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/optional-field.directive.ts
index 0ef0e4b1be0..ae5cb197492 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/optional-field.directive.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/optional-field.directive.ts
@@ -7,7 +7,10 @@ import { AfterViewInit, Directive, ElementRef, Input, Renderer2 } from '@angular
 export class OptionalFieldDirective implements AfterViewInit {
   @Input('cdOptionalField') label: string;
   @Input() skeleton: boolean;
-  constructor(private elementRef: ElementRef, private renderer: Renderer2) {}
+  constructor(
+    private elementRef: ElementRef,
+    private renderer: Renderer2
+  ) {}
 
   ngAfterViewInit() {
     if (!this.label || this.skeleton) return;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/password-button.directive.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/password-button.directive.ts
index 38450fc5095..1cb55d1e4ea 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/password-button.directive.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/password-button.directive.ts
@@ -10,7 +10,10 @@ export class PasswordButtonDirective implements OnInit {
   @Input()
   private cdPasswordButton: string;
 
-  constructor(private elementRef: ElementRef, private renderer: Renderer2) {}
+  constructor(
+    private elementRef: ElementRef,
+    private renderer: Renderer2
+  ) {}
 
   ngOnInit() {
     this.renderer.setAttribute(this.elementRef.nativeElement, 'tabindex', '-1');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/required-field.directive.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/required-field.directive.ts
index 501fc4fc2d9..b3f83c543e9 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/required-field.directive.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/required-field.directive.ts
@@ -7,7 +7,10 @@ import { AfterViewInit, Directive, ElementRef, Input, Renderer2 } from '@angular
 export class RequiredFieldDirective implements AfterViewInit {
   @Input('cdRequiredField') label: string;
   @Input() skeleton: boolean;
-  constructor(private elementRef: ElementRef, private renderer: Renderer2) {}
+  constructor(
+    private elementRef: ElementRef,
+    private renderer: Renderer2
+  ) {}
 
   ngAfterViewInit() {
     if (!this.label || this.skeleton) return;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/trim.directive.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/trim.directive.spec.ts
index 9a119e96315..279967fadd0 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/trim.directive.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/trim.directive.spec.ts
@@ -10,7 +10,11 @@ import { TrimDirective } from './trim.directive';
 @Component({
   template: `
     <form [formGroup]="trimForm">
-      <input type="text" formControlName="trimInput" cdTrim />
+      <input
+        type="text"
+        formControlName="trimInput"
+        cdTrim
+      />
     </form>
   `,
   standalone: false
@@ -38,8 +42,9 @@ describe('TrimDirective', () => {
   it('should trim', () => {
     const fixture: ComponentFixture<TrimComponent> = TestBed.createComponent(TrimComponent);
     const component: TrimComponent = fixture.componentInstance;
-    const inputElement: HTMLInputElement = fixture.debugElement.query(By.css('input'))
-      .nativeElement;
+    const inputElement: HTMLInputElement = fixture.debugElement.query(
+      By.css('input')
+    ).nativeElement;
     fixture.detectChanges();
 
     inputElement.value = ' a b ';
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/validate.directive.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/validate.directive.spec.ts
index 3211369afa5..66cf508bec2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/validate.directive.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/directives/validate.directive.spec.ts
@@ -13,8 +13,15 @@ import { ValidateDirective } from './validate.directive';
 // A test host component to simulate directive usage with a Reactive Form
 @Component({
   template: `
-    <form [formGroup]="form" (ngSubmit)="onSubmit()">
-      <input formControlName="testField" cdValidate #cdValidateRef="cdValidate" />
+    <form
+      [formGroup]="form"
+      (ngSubmit)="onSubmit()"
+    >
+      <input
+        formControlName="testField"
+        cdValidate
+        #cdValidateRef="cdValidate"
+      />
       <button type="submit">Submit</button>
     </form>
   `,
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts
index 288151c24fa..beb3ad0cfd1 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/cd-validators.ts
@@ -312,18 +312,22 @@ export class CdValidators {
   ) {
     conditionalValidators = conditionalValidators.concat(permanentValidators);
 
-    formControl.setValidators((control: AbstractControl): {
-      [key: string]: any;
-    } => {
-      const value = condition.call(this);
-      if (value) {
-        return Validators.compose(conditionalValidators)(control);
+    formControl.setValidators(
+      (
+        control: AbstractControl
+      ): {
+        [key: string]: any;
+      } => {
+        const value = condition.call(this);
+        if (value) {
+          return Validators.compose(conditionalValidators)(control);
+        }
+        if (permanentValidators.length > 0) {
+          return Validators.compose(permanentValidators)(control);
+        }
+        return null;
       }
-      if (permanentValidators.length > 0) {
-        return Validators.compose(permanentValidators)(control);
-      }
-      return null;
-    });
+    );
 
     watchControls.forEach((control: AbstractControl) => {
       control.valueChanges.subscribe(() => {
@@ -566,7 +570,8 @@ export class CdValidators {
       let errorName: string;
       // - Bucket names cannot be formatted as IP address.
       constraints.push(() => {
-        const ipv4Rgx = /^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/i;
+        const ipv4Rgx =
+          /^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/i;
         const ipv6Rgx = /^(?:[a-f0-9]{1,4}:){7}[a-f0-9]{1,4}$/i;
         const name = control.value;
         let notIP = true;
@@ -707,7 +712,8 @@ export class CdValidators {
 
   static oauthAddressTest(): ValidatorFn {
     // Pattern matches: IPv4 addresses or hostnames (with or without dots, like 'localhost')
-    const OAUTH2_HTTPS_ADDRESS_PATTERN = /^((\d{1,3}\.){3}\d{1,3}|([a-zA-Z0-9-_]+\.)*[a-zA-Z0-9-_]+)$/;
+    const OAUTH2_HTTPS_ADDRESS_PATTERN =
+      /^((\d{1,3}\.){3}\d{1,3}|([a-zA-Z0-9-_]+\.)*[a-zA-Z0-9-_]+)$/;
     return (control: AbstractControl): Record<string, boolean> | null => {
       if (!control.value) {
         return null;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.spec.ts
index 25825697672..452d08b6003 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-array-type/formly-array-type.component.spec.ts
@@ -8,7 +8,12 @@ import { configureTestBed } from '~/testing/unit-test-helper';
 
 @Component({
   template: ` <form [formGroup]="form">
-    <formly-form [model]="{}" [fields]="fields" [options]="{}" [form]="form"></formly-form>
+    <formly-form
+      [model]="{}"
+      [fields]="fields"
+      [options]="{}"
+      [form]="form"
+    ></formly-form>
   </form>`
 })
 class MockFormComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.spec.ts
index 0818807d08c..3f7299177ee 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-type/formly-input-type.component.spec.ts
@@ -8,7 +8,12 @@ import { configureTestBed } from '~/testing/unit-test-helper';
 
 @Component({
   template: ` <form [formGroup]="form">
-    <formly-form [model]="{}" [fields]="fields" [options]="{}" [form]="form"></formly-form>
+    <formly-form
+      [model]="{}"
+      [fields]="fields"
+      [options]="{}"
+      [form]="form"
+    ></formly-form>
   </form>`
 })
 class MockFormComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.spec.ts
index 52358d66002..c806eec8319 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-input-wrapper/formly-input-wrapper.component.spec.ts
@@ -8,7 +8,12 @@ import { configureTestBed } from '~/testing/unit-test-helper';
 
 @Component({
   template: ` <form [formGroup]="form">
-    <formly-form [model]="{}" [fields]="fields" [options]="{}" [form]="form"></formly-form>
+    <formly-form
+      [model]="{}"
+      [fields]="fields"
+      [options]="{}"
+      [form]="form"
+    ></formly-form>
   </form>`
 })
 class MockFormComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.spec.ts
index 37756ad52ff..fbe7abc7a5a 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-object-type/formly-object-type.component.spec.ts
@@ -8,7 +8,12 @@ import { configureTestBed } from '~/testing/unit-test-helper';
 
 @Component({
   template: ` <form [formGroup]="form">
-    <formly-form [model]="{}" [fields]="fields" [options]="{}" [form]="form"></formly-form>
+    <formly-form
+      [model]="{}"
+      [fields]="fields"
+      [options]="{}"
+      [form]="form"
+    ></formly-form>
   </form>`
 })
 class MockFormComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.spec.ts
index 11eaa20755c..bd721e4eed2 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/forms/crud-form/formly-textarea-type/formly-textarea-type.component.spec.ts
@@ -8,7 +8,12 @@ import { configureTestBed } from '~/testing/unit-test-helper';
 
 @Component({
   template: ` <form [formGroup]="form">
-    <formly-form [model]="{}" [fields]="fields" [options]="{}" [form]="form"></formly-form>
+    <formly-form
+      [model]="{}"
+      [fields]="fields"
+      [options]="{}"
+      [form]="form"
+    ></formly-form>
   </form>`
 })
 class MockFormComponent {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/image-spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/image-spec.ts
index c6260011a9f..b4a64c03a84 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/image-spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/image-spec.ts
@@ -9,7 +9,11 @@ export class ImageSpec {
     return new this(poolName, namespace, imageName);
   }
 
-  constructor(public poolName: string, public namespace: string, public imageName: string) {}
+  constructor(
+    public poolName: string,
+    public namespace: string,
+    public imageName: string
+  ) {}
 
   private getNameSpace() {
     return this.namespace ? `${this.namespace}/` : '';
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
index 912cd4d3cbe..3316570ebd3 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/nvmeof.ts
@@ -156,8 +156,7 @@ export enum RbdImageCreation {
 }
 
 export type NvmeofNamespaceListResponse =
-  | NvmeofSubsystemNamespace[]
-  | { namespaces: NvmeofSubsystemNamespace[] };
+  NvmeofSubsystemNamespace[] | { namespaces: NvmeofSubsystemNamespace[] };
 
 export type NvmeofInitiatorCandidate = {
   content: string;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/overview.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/overview.ts
index dfab93e2199..a35b972971c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/models/overview.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/models/overview.ts
@@ -10,11 +10,11 @@ type ResileincyHealthType = {
   severity: ResiliencyState;
 };
 
-type ResiliencyState = typeof DATA_RESILIENCY_STATE[keyof typeof DATA_RESILIENCY_STATE];
+type ResiliencyState = (typeof DATA_RESILIENCY_STATE)[keyof typeof DATA_RESILIENCY_STATE];
 
-type PG_STATES = typeof PG_STATES[number];
+type PG_STATES = (typeof PG_STATES)[number];
 
-type SCRUBBING_STATES = typeof SCRUBBING_STATES[number];
+type SCRUBBING_STATES = (typeof SCRUBBING_STATES)[number];
 
 export type TrendPoint = {
   timestamp: Date;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/pipes/ordinal.pipe.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/pipes/ordinal.pipe.ts
index 82aecc98445..5006ab5ce0b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/pipes/ordinal.pipe.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/pipes/ordinal.pipe.ts
@@ -15,12 +15,12 @@ export class OrdinalPipe implements PipeTransform {
       (Math.floor(num / 10) === 1
         ? 'th'
         : num % 10 === 1
-        ? 'st'
-        : num % 10 === 2
-        ? 'nd'
-        : num % 10 === 3
-        ? 'rd'
-        : 'th')
+          ? 'st'
+          : num % 10 === 2
+            ? 'nd'
+            : num % 10 === 3
+              ? 'rd'
+              : 'th')
     );
   }
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/api-interceptor.service.spec.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/api-interceptor.service.spec.ts
index 03dd0decdda..07bcb2bf315 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/api-interceptor.service.spec.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/api-interceptor.service.spec.ts
@@ -221,7 +221,7 @@ describe('ApiInterceptorService', () => {
     it('should use different application icon (default Ceph) in error message', fakeAsync(() => {
       const msg = 'Cannot connect to Alertmanager';
       httpError(undefined, { status: 500 }, (resp) => {
-        (resp.application = 'Prometheus'), (resp.message = msg);
+        ((resp.application = 'Prometheus'), (resp.message = msg));
       });
       expectSaveToHaveBeenCalled(true);
       flush();
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/auth-guard.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/auth-guard.service.ts
index 1f1c3adf2bb..b2d89969e7c 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/auth-guard.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/auth-guard.service.ts
@@ -7,7 +7,10 @@ import { AuthStorageService } from './auth-storage.service';
   providedIn: 'root'
 })
 export class AuthGuardService {
-  constructor(private router: Router, private authStorageService: AuthStorageService) {}
+  constructor(
+    private router: Router,
+    private authStorageService: AuthStorageService
+  ) {}
 
   canActivate(_route: ActivatedRouteSnapshot, state: RouterStateSnapshot) {
     if (this.authStorageService.isLoggedIn()) {
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/change-password-guard.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/change-password-guard.service.ts
index 662ecaa6361..4e27e104d3e 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/change-password-guard.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/change-password-guard.service.ts
@@ -11,7 +11,10 @@ import { AuthStorageService } from './auth-storage.service';
   providedIn: 'root'
 })
 export class ChangePasswordGuardService {
-  constructor(private router: Router, private authStorageService: AuthStorageService) {}
+  constructor(
+    private router: Router,
+    private authStorageService: AuthStorageService
+  ) {}
 
   canActivate(_route: ActivatedRouteSnapshot, state: RouterStateSnapshot) {
     // Redirect to '/login-change-password' when the following constraints
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/data-gateway.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/data-gateway.service.ts
index bc84f002e4d..08bf481502d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/data-gateway.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/data-gateway.service.ts
@@ -13,7 +13,10 @@ export class DataGatewayService {
   cache: { [keys: string]: Observable<any> } = {};
   selected: any;
 
-  constructor(private http: HttpClient, private crudFormAdapater: CrudFormAdapterService) {}
+  constructor(
+    private http: HttpClient,
+    private crudFormAdapater: CrudFormAdapterService
+  ) {}
 
   list(dataPath: string): Observable<any> {
     const cacheable = this.getCacheable(dataPath, 'get');
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.ts
index bb7f2a0d614..476ef420e11 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/feature-toggles.service.ts
@@ -24,7 +24,10 @@ export class FeatureTogglesService {
   readonly REFRESH_INTERVAL: number = 30000;
   private featureToggleMap$: FeatureTogglesMap$;
 
-  constructor(private http: HttpClient, private timerService: TimerService) {
+  constructor(
+    private http: HttpClient,
+    private timerService: TimerService
+  ) {
     this.featureToggleMap$ = this.timerService.get(
       () => this.http.get<FeatureTogglesMap>(this.API_URL),
       this.REFRESH_INTERVAL
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/js-error-handler.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/js-error-handler.service.ts
index de42d005e08..f6c21378a99 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/js-error-handler.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/js-error-handler.service.ts
@@ -6,7 +6,10 @@ import { LoggingService } from '../api/logging.service';
 
 @Injectable()
 export class JsErrorHandler implements ErrorHandler {
-  constructor(private injector: Injector, private router: Router) {}
+  constructor(
+    private injector: Injector,
+    private router: Router
+  ) {}
 
   handleError(error: any) {
     const loggingService = this.injector.get(LoggingService);
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/language.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/language.service.ts
index d2705ee3604..87329e14ecc 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/language.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/language.service.ts
@@ -7,7 +7,10 @@ import { environment } from '~/environments/environment';
   providedIn: 'root'
 })
 export class LanguageService {
-  constructor(private http: HttpClient, @Inject(LOCALE_ID) protected localeId: string) {}
+  constructor(
+    private http: HttpClient,
+    @Inject(LOCALE_ID) protected localeId: string
+  ) {}
 
   getLocale(): string {
     return this.localeId || environment.default_lang;
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/ngzone-scheduler.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/ngzone-scheduler.service.ts
index a2c6b6c95d5..efeeab6346d 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/ngzone-scheduler.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/ngzone-scheduler.service.ts
@@ -44,5 +44,8 @@ export class EnterNgZoneScheduler extends NgZoneScheduler {
   providedIn: 'root'
 })
 export class NgZoneSchedulerService {
-  constructor(public leave: LeaveNgZoneScheduler, public enter: EnterNgZoneScheduler) {}
+  constructor(
+    public leave: LeaveNgZoneScheduler,
+    public enter: EnterNgZoneScheduler
+  ) {}
 }
diff --git a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/summary.service.ts b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/summary.service.ts
index f8282ae9758..a724d781e7b 100644
--- a/src/pybind/mgr/dashboard/frontend/src/app/shared/services/summary.service.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/shared/services/summary.service.ts
@@ -19,7 +19,10 @@ export class SummaryService {
   // Observable streams
   summaryData$ = this.summaryDataSource.asObservable();
 
-  constructor(private http: HttpClient, private timerService: TimerService) {}
+  constructor(
+    private http: HttpClient,
+    private timerService: TimerService
+  ) {}
 
   startPolling(): Subscription {
     return this.timerService
diff --git a/src/pybind/mgr/dashboard/frontend/src/styles/_carbon-defaults.scss b/src/pybind/mgr/dashboard/frontend/src/styles/_carbon-defaults.scss
index 7d920f0c66a..398684d12a4 100644
--- a/src/pybind/mgr/dashboard/frontend/src/styles/_carbon-defaults.scss
+++ b/src/pybind/mgr/dashboard/frontend/src/styles/_carbon-defaults.scss
@@ -1,7 +1,7 @@
 @use '@carbon/styles/scss/config' with (
   $font-path: '~@ibm/plex',
   $flex-grid-columns: 16,
-  $use-flexbox-grid: true,
+  $use-flexbox-grid: true
 );
 @use '@carbon/layout';
 @use '@carbon/colors';
@@ -11,8 +11,8 @@
 @use '@carbon/styles/scss/themes';
 @use '@carbon/styles/scss/theme' with (
   $theme: default.$theme,
-  $fallback: compat.$g90,
-  );
+  $fallback: compat.$g90
+);
 
 /******************************************
   Component token overrides should go here

From b5697987ae86f51d7f16a1409ce9f2b542f3de52 Mon Sep 17 00:00:00 2001
From: David Galloway <david.galloway@ibm.com>
Date: Fri, 10 Jul 2026 16:12:01 -0400
Subject: [PATCH 595/596] script/buildcontainer-setup: fix package install on
 debian trixie

Debian removed software-properties-common from the archive in trixie,
so the flat apt-get install list fails there. The package was only
needed to provide add-apt-repository for llvm.sh, which installs
clang-19 from apt.llvm.org. Trixie ships clang-19 natively, so install
it from the distro instead; run-make.sh's prepare() then finds clang-19
and skips llvm.sh entirely. Ubuntu and older Debian releases still have
software-properties-common and keep the previous behavior.

Fixes: https://tracker.ceph.com/issues/78111
Signed-off-by: David Galloway <david.galloway@ibm.com>
---
 src/script/buildcontainer-setup.sh | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/script/buildcontainer-setup.sh b/src/script/buildcontainer-setup.sh
index e5442f4ab7b..d4de868e68a 100644
--- a/src/script/buildcontainer-setup.sh
+++ b/src/script/buildcontainer-setup.sh
@@ -43,7 +43,17 @@ case "${CEPH_BASE_BRANCH}~${DISTRO_KIND}" in
     ;;
     *~*ubuntu*|*~*debian*)
         apt-get update
-        apt-get install -y wget reprepro curl software-properties-common lksctp-tools libsctp-dev protobuf-compiler ragel libc-ares-dev
+        pkgs=(wget reprepro curl lksctp-tools libsctp-dev protobuf-compiler ragel libc-ares-dev)
+        # software-properties-common provides add-apt-repository, which
+        # llvm.sh needs to install clang from apt.llvm.org. Debian removed
+        # the package in trixie, which ships clang-19 natively instead, so
+        # install that directly and run-make.sh will skip llvm.sh.
+        if apt-cache show software-properties-common >/dev/null 2>&1; then
+            pkgs+=(software-properties-common)
+        else
+            pkgs+=(clang-19)
+        fi
+        apt-get install -y "${pkgs[@]}"
         install_container_deps
     ;;
     *)

From e83c663c47a9ab93704ec54b9529f2b3883b7ffa Mon Sep 17 00:00:00 2001
From: Patrick Donnelly <pdonnell@ibm.com>
Date: Fri, 10 Jul 2026 16:40:47 -0400
Subject: [PATCH 596/596] .github/workflows/releng-audit: keep failed state on
 other label events

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
---
 .github/workflows/releng-audit.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/releng-audit.yaml b/.github/workflows/releng-audit.yaml
index 6112b9ded6e..4cbcfaa039d 100644
--- a/.github/workflows/releng-audit.yaml
+++ b/.github/workflows/releng-audit.yaml
@@ -228,7 +228,11 @@ jobs:
                 }
               }
               
-              core.info(`[Router] Labeled event handled without triggering audit.`);
+              if (hasFailLabel && labelName !== 'releng-audit-override') {
+                core.setFailed("PR is currently in a failed audit state. Remove the releng-audit-fail label to re-run.");
+              } else {
+                core.info(`[Router] Labeled event handled without triggering audit.`);
+              }
               core.setOutput('run_audit', 'false');
               return;
             }
@@ -254,7 +258,11 @@ jobs:
               return;
             }
 
-            core.info('[Router] Event did not match any trigger criteria. Skipping audit.');
+            if (hasFailLabel && eventName === 'pull_request_target') {
+              core.setFailed("PR is currently in a failed audit state. Remove the releng-audit-fail label to re-run.");
+            } else {
+              core.info('[Router] Event did not match any trigger criteria. Skipping audit.');
+            }
             core.setOutput('run_audit', 'false');
 
       - name: Checkout Trusted Base Repository